feat: resolve client roles in import UserBlueprint.roles - #37
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
4 tasks
… lifetimes
post_logout_redirect_uris, web_origins, PKCE requirement, the Device
Authorization grant toggle, and per-client token lifetimes were
missing from ClientBlueprint, so an import couldn't reproduce them and
they were lost on the next realm.
Adds the corresponding client endpoints (POST .../post-logout-redirects,
POST .../web-origins, PATCH .../clients/{id} for PKCE/lifetimes — the
latter only settable after creation, unlike the rest of a client's
fields) and applies them in apply.rs. All five stay optional so
existing blueprint files keep importing unchanged.
Keycloak/Zitadel sources default these fields rather than extracting
them: Keycloak carries the equivalent settings under a free-form
`attributes` map with Keycloak-specific keys, which is a separate
scope of work.
NathaelB
force-pushed
the
feat/import-client-blueprint-fields
branch
from
September 3, 2026 00:30
589207a to
64916be
Compare
UserBlueprint.roles only resolved realm roles: the role_ids table was populated by create_role alone, so client roles created by ClientBlueprint.roles could never be assigned to a user — an import described an intent it couldn't carry out. A role entry can now be qualified as `client_id:role_name` to reference a client role; unqualified entries keep resolving as realm roles. An unresolved client role reference fails the import loudly (ImportError::UnresolvedClientRole) rather than being silently skipped with a warning, per the issue's expected behaviour — this is deliberately different from an unresolved realm role, which keeps its existing warn-and-skip behavior to avoid changing established semantics for existing files. Verified live: assign_user_role accepts a client role id through the same endpoint as a realm role id (no separate client-scoped assignment endpoint needed) — role ids are unique across both scopes, consistent with the delete_role finding in #33.
NathaelB
force-pushed
the
feat/import-client-role-assignment
branch
from
September 3, 2026 00:30
152ad79 to
94fc972
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
UserBlueprint.rolesentries can now reference a client role, qualified asclient_id:role_name; a plain, unqualified name still resolves as a realm role (fully backward compatible with existing blueprint files). Client role ids are tracked the same way realm role ids already were, including a backfill pass for client roles that already existed before this import run.An unresolved client role reference (client or role not found) fails the import loudly with a new
ImportError::UnresolvedClientRole, per the issue's "Expected behaviour" — deliberately different from an unresolved realm role, which keeps its existing warn-and-skip behavior so I'm not silently changing semantics existing files already rely on.Issue
Closes #26.
Stacked on #36 → #35
Branched from
feat/import-client-blueprint-fields(#36), which is itself onfix/import-conflict-detection(#35) — same reasoning as before: this touches the sameapply.rsregion. Merge in order: #35, #36, then this one.Verification
Ran live against a local FerrisKey server:
smoke-crole-client) owning a role (viewer) and a user referencing it assmoke-crole-client:viewer— report showedrole_assignments: 1, anduser rolesconfirmed the user actually holdsviewer.assign_user_roleaccepts a client role id through the exact same endpoint as a realm role id — no separate client-scoped assignment endpoint exists or is needed, consistent with thedelete_rolefinding from fix: correct client-role create/delete (verified against a live server) #33.nonexistent-client:phantom-role— import failed loudly with a clear message, as required, instead of silently warning.Test plan
cargo build --workspacecargo test --workspace(76 passed, +2 new:parse_role_ref)cargo clippy --workspace --all-targets --all-features -- -D warnings