From 55d4ae467fbd6fb7cdd16b4759724657edce3a2c Mon Sep 17 00:00:00 2001 From: William Phetsinorath Date: Mon, 7 Sep 2026 16:57:01 +0200 Subject: [PATCH] fix(server-nestjs): backfill default system roles on roleless projects MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Projects created before generateProjectCreateInput seeded the four default project roles have no ProjectRole rows: members hold no permissions and the Keycloak OIDC groups are absent. Insert Administrateur (2), DevOps (984), Développeur (784) and Lecture seule (768) with system:managed type and slug-derived oidcGroup, mirroring generateProjectCreateInput, only into projects owning zero roles. Projects with any existing role are left untouched and the insert is idempotent. Refs #2684 Signed-off-by: William Phetsinorath Change-Id: I520cf59e2d3fc2d59b64df4441a571b26a6a6964 --- .../migration.sql | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 apps/server-nestjs/src/prisma/migrations/20260907170000_backfill_project_roles/migration.sql diff --git a/apps/server-nestjs/src/prisma/migrations/20260907170000_backfill_project_roles/migration.sql b/apps/server-nestjs/src/prisma/migrations/20260907170000_backfill_project_roles/migration.sql new file mode 100644 index 0000000000..4abc374034 --- /dev/null +++ b/apps/server-nestjs/src/prisma/migrations/20260907170000_backfill_project_roles/migration.sql @@ -0,0 +1,26 @@ +-- Backfill the 4 default system roles on projects that have none. +-- Mirrors generateProjectCreateInput (apps/server-nestjs/src/modules/project/project.utils.ts): +-- Administrateur = MANAGE = 2 +-- DevOps = MANAGE_ENVIRONMENTS | MANAGE_REPOSITORIES | REPLAY_HOOKS +-- | SEE_SECRETS | LIST_ENVIRONMENTS | LIST_REPOSITORIES = 984 +-- Développeur = MANAGE_REPOSITORIES | LIST_ENVIRONMENTS | LIST_REPOSITORIES = 784 +-- Lecture seule = LIST_ENVIRONMENTS | LIST_REPOSITORIES = 768 +INSERT INTO "ProjectRole" ("id", "name", "permissions", "position", "oidcGroup", "type", "projectId") +SELECT + gen_random_uuid(), + r."name", + r."permissions", + r."position", + '/' || p."slug" || r."groupSuffix", + 'system:managed', + p."id" +FROM "Project" p +CROSS JOIN (VALUES + ('Administrateur', 2::bigint, 0, '/console/admin'), + ('DevOps', 984::bigint, 1, '/console/devops'), + ('Développeur', 784::bigint, 2, '/console/developer'), + ('Lecture seule', 768::bigint, 3, '/console/readonly') +) AS r("name", "permissions", "position", "groupSuffix") +WHERE NOT EXISTS ( + SELECT 1 FROM "ProjectRole" existing WHERE existing."projectId" = p."id" +);