# ListUserRolesByUser

## Overview

ListUserRolesByUser retrieves all roles assigned to a specific user. This query supports the permission check flow in RBAC, where the system first resolves a user's roles, then resolves the permissions attached to those roles to determine whether the user has a required permission.

## Business Rules

- Accepts a userId as input
- Returns all Role records associated with the user via UserRole join records
- Returns an empty array when the user has no role assignments — not an error
- The user must exist; a non-existent userId returns an error

## Process Flow

```mermaid
flowchart TD
    A[Receive userId] --> B{User exists?}
    B -->|No| C[Return error: USER_NOT_FOUND]
    B -->|Yes| D[SELECT roles via UserRole where userId = input]
    D --> E{Any roles found?}
    E -->|Yes| F[Return role records]
    E -->|No| G[Return empty array]
```

## External Dependencies

- None

## Error Scenarios

- **USER_NOT_FOUND**: Specified user ID does not exist

## Test Cases

- returns all roles assigned to user
- returns empty array when user has no roles
- returns error when userId does not exist
- returns multiple roles when user has multiple role assignments