Windows installer: payload hash-locking, SBOM, client-IP handling, operator docs

frontend/src/composables/setupState.js

@@ -2,7 +2,7 @@
 // admin into the /setup wizard. Defaults to "complete" so the wizard never
 // flashes before the real value loads.
 import { ref } from 'vue'
-import { settingsApi } from '../api'
+import { settingsApi, setupApi } from '../api'
 
 export const setupComplete = ref(true)
 // Session-only: a fresh admin who clicks "Skip for now" is not nagged again
@@ -26,3 +26,31 @@ export async function refreshSetupState() {
   loaded.value = true
   return setupComplete.value
 }
+
+// First run, before any user exists. Defaults to false so the app never flashes
+// the create-admin screen at an established site while this loads.
+export const needsAdmin = ref(false)
+const adminLoaded = ref(false)
+
+export function isNeedsAdminLoaded() {
+  return adminLoaded.value
+}
+
+export async function refreshNeedsAdmin() {
+  try {
+    const response = await setupApi.needsAdmin()
+    needsAdmin.value = response.data?.data?.needsadmin === true
+  } catch (err) {
+    // Fail open: if we cannot tell, assume an admin exists rather than trap
+    // everyone behind a create-admin screen they cannot complete.
+    needsAdmin.value = false
+  }
+  adminLoaded.value = true
+  return needsAdmin.value
+}
+
+// Called after the first admin is created so the gate stops firing.
+export function clearNeedsAdmin() {
+  needsAdmin.value = false
+  adminLoaded.value = true
+}