Enhance user role management functionality and implement role-related methods

- Added role field lists to DefaultUser and DefaultUserOptions for better role configuration.
- Implemented methods for creating, retrieving, updating, and deleting user roles, improving role management capabilities.
- Enhanced error handling for role operations, ensuring robust feedback for failures.
- Introduced ClearUserRole method to remove role assignments from users, streamlining user-role management.
- Updated tests to ensure proper cleanup of role data and maintain a clean testing environment.

openapi/oauth/providers/user/default.go

@@ -76,6 +76,20 @@ var (
 		"website", "gender", "birthdate", "zoneinfo", "locale", "phone_number", "phone_number_verified",
 		"address", "raw", "last_login_at", "is_active", "created_at", "updated_at",
 	}
+
+	// DefaultRoleFields contains basic role fields
+	DefaultRoleFields = []interface{}{
+		"id", "role_id", "name", "description", "is_active", "is_default", "is_system",
+		"level", "sort_order", "color", "icon", "created_at", "updated_at",
+	}
+
+	// DefaultRoleDetailFields contains all role fields including permissions and metadata
+	DefaultRoleDetailFields = []interface{}{
+		"id", "role_id", "name", "description", "permissions", "restricted_permissions",
+		"parent_role_id", "level", "is_active", "is_default", "is_system", "sort_order",
+		"color", "icon", "max_users", "requires_approval", "auto_revoke_days",
+		"metadata", "conditions", "created_at", "updated_at",
+	}
 )
 
 // DefaultUser provides a default implementation of UserProvider
@@ -100,6 +114,10 @@ type DefaultUser struct {
 	// OAuth Account Field lists
 	oauthAccountFields       []interface{} // configurable
 	oauthAccountDetailFields []interface{} // configurable
+
+	// Role Field lists
+	roleFields       []interface{} // configurable
+	roleDetailFields []interface{} // configurable
 }
 
 // IDStrategy defines the strategy for generating user IDs
@@ -132,6 +150,10 @@ type DefaultUserOptions struct {
 	// OAuth Account field lists (use defaults if not specified)
 	OAuthAccountFields       []interface{} // basic OAuth account fields
 	OAuthAccountDetailFields []interface{} // detailed OAuth account fields with OIDC claims
+
+	// Role field lists (use defaults if not specified)
+	RoleFields       []interface{} // basic role fields
+	RoleDetailFields []interface{} // detailed role fields including permissions and metadata
 }
 
 // NewDefaultUser creates a new DefaultUser
@@ -188,6 +210,17 @@ func NewDefaultUser(options *DefaultUserOptions) *DefaultUser {
 		oauthAccountDetailFields = DefaultOAuthAccountDetailFields
 	}
 
+	// Set role field lists with defaults if not specified
+	roleFields := options.RoleFields
+	if roleFields == nil {
+		roleFields = DefaultRoleFields
+	}
+
+	roleDetailFields := options.RoleDetailFields
+	if roleDetailFields == nil {
+		roleDetailFields = DefaultRoleDetailFields
+	}
+
 	return &DefaultUser{
 		prefix:            options.Prefix,
 		model:             model,
@@ -205,5 +238,9 @@ func NewDefaultUser(options *DefaultUserOptions) *DefaultUser {
 		// OAuth Account field lists
 		oauthAccountFields:       oauthAccountFields,
 		oauthAccountDetailFields: oauthAccountDetailFields,
+
+		// Role field lists
+		roleFields:       roleFields,
+		roleDetailFields: roleDetailFields,
 	}
 }

openapi/oauth/providers/user/role.go

@@ -2,6 +2,7 @@ package user
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/yaoapp/gou/model"
 	"github.com/yaoapp/kun/maps"
@@ -11,60 +12,324 @@ import (
 
 // GetRole retrieves role information by role_id
 func (u *DefaultUser) GetRole(ctx context.Context, roleID string) (maps.MapStrAny, error) {
-	// TODO: implement
-	return nil, nil
+	m := model.Select(u.roleModel)
+	roles, err := m.Get(model.QueryParam{
+		Select: u.roleFields,
+		Wheres: []model.QueryWhere{
+			{Column: "role_id", Value: roleID},
+		},
+		Limit: 1,
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf(ErrFailedToGetRole, err)
+	}
+
+	if len(roles) == 0 {
+		return nil, fmt.Errorf(ErrRoleNotFound)
+	}
+
+	return roles[0], nil
 }
 
 // CreateRole creates a new user role
 func (u *DefaultUser) CreateRole(ctx context.Context, roleData maps.MapStrAny) (interface{}, error) {
-	// TODO: implement - role_id should be provided in roleData
-	return nil, nil
+	// Validate required role_id field
+	if _, exists := roleData["role_id"]; !exists {
+		return nil, fmt.Errorf("role_id is required in roleData")
+	}
+
+	// Set default values if not provided
+	if _, exists := roleData["is_active"]; !exists {
+		roleData["is_active"] = true
+	}
+	if _, exists := roleData["is_default"]; !exists {
+		roleData["is_default"] = false
+	}
+	if _, exists := roleData["is_system"]; !exists {
+		roleData["is_system"] = false
+	}
+	if _, exists := roleData["level"]; !exists {
+		roleData["level"] = 0
+	}
+	if _, exists := roleData["sort_order"]; !exists {
+		roleData["sort_order"] = 0
+	}
+
+	m := model.Select(u.roleModel)
+	id, err := m.Create(roleData)
+	if err != nil {
+		return nil, fmt.Errorf(ErrFailedToCreateRole, err)
+	}
+
+	return id, nil
 }
 
 // UpdateRole updates an existing role
 func (u *DefaultUser) UpdateRole(ctx context.Context, roleID string, roleData maps.MapStrAny) error {
-	// TODO: implement
+	// Remove sensitive fields that should not be updated directly
+	sensitiveFields := []string{"id", "role_id", "created_at"}
+	for _, field := range sensitiveFields {
+		delete(roleData, field)
+	}
+
+	// Skip update if no valid fields remain
+	if len(roleData) == 0 {
+		return nil
+	}
+
+	m := model.Select(u.roleModel)
+	affected, err := m.UpdateWhere(model.QueryParam{
+		Wheres: []model.QueryWhere{
+			{Column: "role_id", Value: roleID},
+		},
+		Limit: 1, // Safety: ensure only one record is updated
+	}, roleData)
+
+	if err != nil {
+		return fmt.Errorf(ErrFailedToUpdateRole, err)
+	}
+
+	if affected == 0 {
+		return fmt.Errorf(ErrRoleNotFound)
+	}
+
 	return nil
 }
 
 // DeleteRole soft deletes a role (if not system role)
 func (u *DefaultUser) DeleteRole(ctx context.Context, roleID string) error {
-	// TODO: implement
+	// First check if role exists and is not a system role
+	m := model.Select(u.roleModel)
+	roles, err := m.Get(model.QueryParam{
+		Select: []interface{}{"id", "role_id", "is_system"},
+		Wheres: []model.QueryWhere{
+			{Column: "role_id", Value: roleID},
+		},
+		Limit: 1,
+	})
+
+	if err != nil {
+		return fmt.Errorf(ErrFailedToGetRole, err)
+	}
+
+	if len(roles) == 0 {
+		return fmt.Errorf(ErrRoleNotFound)
+	}
+
+	role := roles[0]
+	// Check if this is a system role
+	if isSystem, ok := role["is_system"].(bool); ok && isSystem {
+		return fmt.Errorf("cannot delete system role: %s", roleID)
+	}
+	// Handle different boolean types from database
+	if isSystemInt, ok := role["is_system"].(int64); ok && isSystemInt != 0 {
+		return fmt.Errorf("cannot delete system role: %s", roleID)
+	}
+
+	// Proceed with soft delete
+	affected, err := m.DeleteWhere(model.QueryParam{
+		Wheres: []model.QueryWhere{
+			{Column: "role_id", Value: roleID},
+		},
+		Limit: 1, // Safety: ensure only one record is deleted
+	})
+
+	if err != nil {
+		return fmt.Errorf(ErrFailedToDeleteRole, err)
+	}
+
+	if affected == 0 {
+		return fmt.Errorf(ErrRoleNotFound)
+	}
+
 	return nil
 }
 
