kempo 4.4.1 → 4.4.2

package/README.md

@@ -43,7 +43,12 @@ Your site is running at `http://localhost:3000`.
 
 ### Create an Admin User
 
-Register a user through the UI at `/register`, then promote them:
+`npx kempo init` asks how to create the first admin:
+
+- **In the terminal** - the wizard prompts for a name, email and password.
+- **In the browser** - visit `/setup` on your new site and fill in the form. The setup page and its API route are deleted from `public/setup/` as soon as the admin is created, and they refuse to run (and delete themselves) if an administrator already exists, so they can only be used once.
+
+To promote an existing user instead, register through the UI at `/register`, then run:
 
 ```bash
 node node_modules/kempo/scripts/make-admin.js
@@ -64,6 +69,7 @@ Kempo scaffolds these pages into your `public/` directory. All are fully functio
 | `/` | Home page |
 | `/login` | Login form |
 | `/register` | Registration form |
+| `/setup` | First-run admin setup (deletes itself once an admin exists) |
 | `/forgot-password` | Password recovery |
 | `/reset-password/[token]` | Password reset (from email link) |
 | `/verify-email` | Email verification notice |

package/app-public/setup/api/GET.js

@@ -0,0 +1,23 @@
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+import hasAdmin from 'kempo/server/utils/setup/hasAdmin.js';
+import removeSetupFiles from 'kempo/server/utils/setup/removeSetupFiles.js';
+
+/*
+  Tells the setup page whether it is still needed. If an administrator was created some other way
+  (init, makeAdmin) the setup files are deleted here, so they never outlive their purpose.
+*/
+export default async (request, response) => {
+  const [error, adminExists] = await hasAdmin();
+
+  if(error){
+    return response.status(error.code).json({ error: error.msg });
+  }
+
+  if(adminExists){
+    await removeSetupFiles({ setupDir: join(dirname(fileURLToPath(import.meta.url)), '..') });
+    return response.status(404).json({ error: 'Setup is already complete' });
+  }
+
+  response.json({ available: true });
+};

package/app-public/setup/api/POST.js

@@ -0,0 +1,28 @@
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+import completeSetup from 'kempo/server/utils/setup/completeSetup.js';
+
+/*
+  Creates the first administrator and then deletes the whole setup directory, this route included.
+  It only ever works once: completeSetup refuses when an administrator already exists.
+*/
+export default async (request, response) => {
+  try {
+    const { name, email, password } = request.body || {};
+    const [error, result] = await completeSetup({
+      name,
+      email,
+      password,
+      setupDir: join(dirname(fileURLToPath(import.meta.url)), '..')
+    });
+
+    if(error){
+      return response.status(error.code).json({ error: error.msg });
+    }
+
+    response.json({ user: result.user });
+  } catch(error){
+    console.error('Setup error:', error);
+    response.status(500).json({ error: 'Internal server error' });
+  }
+};

package/app-public/setup/index.page.html

@@ -0,0 +1,59 @@
+<!--
+  owner: system
+  title: Setup
+  description: First-run page that creates the initial administrator and then deletes itself
+-->
+<page title="Set up your site">
+<content>
+	<main class="p">
+		<div>
+			<h2>Welcome to Kempo</h2>
+			<p>Create the administrator account for your site. This page deletes itself once you are done.</p>
+			<form id="setupForm">
+				<div class="mb">
+					<label for="name" class="d-b mb-sm">Name</label>
+					<input type="text" id="name" name="name" required class="w-full p-sm br">
+				</div>
+				<div class="mb">
+					<label for="email" class="d-b mb-sm">Email</label>
+					<input type="email" id="email" name="email" required class="w-full p-sm br">
