@flaredev/cli 0.2.0 → 0.3.0

package/templates/app/lib/{admin.ts → dashboard.ts}

@@ -1,103 +1,138 @@
-import { headers } from "next/headers";
-import { notFound, redirect } from "next/navigation";
-import { allowedActions, can, type Policy, type PolicyAction, type Resource } from "@flaredev/core";
-import type { SQLiteTable } from "drizzle-orm/sqlite-core";
-import { createResourceStore, type ResourceStore } from "@flaredev/core/server";
-import { getDb } from "@/db";
-import { policies } from "@/policies";
-import { resourceTables } from "@/resources/server";
-import { auth } from "./auth";
-import { cached, resourceTag, revalidateResource, TTL } from "./cache";
-
-/**
- * Roles that always reach /admin, whatever the policies say. Other roles get in when a
- * policy grants them read access to at least one resource.
- * Register roles with `flare role:add`, assign with `flare user:role`.
- */
-export const ADMIN_ROLES = ["admin", "staff"];
-
-export function policyFor(resourceName: string): Policy | undefined {
-  return (policies as Record<string, Policy | undefined>)[resourceName];
-}
-
-export async function adminSession() {
-  const session = await auth.api.getSession({ headers: await headers() });
-  if (!session) return { session: null, role: null, allowed: false } as const;
-  const role = (session.user as { role?: string | null }).role ?? null;
-  const readable = adminResources().some((resource) => can(policyFor(resource.name), role, "read"));
-  return { session, role, allowed: (role !== null && ADMIN_ROLES.includes(role)) || readable } as const;
-}
-
-/** For admin pages: redirects signed-out visitors to sign-in and users without access to the home page. */
-export async function requireAdmin(returnTo = "/admin") {
-  const { session, role, allowed } = await adminSession();
-  if (!session) redirect(`/sign-in?next=${encodeURIComponent(returnTo)}`);
-  if (!allowed) redirect("/?error=forbidden");
-  return { session, role };
-}
-
-/**
- * For resource pages: also requires the policy to allow `action` on this resource.
- * Sends the user somewhere they can actually go — the list when they may read it,
- * the dashboard when they may not.
- */
-export async function requireAccess(resource: Resource, action: PolicyAction) {
-  const { session, role } = await requireAdmin(adminPath(resource));
-  const policy = policyFor(resource.name);
-  if (!can(policy, role, action)) {
-    redirect(action !== "read" && can(policy, role, "read") ? adminPath(resource) : "/admin?error=forbidden");
-  }
-  return { session, role };
-}
-
-/** What the current user may do with a resource, for hiding actions they can't use. */
-export async function adminPermissions(resourceName: string) {
-  const { role } = await adminSession();
-  return allowedActions(policyFor(resourceName), role);
-}
-
-const stores = new Map<string, ResourceStore>();
-
-/** CRUD store for a resource by name (404 for unknown names). */
-export function adminStore(name: string): ResourceStore {
-  const entry = (resourceTables as unknown as Record<string, { resource: Resource; table: SQLiteTable } | undefined>)[name];
-  if (!entry) notFound();
-  let store = stores.get(name);
-  if (!store) {
-    store = createResourceStore({ resource: entry.resource, table: entry.table, getDb, onChange: revalidateResource });
-    stores.set(name, store);
-  }
-  return store;
-}
-
-/**
- * How many records a resource has. Cached in the data cache under the resource's tag,
- * so the dashboard does not count every table on every visit, and a write through the
- * admin or the API drops the count on its way out.
