From 8b787f1a26ccc4b80772a41f46d1cdab5250c05e Mon Sep 17 00:00:00 2001
From: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Date: Fri, 30 Jan 2026 12:00:18 +0100
Subject: [PATCH] feat: add OIDC group to project groups

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
---
 .../client/src/components/ProjectRoleForm.vue |  14 ++-
 apps/client/src/components/ProjectRoles.vue   |   8 +-
 apps/client/src/utils/project-utils.ts        |   2 +-
 .../migration.sql                             |   2 +
 .../src/prisma/migrations/migration_lock.toml |   2 +-
 apps/server/src/prisma/schema/project.prisma  |   1 +
 .../resources/project-role/business.spec.ts   | 102 ++++++++++++++++--
 .../src/resources/project-role/business.ts    |  23 +++-
 .../src/resources/project-role/queries.ts     |   6 +-
 apps/server/src/resources/project/business.ts |   8 +-
 packages/shared/src/contracts/project-role.ts |  12 +--
 packages/shared/src/schemas/project.ts        |   4 +-
 packages/shared/src/schemas/role.ts           |   2 +
 13 files changed, 155 insertions(+), 31 deletions(-)
 create mode 100644 apps/server/src/prisma/migrations/20260127154602_add_oidc_group_to_project_role/migration.sql

diff --git a/apps/client/src/components/ProjectRoleForm.vue b/apps/client/src/components/ProjectRoleForm.vue
index b0fc7d237..4fb0c7784 100644
--- a/apps/client/src/components/ProjectRoleForm.vue
+++ b/apps/client/src/components/ProjectRoleForm.vue
@@ -1,6 +1,6 @@
 <script lang="ts" setup>
 import { computed, ref } from 'vue'
-import type { Member, ProjectV2, RoleBigint } from '@cpn-console/shared'
+import type { Member, ProjectRoleBigint, ProjectV2 } from '@cpn-console/shared'
 import { PROJECT_PERMS, projectPermsDetails, shallowEqual } from '@cpn-console/shared'
 
 const props = defineProps<{
@@ -10,12 +10,13 @@ const props = defineProps<{
   allMembers: Member[]
   projectId: ProjectV2['id']
   isEveryone: boolean
+  oidcGroup?: string
 }>()
 
 defineEmits<{
   delete: []
   updateMemberRoles: [checked: boolean, userId: Member['userId']]
-  save: [value: Omit<RoleBigint, 'position'>]
+  save: [value: Omit<ProjectRoleBigint, 'position' | 'projectId'>]
   cancel: []
 }>()
 const router = useRouter()
@@ -23,6 +24,7 @@ const role = ref({
   ...props,
   permissions: props.permissions ?? 0n,
   allMembers: props.allMembers ?? [],
+  oidcGroup: props.oidcGroup ?? '',
 })
 
 const isUpdated = computed(() => {
@@ -68,6 +70,14 @@ function updateChecked(checked: boolean, value: bigint) {
         class="mb-5"
         :disabled="role.isEveryone"
       />
+      <h6>Groupe OIDC</h6>
+      <DsfrInput
+        v-model="role.oidcGroup"
+        data-testid="roleOidcGroupInput"
+        label-visible
+        class="mb-5"
+        :disabled="role.isEveryone"
+      />
       <h6>Permissions</h6>
       <div
         v-for="scope in projectPermsDetails"
diff --git a/apps/client/src/components/ProjectRoles.vue b/apps/client/src/components/ProjectRoles.vue
index 95194bbad..01ac343fa 100644
--- a/apps/client/src/components/ProjectRoles.vue
+++ b/apps/client/src/components/ProjectRoles.vue
@@ -1,5 +1,5 @@
 <script lang="ts" setup>
-import type { Member, Role, RoleBigint } from '@cpn-console/shared'
+import type { Member, ProjectRole, ProjectRoleBigint, Role, RoleBigint } from '@cpn-console/shared'
 import { useSnackbarStore } from '@/stores/snackbar.js'
 import type { Project } from '@/utils/project-utils.js'
 
