NOISSUE - Update CLI (#2645)

Signed-off-by: Felix Gateru <felix.gateru@gmail.com>

cli/clients.go

@@ -286,13 +286,368 @@ var cmdClients = []cobra.Command{
 	},
 }
 
+var cmdClientsRoles = []cobra.Command{
+	{
+		Use:   "create <JSON_role> <client_id> <domain_id> <user_auth_token>",
+		Short: "Create client role",
+		Long: "Create role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles create <JSON_role> <client_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles create '{\"role_name\":\"admin\",\"optional_actions\":[\"read\",\"update\"]}' 4ef09eff-d500-4d56-b04f-d23a512d6f2a 39f97daf-d6b6-40f4-b229-2697be8006ef $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			var roleReq smqsdk.RoleReq
+			if err := json.Unmarshal([]byte(args[0]), &roleReq); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			r, err := sdk.CreateClientRole(args[1], args[2], roleReq, args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			logJSONCmd(*cmd, r)
+		},
+	},
+
+	{
+		Use:   "get [all | <role_id>] <client_id>, <domain_id> <user_auth_token>",
+		Short: "Get client roles",
+		Long: "Get client roles\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles get all <client_id> <domain_id> <user_auth_token> - lists all roles\n" +
+			"\tsupermq-cli clients roles get all <client_id> <domain_id> <user_auth_token> --offset <offset> --limit <limit> - lists all roles with provided offset and limit\n" +
+			"\tsupermq-cli clients roles get <role_id> <client_id> <domain_id> <user_auth_token> - shows role by role id and domain id\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			pageMetadata := smqsdk.PageMetadata{
+				Offset: Offset,
+				Limit:  Limit,
+			}
+			if args[0] == all {
+				rs, err := sdk.ClientRoles(args[1], args[2], pageMetadata, args[3])
+				if err != nil {
+					logErrorCmd(*cmd, err)
+					return
+				}
+				logJSONCmd(*cmd, rs)
+				return
+			}
+			r, err := sdk.ClientRole(args[1], args[0], args[2], args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, r)
+		},
+	},
+
+	{
+		Use:   "update <new_name> <role_id> <client_id> <domain_id> <user_auth_token>",
+		Short: "Update client role name",
+		Long: "Update client role name\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles update <new_name> <role_id> <client_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles update new_name 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			r, err := sdk.UpdateClientRole(args[2], args[1], args[0], args[3], args[4])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, r)
+		},
+	},
+
+	{
+		Use:   "delete <role_id> <client_id> <domain_id> <user_auth_token>",
+		Short: "Delete client role",
+		Long: "Delete client role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles delete <role_id> <client_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles delete 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			if err := sdk.DeleteClientRole(args[1], args[0], args[2], args[3]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
+}
+
+var cmdClientsActions = []cobra.Command{
+	{
+		Use:   "add <JSON_actions> <role_id> <client_id> <domain_id> <user_auth_token>",
+		Short: "Add actions to role",
+		Long: "Add actions to role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles actions add <JSON_actions> <role_id> <client_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles actions add '{\"actions\":[\"read\",\"write\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			actions := struct {
+				Actions []string `json:"actions"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &actions); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			acts, err := sdk.AddClientRoleActions(args[2], args[1], args[3], actions.Actions, args[4])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, acts)
+		},
+	},
+
+	{
+		Use:   "list <role_id> <client_id> <domain_id> <user_auth_token>",
+		Short: "List actions of role",
+		Long: "List actions of role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles actions list <role_id> <client_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles actions list 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			l, err := sdk.ClientRoleActions(args[1], args[0], args[2], args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, l)
+		},
+	},
+
+	{
+		Use:   "delete [all | <JSON_actions>] <role_id> <client_id> <domain_id> <user_auth_token>",
+		Short: "Delete actions from role",
+		Long: "Delete actions from role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles actions delete <JSON_actions> <role_id> <client_id> <domain_id> <user_auth_token>\n" +
+			"\tsupermq-cli clients roles actions delete all <role_id> <client_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles actions delete '{\"actions\":[\"read\",\"write\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			if args[0] == all {
+				if err := sdk.RemoveAllClientRoleActions(args[2], args[1], args[3], args[4]); err != nil {
+					logErrorCmd(*cmd, err)
+					return
+				}
+				logOKCmd(*cmd)
+				return
+			}
+			actions := struct {
+				Actions []string `json:"actions"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &actions); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			if err := sdk.RemoveClientRoleActions(args[2], args[1], args[3], actions.Actions, args[4]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
+
+	{
+		Use:   "available-actions <domain_id> <user_auth_token>",
+		Short: "List available actions",
+		Long: "List available actions\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles actions available-actions <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles actions available-actions 39f97daf-d6b6-40f4-b229-2697be8006ef $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 2 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			acts, err := sdk.AvailableClientRoleActions(args[0], args[1])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, acts)
+		},
+	},
+}
+
+var cmdClientMembers = []cobra.Command{
+	{
+		Use:   "add <JSON_members> <role_id> <client_id> <domain_id> <user_auth_token>",
+		Short: "Add members to role",
+		Long: "Add members to role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles members add <JSON_members> <role_id> <client_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles members add '{\"members\":[\"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\", \"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			members := struct {
+				Members []string `json:"members"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &members); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			memb, err := sdk.AddClientRoleMembers(args[2], args[1], args[3], members.Members, args[4])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, memb)
+		},
+	},
+
+	{
+		Use:   "list <role_id> <client_id> <domain_id> <user_auth_token>",
+		Short: "List members of role",
+		Long: "List members of role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles members list <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles members list 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			pageMetadata := smqsdk.PageMetadata{
+				Offset: Offset,
+				Limit:  Limit,
+			}
+
+			l, err := sdk.ClientRoleMembers(args[1], args[0], args[2], pageMetadata, args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, l)
+		},
+	},
+
+	{
+		Use:   "delete [all | <JSON_members>] <role_id> <client_id> <domain_id> <user_auth_token>",
+		Short: "Delete members from role",
+		Long: "Delete members from role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli clients roles members delete <JSON_members> <role_id> <client_id> <domain_id> <user_auth_token>\n" +
+			"\tsupermq-cli clients roles members delete all <role_id> <client_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli clients roles members delete all 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n" +
+			"\tsupermq-cli clients roles members delete '{\"members\":[\"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\", \"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			if args[0] == all {
+				if err := sdk.RemoveAllClientRoleMembers(args[2], args[1], args[3], args[4]); err != nil {
+					logErrorCmd(*cmd, err)
+					return
+				}
+				logOKCmd(*cmd)
+				return
+			}
+
+			members := struct {
+				Members []string `json:"members"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &members); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			if err := sdk.RemoveClientRoleMembers(args[2], args[1], args[3], members.Members, args[4]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
+}
+
 // NewClientsCmd returns clients command.
 func NewClientsCmd() *cobra.Command {
+	actionsCmd := cobra.Command{
+		Use:   "actions [add | list | delete | available-actions]",
+		Short: "Actions management",
+		Long:  "Actions management: add, list, delete actions and list available actions",
+	}
+	for i := range cmdClientsActions {
+		actionsCmd.AddCommand(&cmdClientsActions[i])
+	}
+
+	membersCmd := cobra.Command{
+		Use:   "members [add | list | delete]",
+		Short: "Members management",
+		Long:  "Members management: add, list, delete members",
+	}
+	for i := range cmdClientMembers {
+		membersCmd.AddCommand(&cmdClientMembers[i])
+	}
+
+	rolesCmd := cobra.Command{
+		Use:   "roles [create | get | update | delete | actions | members]",
+		Short: "Roles management",
+		Long:  "Roles management: create, update, retrieve roles and assign/unassign members to roles",
+	}
+
+	rolesCmd.AddCommand(&actionsCmd)
+	rolesCmd.AddCommand(&membersCmd)
+
+	for i := range cmdClientsRoles {
+		rolesCmd.AddCommand(&cmdClientsRoles[i])
+	}
+
 	cmd := cobra.Command{
 		Use:   "clients [create | get | update | delete | share | connect | disconnect | connections | not-connected | users ]",
 		Short: "Clients management",
 		Long:  `Clients management: create, get, update, delete or share Client, connect or disconnect Client from Channel and get the list of Channels connected or disconnected from a Client`,
 	}
+	cmd.AddCommand(&rolesCmd)
 
