remove preact and create setup wizard

apps/server/internal/httpserver/admin_handlers.go

@@ -15,6 +15,10 @@ type adminUserInput struct {
 	Role        string `json:"role"`
 }
 
+type adminSettingsInput struct {
+	SignupsEnabled bool `json:"signupsEnabled"`
+}
+
 func (s *Server) handleAdminLogin(w http.ResponseWriter, r *http.Request) {
 	var input adminUserInput
 	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
@@ -95,7 +99,6 @@ func (s *Server) handleAdminWorkspace(w http.ResponseWriter, r *http.Request) {
 			"databasePath":  s.config.Database.Path,
 			"documentCount": len(documents),
 			"userCount":     len(users),
-			"webDistDir":    s.config.Web.DistDir,
 		},
 		"documents": documents,
 	})
@@ -113,6 +116,30 @@ func (s *Server) handleAdminWorkspaceSync(w http.ResponseWriter, r *http.Request
 	})
 }
 
+func (s *Server) handleAdminSettings(w http.ResponseWriter, r *http.Request) {
+	settings, err := s.auth.GetInstanceSettings(r.Context())
+	if err != nil {
+		writeJSONWithStatus(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"settings": settings})
+}
+
+func (s *Server) handleAdminSettingsUpdate(w http.ResponseWriter, r *http.Request) {
+	principal, _ := requirePrincipal(r)
+	var input adminSettingsInput
+	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
+		writeJSONWithStatus(w, http.StatusBadRequest, map[string]string{"error": "invalid json"})
+		return
+	}
+	settings, err := s.auth.UpdateSignupsEnabled(r.Context(), principal, input.SignupsEnabled)
+	if err != nil {
+		writeJSONWithStatus(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"settings": settings})
+}
+
 func (s *Server) normalizeAdminUserInput(input adminUserInput) (docs.UserRecord, bool) {
 	email := strings.TrimSpace(strings.ToLower(input.Email))
 	if email == "" {

apps/server/internal/httpserver/api_handlers_test.go

@@ -32,6 +32,10 @@ type apiTestServer struct {
 }
 
 func newAPITestServer(t *testing.T) *apiTestServer {
+	return newAPITestServerWithSetup(t, true)
+}
+
+func newAPITestServerWithSetup(t *testing.T, setupComplete bool) *apiTestServer {
 	t.Helper()
 
 	ctx := context.Background()
@@ -69,9 +73,12 @@ func newAPITestServer(t *testing.T) *apiTestServer {
 	if err != nil {
 		t.Fatalf("create auth service: %v", err)
 	}
-	user, err := authService.RegisterPasswordUser(ctx, "editor@example.com", "Editor", "very secure password", string(auth.RoleEditor))
-	if err != nil {
-		t.Fatalf("create test user: %v", err)
+	var user auth.User
+	if setupComplete {
+		user, err = authService.CompleteInitialSetup(ctx, "editor@example.com", "Editor", "very secure password", false)
+		if err != nil {
+			t.Fatalf("create test user: %v", err)
+		}
 	}
 
 	syncRepo := sync.NewRepository(db.SQL())
@@ -81,7 +88,6 @@ func newAPITestServer(t *testing.T) *apiTestServer {
 				SourceDir: sourceDir,
 				StoreDir:  storeDir,
 			},
-			Web:  config.WebConfig{DistDir: filepath.Join(root, "web-dist")},
 			Auth: config.AuthConfig{PublicOrigin: "http://localhost:8080"},
 		},
 		Logger:       logger,
@@ -106,6 +112,54 @@ func newAPITestServer(t *testing.T) *apiTestServer {
 	}
 }
 
