feat: add seed

Author: fiqrikm18

.env.example

@@ -34,3 +34,8 @@ ACCOUNT_LOCKOUT_WINDOW_MINUTES=15
 ACCOUNT_LOCKOUT_DURATION_MINUTES=15
 
 LOG_FORMAT=json
+
+SEED_ADMIN_EMAIL=
+SEED_ADMIN_PASSWORD=
+SEED_ADMIN_USERNAME=admin
+SEED_ADMIN_FULLNAME=System Administrator

Makefile

@@ -10,7 +10,7 @@ COMPOSE_FILE := docker-compose.yml
 
 .DEFAULT_GOAL := help
 
-.PHONY: help install run test lint import-check security-scan check migrate downgrade revision db-up db-down db-logs clean
+.PHONY: help install run test lint import-check security-scan check migrate seed downgrade revision db-up db-down db-logs clean
 
 help:
 	@echo "[make:help] Available commands:"
@@ -22,6 +22,7 @@ help:
 	@echo "  [make:security-scan] Run dependency vulnerability scan with pip-audit"
 	@echo "  [make:check]         Run tests, lint, and import check"
 	@echo "  [make:migrate]       Apply Alembic migrations"
+	@echo "  [make:seed]          Seed baseline database records"
 	@echo "  [make:downgrade]     Roll back one Alembic migration"
 	@echo "  [make:revision]      Create an Alembic migration: make revision name=\"describe change\""
 	@echo "  [make:db-up]         Start Docker Compose services"
@@ -43,7 +44,7 @@ test:
 
 lint:
 	@echo "[make:lint] Running Ruff checks"
-	@$(RUFF) check src tests
+	@$(RUFF) check src tests scripts
 
 import-check:
 	@echo "[make:import-check] Verifying src.main imports"
@@ -64,6 +65,10 @@ migrate:
 	@echo "[make:migrate] Applying Alembic migrations"
 	@$(ALEMBIC) upgrade head
 
+seed:
+	@echo "[make:seed] Running database seeders"
+	@$(PYTHON) scripts/seed.py
+
 downgrade:
 	@echo "[make:downgrade] Rolling back one Alembic migration"
 	@$(ALEMBIC) downgrade -1

README.md

@@ -323,12 +323,32 @@ With Make:
 
 ```bash
 make migrate
+make seed
 make revision name="add todo due date"
 make downgrade
 ```
 
 Important: migration autogeneration depends on importing all SQLAlchemy models in `alembic/env.py`, so new module models must be imported there or through a central model registry.
 
+Seed baseline authorization data after applying migrations:
+
+```bash
+make seed
+```
+
+The seeder is idempotent. It creates default authorization resources, the default `admin` and `user` roles, default permissions, role-permission links, and matching Casbin policies without duplicating existing records.
+
+To seed an initial admin user, set these environment variables before running `make seed`:
+
+```env
+SEED_ADMIN_EMAIL=admin@example.com
+SEED_ADMIN_PASSWORD=
+SEED_ADMIN_USERNAME=admin
+SEED_ADMIN_FULLNAME=System Administrator
+```
+
+If `SEED_ADMIN_EMAIL` or `SEED_ADMIN_PASSWORD` is empty, user seeding is skipped. Existing users are not modified.
+
 ## Testing and Quality Checks
 
 Run tests:
@@ -352,7 +372,7 @@ make check
 Current check set:
 
 - `pytest -q`
-- `ruff check src tests`
+- `ruff check src tests scripts`
 - import check for `src.main`
 
 ## Makefile Commands
@@ -366,6 +386,7 @@ make lint
 make import-check
 make check
 make migrate
+make seed
 make downgrade
 make revision name="migration message"
 make db-up
@@ -527,7 +548,6 @@ Legend: `Implemented` means code exists in the repository. `Partial` means code
 
