Reconcile configured admin role permissions

Author: sfmskywalker

src/modules/Elsa.Identity/HostedServices/AdminUserInitializer.cs

@@ -48,7 +48,21 @@ public override async Task ExecuteAsync(CancellationToken cancellationToken)
         }
         else
         {
-            logger.LogInformation("Admin role '{RoleName}' already exists. Skipping creation.", adminRoleName);
+            var missingPermissions = adminRolePermissions.Except(existingRole.Permissions, StringComparer.Ordinal).ToArray();
+
+            if (missingPermissions.Length == 0)
+            {
+                logger.LogInformation("Admin role '{RoleName}' already exists with all configured permissions.", adminRoleName);
+            }
+            else
+            {
+                existingRole.Permissions = existingRole.Permissions.Concat(missingPermissions).ToList();
+                await roleStore.SaveAsync(existingRole, cancellationToken);
+                logger.LogInformation(
+                    "Admin role '{RoleName}' updated successfully with {PermissionCount} missing configured permissions.",
+                    adminRoleName,
+                    missingPermissions.Length);
+            }
         }
 
         var roleToAssign = adminRoleName;

test/integration/Elsa.ExternalAuthentication.IntegrationTests/Identity/JustInTimeProvisioningTests.cs

@@ -116,6 +116,21 @@ public async Task InMemoryProvisionerRetriesAGeneratedUserNameCollision()
         Assert.Null(user.HashedPasswordSalt);
     }
 
+    [Fact]
+    public async Task InMemoryProvisionerAssignsConfiguredDefaultRolesToNewUser()
+    {
+        var userStore = new MemoryUserStore(new MemoryStore<User>());
+        var roleStore = new MemoryRoleStore(new MemoryStore<Role>());
+        await roleStore.AddAsync(new Role { Id = "admin", Name = "Administrator", TenantId = "tenant-a", Permissions = ["*"] });
+        var provisioner = CreateInMemoryProvisioner(userStore, roleProvider: new StoreBasedRoleProvider(roleStore));
+
+        var result = await provisioner.CreateLinkOrGetExistingAsync(CreateProvisioningRequest(defaultRoleIds: ["admin"]));
+        var user = await userStore.FindAsync(new Elsa.Identity.Models.UserFilter { Id = result.UserId });
+
+        Assert.NotNull(user);
+        Assert.Equal(["admin"], user.Roles);
+    }
+
     [Fact]
     public async Task InMemoryProvisionerTreatsEachExternalIdentityTupleAsDistinct()
     {
@@ -165,20 +180,27 @@ public async Task InMemoryProvisionerSharesTupleStateAcrossDependencyInjectionSc
         [policy],
         Microsoft.Extensions.Options.Options.Create(new ExternalAuthenticationOptions()));
 
-    private static InMemoryExternalIdentityProvisioner CreateInMemoryProvisioner(IUserStore userStore, IIdentityGenerator? identityGenerator = null) => new(
+    private static InMemoryExternalIdentityProvisioner CreateInMemoryProvisioner(
+        IUserStore userStore,
+        IIdentityGenerator? identityGenerator = null,
+        IRoleProvider? roleProvider = null) => new(
         userStore,
         new StoreBasedUserProvider(userStore),
-        NSubstitute.Substitute.For<IRoleProvider>(),
+        roleProvider ?? NSubstitute.Substitute.For<IRoleProvider>(),
         identityGenerator ?? new Elsa.Workflows.GuidIdentityGenerator(),
         new Elsa.Common.Services.SystemClock(),
         new HmacExternalAuthenticationHandleHasher(),
         new InMemoryExternalIdentityProvisionerState());
 
-    private static ProvisioningRequest CreateProvisioningRequest(string? existingUserId = null, string connectionKey = "contoso", string issuer = "https://issuer.example") => new(
+    private static ProvisioningRequest CreateProvisioningRequest(
+        string? existingUserId = null,
+        string connectionKey = "contoso",
+        string issuer = "https://issuer.example",
+        IReadOnlyCollection<string>? defaultRoleIds = null) => new(
         "tenant-a",
         connectionKey,
         new ExternalIdentity(issuer, "subject-a", new Dictionary<string, IReadOnlyCollection<string>>()),
-        existingUserId is null ? new UserCreationProposal("external") : null,
+        existingUserId is null ? new UserCreationProposal("external", DefaultRoleIds: defaultRoleIds) : null,
         existingUserId);
 
     private static ExternalIdentityResolutionContext CreateContext(string policyType = "create-user", IReadOnlyDictionary<string, IReadOnlyCollection<string>>? claims = null)

test/integration/Elsa.ExternalAuthentication.IntegrationTests/Sessions/ExternalRefreshPermissionTests.cs

