@lenne.tech/nest-server 12.3.2 → 12.4.0

package/dist/core/modules/system-setup/core-system-setup.service.js

@@ -17,6 +17,7 @@ import { ForbiddenException, Injectable, Logger } from '@nestjs/common';
 import { InjectConnection } from '../../common/persistence/mongo/mongoose-compat.js';
 import { isEmail } from 'class-validator';
 import { defaultSqlLockStore, SYSTEM_SETUP_CLAIM_STALE_AFTER_MS, SYSTEM_SETUP_LOCK_COLLECTION, SYSTEM_SETUP_LOCK_KEY, systemSetupMongoLocks, } from '../../common/persistence/infrastructure-locks.js';
+import { isLocalEnv } from '../../common/helpers/cookies.helper.js';
 import { ConfigService } from '../../common/services/config.service.js';
 import { legacyCredentialAccountIssuer } from '../better-auth/core-better-auth-account-issuer.helper.js';
 import { CoreBetterAuthUserMapper } from '../better-auth/core-better-auth-user.mapper.js';
@@ -24,6 +25,7 @@ import { CoreBetterAuthService } from '../better-auth/core-better-auth.service.j
 import { ErrorCode } from '../error-code/error-codes.js';
 import { getPersistenceRuntime } from '../../common/persistence/persistence-runtime.registry.js';
 import { getBetterAuthSqlStore } from '../better-auth/core-better-auth-sql.registry.js';
+import { isSystemSetupTokenValid, resolveSystemSetupHttpInit, SYSTEM_SETUP_TOKEN_HEADER, } from './system-setup-http-init.helper.js';
 const SETUP_LOCK_COLLECTION = SYSTEM_SETUP_LOCK_COLLECTION;
 const INITIAL_ADMIN_CLAIM_STALE_AFTER_MS = SYSTEM_SETUP_CLAIM_STALE_AFTER_MS;
 let CoreSystemSetupService = CoreSystemSetupService_1 = class CoreSystemSetupService {
@@ -40,23 +42,14 @@ let CoreSystemSetupService = CoreSystemSetupService_1 = class CoreSystemSetupSer
         this.configService = configService;
     }
     async onApplicationBootstrap() {
-        const initialAdmin = this.configService.configFastButReadOnly?.systemSetup?.initialAdmin;
+        await this.createInitialAdminFromConfig();
+        await this.reportSetupReachability();
+    }
+    async createInitialAdminFromConfig() {
+        const initialAdmin = this.usableInitialAdmin({ warn: true });
         if (!initialAdmin) {
             return;
         }
-        if (!initialAdmin.email || !initialAdmin.password) {
-            const missing = [!initialAdmin.email && 'email', !initialAdmin.password && 'password'].filter(Boolean).join(', ');
-            this.logger.warn(`Incomplete initialAdmin config - missing: ${missing}. Auto-creation skipped.`);
-            return;
-        }
-        if (!isEmail(initialAdmin.email)) {
-            this.logger.warn(`Invalid initialAdmin email format: "${initialAdmin.email}". Auto-creation skipped.`);
-            return;
-        }
-        if (!initialAdmin.password.trim()) {
-            this.logger.warn('Empty initialAdmin password. Auto-creation skipped.');
-            return;
-        }
         const status = await this.getSetupStatus();
         if (!status.needsSetup) {
             return;
@@ -82,6 +75,96 @@ let CoreSystemSetupService = CoreSystemSetupService_1 = class CoreSystemSetupSer
             }
         }
     }
+    usableInitialAdmin(options) {
+        const initialAdmin = this.configService.configFastButReadOnly?.systemSetup?.initialAdmin;
+        const skip = (message) => {
+            if (options?.warn) {
+                this.logger.warn(message);
+            }
+            return undefined;
+        };
+        if (!initialAdmin) {
+            return undefined;
+        }
+        if (!initialAdmin.email || !initialAdmin.password) {
+            const missing = [!initialAdmin.email && 'email', !initialAdmin.password && 'password'].filter(Boolean).join(', ');
+            return skip(`Incomplete initialAdmin config - missing: ${missing}. Auto-creation skipped.`);
+        }
+        if (!isEmail(initialAdmin.email)) {
+            return skip(`Invalid initialAdmin email format: "${initialAdmin.email}". Auto-creation skipped.`);
+        }
+        if (typeof initialAdmin.password !== 'string') {
+            return skip(`initialAdmin password is a ${typeof initialAdmin.password}, not a string (an all-digit ENV value is ` +
+                'converted to a number). Auto-creation skipped.');
+        }
+        if (!initialAdmin.password.trim()) {
+            return skip('Empty initialAdmin password. Auto-creation skipped.');
+        }
+        return initialAdmin;
+    }
+    currentEnv() {
+        return this.configService.configFastButReadOnly?.env ?? process.env.NODE_ENV;
+    }
+    getHttpInitPolicy() {
+        return resolveSystemSetupHttpInit(this.configService.configFastButReadOnly?.systemSetup?.httpInit, this.currentEnv());
+    }
+    assertHttpInitAllowed(token) {
+        const policy = this.getHttpInitPolicy();
+        if (!policy.enabled) {
+            throw new ForbiddenException(ErrorCode.SYSTEM_SETUP_HTTP_INIT_DISABLED);
+        }
+        if (policy.tokenRequired && !isSystemSetupTokenValid(policy.token, token)) {
+            throw new ForbiddenException(ErrorCode.SYSTEM_SETUP_TOKEN_INVALID);
+        }
+    }
+    async reportSetupReachability() {
+        const policy = this.getHttpInitPolicy();
+        if (policy.problem) {
+            this.logger.error(`POST /system-setup/init stays closed: ${policy.problem}. Set a token of at least 16 characters ` +
+                '(NSC__SYSTEM_SETUP__HTTP_INIT__TOKEN), or systemSetup.httpInit: true to open it without one.');
+        }
+        this.warnAboutIgnoredEnvironmentNames();
+        if (isLocalEnv(this.currentEnv()) || this.usableInitialAdmin() || (policy.enabled && policy.tokenRequired)) {
+            return;
