Merge pull request jupyterhub#3714 from team-monolith-product/main

Grant role after user creation during config load

Author: minrk

jupyterhub/app.py

@@ -1993,6 +1993,7 @@ async def _get_or_create_user(self, username):
             self.log.info(f"Creating user {username}")
             user = orm.User(name=username)
             self.db.add(user)
+            roles.assign_default_roles(self.db, entity=user)
             self.db.commit()
         return user
 

jupyterhub/tests/test_app.py

@@ -247,6 +247,7 @@ async def test_load_groups(tmpdir, request):
         kwargs['internal_certs_location'] = str(tmpdir)
     hub = MockHub(**kwargs)
     hub.init_db()
+    await hub.init_role_creation()
     await hub.init_users()
     await hub.init_groups()
     db = hub.db

jupyterhub/tests/test_roles.py

@@ -1203,6 +1203,27 @@ async def test_user_config_respects_memberships():
         assert user in user_role.users
 
 
+async def test_user_config_creates_default_role():
+    role_spec = [
+        {
+            'name': 'new-role',
+            'scopes': ['read:users'],
+            'users': ['not-yet-created-user'],
+        }
+    ]
+    user_names = []
+    hub = MockHub(load_roles=role_spec)
+    hub.init_db()
+    hub.authenticator.allowed_users = user_names
+    await hub.init_role_creation()
+    await hub.init_users()
+    await hub.init_role_assignment()
+    user_role = orm.Role.find(hub.db, 'user')
+    new_role = orm.Role.find(hub.db, 'new-role')
+    assert orm.User.find(hub.db, 'not-yet-created-user') in new_role.users
+    assert orm.User.find(hub.db, 'not-yet-created-user') in user_role.users
+
+
 async def test_admin_role_respects_config():
     role_spec = [
         {