Merge pull request #3598 from codeeu/feature/support-role-remove

Support copilot: add user_role_remove

Author: bernardhanna

app/Jobs/Support/ExecuteApprovedSupportActionJob.php

@@ -12,6 +12,7 @@
 use App\Services\Support\UserProfileUpdateService;
 use App\Services\Support\UserRestoreService;
 use App\Services\Support\UserRoleAddService;
+use App\Services\Support\UserRoleRemoveService;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
@@ -35,6 +36,7 @@ public function handle(
         ArtisanCommandRunner $artisanRunner,
         ContentUpdateService $contentUpdate,
         UserRoleAddService $userRoleAdd,
+        UserRoleRemoveService $userRoleRemove,
     ): void
     {
         $approval = SupportApproval::findOrFail($this->supportApprovalId);
@@ -92,6 +94,8 @@ public function handle(
         } elseif ($action === 'user_role_add') {
             // Re-read the role + emails from the case email at execution time.
             $result = $userRoleAdd->addFromCase($case, dryRun: false, viaEmailApproval: true);
+        } elseif ($action === 'user_role_remove') {
+            $result = $userRoleRemove->removeFromCase($case, dryRun: false, viaEmailApproval: true);
         } elseif ($action === 'code_change') {
             $result = $cursorAgent->launchCodeAgent(
                 prompt: (string) ($payload['cursor_prompt'] ?? ''),

app/Jobs/Support/ProcessSupportCaseDiagnosticsJob.php

@@ -12,6 +12,7 @@
 use App\Services\Support\UserProfileUpdateService;
 use App\Services\Support\UserRestoreService;
 use App\Services\Support\UserRoleAddService;
+use App\Services\Support\UserRoleRemoveService;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
@@ -32,6 +33,7 @@ public function handle(
         UserRestoreService $userRestore,
         UserProfileUpdateService $userProfileUpdate,
         UserRoleAddService $userRoleAdd,
+        UserRoleRemoveService $userRoleRemove,
         ArtisanCommandRunner $artisanRunner,
         ContentUpdateService $contentUpdate,
     ): void {
@@ -79,6 +81,20 @@ public function handle(
             );
         }
 
+        if ($case->case_type === 'role_remove') {
+            $dryRunResult = $userRoleRemove->removeFromCase($case, dryRun: true);
+            $logger->log(
+                case: $case,
+                actionName: 'user_role_remove',
+                actionType: 'write',
+                input: ['dry_run' => true],
+                output: $dryRunResult,
+                succeeded: (bool) ($dryRunResult['ok'] ?? false),
+                executedBy: 'agent',
+                correlationId: $case->correlation_id,
+            );
+        }
+
         if ($case->case_type === 'role_add') {
             $dryRunResult = $userRoleAdd->addFromCase($case, dryRun: true);
             $logger->log(

