iatoolkit 2.69.0__tar.gz → 2.71.0__tar.gz

{iatoolkit-2.69.0/src/iatoolkit.egg-info → iatoolkit-2.71.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.69.0
+Version: 2.71.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.69.0 → iatoolkit-2.71.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.69.0"
+__version__ = "2.71.0"
 
 # Expose main classes and functions at the top level of the package
 

iatoolkit-2.71.0/src/iatoolkit/common/access.py

@@ -0,0 +1,206 @@
+# Copyright (c) 2024 Fernando Libedinsky
+# Product: IAToolkit
+#
+# IAToolkit is open source software.
+
+"""Who may do what: the one question every check asks (BL-010, Fase 1).
+
+Code never names a role. It asks whether a principal (a person's email, or a
+service account `service:<key>`) has a level over a resource:
+
+    access.can(company, user_identifier, EDIT, "company")
+    access.can(company, user_identifier, USE, "agent", "cobranza")
+
+Three levels, each including the one below:
+    1 USE    use an agent, tool, model, SQL source / see content
+    2 EDIT   change the resource (an agent's prompt, a folder's documents)
+    3 ADMIN  decide on it: who has access, delete it, its settings
+
+Over the resource type "company", EDIT is entering the admin console and
+editing every resource, and ADMIN is administering the company (its team,
+settings). Billing and deleting the tenant are for its owners only (`is_owner`).
+
+Enterprise registers the decider backed by groups and grants. Without it,
+the decision falls back to the person's role in the company, as before.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Callable, Protocol
+
+USE = 1
+EDIT = 2
+ADMIN = 3
+
+LEVEL_NAMES = {USE: "use", EDIT: "edit", ADMIN: "admin"}
+
+# The level each legacy role holds over everything (core without enterprise).
+ROLE_LEVELS = {"user": USE, "editor": EDIT, "admin": ADMIN, "owner": ADMIN}
+
+
+class AccessDecider(Protocol):
+    def can(self, company_short_name: str, user_identifier: str | None, level: int,
+            resource_type: str, resource_key: str | None = None,
+            resource_path: str | None = None) -> bool: ...
+
+    def is_owner(self, company_short_name: str, user_identifier: str | None) -> bool: ...
+
+    def effective_role(self, company_short_name: str, user_identifier: str | None) -> str | None: ...
+
+
+class RoleAccessDecider:
+    """Core's fallback: the role of iat_user_company grants its level over everything."""
+
+    def __init__(self, role_reader: Callable[[str, str], str | None]):
+        self.role_reader = role_reader
+
+    def _role(self, company_short_name, user_identifier) -> str | None:
+        if not user_identifier:
+            return None
+        return self.role_reader(company_short_name, user_identifier)
+
+    def can(self, company_short_name, user_identifier, level, resource_type, resource_key=None,
+            resource_path=None) -> bool:
+        if level <= USE and resource_type != "company":
+            # Without groups nothing is restricted: whoever enters the company uses
+            # what it offers (members, and the end users a key acts for).
+            return True
+        role = self._role(company_short_name, user_identifier)
+        if role is None:
+            return False
+        return ROLE_LEVELS.get(role, USE) >= level
+
+    def is_owner(self, company_short_name, user_identifier) -> bool:
+        return self._role(company_short_name, user_identifier) == "owner"
+
+    def effective_role(self, company_short_name, user_identifier) -> str | None:
+        return self._role(company_short_name, user_identifier)
+
+
+class Access:
+    """The registered decider; enterprise replaces core's fallback at boot."""
+
+    _decider: AccessDecider | None = None
+
+    @classmethod
+    def register(cls, decider: AccessDecider) -> None:
+        cls._decider = decider
+
+    @classmethod
+    def clear(cls) -> None:
+        cls._decider = None
+
+    @classmethod
+    def registered(cls) -> bool:
+        """Whether a decider other than core's role fallback is in place (enterprise)."""
+        return cls._decider is not None and not isinstance(cls._decider, RoleAccessDecider)
+
+    @classmethod
+    def decider(cls) -> AccessDecider:
+        if cls._decider is None:
+            cls._decider = RoleAccessDecider(_role_from_profile_service)
+        return cls._decider
+
+
+def decider_for(role_reader: Callable[[str, str], str | None]) -> AccessDecider:
+    """The registered decider, or the role fallback reading roles with `role_reader`
+    (views that already hold a ProfileRepo)."""
+    return Access.decider() if Access.registered() else RoleAccessDecider(role_reader)
+
+
