[PR #2980] [MERGED] Auto-create roles referenced in blueprints #22485

New Issue

GiteaMirror · 2026-06-02T05:20:13-05:00

GiteaMirror commented

2026-06-02 05:20:13 -05:00

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/2980
Author: @rinseaid
Created: 5/3/2026
Status: ✅ Merged
Merged: 5/29/2026
Merged by: @oschwartz10612

Base: main ← Head: blueprint-auto-create-roles

📝 Commits (1)

4786fc3 Auto-create roles referenced in blueprints

📊 Changes

2 files changed (+64 additions, -8 deletions)

View changed files

📝 server/lib/blueprints/clientResources.ts (+48 -6)
📝 server/lib/blueprints/proxyResources.ts (+16 -2)

📄 Description

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Preface

This PR was developed with Claude Code (claude-opus-4-6). I drove the direction and tested everything, but Claude did all of the actual coding. I reviewed, tested, and validated all changes.

Description

When a blueprint references a role that doesn't exist yet, create it automatically instead of failing or silently dropping the association.

Proxy resource blueprints (sso-roles) previously threw Role not found, blocking the entire blueprint apply. Now auto-creates the role.
Client resource blueprints (roles) previously ran a WHERE IN query and silently ignored any role names that didn't match. Now auto-creates missing roles before associating them.
Auto-created roles receive the three default permissions: getOrg, getResource, listResources.

Blueprints are the declarative source of truth for resource configuration. Requiring roles to be pre-created through the UI before they can be referenced in a blueprint breaks the declarative workflow and adds a manual step that's easy to forget. This is especially relevant when integrating with an external IdP where SSO group-to-role mappings should just work on first apply.

How to test?

Apply a blueprint with sso-roles referencing a role that does not exist. Verify the role is created with default permissions and the resource association succeeds.
Apply a blueprint with roles (client resource) referencing a role that does not exist, for both new and existing resources. Verify the same.
Apply a blueprint referencing a role that already exists. Verify no duplicate is created and the existing role is associated normally.
Verify auto-created roles appear in the admin UI with the correct permissions.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/2980 **Author:** [@rinseaid](https://github.com/rinseaid) **Created:** 5/3/2026 **Status:** ✅ Merged **Merged:** 5/29/2026 **Merged by:** [@oschwartz10612](https://github.com/oschwartz10612) **Base:** `main` ← **Head:** `blueprint-auto-create-roles` --- ### 📝 Commits (1) - [`4786fc3`](https://github.com/fosrl/pangolin/commit/4786fc3a315654bd65bdc6fd494e544d7b8d1ca8) Auto-create roles referenced in blueprints ### 📊 Changes **2 files changed** (+64 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `server/lib/blueprints/clientResources.ts` (+48 -6) 📝 `server/lib/blueprints/proxyResources.ts` (+16 -2) </details> ### 📄 Description By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ### Preface This PR was developed with Claude Code (claude-opus-4-6). I drove the direction and tested everything, but Claude did all of the actual coding. I reviewed, tested, and validated all changes. ## Description When a blueprint references a role that doesn't exist yet, create it automatically instead of failing or silently dropping the association. - Proxy resource blueprints (`sso-roles`) previously threw `Role not found`, blocking the entire blueprint apply. Now auto-creates the role. - Client resource blueprints (`roles`) previously ran a `WHERE IN` query and silently ignored any role names that didn't match. Now auto-creates missing roles before associating them. - Auto-created roles receive the three default permissions: `getOrg`, `getResource`, `listResources`. Blueprints are the declarative source of truth for resource configuration. Requiring roles to be pre-created through the UI before they can be referenced in a blueprint breaks the declarative workflow and adds a manual step that's easy to forget. This is especially relevant when integrating with an external IdP where SSO group-to-role mappings should just work on first apply. ## How to test? - Apply a blueprint with `sso-roles` referencing a role that does not exist. Verify the role is created with default permissions and the resource association succeeds. - Apply a blueprint with `roles` (client resource) referencing a role that does not exist, for both new and existing resources. Verify the same. - Apply a blueprint referencing a role that already exists. Verify no duplicate is created and the existing role is associated normally. - Verify auto-created roles appear in the admin UI with the correct permissions. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-06-02 05:20:13 -05:00

GiteaMirror closed this issue

2026-06-02 05:20:14 -05:00

Sign in to join this conversation.

Branches Tags

main

crowdin_dev

dev

dependabot/npm_and_yarn/npm-dependencies-338850a190

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dependabot/docker/docker-dependencies-4faa477378

dependabot/github_actions/github-actions-dependencies-6d79802a48

api-improvements

feat/remember-last-idp-on-smart-login-form

refactor/batch-status-requests

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#22485