TX/artifacts/api-server/src/middlewares/setupGate.ts

import type { Request, Response, NextFunction } from "express";
import { db } from "@workspace/db";
import { systemSettingsTable } from "@workspace/db";

// Blocks /api/setup/{validate,complete} once the system is installed.
// /api/setup/status is intentionally NOT guarded — the SPA must always
// be able to read install state to decide its routing.
//
// Gate semantics: this middleware uses `system_settings.installed` as
// the SINGLE source of truth, per the Stage 1 contract. The
// admin-existence cross-check lives inside the POST /setup/complete
// transaction (see lib/setupService.ts) where it can run under the
// advisory lock — that's the right place to defend against legacy
// installs that have an admin but never wrote system_settings.
// Backfill (in scripts/src/seed.ts) ensures any such legacy install
// flips system_settings.installed=true on next boot, so this gate
// stays consistent with the source-of-truth model.
export async function requireSetupOpen(
  _req: Request,
  res: Response,
  next: NextFunction,
): Promise<void> {
  try {
    const rows = await db
      .select({ installed: systemSettingsTable.installed })
      .from(systemSettingsTable)
      .limit(1);
    const installed = rows[0]?.installed ?? false;
    if (installed) {
      res.status(409).json({
        error: "already_installed",
        message: "Setup has already been completed.",
      });
      return;
    }
    next();
  } catch (err) {
    next(err as Error);
  }
}