feat: bootstrap SuperAdmin from env and lock one-time seeding

Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.

components/seed/seedController.js

@@ -0,0 +1,16 @@
+// /components/seed/seedController.js
+'use strict';
+
+const catchAsync = require('../../utils/catchAsync');
+const seedService = require('./seedService');
+const { successResponse } = require('../../utils/apiResponse');
+
+exports.getStatus = catchAsync(async (req, res) => {
+  const status = await seedService.getStatus();
+  return successResponse(res, 200, 'Seed status retrieved', status);
+});
+
+exports.runSeed = catchAsync(async (req, res) => {
+  const result = await seedService.runSeed(req.user?._id);
+  return successResponse(res, 200, 'Database seeded successfully', result);
+});

components/seed/seedLockModel.js

@@ -0,0 +1,36 @@
+// /components/seed/seedLockModel.js
+'use strict';
+
+const mongoose = require('mongoose');
+
+const SEED_LOCK_KEY = 'database_seed';
+
+const seedLockSchema = new mongoose.Schema({
+  key: {
+    type: String,
+    required: true,
+    unique: true,
+    default: SEED_LOCK_KEY,
+    index: true
+  },
+  locked: {
+    type: Boolean,
+    default: false
+  },
+  lockedAt: {
+    type: Date
+  },
+  lockedBy: {
+    type: mongoose.Schema.Types.ObjectId,
+    ref: 'User'
+  }
+}, {
+  timestamps: true
+});
+
+const SeedLock = mongoose.model('SeedLock', seedLockSchema);
+
+module.exports = {
+  SeedLock,
+  SEED_LOCK_KEY
+};

components/seed/seedRoutes.js

@@ -0,0 +1,17 @@
+// /components/seed/seedRoutes.js
+'use strict';
+
+const express = require('express');
+const seedController = require('./seedController');
+const authMiddleware = require('../../middlewares/authMiddleware');
+const requireSuperAdmin = require('../../middlewares/requireSuperAdmin');
+
+const router = express.Router();
+
+router.use(authMiddleware);
+router.use(requireSuperAdmin);
+
+router.get('/status', seedController.getStatus);
+router.post('/', seedController.runSeed);
+
+module.exports = router;

components/seed/seedService.js

@@ -0,0 +1,45 @@
+// /components/seed/seedService.js
+'use strict';
+
+const { SeedLock, SEED_LOCK_KEY } = require('./seedLockModel');
+const seedDatabase = require('../../seed');
+const AppError = require('../../utils/AppError');
+
+const getStatus = async () => {
+  const doc = await SeedLock.findOne({ key: SEED_LOCK_KEY }).lean();
+  return {
+    locked: Boolean(doc?.locked),
+    lockedAt: doc?.lockedAt || null
+  };
+};
+
+const runSeed = async (userId) => {
+  const existing = await SeedLock.findOne({ key: SEED_LOCK_KEY });
+  if (existing?.locked) {
+    throw new AppError('SEED_LOCKED');
+  }
+
+  const result = await seedDatabase({ disconnectOnComplete: false });
+
+  await SeedLock.findOneAndUpdate(
+    { key: SEED_LOCK_KEY },
+    {
+      $set: {
+        locked: true,
+        lockedAt: new Date(),
+        lockedBy: userId || undefined
+      }
+    },
+    { upsert: true, new: true }
+  );
+
+  return {
+    ...result,
+    locked: true
+  };
+};
+
+module.exports = {
+  getStatus,
+  runSeed
+};