fix setup

mainapp/identities/js/app.js

@@ -28,6 +28,29 @@ const APP_TRIBE = document.querySelector('meta[name="xtribe"]')?.content || 'dev
       }
       return false;
     },
+    async handleSetupHandoff() {
+      var params = new URLSearchParams(window.location.search);
+      var alias = params.get('setup');
+      var xdays = params.get('xdays');
+      var xhash = params.get('xhash');
+      if (!alias || !xdays || !xhash) return false;
+      var clean = () => {
+        try { history.replaceState({}, '', window.location.pathname + window.location.hash); } catch {}
+      };
+      try {
+        var result = await Auth.authCall(alias, xdays, xhash, 'pagans');
+        if (result && result.status === 200) {
+          Log.debug('Setup handoff authenticated as', alias);
+          clean();
+          return true;
+        }
+        Log.debug('Setup handoff rejected:', result && result.msg);
+      } catch (err) {
+        Log.error('Setup handoff auth failed:', err.message || err);
+      }
+      clean();
+      return false;
+    },
     async init() {
       Log.debug('App.init() starting');
       Auth.initAxios();
@@ -49,6 +72,7 @@ const APP_TRIBE = document.querySelector('meta[name="xtribe"]')?.content || 'dev
           return;
         }
       } catch {}
+      await this.handleSetupHandoff();
       const activeIdentity = Auth.getActiveIdentity();
       const activeAlias = Auth.getActiveAlias();
       Log.debug('Active identity:', activeIdentity, 'Active alias:', activeAlias);

middlewares/isAuthenticated.js

@@ -189,11 +189,9 @@ function isAuthenticated(continueAsAnonymous = false) {
       }
     }
     if (!header.xhash) header.xhash="anonymous";
-    console.log("header.xhash:",header.xhash)
-    
+
     // 2. Anonymous users
     // exception is middleware is call with continueAsanonymous=true (by default it is false)
-    console.log('profils:',header.xprofils, "is anonymous:",header.xprofils?.length===1 && header.xprofils[0]==="anonymous")
     if (
       header.xalias === "anonymous" || header.xhash === "anonymous"
     ) {
@@ -250,7 +248,6 @@ function isAuthenticated(continueAsAnonymous = false) {
 
     // get public key from alias.json or req.body
     let publickey = null;
-    console.log(req.body)
     if (aliasExists) {
       ({ publickey } = await fs.readJson(paganFilePath));
     } else if (req.body && req.body.publickey) {

models/Wwws.js

@@ -790,6 +790,9 @@ class Wwws {
           if (tribeId !== 'dev') {
             html = html.replace(/\/cdn\/dev\//g, '/cdn/' + tribeId + '/');
           }
+          // Rewrite hardcoded per-instance meta (xtribe / xnation)
+          html = html.replace(/<meta name="xtribe" content="[^"]*"/g, `<meta name="xtribe" content="${tribeId}"`);
+          html = html.replace(/<meta name="xnation" content="[^"]*"/g, `<meta name="xnation" content="${process.env.NATION || tribeId}"`);
           // Rewrite relative paths for dist
           html = html.replace(/href="\.\.\/dist\//g, 'href="');
           html = html.replace(/src="\.\.\/dist\//g, 'src="');

routes/system.js

@@ -4,14 +4,34 @@
  */
 
 const express = require("express");
+const fs = require("fs-extra");
+const path = require("path");
 const Setup = require("../models/Setup.js");
 const Caddy = require("../models/Caddy.js");
 
 const router = express.Router();
 
-// Set when /setup succeeds so HTTPS can be enabled immediately after mayor creation,
-// even though the server is then already "initialized".
-let httpsPending = false;
+// Persisted flag: set when /setup succeeds so HTTPS can be enabled immediately
+// after mayor creation, even though the server is then already "initialized".
+// File-based so a process restart between /setup and /enable-https doesn't 403.
+const HTTPS_PENDING_FILE = path.join(process.env.NODEPATH || "", "apxtri", "tmp", "https-pending.json");
+
+const isHttpsPending = () => {
+  try { return fs.existsSync(HTTPS_PENDING_FILE); } catch { return false; }
+};
+
+const setHttpsPending = (pending) => {
+  try {
+    if (pending) {
+      fs.ensureDirSync(path.dirname(HTTPS_PENDING_FILE));
+      fs.writeJsonSync(HTTPS_PENDING_FILE, { pending: true, at: new Date().toISOString() });
+    } else if (fs.existsSync(HTTPS_PENDING_FILE)) {
+      fs.removeSync(HTTPS_PENDING_FILE);
+    }
+  } catch (error) {
+    console.error("[SystemRoute] setHttpsPending error:", error.message);
+  }
+};
 
 const handleError = (res, error, context) => {
   console.error(`[SetupRoute] Error in ${context}:`, error);
@@ -150,7 +170,7 @@ router.post('/setup', async (req, res) => {
   try {
     const result = await Setup.setup(req.body);
     if (result.status === 200 || result.status === 201) {
-      httpsPending = true;
+      setHttpsPending(true);
     }
     res.status(result.status).json(result);
   } catch (error) {
@@ -182,12 +202,12 @@ router.post('/setup', async (req, res) => {
 router.post('/enable-https', async (req, res) => {
   try {
     const status = await Setup.status();
-    if (status.data?.initialized && !httpsPending) {
+    if (status.data?.initialized && !isHttpsPending()) {
       return res.status(403).json({ status: 403, ref: "System", msg: "already_initialized" });
     }
     const result = await Caddy.enableHttps();
     if (result.status === 200) {
-      httpsPending = false;
+      setHttpsPending(false);
     }
     res.status(result.status).json(result);
   } catch (error) {