chore: stage changes before history rewrite

app/models.py

@@ -109,7 +109,41 @@ class ApiKey(Base):
     name = Column(String(64), nullable=False, default="")
     user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
     is_active = Column(Boolean, nullable=False, default=True)
+    permissions = Column(Text, nullable=False, default="[]")
     created_at = Column(DateTime, default=_utcnow)
     last_used_at = Column(DateTime, nullable=True)
 
     user = relationship("User", back_populates="api_keys")
+
+
+class SystemConfig(Base):
+    __tablename__ = "system_config"
+
+    key = Column(String(64), primary_key=True)
+    value = Column(Text, nullable=False, default="")
+    updated_at = Column(DateTime, default=_utcnow, onupdate=_utcnow)
+
+
+# ─── API Key Permission System ───────────────────────────────────
+
+# Scopes: "resource:action"
+# Empty list [] means full access (backward compatible).
+PERM_PROFILES_READ = "profiles:read"
+PERM_PROFILES_WRITE = "profiles:write"
+PERM_POSTCARDS_READ = "postcards:read"
+PERM_POSTCARDS_WRITE = "postcards:write"
+PERM_IMAGES_UPLOAD = "images:upload"
+
+ALL_PERMISSIONS = [
+    PERM_PROFILES_READ,
+    PERM_PROFILES_WRITE,
+    PERM_POSTCARDS_READ,
+    PERM_POSTCARDS_WRITE,
+    PERM_IMAGES_UPLOAD,
+]
+
+PERMISSION_GROUPS: dict[str, list[str]] = {
+    "profiles": [PERM_PROFILES_READ, PERM_PROFILES_WRITE],
+    "postcards": [PERM_POSTCARDS_READ, PERM_POSTCARDS_WRITE],
+    "images": [PERM_IMAGES_UPLOAD],
+}