@tailor-platform/erp-kit 0.7.0 → 0.8.0

package/src/modules/user-management/docs/features/user-account-management.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-User Account Management handles the complete user lifecycle from creation through deactivation. Each user has a status that controls their access to the system: PENDING (awaiting activation), ACTIVE (full access), or INACTIVE (access revoked). Status transitions follow defined rules to ensure security and auditability.
+User Account Management handles the complete user lifecycle from creation through deactivation, including profile updates. Each user has a status that controls their access to the system: PENDING (awaiting activation), ACTIVE (full access), or INACTIVE (access revoked). Status transitions follow defined rules to ensure security and auditability. Profile fields (name, email) can be updated at any point in the lifecycle regardless of status.
 
 This feature provides the foundation for all identity-related operations in the ERP system.
 
@@ -12,8 +12,9 @@ Organizations need controlled user provisioning to ensure only authorized indivi
 
 - **Onboarding control**: New users start in PENDING status until verified
 - **Access management**: Only ACTIVE users can perform operations
+- **Profile maintenance**: User name and email can be corrected or updated throughout the account lifecycle
 - **Offboarding safety**: Deactivated users retain their data for audit purposes while losing access
-- **Compliance tracking**: Clear status transitions support regulatory requirements
+- **Compliance tracking**: Clear status transitions support regulatory requirements (GDPR right to rectification supported via profile updates)
 
 ## Process Flow
 
@@ -35,6 +36,16 @@ flowchart TD
     E -->|deactivateUser| H
     H -->|reactivateUser| E
     end
+
+    subgraph Profile Updates - Admin
+    B -->|updateUser| B
+    E -->|updateUser| E
+    H -->|updateUser| H
+    end
+
+    subgraph Profile Updates - Self
+    E -->|updateOwnProfile| E
+    end
 ```
 
 ## Scenario Patterns
@@ -42,7 +53,10 @@ flowchart TD
 - **New Employee Onboarding**: HR creates user account with name and email, user starts in PENDING status. After background check and IT setup complete, administrator activates the user.
 - **Employee Departure**: When employee resigns or is terminated, administrator deactivates user account. User data is preserved for audit and historical reporting, but all access is revoked.
 - **Contractor Return Engagement**: Previously offboarded contractor returns for new project. Administrator reactivates existing account rather than creating duplicate, preserving historical associations.
-- **Duplicate Prevention**: Attempt to create user with existing email address is rejected with clear error, preventing duplicate accounts.
+- **Profile Correction (Admin)**: Administrator updates a user's name after a legal name change via `updateUser`. The update applies immediately regardless of user status.
+- **Email Change (Admin)**: Administrator updates a user's email address via `updateUser`. The system validates format and uniqueness before applying the change.
+- **Self-Service Profile Update**: An ACTIVE user updates their own name or email via `updateOwnProfile`. The command implicitly targets the calling user — no userId parameter is needed. Only ACTIVE users can update their own profile.
+- **Duplicate Prevention**: Attempt to create or update a user with an email already used by another account is rejected with clear error, preventing duplicate accounts.
 - **Invalid Activation**: Attempt to activate already-active user or deactivate already-inactive user returns appropriate error with current status.
