Initial setup

Settings > setup_complete Attribute Utilisation Logic

sequenceDiagram
    actor Client
    participant API
    participant Database

    Note over Client,Database: Fresh install — setup_complete = false

    rect rgb(220, 240, 220)
        Note over Client,Database: Phase 1 · Initial setup (open registration)

        Client->>API: POST /api/users<br/>{name, email, password}
        API->>Database: SELECT value FROM settings<br/>WHERE key = 'setup_complete'
        Database-->>API: 'false'
        Note over API: setup_complete=false<br/>→ skip auth, proceed
        API->>Database: INSERT INTO users
        Database-->>API: ok
        API-->>Client: 201 Created {id, name, email}

        Client->>API: POST /api/sessions<br/>{email, password}
        API->>Database: SELECT * FROM users<br/>WHERE email = ?
        Database-->>API: user row
        API->>API: argon2id verify password
        API->>Database: INSERT INTO sessions
        Database-->>API: ok
        API-->>Client: 201 Created {id, user_id, expires_at}<br/>Set-Cookie: c3_session=<token>
    end

    rect rgb(220, 230, 245)
        Note over Client,Database: Phase 2 · Lock down registration

        Client->>API: PUT /api/settings/setup_complete<br/>{value: "true"}<br/>Cookie: c3_session=<token>
        API->>Database: SELECT * FROM sessions<br/>WHERE id = <token>
        Database-->>API: session (valid, not expired)
        Note over API: auth passed
        API->>Database: INSERT INTO settings (key, value)<br/>ON CONFLICT DO UPDATE SET value='true'
        Database-->>API: ok
        API-->>Client: 200 OK {key: "setup_complete", value: "true"}
    end

    rect rgb(245, 220, 220)
        Note over Client,Database: Phase 3a · Attempt to create user without auth (rejected)

        Client->>API: POST /api/users<br/>{name, email, password}
        API->>Database: SELECT value FROM settings<br/>WHERE key = 'setup_complete'
        Database-->>API: 'true'
        Note over API: setup_complete=true<br/>→ enforce auth
        API->>Database: SELECT * FROM sessions<br/>WHERE id = <cookie>
        Database-->>API: no rows (no cookie sent)
        API-->>Client: 401 Unauthorized<br/>{error: "authentication required"}
    end

    rect rgb(220, 240, 220)
        Note over Client,Database: Phase 3b · Create user with valid session (allowed)

        Client->>API: POST /api/users<br/>{name, email, password}<br/>Cookie: c3_session=<token>
        API->>Database: SELECT value FROM settings<br/>WHERE key = 'setup_complete'
        Database-->>API: 'true'
        Note over API: setup_complete=true<br/>→ enforce auth
        API->>Database: SELECT * FROM sessions<br/>WHERE id = <token>
        Database-->>API: session (valid, not expired)
        Note over API: auth passed
        API->>Database: INSERT INTO users
        Database-->>API: ok
        API-->>Client: 201 Created {id, name, email}
    end

Loading