@synnaxlabs/client 0.56.1 → 0.57.0

package/src/access/granted.ts

@@ -0,0 +1,114 @@
+// Copyright 2026 Synnax Labs, Inc.
+//
+// Use of this software is governed by the Business Source License included in the file
+// licenses/BSL.txt.
+//
+// As of the Change Date specified in that file, in accordance with the Business Source
+// License, use of this software will be governed by the Apache License, Version 2.0,
+// included in the file licenses/APL.txt.
+
+import { type destructor } from "@synnaxlabs/x";
+
+import { type Action } from "@/access/action/types.gen";
+import { allowRequest } from "@/access/enforce";
+import { type policy } from "@/access/policy";
+import { ontology } from "@/ontology";
+import { query } from "@/query";
+
+/** A permission question: may the subject apply the action to the objects? */
+export interface GrantedQuery {
+  objects: ontology.ID | ontology.ID[];
+  action: Action;
+}
+
+interface Verdict {
+  subject: string;
+  policies: policy.Policy[];
+  verdict: boolean;
+}
+
+interface SubjectEntry {
+  key: string;
+  query: { for: ontology.ID };
+}
+
+export interface GrantedConfig {
+  policies: policy.Client;
+}
+
+/**
+ * The cached read surface for permission checks, answering {@link GrantedQuery}
+ * questions against the subject's cached policies. Snapshot reads memoize the
+ * verdict per query object, so render-hot callers pay a policy evaluation only
+ * when the policies actually change.
+ */
+export class Granted {
+  private readonly policies: policy.Client;
+  private readonly subjects = new Map<string, SubjectEntry>();
+  private readonly verdicts = new WeakMap<GrantedQuery, Verdict>();
+
+  constructor(cfg: GrantedConfig) {
+    this.policies = cfg.policies;
+  }
+
+  // A subject's entry holds its canonical key and a stable `{ for }` query, so
+  // repeat reads stringify once and stay on the retriever's normalization memo.
+  private subjectFor(subject: ontology.ID): SubjectEntry {
+    const key = ontology.idToString(subject);
+    let held = this.subjects.get(key);
+    if (held == null) {
+      held = { key, query: { for: subject } };
+      this.subjects.set(key, held);
+    }
+    return held;
+  }
+
+  /** Fetches the subject's policies and answers the question. */
+  async retrieve(subject: ontology.ID, q: GrantedQuery): Promise<boolean> {
+    const policies = await this.policies.retrieveForSubject(subject);
+    return allowRequest({ subject, objects: q.objects, action: q.action }, policies);
+  }
+
+  /**
+   * Subscribes to the verdict, firing only when it flips: policy churn that
+   * cannot change the answer never reaches the handler.
+   */
+  onChange(
+    subject: ontology.ID,
+    q: GrantedQuery,
+    handler: (granted: boolean) => void,
+  ): destructor.Destructor {
+    const { query: policiesQuery } = this.subjectFor(subject);
+    const evaluate = (policies: policy.Policy[]): boolean =>
+      allowRequest({ subject, objects: q.objects, action: q.action }, policies);
+    const cached = this.policies.getCached(policiesQuery);
+    let prev = query.isLive(cached) ? evaluate(cached) : undefined;
+    return this.policies.onChange(policiesQuery, (result) => {
+      if (!query.isLive(result)) return;
+      const next = evaluate(result);
+      if (next === prev) return;
+      prev = next;
+      handler(next);
+    });
+  }
+
+  /**
+   * Returns the cached verdict, or undefined when the subject's policies are
+   * not cached. Repeat calls with the same query object skip the policy
+   * evaluation until the cached policies change.
+   */
+  getCached(subject: ontology.ID, q: GrantedQuery): boolean | undefined {
+    const { key: subjectKey, query: policiesQuery } = this.subjectFor(subject);
+    const cached = this.policies.getCached(policiesQuery);
+    if (!query.isLive(cached)) return undefined;
+    const held = this.verdicts.get(q);
+    if (held != null && held.policies === cached && held.subject === subjectKey)
+      return held.verdict;
+    const verdict = allowRequest(
+      { subject, objects: q.objects, action: q.action },
+      cached,
+    );
+    this.verdicts.set(q, { subject: subjectKey, policies: cached, verdict });
+    return verdict;
+  }
+}

package/src/access/policy/client.ts

@@ -8,18 +8,19 @@
 // included in the file licenses/APL.txt.
 