@@ -91,7 +91,7 @@ public async Task RefreshRetainsBoundedExternalSnapshotAndReevaluatesCurrentElsa
         registry.FindByKeyAsync("tenant-a", "contoso", Arg.Any<CancellationToken>())
             .Returns(ValueTask.FromResult<EffectiveIdentityProviderConnection?>(effective));
         var user = new User { Id = "user-a", Name = "alice", TenantId = "tenant-a", Roles = ["role-a"] };
-        var role = new Role { Id = "role-a", Name = "Operators", TenantId = "tenant-a", Permissions = ["workflows:read"] };
+        var role = new Role { Id = "role-a", Name = "Operators", TenantId = "tenant-a", Permissions = ["*"] };
         var users = Substitute.For<IUserProvider>();
         users.FindAsync(Arg.Any<UserFilter>(), Arg.Any<CancellationToken>()).Returns(Task.FromResult<User?>(user));
         var roles = Substitute.For<IRoleProvider>();
@@ -129,9 +129,9 @@ public async Task RefreshRetainsBoundedExternalSnapshotAndReevaluatesCurrentElsa
         await issuer.RefreshAsync("studio", refreshToken);
 
         Assert.Equal(2, issuanceContexts.Count);
-        Assert.Equal(["workflows:read", "reports:view"], issuanceContexts[0].Permissions);
+        Assert.Equal(["*", "reports:view"], issuanceContexts[0].Permissions);
         Assert.Equal(["workflows:manage", "reports:view"], issuanceContexts[1].Permissions);
-        Assert.DoesNotContain("workflows:read", issuanceContexts[1].Permissions);
+        Assert.DoesNotContain("*", issuanceContexts[1].Permissions);
         Assert.Equal("session-a", issuanceContexts[1].ExternalAuthenticationSessionId);
     }
 

test/unit/Elsa.Identity.UnitTests/HostedServices/AdminUserInitializerTests.cs

@@ -0,0 +1,69 @@
+using Elsa.Common.Services;
+using Elsa.Identity.Contracts;
+using Elsa.Identity.Entities;
+using Elsa.Identity.HostedServices;
+using Elsa.Identity.Models;
+using Elsa.Identity.Options;
+using Elsa.Identity.Services;
+using Microsoft.Extensions.Logging.Abstractions;
+using NSubstitute;
+
+namespace Elsa.Identity.UnitTests.HostedServices;
+
+public class AdminUserInitializerTests
+{
+    [Fact]
+    public async Task ExecuteAsyncAddsMissingConfiguredPermissionsToExistingAdminRole()
+    {
+        var roleStore = await CreateRoleStoreAsync(["custom"]);
+        var initializer = CreateInitializer(roleStore, ["*"]);
+
+        await initializer.ExecuteAsync(CancellationToken.None);
+
+        var role = await roleStore.FindAsync(new RoleFilter { Id = "admin" });
+        Assert.NotNull(role);
+        Assert.Equal(["custom", "*"], role.Permissions);
+    }
+
+    [Fact]
+    public async Task ExecuteAsyncDoesNotDuplicateExistingConfiguredPermissions()
+    {
+        var roleStore = await CreateRoleStoreAsync(["*", "custom"]);
+        var initializer = CreateInitializer(roleStore, ["*"]);
+
+        await initializer.ExecuteAsync(CancellationToken.None);
+        await initializer.ExecuteAsync(CancellationToken.None);
+
+        var role = await roleStore.FindAsync(new RoleFilter { Id = "admin" });
+        Assert.NotNull(role);
+        Assert.Equal(["*", "custom"], role.Permissions);
+    }
+
+    private static async Task<MemoryRoleStore> CreateRoleStoreAsync(ICollection<string> permissions)
+    {
+        var roleStore = new MemoryRoleStore(new MemoryStore<Role>());
+        await roleStore.AddAsync(new Role
+        {
+            Id = "admin",
+            Name = "Administrator",
+            Permissions = permissions
+        });
+        return roleStore;
+    }
+
+    private static AdminUserInitializer CreateInitializer(IRoleStore roleStore, ICollection<string> permissions)
+    {
+        var options = Microsoft.Extensions.Options.Options.Create(new DefaultAdminUserOptions
+        {
+            AdminRoleName = "admin",
+            AdminRolePermissions = permissions
+        });
+        return new(
+            Substitute.For<IUserStore>(),
+            roleStore,
+            Substitute.For<IUserManager>(),
+            Substitute.For<IRoleManager>(),
+            options,
+            NullLogger<AdminUserInitializer>.Instance);
+    }
+}