@nakedev/go-scaffold 0.4.0 → 0.5.0

package/templates/add/auth/migrations/create_auth_tokens.up.sql.hbs

@@ -1,16 +1,21 @@
--- Short-lived auth tokens, for projects scaffolded with `--store postgres`.
--- Only the SHA-256 hash is stored; see model/authtoken.go for what `kind`
+-- Durable recovery tokens for both refresh-store choices. Refresh rotation may
+-- use Redis, but password reset and email verification share this DB contract.
+-- Only the SHA-256 hash is stored; see adapters/outbound/postgres/model.go for what `kind`
 -- means and why the rotation tombstone is a separate row.
 CREATE TABLE user_svc.auth_tokens (
     token_hash TEXT PRIMARY KEY,
     user_id    UUID NOT NULL,
     kind       VARCHAR(20) NOT NULL,
     expires_at TIMESTAMPTZ NOT NULL,
+    absolute_expires_at TIMESTAMPTZ,
+    provider   VARCHAR(20) NOT NULL DEFAULT '',
+    code_challenge TEXT NOT NULL DEFAULT '',
+    nonce      TEXT NOT NULL DEFAULT '',
     created_at TIMESTAMPTZ NOT NULL DEFAULT now()
 );
 
--- Named to match model.AuthToken's own `index:` tags exactly — GORM's
--- AutoMigrate (dev) reconciles against these names, and an index the
--- migration named differently is what stops the app booting.
+-- Named to match model.AuthToken's own `index:` tags exactly, so the
+-- development bootstrap and production migration describe the same indexes.
 CREATE INDEX idx_auth_tokens_user_kind ON user_svc.auth_tokens (user_id, kind);
 CREATE INDEX idx_auth_tokens_expires_at ON user_svc.auth_tokens (expires_at);
+CREATE INDEX idx_auth_tokens_absolute_expires_at ON user_svc.auth_tokens (absolute_expires_at);

package/templates/add/auth/migrations/create_identities.up.sql.hbs

@@ -10,6 +10,6 @@ CREATE TABLE user_svc.identities (
 
 -- Named unique indexes matching model.Identity's own
 -- `uniqueIndex:idx_identities_*` tags — see create_users.up.sql for why an
--- anonymous UNIQUE constraint breaks AutoMigrate.
+-- anonymous UNIQUE constraint breaks schema parity.
 CREATE UNIQUE INDEX idx_identities_user_provider ON user_svc.identities (user_id, provider);
 CREATE UNIQUE INDEX idx_identities_provider_uid ON user_svc.identities (provider, provider_uid);

package/templates/add/auth/migrations/create_login_throttle.up.sql.hbs

@@ -1,7 +1,7 @@
 -- Failed-attempt counter per account. Keyed on a hash of the submitted email
 -- so it works for addresses that have no account (otherwise throttling itself
 -- leaks which addresses are registered) and so this table is not a user list.
--- See model/loginthrottle.go for why this exists separately from the rate limiter.
+-- See adapters/outbound/postgres/model.go for why this exists separately from the rate limiter.
 CREATE TABLE user_svc.login_throttle (
     email_hash   TEXT PRIMARY KEY,
     failures     INTEGER NOT NULL DEFAULT 0,

package/templates/add/auth/migrations/create_mfa.down.sql.hbs

@@ -0,0 +1,3 @@
+DROP TABLE IF EXISTS user_svc.mfa_recovery_codes;
+DROP TABLE IF EXISTS user_svc.mfa_challenges;
+DROP TABLE IF EXISTS user_svc.mfa_enrollments;