+				</div>
+				<div class="mb">
+					<label for="password" class="d-b mb-sm">Password</label>
+					<input type="password" id="password" name="password" minlength="8" required class="w-full p-sm br">
+				</div>
+				<button type="submit" class="w-full p-sm br">Create administrator</button>
+			</form>
+		</div>
+	</main>
+</content>
+<content location="scripts">
+	<script type="module">
+		import Toast from '{{pathToRoot}}kempo-ui/components/Toast.js';
+
+		const status = await fetch('{{pathToRoot}}setup/api');
+		if(!status.ok){
+			window.location.href = '{{pathToRoot}}';
+		}
+
+		document.getElementById('setupForm').addEventListener('submit', async (e) => {
+			e.preventDefault();
+			const response = await fetch('{{pathToRoot}}setup/api', {
+				method: 'POST',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify({
+					name: document.getElementById('name').value,
+					email: document.getElementById('email').value,
+					password: document.getElementById('password').value
+				})
+			});
+			const body = await response.json();
+			if(!response.ok){
+				Toast.error(body.error);
+				return;
+			}
+			window.location.href = '{{pathToRoot}}login';
+		});
+	</script>
+</content>
+</page>

package/bin/cli.js

@@ -82,6 +82,7 @@ const printManualSteps = (databaseUrl) => {
   console.log('  docker compose up -d');
   console.log('  npx drizzle-kit push');
   console.log('  node node_modules/kempo/scripts/init-db.js');
+  console.log('  Then create your admin at http://localhost:9876/setup, or register and run:');
   console.log(`  DATABASE_URL="${databaseUrl}" node node_modules/kempo/scripts/make-admin.js`);
   console.log('  npm run dev\n');
 };
@@ -222,7 +223,19 @@ const databaseUrl = customDatabaseUrl || `postgresql://kempo:${dbPassword}@local
 const generatedAdminPassword = generatePassword();
 let adminName, adminEmail, adminPassword;
 
-if(useDefaults){
+const adminSetupChoice = useDefaults ? 'terminal' : (await inquirer.prompt([{
+  type: 'select',
+  name: 'adminSetup',
+  message: 'How would you like to create the first admin user?',
+  choices: [
+    { name: 'Here in the terminal', value: 'terminal' },
+    { name: 'In the browser (a /setup page that deletes itself once used)', value: 'browser' }
+  ]
+}])).adminSetup;
+
+if(adminSetupChoice === 'browser'){
+  // The admin is created on the /setup page instead
+} else if(useDefaults){
   adminName = 'Admin';
   adminEmail = 'admin@example.com';
   adminPassword = generatedAdminPassword;
@@ -245,7 +258,8 @@ if(useDefaults){
       type: 'password',
       name: 'adminPassword',
       message: 'Admin user password (leave blank to generate one):',
-      mask: '*'
+      mask: '*',
+      validate: v => !v || v.length >= 8 || 'Password must be at least 8 characters'
     }
   ]);
   adminName = adminAnswers.adminName;
@@ -467,26 +481,26 @@ execSync('node node_modules/kempo/scripts/init-db.js', { cwd: projectDir, stdio:
   Step 8: Create admin user
 */
 
-console.log('\n--- Creating admin user ---\n');
-
 process.env.DATABASE_URL = databaseUrl;
 
-const { default: createUser } = await import(pathToFileURL(join(moduleRoot, 'server', 'utils', 'users', 'createUser.js')).href);
-const { default: addUserToGroup } = await import(pathToFileURL(join(moduleRoot, 'server', 'utils', 'groups', 'addUserToGroup.js')).href);
+if(adminSetupChoice === 'terminal'){
+  console.log('\n--- Creating admin user ---\n');
 
-const [createError, createdUser] = await createUser({
-  name: adminName,
-  email: adminEmail,
-  password: adminPassword,
-  emailVerified: true
-});
+  /*
+    The same routine the /setup page uses: it creates the admin and then deletes public/setup/, so
+    this path leaves no setup page behind. If it fails no admin exists, so the setup page stays.
