@hilbras/keystone 1.1.0

package/src/repositories/user.ts

@@ -0,0 +1,161 @@
+import { eq, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { users, orgMemberships, userIdentities, identityProviders, type User } from "../db/schema.js";
+import type { CreateUserInput, UpdateUserInput, UserRepository } from "./types.js";
+
+export class DrizzleUserRepository implements UserRepository {
+  async findById(id: string): Promise<User | undefined> {
+    const [user] = await db.select().from(users).where(eq(users.id, id)).limit(1);
+    return user;
+  }
+
+  async findByEmail(email: string): Promise<User | undefined> {
+    const [user] = await db.select().from(users).where(eq(users.email, email.toLowerCase())).limit(1);
+    return user;
+  }
+
+  async create(input: CreateUserInput): Promise<User> {
+    const [user] = await db
+      .insert(users)
+      .values({
+        email: input.email.toLowerCase().trim(),
+        username: input.username,
+        name: input.name.trim() || input.username,
+        passwordHash: input.passwordHash ?? null,
+        provider: input.provider ?? "password",
+        emailVerified: input.emailVerified ?? true,
+        avatarUrl: input.avatarUrl ?? null,
+        zitadelUserId: input.zitadelUserId ?? null,
+        metadata: input.metadata ?? {},
+      })
+      .returning();
+    return user;
+  }
+
+  async update(id: string, input: UpdateUserInput): Promise<User | undefined> {
+    const [updated] = await db
+      .update(users)
+      .set({ ...input, updatedAt: sql`now()` })
+      .where(eq(users.id, id))
+      .returning();
+    return updated;
+  }
+
+  async deactivate(id: string): Promise<void> {
+    await db.update(users).set({ emailVerified: false, updatedAt: sql`now()` }).where(eq(users.id, id));
+  }
+
+  async listByOrg(orgId: string): Promise<User[]> {
+    const rows = await db
+      .select({ user: users })
+      .from(users)
+      .innerJoin(orgMemberships, eq(users.id, orgMemberships.userId))
+      .where(eq(orgMemberships.orgId, orgId));
+    return rows.map((r) => r.user);
+  }
+
+  async updateLastSeen(id: string): Promise<void> {
+    await db.update(users).set({ updatedAt: sql`now()` }).where(eq(users.id, id));
+  }
+
+  async recordFailedLogin(id: string): Promise<User | undefined> {
+    const [updated] = await db
+      .update(users)
+      .set({ failedLoginAttempts: sql`${users.failedLoginAttempts} + 1`, updatedAt: sql`now()` })
+      .where(eq(users.id, id))
+      .returning();
+    return updated;
+  }
+
+  async resetFailedLogins(id: string): Promise<void> {
+    await db
+      .update(users)
+      .set({ failedLoginAttempts: 0, lockedUntil: null, updatedAt: sql`now()` })
+      .where(eq(users.id, id));
+  }
+
+  async lockAccount(id: string, until: Date): Promise<void> {
+    await db.update(users).set({ lockedUntil: until, updatedAt: sql`now()` }).where(eq(users.id, id));
+  }
+
+  async ensureUniqueUsername(base: string, excludeId?: string): Promise<string> {
+    let username = base || "user";
+    let counter = 2;
+    while (true) {
+      const existing = await db
+        .select({ id: users.id })
+        .from(users)
+        .where(eq(users.username, username))
+        .limit(1);
+      if (existing.length === 0 || existing[0].id === excludeId) {
+        return username;
+      }
+      username = `${base}-${counter}`;
+      counter++;
+    }
+  }
+
+  async listAll(): Promise<User[]> {
+    return db.select().from(users);
+  }
+
+  async setTotpSecret(userId: string, totpSecret: string): Promise<void> {
+    await db.update(users).set({ totpSecret, totpEnabled: false }).where(eq(users.id, userId));
+  }
+
+  async enableTotp(userId: string): Promise<void> {
+    await db.update(users).set({ totpEnabled: true, totpVerifiedAt: new Date() }).where(eq(users.id, userId));
+  }
+
+  async disableTotp(userId: string): Promise<void> {
+    await db.update(users).set({ totpSecret: null, totpEnabled: false, totpVerifiedAt: null }).where(eq(users.id, userId));
+  }
+
+  async deleteById(userId: string): Promise<void> {
+    await db.delete(users).where(eq(users.id, userId));
+  }
+}
+
+export class DrizzleIdentityRepository {
+  async link(input: {
+    userId: string;
+    providerId: string;
+    providerType: string;
+    externalSub: string;
+    email?: string;
+    profile?: Record<string, unknown>;
+  }): Promise<void> {
+    await db
+      .insert(userIdentities)
+      .values({
+        userId: input.userId,
+        providerId: input.providerId,
+        providerType: input.providerType,
+        externalSub: input.externalSub,
+        email: input.email,
+        profile: input.profile ?? {},
+      })
+      .onConflictDoNothing({ target: [userIdentities.providerId, userIdentities.externalSub] });
+  }
+
+  async findLinkedByExternalSub(providerId: string, externalSub: string): Promise<User | undefined> {
+    const [existing] = await db
+      .select({ user: users })
+      .from(userIdentities)
+      .where(eq(userIdentities.externalSub, externalSub))
+      .innerJoin(users, eq(userIdentities.userId, users.id))
+      .limit(1);
+    return existing?.user;
+  }
+
+  async listByUserId(userId: string): Promise<{ identity: any; provider: { id: string; name: string; providerType: string } }[]> {
+    return db
+      .select({
+        identity: userIdentities,
+        provider: { id: identityProviders.id, name: identityProviders.name, providerType: identityProviders.providerType },
+      })
+      .from(userIdentities)
+      .where(eq(userIdentities.userId, userId))
+      .innerJoin(identityProviders, eq(userIdentities.providerId, identityProviders.id));
+  }
+}