- */
-export function recordCount(name: string): Promise<number> {
-  const count = cached(
-    async (resourceName: string) => {
-      const result = await adminStore(resourceName).list(new URLSearchParams({ perPage: "1" }));
-      return result.ok ? result.data.meta.total : 0;
-    },
-    ["flare", "record-count"],
-    { tags: [resourceTag(name)], revalidate: TTL.short },
-  );
-  return count(name);
-}
-
-/** Every resource descriptor (unfiltered): navigation uses `visibleResources()` instead. */
-export function adminResources(): Resource[] {
-  return Object.values(resourceTables as unknown as Record<string, { resource: Resource }>).map((entry) => entry.resource);
-}
-
-/** Resources the current user may read, for the sidebar and dashboard. */
-export async function visibleResources(): Promise<Resource[]> {
-  const { role } = await adminSession();
-  return adminResources().filter((resource) => can(policyFor(resource.name), role, "read"));
-}
-
-export function adminPath(resource: Resource, ...parts: string[]) {
-  return ["/admin", resource.slug, ...parts].join("/");
-}
+import { headers } from "next/headers";
+import { notFound, redirect } from "next/navigation";
+import { allowedActions, can, type Policy, type PolicyAction, type Resource } from "@flaredev/core";
+import { and, count, gte, lt } from "drizzle-orm";
+import type { SQLiteTable } from "drizzle-orm/sqlite-core";
+import { createResourceStore, type ResourceStore } from "@flaredev/core/server";
+import { getDb } from "@/db";
+import { policies } from "@/policies";
+import { resourceTables } from "@/resources/server";
+import { auth } from "./auth";
+import { cached, resourceTag, revalidateResource, TTL } from "./cache";
+
+/**
+ * Roles that always reach the dashboard, whatever the policies say. Other roles get in when a
+ * policy grants them read access to at least one resource.
+ * Register roles with `flare role:add`, assign with `flare user:role`.
+ */
+export const ADMIN_ROLES = ["admin", "staff"];
+
+export function policyFor(resourceName: string): Policy | undefined {
+  return (policies as Record<string, Policy | undefined>)[resourceName];
+}
+
+export async function dashboardSession() {
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) return { session: null, role: null, allowed: false } as const;
+  const role = (session.user as { role?: string | null }).role ?? null;
+  const readable = allResources().some((resource) => can(policyFor(resource.name), role, "read"));
+  return { session, role, allowed: (role !== null && ADMIN_ROLES.includes(role)) || readable } as const;
+}
+
+/** For admin pages: redirects signed-out visitors to sign-in and users without access to the home page. */
+export async function requireDashboard(returnTo = "/dashboard") {
+  const { session, role, allowed } = await dashboardSession();
+  if (!session) redirect(`/sign-in?next=${encodeURIComponent(returnTo)}`);
+  if (!allowed) redirect("/?error=forbidden");
+  return { session, role };
+}
+
+/**
+ * For resource pages: also requires the policy to allow `action` on this resource.
+ * Sends the user somewhere they can actually go — the list when they may read it,
+ * the dashboard when they may not.
+ */
+export async function requireAccess(resource: Resource, action: PolicyAction) {
+  const { session, role } = await requireDashboard(resourcePath(resource));
+  const policy = policyFor(resource.name);
+  if (!can(policy, role, action)) {
+    redirect(action !== "read" && can(policy, role, "read") ? resourcePath(resource) : "/dashboard?error=forbidden");
+  }
+  return { session, role };
+}
+
+/** What the current user may do with a resource, for hiding actions they can't use. */
+export async function adminPermissions(resourceName: string) {
+  const { role } = await dashboardSession();
+  return allowedActions(policyFor(resourceName), role);
+}
+
+const stores = new Map<string, ResourceStore>();
+
+/** CRUD store for a resource by name (404 for unknown names). */
+export function dashboardStore(name: string): ResourceStore {
+  const entry = (resourceTables as unknown as Record<string, { resource: Resource; table: SQLiteTable } | undefined>)[name];
+  if (!entry) notFound();
+  let store = stores.get(name);
+  if (!store) {
+    store = createResourceStore({ resource: entry.resource, table: entry.table, getDb, onChange: revalidateResource });
+    stores.set(name, store);
+  }
+  return store;
+}
+
+/**
+ * How many records a resource has. Cached in the data cache under the resource's tag,
+ * so the dashboard does not count every table on every visit, and a write through the
+ * admin or the API drops the count on its way out.
+ */
+export function recordCount(name: string): Promise<number> {
+  const count = cached(
+    async (resourceName: string) => {
+      const result = await dashboardStore(resourceName).list(new URLSearchParams({ perPage: "1" }));
+      return result.ok ? result.data.meta.total : 0;
+    },
+    ["flare", "record-count"],
+    { tags: [resourceTag(name)], revalidate: TTL.short },
+  );
+  return count(name);
+}
+
+/**
+ * How many records a resource gained in the last `days` days, and in the `days` before
+ * that, so a stat can show which way it's going. Cached like the totals.
