Role and Permission Administration
Problem
Design RolePermissionAdministration to define permission-bearing roles, manage user-role assignments, and evaluate each user's effective access. Calls are sequential on one shared instance.
Requirements
- Upsert the exact role definition.
setRolecreates a missing role or replaces an existing role with exactly the supplied permission set rather than merging with its earlier set. - Apply replacements to existing assignments. Users already assigned a role use its current definition, so later authorization checks reflect a completed replacement without reassignment.
- Assign a defined role.
assignRolereturnstruefor a defined role and adds the user-role membership when it is absent. - Keep duplicate assignment idempotent. Repeating an assignment of the same defined role returns
true, leaves exactly one membership, and does not change authorization. - Reject an unknown role.
assignRolereturnsfalsewhen the role has not been defined. - Keep rejection atomic. A rejected assignment creates no user or membership and changes no role definition, existing membership, or authorization result.
- Revoke one role idempotently.
revokeRoleremoves only the specified membership when present. Repeating the revocation changes nothing, and other memberships and role definitions remain unchanged. - Authorize from the union of roles.
isAllowedreturnstrueexactly when at least one role currently assigned to the user contains the permission in its current definition. Otherwise it returnsfalse.
API
| Signature | Returns | Behavior |
|---|---|---|
RolePermissionAdministration() | Not applicable | Creates an empty service with no role definitions or user-role memberships. |
setRole(role: string, permissions: string[]) | void | Creates the role or replaces its complete permission set. |
assignRole(user: string, role: string) | boolean | Returns true and adds an absent membership when the role is defined. Returns false with no state change when the role is unknown. |
revokeRole(user: string, role: string) | void | Removes only the specified membership if present. The role is defined in judged calls. |
isAllowed(user: string, permission: string) | boolean | Evaluates the union of the user's current role permissions without changing state. |
Examples
| Step | Operation | Result |
|---|---|---|
| 1 | setRole("EDITOR", ["article.read", "article.edit"]) | No return value |
| 2 | assignRole("alice", "EDITOR") | true |
| 3 | isAllowed("alice", "article.edit") | true |
| 4 | setRole("EDITOR", ["article.read"]) | No return value |
| 5 | isAllowed("alice", "article.edit") | false |
| 6 | isAllowed("alice", "article.read") | true |
If bob holds VIEWER with article.read and PUBLISHER with article.publish, both permissions are allowed. A repeated PUBLISHER assignment still returns true, and revoking VIEWER removes only read access.
If assignRole("carol", "MISSING") is called before MISSING is defined, it returns false. Defining MISSING later does not give carol any permission from that role.
Constraints
- A role, user, or permission contains 1 to 64 characters from
A-Z,a-z,0-9,.,:,_, or-. - Each
setRolecall supplies 0 to 500 distinct permissions. - A role passed to
revokeRolehas already been defined bysetRole.assignRolemay name an unknown syntactically valid role. - At most 10,000 roles, 100,000 users with memberships, and 500,000 user-role memberships exist at once.
- A user has at most 100 assigned roles.
- At most 200,000 public method calls occur per testcase.
Notes
Identifiers are case-sensitive and compared exactly. Permission-list order has no observable meaning. Calls execute sequentially in invocation order, and every completed mutation is visible to later authorization checks. Inputs outside the constraints are not supplied or judged. Unknown-role assignment is the only judged domain rejection, and no judged call throws a learner-visible domain exception.