readonly role

backend/src/workers/tenants.rs

@@ -9,7 +9,8 @@ use tracing::warn;
 use uuid::Uuid;
 
 use crate::auth::capability_sets::{
-    ensure_capability_set, owner_capabilities, user_capabilities, webdav_capabilities,
+    ensure_capability_set, owner_capabilities, readonly_capabilities, user_capabilities,
+    webdav_capabilities,
 };
 use crate::documents::search::ensure_quickwit_index;
 use crate::jobs::JOB_PROVISION_TENANT;
@@ -161,6 +162,19 @@ impl JobHandler for ProvisionTenantJob {
             };
         }
 
+        if let Err(err) = ensure_capability_set(&mut conn, tenant.id, readonly_capabilities()) {
+            warn!(
+                job_id = %job.id,
+                tenant_id = %tenant.id,
+                error = ?err,
+                "failed to ensure readonly capability set during provisioning"
+            );
+            return JobExecution::Retry {
+                delay: std::time::Duration::from_secs(30),
+                error: "readonly capability set unavailable".into(),
+            };
+        }
+
         if let Err(err) = ensure_capability_set(&mut conn, tenant.id, webdav_capabilities()) {
             warn!(
                 job_id = %job.id,