+func TestInitialSetupWizardCreatesAdminAndPersistsSignupPolicy(t *testing.T) {
+	server := newAPITestServerWithSetup(t, false)
+
+	index := httptest.NewRecorder()
+	server.handler.ServeHTTP(index, httptest.NewRequest(http.MethodGet, "/", nil))
+	if index.Code != http.StatusSeeOther || index.Header().Get("Location") != "/setup" {
+		t.Fatalf("initial index response = %d %q, want redirect to /setup", index.Code, index.Header().Get("Location"))
+	}
+
+	setupPage := httptest.NewRecorder()
+	server.handler.ServeHTTP(setupPage, httptest.NewRequest(http.MethodGet, "/setup", nil))
+	if setupPage.Code != http.StatusOK || !bytes.Contains(setupPage.Body.Bytes(), []byte("Initial setup")) {
+		t.Fatalf("setup page response = %d %q", setupPage.Code, setupPage.Body.String())
+	}
+
+	setup := httptest.NewRecorder()
+	server.handler.ServeHTTP(setup, jsonRequest(http.MethodPost, "/api/setup", map[string]any{
+		"email":          "owner@example.com",
+		"displayName":    "Owner",
+		"password":       "correct horse battery staple",
+		"signupsEnabled": false,
+	}))
+	if setup.Code != http.StatusCreated {
+		t.Fatalf("setup status = %d, want %d; body=%s", setup.Code, http.StatusCreated, setup.Body.String())
+	}
+	if len(setup.Result().Cookies()) == 0 {
+		t.Fatal("expected setup to create a browser session")
+	}
+
+	settings, err := server.auth.GetInstanceSettings(context.Background())
+	if err != nil {
+		t.Fatalf("GetInstanceSettings() error = %v", err)
+	}
+	if !settings.SetupComplete || settings.SignupsEnabled {
+		t.Fatalf("settings = %#v, want setup complete with signups disabled", settings)
+	}
+
+	register := httptest.NewRecorder()
+	server.handler.ServeHTTP(register, jsonRequest(http.MethodPost, "/api/auth/register/password", map[string]any{
+		"email":       "viewer@example.com",
+		"displayName": "Viewer",
+		"password":    "correct horse battery staple",
+	}))
+	if register.Code != http.StatusBadRequest || !bytes.Contains(register.Body.Bytes(), []byte("signups are disabled")) {
+		t.Fatalf("register response = %d %q, want disabled signup error", register.Code, register.Body.String())
+	}
+}
+
 func (s *apiTestServer) token(t *testing.T, scopes ...auth.Scope) string {
 	t.Helper()
 

apps/server/internal/httpserver/app_files.go

@@ -1,43 +0,0 @@
-package httpserver
-
-import (
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-func (s *Server) appFileServer() http.Handler {
-	if s.config.Web.DevViteURL != "" {
-		viteURL, err := url.Parse(s.config.Web.DevViteURL)
-		if err == nil {
-			proxy := httputil.NewSingleHostReverseProxy(viteURL)
-			originalDirector := proxy.Director
-			proxy.Director = func(req *http.Request) {
-				originalDirector(req)
-				req.Host = viteURL.Host
-				// Add back the /app/ prefix that was stripped by http.StripPrefix
-				req.URL.Path = "/app" + req.URL.Path
-			}
-			return proxy
-		}
-	}
-
-	files := http.FileServer(http.Dir(s.config.Web.DistDir))
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		cleanPath := filepath.Clean(strings.TrimPrefix(r.URL.Path, "/"))
-		if cleanPath == "." {
-			cleanPath = "index.html"
-		}
-
-		target := filepath.Join(s.config.Web.DistDir, cleanPath)
-		if info, err := os.Stat(target); err == nil && !info.IsDir() {
-			files.ServeHTTP(w, r)
-			return
-		}
-
-		http.ServeFile(w, r, filepath.Join(s.config.Web.DistDir, "index.html"))
-	})
-}

apps/server/internal/httpserver/auth_handlers.go

@@ -24,6 +24,13 @@ type passwordLoginRequest struct {
 	Password string `json:"password"`
 }
 
+type initialSetupRequest struct {
+	Email          string `json:"email"`
+	DisplayName    string `json:"displayName"`
+	Password       string `json:"password"`
+	SignupsEnabled bool   `json:"signupsEnabled"`
+}
+
 type passkeyBeginRequest struct {
 	Email       string `json:"email"`
 	DisplayName string `json:"displayName"`
@@ -67,17 +74,61 @@ func (s *Server) handleLoginPage(w http.ResponseWriter, r *http.Request) {
 	if !strings.HasPrefix(nextPath, "/") || strings.HasPrefix(nextPath, "//") {
 		nextPath = "/account"
 	}
+	settings, err := s.auth.GetInstanceSettings(r.Context())
+	if err != nil {
+		s.renderError(w, r, http.StatusInternalServerError, "load registration settings")
+		return
+	}
 	s.renderTemplate(w, http.StatusOK, "login.gohtml", layoutData{
 		Title:        "Sign in",
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-auth",
 		BodyTemplate: "login_content",
 		Data: struct {
-			Next string
-		}{Next: nextPath},
+			Next           string
+			SignupsEnabled bool
+		}{Next: nextPath, SignupsEnabled: settings.SignupsEnabled},
 	})
 }
 
