[Command] Add flag to allow default roles to be created in env export terraform command #91

Activity

1. ocap-kirk

   changed the title [-]Add flag to allow default roles to be created in `env export terraform` command[/-] [+][Command] Add flag to allow default roles to be created in `env export terraform` command[/+] on Mar 27, 2025
2. ocap-kirk

   linked a pull request that will close this issueadd --include-default-roles flag to `env export terraform` command #92on Mar 27, 2025
3. zeevmoney commented on Aug 19, 2026

   

   zeevmoney

   on Aug 19, 2026

   Member

   More actions

   Hi @ocap-kirk — closing this one as already resolved, and thank you for raising it. The behaviour you described was real when you filed it; it just got fixed from an unexpected direction.

   What changed

   At the time of your report, RoleGenerator skipped the built-in roles outright:

   const DEFAULT_GLOBAL_ROLES = ['admin', 'editor', 'viewer'];
   // ...
   if (DEFAULT_GLOBAL_ROLES.includes(role.key)) { /* skipped */ continue; }

   Commit 6456189 ("Adding support for EU region", #137, merged 2025-10-15) removed that constant and both of its call sites. grep -rn DEFAULT_GLOBAL_ROLES source/ now returns nothing, and processGlobalRoles applies no filtering at all.

   So default roles are exported unconditionally today — no flag needed. That is now covered by a test (tests/export/RoleGenerator.test.tsx:110, it('exports default roles')) and documented in the README:

   Note: The export includes all roles, including default roles (admin, editor, viewer) with their actual permissions.

   On your PR #92

   It's still open as a draft. Since the exclusion it toggles no longer exists, the flag has nothing left to switch, and the branch has also drifted — it patches the exact processGlobalRoles/generateTerraformId code that #137 rewrote, so it now shows as conflicting. Nothing to salvage there; we'll tidy it up separately.

   One thing worth flagging

   The fix landed incidentally as part of an unrelated EU-region refactor rather than as a deliberate answer to this issue, which is why nobody linked it back to you here. The pendulum has also swung the other way: there is currently no way to exclude default roles from an export. If that turns out to matter for your workflow — for example to stop Terraform trying to manage roles it didn't create — please open a fresh issue and we'll look at it properly.

   Sorry it took this long to get back to you, and thanks for taking the time to report it.
4. zeevmoney

   closed this as completedon Aug 19, 2026