package/templates/add/auth/migrations/create_mfa.up.sql.hbs

@@ -0,0 +1,29 @@
+-- MFA state is durable in Postgres for both refresh-token store choices. TOTP
+-- secrets are encrypted by the application; challenges and recovery codes are
+-- stored only as hashes and consumed atomically.
+CREATE TABLE user_svc.mfa_enrollments (
+    user_id          UUID PRIMARY KEY REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    encrypted_secret TEXT NOT NULL,
+    enabled          BOOLEAN NOT NULL DEFAULT false,
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE user_svc.mfa_challenges (
+    challenge_hash TEXT PRIMARY KEY,
+    user_id        UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    expires_at     TIMESTAMPTZ NOT NULL,
+    created_at     TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX idx_mfa_challenges_user ON user_svc.mfa_challenges (user_id);
+CREATE INDEX idx_mfa_challenges_expires_at ON user_svc.mfa_challenges (expires_at);
+
+CREATE TABLE user_svc.mfa_recovery_codes (
+    user_id    UUID NOT NULL REFERENCES user_svc.users(id) ON DELETE CASCADE,
+    code_hash  TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (user_id, code_hash)
+);
+
+CREATE INDEX idx_mfa_recovery_codes_user ON user_svc.mfa_recovery_codes (user_id);

package/templates/add/auth/migrations/create_users.up.sql.hbs

@@ -6,14 +6,15 @@ CREATE TABLE user_svc.users (
     name           VARCHAR(255) NOT NULL DEFAULT '',
     avatar_url     TEXT NOT NULL DEFAULT '',
     email_verified BOOLEAN NOT NULL DEFAULT false,
+    role           VARCHAR(20) NOT NULL DEFAULT 'staff',
     created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
     updated_at     TIMESTAMPTZ NOT NULL DEFAULT now()
 );
 
 -- A unique INDEX, not an inline UNIQUE constraint, and named to match the
--- `uniqueIndex:idx_users_email` tag on model.User exactly. Postgres names an
--- inline UNIQUE "users_email_key"; GORM's AutoMigrate (dev, AUTO_MIGRATE=true)
--- then sees uniqueness it didn't create and tries to drop it under its own
+-- `uniqueIndex:idx_users_email` tag on the outbound persistence model exactly. Postgres names an
+-- inline UNIQUE "users_email_key"; the development bootstrap then sees
+-- uniqueness it didn't create and tries to drop it under its own
 -- name, which fails the boot with
 --   constraint "uni_users_email" of relation "users" does not exist
 -- for anyone who ran `make migrate-up` first — which `add rbac` tells you to.

package/templates/add/rbac/internal/app/role/adapters/inbound/http/handler.go.hbs

