1.0.4:0

TODO.md

@@ -0,0 +1,42 @@
+# TODO
+
+## Set a generated admin password
+
+The app resolves its admin Basic Auth credentials as:
+
+```js
+const ADMIN_USERNAME = process.env.PLATFORM_ADMIN_USERNAME || 'admin'
+const ADMIN_PASSWORD = process.env.PLATFORM_ADMIN_PASSWORD || 'Whatever!'
+```
+
+(verified in `/app/server.js` of `spacesops/spacesops:v1.0.4`)
+
+These are **defaults, not hardcoded values** — both are overridable via
+environment variables. The package currently sets neither, so every install
+ships the same publicly known admin password, guarding an area that can run SQL
+and manage tenants.
+
+The fix mirrors what the package already does for `PLATFORM_SESSION_SECRET`:
+
+1. Add an `adminPassword` field to `fileModels/storeJson.ts`.
+2. Seed it in a `setupOnInit` task with `utils.getDefaultString(...)`, the same
+   way `init/taskSessionSecret.ts` does.
+3. Inject `PLATFORM_ADMIN_PASSWORD` (and optionally
+   `PLATFORM_ADMIN_USERNAME`) from the store in `main.ts`.
+4. Update the **Show Admin Credentials** action to read the generated value
+   instead of the `ADMIN_USER` / `ADMIN_PASSWORD` constants in `utils.ts`.
+5. Add a "Reset Admin Password" action (see `recipe-reset-password.md`).
+6. Update `README.md` limitation 2 and the `instructions.md` admin section,
+   which currently document the well-known default as the live credential.
+
+This is a behavior change for existing installs — a user who bookmarked the old
+password would be locked out — so it needs release notes calling it out, and
+possibly a migration that seeds the store for already-installed services.
+
+## Verify on a live box
+
+The 2.x SDK migration and the v1.0.4 bump have been compiled, linted, and
+packed, but not yet installed and exercised on a StartOS 0.4.0-beta.10+ host.
+Confirm the service starts, the web UI is reachable, the Spaces credential probe
+succeeds, and outbound HTTPS to `*.startos` works with the injected
+`NODE_EXTRA_CA_CERTS`.