lobstakit-cloud 1.0.7 → 1.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lobstakit-cloud",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "LobstaKit Cloud — Setup wizard and management for LobstaCloud gateways",
   "main": "server.js",
   "bin": {

package/server.js

@@ -307,14 +307,17 @@ app.get('/api/provision', (req, res) => {
   if (provision) {
     const token = req.headers.authorization?.replace('Bearer ', '');
     const isAuthenticated = token && activeSessions.has(token);
+    const lobstaConfig = getLobstaKitConfig();
+    const setupNotComplete = !lobstaConfig.passwordHash;
     const response = {
       provisioned: true,
       email: isAuthenticated ? (provision.email || null) : maskEmail(provision.email || ''),
       subdomain: provision.subdomain || null,
       plan: provision.plan || null,
     };
-    // Only expose setupToken to authenticated sessions
-    if (isAuthenticated && provision.setupToken) {
+    // Return setupToken during initial setup (before password is set) OR to authenticated sessions
+    // This is safe because setupToken is only useful ONCE (to set the initial password)
+    if (provision.setupToken && (setupNotComplete || isAuthenticated)) {
       response.setupToken = provision.setupToken;
     }
     res.json(response);