feat(core): dynamic menu providers and runtime permission sources (#340, #334)

[antosubash]

Fixes #340
Fixes #334

Design

Menu providers (#340). MenuRegistry.add_provider(fn) takes fn(request) returning an iterable of MenuItem; sync or async. InertiaLayoutDataMiddleware now calls the new async get_for_request, which collects provider items per request (after auth and request.state.tenant_id are resolved) and passes them to the unchanged get_for_user as extra_items, so role/permission filtering, translation, ordering and grouping are shared with static items. The static sorted cache is untouched. A provider that raises is logged and contributes nothing. MenuRegistry.remove(predicate) drops static items and invalidates the cache.

Permission sources (#334). PermissionRegistry.add_source(name, provider) with a sync provider returning keys or (key, label) pairs; output is cached per source and refreshed by invalidate_source(name). all_permissions, groups, has and therefore role_map wildcard expansion, admin's implicit all-permissions, the role editor and both RequiresPermission variants see source permissions, with no changes needed outside the registry. Source permissions are persisted like any key. A failing source is logged and contributes nothing. The role editor API gains an additive PermissionGroupOut.labels.

Additive only, to limit conflicts with #398 / #404.

Not done: label translation keys for source permissions (labels are literal; t() needs literal keys in TSX), and no frontend rendering of labels yet.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-05T11:33:20.017757Z	7c29c8c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	dcb9841
Status:	✅  Deploy successful!
Preview URL:	https://34f8f921.simple-module-python.pages.dev
Branch Preview URL:	https://feat-340-334-runtime-menus-a.simple-module-python.pages.dev

View logs

[antosubash]

/ship results

Converged in 1 round. Pushed 4 commits on top of d288750 (head a5a2008). Full report: https://claude.ai/artifact/EbEz5aCD65dHQ9kasdw3YZ

Optimize: two safe edits (hoisted label lookup, restored a why-comment).

Code review (3 passes, ends clean) fixed:

• A generator provider that fails midway no longer leaves partial items.
• Source labels now show in the user-grants editor and in role search.
• Saving a role or user no longer deletes stored grants for keys that are not registered at that moment (empty or failing source), and the in-memory role map keeps them. Regression test added.
• Security finding (UI spoofing): a source label never replaces the key. The key is always shown in monospace, the label is plain trimmed text capped at 80 chars, and switches are named with the key. Vitest added for PermissionRow and the role editor (markup in a label, over-long label).

Accepted: a source that raises at boot is cached empty until invalidate_source (fails closed); providers run per request (documented as cheap).

QA (temporary fixture, not committed: 5 per-request menu items, a provider failing midway, a source with a misleading label, a raising source; browser agent plus API agent):

• Admin sees admin-only and permission items; a plain user sees neither. PASS
• Source permissions are never granted implicitly to non-admins; * and qafix.* user grants are ignored. PASS
• Grant and revoke on a role is enforced on a route with no restart (200 then 403, menu item appears and disappears). PASS
• Failing provider and source are isolated, no 5xx anywhere. PASS
• 80 concurrent plus 90 sequential mixed-user requests: no cross-user menu leak, Inertia responses are private, no-store. PASS
• Role editor shows label plus key, labels stay inside their group, 375px layout fine. PASS
• Found, exists on main, not changed here: direct per-user grants (/api/permissions/users/{id}) are saved but not enforced by route gates or menus, because the principal is built from roles only. Worth its own issue.
• Not exercised: multi-tenant provider isolation (multi_tenant is build-time); covered by the unit tests.

CI (local): make lint OK, make test-py 3581 passed / 9 skipped, make test-js 476 passed, make ci-check-untranslated OK. No second PR opened.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4