 // GetRoles retrieves roles by query parameters
 func (u *DefaultUser) GetRoles(ctx context.Context, param model.QueryParam) ([]maps.MapStr, error) {
-	// TODO: implement
-	return nil, nil
+	// Set default select fields if not provided
+	if param.Select == nil {
+		param.Select = u.roleFields
+	}
+
+	m := model.Select(u.roleModel)
+	roles, err := m.Get(param)
+	if err != nil {
+		return nil, fmt.Errorf(ErrFailedToGetRole, err)
+	}
+
+	return roles, nil
 }
 
 // PaginateRoles retrieves paginated list of roles
 func (u *DefaultUser) PaginateRoles(ctx context.Context, param model.QueryParam, page int, pagesize int) (maps.MapStr, error) {
-	// TODO: implement
-	return nil, nil
+	// Set default select fields if not provided
+	if param.Select == nil {
+		param.Select = u.roleFields
+	}
+
+	m := model.Select(u.roleModel)
+	result, err := m.Paginate(param, page, pagesize)
+	if err != nil {
+		return nil, fmt.Errorf(ErrFailedToGetRole, err)
+	}
+
+	return result, nil
 }
 
 // CountRoles returns total count of roles with optional filters
 func (u *DefaultUser) CountRoles(ctx context.Context, param model.QueryParam) (int64, error) {
-	// TODO: implement
-	return 0, nil
+	// Use Paginate with a small page size to get the total count
+	// This is more reliable than manual COUNT(*) queries
+	m := model.Select(u.roleModel)
+	result, err := m.Paginate(param, 1, 1) // Get first page with 1 item to get total
+	if err != nil {
+		return 0, fmt.Errorf(ErrFailedToGetRole, err)
+	}
+
+	// Extract total from pagination result
+	if total, ok := result["total"].(int64); ok {
+		return total, nil
+	}
+
+	// Handle different total types returned by Paginate
+	if totalInterface, ok := result["total"]; ok {
+		switch v := totalInterface.(type) {
+		case int:
+			return int64(v), nil
+		case int32:
+			return int64(v), nil
+		case int64:
+			return v, nil
+		case uint:
+			return int64(v), nil
+		case uint32:
+			return int64(v), nil
+		case uint64:
+			return int64(v), nil
+		default:
+			return 0, fmt.Errorf("unexpected total type: %T", totalInterface)
+		}
+	}
+
+	return 0, fmt.Errorf("total not found in pagination result")
 }
 
 // GetRolePermissions retrieves permissions for a role
 func (u *DefaultUser) GetRolePermissions(ctx context.Context, roleID string) (maps.MapStrAny, error) {
-	// TODO: implement
-	return nil, nil
+	m := model.Select(u.roleModel)
+	roles, err := m.Get(model.QueryParam{
+		Select: []interface{}{"role_id", "permissions", "restricted_permissions"},
+		Wheres: []model.QueryWhere{
+			{Column: "role_id", Value: roleID},
+		},
+		Limit: 1,
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf(ErrFailedToGetRole, err)
+	}
+
+	if len(roles) == 0 {
+		return nil, fmt.Errorf(ErrRoleNotFound)
+	}
+
+	role := roles[0]
+	permissions := maps.MapStrAny{
+		"role_id":                roleID,
+		"permissions":            role["permissions"],
+		"restricted_permissions": role["restricted_permissions"],
+	}
+
+	return permissions, nil
 }
 
 // SetRolePermissions sets permissions for a role
 func (u *DefaultUser) SetRolePermissions(ctx context.Context, roleID string, permissions maps.MapStrAny) error {
-	// TODO: implement
+	// Prepare update data - only allow permission-related fields
+	updateData := maps.MapStrAny{}
+
+	if perms, ok := permissions["permissions"]; ok {
+		updateData["permissions"] = perms
+	}
+
+	if restrictedPerms, ok := permissions["restricted_permissions"]; ok {
+		updateData["restricted_permissions"] = restrictedPerms
+	}
+
+	// Skip update if no permission fields provided
+	if len(updateData) == 0 {
+		return nil
+	}
+
+	m := model.Select(u.roleModel)
+	affected, err := m.UpdateWhere(model.QueryParam{
+		Wheres: []model.QueryWhere{
+			{Column: "role_id", Value: roleID},
+		},
+		Limit: 1, // Safety: ensure only one record is updated
+	}, updateData)
+
+	if err != nil {
+		return fmt.Errorf(ErrFailedToUpdateRole, err)
+	}
+
+	if affected == 0 {
+		return fmt.Errorf(ErrRoleNotFound)
+	}
+
 	return nil
 }
 
 // ValidateRolePermissions validates if role has specific permissions
 func (u *DefaultUser) ValidateRolePermissions(ctx context.Context, roleID string, requiredPermissions []string) (bool, error) {
-	// TODO: implement
-	return false, nil
+	if len(requiredPermissions) == 0 {
+		return true, nil // No permissions required
+	}
+
+	// Get role permissions
+	rolePermissions, err := u.GetRolePermissions(ctx, roleID)
+	if err != nil {
+		return false, err
+	}
+
+	// Extract permissions and restricted permissions
+	permissions, _ := rolePermissions["permissions"].(map[string]interface{})
+	restrictedPermissions, _ := rolePermissions["restricted_permissions"].([]interface{})
+
+	// Convert restricted permissions to map for faster lookup
+	restrictedMap := make(map[string]bool)
+	for _, perm := range restrictedPermissions {
+		if permStr, ok := perm.(string); ok {
+			restrictedMap[permStr] = true
+		}
+	}
+
+	// Check each required permission
+	for _, requiredPerm := range requiredPermissions {
+		// First check if permission is explicitly restricted
+		if restrictedMap[requiredPerm] {
+			return false, nil // Permission is explicitly denied
+		}
+
+		// Check if permission exists in granted permissions
+		if permissions == nil {
+			return false, nil // No permissions granted
+		}
+
+		// Look for the permission in the permissions object
+		// This is a simple implementation - in practice, you might want more sophisticated permission matching
+		permValue, exists := permissions[requiredPerm]
+		if !exists {
+			return false, nil // Permission not found
+		}
+
+		// Check if permission is enabled (assuming boolean values)
+		if permBool, ok := permValue.(bool); ok && !permBool {
+			return false, nil // Permission exists but is disabled
+		}
+	}
+
+	return true, nil // All required permissions are valid
 }

