From c15ba58a64cef7d222699f9e260e490a36cde98d Mon Sep 17 00:00:00 2001
From: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Date: Fri, 6 Feb 2026 10:28:11 +0100
Subject: [PATCH 1/3] feat: add OIDC group to project groups

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
---
 .../client/src/components/ProjectRoleForm.vue |  14 +-
 apps/client/src/components/ProjectRoles.vue   |   9 +-
 apps/client/src/utils/project-utils.ts        |   2 +-
 .../migration.sql                             |   2 +
 .../src/prisma/migrations/migration_lock.toml |   2 +-
 apps/server/src/prisma/schema/project.prisma  |   1 +
 .../src/resources/admin-role/business.spec.ts | 116 ++++++++---
 .../resources/project-role/business.spec.ts   | 196 +++++++++++++++---
 .../src/resources/project-role/business.ts    |  26 ++-
 .../src/resources/project-role/queries.ts     |   6 +-
 apps/server/src/resources/project/business.ts |   8 +-
 .../src/resources/stage/business.spec.ts      |   2 +-
 .../src/resources/user/business.spec.ts       |   4 +-
 .../src/resources/zone/business.spec.ts       |   4 +-
 packages/shared/src/contracts/project-role.ts |  12 +-
 packages/shared/src/schemas/project.ts        |   4 +-
 packages/shared/src/schemas/role.ts           |   2 +
 17 files changed, 319 insertions(+), 91 deletions(-)
 create mode 100644 apps/server/src/prisma/migrations/20260127154602_add_oidc_group_to_project_role/migration.sql

diff --git a/apps/client/src/components/ProjectRoleForm.vue b/apps/client/src/components/ProjectRoleForm.vue
index b0fc7d237..4fb0c7784 100644
--- a/apps/client/src/components/ProjectRoleForm.vue
+++ b/apps/client/src/components/ProjectRoleForm.vue
@@ -1,6 +1,6 @@
 <script lang="ts" setup>
 import { computed, ref } from 'vue'
-import type { Member, ProjectV2, RoleBigint } from '@cpn-console/shared'
+import type { Member, ProjectRoleBigint, ProjectV2 } from '@cpn-console/shared'
 import { PROJECT_PERMS, projectPermsDetails, shallowEqual } from '@cpn-console/shared'
 
 const props = defineProps<{
@@ -10,12 +10,13 @@ const props = defineProps<{
   allMembers: Member[]
   projectId: ProjectV2['id']
   isEveryone: boolean
+  oidcGroup?: string
 }>()
 
 defineEmits<{
   delete: []
   updateMemberRoles: [checked: boolean, userId: Member['userId']]
-  save: [value: Omit<RoleBigint, 'position'>]
+  save: [value: Omit<ProjectRoleBigint, 'position' | 'projectId'>]
   cancel: []
 }>()
 const router = useRouter()
@@ -23,6 +24,7 @@ const role = ref({
   ...props,
   permissions: props.permissions ?? 0n,
   allMembers: props.allMembers ?? [],
+  oidcGroup: props.oidcGroup ?? '',
 })
 
 const isUpdated = computed(() => {
@@ -68,6 +70,14 @@ function updateChecked(checked: boolean, value: bigint) {
         class="mb-5"
         :disabled="role.isEveryone"
       />
+      <h6>Groupe OIDC</h6>
+      <DsfrInput
+        v-model="role.oidcGroup"
+        data-testid="roleOidcGroupInput"
+        label-visible
+        class="mb-5"
+        :disabled="role.isEveryone"
+      />
       <h6>Permissions</h6>
       <div
         v-for="scope in projectPermsDetails"
diff --git a/apps/client/src/components/ProjectRoles.vue b/apps/client/src/components/ProjectRoles.vue
index 95194bbad..65bcac1e0 100644
--- a/apps/client/src/components/ProjectRoles.vue
+++ b/apps/client/src/components/ProjectRoles.vue
@@ -1,5 +1,5 @@
 <script lang="ts" setup>
-import type { Member, Role, RoleBigint } from '@cpn-console/shared'
+import type { Member, ProjectRole, ProjectRoleBigint, Role, RoleBigint } from '@cpn-console/shared'
 import { useSnackbarStore } from '@/stores/snackbar.js'
 import type { Project } from '@/utils/project-utils.js'
 
@@ -11,7 +11,7 @@ const snackbarStore = useSnackbarStore()
 
 const selectedId = ref<string>()
 
-type RoleItem = Omit<Role, 'permissions'> & { permissions: bigint, memberCounts: number, isEveryone: boolean }
+type RoleItem = Omit<ProjectRole, 'permissions'> & { permissions: bigint, memberCounts: number, isEveryone: boolean }
 
 const roleList = ref<RoleItem[]>([])
 
@@ -56,7 +56,7 @@ async function saveEveryoneRole(role: { permissions: bigint }) {
   snackbarStore.setMessage('Rôle mis à jour', 'success')
 }
 
-async function saveRole(role: Omit<RoleBigint, 'position'>) {
+async function saveRole(role: Omit<ProjectRoleBigint, 'position' | 'projectId'>) {
   if (role.id === 'everyone') {
     await saveEveryoneRole(role)
     snackbarStore.setMessage('Rôle mis à jour', 'success')
@@ -67,6 +67,7 @@ async function saveRole(role: Omit<RoleBigint, 'position'>) {
     id: selectedRole.value.id,
     permissions: role.permissions.toString(),
     name: role.name,
+    oidcGroup: role.oidcGroup,
   }])
   reload()
   snackbarStore.setMessage('Rôle mis à jour', 'success')
@@ -86,6 +87,7 @@ function reload() {
     permissions: BigInt(props.project.everyonePerms),
     position: 1000,
     isEveryone: true,
+    projectId: props.project.id,
   })
   roleList.value = roles
 }
@@ -142,6 +144,7 @@ watch(props.project, reload, { immediate: true })
       :permissions="BigInt(selectedRole.permissions)"
       :project-id="project.id"
       :is-everyone="selectedRole.isEveryone"
+      :oidc-group="selectedRole.oidcGroup"
       :all-members="project.members"
       @delete="deleteRole(selectedRole.id)"
       @update-member-roles="(checked: boolean, userId: Member['userId']) => updateMember(checked, userId)"
diff --git a/apps/client/src/utils/project-utils.ts b/apps/client/src/utils/project-utils.ts
index 0b31bdda9..a230f5df3 100644
--- a/apps/client/src/utils/project-utils.ts
+++ b/apps/client/src/utils/project-utils.ts
@@ -64,7 +64,7 @@ export class Project implements ProjectV2 {
   locked: boolean
   owner: Omit<User, 'adminRoleIds'>
   ownerId: string
-  roles: { id: string, name: string, permissions: string, position: number }[]
+  roles: { id: string, name: string, permissions: string, position: number, projectId: string, oidcGroup?: string }[]
   members: ({ userId: string, firstName: string, lastName: string, email: string, roleIds: string[] } | { updatedAt: string, createdAt: string, firstName: string, lastName: string, email: string, userId: string, roleIds: string[] })[]
   createdAt: string
   updatedAt: string
diff --git a/apps/server/src/prisma/migrations/20260127154602_add_oidc_group_to_project_role/migration.sql b/apps/server/src/prisma/migrations/20260127154602_add_oidc_group_to_project_role/migration.sql
new file mode 100644
index 000000000..04c98df03
--- /dev/null
+++ b/apps/server/src/prisma/migrations/20260127154602_add_oidc_group_to_project_role/migration.sql
@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "ProjectRole" ADD COLUMN     "oidcGroup" TEXT NOT NULL DEFAULT '';
diff --git a/apps/server/src/prisma/migrations/migration_lock.toml b/apps/server/src/prisma/migrations/migration_lock.toml
index 648c57fd5..044d57cdb 100644
--- a/apps/server/src/prisma/migrations/migration_lock.toml
+++ b/apps/server/src/prisma/migrations/migration_lock.toml
@@ -1,3 +1,3 @@
 # Please do not edit this file manually
 # It should be added in your version-control system (e.g., Git)
-provider = "postgresql"
\ No newline at end of file
+provider = "postgresql"
diff --git a/apps/server/src/prisma/schema/project.prisma b/apps/server/src/prisma/schema/project.prisma
index 9bff043eb..8a0cf34c0 100644
--- a/apps/server/src/prisma/schema/project.prisma
+++ b/apps/server/src/prisma/schema/project.prisma
@@ -66,6 +66,7 @@ model ProjectRole {
   permissions BigInt
   projectId   String  @db.Uuid
   position    Int     @db.SmallInt
+  oidcGroup   String  @default("")
   project     Project @relation(fields: [projectId], references: [id])
 }
 
diff --git a/apps/server/src/resources/admin-role/business.spec.ts b/apps/server/src/resources/admin-role/business.spec.ts
index 9174f544e..1d3b78b12 100644
--- a/apps/server/src/resources/admin-role/business.spec.ts
+++ b/apps/server/src/resources/admin-role/business.spec.ts
@@ -1,6 +1,6 @@
+import { faker } from '@faker-js/faker'
 import { describe, expect, it } from 'vitest'
 import type { AdminRole, User } from '@prisma/client'
-import { faker } from '@faker-js/faker'
 import prisma from '../../__mocks__/prisma.js'
 import { BadRequest400 } from '../../utils/errors.ts'
 import { countRolesMembers, createRole, deleteRole, listRoles, patchRoles } from './business.ts'
@@ -8,54 +8,67 @@ import { countRolesMembers, createRole, deleteRole, listRoles, patchRoles } from
 describe('test admin-role business', () => {
   describe('listRoles', () => {
     it('should stringify bigint', async () => {
-      const partialRole: Partial<AdminRole> = {
+      const dbRole: AdminRole = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
         permissions: 4n,
+        position: 0,
+        oidcGroup: '',
       }
 
-      prisma.adminRole.findMany.mockResolvedValueOnce([partialRole])
+      prisma.adminRole.findMany.mockResolvedValueOnce([dbRole])
       const response = await listRoles()
-      expect(response).toEqual([{ permissions: '4' }])
+      expect(response).toContainEqual(expect.objectContaining({ permissions: '4' }))
     })
   })
 
   describe('createRole', () => {
     it('should create role with incremented position when position 0 is the highest', async () => {
-      const dbRole: Partial<AdminRole> = {
+      const dbRole: AdminRole = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
         permissions: 4n,
         position: 0,
+        oidcGroup: '',
       }
 
       prisma.adminRole.findFirst.mockResolvedValueOnce(dbRole)
       prisma.adminRole.findMany.mockResolvedValueOnce([dbRole])
-      prisma.adminRole.create.mockResolvedValue(null)
+      prisma.adminRole.create.mockResolvedValue(dbRole)
       await createRole({ name: 'test' })
 
       expect(prisma.adminRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 0n, position: 1 } })
     })
 
     it('should create role with incremented position with bigger position', async () => {
-      const dbRole: Partial<AdminRole> = {
+      const dbRole: AdminRole = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
         permissions: 4n,
         position: 50,
+        oidcGroup: '',
       }
 
       prisma.adminRole.findFirst.mockResolvedValueOnce(dbRole)
       prisma.adminRole.findMany.mockResolvedValueOnce([dbRole])
-      prisma.adminRole.create.mockResolvedValue(null)
+      prisma.adminRole.create.mockResolvedValue(dbRole)
       await createRole({ name: 'test' })
 
       expect(prisma.adminRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 0n, position: 51 } })
     })
 
     it('should create role with incremented position with no role in db', async () => {
-      const dbRole: Partial<AdminRole> = {
+      const dbRole: AdminRole = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
         permissions: 4n,
         position: 50,
+        oidcGroup: '',
       }
 
-      prisma.adminRole.findFirst.mockResolvedValueOnce(undefined)
+      prisma.adminRole.findFirst.mockResolvedValueOnce(null)
       prisma.adminRole.findMany.mockResolvedValueOnce([dbRole])
-      prisma.adminRole.create.mockResolvedValue(null)
+      prisma.adminRole.create.mockResolvedValue(dbRole)
       await createRole({ name: 'test' })
 
       expect(prisma.adminRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 0n, position: 0 } })
@@ -65,16 +78,39 @@ describe('test admin-role business', () => {
     const roleId = faker.string.uuid()
     it('should delete role and remove id from concerned users', async () => {
       const users = [{
-        adminRoleIds: [roleId],
         id: faker.string.uuid(),
+        type: 'human',
+        firstName: faker.person.firstName(),
+        lastName: faker.person.lastName(),
+        email: faker.internet.email(),
+        adminRoleIds: [roleId],
+        createdAt: faker.date.past(),
+        updatedAt: faker.date.recent(),
+        lastLogin: faker.date.past(),
       }, {
-        adminRoleIds: [roleId, faker.string.uuid()],
         id: faker.string.uuid(),
-      }] as const satisfies Partial<User>[]
+        type: 'human',
+        firstName: faker.person.firstName(),
+        lastName: faker.person.lastName(),
+        email: faker.internet.email(),
+        adminRoleIds: [roleId, faker.string.uuid()],
+        createdAt: faker.date.past(),
+        updatedAt: faker.date.recent(),
+        lastLogin: faker.date.past(),
+      }] as const satisfies User[]
+
+      const dbRole: AdminRole = {
+        name: 'Admin',
+        id: roleId,
+        permissions: 4n,
+        position: 50,
+        oidcGroup: '',
+      }
 
       prisma.user.findMany.mockResolvedValueOnce(users)
       prisma.adminRole.findMany.mockResolvedValueOnce([])
-      prisma.adminRole.create.mockResolvedValue(null)
+      prisma.adminRole.findUnique.mockResolvedValueOnce(dbRole)
+      prisma.adminRole.create.mockResolvedValue(dbRole)
       await deleteRole(roleId)
 
       expect(prisma.user.update).toHaveBeenNthCalledWith(1, { where: { id: users[0].id }, data: { adminRoleIds: [] } })
@@ -84,35 +120,59 @@ describe('test admin-role business', () => {
   })
   describe('countRolesMembers', () => {
     it('should return aggregated role member counts', async () => {
-      const partialRoles = [{
+      const roles = [{
         id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
+        oidcGroup: '',
+        permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
+        position: 0,
       }, {
         id: faker.string.uuid(),
-      }] as const satisfies Partial<AdminRole>[]
+        name: faker.string.alphanumeric(),
+        oidcGroup: '',
+        permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
+        position: 1,
+      }] as const satisfies AdminRole[]
 
       const users = [{
-        adminRoleIds: [partialRoles[0].id, partialRoles[1].id],
+        id: faker.string.uuid(),
+        type: 'human',
+        firstName: faker.person.firstName(),
+        lastName: faker.person.lastName(),
+        email: faker.internet.email(),
+        adminRoleIds: [roles[0].id, roles[1].id],
+        createdAt: faker.date.past(),
+        updatedAt: faker.date.recent(),
+        lastLogin: faker.date.past(),
       }, {
-        adminRoleIds: [partialRoles[1].id],
-      }] as const satisfies Partial<User>[]
-      prisma.adminRole.findMany.mockResolvedValue(partialRoles)
+        id: faker.string.uuid(),
+        type: 'human',
+        firstName: faker.person.firstName(),
+        lastName: faker.person.lastName(),
+        email: faker.internet.email(),
+        adminRoleIds: [roles[1].id],
+        createdAt: faker.date.past(),
+        updatedAt: faker.date.recent(),
+        lastLogin: faker.date.past(),
+      }] as const satisfies User[]
+      prisma.adminRole.findMany.mockResolvedValue(roles)
       prisma.user.findMany.mockResolvedValue(users)
 
       const response = await countRolesMembers()
 
