[v15] Correctly filter out system roles

api/proto/teleport/legacy/types/types.proto

@@ -2632,6 +2632,8 @@ message PluginDataUpdateParams {
 message RoleFilter {
   // SearchKeywords is a list of search keywords to match against resource field values.
   repeated string SearchKeywords = 1 [(gogoproto.jsontag) = "search_keywords,omitempty"];
+  // SkipSystemRoles filters out teleport system roles from the results.
+  bool SkipSystemRoles = 2 [(gogoproto.jsontag) = "skip_system_roles,omitempty"];
 }
 
 // RoleV6 represents role resource specification

api/types/role.go

@@ -50,6 +50,10 @@ const (
 
 // Match checks if the given role matches this filter.
 func (f *RoleFilter) Match(role *RoleV6) bool {
+	if f.SkipSystemRoles {
+		return !IsSystemResource(role)
+	}
+
 	if len(f.SearchKeywords) != 0 {
 		if !role.MatchSearch(f.SearchKeywords) {
 			return false

api/types/role_test.go

@@ -519,3 +519,65 @@ func TestRoleV6_CheckAndSetDefaults(t *testing.T) {
 		})
 	}
 }
+
+func TestRoleFilterMatch(t *testing.T) {
+	regularRole := RoleV6{
+		Metadata: Metadata{
+			Name: "request-approver",
+		},
+	}
+	systemRole := RoleV6{
+		Metadata: Metadata{
+			Name: "bot",
+			Labels: map[string]string{
+				TeleportInternalResourceType: SystemResource,
+			},
+		},
+	}
+
+	tests := []struct {
+		name        string
+		role        *RoleV6
+		filter      *RoleFilter
+		shouldMatch bool
+	}{
+		{
+			name:        "empty filter should match everything",
+			role:        &regularRole,
+			filter:      &RoleFilter{},
+			shouldMatch: true,
+		},
+		{
+			name:        "correct search keyword should match the role",
+			role:        &regularRole,
+			filter:      &RoleFilter{SearchKeywords: []string{"appr"}},
+			shouldMatch: true,
+		},
+		{
+			name:        "incorrect search keyword shouldn't match the role",
+			role:        &regularRole,
+			filter:      &RoleFilter{SearchKeywords: []string{"xyz"}},
+			shouldMatch: false,
+		},
+		{
+			name:        "skip system roles filter shouldn't match the system role",
+			role:        &systemRole,
+			filter:      &RoleFilter{SkipSystemRoles: true},
+			shouldMatch: false,
+		},
+		{
+			name:        "skip system roles filter should match the regular role",
+			role:        &regularRole,
+			filter:      &RoleFilter{SkipSystemRoles: true},
+			shouldMatch: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.role.CheckAndSetDefaults()
+			require.NoError(t, err)
+			require.Equal(t, tt.shouldMatch, tt.filter.Match(tt.role))
+		})
+	}
+}