adapt-server 0.2.3__tar.gz → 0.2.5__tar.gz

{adapt_server-0.2.3 → adapt_server-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adapt-server
-Version: 0.2.3
+Version: 0.2.5
 Summary: Adaptive file-backed FastAPI server that turns datasets into CRUD APIs and UIs.
 Author-email: notesofcliff <notesofcliff@gmail.com>
 License-Expression: MIT
@@ -21,7 +21,7 @@ Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: fastapi
+Requires-Dist: fastapi>=0.115
 Requires-Dist: uvicorn
 Requires-Dist: sqlmodel
 Requires-Dist: pendulum
@@ -36,6 +36,7 @@ Requires-Dist: pillow
 Requires-Dist: python-json-logger
 Requires-Dist: pandas
 Requires-Dist: fastparquet
+Requires-Dist: mcp<2,>=1.28
 Provides-Extra: dev
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: httpx; extra == "dev"
@@ -51,6 +52,8 @@ Adapt is a FastAPI server that turns files in a directory into APIs and UIs.
 - Markdown/HTML become browsable pages
 - Media files become streaming endpoints and player/gallery UIs
 - Python files can register custom routers
+- Everything is searchable in one place via full-text `/search`
+- Everything is reachable by agentic tools via an MCP server at `/mcp`
 
 ## Quick Start
 
@@ -81,6 +84,8 @@ Useful URLs:
 - `/api/<resource>` resource API
 - `/ui/<resource>` resource UI
 - `/schema/<resource>` resource schema
+- `/search` full-text search across every resource you can read
+- `/mcp` MCP server for agentic tools (see [MCP Interface](#mcp-interface) below)
 
 ## What Adapt Generates
 
@@ -135,6 +140,75 @@ This reflects the current implementation in the codebase.
 - Caching with invalidation on mutations
 - Built-in admin UI for users/groups/permissions/locks/cache/api keys/audit logs
 - Plugin architecture with companion overrides in `.adapt/`
+- Permission-filtered full-text search across every resource type
+- MCP server for agentic tool access, mounted alongside the REST API
+
+## Full-Text Search
+
+`GET /search?q=<query>` searches datasets, Markdown, HTML, and media metadata
+in one ranked list, filtered to what the caller may read — a query term that
+matches a resource you can't see never shows up, and never leaks via the
+result count either.
+
+```bash
+curl -H "X-API-Key: <key>" "http://localhost:8000/search?q=parental+leave"
+```
+
+The index refreshes incrementally on startup (`search_on_startup`, default
+`true`) and can be rebuilt on demand with `adapt reindex <root>`. See the
+[API Reference](docs/manual/api_reference.md#search-endpoint) for query
+parameters and result shape.
+
+## MCP Interface
+
+Adapt mounts a [Model Context Protocol](https://modelcontextprotocol.io)
+server at `/mcp`, on the same host/port as everything else, exposing five
+tools that wrap the same permission checks and plugin methods as the REST
+API — `list_resources`, `get_schema`, `read_resource`, `write_resource`, and
+`search`. There's no separate process, no separate API surface, and no
+extra permission model to maintain.
+
+Minimal walkthrough — create an account for the agent, grant it read access,
+mint an API key, and connect a client:
+
+```bash
+adapt addsuperuser /path/to/docroot --username admin
+adapt serve /path/to/docroot &
+
+adapt admin create-permissions /path/to/docroot __all__
+adapt admin create-user /path/to/docroot --username agent --password <strong-password>
+adapt admin add-to-group /path/to/docroot --username agent --group <resource>_readonly
+```
+
+Log in as `agent` and self-issue an API key from `/profile` (any
+authenticated user can create their own key — no superuser needed), then
+point a client at `/mcp` with that key:
+
+```bash
+# Claude Code CLI
+claude mcp add --transport http adapt http://localhost:8000/mcp \
+  --header "X-API-Key: <key>"
+```
+
+```json
+// Generic MCP client config (Claude Desktop and similar)
+{
+  "mcpServers": {
+    "adapt": {
+      "url": "http://localhost:8000/mcp",
+      "headers": { "X-API-Key": "<key>" }
+    }
+  }
+}
+```
+
+MCP requires an API key on every call — there's no session-cookie or
+anonymous path, since MCP has no concept of a browser session. Set
+`mcp_enabled: false` in `.adapt/conf.json` (or `ADAPT_MCP_ENABLED=false`) to
+remove `/mcp` entirely. Full walkthrough, troubleshooting, and the tool
+reference table: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md).
+For dataset reads, `sort` is the column name and `order` must be `asc` or
+`desc`.
 