-      expect(response).toEqual({ [partialRoles[0].id]: 1, [partialRoles[1].id]: 2 })
+      expect(response).toEqual({ [roles[0].id]: 1, [roles[1].id]: 2 })
     })
   })
   describe('patchRoles', () => {
     const dbRoles: AdminRole[] = [{
       id: faker.string.uuid(),
-      name: faker.company.name(),
+      name: faker.string.alphanumeric(),
       oidcGroup: '',
       permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
       position: 0,
     }, {
       id: faker.string.uuid(),
-      name: faker.company.name(),
+      name: faker.string.alphanumeric(),
       oidcGroup: '',
       permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
       position: 1,
@@ -125,7 +185,7 @@ describe('test admin-role business', () => {
     })
 
     it('should return 400 if incoherent positions', async () => {
-      const updateRoles: Pick<AdminRole, 'id' | 'position'> = [
+      const updateRoles: Pick<AdminRole, 'id' | 'position'>[] = [
         { id: dbRoles[0].id, position: 1 },
         { id: dbRoles[1].id, position: 1 },
       ]
@@ -137,7 +197,7 @@ describe('test admin-role business', () => {
       expect(prisma.adminRole.update).toHaveBeenCalledTimes(0)
     })
     it('should return 400 if incoherent positions (missing roles)', async () => {
-      const updateRoles: Pick<AdminRole, 'id' | 'position'> = [
+      const updateRoles: Pick<AdminRole, 'id' | 'position'>[] = [
         { id: dbRoles[1].id, position: 1 },
       ]
       prisma.adminRole.findMany.mockResolvedValue(dbRoles)
@@ -148,7 +208,7 @@ describe('test admin-role business', () => {
       expect(prisma.adminRole.update).toHaveBeenCalledTimes(0)
     })
     it('should update positions', async () => {
-      const updateRoles: Pick<AdminRole, 'id' | 'position'> = [
+      const updateRoles: Pick<AdminRole, 'id' | 'position'>[] = [
         { id: dbRoles[0].id, position: 1 },
         { id: dbRoles[1].id, position: 0 },
       ]
@@ -159,7 +219,7 @@ describe('test admin-role business', () => {
       expect(prisma.adminRole.update).toHaveBeenCalledTimes(2)
     })
     it('should update permissions', async () => {
-      const updateRoles: Pick<AdminRole, 'id' | 'position'> = [
+      const updateRoles: (Pick<AdminRole, 'id'> & { permissions?: string })[] = [
         { id: dbRoles[1].id, permissions: '0' },
       ]
       prisma.adminRole.findMany.mockResolvedValue(dbRoles)
diff --git a/apps/server/src/resources/project-role/business.spec.ts b/apps/server/src/resources/project-role/business.spec.ts
index cdbaa3fd1..460944f55 100644
--- a/apps/server/src/resources/project-role/business.spec.ts
+++ b/apps/server/src/resources/project-role/business.spec.ts
@@ -1,76 +1,165 @@
 import { faker } from '@faker-js/faker'
 import { describe, expect, it } from 'vitest'
-import type { ProjectMembers, ProjectRole, User } from '@prisma/client'
+import type { ProjectMembers, ProjectRole } from '@prisma/client'
 import prisma from '../../__mocks__/prisma.js'
 import { BadRequest400 } from '../../utils/errors.ts'
 import { countRolesMembers, createRole, deleteRole, listRoles, patchRoles } from './business.ts'
 
-const projectId = faker.string.uuid()
 describe('test project-role business', () => {
+  const project: Project = {
+    id: faker.string.uuid(),
+    name: faker.lorem.word({ length: { min: 2, max: 10 } }),
+    slug: faker.lorem.word({ length: { min: 2, max: 10 } }),
+    limitless: false,
+    hprodCpu: faker.number.int({ min: 0, max: 1000 }),
+    hprodGpu: faker.number.int({ min: 0, max: 1000 }),
+    hprodMemory: faker.number.int({ min: 0, max: 1000 }),
+    prodCpu: faker.number.int({ min: 0, max: 1000 }),
+    prodGpu: faker.number.int({ min: 0, max: 1000 }),
+    prodMemory: faker.number.int({ min: 0, max: 1000 }),
+    description: faker.lorem.sentence({ min: 2, max: 10 }),
+    status: 'created',
+    locked: false,
+    createdAt: faker.date.past(),
+    updatedAt: faker.date.recent(),
+    everyonePerms: 0n,
+    ownerId: faker.string.uuid(),
+    lastSuccessProvisionningVersion: null,
+  }
+  const projectId = faker.string.uuid()
+
   describe('listRoles', () => {
     it('should stringify bigint', async () => {
-      const partialRole: Partial<ProjectRole> = {
+      const dbRole: ProjectRole = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
+        projectId,
         permissions: 4n,
+        position: 0,
+        oidcGroup: '',
       }
 
-      prisma.projectRole.findMany.mockResolvedValueOnce([partialRole])
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
       const response = await listRoles(projectId)
-      expect(response).toEqual([{ permissions: '4' }])
+      expect(response).toContainEqual(expect.objectContaining({ permissions: '4' }))
+    })
+
+    it('should strip oidcGroup prefix', async () => {
+      const dbRole: any = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
+        projectId,
+        permissions: 4n,
+        position: 0,
+        oidcGroup: `/${project.slug}/console/admin`,
+      }
+
+      prisma.project.findUnique.mockResolvedValueOnce(project)
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
+
+      const response = await listRoles(projectId)
+      expect(response[0].oidcGroup).toBe('/admin')
     })
   })
 
   describe('createRole', () => {
     it('should create role with incremented position when position 0 is the highest', async () => {
-      const dbRole: Partial<ProjectRole> = {
+      const dbRole: ProjectRole = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
         projectId,
         permissions: 4n,
         position: 0,
+        oidcGroup: '',
       }
 
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findFirst.mockResolvedValueOnce(dbRole)
       prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
-      prisma.projectRole.create.mockResolvedValue(null)
+      prisma.projectRole.create.mockResolvedValue(dbRole)
       await createRole(projectId, { name: 'test', permissions: '4' })
 
       expect(prisma.projectRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 4n, position: 1, projectId } })
     })
 
     it('should create role with incremented position with bigger position', async () => {
-      const dbRole: Partial<ProjectRole> = {
+      const dbRole: ProjectRole = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
+        projectId,
         permissions: 4n,
         position: 50,
+        oidcGroup: '',
       }
 
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findFirst.mockResolvedValueOnce(dbRole)
       prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
-      prisma.projectRole.create.mockResolvedValue(null)
+      prisma.projectRole.create.mockResolvedValue(dbRole)
       await createRole(projectId, { name: 'test', permissions: '4' })
 
       expect(prisma.projectRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 4n, position: 51, projectId } })
     })
 
     it('should create role with incremented position with no role in db', async () => {
-      const dbRole: Partial<ProjectRole> = {
+      const dbRole: ProjectRole = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
+        projectId,
         permissions: 4n,
         position: 50,
+        oidcGroup: '',
       }
 
-      prisma.projectRole.findFirst.mockResolvedValueOnce(undefined)
+      prisma.project.findUnique.mockResolvedValue(project)
+      prisma.projectRole.findFirst.mockResolvedValueOnce(null)
       prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
-      prisma.projectRole.create.mockResolvedValue(null)
+      prisma.projectRole.create.mockResolvedValue(dbRole)
+      prisma.projectRole.findFirst.mockResolvedValueOnce(null)
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
+      prisma.projectRole.create.mockResolvedValue(dbRole)
       await createRole(projectId, { name: 'test', permissions: '4' })
 
       expect(prisma.projectRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 4n, position: 0, projectId } })
     })
+
+    it('should create role with enforced oidcGroup prefix', async () => {
+      const dbRole: any = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
+        projectId,
+        permissions: 4n,
+        position: 0,
+        oidcGroup: `/${project.slug}/console/admin`,
+      }
+
+      prisma.project.findUnique.mockResolvedValueOnce(project)
+      prisma.projectRole.findFirst.mockResolvedValueOnce(dbRole)
+      prisma.projectRole.create.mockResolvedValue(dbRole)
+      prisma.project.findUnique.mockResolvedValueOnce(project)
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
+
+      await createRole(projectId, { name: 'test', permissions: '4', oidcGroup: '/admin' })
+
+      expect(prisma.projectRole.create).toHaveBeenCalledWith(expect.objectContaining({
+        data: expect.objectContaining({
+          oidcGroup: `/${project.slug}/console/admin`,
+        }),
+      }))
+    })
   })
 
   describe('deleteRole', () => {
     const roleId = faker.string.uuid()
     it('should delete role and remove id from concerned users', async () => {
-      const dbRole: Partial<ProjectRole> = {
+      const dbRole: ProjectRole = {
+        id: roleId,
+        name: faker.string.alphanumeric(),
+        projectId,
         permissions: 4n,
         position: 50,
-        id: faker.string.uuid(),
+        oidcGroup: '',
       }
       const members = [{
         userId: faker.string.uuid(),
@@ -82,6 +171,7 @@ describe('test project-role business', () => {
         roleIds: [roleId, faker.string.uuid()],
       }] as const satisfies Partial<ProjectMembers>[]
 
+      prisma.projectRole.findUnique.mockResolvedValueOnce(dbRole)
       prisma.projectMembers.findMany.mockResolvedValueOnce(members)
       prisma.projectRole.findMany.mockResolvedValueOnce([])
       prisma.projectRole.delete.mockResolvedValue(dbRole)
@@ -94,51 +184,70 @@ describe('test project-role business', () => {
   })
   describe.skip('countRolesMembers', () => {
     it('should return aggregated role member counts', async () => {
-      const partialRoles = [{
+      const roles = [{
         id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
+        projectId,
+        permissions: 4n,
+        position: 50,
+        oidcGroup: '',
       }, {
         id: faker.string.uuid(),
-      }] as const satisfies Partial<ProjectRole>[]
+        name: faker.string.alphanumeric(),
+        projectId,
+        permissions: 4n,
+        position: 50,
+        oidcGroup: '',
+      }] as const satisfies ProjectRole[]
 
-      const users = [{
-        projectRoleIds: [partialRoles[0].id, partialRoles[1].id],
+      const members = [{
+        userId: faker.string.uuid(),
+        projectId,
+        roleIds: [roles[0].id, roles[1].id],
       }, {
-        projectRoleIds: [partialRoles[1].id],
-      }] as const satisfies Partial<User>[]
-      prisma.projectRole.findMany.mockResolvedValue(partialRoles)
-      prisma.user.findMany.mockResolvedValue(users)
+        userId: faker.string.uuid(),
+        projectId,
+        roleIds: [roles[1].id],
+      }] as const satisfies ProjectMembers[]
+
+      prisma.projectRole.findMany.mockResolvedValue(roles)
+      prisma.projectMembers.findMany.mockResolvedValue(members)
 
-      const response = await countRolesMembers()
+      const response = await countRolesMembers(projectId)
 
-      expect(response).toEqual({ [partialRoles[0].id]: 1, [partialRoles[1].id]: 2 })
+      expect(response).toEqual({ [roles[0].id]: 1, [roles[1].id]: 2 })
     })
   })
   describe('patchRoles', () => {
     const dbRoles: ProjectRole[] = [{
       id: faker.string.uuid(),
-      name: faker.company.name(),
+      name: faker.string.alphanumeric(),
       permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
       position: 0,
       projectId,
+      oidcGroup: 'group1',
     }, {
       id: faker.string.uuid(),
-      name: faker.company.name(),
+      name: faker.string.alphanumeric(),
       permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
       position: 1,
       projectId,
+      oidcGroup: 'group2',
     }]
 
     it('should do nothing', async () => {
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue([])
       await patchRoles(projectId, [])
       expect(prisma.projectRole.update).toHaveBeenCalledTimes(0)
     })
 
     it('should return 400 if incoherent positions', async () => {
-      const updateRoles: Pick<ProjectRole, 'id' | 'position'> = [
+      const updateRoles: Pick<ProjectRole, 'id' | 'position'>[] = [
         { id: dbRoles[0].id, position: 1 },
         { id: dbRoles[1].id, position: 1 },
       ]
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue(dbRoles)
 
       const response = await patchRoles(projectId, updateRoles)
@@ -148,9 +257,10 @@ describe('test project-role business', () => {
     })
 
     it('should return 400 if incoherent positions (missing)', async () => {
-      const updateRoles: Pick<ProjectRole, 'id' | 'position'> = [
+      const updateRoles: Pick<ProjectRole, 'id' | 'position'>[] = [
         { id: dbRoles[1].id, position: 1 },
       ]
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue(dbRoles)
 
       const response = await patchRoles(projectId, updateRoles)
@@ -160,10 +270,11 @@ describe('test project-role business', () => {
     })
 
     it('should update positions', async () => {
-      const updateRoles: Pick<ProjectRole, 'id' | 'position'> = [
+      const updateRoles: Pick<ProjectRole, 'id' | 'position'>[] = [
         { id: dbRoles[0].id, position: 1 },
         { id: dbRoles[1].id, position: 0 },
       ]
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue(dbRoles)
 
       await patchRoles(projectId, updateRoles)
@@ -172,24 +283,45 @@ describe('test project-role business', () => {
     })
 
     it('should update permissions', async () => {
-      const updateRoles: Pick<ProjectRole, 'id' | 'position'> = [
+      const updateRoles: (Pick<ProjectRole, 'id'> & { permissions: string })[] = [
         { id: dbRoles[1].id, permissions: '0' },
       ]
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue(dbRoles)
 
       await patchRoles(projectId, updateRoles)
 
