fixing a few thing

public/oauth.php

@@ -67,6 +67,12 @@ $repo = new Repository($db);
 $allowedTokens = $repo->getAllowedUserTokens();
 
 if (empty($allowedTokens)) {
+    $bootstrapAllowed = filter_var(getenv('ALLOW_FIRST_USER_BOOTSTRAP') ?: 'false', FILTER_VALIDATE_BOOL);
+    if (!$bootstrapAllowed) {
+        $_SESSION['auth_error'] = 'No users are authorized for this system. Set allowed_user_tokens or enable first-user bootstrap during initial setup.';
+        header('Location: ' . $errorRedirect);
+        exit;
+    }
     $repo->setAllowedUserTokens([$userToken]);
 } elseif (!in_array($userToken, $allowedTokens, true)) {
     $_SESSION['auth_error'] = 'Your Jakach account is not authorized to access this system. Contact an administrator.';
@@ -86,4 +92,4 @@ unset($_SESSION['auth_error']);
 
 $redirect = isSafeRedirect($rawRedirect) ? $rawRedirect : '/';
 header('Location: ' . $redirect);
-exit;
+exit;