feat: UTC-285: Add OrganizationPermission model + API

.mock/definition/__package__.yml

@@ -1620,6 +1620,23 @@ types:
         docs: Last updated time
     source:
       openapi: openapi/openapi.yaml
+  ConfigurablePermissionOptionDefault:
+    discriminated: false
+    union:
+      - Role9E7Enum
+      - NullEnum
+    source:
+      openapi: openapi/openapi.yaml
+    inline: true
+  ConfigurablePermissionOption:
+    properties:
+      default: optional<ConfigurablePermissionOptionDefault>
+      label: optional<string>
+      options: list<Role9E7Enum>
+      permission: string
+      tooltip: optional<string>
+    source:
+      openapi: openapi/openapi.yaml
   ConvertedFormat:
     properties:
       export_type:
@@ -2160,7 +2177,7 @@ types:
           occurs, contact the LEAP team for assistance with enabling custom
           scripts.
       default_role:
-        type: optional<DefaultRoleEnum>
+        type: optional<Role9E7Enum>
         docs: |-
           Default membership role for invited users
 
@@ -2194,25 +2211,6 @@ types:
           quick view.
     source:
       openapi: openapi/openapi.yaml
-  DefaultRoleEnum:
-    enum:
-      - OW
-      - AD
-      - MA
-      - RE
-      - AN
-      - DI
-      - 'NO'
-    docs: |-
-      * `OW` - Owner
-      * `AD` - Administrator
-      * `MA` - Manager
-      * `RE` - Reviewer
-      * `AN` - Annotator
-      * `DI` - Deactivated
-      * `NO` - Not Activated
-    source:
-      openapi: openapi/openapi.yaml
   EditionEnum:
     enum:
       - Community
@@ -3604,7 +3602,7 @@ types:
           * `MA` - Manager
       custom_scripts_enabled: string
       default_role:
-        type: optional<DefaultRoleEnum>
+        type: optional<Role9E7Enum>
         docs: |-
           Default membership role for invited users
 
@@ -5698,6 +5696,35 @@ types:
           minLength: 1
     source:
       openapi: openapi/openapi.yaml
+  OrganizationPermission:
+    properties:
+      default_role: string
+      id: integer
+      label: string
+      options: string
+      organization: integer
+      permission:
+        type: string
+        validation:
+          maxLength: 255
+      roles:
+        type: optional<list<Role9E7Enum>>
+        docs: Explicit roles that have this permission within the organization.
+      tooltip: string
+    source:
+      openapi: openapi/openapi.yaml
+  OrganizationPermissionRequest:
+    properties:
+      permission:
+        type: string
+        validation:
+          minLength: 1
+          maxLength: 255
+      roles:
+        type: optional<list<Role9E7Enum>>
+        docs: Explicit roles that have this permission within the organization.
+    source:
+      openapi: openapi/openapi.yaml
   PaginatedAllRolesProjectListList:
     properties:
       count: integer

.mock/definition/organizations.yml

@@ -200,7 +200,7 @@ service:
                 will be raised. If this occurs, contact the LEAP team for
                 assistance with enabling custom scripts.
             default_role:
-              type: optional<root.DefaultRoleEnum>
+              type: optional<root.Role9E7Enum>
               docs: |-
                 Default membership role for invited users
 