+func (s *Server) handleSetupPage(w http.ResponseWriter, r *http.Request) {
+	settings, err := s.auth.GetInstanceSettings(r.Context())
+	if err != nil {
+		s.renderError(w, r, http.StatusInternalServerError, "load initial setup state")
+		return
+	}
+	if settings.SetupComplete {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+	s.renderTemplate(w, http.StatusOK, "setup.gohtml", layoutData{
+		Title:        "Initial setup",
+		BodyClass:    "page-auth",
+		BodyTemplate: "setup_content",
+	})
+}
+
+func (s *Server) handleSetup(w http.ResponseWriter, r *http.Request) {
+	if !s.allowAuthAttempt(w, r) {
+		return
+	}
+	var req initialSetupRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeJSONWithStatus(w, http.StatusBadRequest, map[string]string{"error": "invalid json"})
+		return
+	}
+	if _, err := s.auth.CompleteInitialSetup(r.Context(), req.Email, req.DisplayName, req.Password, req.SignupsEnabled); err != nil {
+		writeJSONWithStatus(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+		return
+	}
+	principal, token, err := s.auth.LoginPassword(r.Context(), req.Email, req.Password, requestIP(r), r.UserAgent())
+	if err != nil {
+		writeJSONWithStatus(w, http.StatusInternalServerError, map[string]string{"error": "initial admin created; sign in to continue"})
+		return
+	}
+	setSessionCookie(w, r, token, principal.ExpiresAt)
+	writeJSONWithStatus(w, http.StatusCreated, map[string]any{"principal": principal})
+}
+
 func (s *Server) handleAccountPage(w http.ResponseWriter, r *http.Request) {
 	principal, ok := requirePrincipal(r)
 	if !ok {
@@ -86,7 +137,6 @@ func (s *Server) handleAccountPage(w http.ResponseWriter, r *http.Request) {
 	}
 	s.renderTemplate(w, http.StatusOK, "account.gohtml", layoutData{
 		Title:        "Account",
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-account",
 		BodyTemplate: "account_content",
 		Data:         principal,
@@ -377,7 +427,6 @@ func (s *Server) handleDeviceVerifyPage(w http.ResponseWriter, r *http.Request)
 	userCode := strings.TrimSpace(r.URL.Query().Get("user_code"))
 	s.renderTemplate(w, http.StatusOK, "device_verify.gohtml", layoutData{
 		Title:        "Approve device",
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-auth",
 		BodyTemplate: "device_verify_content",
 		Data: struct {

apps/server/internal/httpserver/handlers.go

@@ -23,7 +23,6 @@ import (
 
 type layoutData struct {
 	Title        string
-	WebEnabled   bool
 	BodyClass    string
 	BodyTemplate string
 	Data         any
@@ -98,7 +97,6 @@ func (s *Server) handleIndex(w http.ResponseWriter, r *http.Request) {
 	activeFolder := strings.Trim(r.URL.Query().Get("folder"), "/")
 	s.renderTemplate(w, http.StatusOK, "index.gohtml", layoutData{
 		Title:        "Cairnquire",
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-index",
 		BodyTemplate: "index_content",
 		Data: indexData{
@@ -118,7 +116,6 @@ func (s *Server) handleSearchPage(w http.ResponseWriter, r *http.Request, query
 
 	s.renderTemplate(w, http.StatusOK, "search.gohtml", layoutData{
 		Title:        "Search: " + query,
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-search",
 		BodyTemplate: "search_content",
 		Data: struct {
@@ -225,7 +222,6 @@ func (s *Server) renderDocumentEditor(w http.ResponseWriter, r *http.Request, pa
 
 	s.renderTemplate(w, http.StatusOK, "document_edit.gohtml", layoutData{
 		Title:        "Edit: " + page.Title,
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-document-edit",
 		BodyTemplate: "document_edit_content",
 		Data: documentEditData{
@@ -259,7 +255,6 @@ func (s *Server) renderDocumentPage(w http.ResponseWriter, r *http.Request, page
 
 	s.renderTemplate(w, http.StatusOK, "document.gohtml", layoutData{
 		Title:        page.Title,
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-document",
 		BodyTemplate: "document_content",
 		Data: documentData{
@@ -403,6 +398,15 @@ func (s *Server) handleAttachment(w http.ResponseWriter, r *http.Request) {
 	_, _ = w.Write(content)
 }
 
