feat: FIRST_INSTALL_TOKEN to help services like Umbrel secure the first_install endpoint (#3751)

Co-authored-by: dni ⚡ <office@dnilabs.com>

lnbits/static/i18n/en.js

@@ -518,6 +518,7 @@ window.localisation.en = {
   hash: 'Hash: ',
   welcome_lnbits: 'Welcome to LNbits',
   setup_su_account: 'Set up the Superuser account below.',
+  first_install_token: 'First Install Token (optional)',
   create_ticker_converter: 'Create Currency Ticker Converter',
   enable_audit: 'Enable Audit',
   recommended: 'Recommended',

lnbits/static/js/pages/first-install.js

@@ -7,7 +7,8 @@ window.PageFirstInstall = {
         isPwdRepeat: true,
         username: '',
         password: '',
-        passwordRepeat: ''
+        passwordRepeat: '',
+        firstInstallToken: ''
       }
     }
   },
@@ -17,20 +18,25 @@ window.PageFirstInstall = {
     }
   },
   methods: {
-    async setPassword() {
-      try {
-        await LNbits.api.request('PUT', '/api/v1/auth/first_install', null, {
+    setPassword() {
+      LNbits.api
+        .request('PUT', `/api/v1/auth/first_install`, null, {
           username: this.loginData.username,
           password: this.loginData.password,
-          password_repeat: this.loginData.passwordRepeat
+          password_repeat: this.loginData.passwordRepeat,
+          first_install_token: this.loginData.firstInstallToken
         })
-        window.location.href = '/admin'
-      } catch (e) {
-        LNbits.utils.notifyApiError(e)
-      }
+        .then(async () => {
+          const res = await LNbits.api.getAuthUser()
+          this.g.user = LNbits.map.user(res.data)
+          this.g.isPublicPage = false
+          this.$router.push('/admin')
+        })
+        .catch(this.utils.notifyApiError)
     }
   },
   created() {
-    document.title = 'First Install - LNbits'
+    const params = new URLSearchParams(window.location.search)
+    this.loginData.firstInstallToken = params.get('token') || ''
   }
 }