feat: bootstrap local platform development

Tiku.UnitTests/Bootstrap/PlatformAdminBootstrapperTests.cs

@@ -82,6 +82,43 @@ public sealed class PlatformAdminBootstrapperTests
         Assert.Equal("bootstrap_user_already_exists", exception.Code);
     }
 
+    [Fact]
+    public async Task Development_async_seed_creates_one_forced_enrollment_administrator()
+    {
+        await using var provider = CreateProvider();
+        await using var scope = provider.CreateAsyncScope();
+        var context = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+
+        var created = await DevelopmentPlatformAdminSeeder.SeedAsync(context);
+        var createdAgain = await DevelopmentPlatformAdminSeeder.SeedAsync(context);
+
+        Assert.True(created);
+        Assert.False(createdAgain);
+        var user = await context.Users.SingleAsync();
+        Assert.Equal(DevelopmentPlatformAdminSeeder.Email, user.Email);
+        Assert.True(user.ForcePasswordChange);
+        Assert.False(user.TwoFactorEnabled);
+        Assert.Equal(BackendPermissions.Platform.Count, await context.PlatformBackendRolePermissions.CountAsync());
+        Assert.Single(context.PlatformBackendUserRoles);
+        Assert.Single(context.AuditLogs);
+    }
+
+    [Fact]
+    public async Task Development_sync_seed_is_idempotent()
+    {
+        await using var provider = CreateProvider();
+        await using var scope = provider.CreateAsyncScope();
+        var context = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+
+        var created = DevelopmentPlatformAdminSeeder.Seed(context);
+        var createdAgain = DevelopmentPlatformAdminSeeder.Seed(context);
+
+        Assert.True(created);
+        Assert.False(createdAgain);
+        Assert.Single(context.Users);
+        Assert.Single(context.PlatformBackendUserRoles);
+    }
+
     private static ServiceProvider CreateProvider()
     {
         var services = new ServiceCollection();