app/Services/Support/Agents/CursorCliTriageProvider.php

@@ -28,6 +28,7 @@ class CursorCliTriageProvider implements TriageProvider
         'certificate_issue',
         'role_issue',
         'role_add',
+        'role_remove',
         'code_change',
         'artisan_command',
         'content_update',
@@ -138,6 +139,9 @@ private function buildPrompt(SupportCase $case, string $rawText): string
 users identified by email. Put the affected emails in target_email/secondary_emails, put the
 role being granted in "role_name" (singular, e.g. "leading teacher"), and set "role_operation"
 to "add". Include EVERY email listed in the request (one per person), even for long pasted tables.
+Use "role_remove" when the request is to remove/revoke/delete a role (e.g. "ambassador") from one
+or more users. Use the same target_email/secondary_emails and role_name fields, and set
+"role_operation" to "remove".
 {$artisanBlock}{$contentBlock}
 JSON schema to return:
 {
@@ -151,8 +155,8 @@ private function buildPrompt(SupportCase $case, string $rawText): string
   "reasoning_summary": "<one sentence>",
   "profile_firstname": "<requested first name or null>",
   "profile_lastname": "<requested last name or null>",
-  "role_name": "<for role_add: the role to grant, e.g. leading teacher, else null>",
-  "role_operation": "<for role_add: add (remove is not supported), else null>",
+  "role_name": "<for role_add/role_remove: the role affected, else null>",
+  "role_operation": "<for role_add: add; for role_remove: remove; else null>",
   "change_summary": "<for code_change: one sentence describing the fix, else null>",
   "change_area": "<for code_change: e.g. frontend/blade/css/js, else null>",
   "cursor_prompt": "<for code_change: a precise instruction for a coding agent to implement the fix and open a PR, else null>",
@@ -296,6 +300,7 @@ private function normalize(array $data): array
             'profile_update' => 'user_profile_update',
             'account_restore' => 'user_restore',
             'role_add' => 'user_role_add',
+            'role_remove' => 'user_role_remove',
             'code_change' => 'code_change',
             'artisan_command' => 'artisan_command',
             'content_update' => 'content_update',
@@ -352,7 +357,11 @@ private function normalizeRoleOperation(mixed $value): ?string
         }
         $value = strtolower(trim($value));
 
-        return in_array($value, ['add', 'grant', 'assign'], true) ? 'add' : null;
+        return match (true) {
+            in_array($value, ['add', 'grant', 'assign'], true) => 'add',
+            in_array($value, ['remove', 'revoke', 'delete'], true) => 'remove',
+            default => null,
+        };
     }
 
     private function stringOrNull(mixed $value): ?string

app/Services/Support/Agents/TriageAgentService.php

@@ -59,14 +59,21 @@ private function heuristicTriage(SupportCase $case): array
         $text = Str::lower($rawText);
         $profile = $this->profileParser->parse($rawText);
         $roleRequest = $this->roleParser->parse($rawText);
-        $hasRoleRequest = $roleRequest['role'] !== null
+        $hasRoleAddRequest = $roleRequest['role'] !== null
             && $roleRequest['operation'] === 'add'
             && $roleRequest['emails'] !== [];
+        $hasRoleRemoveRequest = $roleRequest['role'] !== null
+            && $roleRequest['operation'] === 'remove'
+            && $roleRequest['emails'] !== [];
+        $hasRoleRequest = $hasRoleAddRequest || $hasRoleRemoveRequest;
 
         // V1 heuristic placeholder (replace with LLM later, keep output schema stable).
         $caseType = 'unknown';
         $runbook = 'unknown';
-        if ($hasRoleRequest) {
+        if ($hasRoleRemoveRequest) {
+            $caseType = 'role_remove';
+            $runbook = 'remove_user_role';
+        } elseif ($hasRoleAddRequest) {
             $caseType = 'role_add';
             $runbook = 'add_user_role';
         } elseif (Str::contains($text, ['soft-deleted', 'deleted', 'restore account', 'account missing'])) {
@@ -120,6 +127,7 @@ private function heuristicTriage(SupportCase $case): array
         $requestedAction = match ($caseType) {
             'profile_update' => 'user_profile_update',
             'role_add' => 'user_role_add',
+            'role_remove' => 'user_role_remove',
             default => null,
         };
 

app/Services/Support/SupportApprovalEmailService.php

@@ -26,6 +26,7 @@ public function approvalSubject(SupportCase $case): string
             'profile_update' => 'Please review — name change',
             'account_restore' => 'Please review — account restore',
             'role_add' => 'Please review — add user role',
+            'role_remove' => 'Please review — remove user role',
             'code_change' => 'Please review — proposed code fix (PR into dev)',
             'artisan_command' => 'Please review — proposed server maintenance command',
             'content_update' => 'Please review — proposed content/copy change',
@@ -282,6 +283,20 @@ private function proposedActionForCase(SupportCase $case): array
             }
         }
 
