diff --git a/scm-dao-xml/src/main/java/sonia/scm/repository/xml/SingleRepositoryUpdateProcessor.java b/scm-dao-xml/src/main/java/sonia/scm/repository/xml/SingleRepositoryUpdateProcessor.java
new file mode 100644
index 0000000000..eeb95f75b0
--- /dev/null
+++ b/scm-dao-xml/src/main/java/sonia/scm/repository/xml/SingleRepositoryUpdateProcessor.java
@@ -0,0 +1,15 @@
+package sonia.scm.repository.xml;
+
+import javax.inject.Inject;
+import java.nio.file.Path;
+import java.util.function.BiConsumer;
+
+public class SingleRepositoryUpdateProcessor {
+
+  @Inject
+  private PathBasedRepositoryLocationResolver locationResolver;
+
+  public void doUpdate(BiConsumer<String, Path> forEachRepository) {
+    locationResolver.forAllPaths(forEachRepository);
+  }
+}
diff --git a/scm-ui-components/packages/ui-components/src/Icon.js b/scm-ui-components/packages/ui-components/src/Icon.js
new file mode 100644
index 0000000000..b3b9a9b4c2
--- /dev/null
+++ b/scm-ui-components/packages/ui-components/src/Icon.js
@@ -0,0 +1,25 @@
+//@flow
+import React from "react";
+import classNames from "classnames";
+
+type Props = {
+  title?: string,
+  name: string
+}
+
+export default class Icon extends React.Component<Props> {
+
+  render() {
+    const { title, name } = this.props;
+    if(title) {
+      return (
+        <i title={title} className={classNames("is-icon", "fas", "fa-fw", "fa-" + name)}/>
+      );
+    }
+    return (
+      <i className={classNames("is-icon", "fas", "fa-" + name)}/>
+    );
+  }
+
+}
+
diff --git a/scm-ui-components/packages/ui-components/src/forms/Radio.js b/scm-ui-components/packages/ui-components/src/forms/Radio.js
index 6460e67070..7e61b25ec0 100644
--- a/scm-ui-components/packages/ui-components/src/forms/Radio.js
+++ b/scm-ui-components/packages/ui-components/src/forms/Radio.js
@@ -22,19 +22,18 @@ class Radio extends React.Component<Props> {
 
   render() {
     return (
-
-          <label className="radio" disabled={this.props.disabled}>
-            <input
-              type="radio"
-              name={this.props.name}
-              value={this.props.value}
-              checked={this.props.checked}
-              onChange={this.props.onChange}
-              disabled={this.props.disabled}
-            />{" "}
-            {this.props.label}
-            {this.renderHelp()}
-          </label>
+      <label className="radio" disabled={this.props.disabled}>
+        <input
+          type="radio"
+          name={this.props.name}
+          value={this.props.value}
+          checked={this.props.checked}
+          onChange={this.props.onChange}
+          disabled={this.props.disabled}
+        />{" "}
+        {this.props.label}
+        {this.renderHelp()}
+      </label>
     );
   }
 }
diff --git a/scm-ui-components/packages/ui-components/src/index.js b/scm-ui-components/packages/ui-components/src/index.js
index 954b0b0955..82780c94eb 100644
--- a/scm-ui-components/packages/ui-components/src/index.js
+++ b/scm-ui-components/packages/ui-components/src/index.js
@@ -9,6 +9,7 @@ export { validation, urls, repositories };
 export { default as DateFromNow } from "./DateFromNow.js";
 export { default as ErrorNotification } from "./ErrorNotification.js";
 export { default as ErrorPage } from "./ErrorPage.js";
+export { default as Icon } from "./Icon.js";
 export { default as Image } from "./Image.js";
 export { default as Loading } from "./Loading.js";
 export { default as Logo } from "./Logo.js";
diff --git a/scm-ui-components/packages/ui-components/src/navigation/NavLink.js b/scm-ui-components/packages/ui-components/src/navigation/NavLink.js
index 98c3138a8f..e1236371a8 100644
--- a/scm-ui-components/packages/ui-components/src/navigation/NavLink.js
+++ b/scm-ui-components/packages/ui-components/src/navigation/NavLink.js
@@ -1,5 +1,6 @@
 //@flow
 import * as React from "react";
+import classNames from "classnames";
 import {Link, Route} from "react-router-dom";
 
