saqib mirandClaude Sonnet 5
40687f68fa
Replaces the no-op fastify.authenticate stub and the never-implemented
identity/auth login with real bcrypt password verification, JWT session
issuance/verification (reusing the existing JWT_SECRET), and a Redis-backed
revocation denylist for logout. Adds requireRole('ADMIN') to admin-only
configuration writes across 002-009 that previously relied on a decorator
that never actually checked anything. Adds self-identity (GET /auth/me,
re-validated against live account state) and admin-provisioned accounts
(POST /admin/users).
Making the auth check genuinely reject invalid/missing tokens exposed that
~18 pre-existing integration test files called already-gated routes with no
Authorization header (safe against the old no-op stub, broken against a real
one) — fixed via a shared tests/helpers/auth.ts (loginAs/authHeader) and a
file-by-file pass, plus two related SLA-run cleanup races exposed once admin
setup calls in those files' own beforeAll blocks started actually succeeding.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
35 lines
1.1 KiB
TypeScript
35 lines
1.1 KiB
TypeScript
import { PrismaClient, UserRole } from '@prisma/client';
|
|
import bcrypt from 'bcryptjs';
|
|
|
|
// Local/development bootstrap credentials only (specs/010-identity-auth/spec.md Edge Cases) —
|
|
// never used for a real deployment, which provisions its own first admin out of band.
|
|
const DEV_ADMIN_PASSWORD = 'ChangeMe123!';
|
|
const DEV_AGENT_PASSWORD = 'ChangeMe123!';
|
|
|
|
export async function seedRoles(prisma: PrismaClient): Promise<void> {
|
|
// eslint-disable-next-line no-console
|
|
console.log(' -> Seeding baseline users & roles...');
|
|
|
|
await prisma.user.upsert({
|
|
where: { email: 'admin@supporthub.internal' },
|
|
update: {},
|
|
create: {
|
|
email: 'admin@supporthub.internal',
|
|
name: 'System Admin',
|
|
role: UserRole.ADMIN,
|
|
passwordHash: await bcrypt.hash(DEV_ADMIN_PASSWORD, 10),
|
|
},
|
|
});
|
|
|
|
await prisma.user.upsert({
|
|
where: { email: 'agent@supporthub.internal' },
|
|
update: {},
|
|
create: {
|
|
email: 'agent@supporthub.internal',
|
|
name: 'Default Support Agent',
|
|
role: UserRole.AGENT,
|
|
passwordHash: await bcrypt.hash(DEV_AGENT_PASSWORD, 10),
|
|
},
|
|
});
|
|
}
|