# AssignPermissionToRole

## Overview

AssignPermissionToRole creates an association between a permission and a role, granting that permission to all users who have the role assigned. This command enables building up role capabilities by adding permissions one at a time.

The operation is idempotent - assigning the same permission to a role twice does not create duplicate records or return an error.

## Business Rules

- Role must exist in the system
- Permission must exist in the system
- Operation is idempotent (assigning same permission twice is not an error)
- Creates RolePermission association record if not already present
- Generates PERMISSION_ASSIGNED audit event with actor ID, role ID, permission ID, and timestamp

## Process Flow

```mermaid
flowchart TD
    A[Receive assign request] --> B{Role exists?}
    B -->|No| C[Return error: ROLE_NOT_FOUND]
    B -->|Yes| D{Permission exists?}
    D -->|No| E[Return error: PERMISSION_NOT_FOUND]
    D -->|Yes| F{Assignment exists?}
    F -->|Yes| G[Return success - idempotent]
    F -->|No| H[Create RolePermission record]
    H --> I[Log PERMISSION_ASSIGNED audit event]
    I --> J[Return success]
```

## External Dependencies

- None

## Error Scenarios

- **ROLE_NOT_FOUND**: Role ID does not exist in the system - return not found error with the provided role ID
- **PERMISSION_NOT_FOUND**: Permission ID does not exist in the system - return not found error with the provided permission ID

## Test Cases

- throws when role does not exist
- throws when permission does not exist
- returns success when assignment already exists (idempotent)
- creates RolePermission