 // TODO mostly copy of PrimaryNavigationLink
@@ -28,7 +29,7 @@ class NavLink extends React.Component<Props> {
 
     let showIcon = null;
     if (icon) {
-      showIcon = (<><i className={icon} />{" "}</>);
+      showIcon = (<><i className={classNames(icon, "fa-fw")} />{" "}</>);
     }
 
     return (
diff --git a/scm-ui-components/packages/ui-components/src/navigation/SubNavigation.js b/scm-ui-components/packages/ui-components/src/navigation/SubNavigation.js
index 0a6612a173..cdf92d068d 100644
--- a/scm-ui-components/packages/ui-components/src/navigation/SubNavigation.js
+++ b/scm-ui-components/packages/ui-components/src/navigation/SubNavigation.js
@@ -1,6 +1,7 @@
 //@flow
 import * as React from "react";
 import { Link, Route } from "react-router-dom";
+import classNames from "classnames";
 
 type Props = {
   to: string,
@@ -37,7 +38,7 @@ class SubNavigation extends React.Component<Props> {
     return (
       <li>
         <Link className={this.isActive(route) ? "is-active" : ""} to={to}>
-          <i className={defaultIcon} /> {label}
+          <i className={classNames(defaultIcon, "fa-fw")} /> {label}
         </Link>
         {children}
       </li>
diff --git a/scm-ui/public/locales/de/groups.json b/scm-ui/public/locales/de/groups.json
index bb8eda1cf2..f1c5f295b1 100644
--- a/scm-ui/public/locales/de/groups.json
+++ b/scm-ui/public/locales/de/groups.json
@@ -6,6 +6,7 @@
     "lastModified": "Zuletzt bearbeitet",
     "type": "Typ",
     "external": "Extern",
+    "internal": "Intern",
     "members": "Mitglieder"
   },
   "groups": {
diff --git a/scm-ui/public/locales/de/users.json b/scm-ui/public/locales/de/users.json
index 37416c1e4f..25b6858c8b 100644
--- a/scm-ui/public/locales/de/users.json
+++ b/scm-ui/public/locales/de/users.json
@@ -5,6 +5,7 @@
     "mail": "E-Mail",
     "password": "Passwort",
     "active": "Aktiv",
+    "inactive": "Inaktiv",
     "type": "Typ",
     "creationDate": "Erstellt",
     "lastModified": "Zuletzt bearbeitet"
diff --git a/scm-ui/public/locales/en/groups.json b/scm-ui/public/locales/en/groups.json
index aff350a458..f14347ed30 100644
--- a/scm-ui/public/locales/en/groups.json
+++ b/scm-ui/public/locales/en/groups.json
@@ -6,6 +6,7 @@
     "lastModified": "Last Modified",
     "type": "Type",
     "external": "External",
+    "internal": "Internal",
     "members": "Members"
   },
   "groups": {
diff --git a/scm-ui/public/locales/en/users.json b/scm-ui/public/locales/en/users.json
index d188f6221b..b492923a3f 100644
--- a/scm-ui/public/locales/en/users.json
+++ b/scm-ui/public/locales/en/users.json
@@ -5,6 +5,7 @@
     "mail": "E-Mail",
     "password": "Password",
     "active": "Active",
+    "inactive": "Inactive",
     "type": "Type",
     "creationDate": "Creation Date",
     "lastModified": "Last Modified"
diff --git a/scm-ui/src/groups/components/GroupForm.js b/scm-ui/src/groups/components/GroupForm.js
index baa68de8ef..04a5e6f35f 100644
--- a/scm-ui/src/groups/components/GroupForm.js
+++ b/scm-ui/src/groups/components/GroupForm.js
@@ -123,7 +123,7 @@ class GroupForm extends React.Component<Props, State> {
     );
   };
 
