@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/rbac/security.test.ts

@@ -301,7 +301,7 @@ describe('RBACSecurityMiddleware', () => {
     });
 
     it('blocks requests exceeding rate limit', async () => {
-      const input = {
+      const _input = {
         userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
         scope: { organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID },
         permission: 'read:users' as Permission
@@ -315,30 +315,22 @@ describe('RBACSecurityMiddleware', () => {
         timestamp: new Date()
       };
 
-      // Make many requests quickly to exceed rate limit
-      for (let i = 0; i < 100; i++) {
-        const result = await middleware.validateInput(input, context);
-        if (i < 10) {
-          expect(result.isValid).toBe(true);
-        } else {
-          // Should eventually be rate limited
-          if (!result.isValid) {
-            expect(result.errors.some(e => e.includes('rate limit'))).toBe(true);
-            break;
-          }
+      // Make requests up to the limit
+      let rateLimited = false;
+      for (let i = 0; i < 1100; i++) {
+        const rateLimitResult = await middleware.checkRateLimit(context);
+        if (!rateLimitResult.isAllowed) {
+          rateLimited = true;
+          expect(rateLimitResult.remaining).toBe(0);
+          break;
         }
       }
-    });
-  });
 
-  describe('Suspicious Activity Detection', () => {
-    it('detects rapid permission checks', async () => {
-      const input = {
-        userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
-        scope: { organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID },
-        permission: 'read:users' as Permission
-      };
+      // Should eventually be rate limited (1000 per minute limit)
+      expect(rateLimited).toBe(true);
+    });
 
+    it('tracks remaining requests correctly', async () => {
       const context = {
         userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
         organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
@@ -347,45 +339,134 @@ describe('RBACSecurityMiddleware', () => {
         timestamp: new Date()
       };
 
+      // Make a few requests
+      for (let i = 0; i < 5; i++) {
+        await middleware.checkRateLimit(context);
+      }
+
+      const result = await middleware.checkRateLimit(context);
+      expect(result.isAllowed).toBe(true);
+      expect(result.remaining).toBeLessThan(1000);
+      expect(result.remaining).toBeGreaterThan(0);
+    });
+  });
+
+  describe('Additional Validator Methods', () => {
+    it('validates user ID format', () => {
+      expect(RBACSecurityValidator.validateUserId('123e4567-e89b-12d3-a456-426614174000' as UUID)).toBe(true);
+      expect(RBACSecurityValidator.validateUserId('invalid-uuid' as UUID)).toBe(false);
+      expect(RBACSecurityValidator.validateUserId('' as UUID)).toBe(false);
+    });
+
+    it('detects wildcard permissions', () => {
+      expect(RBACSecurityValidator.isWildcardPermission('read:*')).toBe(true);
+      expect(RBACSecurityValidator.isWildcardPermission('*')).toBe(true);
+      expect(RBACSecurityValidator.isWildcardPermission('read:users')).toBe(false);
+    });
+
+    it('validates permission hierarchy', () => {
+      // Higher level permissions include lower level permissions
+      expect(RBACSecurityValidator.validatePermissionHierarchy('delete:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('update:users', 'create')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('read:users', 'delete')).toBe(false);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('read:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('invalid', 'read')).toBe(false);
+    });
+  });
+
+  describe('Rate Limiting Throttling', () => {
+    it('throttles rate limit warnings', () => {
+      vi.stubEnv('MODE', 'development');
       vi.clearAllMocks();
 
-      // Make many rapid requests
-      for (let i = 0; i < 50; i++) {
-        await middleware.validateInput(input, context);
+      const userId = '123e4567-e89b-12d3-a456-426614174000' as UUID;
+
+      // Make multiple rate limit events within throttle window
+      for (let i = 0; i < 5; i++) {
+        RBACSecurityValidator.logSecurityEvent({
+          type: 'rate_limit_exceeded',
+          userId,
+          details: { remaining: 0 },
+        });
       }
 