openapi/oauth/providers/user/role_test.go

@@ -0,0 +1,737 @@
+package user_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/yaoapp/gou/model"
+	"github.com/yaoapp/kun/maps"
+)
+
+// TestRoleData represents test role data structure
+type TestRoleData struct {
+	RoleID      string                 `json:"role_id"`
+	Name        string                 `json:"name"`
+	Description string                 `json:"description"`
+	IsActive    bool                   `json:"is_active"`
+	IsDefault   bool                   `json:"is_default"`
+	IsSystem    bool                   `json:"is_system"`
+	Level       int                    `json:"level"`
+	SortOrder   int                    `json:"sort_order"`
+	Color       string                 `json:"color"`
+	Icon        string                 `json:"icon"`
+	Permissions map[string]interface{} `json:"permissions"`
+	Metadata    map[string]interface{} `json:"metadata"`
+}
+
+func TestRoleBasicOperations(t *testing.T) {
+	prepare(t)
+	defer clean()
+
+	ctx := context.Background()
+
+	// Use UUID to ensure unique identifiers
+	testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8] // 8 char UUID
+
+	// Create test role data dynamically
+	testRole := &TestRoleData{
+		RoleID:      "testrole_" + testUUID,
+		Name:        "Test Role " + testUUID,
+		Description: "Test role for unit testing " + testUUID,
+		IsActive:    true,
+		IsDefault:   false,
+		IsSystem:    false,
+		Level:       10,
+		SortOrder:   100,
+		Color:       "#007bff",
+		Icon:        "test-icon",
+		Permissions: map[string]interface{}{
+			"read":   true,
+			"write":  true,
+			"delete": false,
+		},
+		Metadata: map[string]interface{}{
+			"source": "test",
+			"uuid":   testUUID,
+		},
+	}
+
+	// Test CreateRole
+	t.Run("CreateRole", func(t *testing.T) {
+		roleData := maps.MapStrAny{
+			"role_id":     testRole.RoleID,
+			"name":        testRole.Name,
+			"description": testRole.Description,
+			"level":       testRole.Level,
+			"sort_order":  testRole.SortOrder,
+			"color":       testRole.Color,
+			"icon":        testRole.Icon,
+			"permissions": testRole.Permissions,
+			"metadata":    testRole.Metadata,
+		}
+
+		id, err := testProvider.CreateRole(ctx, roleData)
+		assert.NoError(t, err)
+		assert.NotNil(t, id)
+
+		// Verify default values were set
+		assert.Equal(t, true, roleData["is_active"])
+		assert.Equal(t, false, roleData["is_default"])
+		assert.Equal(t, false, roleData["is_system"])
+		// level should remain as provided (10), not be overridden
+	})
+
+	// Test GetRole
+	t.Run("GetRole", func(t *testing.T) {
+		role, err := testProvider.GetRole(ctx, testRole.RoleID)
+		assert.NoError(t, err)
+		assert.NotNil(t, role)
+
+		// Verify key fields
+		assert.Equal(t, testRole.RoleID, role["role_id"])
+		assert.Equal(t, testRole.Name, role["name"])
+		assert.Equal(t, testRole.Description, role["description"])
+		assert.Equal(t, testRole.Color, role["color"])
+		assert.Equal(t, testRole.Icon, role["icon"])
+
+		// Handle different boolean representations from database
+		isActive := role["is_active"]
+		switch v := isActive.(type) {
+		case bool:
+			assert.True(t, v)
+		case int, int32, int64:
+			assert.NotEqual(t, 0, v) // Any non-zero value is true
+		default:
+			t.Errorf("unexpected is_active type: %T, value: %v", isActive, isActive)
+		}
+
+		assert.NotNil(t, role["created_at"])
+	})
+
+	// Test UpdateRole
+	t.Run("UpdateRole", func(t *testing.T) {
+		updateData := maps.MapStrAny{
+			"name":        "Updated Test Role",
+			"description": "Updated description for testing",
+			"color":       "#28a745",
+			"icon":        "updated-icon",
+			"level":       20,
+			"metadata": map[string]interface{}{
+				"updated": true,
+				"version": 2,
+			},
+		}
+
+		err := testProvider.UpdateRole(ctx, testRole.RoleID, updateData)
+		assert.NoError(t, err)
+
+		// Verify update
+		role, err := testProvider.GetRole(ctx, testRole.RoleID)
+		assert.NoError(t, err)
+		assert.Equal(t, "Updated Test Role", role["name"])
+		assert.Equal(t, "Updated description for testing", role["description"])
+		assert.Equal(t, "#28a745", role["color"])
+		assert.Equal(t, "updated-icon", role["icon"])
+
+		// Test updating sensitive fields (should be ignored)
+		sensitiveData := maps.MapStrAny{
+			"id":         999,
+			"role_id":    "malicious_role_id",
+			"created_at": "2020-01-01T00:00:00Z",
+		}
+
+		err = testProvider.UpdateRole(ctx, testRole.RoleID, sensitiveData)
+		assert.NoError(t, err) // Should not error, just ignore sensitive fields
+
+		// Verify sensitive fields were not changed
+		role, err = testProvider.GetRole(ctx, testRole.RoleID)
+		assert.NoError(t, err)
+		assert.Equal(t, testRole.RoleID, role["role_id"]) // Should remain unchanged
+	})
+
+	// Create a system role for delete test
+	t.Run("CreateSystemRole", func(t *testing.T) {
+		systemRoleData := maps.MapStrAny{
+			"role_id":     "systemrole_" + testUUID,
+			"name":        "System Role " + testUUID,
+			"description": "System role for delete testing",
+			"is_system":   true,
+		}
+
+		id, err := testProvider.CreateRole(ctx, systemRoleData)
+		assert.NoError(t, err)
+		assert.NotNil(t, id)
+	})
+
+	// Test DeleteRole - System Role Protection
+	t.Run("DeleteRole_SystemRoleProtection", func(t *testing.T) {
+		systemRoleID := "systemrole_" + testUUID
+		err := testProvider.DeleteRole(ctx, systemRoleID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "cannot delete system role")
+
+		// Verify system role still exists
+		role, err := testProvider.GetRole(ctx, systemRoleID)
+		assert.NoError(t, err)
+		assert.NotNil(t, role)
+	})
+
+	// Test DeleteRole - Normal Role (at the end)
+	t.Run("DeleteRole", func(t *testing.T) {
+		err := testProvider.DeleteRole(ctx, testRole.RoleID)
+		assert.NoError(t, err)
+
+		// Verify role was deleted
+		_, err = testProvider.GetRole(ctx, testRole.RoleID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "role not found")
+	})
+}
+
+func TestRolePermissionOperations(t *testing.T) {
+	prepare(t)
+	defer clean()
+
+	ctx := context.Background()
+
+	// Use UUID to ensure unique identifiers
+	testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
+
+	// Create a role for permission testing
+	testRole := &TestRoleData{
+		RoleID:      "permrole_" + testUUID,
+		Name:        "Permission Test Role " + testUUID,
+		Description: "Role for testing permissions",
+		IsActive:    true,
+		Permissions: map[string]interface{}{
+			"users.read":   true,
+			"users.write":  true,
+			"users.delete": false,
+			"admin.access": true,
+		},
+	}
+
+	// Create role
+	roleData := maps.MapStrAny{
+		"role_id":     testRole.RoleID,
+		"name":        testRole.Name,
+		"description": testRole.Description,
+		"permissions": testRole.Permissions,
+		"restricted_permissions": []string{
+			"system.config",
+			"root.access",
+		},
+	}
+
+	_, err := testProvider.CreateRole(ctx, roleData)
+	assert.NoError(t, err)
+
+	// Test GetRolePermissions
+	t.Run("GetRolePermissions", func(t *testing.T) {
+		permissions, err := testProvider.GetRolePermissions(ctx, testRole.RoleID)
+		assert.NoError(t, err)
+		assert.NotNil(t, permissions)
+
+		assert.Equal(t, testRole.RoleID, permissions["role_id"])
+		assert.NotNil(t, permissions["permissions"])
+		assert.NotNil(t, permissions["restricted_permissions"])
+
+		// Verify permissions structure
+		permsMap, ok := permissions["permissions"].(map[string]interface{})
+		if ok {
+			assert.Equal(t, true, permsMap["users.read"])
