tale-js-sdk 0.1.2 → 0.1.4

package/dist/rbac/rbac.js

@@ -0,0 +1,984 @@
+import { getAppToken } from '../token.js';
+import { ApiError, ConfigurationError, NetworkError } from '../errors.js';
+// ===== 角色管理 =====
+/**
+ * Creates a new role in the Tale application.
+ *
+ * @param roleData - Role data to create the new role
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the created role information
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ *
+ * @example
+ * ```typescript
+ * import { createRole } from '@tale/client';
+ *
+ * try {
+ *   const result = await createRole({
+ *     role_name: 'Admin',
+ *     role_type: 'system',
+ *     privilege_ids: ['privilege1', 'privilege2'],
+ *     remark: 'System administrator role'
+ *   });
+ *   console.log('Role created:', result.role.role_id);
+ * } catch (error) {
+ *   console.error('Failed to create role:', error.message);
+ * }
+ * ```
+ */
+export async function createRole(roleData, options) {
+    // Validate required fields
+    if (!roleData.role_name || roleData.role_name.trim() === '') {
+        throw new ApiError('role_name is required for role creation', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + '/rbac/v1/roles';
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+            body: JSON.stringify(roleData),
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to create role: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse role creation response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Role creation failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.role) {
+        throw new ApiError('Invalid role creation response: missing role data', response.status);
+    }
+    return json.data;
+}
+/**
+ * Updates an existing role by ID.
+ *
+ * @param roleId - Role ID to update
+ * @param updateData - Role information to update
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the updated role information
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function updateRole(roleId, updateData, options) {
+    // Validate required fields
+    if (!roleId || roleId.trim() === '') {
+        throw new ApiError('role_id is required for role update', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/roles/${encodeURIComponent(roleId)}`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'PUT',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+            body: JSON.stringify(updateData),
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to update role: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse role update response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Role update failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.role) {
+        throw new ApiError('Invalid role update response: missing role data', response.status);
+    }
+    return json.data;
+}
+/**
+ * Deletes a role by ID.
+ *
+ * @param roleId - Role ID to delete
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the deletion result
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function deleteRole(roleId, options) {
+    // Validate required fields
+    if (!roleId || roleId.trim() === '') {
+        throw new ApiError('role_id is required for role deletion', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/roles/${encodeURIComponent(roleId)}`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'DELETE',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to delete role: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse role deletion response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Role deletion failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || json.data.deleted !== true) {
+        throw new ApiError('Invalid role deletion response: deletion not confirmed', response.status);
+    }
+    return json.data;
+}
+/**
+ * Retrieves role information by ID.
+ *
+ * @param roleId - Role ID to query
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the role information
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function getRoleById(roleId, options) {
+    // Validate required fields
+    if (!roleId || roleId.trim() === '') {
+        throw new ApiError('role_id is required for role query', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/roles/${encodeURIComponent(roleId)}`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to get role: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse role response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Role retrieval failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.role) {
+        throw new ApiError('Invalid role response: missing role data', response.status);
+    }
+    return json.data;
+}
+/**
+ * Lists roles with pagination and filtering.
+ *
+ * @param options - Optional parameters for pagination, filtering, and configuration
+ * @returns Promise resolving to paginated role list with metadata
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function listRoles(options) {
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    // Build URL with query parameters
+    const url = new URL(String(base).replace(/\/+$/, '') + '/rbac/v1/roles');
+    // Add query parameters with defaults
+    const queryParams = {
+        page: 0,
+        size: 20,
+        sort_by: 'created_at',
+        sort_direction: 'desc',
+        ...options
+    };
+    // Add parameters to URL
+    if (queryParams.page !== undefined) {
+        url.searchParams.append('page', String(queryParams.page));
+    }
+    if (queryParams.size !== undefined) {
+        url.searchParams.append('size', String(queryParams.size));
+    }
+    if (queryParams.role_type) {
+        url.searchParams.append('role_type', queryParams.role_type);
+    }
+    if (queryParams.sort_by) {
+        url.searchParams.append('sort_by', queryParams.sort_by);
+    }
+    if (queryParams.sort_direction) {
+        url.searchParams.append('sort_direction', queryParams.sort_direction);
+    }
+    let response;
+    try {
+        response = await globalThis.fetch(url.toString(), {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to list roles: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse roles list response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Roles list retrieval failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !Array.isArray(json.data.content)) {
+        throw new ApiError('Invalid roles list response: missing required data', response.status);
+    }
+    return json.data;
+}
+// ===== 权限管理 =====
+/**
+ * Creates a new privilege in the Tale application.
+ *
+ * @param privilegeData - Privilege data to create the new privilege
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the created privilege information
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function createPrivilege(privilegeData, options) {
+    // Validate required fields
+    if (!privilegeData.privilege_name || privilegeData.privilege_name.trim() === '') {
+        throw new ApiError('privilege_name is required for privilege creation', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + '/rbac/v1/privileges';
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+            body: JSON.stringify(privilegeData),
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to create privilege: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse privilege creation response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Privilege creation failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.privilege) {
+        throw new ApiError('Invalid privilege creation response: missing privilege data', response.status);
+    }
+    return json.data;
+}
+/**
+ * Updates an existing privilege by ID.
