76 lines
2.2 KiB
JavaScript
76 lines
2.2 KiB
JavaScript
import { createHash, randomBytes } from 'node:crypto';
|
|
import { writeFileSync } from 'node:fs';
|
|
import { PrismaPg } from '../../api/node_modules/@prisma/adapter-pg/dist/index.js';
|
|
import { PrismaClient } from '../../api/node_modules/@prisma/client/index.js';
|
|
|
|
const databaseUrl = process.env.DATABASE_URL;
|
|
if (!databaseUrl) {
|
|
throw new Error('DATABASE_URL is required');
|
|
}
|
|
|
|
const prisma = new PrismaClient({ adapter: new PrismaPg(databaseUrl) });
|
|
const username = process.env.PROD_ADMIN_USERNAME || 'prod_admin';
|
|
const email = process.env.PROD_ADMIN_EMAIL || 'admin@example.com';
|
|
const password = process.env.PROD_ADMIN_PASSWORD || randomBytes(18).toString('base64url');
|
|
const credentialFile = process.env.PROD_ADMIN_CREDENTIAL_FILE;
|
|
|
|
function hashPassword(value) {
|
|
return createHash('sha256').update(value).digest('hex');
|
|
}
|
|
|
|
async function main() {
|
|
const role = await prisma.role.upsert({
|
|
where: { code: 'platform_admin' },
|
|
update: { name: '平台管理员', scope: 'platform' },
|
|
create: { code: 'platform_admin', name: '平台管理员', scope: 'platform' },
|
|
});
|
|
const user = await prisma.user.upsert({
|
|
where: { username },
|
|
update: {
|
|
email,
|
|
displayName: '生产平台管理员',
|
|
passwordHash: hashPassword(password),
|
|
status: 'active',
|
|
failedLoginCount: 0,
|
|
lockedUntil: null,
|
|
deletedAt: null,
|
|
tenantId: null,
|
|
},
|
|
create: {
|
|
username,
|
|
email,
|
|
displayName: '生产平台管理员',
|
|
passwordHash: hashPassword(password),
|
|
status: 'active',
|
|
},
|
|
});
|
|
await prisma.userRole.upsert({
|
|
where: { userId_roleId: { userId: user.id, roleId: role.id } },
|
|
update: {},
|
|
create: { userId: user.id, roleId: role.id },
|
|
});
|
|
|
|
const message = [
|
|
'CMPP production admin account',
|
|
`username=${username}`,
|
|
`email=${email}`,
|
|
`password=${password}`,
|
|
`generatedAt=${new Date().toISOString()}`,
|
|
'',
|
|
].join('\n');
|
|
if (credentialFile) {
|
|
writeFileSync(credentialFile, message, { mode: 0o600 });
|
|
}
|
|
console.log(`Production admin is ready: ${email}`);
|
|
if (!credentialFile) {
|
|
console.log(`Temporary password: ${password}`);
|
|
}
|
|
}
|
|
|
|
main()
|
|
.finally(() => prisma.$disconnect())
|
|
.catch((error) => {
|
|
console.error(error);
|
|
process.exit(1);
|
|
});
|