Unknown Administrator Account

Verify the existing authentication accounts

cd /Users/rodrigosilveira/projects/EnterpriseRemoteSystems/backend

grep -E '^(DB_PATH|DATABASE_PATH)=' .env

Use the displayed path below. For the usual local database:

sqlite3 data/app.db <<'SQL' .headers on .mode column

SELECT aua.login, aua.active AS account_active, aua.must_change_password, aa.id AS actor_record_id, aa.actor_key, aa.display_name, aa.active AS actor_active FROM auth_user_accounts AS aua JOIN authz_actors AS aa ON aa.id = aua.actor_id ORDER BY aua.login; SQLUse the displayed path below. For the usual local database:

sqlite3 data/app.db <<'SQL'
.headers on
.mode column

SELECT
    aua.login,
    aua.active AS account_active,
    aua.must_change_password,
    aa.id AS actor_record_id,
    aa.actor_key,
    aa.display_name,
    aa.active AS actor_active
FROM auth_user_accounts AS aua
JOIN authz_actors AS aa
    ON aa.id = aua.actor_id
ORDER BY aua.login;
SQL

Then verify the account’s active role grants:

sqlite3 data/app.db <<'SQL'
.headers on
.mode column

SELECT
    aua.login,
    aa.actor_key,
    ar.code AS role_code,
    arg.tenant_id,
    arg.active AS grant_active
FROM auth_user_accounts AS aua
JOIN authz_actors AS aa
    ON aa.id = aua.actor_id
JOIN authz_actor_role_grants AS arg
    ON arg.actor_id = aa.id
JOIN authz_roles AS ar
    ON ar.id = arg.role_id
ORDER BY aua.login, ar.code, arg.tenant_id;
SQL

For the manual administrator tests, you need a row equivalent to:

account_active = 1
actor_active   = 1
role_code      = APPLICATION_ADMIN
tenant_id      = *
grant_active   = 1

Passwords cannot be retrieved

ERS stores only a bcrypt password hash. The original password cannot be displayed from SQLite.

If you know the password, test it:

BASE_URL="http://127.0.0.1:8080/api/v1"
ADMIN_LOGIN="[email protected]"
ADMIN_PASSWORD="<your-original-temporary-password>"

curl -sS \
  -D /tmp/ers-admin-login.headers \
  -o /tmp/ers-admin-login.json \
  -w 'HTTP %{http_code}\n' \
  -H "Content-Type: application/json" \
  -d "{
    \"login\": \"${ADMIN_LOGIN}\",
    \"password\": \"${ADMIN_PASSWORD}\"
  }" \
  "$BASE_URL/auth/login"

jq . /tmp/ers-admin-login.json

Expected:

HTTP 200

Creating another administrator account

Under Bite 28C, account creation itself requires an authenticated Application Admin session. Assuming you already have a working administrator cookie:

ADMIN_COOKIE="/tmp/ers-b28c-admin.cookies"

Find the internal actor record ID:

curl -sS \
  -b "$ADMIN_COOKIE" \
  -H "X-Tenant-ID: default" \
  "$BASE_URL/authz/actors" \
| jq '.data[]
      | select(.actorKey == "bootstrap-admin")
      | {
          actorRecordId: .id,
          actorKey,
          active,
          roleGrants
        }'

Set that internal ID:

ACTOR_RECORD_ID="<id-from-the-response>"
NEW_ADMIN_LOGIN="[email protected]"
NEW_ADMIN_PASSWORD="Choose-A-Strong-Temporary-Password-1!"

Create the authentication account:

curl -sS \
  -D /tmp/ers-create-admin-account.headers \
  -o /tmp/ers-create-admin-account.json \
  -w 'HTTP %{http_code}\n' \
  -b "$ADMIN_COOKIE" \
  -H "X-Tenant-ID: default" \
  -H "Content-Type: application/json" \
  -d "{
    \"actorId\": \"${ACTOR_RECORD_ID}\",
    \"login\": \"${NEW_ADMIN_LOGIN}\",
    \"temporaryPassword\": \"${NEW_ADMIN_PASSWORD}\",
    \"mustChangePassword\": false
  }" \
  "$BASE_URL/auth/accounts"

jq . /tmp/ers-create-admin-account.json

Expected:

HTTP 201

Then use:

ADMIN_LOGIN="$NEW_ADMIN_LOGIN"
ADMIN_PASSWORD="$NEW_ADMIN_PASSWORD"