+func (s *Server) handleAttachmentsList(w http.ResponseWriter, r *http.Request) {
+	attachments, err := s.repository.ListAttachments(r.Context())
+	if err != nil {
+		writeJSONWithStatus(w, http.StatusInternalServerError, map[string]string{"error": "list attachments"})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"attachments": attachments})
+}
+
 func (s *Server) renderTemplate(w http.ResponseWriter, status int, name string, data layoutData) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(status)
@@ -414,7 +418,6 @@ func (s *Server) renderTemplate(w http.ResponseWriter, status int, name string,
 func (s *Server) renderError(w http.ResponseWriter, r *http.Request, status int, message string) {
 	s.renderTemplate(w, status, "error.gohtml", layoutData{
 		Title:        http.StatusText(status),
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-error",
 		BodyTemplate: "error_content",
 		Data: errorData{

apps/server/internal/httpserver/middleware.go

@@ -76,6 +76,33 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 	})
 }
 
+func (s *Server) setupMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		settings, err := s.auth.GetInstanceSettings(r.Context())
+		if err != nil {
+			writeJSONWithStatus(w, http.StatusInternalServerError, map[string]string{"error": "lookup initial setup state"})
+			return
+		}
+		if settings.SetupComplete || isSetupAllowedPath(r.URL.Path) {
+			next.ServeHTTP(w, r)
+			return
+		}
+		if r.Method == http.MethodGet && !strings.HasPrefix(r.URL.Path, "/api/") {
+			http.Redirect(w, r, "/setup", http.StatusSeeOther)
+			return
+		}
+		writeJSONWithStatus(w, http.StatusServiceUnavailable, map[string]string{"error": "initial setup is required"})
+	})
+}
+
+func isSetupAllowedPath(path string) bool {
+	return path == "/setup" ||
+		path == "/api/setup" ||
+		path == "/health" ||
+		path == "/sw.js" ||
+		strings.HasPrefix(path, "/static/")
+}
+
 func (s *Server) authenticateRequest(r *http.Request) (auth.Principal, bool) {
 	if header := r.Header.Get("Authorization"); strings.HasPrefix(header, "Bearer ") {
 		principal, err := s.auth.ValidateBearerToken(r.Context(), strings.TrimSpace(strings.TrimPrefix(header, "Bearer ")))
@@ -87,7 +114,11 @@ func (s *Server) authenticateRequest(r *http.Request) (auth.Principal, bool) {
 	}
 	cookie, err := r.Cookie(auth.SessionCookieName)
 	if err != nil || cookie.Value == "" {
-		return auth.Principal{}, false
+		if s.devUserID == "" {
+			return auth.Principal{}, false
+		}
+		principal, err := s.auth.PrincipalForUser(r.Context(), s.devUserID)
+		return principal, err == nil
 	}
 	principal, err := s.auth.ValidateSessionToken(r.Context(), cookie.Value)
 	if err != nil {
@@ -120,6 +151,8 @@ func requiredScopeForPath(r *http.Request) (auth.Scope, bool) {
 		return auth.ScopeDocsWrite, true
 	case strings.HasPrefix(path, "/api/uploads"):
 		return auth.ScopeDocsWrite, true
+	case path == "/api/attachments":
+		return auth.ScopeDocsRead, true
 	case strings.HasPrefix(path, "/api/sync/"):
 		if method == http.MethodPost {
 			return auth.ScopeSyncWrite, true

apps/server/internal/httpserver/server.go

@@ -1,11 +1,12 @@
 package httpserver
 
 import (
+	"context"
 	"embed"
+	"fmt"
 	"html/template"
 	"log/slog"
 	"net/http"
-	"os"
 	"strings"
 	"time"
 
@@ -50,7 +51,7 @@ type Server struct {
 	collaboration *collaboration.Service
 	authLimiter   *rateLimiter
 	templates     *template.Template
-	webEnabled    bool
+	devUserID     string
 }
 
 func New(deps Dependencies) (http.Handler, error) {
@@ -81,8 +82,13 @@ func New(deps Dependencies) (http.Handler, error) {
 		templates:     templates,
 	}
 
