Start-up data

Data a new installation starts with - an administrator, a catalog - is saved through the generated services, so passwords are hashed and every rule holds as for any other row. Access checks would refuse a visitor, so the code says it is the application itself: CurrentUser.runAsSystem.

From the agent kit's shop recipe:

src/main/java/com/acme/store/StoreSeed.java

@Component
class StoreSeed implements ApplicationRunner {

    private final MemberService members;
    private final ProductService products;

    StoreSeed(MemberService members, ProductService products) {
        this.members = members;
        this.products = products;
    }

    @Override
    public void run(ApplicationArguments args) {
        CurrentUser.runAsSystem(() -> {
            MemberSrchDTO admin = new MemberSrchDTO();
            admin.setLogin("admin");
            if (members.countBySearch(admin) > 0) return;

            MemberDTO a = new MemberDTO();
            a.setLogin("admin");
            a.setPassword("admin-1234");
            a.setName("Administrator");
            a.setRole(MemberRole.ADMIN);
            a.setAddress(new Address("1 Main Street", "Seoul", "04524"));
            members.save(a);

            product("Angelfish", "10.00");
            product("Bulldog", "180.00");
        });
    }

    private void product(String name, String price) {
        ProductDTO p = new ProductDTO();
        p.setName(name);
        p.setPrice(Money.of(price));
        products.save(p);
    }
}

• runAsSystem passes every @access check inside it - and nowhere else. Only the application itself may make an administrator: role is @access(admin).
• An ApplicationRunner runs once the server already answers requests.
• Check before creating (countBySearch), so a restart against a persistent database does not duplicate rows.
• The pet store does the same in DemoAccounts (the user and admin accounts, switched off with petstore.demo-accounts=false); its catalog comes from data.sql.