caps and delete

backend/src/workers/tenants.rs

@@ -8,6 +8,9 @@ use serde::Deserialize;
 use tracing::warn;
 use uuid::Uuid;
 
+use crate::auth::capability_sets::{
+    ensure_capability_set, owner_capabilities, user_capabilities, webdav_capabilities,
+};
 use crate::documents::search::ensure_quickwit_index;
 use crate::jobs::JOB_PROVISION_TENANT;
 use crate::models::{NewUserMembership, TenantStatus};
@@ -128,12 +131,56 @@ impl JobHandler for ProvisionTenantJob {
             };
         }
 
+        let owner_capability_set_id =
+            match ensure_capability_set(&mut conn, tenant.id, owner_capabilities()) {
+                Ok(set) => set.id,
+                Err(err) => {
+                    warn!(
+                        job_id = %job.id,
+                        tenant_id = %tenant.id,
+                        error = ?err,
+                        "failed to ensure owner capability set during provisioning"
+                    );
+                    return JobExecution::Retry {
+                        delay: std::time::Duration::from_secs(30),
+                        error: "owner capability set unavailable".into(),
+                    };
+                }
+            };
+
+        if let Err(err) = ensure_capability_set(&mut conn, tenant.id, user_capabilities()) {
+            warn!(
+                job_id = %job.id,
+                tenant_id = %tenant.id,
+                error = ?err,
+                "failed to ensure user capability set during provisioning"
+            );
+            return JobExecution::Retry {
+                delay: std::time::Duration::from_secs(30),
+                error: "user capability set unavailable".into(),
+            };
+        }
+
+        if let Err(err) = ensure_capability_set(&mut conn, tenant.id, webdav_capabilities()) {
+            warn!(
+                job_id = %job.id,
+                tenant_id = %tenant.id,
+                error = ?err,
+                "failed to ensure webdav capability set during provisioning"
+            );
+            return JobExecution::Retry {
+                delay: std::time::Duration::from_secs(30),
+                error: "webdav capability set unavailable".into(),
+            };
+        }
+
         if let Some(members) = ProvisionPayload::from_job(&job) {
             for member in members {
                 let new_membership = NewUserMembership {
                     id: Uuid::new_v4(),
                     user_id: member,
                     tenant_id: tenant.id,
+                    capability_set_id: Some(owner_capability_set_id),
                 };
 
                 if let Err(err) = diesel::insert_into(user_memberships::table)