Software/platform
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Seed admin acccount and generalize login/auth routes

Browse Source
This commit is contained in:
Dominic Ferrando
2026-08-21 10:10:22 -04:00
parent 5432610090
commit 4dbcccdef7
8 changed files with 54 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/database/migrations/2026-06-14.ts
+2
View File
@@ -11,6 +11,8 @@ export async function up(db: Kysely<any>): Promise<void> {
)
.addColumn("discord_id", "text", (cb) => cb.unique())
.addColumn("email", "text", (cb) => cb.unique())
.addColumn("password_hash", "text")
.addColumn("role", "text", (cb) => cb.notNull().defaultTo("user"))
.addColumn("name", "text", (cb) => cb.notNull().defaultTo("Anonymous"))
.addColumn("gender", "text")
.execute();
apps/api/src/database/seed.ts
+10 -28
View File
@@ -1,11 +1,11 @@
import {
StandardsConfigSchema,
} from "@blade-and-brawn/calculator";
import { Gender } from "@blade-and-brawn/domain";
import { Value } from "@sinclair/typebox/value";
import { db } from "./db";
import { DEFAULT_NAME, env, log } from "../util";
import standardsConfig from "./seed-data/standards-config.json" with {type: "json"};
import type { AccountRole } from "../services/accounts";
Value.Assert(StandardsConfigSchema, standardsConfig);
@@ -69,44 +69,26 @@ async function seedCalculator(standardsConfigId: string): Promise<void> {
log.info({ id: result.id }, "seeded default calculator");
}
async function seedAccounts(): Promise<void> {
const ACCOUNT_NAME = "Xominus";
async function seedAdminAccount(): Promise<void> {
const existing = await db.selectFrom("accounts")
.select(["id"])
.where("name", "=", ACCOUNT_NAME)
.where("email", "=", env.PUBLIC_ADMIN_EMAIL)
.executeTakeFirst();
if (existing) {
log.info({ id: existing.id }, "default account already seeded, skipping");
log.info({ id: existing.id }, "admin account already seeded, skipping");
return;
}
const account = await db.insertInto("accounts")
.values({
name: ACCOUNT_NAME,
discord_id: "1325552430942916731",
email: "xominus@bladeandbrawn.com"
name: "Admin",
email: env.PUBLIC_ADMIN_EMAIL,
role: "admin" satisfies AccountRole,
password_hash: env.ADMIN_PASSWORD_HASH
})
.returning("id")
.executeTakeFirstOrThrow();
log.info({ id: account.id }, "seeded default account");
await db.insertInto("assessments")
.values({
account_id: account.id,
name: ACCOUNT_NAME,
gender: Gender.Male,
age: 25,
weight: 80,
perf_back_squat: 72.57472,
perf_deadlift: 127.00576,
perf_bench_press: 102.0582,
perf_run: 446000,
perf_broad_jump: 185.42000000000002,
perf_cone_drill: 9870,
})
.execute();
log.info({ accountId: account.id }, "seeded placeholder assessment");
log.info({ id: account.id }, "seeded admin account");
}
(async () => {
@@ -121,7 +103,7 @@ async function seedAccounts(): Promise<void> {
const datasetId = await seedStandardsDataset();
const standardsConfigId = await seedStandardsConfig(datasetId);
await seedCalculator(standardsConfigId);
await seedAccounts();
await seedAdminAccount();
log.info("seed finished");
}
catch (err) {
apps/api/src/server.ts
+20 -15
View File
@@ -20,7 +20,7 @@ import { CalculatorService, CalculatorUnavailableError } from "./services/calcul
import { StandardsParamsSchema } from "@blade-and-brawn/calculator";
import { StandardsService } from "./services/standards";
import { EventsService, EventStatusSchema } from "./services/events";
import { AccountsService } from "./services/accounts";
import { AccountsService, type AccountRole } from "./services/accounts";
import { Value } from "@sinclair/typebox/value";
// CONSTANTS
@@ -56,15 +56,15 @@ const authPlugin = new Elysia({ name: "auth" })
authAdmin: {
async resolve({ jwt, cookie: { auth } }) {
const token = auth.value && await jwt.verify(auth.value);
if (!token || token.role !== "admin" || !token.sessionId) throw status(401, "Unauthorized");
return { sessionId: token.sessionId.toString() };
if (!token || token.role !== "admin" || !token.accountId || !token.sessionId) throw status(401, "Unauthorized");
return { role: token.role.toString(), sessionId: token.sessionId.toString(), accountId: token.accountId.toString() };
}
},
authUser: {
auth: {
async resolve({ jwt, cookie: { auth } }) {
const token = auth.value && await jwt.verify(auth.value);