+			assert.Equal(t, true, permsMap["users.write"])
+			assert.Equal(t, false, permsMap["users.delete"])
+		}
+	})
+
+	// Test SetRolePermissions
+	t.Run("SetRolePermissions", func(t *testing.T) {
+		newPermissions := maps.MapStrAny{
+			"permissions": map[string]interface{}{
+				"users.read":   true,
+				"users.write":  false, // Changed
+				"users.delete": true,  // Changed
+				"posts.read":   true,  // New
+			},
+			"restricted_permissions": []string{
+				"system.config",
+				"dangerous.operation", // New restriction
+			},
+		}
+
+		err := testProvider.SetRolePermissions(ctx, testRole.RoleID, newPermissions)
+		assert.NoError(t, err)
+
+		// Verify permissions were updated
+		permissions, err := testProvider.GetRolePermissions(ctx, testRole.RoleID)
+		assert.NoError(t, err)
+
+		permsMap, ok := permissions["permissions"].(map[string]interface{})
+		if ok {
+			assert.Equal(t, true, permsMap["users.read"])
+			assert.Equal(t, false, permsMap["users.write"]) // Should be updated
+			assert.Equal(t, true, permsMap["users.delete"]) // Should be updated
+			assert.Equal(t, true, permsMap["posts.read"])   // Should be new
+		}
+	})
+
+	// Test ValidateRolePermissions
+	t.Run("ValidateRolePermissions_ValidPermissions", func(t *testing.T) {
+		requiredPermissions := []string{"users.read", "posts.read"}
+		valid, err := testProvider.ValidateRolePermissions(ctx, testRole.RoleID, requiredPermissions)
+		assert.NoError(t, err)
+		assert.True(t, valid)
+	})
+
+	t.Run("ValidateRolePermissions_InvalidPermissions", func(t *testing.T) {
+		requiredPermissions := []string{"users.write"} // This was set to false
+		valid, err := testProvider.ValidateRolePermissions(ctx, testRole.RoleID, requiredPermissions)
+		assert.NoError(t, err)
+		assert.False(t, valid) // Should be false because users.write is disabled
+	})
+
+	t.Run("ValidateRolePermissions_RestrictedPermissions", func(t *testing.T) {
+		requiredPermissions := []string{"system.config"} // This is in restricted list
+		valid, err := testProvider.ValidateRolePermissions(ctx, testRole.RoleID, requiredPermissions)
+		assert.NoError(t, err)
+		assert.False(t, valid) // Should be false because it's restricted
+	})
+
+	t.Run("ValidateRolePermissions_EmptyRequirements", func(t *testing.T) {
+		requiredPermissions := []string{}
+		valid, err := testProvider.ValidateRolePermissions(ctx, testRole.RoleID, requiredPermissions)
+		assert.NoError(t, err)
+		assert.True(t, valid) // Should be true when no permissions required
+	})
+
+	t.Run("ValidateRolePermissions_NonExistentPermission", func(t *testing.T) {
+		requiredPermissions := []string{"nonexistent.permission"}
+		valid, err := testProvider.ValidateRolePermissions(ctx, testRole.RoleID, requiredPermissions)
+		assert.NoError(t, err)
+		assert.False(t, valid) // Should be false for nonexistent permissions
+	})
+}
+
+func TestRoleListOperations(t *testing.T) {
+	prepare(t)
+	defer clean()
+
+	ctx := context.Background()
+
+	// Create multiple test roles for list operations
+	// Use UUID to ensure unique identifiers
+	testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
+
+	testRoles := []TestRoleData{
+		{
+			RoleID:      "listrole_" + testUUID + "_1",
+			Name:        "List Role 1",
+			Description: "First role for list testing",
+			IsActive:    true,
+			Level:       10,
+		},
+		{
+			RoleID:      "listrole_" + testUUID + "_2",
+			Name:        "List Role 2",
+			Description: "Second role for list testing",
+			IsActive:    true,
+			Level:       20,
+		},
+		{
+			RoleID:      "listrole_" + testUUID + "_3",
+			Name:        "List Role 3",
+			Description: "Third role for list testing",
+			IsActive:    false, // Different status for filtering
+			Level:       30,
+		},
+		{
+			RoleID:      "listrole_" + testUUID + "_4",
+			Name:        "List Role 4",
+			Description: "Fourth role for list testing",
+			IsActive:    true,
+			Level:       40,
+		},
+		{
+			RoleID:      "listrole_" + testUUID + "_5",
+			Name:        "List Role 5",
+			Description: "Fifth role for list testing",
+			IsActive:    true,
+			Level:       50,
+		},
+	}
+
+	// Create roles in database
+	for _, roleData := range testRoles {
+		roleMap := maps.MapStrAny{
+			"role_id":     roleData.RoleID,
+			"name":        roleData.Name,
+			"description": roleData.Description,
+			"is_active":   roleData.IsActive,
+			"level":       roleData.Level,
+		}
+
+		_, err := testProvider.CreateRole(ctx, roleMap)
+		assert.NoError(t, err)
+	}
+
+	// Test GetRoles
+	t.Run("GetRoles_All", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", OP: "like", Value: "listrole_" + testUUID + "_%"},
+			},
+		}
+		roles, err := testProvider.GetRoles(ctx, param)
+		assert.NoError(t, err)
+		assert.GreaterOrEqual(t, len(roles), 5) // At least our 5 test roles
+
+		// Check that basic fields are returned by default
+		if len(roles) > 0 {
+			role := roles[0]
+			assert.Contains(t, role, "role_id")
+			assert.Contains(t, role, "name")
+			assert.Contains(t, role, "description")
+			assert.Contains(t, role, "is_active")
+		}
+	})
+
+	t.Run("GetRoles_WithFilters", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", OP: "like", Value: "listrole_" + testUUID + "_%"},
+				{Column: "is_active", Value: true},
+			},
+		}
+		roles, err := testProvider.GetRoles(ctx, param)
+		assert.NoError(t, err)
+		assert.GreaterOrEqual(t, len(roles), 4) // At least 4 active roles
+
+		// All returned roles should be active
+		for _, role := range roles {
+			if strings.Contains(role["role_id"].(string), "listrole_"+testUUID+"_") {
+				// Handle different boolean representations from database
+				isActive := role["is_active"]
+				switch v := isActive.(type) {
+				case bool:
+					assert.True(t, v)
+				case int, int32, int64:
+					assert.NotEqual(t, 0, v) // Any non-zero value is true
+				default:
+					t.Errorf("unexpected is_active type: %T, value: %v", isActive, isActive)
+				}
+			}
+		}
+	})
+
+	t.Run("GetRoles_WithCustomFields", func(t *testing.T) {
+		param := model.QueryParam{
+			Select: []interface{}{"role_id", "name", "is_active", "level"},
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", OP: "like", Value: "listrole_" + testUUID + "_%"},
+			},
+			Limit: 3,
+		}
+		roles, err := testProvider.GetRoles(ctx, param)
+		assert.NoError(t, err)
+		assert.LessOrEqual(t, len(roles), 3) // Respects limit
+
+		if len(roles) > 0 {
+			role := roles[0]
+			assert.Contains(t, role, "role_id")
+			assert.Contains(t, role, "name")
+			assert.Contains(t, role, "is_active")
+			assert.Contains(t, role, "level")
+		}
+	})
+
+	// Test PaginateRoles
+	t.Run("PaginateRoles_FirstPage", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", OP: "like", Value: "listrole_" + testUUID + "_%"},
+			},
+			Orders: []model.QueryOrder{
+				{Column: "level", Option: "asc"},
+			},
+		}
+		result, err := testProvider.PaginateRoles(ctx, param, 1, 3)
+		assert.NoError(t, err)
+		assert.NotNil(t, result)
+
+		// Check pagination structure
+		assert.Contains(t, result, "data")
+		assert.Contains(t, result, "total")
+		assert.Contains(t, result, "page")
+		assert.Contains(t, result, "pagesize")
+
+		data, ok := result["data"].([]maps.MapStr)
+		assert.True(t, ok)
+		assert.LessOrEqual(t, len(data), 3) // Page size limit
+
+		// Handle different total types
+		totalInterface, exists := result["total"]
+		assert.True(t, exists)
+
+		var total int64
+		switch v := totalInterface.(type) {
+		case int:
+			total = int64(v)
+		case int32:
+			total = int64(v)
+		case int64:
