chore: compatiable none list

api/services/enterprise/rbac_service.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from enum import StrEnum
 from typing import Any, Generic, TypeVar
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 from services.enterprise.base import EnterpriseRequest
 
@@ -66,6 +66,13 @@ class RBACRole(_RBACModel):
     is_builtin: bool = False
     permission_keys: list[str] = Field(default_factory=list)
 
+    @field_validator("permission_keys", mode="before")
+    @classmethod
+    def _coerce_permission_keys(cls, value: Any) -> list[str]:
+        if value is None:
+            return []
+        return value
+
 
 class AccessPolicy(_RBACModel):
     id: str

api/tests/unit_tests/services/enterprise/test_rbac_service.py

@@ -93,6 +93,25 @@ class TestRoles:
         svc.RBACService.Roles.list("tenant-1")
         assert _call_args(mock_send).params is None
 
+    def test_list_coerces_null_permission_keys(self, mock_send: MagicMock):
+        mock_send.return_value = {
+            "data": [
+                {
+                    "id": "role-1",
+                    "tenant_id": "tenant-1",
+                    "type": "workspace",
+                    "category": "global_custom",
+                    "name": "Owner",
+                    "permission_keys": None,
+                }
+            ],
+            "pagination": None,
+        }
+
+        out = svc.RBACService.Roles.list("tenant-1")
+
+        assert out.data[0].permission_keys == []
+
     def test_get_passes_id_query_param(self, mock_send: MagicMock):
         mock_send.return_value = {"id": "role-1", "type": "workspace", "name": "Owner"}
         svc.RBACService.Roles.get("tenant-1", "acct-1", "role-1")