From 3f73b62d1bfb543e509f49fba29cb7d42776a8f5 Mon Sep 17 00:00:00 2001
From: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Date: Mon, 26 Jan 2026 10:41:57 +0100
Subject: [PATCH 1/3] chore(hooks): change documentation to a sane pluging
 dependencies management

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Change-Id: Icf127d0b9cc595b5d275dec1658a5c676a6a6964
---
 packages/hooks/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/hooks/README.md b/packages/hooks/README.md
index 8b2c9fdc7..e0149e15c 100644
--- a/packages/hooks/README.md
+++ b/packages/hooks/README.md
@@ -229,7 +229,7 @@ declare module '@cpn-console/hooks' {
 ```json
 // package.json
 {
-  "devDepencies": {
+  "peerDependencies": {
     "my_plugin": "1.2.3"
   }
 }

From 5ec83f39ae604b071a4d6ce207ff5a6eae9c6699 Mon Sep 17 00:00:00 2001
From: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Date: Mon, 26 Jan 2026 12:14:57 +0100
Subject: [PATCH 2/3] feat(plugin): add permission extension

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Change-Id: I956f8cccc962bbf5e886286acac685546a6a6964
---
 apps/client/src/App.vue                       |  3 ++
 apps/client/src/components/AdminRoleForm.vue  | 14 +++--
 .../client/src/components/ProjectRoleForm.vue | 14 +++--
 apps/client/src/stores/permissions.ts         | 43 +++++++++++++++
 apps/server/src/resources/system/router.ts    | 20 ++++++-
 packages/hooks/src/index.ts                   | 13 ++++-
 packages/shared/src/contracts/system.ts       | 30 +++++++++++
 packages/shared/src/utils/permissions.ts      | 52 ++++++++++++++++---
 8 files changed, 170 insertions(+), 19 deletions(-)
 create mode 100644 apps/client/src/stores/permissions.ts

diff --git a/apps/client/src/App.vue b/apps/client/src/App.vue
index ae90457e6..9989010af 100644
--- a/apps/client/src/App.vue
+++ b/apps/client/src/App.vue
@@ -3,6 +3,7 @@ import { useServiceStore } from '@/stores/services-monitor.js'
 import { swaggerUiPath } from '@cpn-console/shared'
 import ReloadPrompt from './components/ReloadPrompt.vue'
 import { useAdminRoleStore } from './stores/admin-role.js'
+import { usePermissionsStore } from './stores/permissions.js'
 
 import { useProjectStore } from './stores/project.js'
 import { useSnackbarStore } from './stores/snackbar.js'
@@ -16,6 +17,7 @@ const systemStore = useSystemSettingsStore()
 const projectStore = useProjectStore()
 const userStore = useUserStore()
 const adminRoleStore = useAdminRoleStore()
+const permissionsStore = usePermissionsStore()
 
 const isLoggedIn = ref<boolean | undefined>(keycloak.authenticated)
 
@@ -46,6 +48,7 @@ onBeforeMount(async () => {
 })
 watch(userStore, async () => {
   if (userStore.isLoggedIn) {
+    await permissionsStore.fetchPermissions()
     if (!adminRoleStore.roles.length) {
       await adminRoleStore.listRoles()
     }
diff --git a/apps/client/src/components/AdminRoleForm.vue b/apps/client/src/components/AdminRoleForm.vue
index 0f1c14916..39e7c87cd 100644
--- a/apps/client/src/components/AdminRoleForm.vue
+++ b/apps/client/src/components/AdminRoleForm.vue
@@ -1,10 +1,12 @@
 <script lang="ts" setup>
 import { computed, onBeforeMount, ref } from 'vue'
 import type { AdminPermsKeys, LettersQuery, SharedZodError, User } from '@cpn-console/shared'
-import { ADMIN_PERMS, RoleSchema, adminPermsDetails, shallowEqual } from '@cpn-console/shared'
+import { RoleSchema, shallowEqual } from '@cpn-console/shared'
