Overview
RolesService.findAllRoles() executes this.roleRepository.find({ relations: ['permissions'] }), hydrating every role together with its full permission set — a join whose row count is roles × permissions. PermissionsService.findAllPermissions() similarly returns the entire permission table. On a system with granular RBAC these tables are large by design, and both methods are exposed directly through their controllers with no bound. The role listing is also the hottest read in the authorization path, so its cost is paid disproportionately often.
Specifications
Features:
- Role and permission listings are paginated.
- Permission hydration is optional rather than always eager.
Tasks:
- Add pagination parameters to both list methods and their controller handlers, returning the standard paginated envelope.
- Make the
permissions relation opt-in via an include query parameter instead of always loading it.
- Add indexes supporting the default ordering.
- Update the corresponding Swagger response types.
Impacted Files:
src/rbac/roles/roles.service.tssrc/rbac/permissions/permissions.service.tssrc/rbac/roles/roles.controller.tssrc/rbac/permissions/permissions.controller.ts
Acceptance Criteria
- Both list endpoints return bounded pages.
- Permissions are hydrated only when requested.
- Swagger reflects the paginated response shape.
Overview
RolesService.findAllRoles()executesthis.roleRepository.find({ relations: ['permissions'] }), hydrating every role together with its full permission set — a join whose row count is roles × permissions.PermissionsService.findAllPermissions()similarly returns the entire permission table. On a system with granular RBAC these tables are large by design, and both methods are exposed directly through their controllers with no bound. The role listing is also the hottest read in the authorization path, so its cost is paid disproportionately often.Specifications
Features:
Tasks:
permissionsrelation opt-in via anincludequery parameter instead of always loading it.Impacted Files:
src/rbac/roles/roles.service.tssrc/rbac/permissions/permissions.service.tssrc/rbac/roles/roles.controller.tssrc/rbac/permissions/permissions.controller.tsAcceptance Criteria