@@ -0,0 +1,142 @@
+// Package httpadapter is role's inbound HTTP boundary. It owns route,
+// authentication middleware, request binding, response DTOs, and translation
+// from application errors to the API error envelope.
+package httpadapter
+
+import (
+	"errors"
+	"net/http"
+
+	"{{goModule}}/internal/app/role/application"
+	"{{goModule}}/internal/app/role/domain"
+	"{{goModule}}/internal/shared/apperror"
+	"{{goModule}}/internal/shared/httpx"
+	"{{goModule}}/internal/shared/middleware"
+	"{{goModule}}/internal/shared/pagination"
+
+	"github.com/gin-gonic/gin"
+)
+
+type Handler struct {
+	svc       application.ServicePort
+	jwtSecret string
+	authz     *middleware.Authz
+}
+
+func NewHandler(svc application.ServicePort, jwtSecret string, authz *middleware.Authz) *Handler {
+	return &Handler{svc: svc, jwtSecret: jwtSecret, authz: authz}
+}
+
+func (h *Handler) Register(rg gin.IRouter) {
+	roles := rg.Group("/roles", middleware.RequireAuth(h.jwtSecret), h.authz.Require(application.PermRoleManage))
+	roles.GET("", h.list)
+	roles.POST("", h.create)
+	roles.PATCH("/:code/permissions", h.setPermissions)
+	roles.DELETE("/:code", h.delete)
+
+	perms := rg.Group("/permissions", middleware.RequireAuth(h.jwtSecret), h.authz.Require(application.PermRoleManage))
+	perms.GET("", h.listPermissions)
+}
+
+func (h *Handler) list(c *gin.Context) {
+	p := pagination.Parse(c)
+	items, err := h.svc.List(c.Request.Context(), p.Limit, p.Offset)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	out := make([]application.RoleResponse, len(items))
+	for i := range items {
+		out[i] = application.ToRoleResponse(items[i])
+	}
+	c.JSON(http.StatusOK, p.Response(out))
+}
+
+func (h *Handler) create(c *gin.Context) {
+	var in application.CreateInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	item, err := h.svc.Create(c.Request.Context(), in)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	c.JSON(http.StatusCreated, application.ToRoleResponse(*item))
+}
+
+func (h *Handler) setPermissions(c *gin.Context) {
+	var in application.SetPermissionsInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	if in.PermissionCodes == nil {
+		c.Error(apperror.NewValidation("invalid role input", map[string]string{"permission_codes": "is required"}))
+		return
+	}
+	item, err := h.svc.SetPermissions(c.Request.Context(), c.Param("code"), *in.PermissionCodes)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	h.authz.Invalidate(item.Role.Code)
+	c.JSON(http.StatusOK, application.ToRoleResponse(*item))
+}
+
+func (h *Handler) delete(c *gin.Context) {
+	if err := h.svc.Delete(c.Request.Context(), c.Param("code")); err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	h.authz.Invalidate(c.Param("code"))
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) listPermissions(c *gin.Context) {
+	p := pagination.Parse(c)
+	items, err := h.svc.ListPermissions(c.Request.Context(), p.Limit, p.Offset)
+	if err != nil {
+		c.Error(toHTTPError(err))
+		return
+	}
+	out := make([]application.PermissionResponse, len(items))
+	for i := range items {
+		out[i] = application.ToPermissionResponse(items[i])
+	}
+	c.JSON(http.StatusOK, p.Response(out))
+}
+
+func toHTTPError(err error) error {
+	if err == nil {
+		return nil
+	}
+	var appErr *apperror.AppError
+	if errors.As(err, &appErr) {
+		return err
+	}
+	var rule *domain.RuleError
+	if errors.As(err, &rule) {
+		status := http.StatusUnprocessableEntity
+		switch {
+		case errors.Is(err, domain.ErrNotFound):
+			status = http.StatusNotFound
+		case errors.Is(err, domain.ErrConflict), errors.Is(err, domain.ErrHasReferences), errors.Is(err, domain.ErrSystemRole), errors.Is(err, domain.ErrLastRoleManager):
+			status = http.StatusConflict
+		}
+		return apperror.New(status, rule.Code, rule.Message)
+	}
+	switch {
+	case errors.Is(err, domain.ErrNotFound):
+		return apperror.New(http.StatusNotFound, "ROLE_NOT_FOUND", "role not found")
+	case errors.Is(err, domain.ErrConflict):
+		return apperror.New(http.StatusConflict, "ROLE_CONFLICT", "role conflict")
+	case errors.Is(err, domain.ErrHasReferences):
+		return apperror.New(http.StatusConflict, "ROLE_HAS_REFERENCES", "role still has users assigned to it")
+	case errors.Is(err, domain.ErrUnknownPermission):
+		return apperror.New(http.StatusUnprocessableEntity, "ROLE_UNKNOWN_PERMISSION", "one or more permission codes do not exist")
+	default:
+		return apperror.NewInternal(err)
+	}
+}

package/templates/add/rbac/internal/app/role/adapters/inbound/http/handler_test.go.hbs

@@ -0,0 +1,19 @@
+package httpadapter
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"{{goModule}}/internal/shared/middleware"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestHandler_Register(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	authz := middleware.NewAuthz(func(context.Context, string) (map[string]struct{}, error) {
+		return map[string]struct{}{}, nil
+	}, time.Minute)
+	NewHandler(nil, "", authz).Register(gin.New())
+}

package/templates/add/rbac/internal/app/role/adapters/outbound/postgres/model.go.hbs

