Use password hashes for authentication

scripts/manage_users.py

@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""
+Create password hashes or user config snippets for RollCalc Basic Auth users.
+"""
+
+import argparse
+import getpass
+import json
+
+from werkzeug.security import generate_password_hash
+
+
+def build_parser():
+    parser = argparse.ArgumentParser(
+        description="Generate RollCalc password hashes or user config entries."
+    )
+    parser.add_argument(
+        "username",
+        nargs="?",
+        help="Optional username for a generated user config snippet.",
+    )
+    parser.add_argument(
+        "--password",
+        help="Password to hash. Omit to enter it securely via prompt.",
+    )
+    parser.add_argument(
+        "--json",
+        action="store_true",
+        help="Output a JSON object for the user entry.",
+    )
+    return parser
+
+
+def main():
+    args = build_parser().parse_args()
+    password = args.password
+
+    if password is None:
+        password = getpass.getpass("Password: ")
+
+    password_hash = generate_password_hash(password)
+
+    if args.username:
+        entry = {args.username: {"password_hash": password_hash}}
+        if args.json:
+            print(json.dumps(entry, indent=2))
+        else:
+            print(f'"{args.username}": {{')
+            print(f'    "password_hash": "{password_hash}"')
+            print("}")
+    else:
+        print(password_hash)
+
+
+if __name__ == "__main__":
+    main()