Add auth bootstrap and database safeguards

src/lib/server/auth/bootstrap.ts

@@ -0,0 +1,17 @@
+import type { Database } from '@tursodatabase/database';
+
+/**
+ * Atomically promotes the authenticated user when no administrator exists.
+ * The conditional UPDATE ensures concurrent first sign-ins cannot both win.
+ */
+export async function ensureBootstrapAdmin(database: Database, userId: string): Promise<void> {
+	const promote = await database.prepare(`
+		UPDATE users
+		SET role = 'admin'
+		WHERE id = ?
+			AND NOT EXISTS (
+				SELECT 1 FROM users WHERE role = 'admin'
+			)
+	`);
+	await promote.run(userId);
+}

src/lib/server/database.ts

@@ -11,7 +11,7 @@ let databasePromise: Promise<Database> | undefined;
  * imported into browser bundles.
  */
 export function getDatabase(): Promise<Database> {
-	const configuredPath = env.TDR_DATABASE_PATH || './data/shd-build.db';
+	const configuredPath = env.TDR_DATABASE_PATH || './data/shd-build-development.db';
 
 	if (!databasePromise) {
 		databasePromise = connect(resolve(configuredPath));