@@ -11,7 +11,7 @@ const snackbarStore = useSnackbarStore()
 
 const selectedId = ref<string>()
 
-type RoleItem = Omit<Role, 'permissions'> & { permissions: bigint, memberCounts: number, isEveryone: boolean }
+type RoleItem = Omit<ProjectRole, 'permissions'> & { permissions: bigint, memberCounts: number, isEveryone: boolean }
 
 const roleList = ref<RoleItem[]>([])
 
@@ -56,7 +56,7 @@ async function saveEveryoneRole(role: { permissions: bigint }) {
   snackbarStore.setMessage('Rôle mis à jour', 'success')
 }
 
-async function saveRole(role: Omit<RoleBigint, 'position'>) {
+async function saveRole(role: Omit<ProjectRoleBigint, 'position' | 'projectId'>) {
   if (role.id === 'everyone') {
     await saveEveryoneRole(role)
     snackbarStore.setMessage('Rôle mis à jour', 'success')
@@ -67,6 +67,7 @@ async function saveRole(role: Omit<RoleBigint, 'position'>) {
     id: selectedRole.value.id,
     permissions: role.permissions.toString(),
     name: role.name,
+    oidcGroup: role.oidcGroup,
   }])
   reload()
   snackbarStore.setMessage('Rôle mis à jour', 'success')
@@ -86,6 +87,7 @@ function reload() {
     permissions: BigInt(props.project.everyonePerms),
     position: 1000,
     isEveryone: true,
+    projectId: props.project.id,
   })
   roleList.value = roles
 }
diff --git a/apps/client/src/utils/project-utils.ts b/apps/client/src/utils/project-utils.ts
index 0b31bdda9..a230f5df3 100644
--- a/apps/client/src/utils/project-utils.ts
+++ b/apps/client/src/utils/project-utils.ts
@@ -64,7 +64,7 @@ export class Project implements ProjectV2 {
   locked: boolean
   owner: Omit<User, 'adminRoleIds'>
   ownerId: string
-  roles: { id: string, name: string, permissions: string, position: number }[]
+  roles: { id: string, name: string, permissions: string, position: number, projectId: string, oidcGroup?: string }[]
   members: ({ userId: string, firstName: string, lastName: string, email: string, roleIds: string[] } | { updatedAt: string, createdAt: string, firstName: string, lastName: string, email: string, userId: string, roleIds: string[] })[]
   createdAt: string
   updatedAt: string
diff --git a/apps/server/src/prisma/migrations/20260127154602_add_oidc_group_to_project_role/migration.sql b/apps/server/src/prisma/migrations/20260127154602_add_oidc_group_to_project_role/migration.sql
new file mode 100644
index 000000000..04c98df03
--- /dev/null
+++ b/apps/server/src/prisma/migrations/20260127154602_add_oidc_group_to_project_role/migration.sql
@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "ProjectRole" ADD COLUMN     "oidcGroup" TEXT NOT NULL DEFAULT '';
diff --git a/apps/server/src/prisma/migrations/migration_lock.toml b/apps/server/src/prisma/migrations/migration_lock.toml
index 648c57fd5..044d57cdb 100644
--- a/apps/server/src/prisma/migrations/migration_lock.toml
+++ b/apps/server/src/prisma/migrations/migration_lock.toml
@@ -1,3 +1,3 @@
 # Please do not edit this file manually
 # It should be added in your version-control system (e.g., Git)
-provider = "postgresql"
\ No newline at end of file
+provider = "postgresql"
diff --git a/apps/server/src/prisma/schema/project.prisma b/apps/server/src/prisma/schema/project.prisma
index 9bff043eb..8a0cf34c0 100644
--- a/apps/server/src/prisma/schema/project.prisma
+++ b/apps/server/src/prisma/schema/project.prisma
@@ -66,6 +66,7 @@ model ProjectRole {
   permissions BigInt
   projectId   String  @db.Uuid
   position    Int     @db.SmallInt
+  oidcGroup   String  @default("")
   project     Project @relation(fields: [projectId], references: [id])
 }
 
diff --git a/apps/server/src/resources/project-role/business.spec.ts b/apps/server/src/resources/project-role/business.spec.ts
index cdbaa3fd1..20c2f9a2d 100644
--- a/apps/server/src/resources/project-role/business.spec.ts
+++ b/apps/server/src/resources/project-role/business.spec.ts
@@ -5,8 +5,29 @@ import prisma from '../../__mocks__/prisma.js'
 import { BadRequest400 } from '../../utils/errors.ts'
 import { countRolesMembers, createRole, deleteRole, listRoles, patchRoles } from './business.ts'
 
