A fresh deployment has no user at all and login itself needs one, and there
was no seed/bootstrap path for the first super_admin. Add
scripts/bootstrap_super_admin.py that creates/ensures an organization, user,
and super_admin membership via the same IdentityRepository/PasswordService the
app uses.
- Password hashed with argon2 (PasswordService), min 12 chars; never printed.
- Idempotent: an existing user's password is left unchanged; re-run only
ensures the super_admin membership exists.
- Verified locally: created org/user/membership, then /api/auth/login with the
bootstrap credentials returned success:true role=super_admin; wrong password
returned invalid_credentials. Re-run left the password unchanged.
Run in container console with ADMIN_EMAIL/ADMIN_PASSWORD/ADMIN_ORG_SLUG env.
211b1a6545