Convert Roles module to MediatR commands/queries

Replaces IRoleService/RoleService. The permission-builder logic moves
to a shared RolePermissionBuilder static helper used by both the
create and update handlers. RolesController keeps its inline
IPermissionService checks unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

mws.application/Roles/Commands/CreateRole.cs

@@ -0,0 +1,40 @@
+using AutoMapper;
+using MediatR;
+using Mws.Application.Common;
+using Mws.Domain.Roles;
+
+namespace Mws.Application.Roles;
+
+public record CreateRoleCommand(SaveRoleRequest Request) : IRequest<RoleDto>;
+
+public class CreateRoleHandler(IUnitOfWork uow, IMapper mapper) : IRequestHandler<CreateRoleCommand, RoleDto>
+{
+    public async Task<RoleDto> Handle(CreateRoleCommand command, CancellationToken ct)
+    {
+        var name = command.Request.Name.Trim();
+        if (string.IsNullOrWhiteSpace(name))
+        {
+            throw new BadRequestException("Role name is required");
+        }
+
+        if (await uow.Roles.ExistsByNameAsync(name, null, ct))
+        {
+            throw new BadRequestException("Role name already exists");
+        }
+
+        var now = DateTime.UtcNow;
+        var role = new Role
+        {
+            Id = Guid.NewGuid(),
+            Name = name,
+            IsSystem = false,
+            CreatedAt = now,
+            UpdatedAt = now,
+            Permissions = RolePermissionBuilder.Build(command.Request.Permissions),
+        };
+
+        uow.Roles.Add(role);
+        await uow.SaveChangesAsync(ct);
+        return mapper.Map<RoleDto>(role);
+    }
+}

mws.application/Roles/Commands/DeleteRole.cs

@@ -0,0 +1,28 @@
+using MediatR;
+using Mws.Application.Common;
+
+namespace Mws.Application.Roles;
+
+public record DeleteRoleCommand(Guid Id) : IRequest;
+
+public class DeleteRoleHandler(IUnitOfWork uow) : IRequestHandler<DeleteRoleCommand>
+{
+    public async Task Handle(DeleteRoleCommand command, CancellationToken ct)
+    {
+        var role = await uow.Roles.GetByIdAsync(command.Id, ct)
+            ?? throw new NotFoundException("Role not found");
+
+        if (role.IsSystem)
+        {
+            throw new BadRequestException("Cannot delete a system role");
+        }
+
+        if (await uow.Users.ExistsByRoleIdAsync(command.Id, ct))
+        {
+            throw new BadRequestException("Cannot delete a role that is assigned to accounts");
+        }
+
+        uow.Roles.Remove(role);
+        await uow.SaveChangesAsync(ct);
+    }
+}

mws.application/Roles/Commands/UpdateRole.cs

@@ -0,0 +1,40 @@
+using AutoMapper;
+using MediatR;
+using Mws.Application.Common;
+
+namespace Mws.Application.Roles;
+
+public record UpdateRoleCommand(Guid Id, SaveRoleRequest Request) : IRequest<RoleDto>;
+
+public class UpdateRoleHandler(IUnitOfWork uow, IMapper mapper) : IRequestHandler<UpdateRoleCommand, RoleDto>
+{
+    public async Task<RoleDto> Handle(UpdateRoleCommand command, CancellationToken ct)
+    {
+        var role = await uow.Roles.GetByIdWithPermissionsAsync(command.Id, ct)
+            ?? throw new NotFoundException("Role not found");
+
+        var name = command.Request.Name.Trim();
+        if (string.IsNullOrWhiteSpace(name))
+        {
+            throw new BadRequestException("Role name is required");
+        }
+
+        if (await uow.Roles.ExistsByNameAsync(name, command.Id, ct))
+        {
+            throw new BadRequestException("Role name already exists");
+        }
+
+        role.Name = name;
+        role.UpdatedAt = DateTime.UtcNow;
+
+        uow.Roles.RemovePermissions(role.Permissions.ToList());
+        role.Permissions = RolePermissionBuilder.Build(command.Request.Permissions);
+        foreach (var p in role.Permissions)
+        {
+            p.RoleId = role.Id;
+        }
+
+        await uow.SaveChangesAsync(ct);
+        return mapper.Map<RoleDto>(role);
+    }
+}