 import { type UnaryClient } from "@synnaxlabs/freighter";
-import { array } from "@synnaxlabs/x";
+import { array, primitive } from "@synnaxlabs/x";
 import { z } from "zod";
 
 import {
   type Key,
   keyZ,
   type New,
-  newZ,
+  ontologyID,
   type Policy,
   policyZ,
 } from "@/access/policy/types.gen";
 import { ontology } from "@/ontology";
+import { query } from "@/query";
 
 export const SET_CHANNEL_NAME = "sy_policy_set";
 export const DELETE_CHANNEL_NAME = "sy_policy_delete";
@@ -32,11 +33,7 @@ const retrieveRequestZ = z.object({
   internal: z.boolean().optional(),
 });
 
-const keyRetrieveRequestZ = z
-  .object({ key: keyZ })
-  .transform(({ key }) => ({ keys: [key] }));
-
-const listRetrieveArgsZ = z.union([
+const listRetrieveParamsZ = z.union([
   z
     .object({ for: ontology.idZ })
     .transform(({ for: forId }) => ({ subjects: [forId] })),
@@ -45,69 +42,164 @@ const listRetrieveArgsZ = z.union([
     .transform(({ for: forIds }) => ({ subjects: forIds })),
   retrieveRequestZ,
 ]);
+const retrieveMultiParamsZ = listRetrieveParamsZ.or(query.keyListZ(keyZ));
 
-export type RetrieveSingleParams = z.input<typeof keyRetrieveRequestZ>;
-export type RetrieveMultipleParams = z.input<typeof listRetrieveArgsZ>;
-
-const retrieveArgsZ = z.union([keyRetrieveRequestZ, listRetrieveArgsZ]);
+export type RetrieveSingleParams = { key: Key };
+export type RetrieveMultipleParams = z.input<typeof listRetrieveParamsZ>;
 
-export type RetrieveArgs = z.input<typeof retrieveArgsZ>;
+interface RetrieveRequest extends z.infer<typeof retrieveRequestZ> {}
 
-const retrieveResZ = z.object({ policies: array.nullishToEmpty(policyZ) });
+const retrieveResZ = z.object({ policies: policyZ.array().default(() => []) });
 
-const singleCreateArgsZ = newZ.transform((p) => ({ policies: [p] }));
-export type SingleCreateArgs = z.input<typeof singleCreateArgsZ>;
+const singleCreateParamsZ = policyZ.transform((p) => ({ policies: [p] }));
+export type SingleCreateParams = z.input<typeof singleCreateParamsZ>;
 
-export const multipleCreateArgsZ = newZ.array().transform((policies) => ({ policies }));
+export const multipleCreateParamsZ = policyZ
+  .array()
+  .transform((policies) => ({ policies }));
 
-export const createArgsZ = z.union([singleCreateArgsZ, multipleCreateArgsZ]);
-export type CreateArgs = z.input<typeof createArgsZ>;
+export const createParamsZ = z.union([singleCreateParamsZ, multipleCreateParamsZ]);
+export type CreateParams = z.input<typeof createParamsZ>;
 
 const createResZ = z.object({ policies: policyZ.array() });
 const deleteReqZ = z.object({ keys: keyZ.array() });
 const deleteResZ = z.object({});
 
-export class Client {
-  private readonly client: UnaryClient;
+/**
+ * Query fields only the server can evaluate: policy records do not carry
+ * their subjects, so subject membership cannot be checked locally.
+ */
+const SERVER_FIELDS = ["subjects", "limit", "offset"] as const;
+
+/**
+ * Client-side matching for a request: key sets and the internal flag. Server-computed
+ * shapes (subjects, pagination) never reach this filter; they refetch instead.
+ */
+const requestFilter = (req: RetrieveRequest): ((p: Policy) => boolean) => {
+  const keySet = primitive.isNonZero(req.keys) ? new Set(req.keys) : undefined;
+  return (p) => {
+    if (keySet != null && !keySet.has(p.key)) return false;
+    if (req.internal != null && p.internal !== req.internal) return false;
+    return true;
+  };
+};
+
+export interface ClientConfig {
+  unary: UnaryClient;
+  cache: query.Cache;
+  ontology: ontology.Client;
+}
 