+			total = v
+		case uint:
+			total = int64(v)
+		case uint32:
+			total = int64(v)
+		case uint64:
+			total = int64(v)
+		default:
+			t.Errorf("unexpected total type: %T, value: %v", totalInterface, totalInterface)
+		}
+		assert.GreaterOrEqual(t, total, int64(5)) // At least 5 roles
+
+		assert.Equal(t, 1, result["page"])
+		assert.Equal(t, 3, result["pagesize"])
+	})
+
+	t.Run("PaginateRoles_WithFilters", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", OP: "like", Value: "listrole_" + testUUID + "_%"},
+				{Column: "is_active", Value: true},
+			},
+		}
+		result, err := testProvider.PaginateRoles(ctx, param, 1, 10)
+		assert.NoError(t, err)
+		assert.NotNil(t, result)
+
+		data, ok := result["data"].([]maps.MapStr)
+		assert.True(t, ok)
+		assert.GreaterOrEqual(t, len(data), 4) // At least 4 active roles
+
+		// Verify is_active filter works
+		for _, role := range data {
+			if strings.Contains(role["role_id"].(string), "listrole_"+testUUID+"_") {
+				// Handle different boolean representations from database
+				isActive := role["is_active"]
+				switch v := isActive.(type) {
+				case bool:
+					assert.True(t, v)
+				case int, int32, int64:
+					assert.NotEqual(t, 0, v) // Any non-zero value is true
+				default:
+					t.Errorf("unexpected is_active type: %T, value: %v", isActive, isActive)
+				}
+			}
+		}
+	})
+
+	// Test CountRoles
+	t.Run("CountRoles_All", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", OP: "like", Value: "listrole_" + testUUID + "_%"},
+			},
+		}
+		count, err := testProvider.CountRoles(ctx, param)
+		assert.NoError(t, err)
+		assert.GreaterOrEqual(t, count, int64(5)) // At least 5 roles
+	})
+
+	t.Run("CountRoles_WithFilters", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", OP: "like", Value: "listrole_" + testUUID + "_%"},
+				{Column: "is_active", Value: true},
+			},
+		}
+		count, err := testProvider.CountRoles(ctx, param)
+		assert.NoError(t, err)
+		assert.GreaterOrEqual(t, count, int64(4)) // At least 4 active roles
+	})
+
+	t.Run("CountRoles_SpecificLevel", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", OP: "like", Value: "listrole_" + testUUID + "_%"},
+				{Column: "level", OP: ">=", Value: 30},
+			},
+		}
+		count, err := testProvider.CountRoles(ctx, param)
+		assert.NoError(t, err)
+		// We created 3 roles with level >= 30 (30, 40, 50), but be flexible with database state
+		assert.GreaterOrEqual(t, count, int64(1)) // At least 1 role with level >= 30
+		assert.LessOrEqual(t, count, int64(5))    // But not more than 5 (our total test roles)
+	})
+
+	t.Run("CountRoles_NoResults", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", Value: "nonexistent_role_id"},
+			},
+		}
+		count, err := testProvider.CountRoles(ctx, param)
+		assert.NoError(t, err)
+		assert.Equal(t, int64(0), count)
+	})
+}
+
+func TestRoleErrorHandling(t *testing.T) {
+	prepare(t)
+	defer clean()
+
+	ctx := context.Background()
+	testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
+	nonExistentRoleID := "nonexistent_role_" + testUUID
+
+	t.Run("GetRole_NotFound", func(t *testing.T) {
+		_, err := testProvider.GetRole(ctx, nonExistentRoleID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "role not found")
+	})
+
+	t.Run("CreateRole_MissingRoleID", func(t *testing.T) {
+		roleData := maps.MapStrAny{
+			"name":        "Test Role",
+			"description": "Role without role_id",
+		}
+
+		_, err := testProvider.CreateRole(ctx, roleData)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "role_id is required")
+	})
+
+	t.Run("UpdateRole_NotFound", func(t *testing.T) {
+		updateData := maps.MapStrAny{"name": "Test"}
+		err := testProvider.UpdateRole(ctx, nonExistentRoleID, updateData)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "role not found")
+	})
+
+	t.Run("DeleteRole_NotFound", func(t *testing.T) {
+		err := testProvider.DeleteRole(ctx, nonExistentRoleID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "role not found")
+	})
+
+	t.Run("GetRolePermissions_NotFound", func(t *testing.T) {
+		_, err := testProvider.GetRolePermissions(ctx, nonExistentRoleID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "role not found")
+	})
+
+	t.Run("SetRolePermissions_NotFound", func(t *testing.T) {
+		permissions := maps.MapStrAny{
+			"permissions": map[string]interface{}{"test": true},
+		}
+		err := testProvider.SetRolePermissions(ctx, nonExistentRoleID, permissions)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "role not found")
+	})
+
+	t.Run("ValidateRolePermissions_NotFound", func(t *testing.T) {
+		requiredPermissions := []string{"test.permission"}
+		_, err := testProvider.ValidateRolePermissions(ctx, nonExistentRoleID, requiredPermissions)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "role not found")
+	})
+
+	t.Run("GetRoles_EmptyResult", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", Value: nonExistentRoleID},
+			},
+		}
+		roles, err := testProvider.GetRoles(ctx, param)
+		assert.NoError(t, err)
+		assert.Equal(t, 0, len(roles)) // Empty slice, not nil
+	})
+
+	t.Run("PaginateRoles_EmptyResult", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", Value: nonExistentRoleID},
+			},
+		}
+		result, err := testProvider.PaginateRoles(ctx, param, 1, 10)
+		assert.NoError(t, err)
+		assert.NotNil(t, result)
+
+		data, ok := result["data"].([]maps.MapStr)
+		assert.True(t, ok)
+		assert.Equal(t, 0, len(data))
+
+		// Handle different total types
+		totalInterface, exists := result["total"]
+		assert.True(t, exists)
+
+		var total int64
+		switch v := totalInterface.(type) {
+		case int:
+			total = int64(v)
+		case int32:
+			total = int64(v)
+		case int64:
+			total = v
+		case uint:
+			total = int64(v)
+		case uint32:
+			total = int64(v)
+		case uint64:
+			total = int64(v)
+		default:
+			t.Errorf("unexpected total type: %T, value: %v", totalInterface, totalInterface)
+		}
+		assert.Equal(t, int64(0), total)
+	})
+
+	t.Run("UpdateRole_EmptyData", func(t *testing.T) {
+		// First create a role for this test
+		testRoleID := "emptyupdate_" + testUUID
+		roleData := maps.MapStrAny{
+			"role_id": testRoleID,
+			"name":    "Test Role for Empty Update",
+		}
+		_, err := testProvider.CreateRole(ctx, roleData)
+		assert.NoError(t, err)
+
+		// Test with empty update data (should not error, just do nothing)
+		emptyData := maps.MapStrAny{}
+		err = testProvider.UpdateRole(ctx, testRoleID, emptyData)
+		assert.NoError(t, err) // Should not error, just skip update
+	})
+
+	t.Run("SetRolePermissions_EmptyData", func(t *testing.T) {
+		// First create a role for this test
+		testRoleID := "emptyperm_" + testUUID
+		roleData := maps.MapStrAny{
+			"role_id": testRoleID,
+			"name":    "Test Role for Empty Permissions",
+		}
+		_, err := testProvider.CreateRole(ctx, roleData)
+		assert.NoError(t, err)
+
+		// Test with empty permission data (should not error, just do nothing)
+		emptyData := maps.MapStrAny{}
+		err = testProvider.SetRolePermissions(ctx, testRoleID, emptyData)
+		assert.NoError(t, err) // Should not error, just skip update
+	})
+
+	t.Run("CountRoles_ComplexFilters", func(t *testing.T) {
+		param := model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "is_active", Value: true},
+				{Column: "level", OP: ">=", Value: 10},
+				{Column: "is_system", Value: false},
+			},
+		}
+		count, err := testProvider.CountRoles(ctx, param)
+		assert.NoError(t, err)
+		assert.GreaterOrEqual(t, count, int64(0)) // Should handle complex filters without error
+	})
+}

