Citali/cms.fellies.org
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): enforce single-owner invariant in bootstrap flow

Browse Source
This commit is contained in:
Citali
2026-02-10 18:43:06 +01:00
parent b96cd6d800
commit 29a6e38ff3
3 changed files with 94 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/product-engineering/auth-baseline.md
View File

@@ -12,6 +12,7 @@ Implemented in MVP0:
- Support fallback sign-in page: `/support/<CMS_SUPPORT_LOGIN_KEY>`
- Prisma auth models (`user`, `session`, `account`, `verification`)
- First registration creates owner; subsequent registrations are disabled
- Owner invariant reconciliation is enforced in auth bootstrap and owner promotion flow
## Environment
@@ -38,5 +39,5 @@ Optional:
- Support user bootstrap is available via `bun run auth:seed:support`.
- Root `bun run db:seed` runs DB seed and support-user seed.
- `CMS_ADMIN_SELF_REGISTRATION_ENABLED` is temporary until admin settings UI manages this policy.
- Owner invariant hardening for all future user-management mutations remains tracked in `TODO.md`.
- Owner invariant checks for future user-management mutations remain tracked in `TODO.md`.
- Email verification and forgot/reset password pipelines are tracked for MVP2.