-  constructor(client: UnaryClient) {
-    this.client = client;
+export class Client extends query.Retriever<typeof retrieveMultiParamsZ, Key, Policy> {
+  private readonly cfg: ClientConfig;
+  private readonly store: query.Table<Key, Policy>;
+
+  constructor(cfg: ClientConfig) {
+    const { cache } = cfg;
+    const store = cache.createTable<Key, Policy>({
+      name: "policies",
+      fetch: async (keys) => await this.execRetrieve({ keys }),
+      listen: [
+        query.createSetListener(SET_CHANNEL_NAME, policyZ),
+        query.createDeleteListener(DELETE_CHANNEL_NAME, keyZ),
+      ],
+    });
+    super(cache, {
+      name: "policy",
+      table: store,
+      request: {
+        schema: retrieveMultiParamsZ,
+        fetch: async (req) => await this.execRetrieve(req),
+        matches: (policy, req) => requestFilter(req)(policy),
+        serverFields: SERVER_FIELDS,
+      },
+    });
+    this.cfg = cfg;
+    this.store = store;
   }
 
   async create(policy: New): Promise<Policy>;
   async create(policies: New[]): Promise<Policy[]>;
-  async create(policies: CreateArgs): Promise<Policy | Policy[]> {
+  async create(policies: CreateParams): Promise<Policy | Policy[]> {
     const isMany = Array.isArray(policies);
-    const res = await this.client.send(
+    const res = await this.cfg.unary.send(
       "/access/policy/create",
       policies,
-      createArgsZ,
+      createParamsZ,
       createResZ,
     );
+    this.store.set(res.policies);
     return isMany ? res.policies : res.policies[0];
   }
 
-  async retrieve(args: RetrieveSingleParams): Promise<Policy>;
-  async retrieve(args: RetrieveMultipleParams): Promise<Policy[]>;
-  async retrieve(args: RetrieveArgs): Promise<Policy | Policy[]> {
-    const isSingle = "key" in args;
-    const res = await this.client.send(
-      "/access/policy/retrieve",
-      args,
-      retrieveArgsZ,
-      retrieveResZ,
+  async delete(key: Key, opts?: query.WriteOptions): Promise<void>;
+  async delete(keys: Key[], opts?: query.WriteOptions): Promise<void>;
+  async delete(keys: Key | Key[], opts: query.WriteOptions = {}): Promise<void> {
+    const keysArr = array.toArray(keys);
+    const ids = ontologyID(keysArr);
+    const drop = () => [
+      this.cfg.ontology.cache.deleteResources(ids),
+      this.store.delete(keysArr),
+    ];
+    await query.optimistic({
+      rollbacks: drop(),
+      onOptimistic: opts.onOptimistic,
+      commit: async () =>
+        await this.cfg.unary.send(
+          "/access/policy/delete",
+          { keys: keysArr },
+          deleteReqZ,
+          deleteResZ,
+        ),
+    });
+    drop();
+    this.cfg.ontology.cache.relationships.delete((r) =>
+      ids.some((id) => ontology.idsEqual(r.from, id) || ontology.idsEqual(r.to, id)),
     );
-    return isSingle ? res.policies[0] : res.policies;
   }
 
-  async delete(key: Key): Promise<void>;
-  async delete(keys: Key[]): Promise<void>;
-  async delete(keys: Key | Key[]): Promise<void> {
-    await this.client.send(
-      "/access/policy/delete",
-      { keys: array.toArray(keys) },
-      deleteReqZ,
-      deleteResZ,
+  async rename(key: Key, name: string, opts: query.WriteOptions = {}): Promise<void> {
+    const existing = await this.retrieve(key);
+    const rename = () => [
+      query.partialUpdate(this.store, key, { name }),
+      this.cfg.ontology.cache.renameResource(ontologyID(key), name),
+    ];
+    await query.optimistic({
+      rollbacks: rename(),
+      onOptimistic: opts.onOptimistic,
+      commit: async () => {
+        await this.create({ ...existing, name });
+      },
+    });
+    rename();
+  }
+
+  /**
+   * Retrieves every policy governing the subject, warming the role links of
+   * the subject and its policies so role reads resolve from the cache.
+   */
+  async retrieveForSubject(subject: ontology.ID): Promise<Policy[]> {
+    const policies = await this.retrieve({ for: subject });
+    const { parents } = this.cfg.ontology;
+    const warms = [parents.retrieve({ ids: subject, types: ["role"] })];
+    if (policies.length > 0)
+      warms.push(
+        parents.retrieve({
+          ids: policies.map((p) => ontologyID(p.key)),
+          types: ["role"],
+        }),
+      );
+    await Promise.all(warms);
+    return policies;
+  }
+
+  private async execRetrieve(params: RetrieveRequest): Promise<Policy[]> {
+    const res = await this.cfg.unary.send(
+      "/access/policy/retrieve",
+      params,
+      retrieveRequestZ,
+      retrieveResZ,
     );
+    return res.policies;
   }
 }

