added user and roles controllers and unified naming

core/lib/Service/SecurityService.php

@@ -22,7 +22,7 @@ class SecurityService
 
     public function __construct(
         private readonly TokenService $tokenService,
-        private readonly UserService $userService,
+        private readonly UserAccountsService $userService,
         private readonly SessionTenant $sessionTenant
     ) {
         $this->securityCode = $this->sessionTenant->configuration()->security()->code();

core/lib/Service/UserAccountsService.php

@@ -5,15 +5,15 @@ namespace KTXC\Service;
 use KTXC\Models\Identity\User;
 use KTXC\SessionIdentity;
 use KTXC\SessionTenant;
-use KTXC\Stores\UserStore;
+use KTXC\Stores\UserAccountsStore;
 
-class UserService
+class UserAccountsService
 {
     
     public function __construct(
         private readonly SessionTenant $tenantIdentity,
 		private readonly SessionIdentity $userIdentity,
-        private readonly UserStore $userStore
+        private readonly UserAccountsStore $userStore
     ) {
     }
 
@@ -21,6 +21,21 @@ class UserService
     // User Operations
     // =========================================================================
 
+    /**
+     * List all users with optional filters
+     */
+    public function listUsers(array $filters = []): array
+    {
+        $users = $this->userStore->listUsers($this->tenantIdentity->identifier(), $filters);
+        
+        // Remove sensitive data
+        foreach ($users as &$user) {
+            unset($user['settings']);
+        }
+        
+        return $users;
+    }
+
     public function fetchByIdentity(string $identifier): User | null
     {
         $data = $this->userStore->fetchByIdentity($this->tenantIdentity->identifier(), $identifier);

core/lib/Service/UserRolesService.php

@@ -0,0 +1,143 @@
+<?php
+
+namespace KTXC\Service;
+
+use KTXC\SessionTenant;
+use KTXC\Stores\UserRolesStore;
+use Psr\Log\LoggerInterface;
+
+/**
+ * User Roles Service - Business logic for user role management
+ */
+class UserRolesService
+{
+    public function __construct(
+        private readonly SessionTenant $tenantIdentity,
+        private readonly UserRolesStore $roleStore,
+        private readonly LoggerInterface $logger
+    ) {}
+
+    // =========================================================================
+    // Role Operations
+    // =========================================================================
+
+    /**
+     * List all roles for current tenant
+     */
+    public function listRoles(): array
+    {
+        return $this->roleStore->listRoles($this->tenantIdentity->identifier());
+    }
+
+    /**
+     * Get role by ID
+     */
+    public function getRole(string $rid): ?array
+    {
+        return $this->roleStore->fetchByRid($this->tenantIdentity->identifier(), $rid);
+    }
+
+    /**
+     * Create a new role
+     */
+    public function createRole(array $roleData): array
+    {
+        $this->validateRoleData($roleData);
+        
+        $this->logger->info('Creating role', [
+            'tenant' => $this->tenantIdentity->identifier(),
+            'label' => $roleData['label'] ?? 'Unnamed'
+        ]);
+        
+        return $this->roleStore->createRole($this->tenantIdentity->identifier(), $roleData);
+    }
+
+    /**
+     * Update existing role
+     */
+    public function updateRole(string $rid, array $updates): bool
+    {
+        // Verify role exists and is not system role
+        $role = $this->getRole($rid);
+        if (!$role) {
+            throw new \InvalidArgumentException('Role not found');
+        }
+        
+        if ($role['system'] ?? false) {
+            throw new \InvalidArgumentException('Cannot modify system roles');
+        }
+        
+        $this->validateRoleData($updates, false);
+        
+        $this->logger->info('Updating role', [
+            'tenant' => $this->tenantIdentity->identifier(),
+            'rid' => $rid
+        ]);
+        
+        return $this->roleStore->updateRole($this->tenantIdentity->identifier(), $rid, $updates);
+    }
+
+    /**
+     * Delete a role
+     */
+    public function deleteRole(string $rid): bool
+    {
+        // Verify role exists and is not system role
+        $role = $this->getRole($rid);
+        if (!$role) {
+            throw new \InvalidArgumentException('Role not found');
+        }
+        
+        if ($role['system'] ?? false) {
+            throw new \InvalidArgumentException('Cannot delete system roles');
+        }
+        
+        // Check if role is assigned to users
+        $userCount = $this->roleStore->countUsersInRole($this->tenantIdentity->identifier(), $rid);
+        if ($userCount > 0) {
+            throw new \InvalidArgumentException("Cannot delete role assigned to {$userCount} user(s)");
+        }
+        
+        $this->logger->info('Deleting role', [
+            'tenant' => $this->tenantIdentity->identifier(),
+            'rid' => $rid
+        ]);
+        
+        return $this->roleStore->deleteRole($this->tenantIdentity->identifier(), $rid);
+    }
+
+    /**
+     * Get user count for a role
+     */
+    public function getRoleUserCount(string $rid): int
+    {
+        return $this->roleStore->countUsersInRole($this->tenantIdentity->identifier(), $rid);
+    }
+
+    /**
+     * Get all available permissions from modules
+     * Grouped by category with metadata
+     */
+    public function availablePermissions(): array
+    {
+        return $this->roleStore->availablePermissions();
+    }
+
+    // =========================================================================
+    // Validation
+    // =========================================================================
+
+    /**
+     * Validate role data
+     */
+    private function validateRoleData(array $data, bool $isCreate = true): void
+    {
+        if ($isCreate && empty($data['label'])) {
+            throw new \InvalidArgumentException('Role label is required');
+        }
+        
+        if (isset($data['permissions']) && !is_array($data['permissions'])) {
+            throw new \InvalidArgumentException('Permissions must be an array');
+        }
+    }
+}