fix(apps): unblock saleor and netbird first-use flows

core/archipelago/src/api/rpc/dispatcher.rs

@@ -55,6 +55,7 @@ impl RpcHandler {
             "package.restart" => self.handle_package_restart(params).await,
             "package.uninstall" => self.clone().spawn_package_uninstall(params).await,
             "package.update" => self.clone().spawn_package_update(params).await,
+            "package.credentials" => self.handle_package_credentials(params).await,
             "app.filebrowser-token" => self.handle_filebrowser_token().await,
 
             // Bundled app management (for pre-loaded container images)

core/archipelago/src/api/rpc/package/install.rs

@@ -1859,6 +1859,42 @@ autopilot.active=false\n",
 
         Ok(serde_json::json!({ "token": token }))
     }
+
+    pub(in crate::api::rpc) async fn handle_package_credentials(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let app_id = params
+            .as_ref()
+            .and_then(|p| p.get("app_id"))
+            .and_then(|v| v.as_str())
+            .unwrap_or_default();
+        super::validation::validate_app_id(app_id)?;
+
+        match app_id {
+            "saleor" => {
+                let password =
+                    tokio::fs::read_to_string("/var/lib/archipelago/secrets/saleor-admin-password")
+                        .await
+                        .unwrap_or_default()
+                        .trim()
+                        .to_string();
+                if password.is_empty() {
+                    return Ok(serde_json::json!({ "credentials": [] }));
+                }
+
+                Ok(serde_json::json!({
+                    "title": "Saleor admin login",
+                    "description": "Saleor opens to its own dashboard login. Use this generated admin account to sign in.",
+                    "credentials": [
+                        { "label": "Email", "value": "admin@example.com", "sensitive": false },
+                        { "label": "Password", "value": password, "sensitive": true }
+                    ]
+                }))
+            }
+            _ => Ok(serde_json::json!({ "credentials": [] })),
+        }
+    }
 }
 
 async fn cleanup_stale_package_ports(package_id: &str) {

core/archipelago/src/api/rpc/package/stacks.rs

@@ -1929,6 +1929,17 @@ impl RpcHandler {
             }
         }
 
+        let admin_script = format!(
+            r#"from django.contrib.auth import get_user_model
+User = get_user_model()
+user, _ = User.objects.get_or_create(email="admin@example.com", defaults={{"is_staff": True, "is_superuser": True}})
+user.is_staff = True
+user.is_superuser = True
+user.set_password({:?})
+user.save()
+"#,
+            admin_pass
+        );
         let mut admin_cmd = tokio::process::Command::new("podman");
         admin_cmd.args([
             "run",
@@ -1940,17 +1951,14 @@ impl RpcHandler {
         ]);
         admin_cmd.args(&saleor_env);
         admin_cmd.args([
-            "-e",
-            "DJANGO_SUPERUSER_EMAIL=admin@example.com",
-            "-e",
-            &format!("DJANGO_SUPERUSER_PASSWORD={}", admin_pass),
             SALEOR_API_IMAGE,
             "python3",
             "manage.py",
-            "createsuperuser",
-            "--noinput",
+            "shell",
+            "-c",
+            &admin_script,
         ]);
-        run_required_stack_command("saleor", "create admin user", &mut admin_cmd).await?;
+        run_required_stack_command("saleor", "create or update admin user", &mut admin_cmd).await?;
         install_log("INSTALL INFO: saleor admin email admin@example.com; password stored in /var/lib/archipelago/secrets/saleor-admin-password").await;
 
         let mut api_cmd = tokio::process::Command::new("podman");
@@ -2044,7 +2052,7 @@ impl RpcHandler {
             "-e",
             &format!("API_URL={}", api_url),
             "-e",
-            &format!("APP_MOUNT_URI={}", dashboard_url),
+            "APP_MOUNT_URI=/",
             SALEOR_DASHBOARD_IMAGE,
         ]);
         run_required_stack_command("saleor", "create dashboard", &mut dashboard_cmd).await?;
@@ -2063,6 +2071,21 @@ impl RpcHandler {
             120,
         )
         .await?;
+        tokio::time::sleep(std::time::Duration::from_secs(5)).await;
+        wait_for_stack_containers(
+            "saleor",
+            &[
+                "saleor-db",
+                "saleor-cache",
+                "saleor-jaeger",
+                "saleor-mailpit",
+                "saleor-api",
+                "saleor-worker",
+                "saleor",
+            ],
+            30,
+        )
+        .await?;
 
         self.set_install_phase("saleor", InstallPhase::WaitingHealthy)
             .await;
@@ -2117,7 +2140,7 @@ async fn write_netbird_config_files(host_ip: &str) -> Result<()> {
   auth:
     issuer: "{public_origin}/oauth2"
     localAuthDisabled: false
-    signKeyRefreshEnabled: true
+    signKeyRefreshEnabled: false
     dashboardRedirectURIs:
       - "{public_origin}/nb-auth"
       - "{public_origin}/nb-silent-auth"
@@ -2145,7 +2168,7 @@ USE_AUTH0=false
 AUTH_SUPPORTED_SCOPES=openid profile email groups
 AUTH_REDIRECT_URI=/nb-auth
 AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
-NETBIRD_TOKEN_SOURCE=accessToken
+NETBIRD_TOKEN_SOURCE=idToken
 NGINX_SSL_PORT=443
 LETSENCRYPT_DOMAIN=none
 "#