package/src/access/policy/types.gen.ts

@@ -9,7 +9,7 @@
 
 // Code generated by Oracle. DO NOT EDIT.
 
-import { array } from "@synnaxlabs/x";
+import { uuid } from "@synnaxlabs/x";
 import { z } from "zod";
 
 import { access } from "@/access/action";
@@ -19,26 +19,24 @@ export const keyZ = z.uuid();
 export type Key = z.infer<typeof keyZ>;
 
 /**
- * Policy is an access control policy that defines which actions are permitted on
- * which resources. Policies are attached to roles, and roles are assigned
- * to users via ontology relationships.
+ * Policy is an access control policy that defines which actions are permitted on which
+ * resources. Policies are attached to roles, and roles are assigned to users via
+ * ontology relationships.
  */
 export const policyZ = z.object({
   /** key is the unique identifier for this policy. */
-  key: keyZ,
+  key: keyZ.default(uuid.create),
   /** name is a human-readable name for the policy. */
   name: z.string(),
   /** objects is the list of ontology resources this policy applies to. */
-  objects: array.nullishToEmpty(ontology.idZ),
+  objects: ontology.idZ.array().default(() => []),
   /** actions is the list of actions this policy permits. */
-  actions: array.nullishToEmpty(access.actionZ),
+  actions: access.actionZ.array().default(() => []),
   /** internal is true if this is a built-in system policy that cannot be deleted. */
-  internal: z.boolean().default(false).optional(),
+  internal: z.boolean().default(false),
 });
 export interface Policy extends z.infer<typeof policyZ> {}
-
-export const newZ = policyZ.partial({ key: true });
-export interface New extends z.input<typeof newZ> {}
+export interface New extends z.input<typeof policyZ> {}
 
 export const ontologyID = ontology.createIDFactory<Key>("policy");
 export const TYPE_ONTOLOGY_ID = ontologyID("");

package/src/access/role/client.ts

@@ -8,52 +8,68 @@
 // included in the file licenses/APL.txt.
 
 import { type UnaryClient } from "@synnaxlabs/freighter";
-import { array } from "@synnaxlabs/x";
+import { array, primitive } from "@synnaxlabs/x";
 import { z } from "zod";
 
-import { keyZ, type New, newZ, type Role, roleZ } from "@/access/role/types.gen";
+import {
+  type Key,
+  keyZ,
+  type New,
+  ontologyID,
+  type Role,
+  roleZ,
+} from "@/access/role/types.gen";
+import { ontology } from "@/ontology";
+import { query } from "@/query";
 import { user } from "@/user";
 
+export const SET_CHANNEL_NAME = "sy_role_set";
+export const DELETE_CHANNEL_NAME = "sy_role_delete";
+
 const retrieveRequestZ = z.object({
   keys: keyZ.array().optional(),
+  searchTerm: z.string().optional(),
   limit: z.number().optional(),
   offset: z.number().optional(),
   internal: z.boolean().optional(),
 });
+const retrieveMultiParamsZ = retrieveRequestZ.or(query.keyListZ(keyZ));
 
 const keyRetrieveRequestZ = z
   .object({ key: keyZ })
   .transform(({ key }) => ({ keys: [key] }));
 
-const singleCreateArgsZ = newZ.transform((r) => ({ roles: [r] }));
-export type SingleCreateArgs = z.input<typeof singleCreateArgsZ>;
+const singleCreateParamsZ = roleZ.transform((r) => ({ roles: [r] }));
+export type SingleCreateParams = z.input<typeof singleCreateParamsZ>;
 
-export const multipleCreateArgsZ = newZ.array().transform((roles) => ({ roles }));
+export const multipleCreateParamsZ = roleZ.array().transform((roles) => ({ roles }));
 
