snipe-auth-rbac 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snipe-auth-rbac",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Two-layer RBAC (system + company) for React, Next.js, and any modern TS app — paired with the Python sibling.",
   "license": "MIT",
   "type": "module",

package/sql/0002_seed_defaults.sql

@@ -1,32 +1,42 @@
 -- snipe-auth-rbac — optional default seed
 --
 -- Companion to 0001_initial.sql that seeds:
---   * Two system roles (System Admin with is_super=true, System Support).
---   * Four generic company-role templates (Owner / Manager / Member /
---     Viewer) with sensible default_permissions patterns.
+--   * Two system roles (System-Administrator with is_super=true,
+--     System-Support).
+--   * Four generic company-role templates (Inhaber / Verwalter /
+--     Mitarbeiter / Leser) with sensible default_permissions
+--     patterns.
 --
--- The four templates use only the `default` action set — they don't
--- reference specific resources or groups, since those are defined by
--- the host. After registering host resources, run
--- ``rbac.apply_template_defaults(role_id)`` to materialise the matrix.
+-- Names are in German — that's the package's primary target
+-- audience (German property-management / SaaS). Adopters who
+-- prefer English names skip this file and seed their own.
 --
--- Domain-specific templates (Property Manager, Tenant Manager,
--- Sales, …) belong in the host's own seed migration where their
--- group/resource defaults can reference real registered resources.
+-- The four templates use only the `default` action set — they
+-- don't reference specific resources or groups, since those are
+-- defined by the host. After registering host resources, run
+-- ``rbac.apply_template_defaults(role_id)`` to materialise the
+-- matrix.
+--
+-- Domain-specific templates (Liegenschaftsverwalter,
+-- Mieterverwalter, Vertrieb, Gutachter, Anwalt, Mieter) belong in
+-- the host's own seed migration where their group/resource
+-- defaults can reference real registered resources.
 --
 -- Idempotent: every INSERT uses ON CONFLICT DO NOTHING. Re-running
--- the file leaves an existing deployment untouched.
+-- the file leaves an existing deployment untouched. Note: this
+-- means upgrading from v0.3.0 (English names) does NOT auto-rename
+-- — see CHANGELOG for the rename snippet.
 
 BEGIN;
 
 -- System roles
 INSERT INTO rbac.roles (id, scope, company_id, name, description, is_system, is_super, default_permissions)
 VALUES
-  (gen_random_uuid(), 'system', NULL, 'System Admin',
+  (gen_random_uuid(), 'system', NULL, 'System-Administrator',
    'Plattform-Vollzugriff. Setzt jede Berechtigungsprüfung außer Kraft.',
    true, true,
    '{"default": ["read", "write", "update", "delete"]}'::jsonb),
-  (gen_random_uuid(), 'system', NULL, 'System Support',
+  (gen_random_uuid(), 'system', NULL, 'System-Support',
    'Lesezugriff auf systemweite Ressourcen für Support-Aufgaben.',
    true, false,
    '{"default": ["read"]}'::jsonb)
@@ -36,19 +46,19 @@ ON CONFLICT DO NOTHING;
 -- Generic shapes only; domain-specific defaults are the host's job.
 INSERT INTO rbac.roles (id, scope, company_id, name, description, is_system, is_super, default_permissions)
 VALUES
-  (gen_random_uuid(), 'company', NULL, 'Owner',
-   'Vollzugriff innerhalb der eigenen Company.',
+  (gen_random_uuid(), 'company', NULL, 'Inhaber',
+   'Vollzugriff innerhalb des eigenen Mandanten.',
    true, false,
    '{"default": ["read", "write", "update", "delete"]}'::jsonb),
-  (gen_random_uuid(), 'company', NULL, 'Manager',
-   'Verwaltet Daten der Company, kann Rollen ändern. Kein Löschen.',
+  (gen_random_uuid(), 'company', NULL, 'Verwalter',
+   'Verwaltet Daten des Mandanten, kann Rollen ändern. Kein Löschen.',
    true, false,
    '{"default": ["read", "write", "update"]}'::jsonb),
-  (gen_random_uuid(), 'company', NULL, 'Member',
+  (gen_random_uuid(), 'company', NULL, 'Mitarbeiter',
    'Standard-Mitarbeiter mit Lese- und Schreibzugriff.',
    true, false,
    '{"default": ["read", "write"]}'::jsonb),
-  (gen_random_uuid(), 'company', NULL, 'Viewer',
+  (gen_random_uuid(), 'company', NULL, 'Leser',
    'Nur Lesezugriff.',
    true, false,
    '{"default": ["read"]}'::jsonb)