Initial Claude implementation

scripts/seed.py

@@ -0,0 +1,76 @@
+"""Bootstrap default permissions, roles, and the first superuser.
+
+Idempotent: safe to run repeatedly. Reads the superuser credentials from
+settings (env vars or .env).
+
+Usage:
+    uv run python -m scripts.seed
+"""
+import asyncio
+
+from app.core.config import settings
+from app.core.database import AsyncSessionLocal, init_db
+from app.crud import role as role_crud
+from app.crud import user as user_crud
+
+# Default permission catalogue: "<resource>:<action>".
+PERMISSIONS = [
+    ("users:read", "View users"),
+    ("users:write", "Create and update users"),
+    ("users:delete", "Delete users"),
+    ("roles:read", "View roles and permissions"),
+    ("roles:write", "Create, update and delete roles"),
+]
+
+# Default roles -> permission names. "admin" gets everything.
+ROLES = {
+    "admin": [name for name, _ in PERMISSIONS],
+    "user": ["users:read"],
+}
+
+
+async def seed() -> None:
+    await init_db()
+
+    async with AsyncSessionLocal() as db:
+        # Permissions
+        perms = {}
+        for name, description in PERMISSIONS:
+            perm = await role_crud.get_permission_by_name(db, name)
+            if perm is None:
+                perm = await role_crud.create_permission(db, name=name, description=description)
+            perms[name] = perm
+
+        # Roles
+        roles = {}
+        for role_name, perm_names in ROLES.items():
+            role = await role_crud.get_by_name(db, role_name)
+            if role is None:
+                role = await role_crud.create(
+                    db,
+                    name=role_name,
+                    description=f"{role_name.title()} role",
+                    permission_ids=[perms[p].id for p in perm_names],
+                )
+            roles[role_name] = role
+
+        # Superuser
+        existing = await user_crud.get_by_email(db, settings.first_superuser_email)
+        if existing is None:
+            await user_crud.create(
+                db,
+                email=settings.first_superuser_email,
+                password=settings.first_superuser_password,
+                full_name="Administrator",
+                is_superuser=True,
+                role_ids=[roles["admin"].id],
+            )
+            print(f"Created superuser: {settings.first_superuser_email}")
+        else:
+            print(f"Superuser already exists: {settings.first_superuser_email}")
+
+    print("Seed complete.")
+
+
+if __name__ == "__main__":
+    asyncio.run(seed())