Added user management endpoints

PostFundManagement.Api/Endpoints/Governance/GetTenantOrganisationsEndpoint.cs

@@ -1,9 +1,9 @@
 using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Entities;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
 
 namespace PostFundManagement.Api.Endpoints.Governance;
 

PostFundManagement.Api/Endpoints/Users/AddUserClaimEndpoint.cs

@@ -1,5 +1,36 @@
-namespace PostFundManagement.Api.Endpoints.Users;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models.Security;
 
-public class AddUserClaimEndpoint
+namespace PostFundManagement.Api.Endpoints.Users;
+
+[ApiVersionTarget(1)]
+public sealed class AddUserClaimEndpoint : IEndpoint
 {
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPatch("api/users/user/claims", async (AddUserClaimRequest request, HttpContext context,
+            IUserService userService, CancellationToken cancellationToken = default) =>
+                await userService.AddUserClaimAsync(request, userId: context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Adds a claim to a user")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(AddUserClaimEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
+    }
 }

PostFundManagement.Api/Endpoints/Users/AddUserRoleEndpoint.cs

@@ -1,5 +1,35 @@
-namespace PostFundManagement.Api.Endpoints.Users;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
 
-public class AddUserRoleEndpoint
+namespace PostFundManagement.Api.Endpoints.Users;
+
+[ApiVersionTarget(1)]
+public sealed class AddUserRoleEndpoint : IEndpoint
 {
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPatch("api/users/{userId:Guid}/roles/{roleId}", async (Guid userId, string roleId, HttpContext context,
+            IUserService userService, CancellationToken cancellationToken = default) =>
+                await userService.AddUserRoleAsync(userId, roleId, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Adds a role to a user")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(AddUserRoleEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
+    }
 }

PostFundManagement.Api/Endpoints/Users/CreateUserEndpoint.cs

@@ -1,4 +1,9 @@
-using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models.Security;
 
 namespace PostFundManagement.Api.Endpoints.Users;
 
@@ -7,6 +12,26 @@ public sealed class CreateUserEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        throw new NotImplementedException();
+        builder.MapPost("/api/users/{tenantId}/{idNumber}", async (string tenantId, string idNumber, CreateUserRequest request, HttpContext context, IUserService userService, 
+            CancellationToken cancellationToken = default) =>
+                await userService.CreateUserAsync(tenantId, idNumber, request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Creates a new user in the system")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateUserEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status404NotFound)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
     }
 }

PostFundManagement.Api/Endpoints/Users/DeleteUserClaimEndpoint.cs

@@ -1,6 +1,35 @@
-namespace PostFundManagement.Api.Endpoints.Users;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
 
-public class DeleteUserClaimEndpoint
+namespace PostFundManagement.Api.Endpoints.Users;
+
+[ApiVersionTarget(1)]
+public sealed class DeleteUserClaimEndpoint : IEndpoint
 {
-
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapDelete("api/users/{targetUserId:Guid}/claims/{claimId}", async (string claimId, Guid targetUserId, HttpContext context, 
+            IUserService service, CancellationToken cancellationToken = default) =>
+                await service.DeleteUserClaimAsync(claimIdHash: claimId, targetUserId: targetUserId, userId: context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Deletes a claim from a user")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(DeleteUserClaimEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
+    }
 }

PostFundManagement.Api/Endpoints/Users/DeleteUserRoleEndpoint.cs

@@ -1,5 +1,34 @@
-namespace PostFundManagement.Api.Endpoints.Users;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
 
-public class DeleteUserRoleEndpoint
+namespace PostFundManagement.Api.Endpoints.Users;
+
+[ApiVersionTarget(1)]
+public sealed class DeleteUserRoleEndpoint : IEndpoint
 {
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapDelete("api/users/{userId:Guid}/roles/{roleId}", async (Guid userId, string roleId, HttpContext context,
+            IUserService service, CancellationToken cancellationToken = default) =>
+                await service.DeleteUserRoleAsync(userId, roleId, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Delete user role")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(DeleteUserRoleEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
+    }
 }

PostFundManagement.Api/Endpoints/Users/GetSystemRolesEndpoint.cs

@@ -1,5 +1,35 @@
-namespace PostFundManagement.Api.Endpoints.Users;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models.Security;
 
