@owox/idp-better-auth 0.5.0

package/dist/services/token-service.js

@@ -0,0 +1,108 @@
+export class TokenService {
+    auth;
+    cryptoService;
+    static DEFAULT_ORGANIZATION_ID = 'owox-default';
+    constructor(auth, cryptoService) {
+        this.auth = auth;
+        this.cryptoService = cryptoService;
+    }
+    async introspectToken(token) {
+        try {
+            const cleanToken = token.replace('Bearer ', '');
+            const decryptedToken = await this.cryptoService.decrypt(cleanToken);
+            const encodedToken = encodeURIComponent(decryptedToken);
+            const session = await this.auth.api.getSession({
+                headers: new Headers({
+                    Cookie: `refreshToken=${encodedToken}`,
+                }),
+            });
+            if (!session || !session.user) {
+                return null;
+            }
+            return {
+                userId: session.user.id,
+                projectId: TokenService.DEFAULT_ORGANIZATION_ID,
+                email: session.user.email,
+                fullName: session.user.name || session.user.email,
+                roles: ['admin'],
+            };
+        }
+        catch (error) {
+            console.error('Token introspection failed:', error);
+            throw new Error('Token introspection failed');
+        }
+    }
+    async parseToken(token) {
+        return this.introspectToken(token);
+    }
+    async verifyToken(token) {
+        try {
+            const cleanToken = token.replace('Bearer ', '');
+            const decryptedToken = await this.cryptoService.decrypt(cleanToken);
+            const session = await this.auth.api.getSession({
+                headers: new Headers({
+                    Authorization: `Bearer ${decryptedToken}`,
+                    Cookie: `refreshToken=${decryptedToken}`,
+                }),
+            });
+            if (!session || !session.user) {
+                return null;
+            }
+            return {
+                userId: session.user.id,
+                projectId: TokenService.DEFAULT_ORGANIZATION_ID,
+                email: session.user.email,
+                fullName: session.user.name || session.user.email,
+                roles: ['admin'],
+            };
+        }
+        catch (error) {
+            console.error('Token verification failed:', error);
+            throw new Error('Token verification failed');
+        }
+    }
+    async refreshToken(refreshToken) {
+        try {
+            // TODO: decode refresh token
+            const session = await this.auth.api.getSession({
+                headers: new Headers({
+                    Cookie: `refreshToken=${refreshToken}`,
+                }),
+            });
+            if (!session) {
+                throw new Error('Invalid refresh token');
+            }
+            const encryptedToken = await this.cryptoService.encrypt(session.session.token);
+            return {
+                accessToken: encryptedToken,
+            };
+        }
+        catch (error) {
+            console.error('Token refresh failed:', error);
+            throw new Error('Token refresh failed');
+        }
+    }
+    async revokeToken(token) {
+        try {
+            const cleanToken = token.replace('Bearer ', '');
+            const decryptedToken = await this.cryptoService.decrypt(cleanToken);
+            const session = await this.auth.api.getSession({
+                headers: new Headers({
+                    Authorization: `Bearer ${decryptedToken}`,
+                    Cookie: `refreshToken=${decryptedToken}`,
+                }),
+            });
+            if (session) {
+                await this.auth.api.signOut({
+                    headers: new Headers({
+                        Cookie: `refreshToken=${decryptedToken}`,
+                    }),
+                });
+            }
+        }
+        catch (error) {
+            console.error('Failed to revoke token:', error);
+            throw new Error('Failed to revoke token');
+        }
+    }
+}

package/dist/services/user-management-service.d.ts

@@ -0,0 +1,74 @@
+import { createBetterAuthConfig } from '../auth/auth-config.js';
+import { MagicLinkService } from './magic-link-service.js';
+import { CryptoService } from './crypto-service.js';
+import { Payload, AddUserCommandResponse } from '@owox/idp-protocol';
+import { type Role } from '../types/index.js';
+import { type Request as ExpressRequest } from 'express';
+export declare class UserManagementService {
+    private readonly auth;
+    private readonly magicLinkService;
+    private readonly cryptoService?;
+    private static readonly DEFAULT_ORGANIZATION_ID;
+    private static readonly DEFAULT_ORGANIZATION_NAME;
