Add 4-layer access control stack (subscription → module → menu → permissions): - P1: Wire requires_permission into menu sidebar filtering - P2: Expose window.USER_PERMISSIONS for Alpine.js client-side gating - P3: Add page-level permission guards on store routes - P4: Role CRUD API endpoints and role editor UI - P5: Audit trail for all role/permission changes Includes unit tests (menu permission filtering, role CRUD service) and integration tests (role API endpoints). All 404 core+tenancy tests pass. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
187 lines
6.0 KiB
Python
187 lines
6.0 KiB
Python
# app/modules/orders/definition.py
|
|
"""
|
|
Orders module definition.
|
|
|
|
Defines the orders module including its features, menu items,
|
|
route configurations, and self-contained module settings.
|
|
"""
|
|
|
|
from app.modules.base import (
|
|
MenuItemDefinition,
|
|
MenuSectionDefinition,
|
|
ModuleDefinition,
|
|
PermissionDefinition,
|
|
)
|
|
from app.modules.enums import FrontendType
|
|
|
|
|
|
def _get_admin_router():
|
|
"""Lazy import of admin router to avoid circular imports."""
|
|
from app.modules.orders.routes.admin import admin_router
|
|
|
|
return admin_router
|
|
|
|
|
|
def _get_store_router():
|
|
"""Lazy import of store router to avoid circular imports."""
|
|
from app.modules.orders.routes.store import store_router
|
|
|
|
return store_router
|
|
|
|
|
|
def _get_metrics_provider():
|
|
"""Lazy import of metrics provider to avoid circular imports."""
|
|
from app.modules.orders.services.order_metrics import order_metrics_provider
|
|
|
|
return order_metrics_provider
|
|
|
|
|
|
def _get_feature_provider():
|
|
"""Lazy import of feature provider to avoid circular imports."""
|
|
from app.modules.orders.services.order_features import order_feature_provider
|
|
|
|
return order_feature_provider
|
|
|
|
|
|
# Orders module definition
|
|
orders_module = ModuleDefinition(
|
|
code="orders",
|
|
name="Order Management",
|
|
description=(
|
|
"Order processing, fulfillment tracking, customer checkout, "
|
|
"invoicing, and bulk order operations. Uses the payments module for checkout."
|
|
),
|
|
version="1.0.0",
|
|
requires=["payments", "catalog", "inventory"], # Depends on payments, catalog, and inventory modules
|
|
# Module-driven permissions
|
|
permissions=[
|
|
PermissionDefinition(
|
|
id="orders.view",
|
|
label_key="orders.permissions.orders_view",
|
|
description_key="orders.permissions.orders_view_desc",
|
|
category="orders",
|
|
),
|
|
PermissionDefinition(
|
|
id="orders.edit",
|
|
label_key="orders.permissions.orders_edit",
|
|
description_key="orders.permissions.orders_edit_desc",
|
|
category="orders",
|
|
),
|
|
PermissionDefinition(
|
|
id="orders.cancel",
|
|
label_key="orders.permissions.orders_cancel",
|
|
description_key="orders.permissions.orders_cancel_desc",
|
|
category="orders",
|
|
),
|
|
PermissionDefinition(
|
|
id="orders.refund",
|
|
label_key="orders.permissions.orders_refund",
|
|
description_key="orders.permissions.orders_refund_desc",
|
|
category="orders",
|
|
),
|
|
],
|
|
features=[
|
|
"order_management", # Basic order CRUD
|
|
"order_bulk_actions", # Bulk status updates
|
|
"order_export", # Export orders to CSV/Excel
|
|
"automation_rules", # Order automation rules
|
|
"fulfillment_tracking", # Shipping and tracking
|
|
"shipping_management", # Carrier integration
|
|
"order_exceptions", # Order item exception handling
|
|
"customer_checkout", # Customer checkout flow
|
|
"invoice_generation", # Invoice creation
|
|
"invoice_pdf", # PDF invoice generation
|
|
],
|
|
menu_items={
|
|
FrontendType.ADMIN: [
|
|
"orders", # Platform-wide order management
|
|
],
|
|
FrontendType.STORE: [
|
|
"orders", # Store order management
|
|
],
|
|
},
|
|
# New module-driven menu definitions
|
|
menus={
|
|
FrontendType.ADMIN: [
|
|
MenuSectionDefinition(
|
|
id="storeOps",
|
|
label_key="orders.menu.store_operations",
|
|
icon="clipboard-list",
|
|
order=40,
|
|
items=[
|
|
MenuItemDefinition(
|
|
id="orders",
|
|
label_key="orders.menu.orders",
|
|
icon="clipboard-list",
|
|
route="/admin/orders",
|
|
order=40,
|
|
),
|
|
],
|
|
),
|
|
],
|
|
FrontendType.STORE: [
|
|
MenuSectionDefinition(
|
|
id="sales",
|
|
label_key="orders.menu.sales_orders",
|
|
icon="document-text",
|
|
order=20,
|
|
items=[
|
|
MenuItemDefinition(
|
|
id="orders",
|
|
label_key="orders.menu.orders",
|
|
icon="document-text",
|
|
route="/store/{store_code}/orders",
|
|
order=10,
|
|
is_mandatory=True,
|
|
requires_permission="orders.view",
|
|
),
|
|
],
|
|
),
|
|
],
|
|
FrontendType.STOREFRONT: [
|
|
MenuSectionDefinition(
|
|
id="account",
|
|
label_key=None,
|
|
order=10,
|
|
items=[
|
|
MenuItemDefinition(
|
|
id="orders",
|
|
label_key="storefront.account.orders",
|
|
icon="clipboard-list",
|
|
route="account/orders",
|
|
order=40,
|
|
),
|
|
],
|
|
),
|
|
],
|
|
},
|
|
is_core=False,
|
|
# =========================================================================
|
|
# Self-Contained Module Configuration
|
|
# =========================================================================
|
|
is_self_contained=True,
|
|
services_path="app.modules.orders.services",
|
|
models_path="app.modules.orders.models",
|
|
schemas_path="app.modules.orders.schemas",
|
|
exceptions_path="app.modules.orders.exceptions",
|
|
migrations_path="migrations",
|
|
# Metrics provider for dashboard statistics
|
|
metrics_provider=_get_metrics_provider,
|
|
feature_provider=_get_feature_provider,
|
|
)
|
|
|
|
|
|
def get_orders_module_with_routers() -> ModuleDefinition:
|
|
"""
|
|
Get orders module with routers attached.
|
|
|
|
This function attaches the routers lazily to avoid circular imports
|
|
during module initialization.
|
|
"""
|
|
orders_module.admin_router = _get_admin_router()
|
|
orders_module.store_router = _get_store_router()
|
|
return orders_module
|
|
|
|
|
|
__all__ = ["orders_module", "get_orders_module_with_routers"]
|