Permission profiles and screen catalog endpoints #10

Goal

Expose permission profiles and the screen catalog through the API, as the Permissões screen uses them.

Scope

Operations of docs/product/features/permission-profiles.md#operations, with their minimum levels:

• listProfiles: whole list, not paged, with userCount, grantedCount, screenCount (API-08); allowed with Reader on Permissões or Usuários (PERM-04).
• getProfile, with createdByName and updatedByName (API-03) and version in body and ETag (API-06).
• createProfile: validation PERM-16, PERM-17; starts all negado (PERM-18); 201 Created with Location (API-05).
• updateProfile and deleteProfile with If-Match (API-06, CNV-12, CNV-13); deletion refused with profile_in_use and the names of who uses it (PERM-20); Gerenciador protected with system_record (PERM-22) and returned with computed levels (PERM-23).
• listScreens (GET /api/v1/screens, ADR-0021).
• Changing levels invalidates the permission cache (PERM-13).

Done when

• Integration tests for every operation: success, validation errors with the verbatim messages, 403 for a lower level, 404, 409 concurrency, 409 profile_in_use, 409 system_record.
• Routes, status codes and error codes match docs/product/features/permission-profiles.md exactly.
• Build with zero warnings, all tests pass.

References

docs/product/features/permission-profiles.md, docs/api/conventions.md, ADR-0009, ADR-0014, ADR-0020, ADR-0021, ADR-0022.