Add role aware updates & endpoints

server/routers/role/addRoleAction.ts

@@ -0,0 +1,59 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roleActions, roles } from '@server/db/schema';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const addRoleActionSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive()),
+    actionId: z.string(),
+});
+
+export async function addRoleAction(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedBody = addRoleActionSchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedBody.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId, actionId } = parsedBody.data;
+
+        // Check if the user has permission to add role actions
+        const hasPermission = await checkUserActionPermission(ActionsEnum.addRoleAction, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        // Get the orgId for the role
+        const role = await db.select({ orgId: roles.orgId }).from(roles).where(eq(roles.roleId, roleId)).limit(1);
+        if (role.length === 0) {
+            return next(createHttpError(HttpCode.NOT_FOUND, `Role with ID ${roleId} not found`));
+        }
+
+        const newRoleAction = await db.insert(roleActions).values({
+            roleId,
+            actionId,
+            orgId: role[0].orgId,
+        }).returning();
+
+        return response(res, {
+            data: newRoleAction[0],
+            success: true,
+            error: false,
+            message: "Action added to role successfully",
+            status: HttpCode.CREATED,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/addRoleResource.ts

@@ -0,0 +1,52 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roleResources } from '@server/db/schema';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const addRoleResourceSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive()),
+    resourceId: z.string(),
+});
+
+export async function addRoleResource(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedBody = addRoleResourceSchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedBody.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId, resourceId } = parsedBody.data;
+
+        // Check if the user has permission to add role resources
+        const hasPermission = await checkUserActionPermission(ActionsEnum.addRoleResource, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const newRoleResource = await db.insert(roleResources).values({
+            roleId,
+            resourceId,
+        }).returning();
+
+        return response(res, {
+            data: newRoleResource[0],
+            success: true,
+            error: false,
+            message: "Resource added to role successfully",
+            status: HttpCode.CREATED,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/addRoleSite.ts

@@ -0,0 +1,79 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { resources, roleResources, roleSites } from '@server/db/schema';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+import { eq } from 'drizzle-orm';
+
+const addRoleSiteParamsSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive()),
+});
+
+const addRoleSiteSchema = z.object({
+    siteId: z.string().transform(Number).pipe(z.number().int().positive()),
+});
+
+export async function addRoleSite(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedBody = addRoleSiteSchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedBody.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { siteId } = parsedBody.data;
+
+        const parsedParams = addRoleSiteParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId } = parsedParams.data;
+
+        // Check if the user has permission to add role sites
+        const hasPermission = await checkUserActionPermission(ActionsEnum.addRoleSite, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const newRoleSite = await db.insert(roleSites).values({
+            roleId,
+            siteId,
+        }).returning();
+
+        const siteResources = await db.select()
+            .from(resources)
+            .where(eq(resources.siteId, siteId));
+
+        for (const resource of siteResources) {
+            await db.insert(roleResources).values({
+                roleId,
+                resourceId: resource.resourceId,
+            });
+        }
+
+        return response(res, {
+            data: newRoleSite[0],
+            success: true,
+            error: false,
+            message: "Site added to role successfully",
+            status: HttpCode.CREATED,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/createRole.ts

@@ -0,0 +1,68 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roles } from '@server/db/schema';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const createRoleParamsSchema = z.object({
+    orgId: z.number().int().positive()
+});
+
+const createRoleSchema = z.object({
+    name: z.string().min(1).max(255),
+    description: z.string().optional(),
+});
+
+export async function createRole(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedBody = createRoleSchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedBody.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const roleData = parsedBody.data;
+
+        const parsedParams = createRoleParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+
+        // Check if the user has permission to create roles
+        const hasPermission = await checkUserActionPermission(ActionsEnum.createRole, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const newRole = await db.insert(roles).values({
+            ...roleData,
+            orgId,
+        }).returning();
+
+        return response(res, {
+            data: newRole[0],
+            success: true,
+            error: false,
+            message: "Role created successfully",
+            status: HttpCode.CREATED,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/deleteRole.ts