 ## Dataset Mutation Envelope
 
@@ -156,6 +230,7 @@ adapt serve <root> [--host ... --port ... --tls-cert ... --tls-key ... --reload
 adapt check <root>
 adapt addsuperuser <root> --username <name>
 adapt list-endpoints <root>
+adapt reindex <root> [--force]
 adapt admin list-resources <root>
 adapt admin create-permissions <root> __all__
 ```
@@ -169,6 +244,7 @@ Detailed docs live under `docs/manual/`.
 - Quick start: [docs/manual/quick_start.md](docs/manual/quick_start.md)
 - Configuration: [docs/manual/configuration.md](docs/manual/configuration.md)
 - API reference: [docs/manual/api_reference.md](docs/manual/api_reference.md)
+- MCP guide: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md)
 - Plugin development: [docs/manual/plugin_development.md](docs/manual/plugin_development.md)
 
 ## License

{adapt_server-0.2.3 → adapt_server-0.2.5}/README.md

@@ -6,6 +6,8 @@ Adapt is a FastAPI server that turns files in a directory into APIs and UIs.
 - Markdown/HTML become browsable pages
 - Media files become streaming endpoints and player/gallery UIs
 - Python files can register custom routers
+- Everything is searchable in one place via full-text `/search`
+- Everything is reachable by agentic tools via an MCP server at `/mcp`
 
 ## Quick Start
 
@@ -36,6 +38,8 @@ Useful URLs:
 - `/api/<resource>` resource API
 - `/ui/<resource>` resource UI
 - `/schema/<resource>` resource schema
+- `/search` full-text search across every resource you can read
+- `/mcp` MCP server for agentic tools (see [MCP Interface](#mcp-interface) below)
 
 ## What Adapt Generates
 
@@ -90,6 +94,75 @@ This reflects the current implementation in the codebase.
 - Caching with invalidation on mutations
 - Built-in admin UI for users/groups/permissions/locks/cache/api keys/audit logs
 - Plugin architecture with companion overrides in `.adapt/`
+- Permission-filtered full-text search across every resource type
+- MCP server for agentic tool access, mounted alongside the REST API
+
+## Full-Text Search
+
+`GET /search?q=<query>` searches datasets, Markdown, HTML, and media metadata
+in one ranked list, filtered to what the caller may read — a query term that
+matches a resource you can't see never shows up, and never leaks via the
+result count either.
+
+```bash
+curl -H "X-API-Key: <key>" "http://localhost:8000/search?q=parental+leave"
+```
+
+The index refreshes incrementally on startup (`search_on_startup`, default
+`true`) and can be rebuilt on demand with `adapt reindex <root>`. See the
+[API Reference](docs/manual/api_reference.md#search-endpoint) for query
+parameters and result shape.
+
+## MCP Interface
+
+Adapt mounts a [Model Context Protocol](https://modelcontextprotocol.io)
+server at `/mcp`, on the same host/port as everything else, exposing five
+tools that wrap the same permission checks and plugin methods as the REST
+API — `list_resources`, `get_schema`, `read_resource`, `write_resource`, and
+`search`. There's no separate process, no separate API surface, and no
+extra permission model to maintain.
+
+Minimal walkthrough — create an account for the agent, grant it read access,
+mint an API key, and connect a client:
+
+```bash
+adapt addsuperuser /path/to/docroot --username admin
+adapt serve /path/to/docroot &
+
+adapt admin create-permissions /path/to/docroot __all__
+adapt admin create-user /path/to/docroot --username agent --password <strong-password>
+adapt admin add-to-group /path/to/docroot --username agent --group <resource>_readonly
+```
+
+Log in as `agent` and self-issue an API key from `/profile` (any
+authenticated user can create their own key — no superuser needed), then
+point a client at `/mcp` with that key:
+
+```bash
+# Claude Code CLI
+claude mcp add --transport http adapt http://localhost:8000/mcp \
+  --header "X-API-Key: <key>"
+```
+
+```json
+// Generic MCP client config (Claude Desktop and similar)
+{
+  "mcpServers": {
+    "adapt": {
+      "url": "http://localhost:8000/mcp",
+      "headers": { "X-API-Key": "<key>" }
+    }
+  }
+}
+```
+
+MCP requires an API key on every call — there's no session-cookie or
+anonymous path, since MCP has no concept of a browser session. Set
+`mcp_enabled: false` in `.adapt/conf.json` (or `ADAPT_MCP_ENABLED=false`) to
+remove `/mcp` entirely. Full walkthrough, troubleshooting, and the tool
+reference table: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md).
+For dataset reads, `sort` is the column name and `order` must be `asc` or
+`desc`.
 
 ## Dataset Mutation Envelope
 
@@ -111,6 +184,7 @@ adapt serve <root> [--host ... --port ... --tls-cert ... --tls-key ... --reload
 adapt check <root>
 adapt addsuperuser <root> --username <name>
 adapt list-endpoints <root>
+adapt reindex <root> [--force]
 adapt admin list-resources <root>
 adapt admin create-permissions <root> __all__
 ```
@@ -124,6 +198,7 @@ Detailed docs live under `docs/manual/`.
 - Quick start: [docs/manual/quick_start.md](docs/manual/quick_start.md)
 - Configuration: [docs/manual/configuration.md](docs/manual/configuration.md)
 - API reference: [docs/manual/api_reference.md](docs/manual/api_reference.md)
+- MCP guide: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md)
 - Plugin development: [docs/manual/plugin_development.md](docs/manual/plugin_development.md)
 