-const projectId = faker.string.uuid()
 describe('test project-role business', () => {
+  const project: Project = {
+    id: faker.string.uuid(),
+    name: faker.lorem.word({ length: { min: 2, max: 10 } }),
+    slug: faker.lorem.word({ length: { min: 2, max: 10 } }),
+    limitless: false,
+    hprodCpu: faker.number.int({ min: 0, max: 1000 }),
+    hprodGpu: faker.number.int({ min: 0, max: 1000 }),
+    hprodMemory: faker.number.int({ min: 0, max: 1000 }),
+    prodCpu: faker.number.int({ min: 0, max: 1000 }),
+    prodGpu: faker.number.int({ min: 0, max: 1000 }),
+    prodMemory: faker.number.int({ min: 0, max: 1000 }),
+    description: faker.lorem.sentence({ min: 2, max: 10 }),
+    status: 'created',
+    locked: false,
+    createdAt: faker.date.past(),
+    updatedAt: faker.date.recent(),
+    everyonePerms: 0n,
+    ownerId: faker.string.uuid(),
+    lastSuccessProvisionningVersion: null,
+  }
+  const projectId = faker.string.uuid()
+
   describe('listRoles', () => {
     it('should stringify bigint', async () => {
       const partialRole: Partial<ProjectRole> = {
@@ -17,6 +38,23 @@ describe('test project-role business', () => {
       const response = await listRoles(projectId)
       expect(response).toEqual([{ permissions: '4' }])
     })
+
+    it('should strip oidcGroup prefix', async () => {
+      const dbRole: any = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
+        projectId,
+        permissions: 4n,
+        position: 0,
+        oidcGroup: `/project-${project.slug}/admin`,
+      }
+
+      prisma.project.findUnique.mockResolvedValueOnce(project)
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
+
+      const response = await listRoles(projectId)
+      expect(response[0].oidcGroup).toBe('/admin')
+    })
   })
 
   describe('createRole', () => {
@@ -27,9 +65,10 @@ describe('test project-role business', () => {
         position: 0,
       }
 
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findFirst.mockResolvedValueOnce(dbRole)
       prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
-      prisma.projectRole.create.mockResolvedValue(null)
+      prisma.projectRole.create.mockResolvedValue(dbRole)
       await createRole(projectId, { name: 'test', permissions: '4' })
 
       expect(prisma.projectRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 4n, position: 1, projectId } })
@@ -41,6 +80,7 @@ describe('test project-role business', () => {
         position: 50,
       }
 
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findFirst.mockResolvedValueOnce(dbRole)
       prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
       prisma.projectRole.create.mockResolvedValue(null)
@@ -55,13 +95,39 @@ describe('test project-role business', () => {
         position: 50,
       }
 
-      prisma.projectRole.findFirst.mockResolvedValueOnce(undefined)
+      prisma.project.findUnique.mockResolvedValue(project)
+      prisma.projectRole.findFirst.mockResolvedValueOnce(null)
       prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
-      prisma.projectRole.create.mockResolvedValue(null)
+      prisma.projectRole.create.mockResolvedValue(dbRole)
       await createRole(projectId, { name: 'test', permissions: '4' })
 