+    private static readonly DEFAULT_ORGANIZATION_SLUG;
+    private readonly baseURL;
+    /**
+     * Role hierarchy permissions
+     * admin can invite: admin, editor, viewer
+     * editor can invite: editor, viewer
+     * viewer can invite: viewer
+     */
+    private static readonly roleHierarchy;
+    constructor(auth: Awaited<ReturnType<typeof createBetterAuthConfig>>, magicLinkService: MagicLinkService, cryptoService?: CryptoService | undefined);
+    addUserViaMagicLink(username: string): Promise<AddUserCommandResponse>;
+    listUsers(): Promise<Payload[]>;
+    private listUsersDirectly;
+    removeUser(userId: string): Promise<void>;
+    private removeUserDirectly;
+    addMemberToOrganization(req: ExpressRequest, role: Role): Promise<void>;
+    private ensureDefaultOrganization;
+    private createDefaultOrganizationForUser;
+    private addUserToOrganization;
+    getUsersForAdmin(): Promise<Array<{
+        id: string;
+        email: string;
+        name: string | null;
+        role: string;
+        createdAt: string;
+        updatedAt: string | null;
+    }>>;
+    getUserDetails(userId: string): Promise<{
+        id: string;
+        email: string;
+        name: string | null;
+        role: string;
+        createdAt: string;
+        updatedAt: string | null;
+        organizationId: string | null;
+    } | null>;
+    generateMagicLinkForUser(email: string, role: Role): Promise<string>;
+    updateUserName(userId: string, name: string): Promise<void>;
+    getUserRole(userId: string): Promise<string | null>;
+    private getDbInstance;
+    /**
+     * Check if current user role can invite target role
+     */
+    canInviteRole(currentUserRole: Role, targetRole: Role): boolean;
+    /**
+     * Get roles that current user can invite
+     */
+    getAllowedRolesForInvite(currentUserRole: Role): Role[];
+    /**
+     * Validate if role exists
+     */
+    isValidRole(role: string): role is Role;
+    /**
+     * Get role priority (higher number = more permissions)
+     */
+    getRolePriority(role: Role): number;
+    /**
+     * Check if current role has higher or equal priority than target role
+     */
+    hasHigherOrEqualPriority(currentRole: Role, targetRole: Role): boolean;
+}
+//# sourceMappingURL=user-management-service.d.ts.map

package/dist/services/user-management-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-management-service.d.ts","sourceRoot":"","sources":["../../src/services/user-management-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EAAE,KAAK,OAAO,IAAI,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzD,qBAAa,qBAAqB;IAmB9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IApBjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAkC;IACjF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAqB;IACtE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAqB;IACtE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAInC;gBAGiB,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,EACxD,gBAAgB,EAAE,gBAAgB,EAClC,aAAa,CAAC,EAAE,aAAa,YAAA;IAK1C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAgBtE,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YA2CvB,iBAAiB;IA0BzB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAiCjC,kBAAkB;IAiD1B,uBAAuB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAgB/D,yBAAyB;YAuBzB,gCAAgC;YA4ChC,qBAAqB;IAyC7B,gBAAgB,IAAI,OAAO,CAC/B,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CACH;IAiCK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5C,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,IAAI,CAAC;IAqCH,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAcpE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoBzD,OAAO,CAAC,aAAa;IAcrB;;OAEG;IACH,aAAa,CAAC,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO;IAK/D;;OAEG;IACH,wBAAwB,CAAC,eAAe,EAAE,IAAI,GAAG,IAAI,EAAE;IAIvD;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,IAAI;IAIvC;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM;IASnC;;OAEG;IACH,wBAAwB,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO;CAGvE"}

package/dist/services/user-management-service.js

@@ -0,0 +1,396 @@
+export class UserManagementService {
+    auth;
+    magicLinkService;
+    cryptoService;
+    static DEFAULT_ORGANIZATION_ID = 'owox_data_marts_organization';
+    static DEFAULT_ORGANIZATION_NAME = 'OWOX Data Marts';
+    static DEFAULT_ORGANIZATION_SLUG = 'owox-data-marts';
+    baseURL;
+    /**
+     * Role hierarchy permissions
+     * admin can invite: admin, editor, viewer
+     * editor can invite: editor, viewer
+     * viewer can invite: viewer
+     */
+    static roleHierarchy = {
+        admin: ['admin', 'editor', 'viewer'],
+        editor: ['editor', 'viewer'],
+        viewer: ['viewer'],
+    };