+def _role_from_profile_service(company_short_name: str, user_identifier: str) -> str | None:
+    from iatoolkit import current_iatoolkit
+    from iatoolkit.services.profile_service import ProfileService
+
+    return current_iatoolkit().get_injector().get(ProfileService).get_role_in_company(
+        company_short_name, user_identifier)
+
+
+def can(company_short_name: str, user_identifier: str | None, level: int, resource_type: str,
+        resource_key: str | None = None, resource_path: str | None = None) -> bool:
+    try:
+        return bool(Access.decider().can(company_short_name, user_identifier, level, resource_type,
+                                         resource_key, resource_path))
+    except Exception as exc:
+        # Deciding failed: deny, never fall open.
+        logging.warning("Access check failed (%s, %s, %s %s): %s", company_short_name, user_identifier,
+                        level, resource_type, exc)
+        return False
+
+
+def is_owner(company_short_name: str, user_identifier: str | None) -> bool:
+    try:
+        return bool(Access.decider().is_owner(company_short_name, user_identifier))
+    except Exception as exc:
+        logging.warning("Owner check failed (%s, %s): %s", company_short_name, user_identifier, exc)
+        return False
+
+
+def effective_roles(company_short_name: str, user_identifiers: list[str]) -> dict[str, str | None]:
+    """`effective_role` for many people at once (the Users screen)."""
+    decider = Access.decider()
+    try:
+        bulk = getattr(decider, "effective_roles", None)
+        if callable(bulk):
+            return bulk(company_short_name, user_identifiers)
+        return {u: decider.effective_role(company_short_name, u) for u in user_identifiers}
+    except Exception as exc:
+        logging.warning("Effective roles failed (%s): %s", company_short_name, exc)
+        return {}
+
+
+def effective_role(company_short_name: str, user_identifier: str | None) -> str | None:
+    """What the person can do over the company, as the console's old role names.
+
+    Only for screens that still show or branch on a role name (labels, menus);
+    access is always decided with `can`.
+    """
+    try:
+        return Access.decider().effective_role(company_short_name, user_identifier)
+    except Exception as exc:
+        logging.warning("Effective role failed (%s, %s): %s", company_short_name, user_identifier, exc)
+        return None
+
+
+def role_assigned(company_short_name: str, user_identifier: str, role: str) -> None:
+    """Somebody was given a legacy role (signup's bootstrap admin, company activation,
+    `init-install --owner`): the registered decider puts them in the matching group."""
+    decider = Access._decider
+    hook = getattr(decider, "role_assigned", None) if decider is not None else None
+    if callable(hook):
+        try:
+            hook(company_short_name, user_identifier, role)
+        except Exception as exc:
+            logging.warning("Role %s of %s in %s not moved to its group: %s", role, user_identifier,
+                            company_short_name, exc)
+
+
+def person_can(company_short_name: str, auth_result: dict | None, level: int, resource_type: str = "company",
+               resource_key: str | None = None) -> bool:
+    """A signed-in person's access, from an AuthService result.
+
+    Only sessions carry `user_role`; an API key is not a person and gets False
+    (each view decides on its own whether a key may pass).
+    """
+    if not isinstance(auth_result, dict) or "user_role" not in auth_result:
+        return False
+    if not Access.registered():
+        # Core alone: the session's role was just read from iat_user_company.
+        return _session_role_decider(auth_result).can(company_short_name, auth_result.get("user_identifier") or "session",
+                                                       level, resource_type, resource_key)
+    return can(company_short_name, auth_result.get("user_identifier"), level, resource_type, resource_key)
+
+
+def person_is_owner(company_short_name: str, auth_result: dict | None) -> bool:
+    if not isinstance(auth_result, dict) or "user_role" not in auth_result:
+        return False
+    if not Access.registered():
+        return _session_role_decider(auth_result).is_owner(company_short_name,
+                                                            auth_result.get("user_identifier") or "session")
+    return is_owner(company_short_name, auth_result.get("user_identifier"))
+
+
+def _session_role_decider(auth_result: dict) -> RoleAccessDecider:
+    role = str(auth_result.get("user_role") or "").strip().lower() or None
+    return RoleAccessDecider(lambda company_short_name, user_identifier: role)