       expect(prisma.projectRole.update).toHaveBeenCalledTimes(1)
-      expect(prisma.projectRole.update).toHaveBeenCalledWith({
+      expect(prisma.projectRole.update).toHaveBeenCalledWith(expect.objectContaining({
         data: {
           name: dbRoles[1].name,
           permissions: 0n,
           position: 1,
+          oidcGroup: dbRoles[1].oidcGroup,
         },
         where: {
           id: dbRoles[1].id,
         },
-      })
+      }))
+    })
+
+    it('should update role with enforced oidcGroup prefix', async () => {
+      const updateRoles: any[] = [
+        { id: dbRoles[1].id, oidcGroup: '/admin' },
+      ]
+
+      prisma.project.findUnique.mockResolvedValue(project)
+
+      const dbRoleWithPrefix = { ...dbRoles[1], oidcGroup: `/${project.slug}/console/group2` }
+      prisma.projectRole.findMany.mockResolvedValue([dbRoleWithPrefix])
+
+      await patchRoles(projectId, updateRoles)
+
+      expect(prisma.projectRole.update).toHaveBeenCalledWith(expect.objectContaining({
+        data: expect.objectContaining({
+          oidcGroup: `/${project.slug}/console/admin`,
+        }),
+      }))
     })
   })
 })
diff --git a/apps/server/src/resources/project-role/business.ts b/apps/server/src/resources/project-role/business.ts
index 3d20dc13c..78a3f252a 100644
--- a/apps/server/src/resources/project-role/business.ts
+++ b/apps/server/src/resources/project-role/business.ts
@@ -6,15 +6,21 @@ import {
   listRoles as listRolesQuery,
   updateRole,
 } from '@/resources/queries-index.js'
-import { BadRequest400 } from '@/utils/errors.js'
+import { BadRequest400, NotFound404 } from '@/utils/errors.js'
 import prisma from '@/prisma.js'
 
 export async function listRoles(projectId: Project['id']) {
-  return listRolesQuery(projectId)
-    .then(roles => roles.map(role => ({ ...role, permissions: role.permissions.toString() })))
+  const roles = await listRolesQuery(projectId)
+  return roles.map(role => ({
+    ...role,
+    permissions: role.permissions.toString(),
+    oidcGroup: role.oidcGroup ? role.oidcGroup.replace(/^\/[^/]+\/console/, '') : role.oidcGroup,
+  }))
 }
 
 export async function patchRoles(projectId: Project['id'], roles: typeof projectRoleContract.patchProjectRoles.body._type) {
+  const project = await prisma.project.findUnique({ where: { id: projectId }, select: { slug: true } })
+  if (!project) throw new NotFound404()
   const dbRoles = await listRoles(projectId)
   const positionsAvailable: number[] = []
 
@@ -22,7 +28,11 @@ export async function patchRoles(projectId: Project['id'], roles: typeof project
     .filter(dbRole => roles.find(role => role.id === dbRole.id)) // filter non concerned dbRoles
     .map((dbRole) => {
       const matchingRole = roles.find(role => role.id === dbRole.id)
-      if (typeof matchingRole?.position !== 'undefined' && !positionsAvailable.includes(matchingRole.position)) {
+      if (typeof matchingRole?.position !== 'undefined' && !positionsAvailable.includes(matchingRole?.position)) {
+        positionsAvailable.push(matchingRole.position)
+      }
+
+      if (typeof matchingRole?.position !== 'undefined' && !positionsAvailable.includes(matchingRole?.position)) {
         positionsAvailable.push(matchingRole.position)
       }
       return {
@@ -30,6 +40,7 @@ export async function patchRoles(projectId: Project['id'], roles: typeof project
         name: matchingRole?.name ?? dbRole.name,
         permissions: matchingRole?.permissions ? BigInt(matchingRole?.permissions) : BigInt(dbRole.permissions),
         position: matchingRole?.position ?? dbRole.position,
+        oidcGroup: matchingRole?.oidcGroup ? `/${project.slug}/console${matchingRole.oidcGroup}` : dbRole.oidcGroup,
       }
     })
   if (positionsAvailable.length && positionsAvailable.length !== dbRoles.length) return new BadRequest400('Les numéros de position des rôles sont incohérentes')
@@ -41,18 +52,25 @@ export async function patchRoles(projectId: Project['id'], roles: typeof project
 }
 
 export async function createRole(projectId: Project['id'], role: typeof projectRoleContract.createProjectRole.body._type) {
+  const project = await prisma.project.findUnique({ where: { id: projectId }, select: { slug: true } })
+  if (!project) throw new NotFound404()
   const dbMaxPosRole = (await prisma.projectRole.findFirst({
     where: { projectId },
     orderBy: { position: 'desc' },
     select: { position: true },
   }))?.position ?? -1
 
+  if (role.oidcGroup && !role.oidcGroup.startsWith('/')) {
+    throw new BadRequest400('oidcGroup doit commencer par /')
+  }
+
   await prisma.projectRole.create({
     data: {
       ...role,
       projectId,
       position: dbMaxPosRole + 1,
       permissions: BigInt(role.permissions),
+      oidcGroup: role.oidcGroup ? `/${project.slug}/console${role.oidcGroup}` : undefined,
     },
   })
 
diff --git a/apps/server/src/resources/project-role/queries.ts b/apps/server/src/resources/project-role/queries.ts
index d915849eb..db2528a9c 100644
--- a/apps/server/src/resources/project-role/queries.ts
+++ b/apps/server/src/resources/project-role/queries.ts
@@ -1,7 +1,6 @@
 import type {
   Prisma,
   Project,
-
   ProjectRole,
 } from '@prisma/client'
 
@@ -9,18 +8,19 @@ import prisma from '@/prisma.js'
 
 export const listRoles = (projectId: Project['id']) => prisma.projectRole.findMany({ where: { projectId }, orderBy: { position: 'asc' } })
 
-export function createRole(data: Pick<Prisma.ProjectRoleUncheckedCreateInput, 'permissions' | 'name' | 'position' | 'projectId'>) {
+export function createRole(data: Pick<Prisma.ProjectRoleUncheckedCreateInput, 'permissions' | 'name' | 'position' | 'projectId' | 'oidcGroup'>) {
   return prisma.projectRole.create({
     data: {
       name: data.name,
       permissions: 0n,
       position: data.position,
       projectId: data.projectId,
+      oidcGroup: data.oidcGroup,
     },
   })
 }
 
-export function updateRole(id: ProjectRole['id'], data: Pick<Prisma.ProjectRoleUncheckedUpdateInput, 'permissions' | 'name' | 'position' | 'id'>) {
+export function updateRole(id: ProjectRole['id'], data: Pick<Prisma.ProjectRoleUncheckedUpdateInput, 'permissions' | 'name' | 'position' | 'id' | 'oidcGroup'>) {
   return prisma.projectRole.update({
     where: { id },
     data,
diff --git a/apps/server/src/resources/project/business.ts b/apps/server/src/resources/project/business.ts
index e81ac8d3e..7c6bb5800 100644
--- a/apps/server/src/resources/project/business.ts
+++ b/apps/server/src/resources/project/business.ts
@@ -46,7 +46,7 @@ export async function listProjects({ status, statusIn, statusNotIn, filter = 'me
   }).then(projects => projects.map(({ clusters, ...project }) => ({
     ...project,
     clusterIds: clusters.map(({ id }) => id),
-    roles: project.roles.map(role => ({ ...role, permissions: role.permissions.toString() })),
+    roles: project.roles.map(role => ({ ...role, permissions: role.permissions.toString(), oidcGroup: project.slug ? role.oidcGroup?.replace(`/${project.slug}/console`, '') : role.oidcGroup })),
     everyonePerms: project.everyonePerms.toString(),
   })))
 }
@@ -86,7 +86,7 @@ export async function createProject(dataDto: typeof projectContract.createProjec
     ...projectInfos,
     clusterIds: projectInfos.clusters.map(({ id }) => id),
     everyonePerms: projectInfos.everyonePerms.toString(),
-    roles: projectInfos.roles.map(role => ({ ...role, permissions: role.permissions.toString() })),
+    roles: projectInfos.roles.map(role => ({ ...role, permissions: role.permissions.toString(), oidcGroup: projectInfos.slug ? role.oidcGroup?.replace(`/${project.slug}/console`, '') : role.oidcGroup })),
   }
 }
 
@@ -94,7 +94,7 @@ export async function getProject(projectId: Project['id']) {
   return getProjectOrThrow(projectId).then(({ clusters, ...project }) => ({
     ...project,
     clusterIds: clusters.map(({ id }) => id),
-    roles: project.roles.map(role => ({ ...role, permissions: role.permissions.toString() })),
+    roles: project.roles.map(role => ({ ...role, permissions: role.permissions.toString(), oidcGroup: project.slug ? role.oidcGroup?.replace(`/${project.slug}/console`, '') : role.oidcGroup })),
     everyonePerms: project.everyonePerms.toString(),
   }))
 }
@@ -151,7 +151,7 @@ export async function updateProject(
     ...projectInfos,
     clusterIds: projectInfos.clusters.map(({ id }) => id),
     everyonePerms: projectInfos.everyonePerms.toString(),
-    roles: projectInfos.roles.map(role => ({ ...role, permissions: role.permissions.toString() })),
+    roles: projectInfos.roles.map(role => ({ ...role, permissions: role.permissions.toString(), oidcGroup: projectInfos.slug ? role.oidcGroup?.replace(`/${projectInfos.slug}/console`, '') : role.oidcGroup })),
   }
 }
 
diff --git a/apps/server/src/resources/stage/business.spec.ts b/apps/server/src/resources/stage/business.spec.ts
index d608ee0c0..815cba497 100644
--- a/apps/server/src/resources/stage/business.spec.ts
+++ b/apps/server/src/resources/stage/business.spec.ts
@@ -11,7 +11,7 @@ describe('test stage busines logic', () => {
     vi.resetAllMocks()
     stage = {
       id: faker.string.uuid(),
-      name: faker.company.name(),
+      name: faker.string.alphanumeric(),
     }
   })
   describe('createStage', () => {
diff --git a/apps/server/src/resources/user/business.spec.ts b/apps/server/src/resources/user/business.spec.ts
index 50e1dd20c..4226d9fdf 100644
--- a/apps/server/src/resources/user/business.spec.ts
+++ b/apps/server/src/resources/user/business.spec.ts
@@ -128,13 +128,13 @@ describe('test users business', () => {
     // ça ne teste pas tout mais c'est déjà bien hein
     const adminRoles = [{
       id: faker.string.uuid(),
-      name: faker.company.name(),
+      name: faker.string.alphanumeric(),
       oidcGroup: '',
       permissions: 0n,
       position: 0,
     }, {
       id: faker.string.uuid(),
-      name: faker.company.name(),
+      name: faker.string.alphanumeric(),
       oidcGroup: '/admin',
       permissions: 0n,
       position: 0,
diff --git a/apps/server/src/resources/zone/business.spec.ts b/apps/server/src/resources/zone/business.spec.ts
index b126fce18..18a02b7db 100644
--- a/apps/server/src/resources/zone/business.spec.ts
+++ b/apps/server/src/resources/zone/business.spec.ts
@@ -17,7 +17,7 @@ vi.mock('../../utils/hook-wrapper.ts', async () => ({
 describe('test zone business', () => {
   const zones: Zone[] = [{
     id: faker.string.uuid(),
-    label: faker.company.name(),
+    label: faker.string.alphanumeric(),
     argocdUrl: faker.internet.url(),
     createdAt: new Date(),
     updatedAt: new Date(),
@@ -25,7 +25,7 @@ describe('test zone business', () => {
     slug: faker.string.alphanumeric(5),
   }, {
     id: faker.string.uuid(),
-    label: faker.company.name(),
+    label: faker.string.alphanumeric(),
     argocdUrl: faker.internet.url(),
     createdAt: new Date(),
     updatedAt: new Date(),
diff --git a/packages/shared/src/contracts/project-role.ts b/packages/shared/src/contracts/project-role.ts
index 361388956..5c1176f07 100644
--- a/packages/shared/src/contracts/project-role.ts
+++ b/packages/shared/src/contracts/project-role.ts
@@ -1,5 +1,5 @@
 import { z } from 'zod'
-import { RoleSchema, apiPrefix, contractInstance } from '../index.js'
+import { ProjectRoleSchema, apiPrefix, contractInstance } from '../index.js'
 import { ErrorSchema, baseHeaders } from './_utils.js'
 
 export const projectRoleContract = contractInstance.router({
@@ -8,7 +8,7 @@ export const projectRoleContract = contractInstance.router({
     path: '',
     pathParams: z.object({ projectId: z.string().uuid() }),
     responses: {
-      200: RoleSchema.array(),
+      200: ProjectRoleSchema.array(),
       400: ErrorSchema,
       401: ErrorSchema,
       403: ErrorSchema,
@@ -18,11 +18,11 @@ export const projectRoleContract = contractInstance.router({
   createProjectRole: {
     method: 'POST',
     path: '',
-    body: RoleSchema.omit({ position: true, id: true }),
+    body: ProjectRoleSchema.omit({ position: true, id: true, projectId: true }),
     pathParams: z.object({ projectId: z.string().uuid() }),
     responses: {
       // 200: z.any(),
-      201: RoleSchema.array(),
+      201: ProjectRoleSchema.array(),
       400: ErrorSchema,
       401: ErrorSchema,
       403: ErrorSchema,
@@ -34,10 +34,10 @@ export const projectRoleContract = contractInstance.router({
     path: '',
     pathParams: z.object({ projectId: z.string().uuid() }),
     // body: z.any(),
-    body: RoleSchema.partial({ name: true, permissions: true, position: true }).array(),
+    body: ProjectRoleSchema.pick({ id: true }).merge(ProjectRoleSchema.omit({ id: true, projectId: true }).partial()).array(),
     responses: {
       // 200: z.any(),
-      200: RoleSchema.array(),
+      200: ProjectRoleSchema.array(),
       400: ErrorSchema,
       401: ErrorSchema,
       403: ErrorSchema,
diff --git a/packages/shared/src/schemas/project.ts b/packages/shared/src/schemas/project.ts
index 313db5966..70c9238fb 100644
--- a/packages/shared/src/schemas/project.ts
+++ b/packages/shared/src/schemas/project.ts
@@ -4,7 +4,7 @@ import { longestEnvironmentName, projectStatus } from '../utils/const.js'
 import { AtDatesToStringExtend, CoerceBooleanSchema, permissionLevelSchema } from './_utils.js'
 import { RepoSchema } from './repository.js'
 import { MemberSchema, UserSchema } from './user.js'
-import { RoleSchema } from './role.js'
+import { ProjectRoleSchema } from './role.js'
 
 export const descriptionMaxLength = 280
 export const projectNameMaxLength = 20
@@ -76,7 +76,7 @@ export const ProjectSchemaV2 = z.object({
     .uuid(),
   owner: UserSchema
     .omit({ adminRoleIds: true }),
-  roles: RoleSchema
+  roles: ProjectRoleSchema
     .array(),
   everyonePerms: permissionLevelSchema,
   lastSuccessProvisionningVersion: z.string()
diff --git a/packages/shared/src/schemas/role.ts b/packages/shared/src/schemas/role.ts
index 0556dca52..faf860110 100644
--- a/packages/shared/src/schemas/role.ts
+++ b/packages/shared/src/schemas/role.ts
@@ -13,6 +13,7 @@ export const RoleSchema = z.object({
 
 export const ProjectRoleSchema = RoleSchema.extend({
   projectId: z.string().uuid(),
+  oidcGroup: z.string().optional(),
 })
 
 export const AdminRoleSchema = RoleSchema.extend({
@@ -29,3 +30,4 @@ export type Role = Zod.infer<typeof RoleSchema>
 export type RoleBigint = Omit<Zod.infer<typeof RoleSchema>, 'permissions'> & { permissions: bigint }
 export type AdminRole = Zod.infer<typeof AdminRoleSchema>
 export type ProjectRole = Zod.infer<typeof ProjectRoleSchema>
+export type ProjectRoleBigint = Omit<Zod.infer<typeof ProjectRoleSchema>, 'permissions'> & { permissions: bigint }

