Initial curated Unraid-AppOps-Gateway source from 3bd6f6fee310125bfbb4d4650389a817f498724d

backend/app/services/controller_bootstrap_import.py

@@ -0,0 +1,35 @@
+"""Write-only import of the fixed controller enrollment bootstrap credential."""
+
+from __future__ import annotations
+
+import json
+import sys
+
+from sqlmodel import Session
+
+from ..db.session import engine
+from .repopulse_secret_import import (
+    BOOTSTRAP_SECRET_REF,
+    MAX_SECRET_BYTES,
+    import_controller_bootstrap,
+)
+
+
+def main() -> int:
+    raw = sys.stdin.buffer.read(MAX_SECRET_BYTES + 1)
+    if len(raw) > MAX_SECRET_BYTES:
+        print(json.dumps({"status": "blocked", "reason": "credential input too large"}))
+        return 2
+    try:
+        token = raw.decode("utf-8")
+        with Session(engine) as session:
+            outcome = import_controller_bootstrap(session, token)
+    except (UnicodeDecodeError, ValueError):
+        print(json.dumps({"status": "blocked", "reason": "credential import rejected"}))
+        return 2
+    print(json.dumps({"status": outcome, "secretRef": BOOTSTRAP_SECRET_REF}))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())