hms/crates/erp-auth/src/service/seed.rs

use sea_orm::{ActiveModelTrait, Set};
use uuid::Uuid;

use crate::entity::{permission, role, role_permission, user, user_credential, user_role};
use crate::error::AuthError;

use super::password;

/// Permission definitions to seed for every new tenant.
/// Each tuple is: (code, name, resource, action, description)
///
/// 编码使用点分隔 (`resource.action`)，与 handler 中的 `require_permission` 调用保持一致。
const DEFAULT_PERMISSIONS: &[(&str, &str, &str, &str, &str)] = &[
    // === Auth module ===
    ("user.list", "查看用户列表", "user", "list", "查看用户列表"),
    ("user.create", "创建用户", "user", "create", "创建新用户"),
    ("user.read", "查看用户详情", "user", "read", "查看用户信息"),
    ("user.update", "编辑用户", "user", "update", "编辑用户信息"),
    ("user.delete", "删除用户", "user", "delete", "软删除用户"),
    ("role.list", "查看角色列表", "role", "list", "查看角色列表"),
    ("role.create", "创建角色", "role", "create", "创建新角色"),
    ("role.read", "查看角色详情", "role", "read", "查看角色信息"),
    ("role.update", "编辑角色", "role", "update", "编辑角色"),
    ("role.delete", "删除角色", "role", "delete", "删除角色"),
    ("permission.list", "查看权限", "permission", "list", "查看权限列表"),
    ("organization.list", "查看组织列表", "organization", "list", "查看组织列表"),
    ("organization.create", "创建组织", "organization", "create", "创建组织"),
    ("organization.update", "编辑组织", "organization", "update", "编辑组织"),
    ("organization.delete", "删除组织", "organization", "delete", "删除组织"),
    ("department.list", "查看部门列表", "department", "list", "查看部门列表"),
    ("department.create", "创建部门", "department", "create", "创建部门"),
    ("department.update", "编辑部门", "department", "update", "编辑部门"),
    ("department.delete", "删除部门", "department", "delete", "删除部门"),
    ("position.list", "查看岗位列表", "position", "list", "查看岗位列表"),
    ("position.create", "创建岗位", "position", "create", "创建岗位"),
    ("position.update", "编辑岗位", "position", "update", "编辑岗位"),
    ("position.delete", "删除岗位", "position", "delete", "删除岗位"),
    // === Config module ===
    ("dictionary.list", "查看字典", "dictionary", "list", "查看数据字典"),
    ("dictionary.create", "创建字典", "dictionary", "create", "创建数据字典"),
    ("dictionary.update", "编辑字典", "dictionary", "update", "编辑数据字典"),
    ("dictionary.delete", "删除字典", "dictionary", "delete", "删除数据字典"),
    ("menu.list", "查看菜单", "menu", "list", "查看菜单配置"),
    ("menu.update", "编辑菜单", "menu", "update", "编辑菜单配置"),
    ("setting.read", "查看配置", "setting", "read", "查看系统参数"),
    ("setting.update", "编辑配置", "setting", "update", "编辑系统参数"),
    ("setting.delete", "删除配置", "setting", "delete", "删除系统参数"),
    ("numbering.list", "查看编号规则", "numbering", "list", "查看编号规则"),
    ("numbering.create", "创建编号规则", "numbering", "create", "创建编号规则"),
    ("numbering.update", "编辑编号规则", "numbering", "update", "编辑编号规则"),
    ("numbering.delete", "删除编号规则", "numbering", "delete", "删除编号规则"),
    ("numbering.generate", "生成编号", "numbering", "generate", "生成文档编号"),
    ("theme.read", "查看主题", "theme", "read", "查看主题设置"),
    ("theme.update", "编辑主题", "theme", "update", "编辑主题设置"),
    ("language.list", "查看语言", "language", "list", "查看语言配置"),
    ("language.update", "编辑语言", "language", "update", "编辑语言设置"),
    // === Workflow module ===
    ("workflow.create", "创建流程", "workflow", "create", "创建流程定义"),
    ("workflow.list", "查看流程", "workflow", "list", "查看流程列表"),
    ("workflow.read", "查看流程详情", "workflow", "read", "查看流程定义详情"),
    ("workflow.update", "编辑流程", "workflow", "update", "编辑流程定义"),
    ("workflow.publish", "发布流程", "workflow", "publish", "发布流程定义"),
    ("workflow.start", "发起流程", "workflow", "start", "发起流程实例"),
    ("workflow.approve", "审批任务", "workflow", "approve", "审批流程任务"),
    ("workflow.delegate", "委派任务", "workflow", "delegate", "委派流程任务"),
    // === Message module ===
    ("message.list", "查看消息", "message", "list", "查看消息列表"),
    ("message.send", "发送消息", "message", "send", "发送新消息"),
    ("message.template.list", "查看消息模板", "message.template", "list", "查看消息模板列表"),
    ("message.template.create", "创建消息模板", "message.template", "create", "创建消息模板"),
];