 import pDebounce from 'p-debounce'
+import { storeToRefs } from 'pinia'
 import SuggestionInput from './SuggestionInput.vue'
 import { useUsersStore } from '@/stores/users.js'
+import { usePermissionsStore } from '@/stores/permissions.js'
 import { clickInDialog, getRandomId } from '@/utils/func.js'
 
 const props = withDefaults(defineProps<{
@@ -22,6 +24,8 @@ const emits = defineEmits<{
   cancel: []
 }>()
 const usersStore = useUsersStore()
+const permissionsStore = usePermissionsStore()
+const { adminPermsDetails, adminPerms } = storeToRefs(permissionsStore)
 const newUserInputKey = ref(getRandomId('input'))
 
 const role = ref({
@@ -51,9 +55,9 @@ const selectedTabIndex = ref(initialSelectedIndex)
 
 function updateChecked(checked: boolean, name: AdminPermsKeys) {
   if (checked) {
-    role.value.permissions |= ADMIN_PERMS[name]
+    role.value.permissions |= adminPerms.value[name]
   } else {
-    role.value.permissions &= ~ADMIN_PERMS[name]
+    role.value.permissions &= ~adminPerms.value[name]
   }
 }
 
@@ -157,12 +161,12 @@ function closeModal() {
         <DsfrCheckbox
           v-for="perm in scope.perms"
           :key="perm.key"
-          :model-value="!!(ADMIN_PERMS[perm.key] & role.permissions)"
+          :model-value="!!(adminPerms[perm.key] & role.permissions)"
           :data-testid="`${perm.key}-cbx`"
           :label="perm.label"
           :hint="perm?.hint"
           :name="perm.key"
-          :disabled="role.permissions & ADMIN_PERMS.MANAGE && perm.key !== 'MANAGE'"
+          :disabled="!!(role.permissions & adminPerms.MANAGE) && perm.key !== 'MANAGE'"
           @update:model-value="(checked: boolean) => updateChecked(checked, perm.key)"
         />
       </div>
diff --git a/apps/client/src/components/ProjectRoleForm.vue b/apps/client/src/components/ProjectRoleForm.vue
index ce163f448..437c5b7ac 100644
--- a/apps/client/src/components/ProjectRoleForm.vue
+++ b/apps/client/src/components/ProjectRoleForm.vue
@@ -1,7 +1,9 @@
 <script lang="ts" setup>
 import { computed, ref } from 'vue'
 import type { Member, ProjectV2, RoleBigint } from '@cpn-console/shared'
-import { PROJECT_PERMS, projectPermsDetails, shallowEqual } from '@cpn-console/shared'
+import { shallowEqual } from '@cpn-console/shared'
+import { storeToRefs } from 'pinia'
+import { usePermissionsStore } from '@/stores/permissions.js'
 
 const props = defineProps<{
   id: string
@@ -18,6 +20,10 @@ defineEmits<{
   save: [value: Omit<RoleBigint, 'position'>]
   cancel: []
 }>()
+
+const permissionsStore = usePermissionsStore()
+const { projectPermsDetails, projectPerms } = storeToRefs(permissionsStore)
+
 const router = useRouter()
 const role = ref({
   ...props,
@@ -82,12 +88,12 @@ function updateChecked(checked: boolean, value: bigint) {
           v-for="perm in scope.perms"
           :id="`${perm.key}-cbx`"
           :key="perm.key"
-          :model-value="!!(PROJECT_PERMS[perm.key] & role.permissions)"
+          :model-value="!!(projectPerms[perm.key] & role.permissions)"
           :label="perm?.label"
           :hint="perm?.hint"
           :name="perm.key"
-          :disabled="role.permissions & PROJECT_PERMS.MANAGE && perm.key !== 'MANAGE'"
-          @update:model-value="(checked: boolean) => updateChecked(checked, PROJECT_PERMS[perm.key])"
+          :disabled="!!(role.permissions & projectPerms.MANAGE) && perm.key !== 'MANAGE'"
+          @update:model-value="(checked: boolean) => updateChecked(checked, projectPerms[perm.key])"
