Kyle DammannandClaude Opus 5.5
ef9deaeff7
- Django 5.2 + PostgreSQL 17 via docker compose (app + db, volumes, healthcheck on /healthz, test profile running pytest against Postgres) - Custom e-mail user model with user/admin roles - Invitation-only registration with single-use, hashed, expiring links - Admin area: invitations, role changes, deactivation, password reset via one-time link or temporary password (forced change on login) - First admin created from ADMIN_EMAIL/ADMIN_PASSWORD on startup - Login rate limiting per e-mail and IP (DB-backed, worker-safe) - Proxy middleware honouring X-Forwarded-* only from TRUSTED_PROXIES, optional CLIENT_IP_HEADER (e.g. CF-Connecting-IP) - Security headers (CSP, HSTS, Permissions-Policy), secure __Host- cookies - Mobile-first German UI, CLAUDE.md, README, init-env script - 65 tests for auth, permissions, proxy handling and rate limiting Co-Authored-By: Claude Opus 5.5 <[email protected]>
36 lines
1.5 KiB
Python
36 lines
1.5 KiB
Python
import os
|
|
|
|
from django.contrib.auth.password_validation import validate_password
|
|
from django.core.exceptions import ValidationError
|
|
from django.core.management.base import BaseCommand, CommandError
|
|
|
|
from accounts.models import User, normalize_email
|
|
|
|
|
|
class Command(BaseCommand):
|
|
help = (
|
|
"Legt den ersten Admin aus ADMIN_EMAIL/ADMIN_PASSWORD an, falls diese E-Mail noch kein Konto hat. "
|
|
"Bestehende Konten werden nie verändert."
|
|
)
|
|
|
|
def handle(self, *args, **options):
|
|
email = normalize_email(os.environ.get("ADMIN_EMAIL", ""))
|
|
password = os.environ.get("ADMIN_PASSWORD", "")
|
|
name = os.environ.get("ADMIN_NAME", "").strip() or "Admin"
|
|
|
|
if not email:
|
|
if not User.objects.filter(role=User.Role.ADMIN).exists():
|
|
self.stderr.write("Warnung: Es gibt noch keinen Admin. Setze ADMIN_EMAIL und ADMIN_PASSWORD in .env.")
|
|
return
|
|
if User.objects.filter(email=email).exists():
|
|
return
|
|
if not password:
|
|
raise CommandError("ADMIN_EMAIL ist gesetzt, aber ADMIN_PASSWORD fehlt.")
|
|
try:
|
|
validate_password(password)
|
|
except ValidationError as error:
|
|
raise CommandError("ADMIN_PASSWORD ist zu schwach: " + " ".join(error.messages)) from error
|
|
|
|
User.objects.create_admin(email=email, password=password, display_name=name)
|
|
self.stdout.write(f"Admin {email} angelegt. ADMIN_PASSWORD kann jetzt aus .env entfernt werden.")
|