Module roles 

Role hierarchy and expansion.

Lives here rather than in cloudillo-core because both the core crate and the auth adapters must mint role strings the exact same way: login (build_tenant_owner_roles in auth-adapter-sqlite) and access-token refresh (cloudillo_auth::handler) produce the tenant owner’s roles independently, and any divergence silently widens or narrows the site admin’s authority depending on which issued their token. cloudillo_core::roles re-exports everything here, so core-side callers see no difference.

Constants

ROLE_HIERARCHY

Role hierarchy for profile-level permissions Higher roles inherit all permissions from lower roles

Functions

expand_roles

Expands hierarchical roles from highest role to all inherited roles

expand_roles_preserving_extras

Expand the hierarchy portion of roles and append any non-hierarchy roles verbatim.

role_level

Hierarchy index of a single role, or None if unknown.