@@ -0,0 +1,48 @@
+// Package postgres contains role persistence records. They are deliberately
+// separate from role/domain so schema tags cannot leak into use cases.
+package postgres
+
+import (
+	"time"
+
+	"{{goModule}}/internal/app/role/domain"
+)
+
+type Role struct {
+	Code      string `gorm:"type:varchar(20);primaryKey"`
+	Name      string `gorm:"not null"`
+	IsSystem  bool   `gorm:"not null;default:false"`
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+func (Role) TableName() string { return "role_svc.roles" }
+
+type Permission struct {
+	Code        string `gorm:"type:varchar(50);primaryKey"`
+	Description string `gorm:"not null"`
+}
+
+func (Permission) TableName() string { return "role_svc.permissions" }
+
+type RolePermission struct {
+	RoleCode       string `gorm:"primaryKey;type:varchar(20)"`
+	PermissionCode string `gorm:"primaryKey;type:varchar(50)"`
+}
+
+func (RolePermission) TableName() string { return "role_svc.role_permissions" }
+
+func toDomainRole(row *Role) domain.Role {
+	return domain.Role{Code: row.Code, Name: row.Name, IsSystem: row.IsSystem, CreatedAt: row.CreatedAt, UpdatedAt: row.UpdatedAt}
+}
+
+func fromDomainRole(value *domain.Role) *Role {
+	if value == nil {
+		return nil
+	}
+	return &Role{Code: value.Code, Name: value.Name, IsSystem: value.IsSystem, CreatedAt: value.CreatedAt, UpdatedAt: value.UpdatedAt}
+}
+
+func toDomainPermission(row *Permission) domain.Permission {
+	return domain.Permission{Code: row.Code, Description: row.Description}
+}

package/templates/add/rbac/internal/app/role/adapters/outbound/postgres/repository.go.hbs

@@ -0,0 +1,127 @@
+package postgres
+
+import (
+	"context"
+	"errors"
+
+	"{{goModule}}/internal/app/role/domain"
+	"{{goModule}}/internal/app/role/ports"
+	"{{goModule}}/internal/shared/dberr"
+	"{{goModule}}/internal/shared/tx"
+
+	"gorm.io/gorm"
+)
+
+var _ ports.Repository = (*Repository)(nil)
+
+type Repository struct {
+	db *gorm.DB
+}
+
+func NewRepository(db *gorm.DB) *Repository { return &Repository{db: db} }
+
+func (r *Repository) PermissionCodes(ctx context.Context, roleCode string) ([]string, error) {
+	var codes []string
+	err := tx.From(ctx, r.db).WithContext(ctx).
+		Model(&RolePermission{}).Where("role_code = ?", roleCode).Pluck("permission_code", &codes).Error
+	return codes, mapDatabaseError(err)
+}
+
+func (r *Repository) FindAll(ctx context.Context, limit, offset int) ([]domain.Role, error) {
+	var rows []Role
+	err := tx.From(ctx, r.db).WithContext(ctx).Order("code").Limit(limit).Offset(offset).Find(&rows).Error
+	if err != nil {
+		return nil, mapDatabaseError(err)
+	}
+	items := make([]domain.Role, len(rows))
+	for i := range rows {
+		items[i] = toDomainRole(&rows[i])
+	}
+	return items, nil
+}
+
+func (r *Repository) FindByCode(ctx context.Context, code string) (*domain.Role, error) {
+	var row Role
+	if err := tx.From(ctx, r.db).WithContext(ctx).First(&row, "code = ?", code).Error; err != nil {
+		return nil, mapDatabaseError(err)
+	}
+	value := toDomainRole(&row)
+	return &value, nil
+}
+
+func (r *Repository) Create(ctx context.Context, role *domain.Role) error {
+	return mapDatabaseError(tx.From(ctx, r.db).WithContext(ctx).Create(fromDomainRole(role)).Error)
+}
+
+func (r *Repository) SetPermissions(ctx context.Context, roleCode string, permissionCodes []string) error {
+	return tx.Do(ctx, r.db, func(txctx context.Context) error {
+		db := tx.From(txctx, r.db).WithContext(txctx)
+		if err := db.Where("role_code = ?", roleCode).Delete(&RolePermission{}).Error; err != nil {
+			return mapDatabaseError(err)
+		}
+		if len(permissionCodes) == 0 {
+			return nil
+		}
+		grants := make([]RolePermission, len(permissionCodes))
+		for i, code := range permissionCodes {
+			grants[i] = RolePermission{RoleCode: roleCode, PermissionCode: code}
+		}
+		return mapDatabaseError(db.Create(&grants).Error)
+	})
+}
+
+func (r *Repository) Delete(ctx context.Context, code string) error {
+	result := tx.From(ctx, r.db).WithContext(ctx).Where("code = ?", code).Delete(&Role{})
+	if result.Error != nil {
+		if dberr.IsForeignKey(result.Error) {
+			return domain.ErrHasReferences
+		}
+		return mapDatabaseError(result.Error)
+	}
+	if result.RowsAffected == 0 {
+		return domain.ErrNotFound
+	}
+	return nil
+}
+
+func (r *Repository) FindAllPermissions(ctx context.Context, limit, offset int) ([]domain.Permission, error) {
+	var rows []Permission
+	err := tx.From(ctx, r.db).WithContext(ctx).Order("code").Limit(limit).Offset(offset).Find(&rows).Error
+	if err != nil {
+		return nil, mapDatabaseError(err)
+	}
+	items := make([]domain.Permission, len(rows))
+	for i := range rows {
+		items[i] = toDomainPermission(&rows[i])
+	}
+	return items, nil
+}
+
+func (r *Repository) AllPermissionCodes(ctx context.Context) ([]string, error) {
+	var codes []string
+	err := tx.From(ctx, r.db).WithContext(ctx).Model(&Permission{}).Pluck("code", &codes).Error
+	return codes, mapDatabaseError(err)
+}
+
+func (r *Repository) CountRolesWithPermission(ctx context.Context, permissionCode, excludeCode string) (int64, error) {
+	var count int64
+	err := tx.From(ctx, r.db).WithContext(ctx).Model(&RolePermission{}).
+		Where("permission_code = ? AND role_code <> ?", permissionCode, excludeCode).Count(&count).Error
+	return count, mapDatabaseError(err)
+}
+
+func mapDatabaseError(err error) error {
+	if err == nil {
+		return nil
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return domain.ErrNotFound
+	}
+	if dberr.IsDuplicate(err) {
+		return domain.ErrConflict
+	}
+	if dberr.IsForeignKey(err) {
+		return domain.ErrUnknownPermission
+	}
+	return err
+}

