Adding LDAP login

scripts/seed.py

@@ -77,6 +77,10 @@ PERMISSIONS = [
     ("audit_log:read", "View audit log"),
 ]
 
+# Role auto-assigned to new (registered/LDAP-provisioned) users unless an admin
+# marks a different one as default in the UI.
+DEFAULT_ROLE = "user"
+
 # Default roles -> permission names. "admin" gets everything.
 ROLES = {
     "admin": [name for name, _ in PERMISSIONS],  # includes audit_log:read
@@ -127,6 +131,12 @@ async def seed() -> None:
                 )
             roles[role_name] = role
 
+        # Ensure a default role is marked (idempotent).
+        if await role_crud.get_default(db) is None:
+            default_role = roles.get(DEFAULT_ROLE)
+            if default_role is not None:
+                await role_crud.set_default(db, default_role)
+
         # Attachment point names
         for apn_name in ATTACHMENT_POINT_NAMES:
             if await apn_crud.get_by_name(db, apn_name) is None: