[silvertakana]

Summary

Implements the globe side of the provisioning flow for Phase 2. The hub calls /api/provision via HMAC to create a new org and setup token for a new cloud user. The user then visits /setup?token=xxx to activate their account.

What Changed

New Files

• prisma/migrations/20260702121851_add_setup_token/ — Prisma migration for SetupToken model
• src/lib/setup-token.ts — Library: generateSetupToken, validateSetupToken, consumeSetupToken
• src/lib/setup-token.test.ts — 11 unit tests covering token generation, validation, consumption, and expiry
• src/app/api/provision/route.ts — HMAC-protected POST endpoint for hub provisioning
• tests/setup-flow.spec.ts — 6 Playwright E2E tests for setup page and provision endpoint

Modified Files

• prisma/schema.prisma — Added SetupToken model with relation to BetterAuthUser
• src/app/setup/actions.ts — Added validateProvisionToken and activateProvisionedAccount server actions
• src/app/setup/page.tsx — Dual-mode setup page (local admin creation + cloud token activation)
• src/proxy.ts — Added /api/provision to PUBLIC_API_PREFIXES
• package.json — Bumped 2.55.0 → 2.56.0

Key Design Decisions

• Custom SetupToken model (not Better Auth oneTimeToken plugin — requires existing session)
• Atomic consumption via updateMany with WHERE guard
• Org + member created directly via Prisma (auth.api.createOrganization requires session headers)
• Token stored as SHA-256 hash, raw token returned to caller (24h expiry)
• After cloud setup, user redirected to /login for manual login (no auto-login/SSO)

Test Results

• Lint: PASS (0 errors, only pre-existing warnings)
• Typecheck: PASS
• Unit tests: 114/115 files pass, 1118/1118 tests pass (1 pre-existing fail in wwv-plugin-sdk)
• SetupToken tests: 11/11 pass

[codecov]

Codecov Report

❌ Patch coverage is 47.61905% with 22 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/app/setup/actions.ts	0.00%	22 Missing ⚠️

📢 Thoughts on this report? Let us know!