refactor(role): use grant only

- remove permission centric mode
    - finalize migration drop all tables with permissions
    - ensure roles are ENUM (owner is always displayed first)

static/js/components/shareModal.js

@@ -73,23 +73,6 @@ function _looksLikeEmail(q) {
     return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(q);
 }
 
-/**
- * Permissions that belong to each role (mirrors `Role::expand()` in
- * `src/application/dtos/grant_dto.rs`). The share modal only renders
- * Viewer/Editor/Owner as picker buttons today; `commenter` and
- * `contributor` are kept here for fidelity with the server-side enum so
- * a future UI exposure doesn't need a mirror-table update. The `manage`
- * permission in the owner bundle is reserved for Drive- and Group-level
- * admin actions (no-op on file/folder resources).
- */
-const ROLE_PERMISSIONS = {
-    viewer: ['read'],
-    commenter: ['read', 'comment'],
-    contributor: ['read', 'create'],
-    editor: ['read', 'comment', 'create', 'update'],
-    owner: ['read', 'comment', 'create', 'update', 'share', 'delete', 'manage']
-};
-
 /**
  * Fetch up to ~8 ReBAC subject groups whose name matches `q`. Authenticated
  * endpoint; returns `[]` on any failure so the autocomplete degrades to
@@ -117,14 +100,20 @@ async function _searchGroups(q) {
 }
 
 /**
- * Derive the highest role a set of grants represents for one subject.
+ * Pick the displayed role for a member row. Server-side every Grant
+ * carries an explicit role since the cleanup PR, so this just reads it.
+ * The server may emit `commenter` or `contributor` (full enum), but the
+ * picker only exposes Viewer/Editor/Owner — collapse the two unexposed
+ * roles to the closest neighbour so the UI never renders an unknown
+ * option.
  * @param {Grant[]} subjectGrants
  * @returns {ShareRoleEnum}
  */
 function _roleFromGrants(subjectGrants) {
-    const perms = new Set(subjectGrants.map((g) => g.permission));
-    if (perms.has('delete') || perms.has('share')) return 'owner';
-    if (perms.has('create') || perms.has('update')) return 'editor';
+    const role = subjectGrants[0]?.role;
+    if (role === 'owner' || role === 'editor' || role === 'viewer') return role;
+    if (role === 'commenter') return 'viewer';
+    if (role === 'contributor') return 'editor';
     return 'viewer';
 }
 
@@ -616,7 +605,7 @@ const shareModal = {
                 granted_at: '',
                 granted_by: '',
                 subject: { type: subjectType, id: contact.id },
-                permission: /** @type {import('../core/types.js').PermissionTypeEnum} */ (ROLE_PERMISSIONS[this._stagedRole][0]),
+                role: this._stagedRole,
                 resource: { type: this._itemType, id: this._item?.id ?? '' }
             };
             this._localMembers.push({

static/js/core/types.js

@@ -302,21 +302,27 @@
  * @property {String} id
  */
 
+/**
+ * Server-side role enum — every grantable role the backend recognises.
+ * The share modal's UI picker only exposes a subset (see `ShareRoleEnum`);
+ * the wire format may carry any of these values on a Grant.
+ * @typedef {'viewer'|'commenter'|'contributor'|'editor'|'owner'} GrantRoleEnum
+ */
+
 /**
  * @typedef {Object} Grant
  * @property {string} id
  * @property {string} granted_at  - ISO-8601 datetime string.
  * @property {string} granted_by
  * @property {Subject} subject
- * @property {PermissionTypeEnum} permission
+ * @property {GrantRoleEnum} role - Role-keyed grant. One Grant = one role
+ *   assignment in `storage.role_grants`. The implied permission bundle
+ *   is derived client-side from the same lookup table used by
+ *   `Role::expand()` on the server (see `ROLE_PERMISSIONS` in shareModal).
  * @property {Resource} resource
  * @property {string|null} [expires_at]  - ISO-8601 datetime string, or absent/null for no expiry.
  */
 
-/**
- * Roles: `viewer`, `commenter`, `editor`, `manager`, `admin`
- */
-
 /**
  * Configuration for `ResourceListComponent`.
  * @typedef {Object} ResourceListConfig
@@ -367,7 +373,7 @@
  * @property {'user'|'group'|'token'|'external'}   subject_type
  * @property {string}                              subject_id
  * @property {string}                              subject_display - Username (users) or share name (tokens).
- * @property {'viewer'|'commenter'|'contributor'|'editor'|'owner'} role - Server-emitted role string. `commenter` and `contributor` are reserved for future UI exposure; today the share modal only renders `viewer`/`editor`/`owner` (see `ShareRoleEnum`).
+ * @property {GrantRoleEnum} role - Server-emitted role string. `commenter` and `contributor` are reserved for future UI exposure; today the share modal only renders `viewer`/`editor`/`owner` (see `ShareRoleEnum`).
  * @property {string}                              granted_at   - ISO-8601
  * @property {string|null}                         [expires_at] - ISO-8601 or absent.
  * @property {boolean}                             has_password - True when a token subject has a password set.
@@ -464,7 +470,11 @@
  * One collaborator row in the share modal's People section.
  * @typedef {Object} MemberEntry
  * @property {Grant}         grant   - Representative grant (used for subject/resource info).
- * @property {Grant[]}       _grants - All grants for this subject on the resource (may be > 1).
+ * @property {Grant[]}       _grants - All grants for this subject on the resource. Post-pivot
+ *   this is at most one entry (`storage.role_grants` UNIQUE on
+ *   `(subject, resource)`); the array shape is preserved so the existing
+ *   "revoke every grant on remove" loop in `_applyAll` still works
+ *   without a special-case for empty / new entries.
  * @property {ShareRoleEnum} role    - Derived role label shown in the UI.
  * @property {'keep'|'remove'|'change'|'new'} _op - Pending local operation.
  * @property {string|null}  [expires_at]  - YYYY-MM-DD expiry date string, or null for no expiry.

static/js/model/grants.js

@@ -164,7 +164,9 @@ const grants = {
 
     /**
      * Create a new grant.
-     * Body mirrors `CreateGrantDto`: `{ subject, resource, role }` OR `{ subject, resource, permissions }`.
+     * Body mirrors `CreateGrantDto`: `{ subject, resource, role, expires_at? }`.
+     * Strictly role-keyed since the cleanup PR — the per-permission shape
+     * is no longer accepted.
      *
      * Response shape (PR N1 — `CreateGrantResponseDto`):
      *