feat(cli): add a lightweight `hikctl db init` instead of pointing operators at full host provisioning #41

New issue

Closed

opened 2026-09-21 18:18:32 +00:00 by gabogg · 1 comment

gabogg commented

2026-09-21 18:18:32 +00:00

Owner

Context

Follow-up from the code review of #39 (comment #issuecomment-884). Non-blocking; #39 merged with this known.

#39 originally called init_db() at the top of every hikctl user command. That was removed because init_db() carries side effects well beyond schema creation — it seeds default-credential accounts and resets exclude_from_rankings on verified-sensor doors. The replacement catches sqlite3.OperationalError and prints:

Database is not initialized. Run 'hikctl setup' to initialize the database.

app/cli/commands/cmd_user.py:212-214

Problem

That guidance works but is disproportionate. init_db() is reachable only from app/main.py:35 (the FastAPI lifespan), so the shortest supported route to "create my schema" is hikctl setup, which also runs host diagnostics, creates a virtualenv, writes .env, sets directory ACLs, configures the firewall, registers a system service and starts it (app/cli/commands/cmd_setup.py:45-215).

An operator who only wants to provision the first admin account on a fresh box has to run full host provisioning to get there.

Proposed solution

Add a narrow hikctl db init (or similar) that creates the schema and nothing else, and point the error message at it. Keep the seeding and flag-cleanup side effects out of that path, or make them explicit opt-ins (--seed-defaults), so the two problems fixed in #39 cannot return through a different door.

Acceptance criteria

A CLI command creates the SQLite schema without seeding default accounts and without mutating door_records.
cmd_user.py's uninitialized-database message names that command.
Test covering: fresh DB -> new command -> hikctl user add succeeds.
Regression tests from #39 (test_user_command_does_not_resurrect_deleted_user, test_user_command_does_not_wipe_door_exclusions) still pass.

## Context Follow-up from the code review of #39 (comment [#issuecomment-884](https://git.gaboggamer.online/gabogg/hikcentral/pulls/39#issuecomment-884)). Non-blocking; #39 merged with this known. #39 originally called `init_db()` at the top of every `hikctl user` command. That was removed because `init_db()` carries side effects well beyond schema creation — it seeds default-credential accounts and resets `exclude_from_rankings` on verified-sensor doors. The replacement catches `sqlite3.OperationalError` and prints: > Database is not initialized. Run 'hikctl setup' to initialize the database. `app/cli/commands/cmd_user.py:212-214` ## Problem That guidance works but is disproportionate. `init_db()` is reachable only from `app/main.py:35` (the FastAPI lifespan), so the shortest supported route to "create my schema" is `hikctl setup`, which also runs host diagnostics, creates a virtualenv, writes `.env`, sets directory ACLs, configures the firewall, registers a system service and starts it (`app/cli/commands/cmd_setup.py:45-215`). An operator who only wants to provision the first admin account on a fresh box has to run full host provisioning to get there. ## Proposed solution Add a narrow `hikctl db init` (or similar) that creates the schema and nothing else, and point the error message at it. Keep the seeding and flag-cleanup side effects out of that path, or make them explicit opt-ins (`--seed-defaults`), so the two problems fixed in #39 cannot return through a different door. ## Acceptance criteria - [ ] A CLI command creates the SQLite schema without seeding default accounts and without mutating `door_records`. - [ ] `cmd_user.py`'s uninitialized-database message names that command. - [ ] Test covering: fresh DB -> new command -> `hikctl user add` succeeds. - [ ] Regression tests from #39 (`test_user_command_does_not_resurrect_deleted_user`, `test_user_command_does_not_wipe_door_exclusions`) still pass.

gabogg added the

needs-triage

label

2026-09-21 18:18:32 +00:00

~~gabogg referenced this issue 2026-09-21 18:35:05 +00:00~~

feat(cli): lightweight db init, credential hygiene, and persistent door exclusions (#41, #43, #48) #45

gabogg referenced this issue

2026-09-21 18:54:41 +00:00

feat(cli): lightweight db init, credential hygiene, and persistent door exclusions (#41, #43, #48) #45

gabogg referenced this issue

2026-09-21 19:41:30 +00:00

feat(cli): lightweight db init, credential hygiene, and persistent door exclusions (#41, #43, #48) #45