trufnetwork · MicBun · Jun 10, 2025 · Jun 10, 2025
diff --git a/internal/migrations/013-role-actions.sql b/internal/migrations/013-role-actions.sql
@@ -230,4 +230,34 @@ CREATE OR REPLACE ACTION are_members_of(
     LEFT JOIN role_members rm ON rm.owner = $owner
                              AND rm.role_name = $role_name
                              AND rm.wallet = a.wallet;
+};
+
+CREATE OR REPLACE ACTION list_role_members(
+    $owner TEXT,
+    $role_name TEXT,
+    $limit INT,
+    $offset INT
+) PUBLIC VIEW RETURNS TABLE (wallet TEXT, granted_at INT8, granted_by TEXT) {
+    $owner := LOWER($owner);
+    $role_name := LOWER($role_name);
+
+    helper_assert_owner_addr($owner);
+    helper_assert_role_exists($owner, $role_name);
+
+    -- Enforce sensible defaults and bounds for pagination
+    IF $limit IS NULL OR $limit <= 0 {
+        $limit := 100;
+    }
+    IF $offset IS NULL OR $offset < 0 {
+        $offset := 0;
+    }
+
+    RETURN SELECT wallet,
+                  granted_at,
+                  granted_by
+           FROM role_members
+           WHERE owner = $owner
+             AND role_name = $role_name
+           ORDER BY granted_at ASC
+           LIMIT $limit OFFSET $offset;
 };
diff --git a/tests/streams/roles/role_management_test.go b/tests/streams/roles/role_management_test.go
@@ -152,6 +152,16 @@ func testRoleManagement(t *testing.T, ctx context.Context, platform *kwilTesting
 		require.True(t, members[wallet3], "Wallet3 should still be a member")
 	})
 
+	// Test 5: List role members returns correct slice
+	t.Run("List role members", func(t *testing.T) {
+		wallets, err := procedure.ListRoleMembers(ctx, procedure.ListRoleMembersInput{Platform: platform, Owner: roleOwner, RoleName: roleName})
+		require.NoError(t, err)
+		// Expecting wallet1 and wallet3 (wallet2 revoked)
+		require.Contains(t, wallets, wallet1)
+		require.Contains(t, wallets, wallet3)
+		require.NotContains(t, wallets, wallet2)
+	})
+
 	t.Run("Case insensitivity is handled correctly", func(t *testing.T) {
 		const upperCaseRole = "CASE_TEST_ROLE"
 		const lowerCaseRole = "case_test_role"

diff --git a/tests/streams/utils/procedure/roles.go b/tests/streams/utils/procedure/roles.go
@@ -146,3 +146,43 @@ func SetRoleManager(ctx context.Context, input SetRoleManagerInput) error {
 	}
 	return nil
 }
+
+func ListRoleMembers(ctx context.Context, input ListRoleMembersInput) ([]string, error) {
+	deployer, err := util.NewEthereumAddressFromBytes(input.Platform.Deployer)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create Ethereum address from deployer bytes for ListRoleMembers")
+	}
+
+	txContext := &common.TxContext{
+		Ctx:          ctx,
+		BlockContext: &common.BlockContext{Height: 0},
+		TxID:         input.Platform.Txid(),
+		Signer:       input.Platform.Deployer,
+		Caller:       deployer.Address(),
+	}
+
+	engineContext := &common.EngineContext{TxContext: txContext}
+
+	// capture wallets
+	var wallets []string
+
+	r, err := input.Platform.Engine.Call(engineContext, input.Platform.DB, "", "list_role_members", []any{input.Owner, input.RoleName, nil, nil}, func(row *common.Row) error {
+		if len(row.Values) < 1 {
+			return fmt.Errorf("unexpected row values length: %d", len(row.Values))
+		}
+		w, ok := row.Values[0].(string)
+		if !ok {
+			return fmt.Errorf("expected wallet string, got %T", row.Values[0])
+		}
+		wallets = append(wallets, w)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	if r.Error != nil {
+		return nil, r.Error
+	}
+
+	return wallets, nil
+}
diff --git a/tests/streams/utils/procedure/types.go b/tests/streams/utils/procedure/types.go
@@ -129,3 +129,9 @@ type RemoveRoleManagersInput struct {
 	RoleName       string
 	ManagerWallets []string
 }
+
+type ListRoleMembersInput struct {
+	Platform *kwilTesting.Platform
+	Owner    string
+	RoleName string
+}