Enable auth-service/api-gateway on production, build their images in CI

2026-08-18 14:11:00 +07:00
parent e5afedfa2f
commit b68005be1c
70 changed files with 6781 additions and 263 deletions
@@ -0,0 +1,41 @@
+/** Seeds the two accounts requested for this first slice: `admin` (role
+ * admin, unlocks /admin) and `demo` (role user, the "logged-in doctor"
+ * persona). Idempotent (ON CONFLICT DO NOTHING) — safe to run on every
+ * deploy alongside migrate.ts.
+ *
+ * Passwords come from ADMIN_SEED_PASSWORD / DEMO_SEED_PASSWORD, defaulting
+ * to "1" only when unset (local/Compose dev). Because ON CONFLICT DO NOTHING
+ * means whichever password lands on the first run is permanent, any
+ * deployment where `/admin` is actually reachable must set both env vars to
+ * real values — see secret.adminSeedPassword in
+ * infra/helm/medical-chatbot/values.yaml, which the chart requires
+ * explicitly once authService.seed.enabled is true.
+ */
+import * as bcrypt from "bcrypt";
+import { createPool } from "./db";
+import { loadSettings } from "./config";
+
+async function main() {
+  const settings = loadSettings();
+  const pool = createPool(settings.postgresDsn);
+  const SEED_USERS: Array<{ username: string; password: string; role: "user" | "admin" }> = [
+    { username: "admin", password: settings.adminSeedPassword, role: "admin" },
+    { username: "demo", password: settings.demoSeedPassword, role: "user" },
+  ];
+  for (const seed of SEED_USERS) {
+    const passwordHash = await bcrypt.hash(seed.password, 12);
+    await pool.query(
+      `INSERT INTO auth_user (username, password_hash, role)
+       VALUES ($1, $2, $3)
+       ON CONFLICT (username) DO NOTHING`,
+      [seed.username, passwordHash, seed.role]
+    );
+    console.log(`Seeded ${seed.username} (${seed.role})`);
+  }
+  await pool.end();
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});