Walkthrough

This PR implements tenant-scoped role assignments by adding org_id tracking to the user_roles table. It updates the repository layer to persist and validate organization context during role assignments, adds comprehensive test coverage for tenant integrity constraints, updates the service layer callsite, and includes forward/backward database migrations to enforce composite foreign keys that prevent cross-tenant role assignments.

Changes

Sequence Diagram

sequenceDiagram
    actor Client
    participant Service as RBACService
    participant Repo as Repository<br/>(roles.go)
    participant DB as PostgreSQL
    
    Client->>Service: AssignRoleToUser(ctx, orgID, userID, roleID)
    Service->>Service: Validate user exists in orgID
    Service->>Service: Validate role exists in orgID
    Service->>Repo: AssignRoleToUser(ctx, orgID, userID, roleID)
    Repo->>DB: INSERT INTO user_roles<br/>(user_id, role_id, org_id)
    alt Same-org assignment
        DB-->>DB: Composite FK check:<br/>(user_id, org_id) → users<br/>(role_id, org_id) → roles
        DB-->>Repo: Success
        Repo-->>Service: nil
        Service-->>Client: Success + Audit log
    else Cross-org assignment
        DB-->>DB: FK violation (code 23503)
        DB-->>Repo: PgError
        Repo-->>Repo: Map to ErrNotFound
        Repo-->>Service: ErrNotFound
        Service-->>Client: Error
    end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Fix tenant scoping for user and role access #13: Modifies the same RBAC/tenant-scoping code paths—changes AssignRoleToUser signature to include orgID, adds tenant-integrity tests validating cross-org rejection via ErrNotFound and PG 23503, and adjusts user_roles schema constraints.

Poem

🐰 With org_id's careful gate,
Cross-tenant roles meet their fate!
Migrations mend what once was loose,
Each burrow safe—no more excuse! 🔐

• X
• Mastodon
• Reddit
• LinkedIn