Module roles 

Role hierarchy and expansion logic

This module defines the built-in role hierarchy and provides utilities for expanding hierarchical roles.

Constants

LEADER_LEVEL

Hierarchy level of the “leader” role.

MODERATOR_LEVEL

Lowest hierarchy level permitted to manage (remove / re-role) other members.

ROLE_HIERARCHY

The hierarchy itself and its expansion live in cloudillo-types so the auth adapters can mint role strings through the same code the token-refresh path uses — see that module for why. Role hierarchy for profile-level permissions Higher roles inherit all permissions from lower roles

Functions

can_assign_role

Whether an actor at actor_level may assign role. Leaders may assign any known role; everyone else is capped strictly below their own level. Unknown roles are never assignable.

can_manage_member

Whether an actor at actor_level may manage (remove or re-role) a member at target_level. Rule: the actor must be moderator+ and strictly outrank the target — except leaders, who may also manage peer leaders.

can_manage_member_by_roles

Whether an actor with actor_roles may manage (remove / re-role) a member with target_roles. Convenience over can_manage_member + highest_role_level.

expand_roles

The hierarchy itself and its expansion live in cloudillo-types so the auth adapters can mint role strings through the same code the token-refresh path uses — see that module for why. Expands hierarchical roles from highest role to all inherited roles

expand_roles_preserving_extras

The hierarchy itself and its expansion live in cloudillo-types so the auth adapters can mint role strings through the same code the token-refresh path uses — see that module for why. Expand the hierarchy portion of roles and append any non-hierarchy roles verbatim.

highest_role_level

Highest hierarchy level among the given roles; unknown roles are ignored. Empty / all-unknown ⇒ 0 (public).

is_leader

True iff roles reaches the leader level — the bar for managing tenant-owned resources. The tenant owner carries the full hierarchy (build_tenant_owner_roles in auth-adapter-sqlite); federated visitors and share-link tokens carry none.

parse_roles

The single parser for comma-separated role strings, re-exported for core-side callers. Empty segments must be dropped — see the definition for why. Parse a comma-separated role list into the shape AuthCtx::roles expects.

role_level

The hierarchy itself and its expansion live in cloudillo-types so the auth adapters can mint role strings through the same code the token-refresh path uses — see that module for why. Hierarchy index of a single role, or None if unknown.