/// Indices of read-only (list/read) permissions within DEFAULT_PERMISSIONS.
const READ_PERM_INDICES: &[usize] = &[
    0,  // user.list
    2,  // user.read
    5,  // role.list
    7,  // role.read
    10, // permission.list
    11, // organization.list
    15, // department.list
    19, // position.list
    23, // dictionary.list
    28, // menu.list
    30, // setting.read
    32, // numbering.list
    37, // theme.read
    39, // language.list
    43, // workflow.list
    44, // workflow.read
    49, // message.list
    51, // message.template.list
];

/// Seed default auth data for a new tenant.
///
/// Creates:
/// - 53 permissions covering auth/config/workflow/message modules
/// - An "admin" system role with all permissions
/// - A "viewer" system role with read-only permissions
/// - A super-admin user with the admin role and a password credential
pub async fn seed_tenant_auth(
    db: &sea_orm::DatabaseConnection,
    tenant_id: Uuid,
    super_admin_password: &str,
) -> Result<(), AuthError> {
    let now = chrono::Utc::now();
    let system_user_id = Uuid::nil();

    // 1. Create permissions
    let mut perm_ids: Vec<Uuid> = Vec::with_capacity(DEFAULT_PERMISSIONS.len());
    for (code, name, resource, action, desc) in DEFAULT_PERMISSIONS {
        let perm_id = Uuid::now_v7();
        perm_ids.push(perm_id);

        let perm = permission::ActiveModel {
            id: Set(perm_id),
            tenant_id: Set(tenant_id),
            code: Set(code.to_string()),
            name: Set(name.to_string()),
            resource: Set(resource.to_string()),
            action: Set(action.to_string()),
            description: Set(Some(desc.to_string())),
            created_at: Set(now),
            updated_at: Set(now),
            created_by: Set(system_user_id),
            updated_by: Set(system_user_id),
            deleted_at: Set(None),
            version: Set(1),
        };
        perm.insert(db).await.map_err(|e| AuthError::Validation(e.to_string()))?;
    }

    // 2. Create "admin" role with all permissions
    let admin_role_id = Uuid::now_v7();
    let admin_role = role::ActiveModel {
        id: Set(admin_role_id),
        tenant_id: Set(tenant_id),
        name: Set("管理员".to_string()),
        code: Set("admin".to_string()),
        description: Set(Some("系统管理员，拥有所有权限".to_string())),
        is_system: Set(true),
        created_at: Set(now),
        updated_at: Set(now),
        created_by: Set(system_user_id),
        updated_by: Set(system_user_id),
        deleted_at: Set(None),
        version: Set(1),
    };
    admin_role.insert(db).await.map_err(|e| AuthError::Validation(e.to_string()))?;

