92 lines
3.1 KiB
Python
92 lines
3.1 KiB
Python
"""Bootstrap default permissions, roles, and the first superuser.
|
|
|
|
Idempotent: safe to run repeatedly. Reads the superuser credentials from
|
|
settings (env vars or .env).
|
|
|
|
Usage:
|
|
uv run python -m scripts.seed
|
|
"""
|
|
|
|
import asyncio
|
|
|
|
from app.core.config import settings
|
|
from app.core.database import AsyncSessionLocal, init_db
|
|
from app.crud import role as role_crud
|
|
from app.crud import user as user_crud
|
|
|
|
# Default permission catalogue: "<resource>:<action>".
|
|
PERMISSIONS = [
|
|
("users:read", "View users"),
|
|
("users:write", "Create and update users"),
|
|
("users:delete", "Delete users"),
|
|
("roles:read", "View roles and permissions"),
|
|
("roles:write", "Create, update and delete roles"),
|
|
("iso_threads:read", "View ISO threads"),
|
|
("iso_threads:write", "Create and update ISO threads"),
|
|
("iso_threads:delete", "Delete ISO threads"),
|
|
("unc_threads:read", "View UNC threads"),
|
|
("unc_threads:write", "Create and update UNC threads"),
|
|
("unc_threads:delete", "Delete UNC threads"),
|
|
("manufacturers:read", "View manufacturers"),
|
|
("manufacturers:write", "Create and update manufacturers"),
|
|
("manufacturers:delete", "Delete manufacturers"),
|
|
("scope_models:read", "View scope models"),
|
|
("scope_models:write", "Create and update scope models"),
|
|
("scope_models:delete", "Delete scope models"),
|
|
]
|
|
|
|
# Default roles -> permission names. "admin" gets everything.
|
|
ROLES = {
|
|
"admin": [name for name, _ in PERMISSIONS],
|
|
"user": ["users:read", "iso_threads:read", "unc_threads:read", "manufacturers:read", "scope_models:read"],
|
|
}
|
|
|
|
|
|
async def seed() -> None:
|
|
await init_db()
|
|
|
|
async with AsyncSessionLocal() as db:
|
|
# Permissions
|
|
perms = {}
|
|
for name, description in PERMISSIONS:
|
|
perm = await role_crud.get_permission_by_name(db, name)
|
|
if perm is None:
|
|
perm = await role_crud.create_permission(
|
|
db, name=name, description=description
|
|
)
|
|
perms[name] = perm
|
|
|
|
# Roles
|
|
roles = {}
|
|
for role_name, perm_names in ROLES.items():
|
|
role = await role_crud.get_by_name(db, role_name)
|
|
if role is None:
|
|
role = await role_crud.create(
|
|
db,
|
|
name=role_name,
|
|
description=f"{role_name.title()} role",
|
|
permission_ids=[perms[p].id for p in perm_names],
|
|
)
|
|
roles[role_name] = role
|
|
|
|
# Superuser
|
|
existing = await user_crud.get_by_email(db, settings.first_superuser_email)
|
|
if existing is None:
|
|
await user_crud.create(
|
|
db,
|
|
email=settings.first_superuser_email,
|
|
password=settings.first_superuser_password,
|
|
full_name="Administrator",
|
|
is_superuser=True,
|
|
role_ids=[roles["admin"].id],
|
|
)
|
|
print(f"Created superuser: {settings.first_superuser_email}")
|
|
else:
|
|
print(f"Superuser already exists: {settings.first_superuser_email}")
|
|
|
|
print("Seed complete.")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
asyncio.run(seed())
|