Close the database wizard's endpoints once the site is installed

[compscidr]

Problem

POST /wizard_db and POST /test_db belong to the install wizard's database step. They take no credentials, because during an install there is nobody to hold any, and they are registered for the life of the process. Nothing turned them off once the install was finished.

Fix

A small installOnly middleware on both routes answers 403 once the site has a database and an admin. Before that (no database yet, or a database with no admin) the wizard works as before.

Testing

New TestInstallOnly: on an installed site both endpoints return 403 and .env is untouched; before install and mid-install /wizard_db still saves. The test fails without the guard. go test ./... passes, and the install smoke test covers the wizard path in CI.

Upgrading

Sites should upgrade to the release that contains this.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟢 Approval recommended

The change is small, focused, and correct, follows the existing middleware convention, and is backed by a passing test that exercises the installed, pre-install, and mid-install states.

Review effort: Balanced
Findings: None

What changed in this PR

This PR closes a security gap in GoBlog's install wizard. The database-step endpoints POST /wizard_db (which rewrites .env with whatever database the request names) and POST /test_db (which opens any file/host it's given) take no credentials — because during an install there is no admin to authenticate — and were previously registered for the life of the process with nothing to turn them off once the install finished. The PR adds a small installOnly middleware that returns 403 once the site is fully installed (has a database and an admin), while leaving the wizard fully functional before and during install.

Changes:

• Added a goblog.installOnly Gin middleware that aborts with 403 when !_wizard.IsDbNil() && !_auth.IsWizardMode(c) (i.e. a DB exists and an admin row exists).
• Wired the middleware onto POST /wizard_db and POST /test_db.
• Added TestInstallOnly covering the installed (403, .env untouched, no file created), pre-install (303, .env written), and mid-install (303) states.

File	Description
goblog.go	Adds the installOnly middleware and applies it to the two wizard database endpoints.
wizard_install_only_test.go	New test verifying the endpoints are blocked post-install and still work before/mid-install.

I verified the key correctness concerns:

• Gin semantics: installOnly not calling c.Next() when it allows the request is correct and consistent with the existing requireJSON middleware pattern (goblog.go:620-642); AbortWithStatusJSON correctly stops the chain when installed.
• Nil safety: IsWizardMode dereferences the DB, but Go's short-circuit evaluation (!IsDbNil() first) ensures it's only called when the DB is non-nil, avoiding a panic in the app(nil) test path.
• No TOCTOU gap: installed sites always connect the DB at startup (goblog.go:271-277), so IsDbNil() is false before any request is served.
• Test soundness: all referenced symbols/fields exist (auth.New/BlogUser/AdminUser/ProviderGitHub, wizard.New, templateWithErrors, and the dbtype/sqlite_file→sqlite_db form/env field mapping in db.go), and t.Chdir is supported on go 1.26.

I did not find any objective issues warranting a comment.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!