initial commit after split

2026-06-24 01:43:10 +02:00
parent b1d6c0150f
commit 30c11a6dcf
173 changed files with 25380 additions and 0 deletions
--- a/src/govoplan_core/db/bootstrap.py
+++ b/src/govoplan_core/db/bootstrap.py
@@ -0,0 +1,120 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from sqlalchemy.orm import Session
+
+from govoplan_core.admin.service import ensure_default_roles, get_or_create_account
+from govoplan_core.db.base import Base
+from govoplan_core.db.models import Role, SystemRoleAssignment, Tenant, User, UserRoleAssignment
+from govoplan_core.db.session import get_database
+from govoplan_core.security.api_keys import CreatedApiKey, create_api_key
+from govoplan_core.security.permissions import TENANT_SCOPES
+
+DEFAULT_SCOPES = sorted(TENANT_SCOPES)
+
+
+@dataclass(slots=True)
+class BootstrapResult:
+    tenant: Tenant
+    user: User
+    created_api_key: CreatedApiKey | None
+
+
+def create_all_tables() -> None:
+    # Import models so SQLAlchemy sees all tables.
+    from govoplan_core.db import models  # noqa: F401
+    from govoplan_core.access.db import models as access_models  # noqa: F401
+    from govoplan_files.backend.db import models as file_models  # noqa: F401
+    from govoplan_mail.backend.db import models as mail_models  # noqa: F401
+    from govoplan_campaign.backend.db import models as campaign_models  # noqa: F401
+    from govoplan_core.access.db.base import AccessBase
+
+    engine = get_database().engine
+    Base.metadata.create_all(bind=engine)
+    AccessBase.metadata.create_all(bind=engine)
+
+
+def bootstrap_dev_data(
+    session: Session,
+    *,
+    api_key_secret: str | None = None,
+    tenant_slug: str = "default",
+    user_email: str = "admin@example.local",
+    user_password: str = "dev-admin",
+) -> BootstrapResult:
+    tenant = session.query(Tenant).filter(Tenant.slug == tenant_slug).one_or_none()
+    if tenant is None:
+        tenant = Tenant(slug=tenant_slug, name="Default Tenant", default_locale="en", settings={})
+        session.add(tenant)
+        session.flush()
+
+    tenant_roles = ensure_default_roles(session, tenant)
+    system_roles = ensure_default_roles(session, None)
+
+    account, _, _ = get_or_create_account(
+        session,
+        email=user_email,
+        display_name="Development Admin",
+        password=user_password,
+        password_reset_required=False,
+    )
+    # Keep development credentials deterministic when an old create_all database
+    # is reused. This is guarded by the explicit dev bootstrap setting.
+    from govoplan_core.security.passwords import hash_password
+
+    if not account.password_hash:
+        account.password_hash = hash_password(user_password)
+    account.is_active = True
+    session.add(account)
+
+    user = session.query(User).filter(User.tenant_id == tenant.id, User.account_id == account.id).one_or_none()
+    if user is None:
+        user = User(
+            tenant_id=tenant.id,
+            account_id=account.id,
+            email=account.email,
+            display_name="Development Admin",
+            is_tenant_admin=True,  # legacy presentation flag; RBAC uses the owner role below.
+            auth_provider=account.auth_provider,
+            password_hash=account.password_hash,
+        )
+        session.add(user)
+        session.flush()
+    else:
+        user.email = account.email
+        user.password_hash = account.password_hash
+        user.is_active = True
+        session.add(user)
+
+    owner_role = tenant_roles["owner"]
+    existing_assignment = session.query(UserRoleAssignment).filter(
+        UserRoleAssignment.tenant_id == tenant.id,
+        UserRoleAssignment.user_id == user.id,
+        UserRoleAssignment.role_id == owner_role.id,
+    ).one_or_none()
+    if existing_assignment is None:
+        session.add(UserRoleAssignment(tenant_id=tenant.id, user_id=user.id, role_id=owner_role.id))
+
+    system_owner = system_roles["system_owner"]
+    existing_system_assignment = session.query(SystemRoleAssignment).filter(
+        SystemRoleAssignment.account_id == account.id,
+        SystemRoleAssignment.role_id == system_owner.id,
+    ).one_or_none()
+    if existing_system_assignment is None:
+        session.add(SystemRoleAssignment(account_id=account.id, role_id=system_owner.id))
+
+    created_api_key = None
+    if api_key_secret:
+        existing = [key for key in user.api_keys if key.name == "Development API key" and key.revoked_at is None]
+        if not existing:
+            created_api_key = create_api_key(
+                session,
+                user=user,
+                name="Development API key",
+                scopes=DEFAULT_SCOPES,
+                secret=api_key_secret,
+            )
+
+    session.commit()
+    return BootstrapResult(tenant=tenant, user=user, created_api_key=created_api_key)