feat: add controlled one-shot CMS admin seed route

apps/cms/src/app/api/seed-admin/route.ts

@@ -0,0 +1,32 @@
+import { getPayload } from "payload";
+import config from "@payload-config";
+import { headers } from "next/headers";
+
+export const POST = async () => {
+  const h = await headers();
+  const token = h.get("x-cms-seed-token");
+  if (!process.env.CMS_SEED_TOKEN || token !== process.env.CMS_SEED_TOKEN) {
+    return Response.json({ ok: false, error: "unauthorized" }, { status: 401 });
+  }
+
+  const email = process.env.CMS_ADMIN_EMAIL;
+  const password = process.env.CMS_ADMIN_PASSWORD;
+  if (!email || !password) {
+    return Response.json({ ok: false, error: "seed env not set" }, { status: 400 });
+  }
+
+  const payload = await getPayload({ config });
+  const existing = await payload.find({ collection: "users", limit: 1, pagination: false });
+  if (existing.totalDocs > 0) {
+    await payload.destroy();
+    return Response.json({ ok: false, error: "user exists" }, { status: 409 });
+  }
+
+  await payload.create({
+    collection: "users",
+    data: { email, password, displayName: "CMS Admin" },
+    overrideAccess: true,
+  });
+  await payload.destroy();
+  return Response.json({ ok: true });
+};