-      // Note: Suspicious activity detection is not implemented yet
-      // The middleware only validates input, it doesn't detect patterns
       const logger = getMockLogger();
-      expect(vi.mocked(logger.warn)).not.toHaveBeenCalled();
+      // Should only log once (first event) due to throttling
+      expect(vi.mocked(logger.warn)).toHaveBeenCalledTimes(1);
+
+      vi.unstubAllEnvs();
     });
+  });
 
-    it('detects unusual permission patterns', async () => {
-      const input = {
+  describe('Page-level vs Resource-level Validation', () => {
+    it('allows null organisationId for page-level permissions', async () => {
+      const pageInput = {
+        permission: 'read:page.meals' as Permission,
+        pageId: 'page-123',
+      };
+
+      const contextWithoutOrg = {
         userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+        organisationId: null,
+        timestamp: new Date(),
+      };
+
+      const result = await middleware.validateInput(pageInput, contextWithoutOrg);
+      expect(result.isValid).toBe(true);
+    });
+
+    it('requires organisationId for resource-level permissions', async () => {
+      const resourceInput = {
+        permission: 'read:users' as Permission,
         scope: { organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID },
-        permission: 'update:everything' as Permission
       };
 
-      const context = {
+      const contextWithoutOrg = {
         userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
-        organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
-        ipAddress: '192.168.1.1',
-        userAgent: 'Mozilla/5.0',
-        timestamp: new Date()
+        organisationId: null,
+        timestamp: new Date(),
       };
 
-      vi.clearAllMocks();
+      const result = await middleware.validateInput(resourceInput, contextWithoutOrg);
+      expect(result.isValid).toBe(false);
+      expect(result.errors).toContain('Organisation ID is required for resource-level permissions');
+    });
 
-      // Make requests with high-privilege permissions
-      for (let i = 0; i < 20; i++) {
-        await middleware.validateInput(input, context);
-      }
+    it('validates organisationId format when provided for page-level permissions', async () => {
+      const pageInput = {
+        permission: 'read:page.meals' as Permission,
+        pageId: 'page-123',
+      };
 
