admin / Synapse-Sonar

import { NextRequest, NextResponse } from "next/server";
import crypto from "crypto";
import { z } from "zod";
import bcrypt from "bcryptjs";
import { prisma } from "@/lib/prisma";

export const runtime = "nodejs";

/**
 * First-run bootstrap. Creates the very first Tenant + Tenant Admin.
 *
 * Username + password only — no organization required. A default tenant is
 * created silently (the admin can rename it later). One-shot: refuses once any
 * user exists.
 */

/** GET /api/setup → whether first-run setup is still required. */
export async function GET() {
  const userCount = await prisma.user.count();
  return NextResponse.json({ needsSetup: userCount === 0 });
}

const SetupSchema = z.object({
  username: z
    .string()
    .min(3)
    .max(40)
    .regex(/^[a-zA-Z0-9._-]+$/, "Letters, numbers, dot, underscore and hyphen only"),
  name: z.string().max(80).optional(),
  password: z.string().min(10, "Use at least 10 characters"),
});

export async function POST(req: NextRequest) {
  // Bootstrap guard: refuse if the system is already initialized.
  const existing = await prisma.user.count();
  if (existing > 0) {
    return NextResponse.json(
      { error: "Setup has already been completed" },
      { status: 409 }
    );
  }

  let body;
  try {
    body = SetupSchema.parse(await req.json());
  } catch (err) {
    if (err instanceof z.ZodError) {
      return NextResponse.json(
        { error: "Invalid input", details: err.issues },
        { status: 422 }
      );
    }
    return NextResponse.json({ error: "Invalid request" }, { status: 400 });
  }

  // Create the default tenant + admin atomically.
  const result = await prisma.$transaction(async (tx) => {
    const tenant = await tx.tenant.create({
      data: {
        name: "My Organization",
        slug: `org-${crypto.randomBytes(4).toString("hex")}`,
      },
    });
    const admin = await tx.user.create({
      data: {
        tenantId: tenant.id,
        username: body.username,
        name: body.name,
        role: "TENANT_ADMIN",
        status: "ACTIVE",
        passwordHash: await bcrypt.hash(body.password, 12),
      },
      select: { id: true, username: true },
    });
    return { tenant, admin };
  });

  return NextResponse.json({ ok: true, username: result.admin.username });
}