+ */
+export function recentCounts(name: string, days = 7): Promise<{ current: number; previous: number }> {
+  const counts = cached(
+    async (resourceName: string, windowDays: number) => {
+      const entry = (resourceTables as unknown as Record<string, { table: SQLiteTable } | undefined>)[resourceName];
+      const createdAt = entry ? (entry.table as unknown as Record<string, unknown>).createdAt : undefined;
+      // A resource whose table has no createdAt (a custom one) simply has no trend.
+      if (!entry || !createdAt) return { current: 0, previous: 0 };
+      const window = windowDays * 86_400_000;
+      const since = new Date(Date.now() - window);
+      const before = new Date(Date.now() - window * 2);
+      const column = createdAt as never;
+      const [current] = await getDb().select({ total: count() }).from(entry.table).where(gte(column, since));
+      const [previous] = await getDb()
+        .select({ total: count() })
+        .from(entry.table)
+        .where(and(gte(column, before), lt(column, since)));
+      return { current: current?.total ?? 0, previous: previous?.total ?? 0 };
+    },
+    ["flare", "recent-count"],
+    { tags: [resourceTag(name)], revalidate: TTL.short },
+  );
+  return counts(name, days);
+}
+
+/** Percentage change between two periods, or undefined when there's nothing to compare. */
+export function trend(current: number, previous: number): number | undefined {
+  if (previous === 0) return current === 0 ? undefined : 100;
+  return ((current - previous) / previous) * 100;
+}
+
+/** Every resource descriptor (unfiltered): navigation uses `visibleResources()` instead. */
+export function allResources(): Resource[] {
+  return Object.values(resourceTables as unknown as Record<string, { resource: Resource }>).map((entry) => entry.resource);
+}
+
+/** Resources the current user may read, for the sidebar and dashboard. */
+export async function visibleResources(): Promise<Resource[]> {
+  const { role } = await dashboardSession();
+  return allResources().filter((resource) => can(policyFor(resource.name), role, "read"));
+}
+
+export function resourcePath(resource: Resource, ...parts: string[]) {
+  return ["/dashboard", resource.slug, ...parts].join("/");
+}

package/templates/app/lib/password-rules.ts

@@ -0,0 +1,159 @@
+/**
+ * What makes a password acceptable here, in one place: the sign-up, reset and change
+ * forms show these rules as you type, and the server checks the same ones before it
+ * accepts a password (lib/auth.ts).
+ *
+ * Only the length is required. The rest are advice, shown as a strength reading — length
+ * beats punctuation, and a form that refuses "correct horse battery staple" while
+ * accepting "P@ssw0rd" has its rules the wrong way round.
+ */
+
+export const PASSWORD_MIN_LENGTH = 8;
+/** Better Auth's own ceiling; long passphrases are the point, so it's generous. */
+export const PASSWORD_MAX_LENGTH = 128;
+
+/** Passwords guessed first in every credential-stuffing list, and the words they're built from. */
+const COMMON = new Set([
+  "password", "passw0rd", "p@ssword", "p@ssw0rd", "letmein", "welcome", "monkey", "dragon", "football", "baseball",
+  "iloveyou", "sunshine", "princess", "admin", "administrator", "login", "master", "hello", "freedom", "whatever",
+  "qwerty", "qwertyuiop", "asdfgh", "zxcvbn", "111111", "123123", "123456", "1234567", "12345678", "123456789",
+  "1234567890", "abc123", "trustno1", "superman", "batman", "starwars", "pokemon", "chocolate", "internet", "computer",
+  "samsung", "google", "facebook", "flare", "changeme", "secret", "test", "temp", "default", "guest",
+]);
+
+const KEYBOARD_RUNS = ["qwertyuiop", "asdfghjkl", "zxcvbnm", "1234567890", "abcdefghijklmnopqrstuvwxyz"];
+
+export type RuleId = "length" | "variety" | "notCommon" | "notPersonal";
+
+export interface PasswordRule {
+  id: RuleId;
+  label: string;
+  met: boolean;
+  /** A password can't be used until every required rule is met. */
+  required: boolean;
+}
+
+export interface PasswordCheck {
+  rules: PasswordRule[];
+  /** 0 (hopeless) to 4 (strong), the way zxcvbn scores. */
+  score: 0 | 1 | 2 | 3 | 4;
+  label: "Too short" | "Weak" | "Fair" | "Good" | "Strong";
+  /** The one thing most worth fixing, or null when there's nothing to say. */
+  advice: string | null;
+  /** Every required rule is met. */
+  valid: boolean;
+}
+
+/** Strip the digits and punctuation people add to the end: "Password123!" is "password". */
+const stem = (value: string) =>
+  value
+    .toLowerCase()
+    .replace(/[^a-z]/g, "")
+    .replace(/(.)\1{2,}/g, "$1");
+
+const looksCommon = (password: string): boolean => {
+  const lower = password.toLowerCase();
+  if (COMMON.has(lower) || COMMON.has(stem(lower))) return true;
+  // A common word with anything tacked on either end is still that word.
