Files
shopdb-flask/shopdb/cli/__init__.py
cproudlock 5fa5160420 Apply skill-driven review fixes: security, hook isolation, tests, docs
Addresses findings from a 6-lens review against the project skills
(defining-asset-contract, enforcing-plugin-contract, hardening-flask-config,
integrating-plugin-hooks, pinning-flask-behavior, simplifying-python).

Security (hardening-flask-config):
- Load per-plugin COLLECTOR_API_KEY_<PLUGIN> from env in create_app. from_object
  only copies class attributes, so per-plugin keys (ADR-006) were dead in real
  deploys and silently fell back to the shared key.
- EMPLOYEE_DB_USER/PASSWORD no longer default to root/rootpassword (no safe
  default for a secret; unset fails loud). Documented in .env.example + DEPLOY.md.
- COLLECTOR_API_KEY + per-plugin + EMPLOYEE_DB_* added to .env.example/DEPLOY.md.

Hook isolation (integrating-plugin-hooks):
- collector _collector_plugins and dashboard get_navigation now re-raise in
  dev/test and log+isolate in prod, instead of silently swallowing a broken
  plugin hook.

Plugin loader (enforcing-plugin-contract):
- enable_plugin/install_plugin read dependencies+version from the manifest
  instead of instantiating the plugin class.
- _register_plugin_components rejects a second plugin claiming an already-used
  api_prefix (reset per app in init_app).

Tests (pinning-flask-behavior):
- test_identifiers.py: gauge/maintenance round-trip on computer/printer/network
  create+update; per-type seed yields the 12 identifier keys.
- contract tests for apply_collector_payload presence + schema-declarers-implement.
- security tests for per-plugin key env loading + no employee-db password default.

Docs/contract sync (defining-asset-contract):
- PLUGIN-HOOKS.md documents apply_collector_payload; stale 0.2.0 -> 0.3.0.
- ADR-006 documents apply_collector_payload + single-dispatch rationale.
- ADR-001 enumerates the expanded shopdb.api import surface.

Simplify (simplifying-python):
- De-duplicate the 21-entry settings defaults: shared build_default_settings()
  used by both the /settings/seed route and the CLI (were drifting copies).
- Remove dead AssetStatus import + redundant AssetType local import in computers
  plugin; comment the statusid=1 collector default.

153 tests pass (was 145), naming/style green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-26 19:25:52 -04:00

