Leon SerfatyandClaude Fable 5
97e1d4c60b
Storage - Migrate document/media storage from local disk to DigitalOcean Spaces (S3); lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required. - Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time). Security hardening (all report findings) - DB pool fails closed in production when the CA cert is missing (no more silent unverified TLS); warns in dev. - trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits. - Login lockout keyed by (email, ip) so an attacker can't lock out a victim. - Superadmin auto-grant now requires a verified email. - CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt. - Upload content-sniffing (magic bytes) rejects spoofed MIME types. - create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED. Production-blocker fixes - SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache. - Invoice numbering is transaction-safe (per-firm advisory lock + max sequence), eliminating concurrent collisions and delete-reuse — no schema change. - Checkout guards against double-billing a firm already on a paid plan. - Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps). Honesty / trust - Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA, and the login-panel stats; replace with non-fabricated copy. - Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.) Quality - Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
72 lines
2.2 KiB
TypeScript
72 lines
2.2 KiB
TypeScript
// One-off: creates a superadmin user.
|
|
// Run from monorepo root: npx tsx scripts/create-admin.ts
|
|
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import dotenv from 'dotenv';
|
|
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
dotenv.config({ path: path.resolve(__dirname, '../.env') });
|
|
|
|
import argon2 from 'argon2';
|
|
import { eq } from 'drizzle-orm';
|
|
import { getDb, getPool, users } from '@lawdesk/db';
|
|
|
|
// Credentials come from the environment or argv — never hardcode them in a tracked file.
|
|
// ADMIN_EMAIL=you@example.com ADMIN_PASSWORD='...' ADMIN_NAME='You' npx tsx scripts/create-admin.ts
|
|
// or: npx tsx scripts/create-admin.ts you@example.com 'password' 'Your Name'
|
|
const EMAIL = process.env.ADMIN_EMAIL ?? process.argv[2];
|
|
const PASSWORD = process.env.ADMIN_PASSWORD ?? process.argv[3];
|
|
const NAME = process.env.ADMIN_NAME ?? process.argv[4] ?? 'Admin';
|
|
|
|
if (!EMAIL || !PASSWORD) {
|
|
console.error(
|
|
'Missing credentials.\n' +
|
|
"Usage: ADMIN_EMAIL=you@example.com ADMIN_PASSWORD='...' [ADMIN_NAME='...'] npx tsx scripts/create-admin.ts",
|
|
);
|
|
process.exit(1);
|
|
}
|
|
if (PASSWORD.length < 10) {
|
|
console.error('ADMIN_PASSWORD must be at least 10 characters.');
|
|
process.exit(1);
|
|
}
|
|
|
|
async function main() {
|
|
const db = getDb();
|
|
const passwordHash = await argon2.hash(PASSWORD, {
|
|
type: argon2.argon2id,
|
|
memoryCost: 64 * 1024,
|
|
timeCost: 3,
|
|
parallelism: 1,
|
|
});
|
|
|
|
const existing = await db.select({ id: users.id }).from(users).where(eq(users.email, EMAIL));
|
|
if (existing.length > 0) {
|
|
await db.update(users).set({
|
|
passwordHash,
|
|
isSuperadmin: true,
|
|
isSuspended: false,
|
|
emailVerifiedAt: new Date(),
|
|
updatedAt: new Date(),
|
|
}).where(eq(users.email, EMAIL));
|
|
console.log(`Updated existing user → superadmin: ${EMAIL}`);
|
|
} else {
|
|
const [u] = await db.insert(users).values({
|
|
email: EMAIL,
|
|
passwordHash,
|
|
fullName: NAME,
|
|
role: 'owner',
|
|
isSuperadmin: true,
|
|
emailVerifiedAt: new Date(),
|
|
}).returning();
|
|
console.log(`Created superadmin: ${u.email} (id: ${u.id})`);
|
|
}
|
|
|
|
await getPool().end();
|
|
}
|
|
|
|
main().catch((err) => {
|
|
console.error(err);
|
|
process.exit(1);
|
|
});
|