Class: Admin::Role

Inherits:
ApplicationRecord show all
Defined in:
app/models/admin/role.rb

Overview

A machine actor, assumable only via an identity member's grant — nothing signs in as a role. Config declares roles (a role exists when a member's scope names it); the row is the stable identity that grants and audit records reference, materialized on first use and never deleted.

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.materialize(slug) ⇒ Object 



19
20
21
 
# File 'app/models/admin/role.rb', line 19

def self.materialize(slug)
  create_or_find_by!(slug:)
end

Instance Method Details

#last_authenticated_at ⇒ Object

Roles authenticate by exchanging an assertion for a token; requests made with the token never touch this row, so issuance is the freshest signal available.



37
38
39
 
# File 'app/models/admin/role.rb', line 37

def last_authenticated_at
  device_authorizations.maximum(:consumed_at)
end

#members ⇒ Object

Members granting this role in the current trust config.



30
31
32
 
# File 'app/models/admin/role.rb', line 30

def members
  Koi::Identity.members.select { |member| member.role_slug == slug }
end

#orphaned? ⇒ Boolean

Config is authoritative for grants: a row whose slug no longer appears in any member's scope is not assumable, but remains for attribution.

Returns:

  • (Boolean) 


25
26
27
 
# File 'app/models/admin/role.rb', line 25

def orphaned?
  Koi::Identity.role_slugs.exclude?(slug)
end