first commit

Interfaces/Services/IGymRoleService.cs

@@ -0,0 +1,19 @@
+using Fitness_core_BE.DTOs.Rbac;
+using Microsoft.AspNetCore.Http;
+
+namespace Fitness_core_BE.Interfaces.Services
+{
+    // Owner-only role CRUD + staff-role assignment. Every method resolves the caller via
+    // UserRoleHelper.GetClientId directly and never consults IPermissionService/GymRolePermission —
+    // this is what makes role management immune to staff self-escalation: no nav-section
+    // permission can ever unlock these methods for a staff account.
+    public interface IGymRoleService
+    {
+        Task<List<GymRoleDto>> GetRolesAsync(HttpContext httpContext);
+        Task<GymRoleDto> CreateRoleAsync(CreateGymRoleRequest request, HttpContext httpContext);
+        Task<GymRoleDto> UpdateRoleAsync(Guid gymRoleId, UpdateGymRoleRequest request, HttpContext httpContext);
+        Task DeleteRoleAsync(Guid gymRoleId, HttpContext httpContext);
+        Task<GymRoleDto> SetRolePermissionsAsync(Guid gymRoleId, SetRolePermissionsRequest request, HttpContext httpContext);
+        Task AssignStaffRoleAsync(Guid staffId, AssignStaffRoleRequest request, HttpContext httpContext);
+    }
+}