Add the get_permissions plugin hook (contract 0.10.0)

Plugins declare their own RBAC permissions instead of core accumulating
them: 36 permissions moved out of the core catalog into the 9 owning
plugins (core keeps the 19 its own blueprints enforce). The catalog is
resolved dynamically (core + enabled plugins) and feeds the roles grid,
the token scope picker and ceiling, and flask seed permissions;
installing or enabling a plugin seeds its permissions automatically. A
disabled plugin drops out of the assignable catalog while existing role
links keep working. New plugins - bundled or external - now bring their
permissions with zero core edits.

781 tests pass; live-verified with a machines.edit-scoped token.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plugins/computers/plugin.py

@@ -384,3 +384,12 @@ class ComputersPlugin(BasePlugin):
                 'position': 15,
             },
         ]
+
+    def get_permissions(self) -> List:
+        """Return the RBAC permissions this plugin owns."""
+        return [
+            ('computers.view', 'View computers', 'computers'),
+            ('computers.create', 'Create computers', 'computers'),
+            ('computers.edit', 'Edit computers', 'computers'),
+            ('computers.delete', 'Delete computers', 'computers'),
+        ]

plugins/knowledgebase/plugin.py

@@ -72,3 +72,12 @@ class KnowledgeBasePlugin(BasePlugin):
                 'section': 'information',
             },
         ]
+
+    def get_permissions(self) -> List:
+        """Return the RBAC permissions this plugin owns."""
+        return [
+            ('kb.view', 'View knowledge base', 'knowledgebase'),
+            ('kb.create', 'Create KB articles', 'knowledgebase'),
+            ('kb.edit', 'Edit KB articles', 'knowledgebase'),
+            ('kb.delete', 'Delete KB articles', 'knowledgebase'),
+        ]

plugins/machines/plugin.py

@@ -217,3 +217,12 @@ class MachinesPlugin(BasePlugin):
                 'position': 10,
             },
         ]
+
+    def get_permissions(self) -> List:
+        """Return the RBAC permissions this plugin owns."""
+        return [
+            ('machines.view', 'View machines', 'machines'),
+            ('machines.create', 'Create machines', 'machines'),
+            ('machines.edit', 'Edit machines', 'machines'),
+            ('machines.delete', 'Delete machines', 'machines'),
+        ]

plugins/measuringtools/plugin.py

@@ -168,3 +168,12 @@ class MeasuringToolsPlugin(BasePlugin):
                     name=name, description=description, color=color))
                 logger.debug(f"Created measuring-tool type: {name}")
         db.session.commit()
+
+    def get_permissions(self) -> List:
+        """Return the RBAC permissions this plugin owns."""
+        return [
+            ('measuringtools.view', 'View measuring tools', 'measuringtools'),
+            ('measuringtools.create', 'Create measuring tools', 'measuringtools'),
+            ('measuringtools.edit', 'Edit measuring tools', 'measuringtools'),
+            ('measuringtools.delete', 'Delete measuring tools', 'measuringtools'),
+        ]

plugins/network/plugin.py

@@ -214,3 +214,12 @@ class NetworkPlugin(BasePlugin):
                 'position': 18,
             },
         ]
+
+    def get_permissions(self) -> List:
+        """Return the RBAC permissions this plugin owns."""
+        return [
+            ('network.view', 'View network devices', 'network'),
+            ('network.create', 'Create network devices', 'network'),
+            ('network.edit', 'Edit network devices', 'network'),
+            ('network.delete', 'Delete network devices', 'network'),
+        ]

plugins/notifications/plugin.py

@@ -220,3 +220,12 @@ class NotificationsPlugin(BasePlugin):
                 'position': 6,
             },
         ]
+
+    def get_permissions(self) -> List:
+        """Return the RBAC permissions this plugin owns."""
+        return [
+            ('notifications.view', 'View notifications', 'notifications'),
+            ('notifications.create', 'Create notifications', 'notifications'),
+            ('notifications.edit', 'Edit notifications', 'notifications'),
+            ('notifications.delete', 'Delete notifications', 'notifications'),
+        ]

plugins/printers/plugin.py

@@ -230,3 +230,12 @@ class PrintersPlugin(BasePlugin):
                 'route': '/reports/toner',
             },
         ]
+
+    def get_permissions(self) -> List:
+        """Return the RBAC permissions this plugin owns."""
+        return [
+            ('printers.view', 'View printers', 'printers'),
+            ('printers.create', 'Create printers', 'printers'),
+            ('printers.edit', 'Edit printers', 'printers'),
+            ('printers.delete', 'Delete printers', 'printers'),
+        ]

plugins/usb/plugin.py

@@ -110,3 +110,12 @@ class USBPlugin(BasePlugin):
                 'position': 45,
             },
         ]
+
+    def get_permissions(self) -> List:
+        """Return the RBAC permissions this plugin owns."""
+        return [
+            ('usb.view', 'View USB devices', 'usb'),
+            ('usb.create', 'Create USB devices', 'usb'),
+            ('usb.edit', 'Edit USB devices', 'usb'),
+            ('usb.delete', 'Delete USB devices', 'usb'),
+        ]

plugins/warranty/plugin.py

@@ -88,5 +88,14 @@ class WarrantyPlugin(BasePlugin):
             },
         ]
 
+    def get_permissions(self) -> List:
+        """Return the RBAC permissions this plugin owns."""
+        return [
+            ('warranty.view', 'View warranties', 'warranty'),
+            ('warranty.create', 'Create warranties', 'warranty'),
+            ('warranty.edit', 'Edit warranties', 'warranty'),
+            ('warranty.delete', 'Delete warranties', 'warranty'),
+        ]
+
     def init_app(self, app: Flask, db_instance) -> None:
         logger.info(f"Warranty plugin initialized (v{self.meta.version})")