-public class GetSystemRolesEndpoint
+namespace PostFundManagement.Api.Endpoints.Users;
+
+[ApiVersionTarget(1)]
+public sealed class GetSystemRolesEndpoint : IEndpoint
 {
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/users/system/roles", async (HttpContext context,
+            IUserService service, CancellationToken cancellationToken = default) =>
+                await service.GetSystemRolesAsync(context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var roles } => Results.Ok(roles),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Get system roles")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetSystemRolesEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Role[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
+    }
 }

PostFundManagement.Api/Endpoints/Users/GetUserClaimsEndpoint.cs

@@ -1,6 +1,35 @@
-namespace PostFundManagement.Api.Endpoints.Users;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using Claim = PostFundManagement.Domain.Models.Security.Claim;
 
-public class GetUserClaimsEndpoint
+namespace PostFundManagement.Api.Endpoints.Users;
+
+[ApiVersionTarget(1)]
+public sealed class GetUserClaimsEndpoint : IEndpoint
 {
-
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/users/{userId:Guid}/claims", async (Guid userId, HttpContext context,
+            IUserService service, CancellationToken cancellationToken = default) =>
+                await service.GetUserClaimsAsync(userId, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var claims } => Results.Ok(claims),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Get user claims")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetUserClaimsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Claim[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
+    }
 }

PostFundManagement.Api/Endpoints/Users/GetUserEndpoint.cs

@@ -17,7 +17,7 @@ public sealed class GetUserEndpoint : IEndpoint
                 await service.GetUserAsync(userId, cancellationToken) switch
                 {
                     { IsSuccess: true, Value: var user } => Results.Ok(user),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                     var r => Results.InternalServerError(r.Errors.ToProblems())
                 })
             .WithDescription("Gets the metadata of a single user.")
@@ -25,8 +25,8 @@ public sealed class GetUserEndpoint : IEndpoint
             .WithName(typeof(GetUserEndpoint).ToEndpointName())
             .MapToApiVersion(new ApiVersion(1))
             .Produces<User>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
             .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
             .Produces<Problems>(StatusCodes.Status500InternalServerError)
             .WithTags(EndpointTags.Users)
             .CacheOutput();

PostFundManagement.Api/Endpoints/Users/GetUserRolesEndpoint.cs

@@ -1,5 +1,35 @@
-namespace PostFundManagement.Api.Endpoints.Users;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models.Security;
 
-public class GetUserRolesEndpoint
+namespace PostFundManagement.Api.Endpoints.Users;
+
+[ApiVersionTarget(1)]
+public sealed class GetUserRolesEndpoint : IEndpoint
 {
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/users/{userId:Guid}/roles", async (Guid userId, HttpContext context,
+            IUserService service, CancellationToken cancellationToken = default) =>
+                await service.GetUserRolesAsync(userId, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var roles } => Results.Ok(roles),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Get user roles")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetUserRolesEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Role[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
+    }
 }

PostFundManagement.Api/Endpoints/Users/LogUserOutEndpoint.cs

@@ -1,5 +1,34 @@
-namespace PostFundManagement.Api.Endpoints.Users;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
 
-public class LogUserOutEndpoint
+namespace PostFundManagement.Api.Endpoints.Users;
+
+[ApiVersionTarget(1)]
+public sealed class LogUserOutEndpoint : IEndpoint
 {
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/users/{userId:Guid}/session/logout", async (Guid userId, HttpContext context,
+            IUserService service, CancellationToken cancellationToken = default) =>
+                await service.LogoutUserAsync(userId, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Logout user session")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(LogUserOutEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
+    }
 }

PostFundManagement.Api/Endpoints/Users/SetUserLockoutEndpoint.cs

@@ -1,5 +1,34 @@
-namespace PostFundManagement.Api.Endpoints.Users;
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
 
-public class SetUserLockoutEndpoint
+namespace PostFundManagement.Api.Endpoints.Users;
+
+[ApiVersionTarget(1)]
+public sealed class SetUserLockoutEndpoint : IEndpoint
 {
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/users/{userId:Guid}/session/lockout/{disable:bool}", async (Guid userId, bool disable, HttpContext context,
+            IUserService service, CancellationToken cancellationToken = default) =>
+                await service.SetUserLockoutAsync(userId, context.GetUserId(), disable, cancellationToken) switch
+                {
+                    {  IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Lock user session")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(SetUserLockoutEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Users);
+    }
 }