openapi/oauth/providers/user/user_role_type.go

@@ -2,7 +2,9 @@ package user
 
 import (
 	"context"
+	"fmt"
 
+	"github.com/yaoapp/gou/model"
 	"github.com/yaoapp/kun/maps"
 )
 
@@ -10,13 +12,142 @@ import (
 
 // GetUserRole retrieves user's role information
 func (u *DefaultUser) GetUserRole(ctx context.Context, userID string) (maps.MapStrAny, error) {
-	// TODO: implement
-	return nil, nil
+	// First get the user's role_id
+	userModel := model.Select(u.model)
+	users, err := userModel.Get(model.QueryParam{
+		Select: []interface{}{"user_id", "role_id"},
+		Wheres: []model.QueryWhere{
+			{Column: "user_id", Value: userID},
+		},
+		Limit: 1,
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf(ErrFailedToGetUser, err)
+	}
+
+	if len(users) == 0 {
+		return nil, fmt.Errorf(ErrUserNotFound)
+	}
+
+	user := users[0]
+	roleID, ok := user["role_id"].(string)
+	if !ok || roleID == "" {
+		return nil, fmt.Errorf("user %s has no role assigned", userID)
+	}
+
+	// Now get the full role information
+	roleModel := model.Select(u.roleModel)
+	roles, err := roleModel.Get(model.QueryParam{
+		Select: u.roleFields,
+		Wheres: []model.QueryWhere{
+			{Column: "role_id", Value: roleID},
+		},
+		Limit: 1,
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf(ErrFailedToGetRole, err)
+	}
+
+	if len(roles) == 0 {
+		return nil, fmt.Errorf(ErrRoleNotFound)
+	}
+
+	return roles[0], nil
 }
 
 // SetUserRole assigns a role to a user
 func (u *DefaultUser) SetUserRole(ctx context.Context, userID string, roleID string) error {
-	// TODO: implement
+	// First validate that the role exists
+	roleModel := model.Select(u.roleModel)
+	roles, err := roleModel.Get(model.QueryParam{
+		Select: []interface{}{"role_id", "is_active"},
+		Wheres: []model.QueryWhere{
+			{Column: "role_id", Value: roleID},
+		},
+		Limit: 1,
+	})
+
+	if err != nil {
+		return fmt.Errorf(ErrFailedToGetRole, err)
+	}
+
+	if len(roles) == 0 {
+		return fmt.Errorf(ErrRoleNotFound)
+	}
+
+	// Check if role is active
+	role := roles[0]
+	if isActive, ok := role["is_active"].(bool); ok && !isActive {
+		return fmt.Errorf("cannot assign inactive role: %s", roleID)
+	}
+	// Handle different boolean types from database
+	if isActiveInt, ok := role["is_active"].(int64); ok && isActiveInt == 0 {
+		return fmt.Errorf("cannot assign inactive role: %s", roleID)
+	}
+
+	// Update user's role_id
+	updateData := maps.MapStrAny{
+		"role_id": roleID,
+	}
+
+	userModel := model.Select(u.model)
+	affected, err := userModel.UpdateWhere(model.QueryParam{
+		Wheres: []model.QueryWhere{
+			{Column: "user_id", Value: userID},
+		},
+		Limit: 1, // Safety: ensure only one record is updated
+	}, updateData)
+
+	if err != nil {
+		return fmt.Errorf(ErrFailedToUpdateUser, err)
+	}
+
+	if affected == 0 {
+		return fmt.Errorf(ErrUserNotFound)
+	}
+
+	return nil
+}
+
+// ClearUserRole removes role assignment from a user (sets role_id to null)
+func (u *DefaultUser) ClearUserRole(ctx context.Context, userID string) error {
+	// First check if user exists
+	userModel := model.Select(u.model)
+	users, err := userModel.Get(model.QueryParam{
+		Select: []interface{}{"user_id"},
+		Wheres: []model.QueryWhere{
+			{Column: "user_id", Value: userID},
+		},
+		Limit: 1,
+	})
+
+	if err != nil {
+		return fmt.Errorf(ErrFailedToGetUser, err)
+	}
+
+	if len(users) == 0 {
+		return fmt.Errorf(ErrUserNotFound)
+	}
+
+	// Update role_id to null (even if it's already null, this should succeed)
+	updateData := maps.MapStrAny{
+		"role_id": nil, // Set role_id to null to clear role assignment
+	}
+
+	_, err = userModel.UpdateWhere(model.QueryParam{
+		Wheres: []model.QueryWhere{
+			{Column: "user_id", Value: userID},
+		},
+		Limit: 1, // Safety: ensure only one record is updated
+	}, updateData)
+
+	if err != nil {
+		return fmt.Errorf(ErrFailedToUpdateUser, err)
+	}
+
+	// Don't check affected rows - setting null to null is still a successful operation
 	return nil
 }
 