+        }
+        let needsSetup;
+        try {
+            needsSetup = (await this.getSetupStatus()).needsSetup;
+        }
+        catch (error) {
+            this.logger.warn(`Could not check whether initial setup is needed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return;
+        }
+        if (!needsSetup) {
+            return;
+        }
+        const env = this.currentEnv() ?? '(not set)';
+        if (!policy.enabled) {
+            this.logger.error(`No users exist and this instance cannot be set up: environment "${env}" closes POST /system-setup/init, ` +
+                'and no initialAdmin is configured. Set NSC__SYSTEM_SETUP__INITIAL_ADMIN__EMAIL and ' +
+                'NSC__SYSTEM_SETUP__INITIAL_ADMIN__PASSWORD (created on the next start), or open the HTTP init explicitly ' +
+                'with NSC__SYSTEM_SETUP__HTTP_INIT__TOKEN=<secret of at least 16 characters> ' +
+                `(sent as the "${SYSTEM_SETUP_TOKEN_HEADER}" header).`);
+            return;
+        }
+        this.logger.warn(`No users exist and POST /system-setup/init is open without a token in environment "${env}": whoever reaches ` +
+            'the API first becomes the administrator. Prefer NSC__SYSTEM_SETUP__INITIAL_ADMIN__EMAIL / __PASSWORD, or ' +
+            'protect the init with NSC__SYSTEM_SETUP__HTTP_INIT__TOKEN.');
+    }
+    warnAboutIgnoredEnvironmentNames() {
+        for (const key of Object.keys(process.env)) {
+            if (!key.startsWith('NSC__')) {
+                continue;
+            }
+            const segments = key.slice('NSC__'.length).split('__');
+            if (segments[0]?.replace(/_/g, '').toLowerCase() !== 'systemsetup' ||
+                !segments.some((s) => /[a-z][A-Z]/.test(s))) {
+                continue;
+            }
+            const corrected = `NSC__${segments.map((s) => s.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toUpperCase()).join('__')}`;
+            this.logger.warn(`Environment variable ${key} is not read (camelCase segment). Use ${corrected} instead.`);
+        }
+    }
     async claimInitialAdminSetup() {
         const locks = await this.setupLocks();
         return locks.tryAcquire(SYSTEM_SETUP_LOCK_KEY, this.claimOwner, INITIAL_ADMIN_CLAIM_STALE_AFTER_MS / 1000);
@@ -94,6 +177,17 @@ let CoreSystemSetupService = CoreSystemSetupService_1 = class CoreSystemSetupSer
             this.logger.warn(`Failed to release initial admin setup claim: ${error instanceof Error ? error.message : 'Unknown error'}`);
         }
     }
+    async rollbackInitialAdmin(context, iamUserId, email) {
+        try {
+            await context.internalAdapter.deleteUser(iamUserId);
+            this.logger.warn(`Initial admin creation failed; the partially created user ${email} was removed again`);
+        }
+        catch (error) {
+            this.logger.error(`Initial admin creation failed and the partially created user ${email} could not be removed ` +
+                `(${error instanceof Error ? error.message : 'Unknown error'}). Remove that user and its accounts from ` +
+                '"users" and "account", otherwise initial setup stays refused because a user exists.');
+        }
+    }
     async setupLocks() {
         return ((await defaultSqlLockStore('system-setup')) ??
             systemSetupMongoLocks(this.connection.collection(SETUP_LOCK_COLLECTION)));
@@ -111,8 +205,11 @@ let CoreSystemSetupService = CoreSystemSetupService_1 = class CoreSystemSetupSer
     }
     async getSetupStatus() {
         const userCount = await this.countUsers();
+        const httpInit = this.getHttpInitPolicy();
         return {
             betterAuthEnabled: this.betterAuthService.isEnabled(),
+            httpInitEnabled: httpInit.enabled,
+            httpInitTokenRequired: httpInit.enabled && httpInit.tokenRequired,
             needsSetup: userCount === 0,
         };
     }
@@ -138,8 +235,10 @@ let CoreSystemSetupService = CoreSystemSetupService_1 = class CoreSystemSetupSer
                 `${INITIAL_ADMIN_CLAIM_STALE_AFTER_MS / 60_000} minutes.`);
             throw new ForbiddenException(ErrorCode.SYSTEM_SETUP_NOT_AVAILABLE);
         }
+        let createdIamUserId;
+        let context;
         try {
-            const context = await authInstance.$context;
+            context = await authInstance.$context;
             const normalizedPassword = this.userMapper.normalizePasswordForIam(input.password);
             const iamUser = await context.internalAdapter.createUser({
                 email: input.email,
@@ -149,6 +248,7 @@ let CoreSystemSetupService = CoreSystemSetupService_1 = class CoreSystemSetupSer
             if (!iamUser) {
                 throw new Error('Failed to create IAM user');
             }
+            createdIamUserId = iamUser.id;
             const hashedPassword = await context.password.hash(normalizedPassword);
             const credentialIssuer = legacyCredentialAccountIssuer();
             await context.internalAdapter.linkAccount({
@@ -185,6 +285,9 @@ let CoreSystemSetupService = CoreSystemSetupService_1 = class CoreSystemSetupSer
             };
         }
         catch (error) {
+            if (createdIamUserId && context) {
+                await this.rollbackInitialAdmin(context, createdIamUserId, input.email);
+            }
             await this.releaseInitialAdminSetupClaim();
             if (error instanceof Error && (error.message?.includes('duplicate key') || error.message?.includes('E11000'))) {
                 throw new ForbiddenException(ErrorCode.SYSTEM_SETUP_NOT_AVAILABLE);

