homeio

1import { z } from "zod";
2import { NextResponse } from "next/server";
3import {
4  createRequestId,
5  logServerAction,
6  withServerTiming,
7} from "@/lib/server/logging/logger";
8import { hasAnyUsers } from "@/lib/server/modules/auth/repository";
9import { AuthError, registerUser } from "@/lib/server/modules/auth/service";
10import { bootstrapDefaultCasaosCatalog } from "@/lib/server/modules/store/catalog";
11import {
12  ensureDataRootDirectories,
13  resolveDataRootDirectory,
14} from "@/lib/server/storage/data-root";
15
16export const runtime = "nodejs";
17
18const registerSchema = z.object({
19  username: z.string().min(1),
20  password: z.string().min(1),
21  confirmPassword: z.string().min(1),
22});
23
24export async function POST(request: Request) {
25  const requestId = createRequestId();
26
27  try {
28    // Homeio is single-user, and the database already knows whether that user
29    // exists — so nothing else gets a say. This used to be gated on an
30    // AUTH_ALLOW_REGISTRATION env var as well, which install.sh wrote as
31    // `true` and never turned off: a second source of truth for a fact the
32    // first one already held, and when they disagreed the flag won. Any
33    // script-installed server reachable from the internet would hand a full
34    // account to whoever asked for one, with no roles to limit it.
35    const usersExist = await hasAnyUsers();
36    if (usersExist) {
37      return NextResponse.json(
38        {
39          error: "Registration is closed: this server already has an account",
40        },
41        { status: 403 },
42      );
43    }
44
45    const body = await request.json();
46    const parsed = registerSchema.safeParse(body);
47
48    if (!parsed.success) {
49      return NextResponse.json(
50        {
51          error: "Invalid request payload",
52        },
53        { status: 400 },
54      );
55    }
56
57    await withServerTiming(
58      {
59        layer: "system",
60        action: "storage.data.bootstrap",
61        requestId,
62        meta: {
63          dataRoot: resolveDataRootDirectory(),
64        },
65      },
66      async () => ensureDataRootDirectories(),
67    );
68
69    // Catalog bootstrap is best-effort during registration. A single broken
70    // upstream YAML used to throw here and turn the whole register call into
71    // a 500. The user can refresh the catalog later from Settings, and the
72    // per-entry parser now skips broken stacks, so this should rarely fail —
73    // but if it does, registration still succeeds.
74    try {
75      await withServerTiming(
76        {
77          layer: "system",
78          action: "store.catalog.bootstrap",
79          requestId,
80        },
81        async () => bootstrapDefaultCasaosCatalog(),
82      );
83    } catch (error) {
84      logServerAction({
85        level: "warn",
86        layer: "api",
87        action: "auth.register",
88        status: "error",
89        requestId,
90        error,
91        meta: { stage: "catalog_bootstrap_skipped" },
92      });
93    }
94
95    const user = await withServerTiming(
96      {
97        layer: "api",
98        action: "auth.register",
99        requestId,
100      },
101      async () => registerUser(parsed.data),
102    );
103
104    return NextResponse.json(
105      {
106        data: {
107          id: user.id,
108          username: user.username,
109        },
110      },
111      { status: 201 },
112    );
113  } catch (error) {
114    const statusCode = error instanceof AuthError ? error.statusCode : 500;
115
116    logServerAction({
117      level: statusCode >= 500 ? "error" : "warn",
118      layer: "api",
119      action: "auth.register",
120      status: "error",
121      requestId,
122      error,
123    });
124
125    return NextResponse.json(
126      {
127        error:
128          error instanceof AuthError
129            ? error.message
130            : "Failed to register user",
131      },
132      { status: statusCode },
133    );
134  }
135}
136