From deb70f093a82df833db2d2d7be37ca78c2d23bf4 Mon Sep 17 00:00:00 2001 From: William Phetsinorath Date: Tue, 8 Sep 2026 17:55:27 +0200 Subject: [PATCH] =?UTF-8?q?feat(server-nestjs):=20backfill=20S=C3=A9curit?= =?UTF-8?q?=C3=A9=20project=20role=20on=20existing=20projects=20The=20S?= =?UTF-8?q?=C3=A9curit=C3=A9=20role=20is=20only=20seeded=20for=20newly=20c?= =?UTF-8?q?reated=20projects=20(see=20#2677):=20projects=20created=20befor?= =?UTF-8?q?e=20the=20role=20existed=20never=20get=20it.=20Add=20a=20migrat?= =?UTF-8?q?ion=20inserting=20the=20missing=20'S=C3=A9curit=C3=A9'=20system?= =?UTF-8?q?:managed=20role=20(position=204,=20permissions=20832=20=3D=20SE?= =?UTF-8?q?E=5FSECRETS=20|=20LIST=5FENVIRONMENTS=20|=20LIST=5FREPOSITORIES?= =?UTF-8?q?,=20oidcGroup=20'//console/security')=20for=20every=20pro?= =?UTF-8?q?ject=20that=20does=20not=20have=20it=20yet,=20mirroring=20gener?= =?UTF-8?q?ateProjectCreateInput.=20The=20insert=20is=20idempotent=20(anti?= =?UTF-8?q?-join=20on=20slug+oidcGroup+position)=20so=20existing=20custom?= =?UTF-8?q?=20roles=20at=20position=204=20are=20left=20untouched=20and=20r?= =?UTF-8?q?etries=20never=20duplicate.=20Refs=20#2676?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: William Phetsinorath Change-Id: I397eac570291a5959dfdca423da721506a6a6964 --- .../migration.sql | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 apps/server-nestjs/src/prisma/migrations/20260908155700_add_security_role/migration.sql diff --git a/apps/server-nestjs/src/prisma/migrations/20260908155700_add_security_role/migration.sql b/apps/server-nestjs/src/prisma/migrations/20260908155700_add_security_role/migration.sql new file mode 100644 index 0000000000..911fac7f3f --- /dev/null +++ b/apps/server-nestjs/src/prisma/migrations/20260908155700_add_security_role/migration.sql @@ -0,0 +1,24 @@ +-- Backfill the project system role 'Sécurité' on existing projects. +-- Mirrors the TS seeding in project.utils.ts (generateProjectCreateInput): +-- permissions 832 = SEE_SECRETS(64) | LIST_ENVIRONMENTS(256) | LIST_REPOSITORIES(512) +-- position 4 (after Lecture seule), oidcGroup = '//console/security' +-- Anti-join on slug+position makes the INSERT idempotent: a retry after a +-- partial failure, or a project that already has the role, is a no-op. + +INSERT INTO "ProjectRole" ("id", "name", "permissions", "projectId", "position", "oidcGroup", "type") +SELECT + gen_random_uuid(), + 'Sécurité', + 832, -- SEE_SECRETS(64) | LIST_ENVIRONMENTS(256) | LIST_REPOSITORIES(512) + p."id", + 4, + '/' || p."slug" || '/console/security', + 'system:managed' +FROM "Project" p +WHERE NOT EXISTS ( + SELECT 1 + FROM "ProjectRole" r + WHERE r."projectId" = p."id" + AND r."position" = 4 + AND r."oidcGroup" = '/' || p."slug" || '/console/security' +);