       expect(prisma.projectRole.create).toHaveBeenCalledWith({ data: { name: 'test', permissions: 4n, position: 0, projectId } })
     })
+
+    it('should create role with enforced oidcGroup prefix', async () => {
+      const dbRole: any = {
+        id: faker.string.uuid(),
+        name: faker.string.alphanumeric(),
+        projectId,
+        permissions: 4n,
+        position: 0,
+        oidcGroup: `/project-${project.slug}/admin`,
+      }
+
+      prisma.project.findUnique.mockResolvedValueOnce(project)
+      prisma.projectRole.findFirst.mockResolvedValueOnce(dbRole)
+      prisma.projectRole.create.mockResolvedValue(dbRole)
+      prisma.project.findUnique.mockResolvedValueOnce(project)
+      prisma.projectRole.findMany.mockResolvedValueOnce([dbRole])
+
+      await createRole(projectId, { name: 'test', permissions: '4', oidcGroup: '/admin' })
+
+      expect(prisma.projectRole.create).toHaveBeenCalledWith(expect.objectContaining({
+        data: expect.objectContaining({
+          oidcGroup: `/project-${project.slug}/admin`,
+        }),
+      }))
+    })
   })
 
   describe('deleteRole', () => {
@@ -129,6 +195,7 @@ describe('test project-role business', () => {
     }]
 
     it('should do nothing', async () => {
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue([])
       await patchRoles(projectId, [])
       expect(prisma.projectRole.update).toHaveBeenCalledTimes(0)
@@ -139,6 +206,7 @@ describe('test project-role business', () => {
         { id: dbRoles[0].id, position: 1 },
         { id: dbRoles[1].id, position: 1 },
       ]
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue(dbRoles)
 
       const response = await patchRoles(projectId, updateRoles)
@@ -151,6 +219,7 @@ describe('test project-role business', () => {
       const updateRoles: Pick<ProjectRole, 'id' | 'position'> = [
         { id: dbRoles[1].id, position: 1 },
       ]
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue(dbRoles)
 
       const response = await patchRoles(projectId, updateRoles)
@@ -164,6 +233,7 @@ describe('test project-role business', () => {
         { id: dbRoles[0].id, position: 1 },
         { id: dbRoles[1].id, position: 0 },
       ]
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue(dbRoles)
 
       await patchRoles(projectId, updateRoles)
@@ -175,12 +245,13 @@ describe('test project-role business', () => {
       const updateRoles: Pick<ProjectRole, 'id' | 'position'> = [
         { id: dbRoles[1].id, permissions: '0' },
       ]
+      prisma.project.findUnique.mockResolvedValue(project)
       prisma.projectRole.findMany.mockResolvedValue(dbRoles)
 
       await patchRoles(projectId, updateRoles)
 
       expect(prisma.projectRole.update).toHaveBeenCalledTimes(1)
-      expect(prisma.projectRole.update).toHaveBeenCalledWith({
+      expect(prisma.projectRole.update).toHaveBeenCalledWith(expect.objectContaining({
         data: {
           name: dbRoles[1].name,
           permissions: 0n,
@@ -189,7 +260,26 @@ describe('test project-role business', () => {
         where: {
           id: dbRoles[1].id,
         },
-      })
+      }))
+    })
+
+    it('should update role with enforced oidcGroup prefix', async () => {
+      const updateRoles: any[] = [
+        { id: dbRoles[1].id, oidcGroup: '/admin' },
+      ]
+
+      prisma.project.findUnique.mockResolvedValue(project)
+
+      const dbRoleWithPrefix = { ...dbRoles[1], oidcGroup: '/project-myproject/group2' }
+      prisma.projectRole.findMany.mockResolvedValue([dbRoleWithPrefix])
+
+      await patchRoles(projectId, updateRoles)
+
+      expect(prisma.projectRole.update).toHaveBeenCalledWith(expect.objectContaining({
+        data: expect.objectContaining({
+          oidcGroup: `/project-${project.slug}/admin`,
+        }),
+      }))
     })
   })
 })
diff --git a/apps/server/src/resources/project-role/business.ts b/apps/server/src/resources/project-role/business.ts
index 3d20dc13c..167e784d6 100644
--- a/apps/server/src/resources/project-role/business.ts
+++ b/apps/server/src/resources/project-role/business.ts
@@ -6,15 +6,21 @@ import {
   listRoles as listRolesQuery,
   updateRole,
 } from '@/resources/queries-index.js'
-import { BadRequest400 } from '@/utils/errors.js'
+import { BadRequest400, NotFound404 } from '@/utils/errors.js'
 import prisma from '@/prisma.js'
 