 	for i := range cmdClients {
 		cmd.AddCommand(&cmdClients[i])

cli/clients_test.go

@@ -16,7 +16,7 @@ import (
 	"github.com/absmach/supermq/internal/testsutil"
 	"github.com/absmach/supermq/pkg/errors"
 	svcerr "github.com/absmach/supermq/pkg/errors/service"
-	sdk "github.com/absmach/supermq/pkg/sdk"
+	smqsdk "github.com/absmach/supermq/pkg/sdk"
 	sdkmocks "github.com/absmach/supermq/pkg/sdk/mocks"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
@@ -31,10 +31,10 @@ var (
 	conntype           = `["publish","subscribe"]`
 )
 
-var client = sdk.Client{
+var client = smqsdk.Client{
 	ID:   testsutil.GenerateUUID(&testing.T{}),
 	Name: "testclient",
-	Credentials: sdk.ClientCredentials{
+	Credentials: smqsdk.ClientCredentials{
 		Secret: "secret",
 	},
 	DomainID: testsutil.GenerateUUID(&testing.T{}),
@@ -48,14 +48,14 @@ func TestCreateClientsCmd(t *testing.T) {
 	clientsCmd := cli.NewClientsCmd()
 	rootCmd := setFlags(clientsCmd)
 
-	var tg sdk.Client
+	var tg smqsdk.Client
 
 	cases := []struct {
 		desc          string
 		args          []string
 		sdkErr        errors.SDKError
 		errLogMessage string
-		client        sdk.Client
+		client        smqsdk.Client
 		logType       outputLog
 	}{
 		{
@@ -138,16 +138,16 @@ func TestGetClientssCmd(t *testing.T) {
 	clientsCmd := cli.NewClientsCmd()
 	rootCmd := setFlags(clientsCmd)
 
-	var tg sdk.Client
-	var page sdk.ClientsPage
+	var tg smqsdk.Client
+	var page smqsdk.ClientsPage
 
 	cases := []struct {
 		desc          string
 		args          []string
 		sdkErr        errors.SDKError
 		errLogMessage string
-		client        sdk.Client
-		page          sdk.ClientsPage
+		client        smqsdk.Client
+		page          smqsdk.ClientsPage
 		logType       outputLog
 	}{
 		{
@@ -158,8 +158,8 @@ func TestGetClientssCmd(t *testing.T) {
 				token,
 			},
 			logType: entityLog,
-			page: sdk.ClientsPage{
-				Clients: []sdk.Client{client},
+			page: smqsdk.ClientsPage{
+				Clients: []smqsdk.Client{client},
 			},
 		},
 		{
@@ -181,7 +181,7 @@ func TestGetClientssCmd(t *testing.T) {
 			},
 			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
 			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
-			page:          sdk.ClientsPage{},
+			page:          smqsdk.ClientsPage{},
 			logType:       errLog,
 		},
 		{
@@ -280,7 +280,7 @@ func TestUpdateClientCmd(t *testing.T) {
 		args          []string
 		sdkErr        errors.SDKError
 		errLogMessage string
-		client        sdk.Client
+		client        smqsdk.Client
 		logType       outputLog
 	}{
 		{
@@ -291,7 +291,7 @@ func TestUpdateClientCmd(t *testing.T) {
 				domainID,
 				token,
 			},
-			client: sdk.Client{
+			client: smqsdk.Client{
 				Name: "clientName",
 				Metadata: map[string]interface{}{
 					"metadata": map[string]interface{}{
@@ -337,7 +337,7 @@ func TestUpdateClientCmd(t *testing.T) {
 				domainID,
 				token,
 			},
-			client: sdk.Client{
+			client: smqsdk.Client{
 				Name:     client.Name,
 				ID:       client.ID,
 				DomainID: client.DomainID,
@@ -381,12 +381,12 @@ func TestUpdateClientCmd(t *testing.T) {
 				domainID,
 				token,
 			},
-			client: sdk.Client{
+			client: smqsdk.Client{
 				Name:     client.Name,
 				ID:       client.ID,
 				DomainID: client.DomainID,
 				Status:   client.Status,
-				Credentials: sdk.ClientCredentials{
+				Credentials: smqsdk.ClientCredentials{
 					Secret: newSecret,
 				},
 			},
@@ -434,20 +434,20 @@ func TestUpdateClientCmd(t *testing.T) {
 
 	for _, tc := range cases {
 		t.Run(tc.desc, func(t *testing.T) {
-			var tg sdk.Client
+			var tg smqsdk.Client
 			sdkCall := sdkMock.On("UpdateClient", mock.Anything, mock.Anything, mock.Anything).Return(tc.client, tc.sdkErr)
 			sdkCall1 := sdkMock.On("UpdateClientTags", mock.Anything, mock.Anything, mock.Anything).Return(tc.client, tc.sdkErr)
 			sdkCall2 := sdkMock.On("UpdateClientSecret", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(tc.client, tc.sdkErr)
 
 			switch {
 			case tc.args[0] == tagUpdateType:
-				var th sdk.Client
+				var th smqsdk.Client
 				th.Tags = []string{"tag1", "tag2"}
 				th.ID = tc.args[1]
 
 				sdkCall1 = sdkMock.On("UpdateClientTags", th, tc.args[3]).Return(tc.client, tc.sdkErr)
 			case tc.args[0] == secretUpdateType:
-				var th sdk.Client
+				var th smqsdk.Client
 				th.Credentials.Secret = tc.args[2]
 				th.ID = tc.args[1]
 
@@ -552,14 +552,14 @@ func TestEnableClientCmd(t *testing.T) {
 	cli.SetSDK(sdkMock)
 	clientsCmd := cli.NewClientsCmd()
 	rootCmd := setFlags(clientsCmd)
-	var tg sdk.Client
+	var tg smqsdk.Client
 
 	cases := []struct {
 		desc          string
 		args          []string
 		sdkErr        errors.SDKError
 		errLogMessage string
-		client        sdk.Client
+		client        smqsdk.Client
 		logType       outputLog
 	}{
 		{
@@ -634,14 +634,14 @@ func TestDisableclientCmd(t *testing.T) {
 	clientsCmd := cli.NewClientsCmd()
 	rootCmd := setFlags(clientsCmd)
 
