mteehan
edaf16a433
- Remove duplicate dead code in daemon/handlers/auth.py (auth_refresh) - Fix logout reading refresh token from localStorage instead of sessionStorage - Align bootstrap auth config access_token_ttl (900 -> 300) with hardened default - Add password hash rehash check on successful login (needs_rehash was unused) - Remove 'unsafe-inline' from CSP style-src (all styles are applied via JS DOM API)
75 lines
2.3 KiB
Python
75 lines
2.3 KiB
Python
"""Bootstrap auth: initialize DB and seed admin user at install time.
|
|
|
|
Run once during installation. Writes config/auth/config.json with a
|
|
generated JWT secret and creates the admin user in SQLite.
|
|
|
|
Usage:
|
|
python scripts/bootstrap_auth.py --project-dir /path/to/project \
|
|
--username admin \
|
|
--password secret \
|
|
--domain wall.example.com
|
|
"""
|
|
|
|
import argparse
|
|
import json
|
|
import os
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
# Ensure project lib is importable
|
|
PROJECT_DIR = Path(".")
|
|
|
|
|
|
def main() -> None:
|
|
parser = argparse.ArgumentParser(description="Bootstrap Vacuum Wall auth")
|
|
parser.add_argument("--project-dir", required=True, help="Project root directory")
|
|
parser.add_argument("--username", required=True, help="Admin username")
|
|
parser.add_argument("--password", required=True, help="Admin password")
|
|
parser.add_argument("--domain", required=True, help="Management domain (rp_id)")
|
|
args = parser.parse_args()
|
|
|
|
project_dir = Path(args.project_dir).resolve()
|
|
sys.path.insert(0, str(project_dir))
|
|
|
|
# Set DB path before importing lib modules
|
|
db_path = str(project_dir / "data" / "auth.db")
|
|
os.environ["VACUUM_WALL_DB_BACKEND"] = "sqlite"
|
|
os.environ["VACUUM_WALL_DB_PATH"] = db_path
|
|
|
|
from lib.auth_users import ALL_SUBSYSTEMS, create_user
|
|
|
|
# Write config
|
|
config_dir = project_dir / "config" / "auth"
|
|
config_dir.mkdir(parents=True, exist_ok=True)
|
|
config_path = config_dir / "config.json"
|
|
|
|
config = {
|
|
"jwt": {
|
|
"access_token_ttl": 300,
|
|
"refresh_token_ttl": 604800,
|
|
"algorithm": "HS256",
|
|
},
|
|
"webauthn": {
|
|
"rp_name": "Vacuum Wall",
|
|
"rp_id": args.domain,
|
|
"origin": f"https://{args.domain}",
|
|
},
|
|
}
|
|
|
|
with open(config_path, "w") as f:
|
|
json.dump(config, f, indent=2)
|
|
f.write("\n")
|
|
|
|
print(f"Wrote auth config: {config_path}")
|
|
|
|
# Initialize DB and create admin user
|
|
permissions = {sub: "rw" for sub in ALL_SUBSYSTEMS}
|
|
user = create_user(args.username, args.password, permissions)
|
|
|
|
print(f"Created admin user: {user['username']} (id={user['id']})")
|
|
print(f"Permissions: {len(permissions)} subsystems, all 'rw'")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|