-      // Note: Suspicious activity detection is not implemented yet
-      // The middleware only validates input, it doesn't detect patterns
-      const logger = getMockLogger();
-      expect(vi.mocked(logger.warn)).not.toHaveBeenCalled();
+      const contextWithInvalidOrg = {
+        userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+        organisationId: 'invalid-uuid' as UUID,
+        timestamp: new Date(),
+      };
+
+      const result = await middleware.validateInput(pageInput, contextWithInvalidOrg);
+      expect(result.isValid).toBe(false);
+      expect(result.errors).toContain('Invalid organisation ID format');
+    });
+  });
+
+  describe('Scope Validation Edge Cases', () => {
+    it('rejects empty string organisationId', () => {
+      const scopeWithEmptyOrg: Scope = {
+        organisationId: '' as UUID,
+        appId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+      };
+
+      expect(RBACSecurityValidator.validateScope(scopeWithEmptyOrg)).toBe(false);
+    });
+
+    it('rejects whitespace-only organisationId', () => {
+      const scopeWithWhitespaceOrg: Scope = {
+        organisationId: '   ' as UUID,
+        appId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+      };
+
+      expect(RBACSecurityValidator.validateScope(scopeWithWhitespaceOrg)).toBe(false);
     });
   });
 });
@@ -399,3 +480,326 @@ describe('Default Security Config', () => {
     expect(DEFAULT_SECURITY_CONFIG.suspiciousActivityThreshold).toBeGreaterThan(0);
   });
 });
+
+describe('RBACSecurityValidator - Additional Edge Cases', () => {
+  describe('validatePermissionHierarchy', () => {
+    it('validates hierarchy correctly for all operations', () => {
+      expect(RBACSecurityValidator.validatePermissionHierarchy('delete:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('delete:users', 'create')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('delete:users', 'update')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('delete:users', 'delete')).toBe(true);
+      
+      expect(RBACSecurityValidator.validatePermissionHierarchy('update:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('update:users', 'create')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('update:users', 'update')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('update:users', 'delete')).toBe(false);
+      
+      expect(RBACSecurityValidator.validatePermissionHierarchy('create:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('create:users', 'create')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('create:users', 'update')).toBe(false);
+      
+      expect(RBACSecurityValidator.validatePermissionHierarchy('read:users', 'read')).toBe(true);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('read:users', 'create')).toBe(false);
+    });
+
+    it('returns false for invalid permission in hierarchy check', () => {
+      expect(RBACSecurityValidator.validatePermissionHierarchy('invalid:users', 'read')).toBe(false);
+      expect(RBACSecurityValidator.validatePermissionHierarchy('read:users', 'invalid')).toBe(false);
+    });
+  });
+
+  describe('sanitizeInput', () => {
+    it('removes HTML tags', () => {
+      // sanitizeInput removes HTML tags, then removes () characters, so alert("xss") becomes alertxss
+      expect(RBACSecurityValidator.sanitizeInput('test<script>alert("xss")</script>test')).toBe('testalertxsstest');
+      expect(RBACSecurityValidator.sanitizeInput('<div>content</div>')).toBe('content');
+    });
+
+    it('removes dangerous characters', () => {
+      expect(RBACSecurityValidator.sanitizeInput('test"quotes"')).toBe('testquotes');
+      expect(RBACSecurityValidator.sanitizeInput('test\'apostrophe\'')).toBe('testapostrophe');
+      expect(RBACSecurityValidator.sanitizeInput('test&ampersand&')).toBe('testampersand');
+      expect(RBACSecurityValidator.sanitizeInput('test;semicolon;')).toBe('testsemicolon');
+      expect(RBACSecurityValidator.sanitizeInput('test(parentheses)')).toBe('testparentheses');
+    });
+
+    it('removes javascript: protocol', () => {
+      // sanitizeInput removes javascript: protocol, then removes () characters
+      expect(RBACSecurityValidator.sanitizeInput('javascript:alert("xss")')).toBe('alertxss');
+      expect(RBACSecurityValidator.sanitizeInput('JAVASCRIPT:alert("xss")')).toBe('alertxss');
+    });
+
+    it('removes data: protocol', () => {
+      // sanitizeInput removes data: protocol, then removes HTML tags and () characters
+      expect(RBACSecurityValidator.sanitizeInput('data:text/html,<script>alert("xss")</script>')).toBe('text/html,alertxss');
