ores.iam.role

A named collection of permissions that can be assigned to accounts. Roles group related permissions for easier management: a "Trading" role might include permissions to read and execute trades, while a "Support" role might have read-only access to most resources.

The table is bi-temporal and audited (see projects/ores.sql/create/iam/iam_roles_create.sql): it carries version, the four audit columns and the valid_from=/=valid_to pair with the GIST exclusion and the delete rule, so the model takes the ordinary audited shape and needs no shape flag.

The model describes the table alone. The hand-written domain struct also carried a std::vector<std::string> permission_codes that no column backs – it is denormalised from ores_iam_role_permissions_tbl by an RBAC join. A joined shape is a message or a query result, never an entity member, so the member is not modelled and the generated role.hpp replaces it; the join itself stays in the hand-written authorization layer.

The entity's canonical CRUD subjects are generated: role_registrar owns list/get/get-many/put/put-many/delete on iam.v1.roles.*. The authorization operation model declares a different set under the same prefix – iam.v1.ops.assign_role, .revoke, .by-account, .permissions and .suggest-commands – so the two coexist rather than compete, and no handler is suppressed here.

The list and the get are open to every signed-in member: a member reads the tenant's roles to choose the one to ask for. The model opens them by subject with :open_reads:, and Authorised reads allow-lists both. The other reads, such as the versions, need iam::roles:read.

std::string("Role_") + ctx.alphanumeric(6)

std::string("Synthetic test role")

false

true

std::vector<domain::role> read_latest_by_name(context ctx, const std::string& name);

std::vector<domain::role>
role_repository::read_latest_by_name(context ctx, const std::string& name) {
    static constexpr auto max = db_timestamp::max();
    const auto tid = ctx.tenant_id().to_string();
    const auto query = query_builder::read<std::vector<role_entity>> |
                       query_builder::where("tenant_id"_c == tid && "name"_c == name &&
                             "valid_to"_c == max);

    return query_builder::execute_read_query<role_entity, domain::role>(
        ctx,
        query,
        [](const auto& entities) { return role_mapper::map(entities); },
        lg(),
        "Reading latest role by name.");
}

std::optional<domain::role> read_registration_default(context ctx);

std::optional<domain::role>
role_repository::read_registration_default(context ctx) {
    static constexpr auto max = db_timestamp::max();
    const auto tid = ctx.tenant_id().to_string();
    const auto query = query_builder::read<std::vector<role_entity>> |
                       query_builder::where("tenant_id"_c == tid && "is_registration_default"_c == true &&
                             "valid_to"_c == max) |
                       query_builder::limit(1);

    const auto rows = query_builder::execute_read_query<role_entity, domain::role>(
        ctx,
        query,
        [](const auto& entities) { return role_mapper::map(entities); },
        lg(),
        "Reading the registration default role.");
    if (rows.empty())
        return std::nullopt;
    return rows.front();
}

#include <boost/uuid/uuid.hpp>
#include <string>

#include <string>