openapi/oauth/providers/user/user_role_type_test.go

@@ -0,0 +1,455 @@
+package user_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/yaoapp/kun/maps"
+)
+
+func TestUserRoleOperations(t *testing.T) {
+	prepare(t)
+	defer clean()
+
+	ctx := context.Background()
+
+	// Use UUID to ensure unique identifiers
+	testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8] // 8 char UUID
+
+	// Step 1: Create a test user first
+	testUser := createTestUserData("roleuser" + testUUID)
+	_, testUserID := setupTestUser(t, ctx, testUser)
+
+	// Step 2: Create test roles for assignment
+	testRoles := []maps.MapStrAny{
+		{
+			"role_id":     "adminrole_" + testUUID,
+			"name":        "Admin Role " + testUUID,
+			"description": "Administrator role for testing",
+			"is_active":   true,
+			"level":       100,
+		},
+		{
+			"role_id":     "userrole_" + testUUID,
+			"name":        "User Role " + testUUID,
+			"description": "Regular user role for testing",
+			"is_active":   true,
+			"level":       10,
+		},
+		{
+			"role_id":     "inactiverole_" + testUUID,
+			"name":        "Inactive Role " + testUUID,
+			"description": "Inactive role for testing",
+			"is_active":   false,
+			"level":       0,
+		},
+	}
+
+	// Create roles in database
+	for _, roleData := range testRoles {
+		_, err := testProvider.CreateRole(ctx, roleData)
+		assert.NoError(t, err)
+	}
+
+	adminRoleID := "adminrole_" + testUUID
+	userRoleID := "userrole_" + testUUID
+	inactiveRoleID := "inactiverole_" + testUUID
+
+	// Test SetUserRole
+	t.Run("SetUserRole", func(t *testing.T) {
+		err := testProvider.SetUserRole(ctx, testUserID, adminRoleID)
+		assert.NoError(t, err)
+
+		// Verify role was assigned by getting user info
+		user, err := testProvider.GetUser(ctx, testUserID)
+		assert.NoError(t, err)
+		assert.Equal(t, adminRoleID, user["role_id"])
+	})
+
+	// Test GetUserRole
+	t.Run("GetUserRole", func(t *testing.T) {
+		role, err := testProvider.GetUserRole(ctx, testUserID)
+		assert.NoError(t, err)
+		assert.NotNil(t, role)
+
+		// Verify we got the correct role information
+		assert.Equal(t, adminRoleID, role["role_id"])
+		assert.Equal(t, "Admin Role "+testUUID, role["name"])
+		assert.Equal(t, "Administrator role for testing", role["description"])
+
+		// Handle different boolean representations from database
+		isActive := role["is_active"]
+		switch v := isActive.(type) {
+		case bool:
+			assert.True(t, v)
+		case int, int32, int64:
+			assert.NotEqual(t, 0, v) // Any non-zero value is true
+		default:
+			t.Errorf("unexpected is_active type: %T, value: %v", isActive, isActive)
+		}
+	})
+
+	// Test SetUserRole - Change to different role
+	t.Run("SetUserRole_ChangeRole", func(t *testing.T) {
+		err := testProvider.SetUserRole(ctx, testUserID, userRoleID)
+		assert.NoError(t, err)
+
+		// Verify role was changed
+		role, err := testProvider.GetUserRole(ctx, testUserID)
+		assert.NoError(t, err)
+		assert.Equal(t, userRoleID, role["role_id"])
+		assert.Equal(t, "User Role "+testUUID, role["name"])
+	})
+
+	// Test SetUserRole - Inactive Role (should fail)
+	t.Run("SetUserRole_InactiveRole", func(t *testing.T) {
+		err := testProvider.SetUserRole(ctx, testUserID, inactiveRoleID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "cannot assign inactive role")
+
+		// Verify role was not changed
+		role, err := testProvider.GetUserRole(ctx, testUserID)
+		assert.NoError(t, err)
+		assert.Equal(t, userRoleID, role["role_id"]) // Should still be the previous role
+	})
+
+	// Test ClearUserRole
+	t.Run("ClearUserRole", func(t *testing.T) {
+		err := testProvider.ClearUserRole(ctx, testUserID)
+		assert.NoError(t, err)
+
+		// Verify role was cleared
+		user, err := testProvider.GetUser(ctx, testUserID)
+		assert.NoError(t, err)
+		assert.Nil(t, user["role_id"]) // Should be null/nil
+
+		// GetUserRole should now fail
+		_, err = testProvider.GetUserRole(ctx, testUserID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "has no role assigned")
+	})
+
+	// Test SetUserRole again after clearing
+	t.Run("SetUserRole_AfterClear", func(t *testing.T) {
+		err := testProvider.SetUserRole(ctx, testUserID, adminRoleID)
+		assert.NoError(t, err)
+
+		// Verify role was assigned again
+		role, err := testProvider.GetUserRole(ctx, testUserID)
+		assert.NoError(t, err)
+		assert.Equal(t, adminRoleID, role["role_id"])
+	})
+}
+
+func TestUserTypeOperations(t *testing.T) {
+	prepare(t)
+	defer clean()
+
+	ctx := context.Background()
+
+	// Use UUID to ensure unique identifiers
+	testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
+
+	// Step 1: Create a test user first
+	testUser := createTestUserData("typeuser" + testUUID)
+	_, testUserID := setupTestUser(t, ctx, testUser)
+
+	// Note: User type operations are not yet implemented
+	// These tests are placeholders for future implementation
+
+	// Test GetUserType (should return not implemented or similar)
+	t.Run("GetUserType_NotImplemented", func(t *testing.T) {
+		_, err := testProvider.GetUserType(ctx, testUserID)
+		// Since implementation returns nil, nil - we expect no error but nil result
+		// In a real implementation, this might return an error or the actual type
+		assert.NoError(t, err) // Based on current TODO implementation
+	})
+
+	// Test SetUserType (should return not implemented or similar)
+	t.Run("SetUserType_NotImplemented", func(t *testing.T) {
+		err := testProvider.SetUserType(ctx, testUserID, "premium")
+		// Since implementation returns nil - we expect no error
+		// In a real implementation, this might return an error or actually set the type
+		assert.NoError(t, err) // Based on current TODO implementation
+	})
+}
+
+func TestValidateUserScope(t *testing.T) {
+	prepare(t)
+	defer clean()
+
+	ctx := context.Background()
+
+	// Use UUID to ensure unique identifiers
+	testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
+
+	// Create a test user
+	testUser := createTestUserData("scopeuser" + testUUID)
+	_, testUserID := setupTestUser(t, ctx, testUser)
+
+	// Note: ValidateUserScope is not yet implemented
+	// This test is a placeholder for future implementation
+
+	t.Run("ValidateUserScope_NotImplemented", func(t *testing.T) {
+		scopes := []string{"read", "write", "admin"}
+		valid, err := testProvider.ValidateUserScope(ctx, testUserID, scopes)
+
+		// Since implementation returns false, nil - we expect no error but false result
+		// In a real implementation, this would validate user's scopes based on role and type
+		assert.NoError(t, err) // Based on current TODO implementation
+		assert.False(t, valid) // Based on current TODO implementation
+	})
+}
+
+func TestUserRoleErrorHandling(t *testing.T) {
+	prepare(t)
+	defer clean()
+
+	ctx := context.Background()
+
+	// Use UUID to avoid conflicts
+	testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
+	nonExistentUserID := "nonexistent_user_" + testUUID
+	nonExistentRoleID := "nonexistent_role_" + testUUID
+
+	// Create a valid user for some tests
+	testUser := createTestUserData("erroruser" + testUUID)
+	_, validUserID := setupTestUser(t, ctx, testUser)
+
+	// Create a valid role for some tests
+	validRoleData := maps.MapStrAny{
+		"role_id":     "validrole_" + testUUID,
+		"name":        "Valid Role " + testUUID,
+		"description": "Valid role for error testing",
+		"is_active":   true,
+	}
+	_, err := testProvider.CreateRole(ctx, validRoleData)
+	assert.NoError(t, err)
+	validRoleID := "validrole_" + testUUID
+
+	t.Run("GetUserRole_UserNotFound", func(t *testing.T) {
+		_, err := testProvider.GetUserRole(ctx, nonExistentUserID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "user not found")
+	})
+
+	t.Run("GetUserRole_NoRoleAssigned", func(t *testing.T) {
+		// Create a user without a role assignment
+		userWithoutRole := createTestUserData("noroleuser" + testUUID)
+		_, userWithoutRoleID := setupTestUser(t, ctx, userWithoutRole)
+
+		// Clear any default role that might have been set
+		err := testProvider.ClearUserRole(ctx, userWithoutRoleID)
+		assert.NoError(t, err)
+
+		_, err = testProvider.GetUserRole(ctx, userWithoutRoleID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "has no role assigned")
+	})
+
+	t.Run("SetUserRole_UserNotFound", func(t *testing.T) {
+		err := testProvider.SetUserRole(ctx, nonExistentUserID, validRoleID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "user not found")
+	})
+
+	t.Run("SetUserRole_RoleNotFound", func(t *testing.T) {
+		err := testProvider.SetUserRole(ctx, validUserID, nonExistentRoleID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "role not found")
+	})
+
+	t.Run("ClearUserRole_UserNotFound", func(t *testing.T) {
+		err := testProvider.ClearUserRole(ctx, nonExistentUserID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "user not found")
+	})
+
+	t.Run("ClearUserRole_NoRoleTooClear", func(t *testing.T) {
+		// Create a user without a role assignment
+		userWithoutRole := createTestUserData("clearnouser" + testUUID)
+		_, userWithoutRoleID := setupTestUser(t, ctx, userWithoutRole)
+
+		// Clear any default role that might have been set
+		err := testProvider.ClearUserRole(ctx, userWithoutRoleID)
+		assert.NoError(t, err) // Should succeed even if no role was assigned
+
+		// Try to clear again (should still succeed)
+		err = testProvider.ClearUserRole(ctx, userWithoutRoleID)
+		assert.NoError(t, err) // Should not error even if no role exists
+	})
+
+	// Test user type error handling (placeholders for future implementation)
+	t.Run("GetUserType_UserNotFound", func(t *testing.T) {
+		_, err := testProvider.GetUserType(ctx, nonExistentUserID)
+		// Since implementation returns nil, nil - we expect no error
+		// In a real implementation, this should return an error
+		assert.NoError(t, err) // Based on current TODO implementation
+	})
+
+	t.Run("SetUserType_UserNotFound", func(t *testing.T) {
+		err := testProvider.SetUserType(ctx, nonExistentUserID, "premium")
+		// Since implementation returns nil - we expect no error
+		// In a real implementation, this should return an error
+		assert.NoError(t, err) // Based on current TODO implementation
+	})
+
+	// Test scope validation error handling (placeholder for future implementation)
+	t.Run("ValidateUserScope_UserNotFound", func(t *testing.T) {
+		scopes := []string{"read", "write"}
+		valid, err := testProvider.ValidateUserScope(ctx, nonExistentUserID, scopes)
+
+		// Since implementation returns false, nil - we expect no error but false result
+		// In a real implementation, this should return an error
+		assert.NoError(t, err) // Based on current TODO implementation
+		assert.False(t, valid) // Based on current TODO implementation
+	})
+}
+
+func TestUserRoleIntegration(t *testing.T) {
+	prepare(t)
+	defer clean()
+
+	ctx := context.Background()
+
+	// Use UUID to ensure unique identifiers
+	testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
+
+	// Create multiple users and roles for integration testing
+	users := make([]string, 3)
+	for i := 0; i < 3; i++ {
+		userData := createTestUserData("integuser" + testUUID + string('0'+rune(i)))
+		_, userID := setupTestUser(t, ctx, userData)
+		users[i] = userID
+	}
+
+	roles := []string{
+		"adminrole_" + testUUID,
+		"userrole_" + testUUID,
+		"guestrole_" + testUUID,
+	}
+
+	roleData := []maps.MapStrAny{
+		{
+			"role_id":     roles[0],
+			"name":        "Admin Role " + testUUID,
+			"description": "Administrator role",
+			"is_active":   true,
+			"level":       100,
+		},
+		{
+			"role_id":     roles[1],
+			"name":        "User Role " + testUUID,
+			"description": "Regular user role",
+			"is_active":   true,
+			"level":       10,
+		},
+		{
+			"role_id":     roles[2],
+			"name":        "Guest Role " + testUUID,
+			"description": "Guest user role",
+			"is_active":   true,
+			"level":       1,
+		},
+	}
+
+	// Create roles
+	for _, role := range roleData {
+		_, err := testProvider.CreateRole(ctx, role)
+		assert.NoError(t, err)
+	}
+
+	t.Run("CompleteUserRoleFlow", func(t *testing.T) {
+		userID := users[0]
+
+		// Step 1: Assign admin role
+		err := testProvider.SetUserRole(ctx, userID, roles[0])
+		assert.NoError(t, err)
+
+		// Step 2: Verify role assignment
+		role, err := testProvider.GetUserRole(ctx, userID)
+		assert.NoError(t, err)
+		assert.Equal(t, roles[0], role["role_id"])
+		assert.Equal(t, "Admin Role "+testUUID, role["name"])
+
+		// Step 3: Change to user role
+		err = testProvider.SetUserRole(ctx, userID, roles[1])
+		assert.NoError(t, err)
+
+		role, err = testProvider.GetUserRole(ctx, userID)
+		assert.NoError(t, err)
+		assert.Equal(t, roles[1], role["role_id"])
+
+		// Step 4: Clear role
+		err = testProvider.ClearUserRole(ctx, userID)
+		assert.NoError(t, err)
+
+		// Step 5: Verify role was cleared
+		_, err = testProvider.GetUserRole(ctx, userID)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "has no role assigned")
+
+		// Step 6: Reassign role
+		err = testProvider.SetUserRole(ctx, userID, roles[2])
+		assert.NoError(t, err)
+
+		role, err = testProvider.GetUserRole(ctx, userID)
+		assert.NoError(t, err)
+		assert.Equal(t, roles[2], role["role_id"])
+	})
+
+	t.Run("MultipleUsersRoleAssignment", func(t *testing.T) {
+		// Assign different roles to different users
+		for i, userID := range users {
+			err := testProvider.SetUserRole(ctx, userID, roles[i])
+			assert.NoError(t, err)
+		}
+
+		// Verify each user has the correct role
+		for i, userID := range users {
+			role, err := testProvider.GetUserRole(ctx, userID)
+			assert.NoError(t, err)
+			assert.Equal(t, roles[i], role["role_id"])
+		}
+
+		// Clear all roles
+		for _, userID := range users {
+			err := testProvider.ClearUserRole(ctx, userID)
+			assert.NoError(t, err)
+		}
+
+		// Verify all roles were cleared
+		for _, userID := range users {
+			_, err := testProvider.GetUserRole(ctx, userID)
+			assert.Error(t, err)
+			assert.Contains(t, err.Error(), "has no role assigned")
+		}
+	})
+
+	t.Run("RoleConsistency", func(t *testing.T) {
+		userID := users[0]
+		roleID := roles[0]
+
+		// Assign role
+		err := testProvider.SetUserRole(ctx, userID, roleID)
+		assert.NoError(t, err)
+
+		// Get role through user role method
+		userRole, err := testProvider.GetUserRole(ctx, userID)
+		assert.NoError(t, err)
+
+		// Get role directly through role method
+		directRole, err := testProvider.GetRole(ctx, roleID)
+		assert.NoError(t, err)
+
+		// Both should return the same role information
+		assert.Equal(t, directRole["role_id"], userRole["role_id"])
+		assert.Equal(t, directRole["name"], userRole["name"])
+		assert.Equal(t, directRole["description"], userRole["description"])
+		assert.Equal(t, directRole["is_active"], userRole["is_active"])
+		assert.Equal(t, directRole["level"], userRole["level"])
+	})
+}