+      expect(RBACSecurityValidator.sanitizeInput('DATA:text/html,content')).toBe('text/html,content');
+    });
+
+    it('trims whitespace', () => {
+      expect(RBACSecurityValidator.sanitizeInput('  test  ')).toBe('test');
+      expect(RBACSecurityValidator.sanitizeInput('\n\ttest\n\t')).toBe('test');
+    });
+  });
+
+  describe('validateScope - Edge Cases', () => {
+    it('rejects scope with empty string organisationId', () => {
+      const scope: Scope = {
+        organisationId: '' as UUID,
+      };
+      expect(RBACSecurityValidator.validateScope(scope)).toBe(false);
+    });
+
+    it('rejects scope with whitespace-only organisationId', () => {
+      const scope: Scope = {
+        organisationId: '   ' as UUID,
+      };
+      expect(RBACSecurityValidator.validateScope(scope)).toBe(false);
+    });
+
+    it('accepts scope with only eventId', () => {
+      const scope: Scope = {
+        eventId: 'event-123',
+      };
+      expect(RBACSecurityValidator.validateScope(scope)).toBe(true);
+    });
+
+    it('accepts scope with only appId', () => {
+      const scope: Scope = {
+        appId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+      };
+      expect(RBACSecurityValidator.validateScope(scope)).toBe(true);
+    });
+  });
+
+  describe('logSecurityEvent - Event Types', () => {
+    beforeEach(() => {
+      vi.stubEnv('MODE', 'development');
+      vi.clearAllMocks();
+    });
+
+    afterEach(() => {
+      vi.unstubAllEnvs();
+    });
+
+    it('logs different event types with correct severity', () => {
+      const eventTypes = [
+        'permission_denied',
+        'invalid_input',
+        'rate_limit_exceeded',
+        'suspicious_activity',
+        'network_error',
+        'database_error',
+        'validation_error',
+        'rate_limit_error',
+        'authentication_error',
+        'unknown_error',
+      ] as const;
+
+      eventTypes.forEach(eventType => {
+        vi.clearAllMocks();
+        RBACSecurityValidator.logSecurityEvent({
+          type: eventType,
+          userId: 'user-123' as UUID,
+          details: { test: 'data' },
+        });
+
+        const logger = getMockLogger();
+        expect(vi.mocked(logger.warn)).toHaveBeenCalled();
+      });
+    });
+
+    it('includes timestamp in security events', () => {
+      const beforeTime = new Date();
+      RBACSecurityValidator.logSecurityEvent({
+        type: 'invalid_input',
+        userId: 'user-123' as UUID,
+        details: { test: 'data' },
+      });
+      const afterTime = new Date();
+
+      const logger = getMockLogger();
+      const callArgs = vi.mocked(logger.warn).mock.calls[0];
+      const event = callArgs[1] as { timestamp?: Date };
+      
+      expect(event.timestamp).toBeInstanceOf(Date);
+      expect(event.timestamp!.getTime()).toBeGreaterThanOrEqual(beforeTime.getTime());
+      expect(event.timestamp!.getTime()).toBeLessThanOrEqual(afterTime.getTime());
+    });
+
+    it('includes severity in security events', () => {
+      RBACSecurityValidator.logSecurityEvent({
+        type: 'database_error',
+        userId: 'user-123' as UUID,
+        details: { test: 'data' },
+      });
+
+      const logger = getMockLogger();
+      const callArgs = vi.mocked(logger.warn).mock.calls[0];
+      const event = callArgs[1] as { severity?: string };
+      
+      expect(event.severity).toBe('critical');
+    });
+  });
+});
+
+describe('RBACSecurityMiddleware - Additional Tests', () => {
+  let middleware: RBACSecurityMiddleware;
+
+  beforeEach(() => {
+    middleware = new RBACSecurityMiddleware(DEFAULT_SECURITY_CONFIG);
+  });
+
+  describe('Rate Limiting - Edge Cases', () => {
+    it('disables rate limiting when config disabled', async () => {
+      const disabledMiddleware = new RBACSecurityMiddleware({
+        ...DEFAULT_SECURITY_CONFIG,
+        enableRateLimiting: false,
+      });
+
+      const context = {
+        userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+        organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+        timestamp: new Date(),
+      };
+
+      // Make many requests - should all be allowed
+      for (let i = 0; i < 2000; i++) {
+        const result = await disabledMiddleware.checkRateLimit(context);
+        expect(result.isAllowed).toBe(true);
+        expect(result.remaining).toBe(DEFAULT_SECURITY_CONFIG.maxPermissionChecksPerMinute);
+      }
+    });
+
+    it('clears expired entries periodically', async () => {
+      const context = {
