mws.backend.dotnet/application/Users/Commands/UnassignUserRole.cs

using MediatR;
using mws.backend.dotnet.application.Audit;
using mws.backend.dotnet.application.Common;
using mws.backend.dotnet.application.Permissions;

namespace mws.backend.dotnet.application.Users;

public record UnassignUserRoleCommand(Guid ActorUserId, Guid TargetUserId, Guid RoleId) : IRequest, IAuditableRequest
{
    public string Action => "User.UnassignRole";
    public string EntityType => "User";
    public Guid? EntityId => TargetUserId;
}

public class UnassignUserRoleHandler(IUnitOfWork uow, IPermissionService permissions, IAuditContext auditContext)
    : IRequestHandler<UnassignUserRoleCommand>
{
    public async Task Handle(UnassignUserRoleCommand command, CancellationToken ct)
    {
        await permissions.EnsureAsync(command.ActorUserId, "permissions", PermissionAction.Edit, ct);

        var user = await uow.Users.GetByIdWithRoleAsync(command.TargetUserId, ct)
            ?? throw new NotFoundException("User not found");

        var userRole = user.UserRoles.FirstOrDefault(ur => ur.RoleId == command.RoleId);
        if (userRole is not null)
        {
            user.UserRoles.Remove(userRole);
            await uow.SaveChangesAsync(ct);
        }

        auditContext.EntityName = user.Username;
    }
}