pastilhas
2e8ec845c8
The word meant four different things in this repo, not the three the offscale
doc records:
1. the permission registry → RENAMED here
2. $OFFICER_ROOT/capabilities/ items → kept; this is what capabilities are
3. sidecar routing keys → step 3, becoming `handles`
4. Lightning wallet features → kept; a domain term, and on the wire
to the mobile apps
The fourth was not in the doc and a global find-and-replace would have broken
the mobile wallet, which reads `{ kind, capabilities: Capability[] }` from the
wallet sidecar. So this renamed against an explicit file allowlist rather than
by sweeping the tree, and `CapabilityPage.tsx` — the UI for the item store, and
correctly named already — was left alone.
Moved: servers/capabilities/ → servers/permissions/, capability-gate.ts →
permission-gate.ts, users/capabilities-routes.ts → permissions-routes.ts,
hooks/useCapabilities.ts → usePermissions.ts. Identifiers follow.
Three breaks the typechecker could not see, all found by exercising it live.
The route paths moved with the prose sweep, so the server served
/user/permissions while the frontend still called /user/capabilities. A 404 on
every page load, and tsgo clean throughout.
The response FIELD moved too. `client.get<SelfPermissions>()` is an unchecked
cast, so `data.capabilities` became `undefined` at runtime with no compile
error — `can()` would have answered "no" to everything and the dock would have
emptied itself.
And the grants list was passed straight out of the database, so it arrived as
`{ role, capability, level }` while the screen read `grant.permission`. Every
role would have rendered as holding nothing. It is now mapped in the route:
the wire says `permission`, the column still says `capability`, and step 2
therefore changes nothing any client can see.
The stale react-query keys were the quiet one: two files still invalidated
['self-capabilities'] after the hook moved to ['self-permissions'], so
installing a plugin would have silently stopped refreshing the dock.
The database is untouched — `role_capabilities` and its `capability` column are
step 2, and the two call sites that cross that boundary say so in a comment.
Round-tripped the 9 live grants through the admin endpoint to prove the PUT
contract survived: 9 before, 9 after, Member's three intact.
Also reverted prettier churn on five landing-page files that a broad --write
picked up. Second time today; the lesson is not sticking.
tsgo clean. 797 tests, 787 pass, same 7 pre-existing failures — two of which
now read "path → permission" rather than "path → capability".
72 lines
3.2 KiB
TypeScript
72 lines
3.2 KiB
TypeScript
import type { Handler } from 'hono';
|
|
import { getUserCount, createUser, replaceRoleGrants, USER_ROLES } from 'officerdb';
|
|
import { DEFAULT_ROLE_PERMISSIONS } from '@@/permissions/registry';
|
|
import argon2 from 'argon2';
|
|
import * as errors from '@@/custom-errors';
|
|
import { rememberUser } from '@@/_middlewares';
|
|
import { validatePassword } from './validate-password';
|
|
import { validateUsername } from './validate-username';
|
|
|
|
// Single-step bootstrap for the one account Officer supports: the server owner is created directly as
|
|
// active, with no email-verification round-trip. Gated to an empty user table.
|
|
export const bootstrapHandler: Handler = async function (ctx) {
|
|
const body = ctx.get('body');
|
|
|
|
const userCount = await getUserCount();
|
|
if (userCount > 0) throw errors.FORBIDDEN('Registration is closed');
|
|
|
|
const email = body.email as string;
|
|
const name = body.name as string;
|
|
const username = body.username as string;
|
|
const password = body.password as string;
|
|
const confirmPassword = body.confirmPassword as string;
|
|
|
|
if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
|
|
throw errors.BAD_REQUEST('Invalid email address');
|
|
}
|
|
if (!name || !name.trim()) throw errors.BAD_REQUEST('Name is required');
|
|
const validUsername = validateUsername(username);
|
|
validatePassword(password);
|
|
if (password !== confirmPassword) throw errors.BAD_REQUEST('Passwords do not match');
|
|
|
|
const passwordHash = await argon2.hash(password);
|
|
|
|
// The role is what makes this account the owner — isSuperAdmin and getOwnerUser both read it, and
|
|
// nothing else confers it. Without this the first account would take the column's 'Member' default
|
|
// and the platform would come up with no owner at all: no vault, no agent identity, and the web
|
|
// origin locked to a Super Admin that does not exist. Bootstrap is gated on an empty user table
|
|
// above, so this cannot promote anyone but the first account.
|
|
const user = await createUser({
|
|
email,
|
|
password: passwordHash,
|
|
name: name.trim(),
|
|
username: validUsername,
|
|
status: 'Active',
|
|
role: 'Super Admin',
|
|
});
|
|
|
|
// Every other role starts with the baseline: terminal, chat and files at write. Done here because
|
|
// bootstrap is the one moment that happens exactly once per install, so seeding cannot fight a later
|
|
// revocation — take one of these away and nothing puts it back.
|
|
//
|
|
// Non-fatal. An owner who exists but whose roles hold nothing is a working server with a one-click fix;
|
|
// failing bootstrap over it would leave a platform with no account at all.
|
|
try {
|
|
for (const role of USER_ROLES.filter((r) => r !== 'Super Admin')) {
|
|
await replaceRoleGrants(
|
|
role,
|
|
// `capability` is the DATABASE's column name, renamed in the step that renames the table.
|
|
DEFAULT_ROLE_PERMISSIONS.map((permission) => ({ capability: permission, level: 'write' as const })),
|
|
);
|
|
}
|
|
} catch (ex) {
|
|
console.warn('[bootstrap] could not seed default role permissions', ex);
|
|
}
|
|
|
|
// The launch-time snapshot was taken while the user table was still empty. Without this the owner's
|
|
// very first sign-in would be filed as an unknown identity.
|
|
rememberUser(user);
|
|
|
|
return ctx.json({ ok: true });
|
|
};
|