-export const createArgsZ = z.union([singleCreateArgsZ, multipleCreateArgsZ]);
-export type CreateArgs = z.input<typeof createArgsZ>;
+export const createParamsZ = z.union([singleCreateParamsZ, multipleCreateParamsZ]);
+export type CreateParams = z.input<typeof createParamsZ>;
 
 const createResZ = z.object({ roles: roleZ.array() });
-const retrieveResZ = z.object({ roles: array.nullishToEmpty(roleZ) });
+const retrieveResZ = z.object({ roles: roleZ.array().default(() => []) });
 
 export type RetrieveSingleParams = z.input<typeof keyRetrieveRequestZ>;
 export type RetrieveMultipleParams = z.input<typeof retrieveRequestZ>;
 
-export const retrieveArgsZ = z.union([keyRetrieveRequestZ, retrieveRequestZ]);
-export type RetrieveArgs = z.input<typeof retrieveArgsZ>;
+export const retrieveParamsZ = z.union([keyRetrieveRequestZ, retrieveRequestZ]);
+export type RetrieveParams = z.input<typeof retrieveParamsZ>;
+
+interface RetrieveRequest extends z.infer<typeof retrieveRequestZ> {}
 
 const deleteResZ = z.object({});
 
-const deleteArgsZ = keyZ
+const deleteParamsZ = keyZ
   .transform((key) => ({ keys: [key] }))
   .or(keyZ.array().transform((keys) => ({ keys })));
-export type DeleteArgs = z.input<typeof deleteArgsZ>;
+export type DeleteParams = z.input<typeof deleteParamsZ>;
 
 const assignReqZ = z.object({
   user: user.keyZ,
   role: keyZ,
 });
-export type AssignArgs = z.input<typeof assignReqZ>;
+export type AssignParams = z.input<typeof assignReqZ>;
 
 const assignResZ = z.object({});
 
@@ -61,55 +77,161 @@ const unassignReqZ = z.object({
   user: user.keyZ,
   role: keyZ,
 });
-export type UnassignArgs = z.input<typeof unassignReqZ>;
+export type UnassignParams = z.input<typeof unassignReqZ>;
 
 const unassignResZ = z.object({});
 
-export const SET_CHANNEL_NAME = "sy_role_set";
-export const DELETE_CHANNEL_NAME = "sy_role_delete";
+/**
+ * Client-side matching for a request: key sets and the internal flag. Server-computed
+ * shapes (search, limit/offset) never reach this filter; they refetch instead.
+ */
+const requestFilter = (req: RetrieveRequest): ((r: Role) => boolean) => {
+  const keySet = primitive.isNonZero(req.keys) ? new Set(req.keys) : undefined;
+  return (r) => {
+    if (keySet != null && !keySet.has(r.key)) return false;
+    if (req.internal != null && r.internal !== req.internal) return false;
+    return true;
+  };
+};
+
+const assignmentRel = (role: Key, userKey: user.Key): ontology.Relationship => ({
+  from: ontologyID(role),
+  type: ontology.PARENT_OF_RELATIONSHIP_TYPE,
+  to: user.ontologyID(userKey),
+});
 
-export class Client {
-  private readonly client: UnaryClient;
+export interface ClientConfig {
+  unary: UnaryClient;
+  cache: query.Cache;
+  ontology: ontology.Client;
+}
 
-  constructor(client: UnaryClient) {
-    this.client = client;
+export class Client extends query.Retriever<typeof retrieveMultiParamsZ, Key, Role> {
+  private readonly cfg: ClientConfig;
+  private readonly store: query.Table<Key, Role>;
+
+  constructor(cfg: ClientConfig) {
+    const { cache } = cfg;
+    const store = cache.createTable<Key, Role>({
+      name: "roles",
+      fetch: async (keys) => await this.execRetrieve({ keys }),
+      listen: [
+        query.createSetListener(SET_CHANNEL_NAME, roleZ),
+        query.createDeleteListener(DELETE_CHANNEL_NAME, keyZ),
+      ],
+    });
+    super(cache, {
+      name: "role",
+      table: store,
+      request: {
+        schema: retrieveMultiParamsZ,
+        fetch: async (req) => await this.execRetrieve(req),
+        matches: (role, req) => requestFilter(req)(role),
+      },
+    });
+    this.cfg = cfg;
+    this.store = store;
   }
 
   async create(role: New): Promise<Role>;
   async create(roles: New[]): Promise<Role[]>;
   async create(roles: New | New[]): Promise<Role | Role[]> {
     const isMany = Array.isArray(roles);
-    const res = await this.client.send(
+    const res = await this.cfg.unary.send(
       "/access/role/create",
       roles,
-      createArgsZ,
+      createParamsZ,
       createResZ,
     );
+    this.store.set(res.roles);
     return isMany ? res.roles : res.roles[0];
   }
 
