60 lines
2.1 KiB
Markdown
60 lines
2.1 KiB
Markdown
|
# Admin Bootstrap Closure Evidence
|
||
|
|
|
||
|
|
Generated at: `2026-03-27 17:39:14 +08:00`
|
||
|
|
|
||
|
|
## Scope
|
||
|
|
|
||
|
|
This evidence package covers the first-admin bootstrap closure for the current repository state:
|
||
|
|
|
||
|
|
- public backend endpoint: `POST /api/v1/auth/bootstrap-admin`
|
||
|
|
- public frontend route: `/bootstrap-admin`
|
||
|
|
- login/register first-run entry points
|
||
|
|
- supported-browser validation for `首次管理员初始化 -> 进入后台 -> 登出`
|
||
|
|
|
||
|
|
## Implemented closure
|
||
|
|
|
||
|
|
- Backend:
|
||
|
|
- added one-time admin bootstrap service flow guarded by `GET /api/v1/auth/capabilities -> admin_bootstrap_required`
|
||
|
|
- bootstrap now creates the first active admin, binds the `admin` role, issues a real session, and closes the bootstrap window afterward
|
||
|
|
- Frontend:
|
||
|
|
- added `/bootstrap-admin` page
|
||
|
|
- added login/register entry points when bootstrap is still required
|
||
|
|
- added post-bootstrap auto-login into `/dashboard`
|
||
|
|
- E2E:
|
||
|
|
- `frontend/admin/scripts/run-playwright-auth-e2e.ps1` no longer depends on startup-injected admin credentials
|
||
|
|
- the Playwright CDP suite now validates real bootstrap creation before the rest of the admin workflow scenarios
|
||
|
|
|
||
|
|
## Verification executed
|
||
|
|
|
||
|
|
```powershell
|
||
|
|
go test ./... -count=1
|
||
|
|
go build ./cmd/server
|
||
|
|
|
||
|
|
cd D:\project\frontend\admin
|
||
|
|
npm.cmd run lint
|
||
|
|
npm.cmd run test:run
|
||
|
|
npm.cmd run build
|
||
|
|
powershell -ExecutionPolicy Bypass -File .\scripts\run-playwright-auth-e2e.ps1
|
||
|
|
```
|
||
|
|
|
||
|
|
## Latest supported-browser result
|
||
|
|
|
||
|
|
The latest real-browser run completed with:
|
||
|
|
|
||
|
|
- `PASS admin-bootstrap`
|
||
|
|
- `PASS public-registration`
|
||
|
|
- `PASS email-activation`
|
||
|
|
- `PASS login-surface`
|
||
|
|
- `PASS auth-workflow`
|
||
|
|
- `PASS responsive-login`
|
||
|
|
- `PASS desktop-mobile-navigation`
|
||
|
|
- `Playwright CDP E2E completed successfully`
|
||
|
|
|
||
|
|
## Real boundary
|
||
|
|
|
||
|
|
- This closes the product loop for first-admin initialization in the current supported browser-validation environment.
|
||
|
|
- It does not change the previously stated external boundaries:
|
||
|
|
- no live third-party OAuth provider evidence yet
|
||
|
|
- no live external SMTP provider deliverability evidence yet
|
||
|
|
- no external production delivery/governance evidence beyond the local auditable package already formed in-repo
|