 
 ## Test Cases
@@ -55,6 +69,17 @@ flowchart TD
 - Deactivating a PENDING user should fail with INVALID_STATUS_TRANSITION error
 - Reactivating an INACTIVE user should transition status to ACTIVE
 - Reactivating a PENDING user should fail with INVALID_STATUS_TRANSITION error
+- updateUser: Updating a user's name should succeed for any user status (PENDING, ACTIVE, INACTIVE)
+- updateUser: Updating a user's email to a unique valid email should succeed
+- updateUser: Updating a user's email to an email already used by another user should fail with USER_ALREADY_EXISTS error
+- updateUser: Updating a user with an invalid email format should fail with validation error
+- updateUser: Updating a user's name to empty should fail with validation error
+- updateUser: Updating a non-existent user should fail with USER_NOT_FOUND error
+- updateOwnProfile: ACTIVE user updating own name should succeed
+- updateOwnProfile: ACTIVE user updating own email to a unique valid email should succeed
+- updateOwnProfile: ACTIVE user updating own email to an email already used by another user should fail with USER_ALREADY_EXISTS error
+- updateOwnProfile: PENDING user updating own profile should fail with INVALID_STATUS_TRANSITION error
+- updateOwnProfile: INACTIVE user updating own profile should fail with INVALID_STATUS_TRANSITION error
 - User email should be validated for proper format
 - User name should be required and non-empty
 

package/src/modules/user-management/docs/models/User.md

@@ -25,6 +25,8 @@ stateDiagram-v2
 ### Command Definitions
 
 - [createUser](../commands/CreateUser.md)
+- [updateUser](../commands/UpdateUser.md)
+- [updateOwnProfile](../commands/UpdateOwnProfile.md)
 - [activateUser](../commands/ActivateUser.md)
 - [deactivateUser](../commands/DeactivateUser.md)
 - [reactivateUser](../commands/ReactivateUser.md)

package/src/modules/user-management/lib/errors.generated.ts

@@ -60,3 +60,8 @@ export const AssignmentNotFoundError = createDomainError(
   "AssignmentNotFoundError", "USER_MANAGEMENT_ASSIGNMENT_NOT_FOUND",
   (identifier: string) => `Role does not have this permission assigned - return not found error indicating the association does not exist: ${identifier}`,
 );
+
+export const InvalidNameError = createDomainError(
+  "InvalidNameError", "USER_MANAGEMENT_INVALID_NAME",
+  (identifier: string) => `Name is empty or whitespace only: ${identifier}`,
+);

package/src/modules/user-management/lib/permissions.generated.ts

@@ -12,4 +12,6 @@ export const { permissions, own, all } = definePermissions("user-management", [
   "reactivateUser",
   "revokePermissionFromRole",
   "revokeRoleFromUser",
+  "updateOwnProfile",
+  "updateUser",
 ] as const);

package/src/modules/user-management/module.ts

@@ -9,6 +9,8 @@ import { assignPermissionToRole } from "./command/assignPermissionToRole.generat
 import { revokePermissionFromRole } from "./command/revokePermissionFromRole.generated";
 import { assignRoleToUser } from "./command/assignRoleToUser.generated";
 import { revokeRoleFromUser } from "./command/revokeRoleFromUser.generated";
+import { updateUser } from "./command/updateUser.generated";
+import { updateOwnProfile } from "./command/updateOwnProfile.generated";
 import { createPermissionType, CreatePermissionTypeParams } from "./db/permission";
 import { createRoleType, CreateRoleTypeParams } from "./db/role";
 import { createRolePermissionType, CreateRolePermissionTypeParams } from "./db/rolePermission";
@@ -33,6 +35,7 @@ export interface DefineModuleParams<
   rolePermission?: CreateRolePermissionTypeParams;
 }
 
+/* @__NO_SIDE_EFFECTS__ */
 export const defineModule = <
   const UF extends Record<string, TailorAnyDBField> = EmptyFields,
   const RF extends Record<string, TailorAnyDBField> = EmptyFields,
@@ -67,6 +70,8 @@ export const defineModule = <
       revokePermissionFromRole: revokePermissionFromRole(),
       assignRoleToUser: assignRoleToUser(),
       revokeRoleFromUser: revokeRoleFromUser(),
+      updateUser: updateUser<FieldsToInsertable<UF>>(),
+      updateOwnProfile: updateOwnProfile<FieldsToInsertable<UF>>(),
     },
   };
 };

package/src/modules/user-management/seed/index.ts

@@ -0,0 +1,19 @@
+// Export seed data maps here.
+// Use PascalCase names matching entity types — `erp-kit app generate seed`
+// discovers exports automatically and writes <ExportName>.jsonl files.
