feat(roles): jc roles command group [Phase 1] - #96
Merged
Conversation
Closes the Roles gap (V2): RBAC scope sets that gate what admins and
service accounts can do. Synergistic with service-accounts, which already
resolves a role via /roles (RoleConfig).
Commands: list, get, create, update, delete.
- create: --name, --scopes (comma-separated), --description.
- update: read-modify-write (the role PUT is a full-object replace with
name+scopes required), so a partial change preserves the rest and
strips the server-managed id — same guard as KLA-484.
- delete: confirmation-gated.
Wire contracts verified live (2026-07-24): /roles list is wrapped in
{results} (ResponseKey), single GET is bare, id in "id". list + get-by-name
live-verified (Administrator, 69 scopes); create/update/delete unit-tested
against the confirmed shapes, incl. the RMW preserving scopes/description on
a name-only update.
Also hardens the service-accounts tests to disable the resolve cache so
name resolution can't pick up a dev-populated on-disk cache entry
(surfaced when live-verifying roles).
Coverage scorecard: 73% → 74% area-level (gap 171 → 166 ops).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Reviewed by Cursor Bugbot for commit abc1c78. Configure here.
jklaassenjc
pushed a commit
that referenced
this pull request
Jul 24, 2026
…gbot, #96 finding applies here too) Bugbot flagged this on roles; the same bug is in service-accounts — I mirrored iplists but dropped its plan-mode blocks. create/delete/rotate/ revoke never checked viper "plan", so --plan (and the dangerous --force --plan) executed for real instead of previewing. Each mutation now returns a plan.Plan preview under --plan, matching iplists. Regression test asserts create --plan makes no POST and returns ExitError(10). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jklaassenjc
pushed a commit
that referenced
this pull request
Jul 24, 2026
…gbot, #96 finding applies here too) Bugbot flagged this on roles; the same bug is in service-accounts — I mirrored iplists but dropped its plan-mode blocks. create/delete/rotate/ revoke never checked viper "plan", so --plan (and the dangerous --force --plan) executed for real instead of previewing. Each mutation now returns a plan.Plan preview under --plan, matching iplists. Regression test asserts create --plan makes no POST and returns ExitError(10). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
runRolesCreate/Update/Delete never checked viper "plan", so --plan (and --force --plan) executed instead of previewing — with delete removing the role. Each mutation now returns a plan.Plan preview under --plan, matching iplists. Regression test asserts create --plan makes no POST and returns ExitError(10). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jtaylorjc
previously approved these changes
Jul 24, 2026
jrennichjc
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 1 continued — closes the Roles gap. Stacked on #95 (service-accounts); merge #94 → #95 → this in order.
Roles (V2) had no CLI presence. A role is a named set of API scopes gating what an admin or service account can do — synergistic with
jc service-accounts create --role, which already resolves a role via the/rolesendpoint wired in #95.Commands
jc roles list | get | create | update | delete--name,--scopes(comma-separated),--description.id(same guard as KLA-484).Wire contracts — verified live (2026-07-24)
/roleslist wrapped in{results}(ResponseKey); single GET bare; id inid.Testing
list,get-by-name (Administrator, 69 scopes).--scopessplit/trim + empty-scope validation, the RMW update preserving scopes/description on a name-only change (+ id stripped), delete path. Fullgo test -race ./...+go vetgreen.Coverage
Scorecard: 73% → 74% area-level (gap 171 → 166 ops).
Tracked under KLA-485.
🤖 Generated with Claude Code
Note
Medium Risk
New destructive RBAC commands can remove roles and strip scopes from admins/service accounts; update/delete paths are guarded with confirmation, plan mode, and RMW tests, but mistakes still have real access impact.
Overview
Adds a new
jc rolescommand group under Security & Policies for JumpCloud V2 RBAC roles (named API scope sets used by admins and service accounts).list,get,create,update, anddeletecall/roleswith list pagination viaresults, name-or-ID resolution, and shell completion. Create takes--name, comma-separated--scopes, and optional--description. Update does read-modify-write because the API PUT replaces the whole object—partial flags preserve other fields and drop serverid. Delete supports batch sources,--plan, and interactive confirmation (with--force).Registers mutation classes for all role subcommands, maps Roles in
api-coverage.py, and refreshes the scorecard (73% → 74% area coverage). Adds HTTP tests for list/create/update/delete and--planno-mutation; service-account tests now disable the resolve cache to avoid flaky name resolution.Reviewed by Cursor Bugbot for commit 85e0509. Bugbot is set up for automated code reviews on this repo. Configure here.