flip_api.db.seed.main_users

Functions

ensure_user_and_role(→ None)

Look up the Cognito user for email and grant them role_ref.

_ensure_user_and_role_resilient(→ None)

Run ensure_user_and_role but tolerate transient Cognito-side HTTP failures.

seed_main_users(→ None)

Seed role grants for the well-known admin/researcher/observer emails.

Module Contents

flip_api.db.seed.main_users.ensure_user_and_role(email: str, role_ref: flip_api.db.models.user_models.RoleRef, session: sqlmodel.Session) → None

Look up the Cognito user for email and grant them role_ref.

Cognito is the source of truth for user identity, so this function does not create or maintain a local users row. It only ensures the user_role grant exists for the Cognito sub corresponding to the given email.

Parameters:

  • email (str) – The user’s email, used to look up the corresponding Cognito user.

  • role_ref (RoleRef) – The role to assign to the user if they don’t already have it.

  • session (Session) – The SQLModel session used for DB reads and writes.

flip_api.db.seed.main_users._ensure_user_and_role_resilient(email: str, role_ref: flip_api.db.models.user_models.RoleRef, session: sqlmodel.Session) → None

Run ensure_user_and_role but tolerate transient Cognito-side HTTP failures.

Seeding now reads from Cognito on every boot. A 5xx blip mid-deploy would otherwise couple flip-api liveness to Cognito read availability — log the skip loudly and continue with the remaining users instead.

Definitive 4xx failures (e.g. 400 “no email/id provided”, 403 if a future auth gate is added) still propagate: those are config / programming errors that should fail boot loudly rather than producing a platform with quietly missing grants.

Parameters:

  • email (str) – The user’s email used to look up the corresponding Cognito user.

  • role_ref (RoleRef) – The role to grant if missing.

  • session (Session) – The SQLModel session used for DB reads and writes.

flip_api.db.seed.main_users.seed_main_users(session: sqlmodel.Session) → None

Seed role grants for the well-known admin/researcher/observer emails.

Resolves each email to its Cognito sub and ensures the corresponding user_role row exists. No local users-table state is created.

Parameters:

session (Session) – The SQLModel session used for DB reads and writes.