OSS-first docs

These docs teach the open system first: contracts, generated surfaces, runtimes, governance, and incremental adoption. Studio shows up as the operating layer on top, not as the source of truth.

AI index

identity.rbac.revoke

Revoke a role from a user or organization.

  • Type: operation (command)
  • Version: 1.0.0
  • Stability: stable
  • Owners: @platform.identity-rbac
  • Tags: identity, rbac, revoke
  • File: packages/libs/identity-rbac/src/contracts/rbac.ts
    • field.key.label
    identity.rbac.revoke
    field.version.label
    1.0.0
    field.type.label
    operation (command)
    field.title.label
    identity.rbac.revoke
    field.description.label

    Revoke a role from a user or organization.

  • Type: operation (command)
  • Version: 1.0.0
  • Stability: stable
  • Owners: @platform.identity-rbac
  • Tags: identity, rbac, revoke
  • File: packages/libs/identity-rbac/src/contracts/rbac.ts
    • field.tags.label
    identity,rbac,revoke
    field.owners.label
    @platform.identity-rbac
    field.stability.label
    stable

    Revoke a role from a user or organization.

    Goal

    Remove permissions via role revocation.

    Context

    User/org permission management.

    Emitted Events

    •

    `role.revoked` (v1.0.0)

    Source Definition

    import { defineCommand, defineQuery } from '@lssm-tech/lib.contracts-spec';
import { ScalarTypeEnum, SchemaModel } from '@lssm-tech/lib.schema';
import { SuccessResultModel } from './user';

export const RevokeRoleContract = defineCommand({
	meta: {
		key: 'identity.rbac.revoke',
		version: '1.0.0',
		stability: 'stable',
		owners: ['@platform.identity-rbac'],
		tags: ['identity', 'rbac', 'revoke'],
		description: 'Revoke a role from a user or organization.',
		goal: 'Remove permissions via role revocation.',
		context: 'User/org permission management.',
	},
	io: {
		input: RevokeRoleInputModel,
		output: SuccessResultModel,
		errors: {
			BINDING_NOT_FOUND: {
				description: 'The policy binding does not exist',
				http: 404,
				gqlCode: 'BINDING_NOT_FOUND',
				when: 'Binding ID is invalid',
			},
		},
	},
	policy: {
		auth: 'admin',
	},
	sideEffects: {
		emits: [
			{
				key: 'role.revoked',
				version: '1.0.0',
				when: 'Role is revoked',
				payload: BindingIdPayloadModel,
			},
		],
		audit: ['role.revoked'],
	},
});