Migrate to add 'write:prinicipals' to default admin role.

tiled/authn_database/core.py

@@ -12,9 +12,10 @@
 
 # This is the alembic revision ID of the database revision
 # required by this version of Tiled.
-REQUIRED_REVISION = "c7bd2573716d"
+REQUIRED_REVISION = "769180ce732e"
 # This is list of all valid revisions (from current to oldest).
 ALL_REVISIONS = [
+    "769180ce732e",
     "c7bd2573716d",
     "4a9dfaba4a98",
     "56809bcbfcb0",

tiled/authn_database/migrations/versions/769180ce732e_add_write_principals_scope_to_admin.py

@@ -0,0 +1,47 @@
+"""Add 'write:principals' scope to admin
+
+Revision ID: 769180ce732e
+Revises: c7bd2573716d
+Create Date: 2023-12-12 17:57:56.388145
+
+"""
+from alembic import op
+from sqlalchemy.orm.session import Session
+
+from tiled.authn_database.orm import Role
+
+# revision identifiers, used by Alembic.
+revision = "769180ce732e"
+down_revision = "c7bd2573716d"
+branch_labels = None
+depends_on = None
+
+
+SCOPE = "write:principals"
+
+
+def upgrade():
+    """
+    Add 'write:principal' scope to default 'admin' Role.
+    """
+    connection = op.get_bind()
+    with Session(bind=connection) as db:
+        role = db.query(Role).filter(Role.name == "admin").first()
+        scopes = role.scopes.copy()
+        scopes.append(SCOPE)
+        role.scopes = scopes
+        db.commit()
+
+
+def downgrade():
+    """
+    Remove new scopes from Roles, if present.
+    """
+    connection = op.get_bind()
+    with Session(bind=connection) as db:
+        role = db.query(Role).filter(Role.name == "admin").first()
+        scopes = role.scopes.copy()
+        if SCOPE in scopes:
+            scopes.remove(SCOPE)
+        role.scopes = scopes
+        db.commit()