Module role_delegation_use_cases 

Story 3.5 — Temporary role delegation use cases (FR8 INV-8).

A syndic (or any holder of a native role) may delegate their role to another user for a bounded duration. The platform enforces:

• Self-delegation forbidden (delegator != target).
• Duration bounded in (now, now + MAX_DELEGATION_DAYS].
• Anti-double-grant (409): the target must not already hold this role actively (native or delegated).
• Non-transitive (403): a user that received the role through a delegation cannot re-delegate it. Caller MUST hold the role as a native assignment (delegated_from_user_id IS NULL).

Handlers enforce the upstream “caller actually holds the role” check via the JWT role + an active assignment lookup before calling delegate_role.

Structs

RoleDelegationUseCases

Constants

MAX_DELEGATION_DAYS

Anti-abuse cap: no single delegation can outlive 90 days. A renewal MUST go through a fresh delegate_role call (audit-faithful).