feat(permissions): expose network permission state (#103)

crates/backend/src/dto.rs

@@ -16,7 +16,10 @@ use application::{
     ListProjectsOutput, LiveSessionKind, LiveSessionSnapshot, OpenProjectOutput, ProjectWorkState,
     StopLiveAgentOutput, TicketWorkSource, TicketWorkStatus, TurnPage, TurnSource, TurnView,
 };
-use domain::{AgentBusyState, PageCursor, PageDirection, Project, ProjectId, TurnRole};
+use domain::{
+    AgentBusyState, PageCursor, PageDirection, Project, ProjectId, ProjectSystemPermissions,
+    ResolvedAgentSystemPermissions, SystemPermissionSet, TurnRole,
+};
 
 pub use crate::ticket_dto::*;
 
@@ -1889,6 +1892,16 @@ pub struct ProjectPermissionsDto(pub ProjectPermissions);
 #[serde(transparent)]
 pub struct EffectivePermissionsDto(pub EffectivePermissions);
 
+/// Full project system permission document crossing the wire.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct ProjectSystemPermissionsDto(pub ProjectSystemPermissions);
+
+/// Resolved agent system permissions crossing the wire.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct ResolvedAgentSystemPermissionsDto(pub ResolvedAgentSystemPermissions);
+
 /// Canonical MCP tool catalogue classification crossing the wire.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -1959,6 +1972,38 @@ pub struct ResolveAgentPermissionsRequestDto {
     pub agent_id: String,
 }
 
+/// Request DTO for updating project default system permissions.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct UpdateProjectSystemPermissionsRequestDto {
+    /// Id of the owning project.
+    pub project_id: String,
+    /// New project defaults. `null` removes defaults.
+    pub permissions: Option<SystemPermissionSet>,
+}
+
+/// Request DTO for updating one agent system permission override.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct UpdateAgentSystemPermissionsRequestDto {
+    /// Id of the owning project.
+    pub project_id: String,
+    /// Target agent id.
+    pub agent_id: String,
+    /// New override. `null` removes the override.
+    pub permissions: Option<SystemPermissionSet>,
+}
+
+/// Request DTO for resolving one agent's effective system permissions.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ResolveAgentSystemPermissionsRequestDto {
+    /// Id of the owning project.
+    pub project_id: String,
+    /// Target agent id.
+    pub agent_id: String,
+}
+
 /// Request DTO for updating project default MCP tool permissions.
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase")]