Onboard the first @swisscairn.ch staff owner so the admin console is reachable #38

New issue

Closed

opened 2026-08-25 19:34:30 +00:00 by Cordy · 1 comment

Cordy commented

2026-08-25 19:34:30 +00:00

Owner

The staff console (admin.html on swisscairn.ch, backed by /v1/me + /v1/admin/*) is live, but access requires a staff account — a registered account whose email is in the staff roster.

The roster seeds from ADMIN_ACCOUNTS (comma-separated, default no-reply@swisscairn.ch) as role owner. Nothing can use the console until an owner account actually exists and signs in.

To do

Decide the first owner email. Either:
- register the no-reply@swisscairn.ch account (it's already the seeded owner), or
- set ADMIN_ACCOUNTS in /etc/cairn-license/env to a real @swisscairn.ch address (e.g. a personal one), restart, then register that account.
Sign in at enter.html, confirm /v1/me returns admin:true, and that admin.html opens the console.
From there, add any further staff via the Staff panel (owner-only).

Notes

Staff access is limited to @swisscairn.ch addresses by design; a personal gmail cannot be staff.
The @swisscairn.ch check in admin.html is only a UI hint — the real gate is the server-side roster, so this onboarding is what makes the console usable.
Related: #33 (staff console). Frontend + backend + geography + funnel are all shipped and live.

The staff console (`admin.html` on swisscairn.ch, backed by `/v1/me` + `/v1/admin/*`) is live, but access requires a **staff account** — a registered account whose email is in the staff roster. The roster seeds from `ADMIN_ACCOUNTS` (comma-separated, default `no-reply@swisscairn.ch`) as role `owner`. Nothing can use the console until an owner account actually exists and signs in. ## To do - Decide the first owner email. Either: - register the `no-reply@swisscairn.ch` account (it's already the seeded owner), **or** - set `ADMIN_ACCOUNTS` in `/etc/cairn-license/env` to a real `@swisscairn.ch` address (e.g. a personal one), restart, then register that account. - Sign in at `enter.html`, confirm `/v1/me` returns `admin:true`, and that `admin.html` opens the console. - From there, add any further staff via the Staff panel (owner-only). ## Notes - Staff access is limited to `@swisscairn.ch` addresses by design; a personal gmail cannot be staff. - The `@swisscairn.ch` check in `admin.html` is only a UI hint — the real gate is the server-side roster, so this onboarding is what makes the console usable. - Related: #33 (staff console). Frontend + backend + geography + funnel are all shipped and live.