Spaces:
Sleeping
Sleeping
| import { clerkClient } from '@clerk/express'; | |
| import { logger } from './logger'; | |
| /** | |
| * Owner-configured bootstrap runs independently in each Clerk environment. | |
| * The completion marker prevents a restart from restoring a revoked role. | |
| * Passwords are read only from Secrets and never logged or reset on restart. | |
| */ | |
| export async function bootstrapAdmin() { | |
| const email = process.env.ADMIN_EMAIL?.trim().toLowerCase(); | |
| if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) { | |
| throw new Error('Set a valid ADMIN_EMAIL before starting admin authentication.'); | |
| } | |
| try { | |
| const client = clerkClient; | |
| const { data: users } = await client.users.getUserList({ emailAddress: [email], limit: 2 }); | |
| if (users.length > 1) throw new Error('Admin bootstrap found multiple matching accounts.'); | |
| const existing = users[0]; | |
| if (existing?.privateMetadata.ecomAdminBootstrapComplete) { | |
| logger.info('Admin account bootstrap already completed; existing permissions preserved.'); | |
| return; | |
| } | |
| if (existing) { | |
| const verified = existing.emailAddresses.some(address => | |
| address.emailAddress.toLowerCase() === email && address.verification?.status === 'verified', | |
| ); | |
| if (!verified) throw new Error('Verify ownership of the configured admin email before granting access.'); | |
| await client.users.updateUserMetadata(existing.id, { | |
| publicMetadata: { ...existing.publicMetadata, role: 'admin' }, | |
| privateMetadata: { ...existing.privateMetadata, ecomAdminBootstrapComplete: true }, | |
| }); | |
| } else { | |
| const password = process.env.ADMIN_INITIAL_PASSWORD; | |
| if (!password) throw new Error('Set ADMIN_INITIAL_PASSWORD in Secrets to create the initial admin account.'); | |
| await client.users.createUser({ | |
| emailAddress: [email], | |
| password, | |
| firstName: 'Admin', | |
| publicMetadata: { role: 'admin' }, | |
| privateMetadata: { ecomAdminBootstrapComplete: true }, | |
| }); | |
| } | |
| logger.info('Owner-configured admin account is ready.'); | |
| } catch (error) { | |
| // Do not log SDK request/response objects: they can contain credentials. | |
| if (error && typeof error === 'object' && 'errors' in error) { | |
| const errors = error.errors as { code?: string }[]; | |
| const codes = errors.map(item => item.code?.replace(/[^a-zA-Z0-9_]/g, '')).filter(Boolean).join(', '); | |
| throw new Error(`Admin account setup was rejected by the login provider (${codes || 'request_failed'}). Check the admin settings and use a strong ADMIN_INITIAL_PASSWORD.`); | |
| } | |
| throw error; | |
| } | |
| } | |