shopdb-flask/shopdb/core/api/setup.py

"""First-run setup wizard support endpoints.

The wizard itself is frontend; these endpoints cover the pieces that need
server work: seeding common starter data and marking setup finished. Site,
plugin, and map configuration reuse the existing settings / plugins APIs.
"""

from flask import Blueprint, request, current_app
from flask_jwt_extended import jwt_required
from werkzeug.security import generate_password_hash

from shopdb.extensions import db
from shopdb.core.models import Vendor, Setting, User, Role
from shopdb.utils.responses import success_response, error_response, ErrorCodes
from shopdb.utils.authz import require_role

setup_bp = Blueprint('setup', __name__)

# Common hardware vendors most sites will want on hand.
STARTER_VENDORS = [
    ('Dell Inc.', 'https://www.dell.com'),
    ('HP Inc.', 'https://www.hp.com'),
    ('Lenovo', 'https://www.lenovo.com'),
    ('Xerox', 'https://www.xerox.com'),
    ('Zebra Technologies', 'https://www.zebra.com'),
    ('Cisco', 'https://www.cisco.com'),
    ('Brother', 'https://www.brother.com'),
    ('Microsoft', 'https://www.microsoft.com'),
]


@setup_bp.route('/needs-admin', methods=['GET'])
def needs_admin():
    """True when no users exist yet - the app's very first run. Public so the
    login screen can offer to create the first admin."""
    return success_response({'needsadmin': User.query.count() == 0})


@setup_bp.route('/create-admin', methods=['POST'])
def create_admin():
    """Create the first admin. Only works while there are zero users, so it
    can't be abused after setup. No auth (there is no one to auth as yet)."""
    if User.query.count() > 0:
        return error_response(ErrorCodes.FORBIDDEN,
                              'An account already exists; sign in instead.', http_code=403)
    data = request.get_json() or {}
    username = (data.get('username') or '').strip()
    email = (data.get('email') or '').strip()
    password = data.get('password') or ''
    if not (username and email and password):
        return error_response(ErrorCodes.VALIDATION_ERROR,
                              'username, email and password are required')

    admin_role = Role.query.filter_by(rolename='admin').first()
    if not admin_role:
        admin_role = Role(rolename='admin', description='Administrator')
        db.session.add(admin_role)

    user = User(username=username, email=email,
                passwordhash=generate_password_hash(password), isactive=True)
    user.roles.append(admin_role)
    db.session.add(user)
    db.session.commit()
    return success_response({'username': username}, message='Admin created', http_code=201)


@setup_bp.route('/seed-reference', methods=['POST'])
@jwt_required()
@require_role('admin')
def seed_reference():
    """Seed core reference data + permissions + default settings. Idempotent -
    reuses the same routines as the `flask seed ...` CLI commands."""
    # Invoke the seed CLI commands in a proper click context via the runner.
    runner = current_app.test_cli_runner()
    for command in ('reference-data', 'permissions', 'settings'):
        result = runner.invoke(args=['seed', command])
        if result.exit_code not in (0, None):
            return error_response(ErrorCodes.INTERNAL_ERROR,
                                  f'seed {command} failed: {result.output}', http_code=500)
    return success_response(message='Reference data, permissions and settings seeded.')


@setup_bp.route('/seed-starter', methods=['POST'])
@jwt_required()
@require_role('admin')
def seed_starter():
    """Add common vendors that are not already present. Idempotent."""
    existing = {v.vendor.strip().lower() for v in Vendor.query.all()}
    added = []
    for name, website in STARTER_VENDORS:
        if name.strip().lower() in existing:
            continue
        db.session.add(Vendor(vendor=name, website=website))
        added.append(name)
    db.session.commit()
    return success_response(
        {'added': added, 'addedcount': len(added)},
        message=f'Seeded {len(added)} vendor(s).'
    )


@setup_bp.route('/complete', methods=['POST'])
@jwt_required()
@require_role('admin')
def mark_complete():
    """Flag the first-run setup as finished."""
    row = Setting.query.filter_by(key='setup_complete').first()
    if row:
        row.value = 'true'
    else:
        db.session.add(Setting(key='setup_complete', value='true',
                               valuetype='boolean', category='site'))
    db.session.commit()
    return success_response({'complete': True}, message='Setup marked complete.')