feat: roles system backend

internal/infrastructure/persistence/database/roleSeed.go

@@ -0,0 +1,70 @@
+package database
+
+import (
+	"slices"
+
+	"RenewCMS/internal/domain/role"
+	"RenewCMS/internal/infrastructure/persistence/mappers"
+	entity "RenewCMS/internal/infrastructure/persistence/models"
+
+	"gorm.io/gorm"
+)
+
+func SeedBuiltInRoles(db *gorm.DB) error {
+	return db.Transaction(func(tx *gorm.DB) error {
+		for _, builtIn := range role.BuiltInRoles() {
+			if err := seedBuiltInRole(tx, builtIn); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
+func seedBuiltInRole(tx *gorm.DB, builtIn role.Role) error {
+	id, found, err := builtInRoleID(tx, builtIn.Name)
+	if err != nil {
+		return err
+	}
+	if found {
+		return reconcileBuiltInRole(tx, id, builtIn)
+	}
+	model := mappers.RoleToModel(builtIn)
+	if err := tx.Create(&model).Error; err != nil {
+		return err
+	}
+	return tx.Create(mappers.GrantsToModel(model.ID, builtIn.Grants)).Error
+}
+
+func builtInRoleID(tx *gorm.DB, name string) (uint32, bool, error) {
+	var found entity.Role
+	result := tx.Where("name = ? AND built_in = ?", name, true).Order("id asc").Limit(1).Find(&found)
+	if result.Error != nil {
+		return 0, false, result.Error
+	}
+	return found.ID, result.RowsAffected > 0, nil
+}
+
+func reconcileBuiltInRole(tx *gorm.DB, id uint32, builtIn role.Role) error {
+	var stored entity.Role
+	if err := tx.First(&stored, id).Error; err != nil {
+		return err
+	}
+	if !builtIn.Locked && stored.Version != 1 {
+		return nil
+	}
+	var present []string
+	if err := tx.Model(&entity.RolePermission{}).Where("role_id = ?", id).Pluck("permission_key", &present).Error; err != nil {
+		return err
+	}
+	missing := []role.Grant{}
+	for _, grant := range builtIn.Grants {
+		if !slices.Contains(present, grant.Key) {
+			missing = append(missing, grant)
+		}
+	}
+	if len(missing) == 0 {
+		return nil
+	}
+	return tx.Create(mappers.GrantsToModel(id, missing)).Error
+}