 export async function listRoles(projectId: Project['id']) {
-  return listRolesQuery(projectId)
-    .then(roles => roles.map(role => ({ ...role, permissions: role.permissions.toString() })))
+  const roles = await listRolesQuery(projectId)
+  return roles.map(role => ({
+    ...role,
+    permissions: role.permissions.toString(),
+    oidcGroup: role.oidcGroup ? role.oidcGroup.replace(/^\/project-[^/]+/, '') : role.oidcGroup,
+  }))
 }
 
 export async function patchRoles(projectId: Project['id'], roles: typeof projectRoleContract.patchProjectRoles.body._type) {
+  const project = await prisma.project.findUnique({ where: { id: projectId }, select: { slug: true } })
+  if (!project) throw new NotFound404()
   const dbRoles = await listRoles(projectId)
   const positionsAvailable: number[] = []
 
@@ -25,11 +31,15 @@ export async function patchRoles(projectId: Project['id'], roles: typeof project
       if (typeof matchingRole?.position !== 'undefined' && !positionsAvailable.includes(matchingRole.position)) {
         positionsAvailable.push(matchingRole.position)
       }
+      if (matchingRole?.oidcGroup && !matchingRole.oidcGroup.startsWith('/')) {
+        throw new BadRequest400('oidcGroup doit commencer par /')
+      }
       return {
         id: matchingRole?.id ?? dbRole.id,
         name: matchingRole?.name ?? dbRole.name,
         permissions: matchingRole?.permissions ? BigInt(matchingRole?.permissions) : BigInt(dbRole.permissions),
         position: matchingRole?.position ?? dbRole.position,
+        oidcGroup: matchingRole?.oidcGroup ? `/project-${project.slug}${matchingRole.oidcGroup}` : dbRole.oidcGroup,
       }
     })
   if (positionsAvailable.length && positionsAvailable.length !== dbRoles.length) return new BadRequest400('Les numéros de position des rôles sont incohérentes')
@@ -41,18 +51,25 @@ export async function patchRoles(projectId: Project['id'], roles: typeof project
 }
 
 export async function createRole(projectId: Project['id'], role: typeof projectRoleContract.createProjectRole.body._type) {
+  const project = await prisma.project.findUnique({ where: { id: projectId }, select: { slug: true } })
+  if (!project) throw new NotFound404()
   const dbMaxPosRole = (await prisma.projectRole.findFirst({
     where: { projectId },
     orderBy: { position: 'desc' },
     select: { position: true },
   }))?.position ?? -1
 
+  if (role.oidcGroup && !role.oidcGroup.startsWith('/')) {
+    throw new BadRequest400('oidcGroup doit commencer par /')
+  }
+
   await prisma.projectRole.create({
     data: {
       ...role,
       projectId,
       position: dbMaxPosRole + 1,
       permissions: BigInt(role.permissions),
+      oidcGroup: role.oidcGroup ? `/project-${project.slug}${role.oidcGroup}` : undefined,
     },
   })
 
diff --git a/apps/server/src/resources/project-role/queries.ts b/apps/server/src/resources/project-role/queries.ts
index d915849eb..db2528a9c 100644
--- a/apps/server/src/resources/project-role/queries.ts
+++ b/apps/server/src/resources/project-role/queries.ts
@@ -1,7 +1,6 @@
 import type {
   Prisma,
   Project,
-
   ProjectRole,
 } from '@prisma/client'
 
@@ -9,18 +8,19 @@ import prisma from '@/prisma.js'
 
 export const listRoles = (projectId: Project['id']) => prisma.projectRole.findMany({ where: { projectId }, orderBy: { position: 'asc' } })
 
