assign role roles

lib/Service/Access/AssignableRoleService.php

@@ -0,0 +1,101 @@
+<?php
+
+namespace MintyPHP\Service\Access;
+
+use MintyPHP\Repository\Access\RoleAssignableRoleRepositoryInterface;
+use MintyPHP\Repository\Access\RoleRepositoryInterface;
+use MintyPHP\Repository\Access\UserRoleRepositoryInterface;
+use MintyPHP\Service\Audit\SystemAuditService;
+
+class AssignableRoleService
+{
+    public function __construct(
+        private readonly RoleAssignableRoleRepositoryInterface $assignableRoleRepository,
+        private readonly UserRoleRepositoryInterface $userRoleRepository,
+        private readonly PermissionService $permissionService,
+        private readonly RoleRepositoryInterface $roleRepository,
+        private readonly SystemAuditService $systemAuditService
+    ) {
+    }
+
+    /**
+     * Returns role IDs the given actor is allowed to assign.
+     * Users with 'roles.assign_all' get all active role IDs.
+     * Otherwise: union of assignable_role_ids from all of the actor's roles.
+     *
+     * @return int[]
+     */
+    public function listAssignableRoleIdsForActor(int $actorUserId): array
+    {
+        if ($actorUserId <= 0) {
+            return [];
+        }
+
+        if ($this->permissionService->userHas($actorUserId, PermissionService::ROLES_ASSIGN_ALL)) {
+            return $this->roleRepository->listActiveIds();
+        }
+
+        $actorRoleIds = $this->userRoleRepository->listRoleIdsByUserId($actorUserId);
+        if (!$actorRoleIds) {
+            return [];
+        }
+
+        return $this->assignableRoleRepository->listAssignableRoleIdsByRoleIds($actorRoleIds);
+    }
+
+    /**
+     * Computes the effective role set respecting the actor's assignable scope.
+     *
+     * Roles the actor cannot assign are "frozen" — they remain as-is.
+     *   frozen  = currentIds ∩ NOT-assignable
+     *   touched = submittedIds ∩ assignable
+     *   result  = frozen ∪ touched
+     *
+     * @param int[] $submittedIds Role IDs the form submitted
+     * @param int[] $currentIds   Role IDs the target user currently has
+     * @return int[]
+     */
+    public function computeEffectiveRoleIds(int $actorUserId, array $submittedIds, array $currentIds): array
+    {
+        $assignable = $this->listAssignableRoleIdsForActor($actorUserId);
+        $assignableMap = array_fill_keys($assignable, true);
+
+        // Roles the actor cannot touch — keep them as they are.
+        $frozen = array_values(array_filter(
+            $currentIds,
+            static fn (int $id): bool => !isset($assignableMap[$id])
+        ));
+
+        // From the submitted set, only keep roles the actor is allowed to assign.
+        $touched = array_values(array_filter(
+            $submittedIds,
+            static fn (int $id): bool => isset($assignableMap[$id])
+        ));
+
+        return array_values(array_unique(array_merge($frozen, $touched)));
+    }
+
+    /**
+     * Saves which roles this role can assign (admin UI) and logs the change.
+     *
+     * @param int[] $assignableRoleIds
+     */
+    public function replaceAssignableRoles(int $roleId, array $assignableRoleIds, int $actorUserId): bool
+    {
+        $beforeIds = $this->assignableRoleRepository->listAssignableRoleIdsByRoleId($roleId);
+        $result = $this->assignableRoleRepository->replaceForRole($roleId, $assignableRoleIds);
+
+        $afterIds = $this->assignableRoleRepository->listAssignableRoleIdsByRoleId($roleId);
+        if ($beforeIds !== $afterIds) {
+            $this->systemAuditService->record('admin.roles.assignable_roles.update', 'success', [
+                'actor_user_id' => $actorUserId > 0 ? $actorUserId : null,
+                'target_type' => 'role',
+                'target_id' => $roleId,
+                'before' => ['assignable_role_ids' => $beforeIds],
+                'after' => ['assignable_role_ids' => $afterIds],
+            ]);
+        }
+
+        return $result;
+    }
+}