From 73821abe00371bb8a3a4bf2b21fa7a6250378a18 Mon Sep 17 00:00:00 2001
From: xiaohei <xiaohei@enterprise.local>
Date: Tue, 21 Apr 2026 20:41:33 +0800
Subject: [PATCH] Seed: bridge LobeChat default signup accounts to enterprise
 roles

- admin@eg.local  -> super_admin
- user1@eg.local  -> customer (customer_id=CUST-0001)

Makes the admin-only model-config UI lock take effect out of the box
after docker compose up + bootstrap-lobechat-users.sh.
---
 .omc/project-memory.json            |  4 ++--
 .omc/state/idle-notif-cooldown.json |  2 +-
 gateway/prisma/seed.ts              | 27 +++++++++++++++++++++++++++
 3 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/.omc/project-memory.json b/.omc/project-memory.json
index 6a46de4..869287c 100644
--- a/.omc/project-memory.json
+++ b/.omc/project-memory.json
@@ -69,8 +69,8 @@
     },
     {
       "path": "gateway/prisma/seed.ts",
-      "accessCount": 20,
-      "lastAccessed": 1776763220682,
+      "accessCount": 23,
+      "lastAccessed": 1776775293304,
       "type": "file"
     },
     {
diff --git a/.omc/state/idle-notif-cooldown.json b/.omc/state/idle-notif-cooldown.json
index 8e04fa5..dc16a3e 100644
--- a/.omc/state/idle-notif-cooldown.json
+++ b/.omc/state/idle-notif-cooldown.json
@@ -1,3 +1,3 @@
 {
-  "lastSentAt": "2026-04-21T12:33:30.508Z"
+  "lastSentAt": "2026-04-21T12:40:13.486Z"
 }
\ No newline at end of file
diff --git a/gateway/prisma/seed.ts b/gateway/prisma/seed.ts
index 204ec3c..8a7cb2b 100644
--- a/gateway/prisma/seed.ts
+++ b/gateway/prisma/seed.ts
@@ -332,6 +332,32 @@ async function ensureModels() {
   console.log('[seed] models/model-permissions/model-policy ensured');
 }
 
+// Bridge the default LobeChat signup accounts to enterprise roles so the UI
+// admin-lock takes effect immediately out of the box. This is idempotent.
+async function ensureLobeChatBridgeUsers() {
+  const bridges = [
+    { email: 'admin@eg.local', username: 'admin-lobe', displayName: 'Admin (LobeChat)', role: 'super_admin', metadata: {} as any },
+    { email: 'user1@eg.local', username: 'user1-lobe', displayName: 'User One (LobeChat)', role: 'customer', metadata: { customer_id: 'CUST-0001' } as any },
+  ];
+  for (const b of bridges) {
+    const role = await prisma.enterpriseRole.findUnique({ where: { key: b.role } });
+    if (!role) continue;
+    let user = await prisma.enterpriseUser.findUnique({ where: { username: b.username } });
+    if (!user) {
+      user = await prisma.enterpriseUser.create({
+        data: { username: b.username, displayName: b.displayName, email: b.email, metadata: b.metadata },
+      });
+    }
+    const existing = await prisma.enterpriseUserRole.findFirst({
+      where: { userId: user.id, roleId: role.id },
+    });
+    if (!existing) {
+      await prisma.enterpriseUserRole.create({ data: { userId: user.id, roleId: role.id } });
+    }
+  }
+  console.log('[seed] lobechat bridge users ensured');
+}
+
 async function ensureSystemDiscoverer() {
   const superRole = await prisma.enterpriseRole.findUnique({ where: { key: 'super_admin' } });
   if (!superRole) return;
@@ -385,6 +411,7 @@ async function main() {
     await ensureToolInputSchemas();
     await ensureModels();
     await ensureRoleToolGrants();
+    await ensureLobeChatBridgeUsers();
     return;
   }