From 4293a30d5023e0feb00f94c5b364bb9744100e4a Mon Sep 17 00:00:00 2001
From: Jared Wolff <hello@jaredwolff.com>
Date: Wed, 4 Mar 2026 20:27:43 -0500
Subject: [PATCH] fix(setup): use /api/setup endpoint for admin creation

The admin setup form was calling /api/auth/register which creates a
regular user (role is hardcoded to User) and never sets the
system_initialized flag. Switch to /api/setup which creates an actual
admin and marks the system as initialized. Add setup token input field.
---
 static/js/features/auth/auth.js | 22 +++++++++++++++++++---
 static/login.html               | 13 +++++++++++++
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/static/js/features/auth/auth.js b/static/js/features/auth/auth.js
index c6982468..d52b223e 100644
--- a/static/js/features/auth/auth.js
+++ b/static/js/features/auth/auth.js
@@ -729,9 +729,25 @@ if (isLoginPage && adminSetupForm) {
     }
     
     try {
-        // Register admin account
-        const data = await register('admin', email, password, 'admin');
-        
+        // Use the /api/setup endpoint which creates an admin and marks the system as initialized
+        const setupToken = document.getElementById('admin-setup-token').value;
+        const response = await fetch('/api/setup', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', ...getCsrfHeaders() },
+            credentials: 'same-origin',
+            body: JSON.stringify({
+                username: 'admin',
+                email,
+                password,
+                setup_token: setupToken
+            })
+        });
+        if (!response.ok) {
+            const err = await response.json().catch(() => ({}));
+            throw new Error(err.message || 'Setup failed');
+        }
+        const data = await response.json();
+
         // Show success message in the GUI instead of alert
         const successMsg = window.i18n ? window.i18n.t('auth.admin_success') : 'Admin account created successfully! You can now log in.';
         
diff --git a/static/login.html b/static/login.html
index 936947a2..76e2ba97 100644
--- a/static/login.html
+++ b/static/login.html
@@ -273,6 +273,19 @@
                     >
                 </div>
                 
+                <div class="auth-input-group">
+                    <label class="auth-label" for="admin-setup-token">Setup token</label>
+                    <input
+                        type="text"
+                        id="admin-setup-token"
+                        class="auth-input"
+                        placeholder="Paste the one-time token from the server log"
+                        required
+                        autocomplete="off"
+                    >
+                    <small style="color: var(--text-secondary, #666); margin-top: 4px; display: block;">Check the server console output for the setup token.</small>
+                </div>
+
                 <button type="submit" class="auth-button" data-i18n="auth.create_admin">Create administrator</button>
             </form>