@@ -0,0 +1,83 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roles } from '@server/db/schema';
+import { eq } from 'drizzle-orm';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const deleteRoleSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+export async function deleteRole(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = deleteRoleSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId } = parsedParams.data;
+
+        // Check if the user has permission to delete roles
+        const hasPermission = await checkUserActionPermission(ActionsEnum.deleteRole, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const role = await db.select()
+        .from(roles)
+        .where(eq(roles.roleId, roleId))
+        .limit(1);
+
+        if (role.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Role with ID ${roleId} not found`
+                )
+            );
+        }
+
+        if (role[0].isSuperuserRole) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    `Cannot delete a superuser role`
+                )
+            );
+        }
+
+        const deletedRole = await db.delete(roles)
+            .where(eq(roles.roleId, roleId))
+            .returning();
+
+        if (deletedRole.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Role with ID ${roleId} not found`
+                )
+            );
+        }
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Role deleted successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/getRole.ts

@@ -0,0 +1,61 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roles } from '@server/db/schema';
+import { eq } from 'drizzle-orm';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const getRoleSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+export async function getRole(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = getRoleSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId } = parsedParams.data;
+
+        // Check if the user has permission to get roles
+        const hasPermission = await checkUserActionPermission(ActionsEnum.getRole, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const role = await db.select()
+            .from(roles)
+            .where(eq(roles.roleId, roleId))
+            .limit(1);
+
+        if (role.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Role with ID ${roleId} not found`
+                )
+            );
+        }
+
+        return response(res, {
+            data: role[0],
+            success: true,
+            error: false,
+            message: "Role retrieved successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/index.ts

@@ -0,0 +1,15 @@
+export * from "./addRoleAction";
+export * from "./addRoleResource";
+export * from "./addRoleSite";
+export * from "./createRole";
+export * from "./deleteRole";
+export * from "./getRole";
+export * from "./index";
+export * from "./listRoleActions";
+export * from "./listRoleResources";
+export * from "./listRoles";
+export * from "./listRoleSites";
+export * from "./removeRoleAction";
+export * from "./removeRoleResource";
+export * from "./removeRoleSite";
+export * from "./updateRole";

server/routers/role/listRoleActions.ts

@@ -0,0 +1,59 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roleActions, actions } from '@server/db/schema';
+import { eq } from 'drizzle-orm';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const listRoleActionsSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive()),
+});
+
+export async function listRoleActions(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = listRoleActionsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId } = parsedParams.data;
+
+        // Check if the user has permission to list role actions
+        const hasPermission = await checkUserActionPermission(ActionsEnum.listRoleActions, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const roleActionsList = await db
+            .select({
+                actionId: actions.actionId,
+                name: actions.name,
+                description: actions.description,
+            })
+            .from(roleActions)
+            .innerJoin(actions, eq(roleActions.actionId, actions.actionId))
+            .where(eq(roleActions.roleId, roleId));
+
+            // TODO: Do we need to filter out what the user can see?
+
+        return response(res, {
+            data: roleActionsList,
+            success: true,
+            error: false,
+            message: "Role actions retrieved successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/listRoleResources.ts

@@ -0,0 +1,59 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roleResources, resources } from '@server/db/schema';
+import { eq } from 'drizzle-orm';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const listRoleResourcesSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive()),
+});
+
+export async function listRoleResources(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = listRoleResourcesSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId } = parsedParams.data;
+
+        // Check if the user has permission to list role resources
+        const hasPermission = await checkUserActionPermission(ActionsEnum.listRoleResources, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const roleResourcesList = await db
+            .select({
+                resourceId: resources.resourceId,
+                name: resources.name,
+                subdomain: resources.subdomain,
+            })
+            .from(roleResources)
+            .innerJoin(resources, eq(roleResources.resourceId, resources.resourceId))
+            .where(eq(roleResources.roleId, roleId));
+
+            // TODO: Do we need to filter out what the user can see?
+
+        return response(res, {
+            data: roleResourcesList,
+            success: true,
+            error: false,
+            message: "Role resources retrieved successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/listRoleSites.ts

