enhancement: do not enable all roles by default.

from now on, not all unified roles are enabled by default, instead the available roles are hand-picked in the default setup.

For advanced use-cases, the administrator is capable to enable the desired set of available roles.

Picking roles is not easy since the uid is NOT humanly readable, therefore a cli is contained which lists the available, disabled and enabled roles.

services/graph/pkg/command/root.go

@@ -5,13 +5,14 @@ import (
 
 	"github.com/owncloud/ocis/v2/ocis-pkg/clihelper"
 
-	"github.com/owncloud/ocis/v2/services/graph/pkg/config"
 	"github.com/urfave/cli/v2"
+
+	"github.com/owncloud/ocis/v2/services/graph/pkg/config"
 )
 
 // GetCommands provides all commands for this service
 func GetCommands(cfg *config.Config) cli.Commands {
-	return []*cli.Command{
+	return append([]*cli.Command{
 		// start this service
 		Server(cfg),
 
@@ -20,7 +21,7 @@ func GetCommands(cfg *config.Config) cli.Commands {
 		// infos about this service
 		Health(cfg),
 		Version(cfg),
-	}
+	}, UnifiedRoles(cfg)...)
 }
 
 // Execute is the entry point for the ocis-graph command.

services/graph/pkg/command/unified_roles.go

@@ -0,0 +1,80 @@
+package command
+
+import (
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/lipgloss/table"
+	"github.com/urfave/cli/v2"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/config/configlog"
+	"github.com/owncloud/ocis/v2/services/graph/pkg/config"
+	"github.com/owncloud/ocis/v2/services/graph/pkg/config/parser"
+	"github.com/owncloud/ocis/v2/services/graph/pkg/unifiedrole"
+)
+
+// UnifiedRoles bundles available commands for unified roles
+func UnifiedRoles(cfg *config.Config) cli.Commands {
+	cmds := cli.Commands{
+		unifiedRolesStatus(cfg),
+	}
+
+	for _, cmd := range cmds {
+		cmd.Category = "unified-roles"
+		cmd.Name = strings.Join([]string{cmd.Name, "unified-roles"}, "-")
+		cmd.Before = func(c *cli.Context) error {
+			return configlog.ReturnError(parser.ParseConfig(cfg))
+		}
+	}
+
+	return cmds
+}
+
+// unifiedRolesStatus lists available unified roles, it contains an indicator to show if the role is enabled or not
+func unifiedRolesStatus(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "list",
+		Usage: "list available unified roles",
+		Action: func(c *cli.Context) error {
+			re := lipgloss.NewRenderer(os.Stdout)
+			baseStyle := re.NewStyle().Padding(0, 1)
+
+			var data [][]string
+
+			for _, definition := range unifiedrole.GetBuiltinRoleDefinitionList() {
+				data = append(data, []string{"", definition.GetId(), definition.GetDescription()})
+			}
+
+			t := table.New().
+				Border(lipgloss.NormalBorder()).
+				Headers("Enabled", "UID", "Description").
+				Rows(data...).
+				StyleFunc(func(row, col int) lipgloss.Style {
+					if row == 0 {
+						return baseStyle.Foreground(lipgloss.Color("252")).Bold(true)
+					}
+
+					if row != 0 && col == 0 {
+						indicatorStyle := baseStyle.Align(lipgloss.Center)
+
+						// Check if the role is enabled, header takes up the first row
+						switch slices.Contains(cfg.UnifiedRoles.AvailableRoles, data[row-1][1]) {
+						case true:
+							return indicatorStyle.Background(lipgloss.Color("34")) // ANSI green
+						default:
+							return indicatorStyle.Background(lipgloss.Color("9")) // ANSI red
+						}
+					}
+
+					return baseStyle
+				})
+
+			fmt.Println(t)
+
+			return nil
+		},
+	}
+}