{iatoolkit-2.69.0 → iatoolkit-2.71.0}/src/iatoolkit/core.py

@@ -195,6 +195,13 @@ class IAToolkit:
         thread.start()
         return thread
 
+    @staticmethod
+    def _effective_role(company_short_name: str | None, user_identifier: str | None) -> str | None:
+        if not company_short_name or not user_identifier:
+            return None
+        from iatoolkit.common import access
+        return access.effective_role(company_short_name, user_identifier)
+
     def _get_config_value(self, key: str, default=None):
         # get a value from the config dict or the environment variable
         return self.config.get(key, os.getenv(key, default))
@@ -653,7 +660,10 @@ class IAToolkit:
                 'app_name': 'IAToolkit',
                 'user_identifier': session_info.get('user_identifier'),
                 'company_short_name': route_company_short_name or session_info.get('company_short_name'),
-                'user_role': user_profile.get('user_role'),
+                # What the person can do over the company (BL-010, Fase 1), never the
+                # role an SSO hook may have written into the session profile.
+                'user_role': self._effective_role(route_company_short_name or session_info.get('company_short_name'),
+                                                  session_info.get('user_identifier')),
                 'user_is_local': user_profile.get('user_is_local'),
                 'user_email': user_profile.get('user_email'),
                 'iatoolkit_base_url': request.url_root,

{iatoolkit-2.69.0 → iatoolkit-2.71.0}/src/iatoolkit/locales/en.yaml

@@ -645,6 +645,48 @@ ui:
   admin:
     workspace: "Workspace"
     team_invitations: "Invitations"
+    team_groups: "Groups"
+    team_groups_edit: "Groups"
+    team_groups_modal_title: "Person's groups"
+    team_groups_save: "Save"
+    team_groups_close: "Close"
+    team_groups_saved: "Groups updated."
+    team_groups_everyone_hint: "Every member is in Everyone: no need to tick it."
+    team_group_new: "New group"
+    team_group_name: "Name"
+    team_group_description: "Description"
+    team_group_members: "Members"
+    team_group_add_member: "Add"
+    team_group_remove: "Remove"
+    team_group_delete: "Delete group"
+    team_group_builtin: "Built-in"
+    team_group_save: "Save"
+    team_group_edit: "Edit"
+    team_group_everyone_note: "Includes everyone in the company."
+    team_group_owners_note: "Only an owner can change the owners. Owners is never empty."
+    team_group_grants: "Can"
+    team_group_no_grants: "No permissions over the company."
+    team_group_owners_all: "everything, billing included"
+    team_group_delete_confirm: "Delete this group? Its permissions are lost."
+    team_group_none_members: "No members."
+    team_group_member_placeholder: "person's email"
+    team_group_created: "Group created."
+    team_group_deleted: "Group deleted."
+    team_group_updated: "Group updated."
+    access_level_1: "use / see"
+    access_level_2: "edit"
+    access_level_3: "administer"
+    access_all_resources: "every resource"
+    access_company: "the company"
+    access_title: "Access"
+    access_default: "Company access (default)"
+    access_default_hint: "Used by whoever has access to every agent. Add groups to restrict it."
+    access_own_hint: "Only these groups (and those who administer the company) have access."
+    access_add_group: "Add group"
+    access_reset: "Back to company access"
+    access_saved: "Access updated."
+    access_group: "Group"
+    access_level: "Level"
     team_invite_user: "Invite user"
     team_invite_none: "No invitations yet."
     team_invite_loading: "Loading invitations..."
@@ -2087,6 +2129,11 @@ ui:
     routing_profile_hint: "Used by enterprise tool routing to rank and select candidate tools."
 
   api_key:
+    can_act_for_users: "May act on behalf of users"
+    can_act_for_users_help: "Without this, the key acts as itself (service:<name>) and cannot pass for anyone. Turn it on only for integrations that must name the user they act for (a portal with its own login, an MCP gateway)."
+    acts: "Acts"
+    acts_as_itself: "As itself"
+    acts_for_users: "On behalf of users"
     title: "API Keys"
     subtitle: "Manage company API keys used to authenticate external requests."
     new_btn: "New API Key"
@@ -2597,6 +2644,8 @@ ui:
 
 errors:
   company_not_found: "The company {company_short_name} does not exist."
+  access:
+    agent_denied: "You do not have access to the agent {prompt_name}."
   timeout: "timeout expired."
   auth:
     invalid_password: "The provided password is incorrect."

