The ordering for this should be allowed on 

Group like -> group.name

Users like -> user.username 

Roles like -> role.created

Last modified field

Acceptance Criteria

  —
  AC1: Valid Group Ordering Fields

  Given a user requests role bindings with a valid group ordering field
  When the request includes order_by with any of: group.name, group.description, group.user_count, group.uuid, group.created, group.modified
  Then the response returns 200 OK with results ordered by the specified field
  —
  AC2: Valid Role Ordering Fields

  Given a user requests role bindings with a valid role ordering field
  When the request includes order_by with any of: role.name, role.uuid, role.created, role.modified
  Then the response returns 200 OK with results ordered by the specified field

  —
  AC3: Descending Order Support

  Given a user requests role bindings with a descending order prefix
  When the request includes order_by prefixed with - (e.g., -group.name, -role.modified)
  Then the response returns 200 OK with results in descending order

  —
  AC4: Multiple Ordering Fields (Comma-Separated)

  Given a user requests role bindings with multiple ordering fields
  When the request includes comma-separated fields (e.g., order_by=group.name,-group.modified)
  Then the response returns 200 OK with results ordered by first field, then second field

  —
  AC5: Multiple Ordering Fields (Multiple Parameters)

  Given a user requests role bindings with multiple order_by parameters
  When the request includes multiple params (e.g., order_by=group.name&order_by=-group.modified)
  Then the response returns 200 OK with results ordered by all specified fields in order

  —
  AC6: Invalid Direct Field Names Rejected

  Given a user requests role bindings with a direct field name (no dot notation)
  When the request includes order_by=name or order_by=modified (without group. or role. prefix)
  Then the response returns 400 Bad Request with error message indicating invalid field

  —
  AC7: Unknown Dot Notation Fields Rejected

  Given a user requests role bindings with an unknown dot notation field
  When the request includes order_by=foo.bar or order_by=group.invalid
  Then the response returns 400 Bad Request with error message listing valid fields

  —
  AC8: Mixed Valid and Invalid Fields Rejected

  Given a user requests role bindings with a mix of valid and invalid fields
  When the request includes order_by=group.name,invalid_field
  Then the response returns 400 Bad Request with error message for the invalid field

  —
  AC9: Default Ordering When No order_by Provided

  Given a user requests role bindings without an order_by parameter
  When the request omits order_by
  Then the response returns 200 OK with results ordered by -modified (default)

  —
  AC10: Empty order_by Uses Default

  Given a user requests role bindings with an empty order_by parameter
  When the request includes order_by= (empty value)
  Then the response returns 200 OK with results ordered by -modified (default)

  —
  Test Data Requirements

  - Workspace with multiple groups assigned via role bindings
  - Groups with varying names, user counts, and timestamps
  - Multiple roles with different names and timestamps

  Valid Fields Reference

  group.name, group.description, group.user_count, group.uuid, group.created, group.modified
  role.name, role.uuid, role.created, role.modified