    // Assign all permissions to admin role
    for perm_id in &perm_ids {
        let rp = role_permission::ActiveModel {
            role_id: Set(admin_role_id),
            permission_id: Set(*perm_id),
            tenant_id: Set(tenant_id),
            created_at: Set(now),
            updated_at: Set(now),
            created_by: Set(system_user_id),
            updated_by: Set(system_user_id),
            deleted_at: Set(None),
            version: Set(1),
        };
        rp.insert(db).await.map_err(|e| AuthError::Validation(e.to_string()))?;
    }

    // 3. Create "viewer" role with read-only permissions
    let viewer_role_id = Uuid::now_v7();
    let viewer_role = role::ActiveModel {
        id: Set(viewer_role_id),
        tenant_id: Set(tenant_id),
        name: Set("查看者".to_string()),
        code: Set("viewer".to_string()),
        description: Set(Some("只读用户，可查看所有数据".to_string())),
        is_system: Set(true),
        created_at: Set(now),
        updated_at: Set(now),
        created_by: Set(system_user_id),
        updated_by: Set(system_user_id),
        deleted_at: Set(None),
        version: Set(1),
    };
    viewer_role.insert(db).await.map_err(|e| AuthError::Validation(e.to_string()))?;

    // Assign read permissions to viewer role
    for idx in READ_PERM_INDICES {
        if *idx < perm_ids.len() {
            let rp = role_permission::ActiveModel {
                role_id: Set(viewer_role_id),
                permission_id: Set(perm_ids[*idx]),
                tenant_id: Set(tenant_id),
                created_at: Set(now),
                updated_at: Set(now),
                created_by: Set(system_user_id),
                updated_by: Set(system_user_id),
                deleted_at: Set(None),
                version: Set(1),
            };
            rp.insert(db).await.map_err(|e| AuthError::Validation(e.to_string()))?;
        }
    }

    // 4. Create super admin user
    let admin_user_id = Uuid::now_v7();
    let password_hash = password::hash_password(super_admin_password)?;

    let admin_user = user::ActiveModel {
        id: Set(admin_user_id),
        tenant_id: Set(tenant_id),
        username: Set("admin".to_string()),
        email: Set(None),
        phone: Set(None),
        display_name: Set(Some("系统管理员".to_string())),
        avatar_url: Set(None),
        status: Set("active".to_string()),
        last_login_at: Set(None),
        created_at: Set(now),
        updated_at: Set(now),
        created_by: Set(system_user_id),
        updated_by: Set(system_user_id),
        deleted_at: Set(None),
        version: Set(1),
    };
    admin_user.insert(db).await.map_err(|e| AuthError::Validation(e.to_string()))?;

    // Create password credential for admin user
    let cred = user_credential::ActiveModel {
        id: Set(Uuid::now_v7()),
        tenant_id: Set(tenant_id),
        user_id: Set(admin_user_id),
        credential_type: Set("password".to_string()),
        credential_data: Set(Some(serde_json::json!({ "hash": password_hash }))),
        verified: Set(true),
        created_at: Set(now),
        updated_at: Set(now),
        created_by: Set(system_user_id),
        updated_by: Set(system_user_id),
        deleted_at: Set(None),
        version: Set(1),
    };
    cred.insert(db).await.map_err(|e| AuthError::Validation(e.to_string()))?;

    // 5. Assign admin role to admin user
    let user_role_assignment = user_role::ActiveModel {
        user_id: Set(admin_user_id),
        role_id: Set(admin_role_id),
        tenant_id: Set(tenant_id),
        created_at: Set(now),
        updated_at: Set(now),
        created_by: Set(system_user_id),
        updated_by: Set(system_user_id),
        deleted_at: Set(None),
        version: Set(1),
    };
    user_role_assignment.insert(db).await.map_err(|e| AuthError::Validation(e.to_string()))?;

    tracing::info!(
        tenant_id = %tenant_id,
        admin_user_id = %admin_user_id,
        "Seeded tenant auth: admin user, 2 roles, {} permissions",
        DEFAULT_PERMISSIONS.len()
    );

    Ok(())
}