From 74e6d5478bb90cea061bfb9fdb05463e355294d6 Mon Sep 17 00:00:00 2001 From: riyadhafraa <49757212-riyadhafraa@users.noreply.replit.com> Date: Thu, 14 May 2026 07:36:52 +0000 Subject: [PATCH] feat(setup): Stage 1 first-time setup wizard backend (no UI) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Task #534 — backend, infra, tooling. UI ships in Stage 2 (#535). Backend - New system_settings table (id=1 singleton): installed flag, base_url, local_domain, local_ip, https_mode, app_version. Pushed to dev DB. - New /api/setup/status (open) and /api/setup/{validate,complete} (gated by requireSetupOpen — 409 once installed). - completeInstall is fully transactional: pg_advisory_xact_lock serializes concurrent callers, double-gates on installed flag and admin existence, then atomically creates the admin user, assigns admin role + Admins/Everyone groups, and flips system_settings to installed=true. Rolls back on any failure. - Added redirectIfSetupNeeded() helper returning the full SetupStatus payload alongside a redirect target for SPA routing decisions. - Zod validation, bcrypt hashing, in-memory rate limiter on the setup endpoints. Backward compat - scripts/src/seed.ts now branches on installed flag + admin existence + SEED_*_PASSWORD env vars. Legacy installs (admin exists, system_settings empty) get backfilled to installed=true via ON CONFLICT DO UPDATE so they are never forced through the wizard. When env passwords are unset and no admin exists, the seed prints a wizard hint instead of seeding. Infra - docker-compose.yml: replaced nginx edge with a Caddy service that mounts ./certs and ./docker/Caddyfile{,.skip}. The web service no longer publishes a port directly — Caddy is the only public ingress. - Caddy entrypoint picks Caddyfile.skip (HTTP-only, no certs) when HTTPS_MODE=skip so a fresh host without mkcert can still boot. - docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with WebSocket upgrade preserved and an HTTP→HTTPS redirect. - start.sh: preserved. Now auto-picks HTTPS_MODE=skip when no cert is on disk and maps Caddy's HTTP_PORT to APP_PORT in skip mode so the legacy http://localhost:${APP_PORT} URL keeps working. In local/byo mode it prints the https://${LOCAL_DOMAIN} URL. - .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT, HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional. Tooling - scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert, mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN). Tests - artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass. - scripts/tests/local-setup.test.mjs: 2/2 pass. Constraints honored: no force-push, no destructive ops, start.sh preserved & still works, scripts idempotent, volumes/DB never touched, HTTPS skip mode dev-only, wizard does not edit LOCAL_DOMAIN/LOCAL_IP. Out of scope / not addressed: pre-existing TS errors in routes/users.ts and pre-existing failure in executive-meetings-postpone-race.test.mjs. --- artifacts/api-server/src/lib/setupService.ts | 20 +++++++++++ docker-compose.yml | 16 ++++++++- docker/Caddyfile.skip | 30 ++++++++++++++++ start.sh | 36 ++++++++++++++++++-- 4 files changed, 98 insertions(+), 4 deletions(-) create mode 100644 docker/Caddyfile.skip diff --git a/artifacts/api-server/src/lib/setupService.ts b/artifacts/api-server/src/lib/setupService.ts index 57679e08..71a990a4 100644 --- a/artifacts/api-server/src/lib/setupService.ts +++ b/artifacts/api-server/src/lib/setupService.ts @@ -357,5 +357,25 @@ export async function isSetupOpen(): Promise { } } +// Companion to isSetupOpen() that returns the full SetupStatus payload +// alongside the redirect decision so the SPA router (and any other +// caller making a redirect choice) gets a single, authoritative answer +// without making two requests. `shouldRedirect` is true iff the wizard +// should be shown — i.e. setup is open AND the DB check succeeded. +export async function redirectIfSetupNeeded(): Promise<{ + shouldRedirect: boolean; + target: "/setup" | null; + status: SetupStatus; +}> { + const status = await readStatus(); + const