+  for (const word of COMMON) {
+    if (word.length >= 5 && lower.includes(word)) return true;
+  }
+  return KEYBOARD_RUNS.some((run) => {
+    for (let i = 0; i + 5 <= run.length; i++) {
+      const slice = run.slice(i, i + 5);
+      if (lower.includes(slice) || lower.includes([...slice].reverse().join(""))) return true;
+    }
+    return false;
+  });
+};
+
+/** Characters that carry information: repeats and runs count once. */
+function effectiveLength(password: string): number {
+  let length = 0;
+  let previous = "";
+  let run = 0;
+  for (const character of password) {
+    if (character === previous) {
+      run++;
+      length += run > 1 ? 0.25 : 0.5;
+    } else {
+      run = 0;
+      length += 1;
+    }
+    previous = character;
+  }
+  return length;
+}
+
+const classes = (password: string) =>
+  [/[a-z]/, /[A-Z]/, /\d/, /[^\w\s]/, /\s/].filter((pattern) => pattern.test(password)).length;
+
+/**
+ * Check a password, for the form as you type and for the server on submit.
+ * `avoid` is the things it shouldn't contain — the person's name and email.
+ */
+export function checkPassword(password: string, avoid: (string | null | undefined)[] = []): PasswordCheck {
+  const personal = avoid
+    .filter((value): value is string => Boolean(value && value.length > 2))
+    .flatMap((value) => [value.toLowerCase(), ...value.toLowerCase().split(/[@.\s]+/)])
+    .filter((part) => part.length > 2);
+  const lower = password.toLowerCase();
+
+  const rules: PasswordRule[] = [
+    { id: "length", label: `At least ${PASSWORD_MIN_LENGTH} characters`, met: password.length >= PASSWORD_MIN_LENGTH, required: true },
+    { id: "variety", label: "Letters and something else: a number, a symbol or a space", met: classes(password) >= 2, required: false },
+    { id: "notCommon", label: "Not a password everyone tries first", met: password.length > 0 && !looksCommon(password), required: false },
+    { id: "notPersonal", label: "Nothing from your name or email", met: !personal.some((part) => lower.includes(part)), required: false },
+  ];
+
+  const valid = rules.every((rule) => !rule.required || rule.met) && password.length <= PASSWORD_MAX_LENGTH;
+  const failed = rules.find((rule) => !rule.met);
+
+  let score: PasswordCheck["score"] = 0;
+  if (password.length >= PASSWORD_MIN_LENGTH) {
+    const length = effectiveLength(password);
+    const variety = classes(password);
+    const guessable = !rules.find((rule) => rule.id === "notCommon")!.met || !rules.find((rule) => rule.id === "notPersonal")!.met;
+    const raw = length >= 20 ? 4 : length >= 16 ? 3.5 : length >= 12 ? 3 : length >= 10 ? 2 : 1;
+    const adjusted = raw + (variety >= 3 ? 0.5 : 0) - (guessable ? 2 : 0);
+    score = Math.max(1, Math.min(4, Math.round(adjusted))) as PasswordCheck["score"];
+  }
+
+  const label = password.length < PASSWORD_MIN_LENGTH ? "Too short" : (["Weak", "Weak", "Fair", "Good", "Strong"] as const)[score];
+
+  let advice: string | null = null;
+  if (password.length === 0) advice = null;
+  else if (password.length < PASSWORD_MIN_LENGTH) advice = `${PASSWORD_MIN_LENGTH - password.length} more to go.`;
+  else if (password.length > PASSWORD_MAX_LENGTH) advice = `That's over ${PASSWORD_MAX_LENGTH} characters.`;
+  else if (failed?.id === "notCommon") advice = "That's close to a password attackers try first. A few unrelated words work better.";
+  else if (failed?.id === "notPersonal") advice = "Anyone who knows your email can guess this. Try something unrelated to you.";
+  else if (score < 3) advice = "Longer is stronger: three or four unrelated words beat a short password with symbols.";
+
+  return { rules, score, label, advice, valid };
+}
+
+/**
+ * Has this password appeared in a breach? Asks Have I Been Pwned with the k-anonymity
+ * range API: only the first five characters of the hash leave the Worker, and the
+ * password itself never does.
