Built-in roles aren't created if a role was made in recovery mode first

jcoffey-dev commented

2026-10-30 20:01:17 +00:00

Owner

If a role is created in recovery mode before the server's first normal start, the server never gets its built-in roles. Every account then has no permissions, and JMAP answers 403 for everyone except the recovery admin.

Repro: start a fresh server in recovery mode, create a domain, a user and a custom role (x:Role/set), then restart normally. The user signs in but gets 403 on everything. The same steps without the custom role work fine.

Cause: insert_safe_defaults in crates/common/src/manager/defaults.rs creates the User, Group, Tenant Administrator and System Administrator roles and the default Authentication only when there are no roles yet. Recovery mode doesn't run it, so a role made there counts as "not a new install". The same check also skips the new-install privacy defaults (D1 to D6).

Seeding should depend on something other than the role count, for example a note in the data store that defaults were seeded, as spam_rules::mark_new_install does. Found while writing inbuxa-migrate's live test, which now avoids making roles before the first normal start.

If a role is created in recovery mode before the server's first normal start, the server never gets its built-in roles. Every account then has no permissions, and JMAP answers 403 for everyone except the recovery admin. Repro: start a fresh server in recovery mode, create a domain, a user and a custom role (x:Role/set), then restart normally. The user signs in but gets 403 on everything. The same steps without the custom role work fine. Cause: `insert_safe_defaults` in `crates/common/src/manager/defaults.rs` creates the User, Group, Tenant Administrator and System Administrator roles and the default Authentication only when there are no roles yet. Recovery mode doesn't run it, so a role made there counts as "not a new install". The same check also skips the new-install privacy defaults (D1 to D6). Seeding should depend on something other than the role count, for example a note in the data store that defaults were seeded, as `spam_rules::mark_new_install` does. Found while writing inbuxa-migrate's live test, which now avoids making roles before the first normal start.

jcoffey-dev added the

priority

p2

bug labels 2026-10-30 20:01:17 +00:00

jcoffey-dev self-assigned this 2026-10-31 05:27:53 +00:00

jcoffey-dev referenced this issue from a commit

2026-10-31 05:43:08 +00:00

Seed the built-in roles when a role was made in recovery mode first

jcoffey-dev referenced a pull request that will close this issue

2026-10-31 05:43:14 +00:00

Seed the built-in roles when a role was made in recovery mode first #279

jcoffey-dev closed this issue

2026-10-31 05:53:29 +00:00

jcoffey-dev commented

2026-10-31 05:53:51 +00:00

Author

Owner

Fixed in #279 (534c58d). Recovery mode on a server with no roles now leaves a note, and the first normal start sets up the built-in roles and the new-install defaults when there are no roles or the note is there. Checked with the steps above: on main everyone gets 403; with the fix the user and admin sign in, the four built-in roles are there next to the custom one, and a second start adds nothing. Servers that have started normally before are unchanged. Ships after 27.1-rc.5.

Fixed in #279 (534c58d). Recovery mode on a server with no roles now leaves a note, and the first normal start sets up the built-in roles and the new-install defaults when there are no roles or the note is there. Checked with the steps above: on main everyone gets 403; with the fix the user and admin sign in, the four built-in roles are there next to the custom one, and a second start adds nothing. Servers that have started normally before are unchanged. Ships after 27.1-rc.5.

jcoffey-dev referenced a pull request that will close this issue

2026-10-31 06:17:40 +00:00

Version 27.1.0-rc.6 #280

Built-in roles aren't created if a role was made in recovery mode first #265