feat(deploy): implement automated initial superuser creation via environment variables

Author: Lidianacosta

AGENTS.md

@@ -88,6 +88,7 @@ O deploy da aplicação é realizado na plataforma **Render** utilizando **Docke
 - **Infraestrutura:** Definida no arquivo `render.yaml` (Blueprint).
 - **Banco de Dados:** PostgreSQL (gerenciado pela Render).
 - **Processo:** O `Dockerfile` realiza o build otimizado com `uv`, executa as migrações do Alembic e inicia o servidor Uvicorn.
+- **Inicialização:** No primeiro deploy, se as variáveis de ambiente `FIRST_SUPERUSER_USERNAME` e `FIRST_SUPERUSER_PASSWORD` estiverem configuradas, o sistema criará automaticamente o primeiro usuário gerente (caso ele ainda não exista).
 - **Configuração:** O validador em `src/core/config.py` converte automaticamente a URL do banco para o driver assíncrono `postgresql+asyncpg://`.
 
 ---

render.yaml

@@ -13,6 +13,10 @@ services:
         generateValue: true
       - key: ENVIRONMENT
         value: production
+      - key: FIRST_SUPERUSER_USERNAME
+        sync: false
+      - key: FIRST_SUPERUSER_PASSWORD
+        sync: false
 
 databases:
   - name: fastapibank-db

scripts/entrypoint.sh

@@ -1,3 +1,4 @@
 #!/bin/sh
 alembic upgrade head
+python -m src.commands.init_db
 exec uvicorn src.main:app --host 0.0.0.0 --port 8000

src/commands/init_db.py

@@ -0,0 +1,62 @@
+"""Database initialization script.
+
+Checks if an initial superuser should be created and creates it if needed.
+"""
+
+import asyncio
+import logging
+
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlmodel import select
+from sqlmodel.ext.asyncio.session import AsyncSession
+
+from src.core.config import settings
+from src.models.user import User
+from src.schemas.user import UserIn
+from src.utils.password import get_password_hash
+
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger(__name__)
+
+
+async def init_db() -> None:
+    """Create the initial superuser if configured."""
+    if (
+        not settings.first_superuser_username
+        or not settings.first_superuser_password
+    ):
+        logger.info(
+            "First superuser credentials not configured. Skipping initialization."
+        )
+        return
+
+    engine = create_async_engine(settings.database_url)
+
+    async with AsyncSession(engine) as session:
+        statement = select(User).where(
+            User.username == settings.first_superuser_username
+        )
+        result = await session.exec(statement)
+        user = result.first()
+
+        if user:
+            logger.info("Superuser already exists. Skipping creation.")
+        else:
+            logger.info("Creating initial superuser.")
+            user_in = UserIn(
+                username=settings.first_superuser_username,
+                plain_password=settings.first_superuser_password,
+            )
+            new_user = User(**user_in.model_dump(exclude={"plain_password"}))
+            new_user.hashed_password = get_password_hash(
+                user_in.plain_password
+            )
+            session.add(new_user)
+            await session.commit()
+            logger.info("Initial superuser created successfully.")
+
+    await engine.dispose()
+
+
+if __name__ == "__main__":
+    asyncio.run(init_db())

src/core/config.py

@@ -45,6 +45,9 @@ def assemble_db_url(cls, v: str) -> str:
     algorithm: str = Field(default="HS256")
     access_token_expire_minutes: int = Field(default=30)
 
+    first_superuser_username: str | None = Field(default=None)
+    first_superuser_password: str | None = Field(default=None)
+
     model_config = SettingsConfigDict(env_file=".env")