-	var tg sdk.Client
+	var tg smqsdk.Client
 
 	cases := []struct {
 		desc          string
 		args          []string
 		sdkErr        errors.SDKError
 		errLogMessage string
-		client        sdk.Client
+		client        smqsdk.Client
 		logType       outputLog
 	}{
 		{
@@ -717,14 +717,14 @@ func TestUsersClientCmd(t *testing.T) {
 	clientsCmd := cli.NewClientsCmd()
 	rootCmd := setFlags(clientsCmd)
 
-	page := sdk.UsersPage{}
+	page := smqsdk.UsersPage{}
 
 	cases := []struct {
 		desc          string
 		args          []string
 		logType       outputLog
 		errLogMessage string
-		page          sdk.UsersPage
+		page          smqsdk.UsersPage
 		sdkErr        errors.SDKError
 	}{
 		{
@@ -734,13 +734,13 @@ func TestUsersClientCmd(t *testing.T) {
 				domainID,
 				token,
 			},
-			page: sdk.UsersPage{
-				PageRes: sdk.PageRes{
+			page: smqsdk.UsersPage{
+				PageRes: smqsdk.PageRes{
 					Total:  1,
 					Offset: 0,
 					Limit:  10,
 				},
-				Users: []sdk.User{user},
+				Users: []smqsdk.User{user},
 			},
 			logType: entityLog,
 		},
@@ -989,3 +989,742 @@ func TestDisconnectClientCmd(t *testing.T) {
 		})
 	}
 }
+
+func TestCreateClientRoleCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	roleReq := smqsdk.RoleReq{
+		RoleName:        "admin",
+		OptionalActions: []string{"read", "update"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		role          smqsdk.Role
+		logType       outputLog
+	}{
+		{
+			desc: "create client role successfully",
+			args: []string{
+				`{"role_name":"admin","optional_actions":["read","update"]}`,
+				client.ID,
+				domainID,
+				token,
+			},
+			role: smqsdk.Role{
+				ID:              testsutil.GenerateUUID(&testing.T{}),
+				Name:            "admin",
+				OptionalActions: []string{"read", "update"},
+			},
+			logType: entityLog,
+		},
+		{
+			desc: "create client role with invalid JSON",
+			args: []string{
+				`{"role_name":"admin","optional_actions":["read","update"}`,
+				client.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("CreateClientRole", tc.args[1], tc.args[2], roleReq, tc.args[3]).Return(tc.role, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "create"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var role smqsdk.Role
+				err := json.Unmarshal([]byte(out), &role)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.role, role, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.role, role))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestGetClientRolesCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	role := smqsdk.Role{
+		ID:              testsutil.GenerateUUID(&testing.T{}),
+		Name:            "admin",
+		OptionalActions: []string{"read", "update"},
+	}
+	rolesPage := smqsdk.RolesPage{
+		Total:  1,
+		Offset: 0,
+		Limit:  10,
+		Roles:  []smqsdk.Role{role},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		roles         smqsdk.RolesPage
+		logType       outputLog
+	}{
+		{
+			desc: "get all client roles successfully",
+			args: []string{
+				all,
+				client.ID,
+				domainID,
+				token,
+			},
+			roles:   rolesPage,
+			logType: entityLog,
+		},
+		{
+			desc: "get client roles with invalid token",
+			args: []string{
+				all,
+				client.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("ClientRoles", tc.args[1], tc.args[2], mock.Anything, tc.args[3]).Return(tc.roles, tc.sdkErr)
+			if tc.args[0] != all {
+				sdkCall = sdkMock.On("ClientRole", tc.args[1], tc.args[0], tc.args[2], tc.args[3]).Return(role, tc.sdkErr)
+			}
+			out := executeCommand(t, rootCmd, append([]string{"roles", "get"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var roles smqsdk.RolesPage
+				err := json.Unmarshal([]byte(out), &roles)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.roles, roles, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.roles, roles))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestUpdateClientRoleCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	role := smqsdk.Role{
+		ID:              testsutil.GenerateUUID(&testing.T{}),
+		Name:            "new_name",
+		OptionalActions: []string{"read", "update"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		role          smqsdk.Role
+		logType       outputLog
+	}{
+		{
+			desc: "update client role name successfully",
+			args: []string{
+				"new_name",
+				role.ID,
+				client.ID,
+				domainID,
+				token,
+			},
+			role:    role,
+			logType: entityLog,
+		},
+		{
+			desc: "update client role name with invalid token",
+			args: []string{
+				"new_name",
+				role.ID,
+				client.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("UpdateClientRole", tc.args[2], tc.args[1], tc.args[0], tc.args[3], tc.args[4]).Return(tc.role, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "update"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var role smqsdk.Role
+				err := json.Unmarshal([]byte(out), &role)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.role, role, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.role, role))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestDeleteClientRoleCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		logType       outputLog
+	}{
+		{
+			desc: "delete client role successfully",
+			args: []string{
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete client role with invalid token",
+			args: []string{
+				roleID,
+				client.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("DeleteClientRole", tc.args[1], tc.args[0], tc.args[2], tc.args[3]).Return(tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "delete"}, tc.args...)...)
+
+			switch tc.logType {
+			case okLog:
+				assert.True(t, strings.Contains(out, "ok"), fmt.Sprintf("%s unexpected response: expected success message, got: %v", tc.desc, out))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestAddClientRoleActionsCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	actions := struct {
+		Actions []string `json:"actions"`
+	}{
+		Actions: []string{"read", "write"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		actions       []string
+		logType       outputLog
+	}{
+		{
+			desc: "add actions to role successfully",
+			args: []string{
+				`{"actions":["read","write"]}`,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			actions: actions.Actions,
+			logType: entityLog,
+		},
+		{
+			desc: "add actions to role with invalid JSON",
+			args: []string{
+				`{"actions":["read","write"}`,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("AddClientRoleActions", tc.args[2], tc.args[1], tc.args[3], tc.actions, tc.args[4]).Return(tc.actions, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "actions", "add"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var acts []string
+				err := json.Unmarshal([]byte(out), &acts)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.actions, acts, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.actions, acts))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestListClientRoleActionsCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	actions := []string{"read", "write"}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		actions       []string
+		logType       outputLog
+	}{
+		{
+			desc: "list actions of role successfully",
+			args: []string{
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			actions: actions,
+			logType: entityLog,
+		},
+		{
+			desc: "list actions of role with invalid token",
+			args: []string{
+				roleID,
+				client.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("ClientRoleActions", tc.args[1], tc.args[0], tc.args[2], tc.args[3]).Return(tc.actions, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "actions", "list"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var acts []string
+				err := json.Unmarshal([]byte(out), &acts)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.actions, acts, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.actions, acts))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestDeleteClientRoleActionsCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	actions := struct {
+		Actions []string `json:"actions"`
+	}{
+		Actions: []string{"read", "write"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		logType       outputLog
+	}{
+		{
+			desc: "delete actions from role successfully",
+			args: []string{
+				`{"actions":["read","write"]}`,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete all actions from role successfully",
+			args: []string{
+				all,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete actions from role with invalid JSON",
+			args: []string{
+				`{"actions":["read","write"}`,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			var sdkCall *mock.Call
+			if tc.args[0] == all {
+				sdkCall = sdkMock.On("RemoveAllClientRoleActions", tc.args[2], tc.args[1], tc.args[3], tc.args[4]).Return(tc.sdkErr)
+			} else {
+				sdkCall = sdkMock.On("RemoveClientRoleActions", tc.args[2], tc.args[1], tc.args[3], actions.Actions, tc.args[4]).Return(tc.sdkErr)
+			}
+			out := executeCommand(t, rootCmd, append([]string{"roles", "actions", "delete"}, tc.args...)...)
+
+			switch tc.logType {
+			case okLog:
+				assert.True(t, strings.Contains(out, "ok"), fmt.Sprintf("%s unexpected response: expected success message, got: %v", tc.desc, out))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestAvailableClientRoleActionsCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	actions := []string{"read", "write", "update"}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		actions       []string
+		logType       outputLog
+	}{
+		{
+			desc: "list available actions successfully",
+			args: []string{
+				domainID,
+				token,
+			},
+			actions: actions,
+			logType: entityLog,
+		},
+		{
+			desc: "list available actions with invalid token",
+			args: []string{
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("AvailableClientRoleActions", tc.args[0], tc.args[1]).Return(tc.actions, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "actions", "available-actions"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var acts []string
+				err := json.Unmarshal([]byte(out), &acts)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.actions, acts, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.actions, acts))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestAddClientRoleMembersCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	members := struct {
+		Members []string `json:"members"`
+	}{
+		Members: []string{"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		members       []string
+		logType       outputLog
+	}{
+		{
+			desc: "add members to role successfully",
+			args: []string{
+				`{"members":["5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"]}`,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			members: members.Members,
+			logType: entityLog,
+		},
+		{
+			desc: "add members to role with invalid JSON",
+			args: []string{
+				`{"members":["5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"}`,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("AddClientRoleMembers", tc.args[2], tc.args[1], tc.args[3], tc.members, tc.args[4]).Return(tc.members, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "members", "add"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var members []string
+				err := json.Unmarshal([]byte(out), &members)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.members, members, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.members, members))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestListClientRoleMembersCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	membersPage := smqsdk.RoleMembersPage{
+		Total:  1,
+		Offset: 0,
+		Limit:  10,
+		Members: []string{
+			"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb",
+		},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		members       smqsdk.RoleMembersPage
+		logType       outputLog
+	}{
+		{
+			desc: "list members of role successfully",
+			args: []string{
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			members: membersPage,
+			logType: entityLog,
+		},
+		{
+			desc: "list members of role with invalid token",
+			args: []string{
+				roleID,
+				client.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("ClientRoleMembers", tc.args[1], tc.args[0], tc.args[2], mock.Anything, tc.args[3]).Return(tc.members, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "members", "list"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var members smqsdk.RoleMembersPage
+				err := json.Unmarshal([]byte(out), &members)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.members, members, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.members, members))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestDeleteClientRoleMembersCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	clientsCmd := cli.NewClientsCmd()
+	rootCmd := setFlags(clientsCmd)
+
+	members := struct {
+		Members []string `json:"members"`
+	}{
+		Members: []string{"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		logType       outputLog
+	}{
+		{
+			desc: "delete members from role successfully",
+			args: []string{
+				`{"members":["5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"]}`,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete all members from role successfully",
+			args: []string{
+				all,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete members from role with invalid JSON",
+			args: []string{
+				`{"members":["5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"}`,
+				roleID,
+				client.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			var sdkCall *mock.Call
+			if tc.args[0] == all {
+				sdkCall = sdkMock.On("RemoveAllClientRoleMembers", tc.args[2], tc.args[1], tc.args[3], tc.args[4]).Return(tc.sdkErr)
+			} else {
+				sdkCall = sdkMock.On("RemoveClientRoleMembers", tc.args[2], tc.args[1], tc.args[3], members.Members, tc.args[4]).Return(tc.sdkErr)
+			}
+			out := executeCommand(t, rootCmd, append([]string{"roles", "members", "delete"}, tc.args...)...)
+
+			switch tc.logType {
+			case okLog:
+				assert.True(t, strings.Contains(out, "ok"), fmt.Sprintf("%s unexpected response: expected success message, got: %v", tc.desc, out))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}