PostFundManagement.Application/Abstractions/Services/IUserService.cs

@@ -2,6 +2,7 @@
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Attributes;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Models.Security;
 
 namespace PostFundManagement.Application.Abstractions.Services;
 
@@ -19,5 +20,42 @@ public interface IUserService
     Task<Result> UpdateUserStatusAsync(Guid userId, ActivityStatus status, CancellationToken cancellationToken = default);
 
     [Log]
-    Task<Result<User>> GetUserAsync(Guid userId, CancellationToken cancellationToken);
+    Task<Result<User>> GetUserAsync(Guid userId, CancellationToken cancellationToken = default);
+
+    [Log]
+    [Audit]
+    Task<Result> CreateUserAsync(string tenantIdHash, string idNumberHash, CreateUserRequest request, Guid userId, CancellationToken cancellationToken = default);
+
+    [Log]
+    [Audit]
+    Task<Result> AddUserClaimAsync(AddUserClaimRequest request, Guid userId, CancellationToken cancellationToken = default);
+
+    [Log]
+    [Audit]
+    Task<Result> AddUserRoleAsync(Guid targetUserId, string roleId, Guid userId, CancellationToken cancellationToken = default);
+
+    [Log]
+    [Audit]
+    Task<Result> DeleteUserClaimAsync(string claimIdHash, Guid targetUserId, Guid userId, CancellationToken cancellationToken = default);
+
+    [Log]
+    [Audit]
+    Task<Result> SetUserLockoutAsync(Guid targetUserId, Guid userId, bool disable, CancellationToken cancellationToken = default);
+
+    [Log]
+    [Audit]
+    Task<Result> LogoutUserAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default);
+
+    [Log]
+    Task<Result<Role[]>> GetUserRolesAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default);
+
+    [Log]
+    Task<Result<Domain.Models.Security.Claim[]>> GetUserClaimsAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default);
+
+    [Log]
+    Task<Result<Role[]>> GetSystemRolesAsync(Guid userId, CancellationToken cancellationToken = default);
+
+    [Log]
+    [Audit]
+    Task<Result> DeleteUserRoleAsync(Guid targetUserId, string roleId, Guid userId, CancellationToken cancellationToken = default);
 }

PostFundManagement.Application/Extensions/Security.cs

@@ -32,12 +32,15 @@ public static class Security
                 client.ClientSecret = ClientSecret.Parse(authOptions.ClientSecret!);
                 client.Scope = Duende.AccessTokenManagement.Scope.ParseOrDefault(authOptions.Scope);
             });
-        
+                
         services.AddHttpClient(SkorubaHttpClient, client =>
         {
             client.BaseAddress = new Uri(configuration.GetConnectionString("SkorubaApi")!);
         }).AddClientCredentialsTokenHandler(ClientCredentialsClientName.Parse(SkorubaCredentialClient));
 
+        services.AddKeyedScoped(SkorubaHttpClient, (provider, key) => 
+            provider.GetRequiredService<IHttpClientFactory>());
+
         services.AddScoped<AuditInterceptor>();
         services.AddScoped<LoggingInterceptor>();
         services.AddSingleton<ProxyGenerator>();

PostFundManagement.Application/Services/Users/UserCacheService.cs

@@ -3,12 +3,54 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Shared;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Models.Security;
+using Claim = PostFundManagement.Domain.Models.Security.Claim;
 
 namespace PostFundManagement.Application.Services.Users;
 
