From 738440cf7115e026ed4d8e1507b5a7a8d6723b5f Mon Sep 17 00:00:00 2001
From: Evan Blaudy <evan@cg-wire.com>
Date: Wed, 31 Jul 2024 17:09:10 +0200
Subject: [PATCH] [cli] for create-admin command allow to bypass protected
 accounts

---
 zou/app/services/persons_service.py |  7 +++++--
 zou/cli.py                          | 12 ++++++++++--
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/zou/app/services/persons_service.py b/zou/app/services/persons_service.py
index 016e7ae4e0..8c777c3ca2 100644
--- a/zou/app/services/persons_service.py
+++ b/zou/app/services/persons_service.py
@@ -276,12 +276,15 @@ def update_password(email, password):
     return person.serialize()
 
 
-def update_person(person_id, data):
+def update_person(person_id, data, bypass_protected_accounts=False):
     """
     Update person entry with data given in parameter.
     """
     person = Person.get(person_id)
-    if person.email in config.PROTECTED_ACCOUNTS:
+    if (
+        not bypass_protected_accounts
+        and person.email in config.PROTECTED_ACCOUNTS
+    ):
         message = None
         if data.get("active") is False:
             message = (
diff --git a/zou/cli.py b/zou/cli.py
index 60ae91f07d..4fdbfe3d5f 100755
--- a/zou/cli.py
+++ b/zou/cli.py
@@ -140,7 +140,7 @@ def reset_migrations():
 
 @cli.command()
 @click.argument("email")
-@click.option("--password", required=True)
+@click.option("--password", default=None)
 def create_admin(email, password):
     """
     Create an admin user to allow usage of the API when database is empty.
@@ -149,10 +149,18 @@ def create_admin(email, password):
         try:
             person = persons_service.get_person_by_email(email)
             if person["role"] != "admin":
-                persons_service.update_person(person["id"], {"role": "admin"})
+                persons_service.update_person(
+                    person["id"],
+                    {"role": "admin"},
+                    bypass_protected_accounts=True,
+                )
                 print("Existing user's role has been upgraded to 'admin'.")
         except PersonNotFoundException:
             try:
+                if password is None:
+                    raise click.MissingParameter(
+                        param_type="option", param_hint="--password"
+                    )
                 auth.validate_password(password)
                 # Allow "admin@example.com" to be invalid.
                 if email != "admin@example.com":