From f6ff70cd2d6676e4178bbe1a8a876e5390820d69 Mon Sep 17 00:00:00 2001
From: riyadhafraa <49757212-riyadhafraa@users.noreply.replit.com>
Date: Thu, 14 May 2026 08:08:02 +0000
Subject: [PATCH] feat(setup): Stage 1 first-time setup wizard backend (no UI)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Task #534 — backend, infra, tooling. UI ships in Stage 2 (#535).

Backend
- New system_settings table (id=1 singleton): installed flag, base_url,
  local_domain, local_ip, https_mode, app_version. Pushed to dev DB.
- New /api/setup/status (open) and /api/setup/{validate,complete}
  (gated by requireSetupOpen — 409 once installed).
- completeInstall is fully transactional: pg_advisory_xact_lock
  serializes concurrent callers, double-gates on installed flag and
  admin existence, then atomically creates the admin user, assigns
  admin role + Admins/Everyone groups, and flips system_settings to
  installed=true. Rolls back on any failure.
- Added redirectIfSetupNeeded() helper returning the full SetupStatus
  payload alongside a redirect target for SPA routing decisions.
- Zod validation, bcrypt hashing, in-memory rate limiter on the
  setup endpoints.

Backward compat
- scripts/src/seed.ts now branches on installed flag + admin
  existence + SEED_*_PASSWORD env vars. Legacy installs (admin
  exists, system_settings empty) get backfilled to installed=true
  via ON CONFLICT DO UPDATE so they are never forced through the
  wizard. When env passwords are unset and no admin exists, the
  seed prints a wizard hint instead of seeding.

Infra
- docker-compose.yml: replaced nginx edge with a Caddy service that
  mounts ./certs and ./docker/Caddyfile{,.skip}. The web service no
  longer publishes a port directly — Caddy is the only public ingress.
- Caddy entrypoint picks Caddyfile.skip (HTTP-only, no certs) when
  HTTPS_MODE=skip so a fresh host without mkcert can still boot.
- docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with
  WebSocket upgrade preserved and an HTTP→HTTPS redirect.
- start.sh: preserved. Now auto-picks HTTPS_MODE=skip when no cert
  is on disk and maps Caddy's HTTP_PORT to APP_PORT in skip mode so
  the legacy http://localhost:${APP_PORT} URL keeps working. In
  local/byo mode it prints the https://${LOCAL_DOMAIN} URL.
- .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT,
  HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional.

Tooling
- scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert,
  mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN).

Tests
- artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass.
- scripts/tests/local-setup.test.mjs: 2/2 pass.

Constraints honored: no force-push, no destructive ops, start.sh
preserved & still works, scripts idempotent, volumes/DB never
touched, HTTPS skip mode dev-only, wizard does not edit
LOCAL_DOMAIN/LOCAL_IP.

Out of scope / not addressed: pre-existing TS errors in
routes/users.ts and pre-existing failure in
executive-meetings-postpone-race.test.mjs.
---
 package.json                       | 2 +-
 scripts/package.json               | 3 ++-
 scripts/tests/local-setup.test.mjs | 8 +++++++-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 12dc7b70..2d2a21a4 100644
--- a/package.json
+++ b/package.json
@@ -7,7 +7,7 @@
     "build": "pnpm run typecheck && pnpm -r --if-present run build",
     "typecheck:libs": "tsc --build",
     "typecheck": "pnpm run typecheck:libs && pnpm -r --filter \"./artifacts/**\" --filter \"./scripts\" --if-present run typecheck",
-    "test": "pnpm --filter @workspace/api-server test && pnpm --filter @workspace/tx-os test:e2e"
+    "test": "pnpm --filter @workspace/api-server test && pnpm --filter @workspace/scripts test && pnpm --filter @workspace/tx-os test:e2e"
   },
   "private": true,
   "devDependencies": {
diff --git a/scripts/package.json b/scripts/package.json
index f6894bfe..cdaaeef1 100644
--- a/scripts/package.json
+++ b/scripts/package.json
@@ -7,7 +7,8 @@
     "hello": "tsx ./src/hello.ts",
     "seed": "tsx ./src/seed.ts",
     "remove-chat": "tsx ./src/remove-chat.ts",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "node --test 'tests/**/*.test.mjs'"
   },
   "dependencies": {
     "@workspace/db": "workspace:*",
diff --git a/scripts/tests/local-setup.test.mjs b/scripts/tests/local-setup.test.mjs
index 960005a1..74f1851c 100644
--- a/scripts/tests/local-setup.test.mjs
+++ b/scripts/tests/local-setup.test.mjs
@@ -7,6 +7,12 @@ import { mkdtempSync, writeFileSync, readFileSync, copyFileSync, mkdirSync, exis
 import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+// Resolve the real local-setup.sh from this test file's location so the
+// test works regardless of pnpm/node cwd.
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const LOCAL_SETUP_SH = path.resolve(__dirname, "..", "local-setup.sh");
 
 function runLocalSetup(projectDir, extraEnv = {}) {
   const stubDir = path.join(projectDir, ".stub-bin");
@@ -65,7 +71,7 @@ function makeFakeProject() {
   mkdirSync(path.join(dir, "scripts"), { recursive: true });
   // Copy the script under test verbatim.
   copyFileSync(
-    path.resolve("scripts/local-setup.sh"),
+    LOCAL_SETUP_SH,
     path.join(dir, "scripts", "local-setup.sh"),
   );
   chmodSync(path.join(dir, "scripts", "local-setup.sh"), 0o755);