cli/commands_test.go

@@ -10,6 +10,7 @@ const (
 	getCmd     = "get"
 	enableCmd  = "enable"
 	disableCmd = "disable"
+	freezeCmd  = "freeze"
 	updCmd     = "update"
 	delCmd     = "delete"
 	rmCmd      = "remove"

cli/domains.go

@@ -152,6 +152,7 @@ var cmdDomains = []cobra.Command{
 			logOKCmd(*cmd)
 		},
 	},
+
 	{
 		Use:   "disable <domain_id> <token>",
 		Short: "Change domain status to disabled",
@@ -171,15 +172,389 @@ var cmdDomains = []cobra.Command{
 			logOKCmd(*cmd)
 		},
 	},
+
+	{
+		Use:   "freeze <domain_id> <token>",
+		Short: "Change domain status to frozen",
+		Long: "Change domain status to frozen\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains freeze <domain_id> <token>\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 2 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			if err := sdk.FreezeDomain(args[0], args[1]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
+}
+
+var cmdDomainRoles = []cobra.Command{
+	{
+		Use:   "create <JSON_role> <domain_id> <user_auth_token>",
+		Short: "Create domain role",
+		Long: "Create role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles create <JSON_role> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles create '{\"role_name\":\"admin\",\"optional_actions\":[\"read\",\"update\"]}' 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 3 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			var roleReq smqsdk.RoleReq
+			if err := json.Unmarshal([]byte(args[0]), &roleReq); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			r, err := sdk.CreateDomainRole(args[1], roleReq, args[2])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			logJSONCmd(*cmd, r)
+		},
+	},
+
+	{
+		Use:   "get [all | <role_id>] <domain_id> <user_auth_token>",
+		Short: "Get roles",
+		Long: "Get roles\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles get all <domain_id> <user_auth_token> - lists all roles\n" +
+			"\tsupermq-cli domains roles get all <domain_id> <user_auth_token> --offset <offset> --limit <limit> - lists all roles with provided offset and limit\n" +
+			"\tsupermq-cli domains roles get <role_id> <domain_id> <user_auth_token> - shows role by role id and domain id\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 3 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			pageMetadata := smqsdk.PageMetadata{
+				Offset: Offset,
+				Limit:  Limit,
+			}
+			if args[0] == all {
+				rs, err := sdk.DomainRoles(args[1], pageMetadata, args[2])
+				if err != nil {
+					logErrorCmd(*cmd, err)
+					return
+				}
+				logJSONCmd(*cmd, rs)
+				return
+			}
+			r, err := sdk.DomainRole(args[0], args[1], args[2])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, r)
+		},
+	},
+
+	{
+		Use:   "update <new_name> <role_id> <domain_id> <user_auth_token>",
+		Short: "Update role name",
+		Long: "Update role name\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles update <new_name> <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles update 'new_name' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			r, err := sdk.UpdateDomainRole(args[2], args[1], args[0], args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, r)
+		},
+	},
+
+	{
+		Use:   "delete <role_id> <domain_id> <user_auth_token>",
+		Short: "Delete role",
+		Long: "Delete role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles delete <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles delete 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 3 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			if err := sdk.DeleteDomainRole(args[1], args[0], args[2]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
+}
+
+var cmdDomainsActions = []cobra.Command{
+	{
+		Use:   "add <JSON_actions> <role_id> <domain_id> <user_auth_token>",
+		Short: "Add actions to role",
+		Long: "Add actions to role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles actions add <JSON_actions> <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles actions add '{\"actions\":[\"read\",\"write\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			actions := struct {
+				Actions []string `json:"actions"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &actions); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			acts, err := sdk.AddDomainRoleActions(args[2], args[1], actions.Actions, args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, acts)
+		},
+	},
+
+	{
+		Use:   "list <role_id> <domain_id> <user_auth_token>",
+		Short: "List actions of role",
+		Long: "List actions of role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles actions list <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles actions list 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 3 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			l, err := sdk.DomainRoleActions(args[1], args[0], args[2])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, l)
+		},
+	},
+
+	{
+		Use:   "delete [all | <JSON_actions>] <role_id> <domain_id> <user_auth_token>",
+		Short: "Delete actions from role",
+		Long: "Delete actions from role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles actions delete <JSON_actions> <role_id> <domain_id> <user_auth_token>\n" +
+			"\tsupermq-cli domains roles actions delete all <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles actions delete '{\"actions\":[\"read\",\"write\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			if args[0] == all {
+				if err := sdk.RemoveAllDomainRoleActions(args[2], args[1], args[3]); err != nil {
+					logErrorCmd(*cmd, err)
+					return
+				}
+				logOKCmd(*cmd)
+				return
+			}
+			actions := struct {
+				Actions []string `json:"actions"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &actions); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			if err := sdk.RemoveDomainRoleActions(args[2], args[1], actions.Actions, args[3]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
+
+	{
+		Use:   "available-actions <user_auth_token>",
+		Short: "List available actions",
+		Long: "List available actions\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles actions available-actions <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles actions available-actions $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 1 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			acts, err := sdk.AvailableDomainRoleActions(args[0])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, acts)
+		},
+	},
+}
+
+var cmdDomainsMembers = []cobra.Command{
+	{
+		Use:   "add <JSON_members> <role_id> <domain_id> <user_auth_token>",
+		Short: "Add members to role",
+		Long: "Add members to role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles members add <JSON_members> <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles members add '{\"members\":[\"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\", \"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			members := struct {
+				Members []string `json:"members"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &members); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			memb, err := sdk.AddDomainRoleMembers(args[2], args[1], members.Members, args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, memb)
+		},
+	},
+
+	{
+		Use:   "list <role_id> <domain_id> <user_auth_token>",
+		Short: "List members of role",
+		Long: "List members of role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles members list <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles members list 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 3 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			pageMetadata := smqsdk.PageMetadata{
+				Offset: Offset,
+				Limit:  Limit,
+			}
+
+			l, err := sdk.DomainRoleMembers(args[1], args[0], pageMetadata, args[2])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, l)
+		},
+	},
+
+	{
+		Use:   "delete [all | <JSON_members>] <role_id> <domain_id> <user_auth_token>",
+		Short: "Delete members from role",
+		Long: "Delete members from role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli domains roles members delete <JSON_members> <role_id> <domain_id> <user_auth_token>\n" +
+			"\tsupermq-cli domains roles members delete all <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli domains roles members delete all 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n" +
+			"\tsupermq-cli domains roles members delete '{\"members\":[\"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\", \"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			if args[0] == all {
+				if err := sdk.RemoveAllDomainRoleMembers(args[2], args[1], args[3]); err != nil {
+					logErrorCmd(*cmd, err)
+					return
+				}
+				logOKCmd(*cmd)
+				return
+			}
+
+			members := struct {
+				Members []string `json:"members"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &members); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			if err := sdk.RemoveDomainRoleMembers(args[2], args[1], members.Members, args[3]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
 }
 
 // NewDomainsCmd returns domains command.
 func NewDomainsCmd() *cobra.Command {
+	actionsCmd := cobra.Command{
+		Use:   "actions [add | list | delete | available-actions]",
+		Short: "Actions management",
+		Long:  "Actions management: add, list, delete actions and list available actions",
+	}
+	for i := range cmdDomainsActions {
+		actionsCmd.AddCommand(&cmdDomainsActions[i])
+	}
+
+	membersCmd := cobra.Command{
+		Use:   "members [add | list | delete]",
+		Short: "Members management",
+		Long:  "Members management: add, list, delete members",
+	}
+	for i := range cmdDomainsMembers {
+		membersCmd.AddCommand(&cmdDomainsMembers[i])
+	}
+
+	rolesCmd := cobra.Command{
+		Use:   "roles [create | get | update | delete | actions | members]",
+		Short: "Roles management",
+		Long:  "Roles management: create, update, retrieve roles and assign/unassign members to roles",
+	}
+
+	rolesCmd.AddCommand(&actionsCmd)
+	rolesCmd.AddCommand(&membersCmd)
+
+	for i := range cmdDomainRoles {
+		rolesCmd.AddCommand(&cmdDomainRoles[i])
+	}
 	cmd := cobra.Command{
 		Use:   "domains [create | get | update | enable | disable | enable | users | assign | unassign]",
 		Short: "Domains management",
 		Long:  `Domains management: create, update, retrieve domains , assign/unassign users to domains and list users of domain"`,
 	}
+	cmd.AddCommand(&rolesCmd)
 
 	for i := range cmdDomains {
 		cmd.AddCommand(&cmdDomains[i])

