feat: add governance bootstrap models

backend/apps/accounts/bootstrap.py

@@ -0,0 +1,105 @@
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Group, Permission
+from django.contrib.contenttypes.models import ContentType
+
+from apps.accounts.menus import DEFAULT_MENUS
+from apps.accounts.models import MenuItem, UserGroup
+from apps.accounts.permissions import DEFAULT_GROUPS, PERMISSIONS
+
+
+def seed_permissions() -> dict[str, Permission]:
+    content_type, _ = ContentType.objects.get_or_create(
+        app_label="system",
+        model="platformpermission",
+    )
+
+    permissions_by_codename: dict[str, Permission] = {}
+    for spec in PERMISSIONS:
+        permission, _ = Permission.objects.get_or_create(
+            content_type=content_type,
+            codename=spec.codename,
+            defaults={"name": spec.name},
+        )
+        if permission.name != spec.name:
+            permission.name = spec.name
+            permission.save(update_fields=["name"])
+        permissions_by_codename[spec.codename] = permission
+    return permissions_by_codename
+
+
+def seed_roles(permissions_by_codename: dict[str, Permission]) -> None:
+    for group_name, codenames in DEFAULT_GROUPS.items():
+        group, _ = Group.objects.get_or_create(name=group_name)
+        group.permissions.set(permissions_by_codename[codename] for codename in codenames)
+
+
+def seed_user_groups() -> None:
+    UserGroup.objects.update_or_create(
+        code="default",
+        defaults={
+            "name": "默认用户组",
+            "description": "系统初始化创建的默认业务用户组。",
+            "is_active": True,
+        },
+    )
+
+
+def seed_menus() -> None:
+    menus_by_code: dict[str, MenuItem] = {}
+    for spec in DEFAULT_MENUS:
+        parent = menus_by_code.get(spec.parent_code) if spec.parent_code else None
+        menu, _ = MenuItem.objects.update_or_create(
+            code=spec.code,
+            defaults={
+                "title": spec.title,
+                "path": spec.path,
+                "icon": spec.icon,
+                "parent": parent,
+                "sort_order": spec.sort_order,
+                "permission_code": spec.permission_code,
+                "is_visible": spec.is_visible,
+                "is_enabled": spec.is_enabled,
+            },
+        )
+        menus_by_code[spec.code] = menu
+
+
+def seed_admin_user() -> None:
+    username = getattr(settings, "DJANGO_SUPERUSER_USERNAME", None) or "admin"
+    password = getattr(settings, "DJANGO_SUPERUSER_PASSWORD", None) or "admin12345"
+    email = getattr(settings, "DJANGO_SUPERUSER_EMAIL", None) or "admin@example.com"
+    user_model = get_user_model()
+    user, created = user_model.objects.get_or_create(
+        username=username,
+        defaults={
+            "email": email,
+            "is_staff": True,
+            "is_superuser": True,
+        },
+    )
+    changed_fields: list[str] = []
+    if user.email != email:
+        user.email = email
+        changed_fields.append("email")
+    if not user.is_staff:
+        user.is_staff = True
+        changed_fields.append("is_staff")
+    if not user.is_superuser:
+        user.is_superuser = True
+        changed_fields.append("is_superuser")
+    if created or not user.check_password(password):
+        user.set_password(password)
+        changed_fields.append("password")
+    if changed_fields:
+        user.save(update_fields=changed_fields)
+    admin_role = Group.objects.get(name="系统管理员")
+    user.groups.add(admin_role)
+
+
+def bootstrap_governance() -> None:
+    permissions_by_codename = seed_permissions()
+    seed_roles(permissions_by_codename)
+    seed_user_groups()
+    seed_menus()
+    seed_admin_user()