package/templates/add/rbac/internal/app/role/{repository_test.go.hbs → adapters/outbound/postgres/repository_test.go.hbs}

@@ -1,11 +1,11 @@
-package role
+package postgres
 
 import (
 	"context"
 	"os"
 	"testing"
 
-	"{{goModule}}/internal/app/role/model"
+	"{{goModule}}/internal/app/role/domain"
 
 	"github.com/google/uuid"
 	"gorm.io/driver/postgres"
@@ -67,11 +67,11 @@ func testCode(t *testing.T) string {
 }
 
 // seedPermission inserts directly rather than through Repository, which has
-// no create method for Permission on purpose (see model/permission.go.hbs:
+// no create method for Permission on purpose (see adapters/outbound/postgres/model.go:
 // "seeded by migration, not admin-created"). Tests still need rows to grant.
 func seedPermission(t *testing.T, tx *gorm.DB, code string) {
 	t.Helper()
-	if err := tx.WithContext(context.Background()).Create(&model.Permission{Code: code, Description: code}).Error; err != nil {
+	if err := tx.WithContext(context.Background()).Create(&Permission{Code: code, Description: code}).Error; err != nil {
 		t.Fatalf("seed permission %s: %v", code, err)
 	}
 }
@@ -87,7 +87,7 @@ func TestRepository_SetPermissions_ReplacesEntireSet(t *testing.T) {
 