+    constructor(auth, magicLinkService, cryptoService) {
+        this.auth = auth;
+        this.magicLinkService = magicLinkService;
+        this.cryptoService = cryptoService;
+        this.baseURL = this.auth.options.baseURL || 'http://localhost:3000';
+    }
+    async addUserViaMagicLink(username) {
+        try {
+            const magicLink = await this.magicLinkService.generateMagicLink(username);
+            return {
+                username,
+                magicLink,
+            };
+        }
+        catch (error) {
+            console.error('Error adding user:', error);
+            throw new Error(`Failed to add user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    async listUsers() {
+        try {
+            const listMembersRequest = new Request(`${this.baseURL}/auth/better-auth/organization/list-members`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    organizationId: UserManagementService.DEFAULT_ORGANIZATION_ID,
+                }),
+            });
+            try {
+                const response = await this.auth.handler(listMembersRequest);
+                if (response.ok) {
+                    const result = await response.json();
+                    const members = result.members || [];
+                    return members.map((member) => ({
+                        userId: member.user?.id || member.userId,
+                        projectId: UserManagementService.DEFAULT_ORGANIZATION_ID,
+                        email: member.user?.email || 'unknown@email.com',
+                        fullName: member.user?.name || member.user?.email || 'Unknown User',
+                        roles: ['editor'],
+                    }));
+                }
+                else {
+                    return await this.listUsersDirectly();
+                }
+            }
+            catch {
+                return await this.listUsersDirectly();
+            }
+        }
+        catch (error) {
+            console.error('Error listing users:', error);
+            throw new Error('Failed to list users');
+        }
+    }
+    async listUsersDirectly() {
+        try {
+            const db = this.auth.options.database;
+            if (!db || typeof db.prepare !== 'function') {
+                return [];
+            }
+            const stmt = db.prepare('SELECT id, email, name FROM user ORDER BY createdAt DESC');
+            const users = stmt.all();
+            return users.map((user) => ({
+                userId: user.id,
+                projectId: UserManagementService.DEFAULT_ORGANIZATION_ID,
+                email: user.email,
+                fullName: user.name || user.email,
+                roles: ['editor'],
+            }));
+        }
+        catch (error) {
+            console.error('Error listing users directly from database:', error);
+            return [];
+        }
+    }
+    async removeUser(userId) {
+        try {
+            // Step 1: Remove user from organization first
+            const removeMemberRequest = new Request(`${this.baseURL}/auth/better-auth/organization/remove-member`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    userId: userId,
+                    organizationId: UserManagementService.DEFAULT_ORGANIZATION_ID,
+                }),
+            });
+            try {
+                await this.auth.handler(removeMemberRequest);
+            }
+            catch {
+                // Continue with user deletion even if organization removal fails
+            }
+            // Step 2: Remove user from Better Auth system
+            await this.removeUserDirectly(userId);
+        }
+        catch (error) {
+            console.error('Error removing user:', error);
+            throw new Error(`Failed to remove user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    async removeUserDirectly(userId) {
+        try {
+            const db = this.auth.options.database;
+            if (!db || typeof db.prepare !== 'function') {
+                console.error('Database adapter does not support direct operations');
+                throw new Error('Database adapter does not support direct operations');
+            }
+            // Clean up user's sessions
+            try {
+                const deleteSessionsStmt = db.prepare('DELETE FROM session WHERE userId = ?');
+                deleteSessionsStmt.run(userId);
+            }
+            catch {
+                // Session cleanup may not be needed
+            }
+            // Clean up user's accounts
+            try {
+                const deleteAccountsStmt = db.prepare('DELETE FROM account WHERE userId = ?');
+                deleteAccountsStmt.run(userId);
+            }
+            catch {
+                // Account cleanup may not be needed
