From 5084576553dbfbca715f391141fcc7d588020017 Mon Sep 17 00:00:00 2001
From: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
Date: Mon, 29 Apr 2024 12:40:14 +0200
Subject: [PATCH] Fix roles filtering

---
 api/types/role.go      |  4 ++--
 api/types/role_test.go | 26 +++++++++++++++++++++++++-
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/api/types/role.go b/api/types/role.go
index e9aa8fbe49776..6539f707f159a 100644
--- a/api/types/role.go
+++ b/api/types/role.go
@@ -48,8 +48,8 @@ const (
 
 // Match checks if the given role matches this filter.
 func (f *RoleFilter) Match(role *RoleV6) bool {
-	if f.SkipSystemRoles {
-		return !IsSystemResource(role)
+	if f.SkipSystemRoles && IsSystemResource(role) {
+		return false
 	}
 
 	if len(f.SearchKeywords) != 0 {
diff --git a/api/types/role_test.go b/api/types/role_test.go
index a82065f89edf0..934ed63b84054 100644
--- a/api/types/role_test.go
+++ b/api/types/role_test.go
@@ -466,11 +466,17 @@ func TestRoleFilterMatch(t *testing.T) {
 			shouldMatch: true,
 		},
 		{
-			name:        "correct search keyword should match the role",
+			name:        "correct search keyword should match the regular role",
 			role:        &regularRole,
 			filter:      &RoleFilter{SearchKeywords: []string{"appr"}},
 			shouldMatch: true,
 		},
+		{
+			name:        "correct search keyword should match the system role",
+			role:        &systemRole,
+			filter:      &RoleFilter{SearchKeywords: []string{"bot"}},
+			shouldMatch: true,
+		},
 		{
 			name:        "incorrect search keyword shouldn't match the role",
 			role:        &regularRole,
@@ -489,6 +495,24 @@ func TestRoleFilterMatch(t *testing.T) {
 			filter:      &RoleFilter{SkipSystemRoles: true},
 			shouldMatch: true,
 		},
+		{
+			name:        "skip system roles filter and incorrect search keywords shouldn't match the regular role",
+			role:        &regularRole,
+			filter:      &RoleFilter{SkipSystemRoles: true, SearchKeywords: []string{"xyz"}},
+			shouldMatch: false,
+		},
+		{
+			name:        "skip system roles filter and correct search keywords shouldn't match the system role",
+			role:        &systemRole,
+			filter:      &RoleFilter{SkipSystemRoles: true, SearchKeywords: []string{"bot"}},
+			shouldMatch: false,
+		},
+		{
+			name:        "skip system roles filter and correct search keywords should match the regular role",
+			role:        &regularRole,
+			filter:      &RoleFilter{SkipSystemRoles: true, SearchKeywords: []string{"appr"}},
+			shouldMatch: true,
+		},
 	}
 
 	for _, tt := range tests {