mirror of
https://github.com/hanzoai/base.git
synced 2026-10-21 03:41:50 +00:00
zeekay
84fc18ac38
Each pointed at `/_/#/...` — the old admin mount plus a hash route in the SPA
this fork replaced — and each had been dead since that rewrite. They survived
because nothing about them fails loudly: the server answers an unknown path with
the admin page at 200, so a link to nowhere looks like a link.
The first boot message handed an operator a browser URL at
`/_/#/baseinstal/{token}` and printed the CLI command underneath as a fallback.
There is no `baseinstal` route, so the fallback was the only thing that ever
worked; it is now the instruction. Nothing mints a throwaway superuser token to
put in that URL any more either.
The other two are the default verification and email-change mails, whose buttons
went to `confirm-verification` and `confirm-email-change`. Those endpoints were
deleted in the IAM-native rip — bindRecordAuthApi keeps auth-methods and
auth-refresh and nothing else, and both paths answer 404 for every deployment,
not only IAM ones. So the button in the one mail a person is most likely to
click had nowhere to go. The defaults now link to the app itself and say that
the account is where the address is confirmed. {TOKEN} still substitutes, since
an app can bind its own confirm route from a hook and write its own template —
what a default may not do is name a route on the reader's behalf and be wrong.
These are defaults, applied when a collection is created; a collection stores its
own copy, so nothing already deployed changes. The mails and jsvm suites go on
asserting the old shape against their fixtures, correctly: they test that a
template's placeholders get substituted, whatever the template says.
Also removes the last /_/ from the settings placeholder and from smoke.mjs, which
was serving the bundle at the old mount — a visual check against a layout nothing
runs would pass while the real page broke. LLM.md documented the deleted knob.
97 lines
2.6 KiB
Go
97 lines
2.6 KiB
Go
package apis
|
|
|
|
import (
|
|
"database/sql"
|
|
"errors"
|
|
"os"
|
|
|
|
"github.com/fatih/color"
|
|
"github.com/hanzoai/base/core"
|
|
"github.com/hanzoai/base/tools/osutils"
|
|
"github.com/hanzoai/dbx"
|
|
)
|
|
|
|
// DefaultInstallerFunc tells an operator how to create the first superuser.
|
|
//
|
|
// It only runs where IAM is NOT the auth source — with IAM on, loadInstaller
|
|
// returns before this and the superuser is whoever IAM issues an admin-claim
|
|
// token to.
|
|
//
|
|
// It used to open a browser at `{baseURL}/_/#/baseinstal/{token}` and print
|
|
// that address. There is no such page: the admin was rewritten and serves no
|
|
// `baseinstal` route, so the link a first-boot operator was handed went
|
|
// nowhere, and the CLI line printed under it as a fallback was the only thing
|
|
// that worked. Now it is the instruction rather than the fallback.
|
|
func DefaultInstallerFunc(app core.App, systemSuperuser *core.Record, baseURL string) error {
|
|
color.Magenta("\n(!) No superuser exists yet. Create the first one with:")
|
|
color.New(color.Bold).Add(color.FgCyan).Printf(" %s superuser upsert EMAIL PASS\n\n", executablePath())
|
|
|
|
return nil
|
|
}
|
|
|
|
func loadInstaller(
|
|
app core.App,
|
|
baseURL string,
|
|
installerFunc func(app core.App, systemSuperuser *core.Record, baseURL string) error,
|
|
) error {
|
|
// IAM is the only auth source — once the platform plugin marks the
|
|
// store as external-only, the local "first superuser" installer is
|
|
// moot. The superuser is whoever IAM issues an admin-claim token to;
|
|
// Base never seeds one locally.
|
|
if externalOnly, _ := app.Store().Get(StoreKeyExternalAuthOnly).(bool); externalOnly {
|
|
return nil
|
|
}
|
|
|
|
if installerFunc == nil || !needInstallerSuperuser(app) {
|
|
return nil
|
|
}
|
|
|
|
superuser, err := findOrCreateInstallerSuperuser(app)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return installerFunc(app, superuser, baseURL)
|
|
}
|
|
|
|
func needInstallerSuperuser(app core.App) bool {
|
|
total, err := app.CountRecords(core.CollectionNameSuperusers, dbx.Not(dbx.HashExp{
|
|
"email": core.DefaultInstallerEmail,
|
|
}))
|
|
|
|
return err == nil && total == 0
|
|
}
|
|
|
|
func findOrCreateInstallerSuperuser(app core.App) (*core.Record, error) {
|
|
col, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
record, err := app.FindAuthRecordByEmail(col, core.DefaultInstallerEmail)
|
|
if err != nil {
|
|
if !errors.Is(err, sql.ErrNoRows) {
|
|
return nil, err
|
|
}
|
|
|
|
record = core.NewRecord(col)
|
|
record.SetEmail(core.DefaultInstallerEmail)
|
|
record.SetVerified(true)
|
|
|
|
err = app.Save(record)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
return record, nil
|
|
}
|
|
|
|
func executablePath() string {
|
|
if osutils.IsProbablyGoRun() {
|
|
return "go run ."
|
|
}
|
|
|
|
return os.Args[0]
|
|
}
|