         />
       </div>
       <DsfrButton
diff --git a/apps/client/src/stores/permissions.ts b/apps/client/src/stores/permissions.ts
new file mode 100644
index 000000000..897b39a1e
--- /dev/null
+++ b/apps/client/src/stores/permissions.ts
@@ -0,0 +1,43 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import { apiClient, extractData } from '@/api/xhr-client.js'
+import {
+  type PermDetails,
+  type ProjectPermsKeys,
+  type AdminPermsKeys,
+  projectPermsDetails as defaultProjectPermsDetails,
+  adminPermsDetails as defaultAdminPermsDetails,
+  PROJECT_PERMS as defaultProjectPerms,
+  ADMIN_PERMS as defaultAdminPerms,
+} from '@cpn-console/shared'
+
+export const usePermissionsStore = defineStore('permissions', () => {
+  const projectPermsDetails = ref<PermDetails<ProjectPermsKeys>>(defaultProjectPermsDetails)
+  const adminPermsDetails = ref<PermDetails<AdminPermsKeys>>(defaultAdminPermsDetails)
+  const projectPerms = ref<Record<string, bigint>>(defaultProjectPerms)
+  const adminPerms = ref<Record<string, bigint>>(defaultAdminPerms)
+
+  const fetchPermissions = async () => {
+    const data = await apiClient.System.getConf().then(response => extractData(response, 200))
+    // @ts-ignore
+    projectPermsDetails.value = data.projectPermsDetails
+    // @ts-ignore
+    adminPermsDetails.value = data.adminPermsDetails
+
+    // Parse BigInts
+    projectPerms.value = Object.fromEntries(
+      Object.entries(data.projectPerms).map(([k, v]) => [k, BigInt(v as string)]),
+    )
+    adminPerms.value = Object.fromEntries(
+      Object.entries(data.adminPerms).map(([k, v]) => [k, BigInt(v as string)]),
+    )
+  }
+
+  return {
+    projectPermsDetails,
+    adminPermsDetails,
+    projectPerms,
+    adminPerms,
+    fetchPermissions,
+  }
+})
diff --git a/apps/server/src/resources/system/router.ts b/apps/server/src/resources/system/router.ts
index 997688496..b67d68941 100644
--- a/apps/server/src/resources/system/router.ts
+++ b/apps/server/src/resources/system/router.ts
@@ -1,4 +1,4 @@
-import { systemContract } from '@cpn-console/shared'
+import { ADMIN_PERMS, PROJECT_PERMS, adminPermsDetails, projectPermsDetails, systemContract } from '@cpn-console/shared'
 import { serverInstance } from '@/app.js'
 import { appVersion } from '@/utils/env.js'
 
@@ -17,5 +17,23 @@ export function systemRouter() {
         status: 'OK',
       },
     }),
+
+    getConf: async () => {
+      const projectPerms = Object.fromEntries(
+        Object.entries(PROJECT_PERMS).map(([k, v]) => [k, v.toString()]),
+      )
+      const adminPerms = Object.fromEntries(
+        Object.entries(ADMIN_PERMS).map(([k, v]) => [k, v.toString()]),
+      )
+      return {
+        status: 200,
+        body: {
+          projectPermsDetails,
+          adminPermsDetails,
+          projectPerms,
+          adminPerms,
+        },
+      }
+    },
   })
 }
diff --git a/packages/hooks/src/index.ts b/packages/hooks/src/index.ts
index 3bc1689a5..7131785e8 100644
--- a/packages/hooks/src/index.ts
+++ b/packages/hooks/src/index.ts
@@ -1,10 +1,10 @@
-import type { Monitor } from '@cpn-console/shared'
 import type { PluginApi } from './utils/utils.js'
 import { objectEntries } from './utils/utils.js'
 import * as hooks from './hooks/index.js'
 import { type ServiceInfos, servicesInfos } from './services.js'
 import type { HookStepsNames, StepCall } from './hooks/hook.js'
