From b6ea98c6fe39987cb05f42d046003170a5dcef54 Mon Sep 17 00:00:00 2001
From: Denis Arh <denis.arh@gmail.com>
Date: Wed, 16 Sep 2020 22:32:21 +0200
Subject: [PATCH] Add role provisioning

---
 provision/system/provision.go | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/provision/system/provision.go b/provision/system/provision.go
index fdddf61f1..b5299d8d8 100644
--- a/provision/system/provision.go
+++ b/provision/system/provision.go
@@ -23,6 +23,15 @@ type (
 	}
 )
 
+// Check if any roels
+func checkRoles(ctx context.Context, s store.Storer) (bool, error) {
+	if set, _, err := store.SearchRoles(ctx, s, types.RoleFilter{}); err != nil {
+		return false, err
+	} else {
+		return len(set) > 0, nil
+	}
+}
+
 // Check if any RBAC rules exist
 func checkRbacRules(ctx context.Context, s store.Storer) (bool, error) {
 	if set, _, err := store.SearchRbacRules(ctx, s, permissions.RuleFilter{}); err != nil {
@@ -34,10 +43,24 @@ func checkRbacRules(ctx context.Context, s store.Storer) (bool, error) {
 
 func Provision(ctx context.Context, log *zap.Logger, s store.Storer) (err error) {
 	var (
-		hasRbacRules bool
-		readers      []io.Reader
+		hasRoles, hasRbacRules bool
+		readers                []io.Reader
 	)
 
+	if hasRoles, err = checkRoles(ctx, s); err != nil {
+		return err
+	} else if !hasRoles {
+		rs := service.DefaultRole.With(ctx)
+		rr := types.RoleSet{
+			&types.Role{ID: 0, Name: "Administrators", Handle: "admins"},
+			&types.Role{ID: 0, Name: "Everyone", Handle: "everyone"},
+		}
+
+		if err = rr.Walk(func(r *types.Role) error { _, err := rs.Create(r); return err }); err != nil {
+			return err
+		}
+	}
+
 	if hasRbacRules, err = checkRbacRules(ctx, s); err != nil {
 		return err
 	}