Introducing the Setup Wizard for creating the first user

- no longer setup a default
- still able to do that with env vars however

backend/internal/token.js

@@ -18,67 +18,66 @@ export default {
 	 * @param   {String} [issuer]
 	 * @returns {Promise}
 	 */
-	getTokenFromEmail: (data, issuer) => {
+	getTokenFromEmail: async (data, issuer) => {
 		const Token = TokenModel();
 
 		data.scope = data.scope || "user";
 		data.expiry = data.expiry || "1d";
 
-		return userModel
+		const user = await userModel
 			.query()
 			.where("email", data.identity.toLowerCase().trim())
 			.andWhere("is_deleted", 0)
 			.andWhere("is_disabled", 0)
-			.first()
-			.then((user) => {
-				if (user) {
-					// Get auth
-					return authModel
-						.query()
-						.where("user_id", "=", user.id)
-						.where("type", "=", "password")
-						.first()
-						.then((auth) => {
-							if (auth) {
-								return auth.verifyPassword(data.secret).then((valid) => {
-									if (valid) {
-										if (data.scope !== "user" && _.indexOf(user.roles, data.scope) === -1) {
-											// The scope requested doesn't exist as a role against the user,
-											// you shall not pass.
-											throw new errs.AuthError(`Invalid scope: ${data.scope}`);
-										}
+			.first();
 
-										// Create a moment of the expiry expression
-										const expiry = parseDatePeriod(data.expiry);
-										if (expiry === null) {
-											throw new errs.AuthError(`Invalid expiry time: ${data.expiry}`);
-										}
+		if (!user) {
+			throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH);
+		}
 
-										return Token.create({
-											iss: issuer || "api",
-											attrs: {
-												id: user.id,
-											},
-											scope: [data.scope],
-											expiresIn: data.expiry,
-										}).then((signed) => {
-											return {
-												token: signed.token,
-												expires: expiry.toISOString(),
-											};
-										});
-									}
-									throw new errs.AuthError(
-										ERROR_MESSAGE_INVALID_AUTH,
-										ERROR_MESSAGE_INVALID_AUTH_I18N,
-									);
-								});
-							}
-							throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH);
-						});
-				}
-				throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH);
-			});
+		const auth = await authModel
+			.query()
+			.where("user_id", "=", user.id)
+			.where("type", "=", "password")
+			.first();
+
+		if (!auth) {
+			throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH);
+		}
+
+		const valid = await auth.verifyPassword(data.secret);
+		if (!valid) {
+			throw new errs.AuthError(
+				ERROR_MESSAGE_INVALID_AUTH,
+				ERROR_MESSAGE_INVALID_AUTH_I18N,
+			);
+		}
+
+		if (data.scope !== "user" && _.indexOf(user.roles, data.scope) === -1) {
+			// The scope requested doesn't exist as a role against the user,
+			// you shall not pass.
+			throw new errs.AuthError(`Invalid scope: ${data.scope}`);
+		}
+
+		// Create a moment of the expiry expression
+		const expiry = parseDatePeriod(data.expiry);
+		if (expiry === null) {
+			throw new errs.AuthError(`Invalid expiry time: ${data.expiry}`);
+		}
+
+		const signed = await Token.create({
+			iss: issuer || "api",
+			attrs: {
+				id: user.id,
+			},
+			scope: [data.scope],
+			expiresIn: data.expiry,
+		});
+
+		return {
+			token: signed.token,
+			expires: expiry.toISOString(),
+		};
 	},
 
 	/**
@@ -88,7 +87,7 @@ export default {
 	 * @param {String} [data.scope]   Only considered if existing token scope is admin
 	 * @returns {Promise}
 	 */
-	getFreshToken: (access, data) => {
+	getFreshToken: async (access, data) => {
 		const Token = TokenModel();
 		const thisData = data || {};
 