-  isExistingGroup = () => !! this.props.group;
+  isExistingGroup = () => !!this.props.group;
 
   render() {
     const { loading, t } = this.props;
diff --git a/scm-ui/src/groups/components/table/GroupRow.js b/scm-ui/src/groups/components/table/GroupRow.js
index 20bc90279e..509fe09ce4 100644
--- a/scm-ui/src/groups/components/table/GroupRow.js
+++ b/scm-ui/src/groups/components/table/GroupRow.js
@@ -1,29 +1,38 @@
 // @flow
 import React from "react";
+import { translate } from "react-i18next";
 import { Link } from "react-router-dom";
 import type { Group } from "@scm-manager/ui-types";
-import { Checkbox } from "@scm-manager/ui-components";
+import { Icon } from "@scm-manager/ui-components";
 
 type Props = {
-  group: Group
+  group: Group,
+
+  // context props
+  t: string => string
 };
 
-export default class GroupRow extends React.Component<Props> {
+class GroupRow extends React.Component<Props> {
   renderLink(to: string, label: string) {
     return <Link to={to}>{label}</Link>;
   }
 
   render() {
-    const { group } = this.props;
+    const { group, t } = this.props;
     const to = `/group/${group.name}`;
+    const iconType = group.external ? (
+      <Icon title={t("group.external")} name="sign-out-alt fa-rotate-270" />
+    ) : (
+      <Icon title={t("group.internal")} name="sign-in-alt fa-rotate-90" />
+    );
+
     return (
       <tr>
-        <td>{this.renderLink(to, group.name)}</td>
+        <td>{iconType} {this.renderLink(to, group.name)}</td>
         <td className="is-hidden-mobile">{group.description}</td>
-        <td>
-          <Checkbox checked={group.external} />
-        </td>
       </tr>
     );
   }
 }
+
+export default translate("groups")(GroupRow);
diff --git a/scm-ui/src/groups/components/table/GroupTable.js b/scm-ui/src/groups/components/table/GroupTable.js
index 85bcb813fc..c7b59b40a7 100644
--- a/scm-ui/src/groups/components/table/GroupTable.js
+++ b/scm-ui/src/groups/components/table/GroupTable.js
@@ -18,7 +18,6 @@ class GroupTable extends React.Component<Props> {
           <tr>
             <th>{t("group.name")}</th>
             <th className="is-hidden-mobile">{t("group.description")}</th>
-            <th>{t("group.external")}</th>
           </tr>
         </thead>
         <tbody>
diff --git a/scm-ui/src/repos/permissions/containers/SinglePermission.js b/scm-ui/src/repos/permissions/containers/SinglePermission.js
index bdb96de0bd..37f3436af3 100644
--- a/scm-ui/src/repos/permissions/containers/SinglePermission.js
+++ b/scm-ui/src/repos/permissions/containers/SinglePermission.js
@@ -11,7 +11,7 @@ import {
 } from "../modules/permissions";
 import { connect } from "react-redux";
 import type { History } from "history";
-import { Button } from "@scm-manager/ui-components";
+import { Button, Icon } from "@scm-manager/ui-components";
 import DeletePermissionButton from "../components/buttons/DeletePermissionButton";
 import RoleSelector from "../components/RoleSelector";
 import AdvancedPermissionsDialog from "./AdvancedPermissionsDialog";
@@ -49,9 +49,6 @@ type State = {
 };
 
 const styles = {
-  iconColor: {
-    color: "#9a9a9a"
-  },
   centerMiddle: {
     display: "table-cell",
     verticalAlign: "middle !important"
@@ -148,15 +145,9 @@ class SinglePermission extends React.Component<Props, State> {
 
     const iconType =
       permission && permission.groupPermission ? (
-        <i
-          title={t("permission.group")}
-          className={classNames("fas fa-user-friends", classes.iconColor)}
-        />
+        <Icon title={t("permission.group")} name="user-friends" />
       ) : (
-        <i
-          title={t("permission.user")}
-          className={classNames("fas fa-user", classes.iconColor)}
-        />
+        <Icon title={t("permission.user")} name="user" />
       );
 
