roles update

apps/sso-core/src/domain/auth.service.ts

@@ -15,6 +15,7 @@ import { MessagingService } from '../infra/messaging.service';
 import { NotificationsService } from './notifications.service';
 import { canonicalPhoneE164, phoneLookupVariants } from '../infra/phone.util';
 import { TotpService } from './totp.service';
+import { RbacService } from './rbac.service';
 
 const FIRST_ADMIN_LOCK = 'locks:first-super-admin';
 const TOTP_LOGIN_CHALLENGE_TTL_SECONDS = 5 * 60;
@@ -33,7 +34,8 @@ export class AuthService {
     private readonly ldapClient: LdapClientService,
     private readonly messaging: MessagingService,
     private readonly notifications: NotificationsService,
-    private readonly totp: TotpService
+    private readonly totp: TotpService,
+    private readonly rbac: RbacService
   ) {}
 
   async register(command: RegisterCommand): Promise<PublicUser> {
@@ -66,6 +68,7 @@ export class AuthService {
         { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }
       );
 
+      await this.rbac.ensureDefaultUserRole(user.id);
       return await this.toPublicUser(user);
     } catch (error) {
       if (this.isUniqueError(error)) {
@@ -533,7 +536,7 @@ export class AuthService {
     }
 
     try {
-      return await this.prisma.$transaction(
+      const user = await this.prisma.$transaction(
         async (tx) => {
           const usersCount = await tx.user.count({ where: { deletedAt: null } });
           return tx.user.create({
@@ -557,6 +560,8 @@ export class AuthService {
         },
         { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }
       );
+      await this.rbac.ensureDefaultUserRole(user.id);
+      return user;
     } finally {
       await this.redis.releaseLock(FIRST_ADMIN_LOCK);
     }
@@ -726,7 +731,7 @@ export class AuthService {
     const lockAcquired = await this.redis.acquireLock(FIRST_ADMIN_LOCK, 10_000);
     if (!lockAcquired) throw new BadRequestException('Регистрация временно недоступна, повторите попытку');
     try {
-      return this.prisma.$transaction(
+      const user = await this.prisma.$transaction(
         async (tx) => {
           const usersCount = await tx.user.count({ where: { deletedAt: null } });
           return tx.user.create({
@@ -741,6 +746,8 @@ export class AuthService {
         },
         { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }
       );
+      await this.rbac.ensureDefaultUserRole(user.id);
+      return user;
     } finally {
       await this.redis.releaseLock(FIRST_ADMIN_LOCK);
     }