-public sealed class UserCacheService(UserService service, IDistributedCache cache, 
+public sealed class UserCacheService(UserService service, IDistributedCache cache,
     IFeatureManager featureManager) : ServiceCacheBase, IUserService
 {
+    public async Task<Result> AddUserClaimAsync(AddUserClaimRequest request, Guid userId, CancellationToken cancellationToken = default) =>
+        await service.AddUserClaimAsync(request, userId, cancellationToken);
+
+    public async Task<Result> AddUserRoleAsync(Guid targetUserId, string roleId, Guid userId, CancellationToken cancellationToken = default) =>
+        await service.AddUserRoleAsync(targetUserId, roleId, userId, cancellationToken);
+
+    public async Task<Result> CreateUserAsync(string tenantIdHash, string idNumberHash, CreateUserRequest request, Guid userId, CancellationToken cancellationToken = default) =>
+        await service.CreateUserAsync(tenantIdHash, idNumberHash, request, userId, cancellationToken);
+
+    public async Task<Result> DeleteUserClaimAsync(string claimIdHash, Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
+        await service.DeleteUserClaimAsync(claimIdHash, targetUserId, userId, cancellationToken);
+
+    public async Task<Result> DeleteUserRoleAsync(Guid targetUserId, string roleId, Guid userId, CancellationToken cancellationToken = default) =>
+        await service.DeleteUserRoleAsync(targetUserId, roleId, userId, cancellationToken);
+
+    public async Task<Result<Role[]>> GetSystemRolesAsync(Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result<Role[]>>>)(async () =>
+        {
+            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+                return await service.GetSystemRolesAsync(userId, cancellationToken);
+
+            var cacheKey = HashService.ToMd5Hash($"getsystemroles-{userId}").Value;
+
+            var cached = await cache.GetStringAsync(cacheKey, cancellationToken);
+
+            if (string.IsNullOrWhiteSpace(cached))
+            {
+                var rolesResult = await service.GetSystemRolesAsync(userId, cancellationToken);
+
+                if (rolesResult.IsFailed) return rolesResult;
+
+                await cache.SetStringAsync(cacheKey, rolesResult.Value.ToJson(),
+                    cacheOptions, cancellationToken);
+
+                return rolesResult;
+            }
+
+            return Result.Ok(cached.FromJson<Role[]>());
+        }));
+
     public async Task<Result<User>> GetUserAsync(Guid userId, CancellationToken cancellationToken) =>
         await Result.Try((Func<Task<Result<User>>>)(async () =>
         {
@@ -19,7 +61,7 @@ public sealed class UserCacheService(UserService service, IDistributedCache cach
 
             var cached = await cache.GetStringAsync(cacheKey, cancellationToken);
 
-            if(string.IsNullOrWhiteSpace(cached))
+            if (string.IsNullOrWhiteSpace(cached))
             {
                 var userResult = await service.GetUserAsync(userId, cancellationToken);
 
@@ -33,6 +75,56 @@ public sealed class UserCacheService(UserService service, IDistributedCache cach
             return Result.Ok(cached.FromJson<User>());
         }));
 
+    public async Task<Result<Claim[]>> GetUserClaimsAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result<Claim[]>>>)(async () =>
+        {
+            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+                return await service.GetUserClaimsAsync(targetUserId, userId, cancellationToken);
+
+            var cacheKey = HashService.ToMd5Hash($"getuserclaims-{userId}").Value;
+
+            var cached = await cache.GetStringAsync(cacheKey, cancellationToken);
+
+            if (string.IsNullOrWhiteSpace(cached))
+            {
+                var claimsResult = await service.GetUserClaimsAsync(targetUserId, userId, cancellationToken);
+
+                if (claimsResult.IsFailed) return claimsResult;
+
+                await cache.SetStringAsync(cacheKey, claimsResult.Value.ToJson(),
+                    cacheOptions, cancellationToken);
+
+                return claimsResult;
+            }
+
+            return Result.Ok(cached.FromJson<Claim[]>());
+        }));
+
+    public async Task<Result<Role[]>> GetUserRolesAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result<Role[]>>>)(async () =>
+        {
+            if (!await featureManager.IsEnabledAsync(ServiceCachingFeature))
+                return await service.GetUserRolesAsync(targetUserId, userId, cancellationToken);
+
+            var cacheKey = HashService.ToMd5Hash($"getuserroles-{userId}").Value;
+
+            var cached = await cache.GetStringAsync(cacheKey, cancellationToken);
+
+            if (string.IsNullOrWhiteSpace(cached))
+            {
+                var rolesResult = await service.GetUserRolesAsync(targetUserId, userId, cancellationToken);
+
+                if (rolesResult.IsFailed) return rolesResult;
+
+                await cache.SetStringAsync(cacheKey, rolesResult.Value.ToJson(),
+                    cacheOptions, cancellationToken);
+
+                return rolesResult;
+            }
+
+            return Result.Ok(cached.FromJson<Role[]>());
+        }));
+
     public async Task<Result<User[]>> GetUsersAsync(Pagination pagination, UserFilterRequest request, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<User[]>>>)(async () =>
         {
@@ -50,7 +142,7 @@ public sealed class UserCacheService(UserService service, IDistributedCache cach
 
                 if (usersResult.IsFailed) return usersResult;
 
