59 lines
1.9 KiB
Python
59 lines
1.9 KiB
Python
"""Deterministic, credential-free Hub seed data."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass
|
|
from uuid import NAMESPACE_URL, UUID, uuid5
|
|
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from .models import RiskClassRow, WorkspaceRow
|
|
|
|
SEED_NAMESPACE = "https://hub.example.com/seed/v1"
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class SeedResult:
|
|
workspace_id: UUID
|
|
risk_class_codes: tuple[str, ...]
|
|
|
|
|
|
def _stable_id(kind: str, name: str) -> UUID:
|
|
return uuid5(NAMESPACE_URL, f"{SEED_NAMESPACE}:{kind}:{name}")
|
|
|
|
|
|
def seed_database(session: Session) -> SeedResult:
|
|
"""Insert the ITWorx workspace and safe read-only risk classes idempotently."""
|
|
|
|
workspace_id = _stable_id("workspace", "itworx")
|
|
workspace = session.get(WorkspaceRow, workspace_id)
|
|
if workspace is None:
|
|
workspace = WorkspaceRow(id=workspace_id, slug="itworx", name="ITWorx", status="active")
|
|
session.add(workspace)
|
|
|
|
risk_classes = (
|
|
("health-read", "Read-only health and liveness metadata", 65536),
|
|
("metadata-read", "Read-only catalog and metadata inspection", 65536),
|
|
("read-only", "Read-only target-system capability", 131072),
|
|
)
|
|
for code, description, max_output_bytes in risk_classes:
|
|
existing = session.get(RiskClassRow, code)
|
|
if existing is None:
|
|
session.add(
|
|
RiskClassRow(
|
|
code=code,
|
|
description=description,
|
|
allows_writes=False,
|
|
max_output_bytes=max_output_bytes,
|
|
)
|
|
)
|
|
|
|
session.flush()
|
|
persisted = session.scalar(select(WorkspaceRow.id).where(WorkspaceRow.slug == "itworx"))
|
|
if persisted is None:
|
|
raise RuntimeError("deterministic workspace seed was not persisted")
|
|
return SeedResult(
|
|
workspace_id=persisted, risk_class_codes=tuple(code for code, _, _ in risk_classes)
|
|
)
|