-  async retrieve(args: RetrieveSingleParams): Promise<Role>;
-  async retrieve(args: RetrieveMultipleParams): Promise<Role[]>;
-  async retrieve(args: RetrieveArgs): Promise<Role | Role[]> {
-    const isSingle = "key" in args;
-    const res = await this.client.send(
-      "/access/role/retrieve",
-      args,
-      retrieveArgsZ,
-      retrieveResZ,
+  async delete(params: DeleteParams, opts: query.WriteOptions = {}): Promise<void> {
+    const keysArr = array.toArray(params);
+    const ids = ontologyID(keysArr);
+    const drop = () => [
+      this.cfg.ontology.cache.deleteResources(ids),
+      this.store.delete(keysArr),
+    ];
+    await query.optimistic({
+      rollbacks: drop(),
+      onOptimistic: opts.onOptimistic,
+      commit: async () =>
+        await this.cfg.unary.send(
+          "/access/role/delete",
+          params,
+          deleteParamsZ,
+          deleteResZ,
+        ),
+    });
+    drop();
+    this.cfg.ontology.cache.relationships.delete((r) =>
+      ids.some((id) => ontology.idsEqual(r.from, id) || ontology.idsEqual(r.to, id)),
     );
-    return isSingle ? res.roles[0] : res.roles;
   }
 
-  async delete(args: DeleteArgs): Promise<void> {
-    await this.client.send("/access/role/delete", args, deleteArgsZ, deleteResZ);
+  async rename(key: Key, name: string, opts: query.WriteOptions = {}): Promise<void> {
+    const existing = await this.retrieve(key);
+    const rename = () => [
+      query.partialUpdate(this.store, key, { name }),
+      this.cfg.ontology.cache.renameResource(ontologyID(key), name),
+    ];
+    await query.optimistic({
+      rollbacks: rename(),
+      onOptimistic: opts.onOptimistic,
+      commit: async () => {
+        await this.create({ ...existing, name });
+      },
+    });
+    rename();
+  }
+
+  async assign(params: AssignParams, opts: query.WriteOptions = {}): Promise<void> {
+    const rel = assignmentRel(params.role, params.user);
+    await query.optimistic({
+      rollbacks: [
+        this.cfg.ontology.cache.relationships.set(
+          ontology.relationshipToString(rel),
+          rel,
+        ),
+      ],
+      onOptimistic: opts.onOptimistic,
+      commit: async () =>
+        await this.cfg.unary.send(
+          "/access/role/assign",
+          params,
+          assignReqZ,
+          assignResZ,
+        ),
+    });
   }
 
-  async assign(args: AssignArgs): Promise<void> {
-    await this.client.send("/access/role/assign", args, assignReqZ, assignResZ);
+  async unassign(params: UnassignParams, opts: query.WriteOptions = {}): Promise<void> {
+    await query.optimistic({
+      rollbacks: [
+        this.cfg.ontology.cache.relationships.delete(
+          ontology.relationshipToString(assignmentRel(params.role, params.user)),
+        ),
+      ],
+      onOptimistic: opts.onOptimistic,
+      commit: async () =>
+        await this.cfg.unary.send(
+          "/access/role/unassign",
+          params,
+          unassignReqZ,
+          unassignResZ,
+        ),
+    });
   }
 
-  async unassign(args: UnassignArgs): Promise<void> {
-    await this.client.send("/access/role/unassign", args, unassignReqZ, unassignResZ);
+  private async execRetrieve(params: RetrieveMultipleParams): Promise<Role[]> {
+    const res = await this.cfg.unary.send(
+      "/access/role/retrieve",
+      params,
+      retrieveRequestZ,
+      retrieveResZ,
+    );
+    return res.roles;
   }
 }