+//
+// Example:
+//
+//   import { uuidv5 } from "../../../shared/uuidv5";
+//   const NS = "erp-kit:<module-name>";
+//
+//   export const entityIds = {
+//     foo: uuidv5(NS, "entity:foo"),
+//   } as const;
+//
+//   const entities: Record<string, SeedRow> = {
+//     [entityIds.foo]: { name: "Foo", ... },
+//   };
+//
+//   // Re-export with PascalCase entity name
+//   export { entities as Entity };

package/templates/scaffold/app/backend/seed/data/AuditEntry.schema.ts

@@ -0,0 +1,20 @@
+import { t } from "@tailor-platform/sdk";
+import { defineSchema } from "@tailor-platform/sdk/seed";
+import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
+import { auditEntry } from "../../src/modules-db";
+
+const schemaType = t.object({
+  ...auditEntry.pickFields(["id","createdAt"], { optional: true }),
+  ...auditEntry.omitFields(["id","createdAt"]),
+});
+
+const hook = createTailorDBHook(auditEntry);
+
+export const schema = defineSchema(
+  createStandardSchema(schemaType, hook),
+  {
+    indexes: [
+      {"name":"auditentry_eventId_unique_idx","columns":["eventId"],"unique":true},
+    ],
+  }
+);

package/templates/scaffold/app/backend/seed/data/AuditPolicy.jsonl

@@ -0,0 +1,7 @@
+{"id":"00000000-0000-0000-0200-000000000001","entityName":"User","companyId":null,"operationType":"CREATE","status":"ACTIVE"}
+{"id":"00000000-0000-0000-0200-000000000002","entityName":"User","companyId":null,"operationType":"UPDATE","status":"ACTIVE"}
+{"id":"00000000-0000-0000-0200-000000000003","entityName":"Role","companyId":null,"operationType":"CREATE","status":"ACTIVE"}
+{"id":"00000000-0000-0000-0200-000000000004","entityName":"UserRole","companyId":null,"operationType":"CREATE","status":"ACTIVE"}
+{"id":"00000000-0000-0000-0200-000000000005","entityName":"UserRole","companyId":null,"operationType":"DELETE","status":"ACTIVE"}
+{"id":"00000000-0000-0000-0200-000000000006","entityName":"RolePermission","companyId":null,"operationType":"CREATE","status":"ACTIVE"}
+{"id":"00000000-0000-0000-0200-000000000007","entityName":"RolePermission","companyId":null,"operationType":"DELETE","status":"ACTIVE"}

package/templates/scaffold/app/backend/seed/data/AuditPolicy.schema.ts

@@ -0,0 +1,15 @@
+import { t } from "@tailor-platform/sdk";
+import { defineSchema } from "@tailor-platform/sdk/seed";
+import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
+import { auditPolicy } from "../../src/modules-db";
+
+const schemaType = t.object({
+  ...auditPolicy.pickFields(["id","createdAt"], { optional: true }),
+  ...auditPolicy.omitFields(["id","createdAt"]),
+});
+
+const hook = createTailorDBHook(auditPolicy);
+
+export const schema = defineSchema(
+  createStandardSchema(schemaType, hook),
+);

package/templates/scaffold/app/backend/seed/data/AuditableEntity.jsonl

@@ -0,0 +1,4 @@
+{"id":"00000000-0000-0000-0100-000000000001","entityName":"User","entityScope":"GLOBAL","auditableFields":"[{\"fieldName\":\"name\"},{\"fieldName\":\"email\"},{\"fieldName\":\"status\"}]"}
+{"id":"00000000-0000-0000-0100-000000000002","entityName":"Role","entityScope":"GLOBAL","auditableFields":"[{\"fieldName\":\"name\"},{\"fieldName\":\"description\"}]"}
+{"id":"00000000-0000-0000-0100-000000000003","entityName":"UserRole","entityScope":"GLOBAL","auditableFields":"[{\"fieldName\":\"userId\"},{\"fieldName\":\"roleId\"}]"}
+{"id":"00000000-0000-0000-0100-000000000004","entityName":"RolePermission","entityScope":"GLOBAL","auditableFields":"[{\"fieldName\":\"roleId\"},{\"fieldName\":\"permissionId\"}]"}

package/templates/scaffold/app/backend/seed/data/AuditableEntity.schema.ts

@@ -0,0 +1,20 @@
+import { t } from "@tailor-platform/sdk";
+import { defineSchema } from "@tailor-platform/sdk/seed";
+import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
+import { auditableEntity } from "../../src/modules-db";
+
+const schemaType = t.object({
+  ...auditableEntity.pickFields(["id","createdAt"], { optional: true }),
+  ...auditableEntity.omitFields(["id","createdAt"]),
+});
+
+const hook = createTailorDBHook(auditableEntity);
+
+export const schema = defineSchema(
+  createStandardSchema(schemaType, hook),
+  {
+    indexes: [
+      {"name":"auditableentity_entityName_unique_idx","columns":["entityName"],"unique":true},
+    ],
+  }
+);