-                await cache.SetStringAsync(cacheKey, usersResult.Value.ToJson(), 
+                await cache.SetStringAsync(cacheKey, usersResult.Value.ToJson(),
                     cacheOptions, cancellationToken);
 
                 return usersResult;
@@ -59,9 +151,15 @@ public sealed class UserCacheService(UserService service, IDistributedCache cach
             return Result.Ok(cached.FromJson<User[]>());
         }));
 
+    public async Task<Result> LogoutUserAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
+        await service.LogoutUserAsync(targetUserId, userId, cancellationToken);
+
+    public async Task<Result> SetUserLockoutAsync(Guid targetUserId, Guid userId, bool disable, CancellationToken cancellationToken = default) =>
+        await service.SetUserLockoutAsync(targetUserId, userId, disable, cancellationToken);
+
     public async Task<Result> SyncUserAsync(Guid userId, string email, string role, CancellationToken cancellationToken = default) =>
         await service.SyncUserAsync(userId, email, role, cancellationToken);
-        
+
     public async Task<Result> UpdateUserStatusAsync(Guid userId, ActivityStatus status, CancellationToken cancellationToken = default) =>
         await service.UpdateUserStatusAsync(userId, status, cancellationToken);
 }

PostFundManagement.Application/Services/Users/UserService.cs

@@ -1,14 +1,18 @@
 using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Services.Shared;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Models.Security;
 using PostFundManagement.Infrastructure.Database;
+using Claim = PostFundManagement.Domain.Models.Security.Claim;
 
 namespace PostFundManagement.Application.Services.Users;
 