package/dist/core/modules/system-setup/core-system-setup.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-system-setup.service.js","sourceRoot":"","sources":["../../../../src/core/modules/system-setup/core-system-setup.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAA0B,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI1C,OAAO,EACL,mBAAmB,EACnB,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kDAAkD,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AASxF,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAQ3D,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AAyCtE,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IAOM;IACpB;IACA;IACA;IATF,MAAM,GAAG,IAAI,MAAM,CAAC,wBAAsB,CAAC,IAAI,CAAC,CAAC;IAGjD,UAAU,GAAG,GAAG,QAAQ,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;IAE7E,YACuC,UAAsB,EAC1C,iBAAwC,EACxC,UAAoC,EACpC,aAA4B;QAHR,eAAU,GAAV,UAAU,CAAY;QAC1C,sBAAiB,GAAjB,iBAAiB,CAAuB;QACxC,eAAU,GAAV,UAAU,CAA0B;QACpC,kBAAa,GAAb,aAAa,CAAe;IAC5C,CAAC;IASJ,KAAK,CAAC,sBAAsB;QAC1B,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,WAAW,EAAE,YAAY,CAAC;QAGzF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAGD,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,OAAO,0BAA0B,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QAGD,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,YAAY,CAAC,KAAK,2BAA2B,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QAGD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAMD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC;gBAC3C,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,0CAA0C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAIf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;YACpG,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAUS,KAAK,CAAC,sBAAsB;QAMpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,UAAU,CAAC,qBAAqB,EAAE,IAAI,CAAC,UAAU,EAAE,kCAAkC,GAAG,IAAI,CAAC,CAAC;IAC7G,CAAC;IAKS,KAAK,CAAC,6BAA6B;QAC3C,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IAKS,KAAK,CAAC,UAAU;QACxB,OAAO,CACL,CAAC,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;YAC3C,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAA+B,CAAC,CACvG,CAAC;IACJ,CAAC;IAMS,KAAK,CAAC,kBAAkB;QAChC,IAAI,MAAM,mBAAmB,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,gBAAgB,qBAAqB,EAAE,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,KAAK,EAAE,oBAAoB,GAAG,IAAI,EAAE,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,qBAAqB,GAAG,EAAE,KAAK,EAAE,IAAI,qBAAqB,GAAG,EAAE,CAAC;IAC5F,CAAC;IAMS,KAAK,CAAC,UAAU;QACxB,MAAM,KAAK,GAAG,qBAAqB,EAAE,EAAE,KAAK,IAAI,CAAC,MAAM,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC;QACrG,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAKD,KAAK,CAAC,cAAc;QAClB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE;YACrD,UAAU,EAAE,SAAS,KAAK,CAAC;SAC5B,CAAC;IACJ,CAAC;IAQD,KAAK,CAAC,kBAAkB,CAAC,KAA2B;QAElD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;QAGD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC3E,CAAC;QASD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC;YAc3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,oDAAoD,KAAK,CAAC,KAAK,YAAY;gBACzE,yFAAyF;gBACzF,oFAAoF;gBACpF,iCAAiC,KAAK,CAAC,MAAM,sBAAsB;gBACnE,iEAAiE;gBACjE,GAAG,kCAAkC,GAAG,MAAM,WAAW,CAC5D,CAAC;YACF,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC;YAEH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC;YAG5C,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAqBnF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CACtD;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aAC9C,EACD,EAAE,MAAM,EAAE,OAAO,EAAE,CACpB,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YAGD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YASvE,MAAM,gBAAgB,GAAG,6BAA6B,EAAE,CAAC;YACzD,MAAM,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC;gBACxC,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,OAAO,CAAC,EAAE;aAC0C,CAAC,CAAC;YAGhE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBACxD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,IAAI;gBACnB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YAGD,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;YACpC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,UAAU;qBAClB,UAAU,CAAC,OAAO,CAAC;qBACnB,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/F,CAAC;YAGD,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAEpF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YAE9D,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,yCAAyC;gBAClD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAIf,MAAM,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAG3C,IAAI,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC9G,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACrE,CAAC;YAGD,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YACtG,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF,CAAA;AAlUY,sBAAsB;IADlC,UAAU,EAAE;IAQR,WAAA,gBAAgB,EAAE,CAAA;+CACiB,qBAAqB;QAC5B,wBAAwB;QACrB,aAAa;GAVpC,sBAAsB,CAkUlC"}
+{"version":3,"file":"core-system-setup.service.js","sourceRoot":"","sources":["../../../../src/core/modules/system-setup/core-system-setup.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAA0B,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI1C,OAAO,EACL,mBAAmB,EACnB,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kDAAkD,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAEL,uBAAuB,EACvB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAS5C,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAQ3D,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AA6DtE,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IAOM;IACpB;IACA;IACA;IATF,MAAM,GAAG,IAAI,MAAM,CAAC,wBAAsB,CAAC,IAAI,CAAC,CAAC;IAGjD,UAAU,GAAG,GAAG,QAAQ,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;IAE7E,YACuC,UAAsB,EAC1C,iBAAwC,EACxC,UAAoC,EACpC,aAA4B;QAHR,eAAU,GAAV,UAAU,CAAY;QAC1C,sBAAiB,GAAjB,iBAAiB,CAAuB;QACxC,eAAU,GAAV,UAAU,CAA0B;QACpC,kBAAa,GAAb,aAAa,CAAe;IAC5C,CAAC;IASJ,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAC1C,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;IACvC,CAAC;IAOS,KAAK,CAAC,4BAA4B;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAMD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC;gBAC3C,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,0CAA0C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAIf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;YACpG,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAOS,kBAAkB,CAAC,OAA4B;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,WAAW,EAAE,YAAY,CAAC;QACzF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAa,EAAE;YAC1C,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QAGF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QAGD,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClH,OAAO,IAAI,CAAC,6CAA6C,OAAO,0BAA0B,CAAC,CAAC;QAC9F,CAAC;QAGD,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,uCAAuC,YAAY,CAAC,KAAK,2BAA2B,CAAC,CAAC;QACpG,CAAC;QAID,IAAI,OAAO,YAAY,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,IAAI,CACT,8BAA8B,OAAO,YAAY,CAAC,QAAQ,4CAA4C;gBACpG,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAGD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAKS,UAAU;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/E,CAAC;IAMD,iBAAiB;QACf,OAAO,0BAA0B,CAC/B,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,WAAW,EAAE,QAAQ,EAC/D,IAAI,CAAC,UAAU,EAAE,CAClB,CAAC;IACJ,CAAC;IAUD,qBAAqB,CAAC,KAAe;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAYS,KAAK,CAAC,uBAAuB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yCAAyC,MAAM,CAAC,OAAO,0CAA0C;gBAC/F,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,gCAAgC,EAAE,CAAC;QAExC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3G,OAAO;QACT,CAAC;QAED,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,UAAU,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oDAAoD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC/G,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,WAAW,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,mEAAmE,GAAG,oCAAoC;gBACxG,qFAAqF;gBACrF,2GAA2G;gBAC3G,8EAA8E;gBAC9E,iBAAiB,yBAAyB,YAAY,CACzD,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sFAAsF,GAAG,qBAAqB;YAC5G,2GAA2G;YAC3G,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IASS,gCAAgC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvD,IACE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa;gBAC9D,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAC3C,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,GAAG,yCAAyC,SAAS,WAAW,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAUS,KAAK,CAAC,sBAAsB;QAMpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,UAAU,CAAC,qBAAqB,EAAE,IAAI,CAAC,UAAU,EAAE,kCAAkC,GAAG,IAAI,CAAC,CAAC;IAC7G,CAAC;IAKS,KAAK,CAAC,6BAA6B;QAC3C,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IAUS,KAAK,CAAC,oBAAoB,CAClC,OAA8E,EAC9E,SAAiB,EACjB,KAAa;QAEb,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,KAAK,oBAAoB,CAAC,CAAC;QAC3G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gEAAgE,KAAK,wBAAwB;gBAC3F,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,4CAA4C;gBACxG,qFAAqF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAKS,KAAK,CAAC,UAAU;QACxB,OAAO,CACL,CAAC,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;YAC3C,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAA+B,CAAC,CACvG,CAAC;IACJ,CAAC;IAMS,KAAK,CAAC,kBAAkB;QAChC,IAAI,MAAM,mBAAmB,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,gBAAgB,qBAAqB,EAAE,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,KAAK,EAAE,oBAAoB,GAAG,IAAI,EAAE,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,qBAAqB,GAAG,EAAE,KAAK,EAAE,IAAI,qBAAqB,GAAG,EAAE,CAAC;IAC5F,CAAC;IAMS,KAAK,CAAC,UAAU;QACxB,MAAM,KAAK,GAAG,qBAAqB,EAAE,EAAE,KAAK,IAAI,CAAC,MAAM,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC;QACrG,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAKD,KAAK,CAAC,cAAc;QAClB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC1C,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE;YACrD,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,aAAa;YACjE,UAAU,EAAE,SAAS,KAAK,CAAC;SAC5B,CAAC;IACJ,CAAC;IAWD,KAAK,CAAC,kBAAkB,CAAC,KAA2B;QAElD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;QAGD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC3E,CAAC;QASD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC;YAc3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,oDAAoD,KAAK,CAAC,KAAK,YAAY;gBACzE,yFAAyF;gBACzF,oFAAoF;gBACpF,iCAAiC,KAAK,CAAC,MAAM,sBAAsB;gBACnE,iEAAiE;gBACjE,GAAG,kCAAkC,GAAG,MAAM,WAAW,CAC5D,CAAC;YACF,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;QAGD,IAAI,gBAAoC,CAAC;QACzC,IAAI,OAA0D,CAAC;QAC/D,IAAI,CAAC;YAEH,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC;YAGtC,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAqBnF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CACtD;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aAC9C,EACD,EAAE,MAAM,EAAE,OAAO,EAAE,CACpB,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YACD,gBAAgB,GAAG,OAAO,CAAC,EAAE,CAAC;YAG9B,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YASvE,MAAM,gBAAgB,GAAG,6BAA6B,EAAE,CAAC;YACzD,MAAM,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC;gBACxC,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,OAAO,CAAC,EAAE;aAC0C,CAAC,CAAC;YAGhE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBACxD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,IAAI;gBACnB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YAGD,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;YACpC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,UAAU;qBAClB,UAAU,CAAC,OAAO,CAAC;qBACnB,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/F,CAAC;YAGD,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAEpF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YAE9D,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,yCAAyC;gBAClD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKf,IAAI,gBAAgB,IAAI,OAAO,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1E,CAAC;YAKD,MAAM,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAG3C,IAAI,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC9G,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACrE,CAAC;YAGD,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YACtG,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF,CAAA;AArgBY,sBAAsB;IADlC,UAAU,EAAE;IAQR,WAAA,gBAAgB,EAAE,CAAA;+CACiB,qBAAqB;QAC5B,wBAAwB;QACrB,aAAa;GAVpC,sBAAsB,CAqgBlC"}