+        userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+        organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+        timestamp: new Date(),
+      };
+
+      // Make requests to populate cache
+      for (let i = 0; i < 10; i++) {
+        await middleware.checkRateLimit(context);
+      }
+
+      // The cleanup interval should eventually clear old entries
+      // We can't easily test the interval, but we can verify the method exists
+      expect(middleware).toBeDefined();
+    });
+  });
+
+  describe('Input Validation - Additional Cases', () => {
+    it('validates IP address format when enabled', async () => {
+      const result = await middleware.validateInput(
+        { permission: 'read:users' },
+        {
+          userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+          organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+          ipAddress: 123 as any, // Invalid IP
+          timestamp: new Date(),
+        }
+      );
+
+      expect(result.isValid).toBe(false);
+      expect(result.errors).toContain('Invalid IP address format');
+    });
+
+    it('validates user agent format when enabled', async () => {
+      const result = await middleware.validateInput(
+        { permission: 'read:users' },
+        {
+          userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+          organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+          userAgent: 123 as any, // Invalid user agent
+          timestamp: new Date(),
+        }
+      );
+
+      expect(result.isValid).toBe(false);
+      expect(result.errors).toContain('Invalid user agent format');
+    });
+
+    it('skips IP and user agent validation when disabled', async () => {
+      const disabledMiddleware = new RBACSecurityMiddleware({
+        ...DEFAULT_SECURITY_CONFIG,
+        enableInputValidation: false,
+      });
+
+      const result = await disabledMiddleware.validateInput(
+        { permission: 'read:users' },
+        {
+          userId: '123e4567-e89b-12d3-a456-426614174000' as UUID,
+          organisationId: '123e4567-e89b-12d3-a456-426614174001' as UUID,
+          ipAddress: 123 as any, // Invalid but should be ignored
+          userAgent: 123 as any, // Invalid but should be ignored
+          timestamp: new Date(),
+        }
+      );
+
+      // Should still validate core fields (userId, permission, scope)
+      expect(result.isValid).toBe(true);
+    });
+  });
+
+  describe('Rate Limit Throttling - Additional Cases', () => {
+    beforeEach(() => {
+      vi.stubEnv('MODE', 'development');
+      vi.clearAllMocks();
+      // Note: The static rateLimitWarningCount Map persists across tests
+      // This is expected behavior - the throttling is per-user and persists
+      // Tests should use different userIds or account for previous test state
+    });
+
+    afterEach(() => {
+      vi.unstubAllEnvs();
+    });
+
+    it('throttles multiple warnings within time window', () => {
+      // Use a unique userId for this test to avoid interference from other tests
+      const userId = 'throttle-test-user-1' as UUID;
+
+      // Make many rate limit events quickly
+      for (let i = 0; i < 20; i++) {
+        RBACSecurityValidator.logSecurityEvent({
+          type: 'rate_limit_exceeded',
+          userId,
+          details: { remaining: 0 },
+        });
+      }
+
+      const logger = getMockLogger();
+      // Should only log once (first event) due to throttling
+      // Note: If this test runs after another test with the same userId, it may log more than once
+      expect(vi.mocked(logger.warn)).toHaveBeenCalledTimes(1);
+    });
+
+    it('logs suppressed warnings after throttle window', async () => {
+      // Use a unique userId for this test to avoid interference from other tests
+      const userId = 'throttle-test-user-2' as UUID;
+      vi.clearAllMocks();
+
+      // Make multiple events
+      for (let i = 0; i < 5; i++) {
+        RBACSecurityValidator.logSecurityEvent({
+          type: 'rate_limit_exceeded',
+          userId,
+          details: { remaining: 0 },
+        });
+      }
+
+      // Wait for throttle window to expire (5 seconds)
+      await new Promise(resolve => setTimeout(resolve, 5100));
+
+      // Make another event - should log with suppressed count
+      RBACSecurityValidator.logSecurityEvent({
+        type: 'rate_limit_exceeded',
+        userId,
+        details: { remaining: 0 },
+      });
+
+      const logger = getMockLogger();
+      // Should have logged at least twice (first + after throttle)
+      expect(vi.mocked(logger.warn).mock.calls.length).toBeGreaterThanOrEqual(2);
+    });
+  });
+});

