1import { defineCommand, defineQuery } from '@lssm-tech/lib.contracts-spec';
2import { ScalarTypeEnum, SchemaModel } from '@lssm-tech/lib.schema';
3import { SuccessResultModel } from './user';
4
5export const AssignRoleContract = defineCommand({
6	meta: {
7		key: 'identity.rbac.assign',
8		version: '1.0.0',
9		stability: 'stable',
10		owners: ['@platform.identity-rbac'],
11		tags: ['identity', 'rbac', 'assign'],
12		description: 'Assign a role to a user or organization.',
13		goal: 'Grant permissions via role assignment.',
14		context: 'User/org permission management.',
15	},
16	io: {
17		input: AssignRoleInputModel,
18		output: PolicyBindingModel,
19		errors: {
20			ROLE_NOT_FOUND: {
21				description: 'The specified role does not exist',
22				http: 404,
23				gqlCode: 'ROLE_NOT_FOUND',
24				when: 'Role ID is invalid',
25			},
26			ALREADY_ASSIGNED: {
27				description: 'This role is already assigned to the target',
28				http: 409,
29				gqlCode: 'ALREADY_ASSIGNED',
30				when: 'Binding already exists',
31			},
32		},
33	},
34	policy: {
35		auth: 'admin',
36	},
37	sideEffects: {
38		emits: [
39			{
40				key: 'role.assigned',
41				version: '1.0.0',
42				when: 'Role is assigned',
43				payload: PolicyBindingModel,
44			},
45		],
46		audit: ['role.assigned'],
47	},
48});