Fix Rust-only startup seed

Author: ewilhelm1979-netizen

rust/iscy-backend/src/db_admin.rs

@@ -2835,13 +2835,14 @@ INSERT OR IGNORE INTO organizations_tenant (
     'Product security scope prepared for Rust cutover'
 );
 INSERT INTO accounts_user (
-    id, password, username, first_name, last_name, email, is_staff, is_active, date_joined, role, job_title, tenant_id
+    id, password, is_superuser, username, first_name, last_name, email, is_staff, is_active, date_joined, role, job_title, tenant_id
 ) VALUES (
-    1, 'pbkdf2_sha256$720000$iscy-demo-salt$dHYZBIWxS3abL+0r4Rp7w3kbLXLSAFUrGq/HaPlAVrY=',
+    1, 'pbkdf2_sha256$720000$iscy-demo-salt$dHYZBIWxS3abL+0r4Rp7w3kbLXLSAFUrGq/HaPlAVrY=', 1,
     'admin', 'Demo', 'Admin', 'admin@example.com', 1, 1, '2026-04-22T10:00:00Z',
     'ADMIN', 'Security Lead', 1
 ) ON CONFLICT(id) DO UPDATE SET
     password = excluded.password,
+    is_superuser = excluded.is_superuser,
     username = excluded.username,
     first_name = excluded.first_name,
     last_name = excluded.last_name,
@@ -3177,13 +3178,14 @@ INSERT INTO organizations_tenant (
     'Product security scope prepared for Rust cutover'
 ) ON CONFLICT (id) DO NOTHING;
 INSERT INTO accounts_user (
-    id, password, username, first_name, last_name, email, is_staff, is_active, date_joined, role, job_title, tenant_id
+    id, password, is_superuser, username, first_name, last_name, email, is_staff, is_active, date_joined, role, job_title, tenant_id
 ) VALUES (
-    1, 'pbkdf2_sha256$720000$iscy-demo-salt$dHYZBIWxS3abL+0r4Rp7w3kbLXLSAFUrGq/HaPlAVrY=',
+    1, 'pbkdf2_sha256$720000$iscy-demo-salt$dHYZBIWxS3abL+0r4Rp7w3kbLXLSAFUrGq/HaPlAVrY=', TRUE,
     'admin', 'Demo', 'Admin', 'admin@example.com', TRUE, TRUE, '2026-04-22T10:00:00Z',
     'ADMIN', 'Security Lead', 1
 ) ON CONFLICT (id) DO UPDATE SET
     password = EXCLUDED.password,
+    is_superuser = EXCLUDED.is_superuser,
     username = EXCLUDED.username,
     first_name = EXCLUDED.first_name,
     last_name = EXCLUDED.last_name,

rust/iscy-backend/tests/http_tests.rs

@@ -7260,6 +7260,49 @@ async fn rust_db_admin_migrates_and_seeds_demo_web_cutover_database() {
     assert_eq!(mapping_count, 67);
 }
 
+#[tokio::test]
+async fn rust_db_admin_seed_sets_superuser_for_existing_sqlite_user_table() {
+    let pool = SqlitePoolOptions::new()
+        .max_connections(1)
+        .connect("sqlite::memory:")
+        .await
+        .unwrap();
+    sqlx::query(
+        r#"
+        CREATE TABLE accounts_user (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            password varchar(128) NOT NULL DEFAULT '',
+            last_login TEXT NULL,
+            is_superuser bool NOT NULL,
+            username varchar(150) NOT NULL UNIQUE,
+            first_name varchar(150) NOT NULL DEFAULT '',
+            last_name varchar(150) NOT NULL DEFAULT '',
+            email varchar(254) NOT NULL DEFAULT '',
+            is_staff bool NOT NULL DEFAULT 0,
+            is_active bool NOT NULL DEFAULT 1,
+            date_joined TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+            role varchar(32) NOT NULL DEFAULT 'CONTRIBUTOR',
+            job_title varchar(255) NOT NULL DEFAULT '',
+            tenant_id INTEGER NULL
+        )
+        "#,
+    )
+    .execute(&pool)
+    .await
+    .unwrap();
+
+    db_admin::run_sqlite_migrations(&pool).await.unwrap();
+    db_admin::seed_sqlite_demo(&pool).await.unwrap();
+    db_admin::seed_sqlite_demo(&pool).await.unwrap();
+
+    let is_superuser: i64 =
+        sqlx::query_scalar("SELECT is_superuser FROM accounts_user WHERE id = 1")
+            .fetch_one(&pool)
+            .await
+            .unwrap();
+    assert_eq!(is_superuser, 1);
+}
+
 #[tokio::test]
 async fn nvd_import_endpoint_fetches_and_persists_cve_record() {
     let pool = SqlitePoolOptions::new()

start.sh

@@ -13,17 +13,38 @@ if [ ! -f ".env" ] && [ -f ".env.example" ]; then
   info ".env aus .env.example erstellt."
 fi
 
+ENV_FILE_READABLE=0
+ENV_FILE_WRITABLE=0
+if [ -f ".env" ]; then
+  if [ -r ".env" ]; then
+    ENV_FILE_READABLE=1
+  else
+    warn ".env ist vorhanden, aber nicht lesbar; nutze Defaults und exportierte Umgebungsvariablen."
+  fi
+  if [ -w ".env" ]; then
+    ENV_FILE_WRITABLE=1
+  else
+    warn ".env ist vorhanden, aber nicht schreibbar; Startwerte werden nicht in .env aktualisiert."
+  fi
+else
+  ENV_FILE_READABLE=1
+  ENV_FILE_WRITABLE=1
+fi
+
 env_file_value() {
   local key="$1"
-  if [ -f ".env" ]; then
+  if [ -f ".env" ] && [ "$ENV_FILE_READABLE" = "1" ]; then
     awk -F= -v key="$key" '$1 == key { sub(/^[^=]*=/, ""); print; exit }' .env
   fi
 }
 
 set_env_var() {
   local key="$1" value="$2" tmp
+  if [ "$ENV_FILE_WRITABLE" != "1" ]; then
+    return 0
+  fi
   tmp="$(mktemp)"
-  if [ -f ".env" ]; then
+  if [ -f ".env" ] && [ "$ENV_FILE_READABLE" = "1" ]; then
     awk -v key="$key" -v value="$value" '
       BEGIN { found = 0 }
       $0 ~ "^" key "=" {