+        if ($case->case_type === 'role_remove') {
+            $role = $this->roleResolver->resolve($case);
+            if ($role['role'] !== null && $role['emails'] !== []) {
+                return [
+                    'action' => 'user_role_remove',
+                    'payload' => [
+                        'operation' => $role['operation'],
+                        'role' => $role['role'],
+                        'emails' => $role['emails'],
+                    ],
+                ];
+            }
+        }
+
         if ($case->case_type === 'role_add') {
             $role = $this->roleResolver->resolve($case);
             if ($role['role'] !== null && $role['emails'] !== []) {
@@ -514,8 +529,8 @@ private function dryRunPlannedChangeLines(SupportCase $case, array $proposedActi
             return $this->dryRunContentLines($case);
         }
 
-        if ($action === 'user_role_add') {
-            return $this->dryRunRoleAddLines($case, $payload);
+        if ($action === 'user_role_add' || $action === 'user_role_remove') {
+            return $this->dryRunRoleChangeLines($case, $payload, $action);
         }
 
         return [
@@ -529,10 +544,13 @@ private function dryRunPlannedChangeLines(SupportCase $case, array $proposedActi
      * @param array<string, mixed> $payload
      * @return list<string>
      */
-    private function dryRunRoleAddLines(SupportCase $case, array $payload): array
+    private function dryRunRoleChangeLines(SupportCase $case, array $payload, string $action): array
     {
+        $actionName = $action === 'user_role_remove' ? 'user_role_remove' : 'user_role_add';
+        $isRemove = $action === 'user_role_remove';
+
         $output = $case->actions()
-            ->where('action_name', 'user_role_add')
+            ->where('action_name', $actionName)
             ->where('action_type', 'write')
             ->latest()
             ->first()?->output_json;
@@ -544,7 +562,9 @@ private function dryRunRoleAddLines(SupportCase $case, array $payload): array
 
         $lines = [
             '',
-            'We will add the role "'.$role.'" to the following CodeWeek accounts:',
+            $isRemove
+                ? 'We will remove the role "'.$role.'" from the following CodeWeek accounts:'
+                : 'We will add the role "'.$role.'" to the following CodeWeek accounts:',
             '',
         ];
 
@@ -554,22 +574,26 @@ private function dryRunRoleAddLines(SupportCase $case, array $payload): array
                 $lines[] = '  • '.$email;
             }
             $lines[] = '';
-            $lines[] = 'We will add the role to each account above that does not already have it.';
+            $lines[] = $isRemove
+                ? 'We will remove the role from each account above that currently has it.'
+                : 'We will add the role to each account above that does not already have it.';
 
             return $lines;
         }
 
         foreach ($items as $item) {
-            $lines[] = '  • '.$this->roleItemLine((array) $item);
+            $lines[] = '  • '.$this->roleItemLine((array) $item, $isRemove);
         }
 
         $lines[] = '';
-        $lines[] = 'Summary: '.$this->roleSummaryLine($summary);
+        $lines[] = 'Summary: '.$this->roleSummaryLine($summary, $isRemove);
 
         if (($summary['ambiguous'] ?? 0) > 0 || ($summary['user_not_found'] ?? 0) > 0) {
             $lines[] = '';
             $lines[] = 'Accounts marked "not found" or "needs manual check" will be skipped.';
-            $lines[] = 'Approving will still add the role to all accounts that are ready.';
+            $lines[] = $isRemove
+                ? 'Approving will still remove the role from all accounts that are ready.'
+                : 'Approving will still add the role to all accounts that are ready.';
         }
 
