chaas/imc-vibe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Remove ADMIN_PASSWORD configuration

Browse source 
Authentication now works only via hashed passwords in imc_users table.
Users must be created through the password reset flow or directly in the database.
This commit is contained in:
Christoph Haas 2026-03-23 21:28:52 +01:00
parent 3e30f3845d
commit b76ea568ae
5 changed files with 7 additions and 97 deletions
Download patch file Download diff file Expand all files Collapse all files

8
backend/internal/config/config.go
View file

@ -28,10 +28,6 @@ type Config struct {
JWTSecret string // Secret key for signing JWT tokens (keep this secret!)
TrustedProxies []string // IPs of trusted reverse proxies (for X-Forwarded-For)
// Admin user configuration (used when --reset-admin-password is not used)
AdminUser string // Username for the admin account
AdminPassword string // Password for the admin account (only used during startup)
// Mail server paths and settings
MailDataDir string // Directory where mail is stored (e.g., /var/vmail)
PostqueuePath string // Path to postqueue command (for mail queue operations)
@ -94,10 +90,6 @@ func Load() *Config {
// Default JWT secret is insecure - must be changed in production!
JWTSecret: getEnv("JWT_SECRET", "change-this-secret-in-production"),
// Admin user (optional - used during startup if set)
AdminUser: getEnv("ADMIN_USER", ""),
AdminPassword: getEnv("ADMIN_PASSWORD", ""),
// Mail server paths
MailDataDir: getEnv("MAIL_DATA_DIR", "/var/vmail"),
PostqueuePath: getEnv("POSTQUEUE_PATH", "/usr/sbin/postqueue"),

17
backend/internal/db/imc_users.go
View file

@ -68,23 +68,6 @@ func (d *DB) DeleteImcUser(id uint) error {
return d.Delete(&ImcUser{}, id).Error // Delete by primary key
}
// EnsureAdminUser creates the admin user if it doesn't exist, or updates the password if it does.
// This is used during --reset-admin-password and startup.
// username: always "admin" in our case.
// passwordHash: the bcrypt hash of the password.
func (d *DB) EnsureAdminUser(username, passwordHash string) error {
var user ImcUser
// Try to find an existing admin user with this username.
err := d.Where("username = ? AND role = ?", username, "admin").First(&user).Error
if err == nil {
// User exists - update their password.
return d.Model(&ImcUser{}).Where("id = ?", user.ID).Update("password_hash", passwordHash).Error
}
// User doesn't exist - create them.
_, err = d.CreateImcUser(username, passwordHash, "admin")
return err
}
// =============================================================================
// Domain Access Control
// These functions manage which domains users can access.