84 lines
2.6 KiB
TypeScript
84 lines
2.6 KiB
TypeScript
/**
|
|
* Creates or repairs a SUPER_ADMIN account.
|
|
*
|
|
* pnpm --filter @sport/api run create-admin
|
|
* ADMIN_EMAIL=me@example.com ADMIN_PASSWORD='…' pnpm ... run create-admin
|
|
*
|
|
* This is the production bootstrap path, and the reason the seed never creates
|
|
* a privileged account with a known password. Safe to re-run: an existing
|
|
* account has its password reset and its role re-granted, which doubles as the
|
|
* "locked out of the admin" recovery procedure.
|
|
*/
|
|
import { PrismaClient } from '@prisma/client';
|
|
import { SYSTEM_ROLES } from '@sport/types';
|
|
|
|
import { generatePassword, hashPassword, verifyPassword } from './seed/accounts';
|
|
|
|
const prisma = new PrismaClient();
|
|
|
|
async function main(): Promise<void> {
|
|
const email = (process.env['ADMIN_EMAIL'] ?? 'admin@sport.local').trim().toLowerCase();
|
|
const provided = process.env['ADMIN_PASSWORD'];
|
|
const password = provided ?? generatePassword();
|
|
|
|
if (provided && provided.length < 10) {
|
|
throw new Error('ADMIN_PASSWORD must be at least 10 characters.');
|
|
}
|
|
|
|
const passwordHash = await hashPassword(password);
|
|
|
|
// Verify the hash round-trips before writing it. A malformed hash here would
|
|
// create an account nobody can ever sign in to, and the failure would only
|
|
// surface at the login screen.
|
|
if (!(await verifyPassword(password, passwordHash))) {
|
|
throw new Error('Password hash failed self-verification; refusing to write.');
|
|
}
|
|
|
|
const role = await prisma.role.findUnique({ where: { key: SYSTEM_ROLES.SUPER_ADMIN } });
|
|
if (!role) {
|
|
throw new Error('The super_admin role is missing. Run `pnpm db:seed` first.');
|
|
}
|
|
|
|
const user = await prisma.user.upsert({
|
|
where: { email },
|
|
update: { passwordHash, status: 'ACTIVE', type: 'SUPER_ADMIN', deletedAt: null },
|
|
create: {
|
|
email,
|
|
passwordHash,
|
|
type: 'SUPER_ADMIN',
|
|
status: 'ACTIVE',
|
|
firstName: 'Super',
|
|
lastName: 'Admin',
|
|
emailVerifiedAt: new Date(),
|
|
},
|
|
select: { id: true },
|
|
});
|
|
|
|
await prisma.userRole.upsert({
|
|
where: { userId_roleId: { userId: user.id, roleId: role.id } },
|
|
update: {},
|
|
create: { userId: user.id, roleId: role.id },
|
|
});
|
|
|
|
console.log('\nSuper admin ready.\n');
|
|
console.log(` Email: ${email}`);
|
|
|
|
if (provided) {
|
|
console.log(' Password: (from ADMIN_PASSWORD)');
|
|
} else {
|
|
console.log(` Password: ${password}`);
|
|
console.log('\n Generated password — shown once. Store it now.');
|
|
}
|
|
|
|
console.log('');
|
|
}
|
|
|
|
main()
|
|
.catch((error: unknown) => {
|
|
console.error(error instanceof Error ? error.message : error);
|
|
process.exitCode = 1;
|
|
})
|
|
.finally(() => {
|
|
void prisma.$disconnect();
|
|
});
|