self delete and role categorized

app/controllers/auth/role_controller.py

@@ -91,8 +91,10 @@ class RoleController:
                 "category": ra.access.category,
                 "name": ra.access.name,
                 "parent_id": str(ra.access.parent_id) if ra.access.parent_id else None,
+                "module_name": "SaaS (Internal)",
             }
             for ra in role.role_accesses
+            if ra.access
         ]
         
         accesses.extend([
@@ -102,8 +104,11 @@ class RoleController:
                 "category": rma.module_access.category,
                 "name": rma.module_access.name,
                 "parent_id": str(rma.module_access.parent_id) if rma.module_access.parent_id else None,
+                "module_id": str(rma.module_access.module_id) if rma.module_access.module_id else None,
+                "module_name": rma.module_access.module.module_name if (rma.module_access and rma.module_access.module) else "DocQube",
             }
             for rma in role.role_module_accesses
+            if rma.module_access
         ])
 
         return RoleWithAccessesResponse(

app/services/auth/role_service.py

@@ -173,7 +173,12 @@ class RoleService:
         equality `get_all_roles` and the paginated list already apply, so global
         (tenant-less) roles stay invisible to tenants.
         """
-        query = db.query(Role).filter(Role.id == role_id)
+        query = db.query(Role).options(
+            joinedload(Role.role_accesses).joinedload(RoleAccess.access),
+            joinedload(Role.role_module_accesses)
+            .joinedload(RoleModuleAccess.module_access)
+            .joinedload(ModuleAccess.module),
+        ).filter(Role.id == role_id)
 
         if not actor_is_superadmin:
             if actor_tenant_id is None:

app/services/auth/user_service.py

@@ -177,6 +177,12 @@ class UserService:
         if tenant_id:
             update_dict.pop("tenant_id", None)
 
+        if str(user_id) == str(user.id) and update_dict.get("status") in ["inactive", "disabled"]:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="You cannot deactivate your own account.",
+            )
+
         if update_dict.get("status") == "active" and user.status != "active":
             SeatService.assert_seat_available(db, user.tenant_id)
 
@@ -292,6 +298,12 @@ class UserService:
     @staticmethod
     def delete_user(db: Session, user_id: uuid.UUID, tenant_id: uuid.UUID = None,
                     actor_id: uuid.UUID = None):
+        if actor_id and str(actor_id) == str(user_id):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="You cannot delete your own account.",
+            )
+
         user = UserService.get_user_by_id(db, user_id, tenant_id)
         
         targets = []