cli/groups.go

@@ -126,14 +126,370 @@ var cmdGroups = []cobra.Command{
 	},
 }
 
+var cmdGroupsRoles = []cobra.Command{
+	{
+		Use:   "create <JSON_role> <group_id> <domain_id> <user_auth_token>",
+		Short: "Create group role",
+		Long: "Create role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles create <JSON_role> <group_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles create '{\"role_name\":\"admin\",\"optional_actions\":[\"read\",\"update\"]}' 4ef09eff-d500-4d56-b04f-d23a512d6f2a 39f97daf-d6b6-40f4-b229-2697be8006ef $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			var roleReq smqsdk.RoleReq
+			if err := json.Unmarshal([]byte(args[0]), &roleReq); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			r, err := sdk.CreateGroupRole(args[1], args[2], roleReq, args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			logJSONCmd(*cmd, r)
+		},
+	},
+
+	{
+		Use:   "get [all | <role_id>] <group_id>, <domain_id> <user_auth_token>",
+		Short: "Get group roles",
+		Long: "Get group roles\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles get all <group_id> <domain_id> <user_auth_token> - lists all roles\n" +
+			"\tsupermq-cli groups roles get all <group_id> <domain_id> <user_auth_token> --offset <offset> --limit <limit> - lists all roles with provided offset and limit\n" +
+			"\tsupermq-cli groups roles get <role_id> <group_id> <domain_id> <user_auth_token> - shows role by role id and domain id\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			pageMetadata := smqsdk.PageMetadata{
+				Offset: Offset,
+				Limit:  Limit,
+			}
+			if args[0] == all {
+				rs, err := sdk.GroupRoles(args[1], args[2], pageMetadata, args[3])
+				if err != nil {
+					logErrorCmd(*cmd, err)
+					return
+				}
+				logJSONCmd(*cmd, rs)
+				return
+			}
+			r, err := sdk.GroupRole(args[1], args[0], args[2], args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, r)
+		},
+	},
+
+	{
+		Use:   "update <new_name> <role_id> <group_id> <domain_id> <user_auth_token>",
+		Short: "Update group role name",
+		Long: "Update group role name\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles update <new_name> <role_id> <group_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles update new_name 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			r, err := sdk.UpdateGroupRole(args[2], args[1], args[0], args[3], args[4])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, r)
+		},
+	},
+
+	{
+		Use:   "delete <role_id> <group_id> <domain_id> <user_auth_token>",
+		Short: "Delete group role",
+		Long: "Delete group role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles delete <role_id> <group_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles delete 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			if err := sdk.DeleteGroupRole(args[1], args[0], args[2], args[3]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
+}
+
+var cmdGroupsActions = []cobra.Command{
+	{
+		Use:   "add <JSON_actions> <role_id> <group_id> <domain_id> <user_auth_token>",
+		Short: "Add actions to role",
+		Long: "Add actions to role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles actions add <JSON_actions> <role_id> <group_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles actions add '{\"actions\":[\"read\",\"write\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			actions := struct {
+				Actions []string `json:"actions"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &actions); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			acts, err := sdk.AddGroupRoleActions(args[2], args[1], args[3], actions.Actions, args[4])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, acts)
+		},
+	},
+
+	{
+		Use:   "list <role_id> <group_id> <domain_id> <user_auth_token>",
+		Short: "List actions of role",
+		Long: "List actions of role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles actions list <role_id> <group_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles actions list 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+
+			l, err := sdk.GroupRoleActions(args[1], args[0], args[2], args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, l)
+		},
+	},
+
+	{
+		Use:   "delete [all | <JSON_actions>] <role_id> <group_id> <domain_id> <user_auth_token>",
+		Short: "Delete actions from role",
+		Long: "Delete actions from role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles actions delete <JSON_actions> <role_id> <group_id> <domain_id> <user_auth_token>\n" +
+			"\tsupermq-cli groups roles actions delete all <role_id> <group_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles actions delete '{\"actions\":[\"read\",\"write\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			if args[0] == all {
+				if err := sdk.RemoveAllGroupRoleActions(args[2], args[1], args[3], args[4]); err != nil {
+					logErrorCmd(*cmd, err)
+					return
+				}
+				logOKCmd(*cmd)
+				return
+			}
+			actions := struct {
+				Actions []string `json:"actions"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &actions); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			if err := sdk.RemoveGroupRoleActions(args[2], args[1], args[3], actions.Actions, args[4]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
+
+	{
+		Use:   "available-actions <domain_id> <user_auth_token>",
+		Short: "List available actions",
+		Long: "List available actions\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles actions available-actions <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles actions available-actions 39f97daf-d6b6-40f4-b229-2697be8006ef $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 2 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			acts, err := sdk.AvailableGroupRoleActions(args[0], args[1])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, acts)
+		},
+	},
+}
+
+var cmdGroupMembers = []cobra.Command{
+	{
+		Use:   "add <JSON_members> <role_id> <group_id> <domain_id> <user_auth_token>",
+		Short: "Add members to role",
+		Long: "Add members to role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles members add <JSON_members> <role_id> <group_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles members add '{\"members\":[\"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\", \"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			members := struct {
+				Members []string `json:"members"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &members); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			memb, err := sdk.AddGroupRoleMembers(args[2], args[1], args[3], members.Members, args[4])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, memb)
+		},
+	},
+
+	{
+		Use:   "list <role_id> <group_id> <domain_id> <user_auth_token>",
+		Short: "List members of role",
+		Long: "List members of role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles members list <role_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles members list 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 4 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			pageMetadata := smqsdk.PageMetadata{
+				Offset: Offset,
+				Limit:  Limit,
+			}
+
+			l, err := sdk.GroupRoleMembers(args[1], args[0], args[2], pageMetadata, args[3])
+			if err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logJSONCmd(*cmd, l)
+		},
+	},
+
+	{
+		Use:   "delete [all | <JSON_members>] <role_id> <group_id> <domain_id> <user_auth_token>",
+		Short: "Delete members from role",
+		Long: "Delete members from role\n" +
+			"Usage:\n" +
+			"\tsupermq-cli groups roles members delete <JSON_members> <role_id> <group_id> <domain_id> <user_auth_token>\n" +
+			"\tsupermq-cli groups roles members delete all <role_id> <group_id> <domain_id> <user_auth_token>\n" +
+			"For example:\n" +
+			"\tsupermq-cli groups roles members delete all 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n" +
+			"\tsupermq-cli groups roles members delete '{\"members\":[\"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\", \"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb\"]}' 39f97daf-d6b6-40f4-b229-2697be8006ef 4ef09eff-d500-4d56-b04f-d23a512d6f2a 4ef09eff-d500-4d56-b04f-d23a512d6f2a $USER_AUTH_TOKEN\n",
+		Run: func(cmd *cobra.Command, args []string) {
+			if len(args) != 5 {
+				logUsageCmd(*cmd, cmd.Use)
+				return
+			}
+			if args[0] == all {
+				if err := sdk.RemoveAllGroupRoleMembers(args[2], args[1], args[3], args[4]); err != nil {
+					logErrorCmd(*cmd, err)
+					return
+				}
+				logOKCmd(*cmd)
+				return
+			}
+
+			members := struct {
+				Members []string `json:"members"`
+			}{}
+			if err := json.Unmarshal([]byte(args[0]), &members); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+
+			if err := sdk.RemoveGroupRoleMembers(args[2], args[1], args[3], members.Members, args[4]); err != nil {
+				logErrorCmd(*cmd, err)
+				return
+			}
+			logOKCmd(*cmd)
+		},
+	},
+}
+
 // NewGroupsCmd returns users command.
 func NewGroupsCmd() *cobra.Command {
+	actionsCmd := cobra.Command{
+		Use:   "actions [add | list | delete | available-actions]",
+		Short: "Actions management",
+		Long:  "Actions management: add, list, delete actions and list available actions",
+	}
+	for i := range cmdGroupsActions {
+		actionsCmd.AddCommand(&cmdGroupsActions[i])
+	}
+
+	membersCmd := cobra.Command{
+		Use:   "members [add | list | delete]",
+		Short: "Members management",
+		Long:  "Members management: add, list, delete members",
+	}
+	for i := range cmdGroupMembers {
+		membersCmd.AddCommand(&cmdGroupMembers[i])
+	}
+
+	rolesCmd := cobra.Command{
+		Use:   "roles [create | get | update | delete | actions | members]",
+		Short: "Roles management",
+		Long:  "Roles management: create, update, retrieve roles and assign/unassign members to roles",
+	}
+
+	rolesCmd.AddCommand(&actionsCmd)
+	rolesCmd.AddCommand(&membersCmd)
+
+	for i := range cmdGroupsRoles {
+		rolesCmd.AddCommand(&cmdGroupsRoles[i])
+	}
+
 	cmd := cobra.Command{
 		Use:   "groups [create | get | update | delete | assign | unassign | users | channels ]",
 		Short: "Groups management",
 		Long:  `Groups management: create, update, delete group and assign and unassign member to groups"`,
 	}
 
+	cmd.AddCommand(&rolesCmd)
+
 	for i := range cmdGroups {
 		cmd.AddCommand(&cmdGroups[i])
 	}

cli/groups_test.go

@@ -14,13 +14,13 @@ import (
 	"github.com/absmach/supermq/internal/testsutil"
 	"github.com/absmach/supermq/pkg/errors"
 	svcerr "github.com/absmach/supermq/pkg/errors/service"
-	mgsdk "github.com/absmach/supermq/pkg/sdk"
+	smqsdk "github.com/absmach/supermq/pkg/sdk"
 	sdkmocks "github.com/absmach/supermq/pkg/sdk/mocks"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 )
 
