feat(rbac): add roles and permissions

backend/hermes/app/rbac/seed.py

@@ -0,0 +1,63 @@
+import logging
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.models.rbac import Permission, Role
+from app.rbac.defaults import ROLE_PERMISSION_NAMES, STANDARD_PERMISSIONS, STANDARD_ROLES
+
+logger = logging.getLogger(__name__)
+
+
+def seed_rbac(db: Session) -> None:
+    roles_by_name = {
+        role.name: role
+        for role in db.scalars(select(Role)).all()
+    }
+    permissions_by_name = {
+        permission.name: permission
+        for permission in db.scalars(select(Permission)).all()
+    }
+
+    for role_data in STANDARD_ROLES:
+        role = roles_by_name.get(role_data["name"])
+        if role is None:
+            role = Role(**role_data)
+            db.add(role)
+            roles_by_name[role.name] = role
+        else:
+            role.display_name = role_data["display_name"]
+            role.description = role_data["description"]
+            role.is_system = role_data["is_system"]
+
+    for name, display_name, description, module in STANDARD_PERMISSIONS:
+        permission = permissions_by_name.get(name)
+        if permission is None:
+            permission = Permission(
+                name=name,
+                display_name=display_name,
+                description=description,
+                module=module,
+            )
+            db.add(permission)
+            permissions_by_name[name] = permission
+        else:
+            permission.display_name = display_name
+            permission.description = description
+            permission.module = module
+
+    db.flush()
+
+    all_permissions = set(permissions_by_name.values())
+    for role_name, permission_names in ROLE_PERMISSION_NAMES.items():
+        role = roles_by_name[role_name]
+        if permission_names == "*":
+            role.permissions = list(all_permissions)
+        else:
+            role.permissions = [
+                permissions_by_name[permission_name]
+                for permission_name in permission_names
+            ]
+
+    db.commit()
+    logger.info("rbac.seeded")