 ## License

{adapt_server-0.2.3 → adapt_server-0.2.5}/adapt/__init__.py

@@ -1,3 +1,3 @@
 """Adapt package namespace."""
 
-__version__ = "0.2.3"
+__version__ = "0.2.5"

{adapt_server-0.2.3 → adapt_server-0.2.5}/adapt/admin/ui.py

@@ -30,4 +30,4 @@ def admin_ui(request: Request):
 
     # Serve the admin template
     logger.debug("Rendering admin UI for superuser %s", user.username)
-    return request.app.state.templates.TemplateResponse("admin/index.html", context)
+    return request.app.state.templates.TemplateResponse(request, "admin/index.html", context)

{adapt_server-0.2.3 → adapt_server-0.2.5}/adapt/app.py

@@ -12,7 +12,6 @@ from fastapi.openapi.docs import get_swagger_ui_html, get_swagger_ui_oauth2_redi
 from fastapi.openapi.utils import get_openapi
 from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi.middleware.trustedhost import TrustedHostMiddleware
-from fastapi.routing import APIRoute
 from fastapi.staticfiles import StaticFiles
 from fastapi.templating import Jinja2Templates
 from sqlmodel import Session, select, delete
@@ -25,11 +24,13 @@ from .admin import router as admin_router
 from .config import AdaptConfig
 from .discovery import discover_resources
 from .permissions import PermissionChecker
-from .routes import generate_routes
+from .routes import build_resource_registry, generate_routes, resource_namespaces as _routes_resource_namespaces
+from .routes_search import router as search_router, safe_snippet
 from .storage import User, DBSession, init_database
 from .locks import LockManager
+from .mcp import build_mcp_server
 from .utils import build_accessible_ui_links
-from . import cache
+from . import cache, search
 from .security import (
     apply_security_headers,
     build_allowed_hosts,
@@ -45,7 +46,7 @@ logger = logging.getLogger(__name__)
 