+ *
+ * Fails open — an outage shouldn't stop people signing up.
+ */
+export async function isBreachedPassword(password: string, fetchImpl: typeof fetch = fetch): Promise<boolean> {
+  try {
+    const bytes = new Uint8Array(await crypto.subtle.digest("SHA-1", new TextEncoder().encode(password)));
+    const hash = [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("").toUpperCase();
+    const response = await fetchImpl(`https://api.pwnedpasswords.com/range/${hash.slice(0, 5)}`, {
+      headers: { "Add-Padding": "true" },
+      signal: AbortSignal.timeout(2500),
+    });
+    if (!response.ok) return false;
+    const suffix = hash.slice(5);
+    return (await response.text()).split("\n").some((line) => {
+      const [candidate, count] = line.trim().split(":");
+      return candidate === suffix && Number(count) > 0;
+    });
+  } catch {
+    return false;
+  }
+}

package/templates/app/lib/site.ts

@@ -1,47 +1,56 @@
-import type { ThemeName } from "./theme";
-
-/**
- * What the site says about itself: the home page, the sign-in screens' side panels and
- * the page titles read from here. Edit freely.
- */
-export const site = {
-  name: "__APP_NAME__",
-  tagline: "The fastest way to run your business",
-  description: "__APP_NAME__ keeps your team, your customers and your data in one place, and it's live on the edge in every region.",
-  /**
-   * The look of the whole app: sign-in screens, dashboard, admin and home page.
-   * One of: default, coral, amber, sky, mono, emerald. FLARE_THEME (shell or .env)
-   * overrides it when the app is built or run with `flare dev`.
-   */
-  theme: "__THEME__" as ThemeName,
-  /** The small pill above the home page headline; set to null to hide it. */
-  announcement: { label: "New", text: "Passkeys and two-factor sign-in are here", href: "/sign-up" } as { label: string; text: string; href: string } | null,
-  /** The home page's feature grid (icon names from lucide.dev). */
-  features: [
-    { icon: "zap", title: "Fast everywhere", description: "Served from the edge in every region, so pages load in milliseconds wherever your customers are." },
-    { icon: "shield-check", title: "Secure by default", description: "Passkeys, two-factor sign-in, roles and rate limits, switched on from day one." },
-    { icon: "layout-dashboard", title: "One place for your data", description: "Every record your team keeps, with search, filters and an admin built in." },
-    { icon: "users", title: "Built for teams", description: "Invite your team, give each person the right access, and see who changed what." },
-    { icon: "plug", title: "Connects to your tools", description: "A documented API for every record, ready for your scripts and integrations." },
-    { icon: "credit-card", title: "Billing when you need it", description: "Plans, checkout and invoices through Stripe, without building a billing system." },
-  ],
-  /** Placeholder names for the logo strip: replace them with your customers (or remove the strip). */
-  customers: ["Acme", "Globex", "Initech", "Vandelay", "Northwind", "Brightline"],
-  /** Shown beside the sign-up form. */
-  highlights: [
-    "Set up in minutes, with nothing to install",
-    "Secure sign-in with passkeys and two-factor",
-    "Your data stays yours: export it any time",
-  ],
-  /** Shown on the sign-in screen of themes with a quote panel. */
-  testimonial: {
-    quote: "We moved our whole workflow over in an afternoon. The team hasn't looked back.",
-    author: "Alex Rivera",
-    role: "Head of Operations",
-  },
-  links: {
-    terms: "/terms",
-    privacy: "/privacy",
-    support: "mailto:support@example.com",
-  },
-};
+import type { ThemeName } from "./theme";
+
+/**
+ * What the site says about itself: the home page, the sign-in screens' side panels and
+ * the page titles read from here. Edit freely.
