From 2f10b3637e2c23d80d1a262f0a3fc6ae0789e18b Mon Sep 17 00:00:00 2001 From: William Phetsinorath Date: Tue, 29 Sep 2026 15:06:57 +0200 Subject: [PATCH] =?UTF-8?q?feat(server-nestjs):=20add=20S=C3=A9curit=C3=A9?= =?UTF-8?q?=20Plateforme=20admin=20role?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ADR-014 defines the only platform administration Keycloak groups as /console/admin, /console/readonly and /console/security. The console ships AdminRole rows for the first two only, while every plugin module (gitlab auditor, argocd platform security, nexus read, registry guest, sonarqube security) already targets '/console/security': the platform security group is therefore never created, synced or resolvable from the database. Add an idempotent migration inserting the 'Sécurité Plateforme' system:managed role (position 3, permissions 1 = ADMIN_PERMS.LIST for the *-RO scope of ADR-014, oidcGroup '/console/security'), mirroring the project-side Sécurité backfill (20260908155700_add_security_role). Refs #2792 Co-authored-by: Automata Signed-off-by: William Phetsinorath Change-Id: Iac69ae508f7e6162d33c602aff4a1bfb6a6a6964 --- .../migration.sql | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 apps/server-nestjs/src/prisma/migrations/20260929130657_add_security_admin_role/migration.sql diff --git a/apps/server-nestjs/src/prisma/migrations/20260929130657_add_security_admin_role/migration.sql b/apps/server-nestjs/src/prisma/migrations/20260929130657_add_security_admin_role/migration.sql new file mode 100644 index 0000000000..792647f9ae --- /dev/null +++ b/apps/server-nestjs/src/prisma/migrations/20260929130657_add_security_admin_role/migration.sql @@ -0,0 +1,13 @@ +INSERT INTO "AdminRole" ("id", "name", "permissions", "position", "oidcGroup", "type") +SELECT + '487450e6-3265-4df2-8581-8e39b0cecc5d'::uuid, + 'Sécurité Plateforme', + 1, + 3, + '/console/security', + 'system:managed' +WHERE NOT EXISTS ( + SELECT 1 FROM "AdminRole" + WHERE "oidcGroup" = '/console/security' + OR "id" = '487450e6-3265-4df2-8581-8e39b0cecc5d'::uuid +);