Variable SETUP_PAGE_JSConst
SETUP_PAGE_JS: "document.getElementById('f').addEventListener('submit', async (e) => {\n\te.preventDefault();\n\tconst form = e.target;\n\tconst button = form.querySelector('button');\n\tconst out = document.getElementById('o');\n\tconst body = {};\n\tfor (const [k, v] of new FormData(form)) if (v) body[k] = v;\n\tbutton.disabled = true;\n\tout.textContent = 'Claiming...';\n\ttry {\n\t\tconst res = await fetch('/firstrun', {\n\t\t\tmethod: 'POST',\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tbody: JSON.stringify(body)\n\t\t});\n\t\tconst data = await res.json();\n\t\tif (!data.ok) throw new Error(data.error || 'refused');\n\t\t// a password the visitor typed is one they already have, so it is not shown back\n\t\tconst chose = Boolean(body.adminPass);\n\t\tconst creds = [['Username', 'admin']];\n\t\tif (data.adminPass) creds.push(['Password', data.adminPass]);\n\t\tif (data.ownerToken) creds.push(['Owner Token', data.ownerToken]);\n\t\tout.textContent = '';\n\t\tconst say = (tag, text, cls) => {\n\t\t\tconst el = document.createElement(tag);\n\t\t\tel.textContent = text;\n\t\t\tif (cls) el.className = cls;\n\t\t\tout.appendChild(el);\n\t\t\treturn el;\n\t\t};\n\t\tsay('h2', 'Claimed');\n\t\tif (data.ownerToken || data.adminPass) {\n\t\t\tsay(\n\t\t\t\t'p',\n\t\t\t\t(data.ownerToken ? 'The owner token' : 'The password') +\n\t\t\t\t\t' is shown once, on this page, and this site cannot show it again. ' +\n\t\t\t\t\t(data.ownerToken\n\t\t\t\t\t\t? 'It reaches the site when Drupal itself is broken, so store it somewhere other than this site.'\n\t\t\t\t\t\t: ''),\n\t\t\t\t'alert'\n\t\t\t);\n\t\t}\n\t\tfor (const [name, value] of creds) {\n\t\t\tconst row = document.createElement('div');\n\t\t\trow.className = 'cred';\n\t\t\tconst label = document.createElement('label');\n\t\t\tlabel.textContent = name;\n\t\t\tconst input = document.createElement('input');\n\t\t\tinput.readOnly = true;\n\t\t\tinput.value = value;\n\t\t\tlabel.appendChild(input);\n\t\t\tconst copy = document.createElement('button');\n\t\t\tcopy.type = 'button';\n\t\t\tcopy.textContent = 'Copy';\n\t\t\tcopy.addEventListener('click', async () => {\n\t\t\t\ttry {\n\t\t\t\t\tawait navigator.clipboard.writeText(value);\n\t\t\t\t} catch {\n\t\t\t\t\tinput.select();\n\t\t\t\t\tdocument.execCommand('copy');\n\t\t\t\t}\n\t\t\t\tcopy.textContent = 'Copied';\n\t\t\t});\n\t\t\trow.append(label, copy);\n\t\t\tout.appendChild(row);\n\t\t}\n\t\tif (chose) say('p', 'Password: the one you just entered.', 'warn');\n\t\tconst save = document.createElement('button');\n\t\tsave.type = 'button';\n\t\tsave.textContent = 'Download as Text';\n\t\tsave.addEventListener('click', () => {\n\t\t\tconst text =\n\t\t\t\tcreds.map(([n, v]) => n + ': ' + v).join('\\n') +\n\t\t\t\t'\\nsite: ' +\n\t\t\t\tlocation.origin +\n\t\t\t\t'\\n';\n\t\t\tconst a = document.createElement('a');\n\t\t\ta.href = URL.createObjectURL(new Blob([text], { type: 'text/plain' }));\n\t\t\ta.download = location.hostname + '-credentials.txt';\n\t\t\ta.click();\n\t\t});\n\t\tout.appendChild(save);\n\t\tconst go = document.createElement('p');\n\t\tconst login = document.createElement('a');\n\t\tlogin.href = '/user/login';\n\t\tlogin.textContent = 'Log in as admin';\n\t\tgo.appendChild(login);\n\t\tif (data.ownerToken) {\n\t\t\t// nothing leaves this page until the visitor says the token is somewhere else\n\t\t\tlogin.className = 'off';\n\t\t\tconst ack = document.createElement('label');\n\t\t\tconst box = document.createElement('input');\n\t\t\tbox.type = 'checkbox';\n\t\t\tbox.style.display = 'inline';\n\t\t\tbox.style.width = 'auto';\n\t\t\tbox.addEventListener('change', () => {\n\t\t\t\tlogin.className = box.checked ? '' : 'off';\n\t\t\t});\n\t\t\tack.append(box, ' I have stored the owner token');\n\t\t\tout.appendChild(ack);\n\t\t}\n\t\tout.appendChild(go);\n\t} catch (err) {\n\t\tbutton.disabled = false;\n\t\tout.textContent = 'Could not claim this site: ' + err.message;\n\t}\n});\n"