enhancement: do not enable all roles by default.

from now on, not all unified roles are enabled by default, instead the available roles are hand-picked in the default setup.

For advanced use-cases, the administrator is capable to enable the desired set of available roles.

Picking roles is not easy since the uid is NOT humanly readable, therefore a cli is contained which lists the available, disabled and enabled roles.

services/graph/pkg/config/parser/parse.go

@@ -5,11 +5,13 @@ import (
 	"fmt"
 
 	"github.com/go-ldap/ldap/v3"
+
 	ociscfg "github.com/owncloud/ocis/v2/ocis-pkg/config"
 	defaults2 "github.com/owncloud/ocis/v2/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/v2/ocis-pkg/shared"
 	"github.com/owncloud/ocis/v2/services/graph/pkg/config"
 	"github.com/owncloud/ocis/v2/services/graph/pkg/config/defaults"
+	"github.com/owncloud/ocis/v2/services/graph/pkg/unifiedrole"
 
 	"github.com/owncloud/ocis/v2/ocis-pkg/config/envdecode"
 )
@@ -72,6 +74,23 @@ func Validate(cfg *config.Config) error {
 		return shared.MissingServiceAccountSecret(cfg.Service.Name)
 	}
 
+	// validate unified roles
+	{
+		var err error
+
+		for _, uid := range cfg.UnifiedRoles.AvailableRoles {
+			// check if the role is known
+			if len(unifiedrole.GetBuiltinRoleDefinitionList(unifiedrole.RoleFilterIDs(uid))) == 0 {
+				// collect all possible errors to return them all at once
+				err = errors.Join(err, fmt.Errorf("%w: %s", unifiedrole.ErrUnknownUnifiedRole, uid))
+			}
+		}
+
+		if err != nil {
+			return err
+		}
+	}
+
 	return nil
 }