43 lines
1.9 KiB
Markdown
43 lines
1.9 KiB
Markdown
# TODO
|
|
|
|
## Set a generated admin password
|
|
|
|
The app resolves its admin Basic Auth credentials as:
|
|
|
|
```js
|
|
const ADMIN_USERNAME = process.env.PLATFORM_ADMIN_USERNAME || 'admin'
|
|
const ADMIN_PASSWORD = process.env.PLATFORM_ADMIN_PASSWORD || 'Whatever!'
|
|
```
|
|
|
|
(verified in `/app/server.js` of `spacesops/spacesops:v1.0.4`)
|
|
|
|
These are **defaults, not hardcoded values** — both are overridable via
|
|
environment variables. The package currently sets neither, so every install
|
|
ships the same publicly known admin password, guarding an area that can run SQL
|
|
and manage tenants.
|
|
|
|
The fix mirrors what the package already does for `PLATFORM_SESSION_SECRET`:
|
|
|
|
1. Add an `adminPassword` field to `fileModels/storeJson.ts`.
|
|
2. Seed it in a `setupOnInit` task with `utils.getDefaultString(...)`, the same
|
|
way `init/taskSessionSecret.ts` does.
|
|
3. Inject `PLATFORM_ADMIN_PASSWORD` (and optionally
|
|
`PLATFORM_ADMIN_USERNAME`) from the store in `main.ts`.
|
|
4. Update the **Show Admin Credentials** action to read the generated value
|
|
instead of the `ADMIN_USER` / `ADMIN_PASSWORD` constants in `utils.ts`.
|
|
5. Add a "Reset Admin Password" action (see `recipe-reset-password.md`).
|
|
6. Update `README.md` limitation 2 and the `instructions.md` admin section,
|
|
which currently document the well-known default as the live credential.
|
|
|
|
This is a behavior change for existing installs — a user who bookmarked the old
|
|
password would be locked out — so it needs release notes calling it out, and
|
|
possibly a migration that seeds the store for already-installed services.
|
|
|
|
## Verify on a live box
|
|
|
|
The 2.x SDK migration and the v1.0.4 bump have been compiled, linted, and
|
|
packed, but not yet installed and exercised on a StartOS 0.4.0-beta.10+ host.
|
|
Confirm the service starts, the web UI is reachable, the Spaces credential probe
|
|
succeeds, and outbound HTTPS to `*.startos` works with the injected
|
|
`NODE_EXTRA_CA_CERTS`.
|