+ *
+ * @param privilegeId - Privilege ID to update
+ * @param updateData - Privilege information to update
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the updated privilege information
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function updatePrivilege(privilegeId, updateData, options) {
+    // Validate required fields
+    if (!privilegeId || privilegeId.trim() === '') {
+        throw new ApiError('privilege_id is required for privilege update', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/privileges/${encodeURIComponent(privilegeId)}`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'PUT',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+            body: JSON.stringify(updateData),
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to update privilege: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse privilege update response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Privilege update failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.privilege) {
+        throw new ApiError('Invalid privilege update response: missing privilege data', response.status);
+    }
+    return json.data;
+}
+/**
+ * Deletes a privilege by ID.
+ *
+ * @param privilegeId - Privilege ID to delete
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the deletion result
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function deletePrivilege(privilegeId, options) {
+    // Validate required fields
+    if (!privilegeId || privilegeId.trim() === '') {
+        throw new ApiError('privilege_id is required for privilege deletion', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/privileges/${encodeURIComponent(privilegeId)}`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'DELETE',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to delete privilege: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse privilege deletion response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Privilege deletion failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || json.data.deleted !== true) {
+        throw new ApiError('Invalid privilege deletion response: deletion not confirmed', response.status);
+    }
+    return json.data;
+}
+/**
+ * Retrieves privilege information by ID.
+ *
+ * @param privilegeId - Privilege ID to query
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the privilege information
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function getPrivilegeById(privilegeId, options) {
+    // Validate required fields
+    if (!privilegeId || privilegeId.trim() === '') {
+        throw new ApiError('privilege_id is required for privilege query', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/privileges/${encodeURIComponent(privilegeId)}`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to get privilege: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse privilege response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Privilege retrieval failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.privilege) {
+        throw new ApiError('Invalid privilege response: missing privilege data', response.status);
+    }
+    return json.data;
+}
+/**
+ * Lists privileges with pagination and filtering.
+ *
+ * @param options - Optional parameters for pagination, filtering, and configuration
+ * @returns Promise resolving to paginated privilege list with metadata
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function listPrivileges(options) {
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    // Build URL with query parameters
+    const url = new URL(String(base).replace(/\/+$/, '') + '/rbac/v1/privileges');
+    // Add query parameters with defaults
+    const queryParams = {
+        page: 0,
+        size: 20,
+        sort_by: 'created_at',
+        sort_direction: 'desc',
+        ...options
+    };
+    // Add parameters to URL
+    if (queryParams.page !== undefined) {
+        url.searchParams.append('page', String(queryParams.page));
+    }
+    if (queryParams.size !== undefined) {
+        url.searchParams.append('size', String(queryParams.size));
+    }
+    if (queryParams.privilege_type) {
+        url.searchParams.append('privilege_type', queryParams.privilege_type);
+    }
+    if (queryParams.sort_by) {
+        url.searchParams.append('sort_by', queryParams.sort_by);
+    }
+    if (queryParams.sort_direction) {
+        url.searchParams.append('sort_direction', queryParams.sort_direction);
+    }
+    let response;
+    try {
+        response = await globalThis.fetch(url.toString(), {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to list privileges: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse privileges list response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Privileges list retrieval failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !Array.isArray(json.data.content)) {
+        throw new ApiError('Invalid privileges list response: missing required data', response.status);
+    }
+    return json.data;
+}
+// ===== 用户角色和权限分配 =====
+/**
+ * Assigns roles to a user.
+ *
+ * @param userId - User ID to assign roles to
+ * @param assignmentData - Role assignment data
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the assigned roles
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function assignRolesToUser(userId, assignmentData, options) {
+    // Validate required fields
+    if (!userId || userId.trim() === '') {
+        throw new ApiError('user_id is required for role assignment', 400, '9400');
+    }
+    if (!assignmentData.role_ids || assignmentData.role_ids.length === 0) {
+        throw new ApiError('role_ids is required for role assignment', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/user/${encodeURIComponent(userId)}/roles`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+            body: JSON.stringify(assignmentData),
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to assign roles to user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse role assignment response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Role assignment failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.roles) {
+        throw new ApiError('Invalid role assignment response: missing roles data', response.status);
+    }
+    return json.data;
+}
+/**
+ * Unassigns roles from a user.
