Keep gating setup until an account actually exists

[elemdos]

Problem

On a fresh deploy (no account yet), the bare domain correctly went to the setup screen the first time. But a second visit landed on /admin/auth — a dead end, since the server was never set up and no account exists to sign in with.

Cause

RegisterAdminApp's setupCompleted flag was latched to true in the else branch that also fires when serving /admin/setup itself (isSetup=true makes the redirect condition false). So the very first request to the setup page marked setup "complete" before any superuser existed, and every later /admin/* request skipped the gate — letting the root page's redirect to /admin/auth stick.

Fix

Only latch setupCompleted when a real superuser exists (!setupRequired). While setup is still required, redirect every non-setup, non-file /admin/* request back to /admin/setup, so an abandoned setup can't strand the instance at the auth dead-end.

Verification

• go build ./internal/ ✅
• Traced the request flow (fresh deploy → setup → revisit); no automated test — the gate lives in a router closure that needs a PocketBase test app to exercise. Will verify on staging.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved administrative setup handling to ensure setup-required requests are redirected appropriately.
  • Prevented setup completion state from being recorded while setup is still required.
  • Preserved setup completion tracking once setup requirements are no longer active.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 937a0819-16d5-4557-a07a-7c53daf2bf41

📥 Commits

Reviewing files that changed from the base of the PR and between 056f2ba and e3cd45f.

📒 Files selected for processing (1)

• internal/admin.go

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The admin route now separates setup redirection from setup completion tracking. It redirects only non-setup, non-file requests when setup is required. It sets setupCompleted only when setup is not required.

Changes

Admin setup flow

Layer / File(s)	Summary
Separate setup gating branches internal/admin.go	The handler redirects eligible requests to /admin/setup while setup is required. It latches setupCompleted only when setup is not required.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to e3cd4

Fresh deployments remain in setup until a superuser exists, while setup pages and assets remain reachable and other admin pages redirect to setup. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: setup remains gated until an account exists.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/setup-gate-auth-dead-end

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}