thbd-portal/scripts/bootstrap-admin.ts

/**
 * Creates the initial admin user from ADMIN_BOOTSTRAP_EMAIL /
 * ADMIN_BOOTSTRAP_PASSWORD if no user with that email exists yet.
 * Safe to run on every container start — idempotent.
 */
import { db } from "../src/lib/db/client";
import { users } from "../src/lib/db/schema";
import { hashPassword } from "../src/lib/auth/password";

async function main() {
  const email = process.env.ADMIN_BOOTSTRAP_EMAIL;
  const password = process.env.ADMIN_BOOTSTRAP_PASSWORD;
  const name = process.env.ADMIN_BOOTSTRAP_NAME ?? "Admin";

  if (!email || !password) {
    console.log("ADMIN_BOOTSTRAP_EMAIL/PASSWORD not set — skipping admin bootstrap.");
    return;
  }

  const normalizedEmail = email.toLowerCase().trim();
  const existing = await db.query.users.findFirst({
    where: (u, { eq }) => eq(u.email, normalizedEmail),
  });

  if (existing) {
    console.log(`Admin user ${normalizedEmail} already exists — skipping.`);
    return;
  }

  const passwordHash = await hashPassword(password);
  await db.insert(users).values({
    email: normalizedEmail,
    passwordHash,
    name,
    role: "admin",
  });

  console.log(`Bootstrapped admin user ${normalizedEmail}.`);
}

main()
  .then(() => process.exit(0))
  .catch((err) => {
    console.error("Admin bootstrap failed:", err);
    process.exit(1);
  });