feat: add openmapx users verify <email> to bootstrap first admin without SMTP

Better Auth blocks sign-in until `email_verified = true`. On a fresh deployment with no SMTP configured, that creates a chicken-and-egg problem: the first user can't verify by email, so they can't sign in, so they can't reach the admin panel to configure anything. Add a CLI command that flips the column directly via psql in the postgis container, mirroring the existing `promote`/`demote` plumbing. Typical bootstrap is now: sign up → `users verify <email>` → `users promote <email>` → sign in → configure SMTP from /admin → self-service signup works for everyone else.

Author: Medformatik

packages/cli/src/commands/users.ts

@@ -129,6 +129,64 @@ export async function promoteUserToAdmin(email: string, rootDir?: string): Promi
   }
 }
 
+/**
+ * Mark a user's email as verified. Useful for bootstrapping the first admin
+ * on a fresh deployment where SMTP isn't configured yet — Better Auth blocks
+ * sign-in until `emailVerified = true`, and without SMTP no verification mail
+ * is ever sent. After verifying + promoting one user, that user signs in,
+ * configures SMTP, and self-service signup works for everyone else.
+ */
+export async function markEmailVerified(email: string, rootDir?: string): Promise<void> {
+  if (!email?.includes("@")) {
+    throw new Error(`"${email}" does not look like an email address`);
+  }
+  const target = await resolvePostgresTarget(rootDir);
+  const paths = repoPaths(rootDir);
+  const result = await execa(
+    "docker",
+    [
+      "compose",
+      "-f",
+      paths.composeOutPath,
+      "exec",
+      "-T",
+      target.serviceId,
+      "psql",
+      "-U",
+      target.user,
+      "-d",
+      target.db,
+      "-v",
+      "ON_ERROR_STOP=1",
+      "--no-psqlrc",
+      "-A",
+      "-t",
+      "-v",
+      `email=${email}`,
+      "-c",
+      `UPDATE "user" SET email_verified = true WHERE email = :'email' RETURNING id;`,
+    ],
+    { cwd: paths.infraDir, reject: false },
+  );
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `psql failed (exit ${result.exitCode}): ${result.stderr?.trim() || result.stdout?.trim() || "no output"}`,
+    );
+  }
+  const updatedIds = (result.stdout ?? "")
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  if (updatedIds.length === 0) {
+    throw new Error(
+      `No user found with email "${email}". Sign up through the web UI first, then re-run this command.`,
+    );
+  }
+  if (updatedIds.length > 1) {
+    log.warn(`${updatedIds.length} users matched "${email}" — verified all of them`);
+  }
+}
+
 export async function listUsers(
   rootDir?: string,
 ): Promise<Array<{ id: string; email: string; name: string; role: string }>> {
@@ -183,6 +241,21 @@ export function registerUsersCommands(program: Command): void {
       }
     });
 
+  users
+    .command("verify <email>")
+    .description(
+      "Mark a user's email as verified (bootstraps the first admin when SMTP isn't configured yet)",
+    )
+    .action(async (email: string) => {
+      try {
+        await markEmailVerified(email);
+        log.ok(`Marked ${email} as email-verified`);
+      } catch (err) {
+        log.err((err as Error).message);
+        process.exit(1);
+      }
+    });
+
   users
     .command("demote <email>")
     .description("Remove admin role from a user (sets role back to user)")