1 files changed, 22 insertions, 0 deletions
diff --git a/internal/storage/roleconfig.go b/internal/storage/roleconfig.go
index 6ae043b..f9478f2 100644
--- a/internal/storage/roleconfig.go
+++ b/internal/storage/roleconfig.go
@@ -125,6 +125,28 @@ func (s *DB) ActivateRoleConfigVersion(roleName string, version int) error {
 	return tx.Commit()
 }
 
+// ListRoleNames returns every distinct role name that has at least one
+// role_configs row, alphabetically. There is no other way to discover which
+// roles exist short of guessing names — this backs GET /api/roles, the
+// "which roles exist" entry point the role/config management panel needs.
+func (s *DB) ListRoleNames() ([]string, error) {
+	rows, err := s.db.Query(`SELECT DISTINCT role FROM role_configs ORDER BY role ASC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := []string{}
+	for rows.Next() {
+		var r string
+		if err := rows.Scan(&r); err != nil {
+			return nil, err
+		}
+		out = append(out, r)
+	}
+	return out, rows.Err()
+}
+
 func scanRoleConfigRow(row scanner) (*RoleConfigRow, error) {
 	var r RoleConfigRow
 	var createdAt time.Time