package/src/routes/admin/billing.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import type { FastifyInstance } from "fastify";
+import { requireAuthAndRole } from "./helpers.js";
+import { getBillingSummary, setOrganizationPlan, provisionBillingCustomer, listPlans } from "../../services/billing.js";
+
+const UpdatePlanSchema = z.object({
+  plan: z.enum(["free", "starter", "growth", "enterprise"]),
+});
+
+export default async function billingRoutes(app: FastifyInstance) {
+  app.get("/billing/plans", { preHandler: [app.authenticate] }, async () => {
+    return { plans: listPlans() };
+  });
+
+  app.get(
+    "/organizations/:id/billing",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "billing", action: "read" })] },
+    async (request) => {
+      const { id } = request.params as { id: string };
+      const summary = await getBillingSummary(id);
+      return summary;
+    }
+  );
+
+  app.patch(
+    "/organizations/:id/plan",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "billing", action: "update" })] },
+    async (request) => {
+      const { id } = request.params as { id: string };
+      const body = UpdatePlanSchema.parse(request.body);
+      const result = await setOrganizationPlan(id, body.plan);
+      await request.audit("organization_plan_updated", { orgId: id, plan: body.plan });
+      return result;
+    }
+  );
+
+  app.post(
+    "/organizations/:id/billing/customer",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "billing", action: "update" })] },
+    async (request, reply) => {
+      const { id } = request.params as { id: string };
+      const user = request.user!;
+      const result = await provisionBillingCustomer(id, user.email!);
+      await request.audit("billing_customer_provisioned", { orgId: id });
+      return reply.status(201).send(result);
+    }
+  );
+}

