From 25fd9cd54f73b529bec66461adb962db6a380b1b Mon Sep 17 00:00:00 2001
From: Martin McKeaveney <martin@shogunsystems.co.uk>
Date: Tue, 6 Jul 2021 17:13:02 +0100
Subject: [PATCH] default users without roles to public role

---
 packages/auth/src/security/roles.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/auth/src/security/roles.js b/packages/auth/src/security/roles.js
index 53e1b90d73..e7055c9147 100644
--- a/packages/auth/src/security/roles.js
+++ b/packages/auth/src/security/roles.js
@@ -226,7 +226,7 @@ exports.getAllRoles = async appId => {
       dbRole => exports.getExternalRoleID(dbRole._id) === builtinRoleId
     )[0]
     if (dbBuiltin == null) {
-      roles.push(builtinRole)
+      roles.push(builtinRole || builtinRoles.PUBLIC)
     } else {
       // remove role and all back after combining with the builtin
       roles = roles.filter(role => role._id !== dbBuiltin._id)