sync: migrate secure-online-shop to Gitea (2026-08-10)

2026-08-10 15:26:59 +00:00
commit 2022c8890d
44 changed files with 3196 additions and 0 deletions
@@ -0,0 +1,101 @@
+"""
+Script to create a shop account with an operator-supplied strong password.
+
+Usage:
+    python -m app.db.create_shop_account
+
+Provide SHOP_ACCOUNT_PASSWORD for non-interactive execution,
+or enter the password securely via getpass().
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from getpass import getpass
+
+from sqlalchemy import select
+
+from app.core.security import get_password_hash
+from app.db.session import SessionLocal, engine
+from app.models import Base, RoleEnum, User
+
+SHOP_USERNAME = "shop"
+MIN_PASSWORD_LENGTH = 12
+
+
+def _validate_password_strength(password: str) -> None:
+    if len(password) < MIN_PASSWORD_LENGTH or len(password) > 72:
+        raise ValueError("Password must be between 12 and 72 characters long.")
+    has_upper = any(char.isupper() for char in password)
+    has_lower = any(char.islower() for char in password)
+    has_digit = any(char.isdigit() for char in password)
+    has_special = any(not char.isalnum() for char in password)
+    if not all((has_upper, has_lower, has_digit, has_special)):
+        raise ValueError(
+            "Password must include upper, lower, digit, and special characters."
+        )
+
+
+def _get_shop_password() -> str:
+    env_password = os.getenv("SHOP_ACCOUNT_PASSWORD", "").strip()
+    if env_password:
+        _validate_password_strength(env_password)
+        return env_password
+
+    if not sys.stdin.isatty():
+        raise RuntimeError(
+            "Interactive password input is unavailable. Set SHOP_ACCOUNT_PASSWORD to create the account safely."
+        )
+
+    while True:
+        password = getpass("Enter a strong password for the shop account: ")
+        confirm_password = getpass("Confirm the password: ")
+        if password != confirm_password:
+            print("Passwords do not match. Please try again.", file=sys.stderr)
+            continue
+        _validate_password_strength(password)
+        return password
+
+
+def create_shop_account() -> None:
+    """Create a shop account with a strong password if it doesn't exist."""
+    Base.metadata.create_all(bind=engine)
+
+    with SessionLocal() as db:
+        existing = db.scalar(
+            select(User).where(User.username == SHOP_USERNAME)
+        )
+        if existing is not None:
+            print(f"Shop account '{SHOP_USERNAME}' already exists (id={existing.id}).")
+            print("No new account was created.")
+            return
+
+        password = _get_shop_password()
+        password_hash = get_password_hash(password)
+
+        shop = User(
+            username=SHOP_USERNAME,
+            password_hash=password_hash,
+            role=RoleEnum.shop,
+            is_active=True,
+        )
+        db.add(shop)
+        db.commit()
+        db.refresh(shop)
+
+        print("=" * 60)
+        print("SHOP ACCOUNT CREATED SUCCESSFULLY")
+        print("=" * 60)
+        print(f"Username: {SHOP_USERNAME}")
+        print("=" * 60)
+        print("Password was accepted and hashed without being printed to stdout.")
+        print("=" * 60)
+
+
+if __name__ == "__main__":
+    try:
+        create_shop_account()
+    except Exception as exc:
+        print(f"Error: {exc}", file=sys.stderr)
+        sys.exit(1)