 import { addPlugin, editStrippers } from './config.js'
+import { addAdminPerms, addProjectPerms, type AdminPermsKeys, type Monitor, type PermDetails, type ProjectPermsKeys } from '@cpn-console/shared'
 
 export * from './utils/logger.js'
 
@@ -26,6 +26,10 @@ export interface Plugin {
   subscribedHooks: PluginsFunctions
   monitor?: Monitor
   start?: (options: unknown) => void
+  permissions?: {
+    project?: { perms: Record<string, bigint>, details: PermDetails<ProjectPermsKeys> }
+    admin?: { perms: Record<string, bigint>, details: PermDetails<AdminPermsKeys> }
+  }
 }
 
 export type RegisterFn = (plugin: Plugin) => void
@@ -52,6 +56,13 @@ function pluginManager(options: PluginManagerOptions): PluginManager {
       addPlugin(plugin.infos.name, plugin.infos.config, editStrippers)
     }
 
+    if (plugin.permissions?.project) {
+      addProjectPerms(plugin.permissions.project.perms, plugin.permissions.project.details)
+    }
+    if (plugin.permissions?.admin) {
+      addAdminPerms(plugin.permissions.admin.perms, plugin.permissions.admin.details)
+    }
+
     if (plugin.infos.to && config.mockExternalServices)
       plugin.infos.to = () => [{ name: 'Lien', to: 'https://theuselessweb.com/' }]
     if (plugin.start && options.startPlugins)
diff --git a/packages/shared/src/contracts/system.ts b/packages/shared/src/contracts/system.ts
index 3b8171912..e9dcd8085 100644
--- a/packages/shared/src/contracts/system.ts
+++ b/packages/shared/src/contracts/system.ts
@@ -34,6 +34,36 @@ export const systemContract = contractInstance.router({
       500: ErrorSchema,
     },
   },
+
+  getConf: {
+    method: 'GET',
+    path: '/conf',
+    summary: 'Get configuration',
+    description: 'Retrieve system configuration including permissions.',
+    responses: {
+      200: z.object({
+        projectPermsDetails: z.array(z.object({
+          name: z.string(),
+          perms: z.array(z.object({
+            key: z.string(),
+            label: z.string(),
+            hint: z.string().optional(),
+          })),
+        })),
+        adminPermsDetails: z.array(z.object({
+          name: z.string(),
+          perms: z.array(z.object({
+            key: z.string(),
+            label: z.string(),
+            hint: z.string().optional(),
+          })),
+        })),
+        projectPerms: z.record(z.string()),
+        adminPerms: z.record(z.string()),
+      }),
+      500: ErrorSchema,
+    },
+  },
 }, {
   pathPrefix: `${apiPrefix}`,
 })
diff --git a/packages/shared/src/utils/permissions.ts b/packages/shared/src/utils/permissions.ts
index 5aed0bd0f..341443507 100644
--- a/packages/shared/src/utils/permissions.ts
+++ b/packages/shared/src/utils/permissions.ts
@@ -43,7 +43,7 @@ function permissionsParser(a: Record<string, bigint>) {
 const bit = (position: bigint) => 1n << position
 
 // Be very careful and think to apply corresponding updates in database if you modify these values, You'll have to do binary updates in SQL, good luck !
-export const PROJECT_PERMS = { // project permissions
+export const PROJECT_PERMS: Record<string, bigint> = { // project permissions
   GUEST: bit(0n),
   MANAGE: bit(1n),
   MANAGE_MEMBERS: bit(2n),
@@ -57,12 +57,12 @@ export const PROJECT_PERMS = { // project permissions
 }
 
 // Be very careful and think to apply corresponding updates in database if you modify these values, You'll have to do binary updates in SQL, good luck !