-var group = mgsdk.Group{
+var group = smqsdk.Group{
 	ID:   testsutil.GenerateUUID(&testing.T{}),
 	Name: "testgroup",
 }
@@ -32,12 +32,12 @@ func TestCreateGroupCmd(t *testing.T) {
 	groupCmd := cli.NewGroupsCmd()
 	rootCmd := setFlags(groupCmd)
 
-	gp := mgsdk.Group{}
+	gp := smqsdk.Group{}
 	cases := []struct {
 		desc          string
 		args          []string
 		logType       outputLog
-		group         mgsdk.Group
+		group         smqsdk.Group
 		sdkErr        errors.SDKError
 		errLogMessage string
 	}{
@@ -200,7 +200,7 @@ func TestUpdategroupCmd(t *testing.T) {
 	cases := []struct {
 		desc          string
 		args          []string
-		group         mgsdk.Group
+		group         smqsdk.Group
 		sdkErr        errors.SDKError
 		errLogMessage string
 		logType       outputLog
@@ -212,7 +212,7 @@ func TestUpdategroupCmd(t *testing.T) {
 				domainID,
 				token,
 			},
-			group: mgsdk.Group{
+			group: smqsdk.Group{
 				Name: "newgroup1",
 				ID:   group.ID,
 			},
@@ -253,7 +253,7 @@ func TestUpdategroupCmd(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.desc, func(t *testing.T) {
-			var ch mgsdk.Group
+			var ch smqsdk.Group
 			sdkCall := sdkMock.On("UpdateGroup", mock.Anything, tc.args[1], tc.args[2]).Return(tc.group, tc.sdkErr)
 			out := executeCommand(t, rootCmd, append([]string{updCmd}, tc.args...)...)
 
@@ -277,14 +277,14 @@ func TestEnablegroupCmd(t *testing.T) {
 	cli.SetSDK(sdkMock)
 	groupCmd := cli.NewGroupsCmd()
 	rootCmd := setFlags(groupCmd)
-	var ch mgsdk.Group
+	var ch smqsdk.Group
 
 	cases := []struct {
 		desc          string
 		args          []string
 		sdkErr        errors.SDKError
 		errLogMessage string
-		group         mgsdk.Group
+		group         smqsdk.Group
 		logType       outputLog
 	}{
 		{
@@ -358,14 +358,14 @@ func TestDisablegroupCmd(t *testing.T) {
 	groupsCmd := cli.NewGroupsCmd()
 	rootCmd := setFlags(groupsCmd)
 
