feat: console role management

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
2026-07-24 21:58:16 -04:00
parent bf14b72a03
commit a723051d11
7 changed files with 548 additions and 1 deletions
@@ -0,0 +1,109 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Console\Role;
+
+use KTXC\Service\TenantService;
+use KTXC\Stores\UserRolesStore;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * Role Create Command
+ *
+ * Creates a new role within a tenant.
+ */
+#[AsCommand(
+    name: 'role:create',
+    description: 'Create a new role in a tenant',
+)]
+class RoleCreateCommand extends Command
+{
+    public function __construct(
+        private readonly TenantService $tenantService,
+        private readonly UserRolesStore $rolesStore,
+        private readonly LoggerInterface $logger
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addArgument('tenant', InputArgument::REQUIRED, 'Tenant identifier')
+            ->addArgument('label', InputArgument::REQUIRED, 'Display label for the role')
+            ->addOption('description', 'd', InputOption::VALUE_REQUIRED, 'Role description', '')
+            ->addOption('permission', 'p', InputOption::VALUE_REQUIRED | InputOption::VALUE_IS_ARRAY, 'Permission(s) to grant (repeatable, e.g. --permission "*")', [])
+            ->addOption('rid', null, InputOption::VALUE_REQUIRED, 'Explicit role id (defaults to a generated UUID)')
+            ->addOption('system', null, InputOption::VALUE_NONE, 'Mark the role as a protected system role (cannot be updated or deleted)')
+            ->setHelp('This command creates a new role in a tenant. Permissions are free-form strings matched by the runtime permission checker, including wildcard suffixes like "user_manager.role.*" or the full wildcard "*".')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+        $tenant = $input->getArgument('tenant');
+        $label = $input->getArgument('label');
+        $rid = $input->getOption('rid');
+
+        $io->title('Create Role');
+
+        try {
+            if (!$this->tenantService->fetchById($tenant)) {
+                $io->error("Tenant '{$tenant}' not found.");
+                return Command::FAILURE;
+            }
+
+            if ($rid !== null && $this->rolesStore->fetchByRid($tenant, $rid)) {
+                $io->error("Role '{$rid}' already exists in tenant '{$tenant}'.");
+                return Command::FAILURE;
+            }
+
+            $roleData = [
+                'label' => $label,
+                'description' => $input->getOption('description') ?? '',
+                'permissions' => $input->getOption('permission'),
+                'system' => $input->getOption('system'),
+            ];
+
+            if ($rid !== null) {
+                $roleData['rid'] = $rid;
+            }
+
+            $role = $this->rolesStore->createRole($tenant, $roleData);
+
+            $this->logger->info('Role created via console', [
+                'tenant' => $tenant,
+                'rid' => $role['rid'] ?? null,
+                'command' => $this->getName(),
+            ]);
+
+            $io->success("Role '{$label}' created successfully!");
+            $io->definitionList(
+                ['Rid' => $role['rid'] ?? ''],
+                ['Label' => $role['label'] ?? ''],
+                ['System' => !empty($role['system']) ? 'yes' : 'no'],
+                ['Permissions' => implode(', ', (array)($role['permissions'] ?? []))],
+            );
+
+            return Command::SUCCESS;
+
+        } catch (\Throwable $e) {
+            $io->error('Failed to create role: ' . $e->getMessage());
+            $this->logger->error('Role create failed', [
+                'tenant' => $tenant,
+                'label' => $label,
+                'error' => $e->getMessage(),
+            ]);
+            return Command::FAILURE;
+        }
+    }
+}