         return $lines;
@@ -578,7 +602,7 @@ private function dryRunRoleAddLines(SupportCase $case, array $payload): array
     /**
      * @param array<string, mixed> $item
      */
-    private function roleItemLine(array $item): string
+    private function roleItemLine(array $item, bool $isRemove = false): string
     {
         $email = (string) ($item['email'] ?? '');
         $status = (string) ($item['status'] ?? '');
@@ -587,6 +611,9 @@ private function roleItemLine(array $item): string
             'would_add' => 'will be added',
             'added' => 'role added',
             'already_has_role' => 'already has this role (no change)',
+            'would_remove' => 'will be removed',
+            'removed' => 'role removed',
+            'does_not_have_role' => 'does not have this role (no change)',
             'user_not_found' => 'no CodeWeek account found — skipped',
             'ambiguous' => 'multiple accounts match — needs manual check, skipped',
             default => $status,
@@ -598,12 +625,20 @@ private function roleItemLine(array $item): string
     /**
      * @param array<string, mixed> $summary
      */
-    private function roleSummaryLine(array $summary): string
+    private function roleSummaryLine(array $summary, bool $isRemove = false): string
     {
-        $toAdd = (int) (($summary['would_add'] ?? 0) + ($summary['added'] ?? 0));
-        $parts = [$toAdd.' to add'];
-        if (($summary['already_has_role'] ?? 0) > 0) {
-            $parts[] = (int) $summary['already_has_role'].' already have it';
+        if ($isRemove) {
+            $toChange = (int) (($summary['would_remove'] ?? 0) + ($summary['removed'] ?? 0));
+            $parts = [$toChange.' to remove'];
+            if (($summary['does_not_have_role'] ?? 0) > 0) {
+                $parts[] = (int) $summary['does_not_have_role'].' do not have it';
+            }
+        } else {
+            $toChange = (int) (($summary['would_add'] ?? 0) + ($summary['added'] ?? 0));
+            $parts = [$toChange.' to add'];
+            if (($summary['already_has_role'] ?? 0) > 0) {
+                $parts[] = (int) $summary['already_has_role'].' already have it';
+            }
         }
         if (($summary['user_not_found'] ?? 0) > 0) {
             $parts[] = (int) $summary['user_not_found'].' not found';
@@ -796,6 +831,7 @@ private function completionHeadline(SupportCase $case, string $action, bool $suc
             'user_profile_update' => 'Done — name updated on CodeWeek account',
             'user_restore' => 'Done — CodeWeek account reactivated',
             'user_role_add' => 'Done — user role added',
+            'user_role_remove' => 'Done — user role removed',
             'code_change' => 'Started — AI coding agent is preparing a PR into dev',
             'artisan_command' => 'Done — maintenance command completed on the server',
             'content_update' => 'Done — content updated',
@@ -840,8 +876,8 @@ private function buildCompletionBody(
             $lines = array_merge($lines, $this->completionFailureLines($action, $result, $email, $case->id));
         }
 
-        // Role-add is a batch action; the per-account list is shown above, so skip the single email line.
-        if ($email !== '' && $action !== 'user_role_add') {
+        // Role add/remove are batch actions; the per-account list is shown above.
+        if ($email !== '' && ! in_array($action, ['user_role_add', 'user_role_remove'], true)) {
             $lines[] = '';
             $lines[] = 'Account email: '.$email;
         }
@@ -852,10 +888,10 @@ private function buildCompletionBody(
 
         $lines[] = '';
         if ($succeeded) {
-            $lines[] = $action === 'user_role_add'
+            $lines[] = in_array($action, ['user_role_add', 'user_role_remove'], true)
                 ? 'No further action is needed. You do not need to reply to this email.'
                 : 'No further action is needed. The supporter can sign in with their usual email and password.';
-            if ($action !== 'user_role_add') {
+            if (! in_array($action, ['user_role_add', 'user_role_remove'], true)) {
                 $lines[] = 'You do not need to reply to this email.';
             }
         } else {
@@ -978,8 +1014,8 @@ private function completionSuccessLines(SupportCase $case, string $action, array
             return $lines;
         }
 
