roleep

type CreateRoleEndpoint struct{}

type CreateRoleRequest struct {
	// Display name for the role, such as "Warehouse Manager".
	//
	// Must be unique within your account.
	Name string `json:"name" validate:"required,max=255"`
	// Permissions to grant, in `{permission}:{action}` format, such as `customers:read`.
	//
	// The first half is a permission code such as `customers` or `sales_orders`, and the action must be one of `create`, `read`, `update`, or `delete`. List each action separately to grant more than one action on the same permission. A role created without any permissions grants no access until permissions are added.
	Permissions []string `json:"permissions,omitzero"`
}

type DeleteRoleEndpoint struct{}

type DeleteRoleRequest struct {
	// Role ID.
	RoleID string `path:"id" validate:"required"`
}

type ListRolesEndpoint struct{}

type ListRolesRequest struct {
	apiresource.PaginationRequest
	// Filter results to roles whose type matches any of the given values.
	RoleType []constants.RoleType `query:"types"`
}

type RetrieveRoleEndpoint struct{}

type RetrieveRoleRequest struct {
	// Role ID.
	RoleID string `path:"id" validate:"required"`
}

type RoleSvc interface {
	ListRoles(ctx context.Context, req *ListRolesRequest) (*apiresource.List[apiresource.Role], *apierror.APIError)
	GetRole(ctx context.Context, req *RetrieveRoleRequest) (*apiresource.Role, *apierror.APIError)
	CreateRole(ctx context.Context, req *CreateRoleRequest) (*apiresource.Role, *apierror.APIError)
	UpdateRole(ctx context.Context, req *UpdateRoleRequest) (*apiresource.Role, *apierror.APIError)
	DeleteRole(ctx context.Context, req *DeleteRoleRequest) (*apiresource.EmptyResource, *apierror.APIError)
}

type RoleSvcConfig struct {
	// CoreClient (required) is the core-service gRPC client.
	CoreClient pb.CoreServiceClient
}

type UpdateRoleEndpoint struct{}

type UpdateRoleRequest struct {
	// Role ID.
	RoleID string `path:"id" validate:"required"`
	// New display name for the role.
	//
	// Returns a conflict error if another role in your account already uses this name.
	Name field.Optional[string] `json:"name,omitzero" validate:"omitempty,max=255"`
	// Full replacement set of permissions, in `{permission}:{action}` format, such as `customers:read`.
	//
	// The role's existing permissions are discarded and replaced with exactly what you send, so include every permission the role should keep. Sending an empty array strips the role of all access, while leaving the field out keeps the current permissions untouched.
	Permissions field.Optional[[]string] `json:"permissions,omitzero"`
}