Initial setup

Objectives

Let's keep in mind that Content Control center is a standalone application, designed for installing on premise. By default it is shipped with minimal number of pre-populated values. setup_complete field in settings table is one of them. It's set to false.

After initial application setup will be finished, this field will be set to true.

State of this field indicates what CRUD endpoints will be unprotected on a stage of application setup. After it will be set to true, every single endpoint will be protected by authentication.

All this logic can be depicted by following sequence diagram:

sequenceDiagram
    actor Client
    participant API
    participant Database

    Note over Client,Database: Fresh install — setup_complete = false

    rect rgb(220, 240, 220)
        Note over Client,Database: Phase 1 · Initial setup (open registration)

        Client->>API: POST /api/users<br/>{name, email, password}
        API->>Database: SELECT value FROM settings<br/>WHERE key = 'setup_complete'
        Database-->>API: 'false'
        Note over API: setup_complete=false<br/>→ skip auth, proceed
        API->>Database: INSERT INTO users
        Database-->>API: ok
        API-->>Client: 201 Created {id, name, email}

        Client->>API: POST /api/sessions<br/>{email, password}
        API->>Database: SELECT * FROM users<br/>WHERE email = ?
        Database-->>API: user row
        API->>API: argon2id verify password
        API->>Database: INSERT INTO sessions
        Database-->>API: ok
        API-->>Client: 201 Created {id, user_id, expires_at}<br/>Set-Cookie: c3_session=<token>
    end

    rect rgb(220, 230, 245)
        Note over Client,Database: Phase 2 · Lock down registration

        Client->>API: PUT /api/settings/setup_complete<br/>{value: "true"}<br/>Cookie: c3_session=<token>
        API->>Database: SELECT * FROM sessions<br/>WHERE id = <token>
        Database-->>API: session (valid, not expired)
        Note over API: auth passed
        API->>Database: INSERT INTO settings (key, value)<br/>ON CONFLICT DO UPDATE SET value='true'
        Database-->>API: ok
        API-->>Client: 200 OK {key: "setup_complete", value: "true"}
    end

    rect rgb(245, 220, 220)
        Note over Client,Database: Phase 3a · Attempt to create user without auth (rejected)

        Client->>API: POST /api/users<br/>{name, email, password}
        API->>Database: SELECT value FROM settings<br/>WHERE key = 'setup_complete'
        Database-->>API: 'true'
        Note over API: setup_complete=true<br/>→ enforce auth
        API->>Database: SELECT * FROM sessions<br/>WHERE id = <cookie>
        Database-->>API: no rows (no cookie sent)
        API-->>Client: 401 Unauthorized<br/>{error: "authentication required"}
    end

    rect rgb(220, 240, 220)
        Note over Client,Database: Phase 3b · Create user with valid session (allowed)

        Client->>API: POST /api/users<br/>{name, email, password}<br/>Cookie: c3_session=<token>
        API->>Database: SELECT value FROM settings<br/>WHERE key = 'setup_complete'
        Database-->>API: 'true'
        Note over API: setup_complete=true<br/>→ enforce auth
        API->>Database: SELECT * FROM sessions<br/>WHERE id = <token>
        Database-->>API: session (valid, not expired)
        Note over API: auth passed
        API->>Database: INSERT INTO users
        Database-->>API: ok
        API-->>Client: 201 Created {id, name, email}
    end

Loading