-export const ADMIN_PERMS = { // admin permissions
+export const ADMIN_PERMS: Record<string, bigint> = { // admin permissions
   MANAGE: bit(1n),
 }
 
-export type ProjectPermsKeys = keyof typeof PROJECT_PERMS
-export type AdminPermsKeys = keyof typeof ADMIN_PERMS
+export type ProjectPermsKeys = keyof typeof PROJECT_PERMS | string
+export type AdminPermsKeys = keyof typeof ADMIN_PERMS | string
 
 permissionsParser(ADMIN_PERMS)
 permissionsParser(PROJECT_PERMS)
@@ -102,11 +102,11 @@ export const ProjectAuthorized = {
     || !!(toBigInt(perms.projectPermissions) & (PROJECT_PERMS.SEE_SECRETS | PROJECT_PERMS.MANAGE)),
 } as const
 
-interface ScopePerm<T extends string> {
+export interface ScopePerm<T extends string> {
   name: string
   perms: Array<{ key: T, label: string, hint?: string }>
 }
-type PermDetails<T extends string> = Array<ScopePerm<T>>
+export type PermDetails<T extends string> = Array<ScopePerm<T>>
 
 export const projectPermsDetails: PermDetails<ProjectPermsKeys> = [{
   name: 'Projet',
@@ -159,7 +159,31 @@ export const projectPermsDetails: PermDetails<ProjectPermsKeys> = [{
       hint: 'Permet de visualiser tous les dépôts et leurs configurations',
     },
   ],
-}] as const
+}, {
+  name: 'Rôles',
+  perms: [
+    {
+      key: 'REPORTER',
+      label: 'Reporter',
+      hint: 'Rôle Reporter',
+    },
+    {
+      key: 'DEVELOPER',
+      label: 'Developer',
+      hint: 'Rôle Developer',
+    },
+    {
+      key: 'MAINTAINER',
+      label: 'Maintainer',
+      hint: 'Rôle Maintainer',
+    },
+    {
+      key: 'OWNER',
+      label: 'Owner',
+      hint: 'Rôle Owner',
+    },
+  ],
+}]
 
 export const adminPermsDetails: PermDetails<AdminPermsKeys> = [{
   name: 'Global',
@@ -168,7 +192,19 @@ export const adminPermsDetails: PermDetails<AdminPermsKeys> = [{
     label: 'Administration globale',
     hint: 'Administration globale de toute la console et de ses ressources',
   }],
-}] as const
+}]
+
+export function addProjectPerms(perms: Record<string, bigint>, details: PermDetails<ProjectPermsKeys>) {
+  Object.assign(PROJECT_PERMS, perms)
+  permissionsParser(PROJECT_PERMS)
+  projectPermsDetails.push(...details)
+}
+
+export function addAdminPerms(perms: Record<string, bigint>, details: PermDetails<AdminPermsKeys>) {
+  Object.assign(ADMIN_PERMS, perms)
+  permissionsParser(ADMIN_PERMS)
+  adminPermsDetails.push(...details)
+}
 
 export function getAdminPermLabelsByValue(value: bigint | string) {
   value = typeof value === 'bigint' ? value : BigInt(value)

From 88d7f9be829cc89e683843d28d5cdc02a2bdf779 Mon Sep 17 00:00:00 2001
From: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Date: Mon, 26 Jan 2026 12:14:57 +0100
Subject: [PATCH 3/3] feat(gitlab): add keycloack group sync

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Change-Id: I273392d697f2fc272677bf9d978c62196a6a6964
---
 packages/hooks/src/hooks/hook-project.ts |  2 +-
 packages/shared/src/utils/permissions.ts |  4 +++
 plugins/gitlab/src/functions.ts          |  1 +
 plugins/gitlab/src/gitlab-project-api.ts | 30 +++++++++++++++++++++
 plugins/gitlab/src/members.ts            | 34 ++++++++++++++++++++----
 plugins/keycloak/src/class.ts            | 12 ++++++++-
 6 files changed, 76 insertions(+), 7 deletions(-)

diff --git a/packages/hooks/src/hooks/hook-project.ts b/packages/hooks/src/hooks/hook-project.ts