-        if ($action === 'user_role_add') {
-            return $this->completionRoleAddLines($inner);
+        if ($action === 'user_role_add' || $action === 'user_role_remove') {
+            return $this->completionRoleChangeLines($inner, $action);
         }
 
         return [
@@ -991,23 +1027,32 @@ private function completionSuccessLines(SupportCase $case, string $action, array
      * @param  array<string, mixed>  $inner
      * @return list<string>
      */
-    private function completionRoleAddLines(array $inner): array
+    private function completionRoleChangeLines(array $inner, string $action): array
     {
+        $isRemove = $action === 'user_role_remove';
         $role = (string) ($inner['role'] ?? 'the requested role');
         $items = is_array($inner['items'] ?? null) ? $inner['items'] : [];
         $summary = is_array($inner['summary'] ?? null) ? $inner['summary'] : [];
-        $addedCount = (int) ($summary['added'] ?? 0);
+        $changedCount = (int) ($isRemove ? ($summary['removed'] ?? 0) : ($summary['added'] ?? 0));
 
-        $lines = [
-            $addedCount === 1
+        if ($isRemove) {
+            $headline = $changedCount === 1
+                ? 'We removed the role "'.$role.'" from 1 CodeWeek account.'
+                : 'We removed the role "'.$role.'" from '.$changedCount.' CodeWeek accounts.';
+        } else {
+            $headline = $changedCount === 1
                 ? 'We added the role "'.$role.'" to 1 CodeWeek account.'
-                : 'We added the role "'.$role.'" to '.$addedCount.' CodeWeek accounts.',
+                : 'We added the role "'.$role.'" to '.$changedCount.' CodeWeek accounts.';
+        }
+
+        $lines = [
+            $headline,
             '',
             'Details:',
         ];
 
         foreach ($items as $item) {
-            $lines[] = '  • '.$this->roleItemLine((array) $item);
+            $lines[] = '  • '.$this->roleItemLine((array) $item, $isRemove);
         }
 
         $skipped = (int) ($summary['user_not_found'] ?? 0) + (int) ($summary['ambiguous'] ?? 0);
@@ -1104,9 +1149,10 @@ private function humanizeError(string $code, string $action, int $caseId): strin
             str_contains($code, 'no_effective_change') => 'The content already matched the requested text — no change was needed.',
             str_starts_with($code, 'role_not_found') => 'We could not find a matching role. Check the role name (e.g. "leading teacher").',
             str_starts_with($code, 'role_not_allowed') => 'That role is not on the list the copilot is allowed to add.',
-            str_contains($code, 'no_role_specified') => 'The request did not say which role to add.',
+            str_contains($code, 'no_role_specified') => 'The request did not say which role to change.',
             str_contains($code, 'no_target_emails') => 'The request did not include any valid email addresses.',
             str_contains($code, 'only_add_operation') => 'Only adding roles is supported right now (not removing).',
+            str_contains($code, 'only_remove_operation') => 'Only removing roles is supported for this action.',
             $action === 'user_restore' && str_contains($code, 'verification') => 'The account was changed but we could not confirm it is fully active. Please verify in Nova.',
             default => 'Technical detail: '.$code,
         };

app/Services/Support/SupportRoleRequestParser.php

@@ -61,6 +61,12 @@ private function parseLabelled(string $text): array
         } elseif (preg_match('/(?:^|\n)\s*(?:remove|revoke)\s+role\s*[:\-]\s*([^\n\r]+)/iu', $text, $m)) {
             $role = $this->cleanRole($m[1]);
             $operation = 'remove';
+        } elseif (preg_match('/\b(?:remove|revoke|delete)\s+(?:the\s+)?["\']?([^"\'\n\r]+?)["\']?\s+role\b/iu', $text, $m)) {
+            $role = $this->cleanRole($m[1]);
+            $operation = 'remove';
+        } elseif (preg_match('/\b(?:remove|revoke|delete)\s+the\s+role\s+["\']?([^"\'\n\r]+?)["\']?\s+from\b/iu', $text, $m)) {
+            $role = $this->cleanRole($m[1]);
+            $operation = 'remove';
         } elseif (preg_match('/(?:^|\n)\s*role\s*(?:to\s+(add|remove))?\s*[:\-]\s*([^\n\r]+)/iu', $text, $m)) {
             $operation = strtolower(trim($m[1] ?? '')) === 'remove' ? 'remove' : 'add';
             $role = $this->cleanRole($m[2]);