ctms/docs/plans/2026-05-29-project-permission-consistency-implementation.md

Project Permission Consistency Implementation Plan

For Claude: REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.

Goal: Make project-level backend permissions and frontend route/menu/action visibility consistent.

Architecture: Treat backend API_ENDPOINT_PERMISSIONS and effective /api-permissions/me matrix as the source of truth. Frontend route guards, menus, quick actions, page actions, and attachment controls should only project that matrix into visibility or disabled states.

Tech Stack: FastAPI, SQLAlchemy, pytest, Vue 3, Pinia, Vue Router, Element Plus, Vitest.

---

Task 1: Frontend Action Visibility

Files:

• Modify: frontend/src/components/QuickActions.vue
• Modify: frontend/src/views/ia/SubjectManagement.vue
• Modify: frontend/src/utils/permission.ts
• Test: frontend/src/components/QuickActions.test.ts
• Test: frontend/src/views/ia/SubjectManagement.test.ts
• Test: frontend/src/utils/permission.test.ts

Steps:

1. Write failing source-level tests that prove quick actions are filtered by getProjectRoutePermission/hasProjectPermission.
2. Write failing source-level tests that prove subject create/delete actions are guarded by subjects:create and subjects:delete.
3. Add minimal permission checks in the affected components.
4. Run the targeted Vitest files and confirm they pass.

Task 2: Permission Contract Coverage

Files:

• Modify: frontend/src/utils/projectRoutePermissions.test.ts
• Modify: backend/tests/test_api_permissions.py

Steps:

1. Add tests for route landing paths and project route mappings using backend operation key names already present in the frontend contract.
2. Extend backend configuration tests so service-level checks are included where feasible, especially document and attachment permission mappings.
3. Keep tests focused on permission contract shape, not business data setup.
4. Run targeted backend pytest files.

Task 3: Verification

Files:

• No production files unless tests identify another mismatch.

Steps:

1. Run targeted frontend tests.
2. Run frontend type check if dependencies are available.
3. Run targeted backend permission tests.
4. Report exact commands and results.

Constraints

• Do not create branches.
• Do not commit.
• Do not revert unrelated dirty worktree changes.
• Keep changes narrow and avoid redesigning permission management.