Move working documents to its own area, rename dashboard

backend/app/models/client_access.py

@@ -30,6 +30,11 @@ class ClientAccount(Base):
         cascade="all, delete-orphan",
         order_by="ClientFeatureAccess.feature_group, ClientFeatureAccess.feature_name",
     )
+    audit_events: Mapped[list["ClientAccessAuditEvent"]] = relationship(
+        back_populates="client_account",
+        cascade="all, delete-orphan",
+        order_by="ClientAccessAuditEvent.created_at.desc()",
+    )
 
 
 class ClientUser(Base):
@@ -48,6 +53,11 @@ class ClientUser(Base):
     created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
 
     client_account: Mapped[ClientAccount] = relationship(back_populates="users")
+    module_permissions: Mapped[list["ClientUserModulePermission"]] = relationship(
+        back_populates="client_user",
+        cascade="all, delete-orphan",
+        order_by="ClientUserModulePermission.module_key",
+    )
 
 
 class ClientFeatureAccess(Base):
@@ -66,3 +76,39 @@ class ClientFeatureAccess(Base):
     created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
 
     client_account: Mapped[ClientAccount] = relationship(back_populates="features")
+
+
+class ClientUserModulePermission(Base):
+    __tablename__ = "client_user_module_permissions"
+    __table_args__ = (UniqueConstraint("client_user_id", "module_key", name="uq_client_user_module_permission"),)
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    tenant_id: Mapped[str] = mapped_column(String(64), default="default")
+    client_account_id: Mapped[int] = mapped_column(ForeignKey("client_accounts.id"), index=True)
+    client_user_id: Mapped[int] = mapped_column(ForeignKey("client_users.id"), index=True)
+    module_key: Mapped[str] = mapped_column(String(64))
+    access_level: Mapped[str] = mapped_column(String(32), default="none")
+    updated_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
+
+    client_user: Mapped[ClientUser] = relationship(back_populates="module_permissions")
+
+
+class ClientAccessAuditEvent(Base):
+    __tablename__ = "client_access_audit_events"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    tenant_id: Mapped[str] = mapped_column(String(64), default="default")
+    client_account_id: Mapped[int] = mapped_column(ForeignKey("client_accounts.id"), index=True)
+    actor_type: Mapped[str] = mapped_column(String(32), default="client")
+    actor_name: Mapped[str] = mapped_column(String(255))
+    actor_email: Mapped[str] = mapped_column(String(255))
+    actor_role: Mapped[str] = mapped_column(String(64))
+    action: Mapped[str] = mapped_column(String(128))
+    target_type: Mapped[str] = mapped_column(String(64))
+    target_id: Mapped[int | None] = mapped_column(nullable=True)
+    module_key: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    summary: Mapped[str] = mapped_column(Text)
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
+
+    client_account: Mapped[ClientAccount] = relationship(back_populates="audit_events")