# RevokeRoleFromUser

## Permission Scope

roleAssignment

## Overview

RevokeRoleFromUser removes an association between a role and a user, revoking all permissions that the user had through that role. This command is used when a user changes positions, leaves a project, or no longer requires the access granted by the role.

The association must exist before it can be revoked.

## Business Rules

- User must exist in the system
- Role must exist in the system
- UserRole association must exist
- Removes the UserRole association record
- Generates ROLE_REVOKED audit event with actor ID, user ID, role ID, and timestamp

## Process Flow

```mermaid
flowchart TD
    A[Receive revoke request] --> B{User exists?}
    B -->|No| C[Return error: USER_NOT_FOUND]
    B -->|Yes| D{Role exists?}
    D -->|No| E[Return error: ROLE_NOT_FOUND]
    D -->|Yes| F{Assignment exists?}
    F -->|No| G[Return error: ASSIGNMENT_NOT_FOUND]
    F -->|Yes| H[Delete UserRole record]
    H --> I[Log ROLE_REVOKED audit event]
    I --> J[Return success]
```

## External Dependencies

- None

## Error Scenarios

- **USER_NOT_FOUND**: Specified user ID does not exist
- **ROLE_NOT_FOUND**: Specified role ID does not exist
- **ASSIGNMENT_NOT_FOUND**: User does not have this role assigned - return not found error indicating the association does not exist

## Test Cases

- throws when user does not exist
- throws when role does not exist
- throws when assignment does not exist
- deletes UserRole and recomputes permissions