fix: treat recovered instances with users as initialized

apps/dokploy/__test__/services/admin-present.test.ts

@@ -0,0 +1,62 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockDb = vi.hoisted(() => ({
+	query: {
+		member: {
+			findFirst: vi.fn(),
+		},
+		organization: {
+			findFirst: vi.fn(),
+		},
+		user: {
+			findFirst: vi.fn(),
+		},
+	},
+}));
+
+vi.mock("@dokploy/server/db", () => ({ db: mockDb }));
+
+import { isAdminPresent } from "@dokploy/server/services/admin";
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	mockDb.query.member.findFirst.mockResolvedValue(undefined);
+	mockDb.query.organization.findFirst.mockResolvedValue(undefined);
+	mockDb.query.user.findFirst.mockResolvedValue(undefined);
+});
+
+describe("isAdminPresent", () => {
+	it("returns false on a truly uninitialized instance", async () => {
+		await expect(isAdminPresent()).resolves.toBe(false);
+	});
+
+	it("returns true when an owner membership exists", async () => {
+		mockDb.query.member.findFirst.mockResolvedValue({
+			id: "member-1",
+			role: "owner",
+			userId: "user-1",
+			organizationId: "org-1",
+		});
+
+		await expect(isAdminPresent()).resolves.toBe(true);
+	});
+
+	it("returns true when member.owner is missing but an organization owner exists", async () => {
+		mockDb.query.organization.findFirst.mockResolvedValue({
+			id: "org-1",
+			ownerId: "user-1",
+			owner: { id: "user-1", email: "admin@example.com" },
+		});
+
+		await expect(isAdminPresent()).resolves.toBe(true);
+	});
+
+	it("returns true when users exist even if owner membership and organizations are missing", async () => {
+		mockDb.query.user.findFirst.mockResolvedValue({
+			id: "user-1",
+			email: "admin@example.com",
+		});
+
+		await expect(isAdminPresent()).resolves.toBe(true);
+	});
+});

packages/server/src/lib/auth.ts

@@ -16,6 +16,7 @@ import {
 	getTrustedOrigins,
 	getTrustedProviders,
 	getUserByToken,
+	isAdminPresent,
 } from "../services/admin";
 import { createAuditLog } from "../services/proprietary/audit-log";
 import { resolveOrganizationDefaultRole } from "../services/proprietary/license-key";
@@ -206,10 +207,7 @@ const createBetterAuth = () =>
 								if (isSSORequest) {
 									return;
 								}
-								const isAdminPresent = await db.query.member.findFirst({
-									where: eq(schema.member.role, "owner"),
-								});
-								if (isAdminPresent) {
+								if (await isAdminPresent()) {
 									throw new APIError("BAD_REQUEST", {
 										message: "Admin is already created",
 									});
@@ -220,11 +218,11 @@ const createBetterAuth = () =>
 					after: async (user, context) => {
 						const isSSORequest = context?.path.includes("/sso");
 						const isSCIMRequest = context?.path.includes("/scim");
-						const isAdminPresent = await db.query.member.findFirst({
+						const ownerMember = await db.query.member.findFirst({
 							where: eq(schema.member.role, "owner"),
 						});
 
-						if (!IS_CLOUD && !isAdminPresent) {
+						if (!IS_CLOUD && !ownerMember) {
 							await updateWebServerSettings({
 								serverIp: await getPublicIpWithFallback(),
 							});
@@ -273,7 +271,7 @@ const createBetterAuth = () =>
 							return;
 						}
 
-						if (IS_CLOUD || !isAdminPresent) {
+						if (IS_CLOUD || !ownerMember) {
 							await db.transaction(async (tx) => {
 								const organization = await tx
 									.insert(schema.organization)

packages/server/src/services/admin.ts

@@ -41,10 +41,24 @@ export const isAdminPresent = async () => {
 		where: eq(member.role, "owner"),
 	});
 
-	if (!admin) {
-		return false;
+	if (admin) {
+		return true;
 	}
-	return true;
+
+	// Partial DB restore can drop member.owner while user/org rows remain.
+	// Those instances are initialized, not a fresh Setup.
+	const org = await db.query.organization.findFirst({
+		with: {
+			owner: true,
+		},
+	});
+
+	if (org?.owner) {
+		return true;
+	}
+
+	const existingUser = await db.query.user.findFirst();
+	return Boolean(existingUser);
 };
 
 export const findOwner = async () => {