@nonext/husk 0.2.3 → 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/README.md +28 -2
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -8,6 +8,16 @@ what shipped.
|
|
|
8
8
|
While the package is on `0.x` the minor version is where breaking changes go. A note that
|
|
9
9
|
describes a breaking change says so in its first line.
|
|
10
10
|
|
|
11
|
+
## 0.2.4
|
|
12
|
+
|
|
13
|
+
### Patch Changes
|
|
14
|
+
|
|
15
|
+
- Document how to sign in to the admin for the first time, in both the root README and the
|
|
16
|
+
package README: the seeded playground credentials, the `scripts/husk-first-admin.mjs`
|
|
17
|
+
command for a freshly scaffolded project, and what a non-emulator deployment still has to
|
|
18
|
+
supply (a signature-checking token verifier and a privileged claim writer) before anyone can
|
|
19
|
+
sign in at all.
|
|
20
|
+
|
|
11
21
|
## 0.2.3
|
|
12
22
|
|
|
13
23
|
### Patch Changes
|
package/README.md
CHANGED
|
@@ -81,8 +81,34 @@ and differs, and prints the difference rather than replacing your work. `doctor`
|
|
|
81
81
|
non-zero when it finds a problem and reports what it cannot check without a real Firebase
|
|
82
82
|
project as `unchecked`, with the reason.
|
|
83
83
|
|
|
84
|
-
|
|
85
|
-
|
|
84
|
+
### Signing in for the first time
|
|
85
|
+
|
|
86
|
+
There is no sign-up screen. An admin interface that lets a stranger create an account is not
|
|
87
|
+
an admin interface, so the *first* account has to come from somewhere else: `init` also
|
|
88
|
+
writes `scripts/husk-first-admin.mjs`, which creates it and claims admin for you.
|
|
89
|
+
|
|
90
|
+
```bash
|
|
91
|
+
npx firebase emulators:start --only auth,firestore,storage # in one terminal
|
|
92
|
+
node scripts/husk-first-admin.mjs you@example.com a-password # in another
|
|
93
|
+
npm run dev
|
|
94
|
+
```
|
|
95
|
+
|
|
96
|
+
Then open `<your-admin-route>` (`/admin` by default) and sign in with that email and
|
|
97
|
+
password. Every account after this one is created by an admin from inside the admin UI, not
|
|
98
|
+
by signing up.
|
|
99
|
+
|
|
100
|
+
That script only exists for an emulator-backed scaffold (`init`'s default). If you ran
|
|
101
|
+
`init --no-emulators`, you're pointed at a real Firebase project, and two things are yours to
|
|
102
|
+
build before anyone can sign in at all:
|
|
103
|
+
|
|
104
|
+
- **A token verifier** that checks a signature against Google's public keys. The generated
|
|
105
|
+
fallback rejects every token, which is fail-closed on purpose.
|
|
106
|
+
- **A privileged claim writer** (a Cloud Function or an Admin SDK service) that mints the
|
|
107
|
+
role claim `firestore.rules` reads, re-checking `settings/bootstrap` and `users/{uid}`
|
|
108
|
+
itself rather than trusting a role sent from a browser.
|
|
109
|
+
|
|
110
|
+
The full six-step setup, including those two pieces in detail, is in
|
|
111
|
+
`docs/getting-started.md` in the repository.
|
|
86
112
|
|
|
87
113
|
## Entry points
|
|
88
114
|
|