package/templates/scaffold/app/backend/seed/data/ChangeDetail.schema.ts

@@ -0,0 +1,20 @@
+import { t } from "@tailor-platform/sdk";
+import { defineSchema } from "@tailor-platform/sdk/seed";
+import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
+import { changeDetail } from "../../src/modules-db";
+
+const schemaType = t.object({
+  ...changeDetail.pickFields(["id","createdAt"], { optional: true }),
+  ...changeDetail.omitFields(["id","createdAt"]),
+});
+
+const hook = createTailorDBHook(changeDetail);
+
+export const schema = defineSchema(
+  createStandardSchema(schemaType, hook),
+  {
+    foreignKeys: [
+      {"column":"auditEntryId","references":{"table":"AuditEntry","column":"id"}},
+    ],
+  }
+);

package/templates/scaffold/app/backend/seed/data/Company.schema.ts

@@ -0,0 +1,15 @@
+import { t } from "@tailor-platform/sdk";
+import { defineSchema } from "@tailor-platform/sdk/seed";
+import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
+import { company } from "../../src/modules-db";
+
+const schemaType = t.object({
+  ...company.pickFields(["id"], { optional: true }),
+  ...company.omitFields(["id"]),
+});
+
+const hook = createTailorDBHook(company);
+
+export const schema = defineSchema(
+  createStandardSchema(schemaType, hook),
+);

package/templates/scaffold/app/backend/seed/data/Permission.jsonl

@@ -0,0 +1,13 @@
+{"id":"00000000-0000-0000-0000-000000000001","key":"user-management:createUser","description":"Create user accounts"}
+{"id":"00000000-0000-0000-0000-000000000002","key":"user-management:activateUser","description":"Activate user accounts"}
+{"id":"00000000-0000-0000-0000-000000000003","key":"user-management:deactivateUser","description":"Deactivate user accounts"}
+{"id":"00000000-0000-0000-0000-000000000004","key":"user-management:reactivateUser","description":"Reactivate user accounts"}
+{"id":"00000000-0000-0000-0000-000000000005","key":"user-management:createRole","description":"Create roles"}
+{"id":"00000000-0000-0000-0000-000000000006","key":"user-management:assignPermissionToRole","description":"Assign permissions to roles"}
+{"id":"00000000-0000-0000-0000-000000000007","key":"user-management:revokePermissionFromRole","description":"Revoke permissions from roles"}
+{"id":"00000000-0000-0000-0000-000000000008","key":"user-management:assignRoleToUser","description":"Assign roles to users"}
+{"id":"00000000-0000-0000-0000-000000000009","key":"user-management:revokeRoleFromUser","description":"Revoke roles from users"}
+{"id":"00000000-0000-0000-0000-00000000000a","key":"user-management:createPermission","description":"Create permissions"}
+{"id":"00000000-0000-0000-0000-00000000000b","key":"audit:logAuditEvent","description":"Log audit events"}
+{"id":"00000000-0000-0000-0000-00000000000c","key":"user-management:updateUser","description":"Update user profiles"}
+{"id":"00000000-0000-0000-0000-00000000000d","key":"user-management:updateOwnProfile","description":"Update own profile"}

package/templates/scaffold/app/backend/seed/data/Permission.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { permission } from "../../src/modules";
+import { permission } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...permission.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/PolicyFieldRule.schema.ts

@@ -0,0 +1,20 @@
+import { t } from "@tailor-platform/sdk";
+import { defineSchema } from "@tailor-platform/sdk/seed";
+import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
+import { policyFieldRule } from "../../src/modules-db";
+
+const schemaType = t.object({
+  ...policyFieldRule.pickFields(["id","createdAt"], { optional: true }),
+  ...policyFieldRule.omitFields(["id","createdAt"]),
+});
+
+const hook = createTailorDBHook(policyFieldRule);
+
+export const schema = defineSchema(
+  createStandardSchema(schemaType, hook),
+  {
+    foreignKeys: [
+      {"column":"auditPolicyId","references":{"table":"AuditPolicy","column":"id"}},
+    ],
+  }
+);

package/templates/scaffold/app/backend/seed/data/Role.jsonl

@@ -0,0 +1 @@
+{"id":"00000000-0000-0000-0001-000000000001","name":"Admin","description":"Full system access"}

package/templates/scaffold/app/backend/seed/data/Role.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { role } from "../../src/modules";