 ## Known Notes
 
-- `alembic/env.py` currently prints metadata debug output during migrations.
 - `src/core/lifespan.py` still calls `Base.metadata.create_all`; with Alembic in place, production environments normally rely on migrations instead.
 - The project has a Pydantic v2 deprecation warning for class-based settings config.
 - The Dockerfile start script path needs alignment before relying on Docker builds.

alembic/env.py

@@ -13,6 +13,9 @@
 from src.core.authorization.infrastructure.models.permission_model import (
     PermissionModel,  # noqa: F401
 )
+from src.core.authorization.infrastructure.models.resource_model import (
+    AuthorizationResourceModel,  # noqa: F401
+)
 from src.core.authorization.infrastructure.models.role_model import (
     RoleModel,  # noqa: F401
 )
@@ -41,10 +44,6 @@
 
 settings = get_settings()
 
-print(
-    "🔍 ALEMBIC DEBUG: Tables found in metadata ->", list(Base.metadata.tables.keys())
-)
-
 config = context.config
 
 if config.config_file_name is not None:

alembic/versions/c7a1b9e5d4f2_rename_authorization_description_columns.py

@@ -0,0 +1,34 @@
+"""rename authorization description columns
+
+Revision ID: c7a1b9e5d4f2
+Revises: b2f4c7d9a1e0
+Create Date: 2026-06-19 00:00:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+
+revision: str = "c7a1b9e5d4f2"
+down_revision: Union[str, Sequence[str], None] = "b2f4c7d9a1e0"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def _rename_column(table_name: str, old_name: str, new_name: str) -> None:
+    with op.batch_alter_table(table_name) as batch_op:
+        batch_op.alter_column(old_name, new_column_name=new_name)
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    _rename_column("permissions", "descpription", "description")
+    _rename_column("roles", "descpription", "description")
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    _rename_column("roles", "description", "descpription")
+    _rename_column("permissions", "description", "descpription")

alembic/versions/d9a7c3f2b6e1_add_authorization_resources.py

@@ -0,0 +1,124 @@
+"""add authorization resources
+
+Revision ID: d9a7c3f2b6e1
+Revises: c7a1b9e5d4f2
+Create Date: 2026-06-19 00:00:00.000000
+
+"""
+
+from typing import Sequence, Union
+from uuid import uuid4
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "d9a7c3f2b6e1"
+down_revision: Union[str, Sequence[str], None] = "c7a1b9e5d4f2"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    op.create_table(
+        "authorization_resources",
+        sa.Column("id", sa.Uuid(), nullable=False),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=False,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=False,
+        ),
+        sa.Column("deleted_at", sa.DateTime(), nullable=True),
+        sa.Column("key", sa.String(length=100), nullable=False),
+        sa.Column("name", sa.String(length=150), nullable=False),
+        sa.Column("description", sa.String(length=255), nullable=True),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(
+        op.f("ix_authorization_resources_key"),
+        "authorization_resources",
+        ["key"],
+        unique=True,
+    )
+
+    with op.batch_alter_table("permissions") as batch_op:
+        batch_op.add_column(sa.Column("resource_id", sa.Uuid(), nullable=True))
+        batch_op.create_index(
+            op.f("ix_permissions_resource_id"),
+            ["resource_id"],
+            unique=False,
+        )
+
+    bind = op.get_bind()
+    resources = [
+        row[0]
+        for row in bind.execute(
+            sa.text("select distinct resource from permissions where resource is not null")
+        )
+    ]
+
+    resource_ids = {}
+    for resource in resources:
+        resource_id = uuid4()
+        resource_ids[resource] = resource_id
+        bind.execute(
+            sa.text(
+                """
+                insert into authorization_resources
+                    (id, key, name, description)
+                values
+                    (:id, :key, :name, :description)
+                """
+            ),
+            {
+                "id": resource_id,
+                "key": resource,
+                "name": resource.replace("_", " ").title(),
+                "description": f"{resource} resources",
+            },
+        )
+
+    for resource, resource_id in resource_ids.items():
+        bind.execute(
+            sa.text(
+                """
+                update permissions
+                set resource_id = :resource_id
+                where resource = :resource
+                """
+            ),
+            {"resource_id": resource_id, "resource": resource},
+        )
+
+    with op.batch_alter_table("permissions") as batch_op:
+        batch_op.create_foreign_key(
+            "fk_permissions_resource_id_authorization_resources",
+            "authorization_resources",
+            ["resource_id"],
+            ["id"],
+        )
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    with op.batch_alter_table("permissions") as batch_op:
+        batch_op.drop_constraint(
+            "fk_permissions_resource_id_authorization_resources",
+            type_="foreignkey",
+        )
+        batch_op.drop_index(op.f("ix_permissions_resource_id"))
+        batch_op.drop_column("resource_id")
+
+    op.drop_index(
+        op.f("ix_authorization_resources_key"),
+        table_name="authorization_resources",
+    )
+    op.drop_table("authorization_resources")