229 lines
9.0 KiB
Python

"""Flask CLI commands."""
import click
from flask.cli import with_appcontext
@click.group('db-utils')
def db_cli():
"""Database utility commands."""
pass
@db_cli.command('create-all')
@with_appcontext
def create_all():
"""Create all database tables."""
from shopdb.extensions import db
db.create_all()
click.echo(click.style("All tables created.", fg='green'))
@db_cli.command('drop-all')
@click.confirmation_option(prompt='This will delete ALL data. Are you sure?')
@with_appcontext
def drop_all():
"""Drop all database tables."""
from shopdb.extensions import db
db.drop_all()
click.echo(click.style("All tables dropped.", fg='yellow'))
@click.group('seed')
def seed_cli():
"""Database seeding commands."""
pass
@seed_cli.command('reference-data')
@with_appcontext
def seed_reference_data():
"""Seed reference data (machine types, statuses, etc.)."""
from shopdb.extensions import db
from shopdb.core.models import MachineType, OperatingSystem, AssetStatus, LocationType
from shopdb.core.models.relationship import RelationshipType
# Machine types
machine_types = [
{'machinetype': 'CNC Mill', 'category': 'Equipment', 'description': 'CNC Milling Machine'},
{'machinetype': 'CNC Lathe', 'category': 'Equipment', 'description': 'CNC Lathe'},
{'machinetype': 'CMM', 'category': 'Equipment', 'description': 'Coordinate Measuring Machine'},
{'machinetype': 'EDM', 'category': 'Equipment', 'description': 'Electrical Discharge Machine'},
{'machinetype': 'Grinder', 'category': 'Equipment', 'description': 'Grinding Machine'},
{'machinetype': 'Inspection Station', 'category': 'Equipment', 'description': 'Inspection Station'},
{'machinetype': 'Desktop PC', 'category': 'PC', 'description': 'Desktop Computer'},
{'machinetype': 'Laptop', 'category': 'PC', 'description': 'Laptop Computer'},
{'machinetype': 'Shopfloor PC', 'category': 'PC', 'description': 'Shopfloor Computer'},
{'machinetype': 'Server', 'category': 'Network', 'description': 'Server'},
{'machinetype': 'Switch', 'category': 'Network', 'description': 'Network Switch'},
{'machinetype': 'Access Point', 'category': 'Network', 'description': 'Wireless Access Point'},
]
for mt_data in machine_types:
existing = MachineType.query.filter_by(machinetype=mt_data['machinetype']).first()
if not existing:
mt = MachineType(**mt_data)
db.session.add(mt)
# Asset statuses (canonical set - the asset model is the contract)
asset_statuses = [
{'status': 'In Use', 'description': 'Currently in use', 'color': '#28a745'},
{'status': 'Inventory', 'description': 'In inventory', 'color': '#17a2b8'},
{'status': 'In Repair', 'description': 'Being repaired', 'color': '#ffc107'},
{'status': 'Retired', 'description': 'No longer in use', 'color': '#6c757d'},
{'status': 'Returned', 'description': 'Returned to vendor or owner', 'color': '#fd7e14'},
{'status': 'Warrantied', 'description': 'Under warranty service', 'color': '#20c997'},
{'status': 'Lost', 'description': 'Lost or missing', 'color': '#dc3545'},
]
for s_data in asset_statuses:
existing = AssetStatus.query.filter_by(status=s_data['status']).first()
if not existing:
db.session.add(AssetStatus(isactive=True, **s_data))
elif existing.isactive is not True:
existing.isactive = True
# Location types (ADR-001)
location_types = ['section', 'cell', 'subcell', 'operation', 'meetingroom',
'lab', 'office', 'storage', 'hallway', 'networkcloset',
'building']
for lt in location_types:
if not LocationType.query.filter_by(locationtype=lt).first():
db.session.add(LocationType(locationtype=lt, isactive=True))
# Operating systems
os_list = [
{'osname': 'Windows 10', 'osversion': '10.0'},
{'osname': 'Windows 11', 'osversion': '11.0'},
{'osname': 'Windows Server 2019', 'osversion': '2019'},
{'osname': 'Windows Server 2022', 'osversion': '2022'},
{'osname': 'Linux', 'osversion': 'Various'},
]
for os_data in os_list:
existing = OperatingSystem.query.filter_by(osname=os_data['osname']).first()
if not existing:
os_obj = OperatingSystem(**os_data)
db.session.add(os_obj)
# Connection types (pre-1.0 legacy; kept for backward compat with
# existing relationship rows. New ADR-001 code reasons about the three
# canonical types below via free-text label.)
connection_types = [
{'relationshiptype': 'Serial Cable', 'description': 'RS-232 or similar serial connection'},
{'relationshiptype': 'Direct Ethernet', 'description': 'Direct network cable (airgapped)'},
{'relationshiptype': 'USB', 'description': 'USB connection'},
{'relationshiptype': 'WiFi', 'description': 'Wireless network connection'},
{'relationshiptype': 'Dualpath', 'description': 'Redundant/failover network path'},
]
for ct_data in connection_types:
existing = RelationshipType.query.filter_by(relationshiptype=ct_data['relationshiptype']).first()
if not existing:
ct = RelationshipType(**ct_data)
db.session.add(ct)
# ADR-001 canonical relationship types. Created first without propagation
# FKs, then patched with propagatesthroughid since `controls` points at
# `partof` (same table). All three are idempotent.
#
# MySQL collation is case-insensitive by default, which would let a
# legacy capitalized row (e.g. "Controls") match the lowercase
# "controls" check and skip the insert. Force binary comparison via
# collate so the three ADR-001 types stay distinct from any legacy
# rows with the same spelling but different case.
from sqlalchemy import func, literal
def _lookup_binary(name):
dialect = db.engine.dialect.name
if dialect == 'mysql':
return RelationshipType.query.filter(
func.binary(RelationshipType.relationshiptype) == literal(name)
).first()
return RelationshipType.query.filter_by(relationshiptype=name).first()
adr_types = [
{'relationshiptype': 'partof', 'description': 'Composition / sub-assembly (ADR-001)'},
{'relationshiptype': 'controls', 'description': 'Operational authority over another asset (ADR-001)'},
{'relationshiptype': 'connectedto', 'description': 'Network or data link without authority (ADR-001)'},
]
for at in adr_types:
if not _lookup_binary(at['relationshiptype']):
db.session.add(RelationshipType(**at))
db.session.flush()
# Wire `controls` -> `partof` propagation rail. partof + connectedto stay
# null (no propagation).
partof = _lookup_binary('partof')
controls = _lookup_binary('controls')
if partof and controls and controls.propagatesthroughid != partof.relationshiptypeid:
controls.propagatesthroughid = partof.relationshiptypeid
db.session.commit()
click.echo(click.style("Reference data seeded.", fg='green'))
@seed_cli.command('test-user')
@with_appcontext
def seed_test_user():
"""Create a test admin user."""
from shopdb.extensions import db
from shopdb.core.models import User, Role
from werkzeug.security import generate_password_hash
# Create admin role if not exists
admin_role = Role.query.filter_by(rolename='admin').first()
if not admin_role:
admin_role = Role(rolename='admin', description='Administrator')
db.session.add(admin_role)
# Create test user
test_user = User.query.filter_by(username='admin').first()
if not test_user:
test_user = User(
username='admin',
email='admin@localhost',
passwordhash=generate_password_hash('admin123'),
isactive=True
)
test_user.roles.append(admin_role)
db.session.add(test_user)
db.session.commit()
click.echo(click.style("Test user created: admin / admin123", fg='green'))
else:
click.echo(click.style("Test user already exists", fg='yellow'))
@seed_cli.command('permissions')
@with_appcontext
def seed_permissions():
"""Seed predefined permissions."""
from shopdb.extensions import db
from shopdb.core.models import Permission
created = Permission.seed()
db.session.commit()
click.echo(click.style(f"{created} permissions created.", fg='green'))
@seed_cli.command('settings')
@with_appcontext
def seed_settings():
"""Seed default system settings."""
from shopdb.extensions import db
from shopdb.core.models import Setting
from shopdb.core.api.settings import build_default_settings
defaults = build_default_settings()
created = 0
for d in defaults:
if not Setting.query.filter_by(key=d['key']).first():
setting = Setting(**d)
db.session.add(setting)
created += 1
db.session.commit()
click.echo(click.style(f"{created} default settings created.", fg='green'))