package/src/routes/admin/helpers.ts

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { getSdk } from "../../sdk/index.js";
+import type { OrgRole } from "../../services/domain/authorization.js";
+import { sendResultError } from "../helpers.js";
+
+export { sendResultError } from "../helpers.js";
+
+export function requireOwner() {
+  return async (request: FastifyRequest, reply: FastifyReply) => {
+    await request.server.authenticate(request, reply);
+    if (reply.sent) return;
+
+    if (request.user!.role !== "owner") {
+      return reply.status(403).send({ error: "Forbidden" });
+    }
+  };
+}
+
+export function requireAuthAndRole(allowedRoles: OrgRole[], permission?: { resource: string; action: string }) {
+  return async (request: FastifyRequest, reply: FastifyReply) => {
+    await request.server.authenticate(request, reply);
+    if (reply.sent) return;
+
+    const { id } = request.params as { id: string };
+    const sdk = getSdk();
+    const membershipResult = await sdk.authorization.requireOrgRole(request.user!.id, id, allowedRoles);
+    if (!membershipResult.success) return sendResultError(reply, membershipResult);
+    request.state.membership = membershipResult.data;
+
+    if (permission) {
+      const permResult = await sdk.authorization.requirePermission(membershipResult.data.role, permission.resource, permission.action);
+      if (!permResult.success) return sendResultError(reply, permResult);
+    }
+  };
+}
+
+export const ipEntry = z.string().max(64).regex(/^[0-9a-fA-F:.\/]+$/, "Invalid IP or CIDR entry");
+
+export const BrandingSchema = z
+  .object({
+    logoUrl: z.string().url().max(2048).optional(),
+    primaryColor: z.string().regex(/^#[0-9a-fA-F]{6}$/, "Use #rrggbb format").optional(),
+    accentColor: z.string().regex(/^#[0-9a-fA-F]{6}$/, "Use #rrggbb format").optional(),
+    companyName: z.string().max(255).optional(),
+    supportEmail: z.string().email().max(255).optional(),
+    loginTitle: z.string().max(255).optional(),
+    loginSubtitle: z.string().max(500).optional(),
+  })
+  .strict();

package/src/routes/admin/index.ts

@@ -0,0 +1,16 @@
+import type { FastifyInstance } from "fastify";
+import platformRoutes from "./platform.js";
+import webhooksRoutes from "./webhooks.js";
+import organizationsRoutes from "./organizations.js";
+import permissionsRoutes from "./permissions.js";
+import ssoRoutes from "./sso.js";
+import billingRoutes from "./billing.js";
+
+export default async function adminRoutes(app: FastifyInstance) {
+  await app.register(platformRoutes);
+  await app.register(webhooksRoutes);
+  await app.register(organizationsRoutes);
+  await app.register(permissionsRoutes);
+  await app.register(ssoRoutes);
+  await app.register(billingRoutes);
+}

