feat: roles SPA Users, Profile, API keys, Activity

internal/infrastructure/useCases/ChangeUserRole.go

@@ -48,10 +48,9 @@ func (u *ChangeUserRoleUseCase) ChangeRole(ctx context.Context, command ChangeUs
 		return DirectoryEntry{}, err
 	}
 	if held && current.ID == next.ID {
-		ref := NewRoleRef(next)
-		return userEntry(target, &ref), nil
+		return u.entryOf(target, next)
 	}
-	return u.write(ctx, target, current, next)
+	return u.write(ctx, command, target, current, held, next)
 }
 
 func (u *ChangeUserRoleUseCase) heldRole(target user.User) (role.Role, bool, error) {
@@ -81,10 +80,10 @@ func (u *ChangeUserRoleUseCase) checkCoverage(command ChangeUserRoleCommand, tar
 	return ensureCoveredBy(command.Caller, typeKeys, next)
 }
 
-func (u *ChangeUserRoleUseCase) write(ctx context.Context, target user.User, current role.Role, next role.Role) (DirectoryEntry, error) {
+func (u *ChangeUserRoleUseCase) write(ctx context.Context, command ChangeUserRoleCommand, target user.User, current role.Role, held bool, next role.Role) (DirectoryEntry, error) {
 	event := audit.NewEvent(audit.ActionUserChangeRole, audit.CategoryUsers)
 	event.Target = audit.NewTarget(audit.TargetUser, target.ID, target.Username)
-	updated, err := u.users.UpdateRole(target.ID, target.RoleID, next.ID)
+	updated, err := u.users.UpdateRole(target.ID, target.RoleID, next.ID, command.Caller.UserID)
 	if errors.Is(err, role.ErrRoleNotFound) {
 		return DirectoryEntry{}, role.ErrUnknownRole
 	}
@@ -92,12 +91,22 @@ func (u *ChangeUserRoleUseCase) write(ctx context.Context, target user.User, cur
 		u.recordWriteFailure(ctx, event, err)
 		return DirectoryEntry{}, err
 	}
-	event.Params[audit.ParamFrom] = current.ID
+	if held {
+		event.Params[audit.ParamFrom] = current.ID
+		event.Changes = audit.AppendTextChange(event.Changes, audit.FieldRole, current.Name, next.Name)
+	}
 	event.Params[audit.ParamTo] = next.ID
-	event.Changes = audit.AppendTextChange(event.Changes, audit.FieldRole, current.Name, next.Name)
 	u.recorder.Record(ctx, event)
-	ref := NewRoleRef(next)
-	return userEntry(updated, &ref), nil
+	return u.entryOf(updated, next)
+}
+
+func (u *ChangeUserRoleUseCase) entryOf(account user.User, assigned role.Role) (DirectoryEntry, error) {
+	assigner, err := resolveRoleAssigner(u.users, account.RoleAssignedByID)
+	if err != nil {
+		return DirectoryEntry{}, err
+	}
+	ref := NewRoleRef(assigned)
+	return userEntry(account, &ref, assigner), nil
 }
 
 func (u *ChangeUserRoleUseCase) recordWriteFailure(ctx context.Context, event audit.Event, err error) {