+            }
+            // Clean up organization memberships
+            try {
+                const deleteMembershipsStmt = db.prepare('DELETE FROM member WHERE userId = ?');
+                deleteMembershipsStmt.run(userId);
+            }
+            catch {
+                // Organization membership cleanup may not be needed
+            }
+            // Finally, remove the user
+            const deleteUserStmt = db.prepare('DELETE FROM user WHERE id = ?');
+            const result = deleteUserStmt.run(userId);
+            if (result.changes === 0) {
+                console.error(`User ${userId} not found`);
+                throw new Error(`User ${userId} not found`);
+            }
+        }
+        catch (error) {
+            console.error(`Failed to delete user ${userId}:`, error);
+            throw new Error(`Failed to delete user ${userId}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    async addMemberToOrganization(req, role) {
+        const session = await this.auth.api.getSession({
+            headers: req.headers,
+        });
+        if (!session) {
+            throw new Error('No session found');
+        }
+        if (!(await this.ensureDefaultOrganization())) {
+            await this.createDefaultOrganizationForUser(session.user.id, role);
+        }
+        else {
+            await this.addUserToOrganization(session.user.id, role);
+        }
+    }
+    async ensureDefaultOrganization() {
+        try {
+            const db = this.auth.options.database;
+            if (!db || typeof db.prepare !== 'function') {
+                console.error('Database adapter does not support direct operations for organization check');
+                throw new Error('Database adapter does not support direct operations for organization check');
+            }
+            const stmt = db.prepare('SELECT id FROM organization WHERE slug = ? LIMIT 1');
+            const existingOrg = stmt.get(UserManagementService.DEFAULT_ORGANIZATION_SLUG);
+            if (existingOrg) {
+                return true;
+            }
+        }
+        catch (error) {
+            console.error('Error checking default organization:', error);
+            throw new Error('Error checking default organization');
+        }
+        return false;
+    }
+    async createDefaultOrganizationForUser(userId, role) {
+        try {
+            const db = this.getDbInstance();
+            const orgId = UserManagementService.DEFAULT_ORGANIZATION_ID;
+            try {
+                const insertOrgStmt = db.prepare(`
+          INSERT INTO organization (id, name, slug, metadata, createdAt) 
+          VALUES (?, ?, ?, ?, ?)
+        `);
+                const now = new Date().toISOString();
+                insertOrgStmt.run(orgId, UserManagementService.DEFAULT_ORGANIZATION_NAME, UserManagementService.DEFAULT_ORGANIZATION_SLUG, JSON.stringify({ isDefault: true, createdBy: userId }), now);
+                const insertMemberStmt = db.prepare(`
+          INSERT INTO member (id, organizationId, userId, role, createdAt) 
+          VALUES (?, ?, ?, ?, ?)
+        `);
+                const memberId = `${orgId}_${userId}`;
+                insertMemberStmt.run(memberId, orgId, userId, role, now);
+            }
+            catch (dbError) {
+                if (String(dbError).includes('UNIQUE constraint failed') ||
+                    String(dbError).includes('already exists')) {
+                    await this.addUserToOrganization(userId, role);
+                }
+                else {
+                    throw dbError;
+                }
+            }
+        }
+        catch (error) {
+            console.error('Error creating default organization for user:', error);
+            throw new Error('Error creating default organization for user');
+        }
+    }
+    async addUserToOrganization(userId, role) {
+        const db = this.getDbInstance();
+        try {
+            // First check if user already exists in organization
+            const checkStmt = db.prepare('SELECT role FROM member WHERE userId = ? AND organizationId = ?');
+            const existingMember = checkStmt.get(userId, UserManagementService.DEFAULT_ORGANIZATION_ID);
+            if (existingMember) {
+                // Update existing member role
+                const updateStmt = db.prepare('UPDATE member SET role = ? WHERE userId = ? AND organizationId = ?');
+                updateStmt.run(role, userId, UserManagementService.DEFAULT_ORGANIZATION_ID);
+            }
+            else {
+                // Insert new member
+                const insertMemberStmt = db.prepare(`
+          INSERT INTO member (id, organizationId, userId, role, createdAt) 
+          VALUES (?, ?, ?, ?, ?)
