813bc46640
A WordPress-inspired CMS whose entire backend is PiCloud Rhai scripts deployed with pic apply, plus a SvelteKit frontend. Built to dogfood the project tool, CLI, and SDK; exercises docs/kv/files/users, docs+queue+cron +pubsub triggers, the transactional-outbox notification chain, a docs before-interceptor, set_if CAS, SSE, per-app CORS, env overlays, and a durable Workflow (validate -> enrich || seo -> publish -> finalize) started with workflow::start and polled with workflow::run_status, visualized live with Svelte Flow. FINDINGS.md / SECURITY.md capture every gap, surprise, and security issue found (each tagged [PiCloud] vs [CMS]); the platform fixes for the actionable ones ship in the preceding commit. Also folds in the read-only `pic` allowlist entries added to .claude/settings.json during the session (fewer-permission-prompts). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
26 lines
1.1 KiB
Plaintext
26 lines
1.1 KiB
Plaintext
// POST /cms/auth/bootstrap — create the first admin/author account.
|
|
// Gated by the `setup-token` secret (compared server-side; never echoed).
|
|
// This exists because there is no CLI/API to grant an app-user a role —
|
|
// role assignment is script-only (users::add_role). See FINDINGS.
|
|
let b = ctx.request.body;
|
|
if b == () || b.setup_token == () {
|
|
return #{ statusCode: 400, body: #{ error: "setup_token required" } };
|
|
}
|
|
let want = secrets::get("setup-token");
|
|
if want == () {
|
|
return #{ statusCode: 500, body: #{ error: "server not configured for bootstrap" } };
|
|
}
|
|
if b.setup_token != want {
|
|
return #{ statusCode: 403, body: #{ error: "bad setup token" } };
|
|
}
|
|
if b.email == () || b.password == () {
|
|
return #{ statusCode: 400, body: #{ error: "email and password required" } };
|
|
}
|
|
if !users::email_available(b.email) {
|
|
return #{ statusCode: 409, body: #{ error: "email already registered" } };
|
|
}
|
|
let u = users::create(#{ email: b.email, password: b.password, display_name: b.display_name });
|
|
users::add_role(u.id, "admin");
|
|
users::add_role(u.id, "author");
|
|
#{ statusCode: 201, body: #{ id: u.id, email: u.email, roles: ["admin", "author"] } }
|