From 1281654d3230c1124ac121afb5f844b5d0ab5a17 Mon Sep 17 00:00:00 2001
From: "Zimin A.N." <zimin.an@nstart.space>
Date: Wed, 13 May 2026 12:27:33 +0300
Subject: [PATCH] =?UTF-8?q?chore(auth):=20rename=20schema=20workflow=20rol?=
 =?UTF-8?q?es=20=D0=BA=20colon-convention?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Project uses Altum-style colon-separated realm roles:
- ordinis:client:public / internal / restricted (scope ACL, уже active)

Schema workflow roles (Phase 1d TODO) приводим к той же convention:
- ordinis:schema:reviewer (был ordinis-schema-reviewer)
- ordinis:schema:publisher
- ordinis:schema:maker

Изменения в usePermissions.ts:
- JSDoc обновлён с новой convention
- Constants ROLE_SCHEMA_* для discoverable rename'а в Phase 1d
- TODO comments указывают на constants, не bare strings

Phase 1d (когда подключится backend role check):
1. Uncomment role check в hooks
2. Backend SchemaDraftService.decide() — require role
---
 ordinis-admin-ui/src/auth/usePermissions.ts | 25 ++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/ordinis-admin-ui/src/auth/usePermissions.ts b/ordinis-admin-ui/src/auth/usePermissions.ts
index 24391e3..961e7bc 100644
--- a/ordinis-admin-ui/src/auth/usePermissions.ts
+++ b/ordinis-admin-ui/src/auth/usePermissions.ts
@@ -11,31 +11,46 @@ import { useAuth } from 'react-oidc-context'
  * </ul>
  *
  * <p>Phase 1d: подключим decode JWT → realm_access.roles, и эти hook'и
- * начнут возвращать false для users без \`ordinis-schema-reviewer\` /
- * \`ordinis-schema-publisher\` ролей. UI hide'ит соответствующие кнопки.
+ * начнут возвращать false для users без {@code ordinis:schema:reviewer}
+ * / {@code ordinis:schema:publisher} ролей. UI hide'ит соответствующие
+ * кнопки.
+ *
+ * <p><b>Naming convention:</b> roles используют colon-separated namespace
+ * pattern {@code ordinis:<domain>:<action>} (как Altum-style scope roles
+ * вида {@code ordinis:client:restricted}). Совпадает с realm role parser
+ * в {@code ScopeContext.java}. Dash-форма ({@code ordinis-schema-reviewer})
+ * НЕ используется в этом проекте — colon-стиль consistent с уже-existing
+ * scope ролями ({@code ordinis:client:public|internal|restricted}).
  *
  * <p>До тех пор все logged-in юзеры могут жать любые workflow buttons —
  * backend гейт остаётся primary defence.
  */
 
+const ROLE_SCHEMA_REVIEWER = 'ordinis:schema:reviewer'
+const ROLE_SCHEMA_PUBLISHER = 'ordinis:schema:publisher'
+const ROLE_SCHEMA_MAKER = 'ordinis:schema:maker'
+
 /** Может ли актор approve / request_changes / reject schema draft. */
 export function useCanReviewSchema(): boolean {
   const auth = useAuth()
   // TODO Phase 1d: const roles = (auth.user?.profile as { realm_access?: { roles?: string[] } })?.realm_access?.roles ?? []
-  // return roles.includes('ordinis-schema-reviewer')
+  // return roles.includes(ROLE_SCHEMA_REVIEWER)
+  void ROLE_SCHEMA_REVIEWER
   return auth.isAuthenticated
 }
 
 /** Может ли актор publish approved schema draft (bump live version). */
 export function useCanPublishSchema(): boolean {
   const auth = useAuth()
-  // TODO Phase 1d: roles.includes('ordinis-schema-publisher')
+  // TODO Phase 1d: roles.includes(ROLE_SCHEMA_PUBLISHER)
+  void ROLE_SCHEMA_PUBLISHER
   return auth.isAuthenticated
 }
 
 /** Может ли актор create schema draft (maker side). */
 export function useCanCreateSchemaDraft(): boolean {
   const auth = useAuth()
-  // TODO Phase 1d: roles.includes('ordinis-schema-maker') OR any authenticated
+  // TODO Phase 1d: roles.includes(ROLE_SCHEMA_MAKER) OR any authenticated
+  void ROLE_SCHEMA_MAKER
   return auth.isAuthenticated
 }