 _DOCS_INTERNAL_PATHS = frozenset({"/docs", "/docs/", "/docs/oauth2-redirect", "/openapi.json"})
 _PUBLIC_OPENAPI_PATHS = frozenset({"/", "/auth/login", "/health"})
-_AUTHENTICATED_OPENAPI_PATHS = frozenset({"/auth/logout", "/auth/me", "/profile", "/api/apikeys"})
+_AUTHENTICATED_OPENAPI_PATHS = frozenset({"/auth/logout", "/auth/me", "/profile", "/api/apikeys", "/search"})
 
 
 async def cleanup_expired_sessions(engine, interval_hours=24):
@@ -72,13 +73,7 @@ def _normalize_path(path: str) -> str:
 
 def _resource_namespaces(resource) -> set[str]:
     """Return the supported permission namespaces for a discovered resource."""
-    namespace_no_ext = resource.relative_path.with_suffix("").as_posix()
-    namespace_with_ext = resource.relative_path.as_posix()
-    if "sub_namespace" in resource.metadata:
-        suffix = f"/{resource.metadata['sub_namespace']}"
-        namespace_no_ext += suffix
-        namespace_with_ext += suffix
-    return {namespace_no_ext, namespace_with_ext}
+    return set(_routes_resource_namespaces(resource))
 
 
 def _all_resource_namespaces(resources) -> set[str]:
@@ -125,14 +120,14 @@ def _extract_resource_namespace(path: str, all_namespaces: set[str]) -> str | No
     return None
 
 
-def _route_is_visible(route: APIRoute, request: Request, user: User | None, all_namespaces: set[str], visible_namespaces: set[str]) -> bool:
-    """Decide whether a route should appear in the current request's OpenAPI schema."""
-    path = _normalize_path(route.path)
+def _operation_is_visible(path: str, operation: dict, request: Request, user: User | None, all_namespaces: set[str], visible_namespaces: set[str]) -> bool:
+    """Decide whether an OpenAPI operation should appear in the current request's schema."""
+    path = _normalize_path(path)
 
     if path in _DOCS_INTERNAL_PATHS:
         return False
 
-    if path.startswith("/admin") or "admin" in (route.tags or []):
+    if path.startswith("/admin") or "admin" in (operation.get("tags") or []):
         return bool(user and getattr(user, "is_superuser", False))
 
     if path in _PUBLIC_OPENAPI_PATHS:
@@ -160,24 +155,73 @@ def _route_is_visible(route: APIRoute, request: Request, user: User | None, all_
     return False
 
 
+def _iter_schema_refs(node):
+    """Yield component schema names referenced anywhere within a JSON-like node."""
+    if isinstance(node, dict):
+        ref = node.get("$ref")
+        if isinstance(ref, str) and ref.startswith("#/components/schemas/"):
+            yield ref.removeprefix("#/components/schemas/")
+        for value in node.values():
+            yield from _iter_schema_refs(value)
+    elif isinstance(node, list):
+        for item in node:
+            yield from _iter_schema_refs(item)
+
+
+def _prune_unreferenced_components(schema: dict) -> None:
+    """Drop component schemas no longer reachable from any kept path.
+
+    Filtering removes paths but leaves their request/response models behind in
+    components.schemas — a non-superuser would otherwise receive the
+    field-level shape of admin-only models like UserPublic or Permission.
+    """
+    components = schema.get("components") or {}
+    schemas = components.get("schemas")
+    if not schemas:
+        return
+
+    reachable: set[str] = set()
+    pending = set(_iter_schema_refs(schema.get("paths", {})))
+    while pending:
+        name = pending.pop()
+        if name in reachable:
+            continue
+        reachable.add(name)
+        pending.update(_iter_schema_refs(schemas.get(name, {})))
+
+    pruned = {name: definition for name, definition in schemas.items() if name in reachable}
+    if pruned:
+        components["schemas"] = pruned
+    else:
+        components.pop("schemas", None)
+    if not components:
+        schema.pop("components", None)
+
+
 def _build_openapi_schema(app: FastAPI, request: Request, user: User | None) -> dict:
     """Build a filtered OpenAPI schema for the current request context."""
-    all_namespaces = _all_resource_namespaces(request.app.state.resources)
-    visible_namespaces = _visible_resource_namespaces(request, user)
-    visible_routes = [
-        route
-        for route in app.routes
-        if isinstance(route, APIRoute)
-        and route.include_in_schema
-        and _route_is_visible(route, request, user, all_namespaces, visible_namespaces)
-    ]
-
-    return get_openapi(
+    schema = get_openapi(
         title=app.title,
         version=app.version,
         description=app.description,
-        routes=visible_routes,
+        routes=app.routes,
     )
+    all_namespaces = _all_resource_namespaces(request.app.state.resources)
+    visible_namespaces = _visible_resource_namespaces(request, user)
+
+    visible_paths: dict[str, dict] = {}
+    for path, operations in schema.get("paths", {}).items():
+        kept = {
+            method: operation
+            for method, operation in operations.items()
+            if _operation_is_visible(path, operation, request, user, all_namespaces, visible_namespaces)
+        }
+        if kept:
+            visible_paths[path] = kept
+
+    schema["paths"] = visible_paths
+    _prune_unreferenced_components(schema)
+    return schema
 
