first commit

backend/internal/auth/bootstrap.go

@@ -0,0 +1,42 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"mira/backend/internal/config"
+	"mira/backend/internal/users"
+)
+
+func BootstrapSuperAdmin(ctx context.Context, cfg config.Config, store users.Store, logger *slog.Logger) error {
+	email := strings.TrimSpace(cfg.SuperAdminEmail)
+	password := cfg.SuperAdminPassword
+
+	if email == "" || password == "" {
+		if cfg.AppEnv == "production" {
+			return errors.New("SUPER_ADMIN_EMAIL and SUPER_ADMIN_PASSWORD are required in production")
+		}
+		logger.Warn("super admin bootstrap skipped because credentials are not configured")
+		return nil
+	}
+
+	if len(password) < 12 {
+		return fmt.Errorf("SUPER_ADMIN_PASSWORD must have at least 12 characters")
+	}
+
+	hash, err := HashPassword(password)
+	if err != nil {
+		return fmt.Errorf("hash super admin password: %w", err)
+	}
+
+	user, err := store.UpsertSuperAdmin(ctx, email, hash)
+	if err != nil {
+		return fmt.Errorf("upsert super admin: %w", err)
+	}
+
+	logger.Info("super admin bootstrapped", "user_id", user.ID, "email", user.Email)
+	return nil
+}