[Command] Add flag to allow default roles to be created in `env export terraform` command

[ocap-kirk]

The CLI asumes you don't want the default roles Permit generates to be used in the model. Because some users do plan on using these roles can a flag be added to include these roles?

[zeevmoney]

Hi @ocap-kirk — closing this one as already resolved, and thank you for raising it. The behaviour you described was real when you filed it; it just got fixed from an unexpected direction.

What changed

At the time of your report, RoleGenerator skipped the built-in roles outright:

const DEFAULT_GLOBAL_ROLES = ['admin', 'editor', 'viewer'];
// ...
if (DEFAULT_GLOBAL_ROLES.includes(role.key)) { /* skipped */ continue; }

Commit 6456189 ("Adding support for EU region", #137, merged 2025-10-15) removed that constant and both of its call sites. grep -rn DEFAULT_GLOBAL_ROLES source/ now returns nothing, and processGlobalRoles applies no filtering at all.

So default roles are exported unconditionally today — no flag needed. That is now covered by a test (tests/export/RoleGenerator.test.tsx:110, it('exports default roles')) and documented in the README:

Note: The export includes all roles, including default roles (admin, editor, viewer) with their actual permissions.

On your PR #92

It's still open as a draft. Since the exclusion it toggles no longer exists, the flag has nothing left to switch, and the branch has also drifted — it patches the exact processGlobalRoles/generateTerraformId code that #137 rewrote, so it now shows as conflicting. Nothing to salvage there; we'll tidy it up separately.

One thing worth flagging

The fix landed incidentally as part of an unrelated EU-region refactor rather than as a deliberate answer to this issue, which is why nobody linked it back to you here. The pendulum has also swung the other way: there is currently no way to exclude default roles from an export. If that turns out to matter for your workflow — for example to stop Terraform trying to manage roles it didn't create — please open a fresh issue and we'll look at it properly.

Sorry it took this long to get back to you, and thanks for taking the time to report it.