feat: namespace plugin permissions and keep them valid when a plugin is off

plugins/tailscale/manifest.json

@@ -21,10 +21,13 @@
     "ui:surface"
   ],
   "contributes": {
-    "permissionGroup": {
-      "group": "tailscale",
-      "permissions": ["tailscale.devices.view"]
-    }
+    "permissions": [
+      {
+        "name": "devices.view",
+        "titleKey": "permissions.devices.view.title",
+        "descriptionKey": "permissions.devices.view.description"
+      }
+    ]
   },
   "locales": "locales",
   "platforms": ["linux", "win32", "darwin"]

plugins/tailscale/tests/backend/permissions.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import { parseManifest, qualifyPermission } from "@termix/plugin-sdk/manifest";
+
+/**
+ * The permission ids an admin grants.
+ *
+ * Core registers each declared name as `<pluginId>.<name>`, so these strings
+ * are what end up stored in a role. They have to keep matching what tailscale
+ * shipped before the permissions moved out of the core catalog, or every role
+ * holding one would silently stop working.
+ */
+const EXPECTED = ["tailscale.devices.view"];
+
+describe("tailscale permissions", () => {
+  const manifest = parseManifest(
+    JSON.parse(
+      fs.readFileSync(
+        path.resolve(import.meta.dirname, "../../manifest.json"),
+        "utf8",
+      ),
+    ),
+  );
+
+  it("parses cleanly", () => {
+    expect(manifest.errors).toEqual([]);
+  });
+
+  it("registers exactly the ids roles already hold", () => {
+    const ids = (manifest.manifest?.contributes?.permissions ?? []).map(
+      (permission) => qualifyPermission("tailscale", permission.name),
+    );
+
+    expect(ids).toEqual(EXPECTED);
+  });
+
+  it("declares a title and description for every permission", () => {
+    for (const permission of manifest.manifest?.contributes?.permissions ??
+      []) {
+      expect(permission.titleKey).toBeTruthy();
+      expect(permission.descriptionKey).toBeTruthy();
+    }
+  });
+
+  // No wildcard covered tailscale in SYSTEM_ROLE_DEFAULTS, so nothing is
+  // granted by default and an admin has to opt in.
+  it("grants nothing by default", () => {
+    for (const permission of manifest.manifest?.contributes?.permissions ??
+      []) {
+      expect(permission.defaultRoles).toBeUndefined();
+    }
+  });
+});