feat: add auth subsystem with WebAuthn passkeys support

New modules: lib/auth, lib/auth_users, lib/db, lib/db_sqlite, lib/password, lib/webauthn, daemon/handlers/auth, scripts/bootstrap_auth, tests/test_auth Frontend: webui/api/auth, hoover/components/auth, pages/login, passkeys, users Updates: daemon/iface and server, lib/common and nginx, pyproject.toml deps, install script, server.py, app.js, and websocket/api clients
2026-07-24 01:21:39 +00:00
parent 04417cf05c
commit 56b200d233
28 changed files with 4900 additions and 82 deletions
@@ -0,0 +1,78 @@
+"""Bootstrap auth: initialize DB and seed admin user at install time.
+
+Run once during installation. Writes config/auth/config.json with a
+generated JWT secret and creates the admin user in SQLite.
+
+Usage:
+    python scripts/bootstrap_auth.py --project-dir /path/to/project \
+                                      --username admin \
+                                      --password secret \
+                                      --domain wall.example.com
+"""
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+
+# Ensure project lib is importable
+PROJECT_DIR = Path(".")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="Bootstrap Vacuum Wall auth")
+    parser.add_argument("--project-dir", required=True, help="Project root directory")
+    parser.add_argument("--username", required=True, help="Admin username")
+    parser.add_argument("--password", required=True, help="Admin password")
+    parser.add_argument("--domain", required=True, help="Management domain (rp_id)")
+    args = parser.parse_args()
+
+    project_dir = Path(args.project_dir).resolve()
+    sys.path.insert(0, str(project_dir))
+
+    # Set DB path before importing lib modules
+    db_path = str(project_dir / "data" / "auth.db")
+    os.environ["VACUUM_WALL_DB_BACKEND"] = "sqlite"
+    os.environ["VACUUM_WALL_DB_PATH"] = db_path
+
+    from lib.auth_users import ALL_SUBSYSTEMS, create_user
+
+    # Generate JWT secret
+    secret = os.urandom(32).hex()
+
+    # Write config
+    config_dir = project_dir / "config" / "auth"
+    config_dir.mkdir(parents=True, exist_ok=True)
+    config_path = config_dir / "config.json"
+
+    config = {
+        "jwt": {
+            "access_token_ttl": 900,
+            "refresh_token_ttl": 604800,
+            "algorithm": "HS256",
+            "secret": secret,
+        },
+        "webauthn": {
+            "rp_name": "Vacuum Wall",
+            "rp_id": args.domain,
+            "origin": f"https://{args.domain}",
+        },
+    }
+
+    with open(config_path, "w") as f:
+        json.dump(config, f, indent=2)
+        f.write("\n")
+
+    print(f"Wrote auth config: {config_path}")
+
+    # Initialize DB and create admin user
+    permissions = {sub: "rw" for sub in ALL_SUBSYSTEMS}
+    user = create_user(args.username, args.password, permissions)
+
+    print(f"Created admin user: {user['username']} (id={user['id']})")
+    print(f"Permissions: {len(permissions)} subsystems, all 'rw'")
+
+
+if __name__ == "__main__":
+    main()