fix: change permission

infrastructure/Persistence/DbSeeder.cs

@@ -134,29 +134,58 @@ public static class DbSeeder
     {
         var now = DateTime.UtcNow;
 
-        if (!await db.Roles.AnyAsync(r => r.Name == "Admin"))
-        {
-            var adminRole = new Role { Id = Guid.NewGuid(), Name = "Admin", IsSystem = true, CreatedAt = now, UpdatedAt = now };
-            adminRole.Permissions = ScreenCatalog.Screens.Select(s => new RolePermission
+        await SyncSystemRoleAsync(
+            db,
+            "Admin",
+            _ => (View: true, Create: true, Edit: true, Delete: true),
+            now);
+
+        await SyncSystemRoleAsync(
+            db,
+            "Member",
+            screen => screen.Key switch
             {
-                RoleId = adminRole.Id, Screen = s.Key, CanView = true, CanCreate = true, CanEdit = true, CanDelete = true,
-            }).ToList();
-            db.Roles.Add(adminRole);
-            await db.SaveChangesAsync();
+                "users" or "permissions" or "masterdata" => (View: false, Create: false, Edit: false, Delete: false),
+                "projects" => (View: true, Create: false, Edit: false, Delete: false),
+                _ => (View: true, Create: true, Edit: true, Delete: false),
+            },
+            now);
+    }
+
+    private static async Task SyncSystemRoleAsync(
+        AppDbContext db,
+        string name,
+        Func<ScreenDefinition, (bool View, bool Create, bool Edit, bool Delete)> rule,
+        DateTime now)
+    {
+        var role = await db.Roles
+            .Include(r => r.Permissions)
+            .FirstOrDefaultAsync(r => r.Name == name);
+
+        if (role is null)
+        {
+            role = new Role { Id = Guid.NewGuid(), Name = name, IsSystem = true, CreatedAt = now, UpdatedAt = now };
+            db.Roles.Add(role);
         }
 
-        if (!await db.Roles.AnyAsync(r => r.Name == "Member"))
+        var byScreen = role.Permissions.ToDictionary(p => p.Screen);
+        foreach (var screen in ScreenCatalog.Screens)
         {
-            var memberRole = new Role { Id = Guid.NewGuid(), Name = "Member", IsSystem = true, CreatedAt = now, UpdatedAt = now };
-            memberRole.Permissions = ScreenCatalog.Screens
-                .Where(s => s.Key is not ("users" or "permissions" or "masterdata"))
-                .Select(s => new RolePermission
-                {
-                    RoleId = memberRole.Id, Screen = s.Key, CanView = true, CanCreate = true, CanEdit = true, CanDelete = false,
-                }).ToList();
-            db.Roles.Add(memberRole);
-            await db.SaveChangesAsync();
+            if (!byScreen.TryGetValue(screen.Key, out var permission))
+            {
+                permission = new RolePermission { RoleId = role.Id, Screen = screen.Key };
+                role.Permissions.Add(permission);
+            }
+
+            var (view, create, edit, delete) = rule(screen);
+            permission.CanView = view;
+            permission.CanCreate = create;
+            permission.CanEdit = edit;
+            permission.CanDelete = delete;
         }
+
+        role.UpdatedAt = now;
+        await db.SaveChangesAsync();
     }
 
     private static async Task<User> EnsureUserAsync(AppDbContext db, IPasswordHasher passwordHasher, string username, string displayName, string roleName)