@@ -0,0 +1,59 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roleSites, sites } from '@server/db/schema';
+import { eq } from 'drizzle-orm';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const listRoleSitesSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive()),
+});
+
+export async function listRoleSites(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = listRoleSitesSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId } = parsedParams.data;
+
+        // Check if the user has permission to list role sites
+        const hasPermission = await checkUserActionPermission(ActionsEnum.listRoleSites, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const roleSitesList = await db
+            .select({
+                siteId: sites.siteId,
+                name: sites.name,
+                subdomain: sites.subdomain,
+            })
+            .from(roleSites)
+            .innerJoin(sites, eq(roleSites.siteId, sites.siteId))
+            .where(eq(roleSites.roleId, roleId));
+
+            // TODO: Do we need to filter out what the user can see?
+
+        return response(res, {
+            data: roleSitesList,
+            success: true,
+            error: false,
+            message: "Role sites retrieved successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/listRoles.ts

@@ -0,0 +1,95 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roles, orgs } from '@server/db/schema';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { sql, eq } from 'drizzle-orm';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const listRolesParamsSchema = z.object({
+    orgId: z.string().optional().transform(Number).pipe(z.number().int().positive()),
+});
+
+const listRolesSchema = z.object({
+    limit: z.string().optional().transform(Number).pipe(z.number().int().positive().default(10)),
+    offset: z.string().optional().transform(Number).pipe(z.number().int().nonnegative().default(0)),
+    orgId: z.string().optional().transform(Number).pipe(z.number().int().positive()),
+});
+
+export async function listRoles(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedQuery = listRolesSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedQuery.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { limit, offset } = parsedQuery.data;
+
+        const parsedParams = listRolesParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+
+        // Check if the user has permission to list roles
+        const hasPermission = await checkUserActionPermission(ActionsEnum.listRoles, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        let baseQuery: any = db
+            .select({
+                roleId: roles.roleId,
+                orgId: roles.orgId,
+                isSuperuserRole: roles.isSuperuserRole,
+                name: roles.name,
+                description: roles.description,
+                orgName: orgs.name,
+            })
+            .from(roles)
+            .leftJoin(orgs, eq(roles.orgId, orgs.orgId));
+
+        let countQuery: any = db.select({ count: sql<number>`cast(count(*) as integer)` }).from(roles);
+
+        if (orgId) {
+            baseQuery = baseQuery.where(eq(roles.orgId, orgId));
+            countQuery = countQuery.where(eq(roles.orgId, orgId));
+        }
+
+        const rolesList = await baseQuery.limit(limit).offset(offset);
+        const totalCountResult = await countQuery;
+        const totalCount = totalCountResult[0].count;
+
+        return response(res, {
+            data: {
+                roles: rolesList,
+                pagination: {
+                    total: totalCount,
+                    limit,
+                    offset,
+                },
+            },
+            success: true,
+            error: false,
+            message: "Roles retrieved successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/removeRoleAction.ts

@@ -0,0 +1,76 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roleActions } from '@server/db/schema';
+import { and, eq } from 'drizzle-orm';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const removeRoleActionParamsSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive()),
+});
+
+const removeRoleActionSchema = z.object({
+    actionId: z.string(),
+});
+
+export async function removeRoleAction(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = removeRoleActionSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { actionId } = parsedParams.data;
+
+        const parsedBody = removeRoleActionParamsSchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedBody.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId } = parsedBody.data;
+
+        // Check if the user has permission to remove role actions
+        const hasPermission = await checkUserActionPermission(ActionsEnum.removeRoleAction, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const deletedRoleAction = await db.delete(roleActions)
+            .where(and(eq(roleActions.roleId, roleId), eq(roleActions.actionId, actionId)))
+            .returning();
+
+        if (deletedRoleAction.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Action with ID ${actionId} not found for role with ID ${roleId}`
+                )
+            );
+        }
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Action removed from role successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/removeRoleResource.ts

