raystack / frontier / 27126681961

44%

main: 43%

Pull #1687

github

fix(bootstrap): reconcile predefined roles instead of add-only migrate

MigrateRoles skipped any predefined role that already existed, so it was
add-only: when a predefined role was narrowed in a later release, the
dropped permissions kept granting access on existing deployments because
the boot migration never updated the role.

createRole now reconciles an existing predefined role when its permission
set has drifted from the definition, going through role.Update (which
prunes the removed permission tuples and rewrites the current set). When the
permission set is unchanged it still short-circuits, so there is no churn or
audit noise on a normal boot.

Adds Update to the bootstrap RoleService interface and unit tests for the
create / unchanged / drifted paths.

Refs #1661

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

41 of 45 new or added lines in 1 file covered. (91.11%)

16581 of 38109 relevant lines covered (43.51%)

12.2 hits per line