Setup wizard UI verification

• Date: 2026-08-25
• Runtime: PortalConsole development server with DATABASE_URL, DATABASE_DIALECT, PORTAL_JWT_SECRET, and JWT_SECRET unset; PORTAL_CONSOLE_SETUP_TOKEN configured.
• URL: http://127.0.0.1:3105/setup

Results

1. The service started without a configured database and logged that only setup mode is available.

2. GET / returned HTTP 302 with Location: /setup.

3. The /setup client rendered the four-stage wizard after Vite completed client loading.

4. The page displayed MySQL/PostgreSQL selection, password-masked database URL entry, initial administrator fields, optional FileStore and UiPlatform endpoints, deployment provider selection, and the review-plan action.

5. No preexisting database contents or provider secret values were rendered in the setup page.

6. After production-token protection was added, the wizard rendered a password-masked PORTAL_CONSOLE_SETUP_TOKEN input before any database validation action.

7. Browser form filling kept the setup token and database URL as password fields; the visible page labels did not disclose either value.