[FEATURE]: Seed Data - Roles and Default Assignment #365

New issue

Closed

opened 2026-01-22 23:37:42 +01:00 by moritz · 0 comments

moritz commented

2026-01-22 23:37:42 +01:00

Owner

Description:

Create seed data for 5 roles and assign default "Mitglied" role to existing users. Optionally designate one admin via environment variable.

Tasks:

Create priv/repo/seeds/authorization_seeds.exs
Seed 5 roles using Ash.Seed.seed!/2 or create actions:
- Mitglied: name="Mitglied", description="Default member role", permission_set_name="own_data", is_system_role=true
- Vorstand: name="Vorstand", description="Board member with read access", permission_set_name="read_only", is_system_role=false
- Kassenwart: name="Kassenwart", description="Treasurer with full member management", permission_set_name="normal_user", is_system_role=false
- Buchhaltung: name="Buchhaltung", description="Accounting with read access", permission_set_name="read_only", is_system_role=false
- Admin: name="Admin", description="Administrator with full access", permission_set_name="admin", is_system_role=false
Make idempotent: Use upsert logic (get by name, update if exists, create if not)

Assign "Mitglied" role to all users without role_id:

mitglied_role = Ash.get!(Role, name: "Mitglied")
users_without_role = Ash.read!(User, filter: expr(is_nil(role_id)))
Enum.each(users_without_role, fn user ->
  Ash.update!(user, %{role_id: mitglied_role.id})
end)

(Optional) Check for ADMIN_EMAIL env var, assign Admin role to that user
Add error handling with clear error messages
Add IO.puts statements to show progress

Acceptance Criteria:

All 5 roles created with correct permission_set_name
"Mitglied" has is_system_role=true
Existing users without role get "Mitglied" role
Optional: ADMIN_EMAIL user gets Admin role
Seeds are idempotent (can run multiple times)
Error messages are clear
Progress is logged to console

Test Strategy (TDD):

Role Creation Tests:

After running seeds, 5 roles exist
Each role has correct permission_set_name:
- Mitglied → "own_data"
- Vorstand → "read_only"
- Kassenwart → "normal_user"
- Buchhaltung → "read_only"
- Admin → "admin"
"Mitglied" role has is_system_role=true
Other roles have is_system_role=false
All permission_set_names are valid (exist in PermissionSets.all_permission_sets/0)

User Assignment Tests:

Users without role_id are assigned "Mitglied" role
Users who already have role_id are not changed
New Users will automatically be assigned "Mitglied" role
Count of users with "Mitglied" role increases by number of previously unassigned users

Idempotency Tests:

Running seeds twice doesn't create duplicate roles
Each role name appears exactly once
Running seeds twice doesn't reassign users who already have roles

Optional Admin Tests:

If ADMIN_EMAIL set, user with that email gets Admin role
If ADMIN_EMAIL not set, no error occurs
If email doesn't exist, error is logged but seeds continue

Error Handling Tests:

Seeds fail gracefully if invalid permission_set_name provided
Error message indicates which permission_set_name is invalid

Test File: test/seeds/authorization_seeds_test.exs

**Description:** Create seed data for 5 roles and assign default "Mitglied" role to existing users. Optionally designate one admin via environment variable. **Tasks:** 1. Create `priv/repo/seeds/authorization_seeds.exs` 2. Seed 5 roles using `Ash.Seed.seed!/2` or create actions: - **Mitglied:** name="Mitglied", description="Default member role", permission_set_name="own_data", is_system_role=true - **Vorstand:** name="Vorstand", description="Board member with read access", permission_set_name="read_only", is_system_role=false - **Kassenwart:** name="Kassenwart", description="Treasurer with full member management", permission_set_name="normal_user", is_system_role=false - **Buchhaltung:** name="Buchhaltung", description="Accounting with read access", permission_set_name="read_only", is_system_role=false - **Admin:** name="Admin", description="Administrator with full access", permission_set_name="admin", is_system_role=false 3. Make idempotent: Use upsert logic (get by name, update if exists, create if not) 4. Assign "Mitglied" role to all users without role_id: ```elixir mitglied_role = Ash.get!(Role, name: "Mitglied") users_without_role = Ash.read!(User, filter: expr(is_nil(role_id))) Enum.each(users_without_role, fn user -> Ash.update!(user, %{role_id: mitglied_role.id}) end) ``` 5. (Optional) Check for `ADMIN_EMAIL` env var, assign Admin role to that user 6. Add error handling with clear error messages 7. Add `IO.puts` statements to show progress **Acceptance Criteria:** - [ ] All 5 roles created with correct permission_set_name - [ ] "Mitglied" has is_system_role=true - [ ] Existing users without role get "Mitglied" role - [ ] Optional: ADMIN_EMAIL user gets Admin role - [ ] Seeds are idempotent (can run multiple times) - [ ] Error messages are clear - [ ] Progress is logged to console **Test Strategy (TDD):** **Role Creation Tests:** - After running seeds, 5 roles exist - Each role has correct permission_set_name: - Mitglied → "own_data" - Vorstand → "read_only" - Kassenwart → "normal_user" - Buchhaltung → "read_only" - Admin → "admin" - "Mitglied" role has is_system_role=true - Other roles have is_system_role=false - All permission_set_names are valid (exist in PermissionSets.all_permission_sets/0) **User Assignment Tests:** - Users without role_id are assigned "Mitglied" role - Users who already have role_id are not changed - New Users will automatically be assigned "Mitglied" role - Count of users with "Mitglied" role increases by number of previously unassigned users **Idempotency Tests:** - Running seeds twice doesn't create duplicate roles - Each role name appears exactly once - Running seeds twice doesn't reassign users who already have roles **Optional Admin Tests:** - If ADMIN_EMAIL set, user with that email gets Admin role - If ADMIN_EMAIL not set, no error occurs - If email doesn't exist, error is logged but seeds continue **Error Handling Tests:** - Seeds fail gracefully if invalid permission_set_name provided - Error message indicates which permission_set_name is invalid **Test File:** `test/seeds/authorization_seeds_test.exs`