feat: Users API, ownership transfer and removal of the legacy role string

internal/infrastructure/useCases/roleSupport.go

@@ -11,6 +11,17 @@ import (
 	"slices"
 )
 
+func builtInRole(roles role.Repository, name string) (role.Role, error) {
+	found, err := roles.GetByName(name)
+	if err != nil {
+		return role.Role{}, err
+	}
+	if !found.BuiltIn {
+		return role.Role{}, role.ErrRoleNotFound
+	}
+	return found, nil
+}
+
 func roleTarget(found role.Role) audit.Target {
 	return audit.NewTarget(audit.TargetRole, found.ID, found.Name)
 }
@@ -33,9 +44,41 @@ func ensureCovered(caller ContentCaller, contentTypes contenttype.Repository, ca
 	if err != nil {
 		return err
 	}
+	return ensureCoveredBy(caller, typeKeys, candidate)
+}
+
+func ensureCoveredBy(caller ContentCaller, typeKeys []string, candidate role.Role) error {
 	return caller.Grants.Covers(candidate.GrantSet(), typeKeys)
 }
 
+func assignableRole(roles role.Repository, id uint32) (role.Role, error) {
+	if id == 0 {
+		return role.Role{}, role.ErrUnknownRole
+	}
+	found, err := roles.Get(id)
+	if errors.Is(err, role.ErrRoleNotFound) {
+		return role.Role{}, role.ErrUnknownRole
+	}
+	if err != nil {
+		return role.Role{}, err
+	}
+	if found.Locked {
+		return role.Role{}, role.ErrRoleLocked
+	}
+	return found, nil
+}
+
+func coveredAssignableRole(caller ContentCaller, roles role.Repository, contentTypes contenttype.Repository, id uint32) (role.Role, error) {
+	found, err := assignableRole(roles, id)
+	if err != nil {
+		return role.Role{}, err
+	}
+	if err := ensureCovered(caller, contentTypes, found); err != nil {
+		return role.Role{}, err
+	}
+	return found, nil
+}
+
 func ensureNotOwnRole(roles role.Repository, users user.Repository, caller ContentCaller, target role.Role) error {
 	account, err := users.Get(caller.UserID)
 	if err != nil {