Prepare ERP source for Gitea deployment

app/modules/core/rbac/permission_guard.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from fastapi import HTTPException
+from sqlalchemy.orm import Session
+
+from app.modules.core.iam.models import User
+from app.modules.core.rbac.deps import get_user_permissions, get_user_roles
+from app.modules.core.rbac.permissions_registry import expand_permission_codes
+
+
+def has_permission(db: Session, user: User | None, permission_code: str) -> bool:
+    if not user:
+        return False
+    roles = set(get_user_roles(db, user.id))
+    if "System Admin" in roles:
+        return True
+    granted = set(get_user_permissions(db, user.id))
+    for code in expand_permission_codes(permission_code):
+        if code in granted:
+            return True
+    return False
+
+
+def require_permission(db: Session, user: User | None, permission_code: str) -> None:
+    if not has_permission(db, user, permission_code):
+        raise HTTPException(status_code=403, detail=f"Missing permission: {permission_code}")