index 7d531d142..38323bc40 100644
--- a/packages/hooks/src/hooks/hook-project.ts
+++ b/packages/hooks/src/hooks/hook-project.ts
@@ -10,7 +10,7 @@ export interface RepoCreds {
 
 export interface Role {
   userId: string
-  role: 'owner' | 'user'
+  role: 'owner' | 'user' | 'guest' | 'reporter' | 'developer' | 'maintainer'
 }
 
 export interface EnvironmentApis {
diff --git a/packages/shared/src/utils/permissions.ts b/packages/shared/src/utils/permissions.ts
index 341443507..99b5f2753 100644
--- a/packages/shared/src/utils/permissions.ts
+++ b/packages/shared/src/utils/permissions.ts
@@ -54,6 +54,10 @@ export const PROJECT_PERMS: Record<string, bigint> = { // project permissions
   REPLAY_HOOKS: bit(7n),
   LIST_ENVIRONMENTS: bit(8n),
   LIST_REPOSITORIES: bit(9n),
+  REPORTER: bit(10n),
+  DEVELOPER: bit(11n),
+  MAINTAINER: bit(12n),
+  OWNER: bit(13n),
 }
 
 // Be very careful and think to apply corresponding updates in database if you modify these values, You'll have to do binary updates in SQL, good luck !
diff --git a/plugins/gitlab/src/functions.ts b/plugins/gitlab/src/functions.ts
index 110ff01b8..95f456024 100644
--- a/plugins/gitlab/src/functions.ts
+++ b/plugins/gitlab/src/functions.ts
@@ -99,6 +99,7 @@ export const upsertDsoProject: StepCall<Project> = async (payload) => {
     const { gitlab: gitlabApi, vault: vaultApi } = payload.apis
 
     await gitlabApi.getOrCreateProjectGroup()
+    await gitlabApi.ensureRightsGroups()
 
     const { failedInUpsertUsers } = await ensureMembers(gitlabApi, project)
     if (failedInUpsertUsers) {
diff --git a/plugins/gitlab/src/gitlab-project-api.ts b/plugins/gitlab/src/gitlab-project-api.ts
index 5d3f8a6c1..7a7137f81 100644
--- a/plugins/gitlab/src/gitlab-project-api.ts
+++ b/plugins/gitlab/src/gitlab-project-api.ts
@@ -55,6 +55,31 @@ export class GitlabProjectApi extends GitlabApi {
     return this.createProjectGroup()
   }
 
+  private async getOrCreateSubGroup(parentId: number, name: string): Promise<GroupSchema> {
+    const subgroups = await this.api.Groups.allSubgroups(parentId)
+    const existingGroup = subgroups.find(group => group.name === name)
+    if (existingGroup) return existingGroup
+    return this.api.Groups.create(name, name, {
+      parentId,
+      visibility: 'internal',
+      projectCreationLevel: 'maintainer',
+      subgroupCreationLevel: 'owner',
+      defaultBranchProtection: 0,
+    })
+  }
+
+  public async ensureRightsGroups(): Promise<void> {
+    const projectGroup = await this.getOrCreateProjectGroup()
+    const consoleGroup = await this.getOrCreateSubGroup(projectGroup.id, 'console')
+
+    const envs = ['prod', 'hprod']
+    for (const env of envs) {
+      const envGroup = await this.getOrCreateSubGroup(consoleGroup.id, env)
+      await this.getOrCreateSubGroup(envGroup.id, 'RO')
+      await this.getOrCreateSubGroup(envGroup.id, 'RW')
+    }
+  }
+
   public async getPublicGroupUrl() {
     return `${config().publicUrl}/${config().projectsRootDir}/${this.project.slug}`
   }
@@ -219,6 +244,11 @@ export class GitlabProjectApi extends GitlabApi {
     return this.api.GroupMembers.add(group.id, userId, accessLevel)
   }
 
+  public async editGroupMember(userId: number, accessLevel: AccessLevelAllowed = AccessLevel.DEVELOPER): Promise<MemberSchema> {
+    const group = await this.getOrCreateProjectGroup()
