feat: мультироль

backend/UniVerse.Api/Controllers/AuthController.cs

@@ -3,6 +3,7 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.WebUtilities;
 using UniVerse.Application.DTOs.Auth;
 using UniVerse.Application.Interfaces;
+using UniVerse.Domain.Enums;
 using System.Security.Cryptography;
 using System.Security.Claims;
 
@@ -184,7 +185,8 @@ public class AuthController : ControllerBase
     {
         if (!HttpContext.RequestServices.GetRequiredService<IWebHostEnvironment>().IsDevelopment())
             return NotFound();
-        var result = await _auth.DevLoginAsync(request.Email, request.DisplayName, request.Role, GetClientIpAddress());
+        var roles = request.Roles?.Count > 0 ? request.Roles : [UserRole.Student];
+        var result = await _auth.DevLoginAsync(request.Email, request.DisplayName, roles, GetClientIpAddress());
         SetRefreshTokenCookie(result.RefreshToken);
         return Ok(result.Response);
     }

backend/UniVerse.Api/Controllers/UsersController.cs

@@ -137,23 +137,26 @@ public class UsersController : ControllerBase
     public async Task<ActionResult> GetAll([FromQuery] UserFilterRequest filter) =>
         Ok(await _users.GetAllAsync(filter));
 
-    /// <summary>Изменить роль пользователя.</summary>
+    /// <summary>Изменить набор ролей пользователя.</summary>
     /// <remarks>Только Admin. Доступные роли: Student, Teacher, Admin.</remarks>
     /// <param name="id">ID пользователя.</param>
-    /// <param name="role">Новая роль.</param>
-    /// <response code="204">Роль успешно изменена.</response>
+    /// <param name="roles">Новый набор ролей пользователя.</param>
+    /// <response code="204">Роли успешно изменены.</response>
     /// <response code="401">Требуется аутентификация.</response>
     /// <response code="403">Требуется роль Admin.</response>
     /// <response code="404">Пользователь не найден.</response>
     [Authorize(Roles = "Admin")]
     [HttpPatch("{id:int}/role")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
     [ProducesResponseType(StatusCodes.Status401Unauthorized)]
     [ProducesResponseType(StatusCodes.Status403Forbidden)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> SetRole(int id, [FromBody] UserRole role)
+    public async Task<IActionResult> SetRole(int id, [FromBody] IReadOnlyCollection<UserRole> roles)
     {
-        await _users.SetRoleAsync(id, role);
+        if (roles.Count == 0)
+            return BadRequest("At least one role is required.");
+        await _users.SetRolesAsync(id, roles);
         return NoContent();
     }