v1.0.0:4 — remove default admin@local credentials; require StartOS action to bootstrap

Security: shipping admin@local / workout123 as a default that the operator was supposed-to-rotate-but-might-not is the kind of footgun that turns into "default-credential exposure" headlines. Eliminated. prisma/seed.ts now ONLY seeds the InstanceSettings singleton — no admin user, no UserPreferences, no exercises in the build-time fallback DB. The image still ships with prisma/exercises.seed.json (curated 164-exercise library) but those rows aren't inserted until an admin is created via the StartOS Action. The change-admin-credentials Action now does INSERT-or-UPDATE in one shot. CREATE mode (no admin exists) inserts the User row, inserts UserPreferences with sensible defaults, and runs ensureExerciseLibrary.cjs for the new admin so they don't have to wait for the next service start to see the curated library. UPDATE mode (admin exists) keeps the v1.0.0:1-3 rotation behavior. The mode is auto-detected by counting `WHERE isAdmin = 1`. The login page is now a server component that reads the admin count upfront. Zero admins -> renders a "needs setup" panel pointing at the StartOS Action ("Services -> Proof of Work -> Actions -> Set admin credentials"). Otherwise renders the existing LoginForm (extracted to LoginForm.tsx). Eliminates the "I tried admin@local/workout123 and it failed, what's wrong" fresh-installer confusion. Backward compatible for upgrades from v1.0.0:1-3: - /data already has an admin user; the no-admin detection never triggers; login behaves identically to before. - The Action's UPDATE mode still works for rotation. Version graph: v1.0.0:4 promoted to current; v1.0.0:1, :2, :3 all listed as `other` for in-place upgrade paths. README updated to call out the explicit no-default-account design and how to bootstrap an admin in local dev (Prisma Studio, since the StartOS action isn't available off-StartOS).
2026-05-09 19:13:49 -05:00
parent a64fee4873
commit 5f7b3b6b7a
8 changed files with 405 additions and 266 deletions
@@ -0,0 +1,92 @@
+'use client';
+
+import { useState } from 'react';
+import { useRouter } from 'next/navigation';
+import { loginAction } from './actions';
+
+export default function LoginForm() {
+  const router = useRouter();
+  const [email, setEmail] = useState('');
+  const [password, setPassword] = useState('');
+  const [error, setError] = useState('');
+  const [loading, setLoading] = useState(false);
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setError('');
+    setLoading(true);
+
+    try {
+      const result = await loginAction(email, password);
+
+      if (result.error) {
+        setError(result.error);
+        setLoading(false);
+        return;
+      }
+
+      if (result.success) {
+        router.push('/main/dashboard');
+      }
+    } catch (err) {
+      setError('An unexpected error occurred');
+      setLoading(false);
+    }
+  };
+
+  return (
+    <form onSubmit={handleSubmit} className="space-y-5">
+      <div className="space-y-2">
+        <label
+          htmlFor="email"
+          className="text-xs font-semibold text-white uppercase tracking-wider"
+        >
+          Email
+        </label>
+        <input
+          id="email"
+          type="email"
+          placeholder="you@example.com"
+          value={email}
+          onChange={(e) => setEmail(e.target.value)}
+          required
+          className="w-full px-4 py-2.5 rounded border border-zinc-700 bg-zinc-800 text-white placeholder:text-zinc-500 focus:outline-none focus:ring-2 focus:ring-white focus:ring-offset-0 focus:border-white transition-all"
+          disabled={loading}
+        />
+      </div>
+
+      <div className="space-y-2">
+        <label
+          htmlFor="password"
+          className="text-xs font-semibold text-white uppercase tracking-wider"
+        >
+          Password
+        </label>
+        <input
+          id="password"
+          type="password"
+          placeholder="••••••••"
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+          required
+          className="w-full px-4 py-2.5 rounded border border-zinc-700 bg-zinc-800 text-white placeholder:text-zinc-500 focus:outline-none focus:ring-2 focus:ring-white focus:ring-offset-0 focus:border-white transition-all"
+          disabled={loading}
+        />
+      </div>
+
+      {error && (
+        <div className="rounded bg-red-900/50 px-4 py-3 border border-red-800 text-sm text-red-400">
+          {error}
+        </div>
+      )}
+
+      <button
+        type="submit"
+        disabled={loading}
+        className="w-full py-2.5 px-4 rounded bg-white text-black font-bold text-sm uppercase tracking-wider transition-all duration-200 hover:bg-gray-100 disabled:bg-zinc-700 disabled:text-zinc-500 disabled:cursor-not-allowed"
+      >
+        {loading ? 'Signing in...' : 'Sign In'}
+      </button>
+    </form>
+  );
+}