Feat v0.7.7 api tokens ext permissions (#61)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/sandbox/permissions_module.go

@@ -0,0 +1,44 @@
+// Package sandbox — permissions_module.go
+//
+// Read-only module for checking user permissions from Starlark scripts.
+// No sandbox permission required — extensions can check whether a user
+// has a specific permission without needing any special grants.
+//
+// Starlark API:
+//   permissions.check(user_id, "image-gen.use")  → True/False
+package sandbox
+
+import (
+	"context"
+
+	"go.starlark.net/starlark"
+	"go.starlark.net/starlarkstruct"
+
+	"armature/auth"
+	"armature/store"
+)
+
+// BuildPermissionsModule creates the "permissions" module.
+// Always available to all extensions (no permission gate).
+func BuildPermissionsModule(ctx context.Context, stores store.Stores) *starlarkstruct.Module {
+	return MakeModule("permissions", starlark.StringDict{
+		"check": starlark.NewBuiltin("permissions.check", func(
+			thread *starlark.Thread, b *starlark.Builtin,
+			args starlark.Tuple, kwargs []starlark.Tuple,
+		) (starlark.Value, error) {
+			var userID, perm string
+			if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 2, &userID, &perm); err != nil {
+				return nil, err
+			}
+
+			perms, err := auth.ResolvePermissions(ctx, stores, userID)
+			if err != nil {
+				return starlark.False, nil
+			}
+			if perms[perm] {
+				return starlark.True, nil
+			}
+			return starlark.False, nil
+		}),
+	})
+}