From 70cd49299a832392134f490fd7e07a4bffecea8e Mon Sep 17 00:00:00 2001
From: bvandeusen <bryan.vandeusen@fabledsword.com>
Date: Sun, 19 Apr 2026 02:30:39 +0000
Subject: [PATCH] M1/#292: add Auth.AdminBootstrap config + env overrides

---
 internal/config/config.go | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/internal/config/config.go b/internal/config/config.go
index 4f69369e..2accc8c3 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -12,6 +12,7 @@ type Config struct {
 	Server   ServerConfig   `yaml:"server"`
 	Database DatabaseConfig `yaml:"database"`
 	Log      LogConfig      `yaml:"log"`
+	Auth     AuthConfig     `yaml:"auth"`
 }
 
 type ServerConfig struct {
@@ -27,6 +28,18 @@ type LogConfig struct {
 	Format string `yaml:"format"`
 }
 
+type AuthConfig struct {
+	AdminBootstrap AdminBootstrapConfig `yaml:"admin_bootstrap"`
+}
+
+// AdminBootstrapConfig drives the one-shot admin creation on an empty users
+// table. Username is required to enable the flow; leaving Password blank asks
+// the server to generate a random one and log it to stderr.
+type AdminBootstrapConfig struct {
+	Username string `yaml:"username"`
+	Password string `yaml:"password"`
+}
+
 func Default() Config {
 	return Config{
 		Server:   ServerConfig{Address: ":4533"},
@@ -64,4 +77,10 @@ func applyEnv(cfg *Config) {
 	if v, ok := os.LookupEnv("SMARTMUSIC_LOG_FORMAT"); ok {
 		cfg.Log.Format = strings.ToLower(v)
 	}
+	if v, ok := os.LookupEnv("SMARTMUSIC_AUTH_ADMIN_USERNAME"); ok {
+		cfg.Auth.AdminBootstrap.Username = v
+	}
+	if v, ok := os.LookupEnv("SMARTMUSIC_AUTH_ADMIN_PASSWORD"); ok {
+		cfg.Auth.AdminBootstrap.Password = v
+	}
 }