'
+ . state_block($state)
. '
🐾 Tiger Installer v' . INSTALLER_VERSION . '
'
. $body
. '
One file, nothing more. Downloads & verifies the latest Tiger release, installs it above your document root, then deletes itself.
'
@@ -386,12 +410,17 @@ function db_form($bag, $errNote = '') {
function admin_form($bag, $errNote = '') {
return '
Create your admin account
'
. ($errNote !== '' ? '
' . h($errNote) . '
' : '
Database installed and ready.
')
- . '
';
}
@@ -572,17 +601,63 @@ function do_provision($bag) {
}
/** Create the founding org + admin. Returns '' or an error message. */
-function do_create_owner($bag) {
+function do_create_owner($bag, &$owner = null) {
try {
ensure_booted($bag['app_dir']);
$username = $bag['username'] !== '' ? $bag['username'] : null;
- Tiger_Install::createOwner($bag['email'], $bag['password'], $bag['org'], null, 'developer', $username);
+ $owner = Tiger_Install::createOwner($bag['email'], $bag['password'], $bag['org'], null, 'developer', $username);
} catch (Throwable $e) {
return $e->getMessage();
}
return '';
}
+/**
+ * Mint the agent credential and switch `/mcp` on — TIGER-90, the connect handshake.
+ *
+ * Runs ONLY after do_create_owner() has succeeded: the token is scoped to the owner that was just
+ * created, so there is no ordering in which MCP is reachable before an admin exists to revoke it.
+ *
+ * Within that, mint BEFORE enabling. The ticket requires both to happen after the owner exists and
+ * warns that the reverse order can leave "MCP enabled on a site with no admin"; minting first also
+ * means a failure at the mint step leaves the site on today's defaults (MCP off) rather than on with
+ * no credential to show for it. The safe half-state is the one that grants nothing.
+ *
+ * Failure here NEVER fails the install. The site is already live and the owner already exists; all
+ * that is lost is the convenience, and the finish screen says so plainly.
+ *
+ * Scope: the curated starter set (Tiger_Mcp_Token::DEFAULT_MODULES), org-scoped, not read-only.
+ * `tiger.api.discovery` is deliberately left alone — publishing the OpenAPI document is a separate
+ * decision, and MCP's tools/list already gives the client its typed surface.
+ *
+ * @return array {ok: bool, token?: string, modules?: string[], error?: string}
+ */
+function do_enable_agent($bag, $owner) {
+ try {
+ ensure_booted($bag['app_dir']);
+
+ $userId = is_array($owner) ? ($owner['user_id'] ?? null) : null;
+ $orgId = is_array($owner) ? ($owner['org_id'] ?? null) : null;
+ if ($userId === null) { return ['ok' => false, 'error' => 'No owner id was returned; agent access not enabled.']; }
+
+ $cred = (new Tiger_Model_UserCredential())->createToken($userId);
+ Tiger_Mcp_Token::saveConfig($cred['credential_id'], [
+ 'modules' => Tiger_Mcp_Token::DEFAULT_MODULES,
+ 'read_only' => false,
+ 'org_scoped' => true,
+ 'role' => 'developer',
+ 'org_id' => (string) $orgId,
+ ]);
+
+ // Only now is there a credential to reach it with.
+ (new Tiger_Model_Config())->set(Tiger_Model_Config::SCOPE_GLOBAL, '', Tiger_Mcp::CONFIG_ENABLED, '1');
+
+ return ['ok' => true, 'token' => $cred['token'], 'modules' => Tiger_Mcp_Token::DEFAULT_MODULES];
+ } catch (Throwable $e) {
+ return ['ok' => false, 'error' => $e->getMessage()];
+ }
+}
+
/* ---------------------------------------------------------------------------
* Controller — a Back/Next wizard. Every field rides in a "bag" carried on every
* request, so navigating Back never loses what you typed (passwords included).
@@ -597,16 +672,30 @@ function do_create_owner($bag) {
// The value bag — read every field each request; fill sensible defaults once.
$bag = [];
-foreach (['app_dir', 'docroot', 'db_host', 'db_name', 'db_user', 'db_pass', 'org', 'email', 'username', 'password'] as $f) {
+foreach (['app_dir', 'docroot', 'db_host', 'db_name', 'db_user', 'db_pass', 'org', 'email', 'username', 'password', 'agent'] as $f) {
$bag[$f] = post($f, '');
}
+// `agent` may be SEEDED from the query string (?agent=1) but only on a GET. On a POST the visible
+// checkbox is the only authority, so un-ticking it actually turns it off — an unchecked box submits
+// nothing, which is exactly what makes the seeded choice reversible (TIGER-90).
+//
+// This is safe ONLY because there is no callback: the minted token is displayed on the installer's own
+// screen and nowhere else, so a crafted ?agent=1 link gains its sender nothing — they do not see the
+// screen, the person running the install does. Re-read TIGER-90 before adding any field that would
+// send the credential somewhere.
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+ $bag['agent'] = truthy(req('agent', '')) ? '1' : '';
+}
+$agentWanted = truthy($bag['agent']);
if ($bag['docroot'] === '') { $bag['docroot'] = $docroot; }
if ($bag['app_dir'] === '') { $bag['app_dir'] = $home . '/' . $domain . '/tiger-app'; }
if ($bag['db_host'] === '') { $bag['db_host'] = 'localhost'; }
// CSRF gate for every POST.
if ($_SERVER['REQUEST_METHOD'] === 'POST' && !csrf_ok()) {
- page('Session expired', '
');
+ page('Session expired', '
',
+ ['installer' => INSTALLER_VERSION, 'step' => 'expired', 'status' => 'error', 'error' => 'csrf_expired',
+ 'detail' => 'The CSRF cookie did not match. Reload the installer and start again.']);
exit;
}
@@ -633,7 +722,14 @@ function do_create_owner($bag) {
$body .= $blocked
? '
Fix the FAIL items in cPanel, then reload this page.
'
: '
';
- page('Requirements', $body);
+ page('Requirements', $body, [
+ 'installer' => INSTALLER_VERSION,
+ 'step' => 'requirements',
+ 'status' => $blocked ? 'blocked' : 'awaiting-input',
+ 'next_step' => $blocked ? null : 'location',
+ 'checks' => array_map(static fn($c) => ['label' => $c['label'], 'ok' => (bool) $c['ok'],
+ 'required' => (bool) $c['hard'], 'fix' => $c['ok'] ? null : $c['fix']], $checks),
+ ]);
break;
/* --- Location ----------------------------------------------------------- */
@@ -653,33 +749,51 @@ function do_create_owner($bag) {
. '
Running several domains on this account? Each gets its own folder like '
. '' . h($home) . '/<domain>/tiger-app and its own database — fully independent installs.
'
. '
This installer has deleted itself. Nothing else to clean up.
'
: '