 
 def _visible_resource_paths(request: Request, user: User | None) -> list[str]:
@@ -192,14 +236,25 @@ def _visible_resource_paths(request: Request, user: User | None) -> list[str]:
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    """Handle application startup and shutdown events."""
+    """Handle application startup and shutdown events.
+
+    A mounted MCP sub-app's own `lifespan` is never invoked by the ASGI
+    server: Starlette's `Mount` only forwards `http`/`websocket` scope types,
+    never `lifespan`. So the MCP session manager's `run()` context must be
+    entered here, alongside the rest of this app's own startup/shutdown.
+    """
     # Startup: Start background cleanup task
     engine = app.state.db_engine
     cleanup_task = asyncio.create_task(cleanup_expired_sessions(engine))
     logger.debug("Application startup: background cleanup task started")
-    
-    yield
-    
+
+    mcp_server = getattr(app.state, "mcp_server", None)
+    if mcp_server is not None:
+        async with mcp_server.session_manager.run():
+            yield
+    else:
+        yield
+
     # Shutdown: Could add cleanup logic here if needed
     cleanup_task.cancel()
     try:
@@ -219,12 +274,16 @@ def _init_infrastructure(config: AdaptConfig):
     """
     engine = init_database(config.db_path)
     cache.configure(str(config.db_path))
+    search.configure(str(config.db_path))
     lock_manager = LockManager(engine)
     cleaned = lock_manager.release_stale_locks(max_age_seconds=300)
     if cleaned > 0:
         logging.warning("Cleaned %d stale locks on startup", cleaned)
     resources = discover_resources(config.root, config)
     logger.debug("Discovered %d resources", len(resources))
+    if config.search_on_startup:
+        # Incremental: unchanged files are skipped, so restarts stay cheap.
+        search.reindex_all(resources, config)
     return engine, lock_manager, resources
 
 
@@ -246,6 +305,7 @@ def create_app(config: AdaptConfig) -> FastAPI:
     app.state.use_tls = bool(config.tls_cert and config.tls_key)
     app.state.lock_manager = lock_manager
     app.state.resources = resources
+    app.state.resource_registry = build_resource_registry(resources, config)
 
     allowed_hosts = build_allowed_hosts(config.host)
     if allowed_hosts != ["*"]:
@@ -254,6 +314,9 @@ def create_app(config: AdaptConfig) -> FastAPI:
     # Set up Jinja2 templates
     templates_dir = Path(__file__).parent / "templates"
     templates = Jinja2Templates(directory=str(templates_dir))
+    # Search snippets hold raw docroot text; this escapes them and restores only
+    # the <mark> highlights. See routes_search.safe_snippet.
+    templates.env.filters["safe_snippet"] = safe_snippet
     app.state.templates = templates
 
     # Mount static files
@@ -310,8 +373,32 @@ def create_app(config: AdaptConfig) -> FastAPI:
     # Mount admin routes
     app.include_router(admin_router)
 
