superAdmin first login requires invite code but shows 'already a space member' error — no default space seeded

[dolphinsboy]

Problem

After a fresh deployment, superAdmin can authenticate successfully via POST /v1/user/login and POST /v1/manager/login, but the web client redirects to an invite-code entry page because no Space exists for the admin user.

When the admin tries to enter any invite code, the error "你已经是该空间成员" (already a space member) is returned — creating a catch-22: the UI demands an invite code to proceed, but the invite/join flow rejects the user as already a member.

Reproduction (fresh Docker Compose deployment)

# 1. Fresh deploy
git clone https://github.com/Mininglamp-OSS/octo-deployment.git
cd octo-deployment
./setup.sh --non-interactive --ip 127.0.0.1
cd docker && docker compose --env-file .env up -d

# 2. Verify superAdmin token works
curl -s -X POST http://127.0.0.1:28081/v1/user/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"superAdmin","password":"<OCTO_ADMIN_PWD>"}' | jq .
# → returns valid token ✅

# 3. Check spaces for superAdmin
curl -s http://127.0.0.1:28081/v1/space/my -H "token: <token>"
# → [] (empty array — no spaces) ✅ explains web redirect

# 4. Open web UI: http://127.0.0.1:28080
# → Login with superAdmin / <OCTO_ADMIN_PWD>
# → Redirected to invite-code entry page ❌
# → Enter any invite code → "你已经是该空间成员" ❌

Root Cause (source analysis)

1. superAdmin is seeded without a Space

createManagerAccount() in modules/user/api_manager.go only creates the user row — it does not create a default Space or add the admin as a member of any Space:

func (m *Manager) createManagerAccount() {
    // Only inserts a User row (UID, name, role=superAdmin, ...)
    // No space creation, no space membership
    err = m.userDB.Insert(&Model{ ... })
}

2. Web client: empty Space list → invite-code redirect

GET /v1/space/my returns [] for superAdmin → web treats this as "not in any space" → redirects to invite-code entry.

3. joinSpace catches ErrAlreadyMember but space doesn't exist

The joinSpace handler in modules/space/api.go (line ~873) returns "你已经是该空间成员" via ErrAlreadyMember. This appears to be triggered even when GET /v1/space/list returns "空间不存在" — suggesting a data inconsistency between the space membership table and the spaces table after the initial seed.

Expected Behavior

After fresh deployment:

• Option A: createManagerAccount() automatically creates a default Space and adds superAdmin as owner → web client lands directly on the main UI
• Option B: Web client detects role == superAdmin with no spaces and shows a "Create your first Space" onboarding flow instead of an invite-code entry page
• Either way: the invite-code catch-22 ("enter code" + "already member" error) must not occur

Environment

• octo-server: latest (mininglamposs/octo-server Docker image)
• octo-deployment: main
• Fresh Docker Compose deployment on macOS

Additional Notes

• superAdmin can log in to the Admin console (http://127.0.0.1:28080/admin/) without any issue
• The problem is specific to the Web client first-login flow
• GET /v1/manager/login works correctly for admin console use cases
• The catch-22 completely blocks superAdmin from accessing the web client on a fresh install

[github-actions]

嗨，感谢提交 Issue！🐙

我们已收到，近期会进行 triage。有后续进展会在这里跟进。

— Octo Team 🐙

[an9xyz]

Triage 结论:本仓代码层面未复现 catch-22

我在本地用 MySQL mock 了 fresh deploy 的完整时序(只跑 modules/*/sql/ 自动 migration + createManagerAccount),无法复现 "输入邀请码 → 你已经是该空间成员" 这条错误路径。

关键发现

1. Fresh deploy 后 space 表是空的

createManagerAccount() (modules/user/api_manager.go:1153-1187) 只插入 user 行,不建 Space、不写 space_member。普通注册路径 createUserWithRespAndTx 和所有 EventUserRegister listener (group / botfather / friend) 也都不建 Space。

modules/space/sql/20260308000003_space_legacy02.sql 只把 bot 写进 minglue_default 的 space_member,不创建 minglue_default 这个 space 行本身。

真正会建 minglue_default space + 默认邀请码 minglue2026 的脚本是 scripts/migrate-to-space.sql,但它:

• 不在自动 migration 列表里
• 不被 Dockerfile / Dockerfile.ghcr 调用
• 整个 octo-server 仓没有任何代码/脚本执行它

2. Catch-22 的两条边界都不成立

场景	/v1/space/my	输邀请码结果
未跑 migrate-to-space.sql	[] ✅	"邀请码无效或已过期"(api.go:781),因为 space_invitation 也是空表
跑过 migrate-to-space.sql	返回 minglue_default,role=2	不会跳邀请码页

"你已经是该空间成员"(api.go:809 / 873)只可能在 space_member 存在 status=1 行、且对应 space.status≠1(被 disband/banned)的不一致状态下出现。这种不一致需要外部 SQL 操作才能制造,不是 octo-server 本仓代码缺陷。

请补充以下信息以便继续 triage

请在出问题环境里执行:

SELECT space_id, name, status FROM space;
SELECT space_id, uid, status FROM space_member WHERE uid='<superAdmin_uid>';
SELECT space_id, invite_code, status, expires_at FROM space_invitation;

另外请说明:octo-deployment 的 setup.sh / docker-entrypoint 里是否执行过 scripts/migrate-to-space.sql 或类似 SQL?如果是,catch-22 可能源自 deployment 侧的执行顺序,issue 应转去 octo-deployment。

关于 Expected Behavior

不论 catch-22 是否能稳定复现,fresh deploy 后 superAdmin 无任何 Space 导致 Web 端跳邀请码页 这件事本身确实存在(Stage A 已验证)。Issue Option A 仍然合理:在 createManagerAccount 里顺带创建一个 default Space 并把 superAdmin 设为 owner,作为产品级兜底。这个可以另起 PR 处理。