Coverage for apps/accounts/management/commands/seed_rbac.py: 100%

1"""Seed RBAC permissions, roles, the role-permission matrix, and a dev admin.""" 

2 

3from django.core.management.base import BaseCommand 

4from django.db import transaction 

5 

6from apps.accounts.models import OrgUnit, Permission, Role, RolePermission, User, UserRole 

7from domain.rbac import PERMISSIONS, ROLE_PERMISSIONS, ROLES, permission_meta 

8 

9DEV_ADMIN_EMAIL = "dev.admin@lumen.test" 

10 

11 

12class Command(BaseCommand): 

13 help = "Seed RBAC catalog (permissions, roles, matrix) and a dev admin user." 

14 

15 @transaction.atomic 

16 def handle(self, *args, **options): 

17 for code in PERMISSIONS: 

18 meta = permission_meta(code) 

19 Permission.objects.update_or_create( 

20 code=code, 

21 defaults={ 

22 "branch_override": meta["branch_override"], 

23 "admin_role_check_reqd": meta["admin_role_check_reqd"], 

24 }, 

25 ) 

26 for name in ROLES: 

27 Role.objects.get_or_create(name=name) 

28 

29 perms = {p.code: p for p in Permission.objects.all()} 

30 roles = {r.name: r for r in Role.objects.all()} 

31 RolePermission.objects.all().delete() 

32 RolePermission.objects.bulk_create( 

33 [ 

34 RolePermission(role=roles[name], permission=perms[code]) 

35 for code, role_names in ROLE_PERMISSIONS.items() 

36 for name in role_names 

37 ] 

38 ) 

39 

40 # Dev admin for local token auth: Bearer staff:dev.admin@lumen.test 

41 hq, _ = OrgUnit.objects.get_or_create(name="Demo HQ", defaults={"is_headquarters": True}) 

42 admin, created = User.objects.get_or_create( 

43 email=DEV_ADMIN_EMAIL, 

44 defaults={"first_name": "Dev", "last_name": "Admin", "org_unit": hq, "is_staff": True}, 

45 ) 

46 if created: 

47 admin.set_password("devadmin") 

48 admin.save() 

49 UserRole.objects.get_or_create(user=admin, role=roles["Owner"], org_unit=hq) 

50 

51 self.stdout.write( 

52 self.style.SUCCESS( 

53 f"RBAC seeded: {len(PERMISSIONS)} permissions, {len(ROLES)} roles. " 

54 f"Dev admin: {DEV_ADMIN_EMAIL} (token 'staff:{DEV_ADMIN_EMAIL}')." 

55 ) 

56 )