# Project Permission Consistency Implementation Plan

> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.

**Goal:** Make project-level backend permissions and frontend route/menu/action visibility consistent.

**Architecture:** Treat backend `API_ENDPOINT_PERMISSIONS` and effective `/api-permissions/me` matrix as the source of truth. Frontend route guards, menus, quick actions, page actions, and attachment controls should only project that matrix into visibility or disabled states.

**Tech Stack:** FastAPI, SQLAlchemy, pytest, Vue 3, Pinia, Vue Router, Element Plus, Vitest.

---

### Task 1: Frontend Action Visibility

**Files:**
- Modify: `frontend/src/components/QuickActions.vue`
- Modify: `frontend/src/views/ia/SubjectManagement.vue`
- Modify: `frontend/src/utils/permission.ts`
- Test: `frontend/src/components/QuickActions.test.ts`
- Test: `frontend/src/views/ia/SubjectManagement.test.ts`
- Test: `frontend/src/utils/permission.test.ts`

**Steps:**
1. Write failing source-level tests that prove quick actions are filtered by `getProjectRoutePermission`/`hasProjectPermission`.
2. Write failing source-level tests that prove subject create/delete actions are guarded by `subjects:create` and `subjects:delete`.
3. Add minimal permission checks in the affected components.
4. Run the targeted Vitest files and confirm they pass.

### Task 2: Permission Contract Coverage

**Files:**
- Modify: `frontend/src/utils/projectRoutePermissions.test.ts`
- Modify: `backend/tests/test_api_permissions.py`

**Steps:**
1. Add tests for route landing paths and project route mappings using backend operation key names already present in the frontend contract.
2. Extend backend configuration tests so service-level checks are included where feasible, especially document and attachment permission mappings.
3. Keep tests focused on permission contract shape, not business data setup.
4. Run targeted backend pytest files.

### Task 3: Verification

**Files:**
- No production files unless tests identify another mismatch.

**Steps:**
1. Run targeted frontend tests.
2. Run frontend type check if dependencies are available.
3. Run targeted backend permission tests.
4. Report exact commands and results.

### Constraints

- Do not create branches.
- Do not commit.
- Do not revert unrelated dirty worktree changes.
- Keep changes narrow and avoid redesigning permission management.