|
|
|
|
@@ -5,6 +5,7 @@ import (
|
|
|
|
|
"time"
|
|
|
|
|
|
|
|
|
|
"git.haelnorr.com/h/oslstats/internal/db"
|
|
|
|
|
"github.com/pkg/errors"
|
|
|
|
|
"github.com/uptrace/bun"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
@@ -141,78 +142,7 @@ func init() {
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Seed system roles
|
|
|
|
|
now := time.Now().Unix()
|
|
|
|
|
|
|
|
|
|
adminRole := &db.Role{
|
|
|
|
|
Name: "admin",
|
|
|
|
|
DisplayName: "Administrator",
|
|
|
|
|
Description: "Full system access with all permissions",
|
|
|
|
|
IsSystem: true,
|
|
|
|
|
CreatedAt: now,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
_, err = dbConn.NewInsert().
|
|
|
|
|
Model(adminRole).
|
|
|
|
|
Returning("id").
|
|
|
|
|
Exec(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
userRole := &db.Role{
|
|
|
|
|
Name: "user",
|
|
|
|
|
DisplayName: "User",
|
|
|
|
|
Description: "Standard user with basic permissions",
|
|
|
|
|
IsSystem: true,
|
|
|
|
|
CreatedAt: now,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
_, err = dbConn.NewInsert().
|
|
|
|
|
Model(userRole).
|
|
|
|
|
Exec(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Seed system permissions
|
|
|
|
|
permissionsData := []*db.Permission{
|
|
|
|
|
{Name: "*", DisplayName: "Wildcard (All Permissions)", Description: "Grants access to all permissions, past, present, and future", Resource: "*", Action: "*", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "seasons.create", DisplayName: "Create Seasons", Description: "Create new seasons", Resource: "seasons", Action: "create", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "seasons.update", DisplayName: "Update Seasons", Description: "Update existing seasons", Resource: "seasons", Action: "update", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "seasons.delete", DisplayName: "Delete Seasons", Description: "Delete seasons", Resource: "seasons", Action: "delete", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "users.update", DisplayName: "Update Users", Description: "Update user information", Resource: "users", Action: "update", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "users.ban", DisplayName: "Ban Users", Description: "Ban users from the system", Resource: "users", Action: "ban", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "users.manage_roles", DisplayName: "Manage User Roles", Description: "Assign and revoke user roles", Resource: "users", Action: "manage_roles", IsSystem: true, CreatedAt: now},
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
_, err = dbConn.NewInsert().
|
|
|
|
|
Model(&permissionsData).
|
|
|
|
|
Exec(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Grant wildcard permission to admin role using Bun
|
|
|
|
|
// First, get the IDs
|
|
|
|
|
var wildcardPerm db.Permission
|
|
|
|
|
err = dbConn.NewSelect().
|
|
|
|
|
Model(&wildcardPerm).
|
|
|
|
|
Where("name = ?", "*").
|
|
|
|
|
Scan(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Insert role_permission mapping
|
|
|
|
|
adminRolePerms := &db.RolePermission{
|
|
|
|
|
RoleID: adminRole.ID,
|
|
|
|
|
PermissionID: wildcardPerm.ID,
|
|
|
|
|
}
|
|
|
|
|
_, err = dbConn.NewInsert().
|
|
|
|
|
Model(adminRolePerms).
|
|
|
|
|
On("CONFLICT (role_id, permission_id) DO NOTHING").
|
|
|
|
|
Exec(ctx)
|
|
|
|
|
err = seedSystemRBAC(ctx, dbConn)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
@@ -242,3 +172,82 @@ func init() {
|
|
|
|
|
},
|
|
|
|
|
)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func seedSystemRBAC(ctx context.Context, dbConn *bun.DB) error {
|
|
|
|
|
// Seed system roles
|
|
|
|
|
now := time.Now().Unix()
|
|
|
|
|
|
|
|
|
|
adminRole := &db.Role{
|
|
|
|
|
Name: "admin",
|
|
|
|
|
DisplayName: "Administrator",
|
|
|
|
|
Description: "Full system access with all permissions",
|
|
|
|
|
IsSystem: true,
|
|
|
|
|
CreatedAt: now,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
_, err := dbConn.NewInsert().
|
|
|
|
|
Model(adminRole).
|
|
|
|
|
Returning("id").
|
|
|
|
|
Exec(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return errors.Wrap(err, "dbConn.NewInsert")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
userRole := &db.Role{
|
|
|
|
|
Name: "user",
|
|
|
|
|
DisplayName: "User",
|
|
|
|
|
Description: "Standard user with basic permissions",
|
|
|
|
|
IsSystem: true,
|
|
|
|
|
CreatedAt: now,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
_, err = dbConn.NewInsert().
|
|
|
|
|
Model(userRole).
|
|
|
|
|
Exec(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return errors.Wrap(err, "dbConn.NewInsert")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Seed system permissions
|
|
|
|
|
permissionsData := []*db.Permission{
|
|
|
|
|
{Name: "*", DisplayName: "Wildcard (All Permissions)", Description: "Grants access to all permissions, past, present, and future", Resource: "*", Action: "*", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "seasons.create", DisplayName: "Create Seasons", Description: "Create new seasons", Resource: "seasons", Action: "create", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "seasons.update", DisplayName: "Update Seasons", Description: "Update existing seasons", Resource: "seasons", Action: "update", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "seasons.delete", DisplayName: "Delete Seasons", Description: "Delete seasons", Resource: "seasons", Action: "delete", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "users.update", DisplayName: "Update Users", Description: "Update user information", Resource: "users", Action: "update", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "users.ban", DisplayName: "Ban Users", Description: "Ban users from the system", Resource: "users", Action: "ban", IsSystem: true, CreatedAt: now},
|
|
|
|
|
{Name: "users.manage_roles", DisplayName: "Manage User Roles", Description: "Assign and revoke user roles", Resource: "users", Action: "manage_roles", IsSystem: true, CreatedAt: now},
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
_, err = dbConn.NewInsert().
|
|
|
|
|
Model(&permissionsData).
|
|
|
|
|
Exec(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return errors.Wrap(err, "dbConn.NewInsert")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Grant wildcard permission to admin role using Bun
|
|
|
|
|
// First, get the IDs
|
|
|
|
|
var wildcardPerm db.Permission
|
|
|
|
|
err = dbConn.NewSelect().
|
|
|
|
|
Model(&wildcardPerm).
|
|
|
|
|
Where("name = ?", "*").
|
|
|
|
|
Scan(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Insert role_permission mapping
|
|
|
|
|
adminRolePerms := &db.RolePermission{
|
|
|
|
|
RoleID: adminRole.ID,
|
|
|
|
|
PermissionID: wildcardPerm.ID,
|
|
|
|
|
}
|
|
|
|
|
_, err = dbConn.NewInsert().
|
|
|
|
|
Model(adminRolePerms).
|
|
|
|
|
On("CONFLICT (role_id, permission_id) DO NOTHING").
|
|
|
|
|
Exec(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return errors.Wrap(err, "dbConn.NewInsert")
|
|
|
|
|
}
|
|
|
|
|
return nil
|
|
|
|
|
}
|
|
|
|
|
|