+import { role } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...role.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/RolePermission.jsonl

@@ -0,0 +1,13 @@
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000001"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000002"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000003"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000004"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000005"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000006"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000007"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000008"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000009"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000a"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000b"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000c"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000d"}

package/templates/scaffold/app/backend/seed/data/RolePermission.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { rolePermission } from "../../src/modules";
+import { rolePermission } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...rolePermission.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/User.jsonl

@@ -1 +1 @@
-{"email":"test@example.com","name":"Demo User","status":"ACTIVE","permissions":["user-management:createUser"]}
+{"id":"00000000-0000-0000-0002-000000000001","email":"admin@example.com","name":"Admin User","status":"ACTIVE","permissions":["user-management:createUser","user-management:activateUser","user-management:deactivateUser","user-management:reactivateUser","user-management:createRole","user-management:assignPermissionToRole","user-management:revokePermissionFromRole","user-management:assignRoleToUser","user-management:revokeRoleFromUser","user-management:createPermission","audit:logAuditEvent"]}

package/templates/scaffold/app/backend/seed/data/User.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { user } from "../../src/modules";
+import { user } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...user.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/UserRole.jsonl

@@ -0,0 +1 @@
+{"userId":"00000000-0000-0000-0002-000000000001","roleId":"00000000-0000-0000-0001-000000000001"}

package/templates/scaffold/app/backend/seed/data/UserRole.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { userRole } from "../../src/modules";
+import { userRole } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...userRole.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/_User.jsonl

@@ -1 +1 @@
-{"name":"test@example.com","password":"password"}
+{"name":"admin@example.com","password":"Passw0rd!"}

package/templates/scaffold/app/backend/seed/exec.mjs

@@ -141,7 +141,13 @@ if (!machineUserName) {
 // Entity configuration
 const namespaceEntities = {
   "main-db": [
+    "AuditEntry",
+    "AuditPolicy",
+    "AuditableEntity",
+    "ChangeDetail",
+    "Company",
     "Permission",
+    "PolicyFieldRule",
     "Role",
     "RolePermission",
     "User",
@@ -150,7 +156,13 @@ const namespaceEntities = {
 };
 const namespaceDeps = {
   "main-db": {
+    "AuditEntry": ["Company"],
+    "AuditPolicy": ["Company"],
+    "AuditableEntity": [],
+    "ChangeDetail": ["AuditEntry"],
+    "Company": [],
     "Permission": [],
+    "PolicyFieldRule": ["AuditPolicy"],
     "Role": [],
     "RolePermission": ["Role", "Permission"],
     "User": [],

package/templates/scaffold/app/backend/src/executors/permissionCreated.ts

@@ -1,3 +1,3 @@
-import { rolePermissionCreated } from "@/modules";
+import { umModules } from "@/modules";
 
-export default rolePermissionCreated;
+export default umModules.executors.rolePermissionCreated;

package/templates/scaffold/app/backend/src/executors/permissionDeleted.ts

@@ -1,3 +1,3 @@
-import { rolePermissionDeleted } from "@/modules";
+import { umModules } from "@/modules";
 
-export default rolePermissionDeleted;
+export default umModules.executors.rolePermissionDeleted;

package/templates/scaffold/app/backend/src/generated/kysely-tailordb.ts

@@ -13,6 +13,59 @@ import {
 
 export interface Namespace {
   "main-db": {
+    AuditEntry: {
+      id: Generated<string>;
+      eventId: string;
+      actorType: string;
+      actorId: string;
+      entityType: string;
+      entityId: string;
