Function seedOrgAndAdmin

apps/host-selfhost/src/auth/seed.ts:18–89

(
  auth: Auth,
  client: Client,
  config: SelfHostConfig,
)

// ---------------------------------------------------------------------------

export const seedOrgAndAdmin = async (
  auth: Auth,
  client: Client,
  config: SelfHostConfig,
): Promise<{ organizationId: string; organizationName: string }> => {
  // Idempotent: once the single organization exists, boot is past first-run.
  // This instance is SINGLE-org, so adopt whatever organization exists rather
  // than looking it up by slug — matching on slug would silently create a
  // second org (forking the instance) the first boot after EXECUTOR_ORG_SLUG
  // changes. A changed slug is a rename of the one org, applied here.
  // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT columns are the schema contract for the Better Auth `organization` row read off the libSQL client
  const existingOrg = (
    await client.execute({
      sql: "SELECT id, name, slug FROM organization ORDER BY createdAt ASC LIMIT 1",
      args: [],
    })
  ).rows[0] as unknown as { id: string; name: string; slug: string } | undefined;
  if (existingOrg) {
    if (existingOrg.slug !== config.orgSlug) {
      await client.execute({
        sql: "UPDATE organization SET slug = ? WHERE id = ?",
        args: [config.orgSlug, existingOrg.id],
      });
    }
    return { organizationId: existingOrg.id, organizationName: existingOrg.name };
  }

  // Headless bootstrap: when BOTH admin email and password are set, pre-create
  // that admin as the org owner (CI / infra-as-code). Otherwise fall through to
  // the turnkey path so the first browser visitor claims the instance.
  if (config.bootstrapAdminEmail && config.bootstrapAdminPassword) {
    // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT column is the schema contract for the Better Auth `user` row read off the libSQL client
    const existingUser = (
      await client.execute({
        sql: "SELECT id FROM user WHERE email = ?",
        args: [config.bootstrapAdminEmail],
      })
    ).rows[0] as unknown as { id: string } | undefined;
    let adminId = existingUser?.id;
    if (!adminId) {
      const created = await auth.api.createUser({
        body: {
          email: config.bootstrapAdminEmail,
          password: config.bootstrapAdminPassword,
          name: config.bootstrapAdminName,
          role: "admin",
        },
      });
      adminId = created.user.id;
    }
    // Pass userId so the org is created with no session and the admin becomes
    // its owner (creates the membership row).
    const org = await auth.api.createOrganization({
      body: { name: config.organizationName, slug: config.orgSlug, userId: adminId },
    });
    if (!org) {
      // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: org creation must succeed for a usable instance
      throw new Error("Failed to create the bootstrap organization");