-export function createRole(data: Pick<Prisma.ProjectRoleUncheckedCreateInput, 'permissions' | 'name' | 'position' | 'projectId'>) {
+export function createRole(data: Pick<Prisma.ProjectRoleUncheckedCreateInput, 'permissions' | 'name' | 'position' | 'projectId' | 'oidcGroup'>) {
   return prisma.projectRole.create({
     data: {
       name: data.name,
       permissions: 0n,
       position: data.position,
       projectId: data.projectId,
+      oidcGroup: data.oidcGroup,
     },
   })
 }
 
-export function updateRole(id: ProjectRole['id'], data: Pick<Prisma.ProjectRoleUncheckedUpdateInput, 'permissions' | 'name' | 'position' | 'id'>) {
+export function updateRole(id: ProjectRole['id'], data: Pick<Prisma.ProjectRoleUncheckedUpdateInput, 'permissions' | 'name' | 'position' | 'id' | 'oidcGroup'>) {
   return prisma.projectRole.update({
     where: { id },
     data,
diff --git a/apps/server/src/resources/project/business.ts b/apps/server/src/resources/project/business.ts
index e81ac8d3e..3ff4f824d 100644
--- a/apps/server/src/resources/project/business.ts
+++ b/apps/server/src/resources/project/business.ts
@@ -46,7 +46,7 @@ export async function listProjects({ status, statusIn, statusNotIn, filter = 'me
   }).then(projects => projects.map(({ clusters, ...project }) => ({
     ...project,
     clusterIds: clusters.map(({ id }) => id),
-    roles: project.roles.map(role => ({ ...role, permissions: role.permissions.toString() })),
+    roles: project.roles.map(role => ({ ...role, permissions: role.permissions.toString(), oidcGroup: project.slug ? role.oidcGroup?.replace(new RegExp(`^/project-${project.slug}`), '') : role.oidcGroup })),
     everyonePerms: project.everyonePerms.toString(),
   })))
 }
@@ -86,7 +86,7 @@ export async function createProject(dataDto: typeof projectContract.createProjec
     ...projectInfos,
     clusterIds: projectInfos.clusters.map(({ id }) => id),
     everyonePerms: projectInfos.everyonePerms.toString(),
-    roles: projectInfos.roles.map(role => ({ ...role, permissions: role.permissions.toString() })),
+    roles: projectInfos.roles.map(role => ({ ...role, permissions: role.permissions.toString(), oidcGroup: projectInfos.slug ? role.oidcGroup?.replace(new RegExp(`^/project-${projectInfos.slug}`), '') : role.oidcGroup })),
   }
 }
 
@@ -94,7 +94,7 @@ export async function getProject(projectId: Project['id']) {
   return getProjectOrThrow(projectId).then(({ clusters, ...project }) => ({
     ...project,
     clusterIds: clusters.map(({ id }) => id),
-    roles: project.roles.map(role => ({ ...role, permissions: role.permissions.toString() })),
+    roles: project.roles.map(role => ({ ...role, permissions: role.permissions.toString(), oidcGroup: project.slug ? role.oidcGroup?.replace(new RegExp(`^/project-${project.slug}`), '') : role.oidcGroup })),
     everyonePerms: project.everyonePerms.toString(),
   }))
 }
@@ -151,7 +151,7 @@ export async function updateProject(
     ...projectInfos,
     clusterIds: projectInfos.clusters.map(({ id }) => id),
     everyonePerms: projectInfos.everyonePerms.toString(),
-    roles: projectInfos.roles.map(role => ({ ...role, permissions: role.permissions.toString() })),
+    roles: projectInfos.roles.map(role => ({ ...role, permissions: role.permissions.toString(), oidcGroup: projectInfos.slug ? role.oidcGroup?.replace(new RegExp(`^/project-${projectInfos.slug}/`), '') : role.oidcGroup })),
   }
 }
 
diff --git a/packages/shared/src/contracts/project-role.ts b/packages/shared/src/contracts/project-role.ts
index 361388956..5c1176f07 100644
--- a/packages/shared/src/contracts/project-role.ts
+++ b/packages/shared/src/contracts/project-role.ts
@@ -1,5 +1,5 @@
 import { z } from 'zod'
-import { RoleSchema, apiPrefix, contractInstance } from '../index.js'
+import { ProjectRoleSchema, apiPrefix, contractInstance } from '../index.js'
 import { ErrorSchema, baseHeaders } from './_utils.js'
 
