Method create_role

nodedb/src/control/security/role.rs:162–214

Create a custom role. Returns error if it already exists or would create a cycle.

(
        &self,
        name: &str,
        tenant_id: TenantId,
        parent: Option<&str>,
        catalog: Option<&SystemCatalog>,
    )

    /// Create a custom role. Returns error if it already exists or would create a cycle.
    pub fn create_role(
        &self,
        name: &str,
        tenant_id: TenantId,
        parent: Option<&str>,
        catalog: Option<&SystemCatalog>,
    ) -> crate::Result<()> {
        // Reject built-in role names.
        if is_builtin(name) {
            return Err(crate::Error::BadRequest {
                detail: format!("'{name}' is a built-in role and cannot be created"),
            });
        }

        let mut roles = self.roles.write().map_err(|e| crate::Error::Internal {
            detail: format!("role store lock poisoned: {e}"),
        })?;

        if roles.contains_key(name) {
            return Err(crate::Error::BadRequest {
                detail: format!("role '{name}' already exists"),
            });
        }

        // Validate parent exists (built-in or custom) and enforce depth/cycle rules.
        if let Some(parent_name) = parent {
            validate_parent(name, parent_name, &roles)?;
        }

        let now = std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .unwrap_or_default()
            .as_secs();

        let role = CustomRole {
            name: name.to_string(),
            tenant_id,
            parent: parent.map(|s| s.to_string()),
            created_at: now,
        };

        if let Some(catalog) = catalog {
            catalog.put_role(&StoredRole {
                name: name.to_string(),
                tenant_id: tenant_id.as_u64(),
                parent: parent.unwrap_or("").to_string(),
                created_at: now,
            })?;
        }

        roles.insert(name.to_string(), role);
        Ok(())
    }

    /// Drop a custom role.
    pub fn drop_role(&self, name: &str, catalog: Option<&SystemCatalog>) -> crate::Result<bool> {