From a486d482c30e28efd121c787d456d1cc487a8f32 Mon Sep 17 00:00:00 2001
From: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Date: Mon, 9 Feb 2026 14:56:46 +0100
Subject: [PATCH] fix(admin-roles): admin conflicting with existing admin group
 in Keycloack

The new AdminRole implementation introduced by https://github.com/cloud-pi-native/console/pull/1893 changed the source of truth from Keycloak to Console, which overrides all existing data based on the state of Console.

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
---
 .../migration.sql                             |  2 +-
 .../20260206105522_dso/migration.sql          | 28 +++++++++++++++++++
 packages/test-utils/src/imports/data.ts       | 10 ++++++-
 3 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 apps/server/src/prisma/migrations/20260206105522_dso/migration.sql

diff --git a/apps/server/src/prisma/migrations/20260204150335_add_system_roles/migration.sql b/apps/server/src/prisma/migrations/20260204150335_add_system_roles/migration.sql
index adb8b6f25..92c200d26 100644
--- a/apps/server/src/prisma/migrations/20260204150335_add_system_roles/migration.sql
+++ b/apps/server/src/prisma/migrations/20260204150335_add_system_roles/migration.sql
@@ -1,6 +1,6 @@
 -- Update existing Admin role to be system role 'Administrateur Plateforme'
 UPDATE "AdminRole"
-SET 
+SET
   "name" = 'Administrateur Plateforme',
   "type" = 'system',
   "permissions" = 3, -- Assuming 3n means bit 0 and 1 (1 | 2 = 3)
diff --git a/apps/server/src/prisma/migrations/20260206105522_dso/migration.sql b/apps/server/src/prisma/migrations/20260206105522_dso/migration.sql
new file mode 100644
index 000000000..2a4afa897
--- /dev/null
+++ b/apps/server/src/prisma/migrations/20260206105522_dso/migration.sql
@@ -0,0 +1,28 @@
+-- Update existing Admin role to be system role 'Root Administrateur Plateforme'
+UPDATE "AdminRole"
+SET
+  "name" = 'Root Administrateur Plateforme'
+WHERE "id" = '76229c96-4716-45bc-99da-00498ec9018c'::uuid;
+
+-- Insert 'Administrateur Plateforme' system role if it doesn't exist
+INSERT INTO "AdminRole" ("id", "name", "permissions", "position", "oidcGroup", "type")
+VALUES (
+  '6bebe7b2-0f0a-456e-ab7f-b3d7640a7cbf'::uuid,
+  'Administrateur Plateforme',
+  3, -- Assuming 3n means bit 0 and 1 (1 | 2 = 3)
+  0,
+  '/console/admin',
+  'system'
+)
+ON CONFLICT ("id") DO UPDATE
+SET
+  "name" = 'Administrateur Plateforme',
+  "type" = 'system',
+  "permissions" = 3,
+  "oidcGroup" = '/console/admin';
+
+-- Update 'Lecture Seule Plateforme' system role
+UPDATE "AdminRole"
+SET
+  "oidcGroup" = '/console/readonly'
+WHERE "id" = '35848aa2-e881-4770-9844-0c5c3693e506'::uuid;
diff --git a/packages/test-utils/src/imports/data.ts b/packages/test-utils/src/imports/data.ts
index 394b07959..b4d38d6b3 100644
--- a/packages/test-utils/src/imports/data.ts
+++ b/packages/test-utils/src/imports/data.ts
@@ -24,6 +24,14 @@ export const data = {
       permissions: '3n',
       position: 0,
       oidcGroup: '/admin',
+      name: 'Root Administrateur Plateforme',
+      type: 'system',
+    },
+    {
+      id: '6bebe7b2-0f0a-456e-ab7f-b3d7640a7cbf',
+      permissions: '3n',
+      position: 0,
+      oidcGroup: '/console/admin',
       name: 'Administrateur Plateforme',
       type: 'system',
     },
@@ -39,7 +47,7 @@ export const data = {
       id: '35848aa2-e881-4770-9844-0c5c3693e506',
       permissions: '1n',
       position: 2,
-      oidcGroup: '/readonly',
+      oidcGroup: '/console/readonly',
       name: 'Lecture Seule Plateforme',
       type: 'system',
     },