@habeetat/cli 0.1.0-dev.20260619123920.2f9dafc → 0.1.0-dev.20260624111225.3bf52a3

package/dist/bin.js

@@ -13184,6 +13184,17 @@ VALUES ('default', 'nhp-backend-scope', 'nhp-backend-resource', 'nhp:all', 'Full
 ON CONFLICT (id) DO UPDATE
 SET resource_id = EXCLUDED.resource_id, name = EXCLUDED.name, description = EXCLUDED.description;
 
+-- Default platform user role: grants the API scope (nhp:all) to EVERY user and is a Logto
+-- default role (is_default), so self-registered users are auto-assigned it on sign-up. Without
+-- this a new user has no scope on the API resource \u2192 their token is opaque \u2192 they can't call
+-- /auth/me or create their first org (org-onboarding self-registration would be locked out).
+INSERT INTO roles (tenant_id, id, name, description, type, is_default)
+VALUES ('default', 'role_platform_user', 'platform-user', 'Baseline API access for all users', 'User', true)
+ON CONFLICT (id) DO UPDATE SET is_default = true;
+INSERT INTO roles_scopes (tenant_id, id, role_id, scope_id)
+VALUES ('default', 'rs_platform_user_all', 'role_platform_user', 'nhp-backend-scope')
+ON CONFLICT DO NOTHING;
+
 -- Group scopes (enforced by the SDK ScopeGuard on /sdk/v1/groups). Without
 -- these the groups:read scope-gate is unsatisfiable for any client.
 INSERT INTO scopes (tenant_id, id, resource_id, name, description)
@@ -13750,7 +13761,9 @@ async function initPlatform(projectDir) {
     try {
       const signozReady = await waitForDockerHealthy(projectDir, "signoz-query-service", 120);
       if (!signozReady) {
-        signozUserSpinner.warn("SigNoz query service not healthy \u2014 skipping admin user creation");
+        signozUserSpinner.warn(
+          "SigNoz query service not healthy \u2014 SKIPPED admin creation. SECURITY: the SigNoz UI (logs.<domain>) stays on OPEN SIGNUP until an admin exists \u2014 re-run `habeetat init` (or register the admin) before exposing it."
+        );
       } else {
         const adminEmail = env2.PLATFORM_ADMIN_EMAIL || config.platform.adminEmail;
         const adminPassword = env2.PLATFORM_ADMIN_PASSWORD || "";
@@ -13776,9 +13789,11 @@ async function initPlatform(projectDir) {
             `--post-data=${jsonBody}`,
             "http://localhost:8080/api/v1/register"
           ], { cwd: projectDir, stdio: "pipe" });
-          signozUserSpinner.succeed("SigNoz admin user created");
+          signozUserSpinner.succeed("SigNoz admin user created \u2014 UI now requires login");
         } catch {
-          signozUserSpinner.warn("SigNoz admin user already exists or registration not available");
+          signozUserSpinner.warn(
+            "SigNoz admin already exists or registration unavailable \u2014 if this is a fresh SigNoz with no admin, the UI is on OPEN SIGNUP until one is created."
+          );
         }
       }
     } catch (err) {