Describe the bug
A client role created by an import cannot be assigned to anyone. ClientBlueprint.roles creates client roles, but UserBlueprint.roles only resolves realm roles: in apply.rs, the role_ids table is populated by create_role alone, so client roles never enter the lookup used when assigning roles to a user.
The result is an import that produces roles no user can hold — the file describes an intent it cannot carry out, without reporting anything.
Expected behaviour
UserBlueprint.roles should be able to name a client role, qualified by its client, for example client_id:role_name or an explicit { client, role } form. Whichever spelling is chosen, an unresolved role must fail the import loudly rather than being silently skipped.
Environment
ferris-ctl 0.2.3, FerrisKey server 0.7.0
Describe the bug
A client role created by an import cannot be assigned to anyone.
ClientBlueprint.rolescreates client roles, butUserBlueprint.rolesonly resolves realm roles: inapply.rs, therole_idstable is populated bycreate_rolealone, so client roles never enter the lookup used when assigning roles to a user.The result is an import that produces roles no user can hold — the file describes an intent it cannot carry out, without reporting anything.
Expected behaviour
UserBlueprint.rolesshould be able to name a client role, qualified by its client, for exampleclient_id:role_nameor an explicit{ client, role }form. Whichever spelling is chosen, an unresolved role must fail the import loudly rather than being silently skipped.Environment
ferris-ctl 0.2.3, FerrisKey server 0.7.0