-public sealed class UserService(IDbContextFactory<ApplicationDbContext> contextFactory, ITenantContextService tenantContext) : IUserService
+public sealed class UserService(IDbContextFactory<ApplicationDbContext> contextFactory, ITenantContextService tenantContext,
+    ISkorubaUserService skorubaService, HashService hashService) : IUserService
 {
     public async Task<Result> SyncUserAsync(Guid userId, string email, string role, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result>>)(async () =>
@@ -113,4 +117,208 @@ public sealed class UserService(IDbContextFactory<ApplicationDbContext> contextF
             return Result.FailIf(tenantUser == null, NotFoundError.Create("User not found."))
                 .ToResult(tenantUser!.User?.Map()!);
         }));
+
+    public async Task<Result> CreateUserAsync(string tenantIdHash, string idNumberHash, CreateUserRequest request, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result>>)(async () =>
+        {
+            var tenantIdHashDecode = hashService.DecodeLongIdHash(tenantIdHash);
+
+            if (tenantIdHashDecode.IsFailed)
+                return Result.Fail(IdDecodeError.Create()
+                    .CausedBy(tenantIdHashDecode.Errors));
+
+            var tenantId = tenantIdHashDecode.Value;
+
+            var idNumberHashDecode = await hashService.DecodeHexHash(idNumberHash);
+
+            if (idNumberHashDecode.IsFailed)
+                return Result.Fail(IdDecodeError.Create()
+                    .CausedBy(idNumberHashDecode.Errors));
+
+            var idNumber = idNumberHashDecode.Value.Trim();
+
+            var email = request.Email?.Trim().ToLowerInvariant();
+
+            if (string.IsNullOrWhiteSpace(email))
+                return Result.Fail(ValidationError.Create("Email is required."));
+
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            if (await context.Users.AnyAsync(u => u.Email == email, cancellationToken))
+                return Result.Fail(ValidationError.Create("User with this email already exists."));
+
+            var createUserResult = await skorubaService.CreateUserAsync(request, userId, cancellationToken);
+
+            if (createUserResult.IsFailed)
+                return Result.Fail(CreateError.Create("Failed to create user."));
+
+            var newUserId = Guid.Parse(createUserResult.Value.Trim());
+
+            var availableRolesResult = await skorubaService.GetAvailableRolesAsync(cancellationToken: cancellationToken);
+
+            if (availableRolesResult.IsFailed)
+                return Result.Fail(NotFoundError.Create("Failed to retrieve available roles."));
+
+            var defaultRole = availableRolesResult.Value.FirstOrDefault(r => r.Name == "Contributor");
+
+            if (defaultRole == null)
+                return Result.Fail(NotFoundError.Create("Role 'Contributor' not found."));
+
+            var roleAssignmentResult = await skorubaService.AddRoleAsync(newUserId, defaultRole.Id, cancellationToken);
+
+            if (roleAssignmentResult.IsFailed)
+                return Result.Fail(UpdateError.Create("Failed to assign role to user."));
+
+            var newUser = context.Users.Add(new Domain.Entities.User
+            {
+                Id = newUserId,
+                Email = email,
+                Status = ActivityStatus.Active,
+                LastLoginAt = DateTime.UtcNow,
+                IdNumber = idNumber,
+                Role = defaultRole.Name,
+            });
+
+            context.TenantUsers.Add(new Domain.Entities.TenantUser
+            {
+                CreatedAt = DateTime.UtcNow,
+                CreatedBy = userId,
+                Status = ActivityStatus.Active,
+                TenantId = tenantId,
+                UserId = newUserId,
+            });
+
+            return Result.OkIf(await context.SaveChangesAsync(cancellationToken) > 0, CreateError.Create("Failed to create user, contact support"));
+        }));
+
+    public async Task<Result> DeleteUserClaimAsync(string claimIdHash, Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result>>)(async () =>
+        {
+            var claimIdHashDecode = hashService.DecodeIntIdHash(claimIdHash);
+
+            if (claimIdHashDecode.IsFailed)
+                return Result.Fail(IdDecodeError.Create()
+                    .CausedBy(claimIdHashDecode.Errors));
+
+            var claimId = claimIdHashDecode.Value;
+
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            if (!await context.Users.AnyAsync(u => u.Id == targetUserId, cancellationToken))
+                return Result.Fail(NotFoundError.Create("User not found."));
+
+            var claimDeleteResult = await skorubaService.RemoveClaimAsync(targetUserId, claimId, cancellationToken);
+
+            return Result.OkIf(claimDeleteResult.IsSuccess, ValidationError.Create("Failed to delete user claim.")
+                .CausedBy(claimDeleteResult.Errors));
+        }));
+
+    public async Task<Result> SetUserLockoutAsync(Guid targetUserId, Guid userId, bool disable, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result>>)(async () =>
+        {
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            var lockoutResult = await skorubaService.SetUserLockoutAsync(targetUserId, disable, cancellationToken);
+
+            if(lockoutResult.IsFailed)
