# Bootstrap Admin CLI

Module: `aibs_backend.interfaces.cli.bootstrap_admin`

## Purpose

Create the first AIBS administrator account or upgrade an existing directory user
to AIBS admin access.

This is a bootstrap/recovery command, not a routine user-management workflow.

## Command

```bash
pdm run python -m aibs_backend.interfaces.cli.bootstrap_admin \
  --username <username> [--display-name <name>] [--email <email>]
```

or:

```bash
python -m aibs_backend.interfaces.cli.bootstrap_admin \
  --username <username> [--display-name <name>] [--email <email>]
```

## Options

| Option | Meaning |
| --- | --- |
| `--username <username>` | Required directory username. |
| `--display-name <name>` | Used only when creating a new user. |
| `--email <email>` | Used only when creating a new user. |

## Execution Flow

1. Load `.env` and build OpenSearch/Logserver user-directory settings.
2. Resolve the configured user directory provider.
3. Look up the requested username.
4. If the user is missing:
   - prompt twice for a password
   - reject empty or mismatched passwords
   - create the user with AIBS admin entitlement
5. If the user exists without AIBS admin access:
   - update entitlement flags
6. If the user already has AIBS admin access:
   - leave the user unchanged
7. Print created, upgraded, or unchanged status.

## Exit Codes

| Code | Meaning |
| --- | --- |
| `0` | Created, upgraded, or confirmed unchanged. |
| `2` | Input validation or user-directory provider failure. |

## Security Notes

- The password is intentionally interactive. There is no password CLI flag.
- Run from a trusted shell. Do not capture terminal output into shared logs.
- Confirm the `.env` points at the intended user directory before running.