-	if _, err := os.Stat(deps.Config.Web.DistDir); err == nil {
-		server.webEnabled = true
+	if deps.Config.DevMode {
+		devUser, err := deps.Auth.EnsureDevUser(context.Background())
+		if err != nil {
+			return nil, fmt.Errorf("ensure dev user: %w", err)
+		}
+		server.devUserID = devUser.ID
+		deps.Logger.Info("dev mode enabled", "dev_user_id", devUser.ID)
 	}
 
 	router := chi.NewRouter()
@@ -92,9 +98,11 @@ func New(deps Dependencies) (http.Handler, error) {
 	router.Use(server.timeoutExceptWebSocket(30 * time.Second))
 	router.Use(server.requestLogger)
 	router.Use(server.securityHeaders)
+	router.Use(server.setupMiddleware)
 	router.Use(server.authMiddleware)
 
 	router.Get("/", server.handleIndex)
+	router.Get("/setup", server.handleSetupPage)
 	router.Get("/login", server.handleLoginPage)
 	router.Get("/account", server.handleAccountPage)
 	router.Get("/device/verify", server.handleDeviceVerifyPage)
@@ -102,6 +110,7 @@ func New(deps Dependencies) (http.Handler, error) {
 	router.Get("/sw.js", server.handleServiceWorker)
 	router.Get("/ws", server.handleWebSocket)
 	router.Get("/api/auth/me", server.handleAuthMe)
+	router.Post("/api/setup", server.handleSetup)
 	router.Post("/api/auth/register/password", server.handlePasswordRegister)
 	router.Post("/api/auth/login/password", server.handlePasswordLogin)
 	router.Post("/api/auth/logout", server.handleLogout)
@@ -123,6 +132,8 @@ func New(deps Dependencies) (http.Handler, error) {
 	router.Post("/api/admin/users", server.handleAdminCreateUser)
 	router.Patch("/api/admin/users/{id}/role", server.handleAdminUpdateUserRole)
 	router.Get("/api/admin/auth-users", server.handleAdminAuthUsers)
+	router.Get("/api/admin/settings", server.handleAdminSettings)
+	router.Patch("/api/admin/settings", server.handleAdminSettingsUpdate)
 	router.Get("/api/admin/workspace", server.handleAdminWorkspace)
 	router.Post("/api/admin/workspace/sync", server.handleAdminWorkspaceSync)
 	router.Get("/docs", server.handleDocsIndex)
@@ -131,6 +142,7 @@ func New(deps Dependencies) (http.Handler, error) {
 	router.Post("/api/documents/*", server.handleDocumentSave)
 	router.Get("/api/search", server.handleSearch)
 	router.Post("/api/uploads", server.handleUpload)
+	router.Get("/api/attachments", server.handleAttachmentsList)
 	router.Get("/attachments/{hash}", server.handleAttachment)
 
 	// Collaboration endpoints
@@ -155,18 +167,9 @@ func New(deps Dependencies) (http.Handler, error) {
 
 	router.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(mustSub("static"))))
 
-	if server.webEnabled {
-		router.Get("/app", server.handleAppRedirect)
-		router.Handle("/app/*", http.StripPrefix("/app/", server.appFileServer()))
-	}
-
 	return router, nil
 }
 
-func (s *Server) handleAppRedirect(w http.ResponseWriter, r *http.Request) {
-	http.Redirect(w, r, "/app/", http.StatusMovedPermanently)
-}
-
 func mustSub(path string) http.FileSystem {
 	sub, err := fsSub(path)
 	if err != nil {

apps/server/internal/httpserver/static/auth.js

@@ -78,6 +78,22 @@
 
   const formJSON = (form) => Object.fromEntries(new FormData(form).entries());
 
+  document.querySelector("[data-initial-setup]")?.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const form = event.currentTarget;
+    try {
+      await postJSON("/api/setup", {
+        email: form.elements.email.value,
+        displayName: form.elements.displayName.value,
+        password: form.elements.password.value,
+        signupsEnabled: form.elements.signupsEnabled.checked,
+      });
+      window.location.href = "/account";
+    } catch (error) {
+      setStatus("[data-setup-status]", error.message, true);
+    }
+  });
+
   const base64URLToBuffer = (value) => {
     const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
     const binary = atob(padded);
@@ -350,6 +366,29 @@
     );
   };
 
+  const loadAdminSettings = async () => {
+    const section = document.querySelector("[data-admin-settings-section]");
+    const form = document.querySelector("[data-admin-settings]");
+    if (!section || !form) return;
+    const me = await fetch("/api/auth/me", { credentials: "same-origin" }).then((response) => response.json()).catch(() => null);
+    if (me?.principal?.role !== "admin") return;
+    section.hidden = false;
+    const data = await fetch("/api/admin/settings", { credentials: "same-origin" }).then((response) => response.json());
+    form.elements.signupsEnabled.checked = Boolean(data.settings?.signupsEnabled);
+  };
+
+  document.querySelector("[data-admin-settings]")?.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    try {
+      const form = event.currentTarget;
+      await postJSON("/api/admin/settings", { signupsEnabled: form.elements.signupsEnabled.checked }, { method: "PATCH" });
+      setStatus("[data-admin-settings-status]", "Registration setting saved.");
+    } catch (error) {
+      setStatus("[data-admin-settings-status]", error.message, true);
+    }
+  });
+
   loadTokens().catch(() => {});
   loadAdminUsers().catch(() => {});
+  loadAdminSettings().catch(() => {});
 })();