package/dist/core/modules/system-setup/system-setup-http-init.helper.d.ts

@@ -0,0 +1,11 @@
+export declare const SYSTEM_SETUP_TOKEN_HEADER = "x-system-setup-token";
+export declare const SYSTEM_SETUP_TOKEN_MIN_LENGTH = 16;
+export interface ISystemSetupHttpInitPolicy {
+    enabled: boolean;
+    problem?: string;
+    source: 'config' | 'default';
+    token?: string;
+    tokenRequired: boolean;
+}
+export declare function resolveSystemSetupHttpInit(httpInit: unknown, env: string | undefined): ISystemSetupHttpInitPolicy;
+export declare function isSystemSetupTokenValid(expected: string | undefined, provided: unknown): boolean;

package/dist/core/modules/system-setup/system-setup-http-init.helper.js

@@ -0,0 +1,45 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { isLocalEnv } from '../../common/helpers/cookies.helper.js';
+export const SYSTEM_SETUP_TOKEN_HEADER = 'x-system-setup-token';
+export const SYSTEM_SETUP_TOKEN_MIN_LENGTH = 16;
+export function resolveSystemSetupHttpInit(httpInit, env) {
+    if (httpInit === true) {
+        return { enabled: true, source: 'config', tokenRequired: false };
+    }
+    if (httpInit === false) {
+        return { enabled: false, source: 'config', tokenRequired: false };
+    }
+    if (httpInit && typeof httpInit === 'object' && !Array.isArray(httpInit)) {
+        const { enabled, token } = httpInit;
+        if (enabled === false) {
+            return { enabled: false, source: 'config', tokenRequired: false };
+        }
+        const problem = tokenProblem(token);
+        if (problem) {
+            return { enabled: false, problem, source: 'config', tokenRequired: false };
+        }
+        return { enabled: true, source: 'config', token: token, tokenRequired: true };
+    }
+    return { enabled: isLocalEnv(env), source: 'default', tokenRequired: false };
+}
+export function isSystemSetupTokenValid(expected, provided) {
+    if (typeof expected !== 'string' || !expected || typeof provided !== 'string' || !provided) {
+        return false;
+    }
+    const digest = (value) => createHash('sha256').update(value, 'utf8').digest();
+    return timingSafeEqual(digest(expected), digest(provided));
+}
+function tokenProblem(token) {
+    if (token === undefined || token === null) {
+        return 'systemSetup.httpInit is an object without a token';
+    }
+    if (typeof token !== 'string') {
+        return (`systemSetup.httpInit.token is a ${typeof token}, not a string — an empty or all-digit ` +
+            'NSC__SYSTEM_SETUP__HTTP_INIT__TOKEN is converted to a number; use a token with letters');
+    }
+    if (token.trim().length < SYSTEM_SETUP_TOKEN_MIN_LENGTH) {
+        return `systemSetup.httpInit.token is shorter than ${SYSTEM_SETUP_TOKEN_MIN_LENGTH} characters`;
+    }
+    return undefined;
+}
+//# sourceMappingURL=system-setup-http-init.helper.js.map

package/dist/core/modules/system-setup/system-setup-http-init.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-setup-http-init.helper.js","sourceRoot":"","sources":["../../../../src/core/modules/system-setup/system-setup-http-init.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAUpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAWhE,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAsDhD,MAAM,UAAU,0BAA0B,CAAC,QAAiB,EAAE,GAAuB;IACnF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,QAAkD,CAAC;QAC9E,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAe,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAC/E,CAAC;AAUD,MAAM,UAAU,uBAAuB,CAAC,QAA4B,EAAE,QAAiB;IACrF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACtF,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7D,CAAC;AAGD,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CACL,mCAAmC,OAAO,KAAK,yCAAyC;YACxF,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,6BAA6B,EAAE,CAAC;QACxD,OAAO,8CAA8C,6BAA6B,aAAa,CAAC;IAClG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/index.d.ts

