From 90cbc47607810839585e9f957ad46c167c8a2d18 Mon Sep 17 00:00:00 2001
From: lilleman <lilleman@larvit.se>
Date: Wed, 5 Aug 2026 12:55:12 +0200
Subject: [PATCH] Seed the demo admin from the mounted plugins, not the image's
 empty copy

---
 README.md   | 9 ++++++---
 compose.yml | 4 ++++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 67e6c85..d833f75 100644
--- a/README.md
+++ b/README.md
@@ -32,11 +32,13 @@ docker compose up -d        # http://localhost:3000, live-reloads on source chan
 
 ```bash
 cp -r examples/plugins/admin plugins/admin
-docker compose restart web
+docker compose up -d
 ```
 
 The bootstrap grants the seeded admin every permission the installed plugins declare, so the
-**Admin** section now shows in the menu.
+**Admin** section now shows in the menu. Use `up -d`, not `restart web`: the seed runs in the
+one-shot `bootstrap` service, and only `up` re-runs it to pick up the new plugin's permissions
+(it is idempotent, so re-running costs nothing).
 See [`examples/plugins/admin/`](examples/plugins/admin/).
 
 **4. Add your first plugin.** The clone is bind-mounted into the container, so a new
@@ -60,7 +62,8 @@ docker compose restart web
 
 Visit <http://localhost:3000/hello> — the page is mounted at `/hello` (the folder name
 is the plugin id *and* the mount path) and "Hello" is in the menu. That's the whole loop:
-**drop a folder in `plugins/`, restart, it's live.**
+**drop a folder in `plugins/`, restart, it's live.** A plugin that declares `permissions` needs
+`docker compose up -d` instead, so the seed re-runs and grants them (as in step 3).
 
 From here, render real pages against the app shell and fetch upstream data — see
 [Building plugins](#building-plugins) and the runnable reference in
diff --git a/compose.yml b/compose.yml
index bc24df4..3517741 100644
--- a/compose.yml
+++ b/compose.yml
@@ -139,6 +139,10 @@ services:
       KRATOS_ADMIN_URL: http://kratos:4434
     volumes:
       - ./ory/kratos/tokenizer:/etc/config/kratos/tokenizer
+      # The seed grants what the installed plugins declare, so bootstrap must see the same plugins/
+      # as web. Without this it discovers only the image's (empty) copy and the demo admin is seeded
+      # with nothing — a drop-in plugin's screens then 403 with nothing logged.
+      - ./plugins:/app/plugins:ro
     command: node src/auth/bootstrap.ts
     # Bounded retry: the seed is idempotent, so transient Ory blips recover — but a permanent
     # error must give up, not loop forever and hang `web` (gates on completion).