Role Assignment Service
Component Detail
Service Layer
medium complexity
backend
1
Dependencies
1
Dependents
10
Entities
0
Integrations
Description
Backend service encapsulating role assignment business logic. Validates role changes against the permission hierarchy (e.g., Org Admin cannot grant Global Admin), persists assignments to user_role_assignments, and updates the roles_updated_at timestamp to trigger JWT re-validation on the user's next token refresh.
role-assignment-service
Responsibilities
- Validate role assignment requests against escalation rules
- Persist role changes to user_role_assignments table
- Update roles_updated_at timestamp to invalidate existing JWTs
- Enforce deny-by-default access model for all role transitions
- Log role changes to audit trail
Interfaces
assignRole(userId: string, roleId: string, assignedBy: string): Promise<RoleAssignment>
revokeRole(userId: string, roleId: string, revokedBy: string): Promise<void>
getUserRoles(userId: string): Promise<UserRole[]>
getAssignableRoles(requesterId: string): Promise<Role[]>
validateRoleEscalation(requesterId: string, targetRoleId: string): boolean
getRoleChangeHistory(userId: string): Promise<RoleChangeLog[]>
bulkAssignRole(userIds: string[], roleId: string, assignedBy: string): Promise<BulkResult>
Relationships
Related Data Entities (10)
Data entities managed by this component