scripts/seed.py

@@ -0,0 +1,26 @@
+import asyncio
+
+from src.core.seed.runner import run_seeders
+
+
+async def main() -> None:
+    result = await run_seeders()
+    authorization = result.authorization
+    print(
+        "[seed:authorization] "
+        f"resources_created={authorization.resources_created} "
+        f"roles_created={authorization.roles_created} "
+        f"permissions_created={authorization.permissions_created} "
+        f"role_permissions_created={authorization.role_permissions_created} "
+        f"policies_created={authorization.policies_created}"
+    )
+    user = result.user
+    print(
+        "[seed:user] "
+        f"users_created={user.users_created} "
+        f"roles_assigned={user.roles_assigned}"
+    )
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

src/core/authorization/infrastructure/models/permission_model.py

@@ -1,4 +1,6 @@
-from sqlalchemy import String, UniqueConstraint
+from uuid import UUID
+
+from sqlalchemy import ForeignKey, String, UniqueConstraint
 from sqlalchemy.orm import Mapped, mapped_column
 
 from src.shared.database.mixin.timestamp import SoftDeleteMixin, TimeStampMixin
@@ -12,6 +14,10 @@ class PermissionModel(Base, TimeStampMixin, SoftDeleteMixin):
     )
 
     key: Mapped[str] = mapped_column(String(255), unique=True, index=True)
+    resource_id: Mapped[UUID] = mapped_column(
+        ForeignKey("authorization_resources.id"),
+        index=True,
+    )
     resource: Mapped[str] = mapped_column(String(100), index=True)
     action: Mapped[str] = mapped_column(String(100), index=True)
-    descpription: Mapped[str] = mapped_column(String(255), nullable=True)
+    description: Mapped[str | None] = mapped_column(String(255), nullable=True)

src/core/authorization/infrastructure/models/resource_model.py

@@ -0,0 +1,13 @@
+from sqlalchemy import String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from src.shared.database.mixin.timestamp import SoftDeleteMixin, TimeStampMixin
+from src.shared.database.model import Base
+
+
+class AuthorizationResourceModel(Base, TimeStampMixin, SoftDeleteMixin):
+    __tablename__ = "authorization_resources"
+
+    key: Mapped[str] = mapped_column(String(100), unique=True, index=True)
+    name: Mapped[str] = mapped_column(String(150), nullable=False)
+    description: Mapped[str | None] = mapped_column(String(255), nullable=True)

src/core/authorization/infrastructure/models/role_model.py

@@ -9,4 +9,4 @@ class RoleModel(Base, TimeStampMixin, SoftDeleteMixin):
     __tablename__ = "roles"
 
     name: Mapped[str] = mapped_column(String(100), unique=True, index=True)
-    descpription: Mapped[str] = mapped_column(String(255), nullable=True)
+    description: Mapped[str | None] = mapped_column(String(255), nullable=True)