Release 0.2.0

src/routes/setup/+page.server.ts

@@ -0,0 +1,47 @@
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	createFirstAdmin,
+	createSession,
+	hasUsers,
+	setupIsConfigured,
+	validDisplayName,
+	validEmail,
+	validPassword
+} from '#lib/server/auth.js';
+
+export const load: PageServerLoad = () => {
+	if (hasUsers()) redirect(303, '/login');
+	return { configured: setupIsConfigured() };
+};
+
+export const actions = {
+	default: async ({ request, cookies }) => {
+		if (hasUsers()) redirect(303, '/login');
+		const data = await request.formData();
+		const setupToken = String(data.get('setupToken') || '');
+		const displayName = String(data.get('displayName') || '').trim();
+		const email = String(data.get('email') || '').trim();
+		const password = String(data.get('password') || '');
+		if (!validDisplayName(displayName) || !validEmail(email) || !validPassword(password)) {
+			return fail(400, {
+				error: 'Bitte Name, gültige E-Mail und ein Passwort mit mindestens 12 Zeichen prüfen.',
+				displayName,
+				email
+			});
+		}
+		try {
+			const user = await createFirstAdmin({ setupToken, displayName, email, password });
+			createSession(user.id, cookies);
+		} catch (cause) {
+			const code = cause instanceof Error ? cause.message : '';
+			if (code === 'SETUP_CLOSED') redirect(303, '/login');
+			return fail(403, {
+				error: 'Das Betreiber-Setup-Token ist ungültig.',
+				displayName,
+				email
+			});
+		}
+		redirect(303, '/fundus');
+	}
+} satisfies Actions;

src/routes/setup/+page.svelte

@@ -0,0 +1,65 @@
+<script lang="ts">
+	import type { PageProps } from './$types';
+	let { data, form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Erstadmin einrichten | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Einmalige Einrichtung</p>
+	<h1>Ersten Barkeeper anlegen</h1>
+	<p>
+		Dieses Konto verwaltet Einladungen, Rollen und Sperren. Danach wird die Einrichtung geschlossen.
+	</p>
+	{#if !data.configured}
+		<div class="form-message error" role="alert">
+			Vor dem Start muss ein mindestens 32 Zeichen langes <code>SENDEWERK_SETUP_TOKEN</code>
+			konfiguriert werden.
+		</div>
+	{:else}
+		{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+		<form class="auth-form" method="POST">
+			<label
+				>Betreiber-Setup-Token<input
+					name="setupToken"
+					type="password"
+					required
+					autocomplete="off"
+				/></label
+			>
+			<label
+				>Name<input
+					name="displayName"
+					required
+					maxlength="80"
+					value={form?.displayName ?? ''}
+					autocomplete="name"
+				/></label
+			>
+			<label
+				>E-Mail<input
+					name="email"
+					type="email"
+					required
+					maxlength="254"
+					value={form?.email ?? ''}
+					autocomplete="email"
+				/></label
+			>
+			<label
+				>Passwort<input
+					name="password"
+					type="password"
+					required
+					minlength="12"
+					maxlength="256"
+					autocomplete="new-password"
+				/></label
+			>
+			<p class="field-hint">
+				Mindestens 12 Zeichen. Das Passwort wird ausschließlich als Argon2id-Hash gespeichert.
+			</p>
+			<button class="primary-button" type="submit">Barkeeper anlegen</button>
+		</form>
+	{/if}
+</section>