feat(server): add project RBAC and guarded workflows

tests/api/test_access_endpoints.py

@@ -0,0 +1,77 @@
+from types import SimpleNamespace
+from uuid import uuid4
+
+from fastapi.testclient import TestClient
+
+from app.api.v1.endpoints import access as access_endpoint
+from app.auth.metadata_dependencies import (
+    get_current_metadata_user,
+    get_metadata_repository,
+)
+from tests.conftest import build_test_app
+
+
+def _user(**overrides):
+    data = {
+        "id": uuid4(),
+        "username": "alice",
+        "role": "user",
+        "is_superuser": False,
+    }
+    data.update(overrides)
+    return SimpleNamespace(**data)
+
+
+def _build_client(user, repo) -> TestClient:
+    app = build_test_app(access_endpoint.router, "/api/v1")
+    app.dependency_overrides[get_current_metadata_user] = lambda: user
+    app.dependency_overrides[get_metadata_repository] = lambda: repo
+    return TestClient(app)
+
+
+def test_access_context_returns_global_admin_permissions_without_project():
+    user = _user(role="admin")
+    repo = SimpleNamespace()
+    client = _build_client(user, repo)
+
+    response = client.get("/api/v1/access/context")
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["is_system_admin"] is True
+    assert payload["project_id"] is None
+    assert "environment.manage" in payload["permissions"]
+    assert "webgis.view" not in payload["permissions"]
+
+
+def test_access_context_returns_project_member_permissions():
+    project_id = uuid4()
+    user = _user()
+
+    async def get_project_by_id(value):
+        assert value == project_id
+        return SimpleNamespace(id=project_id, code="demo", status="active")
+
+    async def get_membership_role(value, user_id):
+        assert value == project_id
+        assert user_id == user.id
+        return "member"
+
+    repo = SimpleNamespace(
+        get_project_by_id=get_project_by_id,
+        get_membership_role=get_membership_role,
+    )
+    client = _build_client(user, repo)
+
+    response = client.get(
+        "/api/v1/access/context",
+        headers={"X-Project-Id": str(project_id)},
+    )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["project_id"] == str(project_id)
+    assert payload["project_role"] == "member"
+    assert "scada.clean" in payload["permissions"]
+    assert "optimization.run" in payload["permissions"]
+    assert "model.import" not in payload["permissions"]