groombook/app
Archived
13
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(api): needsSetup guard ordering in setup auth endpoints (GRO-392 UAT fix) #215

Merged
groombook-engineer[bot] merged 13 commits from feat/gro-392-oobe-auth-provider-bootstrap into main 2026-04-03 07:17:13 +00:00
Conversation 5 Commits 13 Files Changed 3
+4 -4
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 0953d6cb32 - Show all commits
apps/api/src/routes/setup.ts
+4 -4
View File
@@ -123,7 +123,7 @@ const authProviderTestSchema = z.object({
* Rate-limited by the API gateway; additionally restricted to first-time setup only. * Rate-limited by the API gateway; additionally restricted to first-time setup only.
* After setup completes, this endpoint permanently returns 403. * After setup completes, this endpoint permanently returns 403.
*/ */
setupRouter.post("/auth-provider", zValidator("json", authProviderBootstrapSchema), async (c) => { setupRouter.post("/auth-provider", async (c) => {
const db = getDb(); const db = getDb();
// Guard: only allow during fresh install (no super user yet) // Guard: only allow during fresh install (no super user yet)
@@ -149,7 +149,7 @@ setupRouter.post("/auth-provider", zValidator("json", authProviderBootstrapSchem
return c.json({ error: "Auth provider is already configured." }, 409); return c.json({ error: "Auth provider is already configured." }, 409);
} }
const body = c.req.valid("json"); const body = authProviderBootstrapSchema.parse(c.req.valid("json"));
// Encrypt clientSecret before storing // Encrypt clientSecret before storing
const encryptedSecret = encryptSecret(body.clientSecret); const encryptedSecret = encryptSecret(body.clientSecret);
@@ -192,7 +192,7 @@ setupRouter.post("/auth-provider", zValidator("json", authProviderBootstrapSchem
* Fetches the OIDC discovery document to confirm the issuer is reachable. * Fetches the OIDC discovery document to confirm the issuer is reachable.
* Only available when needsSetup is true (no super user = fresh install). * Only available when needsSetup is true (no super user = fresh install).
*/ */
setupRouter.post("/auth-provider/test", zValidator("json", authProviderTestSchema), async (c) => { setupRouter.post("/auth-provider/test", async (c) => {
const db = getDb(); const db = getDb();
// Guard: only allow during fresh install (no super user yet) // Guard: only allow during fresh install (no super user yet)
@@ -206,7 +206,7 @@ setupRouter.post("/auth-provider/test", zValidator("json", authProviderTestSchem
return c.json({ ok: false, error: "Setup has already been completed." }, 403); return c.json({ ok: false, error: "Setup has already been completed." }, 403);
} }
const body = c.req.valid("json"); const body = authProviderTestSchema.parse(c.req.valid("json"));
// Determine the discovery URL // Determine the discovery URL
const discoveryUrl = body.internalBaseUrl const discoveryUrl = body.internalBaseUrl