feat: setup and roles

app/middleware/auth.global.ts

@@ -22,6 +22,31 @@ export default defineNuxtRouteMiddleware(async (to) => {
         return await navigateTo((to.query.to as string) ?? "/");
     }
 
+    // A fresh instance has no accounts, so there is nothing to log in to yet
+    // and the first visitor creates the admin account instead.
+    if (!loggedIn.value) {
+        const setupNeeded = useState<boolean | null>('instance:setupNeeded', () => null);
+        const isSetupPage = to.path.toLowerCase() === '/auth/setup';
+
+        // once an account exists the answer never changes back
+        if (setupNeeded.value !== false) {
+            try {
+                setupNeeded.value = (await $fetch<{ needed: boolean }>('/api/setup')).needed;
+            } catch (error) {
+                console.error('Failed to check instance setup:', error);
+                setupNeeded.value = null;
+            }
+        }
+
+        if (setupNeeded.value === true && !isSetupPage) {
+            return await navigateTo('/auth/setup');
+        }
+
+        if (setupNeeded.value !== true && isSetupPage) {
+            return await navigateTo('/auth/login');
+        }
+    }
+
     // If not authenticated, and not on a signin/signup page, redirect to login page
     if (!loggedIn.value && !isAuthPage) {
         return await navigateTo(`/auth/login?to=${to.path}`);