fix: seed creates the first admin only on an empty user table

The seed checked only SEED_ADMIN_EMAIL. After the real admin changed
their address, every start created a second ADMIN with a random
password and wrote that password to the log. The seed now skips as
soon as any user exists and never prints an operator-supplied
password. seedAdmin() is exported for tests; main() runs only when the
file is executed directly.

Refs #45

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/prisma/seed.ts

@@ -16,18 +16,28 @@ function generateRandomPassword(): string {
 }
 
 // Only printed the moment the account is actually created (first deploy on
-// an empty database), never on later restarts: by then the real admin may
+// an empty user table), never on later restarts: by then the real admin may
 // have changed the password via /profile, so repeating it would just be
 // stale and would leak credentials into logs indefinitely for no reason.
-function printLoginBanner(email: string, password: string): void {
+// An operator-supplied password is never printed: the operator already has
+// it, and the log would only be one more place it leaks to.
+function printLoginBanner(
+  email: string,
+  password: string | null,
+  log: (line: string) => void,
+): void {
   const url = process.env.FRONTEND_ORIGIN ?? 'http://localhost:3000';
   const line = '='.repeat(60);
-  console.log(line);
-  console.log('Seed: Admin-Zugang eingerichtet.');
-  console.log(`  URL:      ${url}`);
-  console.log(`  Benutzer: ${email}`);
-  console.log(`  Passwort: ${password}`);
-  console.log(line);
+  log(line);
+  log('Seed: Admin-Zugang eingerichtet.');
+  log(`  URL:      ${url}`);
+  log(`  Benutzer: ${email}`);
+  log(
+    password === null
+      ? '  Passwort: wie in SEED_ADMIN_PASSWORD gesetzt'
+      : `  Passwort: ${password}`,
+  );
+  log(line);
 }
 
 // Duplicated from src/task-templates/recurrence.ts rather than imported:
@@ -189,22 +199,26 @@ async function seedDefaultTaskTemplates(prisma: PrismaClient): Promise<void> {
   );
 }
 
-async function main(): Promise<void> {
-  const prisma = new PrismaClient({
-    adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL }),
-  });
+type AdminSeedClient = Pick<PrismaClient, 'user' | 'role'>;
 
-  await seedDefaultTaskTemplates(prisma);
-
-  const email = process.env.SEED_ADMIN_EMAIL ?? DEFAULT_ADMIN_EMAIL;
-  const password = process.env.SEED_ADMIN_PASSWORD ?? generateRandomPassword();
-  const existing = await prisma.user.findUnique({ where: { email } });
-  if (existing) {
-    console.log(`Seed: admin user ${email} already exists, skipping.`);
-    await prisma.$disconnect();
-    return;
+/**
+ * Creates the first administrator, but only while the user table is still
+ * empty. Checking SEED_ADMIN_EMAIL instead would add a second ADMIN (and log
+ * its password) on every start after the real admin changed their address.
+ */
+export async function seedAdmin(
+  prisma: AdminSeedClient,
+  env: NodeJS.ProcessEnv,
+  log: (line: string) => void,
+): Promise<'created' | 'skipped'> {
+  if ((await prisma.user.count()) > 0) {
+    log('Seed: Es gibt bereits Benutzer, kein Admin angelegt.');
+    return 'skipped';
   }
 
+  const email = env.SEED_ADMIN_EMAIL ?? DEFAULT_ADMIN_EMAIL;
+  const suppliedPassword = env.SEED_ADMIN_PASSWORD;
+  const password = suppliedPassword ?? generateRandomPassword();
   const passwordHash = await bcrypt.hash(password, BCRYPT_SALT_ROUNDS);
   const adminRole = await prisma.role.findUniqueOrThrow({
     where: { key: 'ADMIN' },
@@ -218,27 +232,42 @@ async function main(): Promise<void> {
         roleId: adminRole.id,
       },
     });
-    printLoginBanner(email, password);
   } catch (error: unknown) {
     // P2002 = unique constraint violation on email: another replica's
-    // startup won this race between the existence check above and this
-    // create() call. The user now exists either way, so this is a no-op,
-    // not a failure - container startup must not crash on it.
+    // startup won this race between the count above and this create()
+    // call. The user now exists either way, so this is a no-op, not a
+    // failure - container startup must not crash on it.
     if (
       error instanceof Prisma.PrismaClientKnownRequestError &&
       error.code === 'P2002'
     ) {
-      console.log(
-        `Seed: admin user ${email} was created concurrently, skipping.`,
-      );
-    } else {
-      throw error;
+      log(`Seed: admin user ${email} was created concurrently, skipping.`);
+      return 'skipped';
     }
+    throw error;
   }
+  printLoginBanner(
+    email,
+    suppliedPassword === undefined ? password : null,
+    log,
+  );
+  return 'created';
+}
+
+async function main(): Promise<void> {
+  const prisma = new PrismaClient({
+    adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL }),
+  });
+
+  await seedDefaultTaskTemplates(prisma);
+  await seedAdmin(prisma, process.env, (line) => console.log(line));
   await prisma.$disconnect();
 }
 
-main().catch((error: unknown) => {
-  console.error(error);
-  process.exit(1);
-});
+// Only when run as `node dist/seed.js`, not when a test imports seedAdmin.
+if (require.main === module) {
+  main().catch((error: unknown) => {
+    console.error(error);
+    process.exit(1);
+  });
+}