     return (
@@ -171,7 +162,7 @@ class SinglePermission extends React.Component<Props, State> {
             action={this.handleDetailedPermissionsPressed}
           />
         </td>
-        <td className={classes.centerMiddle}>
+        <td className={classNames("is-darker", classes.centerMiddle)}>
           <DeletePermissionButton
             permission={permission}
             namespace={namespace}
diff --git a/scm-ui/src/users/components/UserForm.js b/scm-ui/src/users/components/UserForm.js
index 3d7f2cfc30..c473e92322 100644
--- a/scm-ui/src/users/components/UserForm.js
+++ b/scm-ui/src/users/components/UserForm.js
@@ -80,7 +80,6 @@ class UserForm extends React.Component<Props, State> {
       return (
         this.props.user.displayName === user.displayName &&
         this.props.user.mail === user.mail &&
-        this.props.user.admin === user.admin &&
         this.props.user.active === user.active
       );
     } else {
diff --git a/scm-ui/src/users/components/table/UserRow.js b/scm-ui/src/users/components/table/UserRow.js
index 9cb55295fb..03c7f1ebaa 100644
--- a/scm-ui/src/users/components/table/UserRow.js
+++ b/scm-ui/src/users/components/table/UserRow.js
@@ -1,31 +1,43 @@
 // @flow
 import React from "react";
+import { translate } from "react-i18next";
 import { Link } from "react-router-dom";
 import type { User } from "@scm-manager/ui-types";
+import { Icon } from "@scm-manager/ui-components";
 
 type Props = {
-  user: User
+  user: User,
+
+  // context props
+  t: string => string
 };
 
-export default class UserRow extends React.Component<Props> {
+class UserRow extends React.Component<Props> {
   renderLink(to: string, label: string) {
     return <Link to={to}>{label}</Link>;
   }
 
   render() {
-    const { user } = this.props;
+    const { user, t } = this.props;
     const to = `/user/${user.name}`;
+    const iconType = user.active ? (
+      <Icon title={t("user.active")} name="user" />
+    ) : (
+      <Icon title={t("user.inactive")} name="user-slash" />
+    );
+
     return (
-      <tr>
-        <td className="is-hidden-mobile">{this.renderLink(to, user.name)}</td>
-        <td>{this.renderLink(to, user.displayName)}</td>
+      <tr className={user.active ? "border-is-green" : "border-is-yellow"}>
+        <td>{iconType} {this.renderLink(to, user.name)}</td>
+        <td className="is-hidden-mobile">
+          {this.renderLink(to, user.displayName)}
+        </td>
         <td>
           <a href={`mailto:${user.mail}`}>{user.mail}</a>
         </td>
-        <td className="is-hidden-mobile">
-          <input type="checkbox" id="active" checked={user.active} readOnly />
-        </td>
       </tr>
     );
   }
 }
+
+export default translate("users")(UserRow);
diff --git a/scm-ui/src/users/components/table/UserTable.js b/scm-ui/src/users/components/table/UserTable.js
index 8c012f11f4..ab29dca9e7 100644
--- a/scm-ui/src/users/components/table/UserTable.js
+++ b/scm-ui/src/users/components/table/UserTable.js
@@ -19,7 +19,6 @@ class UserTable extends React.Component<Props> {
             <th className="is-hidden-mobile">{t("user.name")}</th>
             <th>{t("user.displayName")}</th>
             <th>{t("user.mail")}</th>
-            <th className="is-hidden-mobile">{t("user.active")}</th>
           </tr>
         </thead>
         <tbody>
diff --git a/scm-ui/styles/scm.scss b/scm-ui/styles/scm.scss
index 09a4eb5c27..05bd1c2949 100644
--- a/scm-ui/styles/scm.scss
+++ b/scm-ui/styles/scm.scss
@@ -219,16 +219,23 @@ ul.is-separated {
 // card tables
 .card-table {
   border-collapse: separate;
-  border-spacing: 0px 5px;
+  border-spacing: 0 5px;
 
