feat(09-02): add admin create and reset-password commands

- Commands hash with bcrypt, validate role codes, and revoke tokens on reset
- Generated app main appends cabana.RuntimeCommands exactly once

cabana/commands.go

@@ -1,11 +1,185 @@
 package cabana
 
 import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
 	"git.golem15.com/golem15/summercms/backpack"
 	"git.golem15.com/golem15/summercms/bonfire"
+	"git.golem15.com/golem15/summercms/bouncer"
+	"git.golem15.com/golem15/summercms/lagoon"
+	"gorm.io/gorm"
 )
 
 // RuntimeCommands returns the operator commands for backend administrators.
 func RuntimeCommands(app *backpack.App) []bonfire.Command {
-	return nil
+	return []bonfire.Command{
+		{
+			Name:        "admin:create",
+			Description: "Create an activated backend administrator",
+			Flags: []bonfire.Flag{
+				{Name: "email", Description: "Admin email"},
+				{Name: "password", Description: "Admin password"},
+				{Name: "login", Description: "Login; defaults to the lower-cased email"},
+				{Name: "superuser", Description: "Grant superuser", Bare: true},
+				{Name: "role", Description: "Role code"},
+			},
+			Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
+				return adminCreate(ctx, app, in, out)
+			},
+		},
+		{
+			Name:        "admin:reset-password",
+			Description: "Reset a backend administrator password and revoke existing tokens",
+			Args: []bonfire.Arg{{
+				Name:        "identifier",
+				Description: "Login or email",
+				Required:    true,
+			}},
+			Flags: []bonfire.Flag{{
+				Name:        "password",
+				Description: "New password",
+			}},
+			Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
+				return adminResetPassword(ctx, app, in, out)
+			},
+		},
+	}
+}
+
+func adminCreate(ctx context.Context, app *backpack.App, in bonfire.Input, out bonfire.Output) error {
+	email := strings.ToLower(strings.TrimSpace(flagValue(in, "email")))
+	password := flagValue(in, "password")
+	if email == "" || !strings.Contains(email, "@") || strings.TrimSpace(password) == "" {
+		return errors.New("cabana: email and password are required")
+	}
+	login := strings.TrimSpace(flagValue(in, "login"))
+	if login == "" {
+		login = email
+	}
+	roleCode := strings.TrimSpace(flagValue(in, "role"))
+	superuser := flagValue(in, "superuser") == "true"
+	return withAdminDB(ctx, app, func(gdb *gorm.DB) error {
+		return gdb.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+			roleID, err := roleIDByCode(tx, roleCode)
+			if err != nil {
+				return err
+			}
+			var existing int64
+			if err := tx.Model(&BackendUser{}).Where("login = ? OR lower(email) = ?", login, email).Count(&existing).Error; err != nil {
+				return err
+			}
+			if existing > 0 {
+				return errors.New("cabana: admin already exists")
+			}
+			hash, err := bouncer.HashPassword(adminBcryptCost(app), password)
+			if err != nil {
+				return err
+			}
+			now := time.Now().UTC()
+			user := BackendUser{
+				Login:       login,
+				Email:       email,
+				Password:    hash,
+				IsActivated: true,
+				IsSuperuser: superuser,
+				RoleID:      roleID,
+				ActivatedAt: &now,
+			}
+			if err := tx.Create(&user).Error; err != nil {
+				return err
+			}
+			out.Success(fmt.Sprintf("created admin %s <%s>", user.Login, user.Email))
+			return nil
+		})
+	})
+}
+
+func adminResetPassword(ctx context.Context, app *backpack.App, in bonfire.Input, out bonfire.Output) error {
+	identifier := ""
+	if value, ok := in.Argument("identifier"); ok {
+		identifier = strings.TrimSpace(value)
+	}
+	if identifier == "" && len(in.Args()) > 0 {
+		identifier = strings.TrimSpace(in.Args()[0])
+	}
+	password := flagValue(in, "password")
+	if identifier == "" || strings.TrimSpace(password) == "" {
+		return errors.New("cabana: identifier and password are required")
+	}
+	return withAdminDB(ctx, app, func(gdb *gorm.DB) error {
+		return gdb.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+			var users []BackendUser
+			err := tx.Where("login = ? OR lower(email) = ?", identifier, strings.ToLower(identifier)).Find(&users).Error
+			if err != nil {
+				return err
+			}
+			if len(users) == 0 {
+				return errors.New("cabana: admin not found")
+			}
+			if len(users) > 1 {
+				return errors.New("cabana: ambiguous admin")
+			}
+			hash, err := bouncer.HashPassword(adminBcryptCost(app), password)
+			if err != nil {
+				return err
+			}
+			cutoff := time.Now().UTC().Add(time.Second)
+			if err := tx.Model(&BackendUser{}).Where("id = ?", users[0].ID).Updates(map[string]any{
+				"password":           hash,
+				"tokens_valid_after": cutoff,
+			}).Error; err != nil {
+				return err
+			}
+			out.Success(fmt.Sprintf("reset password for %s", users[0].Login))
+			return nil
+		})
+	})
+}
+
+func roleIDByCode(tx *gorm.DB, code string) (*uint, error) {
+	if code == "" {
+		return nil, nil
+	}
+	var ids []uint
+	if err := tx.Model(&BackendUserRole{}).Where("code = ?", code).Pluck("id", &ids).Error; err != nil {
+		return nil, err
+	}
+	switch len(ids) {
+	case 0:
+		return nil, fmt.Errorf("cabana: unknown role %q", code)
+	case 1:
+		return &ids[0], nil
+	default:
+		return nil, fmt.Errorf("cabana: ambiguous role %q", code)
+	}
+}
+
+func flagValue(in bonfire.Input, name string) string {
+	if in == nil {
+		return ""
+	}
+	value, _ := in.Flag(name)
+	return value
+}
+
+func withAdminDB(ctx context.Context, app *backpack.App, fn func(*gorm.DB) error) error {
+	if app == nil {
+		return errors.New("cabana: app is nil")
+	}
+	if gdb, ok := app.Lookup[*gorm.DB](); ok && gdb != nil {
+		return fn(gdb)
+	}
+	sqlDB, gdb, err := lagoon.OpenFromApp(ctx, app)
+	if err != nil {
+		return err
+	}
+	defer sqlDB.Close()
+	if err := lagoon.Publish(app, sqlDB, gdb); err != nil {
+		return err
+	}
+	return fn(gdb)
 }