+      operationType: string;
+      companyId: string | null;
+      correlationId: string | null;
+      ipAddress: string | null;
+      userAgent: string | null;
+      sessionId: string | null;
+      requestId: string | null;
+      onBehalfOf: string | null;
+      timestamp: Timestamp;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    AuditPolicy: {
+      id: Generated<string>;
+      entityName: string;
+      companyId: string | null;
+      operationType: string;
+      status: string;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    AuditableEntity: {
+      id: Generated<string>;
+      entityName: string;
+      entityScope: string;
+      auditableFields: string;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    ChangeDetail: {
+      id: Generated<string>;
+      auditEntryId: string;
+      fieldName: string;
+      oldValue: string | null;
+      newValue: string | null;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    Company: {
+      id: Generated<string>;
+    }
+
     Permission: {
       id: Generated<string>;
       key: string;
@@ -21,6 +74,15 @@ export interface Namespace {
       updatedAt: Timestamp | null;
     }
 
+    PolicyFieldRule: {
+      id: Generated<string>;
+      auditPolicyId: string;
+      fieldName: string;
+      sensitivityMode: string;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
     Role: {
       id: Generated<string>;
       name: string;

package/templates/scaffold/app/backend/src/modules-db.ts

@@ -0,0 +1,13 @@
+import { auditCompanyStub } from "@tailor-platform/erp-kit/module";
+import { umModules, auditModules } from "./modules";
+
+// Destructured for DB scanner (tailor.config.ts db.files).
+// This file must NOT be imported by resolvers — property access prevents tree-shaking.
+
+// user-management
+export const { user, permission, role, userRole, rolePermission } = umModules.db;
+
+// audit
+export const { auditableEntity, auditPolicy, policyFieldRule, auditEntry, changeDetail } =
+  auditModules.db;
+export { auditCompanyStub as company };

package/templates/scaffold/app/backend/src/modules.ts

@@ -1,9 +1,7 @@
-import { defineUserManagementModule } from "@tailor-platform/erp-kit/module";
+import { defineUserManagementModule, defineAuditModule } from "@tailor-platform/erp-kit/module";
 
-const umModules = defineUserManagementModule({
+export const umModules = defineUserManagementModule({
   dbNamespace: "main-db",
 });
 
-export const { db: umDb, executors: umExecutors, commands: umCommands } = umModules;
-export const { user, permission, role, userRole, rolePermission } = umDb;
-export const { rolePermissionCreated, rolePermissionDeleted } = umExecutors;
+export const auditModules = defineAuditModule();

package/templates/scaffold/app/backend/src/resolvers/assignPermissionToRole.ts

@@ -0,0 +1,70 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "assignPermissionToRole",
+  operation: "mutation",
+  input: {
+    roleId: t.string().description("Role ID"),
+    permissionId: t.string().description("Permission ID to assign"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.assignPermissionToRole(
+        trx,
+        {
+          roleId: context.input.roleId,
+          permissionId: context.input.permissionId,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_ROLE_NOT_FOUND":
+            throw new Error(`Role ${context.input.roleId} does not exist`);
+          case "USER_MANAGEMENT_PERMISSION_NOT_FOUND":
+            throw new Error(`Permission ${context.input.permissionId} does not exist`);
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+      return {
+        roleId: context.input.roleId,
+        permissionId: context.input.permissionId,
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "RolePermission",
+            entityId: `${result.roleId}:${result.permissionId}`,
+            operationType: "CREATE",
+            changes: [
+              { fieldName: "roleId", newValue: result.roleId },
+              { fieldName: "permissionId", newValue: result.permissionId },
+            ],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      roleId: t.string().description("Role ID"),
+      permissionId: t.string().description("Assigned permission ID"),
+    })
+    .description("Permission assignment result"),
+});