+  */
+  const { default: completeSetup } = await import(pathToFileURL(join(moduleRoot, 'server', 'utils', 'setup', 'completeSetup.js')).href);
 
-if(createError){
-  console.error(`Failed to create admin user: ${createError.msg}`);
-} else {
-  const [groupError] = await addUserToGroup(createdUser.user.id, 'system:Administrators');
-  if(groupError){
-    console.error(`Failed to assign admin role: ${groupError.msg}`);
+  const [setupError] = await completeSetup({
+    name: adminName,
+    email: adminEmail,
+    password: adminPassword,
+    setupDir: join(projectDir, 'public', 'setup')
+  });
+
+  if(setupError){
+    console.error(`Failed to create admin user: ${setupError.msg}`);
   } else {
     console.log(`Admin user created: ${adminEmail}`);
   }
@@ -501,10 +515,13 @@ console.log(`
 ║        Kempo setup complete!             ║
 ╚══════════════════════════════════════════╝
 
-Admin credentials:
+${adminSetupChoice === 'browser' ? `Create your admin user in the browser:
+  http://localhost:9876/setup
+  (the setup page deletes itself once you finish)
+` : `Admin credentials:
   Email:    ${adminEmail}
   Password: ${adminPassword}
-${emailServiceSkipped ? '\n  Note: Email is not configured. Update RESEND_API_KEY in .env when ready.\n' : ''}
+`}${emailServiceSkipped ? '\n  Note: Email is not configured. Update RESEND_API_KEY in .env when ready.\n' : ''}
 Next steps:
   npm run dev
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo",
-  "version": "4.4.1",
+  "version": "4.4.2",
   "type": "module",
   "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {

package/server/utils/setup/completeSetup.js

@@ -0,0 +1,49 @@
+import createUser from '../users/createUser.js';
+import addUserToGroup from '../groups/addUserToGroup.js';
+import hasAdmin from './hasAdmin.js';
+import removeSetupFiles from './removeSetupFiles.js';
+
+let running = false;
+
+export default async ({ name, email, password, setupDir }) => {
+  if(!password || password.length < 8){
+    return [{ code: 400, msg: 'Password must be at least 8 characters' }, null];
+  }
+
+  /*
+    The admin check and the user insert are not one transaction, so two simultaneous requests on a
+    fresh install could both pass the check. Setup runs once per install, so a process-level lock
+    is enough to close that.
+  */
+  if(running){
+    return [{ code: 409, msg: 'Setup is already in progress' }, null];
+  }
+  running = true;
+
+  try {
+    const [checkError, adminExists] = await hasAdmin();
+    if(checkError){
+      return [checkError, null];
+    }
+    if(adminExists){
+      await removeSetupFiles({ setupDir });
+      return [{ code: 404, msg: 'Setup is already complete' }, null];
+    }
+
+    const [createError, created] = await createUser({ name, email, password, emailVerified: true });
+    if(createError){
+      return [createError, null];
+    }
+
+    const [groupError] = await addUserToGroup(created.user.id, 'system:Administrators');
+    if(groupError){
+      return [groupError, null];
+    }
+
+    const [removeError] = await removeSetupFiles({ setupDir });
+
+    return [null, { user: created.user, setupFilesRemoved: !removeError }];
+  } finally {
+    running = false;
+  }
+};

package/server/utils/setup/hasAdmin.js

@@ -0,0 +1,12 @@
+import db from '../../db/index.js';
+import { userGroup } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async () => {
+  try {
+    const [found] = await db.select().from(userGroup).where(eq(userGroup.groupName, 'system:Administrators')).limit(1);
+    return [null, !!found];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to check for an administrator' }, null];
+  }
+};

package/server/utils/setup/removeSetupFiles.js

@@ -0,0 +1,24 @@
+import { rm } from 'fs/promises';
+
+export default async ({ setupDir }) => {
+  if(!setupDir){
+    return [{ code: 400, msg: 'Setup directory is required' }, null];
+  }
+
+  try {
+    await rm(setupDir, { recursive: true, force: true });
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to remove the setup files' }, null];
+  }
+
+  /*
+    A running server only learns the files are gone on its next scan; without this the deleted
+    page and route would keep answering until the process restarts.
+  */
+  try {
+    const { default: rescan } = await import('kempo-server/rescan');
+    await rescan();
+  } catch {}
+
+  return [null, { removed: true }];
+};