+        `);
+                const memberId = `${UserManagementService.DEFAULT_ORGANIZATION_ID}_${userId}`;
+                const now = new Date().toISOString();
+                insertMemberStmt.run(memberId, UserManagementService.DEFAULT_ORGANIZATION_ID, userId, role, now);
+            }
+        }
+        catch (error) {
+            console.error('Error in addUserToOrganization:', error);
+            if (!String(error).includes('UNIQUE constraint failed')) {
+                throw error;
+            }
+        }
+    }
+    async getUsersForAdmin() {
+        try {
+            const db = this.getDbInstance();
+            const stmt = db.prepare(`
+        SELECT 
+          u.id, 
+          u.email, 
+          u.name, 
+          u.createdAt,
+          u.updatedAt,
+          COALESCE(m.role, 'viewer') as role
+        FROM user u
+        LEFT JOIN member m ON u.id = m.userId
+        ORDER BY u.createdAt DESC
+      `);
+            const users = stmt.all();
+            return users;
+        }
+        catch (error) {
+            console.error('Error getting users for admin:', error);
+            throw new Error('Failed to get users for admin');
+        }
+    }
+    async getUserDetails(userId) {
+        try {
+            const db = this.getDbInstance();
+            const stmt = db.prepare(`
+        SELECT 
+          u.id, 
+          u.email, 
+          u.name, 
+          u.createdAt,
+          u.updatedAt,
+          COALESCE(m.role, 'viewer') as role,
+          m.organizationId
+        FROM user u
+        LEFT JOIN member m ON u.id = m.userId
+        WHERE u.id = ?
+      `);
+            const user = stmt.get(userId);
+            return user || null;
+        }
+        catch (error) {
+            console.error('Error getting user details:', error);
+            throw new Error('Failed to get user details');
+        }
+    }
+    async generateMagicLinkForUser(email, role) {
+        try {
+            if (!this.cryptoService) {
+                throw new Error('CryptoService not available for magic link generation');
+            }
+            const magicLink = await this.magicLinkService.generateMagicLink(email, role);
+            return magicLink;
+        }
+        catch (error) {
+            console.error('Error generating magic link for user:', error);
+            throw new Error('Failed to generate magic link');
+        }
+    }
+    async updateUserName(userId, name) {
+        try {
+            const db = this.getDbInstance();
+            const updateStmt = db.prepare('UPDATE user SET name = ? WHERE id = ?');
+            const result = updateStmt.run(name, userId);
+            if (result.changes === 0) {
+                throw new Error(`User ${userId} not found or name not updated`);
+            }
+        }
+        catch (error) {
+            console.error('Error updating user name:', error);
+            throw new Error('Failed to update user name');
+        }
+    }
+    async getUserRole(userId) {
+        try {
+            const db = this.getDbInstance();
+            const stmt = db.prepare(`
+        SELECT role FROM member 
+        WHERE userId = ? AND organizationId = ?
+      `);
+            const member = stmt.get(userId, UserManagementService.DEFAULT_ORGANIZATION_ID);
+            return member ? member.role : null;
+        }
+        catch (error) {
+            console.error('Failed to get user role:', error);
+            throw new Error('Failed to get user role');
+        }
+    }
+    getDbInstance() {
+        const db = this.auth.options.database;
+        if (!db || typeof db.prepare !== 'function') {
+            throw new Error('Database adapter does not support direct operations');
+        }
+        return db;
+    }
+    // ========== Role Permission Methods ==========
+    /**
+     * Check if current user role can invite target role
+     */
+    canInviteRole(currentUserRole, targetRole) {
+        const allowedRoles = UserManagementService.roleHierarchy[currentUserRole];
+        return allowedRoles.includes(targetRole);
+    }
+    /**
+     * Get roles that current user can invite
+     */
+    getAllowedRolesForInvite(currentUserRole) {
+        return UserManagementService.roleHierarchy[currentUserRole];
+    }
+    /**
+     * Validate if role exists
+     */
+    isValidRole(role) {
+        return ['admin', 'editor', 'viewer'].includes(role);
+    }
+    /**
+     * Get role priority (higher number = more permissions)
+     */
+    getRolePriority(role) {
+        const priorities = {
+            admin: 3,
+            editor: 2,
+            viewer: 1,
+        };
+        return priorities[role];
+    }
+    /**
+     * Check if current role has higher or equal priority than target role
+     */
+    hasHigherOrEqualPriority(currentRole, targetRole) {
+        return this.getRolePriority(currentRole) >= this.getRolePriority(targetRole);
+    }
+}