{iatoolkit-2.69.0 → iatoolkit-2.71.0}/src/iatoolkit/locales/es.yaml

@@ -659,6 +659,48 @@ ui:
   admin:
     workspace: "Recursos"
     team_invitations: "Invitaciones"
+    team_groups: "Grupos"
+    team_groups_edit: "Grupos"
+    team_groups_modal_title: "Grupos de la persona"
+    team_groups_save: "Guardar"
+    team_groups_close: "Cerrar"
+    team_groups_saved: "Grupos actualizados."
+    team_groups_everyone_hint: "Todos los miembros están en Todos: no hace falta marcarlo."
+    team_group_new: "Nuevo grupo"
+    team_group_name: "Nombre"
+    team_group_description: "Descripción"
+    team_group_members: "Miembros"
+    team_group_add_member: "Agregar"
+    team_group_remove: "Quitar"
+    team_group_delete: "Eliminar grupo"
+    team_group_builtin: "De fábrica"
+    team_group_save: "Guardar"
+    team_group_edit: "Editar"
+    team_group_everyone_note: "Incluye a todas las personas de la empresa."
+    team_group_owners_note: "Solo un dueño puede cambiar los dueños. Dueños nunca queda vacío."
+    team_group_grants: "Puede"
+    team_group_no_grants: "Sin permisos sobre la empresa."
+    team_group_owners_all: "todo, incluida la facturación"
+    team_group_delete_confirm: "¿Eliminar este grupo? Sus permisos se pierden."
+    team_group_none_members: "Sin miembros."
+    team_group_member_placeholder: "email de la persona"
+    team_group_created: "Grupo creado."
+    team_group_deleted: "Grupo eliminado."
+    team_group_updated: "Grupo actualizado."
+    access_level_1: "usar / ver"
+    access_level_2: "editar"
+    access_level_3: "administrar"
+    access_all_resources: "todos los recursos"
+    access_company: "la empresa"
+    access_title: "Acceso"
+    access_default: "Acceso de la empresa (por defecto)"
+    access_default_hint: "Lo usan quienes tienen acceso a todos los agentes. Agrega grupos para restringirlo."
+    access_own_hint: "Solo estos grupos (y quienes administran la empresa) tienen acceso."
+    access_add_group: "Agregar grupo"
+    access_reset: "Volver al acceso de la empresa"
+    access_saved: "Acceso actualizado."
+    access_group: "Grupo"
+    access_level: "Nivel"
     team_invite_user: "Invitar usuario"
     team_invite_none: "Todavía no hay invitaciones."
     team_invite_loading: "Cargando invitaciones..."
@@ -2105,6 +2147,11 @@ ui:
     routing_profile_hint: "Usado por el router enterprise para rankear y seleccionar herramientas candidatas."
 
   api_key:
+    can_act_for_users: "Puede actuar en nombre de usuarios"
+    can_act_for_users_help: "Sin esta opción, la llave actúa como sí misma (service:<nombre>) y no puede hacerse pasar por nadie. Actívala solo para integraciones que deben indicar el usuario por el que actúan (un portal con login propio, un gateway MCP)."
+    acts: "Actúa"
+    acts_as_itself: "Como sí misma"
+    acts_for_users: "En nombre de usuarios"
     title: "API Keys"
     subtitle: "Administra las API keys de la empresa para autenticar solicitudes externas."
     new_btn: "Nueva API Key"
@@ -2612,6 +2659,8 @@ ui:
 
 errors:
   company_not_found: "La empresa {company_short_name} no existe."
+  access:
+    agent_denied: "No tienes acceso al agente {prompt_name}."
   timeout: "El tiempo de espera ha expirado."
 
