From 2fe0d81b5565a38a2db38c8f5736376a430e64f3 Mon Sep 17 00:00:00 2001
From: forge-bot <bot@forge.local>
Date: Tue, 14 Jul 2026 10:29:49 +0000
Subject: [PATCH] =?UTF-8?q?Reviewer=20=EC=97=AD=ED=95=A0=20=EA=B2=80?=
 =?UTF-8?q?=EC=A6=9D=20=EB=B3=B4=EA=B3=A0=EC=84=9C=20smoke=20(runtime-role?=
 =?UTF-8?q?-matrix-live-20260714101723-v7-reviewer-001)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../runtime/role/RoleValidator.java           | 94 +++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 src/main/java/com/klaroworks/runtime/role/RoleValidator.java

diff --git a/src/main/java/com/klaroworks/runtime/role/RoleValidator.java b/src/main/java/com/klaroworks/runtime/role/RoleValidator.java
new file mode 100644
index 0000000..0b20259
--- /dev/null
+++ b/src/main/java/com/klaroworks/runtime/role/RoleValidator.java
@@ -0,0 +1,94 @@
+package com.klaroworks.runtime.role;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * Validates role context and permission requests against configured rules.
+ */
+public final class RoleValidator {
+
+    private final Set<String> validRoles;
+    private final Set<String> validPermissions;
+
+    public RoleValidator() {
+        this(Collections.emptySet(), Collections.emptySet());
+    }
+
+    public RoleValidator(Collection<String> validRoles, Collection<String> validPermissions) {
+        this.validRoles = Set.copyOf(validRoles);
+        this.validPermissions = Set.copyOf(validPermissions);
+    }
+
+    public boolean isValidRole(String role) {
+        if (role == null || role.isBlank()) {
+            return false;
+        }
+        return validRoles.isEmpty() || validRoles.contains(role);
+    }
+
+    public boolean isValidPermission(String permission) {
+        if (permission == null || permission.isBlank()) {
+            return false;
+        }
+        return validPermissions.isEmpty() || validPermissions.contains(permission);
+    }
+
+    public ValidationResult validateContext(RoleContext context) {
+        if (context == null) {
+            return new ValidationResult(false, "Context must not be null");
+        }
+        if (context.getUserId() == null || context.getUserId().isBlank()) {
+            return new ValidationResult(false, "User ID must not be blank");
+        }
+        return new ValidationResult(true, null);
+    }
+
+    public ValidationResult validateRole(String role) {
+        if (role == null || role.isBlank()) {
+            return new ValidationResult(false, "Role must not be blank");
+        }
+        if (!validRoles.isEmpty() && !validRoles.contains(role)) {
+            return new ValidationResult(false, "Unknown role: " + role);
+        }
+        return new ValidationResult(true, null);
+    }
+
+    public ValidationResult validatePermission(String permission) {
+        if (permission == null || permission.isBlank()) {
+            return new ValidationResult(false, "Permission must not be blank");
+        }
+        if (!validPermissions.isEmpty() && !validPermissions.contains(permission)) {
+            return new ValidationResult(false, "Unknown permission: " + permission);
+        }
+        return new ValidationResult(true, null);
+    }
+
+    public Set<String> getValidRoles() {
+        return Collections.unmodifiableSet(validRoles);
+    }
+
+    public Set<String> getValidPermissions() {
+        return Collections.unmodifiableSet(validPermissions);
+    }
+
+    public static final class ValidationResult {
+        private final boolean valid;
+        private final String errorMessage;
+
+        public ValidationResult(boolean valid, String errorMessage) {
+            this.valid = valid;
+            this.errorMessage = errorMessage;
+        }
+
+        public boolean isValid() {
+            return valid;
+        }
+
+        public String getErrorMessage() {
+            return errorMessage;
+        }
+    }
+}