   tr {
     a {
       color: #363636;
     }
+    &.border-is-green td:first-child {
+      border-left-color: $green;
+    }
+    &.border-is-yellow td:first-child {
+      border-left-color: $yellow;
+    }
     &:hover {
       td {
         background-color: whitesmoke;
-        &:nth-child(4) {
+
+        &.is-darker {
           background-color: #e1e1e1;
         }
       }
@@ -238,13 +245,14 @@ ul.is-separated {
     }
   }
   td {
-    border-bottom: 1px solid whitesmoke;
-    background-color: #fafafa;
     padding: 1em 1.25em;
+    background-color: #fafafa;
+    border-bottom: 1px solid whitesmoke;
+
     &:first-child {
-      border-left: 3px solid $mint;
+      border-left: 3px solid $grey;
     }
-    &:nth-child(4) {
+    &.is-darker {
       background-color: whitesmoke;
     }
   }
@@ -318,6 +326,10 @@ form .field:not(.is-grouped) {
   }
 }
 
+.is-icon {
+  color: $grey-light;
+}
+
 // label with help-icon compensation
 .label-icon-spacing {
   margin-top: 30px;
diff --git a/scm-webapp/src/main/java/sonia/scm/security/SystemRepositoryPermissionProvider.java b/scm-webapp/src/main/java/sonia/scm/security/SystemRepositoryPermissionProvider.java
index 0350698352..444ee3e941 100644
--- a/scm-webapp/src/main/java/sonia/scm/security/SystemRepositoryPermissionProvider.java
+++ b/scm-webapp/src/main/java/sonia/scm/security/SystemRepositoryPermissionProvider.java
@@ -25,7 +25,7 @@ import java.util.Set;
 import static java.util.Collections.unmodifiableCollection;
 import static java.util.stream.Collectors.toList;
 
-class SystemRepositoryPermissionProvider {
+public class SystemRepositoryPermissionProvider {
 