openapi/oauth/providers/user/user_test.go

@@ -112,13 +112,29 @@ func cleanupTestData() {
 		})
 	}
 
+	// Clean roles (should be done before users due to potential role_id references)
+	roleModel := model.Select("__yao.user_role")
+	rolePatterns := []string{
+		"test%", "%testrole%", "%listrole%", "%permrole%", "%adminrole%", "%userrole%",
+		"%inactiverole%", "%systemrole%", "%validrole%", "%emptyupdate%", "%emptyperm%",
+		"%guestrole%",
+	}
+	for _, pattern := range rolePatterns {
+		roleModel.DestroyWhere(model.QueryParam{
+			Wheres: []model.QueryWhere{
+				{Column: "role_id", OP: "like", Value: pattern},
+			},
+		})
+	}
+
 	// Clean users
 	userModel := model.Select("__yao.user")
 
 	// Delete test users by pattern (using hard delete)
 	userPatterns := []string{
 		"test-%", "test_%", "%testuser%", "%oauthtest%", "%oauthlist%",
-		"%oautherror%", "%deletetest%",
+		"%oautherror%", "%deletetest%", "%roleuser%", "%typeuser%", "%scopeuser%",
+		"%erroruser%", "%noroleuser%", "%clearnouser%", "%integuser%",
 	}
 	for _, pattern := range userPatterns {
 		userModel.DestroyWhere(model.QueryParam{
@@ -129,7 +145,10 @@ func cleanupTestData() {
 	}
 
 	// Also clean by username pattern
-	usernamePatterns := []string{"testuser%", "%oauth_%", "%deletetest%"}
+	usernamePatterns := []string{
+		"testuser%", "%oauth_%", "%deletetest%", "%roleuser%", "%typeuser%",
+		"%scopeuser%", "%erroruser%", "%noroleuser%", "%clearnouser%", "%integuser%",
+	}
 	for _, pattern := range usernamePatterns {
 		userModel.DestroyWhere(model.QueryParam{
 			Wheres: []model.QueryWhere{

openapi/oauth/types/interfaces.go

@@ -174,6 +174,7 @@ type UserProvider interface {
 	// User Role and Type Management
 	GetUserRole(ctx context.Context, userID string) (maps.MapStrAny, error)
 	SetUserRole(ctx context.Context, userID string, roleID string) error
+	ClearUserRole(ctx context.Context, userID string) error
 	GetUserType(ctx context.Context, userID string) (maps.MapStrAny, error)
 	SetUserType(ctx context.Context, userID string, typeID string) error
 	ValidateUserScope(ctx context.Context, userID string, scopes []string) (bool, error)