feat: Phase 5 – Berechtigungssystem (User-Module-Zuweisung, Gateway-Access-Control)

apps/platform-frontend/src/lib/modules-api.ts

@@ -1,5 +1,12 @@
 import { apiRequest, ApiError } from './api-client';
-import { moduleSchema, type Module } from './schemas';
+import {
+  accessibleModuleSchema,
+  modulePermissionSchema,
+  moduleSchema,
+  type AccessibleModule,
+  type Module,
+  type ModulePermission,
+} from './schemas';
 
 /** Typsichere API-Funktionen für die Modul-Verwaltung. */
 
@@ -88,6 +95,30 @@ export async function checkModuleHealth(
   return apiRequest(`/api/v1/modules/${id}/health`);
 }
 
+/** Module, die der angemeldete Benutzer sehen darf (Dashboard). */
+export async function fetchAccessibleModules(): Promise<AccessibleModule[]> {
+  const response = await apiRequest<{ modules: unknown[] }>('/api/v1/profile/modules');
+  return response.modules.map((module) => accessibleModuleSchema.parse(module));
+}
+
+/** Modul-Berechtigungen eines Benutzers (Admin). */
+export async function fetchUserModulePermissions(userId: string): Promise<ModulePermission[]> {
+  const response = await apiRequest<{ permissions: unknown[]}>(
+    `/api/v1/users/${userId}/modules`,
+  );
+  return response.permissions.map((permission) => modulePermissionSchema.parse(permission));
+}
+
+/** Modul-Zugriff gewähren (Admin). */
+export async function grantModuleAccess(userId: string, moduleId: string): Promise<void> {
+  await apiRequest(`/api/v1/users/${userId}/modules/${moduleId}`, { method: 'POST' });
+}
+
+/** Modul-Zugriff entziehen (Admin). */
+export async function revokeModuleAccess(userId: string, moduleId: string): Promise<void> {
+  await apiRequest(`/api/v1/users/${userId}/modules/${moduleId}`, { method: 'DELETE' });
+}
+
 /** Liest das CSRF-Token aus dem nicht-HttpOnly-Cookie. */
 function readCsrfToken(): string | null {
   for (const part of document.cookie.split(';')) {

apps/platform-frontend/src/lib/schemas.ts

@@ -135,4 +135,24 @@ export const moduleSchema = z.object({
   enabled: z.boolean(),
   createdAt: z.string(),
 });
-export type Module = z.infer<typeof moduleSchema>;
+export type Module = z.infer<typeof moduleSchema>;
+
+/** Modul-Kachel für das Dashboard (/api/v1/profile/modules). */
+export const accessibleModuleSchema = z.object({
+  id: z.string(),
+  moduleId: z.string(),
+  name: z.string(),
+  slug: z.string(),
+  description: z.string(),
+  status: z.enum(MODULE_STATUSES),
+});
+export type AccessibleModule = z.infer<typeof accessibleModuleSchema>;
+
+/** Modul-Berechtigung eines Benutzers. */
+export const modulePermissionSchema = z.object({
+  moduleId: z.string(),
+  moduleSlug: z.string(),
+  moduleName: z.string(),
+  permission: z.enum(['GRANTED', 'DENIED']),
+});
+export type ModulePermission = z.infer<typeof modulePermissionSchema>;