+    # Mount search routes
+    app.include_router(search_router)
+
     # Generate and mount routes
-    generate_routes(app, resources, config)
+    generate_routes(app, app.state.resource_registry)
+
+    # Mount the MCP server, exposing resources as agent-facing tools
+    if config.mcp_enabled:
+        mcp_server = build_mcp_server(config)
+        mcp_app = mcp_server.streamable_http_app()
+        # A mounted sub-app's `request.app` is itself, not the main app (see
+        # lifespan() docstring for the related lifespan gotcha) — mirror the
+        # slice of state every tool/helper needs onto it.
+        mcp_app.state.db_engine = engine
+        mcp_app.state.resources = resources
+        mcp_app.state.config = config
+        mcp_app.state.lock_manager = lock_manager
+        mcp_app.state.resource_registry = app.state.resource_registry
+        # The outer app's own middleware still runs for /mcp requests (it wraps
+        # routing, including the Mount), and by the time it inspects
+        # `request.app.state` post-routing, `scope["app"]` has already been
+        # overwritten to `mcp_app` — so anything that middleware reads off
+        # app.state must be mirrored here too, not just what the tools need.
+        mcp_app.state.use_tls = app.state.use_tls
+        app.state.mcp_server = mcp_server
+        app.mount("/mcp", mcp_app)
 
     @app.get("/openapi.json", include_in_schema=False)
     def openapi_schema(request: Request):

{adapt_server-0.2.3 → adapt_server-0.2.5}/adapt/cache.py

@@ -8,12 +8,22 @@ import threading
 import logging
 from datetime import datetime, timedelta, timezone
 import pickle
+from pathlib import Path
 
 logger = logging.getLogger(__name__)
 
 CACHE_TABLE = "cache"
-_lock = threading.Lock()
+_lock = threading.RLock()
 _db_path: str | None = None
+_CREATE_CACHE_TABLE_SQL = f"""
+    CREATE TABLE IF NOT EXISTS {CACHE_TABLE} (
+        key TEXT PRIMARY KEY,
+        value BLOB,
+        expires_at DATETIME,
+        resource TEXT,
+        user TEXT
+    )
+"""
 
 
 def _default_db_path() -> str:
@@ -35,24 +45,22 @@ def configure(db_path: str | None) -> None:
 def _get_conn():
     """Get a SQLite connection to the cache database."""
     path = _db_path or _default_db_path()
+    Path(path).parent.mkdir(parents=True, exist_ok=True)
     conn = sqlite3.connect(path, check_same_thread=False)
     conn.row_factory = sqlite3.Row
+    _ensure_cache_table(conn)
     return conn
 
+
+def _ensure_cache_table(conn: sqlite3.Connection) -> None:
+    """Ensure the cache table exists for the active database connection."""
+    conn.execute(_CREATE_CACHE_TABLE_SQL)
+    conn.commit()
+
 def init_cache_table():
     """Initialize the cache table in the SQLite database."""
     with _lock:
         conn = _get_conn()
-        conn.execute(f"""
-            CREATE TABLE IF NOT EXISTS {CACHE_TABLE} (
-                key TEXT PRIMARY KEY,
-                value BLOB,
-                expires_at DATETIME,
-                resource TEXT,
-                user TEXT
-            )
-        """)
-        conn.commit()
         conn.close()
     logger.debug("Cache table initialized")
 

{adapt_server-0.2.3 → adapt_server-0.2.5}/adapt/cli.py

@@ -7,7 +7,7 @@ import logging.config
 from pathlib import Path
 
 from .config import AdaptConfig
-from .commands import check, addsuperuser, list_endpoints, serve
+from .commands import check, addsuperuser, list_endpoints, reindex, serve
 from .commands.admin import run_admin
 
 logger = logging.getLogger(__name__)
@@ -36,10 +36,20 @@ def main() -> None:
     user_parser.add_argument("root", nargs="?", default=".", help="Document root containing the SQLite store")
     user_parser.add_argument("--username", required=True, help="Username for the superuser")
     user_parser.add_argument("--password", help="Password (will prompt if missing)")
+    user_parser.add_argument("--password-confirm", help="Password confirmation for non-interactive use")
+    user_parser.add_argument(
+        "--allow-weak-password",
+        action="store_true",
+        help="Allow a weak password without the safety confirmation prompt",
+    )
 
     list_parser = subparsers.add_parser("list-endpoints", help="List the auto-generated REST/UI endpoints")
     list_parser.add_argument("root", nargs="?", default=".", help="Document root to inspect")
 