 export const projectRoleContract = contractInstance.router({
@@ -8,7 +8,7 @@ export const projectRoleContract = contractInstance.router({
     path: '',
     pathParams: z.object({ projectId: z.string().uuid() }),
     responses: {
-      200: RoleSchema.array(),
+      200: ProjectRoleSchema.array(),
       400: ErrorSchema,
       401: ErrorSchema,
       403: ErrorSchema,
@@ -18,11 +18,11 @@ export const projectRoleContract = contractInstance.router({
   createProjectRole: {
     method: 'POST',
     path: '',
-    body: RoleSchema.omit({ position: true, id: true }),
+    body: ProjectRoleSchema.omit({ position: true, id: true, projectId: true }),
     pathParams: z.object({ projectId: z.string().uuid() }),
     responses: {
       // 200: z.any(),
-      201: RoleSchema.array(),
+      201: ProjectRoleSchema.array(),
       400: ErrorSchema,
       401: ErrorSchema,
       403: ErrorSchema,
@@ -34,10 +34,10 @@ export const projectRoleContract = contractInstance.router({
     path: '',
     pathParams: z.object({ projectId: z.string().uuid() }),
     // body: z.any(),
-    body: RoleSchema.partial({ name: true, permissions: true, position: true }).array(),
+    body: ProjectRoleSchema.pick({ id: true }).merge(ProjectRoleSchema.omit({ id: true, projectId: true }).partial()).array(),
     responses: {
       // 200: z.any(),
-      200: RoleSchema.array(),
+      200: ProjectRoleSchema.array(),
       400: ErrorSchema,
       401: ErrorSchema,
       403: ErrorSchema,
diff --git a/packages/shared/src/schemas/project.ts b/packages/shared/src/schemas/project.ts
index 313db5966..70c9238fb 100644
--- a/packages/shared/src/schemas/project.ts
+++ b/packages/shared/src/schemas/project.ts
@@ -4,7 +4,7 @@ import { longestEnvironmentName, projectStatus } from '../utils/const.js'
 import { AtDatesToStringExtend, CoerceBooleanSchema, permissionLevelSchema } from './_utils.js'
 import { RepoSchema } from './repository.js'
 import { MemberSchema, UserSchema } from './user.js'
-import { RoleSchema } from './role.js'
+import { ProjectRoleSchema } from './role.js'
 
 export const descriptionMaxLength = 280
 export const projectNameMaxLength = 20
@@ -76,7 +76,7 @@ export const ProjectSchemaV2 = z.object({
     .uuid(),
   owner: UserSchema
     .omit({ adminRoleIds: true }),
-  roles: RoleSchema
+  roles: ProjectRoleSchema
     .array(),
   everyonePerms: permissionLevelSchema,
   lastSuccessProvisionningVersion: z.string()
diff --git a/packages/shared/src/schemas/role.ts b/packages/shared/src/schemas/role.ts
index 0556dca52..faf860110 100644
--- a/packages/shared/src/schemas/role.ts
+++ b/packages/shared/src/schemas/role.ts
@@ -13,6 +13,7 @@ export const RoleSchema = z.object({
 
 export const ProjectRoleSchema = RoleSchema.extend({
   projectId: z.string().uuid(),
+  oidcGroup: z.string().optional(),
 })
 
 export const AdminRoleSchema = RoleSchema.extend({
@@ -29,3 +30,4 @@ export type Role = Zod.infer<typeof RoleSchema>
 export type RoleBigint = Omit<Zod.infer<typeof RoleSchema>, 'permissions'> & { permissions: bigint }
 export type AdminRole = Zod.infer<typeof AdminRoleSchema>
 export type ProjectRole = Zod.infer<typeof ProjectRoleSchema>
+export type ProjectRoleBigint = Omit<Zod.infer<typeof ProjectRoleSchema>, 'permissions'> & { permissions: bigint }