From b7e9f16e1a00337e82ddb86e9ad156295f0af0f1 Mon Sep 17 00:00:00 2001
From: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Date: Fri, 6 Feb 2026 10:28:11 +0100
Subject: [PATCH 2/3] feat: add system roles on project creation

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
---
 apps/client/src/components/AdminRoleForm.vue  | 12 +++-
 .../client/src/components/ProjectRoleForm.vue | 13 ++--
 apps/client/src/components/ProjectRoles.vue   |  1 +
 apps/client/src/utils/project-utils.ts        |  2 +-
 apps/client/src/views/admin/AdminRoles.vue    |  6 +-
 .../migration.sql                             | 11 +++
 .../migration.sql                             | 26 +++++++
 apps/server/src/prisma/schema/admin.prisma    |  1 +
 apps/server/src/prisma/schema/project.prisma  |  1 +
 .../src/resources/admin-role/business.spec.ts | 67 ++++++++++++++++++-
 .../src/resources/admin-role/business.ts      | 43 ++++++++----
 .../src/resources/admin-role/queries.ts       | 12 +++-
 .../src/resources/admin-role/router.spec.ts   |  6 +-
 .../server/src/resources/admin-role/router.ts |  1 +
 .../resources/project-role/business.spec.ts   | 63 +++++++++++++++--
 .../src/resources/project-role/business.ts    | 49 +++++++++-----
 .../src/resources/project-role/queries.ts     |  1 +
 .../src/resources/project-role/router.ts      |  2 +
 apps/server/src/resources/project/queries.ts  | 33 +++++++++
 packages/shared/src/contracts/admin-role.ts   |  2 +-
 packages/shared/src/schemas/role.ts           |  2 +
 packages/shared/src/utils/permissions.ts      |  1 +
 packages/test-utils/src/imports/data.ts       | 14 +++-
 playwright/e2e-tests/roles.spec.ts            | 19 ++++++
 24 files changed, 333 insertions(+), 55 deletions(-)
 create mode 100644 apps/server/src/prisma/migrations/20260127164002_add_type_to_roles/migration.sql
 create mode 100644 apps/server/src/prisma/migrations/20260204150335_add_system_roles/migration.sql

diff --git a/apps/client/src/components/AdminRoleForm.vue b/apps/client/src/components/AdminRoleForm.vue
index e576aed06..a12b4ce45 100644
--- a/apps/client/src/components/AdminRoleForm.vue
+++ b/apps/client/src/components/AdminRoleForm.vue
@@ -12,13 +12,15 @@ const props = withDefaults(defineProps<{
   permissions: bigint
   name: string
   oidcGroup: string
+  type: string
 }>(), {
   name: 'Nouveau rôle',
   oidcGroup: '',
+  type: 'custom',
 })
 const emits = defineEmits<{
   delete: []
-  save: [{ name: string, permissions: string, oidcGroup: string }]
+  save: [{ name: string, permissions: string, oidcGroup: string, type: string }]
   cancel: []
 }>()
 const usersStore = useUsersStore()
@@ -33,6 +35,8 @@ const isUpdated = computed(() => {
   return !shallowEqual(props, role.value)
 })
 
+const isSystem = computed(() => props.type === 'system')
+
 const errorSchema = computed<SharedZodError | undefined>(() => {
   const schemaValidation = RoleSchema.partial().safeParse(role.value)
   return schemaValidation.success ? undefined : schemaValidation.error
@@ -139,6 +143,7 @@ function closeModal() {
         label-visible
         hint="Ne doit pas dépasser 30 caractères."
         class="mb-5"
+        :disabled="isSystem"
       />
       <p
         class="fr-h6"
@@ -163,7 +168,7 @@ function closeModal() {
           :label="perm.label"
           :hint="perm?.hint"
           :name="perm.key"
-          :disabled="role.permissions & ADMIN_PERMS.MANAGE && perm.key !== 'MANAGE'"
+          :disabled="isSystem || (role.permissions & ADMIN_PERMS.MANAGE && perm.key !== 'MANAGE')"
           @update:model-value="(checked: boolean) => updateChecked(checked, perm.key)"
         />
       </div>
@@ -174,8 +179,10 @@ function closeModal() {
         label-visible
         placeholder="/admin"
         class="mb-5"
+        :disabled="isSystem"
       />
       <DsfrButton
+        v-if="!isSystem"
         data-testid="saveBtn"
         label="Enregistrer"
         secondary
@@ -184,6 +191,7 @@ function closeModal() {
         @click="$emit('save', { ...role, permissions: role.permissions.toString() })"
       />
       <DsfrButton
+        v-if="!isSystem"
         data-testid="deleteBtn"
         label="Supprimer"
         secondary
diff --git a/apps/client/src/components/ProjectRoleForm.vue b/apps/client/src/components/ProjectRoleForm.vue
index 4fb0c7784..f09eb6ecf 100644
--- a/apps/client/src/components/ProjectRoleForm.vue
+++ b/apps/client/src/components/ProjectRoleForm.vue
@@ -11,6 +11,7 @@ const props = defineProps<{
   projectId: ProjectV2['id']
   isEveryone: boolean
   oidcGroup?: string
+  type?: string
 }>()
 
 defineEmits<{
@@ -25,12 +26,16 @@ const role = ref({
   permissions: props.permissions ?? 0n,
   allMembers: props.allMembers ?? [],
   oidcGroup: props.oidcGroup ?? '',
+  type: props.type ?? 'custom',
 })
 
 const isUpdated = computed(() => {
   if (role.value.isEveryone) return props.permissions !== role.value.permissions
   return !shallowEqual(props, role.value)
 })
+
+const isSystem = computed(() => props.type === 'system')
+
 const tabListName = 'Liste d’onglet'
 const tabTitles = [
   { title: 'Général', icon: 'ri:checkbox-circle-line', tabId: 'general' },
@@ -68,7 +73,7 @@ function updateChecked(checked: boolean, value: bigint) {
         data-testid="roleNameInput"
         label-visible
         class="mb-5"
-        :disabled="role.isEveryone"
+        :disabled="role.isEveryone || isSystem"
       />
       <h6>Groupe OIDC</h6>
       <DsfrInput
@@ -76,7 +81,7 @@ function updateChecked(checked: boolean, value: bigint) {
         data-testid="roleOidcGroupInput"
         label-visible
         class="mb-5"
-        :disabled="role.isEveryone"
+        :disabled="role.isEveryone || isSystem"
       />
       <h6>Permissions</h6>
       <div
@@ -97,7 +102,7 @@ function updateChecked(checked: boolean, value: bigint) {
           :label="perm?.label"
           :hint="perm?.hint"
           :name="perm.key"
-          :disabled="role.permissions & PROJECT_PERMS.MANAGE && perm.key !== 'MANAGE'"
+          :disabled="(role.permissions & PROJECT_PERMS.MANAGE && perm.key !== 'MANAGE') || role.type === 'system'"
           @update:model-value="(checked: boolean) => updateChecked(checked, PROJECT_PERMS[perm.key])"
         />
       </div>
@@ -110,7 +115,7 @@ function updateChecked(checked: boolean, value: bigint) {
         @click="$emit('save', role)"
       />
       <DsfrButton
-        v-if="!role.isEveryone"
+        v-if="!role.isEveryone && role.type !== 'system'"
         data-testid="deleteBtn"
         label="Supprimer"
         secondary
diff --git a/apps/client/src/components/ProjectRoles.vue b/apps/client/src/components/ProjectRoles.vue
index 65bcac1e0..010138648 100644
--- a/apps/client/src/components/ProjectRoles.vue
+++ b/apps/client/src/components/ProjectRoles.vue
@@ -145,6 +145,7 @@ watch(props.project, reload, { immediate: true })
       :project-id="project.id"
       :is-everyone="selectedRole.isEveryone"
       :oidc-group="selectedRole.oidcGroup"
+      :type="selectedRole.type"
       :all-members="project.members"
       @delete="deleteRole(selectedRole.id)"
       @update-member-roles="(checked: boolean, userId: Member['userId']) => updateMember(checked, userId)"
diff --git a/apps/client/src/utils/project-utils.ts b/apps/client/src/utils/project-utils.ts
index a230f5df3..58b03e265 100644
--- a/apps/client/src/utils/project-utils.ts
+++ b/apps/client/src/utils/project-utils.ts
@@ -64,7 +64,7 @@ export class Project implements ProjectV2 {
   locked: boolean
   owner: Omit<User, 'adminRoleIds'>
   ownerId: string
-  roles: { id: string, name: string, permissions: string, position: number, projectId: string, oidcGroup?: string }[]
+  roles: { id: string, name: string, permissions: string, position: number, projectId: string, oidcGroup?: string, type?: string }[]
   members: ({ userId: string, firstName: string, lastName: string, email: string, roleIds: string[] } | { updatedAt: string, createdAt: string, firstName: string, lastName: string, email: string, userId: string, roleIds: string[] })[]
   createdAt: string
   updatedAt: string
diff --git a/apps/client/src/views/admin/AdminRoles.vue b/apps/client/src/views/admin/AdminRoles.vue
index 155222222..30081e3d5 100644
--- a/apps/client/src/views/admin/AdminRoles.vue
+++ b/apps/client/src/views/admin/AdminRoles.vue
@@ -32,7 +32,7 @@ async function deleteRole(roleId: Role['id']) {
   selectedId.value = undefined
 }
 
-async function saveRole(role: Pick<AdminRole, 'name' | 'oidcGroup' | 'permissions'>) {
+async function saveRole(role: Pick<AdminRole, 'name' | 'oidcGroup' | 'permissions' | 'type'>) {
   if (!selectedRole.value) return
   await adminRoleStore.patchRoles(
     [{
@@ -40,6 +40,7 @@ async function saveRole(role: Pick<AdminRole, 'name' | 'oidcGroup' | 'permission
       permissions: role.permissions.toString(),
       name: role.name,
       oidcGroup: role.oidcGroup,
+      type: role.type,
     }],
   )
   snackbarStore.setMessage('Rôle mis à jour', 'success')
@@ -117,8 +118,9 @@ onBeforeMount(async () => {
       :name="selectedRole.name"
       :permissions="BigInt(selectedRole.permissions)"
       :oidc-group="selectedRole.oidcGroup"
+      :type="selectedRole.type"
       @delete="deleteRole(selectedRole.id)"
-      @save="(role: Pick<AdminRole, 'name' | 'oidcGroup' | 'permissions'>) => saveRole(role)"
+      @save="(role: Pick<AdminRole, 'name' | 'oidcGroup' | 'permissions' | 'type'>) => saveRole(role)"
       @cancel="() => cancel()"
     />
   </div>
diff --git a/apps/server/src/prisma/migrations/20260127164002_add_type_to_roles/migration.sql b/apps/server/src/prisma/migrations/20260127164002_add_type_to_roles/migration.sql
new file mode 100644
index 000000000..40da41a75
--- /dev/null
+++ b/apps/server/src/prisma/migrations/20260127164002_add_type_to_roles/migration.sql
@@ -0,0 +1,11 @@
+-- AlterTable
+ALTER TABLE "AdminRole" ADD COLUMN     "type" TEXT NOT NULL DEFAULT 'custom';
+
+-- AlterTable
+ALTER TABLE "ProjectRole" ADD COLUMN     "type" TEXT NOT NULL DEFAULT 'custom';
+
+-- Update AdminRole system roles
+UPDATE "AdminRole" SET "type" = 'system' WHERE "name" IN ('Admin', 'Admin Locaux');
+
+-- Update ProjectRole system roles
+UPDATE "ProjectRole" SET "type" = 'system' WHERE "name" IN ('Administrateur', 'DevOps', 'Développeur', 'Lecture seule');
diff --git a/apps/server/src/prisma/migrations/20260204150335_add_system_roles/migration.sql b/apps/server/src/prisma/migrations/20260204150335_add_system_roles/migration.sql
new file mode 100644
index 000000000..adb8b6f25
--- /dev/null
+++ b/apps/server/src/prisma/migrations/20260204150335_add_system_roles/migration.sql
@@ -0,0 +1,26 @@
+-- Update existing Admin role to be system role 'Administrateur Plateforme'
+UPDATE "AdminRole"
+SET 
+  "name" = 'Administrateur Plateforme',
+  "type" = 'system',
+  "permissions" = 3, -- Assuming 3n means bit 0 and 1 (1 | 2 = 3)
+  "oidcGroup" = '/admin',
+  "position" = 0
+WHERE "id" = '76229c96-4716-45bc-99da-00498ec9018c'::uuid;
+
+-- Insert 'Lecture Seule Plateforme' system role if it doesn't exist
+INSERT INTO "AdminRole" ("id", "name", "permissions", "position", "oidcGroup", "type")
+VALUES (
+  '35848aa2-e881-4770-9844-0c5c3693e506'::uuid,
+  'Lecture Seule Plateforme',
+  1, -- Assuming 1n means bit 0
+  2,
+  '/readonly',
+  'system'
+)
+ON CONFLICT ("id") DO UPDATE
+SET
+  "name" = 'Lecture Seule Plateforme',
+  "type" = 'system',
+  "permissions" = 1,
+  "oidcGroup" = '/readonly';
diff --git a/apps/server/src/prisma/schema/admin.prisma b/apps/server/src/prisma/schema/admin.prisma
index 71cfb1754..e4a193197 100644
--- a/apps/server/src/prisma/schema/admin.prisma
+++ b/apps/server/src/prisma/schema/admin.prisma
@@ -12,6 +12,7 @@ model AdminRole {
   permissions BigInt
   position    Int    @db.SmallInt
   oidcGroup   String @default("")
+  type        String @default("custom")
 }
 
 model SystemSetting {
diff --git a/apps/server/src/prisma/schema/project.prisma b/apps/server/src/prisma/schema/project.prisma
index 8a0cf34c0..dfb84f521 100644
--- a/apps/server/src/prisma/schema/project.prisma
+++ b/apps/server/src/prisma/schema/project.prisma
@@ -67,6 +67,7 @@ model ProjectRole {
   projectId   String  @db.Uuid
   position    Int     @db.SmallInt
   oidcGroup   String  @default("")
+  type        String  @default("custom")
   project     Project @relation(fields: [projectId], references: [id])
 }
 
diff --git a/apps/server/src/resources/admin-role/business.spec.ts b/apps/server/src/resources/admin-role/business.spec.ts
index 1d3b78b12..d182ce2a5 100644
--- a/apps/server/src/resources/admin-role/business.spec.ts
+++ b/apps/server/src/resources/admin-role/business.spec.ts
@@ -2,7 +2,7 @@ import { faker } from '@faker-js/faker'
 import { describe, expect, it } from 'vitest'
 import type { AdminRole, User } from '@prisma/client'
 import prisma from '../../__mocks__/prisma.js'
-import { BadRequest400 } from '../../utils/errors.ts'
+import { BadRequest400, Forbidden403 } from '../../utils/errors.ts'
 import { countRolesMembers, createRole, deleteRole, listRoles, patchRoles } from './business.ts'
 
 describe('test admin-role business', () => {
@@ -14,11 +14,12 @@ describe('test admin-role business', () => {
         permissions: 4n,
         position: 0,
         oidcGroup: '',
+        type: 'custom',
       }
 
       prisma.adminRole.findMany.mockResolvedValueOnce([dbRole])
       const response = await listRoles()
-      expect(response).toContainEqual(expect.objectContaining({ permissions: '4' }))
+      expect(response).toContainEqual(expect.objectContaining({ permissions: '4', type: 'custom' }))
     })
   })
 