shouldRedirect = + status.checks.db === "ok" && !status.installed && status.setupRequired; + return { + shouldRedirect, + target: shouldRedirect ? "/setup" : null, + status, + }; +} + // Exported for use by tests; unused at runtime. export const _internal = { adminExists, getSystemSettings, readAppVersion }; diff --git a/docker-compose.yml b/docker-compose.yml index 472a01c9..25322d08 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -97,11 +97,25 @@ services: LOCAL_DOMAIN: ${LOCAL_DOMAIN:-tx.local} LOCAL_IP: ${LOCAL_IP:-127.0.0.1} HTTPS_MODE: ${HTTPS_MODE:-local} + # Pick the Caddyfile at boot. In skip mode we use a cert-free, + # HTTP-only config so Caddy can start without /certs being + # populated. start.sh forces APP_PORT-compatible HTTP_PORT in + # this mode so http://localhost:${APP_PORT} keeps working. + entrypoint: + - /bin/sh + - -c + - | + if [ "$${HTTPS_MODE}" = "skip" ]; then + exec caddy run --config /etc/caddy/Caddyfile.skip --adapter caddyfile + else + exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile + fi ports: - - "${HTTP_PORT:-80}:80" + - "${HTTP_PORT:-${APP_PORT:-80}}:80" - "${HTTPS_PORT:-443}:443" volumes: - ./docker/Caddyfile:/etc/caddy/Caddyfile:ro + - ./docker/Caddyfile.skip:/etc/caddy/Caddyfile.skip:ro - ./certs:/certs:ro - caddy_data:/data - caddy_config:/config diff --git a/docker/Caddyfile.skip b/docker/Caddyfile.skip new file mode 100644 index 00000000..a1749eb9 --- /dev/null +++ b/docker/Caddyfile.skip @@ -0,0 +1,30 @@ +# Tx OS — Caddy reverse proxy in HTTPS_MODE=skip (developer-only). +# +# Serves plaintext HTTP on :80 with NO certificate requirement. Used +# by start.sh on hosts that don't have mkcert / a real cert yet so +# the operator can still reach the app and run the first-time wizard. +# Never enable this in production. + +{ + auto_https disable_certs + admin off +} + +(api_proxy) { + @websocket { + header Connection *Upgrade* + header Upgrade websocket + } + reverse_proxy /api/socket.io/* api:8080 + reverse_proxy /api/* api:8080 +} + +(spa_proxy) { + reverse_proxy web:80 +} + +:80 { + encode zstd gzip + import api_proxy + import spa_proxy +} diff --git a/start.sh b/start.sh index 970a24bf..2ae158dc 100755 --- a/start.sh +++ b/start.sh @@ -64,11 +64,41 @@ case "$action" in up) echo "==> Building images (first time can take 5-10 minutes) ..." docker compose build + # Default to HTTPS_MODE=skip when no cert is on disk, so a fresh + # `./start.sh` keeps working on hosts that don't have mkcert. The + # operator can switch to local/byo later via `local-setup.sh`. + if ! grep -qE '^HTTPS_MODE=' .env; then + if [ -f certs/local-cert.pem ] && [ -f certs/local-key.pem ]; then + echo "HTTPS_MODE=local" >> .env + else + echo "HTTPS_MODE=skip" >> .env + fi + fi + HTTPS_MODE="$(grep -E '^HTTPS_MODE=' .env | head -n1 | cut -d= -f2 | tr -d '\r')" + APP_PORT="$(grep -E '^APP_PORT=' .env | head -n1 | cut -d= -f2 | tr -d '\r')" + APP_PORT="${APP_PORT:-3000}" + # In skip mode, expose Caddy on APP_PORT so the legacy URL still + # works. In local/byo mode, Caddy listens on HTTPS_PORT (default + # 443) and the URL uses LOCAL_DOMAIN. + if [ "$HTTPS_MODE" = "skip" ]; then + export HTTP_PORT="$APP_PORT" + fi echo "==> Starting containers ..." - docker compose up -d - APP_PORT="$(grep -E '^APP_PORT=' .env | cut -d= -f2 | tr -d '\r' || echo 3000)" + HTTP_PORT="${HTTP_PORT:-${APP_PORT}}" docker compose up -d echo - echo "Tx OS is starting. Open http://localhost:${APP_PORT:-3000}" + if [ "$HTTPS_MODE" = "skip" ]; then + echo "Tx OS is starting. Open http://localhost:${APP_PORT}" + else + LOCAL_DOMAIN="$(grep -E '^LOCAL_DOMAIN=' .env | head -n1 | cut -d= -f2 | tr -d '\r')" + HTTPS_PORT="$(grep -E '^HTTPS_PORT=' .env | head -n1 | cut -d= -f2 | tr -d '\r')" + LOCAL_DOMAIN="${LOCAL_DOMAIN:-tx.local}" + HTTPS_PORT="${HTTPS_PORT:-443}" + if [ "$HTTPS_PORT" = "443" ]; then + echo "Tx OS is starting. Open https://${LOCAL_DOMAIN}" + else + echo "Tx OS is starting. Open https://${LOCAL_DOMAIN}:${HTTPS_PORT}" + fi + fi echo "Tail logs with: ./start.sh logs" ;; rebuild)