 

{iatoolkit-2.69.0 → iatoolkit-2.71.0}/src/iatoolkit/repositories/models.py

@@ -9,6 +9,7 @@ from sqlalchemy import Column, Integer, BigInteger, String, DateTime, Enum, Text
 from sqlalchemy.orm import DeclarativeBase
 from sqlalchemy.orm import relationship, class_mapper
 from sqlalchemy.sql import func, literal_column
+from sqlalchemy.sql import text as sql_text
 from sqlalchemy import UniqueConstraint, Index
 from sqlalchemy.dialects.postgresql import JSONB
 from datetime import datetime
@@ -125,6 +126,11 @@ class ApiKey(Base):
     is_active = Column(Boolean, default=True, nullable=False)
     created_at = Column(DateTime, default=datetime.now)
     last_used_at = Column(DateTime, nullable=True) # Opcional: para rastrear uso
+    # A key is a service account that acts as itself ("service:<key name>"). Only with
+    # this on may it name the user it acts for, who must belong to the company
+    # (BL-010, Fase 0). Keys created before it existed keep acting for users;
+    # migration: iatoolkit-enterprise/migrations/2026-10-18-api-keys-can-act-for-users.sql
+    can_act_for_users = Column(Boolean, nullable=False, default=False, server_default=sql_text("true"))
 
     company = relationship("Company", back_populates="api_keys")
 

{iatoolkit-2.69.0 → iatoolkit-2.71.0}/src/iatoolkit/services/api_key_service.py

@@ -30,6 +30,8 @@ class ApiKeyService:
             "key_name": api_key.key_name,
             "key": api_key.key,
             "is_active": api_key.is_active,
+            # BL-010, Fase 0: whether the key may name the user it acts for.
+            "can_act_for_users": bool(getattr(api_key, "can_act_for_users", False)),
             "created_at": api_key.created_at.isoformat() if api_key.created_at else None,
             "last_used_at": api_key.last_used_at.isoformat() if api_key.last_used_at else None,
         }
@@ -65,7 +67,7 @@ class ApiKeyService:
 
         return {"data": self._api_key_to_dict(api_key)}
 
-    def create_api_key_entry(self, company_short_name: str, key_name: str) -> Dict:
+    def create_api_key_entry(self, company_short_name: str, key_name: str, can_act_for_users: bool = False) -> Dict:
         company, error = self._get_company(company_short_name)
         if error:
             return error
@@ -81,7 +83,8 @@ class ApiKeyService:
         alphabet = string.ascii_letters + string.digits
         key = ''.join(secrets.choice(alphabet) for _ in range(length))
 
-        api_key = ApiKey(key=key, company_id=company.id, key_name=key_name)
+        # A new key acts as itself unless the admin allows it to act for users (BL-010).
+        api_key = ApiKey(key=key, company_id=company.id, key_name=key_name, can_act_for_users=bool(can_act_for_users))
         created = self.api_key_repo.create_api_key(api_key)
         return {"data": self._api_key_to_dict(created)}
 
@@ -89,7 +92,8 @@ class ApiKeyService:
                              company_short_name: str,
                              api_key_id: int,
                              key_name: str | None = None,
-                             is_active: bool | None = None) -> Dict:
+                             is_active: bool | None = None,
+                             can_act_for_users: bool | None = None) -> Dict:
         company, error = self._get_company(company_short_name)
         if error:
             return error
@@ -98,7 +102,7 @@ class ApiKeyService:
         if not api_key:
             return {"error": "API key not found.", "status_code": 404}
 
-        if key_name is None and is_active is None:
+        if key_name is None and is_active is None and can_act_for_users is None:
             return {"error": "No changes provided.", "status_code": 400}
 
         if key_name is not None:
@@ -116,6 +120,11 @@ class ApiKeyService:
                 return {"error": "Invalid value for is_active.", "status_code": 400}
             api_key.is_active = is_active
 
+        if can_act_for_users is not None:
+            if not isinstance(can_act_for_users, bool):
+                return {"error": "Invalid value for can_act_for_users.", "status_code": 400}
+            api_key.can_act_for_users = can_act_for_users
+
         updated = self.api_key_repo.update_api_key(api_key)
         return {"data": self._api_key_to_dict(updated)}
 