-	var ch mgsdk.Group
+	var ch smqsdk.Group
 
 	cases := []struct {
 		desc          string
 		args          []string
 		sdkErr        errors.SDKError
 		errLogMessage string
-		group         mgsdk.Group
+		group         smqsdk.Group
 		logType       outputLog
 	}{
 		{
@@ -401,7 +401,7 @@ func TestDisablegroupCmd(t *testing.T) {
 			logType:       errLog,
 		},
 		{
-			desc: "disable client with invalid args",
+			desc: "disable group with invalid args",
 			args: []string{
 				group.ID,
 				domainID,
@@ -434,3 +434,742 @@ func TestDisablegroupCmd(t *testing.T) {
 		})
 	}
 }
+
+func TestCreateGroupRoleCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	roleReq := smqsdk.RoleReq{
+		RoleName:        "admin",
+		OptionalActions: []string{"read", "update"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		role          smqsdk.Role
+		logType       outputLog
+	}{
+		{
+			desc: "create group role successfully",
+			args: []string{
+				`{"role_name":"admin","optional_actions":["read","update"]}`,
+				group.ID,
+				domainID,
+				token,
+			},
+			role: smqsdk.Role{
+				ID:              testsutil.GenerateUUID(&testing.T{}),
+				Name:            "admin",
+				OptionalActions: []string{"read", "update"},
+			},
+			logType: entityLog,
+		},
+		{
+			desc: "create group role with invalid JSON",
+			args: []string{
+				`{"role_name":"admin","optional_actions":["read","update"}`,
+				group.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("CreateGroupRole", tc.args[1], tc.args[2], roleReq, tc.args[3]).Return(tc.role, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "create"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var role smqsdk.Role
+				err := json.Unmarshal([]byte(out), &role)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.role, role, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.role, role))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestGetGroupRolesCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	role := smqsdk.Role{
+		ID:              testsutil.GenerateUUID(&testing.T{}),
+		Name:            "admin",
+		OptionalActions: []string{"read", "update"},
+	}
+	rolesPage := smqsdk.RolesPage{
+		Total:  1,
+		Offset: 0,
+		Limit:  10,
+		Roles:  []smqsdk.Role{role},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		roles         smqsdk.RolesPage
+		logType       outputLog
+	}{
+		{
+			desc: "get all group roles successfully",
+			args: []string{
+				all,
+				group.ID,
+				domainID,
+				token,
+			},
+			roles:   rolesPage,
+			logType: entityLog,
+		},
+		{
+			desc: "get group roles with invalid token",
+			args: []string{
+				all,
+				group.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("GroupRoles", tc.args[1], tc.args[2], mock.Anything, tc.args[3]).Return(tc.roles, tc.sdkErr)
+			if tc.args[0] != all {
+				sdkCall = sdkMock.On("GroupRole", tc.args[1], tc.args[0], tc.args[2], tc.args[3]).Return(role, tc.sdkErr)
+			}
+			out := executeCommand(t, rootCmd, append([]string{"roles", "get"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var roles smqsdk.RolesPage
+				err := json.Unmarshal([]byte(out), &roles)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.roles, roles, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.roles, roles))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestUpdateGroupRoleCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	role := smqsdk.Role{
+		ID:              testsutil.GenerateUUID(&testing.T{}),
+		Name:            "new_name",
+		OptionalActions: []string{"read", "update"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		role          smqsdk.Role
+		logType       outputLog
+	}{
+		{
+			desc: "update group role name successfully",
+			args: []string{
+				"new_name",
+				role.ID,
+				group.ID,
+				domainID,
+				token,
+			},
+			role:    role,
+			logType: entityLog,
+		},
+		{
+			desc: "update group role name with invalid token",
+			args: []string{
+				"new_name",
+				role.ID,
+				group.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("UpdateGroupRole", tc.args[2], tc.args[1], tc.args[0], tc.args[3], tc.args[4]).Return(tc.role, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "update"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var role smqsdk.Role
+				err := json.Unmarshal([]byte(out), &role)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.role, role, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.role, role))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestDeleteGroupRoleCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		logType       outputLog
+	}{
+		{
+			desc: "delete group role successfully",
+			args: []string{
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete group role with invalid token",
+			args: []string{
+				roleID,
+				group.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("DeleteGroupRole", tc.args[1], tc.args[0], tc.args[2], tc.args[3]).Return(tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "delete"}, tc.args...)...)
+
+			switch tc.logType {
+			case okLog:
+				assert.True(t, strings.Contains(out, "ok"), fmt.Sprintf("%s unexpected response: expected success message, got: %v", tc.desc, out))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestAddGroupRoleActionsCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	actions := struct {
+		Actions []string `json:"actions"`
+	}{
+		Actions: []string{"read", "write"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		actions       []string
+		logType       outputLog
+	}{
+		{
+			desc: "add actions to role successfully",
+			args: []string{
+				`{"actions":["read","write"]}`,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			actions: actions.Actions,
+			logType: entityLog,
+		},
+		{
+			desc: "add actions to role with invalid JSON",
+			args: []string{
+				`{"actions":["read","write"}`,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("AddGroupRoleActions", tc.args[2], tc.args[1], tc.args[3], tc.actions, tc.args[4]).Return(tc.actions, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "actions", "add"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var acts []string
+				err := json.Unmarshal([]byte(out), &acts)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.actions, acts, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.actions, acts))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestListGroupRoleActionsCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	actions := []string{"read", "write"}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		actions       []string
+		logType       outputLog
+	}{
+		{
+			desc: "list actions of role successfully",
+			args: []string{
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			actions: actions,
+			logType: entityLog,
+		},
+		{
+			desc: "list actions of role with invalid token",
+			args: []string{
+				roleID,
+				group.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("GroupRoleActions", tc.args[1], tc.args[0], tc.args[2], tc.args[3]).Return(tc.actions, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "actions", "list"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var acts []string
