[v9] Gracefully degrade tsh db ls in case fetching roles fails. (#12318)

tool/tsh/db.go

@@ -72,7 +72,7 @@ func onListDatabases(cf *CLIConf) error {
 
 	roleSet, err := services.FetchRoles(profile.Roles, cluster, profile.Traits)
 	if err != nil {
-		return trace.Wrap(err)
+		log.Debugf("Failed to fetch user roles: %v.", err)
 	}
 
 	sort.Slice(databases, func(i, j int) bool {

tool/tsh/tsh.go

@@ -1658,6 +1658,10 @@ func showAppsAsText(apps []types.Application, active []tlsca.RouteToApp, verbose
 }
 
 func getUsersForDb(database types.Database, roleSet services.RoleSet) string {
+	// may happen if fetching the role set failed for any reason.
+	if roleSet == nil {
+		return "(unknown)"
+	}
 	dbUsers := roleSet.EnumerateDatabaseUsers(database)
 	allowed := dbUsers.Allowed()
 

tool/tsh/tsh_test.go

@@ -1525,34 +1525,36 @@ func Test_getUsersForDb(t *testing.T) {
 			database: dbProd,
 			result:   "[dev]",
 		},
-
 		{
 			name:     "roleDevStage x dbStage",
 			roles:    services.RoleSet{roleDevStage},
 			database: dbStage,
 			result:   "[*], except: [superuser]",
 		},
-
 		{
 			name:     "roleDevStage x dbProd",
 			roles:    services.RoleSet{roleDevStage},
 			database: dbProd,
 			result:   "(none)",
 		},
-
 		{
 			name:     "roleDevProd x dbStage",
 			roles:    services.RoleSet{roleDevProd},
 			database: dbStage,
 			result:   "(none)",
 		},
-
 		{
 			name:     "roleDevProd x dbProd",
 			roles:    services.RoleSet{roleDevProd},
 			database: dbProd,
 			result:   "[dev]",
 		},
+		{
+			name:     "no role set",
+			roles:    nil,
+			database: dbProd,
+			result:   "(unknown)",
+		},
 	}
 
 	for _, tc := range testCases {