apps/server/internal/httpserver/static/site.css

@@ -240,6 +240,16 @@ code {
   font-size: 0.9rem;
 }
 
+.auth-form .auth-choice {
+  display: flex;
+  align-items: center;
+  gap: 0.55rem;
+}
+
+.auth-choice input {
+  width: auto;
+}
+
 .auth-form input,
 .auth-form select,
 .user-row select {
@@ -1817,4 +1827,3 @@ code {
   line-height: 1.5;
 }
 
-

apps/server/internal/httpserver/templates/account.gohtml

@@ -56,6 +56,18 @@
       <p class="form-status" data-admin-users-status></p>
     </section>
 
+    <section class="account-section" data-admin-settings-section hidden>
+      <h2>Registration</h2>
+      <form class="auth-form" data-admin-settings>
+        <label class="auth-choice">
+          <input type="checkbox" name="signupsEnabled" />
+          Allow visitors to create accounts
+        </label>
+        <button type="submit">Save registration setting</button>
+        <p class="form-status" data-admin-settings-status></p>
+      </form>
+    </section>
+
     <section class="account-section account-section--danger">
       <h2>Delete Account</h2>
       <form class="auth-form" data-account-delete>

apps/server/internal/httpserver/templates/base.gohtml

@@ -50,6 +50,8 @@
     {{ template "search_content" .Data }}
     {{ else if eq .BodyTemplate "login_content" }}
     {{ template "login_content" .Data }}
+    {{ else if eq .BodyTemplate "setup_content" }}
+    {{ template "setup_content" .Data }}
     {{ else if eq .BodyTemplate "account_content" }}
     {{ template "account_content" .Data }}
     {{ else if eq .BodyTemplate "device_verify_content" }}

apps/server/internal/httpserver/templates/login.gohtml

@@ -43,12 +43,12 @@
         </div>
       </div>
 
-      <div class="auth-register-cta">
+      {{ if .SignupsEnabled }}<div class="auth-register-cta">
         <button type="button" class="btn-cta" data-register-toggle>Create an Account</button>
-      </div>
+      </div>{{ end }}
     </div>
 
-    <div class="auth-register-panel" data-register-panel hidden>
+    {{ if .SignupsEnabled }}<div class="auth-register-panel" data-register-panel hidden>
       <div class="auth-tabs">
         <div class="auth-tab-list" role="tablist">
           <button type="button" class="auth-tab is-active" role="tab" aria-selected="true" data-tab="passkey-register">Passkey</button>
@@ -93,7 +93,7 @@
       <div class="auth-register-cancel">
         <button type="button" class="btn-secondary" data-register-cancel>Cancel — Back to Log In</button>
       </div>
-    </div>
+    </div>{{ end }}
   </div>
 </section>
 {{ end }}

apps/server/internal/httpserver/templates/setup.gohtml

@@ -0,0 +1,34 @@
+{{ define "setup.gohtml" }}{{ template "base" . }}{{ end }}
+
+{{ define "setup_content" }}
+<section class="auth-shell">
+  <div class="auth-panel">
+    <div class="auth-panel__header">
+      <p class="eyebrow">Cairnquire</p>
+      <h1>Initial setup</h1>
+      <p class="auth-note">Create the first administrator account and choose whether visitors can register their own accounts.</p>
+    </div>
+
+    <form class="auth-form" data-initial-setup>
+      <label>
+        Admin email
+        <input type="email" name="email" autocomplete="email" required />
+      </label>
+      <label>
+        Display name
+        <input type="text" name="displayName" autocomplete="name" />
+      </label>
+      <label>
+        Password
+        <input type="password" name="password" autocomplete="new-password" minlength="12" required />
+      </label>
+      <label class="auth-choice">
+        <input type="checkbox" name="signupsEnabled" />
+        Allow visitors to create accounts
+      </label>
+      <button type="submit" class="btn-primary">Finish setup</button>
+      <p class="form-status" data-setup-status></p>
+    </form>
+  </div>
+</section>
+{{ end }}