feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention

app/routes/roles.py

@@ -9,7 +9,10 @@ from fastapi.responses import JSONResponse
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.audit import log_audit
+from app.core.auth import get_redis
 from app.core.db import get_db
+from app.core.permissions import invalidate_all_user_permissions
 from app.deps import get_current_user, require_admin
 from app.models.plugin import Plugin as PluginModel
 from app.plugins.registry import get_registry
@@ -142,6 +145,17 @@ async def update_role(
     if role is None:
         raise HTTPException(404, detail={"detail": "Role not found", "code": "not_found"})
 
+    # Invalidate permission cache for all users in this tenant
+    redis = get_redis()
+    await invalidate_all_user_permissions(redis, tenant_id)
+
+    # Audit log
+    acting_user_id = uuid.UUID(current_user["user_id"])
+    await log_audit(
+        db, tenant_id, acting_user_id, "update", "role", rid,
+        changes=body.model_dump(exclude_none=True),
+    )
+
     return {
         "id": str(role.id),
         "name": role.name,
@@ -169,4 +183,11 @@ async def delete_role(
     if not success:
         raise HTTPException(404, detail={"detail": "Role not found", "code": "not_found"})
 
+    # Invalidate permission cache for all users in this tenant
+    redis = get_redis()
+    await invalidate_all_user_permissions(redis, tenant_id)
+
+    acting_user_id = uuid.UUID(current_user["user_id"])
+    await log_audit(db, tenant_id, acting_user_id, "delete", "role", rid)
+
     return Response(status_code=status.HTTP_204_NO_CONTENT)