package/src/routes/admin/organizations.ts

@@ -0,0 +1,299 @@
+import { z } from "zod";
+import type { FastifyInstance } from "fastify";
+import { getSdk } from "../../sdk/index.js";
+import { requireAuthAndRole, sendResultError, ipEntry, BrandingSchema } from "./helpers.js";
+import { updateMembershipRole, removeMembership, findMembership, countOwners } from "../../services/organizations.js";
+import { rateLimit } from "../../plugins/rateLimit.js";
+
+const CreateOrgSchema = z.object({
+  name: z.string().min(1).max(255),
+  slug: z.string().max(64).optional(),
+  plan: z.string().max(32).optional(),
+});
+
+const UpdateOrgSchema = z.object({
+  name: z.string().min(1).max(255).optional(),
+  branding: BrandingSchema.optional(),
+});
+
+const CreateAppSchema = z.object({
+  name: z.string().min(1).max(255),
+  redirectUris: z.array(z.string().url()).optional(),
+  allowedOrigins: z.array(z.string()).optional(),
+  allowedIps: z.array(ipEntry).optional(),
+  blockedIps: z.array(ipEntry).optional(),
+});
+
+const UpdateAppSchema = z.object({
+  name: z.string().min(1).max(255).optional(),
+  redirectUris: z.array(z.string().url()).optional(),
+  allowedOrigins: z.array(z.string()).optional(),
+  allowedIps: z.array(ipEntry).optional(),
+  blockedIps: z.array(ipEntry).optional(),
+  isActive: z.boolean().optional(),
+  branding: BrandingSchema.optional(),
+});
+
+const InviteSchema = z.object({
+  email: z.string().email(),
+  role: z.enum(["owner", "admin", "member"]).default("member"),
+});
+
+const UpdateMemberSchema = z.object({
+  role: z.enum(["owner", "admin", "member"]),
+});
+
+const UpdateUserSchema = z.object({
+  name: z.string().min(1).max(255).optional(),
+  username: z.string().min(3).max(32).optional(),
+  role: z.string().optional(),
+  emailVerified: z.boolean().optional(),
+});
+
+export default async function organizationsRoutes(app: FastifyInstance) {
+  const sdk = getSdk();
+
+  app.post(
+    "/organizations",
+    {
+      preHandler: [
+        app.authenticate,
+        rateLimit({
+          keyPrefix: "create-org",
+          maxAttempts: 5,
+          windowSeconds: 3600,
+        }),
+      ],
+    },
+    async (request, reply) => {
+      const body = CreateOrgSchema.parse(request.body);
+      const result = await sdk.organization.createOrganization(request.user!.id, body);
+      if (!result.success) return sendResultError(reply, result);
+      await request.audit("organization_created", { orgId: result.data.id });
+      return reply.status(201).send(result.data);
+    }
+  );
+
+  app.get("/organizations", { preHandler: [app.authenticate] }, async (request) => {
+    const orgs = await sdk.organization.listUserOrganizations(request.user!.id);
+    return { organizations: orgs };
+  });
+
+  app.get("/organizations/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
+    const { id } = request.params as { id: string };
+    const result = await sdk.organization.getOrganization(request.user!.id, id);
+    if (!result.success) return sendResultError(reply, result);
+
+    const membership = await sdk.authorization.isOrgMember(request.user!.id, id);
+    request.state.membership = membership;
+
+    const memberCount = await app.container.organizationRepository.countMembers(id);
+
+    return { ...result.data, memberCount, membership };
+  });
+
+  app.post(
+    "/organizations/:id/applications",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "application", action: "create" })] },
+    async (request, reply) => {
+      const { id } = request.params as { id: string };
+      const body = CreateAppSchema.parse(request.body);
+      const result = await sdk.organization.createApplication(request.user!.id, id, body);
+      if (!result.success) return sendResultError(reply, result);
+      return reply.status(201).send({ ...result.data, clientSecret: result.data.clientSecret });
+    }
+  );
+
+  app.get(
+    "/organizations/:id/applications",
+    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "application", action: "read" })] },
+    async (request, reply) => {
+      const { id } = request.params as { id: string };
+      const result = await sdk.organization.listOrganizationApplications(request.user!.id, id);
+      if (!result.success) return sendResultError(reply, result);
+      return { applications: result.data };
+    }
+  );
+
+  app.patch(
+    "/organizations/:id",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "update" })] },
+    async (request, reply) => {
+      const { id } = request.params as { id: string };
+      const body = UpdateOrgSchema.parse(request.body);
+      if (body.name === undefined && body.branding === undefined) {
+        return reply.status(400).send({ error: "Nothing to update" });
+      }
+      const updated = await app.container.organizationRepository.update(id, {
+        name: body.name,
+        branding: body.branding,
+      });
+      if (!updated) return reply.status(404).send({ error: "Organization not found" });
+      await request.audit("organization_updated", { orgId: id, updates: Object.keys(body) });
+      return updated;
+    }
+  );
+
+  app.patch(
+    "/organizations/:id/applications/:appId",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "application", action: "update" })] },
+    async (request, reply) => {
+      const { id, appId } = request.params as { id: string; appId: string };
+      const body = UpdateAppSchema.parse(request.body);
+      const result = await sdk.organization.updateApplication(request.user!.id, id, appId, body);
+      if (!result.success) return sendResultError(reply, result);
+      await request.audit("application_updated", { orgId: id, appId, updates: Object.keys(body) });
+      return result.data;
+    }
+  );
+
+  app.post(
+    "/organizations/:id/invites",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "invite" })] },
+    async (request, reply) => {
+      const { id } = request.params as { id: string };
+      const body = InviteSchema.parse(request.body);
+      const result = await sdk.organization.inviteMember(request.user!.id, id, body);