@@ -30,6 +31,7 @@ describe('test admin-role business', () => {
         permissions: 4n,
         position: 0,
         oidcGroup: '',
+        type: 'custom',
       }
 
       prisma.adminRole.findFirst.mockResolvedValueOnce(dbRole)
@@ -47,6 +49,7 @@ describe('test admin-role business', () => {
         permissions: 4n,
         position: 50,
         oidcGroup: '',
+        type: 'custom',
       }
 
       prisma.adminRole.findFirst.mockResolvedValueOnce(dbRole)
@@ -64,6 +67,7 @@ describe('test admin-role business', () => {
         permissions: 4n,
         position: 50,
         oidcGroup: '',
+        type: 'custom',
       }
 
       prisma.adminRole.findFirst.mockResolvedValueOnce(null)
@@ -105,9 +109,10 @@ describe('test admin-role business', () => {
         permissions: 4n,
         position: 50,
         oidcGroup: '',
+        type: 'custom',
       }
 
-      prisma.user.findMany.mockResolvedValueOnce(users)
+      prisma.user.findMany.mockResolvedValue(users)
       prisma.adminRole.findMany.mockResolvedValueOnce([])
       prisma.adminRole.findUnique.mockResolvedValueOnce(dbRole)
       prisma.adminRole.create.mockResolvedValue(dbRole)
@@ -117,7 +122,21 @@ describe('test admin-role business', () => {
       expect(prisma.user.update).toHaveBeenNthCalledWith(2, { where: { id: users[1].id }, data: { adminRoleIds: [users[1].adminRoleIds[1]] } })
       expect(prisma.adminRole.delete).toHaveBeenCalledWith({ where: { id: roleId } })
     })
+
+    it('should return 403 if trying to delete system role', async () => {
+      const systemRole = {
+        id: roleId,
+        type: 'system',
+      }
+      prisma.adminRole.findUnique.mockResolvedValue(systemRole as any)
+      prisma.user.findMany.mockResolvedValue([])
+
+      const response = await deleteRole(roleId)
+      expect(response).toBeInstanceOf(Forbidden403)
+      expect(prisma.adminRole.delete).not.toHaveBeenCalled()
+    })
   })
+
   describe('countRolesMembers', () => {
     it('should return aggregated role member counts', async () => {
       const roles = [{
@@ -126,12 +145,14 @@ describe('test admin-role business', () => {
         oidcGroup: '',
         permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
         position: 0,
+        type: 'custom',
       }, {
         id: faker.string.uuid(),
         name: faker.string.alphanumeric(),
         oidcGroup: '',
         permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
         position: 1,
+        type: 'custom',
       }] as const satisfies AdminRole[]
 
       const users = [{
@@ -170,14 +191,38 @@ describe('test admin-role business', () => {
       oidcGroup: '',
       permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
       position: 0,
+      type: 'custom',
     }, {
       id: faker.string.uuid(),
       name: faker.string.alphanumeric(),
       oidcGroup: '',
       permissions: faker.number.bigInt({ min: 0n, max: 50000n }),
       position: 1,
+      type: 'custom',
     }]
 
+    it('should throw Forbidden403 when renaming a system role', async () => {
+      const systemRole: AdminRole = {
+        id: faker.string.uuid(),
+        name: 'Admin',
+        permissions: 10n,
+        position: 0,
+        oidcGroup: 'admin-group',
+        type: 'system',
+      }
+      prisma.adminRole.findMany.mockResolvedValue([systemRole])
+
+      const updateRoles = [{
+        id: systemRole.id,
+        name: 'New Admin Name',
+      }]
+
+      const result = await patchRoles(updateRoles)
+
+      await expect(result).toBeInstanceOf(Forbidden403)
+      expect(prisma.adminRole.update).toHaveBeenCalledTimes(0)
+    })
+
     it('should do nothing', async () => {
       prisma.adminRole.findMany.mockResolvedValue([])
       await patchRoles([])
@@ -233,11 +278,27 @@ describe('test admin-role business', () => {
           oidcGroup: dbRoles[1].oidcGroup,
           permissions: 0n,
           position: 1,
+          type: 'custom',
         },
         where: {
           id: dbRoles[1].id,
         },
       })
     })
+
+    it('should return 403 if trying to update system role', async () => {
+      const systemRole = {
+        id: faker.string.uuid(),
+        type: 'system',
+        name: 'sys',
+        permissions: 0n,
+        position: 0,
+      }
+      prisma.adminRole.findMany.mockResolvedValue([systemRole as any])
+
+      const response = await patchRoles([{ id: systemRole.id, name: 'new name' }])
+      expect(response).toBeInstanceOf(Forbidden403)
+      expect(prisma.adminRole.update).not.toHaveBeenCalled()
+    })
   })
 })
diff --git a/apps/server/src/resources/admin-role/business.ts b/apps/server/src/resources/admin-role/business.ts
index a43cebf22..0610cf310 100644
--- a/apps/server/src/resources/admin-role/business.ts
+++ b/apps/server/src/resources/admin-role/business.ts
@@ -1,39 +1,49 @@
 import type { Project, ProjectRole } from '@prisma/client'
 import type { AdminRole, adminRoleContract } from '@cpn-console/shared'
 import {
+  getAdminRoleById,
   listAdminRoles,
 } from '@/resources/queries-index.js'
 import type { ErrorResType } from '@/utils/errors.js'
-import { BadRequest400 } from '@/utils/errors.js'
+import { BadRequest400, Forbidden403 } from '@/utils/errors.js'
 import prisma from '@/prisma.js'
 
 export async function listRoles() {
   return listAdminRoles()
-    .then(roles => roles.map(role => ({ ...role, permissions: role.permissions.toString() })))
+    .then(roles => roles.map(role => ({ ...role, permissions: role.permissions.toString(), type: role.type ?? 'custom' })))
 }
 
 export async function patchRoles(roles: typeof adminRoleContract.patchAdminRoles.body._type): Promise<AdminRole[] | ErrorResType> {
   const dbRoles = await prisma.adminRole.findMany()
   const positionsAvailable: number[] = []
+  const updatedRoles: (Omit<AdminRole, 'permissions'> & { permissions: bigint })[] = []
 
-  const updatedRoles: (Omit<AdminRole, 'permissions'> & { permissions: bigint })[] = dbRoles
-    .filter(dbRole => roles.find(role => role.id === dbRole.id)) // filter non concerned dbRoles
-    .map((dbRole) => {
-      const matchingRole = roles.find(role => role.id === dbRole.id)
-      if (typeof matchingRole?.position !== 'undefined' && !positionsAvailable.includes(matchingRole.position)) {
+  for (const dbRole of dbRoles) {
+    const matchingRole = roles.find(role => role.id === dbRole.id)
+    if (matchingRole) {
+      if (dbRole.type === 'system') {
+        return new Forbidden403('Impossible de modifier un rôle système')
+      }
+
+      if (typeof matchingRole.position !== 'undefined' && !positionsAvailable.includes(matchingRole.position)) {
         positionsAvailable.push(matchingRole.position)
       }
-      return {
+      updatedRoles.push({
         id: dbRole.id,
-        name: matchingRole?.name ?? dbRole.name,
-        permissions: matchingRole?.permissions ? BigInt(matchingRole?.permissions) : dbRole.permissions,
-        position: matchingRole?.position ?? dbRole.position,
-        oidcGroup: matchingRole?.oidcGroup ?? dbRole.oidcGroup,
-      }
-    })
+        name: matchingRole.name ?? dbRole.name,
+        permissions: matchingRole.permissions ? BigInt(matchingRole.permissions) : dbRole.permissions,
+        position: matchingRole.position ?? dbRole.position,
+        oidcGroup: matchingRole.oidcGroup ?? dbRole.oidcGroup,
+        type: matchingRole.type ?? dbRole.type,
+      })
+    }
+  }
 
   if (positionsAvailable.length && positionsAvailable.length !== dbRoles.length) return new BadRequest400('Les numéros de position des rôles sont incohérentes')
   for (const { id, ...role } of updatedRoles) {
+    if (role.type === 'system') {
+      return new Forbidden403('Ce rôle système ne peut pas être renommé')
+    }
     await prisma.adminRole.update({ where: { id }, data: role })
   }
 
@@ -74,6 +84,11 @@ export async function countRolesMembers() {
 }
 
 export async function deleteRole(roleId: Project['id']) {
+  const role = await getAdminRoleById(roleId)
+  if (role) {
+    if (role.type === 'system') return new Forbidden403('Impossible de supprimer un rôle système')
+  }
+
   const allUsers = await prisma.user.findMany({
     where: {
       adminRoleIds: { has: roleId },
diff --git a/apps/server/src/resources/admin-role/queries.ts b/apps/server/src/resources/admin-role/queries.ts
index f4893b317..bb3c4e4d5 100644
--- a/apps/server/src/resources/admin-role/queries.ts
+++ b/apps/server/src/resources/admin-role/queries.ts
@@ -12,21 +12,29 @@ export function createAdminRole(data: Pick<Prisma.AdminRoleUncheckedCreateInput,
       name: data.name,
       permissions: 0n,
       position: data.position,
+      type: 'custom',
     },
   })
 }
 
 export function updateAdminRole(id: AdminRole['id'], data: Pick<Prisma.AdminRoleUncheckedUpdateInput, 'permissions' | 'name' | 'position' | 'id'>) {
-  return prisma.projectRole.updateMany({
+  return prisma.adminRole.updateMany({
     where: { id },
     data,
   })
 }
 
 export function deleteAdminRole(id: AdminRole['id']) {
-  return prisma.projectRole.delete({
+  return prisma.adminRole.delete({
     where: {
       id,
     },
   })
 }
+
+export async function getAdminRoleById(id: string) {
+  const role = await prisma.adminRole.findUnique({ where: { id } })
+  if (!role) return null
+  const members = await prisma.user.findMany({ where: { adminRoleIds: { has: id } } })
+  return { ...role, members }
+}
diff --git a/apps/server/src/resources/admin-role/router.spec.ts b/apps/server/src/resources/admin-role/router.spec.ts
index 5fc0bc66c..f23880cdf 100644
--- a/apps/server/src/resources/admin-role/router.spec.ts
+++ b/apps/server/src/resources/admin-role/router.spec.ts
@@ -22,7 +22,7 @@ describe('test adminRoleContract', () => {
 
   describe('listAdminRoles', () => {
     it('should return list of admin roles', async () => {
-      const roles = [{ id: faker.string.uuid(), name: 'Role 1', oidcGroup: '', position: 0, permissions: '1' }]
+      const roles = [{ id: faker.string.uuid(), name: 'Role 1', oidcGroup: '', position: 0, permissions: '1', type: 'custom' }]
       businessListRolesMock.mockResolvedValueOnce(roles)
 
       const response = await app.inject()
@@ -70,8 +70,8 @@ describe('test adminRoleContract', () => {
   })
 
   describe('patchAdminRoles', () => {
-    const updatedRoles = [{ id: faker.string.uuid(), name: 'Role 1', oidcGroup: '', position: 0, permissions: '1' }]
-    const rolesData = [{ id: updatedRoles[0].id, name: 'Updated Role' }]
+    const updatedRoles = [{ id: faker.string.uuid(), name: 'Role 1', oidcGroup: '', position: 0, permissions: '1', type: 'custom' }]
+    const rolesData = [{ id: updatedRoles[0].id, name: 'Updated Role', type: 'custom' }]
     it('should update roles for authorized users', async () => {
       const user = getUserMockInfos(true)
 
diff --git a/apps/server/src/resources/admin-role/router.ts b/apps/server/src/resources/admin-role/router.ts
index 18b1fc226..da758c0e9 100644
--- a/apps/server/src/resources/admin-role/router.ts
+++ b/apps/server/src/resources/admin-role/router.ts
@@ -64,6 +64,7 @@ export function adminRoleRouter() {
       if (!AdminAuthorized.isAdmin(perms.adminPermissions)) return new Forbidden403()
 
       const resBody = await deleteRole(params.roleId)
+      if (resBody instanceof ErrorResType) return resBody
 
       return {
         status: 204,
diff --git a/apps/server/src/resources/project-role/business.spec.ts b/apps/server/src/resources/project-role/business.spec.ts
index 460944f55..c080406d2 100644
--- a/apps/server/src/resources/project-role/business.spec.ts
+++ b/apps/server/src/resources/project-role/business.spec.ts
@@ -1,9 +1,9 @@
 import { faker } from '@faker-js/faker'
 import { describe, expect, it } from 'vitest'
-import type { ProjectMembers, ProjectRole } from '@prisma/client'
+import type { Project, ProjectMembers, ProjectRole } from '@prisma/client'
 import prisma from '../../__mocks__/prisma.js'
-import { BadRequest400 } from '../../utils/errors.ts'
 import { countRolesMembers, createRole, deleteRole, listRoles, patchRoles } from './business.ts'
+import { Forbidden403, BadRequest400 } from '@/utils/errors.js'
 
 describe('test project-role business', () => {
   const project: Project = {
@@ -37,6 +37,7 @@ describe('test project-role business', () => {
         permissions: 4n,
         position: 0,
         oidcGroup: '',
+        type: 'custom',
       }
 
       prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
@@ -46,13 +47,14 @@ describe('test project-role business', () => {
     })
 
