mega-plant/scripts/setup-auth.mjs

// Private first-login and access state. Existing collection rules are unchanged.
import PocketBase from "pocketbase";

const { NEXT_PUBLIC_PB_URL, PB_ADMIN, PB_PASS } = process.env;
if (!NEXT_PUBLIC_PB_URL || !PB_ADMIN || !PB_PASS) throw new Error("Configure NEXT_PUBLIC_PB_URL, PB_ADMIN and PB_PASS first.");
const pb = new PocketBase(NEXT_PUBLIC_PB_URL);
pb.autoCancellation(false);
await pb.collection("_superusers").authWithPassword(PB_ADMIN, PB_PASS);
const existing = (await pb.collections.getFullList()).find((c) => c.name === "user_onboarding");
if (existing) {
  const fields = existing.fields;
  if (existing.type !== "base" || !fields.some((f) => f.name === "user" && f.type === "relation") ||
      !fields.some((f) => f.name === "password_changed" && f.type === "bool") ||
      [existing.listRule, existing.viewRule, existing.createRule, existing.updateRule, existing.deleteRule].some((rule) => rule !== null)) {
    throw new Error("Existing user_onboarding collection does not match the required private schema.");
  }
  const disabled = fields.find((field) => field.name === "disabled");
  if (disabled && disabled.type !== "bool") throw new Error("user_onboarding.disabled must be a boolean.");
  const add = [];
  if (!disabled) add.push({ name: "disabled", type: "bool" });
  // "full" (or empty) = main app + clock; "clock" = Plant Clock app only.
  if (!fields.some((f) => f.name === "access")) add.push({ name: "access", type: "text" });
  if (add.length) {
    await pb.collections.update(existing.id, { fields: [...fields, ...add] });
    console.log(`Added ${add.map((f) => f.name).join(", ")}. Existing users remain active with full access.`);
  } else console.log("Private user_onboarding collection already configured. No changes made.");
} else {
  const users = await pb.collections.getOne("users");
  await pb.collections.create({
    name: "user_onboarding", type: "base",
    listRule: null, viewRule: null, createRule: null, updateRule: null, deleteRule: null,
    fields: [
      { name: "user", type: "relation", collectionId: users.id, required: true, maxSelect: 1, cascadeDelete: true },
      { name: "password_changed", type: "bool" },
      { name: "disabled", type: "bool" },
      { name: "access", type: "text" },
    ],
    indexes: ["CREATE UNIQUE INDEX idx_user_onboarding_user ON user_onboarding (user)"],
  });
  console.log("Created private user_onboarding collection. Existing users and collection rules are unchanged.");
}