@@ -215,6 +215,7 @@ export * from './core/modules/permissions/permissions-scanner.js';
 export * from './core/modules/system-setup/core-system-setup.controller.js';
 export * from './core/modules/system-setup/core-system-setup.module.js';
 export * from './core/modules/system-setup/core-system-setup.service.js';
+export * from './core/modules/system-setup/system-setup-http-init.helper.js';
 export * from './core/modules/sync/core-sync-base.controller.js';
 export * from './core/modules/sync/core-sync.constants.js';
 export * from './core/modules/sync/core-sync.controller.js';

package/dist/index.js

@@ -214,6 +214,7 @@ export * from './core/modules/permissions/permissions-scanner.js';
 export * from './core/modules/system-setup/core-system-setup.controller.js';
 export * from './core/modules/system-setup/core-system-setup.module.js';
 export * from './core/modules/system-setup/core-system-setup.service.js';
+export * from './core/modules/system-setup/system-setup-http-init.helper.js';
 export * from './core/modules/sync/core-sync-base.controller.js';
 export * from './core/modules/sync/core-sync.constants.js';
 export * from './core/modules/sync/core-sync.controller.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,kBAAkB,CAAC;AAKjC,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,oDAAoD,CAAC;AACnE,cAAc,wDAAwD,CAAC;AACvE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,oDAAoD,CAAC;AACnE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,iDAAiD,CAAC;AAChE,cAAc,sDAAsD,CAAC;AACrE,cAAc,kDAAkD,CAAC;AACjE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,qDAAqD,CAAC;AACpE,cAAc,iDAAiD,CAAC;AAChE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qDAAqD,CAAC;AACpE,cAAc,oDAAoD,CAAC;AACnE,cAAc,qDAAqD,CAAC;AACpE,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qDAAqD,CAAC;AACpE,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,mDAAmD,CAAC;AAClE,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sCAAsC,CAAC;AACrD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC;AACxD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,qDAAqD,CAAC;AACpE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,sCAAsC,CAAC;AACrD,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oCAAoC,CAAC;AACnD,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,8DAA8D,CAAC;AAC7E,cAAc,sEAAsE,CAAC;AACrF,cAAc,uEAAuE,CAAC;AACtF,cAAc,uDAAuD,CAAC;AACtE,cAAc,uDAAuD,CAAC;AACtE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,8DAA8D,CAAC;AAC7E,cAAc,wDAAwD,CAAC;AACvE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uDAAuD,CAAC;AACtE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,wDAAwD,CAAC;AACvE,cAAc,uDAAuD,CAAC;AACtE,cAAc,0DAA0D,CAAC;AACzE,cAAc,0CAA0C,CAAC;AACzD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,sDAAsD,CAAC;AACrE,cAAc,iDAAiD,CAAC;AAChE,cAAc,mDAAmD,CAAC;AAClE,cAAc,wCAAwC,CAAC;AACvD,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,kDAAkD,CAAC;AACjE,cAAc,wDAAwD,CAAC;AACvE,cAAc,iDAAiD,CAAC;AAChE,cAAc,2DAA2D,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mDAAmD,CAAC;AACzF,cAAc,yCAAyC,CAAC;AACxD,cAAc,2DAA2D,CAAC;AAC1E,cAAc,yDAAyD,CAAC;AACxE,cAAc,yDAAyD,CAAC;AACxE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iDAAiD,CAAC;AAChE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,yDAAyD,CAAC;AACxE,cAAc,yCAAyC,CAAC;AACxD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,mDAAmD,CAAC;AAClE,cAAc,qDAAqD,CAAC;AACpE,cAAc,sDAAsD,CAAC;AACrE,cAAc,iDAAiD,CAAC;AAChE,cAAc,qCAAqC,CAAC;AACpD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wDAAwD,CAAC;AACvE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,0CAA0C,CAAC;AACzD,cAAc,mDAAmD,CAAC;AAClE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oDAAoD,CAAC;AACnE,cAAc,mCAAmC,CAAC;AAClD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,yCAAyC,CAAC;AACxD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,0CAA0C,CAAC;AACzD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,iDAAiD,CAAC;AAChE,cAAc,qCAAqC,CAAC;AAMpD,cAAc,sDAAsD,CAAC;AACrE,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,kDAAkD,CAAC;AACjE,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AAMnE,cAAc,iDAAiD,CAAC;AAChE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,iEAAiE,CAAC;AAChF,cAAc,mEAAmE,CAAC;AAClF,cAAc,2DAA2D,CAAC;AAC1E,cAAc,2DAA2D,CAAC;AAC1E,cAAc,kEAAkE,CAAC;AACjF,cAAc,0CAA0C,CAAC;AACzD,cAAc,wDAAwD,CAAC;AACvE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,oDAAoD,CAAC;AACnE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,uDAAuD,CAAC;AACtE,cAAc,uDAAuD,CAAC;AACtE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,yDAAyD,CAAC;AACxE,cAAc,wDAAwD,CAAC;AACvE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kEAAkE,CAAC;AACjF,cAAc,wDAAwD,CAAC;AACvE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AAMxD,cAAc,4BAA4B,CAAC;AAM3C,cAAc,qCAAqC,CAAC;AAMpD,cAAc,oCAAoC,CAAC;AAMnD,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,0CAA0C,CAAC;AACzD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,kEAAkE,CAAC;AACjF,cAAc,yDAAyD,CAAC;AAMxE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,yDAAyD,CAAC;AACxE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,0DAA0D,CAAC;AAMzE,cAAc,6BAA6B,CAAC;AAM5C,cAAc,iCAAiC,CAAC;AAMhD,cAAc,2DAA2D,CAAC;AAC1E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wDAAwD,CAAC;AACvE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mDAAmD,CAAC;AAMlE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,yDAAyD,CAAC;AACxE,cAAc,0DAA0D,CAAC;AAMzE,cAAc,kDAAkD,CAAC;AACjE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,mDAAmD,CAAC;AAClE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wDAAwD,CAAC;AACvE,cAAc,yCAAyC,CAAC;AACxD,cAAc,iDAAiD,CAAC;AAChE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wDAAwD,CAAC;AACvE,cAAc,oDAAoD,CAAC;AAMnE,cAAc,6BAA6B,CAAC;AAM5C,cAAc,mDAAmD,CAAC;AAClE,cAAc,iDAAiD,CAAC;AAChE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,8CAA8C,CAAC;AAM7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sDAAsD,CAAC;AACrE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uEAAuE,CAAC;AAMtF,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,kBAAkB,CAAC;AAKjC,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