+				err := json.Unmarshal([]byte(out), &acts)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.actions, acts, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.actions, acts))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestDeleteGroupRoleActionsCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	actions := struct {
+		Actions []string `json:"actions"`
+	}{
+		Actions: []string{"read", "write"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		logType       outputLog
+	}{
+		{
+			desc: "delete actions from role successfully",
+			args: []string{
+				`{"actions":["read","write"]}`,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete all actions from role successfully",
+			args: []string{
+				all,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete actions from role with invalid JSON",
+			args: []string{
+				`{"actions":["read","write"}`,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			var sdkCall *mock.Call
+			if tc.args[0] == all {
+				sdkCall = sdkMock.On("RemoveAllGroupRoleActions", tc.args[2], tc.args[1], tc.args[3], tc.args[4]).Return(tc.sdkErr)
+			} else {
+				sdkCall = sdkMock.On("RemoveGroupRoleActions", tc.args[2], tc.args[1], tc.args[3], actions.Actions, tc.args[4]).Return(tc.sdkErr)
+			}
+			out := executeCommand(t, rootCmd, append([]string{"roles", "actions", "delete"}, tc.args...)...)
+
+			switch tc.logType {
+			case okLog:
+				assert.True(t, strings.Contains(out, "ok"), fmt.Sprintf("%s unexpected response: expected success message, got: %v", tc.desc, out))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestAvailableGroupRoleActionsCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	actions := []string{"read", "write", "update"}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		actions       []string
+		logType       outputLog
+	}{
+		{
+			desc: "list available actions successfully",
+			args: []string{
+				domainID,
+				token,
+			},
+			actions: actions,
+			logType: entityLog,
+		},
+		{
+			desc: "list available actions with invalid token",
+			args: []string{
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("AvailableGroupRoleActions", tc.args[0], tc.args[1]).Return(tc.actions, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "actions", "available-actions"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var acts []string
+				err := json.Unmarshal([]byte(out), &acts)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.actions, acts, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.actions, acts))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestAddGroupRoleMembersCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	members := struct {
+		Members []string `json:"members"`
+	}{
+		Members: []string{"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		members       []string
+		logType       outputLog
+	}{
+		{
+			desc: "add members to role successfully",
+			args: []string{
+				`{"members":["5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"]}`,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			members: members.Members,
+			logType: entityLog,
+		},
+		{
+			desc: "add members to role with invalid JSON",
+			args: []string{
+				`{"members":["5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"}`,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("AddGroupRoleMembers", tc.args[2], tc.args[1], tc.args[3], tc.members, tc.args[4]).Return(tc.members, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "members", "add"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var members []string
+				err := json.Unmarshal([]byte(out), &members)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.members, members, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.members, members))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestListGroupRoleMembersCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	membersPage := smqsdk.RoleMembersPage{
+		Total:  1,
+		Offset: 0,
+		Limit:  10,
+		Members: []string{
+			"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb",
+		},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		members       smqsdk.RoleMembersPage
+		logType       outputLog
+	}{
+		{
+			desc: "list members of role successfully",
+			args: []string{
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			members: membersPage,
+			logType: entityLog,
+		},
+		{
+			desc: "list members of role with invalid token",
+			args: []string{
+				roleID,
+				group.ID,
+				domainID,
+				invalidToken,
+			},
+			sdkErr:        errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.NewSDKErrorWithStatus(svcerr.ErrAuthorization, http.StatusForbidden)),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			sdkCall := sdkMock.On("GroupRoleMembers", tc.args[1], tc.args[0], tc.args[2], mock.Anything, tc.args[3]).Return(tc.members, tc.sdkErr)
+			out := executeCommand(t, rootCmd, append([]string{"roles", "members", "list"}, tc.args...)...)
+
+			switch tc.logType {
+			case entityLog:
+				var members smqsdk.RoleMembersPage
+				err := json.Unmarshal([]byte(out), &members)
+				assert.Nil(t, err)
+				assert.Equal(t, tc.members, members, fmt.Sprintf("%s unexpected response: expected: %v, got: %v", tc.desc, tc.members, members))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}
+
+func TestDeleteGroupRoleMembersCmd(t *testing.T) {
+	sdkMock := new(sdkmocks.SDK)
+	cli.SetSDK(sdkMock)
+	groupsCmd := cli.NewGroupsCmd()
+	rootCmd := setFlags(groupsCmd)
+
+	members := struct {
+		Members []string `json:"members"`
+	}{
+		Members: []string{"5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"},
+	}
+
+	cases := []struct {
+		desc          string
+		args          []string
+		sdkErr        errors.SDKError
+		errLogMessage string
+		logType       outputLog
+	}{
+		{
+			desc: "delete members from role successfully",
+			args: []string{
+				`{"members":["5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"]}`,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete all members from role successfully",
+			args: []string{
+				all,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			logType: okLog,
+		},
+		{
+			desc: "delete members from role with invalid JSON",
+			args: []string{
+				`{"members":["5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb", "5dc1ce4b-7cc9-4f12-98a6-9d74cc4980bb"}`,
+				roleID,
+				group.ID,
+				domainID,
+				token,
+			},
+			sdkErr:        errors.NewSDKError(errors.New("invalid character '}' after array element")),
+			errLogMessage: fmt.Sprintf("\nerror: %s\n\n", errors.New("invalid character '}' after array element")),
+			logType:       errLog,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			var sdkCall *mock.Call
+			if tc.args[0] == all {
+				sdkCall = sdkMock.On("RemoveAllGroupRoleMembers", tc.args[2], tc.args[1], tc.args[3], tc.args[4]).Return(tc.sdkErr)
+			} else {
+				sdkCall = sdkMock.On("RemoveGroupRoleMembers", tc.args[2], tc.args[1], tc.args[3], members.Members, tc.args[4]).Return(tc.sdkErr)
+			}
+			out := executeCommand(t, rootCmd, append([]string{"roles", "members", "delete"}, tc.args...)...)
+
+			switch tc.logType {
+			case okLog:
+				assert.True(t, strings.Contains(out, "ok"), fmt.Sprintf("%s unexpected response: expected success message, got: %v", tc.desc, out))
+			case errLog:
+				assert.Equal(t, tc.errLogMessage, out, fmt.Sprintf("%s unexpected error response: expected %s got errLogMessage:%s", tc.desc, tc.errLogMessage, out))
+			}
+
+			sdkCall.Unset()
+		})
+	}
+}