remove preact and create setup wizard

apps/server/internal/httpserver/middleware.go

@@ -76,6 +76,33 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 	})
 }
 
+func (s *Server) setupMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		settings, err := s.auth.GetInstanceSettings(r.Context())
+		if err != nil {
+			writeJSONWithStatus(w, http.StatusInternalServerError, map[string]string{"error": "lookup initial setup state"})
+			return
+		}
+		if settings.SetupComplete || isSetupAllowedPath(r.URL.Path) {
+			next.ServeHTTP(w, r)
+			return
+		}
+		if r.Method == http.MethodGet && !strings.HasPrefix(r.URL.Path, "/api/") {
+			http.Redirect(w, r, "/setup", http.StatusSeeOther)
+			return
+		}
+		writeJSONWithStatus(w, http.StatusServiceUnavailable, map[string]string{"error": "initial setup is required"})
+	})
+}
+
+func isSetupAllowedPath(path string) bool {
+	return path == "/setup" ||
+		path == "/api/setup" ||
+		path == "/health" ||
+		path == "/sw.js" ||
+		strings.HasPrefix(path, "/static/")
+}
+
 func (s *Server) authenticateRequest(r *http.Request) (auth.Principal, bool) {
 	if header := r.Header.Get("Authorization"); strings.HasPrefix(header, "Bearer ") {
 		principal, err := s.auth.ValidateBearerToken(r.Context(), strings.TrimSpace(strings.TrimPrefix(header, "Bearer ")))
@@ -87,7 +114,11 @@ func (s *Server) authenticateRequest(r *http.Request) (auth.Principal, bool) {
 	}
 	cookie, err := r.Cookie(auth.SessionCookieName)
 	if err != nil || cookie.Value == "" {
-		return auth.Principal{}, false
+		if s.devUserID == "" {
+			return auth.Principal{}, false
+		}
+		principal, err := s.auth.PrincipalForUser(r.Context(), s.devUserID)
+		return principal, err == nil
 	}
 	principal, err := s.auth.ValidateSessionToken(r.Context(), cookie.Value)
 	if err != nil {
@@ -120,6 +151,8 @@ func requiredScopeForPath(r *http.Request) (auth.Scope, bool) {
 		return auth.ScopeDocsWrite, true
 	case strings.HasPrefix(path, "/api/uploads"):
 		return auth.ScopeDocsWrite, true
+	case path == "/api/attachments":
+		return auth.ScopeDocsRead, true
 	case strings.HasPrefix(path, "/api/sync/"):
 		if method == http.MethodPost {
 			return auth.ScopeSyncWrite, true