,oDAAoD,CAAC;AACnE,cAAc,wDAAwD,CAAC;AACvE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,oDAAoD,CAAC;AACnE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,iDAAiD,CAAC;AAChE,cAAc,sDAAsD,CAAC;AACrE,cAAc,kDAAkD,CAAC;AACjE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,qDAAqD,CAAC;AACpE,cAAc,iDAAiD,CAAC;AAChE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qDAAqD,CAAC;AACpE,cAAc,oDAAoD,CAAC;AACnE,cAAc,qDAAqD,CAAC;AACpE,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qDAAqD,CAAC;AACpE,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,mDAAmD,CAAC;AAClE,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2DAA2D,CAAC;AAC1E,cAAc,sCAAsC,CAAC;AACrD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yCAAyC,CAAC;AACxD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,qDAAqD,CAAC;AACpE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,sCAAsC,CAAC;AACrD,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,0CAA0C,CAAC;AACzD,cAAc,sCAAsC,CAAC;AACrD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oCAAoC,CAAC;AACnD,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,0DAA0D,CAAC;AACzE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,8DAA8D,CAAC;AAC7E,cAAc,sEAAsE,CAAC;AACrF,cAAc,uEAAuE,CAAC;AACtF,cAAc,uDAAuD,CAAC;AACtE,cAAc,uDAAuD,CAAC;AACtE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,8DAA8D,CAAC;AAC7E,cAAc,wDAAwD,CAAC;AACvE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uDAAuD,CAAC;AACtE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,wDAAwD,CAAC;AACvE,cAAc,uDAAuD,CAAC;AACtE,cAAc,0DAA0D,CAAC;AACzE,cAAc,0CAA0C,CAAC;AACzD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,sDAAsD,CAAC;AACrE,cAAc,iDAAiD,CAAC;AAChE,cAAc,mDAAmD,CAAC;AAClE,cAAc,wCAAwC,CAAC;AACvD,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,yDAAyD,CAAC;AACxE,cAAc,sDAAsD,CAAC;AACrE,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AACnE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,kDAAkD,CAAC;AACjE,cAAc,wDAAwD,CAAC;AACvE,cAAc,iDAAiD,CAAC;AAChE,cAAc,2DAA2D,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mDAAmD,CAAC;AACzF,cAAc,yCAAyC,CAAC;AACxD,cAAc,2DAA2D,CAAC;AAC1E,cAAc,yDAAyD,CAAC;AACxE,cAAc,yDAAyD,CAAC;AACxE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iDAAiD,CAAC;AAChE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,yDAAyD,CAAC;AACxE,cAAc,yCAAyC,CAAC;AACxD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uDAAuD,CAAC;AACtE,cAAc,mDAAmD,CAAC;AAClE,cAAc,qDAAqD,CAAC;AACpE,cAAc,sDAAsD,CAAC;AACrE,cAAc,iDAAiD,CAAC;AAChE,cAAc,qCAAqC,CAAC;AACpD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wDAAwD,CAAC;AACvE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC;AACjE,cAAc,0CAA0C,CAAC;AACzD,cAAc,mDAAmD,CAAC;AAClE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oDAAoD,CAAC;AACnE,cAAc,mCAAmC,CAAC;AAClD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,yCAAyC,CAAC;AACxD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,0CAA0C,CAAC;AACzD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,iDAAiD,CAAC;AAChE,cAAc,qCAAqC,CAAC;AAMpD,cAAc,sDAAsD,CAAC;AACrE,cAAc,uDAAuD,CAAC;AACtE,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC;AACtE,cAAc,kDAAkD,CAAC;AACjE,cAAc,mDAAmD,CAAC;AAClE,cAAc,oDAAoD,CAAC;AAMnE,cAAc,iDAAiD,CAAC;AAChE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,iEAAiE,CAAC;AAChF,cAAc,mEAAmE,CAAC;AAClF,cAAc,2DAA2D,CAAC;AAC1E,cAAc,2DAA2D,CAAC;AAC1E,cAAc,kEAAkE,CAAC;AACjF,cAAc,0CAA0C,CAAC;AACzD,cAAc,wDAAwD,CAAC;AACvE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,oDAAoD,CAAC;AACnE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,uDAAuD,CAAC;AACtE,cAAc,uDAAuD,CAAC;AACtE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,yDAAyD,CAAC;AACxE,cAAc,wDAAwD,CAAC;AACvE,cAAc,mDAAmD,CAAC;AAClE,cAAc,kEAAkE,CAAC;AACjF,cAAc,wDAAwD,CAAC;AACvE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AAMxD,cAAc,4BAA4B,CAAC;AAM3C,cAAc,qCAAqC,CAAC;AAMpD,cAAc,oCAAoC,CAAC;AAMnD,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,0CAA0C,CAAC;AACzD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,kEAAkE,CAAC;AACjF,cAAc,yDAAyD,CAAC;AAMxE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,yDAAyD,CAAC;AACxE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,0DAA0D,CAAC;AAMzE,cAAc,6BAA6B,CAAC;AAM5C,cAAc,iCAAiC,CAAC;AAMhD,cAAc,2DAA2D,CAAC;AAC1E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wDAAwD,CAAC;AACvE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mDAAmD,CAAC;AAMlE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,yDAAyD,CAAC;AACxE,cAAc,0DAA0D,CAAC;AACzE,cAAc,8DAA8D,CAAC;AAM7E,cAAc,kDAAkD,CAAC;AACjE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,mDAAmD,CAAC;AAClE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wDAAwD,CAAC;AACvE,cAAc,yCAAyC,CAAC;AACxD,cAAc,iDAAiD,CAAC;AAChE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wDAAwD,CAAC;AACvE,cAAc,oDAAoD,CAAC;AAMnE,cAAc,6BAA6B,CAAC;AAM5C,cAAc,mDAAmD,CAAC;AAClE,cAAc,iDAAiD,CAAC;AAChE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,8CAA8C,CAAC;AAM7D,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,sDAAsD,CAAC;AACrE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uEAAuE,CAAC;AAMtF,cAAc,uBAAuB,CAAC"}

package/dist/server/modules/error-code/error-codes.d.ts

@@ -71,6 +71,8 @@ export declare const ErrorCode: {
     SYSTEM_SETUP_NOT_AVAILABLE: string;
     SYSTEM_SETUP_DISABLED: string;
     SYSTEM_SETUP_BETTERAUTH_REQUIRED: string;
+    SYSTEM_SETUP_HTTP_INIT_DISABLED: string;
+    SYSTEM_SETUP_TOKEN_INVALID: string;
     AI_NO_CONNECTION: string;
     AI_CONNECTION_DISABLED: string;
     AI_CONNECTION_NOT_AVAILABLE: string;

package/migration-guides/11.13.x-to-11.14.0.md

@@ -49,9 +49,9 @@ New module for creating the first admin user on fresh deployments, especially us
 
 ```bash
 # .env or Docker environment
-NSC__systemSetup__initialAdmin__email=admin@example.com
-NSC__systemSetup__initialAdmin__password=YourSecurePassword123!
-NSC__systemSetup__initialAdmin__name=Admin  # optional
+NSC__SYSTEM_SETUP__INITIAL_ADMIN__EMAIL=admin@example.com
+NSC__SYSTEM_SETUP__INITIAL_ADMIN__PASSWORD=YourSecurePassword123!
+NSC__SYSTEM_SETUP__INITIAL_ADMIN__NAME=Admin  # optional
 ```
 
