[ppenguin]

Closes ReCasaOS/CasaOS#45. Includes the follow-up asked on #4.

Commit
feat(auth): first administrator created on the machine (opt-in)	[app] FirstAdmin = local (default web: unchanged)
fix(cli): -bootstrap-admin refuses before reading; -ru reports a write that failed	#45 ask + #4 follow-up

FirstAdmin = local

• GET /v1/users/status: no register key, first_admin: local (new field, web|local)
• POST /v1/users/register: 403, also with a key handed out before the switch
• casaos-user-service -bootstrap-admin: creates the first administrator, then exits
  • rules of the web registration: argon2id, ≥ 6 characters, role admin
  • credentials: $CREDENTIALS_DIRECTORY/{username,password} (systemd LoadCredential=) or two lines on stdin; never argv/env
  • an account exists → exit 1 before any credential is read

#4 follow-up

• UpdateUserPassword, UpdateUserTOTP return their error
  • -ru: password not stored → exit 1, nothing printed as new password; 2FA not cleared → exit 1, says so
  • PUT /v1/users/current/password: 500 when the write failed (was 200)
• DB DSN _pragma=busy_timeout(5000): -ru / -bootstrap-admin beside the running service wait instead of SQLITE_BUSY
• nits: accounts inlined, CLI errors on stderr

Tests

• local refuses the web (status, register incl. earlier key); CreateFirstAdmin once; credentials from stdin and systemd
• bootstrap: refuses without reading when an account exists; creates
• writes report errors (closed DB); busy_timeout = 5000
• go test -race ./... green

🤖 Generated with Claude Code

[inkly]

Thanks, this matches #45 closely: the register path is refused before the key is looked at, bootstrap refuses before reading anything, and the -ru writes now report failures. Two small requests before merge:

1. TestFirstAdminLocalRefusesTheWeb panics when run on its own (-run FirstAdmin): GetUserStatus logs the GPU lookup error through an uninitialised logger, and it only passes because event_listen_test sets the logger up first. Could you call logger.LogInitConsoleOnly() in the test (or in newRig)?
2. In -ru, if the 2FA write fails after the password write succeeded, the new password is never printed, so the account is left with a password nobody knows. Could both go in one UPDATE, or could that branch print the password and say to run -ru again?

Optional: warn on unknown FirstAdmin values (a typo silently means web), refuse a terminal on stdin (the password is echoed), and close the DB in busy_test (cleanup fails on Windows).

We'll squash-merge with a plain commit message, so nothing to change in the commit trailers.

[ppenguin]

Done in 2e84e1c:

1. newRig: logger.LogInitConsoleOnly(); go test -run FirstAdmin ./route/ passes on its own
2. -ru: ResetUserCredentials writes the password and the four 2FA columns in one UPDATE: both or neither

Optional, also done:

• unknown [app] FirstAdmin → warning at start (taken as web)
• -bootstrap-admin from a terminal without systemd credentials → refused (ErrTerminalInput); pipes and /dev/null are read (isatty)
• busy_test closes the DB

[inkly]

Thanks, all verified: one UPDATE for -ru (argon2id hash stored, 2FA fully cleared), a warning on an unknown FirstAdmin, a terminal refused while pipes and /dev/null are read, the rig logger, and the DB closed in busy_test. It also merges cleanly with #7. Optional nit: UpdateUserTOTP has no caller left outside the tests and could go. Approving. We'll squash-merge with a plain commit message.