Redflag/docs/4_LOG/2025-12-13_Setup-Flow-Fix.md

Setup Flow Fix - 2025-12-13

Problem

Fresh RedFlag installations went straight to /login page instead of /setup, preventing users from:

• Generating signing keys (required for v0.2.x security)
• Configuring admin credentials properly
• Completing initial server setup

Root Cause

The welcome mode only triggered when config.Load() failed (config file didn't exist). However, in a fresh Docker installation, a config file with default values exists, so welcome mode never triggered even though setup wasn't complete.

Solution Implemented

Added isSetupComplete() check that runs AFTER config loads and BEFORE full server starts.

What isSetupComplete() Checks:

1. Signing keys configured - cfg.SigningPrivateKey != ""
2. Admin password configured - cfg.Admin.Password != ""
3. JWT secret configured - cfg.Admin.JWTSecret != ""
4. Database accessible - db.Ping() succeeds
5. Users table exists - Can query users table
6. Admin users exist - COUNT(*) FROM users > 0

If ANY check fails, server starts in welcome mode with setup UI.

Files Modified

• aggregator-server/cmd/server/main.go:
  • Added isSetupComplete() helper function (lines 50-94)
  • Added setup check after security settings init (lines 264-275)
  • Uses proper config paths: cfg.Server.Host, cfg.Server.Port, cfg.Admin.Password

Result

Now the server correctly:

1. Loads config (even if defaults exist)
2. Checks if setup is ACTUALLY complete
3. If not complete → Welcome mode with /setup page
4. If complete → Normal server with dashboard

Benefits

• ✅ Fresh installs now show setup page correctly
• ✅ Users can generate signing keys
• ✅ Can force re-setup later by clearing any required field
• ✅ Proper separation: config exists ≠ setup complete
• ✅ Clear error messages in logs about what's missing

Testing

Build succeeds: go build ./cmd/server ✓

Expected behavior now:

1. Fresh install → /setup page → create admin, keys → restart → /login
2. Reconfigure → clear SIGNING_PRIVATE_KEY → restart → /setup again
3. Complete config → starts normally → /login

This provides a much better first-time user experience and allows forcing re-setup when needed.