Ensure bootstrap admin on every init

Author: initstring

src/server/init/ensure-initialized.ts

@@ -14,21 +14,17 @@ export function ensureInitialized(db: PrismaClient): Promise<void> {
   if (initPromise) return initPromise;
 
   initPromise = (async () => {
-    // 1) Ensure admin exists (if no users at all)
-    const userCount = await db.user.count();
-    if (userCount === 0) {
-      const defaultEmail = process.env.INITIAL_ADMIN_EMAIL?.trim().toLowerCase() ?? "admin@example.com";
-
-      await db.user.upsert({
-        where: { email: defaultEmail },
-        update: { role: UserRole.ADMIN },
-        create: {
-          email: defaultEmail,
-          name: "Admin User",
-          role: UserRole.ADMIN,
-        },
-      });
-    }
+    // 1) Ensure the bootstrap admin exists (every init, no auto-provisioning outside env)
+    const defaultEmail = process.env.INITIAL_ADMIN_EMAIL?.trim().toLowerCase() ?? "admin@example.com";
+    await db.user.upsert({
+      where: { email: defaultEmail },
+      update: { role: UserRole.ADMIN },
+      create: {
+        email: defaultEmail,
+        name: "Admin User",
+        role: UserRole.ADMIN,
+      },
+    });
 
     // 2) Ensure MITRE data exists
     const tacticCount = await db.mitreTactic.count();

src/test/init.test.ts

@@ -15,8 +15,8 @@ describe("ensureInitialized", () => {
     delete process.env.INITIAL_ADMIN_EMAIL;
   });
 
-  it("creates admin when no users and seeds MITRE when empty", async () => {
-    const user = { count: vi.fn().mockResolvedValue(0), upsert: vi.fn() };
+  it("creates admin and seeds MITRE when empty", async () => {
+    const user = { upsert: vi.fn() };
     const mitreTactic = { count: vi.fn().mockResolvedValue(0), upsert: vi.fn() };
     const mitreTechnique = { upsert: vi.fn() };
     const mitreSubTechnique = { upsert: vi.fn() };