Paddy
7aac07a013
Introduces src/models/admin/, a dedicated identity and permissions module on its own nachklang_admin database, and the shared authenticator that feedback and tickets will move onto in the cutover step. Nothing swaps over yet: feedback.auth.ts and tickets.auth.ts still authenticate against the legacy calendar sessions, so production behaviour is unchanged. - better-auth 1.7 mounted at /admin/auth/*, sessions as httpOnly cookies scoped to .nachklang.art so one sign-in covers every *.nachklang.art app. - Accounts are invite-only: public sign-up is disabled, and the invitations plugin is the only code that creates users. Tokens are stored as SHA-256 hashes and travel in the request body, never in a URL. - Per-app permissions in user_app_permissions; requireAppAccess(app) queries the database on every request (no cookie cache) so disabling a user or revoking a session takes effect immediately. - ADMIN_BOOTSTRAP_EMAIL guarantees a way in on an empty database, idempotently and without crashing the API if the database is unreachable at boot. - Guards prevent an admin from removing their own admin permission, disabling themselves, or stripping the last active admin. The admin pool uses the callback-style mysql2, not mysql2/promise: Kysely's MysqlDialect drives the pool with callbacks, and the promise wrapper ignores them, so every query hangs silently. Only the integration tests caught this. Schema in sql/admin/001_init.sql, derived from getAuthTables() on the installed better-auth rather than the published CLI, which lags the library and omits account.issuer. app.ts is split into src/app.factory.ts so the integration tests drive the real middleware order rather than a copy of it. Tests: 131 unit, plus 41 integration tests against a throwaway MariaDB started by test/integration/setup.ts (docker or podman). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
68 lines
2.6 KiB
TypeScript
68 lines
2.6 KiB
TypeScript
import * as UsersService from './users/users.admin.service.js';
|
|
import * as InvitationsService from './invitations/invitations.service.js';
|
|
import {sendInvitationMail} from './admin.mail.js';
|
|
import {ADMIN_APP_URL, ADMIN_BOOTSTRAP_EMAIL, isProd} from './admin.config.js';
|
|
import logger from '../../middleware/logger.js';
|
|
|
|
/**
|
|
* Solves the empty-database problem: with invite-only accounts and no public
|
|
* sign-up, a fresh nachklang_admin has nobody who can invite anybody. Rather
|
|
* than a CLI script somebody has to remember to run against production, the API
|
|
* makes sure on every start that ADMIN_BOOTSTRAP_EMAIL can get in.
|
|
*
|
|
* Idempotent by design - it is safe on every restart:
|
|
* - an active admin already exists -> do nothing
|
|
* - the address exists as a user -> grant it `admin`
|
|
* - an open invitation exists -> do nothing (do not re-mail on restart)
|
|
* - otherwise -> invite, and mail the link
|
|
*
|
|
* Never throws: a database blip at boot must not stop the API from serving the
|
|
* calendar, feedback and tickets domains.
|
|
*/
|
|
export const bootstrapAdmin = async (): Promise<void> => {
|
|
try {
|
|
if (!ADMIN_BOOTSTRAP_EMAIL) {
|
|
return;
|
|
}
|
|
|
|
const email = ADMIN_BOOTSTRAP_EMAIL.trim().toLowerCase();
|
|
|
|
if ((await UsersService.countActiveAdmins()) > 0) {
|
|
return;
|
|
}
|
|
|
|
const existing = await UsersService.findUserByEmail(email);
|
|
if (existing) {
|
|
await UsersService.grantPermission(existing.id, 'admin', null);
|
|
logger.info('Admin bootstrap: granted the admin permission to the existing bootstrap user', {email});
|
|
return;
|
|
}
|
|
|
|
// An expired invitation is not "open", so the next restart re-issues
|
|
// one - which is the recovery path if the first mail never arrived.
|
|
if (await InvitationsService.hasOpenInvitationFor(email)) {
|
|
logger.info('Admin bootstrap: an open invitation already exists', {email});
|
|
return;
|
|
}
|
|
|
|
const invitation = await InvitationsService.createInvitation(
|
|
email,
|
|
'Nachklang Admin',
|
|
['admin'],
|
|
null
|
|
);
|
|
|
|
const mailed = await sendInvitationMail(email, 'Nachklang Admin', invitation.token, invitation.expiresAt);
|
|
logger.info('Admin bootstrap: invitation created', {email, mailed});
|
|
|
|
// Outside production the Salesforce mail relay is usually off, so the
|
|
// link is logged instead - that is how a local setup gets its first
|
|
// admin. Never in production: the log would then hold a live credential.
|
|
if (!isProd) {
|
|
logger.info(`Admin bootstrap: ${ADMIN_APP_URL}/accept-invite?token=${invitation.token}`);
|
|
}
|
|
} catch (e: any) {
|
|
logger.error('Admin bootstrap failed', {detail: e?.message});
|
|
}
|
|
};
|