From 596e017d44411039747cc2cb1595ed723acf1ed2 Mon Sep 17 00:00:00 2001
From: Zach Wasserman <zach@fleetdm.com>
Date: Mon, 3 May 2021 09:31:51 -0700
Subject: [PATCH] Fix admin setup (#701)

Fixes a null pointer issue and clarifies setup logic.
---
 server/service/endpoint_setup.go | 34 ++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/server/service/endpoint_setup.go b/server/service/endpoint_setup.go
index 3e9ad720f2..55e5722bb9 100644
--- a/server/service/endpoint_setup.go
+++ b/server/service/endpoint_setup.go
@@ -47,23 +47,27 @@ func makeSetupEndpoint(svc kolide.Service) endpoint.Endpoint {
 		if err != nil {
 			return setupResponse{Err: err}, nil
 		}
+
+		if req.Admin == nil {
+			return setupResponse{Err: errors.New("setup request must provide admin")}, nil
+		}
+
 		// creating the user should be the last action. If there's a user
 		// present and other errors occur, the setup endpoint closes.
-		if req.Admin != nil {
-			if *req.Admin.Email == "" {
-				err := errors.Errorf("admin email cannot be empty")
-				return setupResponse{Err: err}, nil
-			}
-			if *req.Admin.Password == "" {
-				err := errors.Errorf("admin password cannot be empty")
-				return setupResponse{Err: err}, nil
-			}
-			// Make the user an admin
-			req.Admin.GlobalRole = null.StringFrom("admin")
-			admin, err = svc.CreateUser(ctx, *req.Admin)
-			if err != nil {
-				return setupResponse{Err: err}, nil
-			}
+		adminPayload := *req.Admin
+		if adminPayload.Email == nil || *adminPayload.Email == "" {
+			err := errors.Errorf("admin email cannot be empty")
+			return setupResponse{Err: err}, nil
+		}
+		if adminPayload.Password == nil || *adminPayload.Password == "" {
+			err := errors.Errorf("admin password cannot be empty")
+			return setupResponse{Err: err}, nil
+		}
+		// Make the user an admin
+		adminPayload.GlobalRole = null.StringFrom("admin")
+		admin, err = svc.CreateUser(ctx, adminPayload)
+		if err != nil {
+			return setupResponse{Err: err}, nil
 		}
 
 		// If everything works to this point, log the user in and return token.  If