fix(intent): generate enforced default roles per entity (#6331)

EdmIntentGenerator hardcoded generateDefaultRoles="false" and never wrote
roleRead/roleWrite, so intent-generated apps had no access control: every
generated REST controller was open and default-roles.roles was empty.

Emit generateDefaultRoles="true" plus the standard
<project>.<perspective>.<Entity>ReadOnly / FullAccess role names for every
real (controller-backed) entity, mirroring the EDM editor's "Generate Default
Roles" checkbox. The perspective segment is the entity's resolved perspective
(resolvePerspective): its own name for a top-level entity, its parent's for a
composition child, and its own name for a setting too (never the "Settings"
shell grouping) - consistent with how regular entities name their roles. The
downstream template-application-rest-java template already consumes this
metadata to emit checkPermissions() and default-roles.roles; no template
change is needed. PROJECTION entities stay unsecured (read-only). The .edm XML
carries the attributes too so a generated .edm opens with the box checked.

Covered by EdmIntentGeneratorTest (regular + setting entity role names,
PROJECTION-stays-false) and IntentEngineIT (model/edm role assertions incl.
the setting entity not using the Settings perspective).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: NicoleNG18

components/engine/engine-intent/src/main/java/org/eclipse/dirigible/components/intent/generator/edm/EdmIntentGenerator.java

@@ -153,6 +153,7 @@ private static EdmDocument buildDocument(IntentGenerationContext context, Intent
         List<Map<String, Object>> entityList = new ArrayList<>();
         List<Map<String, Object>> perspectiveList = new ArrayList<>();
         String tablePrefix = IntentNaming.upperSnake(intentName);
+        String projectName = context != null && notBlank(context.getProjectName()) ? context.getProjectName() : intentName;
         // Document (header-items) layout: a master that owns a composition child whose name ends in
         // "Item" (SalesInvoice -> SalesInvoiceItem) renders as a document - header form, inline items
         // table, totals footer - rather than the default master-detail. Maps master -> its items entity.
@@ -175,8 +176,9 @@ private static EdmDocument buildDocument(IntentGenerationContext context, Intent
             // A setting lives under the global Settings perspective (provided by the shell); it does not
             // own a generated perspective.
             String perspective = perspectiveFor(name, compositionParents, settingEntities);
+            String rolePerspective = resolvePerspective(name, compositionParents);
             Map<String, Object> entityMap = entityDefaults(name, entity.getDescription(), entity.getIcon(), dependent, setting, perspective,
-                    tablePrefix, perspectiveOrder);
+                    tablePrefix, perspectiveOrder, projectName, rolePerspective);
             // A navigation-group id makes the generated perspective nest under that group in the shared
             // application shell (the standalone shell is unaffected). Defaults to empty (top-level).
             if (notBlank(entity.getGroup())) {
@@ -740,7 +742,7 @@ private static Map<String, Object> perspectiveEntry(String name, int order, Stri
     }
 
     private static Map<String, Object> entityDefaults(String name, String description, String icon, boolean dependent, boolean setting,
-            String perspective, String tablePrefix, int order) {
+            String perspective, String tablePrefix, int order, String projectName, String rolePerspective) {
         String dataName = tablePrefix + "_" + IntentNaming.upperSnake(name);
         Map<String, Object> entity = new LinkedHashMap<>();
         entity.put("name", name);
@@ -771,7 +773,9 @@ private static Map<String, Object> entityDefaults(String name, String descriptio
         entity.put("perspectiveNavId", "");
         entity.put("perspectiveRole", "");
         entity.put("generateReport", "false");
-        entity.put("generateDefaultRoles", "false");
+        entity.put("generateDefaultRoles", "true");
+        entity.put("roleRead", projectName + "." + rolePerspective + "." + name + "ReadOnly");
+        entity.put("roleWrite", projectName + "." + rolePerspective + "." + name + "FullAccess");
         return entity;
     }
 
@@ -1972,7 +1976,7 @@ private static void appendEntityValue(StringBuilder sb, Map<String, Object> enti
             appendAttribute(sb, "entityType", entityType);
         }
         for (String key : new String[] {"dataName", "dataCount", "dataQuery", "title", "caption", "description", "tooltip", "menuKey",
-                "menuLabel", "layoutType", "perspectiveName", "importsCode"}) {
+                "menuLabel", "layoutType", "perspectiveName", "importsCode", "generateDefaultRoles", "roleRead", "roleWrite"}) {
             if (entity.get(key) != null) {
                 appendAttribute(sb, key, entity.get(key));
             }

components/engine/engine-intent/src/test/java/org/eclipse/dirigible/components/intent/generator/edm/EdmIntentGeneratorTest.java