+      if (!result.success) return sendResultError(reply, result);
+      await request.audit("organization_member_invited", {
+        orgId: id,
+        invitedUserId: result.data.user.id,
+        role: body.role,
+      });
+      return reply.status(201).send(result.data);
+    }
+  );
+
+  app.get(
+    "/organizations/:id/members",
+    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "organization", action: "read" })] },
+    async (request) => {
+      const { id } = request.params as { id: string };
+      const members = await getSdk().identity.listOrganizationUsers(id);
+      return { members };
+    }
+  );
+
+  app.patch(
+    "/organizations/:id/members/:userId",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "manage_members" })] },
+    async (request, reply) => {
+      const { id, userId } = request.params as { id: string; userId: string };
+      const body = UpdateMemberSchema.parse(request.body);
+      const updated = await updateMembershipRole(id, userId, body.role);
+      if (!updated) return reply.status(404).send({ error: "Membership not found" });
+      await request.audit("organization_member_role_updated", { orgId: id, userId, role: body.role });
+      return updated;
+    }
+  );
+
+  app.delete(
+    "/organizations/:id/members/:userId",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "manage_members" })] },
+    async (request, reply) => {
+      const { id, userId } = request.params as { id: string; userId: string };
+      const membership = await findMembership(id, userId);
+      if (!membership) return reply.status(404).send({ error: "Membership not found" });
+      if (membership.role === "owner" && (await countOwners(id)) <= 1) {
+        return reply.status(400).send({ error: "Cannot remove the last owner" });
+      }
+      await removeMembership(id, userId);
+      await request.audit("organization_member_removed", { orgId: id, userId });
+      return { success: true };
+    }
+  );
+
+  app.get(
+    "/organizations/:id/users",
+    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "organization", action: "read" })] },
+    async (request) => {
+      const { id } = request.params as { id: string };
+      const users = await sdk.identity.listOrganizationUsers(id);
+      return { users };
+    }
+  );
+
+  app.get(
+    "/organizations/:id/users/:userId",
+    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "organization", action: "read" })] },
+    async (request, reply) => {
+      const { id, userId } = request.params as { id: string; userId: string };
+      const membership = await sdk.authorization.isOrgMember(userId, id);
+      if (!membership) return reply.status(404).send({ error: "User is not a member of this organization" });
+      const users = await sdk.identity.listOrganizationUsers(id);
+      const user = users.find((u) => u.id === userId);
+      if (!user) return reply.status(404).send({ error: "User not found" });
+      return { user, membership };
+    }
+  );
+
+  app.patch(
+    "/organizations/:id/users/:userId",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "manage_members" })] },
+    async (request, reply) => {
+      const { id, userId } = request.params as { id: string; userId: string };
+      const body = UpdateUserSchema.parse(request.body);
+      const membership = await sdk.authorization.isOrgMember(userId, id);
+      if (!membership) return reply.status(404).send({ error: "User is not a member of this organization" });
+      const result = await sdk.identity.updateUserProfile(userId, body);
+      if (!result.success) return sendResultError(reply, result);
+      await request.audit("organization_member_role_updated", { orgId: id, userId, updates: body });
+      return result.data;
+    }
+  );
+
+  app.delete(
+    "/organizations/:id/users/:userId",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "manage_members" })] },
+    async (request, reply) => {
+      const { id, userId } = request.params as { id: string; userId: string };
+      const membership = await sdk.authorization.isOrgMember(userId, id);
+      if (!membership) return reply.status(404).send({ error: "User is not a member of this organization" });
+      const result = await sdk.identity.deactivate(userId);
+      if (!result.success) return sendResultError(reply, result);
+      await removeMembership(id, userId);
+      await request.audit("organization_member_removed", { orgId: id, userId });
+      return { success: true };
+    }
+  );
+
+  // Organization API keys.
+  app.get(
+    "/organizations/:id/api-keys",
+    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "api_key", action: "read" })] },
+    async (request) => {
+      const { id } = request.params as { id: string };
+      const keys = await app.container.apiKeyRepository.listByOrgId(id);
+      return { keys };
+    }
+  );
+
+  app.delete(
+    "/organizations/:id/api-keys/:keyId",
+    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "api_key", action: "revoke" })] },
+    async (request, reply) => {
+      const { id, keyId } = request.params as { id: string; keyId: string };
+      const record = await app.container.apiKeyRepository.revokeByKeyIdAndOrgId(keyId, id);
+      if (!record) return reply.status(404).send({ error: "API key not found" });
+      await request.audit("api_key_revoked", { keyId: record.id, name: record.name, orgId: id });
+      return { success: true };
+    }
+  );
+
+  // Organization audit logs.
+  app.get(
+    "/organizations/:id/audit-logs",
+    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "audit_log", action: "read" })] },
+    async (request) => {
+      const { id } = request.params as { id: string };
+      const query = request.query as { limit?: string; offset?: string; event?: string };
+      const logs = await app.container.auditRepository.list({
+        orgId: id,
+        event: query.event,
+        limit: query.limit ? Number(query.limit) : 50,
+        offset: query.offset ? Number(query.offset) : 0,
+      });
+      return { logs };
+    }
+  );
+}

