Notifications

Added a cron job processor so emails and notifications can get processed.

Added super admin settings with a gui to edit.

scripts/ensure-super-admin.ts

@@ -2,9 +2,18 @@
  * Idempotent Super Administrator provisioning, run on every container
  * start (see docker/entrypoint.sh) — NOT part of the installation wizard,
  * per the brief's explicit requirement that this account come from
- * environment variables. Safe to run repeatedly: re-hashes and syncs the
- * password/name from the env vars every run, so rotating
- * SUPER_ADMIN_PASSWORD and restarting the container is how you change it.
+ * environment variables. Safe to run repeatedly: re-syncs the name from
+ * the env vars every run.
+ *
+ * No password — sign-in across this entire app is OTP-only (see
+ * src/lib/auth/authorize-credentials.ts), and a Super Administrator signs
+ * in exactly the same way as anyone else, via a one-time code emailed to
+ * SUPER_ADMIN_EMAIL. `User.passwordHash` is never read anywhere in the
+ * actual sign-in path — this script used to require and set one anyway
+ * (a leftover from before the OTP migration), which only meant an unused
+ * value with its own, pointless minimum-length requirement. Removed
+ * rather than kept "just in case": a field nothing checks is worse than
+ * no field, since it invites someone to assume it's load-bearing.
  *
  * Deliberately does NOT create a StaffProfile — that's what keeps the
  * Super Administrator out of the Team list, the customer-facing barber
@@ -18,13 +27,10 @@
  * outside Next's own module resolution/bundling.
  */
 import "dotenv/config";
-import bcrypt from "bcryptjs";
 import { PrismaClient } from "../generated/prisma/client";
 import { PrismaMariaDb } from "@prisma/adapter-mariadb";
 import { buildMysqlPoolConfig } from "../src/lib/db/mysql-pool-config";
 
-const BCRYPT_COST = 12; // matches src/features/installation/installer.service.ts
-
 async function main() {
   const email = process.env.SUPER_ADMIN_EMAIL?.trim().toLowerCase();
   if (!email) {
@@ -32,15 +38,6 @@ async function main() {
     return;
   }
 
-  const password = process.env.SUPER_ADMIN_PASSWORD;
-  if (!password || password.length < 8) {
-    console.error(
-      "[ensure-super-admin] SUPER_ADMIN_EMAIL is set but SUPER_ADMIN_PASSWORD is missing or shorter than 8 characters. Refusing to provision a Super Administrator with no usable password.",
-    );
-    process.exitCode = 1;
-    return;
-  }
-
   const firstName = process.env.SUPER_ADMIN_FIRST_NAME?.trim() ?? "";
   const lastName = process.env.SUPER_ADMIN_LAST_NAME?.trim() ?? "";
   const name = [firstName, lastName].filter(Boolean).join(" ") || null;
@@ -49,7 +46,6 @@ async function main() {
   const prisma = new PrismaClient({ adapter });
 
   try {
-    const passwordHash = await bcrypt.hash(password, BCRYPT_COST);
     const existing = await prisma.user.findUnique({ where: { email } });
 
     if (existing && !existing.isSuperAdmin) {
@@ -63,12 +59,12 @@ async function main() {
     if (existing) {
       await prisma.user.update({
         where: { id: existing.id },
-        data: { name, passwordHash, emailVerified: existing.emailVerified ?? new Date() },
+        data: { name, emailVerified: existing.emailVerified ?? new Date() },
       });
-      console.log(`[ensure-super-admin] Synced credentials for existing Super Administrator (${email}).`);
+      console.log(`[ensure-super-admin] Synced name for existing Super Administrator (${email}).`);
     } else {
       await prisma.user.create({
-        data: { email, name, passwordHash, isSuperAdmin: true, emailVerified: new Date() },
+        data: { email, name, isSuperAdmin: true, emailVerified: new Date() },
       });
       console.log(`[ensure-super-admin] Created Super Administrator (${email}).`);
     }