@@ -47,8 +47,11 @@ void customerEmitsCrossModelProjectionsAndForeignKeys() {
         assertEquals("Country", country.get("projectionReferencedEntity"));
         // A projection must stay out of this app's navigation - no perspective.
         assertEquals("", country.get("perspectiveName"));
+        assertEquals("false", country.get("generateDefaultRoles"));
+        assertNull(country.get("roleRead"));
 
         Map<String, Object> customer = entityByName(entities, "Customer");
+        assertEquals("true", customer.get("generateDefaultRoles"));
         Map<String, Object> countryFk = propertyByName(customer, "Country");
         assertEquals("INTEGER", countryFk.get("dataType"));
         assertEquals("DROPDOWN", countryFk.get("widgetType"));
@@ -253,6 +256,38 @@ void immutableWhenEmitsStatusGuardAttributes() {
         assertEquals("2,3", entry.get("immutableStatusValues"));
     }
 
+    @Test
+    void securedByDefaultEmitsGenerateDefaultRolesAndRoleNames() {
+        String yaml = """
+                name: library
+                entities:
+                  - name: Genre
+                    kind: setting
+                    fields:
+                      - { name: id, type: integer, primaryKey: true, generated: true }
+                      - { name: name, type: string }
+                  - name: Book
+                    fields:
+                      - { name: id, type: integer, primaryKey: true, generated: true }
+                      - { name: title, type: string, required: true }
+                    relations:
+                      - { name: Genre, kind: manyToOne, to: Genre }
+                """;
+        Map<String, Object> model = EdmIntentGenerator.buildModelJsonForTest(IntentParser.parse(yaml), "library");
+        List<Map<String, Object>> entities = entities(model);
+
+        Map<String, Object> book = entityByName(entities, "Book");
+        assertEquals("true", book.get("generateDefaultRoles"));
+        assertEquals("library.Book.BookReadOnly", book.get("roleRead"));
+        assertEquals("library.Book.BookFullAccess", book.get("roleWrite"));
+
+        Map<String, Object> genre = entityByName(entities, "Genre");
+        assertEquals("true", genre.get("generateDefaultRoles"));
+        assertEquals("Settings", genre.get("perspectiveName"));
+        assertEquals("library.Genre.GenreReadOnly", genre.get("roleRead"));
+        assertEquals("library.Genre.GenreFullAccess", genre.get("roleWrite"));
+    }
+
     @Test
     void hierarchyEmitsTreeAndLeafOnlyAttributes() {
         String yaml = """

tests/tests-integrations/src/main/java/org/eclipse/dirigible/integration/tests/api/IntentEngineIT.java

@@ -1825,6 +1825,16 @@ private void assertEdmAndModel() {
         assertTrue(edmXml.contains("isReadOnlyProperty=\"true\""),
                 "system fields (ProcessId, audit columns) should be flagged read-only so forms render them in the read-only details block");
 
+        assertTrue(edmXml.contains("generateDefaultRoles=\"true\""),
+                "entities should carry generateDefaultRoles=\"true\" so the REST template enforces access control");
+        assertTrue(edmXml.contains("roleRead=\"") && edmXml.contains("OrderReadOnly\""),
+                "a secured entity must carry a roleRead (<project>.<perspective>.<Entity>ReadOnly)");
+        assertTrue(edmXml.contains("roleWrite=\"") && edmXml.contains("OrderFullAccess\""),
+                "a secured entity must carry a roleWrite (<project>.<perspective>.<Entity>FullAccess)");
+        assertTrue(edmXml.contains(".Country.CountryReadOnly\""),
+                "a setting entity's role must use its own domain perspective (Country), like the codbex convention");
+        assertFalse(edmXml.contains(".Settings.CountryReadOnly\""), "a setting entity's role must NOT use the Settings shell perspective");
+
         // The EDM editor renders the canvas ONLY from mxGraphModel - without it the editor opens
         // empty. Assert the diagram block, an entity vertex, and a relation edge are present.
         assertTrue(edmXml.contains("<mxGraphModel>"), "EDM must carry an mxGraphModel diagram or the editor renders an empty canvas");
@@ -1836,6 +1846,8 @@ private void assertEdmAndModel() {
         assertTrue(resource("orders.model").exists(), "orders.model should be generated");
         String modelBody = contentOf("orders.model");
         assertTrue(modelBody.contains("\"entities\""), "model JSON should have an entities array");
+        assertTrue(modelBody.contains("\"generateDefaultRoles\": \"true\"") && modelBody.contains("OrderFullAccess"),
+                "the .model JSON (which drives generation) must carry generateDefaultRoles + the role names");
         assertTrue(modelBody.contains("\"perspectives\""), "model JSON should carry the perspectives array like editor-written files");
         assertTrue(modelBody.contains("\"navigations\""), "model JSON should carry the navigations array like editor-written files");
         // Process glue (triggers, resolvers) is NOT in the EDM model - it lives in the .glue file.