   private static final Logger logger = LoggerFactory.getLogger(SystemRepositoryPermissionProvider.class);
   private static final String REPOSITORY_PERMISSION_DESCRIPTOR = "META-INF/scm/repository-permissions.xml";
diff --git a/scm-webapp/src/main/java/sonia/scm/update/repository/MigrateVerbsToPermissionRoles.java b/scm-webapp/src/main/java/sonia/scm/update/repository/MigrateVerbsToPermissionRoles.java
new file mode 100644
index 0000000000..0b96a58385
--- /dev/null
+++ b/scm-webapp/src/main/java/sonia/scm/update/repository/MigrateVerbsToPermissionRoles.java
@@ -0,0 +1,158 @@
+package sonia.scm.update.repository;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import sonia.scm.migration.UpdateException;
+import sonia.scm.migration.UpdateStep;
+import sonia.scm.plugin.Extension;
+import sonia.scm.repository.HealthCheckFailure;
+import sonia.scm.repository.Repository;
+import sonia.scm.repository.RepositoryPermission;
+import sonia.scm.repository.RepositoryRole;
+import sonia.scm.repository.xml.SingleRepositoryUpdateProcessor;
+import sonia.scm.security.SystemRepositoryPermissionProvider;
+import sonia.scm.version.Version;
+
+import javax.inject.Inject;
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.JAXBException;
+import javax.xml.bind.Marshaller;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlElementWrapper;
+import javax.xml.bind.annotation.XmlRootElement;
+import java.nio.file.Path;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+
+@Extension
+public class MigrateVerbsToPermissionRoles implements UpdateStep {
+
+  public static final Logger LOG = LoggerFactory.getLogger(MigrateVerbsToPermissionRoles.class);
+
+  private final SingleRepositoryUpdateProcessor updateProcessor;
+  private final SystemRepositoryPermissionProvider systemRepositoryPermissionProvider;
+  private final JAXBContext jaxbContextNewRepository;
+  private final JAXBContext jaxbContextOldRepository;
+
+  @Inject
+  public MigrateVerbsToPermissionRoles(SingleRepositoryUpdateProcessor updateProcessor, SystemRepositoryPermissionProvider systemRepositoryPermissionProvider) {
+    this.updateProcessor = updateProcessor;
+    this.systemRepositoryPermissionProvider = systemRepositoryPermissionProvider;
+    jaxbContextNewRepository = createJAXBContext(Repository.class);
+    jaxbContextOldRepository = createJAXBContext(OldRepository.class);
+  }
+
+  @Override
+  public void doUpdate() {
+    updateProcessor.doUpdate(this::update);
+  }
+
+  void update(String repositoryId, Path path) {
+    LOG.info("updating repository {}", repositoryId);
+    OldRepository oldRepository = readOldRepository(path);
+    Repository newRepository = createNewRepository(oldRepository);
+    writeNewRepository(path, newRepository);
+  }
+
+  private void writeNewRepository(Path path, Repository newRepository) {
+    try {
+      Marshaller marshaller = jaxbContextNewRepository.createMarshaller();
+      marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, Boolean.TRUE);
+      marshaller.marshal(newRepository, path.resolve("metadata.xml").toFile());
+    } catch (JAXBException e) {
+      throw new UpdateException("could not read old repository structure", e);
+    }
+  }
+
+  private OldRepository readOldRepository(Path path) {
+    try {
+      return (OldRepository) jaxbContextOldRepository.createUnmarshaller().unmarshal(path.resolve("metadata.xml").toFile());
+    } catch (JAXBException e) {
+      throw new UpdateException("could not read old repository structure", e);
+    }
+  }
+
+  private Repository createNewRepository(OldRepository oldRepository) {
+    Repository repository = new Repository(
+      oldRepository.id,
+      oldRepository.type,
+      oldRepository.namespace,
+      oldRepository.name,
+      oldRepository.contact,
+      oldRepository.description,
+      oldRepository.permissions.stream().map(this::updatePermission).toArray(RepositoryPermission[]::new)
+    );
+    repository.setCreationDate(oldRepository.creationDate);
+    repository.setHealthCheckFailures(oldRepository.healthCheckFailures);
+    repository.setLastModified(oldRepository.lastModified);
+    repository.setPublicReadable(oldRepository.publicReadable);
+    repository.setArchived(oldRepository.archived);
+    return repository;
+  }
+
+  private RepositoryPermission updatePermission(RepositoryPermission repositoryPermission) {
+    return findMatchingRole(repositoryPermission.getVerbs())
+      .map(roleName -> copyRepositoryPermissionWithRole(repositoryPermission, roleName))
+      .orElse(repositoryPermission);
+  }
+
+  private RepositoryPermission copyRepositoryPermissionWithRole(RepositoryPermission repositoryPermission, String roleName) {
+    return new RepositoryPermission(repositoryPermission.getName(), roleName, repositoryPermission.isGroupPermission());
+  }
+
+  private Optional<String> findMatchingRole(Collection<String> verbs) {
+    return systemRepositoryPermissionProvider.availableRoles()
+      .stream()
+      .filter(r -> roleMatchesVerbs(verbs, r))
+      .map(RepositoryRole::getName)
+      .findFirst();
+  }
+
+  private boolean roleMatchesVerbs(Collection<String> verbs, RepositoryRole r) {