     it('should strip oidcGroup prefix', async () => {
-      const dbRole: any = {
+      const dbRole: ProjectRole = {
         id: faker.string.uuid(),
         name: faker.string.alphanumeric(),
         projectId,
         permissions: 4n,
         position: 0,
         oidcGroup: `/${project.slug}/console/admin`,
+        type: 'custom',
       }
 
       prisma.project.findUnique.mockResolvedValueOnce(project)
@@ -72,6 +74,7 @@ describe('test project-role business', () => {
         permissions: 4n,
         position: 0,
         oidcGroup: '',
+        type: 'custom',
       }
 
       prisma.project.findUnique.mockResolvedValue(project)
@@ -91,6 +94,7 @@ describe('test project-role business', () => {
         permissions: 4n,
         position: 50,
         oidcGroup: '',
+        type: 'custom',
       }
 
       prisma.project.findUnique.mockResolvedValue(project)
@@ -110,6 +114,7 @@ describe('test project-role business', () => {
         permissions: 4n,
         position: 50,
         oidcGroup: '',
+        type: 'custom',
       }
 
       prisma.project.findUnique.mockResolvedValue(project)
@@ -132,6 +137,7 @@ describe('test project-role business', () => {
         permissions: 4n,
         position: 0,
         oidcGroup: `/${project.slug}/console/admin`,
+        type: 'custom',
       }
 
       prisma.project.findUnique.mockResolvedValueOnce(project)
@@ -160,6 +166,7 @@ describe('test project-role business', () => {
         permissions: 4n,
         position: 50,
         oidcGroup: '',
+        type: 'custom',
       }
       const members = [{
         userId: faker.string.uuid(),
@@ -181,6 +188,24 @@ describe('test project-role business', () => {
       expect(prisma.projectMembers.update).toHaveBeenNthCalledWith(2, { where: expect.any(Object), data: { roleIds: { set: [members[1].roleIds[1]] } } })
       expect(prisma.projectRole.delete).toHaveBeenCalledWith({ where: { id: roleId } })
     })
+
+    it('should throw Forbidden403 when deleting a system role', async () => {
+      const dbRole: ProjectRole = {
+        id: roleId,
+        name: 'Administrateur',
+        projectId,
+        permissions: 4n,
+        position: 50,
+        oidcGroup: '',
+        type: 'system',
+      }
+      prisma.projectRole.findUnique.mockResolvedValueOnce(dbRole)
+
+      const result = await deleteRole(roleId)
+
+      await expect(result).toBeInstanceOf(Forbidden403)
+      expect(prisma.projectRole.delete).not.toHaveBeenCalled()
+    })
   })
   describe.skip('countRolesMembers', () => {
     it('should return aggregated role member counts', async () => {
@@ -191,6 +216,7 @@ describe('test project-role business', () => {
         permissions: 4n,
         position: 50,
         oidcGroup: '',
+        type: 'custom',
       }, {
         id: faker.string.uuid(),
         name: faker.string.alphanumeric(),
@@ -198,6 +224,7 @@ describe('test project-role business', () => {
         permissions: 4n,
         position: 50,
         oidcGroup: '',
+        type: 'custom',
       }] as const satisfies ProjectRole[]
 
       const members = [{
@@ -218,6 +245,7 @@ describe('test project-role business', () => {
       expect(response).toEqual({ [roles[0].id]: 1, [roles[1].id]: 2 })
     })
   })
+
   describe('patchRoles', () => {
     const dbRoles: ProjectRole[] = [{
       id: faker.string.uuid(),
@@ -226,6 +254,7 @@ describe('test project-role business', () => {
       position: 0,
       projectId,
       oidcGroup: 'group1',
+      type: 'custom',
     }, {
       id: faker.string.uuid(),
       name: faker.string.alphanumeric(),
@@ -233,8 +262,33 @@ describe('test project-role business', () => {
       position: 1,
       projectId,
       oidcGroup: 'group2',
+      type: 'custom',
     }]
 
+    it('should throw Forbidden403 when renaming a system role', async () => {
+      const systemRole: ProjectRole = {
+        id: faker.string.uuid(),
+        name: 'Administrateur',
+        permissions: 10n,
+        position: 0,
+        projectId,
+        oidcGroup: 'admin-group',
+        type: 'system',
+      }
+      prisma.project.findUnique.mockResolvedValue({ name: 'My Project', slug: 'myproject' } as any)
+      prisma.projectRole.findMany.mockResolvedValue([systemRole])
+
+      const updateRoles = [{
+        id: systemRole.id,
+        name: 'New Admin Name',
+      }]
+
+      const result = await patchRoles(projectId, updateRoles)
+
+      await expect(result).toBeInstanceOf(Forbidden403)
+      expect(prisma.projectRole.update).toHaveBeenCalledTimes(0)
+    })
+
     it('should do nothing', async () => {
       prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue([])
@@ -291,13 +345,14 @@ describe('test project-role business', () => {
 
       await patchRoles(projectId, updateRoles)
 
-      expect(prisma.projectRole.update).toHaveBeenCalledTimes(1)
       expect(prisma.projectRole.update).toHaveBeenCalledWith(expect.objectContaining({
         data: {
           name: dbRoles[1].name,
           permissions: 0n,
           position: 1,
           oidcGroup: dbRoles[1].oidcGroup,
+          projectId,
+          type: 'custom',
         },
         where: {
           id: dbRoles[1].id,
diff --git a/apps/server/src/resources/project-role/business.ts b/apps/server/src/resources/project-role/business.ts
index 78a3f252a..8dfca0208 100644
--- a/apps/server/src/resources/project-role/business.ts
+++ b/apps/server/src/resources/project-role/business.ts
@@ -4,9 +4,8 @@ import {
   deleteRole as deleteRoleQuery,
   listMembers,
   listRoles as listRolesQuery,
-  updateRole,
 } from '@/resources/queries-index.js'
-import { BadRequest400, NotFound404 } from '@/utils/errors.js'
+import { BadRequest400, Forbidden403, NotFound404 } from '@/utils/errors.js'
 import prisma from '@/prisma.js'
 
 export async function listRoles(projectId: Project['id']) {
@@ -21,31 +20,39 @@ export async function listRoles(projectId: Project['id']) {
 export async function patchRoles(projectId: Project['id'], roles: typeof projectRoleContract.patchProjectRoles.body._type) {
   const project = await prisma.project.findUnique({ where: { id: projectId }, select: { slug: true } })
   if (!project) throw new NotFound404()
-  const dbRoles = await listRoles(projectId)
+  const dbRoles = await listRolesQuery(projectId)
   const positionsAvailable: number[] = []
 
-  const updatedRoles = dbRoles
-    .filter(dbRole => roles.find(role => role.id === dbRole.id)) // filter non concerned dbRoles
-    .map((dbRole) => {
-      const matchingRole = roles.find(role => role.id === dbRole.id)
-      if (typeof matchingRole?.position !== 'undefined' && !positionsAvailable.includes(matchingRole?.position)) {
-        positionsAvailable.push(matchingRole.position)
+  const updatedRoles: (Omit<ProjectRole, 'permissions'> & { permissions: bigint })[] = []
+
+  for (const dbRole of dbRoles) {
+    const matchingRole = roles.find(role => role.id === dbRole.id)
+    if (matchingRole) {
+      if (dbRole.type === 'system') {
+        return new Forbidden403('Ce rôle système ne peut pas être renommé')
       }
 
       if (typeof matchingRole?.position !== 'undefined' && !positionsAvailable.includes(matchingRole?.position)) {
         positionsAvailable.push(matchingRole.position)
       }
-      return {
-        id: matchingRole?.id ?? dbRole.id,
-        name: matchingRole?.name ?? dbRole.name,
-        permissions: matchingRole?.permissions ? BigInt(matchingRole?.permissions) : BigInt(dbRole.permissions),
-        position: matchingRole?.position ?? dbRole.position,
-        oidcGroup: matchingRole?.oidcGroup ? `/${project.slug}/console${matchingRole.oidcGroup}` : dbRole.oidcGroup,
+      if (matchingRole.oidcGroup && !matchingRole.oidcGroup.startsWith('/')) {
+        return new BadRequest400('oidcGroup doit commencer par /')
       }
-    })
+      updatedRoles.push({
+        id: dbRole.id,
+        name: matchingRole.name ?? dbRole.name,
+        permissions: matchingRole.permissions ? BigInt(matchingRole.permissions) : dbRole.permissions,
+        position: matchingRole.position ?? dbRole.position,
+        oidcGroup: matchingRole.oidcGroup ? `/${project.slug}/console${matchingRole.oidcGroup}` : dbRole.oidcGroup,
+        type: matchingRole.type ?? dbRole.type,
+        projectId: dbRole.projectId,
+      })
+    }
+  }
+
   if (positionsAvailable.length && positionsAvailable.length !== dbRoles.length) return new BadRequest400('Les numéros de position des rôles sont incohérentes')
   for (const { id, ...role } of updatedRoles) {
-    await updateRole(id, role)
+    await prisma.projectRole.update({ where: { id }, data: role })
   }
 
   return listRoles(projectId)
@@ -60,6 +67,10 @@ export async function createRole(projectId: Project['id'], role: typeof projectR
     select: { position: true },
   }))?.position ?? -1
 
+  if (role.type === 'system') {
+    return new Forbidden403('Ce rôle système ne peut pas être renommé')
+  }
+
   if (role.oidcGroup && !role.oidcGroup.startsWith('/')) {
     throw new BadRequest400('oidcGroup doit commencer par /')
   }
@@ -90,6 +101,10 @@ export async function countRolesMembers(projectId: Project['id']) {
 }
 
 export async function deleteRole(roleId: Project['id']) {
+  const role = await prisma.projectRole.findUnique({ where: { id: roleId } })
+  if (role?.type === 'system') {
+    return new Forbidden403('Ce rôle système ne peut pas être supprimé')
+  }
   await deleteRoleQuery(roleId)
   return null
 }
diff --git a/apps/server/src/resources/project-role/queries.ts b/apps/server/src/resources/project-role/queries.ts
index db2528a9c..7fb791878 100644
--- a/apps/server/src/resources/project-role/queries.ts
+++ b/apps/server/src/resources/project-role/queries.ts
@@ -16,6 +16,7 @@ export function createRole(data: Pick<Prisma.ProjectRoleUncheckedCreateInput, 'p
       position: data.position,
       projectId: data.projectId,
       oidcGroup: data.oidcGroup,
+      type: 'custom',
     },
   })
 }
diff --git a/apps/server/src/resources/project-role/router.ts b/apps/server/src/resources/project-role/router.ts
index 2d55a2b84..7c6e1c71e 100644
--- a/apps/server/src/resources/project-role/router.ts
+++ b/apps/server/src/resources/project-role/router.ts
@@ -35,6 +35,7 @@ export function projectRoleRouter() {
       if (perms.projectStatus === 'archived') return new Forbidden403('Le projet est archivé')
 
       const resBody = await createRole(projectId, body)
+      if (resBody instanceof ErrorResType) return resBody
 
       return {
         status: 201,
@@ -80,6 +81,7 @@ export function projectRoleRouter() {
       if (perms.projectStatus === 'archived') return new Forbidden403('Le projet est archivé')
 
       const resBody = await deleteRole(roleId)
+      if (resBody instanceof ErrorResType) return resBody
 
       return {
         status: 204,
diff --git a/apps/server/src/resources/project/queries.ts b/apps/server/src/resources/project/queries.ts
index 23544d1d2..4bf5d61aa 100644
--- a/apps/server/src/resources/project/queries.ts
+++ b/apps/server/src/resources/project/queries.ts
@@ -7,6 +7,7 @@ import {
   ProjectStatus,
 } from '@prisma/client'
 import type { XOR, projectContract } from '@cpn-console/shared'
+import { PROJECT_PERMS } from '@cpn-console/shared'
 import prisma from '@/prisma.js'
 import { appVersion } from '@/utils/env.js'
 import { uuid } from '@/utils/queries-tools.js'
@@ -257,6 +258,38 @@ export function initializeProject(params: CreateProjectParams) {
       description: params.description ?? '',
       status: ProjectStatus.created,
       locked: false,
+      roles: {
+        create: [
+          {
+            name: 'Administrateur',
+            permissions: PROJECT_PERMS.MANAGE,
+            position: 0,
+            oidcGroup: `/${params.slug}/console/admin`,
+            type: 'system',
+          },
+          {
+            name: 'DevOps',
+            permissions: PROJECT_PERMS.MANAGE_ENVIRONMENTS | PROJECT_PERMS.MANAGE_REPOSITORIES | PROJECT_PERMS.REPLAY_HOOKS | PROJECT_PERMS.SEE_SECRETS | PROJECT_PERMS.LIST_ENVIRONMENTS | PROJECT_PERMS.LIST_REPOSITORIES,
+            position: 1,
+            oidcGroup: `/${params.slug}/console/devops`,
+            type: 'system',
+          },
+          {
+            name: 'Développeur',
+            permissions: PROJECT_PERMS.MANAGE_REPOSITORIES | PROJECT_PERMS.LIST_ENVIRONMENTS | PROJECT_PERMS.LIST_REPOSITORIES,
+            position: 2,
+            oidcGroup: `/${params.slug}/console/developer`,
+            type: 'system',
+          },
+          {
+            name: 'Lecture seule',
+            permissions: PROJECT_PERMS.LIST_ENVIRONMENTS | PROJECT_PERMS.LIST_REPOSITORIES,
+            position: 3,
+            oidcGroup: `/${params.slug}/console/readonly`,
+            type: 'system',
+          },
+        ],
+      },
       ...params,
     },
   })
diff --git a/packages/shared/src/contracts/admin-role.ts b/packages/shared/src/contracts/admin-role.ts
index b2c41f0d4..fbc83446b 100644
--- a/packages/shared/src/contracts/admin-role.ts
+++ b/packages/shared/src/contracts/admin-role.ts
@@ -31,7 +31,7 @@ export const adminRoleContract = contractInstance.router({
   patchAdminRoles: {
     method: 'PATCH',
     path: '',
-    body: AdminRoleSchema.partial({ name: true, permissions: true, position: true, oidcGroup: true }).array(),
+    body: AdminRoleSchema.partial({ name: true, permissions: true, position: true, oidcGroup: true, type: true }).array(),
     responses: {
       200: AdminRoleSchema.array(),
       400: ErrorSchema,
diff --git a/packages/shared/src/schemas/role.ts b/packages/shared/src/schemas/role.ts
index faf860110..24224f5fc 100644
--- a/packages/shared/src/schemas/role.ts
+++ b/packages/shared/src/schemas/role.ts
@@ -9,6 +9,7 @@ export const RoleSchema = z.object({
   name: RoleNameSchema,
   permissions: permissionLevelSchema,
   position: z.number().min(0),
+  type: z.string().optional(),
 })
 
 export const ProjectRoleSchema = RoleSchema.extend({
@@ -18,6 +19,7 @@ export const ProjectRoleSchema = RoleSchema.extend({
 
 export const AdminRoleSchema = RoleSchema.extend({
   oidcGroup: z.string(),
+  type: z.string().optional().default('custom'),
 })
 
 export const RoleNameCsvSchema = z.string()
diff --git a/packages/shared/src/utils/permissions.ts b/packages/shared/src/utils/permissions.ts
index 5aed0bd0f..a042e8d14 100644
--- a/packages/shared/src/utils/permissions.ts
+++ b/packages/shared/src/utils/permissions.ts
@@ -58,6 +58,7 @@ export const PROJECT_PERMS = { // project permissions
 
