[schmitch]

Fixes #792

Problem

Migration 0013 gave the built-in reader role only to users holding neither admin nor writer. An identity provider or upstream demotes an account through sync_admin_role(…, false) (crates/db/src/authz_dao.rs:380-408), which deletes admin and nothing else. That covers OIDC admin_groups/admin_claim and a credential-forwarding admin_group.

• An account provisioned on 2.2 holds the realm's new_account_access role next to admin, so a demotion leaves it a reader.
• An administrator from before the upgrade held admin alone, so the same demotion left it Roles only. It got 403 on every private repository while everyone else read them.

Change

• migrations/0013_reader_role.sql gives reader to every kind = 'user' account that does not hold writer, administrators included.
  • While they are administrators it adds nothing: the web UI shows the highest built-in role (accessLevel), and changing the level there removes every other level role.
  • Writers read every repository through writer already.
  • Service accounts stay Roles only.
  • 0013 has not shipped, so it is changed in place, as Reader role migration: rename the role in workload-identity rules too, so they keep their grants #784 did. A development database that already ran the old 0013 reports a checksum mismatch and needs recreating.
• docs/changes/2.2.0/733.upgrade.md says administrators get the role too.

Tests

readers_before_the_upgrade_get_the_reader_role (crates/db/tests/migrations.rs) checks:

• an administrator holds admin and reader after the upgrade;
• after sync_admin_role(…, false), as an identity provider's demotion runs it, reader remains.

Without the migration change it fails with left: ["admin"], right: ["admin", "reader"].

Run locally:

• cargo test -p forge-db --test migrations: 5 passed;
• cargo clippy -p forge-db --all-targets -- -D warnings, cargo fmt --all --check and cargo xtask changelog --check: clean.

---

Generated by Claude Code