+    return verbs.size() == r.getVerbs().size() && r.getVerbs().containsAll(verbs);
+  }
+
+  private JAXBContext createJAXBContext(Class<?> clazz) {
+    try {
+      return JAXBContext.newInstance(clazz);
+    } catch (JAXBException e) {
+      throw new UpdateException("could not create XML marshaller", e);
+    }
+  }
+
+  @Override
+  public Version getTargetVersion() {
+    return Version.parse("2.0.2");
+  }
+
+  @Override
+  public String getAffectedDataType() {
+    return "sonia.scm.repository.xml";
+  }
+
+  @XmlAccessorType(XmlAccessType.FIELD)
+  @XmlRootElement(name = "repositories")
+  private static class OldRepository {
+    private String contact;
+    private Long creationDate;
+    private String description;
+    @XmlElement(name = "healthCheckFailure")
+    @XmlElementWrapper(name = "healthCheckFailures")
+    private List<HealthCheckFailure> healthCheckFailures;
+    private String id;
+    private Long lastModified;
+    private String namespace;
+    private String name;
+    @XmlElement(name = "permission")
+    private final Set<RepositoryPermission> permissions = new HashSet<>();
+    @XmlElement(name = "public")
+    private boolean publicReadable = false;
+    private boolean archived = false;
+    private String type;
+  }
+}
diff --git a/scm-webapp/src/test/java/sonia/scm/update/repository/MigrateVerbsToPermissionRolesTest.java b/scm-webapp/src/test/java/sonia/scm/update/repository/MigrateVerbsToPermissionRolesTest.java
new file mode 100644
index 0000000000..8d4ceb1a14
--- /dev/null
+++ b/scm-webapp/src/test/java/sonia/scm/update/repository/MigrateVerbsToPermissionRolesTest.java
@@ -0,0 +1,76 @@
+package sonia.scm.update.repository;
+
+import com.google.common.io.Resources;
+import org.assertj.core.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junitpioneer.jupiter.TempDirectory;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import sonia.scm.repository.RepositoryRole;
+import sonia.scm.repository.xml.SingleRepositoryUpdateProcessor;
+import sonia.scm.security.SystemRepositoryPermissionProvider;
+
+import java.io.IOException;
+import java.net.URL;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Collections;
+import java.util.List;
+import java.util.function.BiConsumer;
+
+import static java.util.Arrays.asList;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+@ExtendWith(TempDirectory.class)
+class MigrateVerbsToPermissionRolesTest {
+
+  private static final String EXISTING_REPOSITORY_ID = "id";
+
+  @Mock
+  private SingleRepositoryUpdateProcessor singleRepositoryUpdateProcessor;
+  @Mock
+  private SystemRepositoryPermissionProvider systemRepositoryPermissionProvider;
+
+  @InjectMocks
+  private MigrateVerbsToPermissionRoles migration;
+
+  @BeforeEach
+  void init(@TempDirectory.TempDir Path tempDir) throws IOException {
+    URL metadataUrl = Resources.getResource("sonia/scm/update/repository/metadataWithoutRoles.xml");
+    Files.copy(metadataUrl.openStream(), tempDir.resolve("metadata.xml"));
+    doAnswer(invocation -> {
+      ((BiConsumer<String, Path>) invocation.getArgument(0)).accept(EXISTING_REPOSITORY_ID, tempDir);
+      return null;
+    }).when(singleRepositoryUpdateProcessor).doUpdate(any());
+    when(systemRepositoryPermissionProvider.availableRoles()).thenReturn(Collections.singletonList(new RepositoryRole("ROLE", asList("read", "write"), "")));
+  }
+
+  @Test
+  void shouldUpdateToRolesIfPossible(@TempDirectory.TempDir Path tempDir) throws IOException {
+    migration.doUpdate();
+
+    List<String> newMetadata = Files.readAllLines(tempDir.resolve("metadata.xml"));
+    Assertions.assertThat(newMetadata.stream().map(String::trim)).
+      containsSubsequence(
+        "<groupPermission>false</groupPermission>",
+        "<name>user</name>",
+        "<role>ROLE</role>"
+      )
+      .containsSubsequence(
+        "<groupPermission>true</groupPermission>",
+        "<name>group</name>",
+        "<verb>special</verb>"
+      )
+      .doesNotContain(
+        "<verb>read</verb>",
+        "<verb>write</verb>"
+      );
+  }
+
+}
diff --git a/scm-webapp/src/test/resources/sonia/scm/update/repository/metadataWithoutRoles.xml b/scm-webapp/src/test/resources/sonia/scm/update/repository/metadataWithoutRoles.xml
new file mode 100644
index 0000000000..4716943f47
--- /dev/null
+++ b/scm-webapp/src/test/resources/sonia/scm/update/repository/metadataWithoutRoles.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<repositories>
+    <properties/>
+    <contact>ich@du.er</contact>
+    <creationDate>1557729536519</creationDate>
+    <description/>
+    <id>B3RQKYNzo2</id>
+    <lastModified>1557825677782</lastModified>
+    <namespace>scmadmin</namespace>
+    <name>git</name>
+    <permission>
+        <groupPermission>false</groupPermission>
+        <name>user</name>
+        <verb>read</verb>
+        <verb>write</verb>
+    </permission>
+    <permission>
+        <groupPermission>true</groupPermission>
+        <name>group</name>
+        <verb>special</verb>
+    </permission>
+    <public>false</public>
+    <archived>false</archived>
+    <type>git</type>
+</repositories>