 // Be very careful and think to apply corresponding updates in database if you modify these values, You'll have to do binary updates in SQL, good luck !
 export const ADMIN_PERMS = { // admin permissions
+  LIST: bit(0n),
   MANAGE: bit(1n),
 }
 
diff --git a/packages/test-utils/src/imports/data.ts b/packages/test-utils/src/imports/data.ts
index 7ee16e5e2..394b07959 100644
--- a/packages/test-utils/src/imports/data.ts
+++ b/packages/test-utils/src/imports/data.ts
@@ -21,10 +21,11 @@ export const data = {
   adminRole: [
     {
       id: '76229c96-4716-45bc-99da-00498ec9018c',
-      permissions: '2n',
+      permissions: '3n',
       position: 0,
       oidcGroup: '/admin',
-      name: 'Admin',
+      name: 'Administrateur Plateforme',
+      type: 'system',
     },
     {
       id: 'eadf604f-5f54-4744-bdfb-4793d2271e9b',
@@ -32,6 +33,15 @@ export const data = {
       position: 1,
       oidcGroup: '',
       name: 'Admin Locaux',
+      type: 'custom',
+    },
+    {
+      id: '35848aa2-e881-4770-9844-0c5c3693e506',
+      permissions: '1n',
+      position: 2,
+      oidcGroup: '/readonly',
+      name: 'Lecture Seule Plateforme',
+      type: 'system',
     },
   ],
   kubeconfig: [
diff --git a/playwright/e2e-tests/roles.spec.ts b/playwright/e2e-tests/roles.spec.ts
index 1b64cc4dc..7028e4ad5 100644
--- a/playwright/e2e-tests/roles.spec.ts
+++ b/playwright/e2e-tests/roles.spec.ts
@@ -194,4 +194,23 @@ test.describe('Administration Roles', () => {
     // Assert
     await expect(page.getByTestId('role-list')).not.toContainText(newRole.name)
   })
+
+  test('Should not be able to edit system roles', { tag: '@e2e' }, async ({ page }) => {
+    // Arrange
+    await page.goto(clientURL)
+    await signInCloudPiNative({ page, credentials: tcolinUser })
+
+    // Act
+    await page.getByTestId('menuAdministrationBtn').click()
+    await page.getByTestId('menuAdministrationRoles').click()
+
+    // Select system role
+    await page.getByTestId('76229c96-4716-45bc-99da-00498ec9018c-tab').click()
+
+    // Assert
+    await expect(page.getByTestId('roleNameInput')).toBeDisabled()
+    await expect(page.getByTestId('oidcGroupInput')).toBeDisabled()
+    await expect(page.getByTestId('saveBtn')).toBeHidden()
+    await expect(page.getByTestId('deleteBtn')).toBeHidden()
+  })
 })

From 425591f64533d1b0cb53732a300462e8c03edc68 Mon Sep 17 00:00:00 2001
From: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Date: Fri, 6 Feb 2026 10:28:11 +0100
Subject: [PATCH 3/3] feat(keycloak): add project role creation hook

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
---
 .../src/__mocks__/utils/hook-wrapper.ts       |  4 +
 .../resources/project-role/business.spec.ts   | 32 +++++--
 .../src/resources/project-role/business.ts    | 10 ++-
 .../src/resources/project-role/queries.ts     |  2 +
 apps/server/src/resources/project/business.ts |  5 ++
 apps/server/src/utils/hook-wrapper.ts         | 29 ++++++-
 packages/hooks/src/hooks/hook-project-role.ts |  6 ++
 packages/hooks/src/hooks/index.ts             |  1 +
 playwright/e2e-tests/project-logs.spec.ts     | 10 +--
 playwright/e2e-tests/service-chains.spec.ts   | 11 +--
 playwright/e2e-tests/system-roles.spec.ts     | 47 ++++++++++
 plugins/keycloak/src/functions.ts             | 85 ++++++++++++++++++-
 plugins/keycloak/src/group.ts                 |  4 +
 plugins/keycloak/src/index.ts                 |  8 ++
 14 files changed, 229 insertions(+), 25 deletions(-)
 create mode 100644 packages/hooks/src/hooks/hook-project-role.ts
 create mode 100644 playwright/e2e-tests/system-roles.spec.ts

diff --git a/apps/server/src/__mocks__/utils/hook-wrapper.ts b/apps/server/src/__mocks__/utils/hook-wrapper.ts
index 34c7bee26..07ef829dc 100644
--- a/apps/server/src/__mocks__/utils/hook-wrapper.ts
+++ b/apps/server/src/__mocks__/utils/hook-wrapper.ts
@@ -17,6 +17,10 @@ export const hook = {
     delete: vi.fn(),
     getSecrets: vi.fn(),
   },
+  projectRole: {
+    upsert: vi.fn(),
+    delete: vi.fn(),
+  },
   user: {
     retrieveUserByEmail: vi.fn(),
   },
diff --git a/apps/server/src/resources/project-role/business.spec.ts b/apps/server/src/resources/project-role/business.spec.ts
index c080406d2..f1719ef06 100644
--- a/apps/server/src/resources/project-role/business.spec.ts
+++ b/apps/server/src/resources/project-role/business.spec.ts
@@ -1,10 +1,27 @@
 import { faker } from '@faker-js/faker'
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import type { Project, ProjectMembers, ProjectRole } from '@prisma/client'
 import prisma from '../../__mocks__/prisma.js'
 import { countRolesMembers, createRole, deleteRole, listRoles, patchRoles } from './business.ts'
 import { Forbidden403, BadRequest400 } from '@/utils/errors.js'
 
+vi.mock('../../utils/hook-wrapper.ts', () => ({
+  hook: {
+    project: {
+      upsert: vi.fn(),
+      delete: vi.fn(),
+      getSecrets: vi.fn(),
+    },
+    projectRole: {
+      upsert: vi.fn(),
+      delete: vi.fn(),
+    },
+    user: {
+      retrieveUserByEmail: vi.fn(),
+    },
+  },
+}))
+
 describe('test project-role business', () => {
   const project: Project = {
     id: faker.string.uuid(),
@@ -79,8 +96,8 @@ describe('test project-role business', () => {
 
       prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findFirst.mockResolvedValueOnce(dbRole)
-      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
       prisma.projectRole.create.mockResolvedValue(dbRole)
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
       await createRole(projectId, { name: 'test', permissions: '4' })
 
       expect(prisma.projectRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 4n, position: 1, projectId } })
@@ -99,8 +116,8 @@ describe('test project-role business', () => {
 
       prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findFirst.mockResolvedValueOnce(dbRole)
-      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
       prisma.projectRole.create.mockResolvedValue(dbRole)
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
       await createRole(projectId, { name: 'test', permissions: '4' })
 
       expect(prisma.projectRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 4n, position: 51, projectId } })
@@ -119,11 +136,11 @@ describe('test project-role business', () => {
 
       prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findFirst.mockResolvedValueOnce(null)
-      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
       prisma.projectRole.create.mockResolvedValue(dbRole)
-      prisma.projectRole.findFirst.mockResolvedValueOnce(null)
       prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
+      prisma.projectRole.findFirst.mockResolvedValueOnce(null)
       prisma.projectRole.create.mockResolvedValue(dbRole)
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
       await createRole(projectId, { name: 'test', permissions: '4' })
 
       expect(prisma.projectRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 4n, position: 0, projectId } })
@@ -143,7 +160,6 @@ describe('test project-role business', () => {
       prisma.project.findUnique.mockResolvedValueOnce(project)
       prisma.projectRole.findFirst.mockResolvedValueOnce(dbRole)
       prisma.projectRole.create.mockResolvedValue(dbRole)
-      prisma.project.findUnique.mockResolvedValueOnce(project)
       prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
 
       await createRole(projectId, { name: 'test', permissions: '4', oidcGroup: '/admin' })
@@ -178,7 +194,7 @@ describe('test project-role business', () => {
         roleIds: [roleId, faker.string.uuid()],
       }] as const satisfies Partial<ProjectMembers>[]
 
-      prisma.projectRole.findUnique.mockResolvedValueOnce(dbRole)
+      prisma.projectRole.findUnique.mockResolvedValue(dbRole)
       prisma.projectMembers.findMany.mockResolvedValueOnce(members)
       prisma.projectRole.findMany.mockResolvedValueOnce([])
       prisma.projectRole.delete.mockResolvedValue(dbRole)
@@ -199,7 +215,7 @@ describe('test project-role business', () => {
         oidcGroup: '',
         type: 'system',
       }
-      prisma.projectRole.findUnique.mockResolvedValueOnce(dbRole)
+      prisma.projectRole.findUnique.mockResolvedValue(dbRole)
 
       const result = await deleteRole(roleId)
 
diff --git a/apps/server/src/resources/project-role/business.ts b/apps/server/src/resources/project-role/business.ts
index 8dfca0208..13e413bd4 100644
--- a/apps/server/src/resources/project-role/business.ts
+++ b/apps/server/src/resources/project-role/business.ts
@@ -4,8 +4,10 @@ import {
   deleteRole as deleteRoleQuery,
   listMembers,
   listRoles as listRolesQuery,
+  updateRole,
 } from '@/resources/queries-index.js'
 import { BadRequest400, Forbidden403, NotFound404 } from '@/utils/errors.js'
+import { hook } from '@/utils/hook-wrapper.js'
 import prisma from '@/prisma.js'
 
 export async function listRoles(projectId: Project['id']) {
@@ -52,7 +54,8 @@ export async function patchRoles(projectId: Project['id'], roles: typeof project
 
   if (positionsAvailable.length && positionsAvailable.length !== dbRoles.length) return new BadRequest400('Les numéros de position des rôles sont incohérentes')
   for (const { id, ...role } of updatedRoles) {
-    await prisma.projectRole.update({ where: { id }, data: role })
+    await updateRole(id, role)
+    await hook.projectRole.upsert(id)
   }
 
   return listRoles(projectId)
@@ -75,7 +78,7 @@ export async function createRole(projectId: Project['id'], role: typeof projectR
     throw new BadRequest400('oidcGroup doit commencer par /')
   }
 
-  await prisma.projectRole.create({
+  const createdRole = await prisma.projectRole.create({
     data: {
       ...role,
       projectId,
@@ -85,6 +88,8 @@ export async function createRole(projectId: Project['id'], role: typeof projectR
     },
   })
 
+  await hook.projectRole.upsert(createdRole.id)
+
   return listRoles(projectId)
 }
 
@@ -105,6 +110,7 @@ export async function deleteRole(roleId: Project['id']) {
   if (role?.type === 'system') {
     return new Forbidden403('Ce rôle système ne peut pas être supprimé')
   }
+  await hook.projectRole.delete(roleId)
   await deleteRoleQuery(roleId)
   return null
 }
diff --git a/apps/server/src/resources/project-role/queries.ts b/apps/server/src/resources/project-role/queries.ts
index 7fb791878..810d4c83a 100644
--- a/apps/server/src/resources/project-role/queries.ts
+++ b/apps/server/src/resources/project-role/queries.ts
@@ -6,6 +6,8 @@ import type {
 
 import prisma from '@/prisma.js'
 
+export const getRole = (id: ProjectRole['id']) => prisma.projectRole.findUnique({ where: { id } })
+
 export const listRoles = (projectId: Project['id']) => prisma.projectRole.findMany({ where: { projectId }, orderBy: { position: 'asc' } })
 
 export function createRole(data: Pick<Prisma.ProjectRoleUncheckedCreateInput, 'permissions' | 'name' | 'position' | 'projectId' | 'oidcGroup'>) {
diff --git a/apps/server/src/resources/project/business.ts b/apps/server/src/resources/project/business.ts
index 7c6bb5800..9f76e983f 100644
--- a/apps/server/src/resources/project/business.ts
+++ b/apps/server/src/resources/project/business.ts
@@ -82,6 +82,11 @@ export async function createProject(dataDto: typeof projectContract.createProjec
     return new Unprocessable422('Echec des services à la création du projet')
   }
 
+  for (const role of projectInfos.roles) {
+    const roleResult = await hook.projectRole.upsert(role.id)
+    await addLogs({ action: 'Upsert Project Role', data: roleResult.results, userId: requestor.id, requestId, projectId: project.id })
+  }
+
   return {
     ...projectInfos,
     clusterIds: projectInfos.clusters.map(({ id }) => id),
diff --git a/apps/server/src/utils/hook-wrapper.ts b/apps/server/src/utils/hook-wrapper.ts
index 4a248450e..2d2496953 100644
--- a/apps/server/src/utils/hook-wrapper.ts
+++ b/apps/server/src/utils/hook-wrapper.ts
@@ -4,7 +4,7 @@ import { hooks } from '@cpn-console/hooks'
 import type { AsyncReturnType } from '@cpn-console/shared'
 import { ProjectAuthorized, getPermsByUserRoles, resourceListToDict } from '@cpn-console/shared'
 import { genericProxy } from './proxy.js'
-import { archiveProject, getAdminPlugin, getClusterByIdOrThrow, getClusterNamesByZoneId, getClustersAssociatedWithProject, getHookProjectInfos, getHookRepository, getProjectStore, getZoneByIdOrThrow, saveProjectStore, updateProjectClusterHistory, updateProjectCreated, updateProjectFailed, updateProjectWarning } from '@/resources/queries-index.js'
+import { archiveProject, getAdminPlugin, getClusterByIdOrThrow, getClusterNamesByZoneId, getClustersAssociatedWithProject, getHookProjectInfos, getHookRepository, getProjectStore, getRole, getZoneByIdOrThrow, saveProjectStore, updateProjectClusterHistory, updateProjectCreated, updateProjectFailed, updateProjectWarning } from '@/resources/queries-index.js'
 import type { ConfigRecords } from '@/resources/project-service/business.js'
 import { dbToObj } from '@/resources/project-service/business.js'
 
