assign role roles

lib/Service/Access/AccessRepositoryFactory.php

@@ -4,6 +4,8 @@ namespace MintyPHP\Service\Access;
 
 use MintyPHP\Repository\Access\PermissionRepository;
 use MintyPHP\Repository\Access\PermissionRepositoryInterface;
+use MintyPHP\Repository\Access\RoleAssignableRoleRepository;
+use MintyPHP\Repository\Access\RoleAssignableRoleRepositoryInterface;
 use MintyPHP\Repository\Access\RolePermissionRepository;
 use MintyPHP\Repository\Access\RolePermissionRepositoryInterface;
 use MintyPHP\Repository\Access\UserRoleRepository;
@@ -13,6 +15,7 @@ class AccessRepositoryFactory
 {
     private ?PermissionRepository $permissionRepository = null;
     private ?RolePermissionRepository $rolePermissionRepository = null;
+    private ?RoleAssignableRoleRepository $roleAssignableRoleRepository = null;
     private ?UserRoleRepository $userRoleRepository = null;
 
     public function createPermissionRepository(): PermissionRepositoryInterface
@@ -25,6 +28,11 @@ class AccessRepositoryFactory
         return $this->rolePermissionRepository ??= new RolePermissionRepository();
     }
 
+    public function createRoleAssignableRoleRepository(): RoleAssignableRoleRepositoryInterface
+    {
+        return $this->roleAssignableRoleRepository ??= new RoleAssignableRoleRepository();
+    }
+
     public function createUserRoleRepository(): UserRoleRepositoryInterface
     {
         return $this->userRoleRepository ??= new UserRoleRepository();

lib/Service/Access/AccessServicesFactory.php

@@ -3,6 +3,7 @@
 namespace MintyPHP\Service\Access;
 
 use MintyPHP\Repository\Access\PermissionRepositoryInterface;
+use MintyPHP\Repository\Access\RoleAssignableRoleRepositoryInterface;
 use MintyPHP\Repository\Access\RolePermissionRepositoryInterface;
 use MintyPHP\Repository\Access\UserRoleRepositoryInterface;
 
@@ -34,6 +35,11 @@ class AccessServicesFactory
         return $this->accessRepositoryFactory->createUserRoleRepository();
     }
 
+    public function createRoleAssignableRoleRepository(): RoleAssignableRoleRepositoryInterface
+    {
+        return $this->accessRepositoryFactory->createRoleAssignableRoleRepository();
+    }
+
     public function createPermissionService(): PermissionService
     {
         return $this->accessGatewayFactory->createPermissionService();

lib/Service/Access/AssignableRoleService.php

@@ -0,0 +1,101 @@
+<?php
+
+namespace MintyPHP\Service\Access;
+
+use MintyPHP\Repository\Access\RoleAssignableRoleRepositoryInterface;
+use MintyPHP\Repository\Access\RoleRepositoryInterface;
+use MintyPHP\Repository\Access\UserRoleRepositoryInterface;
+use MintyPHP\Service\Audit\SystemAuditService;
+
+class AssignableRoleService
+{
+    public function __construct(
+        private readonly RoleAssignableRoleRepositoryInterface $assignableRoleRepository,
+        private readonly UserRoleRepositoryInterface $userRoleRepository,
+        private readonly PermissionService $permissionService,
+        private readonly RoleRepositoryInterface $roleRepository,
+        private readonly SystemAuditService $systemAuditService
+    ) {
+    }
+
+    /**
+     * Returns role IDs the given actor is allowed to assign.
+     * Users with 'roles.assign_all' get all active role IDs.
+     * Otherwise: union of assignable_role_ids from all of the actor's roles.
+     *
+     * @return int[]
+     */
+    public function listAssignableRoleIdsForActor(int $actorUserId): array
+    {
+        if ($actorUserId <= 0) {
+            return [];
+        }
+
+        if ($this->permissionService->userHas($actorUserId, PermissionService::ROLES_ASSIGN_ALL)) {
+            return $this->roleRepository->listActiveIds();
+        }
+
+        $actorRoleIds = $this->userRoleRepository->listRoleIdsByUserId($actorUserId);
+        if (!$actorRoleIds) {
+            return [];
+        }
+
+        return $this->assignableRoleRepository->listAssignableRoleIdsByRoleIds($actorRoleIds);
+    }
+
+    /**
+     * Computes the effective role set respecting the actor's assignable scope.
+     *
+     * Roles the actor cannot assign are "frozen" — they remain as-is.
+     *   frozen  = currentIds ∩ NOT-assignable
+     *   touched = submittedIds ∩ assignable
+     *   result  = frozen ∪ touched
+     *
+     * @param int[] $submittedIds Role IDs the form submitted
+     * @param int[] $currentIds   Role IDs the target user currently has
+     * @return int[]
+     */
+    public function computeEffectiveRoleIds(int $actorUserId, array $submittedIds, array $currentIds): array
+    {
+        $assignable = $this->listAssignableRoleIdsForActor($actorUserId);
+        $assignableMap = array_fill_keys($assignable, true);
+
+        // Roles the actor cannot touch — keep them as they are.
+        $frozen = array_values(array_filter(
+            $currentIds,
+            static fn (int $id): bool => !isset($assignableMap[$id])
+        ));
+
+        // From the submitted set, only keep roles the actor is allowed to assign.
+        $touched = array_values(array_filter(
+            $submittedIds,
+            static fn (int $id): bool => isset($assignableMap[$id])
+        ));
+
+        return array_values(array_unique(array_merge($frozen, $touched)));
+    }
+
+    /**
+     * Saves which roles this role can assign (admin UI) and logs the change.
+     *
+     * @param int[] $assignableRoleIds
+     */
+    public function replaceAssignableRoles(int $roleId, array $assignableRoleIds, int $actorUserId): bool
+    {
+        $beforeIds = $this->assignableRoleRepository->listAssignableRoleIdsByRoleId($roleId);
+        $result = $this->assignableRoleRepository->replaceForRole($roleId, $assignableRoleIds);
+
+        $afterIds = $this->assignableRoleRepository->listAssignableRoleIdsByRoleId($roleId);
+        if ($beforeIds !== $afterIds) {
+            $this->systemAuditService->record('admin.roles.assignable_roles.update', 'success', [
+                'actor_user_id' => $actorUserId > 0 ? $actorUserId : null,
+                'target_type' => 'role',
+                'target_id' => $roleId,
+                'before' => ['assignable_role_ids' => $beforeIds],
+                'after' => ['assignable_role_ids' => $afterIds],
+            ]);
+        }
+
+        return $result;
+    }
+}

lib/Service/Access/PermissionService.php

@@ -45,6 +45,7 @@ class PermissionService
     public const ROLES_CREATE = 'roles.create';
     public const ROLES_UPDATE = 'roles.update';
     public const ROLES_DELETE = 'roles.delete';
+    public const ROLES_ASSIGN_ALL = 'roles.assign_all';
     public const PERMISSIONS_VIEW = 'permissions.view';
     public const PERMISSIONS_CREATE = 'permissions.create';
     public const PERMISSIONS_UPDATE = 'permissions.update';