refactor(10.2-01): nest framework packages under modules

- Move remaining beach packages and embedded admin assets\n- Rewrite framework, example, build, and gate paths

modules/lagoon/backend_admin_migrations.go

@@ -0,0 +1,88 @@
+package lagoon
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+// BackendJWTBlacklistTable is the framework-owned jti table for admin tokens.
+// It is distinct from the frontend jwt_blacklist table.
+const BackendJWTBlacklistTable = "backend_jwt_blacklist"
+
+// BackendAdminMigrations creates Winter-shaped backend identity tables and
+// seeds the developer and publisher system roles. History is isolated under
+// the summercms.cabana plugin id. DDL is re-runnable so the system-role seed
+// stays idempotent if the history row is removed.
+var BackendAdminMigrations = []*gormigrate.Migration{
+	{
+		ID: "202609240001_backend_admin_identity",
+		Migrate: func(tx *gorm.DB) error {
+			stmts := []string{
+				`CREATE TABLE IF NOT EXISTS backend_user_roles (
+	id SERIAL PRIMARY KEY,
+	name TEXT NOT NULL UNIQUE,
+	code TEXT,
+	description TEXT,
+	permissions TEXT,
+	is_system BOOLEAN NOT NULL DEFAULT FALSE,
+	created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+	updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+)`,
+				`CREATE TABLE IF NOT EXISTS backend_users (
+	id SERIAL PRIMARY KEY,
+	first_name TEXT,
+	last_name TEXT,
+	login TEXT NOT NULL UNIQUE,
+	email TEXT NOT NULL UNIQUE,
+	password TEXT NOT NULL,
+	activation_code TEXT,
+	persist_code TEXT,
+	reset_password_code TEXT,
+	permissions TEXT,
+	is_activated BOOLEAN NOT NULL DEFAULT FALSE,
+	is_superuser BOOLEAN NOT NULL DEFAULT FALSE,
+	role_id INTEGER REFERENCES backend_user_roles(id),
+	activated_at TIMESTAMPTZ,
+	last_login TIMESTAMPTZ,
+	created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+	updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+	deleted_at TIMESTAMPTZ,
+	tokens_valid_after TIMESTAMPTZ
+)`,
+				`CREATE TABLE IF NOT EXISTS backend_jwt_blacklist (
+	jti TEXT PRIMARY KEY,
+	expires_at TIMESTAMPTZ NOT NULL,
+	valid_until TIMESTAMPTZ NOT NULL
+)`,
+				`CREATE INDEX IF NOT EXISTS backend_users_role_id_index ON backend_users (role_id)`,
+				`CREATE INDEX IF NOT EXISTS backend_users_deleted_at_index ON backend_users (deleted_at)`,
+				`CREATE INDEX IF NOT EXISTS backend_users_activation_code_index ON backend_users (activation_code)`,
+				`CREATE INDEX IF NOT EXISTS backend_users_reset_password_code_index ON backend_users (reset_password_code)`,
+				`CREATE INDEX IF NOT EXISTS backend_user_roles_code_index ON backend_user_roles (code)`,
+				`INSERT INTO backend_user_roles (name, code, description, permissions, is_system)
+VALUES
+	('Developer', 'developer', 'Site administrator with access to developer tools.', '{}', TRUE),
+	('Publisher', 'publisher', 'Site editor with access to publishing tools.', '{}', TRUE)
+ON CONFLICT (name) DO NOTHING`,
+			}
+			for _, stmt := range stmts {
+				if err := tx.Exec(stmt).Error; err != nil {
+					return err
+				}
+			}
+			return nil
+		},
+		Rollback: func(tx *gorm.DB) error {
+			for _, stmt := range []string{
+				`DROP TABLE IF EXISTS backend_jwt_blacklist`,
+				`DROP TABLE IF EXISTS backend_users`,
+				`DROP TABLE IF EXISTS backend_user_roles`,
+			} {
+				if err := tx.Exec(stmt).Error; err != nil {
+					return err
+				}
+			}
+			return nil
+		},
+	},
+}