@@ -115,17 +114,17 @@ export default {
 				}
 			}
 
-			return Token.create({
+			const signed = await Token.create({
 				iss: "api",
 				scope: scope,
 				attrs: token_attrs,
 				expiresIn: thisData.expiry,
-			}).then((signed) => {
-				return {
-					token: signed.token,
-					expires: expiry.toISOString(),
-				};
 			});
+
+			return {
+				token: signed.token,
+				expires: expiry.toISOString(),
+			};
 		}
 		throw new error.AssertionFailedError("Existing token contained invalid user data");
 	},
@@ -136,7 +135,7 @@ export default {
 	 */
 	getTokenFromUser: async (user) => {
 		const expire = "1d";
-		const Token = new TokenModel();
+		const Token = TokenModel();
 		const expiry = parseDatePeriod(expire);
 
 		const signed = await Token.create({

backend/internal/user.js

@@ -10,17 +10,20 @@ import internalToken from "./token.js";
 
 const omissions = () => {
 	return ["is_deleted"];
-}
+};
 
-const DEFAULT_AVATAR = 'https://gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=200&d=mp&r=g';
+const DEFAULT_AVATAR = gravatar.url("admin@example.com", { default: "mm" });
 
 const internalUser = {
 	/**
+	 * Create a user can happen unauthenticated only once and only when no active users exist.
+	 * Otherwise, a valid auth method is required.
+	 *
 	 * @param   {Access}  access
 	 * @param   {Object}  data
 	 * @returns {Promise}
 	 */
-	create: (access, data) => {
+	create: async (access, data) => {
 		const auth = data.auth || null;
 		delete data.auth;
 
@@ -31,61 +34,43 @@ const internalUser = {
 			data.is_disabled = data.is_disabled ? 1 : 0;
 		}
 
-		return access
-			.can("users:create", data)
-			.then(() => {
-				data.avatar = gravatar.url(data.email, { default: "mm" });
-				return userModel.query().insertAndFetch(data).then(utils.omitRow(omissions()));
-			})
-			.then((user) => {
-				if (auth) {
-					return authModel
-						.query()
-						.insert({
-							user_id: user.id,
-							type: auth.type,
-							secret: auth.secret,
-							meta: {},
-						})
-						.then(() => {
-							return user;
-						});
-				}
-				return user;
-			})
-			.then((user) => {
-				// Create permissions row as well
-				const is_admin = data.roles.indexOf("admin") !== -1;
+		await access.can("users:create", data);
+		data.avatar = gravatar.url(data.email, { default: "mm" });
 
-				return userPermissionModel
-					.query()
-					.insert({
-						user_id: user.id,
-						visibility: is_admin ? "all" : "user",
-						proxy_hosts: "manage",
-						redirection_hosts: "manage",
-						dead_hosts: "manage",
-						streams: "manage",
-						access_lists: "manage",
-						certificates: "manage",
-					})
-					.then(() => {
-						return internalUser.get(access, { id: user.id, expand: ["permissions"] });
-					});
-			})
-			.then((user) => {
-				// Add to audit log
-				return internalAuditLog
-					.add(access, {
-						action: "created",
-						object_type: "user",
-						object_id: user.id,
-						meta: user,
-					})
-					.then(() => {
-						return user;
-					});
+		let user = await userModel.query().insertAndFetch(data).then(utils.omitRow(omissions()));
+		if (auth) {
+			user = await authModel.query().insert({
+				user_id: user.id,
+				type: auth.type,
+				secret: auth.secret,
+				meta: {},
 			});
+		}
+
+		// Create permissions row as well
+		const isAdmin = data.roles.indexOf("admin") !== -1;
+
+		await userPermissionModel.query().insert({
+			user_id: user.id,
+			visibility: isAdmin ? "all" : "user",
+			proxy_hosts: "manage",
+			redirection_hosts: "manage",
+			dead_hosts: "manage",
+			streams: "manage",
+			access_lists: "manage",
+			certificates: "manage",
+		});
+
+		user = await internalUser.get(access, { id: user.id, expand: ["permissions"] });
+
+		await internalAuditLog.add(access, {
+			action: "created",
+			object_type: "user",
+			object_id: user.id,
+			meta: user,
+		});
+
+		return user;
 	},
 
 	/**
@@ -316,11 +301,7 @@ const internalUser = {
 		// Query is used for searching
 		if (typeof search_query === "string") {
 			query.where(function () {
-				this.where("name", "like", `%${search_query}%`).orWhere(
-					"email",
-					"like",
-					`%${search_query}%`,
-				);
+				this.where("name", "like", `%${search_query}%`).orWhere("email", "like", `%${search_query}%`);
 			});
 		}