+    return this.api.GroupMembers.edit(group.id, userId, accessLevel)
+  }
+
   public async removeGroupMember(userId: number) {
     const group = await this.getOrCreateProjectGroup()
     return this.api.GroupMembers.remove(group.id, userId)
diff --git a/plugins/gitlab/src/members.ts b/plugins/gitlab/src/members.ts
index 33dd1c035..716b0f51e 100644
--- a/plugins/gitlab/src/members.ts
+++ b/plugins/gitlab/src/members.ts
@@ -1,8 +1,20 @@
 import type { Project } from '@cpn-console/hooks'
 import type { UserSchema } from '@gitbeaker/core'
+import { AccessLevel } from '@gitbeaker/core'
 import type { GitlabProjectApi } from './gitlab-project-api.js'
 import { upsertUser } from './user.js'
 
+function getAccessLevel(role: string | undefined): number {
+  switch (role) {
+    case 'guest': return AccessLevel.GUEST
+    case 'reporter': return AccessLevel.REPORTER
+    case 'developer': return AccessLevel.DEVELOPER
+    case 'maintainer': return AccessLevel.MAINTAINER
+    case 'owner': return AccessLevel.OWNER
+    default: return AccessLevel.DEVELOPER
+  }
+}
+
 export async function ensureMembers(gitlabApi: GitlabProjectApi, project: Project) {
   // Ensure all users exists in gitlab
   const [gitlabUserPromiseResults, members] = await Promise.all([
@@ -21,11 +33,23 @@ export async function ensureMembers(gitlabApi: GitlabProjectApi, project: Projec
 
   // Ensure members are set
   const membersAdded = await Promise.all([
-    ...fulfilledGitlabUsers.map(gitlabUser =>
-      members.find(member => member.id === gitlabUser.value.id)
-        ? undefined
-        : gitlabApi.addGroupMember(gitlabUser.value.id),
-    ),
+    ...project.users.map((user, index) => {
+      const result = gitlabUserPromiseResults[index]
+      if (result.status === 'rejected') return undefined
+      const gitlabUser = result.value
+
+      const userRole = project.roles.find(r => r.userId === user.id)?.role
+      const accessLevel = getAccessLevel(userRole)
+      const existingMember = members.find(member => member.id === gitlabUser.id)
+
+      if (existingMember) {
+        if (existingMember.access_level !== accessLevel) {
+          return gitlabApi.editGroupMember(gitlabUser.id, accessLevel)
+        }
+        return undefined
+      }
+      return gitlabApi.addGroupMember(gitlabUser.id, accessLevel)
+    }),
     ...members.map(member =>
       (
         !member.username.match(/group_\d+_bot/)
diff --git a/plugins/keycloak/src/class.ts b/plugins/keycloak/src/class.ts
index 36f3dc045..fc93c9960 100644
--- a/plugins/keycloak/src/class.ts
+++ b/plugins/keycloak/src/class.ts
@@ -1,5 +1,6 @@
 import { PluginApi } from '@cpn-console/hooks'
-import { consoleGroupName } from './group.js'
+import { consoleGroupName, getGroupByName, getOrCreateChildGroup } from './group.js'
+import { getkcClient } from './client.js'
 
 interface KeycloakEnv {
   path: string
@@ -30,4 +31,13 @@ export class KeycloakProjectApi extends PluginApi {
       },
     }
   }
+
+  public async getOrCreateProjectGroup(name: string) {
+    const kcClient = await getkcClient()
+    const projectGroup = await getGroupByName(kcClient, this.projectSlug)
+    if (!projectGroup) throw new Error(`Project group ${this.projectSlug} not found`)
+    if (!projectGroup.id) throw new Error(`Project group ${this.projectSlug} has no id`)
+
+    return getOrCreateChildGroup(kcClient, projectGroup.id, name)
+  }
 }