Add first-run local administrator onboarding

[1012839419a-alt]

Summary

• make local administrator password setup the primary first-run path for self-hosted installs
• keep OIDC optional and move Bootstrap access behind an explicit emergency-recovery disclosure
• persist a single salted scrypt credential and issue server-signed 12-hour local sessions
• allow only the exact status/setup/login endpoints through the unauthenticated Fleet boundary, with per-client failure limiting
• accept a valid local administrator session even when an upgraded browser also sends a stale Fleet transport token
• document the decision, installer flow, design states, and verification evidence

Why

A fresh deployment currently asks the operator for an organization account or opaque deployment tokens. Single-operator installs often have no OIDC provider, and a Bootstrap credential should not be the everyday browser login.

The new flow is: deploy, enter Bootstrap once and choose a password, then use the password for normal login. Static Fleet tokens remain machine credentials and Bootstrap remains available for recovery.

During live upgrade verification, the browser retained an older Fleet token in addition to the new local session. FleetAuth previously selected the stale X-API-Token first and rejected the request without considering the valid local bearer session. The middleware now evaluates both presented credentials and accepts the request when either one is valid.

Security notes

• setup still requires BOOTSTRAP_ADMIN_TOKEN and can create only the fixed local-admin record
• passwords require 12-256 characters and are stored only as salted scrypt hashes with fixed work parameters
• sessions are HS256 tokens signed by SECRET_KEY and expire after 12 hours
• failed setup/login attempts are bounded per client; tracked-client memory is bounded
• concurrent first-run setup is guarded by the database primary key and returns 409
• a stale invalid Fleet header cannot override an independently valid local session
• no registration, invitation, multi-user local accounts, or password-reset subsystem is introduced

Verification

• 43 tests passed across the original local-auth, Fleet-auth, identity, and identity-model suite
• 36 focused local-auth and Fleet-auth tests passed after the stale-header regression fix
• targeted Ruff checks passed
• TypeScript type-check passed
• targeted frontend ESLint passed
• login regression suite: 4 passed
• Next.js production build passed
• Alembic reports one head; a fresh SQLite database upgraded through the full chain to the new migration
• live Docker deployment migrated the existing SQLite database and remained healthy
• real browser login reached the Studio project page and a full refresh preserved the authenticated session
• design and motion foundation checks passed

Docker note

A clean Compose image build was attempted locally after the application checks. Docker Desktop's BuildKit data store became read-only while committing downloaded base-image layers, before project compilation inside Docker. The failed cache was cleared and the installed release images were reused with the reviewed D-drive application code mounted for live verification. CI or a clean Docker builder should repeat the full image build.

[repowise-bot]

⏳ Repowise has not indexed this repository yet

No analysis on this PR because there is no index to compare against. Indexing usually runs automatically after install; if this persists, start it from the dashboard.

Index 2233admin/opencli-Razormind · Docs

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 02654446-f29c-4b3e-81a9-b182d03db18c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}