 	roleCode := testCode(t)
 	permA, permB, permC := testCode(t), testCode(t), testCode(t)
-	if err := repo.Create(ctx, &model.Role{Code: roleCode, Name: roleCode}); err != nil {
+	if err := repo.Create(ctx, &domain.Role{Code: roleCode, Name: roleCode}); err != nil {
 		t.Fatalf("seed role: %v", err)
 	}
 	seedPermission(t, tx, permA)
@@ -121,7 +121,7 @@ func TestRepository_Delete_CascadesRolePermissions(t *testing.T) {
 
 	roleCode := testCode(t)
 	permCode := testCode(t)
-	if err := repo.Create(ctx, &model.Role{Code: roleCode, Name: roleCode}); err != nil {
+	if err := repo.Create(ctx, &domain.Role{Code: roleCode, Name: roleCode}); err != nil {
 		t.Fatalf("seed role: %v", err)
 	}
 	seedPermission(t, tx, permCode)
@@ -152,10 +152,10 @@ func TestRepository_CountRolesWithPermission_ExcludesGivenRole(t *testing.T) {
 
 	roleA, roleB := testCode(t), testCode(t)
 	permCode := testCode(t)
-	if err := repo.Create(ctx, &model.Role{Code: roleA, Name: roleA}); err != nil {
+	if err := repo.Create(ctx, &domain.Role{Code: roleA, Name: roleA}); err != nil {
 		t.Fatalf("seed role a: %v", err)
 	}
-	if err := repo.Create(ctx, &model.Role{Code: roleB, Name: roleB}); err != nil {
+	if err := repo.Create(ctx, &domain.Role{Code: roleB, Name: roleB}); err != nil {
 		t.Fatalf("seed role b: %v", err)
 	}
 	seedPermission(t, tx, permCode)

package/templates/add/rbac/internal/app/role/application/dto.go.hbs

@@ -0,0 +1,47 @@
+package application
+
+import (
+	"time"
+
+	"{{goModule}}/internal/app/role/domain"
+)
+
+const PermRoleManage = "role:manage"
+
+type CreateInput struct {
+	Code string `json:"code"`
+	Name string `json:"name"`
+}
+
+type SetPermissionsInput struct {
+	PermissionCodes *[]string `json:"permission_codes"`
+}
+
+type RoleListItem struct {
+	Role        domain.Role
+	Permissions []string
+}
+
+type RoleResponse struct {
+	Code        string    `json:"code"`
+	Name        string    `json:"name"`
+	IsSystem    bool      `json:"is_system"`
+	Permissions []string  `json:"permissions"`
+	CreatedAt   time.Time `json:"created_at"`
+}
+
+type PermissionResponse struct {
+	Code        string `json:"code"`
+	Description string `json:"description"`
+}
+
+func ToRoleResponse(item RoleListItem) RoleResponse {
+	return RoleResponse{
+		Code: item.Role.Code, Name: item.Role.Name, IsSystem: item.Role.IsSystem,
+		Permissions: item.Permissions, CreatedAt: item.Role.CreatedAt,
+	}
+}
+
+func ToPermissionResponse(item domain.Permission) PermissionResponse {
+	return PermissionResponse{Code: item.Code, Description: item.Description}
+}

package/templates/add/rbac/internal/app/role/application/errors.go.hbs

@@ -0,0 +1,19 @@
+package application
+
+import "{{goModule}}/internal/app/role/domain"
+
+func errInvalidCode() error {
+	return domain.Rule("ROLE_INVALID_CODE", "code must start with a lowercase letter and contain only lowercase letters, digits, or underscores", domain.ErrInvalidCode)
+}
+
+func errSystemRole() error {
+	return domain.Rule("ROLE_IS_SYSTEM", "staff/admin are system roles and cannot be deleted", domain.ErrSystemRole)
+}
+
+func errUnknownPermission() error {
+	return domain.Rule("ROLE_UNKNOWN_PERMISSION", "one or more permission codes do not exist", domain.ErrUnknownPermission)
+}
+
+func errLastRoleManager() error {
+	return domain.Rule("ROLE_LAST_MANAGER", "this is the only role that can manage roles/permissions — grant "+PermRoleManage+" to another role first", domain.ErrLastRoleManager)
+}