+    reindex_parser = subparsers.add_parser("reindex", help="Rebuild the full-text search index")
+    reindex_parser.add_argument("root", nargs="?", default=".", help="Document root to index")
+    reindex_parser.add_argument("--force", action="store_true", help="Reindex even unchanged files")
+
     admin_parser = subparsers.add_parser("admin", help="Admin tasks")
     admin_subparsers = admin_parser.add_subparsers(dest="admin_command", required=True)
     admin_list_resources_parser = admin_subparsers.add_parser("list-resources", help="List discovered resources")
@@ -61,6 +71,12 @@ def main() -> None:
     admin_create_user_parser.add_argument("root", nargs="?", default=".", help="Document root")
     admin_create_user_parser.add_argument("--username", required=True, help="Username")
     admin_create_user_parser.add_argument("--password", help="Password (will prompt if missing)")
+    admin_create_user_parser.add_argument("--password-confirm", help="Password confirmation for non-interactive use")
+    admin_create_user_parser.add_argument(
+        "--allow-weak-password",
+        action="store_true",
+        help="Allow a weak password without the safety confirmation prompt",
+    )
     admin_create_user_parser.add_argument("--superuser", action="store_true", help="Create as superuser")
 
     admin_delete_user_parser = admin_subparsers.add_parser("delete-user", help="Delete user")
@@ -112,10 +128,19 @@ def main() -> None:
         check.run_check(Path(args.root).resolve())
     elif args.command == "addsuperuser":
         logger.info("Running addsuperuser command for username=%s", args.username)
-        addsuperuser.run_add_superuser(Path(args.root).resolve(), args.username, args.password)
+        addsuperuser.run_add_superuser(
+            Path(args.root).resolve(),
+            args.username,
+            args.password,
+            password_confirm=args.password_confirm,
+            allow_weak_password=args.allow_weak_password,
+        )
     elif args.command == "list-endpoints":
         logger.info("Running list-endpoints command with root=%s", args.root)
         list_endpoints.run_list_endpoints(Path(args.root).resolve())
+    elif args.command == "reindex":
+        logger.info("Running reindex command with root=%s force=%s", args.root, args.force)
+        reindex.run_reindex(Path(args.root).resolve(), force=args.force)
     elif args.command == "admin":
         logger.info("Running admin command: %s", args.admin_command)
         run_admin(args)

{adapt_server-0.2.3 → adapt_server-0.2.5}/adapt/commands/addsuperuser.py

@@ -1,4 +1,3 @@
-import getpass
 from pathlib import Path
 import logging
 
@@ -7,17 +6,26 @@ from sqlmodel import Session, select
 from ..config import AdaptConfig
 from ..storage import User, init_database
 from ..auth.password import hash_password
+from .passwords import resolve_password
 
 logger = logging.getLogger(__name__)
 
 
-def run_add_superuser(root: Path, username: str, password: str | None) -> None:
+def run_add_superuser(
+    root: Path,
+    username: str,
+    password: str | None,
+    password_confirm: str | None = None,
+    allow_weak_password: bool = False,
+) -> None:
     """Create a new superuser account.
 
     Args:
         root: The root directory path for the Adapt configuration.
         username: The username for the new superuser.
         password: The password for the new superuser. If None, prompts for input.
+        password_confirm: Confirmation for non-interactive password entry.
+        allow_weak_password: Allow weak passwords without an interactive override prompt.
 
     Returns:
         None
@@ -27,8 +35,15 @@ def run_add_superuser(root: Path, username: str, password: str | None) -> None:
     """
     config = AdaptConfig(root=root)
     engine = init_database(config.db_path)
+    password = resolve_password(
+        username=username,
+        password=password,
+        password_confirm=password_confirm,
+        allow_weak_password=allow_weak_password,
+    )
     if password is None:
-        password = getpass.getpass("Password: ")
+        logger.warning("Aborted superuser creation for %s due to password validation", username)
+        return
 
     hashed = hash_password(password)
     logger.debug("Hashed password for user %s", username)
@@ -43,4 +58,4 @@ def run_add_superuser(root: Path, username: str, password: str | None) -> None:
         session.add(user)
         session.commit()
         logger.info("Created superuser '%s'", username)
-        print(f"Created superuser '{username}'")
+        print(f"Created superuser '{username}'")