+                return Result.Fail(UpdateError.Create("Failed to set user lockout.")
+                    .CausedBy(lockoutResult.Errors));
+
+            var changedTotal = await context.Users.Where(f => f.Id == targetUserId)
+                .ExecuteUpdateAsync(f => f.SetProperty(u => u.Status, disable ? ActivityStatus.Disabled : ActivityStatus.Active), cancellationToken);
+
+            changedTotal += await context.TenantUsers.Where(f => f.UserId == targetUserId)
+                .ExecuteUpdateAsync(f => f.SetProperty(u => u.Status, disable ? ActivityStatus.Disabled : ActivityStatus.Active), cancellationToken);
+
+            return Result.OkIf(lockoutResult.IsSuccess && changedTotal > 0, ValidationError.Create("Failed to set user lockout.")
+                .CausedBy(lockoutResult.Errors));
+        }));
+
+    public async Task<Result> LogoutUserAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result>>)(async () =>
+        {
+            var logoutResult = await skorubaService.InvalidateUserSessionAsync(targetUserId, cancellationToken);
+
+            return Result.OkIf(logoutResult.IsSuccess, ValidationError.Create("Failed to logout user.")
+                .CausedBy(logoutResult.Errors));
+        }));
+
+    public async Task<Result<Role[]>> GetUserRolesAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result<Role[]>>>)(async () => 
+            await skorubaService.GetUserRolesAsync(targetUserId, cancellationToken: cancellationToken)));
+
+    public async Task<Result<Claim[]>> GetUserClaimsAsync(Guid targetUserId, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result<Claim[]>>>)(async () => 
+            await skorubaService.GetUserClaimsAsync(targetUserId, cancellationToken: cancellationToken)));
+
+    public async Task<Result<Role[]>> GetSystemRolesAsync(Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result<Role[]>>>)(async () => 
+            await skorubaService.GetAvailableRolesAsync(cancellationToken: cancellationToken)));
+
+    public async Task<Result> DeleteUserRoleAsync(Guid targetUserId, string roleId, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result>>)(async () =>
+        {
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            var changedTotal = await context.Users.Where(f => f.Id == targetUserId)
+                .ExecuteUpdateAsync(f => f.SetProperty(u => u.Role, string.Empty), cancellationToken);
+
+            var roleDeleteResult = await skorubaService.RemoveRoleAsync(targetUserId, roleId, cancellationToken);
+
+            return Result.OkIf(roleDeleteResult.IsSuccess && changedTotal > 0, ValidationError.Create("Failed to delete user role.")
+                .CausedBy(roleDeleteResult.Errors));
+        }));
+
+    public async Task<Result> AddUserClaimAsync(AddUserClaimRequest request, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result>>)(async () =>
+        {
+            var addClaimResult = await skorubaService.AddClaimAsync(request.UserId, request.ClaimType, request.ClaimValue, cancellationToken);
+
+            return Result.OkIf(addClaimResult.IsSuccess, ValidationError.Create("Failed to add user claim.")
+                .CausedBy(addClaimResult.Errors));
+        }));
+
+    public async Task<Result> AddUserRoleAsync(Guid targetUserId, string roleId, Guid userId, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<Task<Result>>)(async () =>
+        {
+            var userRolesResult = await skorubaService.GetUserRolesAsync(targetUserId, cancellationToken: cancellationToken);
+
+            if (userRolesResult.IsFailed)
+                return Result.Fail(NotFoundError.Create("Failed to retrieve user roles.")
+                    .CausedBy(userRolesResult.Errors));
+
+            foreach (var role in userRolesResult.Value)
+            {
+                var deleteRoleResult = await skorubaService.RemoveRoleAsync(targetUserId, role.Id, cancellationToken);
+
+                if (deleteRoleResult.IsFailed)
+                    return Result.Fail(UpdateError.Create("Failed to remove existing user role.")
+                        .CausedBy(deleteRoleResult.Errors));
+            }
+
+            var roleAddResult = await skorubaService.AddRoleAsync(targetUserId, roleId, cancellationToken);
+
+            if(roleAddResult.IsFailed)
+                return Result.Fail(UpdateError.Create("Failed to add user role.")
+                    .CausedBy(roleAddResult.Errors));
+
+            var systemRoles = await skorubaService.GetAvailableRolesAsync(cancellationToken: cancellationToken);
+
+            if (systemRoles.IsFailed)
+                return Result.Fail(NotFoundError.Create("Failed to retrieve system roles.")
+                    .CausedBy(systemRoles.Errors));
+
+            var targetRole = systemRoles.Value.FirstOrDefault(r => r.Id == roleId);
+
+            if (targetRole == null)
+                return Result.Fail(NotFoundError.Create("Role not found."));
+
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            var changedTotal = await context.Users.Where(f => f.Id == targetUserId)
+                .ExecuteUpdateAsync(f => f.SetProperty(u => u.Role, targetRole.Name), cancellationToken);
+
+            return Result.OkIf(roleAddResult.IsSuccess && changedTotal > 0, ValidationError.Create("Failed to add user role.")
+                .CausedBy(roleAddResult.Errors));
+        }));
 }

