Add users, roles, and per-novel permissions

Introduces accounts (ASP.NET Identity + cookie auth), four global roles (Admin/Writer/Editor/Reviewer), per-novel ownership and grants via ProjectMember, and a service-API-key principal for the MCP server and background import jobs. Enforcement lives in the application services (not endpoint filters) so the embedded agent and MCP tools, which call the same services directly, can't bypass it. Web client gets a login page, session-aware routing, and a People section for managing per-novel access. Also includes prior in-flight changes from this branch (CLAUDE.md compliance pass, dev-deploy docker-compose setup) that were uncommitted when this feature work started.
2026-08-15 22:29:33 -07:00
parent 7d8dd0c4fd
commit e598c18d67
111 changed files with 6562 additions and 797 deletions
@@ -0,0 +1,46 @@
+using Microsoft.EntityFrameworkCore;
+using Novelly.Api.Data;
+
+namespace Novelly.Api.Users;
+
+public static class ServiceUser
+{
+    public static readonly Guid Id = new("9f1d6f2c-6d1b-4d3e-9a54-0f2b6f8a7c11");
+
+    public const string Email = "service@novelly.local";
+    public const string DisplayName = "Novelly Service";
+
+    public static async Task<NovellyUser?> EnsureSeededAsync(INovelDbContext db, string? serviceApiKey, ILogger logger, CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(serviceApiKey))
+        {
+            logger.LogInformation("No service api key configured; the service user {UserId} was not seeded", Id);
+            return null;
+        }
+
+        var existing = await db.Users.FirstOrDefaultAsync(u => u.Id == Id, ct);
+        if (existing is not null)
+            return existing;
+
+        var user = new NovellyUser
+        {
+            Id = Id,
+            UserName = Email,
+            NormalizedUserName = Email.ToUpperInvariant(),
+            Email = Email,
+            NormalizedEmail = Email.ToUpperInvariant(),
+            EmailConfirmed = true,
+            DisplayName = DisplayName,
+            GlobalRole = GlobalRole.Admin,
+            SecurityStamp = Guid.NewGuid().ToString("N"),
+            ConcurrencyStamp = Guid.NewGuid().ToString("N")
+        };
+
+        db.Users.Add(user);
+        await db.SaveChangesAsync(ct);
+
+        logger.LogInformation("Seeded the service user {UserId} with global role {GlobalRole}", user.Id, user.GlobalRole);
+
+        return user;
+    }
+}