{iatoolkit-2.69.0 → iatoolkit-2.71.0}/src/iatoolkit/services/auth_service.py

@@ -14,7 +14,10 @@ from iatoolkit.repositories.models import AccessLog
 from iatoolkit.infra.google_auth_client import GoogleAuthClient, GoogleAuthError
 from flask import request
 import logging
+import re
+import unicodedata
 import hashlib
+from iatoolkit.common import access
 
 
 class AuthService:
@@ -284,7 +287,11 @@ class AuthService:
                 "success": True,
                 "company_short_name": session_info['company_short_name'],
                 "user_identifier": session_info['user_identifier'],
-                "user_role": (session_info.get('profile') or {}).get('user_role'),
+                # From the database, never from the stored session profile: an SSO
+                # hook writes that profile, and must not be able to grant admin
+                # (BL-010, Fase 0).
+                "user_role": self._role_in_company(session_info['company_short_name'],
+                                                   session_info['user_identifier']),
             }
 
         # --- Priority 2: Check for a valid API Key in headers ---
@@ -311,7 +318,22 @@ class AuthService:
         # get the company from the api_key_entry
         company = api_key_entry.company
 
-        # For API calls, the external_user_id must be provided in the request.
+        # The key is a service account (BL-010, Fase 0): it acts as itself unless it
+        # was allowed to act for users. Every result says which key acted.
+        principal = self.service_principal(api_key_entry)
+        base = {
+            "success": True,
+            "company_short_name": company.short_name,
+            "auth_type": "api_key",
+            "auth_principal": principal,
+            "api_key_id": api_key_entry.id,
+        }
+        # Only an explicit False: a key loaded before the column existed keeps acting for users.
+        if getattr(api_key_entry, "can_act_for_users", None) is False:
+            # Whatever user the request names is ignored: the key cannot pass for anyone.
+            return {**base, "user_identifier": principal, "acting_for": None}
+
+        # A key allowed to act for users must say who (unless the endpoint allows none).
         data = request.get_json(silent=True) or {}
         user_identifier = data.get('user_identifier', '')
         if not anonymous and not user_identifier:
@@ -320,11 +342,27 @@ class AuthService:
                     "error_message": self.i18n_service.t('errors.auth.no_user_identifier_api'),
                     "status_code": 403}
 
-        return {
-            "success": True,
-            "company_short_name": company.short_name,
-            "user_identifier": user_identifier
-        }
+        return {**base, "user_identifier": user_identifier, "acting_for": user_identifier or None}
+
+    SERVICE_PREFIX = "service:"
+
+    @classmethod
+    def service_principal(cls, api_key_entry) -> str:
+        """The identity a key acts with by itself: "service:<key name>" (lowercase, dashes)."""
+        raw = unicodedata.normalize("NFKD", str(getattr(api_key_entry, "key_name", "") or ""))
+        ascii_name = raw.encode("ascii", "ignore").decode("ascii").strip().lower()
+        name = re.sub(r"[^a-z0-9._-]+", "-", ascii_name)
+        return f"{cls.SERVICE_PREFIX}{name.strip('-') or getattr(api_key_entry, 'id', 'key')}"
+
+    def _role_in_company(self, company_short_name: str, user_identifier: str) -> str | None:
+        """What the person can do over the company, by its old role name (BL-010, Fase 1).
+
+        Views decide with `iatoolkit.common.access`; this name stays in the result to
+        tell a session from an API key and for screens that show it.
+        """
+        if access.Access.registered():
+            return access.effective_role(company_short_name, user_identifier)
+        return self.profile_service.get_role_in_company(company_short_name, user_identifier)
 
     def verify_for_company(self, company_short_name: str, anonymous: bool = False) -> dict:
         """

{iatoolkit-2.69.0 → iatoolkit-2.71.0}/src/iatoolkit/services/memory_wiki_service.py

@@ -12,6 +12,7 @@ from injector import inject
 
 from iatoolkit.services.markdown_wiki_service import MarkdownWikiService
 from iatoolkit.services.tenant_wiki_service import TenantWikiService
+from iatoolkit.common.access import ADMIN
 
 
 class MemoryWikiService:
@@ -223,7 +224,8 @@ def _read_schema_template(path: str) -> str:
         return ""
 