+ *
+ * @param userId - User ID to unassign roles from
+ * @param unassignmentData - Role unassignment data
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the unassignment result
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function unassignRolesFromUser(userId, unassignmentData, options) {
+    // Validate required fields
+    if (!userId || userId.trim() === '') {
+        throw new ApiError('user_id is required for role unassignment', 400, '9400');
+    }
+    if (!unassignmentData.role_ids || unassignmentData.role_ids.length === 0) {
+        throw new ApiError('role_ids is required for role unassignment', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/user/${encodeURIComponent(userId)}/roles`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'DELETE',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+            body: JSON.stringify(unassignmentData),
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to unassign roles from user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse role unassignment response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Role unassignment failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || json.data.unassigned !== true) {
+        throw new ApiError('Invalid role unassignment response: unassignment not confirmed', response.status);
+    }
+    return json.data;
+}
+/**
+ * Assigns privileges to a user.
+ *
+ * @param userId - User ID to assign privileges to
+ * @param assignmentData - Privilege assignment data
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the assigned privileges
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function assignPrivilegesToUser(userId, assignmentData, options) {
+    // Validate required fields
+    if (!userId || userId.trim() === '') {
+        throw new ApiError('user_id is required for privilege assignment', 400, '9400');
+    }
+    if (!assignmentData.privilege_ids || assignmentData.privilege_ids.length === 0) {
+        throw new ApiError('privilege_ids is required for privilege assignment', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/user/${encodeURIComponent(userId)}/privileges`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+            body: JSON.stringify(assignmentData),
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to assign privileges to user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse privilege assignment response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Privilege assignment failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.privileges) {
+        throw new ApiError('Invalid privilege assignment response: missing privileges data', response.status);
+    }
+    return json.data;
+}
+/**
+ * Unassigns privileges from a user.
+ *
+ * @param userId - User ID to unassign privileges from
+ * @param unassignmentData - Privilege unassignment data
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the unassignment result
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function unassignPrivilegesFromUser(userId, unassignmentData, options) {
+    // Validate required fields
+    if (!userId || userId.trim() === '') {
+        throw new ApiError('user_id is required for privilege unassignment', 400, '9400');
+    }
+    if (!unassignmentData.privilege_ids || unassignmentData.privilege_ids.length === 0) {
+        throw new ApiError('privilege_ids is required for privilege unassignment', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/user/${encodeURIComponent(userId)}/privileges`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'DELETE',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+            body: JSON.stringify(unassignmentData),
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to unassign privileges from user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse privilege unassignment response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'Privilege unassignment failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || json.data.unassigned !== true) {
+        throw new ApiError('Invalid privilege unassignment response: unassignment not confirmed', response.status);
+    }
+    return json.data;
+}
+/**
+ * Gets the roles assigned to a user.
+ *
+ * @param userId - User ID to query
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the user's roles
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function getUserRoles(userId, options) {
+    // Validate required fields
+    if (!userId || userId.trim() === '') {
+        throw new ApiError('user_id is required for user roles query', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/user/${encodeURIComponent(userId)}/roles`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to get user roles: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse user roles response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'User roles retrieval failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.roles) {
+        throw new ApiError('Invalid user roles response: missing roles data', response.status);
+    }
+    return json.data;
+}
+/**
+ * Gets the privileges assigned to a user.
+ *
+ * @param userId - User ID to query
+ * @param options - Optional configuration for the request
+ * @returns Promise resolving to the user's privileges
+ * @throws {ConfigurationError} When required environment variables are missing
+ * @throws {ApiError} When API request fails or returns invalid response
+ * @throws {NetworkError} When network request fails
+ */
+export async function getUserPrivileges(userId, options) {
+    // Validate required fields
+    if (!userId || userId.trim() === '') {
+        throw new ApiError('user_id is required for user privileges query', 400, '9400');
+    }
+    // Use provided app token or get one from token service
+    const token = options?.appToken ?? await getAppToken(options);
+    // Determine base URL
+    const env = globalThis?.process?.env ?? import.meta?.env ?? undefined;
+    const base = options?.baseUrl ?? env?.TALE_BASE_URL ?? undefined;
+    if (!base) {
+        throw new ConfigurationError('Missing required environment variable: TALE_BASE_URL');
+    }
+    const url = String(base).replace(/\/+$/, '') + `/rbac/v1/user/${encodeURIComponent(userId)}/privileges`;
+    let response;
+    try {
+        response = await globalThis.fetch(url, {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-t-token': token,
+            },
+        });
+    }
+    catch (error) {
+        throw new NetworkError(`Failed to get user privileges: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    let json;
+    try {
+        const responseJson = await response.json();
+        json = responseJson;
+    }
+    catch (error) {
+        throw new ApiError(`Failed to parse user privileges response: ${error instanceof Error ? error.message : 'Invalid JSON'}`, response.status);
+    }
+    // Handle API errors
+    if (json.code !== 200) {
+        const errorMsg = typeof json.msg === 'string' ? json.msg : 'User privileges retrieval failed';
+        throw new ApiError(errorMsg, response.status, json.code);
+    }
+    // Validate response structure
+    if (!json.data || !json.data.privileges) {
+        throw new ApiError('Invalid user privileges response: missing privileges data', response.status);
+    }
+    return json.data;
+}