feat: bootstrap SuperAdmin from env and lock one-time seeding

Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.
2026-08-14 23:23:06 +03:30
parent 3ca098b74d
commit 35704409ec
13 changed files with 251 additions and 34 deletions
@@ -4,6 +4,7 @@ const jwt = require('jsonwebtoken');
 const config = require('../config/config');
 const AppError = require('../utils/AppError');
 const User = require('../components/users/userModel');
+const { isBootstrapSuperAdminDisabled } = require('../utils/superAdmin');

 const authMiddleware = async (req, res, next) => {
  try {
@@ -29,7 +30,7 @@ const authMiddleware = async (req, res, next) => {
    }

    const user = await User.findById(decoded.id).populate('role');
-    if (!user || !user.isActive) {
+    if (!user || !user.isActive || isBootstrapSuperAdminDisabled(user)) {
      return next(new AppError('UNAUTHORIZED'));
    }