 
-# Memoria's wiki opens in the wiki viewer for admin and owner only ("Ver como wiki",
-# BL-014); for every other role, and for the wiki tools and MCP, it stays hidden.
-TenantWikiService.register_system_wiki_readers(MemoryWikiService.SYSTEM_OWNER, {"admin", "owner"})
+# Memoria's wiki opens in the wiki viewer only for those who administer the company
+# ("Ver como wiki", BL-014); for everyone else, and for the wiki tools and MCP, it
+# stays hidden.
+TenantWikiService.register_system_wiki_readers(MemoryWikiService.SYSTEM_OWNER, ADMIN)
 

{iatoolkit-2.69.0 → iatoolkit-2.71.0}/src/iatoolkit/services/profile_service.py

@@ -28,6 +28,7 @@ from typing import List, Dict
 from sqlalchemy import update
 from iatoolkit.common.interfaces.signup_policy_resolver import SignupPolicyResolver
 from iatoolkit.services.signup_policy_resolver import AllowAllSignupPolicyResolver
+from iatoolkit.common import access
 
 
 class ProfileService:
@@ -107,6 +108,10 @@ class ProfileService:
         return first_name, last_name
 
     def _build_session_user_profile(self, user: User, company: Company, user_role: str | None) -> dict:
+        if access.Access.registered():
+            # What the person can do over the company (BL-010, Fase 1), for screens and
+            # prompt context; access is always decided with `access.can`.
+            user_role = access.effective_role(company.short_name, user.email)
         auth_method = str(getattr(user, "auth_method", "local") or "local").lower()
         is_local = auth_method == "local"
         user_identifier = user.email
@@ -150,6 +155,7 @@ class ProfileService:
             )
             .values(role="admin")
         )
+        access.role_assigned(company.short_name, user_email, "admin")
 
         updated_params = dict(params)
         updated_params.pop("bootstrap_admin_email", None)
@@ -396,6 +402,20 @@ class ProfileService:
             "profile": profile
         }
 
+    def get_role_in_company(self, company_short_name: str, user_identifier: str) -> str | None:
+        """
+        The person's role in the company as iat_user_company records it; None if
+        not a member. Every authorization reads the role here, never from the
+        stored session profile: an SSO hook writes that profile (BL-010, Fase 0).
+        """
+        try:
+            company = self.profile_repo.get_company_by_short_name(company_short_name)
+            user = self.profile_repo.get_user_by_email(str(user_identifier or "").strip().lower()) if company else None
+            return self.profile_repo.get_user_role_in_company(company.id, user.id) if user else None
+        except Exception as exc:
+            logging.warning("Role of %s in %s could not be read: %s", user_identifier, company_short_name, exc)
+            return None
+
     def _account_user(self, company_short_name: str, session_info: dict):
         profile = session_info.get("profile") or {}
         method = (profile.get("extras") or {}).get("auth_method")
@@ -416,7 +436,8 @@ class ProfileService:
             "last_name": user.last_name if user else "",
             "full_name": f"{user.first_name} {user.last_name}" if user else profile.get("user_fullname", ""),
             "email": profile.get("user_email") or session_info["user_identifier"],
-            "role": profile.get("user_role") or "user",
+            "role": (access.effective_role(company_short_name, session_info["user_identifier"])
+                     if access.Access.registered() else profile.get("user_role")) or "user",
             "auth_method": method,
             "can_edit_name": bool(user and method == "local"),
             "language": self.lang_service.get_current_language(),
@@ -938,8 +959,11 @@ class ProfileService:
         # get the company users from the repo
         company_users =  self.profile_repo.get_company_users_with_details(company_short_name)
 
+        effective = access.effective_roles(company_short_name, [u.email for u, _, _ in company_users]) \
+            if access.Access.registered() else {}
         users_data = []
         for user, role, last_access in company_users:
+            role = effective.get(user.email, role) if access.Access.registered() else role
             users_data.append({
                 "first_name": user.first_name,
                 "last_name": user.last_name,