if (!token || token.role !== "user" || !token.accountId || !token.sessionId) throw status(401, "Unauthorized");
return { sessionId: token.sessionId.toString(), accountId: token.accountId.toString() };
if (!token || !token.role || !token.accountId || !token.sessionId) throw status(401, "Unauthorized");
return { role: token.role.toString(), sessionId: token.sessionId.toString(), accountId: token.accountId.toString() };
}
}
});
@@ -137,22 +137,27 @@ export const app = new Elysia()
.get("/health", () => ({ status: "ok" }))
// AUTHENTICATION
.post("/auth/admin/login", async ({ jwt, body, cookie: { auth } }) => {
const match = crypto.timingSafeEqual(sha256Sum(body.password), Buffer.from(env.ADMIN_PASSWORD, "hex"));
if (!match) throw status(401, "Invalid credentials");
.post("/auth/login", async ({ jwt, body: { password, email }, cookie: { auth } }) => {
const account = await s.Accounts.getByEmail(email);
const password_match = crypto.timingSafeEqual(
sha256Sum(password),
account?.password_hash ? Buffer.from(account?.password_hash, "hex") : sha256Sum("Dummy")
);
if (!account?.password_hash || !password_match) throw status(401, "Invalid credentials");
auth.set({
value: await jwt.sign({ role: "admin", sessionId: randomUUIDv7(), exp: JWT_EXP }),
value: await jwt.sign({ role: account.role, sessionId: randomUUIDv7(), accountId: account.id, exp: JWT_EXP }),
path: "/",
maxAge: JWT_EXP_SECONDS,
sameSite: "lax",
sameSite: env.NODE_ENV === "production" ? "lax" : "none",
httpOnly: true,
secure: env.NODE_ENV === "production",
secure: true,
domain: env.NODE_ENV === "production" ?
".bladeandbrawn.com" :
undefined
});
}, { body: t.Object({ password: t.String() }) })
}, { body: t.Object({ email: t.String(), password: t.String() }) })
.group("/auth/discord", (app) => app
.get("/login", async ({ cookie: { authDiscord } }) => {
@@ -226,7 +231,7 @@ export const app = new Elysia()
// Authenticate
auth.set({
value: await jwt.sign({ role: "user", sessionId: randomUUIDv7(), accountId, exp: JWT_EXP }),
value: await jwt.sign({ role: "user" satisfies AccountRole, sessionId: randomUUIDv7(), accountId, exp: JWT_EXP }),
path: "/",
maxAge: JWT_EXP_SECONDS,
sameSite: env.NODE_ENV === "production" ? "lax" : "none",
@@ -457,7 +462,7 @@ export const app = new Elysia()
}, {
params: t.Object({ id: t.String() })
})
.guard({ authUser: true }, (app) => app
.guard({ auth: true }, (app) => app
.get("/me/stats", async ({ accountId }) => {
const stats = await s.Accounts.stats(accountId);
if (!stats) throw new NotFoundError("Account stats not found");
apps/api/src/services/accounts.ts
+11 -2
View File
@@ -1,9 +1,11 @@
import { Activity, Gender, type Player } from "@blade-and-brawn/domain";
import { Activity, Gender } from "@blade-and-brawn/domain";
import { db } from "../database/db";
import type { CalculatorService } from "./calculator";
import { Value } from "@sinclair/typebox/value";
import { t } from "elysia";
export type AccountRole = "user" | "admin";
export class AccountsService {
constructor(private Calculator: CalculatorService) { }
@@ -26,11 +28,18 @@ export class AccountsService {
async get(id: string) {
return await (db).selectFrom("accounts")
.select(["id", "discord_id", "name", "email", "gender"])
.select(["id", "discord_id", "name", "email", "gender", "role"])
.where(...AccountsService.idComparison(id))
.executeTakeFirst();
}
async getByEmail(email: string) {
return await (db).selectFrom("accounts")
.select(["id", "discord_id", "name", "email", "gender", "password_hash", "role"])
.where("email", "=", email)
.executeTakeFirst();
}
async stats(id: string) {
const latestAssessment = await db.selectFrom("accounts")
.innerJoin("assessments", "assessments.account_id", "accounts.id")
apps/api/src/util.ts
+2 -1
View File
@@ -20,7 +20,8 @@ export const env = {
WEBFLOW_AUTH: requireEnv("WEBFLOW_AUTH"),
WEBFLOW_WEBHOOK_SECRET: requireEnv("WEBFLOW_WEBHOOK_SECRET"),
AUTH_SECRET: requireEnv("AUTH_SECRET"),
ADMIN_PASSWORD: requireEnv("ADMIN_PASSWORD"),
PUBLIC_ADMIN_EMAIL: requireEnv("PUBLIC_ADMIN_EMAIL"),
ADMIN_PASSWORD_HASH: requireEnv("ADMIN_PASSWORD_HASH"),
DATABASE_URL: requireEnv("DATABASE_URL"),
DATABASE_POOL_MAX: requireEnv("DATABASE_POOL_MAX"),
MAX_WORKER_COUNT: requireEnv("MAX_WORKER_COUNT"),