raystack / frontier / 27118141309

44%

main: 43%

Build Type

Pull #1687

github

Committed by whoAbhishekSah

Commit Message

fix(bootstrap): reconcile predefined roles instead of add-only migrate

MigrateRoles skipped any predefined role that already existed, so it was
add-only: when a predefined role was narrowed in a later release, the
dropped permissions kept granting access on existing deployments because
the boot migration never updated the role.

createRole now reconciles an existing predefined role when its permission
set has drifted from the definition, going through role.Update (which
prunes the removed permission tuples and rewrites the current set). When the
permission set is unchanged it still short-circuits, so there is no churn or
audit noise on a normal boot.

Adds Update to the bootstrap RoleService interface and unit tests for the
create / unchanged / drifted paths.

Refs #1661

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #1687: fix(bootstrap): reconcile predefined roles instead of add-only migrate

Coverage Stats

29 of 33 new or added lines in 1 file covered. (87.88%)

26 existing lines in 1 file now uncovered.

16488 of 38074 relevant lines covered (43.31%)

12.13 hits per line