feat(roles): jc roles command group [Phase 1]

[jklaassenjc]

Phase 1 continued — closes the Roles gap. Stacked on #95 (service-accounts); merge #94 → #95 → this in order.

Roles (V2) had no CLI presence. A role is a named set of API scopes gating what an admin or service account can do — synergistic with jc service-accounts create --role, which already resolves a role via the /roles endpoint wired in #95.

Commands

jc roles list | get | create | update | delete

• create: --name, --scopes (comma-separated), --description.
• update: read-modify-write — the role PUT is a full-object replace (name+scopes required), so a partial change preserves the rest and strips the server-managed id (same guard as KLA-484).
• delete: confirmation-gated.

Wire contracts — verified live (2026-07-24)

/roles list wrapped in {results} (ResponseKey); single GET bare; id in id.

Testing

• Live-verified: list, get-by-name (Administrator, 69 scopes).
• Unit-tested: create body, --scopes split/trim + empty-scope validation, the RMW update preserving scopes/description on a name-only change (+ id stripped), delete path. Full go test -race ./... + go vet green.
• Also hardens the service-accounts tests to disable the resolve cache (a dev-populated on-disk cache entry could otherwise leak into name resolution — surfaced here).

Coverage

Scorecard: 73% → 74% area-level (gap 171 → 166 ops).

Tracked under KLA-485.

🤖 Generated with Claude Code

---

Note

Medium Risk
Create/update/delete change org RBAC and can strip scopes from admins and service accounts; update’s RMW is intentional but a bug could widen or narrow permissions incorrectly.

Overview
Introduces a jc roles command group under Security & Policies for JumpCloud V2 RBAC roles (named API scope sets used by admins and service accounts).

Commands: list (filter/sort/limit, results unwrap), get / update / delete by name or ID via resolve.RoleConfig, create with --name, --scopes (comma-separated, trimmed), and optional --description. update does read-modify-write because role PUT is a full replace—partial flags preserve other fields and id is stripped from the PUT body. delete supports batch sources, --plan, TTY/--force confirmation, and warns that bound admins/service accounts lose scopes.

Also registers mutation classifications for all role subcommands, maps Roles → roles in api-coverage.py (scorecard 73% → 74%), and adds unit tests (create body, scope validation, RMW update, plan-no-mutation, delete path). Service-accounts tests now set cache.enabled false (same as roles tests) so on-disk resolve cache cannot leak into name resolution.

^{Reviewed by Cursor Bugbot for commit 85e0509. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit abc1c78. Configure here.}