First run

A freshly installed instance has no account. Every request is therefore redirected to the setup page (/en/setup, with its own slug per language) as long as no administrator exists.

The only exceptions are the paths without which the wizard could not work: the static assets (/css, /js, /lib, /img, /favicon.ico), /health — so that the installer can wait for the service — and /auth/logout, /auth/confirm and /auth/magic.

What the wizard asks

An email address and a password, nothing else, with a minimum of 12 characters.

Why nothing more

Company details, number ranges, customer and article records and mail dispatch are ordinary settings in the account area. An administrator should be able to complete the installation without knowing the SMTP credentials.

Both the user and their tenant are created — the same route the first redemption of a sign-in link takes in the cloud. An account created here is indistinguishable from a cloud account.

Afterwards the page is permanently locked

Once setup is complete, every further call redirects to sign-in. Otherwise somebody could walk in and create themselves a second administrator.

The check also applies on submission, not only when opening the page

Two pages opened at the same time cannot therefore both create a “first” administrator.

A second gate: a pending password change

If a password was set by somebody else — on the command line or by an administrator — the account is unusable until the holder replaces it: every request from a cookie session lands on the password-change page.

What counts here is the database, not the claim in the cookie — a cookie can be 30 days old.

If the web interface is unreachable

Then the command line creates the first account:

cd "C:\Program Files\Invoiceflair\Portal"
Invoiceflair.Api.exe create-owner chef@firma.de --password "a long passphrase" --must-change

--must-change makes sense here, because the password appears on the command line and therefore in the command history. The command also marks setup as complete.

Further commands are set out under Administration on the command line.