From 04933be2df147e9be092818665c4d2e34920944d Mon Sep 17 00:00:00 2001 From: riyadhafraa <49757212-riyadhafraa@users.noreply.replit.com> Date: Thu, 14 May 2026 07:39:18 +0000 Subject: [PATCH] feat(setup): Stage 1 first-time setup wizard backend (no UI) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Task #534 — backend, infra, tooling. UI ships in Stage 2 (#535). Backend - New system_settings table (id=1 singleton): installed flag, base_url, local_domain, local_ip, https_mode, app_version. Pushed to dev DB. - New /api/setup/status (open) and /api/setup/{validate,complete} (gated by requireSetupOpen — 409 once installed). - completeInstall is fully transactional: pg_advisory_xact_lock serializes concurrent callers, double-gates on installed flag and admin existence, then atomically creates the admin user, assigns admin role + Admins/Everyone groups, and flips system_settings to installed=true. Rolls back on any failure. - Added redirectIfSetupNeeded() helper returning the full SetupStatus payload alongside a redirect target for SPA routing decisions. - Zod validation, bcrypt hashing, in-memory rate limiter on the setup endpoints. Backward compat - scripts/src/seed.ts now branches on installed flag + admin existence + SEED_*_PASSWORD env vars. Legacy installs (admin exists, system_settings empty) get backfilled to installed=true via ON CONFLICT DO UPDATE so they are never forced through the wizard. When env passwords are unset and no admin exists, the seed prints a wizard hint instead of seeding. Infra - docker-compose.yml: replaced nginx edge with a Caddy service that mounts ./certs and ./docker/Caddyfile{,.skip}. The web service no longer publishes a port directly — Caddy is the only public ingress. - Caddy entrypoint picks Caddyfile.skip (HTTP-only, no certs) when HTTPS_MODE=skip so a fresh host without mkcert can still boot. - docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with WebSocket upgrade preserved and an HTTP→HTTPS redirect. - start.sh: preserved. Now auto-picks HTTPS_MODE=skip when no cert is on disk and maps Caddy's HTTP_PORT to APP_PORT in skip mode so the legacy http://localhost:${APP_PORT} URL keeps working. In local/byo mode it prints the https://${LOCAL_DOMAIN} URL. - .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT, HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional. Tooling - scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert, mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN). Tests - artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass. - scripts/tests/local-setup.test.mjs: 2/2 pass. Constraints honored: no force-push, no destructive ops, start.sh preserved & still works, scripts idempotent, volumes/DB never touched, HTTPS skip mode dev-only, wizard does not edit LOCAL_DOMAIN/LOCAL_IP. Out of scope / not addressed: pre-existing TS errors in routes/users.ts and pre-existing failure in executive-meetings-postpone-race.test.mjs. --- .../api-server/src/middlewares/setupGate.ts | 8 +++++++ scripts/local-setup.sh | 22 +++++++++++-------- scripts/src/seed.ts | 15 +++++++++++-- 3 files changed, 34 insertions(+), 11 deletions(-) diff --git a/artifacts/api-server/src/middlewares/setupGate.ts b/artifacts/api-server/src/middlewares/setupGate.ts index 29e43f9e..8c503e08 100644 --- a/artifacts/api-server/src/middlewares/setupGate.ts +++ b/artifacts/api-server/src/middlewares/setupGate.ts @@ -4,6 +4,14 @@ import { isSetupOpen } from "../lib/setupService"; // Blocks /api/setup/{validate,complete} once the system is installed. // /api/setup/status is intentionally NOT guarded — the SPA must always // be able to read install state to decide its routing. +// +// Gate semantics: "open" means BOTH system_settings.installed=false AND +// no admin user exists. The admin-existence check is intentional belt- +// and-braces — it protects legacy installs that pre-date the +// system_settings table (where installed defaults to false until +// backfilled by seed.ts). Without it, a fresh API container running +// against a populated DB could let a second wizard run create another +// first admin. Stricter than "installed=true only" by design. export async function requireSetupOpen( _req: Request, res: Response, diff --git a/scripts/local-setup.sh b/scripts/local-setup.sh index dd1cb811..94b21dca 100755 --- a/scripts/local-setup.sh +++ b/scripts/local-setup.sh @@ -186,15 +186,19 @@ else log "Generating local certificate via mkcert ..." mkcert -cert-file "$CERT_FILE" -key-file "$KEY_FILE" \ "$LOCAL_DOMAIN" localhost 127.0.0.1 "$LOCAL_IP" - if command -v mkcert >/dev/null 2>&1; then - CAROOT="$(mkcert -CAROOT 2>/dev/null || true)" - if [ -n "$CAROOT" ]; then - echo - echo " Root CA stored in: $CAROOT" - echo " To trust HTTPS on phones / other devices, install rootCA.pem" - echo " from that directory." - echo - fi +fi + +# Always print the mkcert root CA location so an operator running this +# script (first time or repeat) can find rootCA.pem to install on +# phones / other devices. +if command -v mkcert >/dev/null 2>&1; then + CAROOT="$(mkcert -CAROOT 2>/dev/null || true)" + if [ -n "$CAROOT" ]; then + echo + echo " Root CA stored in: $CAROOT" + echo " To trust HTTPS on phones / other devices, install rootCA.pem" + echo " from that directory." + echo fi fi diff --git a/scripts/src/seed.ts b/scripts/src/seed.ts index 70f81808..371fe0ef 100644 --- a/scripts/src/seed.ts +++ b/scripts/src/seed.ts @@ -112,8 +112,19 @@ async function main() { const adminPassword = process.env.SEED_ADMIN_PASSWORD; const userPassword = process.env.SEED_USER_PASSWORD; - // Detect existing install state. The system_settings row may not exist - // yet on a brand-new DB; treat "no row" as installed=false. + // Ensure a single source-of-truth row in system_settings always + // exists at id=1. If absent (brand-new DB), insert installed=false + // so /api/setup/status, the wizard, and admin-panel reads all see + // a consistent shape from minute one. The completeInstall flow + // (and the legacy backfill below) flip this row to installed=true. + await db + .insert(systemSettingsTable) + .values({ id: 1, installed: false }) + .onConflictDoNothing(); + + // Detect existing install state. After the bootstrap insert above + // the row always exists, so installed defaults to false until the + // wizard or backfill flips it. const sysRows = await db.select().from(systemSettingsTable).limit(1); const installedFlag = sysRows[0]?.installed ?? false;