 Or in `config.env.ts`:
@@ -190,8 +190,8 @@ betterAuth: {
 
 ```bash
 # .env
-NSC__systemSetup__initialAdmin__email=admin@example.com
-NSC__systemSetup__initialAdmin__password=YourSecurePassword123!
+NSC__SYSTEM_SETUP__INITIAL_ADMIN__EMAIL=admin@example.com
+NSC__SYSTEM_SETUP__INITIAL_ADMIN__PASSWORD=YourSecurePassword123!
 ```
 
 ### Step 4: Build and Test

package/migration-guides/12.3.x-to-12.4.x.md

@@ -0,0 +1,169 @@
+# Migration Guide: 12.3.x → 12.4.x
+
+## 12.4.0 contains breaking changes
+
+The version number moves only the MINOR digit (the MAJOR follows NestJS). Read §1 before you update: a deployed
+instance that creates its first administrator through `POST /system-setup/init` (a setup page in the frontend) is
+refused from now on until it is configured.
+
+## Overview
+
+| Category | Details |
+|---|---|
+| **Breaking Changes** | `POST /system-setup/init` is closed outside `local`, `ci` and `e2e` unless `systemSetup.httpInit` opens it (§1) |
+| **New Features** | `systemSetup.httpInit` (`true` or `{ token }`), the `X-System-Setup-Token` header, `httpInitEnabled` / `httpInitTokenRequired` in `GET /system-setup/status`, error codes `LTNS_0053` / `LTNS_0054`, a boot report for a deployment that cannot be set up (§1) |
+| **Bugfixes** | A deployed instance without `initialAdmin` could be taken over through the anonymous init (§1). A creation that failed after the user was written left a user without the admin role behind and locked the setup for good (§2). The documented ENV names for `initialAdmin` were never read (§3) |
+| **Migration Effort** | None for a deployment that provisions its first admin through `initialAdmin`, and none locally. A deployed stage set up through the UI: one ENV variable (§1). A project using the camelCase ENV names: rename them (§3) |
+
+## Quick Migration
+
+```bash
+pnpm add @lenne.tech/nest-server@12.4.0
+pnpm run update   # nest-server-starter based projects: aligns the pins the framework raised
+pnpm run build
+pnpm test
+```
+
+**Vendor mode**: run `/lt-dev:backend:update-nest-server-core` as usual.
+
+Local development and the e2e suites of a starter-based project keep working without a change: `local`, `ci` and
+`e2e` keep the init open.
+
+## 1. The HTTP init is fail-closed outside the local environments
+
+`POST /system-setup/init` is anonymous (`S_EVERYONE`). Until 12.4.0 its only guard was "no user exists yet", in every
+environment, so every deployed instance that went live without `systemSetup.initialAdmin` could be taken over by
+whoever called the route before the first person signed up — an administrator account for anybody who found the API.
+
+**What changes:** outside `local`, `ci` and `e2e` the init answers **403 `LTNS_0053`** unless `systemSetup.httpInit`
+opens it. The environment is the configured `env` (else `NODE_ENV`); the deployed `develop` and `test` stages of a
+starter-based project, `production`, `staging` and any unknown or missing name count as deployed.
+
+| `systemSetup.httpInit` | `local` / `ci` / `e2e` | every other environment |
+|---|---|---|
+| not set | open | **closed** — 403 `LTNS_0053` |
+| `true` | open | open, without a token |
+| `{ token: '<at least 16 characters>' }` | open, token required | open, token required — 403 `LTNS_0054` without it |
+| `false` / `{ enabled: false }` | closed | closed |
+
+`systemSetup.initialAdmin` is not affected: the configured admin is still created at boot in every environment.
+
+**What to do on a deployed stage**, preferred first:
+
+1. **Provision the admin via ENV** — created on the next start, no setup page needed:
+
+   ```bash
+   NSC__SYSTEM_SETUP__INITIAL_ADMIN__EMAIL=admin@example.com
+   NSC__SYSTEM_SETUP__INITIAL_ADMIN__PASSWORD=<strong password>
+   ```
+
+2. **Open the init with a token** when the setup must happen through the UI:
+
+   ```bash
+   NSC__SYSTEM_SETUP__HTTP_INIT__TOKEN=<secret of at least 16 characters, with letters>
+   ```
+
+   The frontend sends it in the `X-System-Setup-Token` header. Remove the variable once the admin exists.
+
+3. **Open the init without a token** (`NSC__SYSTEM_SETUP__HTTP_INIT=true`) only where nobody else can reach the API
+   before you do: whoever calls it first becomes the administrator. The boot warns about it while no user exists.
+
+**A misconfiguration closes, it never opens.** `httpInit: { token: process.env.SETUP_TOKEN }` with the variable unset,
+an empty or short token, or an empty / all-digit `NSC__SYSTEM_SETUP__HTTP_INIT__TOKEN` (the environment reader turns
+it into a number) keep the init closed and log an error at boot naming the problem. A string `"true"` from
+`NEST_SERVER_CONFIG` counts as not set.
+
+**Frontend:** `GET /system-setup/status` additionally returns `httpInitEnabled` and `httpInitTokenRequired`, always,
+whatever `needsSetup` says. Show the setup form only when `needsSetup && httpInitEnabled`, with a token field when
+`httpInitTokenRequired`. A backend older than 12.4.0 sends neither field; treat that as "available" (as before).
+`@lenne.tech/nuxt-extensions` handles this from its next release on.
+
+```typescript
+const { needsSetup, httpInitEnabled = true, httpInitTokenRequired = false } = await status.json();
+if (needsSetup && httpInitEnabled) {
+  await fetch('/system-setup/init', {
+    body: JSON.stringify({ email, name, password }),
+    headers: {
+      'Content-Type': 'application/json',
+      ...(httpInitTokenRequired ? { 'X-System-Setup-Token': setupToken } : {}),
+    },
+    method: 'POST',
+  });
+}
+```
+
+**Boot report.** A deployed instance that starts with zero users, no usable `initialAdmin` and a closed init now logs
+an error that names both ways in — before, it stayed silent until somebody tried to sign in.
+
+**Swagger:** while the init is closed, `POST /system-setup/init` is left out of the document `setupSwagger()` builds.
+
+**A project controller** that extends `CoreSystemSetupController` and overrides `createInitialAdmin()` must call
+`this.systemSetupService.assertHttpInitAllowed(token)` first (the token read with
+`@Headers(SYSTEM_SETUP_TOKEN_HEADER)`); otherwise the override keeps the init open in every environment. A project's
+own endpoint that calls `CoreSystemSetupService.createInitialAdmin()` directly does the same.
+
+## 2. A failed creation no longer leaves a user behind
+
+When a step after creating the user failed (linking the credential account, the user sync, the role update, the legacy
+password), only the setup claim was released. The user stayed — without the admin role — so `needsSetup` turned
+`false` and the init was refused for good: a deployment with a user and no administrator, recoverable only by editing
+the database.
+
+**What changes:** the partially created user is removed again (`internalAdapter.deleteUser()`: sessions, accounts and
+the `users` row), `needsSetup` stays `true`, and the setup can be retried. The caller still gets 403 `LTNS_0050`, and
+the server log names the original failure. If the removal itself fails, the log says which user to delete by hand.
+
+**What to check on an instance that hit this before 12.4.0:** a `users` row without the admin role and no
+administrator anywhere. Delete that row and its `account` rows, then provision the admin as in §1.
+
+## 3. The ENV names for `initialAdmin`
+
+The README, the integration checklist, the interface documentation and the 11.14.0 migration guide named the
+variables `NSC__systemSetup__initialAdmin__email` / `__password` / `__name`. The environment reader lowercases every
+segment it does not split at `_`, so those land under `systemsetup.initialadmin` — a key nothing reads — and no admin
+was ever created from them.
+
+**The names that work:**
+
+```bash
+NSC__SYSTEM_SETUP__INITIAL_ADMIN__EMAIL=admin@example.com
+NSC__SYSTEM_SETUP__INITIAL_ADMIN__PASSWORD=<strong password>
+NSC__SYSTEM_SETUP__INITIAL_ADMIN__NAME=Admin   # optional
+```
+
+Since 12.4.0 the boot warns about a `NSC__systemSetup__…` variable and names its correct spelling (names only, never
+values). The environment reader itself is unchanged: it applies to every setting of every project.
+
+## Compatibility Notes
+
+| Pattern | Status |
+|---|---|
+| `systemSetup.initialAdmin` via config or (SCREAMING_SNAKE) ENV | Unchanged |
+| Setup page used locally / in e2e suites (`local`, `ci`, `e2e`) | Unchanged |
+| Setup page used on a deployed stage without configuration | **403 `LTNS_0053`** — see §1 |
+| `systemSetup: { enabled: false }` | Unchanged (no endpoints at all) |
+| `CoreSystemSetupService.createInitialAdmin()` called by project code | Not gated — call `assertHttpInitAllowed()` first on an HTTP path |
+| A frontend reading `GET /system-setup/status` | Two additional fields; existing fields unchanged |
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---|---|---|
+| 403 `LTNS_0053` on a deployed stage | The init is closed there by default | `initialAdmin` via ENV, or `NSC__SYSTEM_SETUP__HTTP_INIT__TOKEN` (§1) |
+| 403 `LTNS_0054` | Token missing or different | Send the configured value in `X-System-Setup-Token` |
+| Boot error "POST /system-setup/init stays closed" | The token configuration is unusable (missing, empty, short, a number) | Set a token of at least 16 characters with letters |
+| Boot error "No users exist and this instance cannot be set up" | Deployed, no users, no usable `initialAdmin`, init closed | One of the ways in §1 |
+| Boot warning "Environment variable NSC__systemSetup__… is not read" | camelCase ENV names | Rename as in §3 |
+
+## Module Documentation
+
+### System Setup
+
+- [README](../src/core/modules/system-setup/README.md) — "HTTP init (`systemSetup.httpInit`)"
+- [Integration Checklist](../src/core/modules/system-setup/INTEGRATION-CHECKLIST.md) — Steps 1 and 1b
+
+## References
+
+- `src/core/modules/system-setup/system-setup-http-init.helper.ts` — `resolveSystemSetupHttpInit()`, `isSystemSetupTokenValid()`
+- `src/core/modules/system-setup/core-system-setup.service.ts` — `assertHttpInitAllowed()`, `reportSetupReachability()`, `rollbackInitialAdmin()`
+- `.claude/rules/configurable-features.md` — "System Setup" row