PostFundManagement.Domain/Abstractions/ISkorubaUserService.cs

@@ -7,7 +7,7 @@ public interface ISkorubaUserService
 {
     [Log]
     [Audit]
-    Task<Result<string>> CreateUserAsync(CreateUserRequest request, CancellationToken cancellationToken = default);
+    Task<Result<string>> CreateUserAsync(CreateUserRequest request, Guid userId, CancellationToken cancellationToken = default);
 
     [Log]
     Task<Result<UserResponse>> GetUserAsync(Guid userId, CancellationToken cancellationToken = default);
@@ -40,8 +40,11 @@ public interface ISkorubaUserService
     Task<Result<Role[]>> GetAvailableRolesAsync(string? searchText = null, int page = 1, int pageSize = 50, CancellationToken cancellationToken = default);
 
     [Log]
-    Task<Result<Role[]>> GetUserRolesAsync(string userId, int page = 1, int pageSize = 50, CancellationToken cancellationToken = default);
+    Task<Result<Role[]>> GetUserRolesAsync(Guid userId, int page = 1, int pageSize = 50, CancellationToken cancellationToken = default);
 
     [Log]
-    Task<Result<Models.Security.Claim[]>> GetUserClaimsAsync(string userId, int page = 1, int pageSize = 50, CancellationToken cancellationToken = default);
+    Task<Result<Models.Security.Claim[]>> GetUserClaimsAsync(Guid userId, int page = 1, int pageSize = 50, CancellationToken cancellationToken = default);
+
+    [Log]
+    Task<Result> InvalidateUserSessionAsync(Guid userId, CancellationToken cancellationToken = default);
 }

PostFundManagement.Domain/Models/Security/Contracts.cs

@@ -1,8 +1,15 @@
-namespace PostFundManagement.Domain.Models.Security;
+using System.ComponentModel.DataAnnotations;
+
+namespace PostFundManagement.Domain.Models.Security;
+
+public sealed record AddUserClaimRequest([Required] Guid UserId, 
+    [Required] int ClaimId, 
+    [Required][MaxLength(LabelLength)] string ClaimType, 
+    [Required][MaxLength(LabelLength)] string ClaimValue);
 
 public sealed record CreateUserRequest(string UserName, string Email, string Password, bool EmailConfirmed = true, string? PhoneNumber = null, bool PhoneNumberConfirmed = false);
 
-public sealed record UpdateUserRequest(string Id, string UserName, string Email, bool EmailConfirmed, string? PhoneNumber, bool PhoneNumberConfirmed, bool LockoutEnabled, DateTimeOffset? LockoutEnd, int AccessFailedCount, bool TwoFactorEnabled);
+public sealed record UpdateUserRequest(string UserId, string UserName, string Email, bool EmailConfirmed, string? PhoneNumber, bool PhoneNumberConfirmed, bool LockoutEnabled, DateTimeOffset? LockoutEnd, int AccessFailedCount, bool TwoFactorEnabled);
 
 public sealed record Claim(string ClaimType, string ClaimValue, int? ClaimId = null);
 

PostFundManagement.Infrastructure/Security/SkorubaUserService.cs

@@ -6,7 +6,7 @@ namespace PostFundManagement.Infrastructure.Security;
 
 public class SkorubaUserService([FromKeyedServices(SkorubaHttpClient)] IHttpClientFactory httpClientFactory) : ISkorubaUserService
 {
-    public async Task<Result<string>> CreateUserAsync(CreateUserRequest request, CancellationToken cancellationToken = default) =>
+    public async Task<Result<string>> CreateUserAsync(CreateUserRequest request, Guid userId, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<string>>>)(async () =>
         {
             var httpClient = httpClientFactory.CreateClient();
@@ -80,7 +80,7 @@ public class SkorubaUserService([FromKeyedServices(SkorubaHttpClient)] IHttpClie
             return Result.OkIf(response.IsSuccessStatusCode, CreateError.Create("Failed to remove user claim."));
         }));
 
-    public async Task<Result<Claim[]>> GetUserClaimsAsync(string userId, int page = 1, int pageSize = 50, CancellationToken cancellationToken = default) =>
+    public async Task<Result<Claim[]>> GetUserClaimsAsync(Guid userId, int page = 1, int pageSize = 50, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Claim[]>>>)(async () =>
         {
             var httpClient = httpClientFactory.CreateClient();
@@ -111,7 +111,7 @@ public class SkorubaUserService([FromKeyedServices(SkorubaHttpClient)] IHttpClie
             return Result.OkIf(response.IsSuccessStatusCode, CreateError.Create("Failed to remove user role."));
         }));
 
-    public async Task<Result<Role[]>> GetUserRolesAsync(string userId, int page = 1, int pageSize = 50, CancellationToken cancellationToken = default) =>
+    public async Task<Result<Role[]>> GetUserRolesAsync(Guid userId, int page = 1, int pageSize = 50, CancellationToken cancellationToken = default) =>
         await Result.Try((Func<Task<Result<Role[]>>>)(async () =>
         {
             var httpClient = httpClientFactory.CreateClient();