cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: auto-persist JWT secret, remove setup token requirement

Browse Source 
- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields
This commit is contained in:
Dionisio
2026-03-05 22:12:21 +01:00
parent c77ce202c6
commit f2d35ca792
336 changed files with 104 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/common/di.rs
Regular → Executable
+5 -18
View File
@@ -612,7 +612,7 @@ impl AppServiceFactory {
path_resolver: None,
webdav_lock_store:
crate::infrastructure::services::webdav_lock_service::create_webdav_lock_store(),
setup_token: None,
};
// 9b. Wire admin settings service when auth is available
@@ -663,24 +663,14 @@ impl AppServiceFactory {
app_state.admin_settings_service = Some(admin_svc.clone());
// 9b-2. Generate one-time setup token if system is NOT yet initialized
// 9b-2. Log whether system needs first-time admin setup
if !admin_svc.is_system_initialized().await {
use rand_core::{OsRng, RngCore};
let mut token_bytes = [0u8; 32];
OsRng.fill_bytes(&mut token_bytes);
let token = hex::encode(token_bytes);
tracing::warn!("╔══════════════════════════════════════════════════════════╗");
tracing::warn!("║ SYSTEM NOT INITIALIZED — first admin setup required ║");
tracing::warn!("║ ║");
tracing::warn!("║ POST /api/setup with this one-time token: ║");
tracing::warn!("║ {} ║", token);
tracing::warn!("║ ║");
tracing::warn!("║ This token is valid until the server restarts or the ║");
tracing::warn!("║ first admin is created. Keep it secret! ║");
tracing::warn!("║ Open the web UI to create the first admin account. ║");
tracing::warn!("║ The setup page is available until an admin is created. ║");
tracing::warn!("╚══════════════════════════════════════════════════════════╝");
app_state.setup_token = Some(token);
} else {
tracing::info!("System already initialized — setup endpoint disabled");
}
@@ -903,10 +893,7 @@ pub struct AppState {
Option<Arc<crate::infrastructure::services::path_resolver_service::PathResolverService>>,
pub webdav_lock_store:
Arc<crate::infrastructure::services::webdav_lock_service::WebDavLockStore>,
/// One-time setup token generated on startup when the system is not yet
/// initialized. Printed to the server log so the operator can create the
/// first admin user via `POST /api/setup`.
pub setup_token: Option<String>,
}
// All AppState construction is done via struct literal in build_app_state().