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "12.3.2",
+  "version": "12.4.0",
   "type": "module",
   "description": "Server framework in TypeScript on top of NestJS: GraphQL and REST APIs on MongoDB, PostgreSQL, MySQL or MariaDB, with authentication, field-level permissions, multi-tenancy, offline sync and an AI assistant.",
   "keywords": [

package/src/core/common/helpers/swagger.helper.ts

@@ -22,6 +22,8 @@ import { CoreBetterAuthService } from '../../modules/better-auth/core-better-aut
 import { CoreHubActionsController } from '../../modules/hub/core-hub-actions.controller.js';
 import { CoreHubController } from '../../modules/hub/core-hub.controller.js';
 import { isHubEnabled, normalizeHubConfig } from '../../modules/hub/hub-config.helper.js';
+import { CoreSystemSetupController } from '../../modules/system-setup/core-system-setup.controller.js';
+import { resolveSystemSetupHttpInit } from '../../modules/system-setup/system-setup-http-init.helper.js';
 import { SKIP_TENANT_CHECK_KEY } from '../../modules/tenant/core-tenant.decorators.js';
 import { API_METHODS_KEY } from '../decorators/api-methods.decorator.js';
 import { mergeRolesMetadata } from '../../modules/tenant/core-tenant.helpers.js';
@@ -419,6 +421,11 @@ function isSwitchedOffOperation(reference: IHandlerReference, method: string, av
   ) {
     return !HUB_AVAILABILITY[handlerName](availability, availability.hub);
   }
+  // The anonymous init answers LTNS_0053 to everybody where `systemSetup.httpInit` keeps it closed (12.4.0+)
+  if (extendsClass(controller, CoreSystemSetupController) && handlerName === 'createInitialAdmin') {
+    const { env, systemSetup } = availability.config;
+    return !resolveSystemSetupHttpInit(systemSetup?.httpInit, env ?? process.env.NODE_ENV).enabled;
+  }
   return false;
 }