First Run Setup

The First Run wizard runs automatically on the first deployment when there are no admin users in the database. It lets you create the initial Super Admin account without needing an invitation.

One-time only. Once a Super Admin account exists, the /admin/first-run route is locked for new account creation. It is reused later only when an admin needs to re-enrol their authenticator after a 2FA reset. All subsequent admin accounts must be created through the Invitation system.

Steps

1. Deploy the platform and run all database migrations, including migration 090 (admin groups) and 095 (2FA reset OTP type).
2. Navigate to https://admin.noteriseit.com/admin/first-run
3. Fill in:
   • First name, last name
   • Email address (this becomes your login email)
   • Password (must meet the strength requirements shown)
4. Submit — your account is created as a Super Admin and automatically assigned to the super_admin group.
5. You are redirected to the 2FA setup page. Scan the QR code with your authenticator app (Google Authenticator, Authy, or similar) and enter the 6-digit code to confirm.
6. Once verified, you are redirected to the dashboard.

2FA is mandatory for all admin accounts. The dashboard is inaccessible until 2FA is enrolled. Invited admins go through the same TOTP setup on their first login.

Re-enrolling after a 2FA reset

If an admin resets their 2FA (via Profile → Security → Reset 2FA), they are redirected to /admin/first-run automatically after the reset is confirmed. The account creation form is not shown — only the TOTP setup step. They scan the new QR code and enrol their authenticator to regain full dashboard access.

After First Run

Once logged in as Super Admin, your first steps should be:

• Configure Platform Settings — set the platform name, contact email, default VAT rate.
• Invite your team — send invitations to compliance officers, billing admins, and support staff via Team Invitations.
• Verify billing settings — check the service charge percentage and payout thresholds under Billing Settings.

Migration Checklist (before first run)

Run these in order:

npx ts-node -r dotenv/config src/migrations/scripts/run-083-support-tickets.ts
npx ts-node -r dotenv/config src/migrations/scripts/run-085-approval-status-suspended-external.ts
npx ts-node -r dotenv/config src/migrations/scripts/run-086-enr-submission-tracking.ts
npx ts-node -r dotenv/config src/migrations/scripts/run-087-admin-invitations.ts
npx ts-node -r dotenv/config src/migrations/scripts/run-088-...ts
npx ts-node -r dotenv/config src/migrations/scripts/run-089-...ts
npx ts-node -r dotenv/config src/migrations/scripts/run-090-admin-groups.ts
npx ts-node -r dotenv/config src/migrations/scripts/run-095-otp-type-two-fa-reset.ts

Fill in the exact filenames for 088 and 089 from the ron-api-service/src/migrations/scripts/ directory.

All runners are idempotent — safe to run multiple times.