Adding LDAP login

app/crud/role.py

@@ -1,4 +1,5 @@
 from sqlalchemy import select
+from sqlalchemy import update as sa_update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models.permission import Permission
@@ -14,6 +15,23 @@ async def get_by_name(db: AsyncSession, name: str) -> Role | None:
     return result.scalar_one_or_none()
 
 
+async def get_default(db: AsyncSession) -> Role | None:
+    """The role auto-assigned to new users, or ``None`` if none is marked."""
+    result = await db.execute(select(Role).where(Role.is_default.is_(True)))
+    return result.scalars().first()
+
+
+async def set_default(db: AsyncSession, role: Role) -> Role:
+    """Make ``role`` the sole default, clearing the flag on every other role."""
+    await db.execute(
+        sa_update(Role).where(Role.id != role.id).values(is_default=False)
+    )
+    role.is_default = True
+    await db.commit()
+    await db.refresh(role)
+    return role
+
+
 async def list_roles(db: AsyncSession) -> list[Role]:
     result = await db.execute(select(Role).order_by(Role.id))
     return list(result.scalars().all())
@@ -50,6 +68,16 @@ async def update(db: AsyncSession, role: Role, data: dict) -> Role:
     else:
         data.pop("permission_ids", None)
 
+    # Setting a role default must clear the flag on all others.
+    make_default = data.pop("is_default", None)
+    if make_default:
+        await db.execute(
+            sa_update(Role).where(Role.id != role.id).values(is_default=False)
+        )
+        role.is_default = True
+    elif make_default is False:
+        role.is_default = False
+
     for field, value in data.items():
         if value is not None:
             setattr(role, field, value)