@easy-cms/core 0.36.1 → 0.37.1

package/dist/index.d.ts

@@ -194,11 +194,16 @@ declare class Auth {
     private get config();
     /** Checks credentials and starts a session. Throws `UnauthorizedError` or `TooManyRequestsError`. */
     login(args: LoginArgs): Promise<Session>;
-    /** Creates the first admin. Only works while there are no users. */
+    /**
+     * Creates the first admin. Only works while there are no users, and with `auth.setupCode`
+     * (`EASY_CMS_SETUP_CODE`) only with that code.
+     */
     registerFirstUser(args: {
         email: string;
         password: string;
         name?: string;
+        setupCode?: string;
+        ip?: string | undefined;
     }): Promise<Session>;
     hasUsers(): Promise<boolean>;
     /** Ends the session for a signed token. Unknown tokens are ignored. */
@@ -2233,6 +2238,12 @@ interface AuthConfig {
      * everyone else signs in with `providers`. Default `true`.
      */
     readonly password?: boolean;
+    /**
+     * A code the first admin must enter to create their account, so nobody else can claim a
+     * freshly deployed site. Default: the `EASY_CMS_SETUP_CODE` environment variable; without it,
+     * no code is asked.
+     */
+    readonly setupCode?: string;
     /** Your own text for the password emails, e.g. in your brand's voice. Default: English or Thai. */
     readonly emails?: {
         readonly resetPassword?: PasswordEmailFn;

package/dist/index.js

@@ -1515,9 +1515,21 @@ var Auth = class {
     await this.cms.audit.record({ action: "login", target: "auth", user: session.user });
     return session;
   }
-  /** Creates the first admin. Only works while there are no users. */
+  /**
+   * Creates the first admin. Only works while there are no users, and with `auth.setupCode`
+   * (`EASY_CMS_SETUP_CODE`) only with that code.
+   */
   async registerFirstUser(args) {
     if (await this.hasUsers()) throw new ForbiddenError("An admin already exists");
+    const code = this.config.auth.setupCode;
+    if (code) {
+      const key2 = `setup|${args.ip ?? ""}`;
+      await this.checkRateLimit(key2);
+      if (!safeEqual(String(args.setupCode ?? ""), code)) {
+        await this.recordFailure(key2);
+        throw new ValidationError(USERS, [{ field: "setupCode", message: "is not the setup code" }]);
+      }
+    }
     const user = await this.cms.create(USERS, {
       email: args.email,
       password: args.password,
@@ -4049,6 +4061,8 @@ function validateAuth(config, add) {
     add("auth.rbac", "must be true or false");
   if (auth.password !== void 0 && typeof auth.password !== "boolean")
     add("auth.password", "must be true or false");
+  if (auth.setupCode !== void 0 && typeof auth.setupCode !== "string")
+    add("auth.setupCode", "must be a string");
   const providers = auth.providers;
   if (providers !== void 0) {
     if (!Array.isArray(providers)) {
@@ -4832,6 +4846,7 @@ async function resolveConfig(input) {
       providers: config.auth?.providers ?? [],
       allowSignUp: config.auth?.allowSignUp ?? { domains: [] },
       password: config.auth?.password !== false,
+      setupCode: config.auth?.setupCode ?? process.env.EASY_CMS_SETUP_CODE ?? "",
       tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
       maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
       lockWindow: config.auth?.lockWindow ?? 15 * 60,
@@ -7611,7 +7626,7 @@ async function widgets(cms, user) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.36.1" : "0.0.0-dev";
+var VERSION = true ? "0.37.1" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -8004,7 +8019,9 @@ async function route(cms, ctx, method, segments, options) {
             passwordReset: cms.auth.canSendPasswordLinks(ctx.url.origin),
             // Buttons to sign in with outside accounts; `password: false`: only admins use one.
             providers: cms.auth.sso.providers(),
-            password: cms.config.auth.password
+            password: cms.config.auth.password,
+            // The first admin needs the setup code (`EASY_CMS_SETUP_CODE`).
+            setupCode: cms.config.auth.setupCode !== ""
           }
         };
       // Forgot password: the same answer whether or not the email has an account.
@@ -8045,7 +8062,9 @@ async function route(cms, ctx, method, segments, options) {
         const session = await cms.auth.registerFirstUser({
           email: String(body.email ?? ""),
           password: String(body.password ?? ""),
-          ...typeof body.name === "string" ? { name: body.name } : {}
+          ...typeof body.name === "string" ? { name: body.name } : {},
+          ...typeof body.setupCode === "string" ? { setupCode: body.setupCode } : {},
+          ip: options.getClientIp?.(ctx.request)
         });
         setSessionCookies(cms, ctx, session);
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.36.1",
+  "version": "0.37.1",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",