@commonpub/layer 0.21.1 → 0.21.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/layer",
-  "version": "0.21.1",
+  "version": "0.21.2",
   "type": "module",
   "main": "./nuxt.config.ts",
   "files": [
@@ -50,16 +50,16 @@
     "vue": "^3.4.0",
     "vue-router": "^4.3.0",
     "zod": "^4.3.6",
-    "@commonpub/auth": "0.6.0",
-    "@commonpub/learning": "0.5.2",
-    "@commonpub/docs": "0.6.2",
     "@commonpub/config": "0.12.0",
     "@commonpub/editor": "0.7.9",
-    "@commonpub/protocol": "0.9.9",
-    "@commonpub/schema": "0.16.0",
     "@commonpub/explainer": "0.7.12",
+    "@commonpub/learning": "0.5.2",
+    "@commonpub/server": "2.51.0",
+    "@commonpub/auth": "0.6.0",
     "@commonpub/ui": "0.8.5",
-    "@commonpub/server": "2.51.0"
+    "@commonpub/protocol": "0.9.9",
+    "@commonpub/schema": "0.16.0",
+    "@commonpub/docs": "0.6.2"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",

package/server/plugins/auto-admin.ts

@@ -1,16 +1,31 @@
 /**
  * Admin bootstrap plugin.
  *
- * In development: promotes the first registered user to admin.
- * In production: promotes ADMIN_BOOTSTRAP_USER (env var) if no admin exists.
+ * Runs once when no admin exists yet:
  *
- * This solves the bootstrap problem where no admin exists to promote users.
- * The production path only runs ONCE (when admin count is 0) and requires
- * an explicit env var, so it's safe to leave enabled.
+ *   - Development (NODE_ENV !== 'production'): promotes the first
+ *     registered user to admin. Zero config.
+ *   - Production, ADMIN_BOOTSTRAP_USER set: promotes that username.
+ *     The canonical "set the admin directly" path.
+ *   - Production, ADMIN_BOOTSTRAP_FIRST_USER truthy (1/true/yes):
+ *     promotes the first registered user — the frictionless
+ *     one-click-deploy path (deploy → register → you're admin).
+ *   - Production, neither set: does nothing (safe default — a public
+ *     instance shouldn't hand admin to a random first signup unless
+ *     the operator explicitly opted in).
+ *
+ * Idempotent: the whole block early-returns once any admin exists, so
+ * this is safe to leave enabled forever and ships harmlessly to
+ * instances that already have admins (no behavior change there).
  */
 import { users } from '@commonpub/schema';
 import { eq, asc, count } from 'drizzle-orm';
 
+/** Truthy env check — accepts 1/true/yes (case-insensitive). */
+function envTruthy(value: string | undefined): boolean {
+  return /^(1|true|yes)$/i.test(value ?? '');
+}
+
 export default defineNitroPlugin((nitro) => {
   // Run after a short delay so the DB pool is ready
   setTimeout(async () => {
@@ -27,14 +42,21 @@ export default defineNitroPlugin((nitro) => {
 
       // No admins exist — bootstrap one
 
-      // Production: promote specific user from env var
       const bootstrapUsername = process.env.ADMIN_BOOTSTRAP_USER;
-      if (process.env.NODE_ENV === 'production' && !bootstrapUsername) return;
+      const isProd = process.env.NODE_ENV === 'production';
+      // First-user promotion: default in dev, opt-in in prod via
+      // ADMIN_BOOTSTRAP_FIRST_USER (the one-click-deploy path).
+      const allowFirstUser = !isProd || envTruthy(process.env.ADMIN_BOOTSTRAP_FIRST_USER);
+
+      // In production, do nothing unless the operator either named a
+      // user OR explicitly opted into first-user promotion. Preserves
+      // the original safe default for instances that set neither.
+      if (isProd && !bootstrapUsername && !allowFirstUser) return;
 
       let targetUser: { id: string; username: string } | undefined;
 
       if (bootstrapUsername) {
-        // Promote the specified user
+        // Promote the specified user (canonical "set admin directly").
         const [found] = await db
           .select({ id: users.id, username: users.username })
           .from(users)
@@ -44,8 +66,9 @@ export default defineNitroPlugin((nitro) => {
         if (!targetUser) {
           console.warn(`[auto-admin] ADMIN_BOOTSTRAP_USER="${bootstrapUsername}" not found`);
         }
-      } else {
-        // Dev mode: promote first registered user
+      } else if (allowFirstUser) {
+        // Promote the first registered user (dev always; prod only
+        // when ADMIN_BOOTSTRAP_FIRST_USER opted in).
         const [firstUser] = await db
           .select({ id: users.id, username: users.username })
           .from(users)