@@ -0,0 +1,61 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roleResources } from '@server/db/schema';
+import { and, eq } from 'drizzle-orm';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const removeRoleResourceSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive()),
+    resourceId: z.string(),
+});
+
+export async function removeRoleResource(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = removeRoleResourceSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId, resourceId } = parsedParams.data;
+
+        // Check if the user has permission to remove role resources
+        const hasPermission = await checkUserActionPermission(ActionsEnum.removeRoleResource, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const deletedRoleResource = await db.delete(roleResources)
+            .where(and(eq(roleResources.roleId, roleId), eq(roleResources.resourceId, resourceId)))
+            .returning();
+
+        if (deletedRoleResource.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found for role with ID ${roleId}`
+                )
+            );
+        }
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Resource removed from role successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/removeRoleSite.ts

@@ -0,0 +1,86 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { resources, roleResources, roleSites } from '@server/db/schema';
+import { and, eq } from 'drizzle-orm';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const removeRoleSiteParamsSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive()),
+});
+
+const removeRoleSiteSchema = z.object({
+    siteId: z.string().transform(Number).pipe(z.number().int().positive()),
+});
+
+export async function removeRoleSite(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = removeRoleSiteSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { siteId } = parsedParams.data;
+
+        const parsedBody = removeRoleSiteParamsSchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedBody.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId } = parsedBody.data;
+
+        // Check if the user has permission to remove role sites
+        const hasPermission = await checkUserActionPermission(ActionsEnum.removeRoleSite, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const deletedRoleSite = await db.delete(roleSites)
+            .where(and(eq(roleSites.roleId, roleId), eq(roleSites.siteId, siteId)))
+            .returning();
+
+        if (deletedRoleSite.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Site with ID ${siteId} not found for role with ID ${roleId}`
+                )
+            );
+        }
+
+        const siteResources = await db.select()
+        .from(resources)
+        .where(eq(resources.siteId, siteId));
+
+        for (const resource of siteResources) {
+            await db.delete(roleResources)
+                .where(and(eq(roleResources.roleId, roleId), eq(roleResources.resourceId, resource.resourceId)))
+                .returning();
+        }
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Site removed from role successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}

server/routers/role/updateRole.ts

@@ -0,0 +1,102 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { db } from '@server/db';
+import { roles } from '@server/db/schema';
+import { eq } from 'drizzle-orm';
+import response from "@server/utils/response";
+import HttpCode from '@server/types/HttpCode';
+import createHttpError from 'http-errors';
+import { ActionsEnum, checkUserActionPermission } from '@server/auth/actions';
+import logger from '@server/logger';
+
+const updateRoleParamsSchema = z.object({
+    roleId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+const updateRoleBodySchema = z.object({
+    name: z.string().min(1).max(255).optional(),
+    description: z.string().optional(),
+}).refine(data => Object.keys(data).length > 0, {
+    message: "At least one field must be provided for update"
+});
+
+export async function updateRole(req: Request, res: Response, next: NextFunction): Promise<any> {
+    try {
+        const parsedParams = updateRoleParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const parsedBody = updateRoleBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedBody.error.errors.map(e => e.message).join(', ')
+                )
+            );
+        }
+
+        const { roleId } = parsedParams.data;
+        const updateData = parsedBody.data;
+
+        // Check if the user has permission to update roles
+        const hasPermission = await checkUserActionPermission(ActionsEnum.updateRole, req);
+        if (!hasPermission) {
+            return next(createHttpError(HttpCode.FORBIDDEN, 'User does not have permission to perform this action'));
+        }
+
+        const role = await db.select()
+        .from(roles)
+        .where(eq(roles.roleId, roleId))
+        .limit(1);
+
+        if (role.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Role with ID ${roleId} not found`
+                )
+            );
+        }
+
+        if (role[0].isSuperuserRole) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    `Cannot update a superuser role`
+                )
+            );
+        }
+
+        const updatedRole = await db.update(roles)
+            .set(updateData)
+            .where(eq(roles.roleId, roleId))
+            .returning();
+
+        if (updatedRole.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Role with ID ${roleId} not found`
+                )
+            );
+        }
+
+        return response(res, {
+            data: updatedRole[0],
+            success: true,
+            error: false,
+            message: "Role updated successfully",
+            status: HttpCode.OK,
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred..."));
+    }
+}