.mock/definition/organizations/permissions.yml

@@ -0,0 +1,267 @@
+imports:
+  root: ../__package__.yml
+service:
+  auth: false
+  base-path: ''
+  endpoints:
+    list:
+      path: /api/organizations/{id}/permissions
+      method: GET
+      auth: true
+      docs: >-
+        List all organization-level permission overrides for a given
+        organization.
+      source:
+        openapi: openapi/openapi.yaml
+      path-parameters:
+        id: integer
+      display-name: List organization permission overrides
+      request:
+        name: PermissionsListRequest
+        query-parameters:
+          ordering:
+            type: optional<string>
+            docs: Which field to use when ordering the results.
+      response:
+        docs: ''
+        type: list<root.OrganizationPermission>
+      examples:
+        - path-parameters:
+            id: 1
+          response:
+            body:
+              - default_role: default_role
+                id: 1
+                label: label
+                options: options
+                organization: 1
+                permission: permission
+                roles:
+                  - OW
+                tooltip: tooltip
+      audiences:
+        - public
+    create:
+      path: /api/organizations/{id}/permissions
+      method: POST
+      auth: true
+      docs: >-
+        Create a new organization-level permission override for a given
+        organization.
+      source:
+        openapi: openapi/openapi.yaml
+      path-parameters:
+        id: integer
+      display-name: Create organization permission override
+      request:
+        body: root.OrganizationPermissionRequest
+        content-type: application/json
+      response:
+        docs: ''
+        type: root.OrganizationPermission
+      errors:
+        - root.BadRequestError
+        - root.ForbiddenError
+      examples:
+        - path-parameters:
+            id: 1
+          request:
+            permission: permission
+          response:
+            body:
+              default_role: default_role
+              id: 1
+              label: label
+              options: options
+              organization: 1
+              permission: permission
+              roles:
+                - OW
+              tooltip: tooltip
+      audiences:
+        - public
+    get_options:
+      path: /api/organizations/{id}/permissions/options
+      method: GET
+      auth: true
+      docs: >-
+        Retrieve the list of configurable permission options (label, tooltip,
+        default role and allowed roles).
+      source:
+        openapi: openapi/openapi.yaml
+      path-parameters:
+        id: integer
+      display-name: Get configurable permissions options
+      request:
+        name: PermissionsGetOptionsRequest
+        query-parameters:
+          ordering:
+            type: optional<string>
+            docs: Which field to use when ordering the results.
+      response:
+        docs: ''
+        type: list<root.ConfigurablePermissionOption>
+      examples:
+        - path-parameters:
+            id: 1
+          response:
+            body:
+              - default: OW
+                label: label
+                options:
+                  - OW
+                permission: permission
+                tooltip: tooltip
+      audiences:
+        - public
+    get:
+      path: /api/organizations/{id}/permissions/{permission}
+      method: GET
+      auth: true
+      source:
+        openapi: openapi/openapi.yaml
+      path-parameters:
+        id: integer
+        permission: string
+      display-name: Retrieve organization permission override
+      response:
+        docs: ''
+        type: root.OrganizationPermission
+      errors:
+        - root.ForbiddenError
+        - root.NotFoundError
+      examples:
+        - path-parameters:
+            id: 1
+            permission: permission
+          response:
+            body:
+              default_role: default_role
+              id: 1
+              label: label
+              options: options
+              organization: 1
+              permission: permission
+              roles:
+                - OW
+              tooltip: tooltip
+      audiences:
+        - public
+    replace:
+      path: /api/organizations/{id}/permissions/{permission}
+      method: PUT
+      auth: true
+      docs: >-
+        Replace the organization-level permission override for a given
+        permission key.
+      source:
+        openapi: openapi/openapi.yaml
+      path-parameters:
+        id:
+          type: integer
+          docs: A unique integer value identifying this organization.
+        permission:
+          type: string
+          docs: Permission key to update within the organization.
+      display-name: Replace organization permission override
+      request:
+        body: root.OrganizationPermissionRequest
+        content-type: application/json
+      response:
+        docs: ''
+        type: root.OrganizationPermission
+      errors:
+        - root.BadRequestError
+        - root.ForbiddenError
+        - root.NotFoundError
+      examples:
+        - path-parameters:
+            id: 1
+            permission: permission
+          request:
+            permission: permission
+          response:
+            body:
+              default_role: default_role
+              id: 1
+              label: label
+              options: options
+              organization: 1
+              permission: permission
+              roles:
+                - OW
+              tooltip: tooltip
+      audiences:
+        - public
+    delete:
+      path: /api/organizations/{id}/permissions/{permission}
+      method: DELETE
+      auth: true
+      source:
+        openapi: openapi/openapi.yaml
+      path-parameters:
+        id: integer
+        permission: string
+      display-name: Delete organization permission override
+      errors:
+        - root.ForbiddenError
+        - root.NotFoundError
+      examples:
+        - path-parameters:
+            id: 1
+            permission: permission
+      audiences:
+        - public
+    update:
+      path: /api/organizations/{id}/permissions/{permission}
+      method: PATCH
+      auth: true
+      docs: >-
+        Partially update the organization-level permission override for a given
+        permission key.
+      source:
+        openapi: openapi/openapi.yaml
+      path-parameters:
+        id: integer
+        permission: string
+      display-name: Update organization permission override
+      request:
+        name: PatchedOrganizationPermissionRequest
+        body:
+          properties:
+            permission:
+              type: optional<string>
+              name: patchedOrganizationPermissionRequestPermission
+            roles:
+              type: optional<list<root.Role9E7Enum>>
+              docs: >-
+                Explicit roles that have this permission within the
+                organization.
+        content-type: application/json
+      response:
+        docs: ''
+        type: root.OrganizationPermission
+      errors:
+        - root.BadRequestError
+        - root.ForbiddenError
+        - root.NotFoundError
+      examples:
+        - path-parameters:
+            id: 1
+            permission: permission
+          request: {}
+          response:
+            body:
+              default_role: default_role
+              id: 1
+              label: label
+              options: options
+              organization: 1
+              permission: permission
+              roles:
+                - OW
+              tooltip: tooltip
+      audiences:
+        - public
+  source:
+    openapi: openapi/openapi.yaml