brian/get_healthy
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases 2 Packages Wiki Activity Actions

FEATURE GAP: OIDC login does not assign admin role to the first user, blocking template seeding #3

New issue
Open
opened 2026-08-21 17:45:12 +00:00 by brian · 0 comments
brian commented 2026-08-21 17:45:12 +00:00
Owner
Copy link

Found while fixing #1.

seedPrebuiltTemplates() requires an admin user to exist before it will seed the pre-built
templates. Local registration assigns the admin role to the first user
(authController.js:34-45), but the OIDC user-creation path does not:

https://forge.routemehome.org/brian/get_healthy/src/commit/main/backend/src/utils/passport-config.js#L47-L58

findOrCreateUser() in backend/src/utils/passport-config.js creates new users without setting a
role, so the user gets the schema default (user). If the first account on an instance is
created via OIDC login instead of local registration:

  1. No admin user ever exists
  2. Pre-built templates are never seeded (same failure mode as #1)
  3. No one can access /api/admin endpoints to promote a user manually — likely requiring manual DB
    surgery to recover

Suggested fix

Mirror the local-registration logic in findOrCreateUser(): count existing users and assign
role: 'admin' when creating the first one (and trigger seedPrebuiltTemplates() afterward,
matching the behavior added in authController.register).

Notes

  • Existing users created via OIDC on already-bootstrapped instances are unaffected.
  • Should also consider what happens if an instance has users but zero admins (e.g., the only admin
    was deleted) — possibly out of scope, but worth a thought while in this code path.
Found while fixing #1. `seedPrebuiltTemplates()` requires an admin user to exist before it will seed the pre-built templates. Local registration assigns the `admin` role to the first user (authController.js:34-45), but the OIDC user-creation path does not: https://forge.routemehome.org/brian/get_healthy/src/commit/main/backend/src/utils/passport-config.js#L47-L58 `findOrCreateUser()` in `backend/src/utils/passport-config.js` creates new users without setting a `role`, so the user gets the schema default (`user`). If the **first** account on an instance is created via OIDC login instead of local registration: 1. No admin user ever exists 2. Pre-built templates are never seeded (same failure mode as #1) 3. No one can access /api/admin endpoints to promote a user manually — likely requiring manual DB surgery to recover ### Suggested fix Mirror the local-registration logic in `findOrCreateUser()`: count existing users and assign `role: 'admin'` when creating the first one (and trigger `seedPrebuiltTemplates()` afterward, matching the behavior added in authController.register). ### Notes - Existing users created via OIDC on already-bootstrapped instances are unaffected. - Should also consider what happens if an instance has users but zero admins (e.g., the only admin was deleted) — possibly out of scope, but worth a thought while in this code path.
brian changed title from FEATUR GAP: OIDC login does not assign admin role to the first user, blocking template seeding to FEATURE GAP: OIDC login does not assign admin role to the first user, blocking template seeding 2026-08-21 17:45:29 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
0.1.4
0.1.3
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
brian/get_healthy#3
No description provided.