package/src/routes/admin/permissions.ts

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import type { FastifyInstance } from "fastify";
+import { requireOwner } from "./helpers.js";
+
+const CreatePermissionSchema = z.object({
+  resource: z.string().min(1).max(64).regex(/^[a-z][a-z0-9_]*$/, "lowercase snake_case only"),
+  action: z.string().min(1).max(64).regex(/^[a-z][a-z0-9_]*$/, "lowercase snake_case only"),
+  description: z.string().max(255).optional(),
+});
+
+const RolePermissionSchema = z.object({
+  permissionId: z.string().uuid(),
+});
+
+export default async function permissionsRoutes(app: FastifyInstance) {
+  app.get("/permissions", { preHandler: [requireOwner()] }, async () => {
+    return { permissions: await app.container.permissionRepository.list() };
+  });
+
+  app.post("/permissions", { preHandler: [requireOwner()] }, async (request, reply) => {
+    const body = CreatePermissionSchema.parse(request.body);
+    const created = await app.container.permissionRepository.create(body);
+    if (!created) {
+      return reply.status(409).send({ error: `Permission ${body.resource}:${body.action} already exists` });
+    }
+    await request.audit("permission_created", {
+      permissionId: created.id,
+      resource: created.resource,
+      action: created.action,
+    });
+    return reply.status(201).send(created);
+  });
+
+  app.delete("/permissions/:id", { preHandler: [requireOwner()] }, async (request, reply) => {
+    const { id } = request.params as { id: string };
+    const removed = await app.container.permissionRepository.remove(id);
+    if (!removed) {
+      return reply.status(404).send({ error: "Permission not found" });
+    }
+    await request.audit("permission_deleted", {
+      permissionId: removed.id,
+      resource: removed.resource,
+      action: removed.action,
+    });
+    return { success: true };
+  });
+
+  app.get("/roles", { preHandler: [requireOwner()] }, async () => {
+    const roles = await app.container.permissionRepository.listDistinctRoles();
+    return { roles };
+  });
+
+  app.get("/roles/:role/permissions", { preHandler: [requireOwner()] }, async (request) => {
+    const { role } = request.params as { role: string };
+    return { role, permissions: await app.container.permissionRepository.listForRole(role) };
+  });
+
+  app.post(
+    "/roles/:role/permissions",
+    { preHandler: [requireOwner()] },
+    async (request, reply) => {
+      const { role } = request.params as { role: string };
+      const body = RolePermissionSchema.parse(request.body);
+      await app.container.permissionRepository.assignToRole(role, body.permissionId);
+      await request.audit("organization_member_role_updated", { role, permissionId: body.permissionId });
+      return reply.status(201).send({ success: true });
+    }
+  );
+
+  app.delete(
+    "/roles/:role/permissions/:permissionId",
+    { preHandler: [requireOwner()] },
+    async (request) => {
+      const { role, permissionId } = request.params as { role: string; permissionId: string };
+      await app.container.permissionRepository.removeFromRole(role, permissionId);
+      await request.audit("organization_member_role_updated", { role, permissionId });
+      return { success: true };
+    }
+  );
+}