KemalIdentity::Testing::MemoryAuthzRepository

Everyone holding role in tenant_id, for the access review that asks the question the other way round: not "what can this person do" but "who can do this".

Adds a membership. Returns false if the account is already a member, which is not an error — a double-submitted invitation is an ordinary thing.

Every assignment for an account, global and per-tenant, oldest first. For an access review, and for the "what would deleting this account remove" screen.

Grants a role. Returns false if the account already holds it in that scope.

It is not this method's job to check that the role exists — RoleCatalog is what knows that, it lives in the application, and a repository that validated role names would be a second, weaker copy of the same rule.

Everything one decision needs about account_id, optionally within tenant_id.

With a nil tenant_id the result must have member false and tenant_roles empty: no tenant was named, so neither has any meaning.

Who belongs to this tenant, oldest first. Paged, because a tenant with fifty thousand members is a tenant whose administration screen must not load fifty thousand rows to show the first twenty.

Which tenants this account belongs to, oldest first.

Deletes every membership and assignment for an account, returning how many rows went. What account deletion calls, and what a repository must offer so that authorization data does not outlive the account it describes.

Removes a membership and every role assignment for that account in that tenant. Returns false if there was no membership. See the note above on why the two are one operation.

Takes a role away. tenant_id nil revokes the global assignment, not every tenant one: they are different grants and revoking the wrong one silently leaves access in place. Returns false if it was not held.