feat(workbench): persist operational workflows and events

tests/auth/test_permissions.py

@@ -8,6 +8,14 @@ from app.auth.permissions import (
     ENVIRONMENT_MANAGE,
     MODEL_IMPORT,
     OPTIMIZATION_RUN,
+    OPERATIONAL_ACTION_COMMAND_APPROVE,
+    OPERATIONAL_ACTION_COMMAND_EXECUTE,
+    OPERATIONAL_ACTION_WORK_ORDER_APPROVE,
+    OPERATIONAL_ACTION_WORK_ORDER_EXECUTE,
+    OPERATIONAL_TASK_EXECUTE,
+    OPERATIONAL_TASK_EXTERNAL_SYNC,
+    OPERATIONAL_TASK_VIEW,
+    OPERATIONAL_TASK_WRITE,
     SCADA_CLEAN,
     SIMULATION_RUN,
     SIMULATION_VIEW,
@@ -52,11 +60,36 @@ def test_project_role_permission_matrix():
     assert SIMULATION_RUN in member
     assert OPTIMIZATION_RUN in member
     assert MODEL_IMPORT not in member
+    assert OPERATIONAL_TASK_VIEW in member
+    assert OPERATIONAL_TASK_WRITE in member
+    assert OPERATIONAL_TASK_EXECUTE not in member
+    assert OPERATIONAL_TASK_EXTERNAL_SYNC not in member
+    assert OPERATIONAL_ACTION_WORK_ORDER_APPROVE in member
+    assert OPERATIONAL_ACTION_WORK_ORDER_EXECUTE in member
+    assert OPERATIONAL_ACTION_COMMAND_APPROVE not in member
+    assert OPERATIONAL_ACTION_COMMAND_EXECUTE not in member
     assert WEBGIS_VIEW in viewer
     assert SIMULATION_VIEW in viewer
     assert WEBGIS_EDIT not in viewer
     assert SCADA_CLEAN not in viewer
     assert SIMULATION_RUN not in viewer
+    assert OPERATIONAL_TASK_VIEW in viewer
+    assert OPERATIONAL_TASK_WRITE not in viewer
+    assert OPERATIONAL_ACTION_WORK_ORDER_APPROVE not in viewer
+
+
+def test_service_identity_gets_only_project_scoped_control_permissions():
+    service = resolve_permissions(
+        project_role="member",
+        system_role="service",
+        is_superuser=False,
+    )
+
+    assert OPERATIONAL_TASK_VIEW in service
+    assert OPERATIONAL_TASK_EXECUTE in service
+    assert OPERATIONAL_TASK_EXTERNAL_SYNC in service
+    assert ENVIRONMENT_MANAGE not in service
+    assert OPERATIONAL_ACTION_COMMAND_EXECUTE not in service
 
 
 def test_system_admin_permissions_do_not_grant_project_business_access():
@@ -70,6 +103,16 @@ def test_system_admin_permissions_do_not_grant_project_business_access():
     assert AUDIT_VIEW in permissions
     assert MODEL_IMPORT in permissions
     assert WEBGIS_VIEW not in permissions
+    assert OPERATIONAL_ACTION_COMMAND_APPROVE not in permissions
+    assert OPERATIONAL_ACTION_COMMAND_EXECUTE not in permissions
+
+    project_operator = resolve_permissions(
+        project_role="member",
+        system_role="admin",
+        is_superuser=False,
+    )
+    assert OPERATIONAL_ACTION_COMMAND_APPROVE in project_operator
+    assert OPERATIONAL_ACTION_COMMAND_EXECUTE in project_operator
 
 
 @pytest.mark.anyio

tests/auth/test_rbac_migration.py

@@ -41,3 +41,11 @@ def test_rbac_migration_normalizes_legacy_roles():
     assert "'dispatcher'" in sql
     assert "THEN 'member'" in sql
     assert "ELSE 'viewer'" in sql
+
+
+def test_service_identity_migration_extends_business_roles():
+    sql = Path("resources/sql/016_metadata_service_identities.sql").read_text(
+        encoding="utf-8"
+    )
+
+    assert "role IN ('admin', 'service', 'user')" in sql