lytx 0.3.6 → 0.3.8

package/README.md

@@ -72,7 +72,7 @@ export default app satisfies ExportedHandler<Env>;
 - `trackingRoutePrefix` (prefix all tracking routes, e.g. `/collect`)
 - `tagRoutes.scriptPath` + `tagRoutes.eventPath` (custom v2 route paths)
 - `auth.emailPasswordEnabled`, `auth.requireEmailVerification`, `auth.socialProviders.google`, `auth.socialProviders.github`
-- `auth.signupMode` (`"open" | "bootstrap_then_invite" | "invite_only"`)
+- `auth.signupMode` (`"open" | "bootstrap_then_invite" | "invite_only"`; default is `"bootstrap_then_invite"`)
 - `ai.provider`, `ai.model`, `ai.baseURL`, `ai.apiKey`, `ai.accountId` (runtime AI vendor/model overrides; blank values are ignored; provider/model include preset autocomplete values)
 - `features.reportBuilderEnabled` + `features.askAiEnabled`
 - `names.*` (typed resource binding names for D1/KV/Queue/DO)
@@ -348,6 +348,40 @@ LYTX_TRACKING_DOMAIN=collect.example.com
 
 Use `createLytxApp({ tagRoutes: { pathPrefix: "/collect" } })` to prefix tracking script and ingestion endpoints.
 
+### Auth setup (important)
+
+`createLytxApp` defaults to bootstrap-safe auth behavior:
+
+- `auth.signupMode` defaults to `"bootstrap_then_invite"`.
+- First account signup is allowed and becomes the initial admin.
+- After the first account exists, public signup is automatically closed.
+- New users can then register only through team invites.
+
+This default applies when:
+
+- `auth` is omitted entirely, or
+- `auth: {}` is passed.
+
+Use these explicit modes when you need different behavior:
+
+```tsx
+createLytxApp({
+  auth: {
+    // "bootstrap_then_invite" is the default
+    signupMode: "bootstrap_then_invite",
+    // signupMode: "invite_only", // never allow public signup
+    // signupMode: "open", // always allow public signup
+  },
+});
+```
+
+If you need to bootstrap an admin user without public signup, use the CLI:
+
+```bash
+cd core
+bun run cli/bootstrap-admin.ts --email admin@example.com --password "StrongPassword123"
+```
+
 ### Environment variables
 
 Add these to your `.env` (local) or worker secrets (production):

package/lib/auth.ts

@@ -81,26 +81,32 @@ export type AuthProviderAvailability = {
   github: boolean;
 };
 
-let auth_runtime_config: AuthRuntimeConfig = {
+const DEFAULT_AUTH_RUNTIME_CONFIG: AuthRuntimeConfig = {
   emailPasswordEnabled: true,
   requireEmailVerification: true,
-  signupMode: "open",
+  signupMode: "bootstrap_then_invite",
   socialProviders: {},
 };
 
+let auth_runtime_config: AuthRuntimeConfig = {
+  ...DEFAULT_AUTH_RUNTIME_CONFIG,
+};
+
 let auth_instance: ReturnType<typeof betterAuth> | null = null;
 
 const hasGoogleCredentials = () => Boolean(env.GOOGLE_CLIENT_ID?.trim() && env.GOOGLE_CLIENT_SECRET?.trim());
 const hasGithubCredentials = () => Boolean(env.GITHUB_CLIENT_ID?.trim() && env.GITHUB_CLIENT_SECRET?.trim());
 
 export function setAuthRuntimeConfig(config: AuthRuntimeConfig = {}) {
+  const socialProviders = {
+    ...DEFAULT_AUTH_RUNTIME_CONFIG.socialProviders,
+    ...config.socialProviders,
+  };
+
   auth_runtime_config = {
-    ...auth_runtime_config,
+    ...DEFAULT_AUTH_RUNTIME_CONFIG,
     ...config,
-    socialProviders: {
-      ...auth_runtime_config.socialProviders,
-      ...config.socialProviders,
-    },
+    socialProviders,
   };
 
   auth_instance = null;
@@ -117,7 +123,7 @@ export function getAuthProviderAvailability(): AuthProviderAvailability {
 }
 
 function getSignupMode(): SignupMode {
-  return auth_runtime_config.signupMode ?? "open";
+  return auth_runtime_config.signupMode ?? "bootstrap_then_invite";
 }
 
 function isMissingTableError(error: unknown): boolean {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lytx",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "private": false,
   "license": "MIT",
   "publishConfig": {

package/src/app/components/NewSiteSetup.tsx

@@ -49,7 +49,7 @@ export const NewSiteSetup: React.FC<NewSiteSetupProps> = ({
 
       const siteData = await response.json();
       onSiteCreated?.(siteData);
-      window.location.href = "/dashboard/settings";
+      window.location.href = "/dashboard";
     } catch (err) {
       setError(err instanceof Error ? err.message : "An error occurred");
     } finally {