package/src/rbac/security.ts

@@ -7,7 +7,7 @@
  * Additional security measures for the RBAC system
  */
 
-import { UUID, Permission, Scope } from './types';
+import { UUID, Scope } from './types';
 import { createLogger } from '../utils/core/logger';
 
 const log = createLogger('RBACSecurity');
@@ -153,7 +153,7 @@ export class RBACSecurityValidator {
    * @param operation - Operation being performed
    * @returns True if within rate limit, false otherwise
    */
-  static async checkRateLimit(userId: UUID, operation: string): Promise<boolean> {
+  static async checkRateLimit(_userId: UUID, _operation: string): Promise<boolean> {
     // TODO: Implement actual rate limiting logic
     // This could use Redis, in-memory cache, or database-based rate limiting
     return true;
@@ -180,7 +180,7 @@ export class RBACSecurityValidator {
       | 'authentication_error'
       | 'unknown_error';
     userId: UUID;
-    details: Record<string, any>;
+    details: Record<string, unknown>;
     timestamp?: Date;
   }): void {
     const securityEvent = {
@@ -319,7 +319,7 @@ export class RBACSecurityMiddleware {
    * @param context - Security context
    * @returns Validation result
    */
-  async validateInput(input: any, context: SecurityContext): Promise<{
+  async validateInput(input: Record<string, unknown>, context: SecurityContext): Promise<{
     isValid: boolean;
     errors: string[];
   }> {
@@ -332,7 +332,8 @@ export class RBACSecurityMiddleware {
 
     // For page-level permissions, organisationId can be null (database handles it)
     // For resource-level permissions, organisationId is required
-    const isPagePermission = input.permission?.includes(':page.') || !!input.pageId;
+    const permission: string = typeof input.permission === 'string' ? input.permission : '';
+    const isPagePermission = permission.includes(':page.') || !!input.pageId;
     const requiresOrgId = !isPagePermission;
 
     // OrganisationId validation - only required for resource-level permissions
@@ -349,7 +350,7 @@ export class RBACSecurityMiddleware {
       }
     }
 
-    if (input.permission && !RBACSecurityValidator.validatePermission(input.permission)) {
+    if (permission && !RBACSecurityValidator.validatePermission(permission)) {
       errors.push('Invalid permission format');
     }
 

package/src/rbac/types/roleManagement.ts

@@ -0,0 +1,66 @@
+/**
+ * RBAC Role Management Types
+ * @package @jmruthers/pace-core
+ * @module RBAC/Types/RoleManagement
+ * @since 2.1.0
+ *
+ * Types for role management RPC params and results (event app, global, organisation).
+ */
+
+import type { UUID } from '../types';
+
+export interface EventAppRoleData {
+  user_id: UUID;
+  organisation_id: UUID;
+  event_id: string;
+  app_id: UUID;
+  role: 'viewer' | 'participant' | 'planner' | 'event_admin';
+}
+
+export interface OrganisationRoleData {
+  user_id: UUID;
+  organisation_id: UUID;
+  role: 'supporter' | 'member' | 'leader' | 'org_admin';
+}
+
+export interface GlobalRoleData {
+  user_id: UUID;
+  role: 'super_admin';
+}
+
+export interface RevokeEventAppRoleParams extends EventAppRoleData {
+  revoked_by?: UUID;
+}
+
+export interface GrantEventAppRoleParams extends EventAppRoleData {
+  granted_by?: UUID;
+  valid_from?: string;
+  valid_to?: string | null;
+}
+
+export interface RevokeOrganisationRoleParams extends OrganisationRoleData {
+  revoked_by?: UUID;
+}
+
+export interface GrantOrganisationRoleParams extends OrganisationRoleData {
+  granted_by?: UUID;
+  valid_from?: string;
+  valid_to?: string | null;
+}
+
+export interface RevokeGlobalRoleParams extends GlobalRoleData {
+  revoked_by?: UUID;
+}
+
+export interface GrantGlobalRoleParams extends GlobalRoleData {
+  granted_by?: UUID;
+  valid_from?: string;
+  valid_to?: string | null;
+}
+
+export interface RoleManagementResult {
+  success: boolean;
+  message?: string;
+  error?: string;
+  roleId?: UUID;
+}