@@ -139,6 +139,31 @@ const user = {
   },
 } as const
 
+const projectRole = {
+  upsert: async (roleId: ProjectRole['id']) => {
+    const role = await getRole(roleId)
+    if (!role) throw new Error('Role not found')
+
+    const rolePayload = {
+      ...role,
+      permissions: role.permissions.toString(),
+    }
+    const store = dbToObj(await getAdminPlugin())
+    return hooks.upsertProjectRole.execute(rolePayload, store)
+  },
+  delete: async (roleId: ProjectRole['id']) => {
+    const role = await getRole(roleId)
+    if (!role) throw new Error('Role not found')
+
+    const rolePayload = {
+      ...role,
+      permissions: role.permissions.toString(),
+    }
+    const store = dbToObj(await getAdminPlugin())
+    return hooks.deleteProjectRole.execute(rolePayload, store)
+  },
+} as const
+
 const zone = {
   upsert: async (zoneId: Zone['id']) => {
     const zone: ZoneObject = await getZoneByIdOrThrow(zoneId)
@@ -177,6 +202,8 @@ export const hook = {
   // @ts-ignore TODO voir comment opti la signature de la fonction
   project: genericProxy(project, { upsert: ['delete'], delete: ['upsert', 'delete'], getSecrets: ['delete'] }),
   // @ts-ignore TODO voir comment opti la signature de la fonction
+  projectRole: genericProxy(projectRole, { delete: ['upsert', 'delete'], upsert: ['delete'] }),
+  // @ts-ignore TODO voir comment opti la signature de la fonction
   cluster: genericProxy(cluster, { delete: ['upsert', 'delete'], upsert: ['delete'] }),
   // @ts-ignore TODO voir comment opti la signature de la fonction
   zone: genericProxy(zone, { delete: ['upsert'], upsert: ['delete'] }),
diff --git a/packages/hooks/src/hooks/hook-project-role.ts b/packages/hooks/src/hooks/hook-project-role.ts
new file mode 100644
index 000000000..e481144e9
--- /dev/null
+++ b/packages/hooks/src/hooks/hook-project-role.ts
@@ -0,0 +1,6 @@
+import type { ProjectRole } from '@cpn-console/shared'
+import type { Hook } from './hook.js'
+import { createHook } from './hook.js'
+
+export const upsertProjectRole: Hook<ProjectRole> = createHook()
+export const deleteProjectRole: Hook<ProjectRole> = createHook()
diff --git a/packages/hooks/src/hooks/index.ts b/packages/hooks/src/hooks/index.ts
index 452ae98cc..2f195a5fc 100644
--- a/packages/hooks/src/hooks/index.ts
+++ b/packages/hooks/src/hooks/index.ts
@@ -1,6 +1,7 @@
 export * from './hook-cluster.js'
 export * from './hook-misc.js'
 export * from './hook-project.js'
+export * from './hook-project-role.js'
 export * from './hook-user.js'
 export * from './hook-zone.js'
 
diff --git a/playwright/e2e-tests/project-logs.spec.ts b/playwright/e2e-tests/project-logs.spec.ts
index 2634ea3e5..e4878622f 100644
--- a/playwright/e2e-tests/project-logs.spec.ts
+++ b/playwright/e2e-tests/project-logs.spec.ts
@@ -23,7 +23,7 @@ test.describe('Project logs page', () => {
       await page.getByTestId('test-tab-logs').click()
       await expect(page.locator('#panel-logs')).toBeVisible()
       await expect(page.getByTestId('positionInfo')).toContainText(
-        '1 - 1 sur 1',
+        '1 - 5 sur 5',
       )
     },
   )
@@ -40,7 +40,7 @@ test.describe('Project logs page', () => {
       await page.getByTestId('test-tab-logs').click()
       await expect(page.locator('#panel-logs')).toBeVisible()
       await expect(page.getByTestId('positionInfo')).toContainText(
-        '1 - 1 sur 1',
+        '1 - 5 sur 5',
       )
 
       // Act
@@ -49,7 +49,7 @@ test.describe('Project logs page', () => {
       // Assert
       await expect(page.locator('#panel-logs')).toBeVisible()
       await expect(page.getByTestId('positionInfo')).toContainText(
-        '1 - 2 sur 2',
+        '1 - 5 sur 6',
       )
     },
   )
@@ -73,7 +73,7 @@ test.describe('Project logs page', () => {
       await expect(page.locator('#panel-logs')).toBeVisible()
       await page.getByTestId('replayHooksBtn').click()
       await expect(page.getByTestId('positionInfo')).toContainText(
-        '1 - 2 sur 2',
+        '1 - 5 sur 6',
       )
 
       // Assert - as Project Member
@@ -84,7 +84,7 @@ test.describe('Project logs page', () => {
       await page.getByTestId('test-tab-logs').click()
       await expect(page.locator('#panel-logs')).toBeVisible()
       await expect(page.getByTestId('positionInfo')).toContainText(
-        '1 - 2 sur 2',
+        '1 - 5 sur 6',
       )
     },
   )
diff --git a/playwright/e2e-tests/service-chains.spec.ts b/playwright/e2e-tests/service-chains.spec.ts
index 961932da5..45feb09b0 100644
--- a/playwright/e2e-tests/service-chains.spec.ts
+++ b/playwright/e2e-tests/service-chains.spec.ts
@@ -4,16 +4,11 @@ import { adminUser, clientURL, signInCloudPiNative } from '../config/console'
 
 test.describe('Service Chains page', () => {
   test.describe('Given an Admin-level user', () => {
-    let user: Credentials
-    test.beforeEach(() => {
-      user = adminUser
-    })
-
     // @TODO These tests assume that there is at least one Service Chain present
     // in the mocked up data. Ensure that this is true at all times !
     test('should list service chains', { tag: '@e2e' }, async ({ page }) => {
       await page.goto(clientURL)
-      await signInCloudPiNative({ page, credentials: user })
+      await signInCloudPiNative({ page, credentials: adminUser })
       await page.getByTestId('menuAdministrationBtn').click()
       await page.getByTestId('menuAdministrationServiceChains').click()
       // We take the first service chain available
@@ -27,7 +22,7 @@ test.describe('Service Chains page', () => {
 
     test('should show a service chain details', { tag: '@e2e' }, async ({ page }) => {
       await page.goto(clientURL)
-      await signInCloudPiNative({ page, credentials: user })
+      await signInCloudPiNative({ page, credentials: adminUser })
       await page.getByTestId('menuAdministrationBtn').click()
       await page.getByTestId('menuAdministrationServiceChains').click()
       // We take the first service chain available
@@ -43,7 +38,7 @@ test.describe('Service Chains page', () => {
 
     test('should show a service chain flows', { tag: '@e2e' }, async ({ page }) => {
       await page.goto(clientURL)
-      await signInCloudPiNative({ page, credentials: user })
+      await signInCloudPiNative({ page, credentials: adminUser })
       await page.getByTestId('menuAdministrationBtn').click()
       await page.getByTestId('menuAdministrationServiceChains').click()
       await expect(page.getByTestId('cpin-loader')).toHaveCount(0)
diff --git a/playwright/e2e-tests/system-roles.spec.ts b/playwright/e2e-tests/system-roles.spec.ts
new file mode 100644
index 000000000..2c5947f22
--- /dev/null
+++ b/playwright/e2e-tests/system-roles.spec.ts
@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test'
+import {
+  clientURL,
+  signInCloudPiNative,
+  testUser,
+} from '../config/console'
+import {
+  addProject,
+} from './utils'
+
+test.describe('System Roles at Project Creation', () => {
+  test('Should have built-in system roles after project creation', { tag: '@e2e' }, async ({ page }) => {
+    // Arrange
+    await page.goto(clientURL)
+    await signInCloudPiNative({ page, credentials: testUser })
+    await addProject({ page })
+
+    // Act
+    await page.getByTestId('test-tab-roles').click()
+
+    // Assert
+    const systemRoles = [
+      { name: 'Administrateur', oidcGroup: '/admin' },
+      { name: 'DevOps', oidcGroup: '/devops' },
+      { name: 'Développeur', oidcGroup: '/developer' },
+      { name: 'Lecture seule', oidcGroup: '/readonly' },
+    ]
+
+    for (const role of systemRoles) {
+      // Click on the role to select it
+      const roleElement = await page.getByText(role.name)
+      await expect(roleElement).toBeVisible()
+      await roleElement.click()
+
+      // Check name input is disabled
+      await expect(page.getByTestId('roleNameInput')).toBeDisabled()
+      await expect(page.getByTestId('roleNameInput')).toHaveValue(role.name)
+
+      // Check OIDC group input is disabled and has correct value
+      await expect(page.getByTestId('roleOidcGroupInput')).toBeDisabled()
+      await expect(page.getByTestId('roleOidcGroupInput')).toHaveValue(role.oidcGroup)
+
+      // Check delete button is not visible
+      await expect(page.getByTestId('deleteBtn')).toBeHidden()
+    }
+  })
+})
diff --git a/plugins/keycloak/src/functions.ts b/plugins/keycloak/src/functions.ts
index 6ab77eeae..b772b0a2b 100644
--- a/plugins/keycloak/src/functions.ts
+++ b/plugins/keycloak/src/functions.ts
@@ -1,9 +1,10 @@
 import type { Project, StepCall, UserEmail, ZoneObject } from '@cpn-console/hooks'
+import type { ProjectRole } from '@cpn-console/shared'
 import { generateRandomPassword, parseError, PluginResultBuilder } from '@cpn-console/hooks'
 import type GroupRepresentation from '@keycloak/keycloak-admin-client/lib/defs/groupRepresentation.js'
 import type ClientRepresentation from '@keycloak/keycloak-admin-client/lib/defs/clientRepresentation.js'
 import type { CustomGroup } from './group.js'
-import { consoleGroupName, getAllSubgroups, getGroupByName, getOrCreateChildGroup, getOrCreateProjectGroup } from './group.js'
+import { consoleGroupName, deleteGroup, getAllSubgroups, getGroupByName, getOrCreateChildGroup, getOrCreateProjectGroup } from './group.js'
 import { getkcClient } from './client.js'
 
 export const retrieveKeycloakUserByEmail: StepCall<UserEmail> = async ({ args: { email } }) => {
@@ -65,6 +66,7 @@ export const upsertProject: StepCall<Project> = async ({ args: project }) => {
     const kcClient = await getkcClient()
     const projectName = project.slug
     const projectGroup = await getOrCreateProjectGroup(kcClient, projectName)
+
     const groupMembers = await kcClient.groups.listMembers({ id: projectGroup.id })
 
     await Promise.all([
@@ -221,6 +223,87 @@ export const deleteZone: StepCall<ZoneObject> = async ({ args: zone }) => {
   }
 }
 
+export const upsertProjectRole: StepCall<ProjectRole> = async ({ args: role }) => {
+  if (!role.oidcGroup) {
+    return {
+      status: {
+        result: 'OK',
+        message: 'No OIDC group defined',
+      },
+    }
+  }
+  try {
+    const kcClient = await getkcClient()
+    const [projectName, pluginName, roleName] = role.oidcGroup.split('/').slice(1)
+    if (!projectName || !pluginName || !roleName) throw new Error('Invalid OIDC group format')
+    const projectGroup = await getOrCreateProjectGroup(kcClient, projectName)
+    const pluginGroup = await getOrCreateChildGroup(kcClient, projectGroup.id, pluginName)
+    await getOrCreateChildGroup(kcClient, pluginGroup.id, roleName)
+    return {
+      status: {
+        result: 'OK',
+        message: 'Synced',
+      },
+    }
+  } catch (error) {
+    return {
+      error: parseError(error),
+      status: {
+        result: 'KO',
+        message: 'Failed to sync role',
+      },
+    }
+  }
+}
+
+export const deleteProjectRole: StepCall<ProjectRole> = async ({ args: role }) => {
+  if (!role.oidcGroup) {
+    return {
+      status: {
+        result: 'OK',
+        message: 'No OIDC group defined',
+      },
+    }
+  }
+  try {
+    const kcClient = await getkcClient()
+    const [projectName, pluginName, roleName] = role.oidcGroup.split('/').slice(1)
+    if (!projectName || !pluginName || !roleName) throw new Error('Invalid OIDC group format')
+    const projectGroup = await getGroupByName(kcClient, projectName)
+    if (projectGroup?.id) {
+      const pluginGroups = await getAllSubgroups(kcClient, projectGroup.id, 0)
+      const pluginGroup = pluginGroups.find(({ name }) => name === pluginName) as Required<GroupRepresentation> | undefined
+      if (pluginGroup?.id) {
+        const roleGroups = await getAllSubgroups(kcClient, pluginGroup.id, 0)
+        const roleGroup = roleGroups.find(({ name }) => name === roleName) as Required<GroupRepresentation> | undefined
+        if (roleGroup?.id) {
+          await deleteGroup(kcClient, roleGroup.id)
+          return {
+            status: {
+              result: 'OK',
+              message: 'Deleted',
+            },
+          }
+        }
+      }
+    }
+    return {
+      status: {
+        result: 'OK',
+        message: 'Already deleted',
+      },
+    }
+  } catch (error) {
+    return {
+      error: parseError(error),
+      status: {
+        result: 'KO',
+        message: 'Failed to delete role',
+      },
+    }
+  }
+}
+
 function getClientZoneId(zone: ZoneObject): string {
   return `argocd-${zone.slug}-zone`
 }
diff --git a/plugins/keycloak/src/group.ts b/plugins/keycloak/src/group.ts
index 388b63539..2feccd38a 100644
--- a/plugins/keycloak/src/group.ts
+++ b/plugins/keycloak/src/group.ts
@@ -72,3 +72,7 @@ export async function getOrCreateProjectGroup(kcClient: KeycloakAdminClient, nam
     name: existingGroup.name,
   }
 }
+
+export async function deleteGroup(kcClient: KeycloakAdminClient, groupId: string) {
+  await kcClient.groups.del({ id: groupId })
+}
diff --git a/plugins/keycloak/src/index.ts b/plugins/keycloak/src/index.ts
index 04e623047..ed5be5000 100644
--- a/plugins/keycloak/src/index.ts
+++ b/plugins/keycloak/src/index.ts
@@ -1,9 +1,11 @@
 import type { DefaultArgs, Plugin, Project, ProjectLite } from '@cpn-console/hooks'
 import {
   deleteProject,
+  deleteProjectRole,
   deleteZone,
   retrieveKeycloakUserByEmail,
   upsertProject,
+  upsertProjectRole,
   upsertZone,
 } from './functions.js'
 import infos from './infos.js'
@@ -22,12 +24,18 @@ export const plugin: Plugin = {
       api: project => new KeycloakProjectApi(project.slug),
       steps: { main: upsertProject },
     },
+    upsertProjectRole: {
+      steps: { main: upsertProjectRole },
+    },
     upsertZone: {
       steps: { main: upsertZone },
     },
     deleteZone: {
       steps: { post: deleteZone },
     },
+    deleteProjectRole: {
+      steps: { post: deleteProjectRole },
+    },
     retrieveUserByEmail: { steps: { main: retrieveKeycloakUserByEmail } },
   },
   monitor,