From f3b7ebf6d8029113046f228a2015dd1419780e22 Mon Sep 17 00:00:00 2001 From: William Phetsinorath Date: Mon, 5 Oct 2026 11:54:13 +0200 Subject: [PATCH] fix(server): backport role backfill migrations to the apps/server tree The three role backfills (20260907170000_backfill_project_roles, 20260908155700_add_security_role, 20260929130657_add_security_admin_role) only existed in apps/server-nestjs, but the production prestart deploys from apps/server/src/prisma/migrations, so existing instances never received them. Port the three migrations verbatim under the same names: identical SQL means a database already backfilled via the nestjs tree is untouched (anti-joins are no-ops) and both trees converge on the same AdminRole id. Closes #2812 Co-authored-by: Automata Signed-off-by: William Phetsinorath Change-Id: I05da2a441ea12222afc741a48e0772aa6a6a6964 --- .../migration.sql | 26 +++++++++++++++++++ .../migration.sql | 24 +++++++++++++++++ .../migration.sql | 13 ++++++++++ 3 files changed, 63 insertions(+) create mode 100644 apps/server/src/prisma/migrations/20260907170000_backfill_project_roles/migration.sql create mode 100644 apps/server/src/prisma/migrations/20260908155700_add_security_role/migration.sql create mode 100644 apps/server/src/prisma/migrations/20260929130657_add_security_admin_role/migration.sql diff --git a/apps/server/src/prisma/migrations/20260907170000_backfill_project_roles/migration.sql b/apps/server/src/prisma/migrations/20260907170000_backfill_project_roles/migration.sql new file mode 100644 index 0000000000..4abc374034 --- /dev/null +++ b/apps/server/src/prisma/migrations/20260907170000_backfill_project_roles/migration.sql @@ -0,0 +1,26 @@ +-- Backfill the 4 default system roles on projects that have none. +-- Mirrors generateProjectCreateInput (apps/server-nestjs/src/modules/project/project.utils.ts): +-- Administrateur = MANAGE = 2 +-- DevOps = MANAGE_ENVIRONMENTS | MANAGE_REPOSITORIES | REPLAY_HOOKS +-- | SEE_SECRETS | LIST_ENVIRONMENTS | LIST_REPOSITORIES = 984 +-- Développeur = MANAGE_REPOSITORIES | LIST_ENVIRONMENTS | LIST_REPOSITORIES = 784 +-- Lecture seule = LIST_ENVIRONMENTS | LIST_REPOSITORIES = 768 +INSERT INTO "ProjectRole" ("id", "name", "permissions", "position", "oidcGroup", "type", "projectId") +SELECT + gen_random_uuid(), + r."name", + r."permissions", + r."position", + '/' || p."slug" || r."groupSuffix", + 'system:managed', + p."id" +FROM "Project" p +CROSS JOIN (VALUES + ('Administrateur', 2::bigint, 0, '/console/admin'), + ('DevOps', 984::bigint, 1, '/console/devops'), + ('Développeur', 784::bigint, 2, '/console/developer'), + ('Lecture seule', 768::bigint, 3, '/console/readonly') +) AS r("name", "permissions", "position", "groupSuffix") +WHERE NOT EXISTS ( + SELECT 1 FROM "ProjectRole" existing WHERE existing."projectId" = p."id" +); diff --git a/apps/server/src/prisma/migrations/20260908155700_add_security_role/migration.sql b/apps/server/src/prisma/migrations/20260908155700_add_security_role/migration.sql new file mode 100644 index 0000000000..911fac7f3f --- /dev/null +++ b/apps/server/src/prisma/migrations/20260908155700_add_security_role/migration.sql @@ -0,0 +1,24 @@ +-- Backfill the project system role 'Sécurité' on existing projects. +-- Mirrors the TS seeding in project.utils.ts (generateProjectCreateInput): +-- permissions 832 = SEE_SECRETS(64) | LIST_ENVIRONMENTS(256) | LIST_REPOSITORIES(512) +-- position 4 (after Lecture seule), oidcGroup = '//console/security' +-- Anti-join on slug+position makes the INSERT idempotent: a retry after a +-- partial failure, or a project that already has the role, is a no-op. + +INSERT INTO "ProjectRole" ("id", "name", "permissions", "projectId", "position", "oidcGroup", "type") +SELECT + gen_random_uuid(), + 'Sécurité', + 832, -- SEE_SECRETS(64) | LIST_ENVIRONMENTS(256) | LIST_REPOSITORIES(512) + p."id", + 4, + '/' || p."slug" || '/console/security', + 'system:managed' +FROM "Project" p +WHERE NOT EXISTS ( + SELECT 1 + FROM "ProjectRole" r + WHERE r."projectId" = p."id" + AND r."position" = 4 + AND r."oidcGroup" = '/' || p."slug" || '/console/security' +); diff --git a/apps/server/src/prisma/migrations/20260929130657_add_security_admin_role/migration.sql b/apps/server/src/prisma/migrations/20260929130657_add_security_admin_role/migration.sql new file mode 100644 index 0000000000..792647f9ae --- /dev/null +++ b/apps/server/src/prisma/migrations/20260929130657_add_security_admin_role/migration.sql @@ -0,0 +1,13 @@ +INSERT INTO "AdminRole" ("id", "name", "permissions", "position", "oidcGroup", "type") +SELECT + '487450e6-3265-4df2-8581-8e39b0cecc5d'::uuid, + 'Sécurité Plateforme', + 1, + 3, + '/console/security', + 'system:managed' +WHERE NOT EXISTS ( + SELECT 1 FROM "AdminRole" + WHERE "oidcGroup" = '/console/security' + OR "id" = '487450e6-3265-4df2-8581-8e39b0cecc5d'::uuid +);