+ */
+export const site = {
+  name: "__APP_NAME__",
+  tagline: "The fastest way to run your business",
+  description: "__APP_NAME__ keeps your team, your customers and your data in one place, and it's live on the edge in every region.",
+  /**
+   * The look of the whole app: sign-in screens, dashboard, admin and home page.
+   * One of: default, coral, amber, sky, mono, emerald. FLARE_THEME (shell or .env)
+   * overrides it when the app is built or run with `flare dev`.
+   */
+  theme: "__THEME__" as ThemeName,
+  /** How the dashboard behaves. */
+  dashboard: {
+    /**
+     * Where a record is created and edited: in a dialog over the list ("modal", the
+     * default, which keeps the list, its filters and your place in it), or on its own
+     * page ("page", better for long forms).
+     */
+    forms: "modal" as "modal" | "page",
+  },
+  /** The small pill above the home page headline; set to null to hide it. */
+  announcement: { label: "New", text: "Passkeys and two-factor sign-in are here", href: "/sign-up" } as { label: string; text: string; href: string } | null,
+  /** The home page's feature grid (icon names from lucide.dev). */
+  features: [
+    { icon: "zap", title: "Fast everywhere", description: "Served from the edge in every region, so pages load in milliseconds wherever your customers are." },
+    { icon: "shield-check", title: "Secure by default", description: "Passkeys, two-factor sign-in, roles and rate limits, switched on from day one." },
+    { icon: "layout-dashboard", title: "One place for your data", description: "Every record your team keeps, with search, filters and an admin built in." },
+    { icon: "users", title: "Built for teams", description: "Invite your team, give each person the right access, and see who changed what." },
+    { icon: "plug", title: "Connects to your tools", description: "A documented API for every record, ready for your scripts and integrations." },
+    { icon: "credit-card", title: "Billing when you need it", description: "Plans, checkout and invoices through Stripe, without building a billing system." },
+  ],
+  /** Placeholder names for the logo strip: replace them with your customers (or remove the strip). */
+  customers: ["Acme", "Globex", "Initech", "Vandelay", "Northwind", "Brightline"],
+  /** Shown beside the sign-up form. */
+  highlights: [
+    "Set up in minutes, with nothing to install",
+    "Secure sign-in with passkeys and two-factor",
+    "Your data stays yours: export it any time",
+  ],
+  /** Shown on the sign-in screen of themes with a quote panel. */
+  testimonial: {
+    quote: "We moved our whole workflow over in an afternoon. The team hasn't looked back.",
+    author: "Alex Rivera",
+    role: "Head of Operations",
+  },
+  links: {
+    terms: "/terms",
+    privacy: "/privacy",
+    support: "mailto:support@example.com",
+  },
+};

package/templates/app/migrations/0000_init.sql

@@ -87,11 +87,23 @@ CREATE TABLE `verification` (
 );
 --> statement-breakpoint
 CREATE INDEX `verification_identifier_idx` ON `verification` (`identifier`);--> statement-breakpoint
+CREATE TABLE `audit_log` (
+	`id` text PRIMARY KEY NOT NULL,
+	`action` text NOT NULL,
+	`resource` text NOT NULL,
+	`record_id` text,
+	`record_label` text,
+	`user_id` text,
+	`user_email` text,
+	`changes` text,
+	`ip` text,
+	`created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `audit_log_created_at_idx` ON `audit_log` (`created_at`);--> statement-breakpoint
+CREATE INDEX `audit_log_resource_idx` ON `audit_log` (`resource`);--> statement-breakpoint
 CREATE TABLE `role` (
 	`name` text PRIMARY KEY NOT NULL,
 	`label` text NOT NULL,
 	`created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL
 );
---> statement-breakpoint
--- Built-in roles: lib/admin.ts lets both into /admin. Add more with `flare role:add`.
-INSERT INTO `role` (`name`, `label`) VALUES ('admin', 'Admin'), ('staff', 'Staff');