fix(appview): seedDefaultRoles fails fast on critical role failure (#69)

Mark all default roles as critical and throw on any failure during
startup seeding. Previously, per-role errors were caught and swallowed,
allowing the server to start without a Member role — causing every new
user login to create a permanently broken membership with no permissions.

Also scope the existing-role check to ctx.config.forumDid so that roles
from other DIDs in a shared database don't incorrectly satisfy the
idempotency check.

Adds seed-roles unit tests covering the new fail-fast behavior.

Closes ATB-38

apps/appview/src/lib/__tests__/seed-roles.test.ts

···
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { seedDefaultRoles } from "../seed-roles.js";
+import { createTestContext, type TestContext } from "./test-context.js";
+import { roles } from "@atbb/db";
+
+describe("seedDefaultRoles", () => {
+  let ctx: TestContext;
+
+  beforeEach(async () => {
+    ctx = await createTestContext();
+  });
+
+  afterEach(async () => {
+    await ctx.cleanup();
+  });
+
+  function mockAgent(opts: {
+    failForRole?: string;
+    alwaysFail?: boolean;
+  } = {}) {
+    let callIndex = 0;
+    return {
+      com: {
+        atproto: {
+          repo: {
+            createRecord: vi.fn().mockImplementation(({ record }: { record: { name: string } }) => {
+              callIndex++;
+              if (opts.alwaysFail || record.name === opts.failForRole) {
+                throw new Error(`PDS write failed for role "${record.name}"`);
+              }
+              return Promise.resolve({
+                data: {
+                  uri: `at://${ctx.config.forumDid}/space.atbb.forum.role/tid${callIndex}`,
+                  cid: `bafynew${callIndex}`,
+                },
+              });
+            }),
+          },
+        },
+      },
+    } as any;
+  }
+
+  function withAgent(agent: ReturnType<typeof mockAgent>) {
+    return {
+      ...ctx,
+      forumAgent: {
+        getAgent: () => agent,
+      } as any,
+    };
+  }
+
+  it("creates all roles when none exist", async () => {
+    const agent = mockAgent();
+    const result = await seedDefaultRoles(withAgent(agent));
+
+    expect(result.created).toBe(4);
+    expect(result.skipped).toBe(0);
+    expect(agent.com.atproto.repo.createRecord).toHaveBeenCalledTimes(4);
+  });
+
+  it("skips roles that already exist in the database", async () => {
+    // Pre-insert Owner role so it gets skipped
+    await ctx.db.insert(roles).values({
+      did: ctx.config.forumDid,
+      rkey: "owner-rkey",
+      cid: "bafyexisting",
+      name: "Owner",
+      description: "Forum owner",
+      priority: 0,
+      createdAt: new Date(),
+      indexedAt: new Date(),
+    });
+
+    const agent = mockAgent();
+    const result = await seedDefaultRoles(withAgent(agent));
+
+    expect(result.skipped).toBe(1);
+    expect(result.created).toBe(3);
+    // Only 3 PDS writes — Owner was skipped
+    expect(agent.com.atproto.repo.createRecord).toHaveBeenCalledTimes(3);
+  });
+
+  it("throws when ForumAgent is null", async () => {
+    await expect(seedDefaultRoles({ ...ctx, forumAgent: null })).rejects.toThrow(
+      "ForumAgent not available"
+    );
+  });
+
+  it("throws when ForumAgent is not authenticated (getAgent returns null)", async () => {
+    const unauthenticatedAgent = { getAgent: () => null } as any;
+    await expect(
+      seedDefaultRoles({ ...ctx, forumAgent: unauthenticatedAgent })
+    ).rejects.toThrow("ForumAgent not authenticated");
+  });
+
+  it("throws when the Member role (critical) fails to seed", async () => {
+    const agent = mockAgent({ failForRole: "Member" });
+
+    await expect(seedDefaultRoles(withAgent(agent))).rejects.toThrow(
+      'Failed to seed critical role "Member"'
+    );
+  });
+
+  it("throws when any other role fails to seed", async () => {
+    const agent = mockAgent({ failForRole: "Owner" });
+
+    await expect(seedDefaultRoles(withAgent(agent))).rejects.toThrow(
+      'Failed to seed critical role "Owner"'
+    );
+  });
+
+  it("does not partially create roles when a critical role fails", async () => {
+    // Owner and Admin succeed, then Member fails
+    let callCount = 0;
+    const failingAgent = {
+      com: {
+        atproto: {
+          repo: {
+            createRecord: vi.fn().mockImplementation(({ record }: { record: { name: string } }) => {
+              callCount++;
+              if (record.name === "Member") {
+                throw new Error("PDS timeout");
+              }
+              return Promise.resolve({
+                data: {
+                  uri: `at://${ctx.config.forumDid}/space.atbb.forum.role/tid${callCount}`,
+                  cid: `bafynew${callCount}`,
+                },
+              });
+            }),
+          },
+        },
+      },
+    } as any;
+
+    await expect(seedDefaultRoles(withAgent(failingAgent))).rejects.toThrow(
+      'Failed to seed critical role "Member"'
+    );
+  });
+});

apps/appview/src/lib/seed-roles.ts

···
 import type { AppContext } from "./app-context.js";
 import { roles } from "@atbb/db";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 
 interface DefaultRole {
   name: string;
   description: string;
   permissions: string[];
   priority: number;
+  critical: boolean;
 }
 
 const DEFAULT_ROLES: DefaultRole[] = [
···
     description: "Forum owner with full control",
     permissions: ["*"],
     priority: 0,
+    critical: true,
   },
   {
     name: "Admin",
···
       "space.atbb.permission.createPosts",
     ],
     priority: 10,
+    critical: true,
   },
   {
     name: "Moderator",
···
       "space.atbb.permission.createPosts",
     ],
     priority: 20,
+    critical: true,
   },
   {
     name: "Member",
···
       "space.atbb.permission.createPosts",
     ],
     priority: 30,
+    critical: true,
   },
 ];
 
···
  * Idempotent: Checks for existing roles by name before creating.
  * Safe to run on every startup.
  *
- * @throws Error if ForumAgent is unavailable - permission system cannot function without roles
+ * @throws Error if ForumAgent is unavailable or if any critical role fails to seed
  */
 export async function seedDefaultRoles(ctx: AppContext): Promise<{ created: number; skipped: number }> {
   // Check ForumAgent availability
···
       const [existingRole] = await ctx.db
         .select()
         .from(roles)
-        .where(eq(roles.name, defaultRole.name))
+        .where(and(eq(roles.did, ctx.config.forumDid), eq(roles.name, defaultRole.name)))
         .limit(1);
 
       if (existingRole) {
···
         roleName: defaultRole.name,
         error: error instanceof Error ? error.message : String(error),
       });
-      // Continue seeding other roles even if one fails
+      if (defaultRole.critical) {
+        throw new Error(
+          `Failed to seed critical role "${defaultRole.name}": ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
     }
   }