spacesops-startos/TODO.md

TODO

Set a generated admin password

The app resolves its admin Basic Auth credentials as:

const ADMIN_USERNAME = process.env.PLATFORM_ADMIN_USERNAME || 'admin'
const ADMIN_PASSWORD = process.env.PLATFORM_ADMIN_PASSWORD || 'Whatever!'

(verified in /app/server.js of spacesops/spacesops:v1.0.4)

These are defaults, not hardcoded values — both are overridable via environment variables. The package currently sets neither, so every install ships the same publicly known admin password, guarding an area that can run SQL and manage tenants.

The fix mirrors what the package already does for PLATFORM_SESSION_SECRET:

1. Add an adminPassword field to fileModels/storeJson.ts.
2. Seed it in a setupOnInit task with utils.getDefaultString(...), the same way init/taskSessionSecret.ts does.
3. Inject PLATFORM_ADMIN_PASSWORD (and optionally PLATFORM_ADMIN_USERNAME) from the store in main.ts.
4. Update the Show Admin Credentials action to read the generated value instead of the ADMIN_USER / ADMIN_PASSWORD constants in utils.ts.
5. Add a "Reset Admin Password" action (see recipe-reset-password.md).
6. Update README.md limitation 2 and the instructions.md admin section, which currently document the well-known default as the live credential.

This is a behavior change for existing installs — a user who bookmarked the old password would be locked out — so it needs release notes calling it out, and possibly a migration that seeds the store for already-installed services.

Verify on a live box

The 2.x SDK migration and the v1.0.4 bump have been compiled, linted, and packed, but not yet installed and exercised on a StartOS 0.4.0-beta.10+ host. Confirm the service starts, the web UI is reachable, the Spaces credential probe succeeds, and outbound HTTPS to *.startos works with the injected NODE_EXTRA_CA_CERTS.