theta42/proxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Release 1.1.18: fix bootstrap admin lockout, refresh screenshots

Browse Source 
models/user_redis.js hardcoded the bootstrap anti-lockout admin
username to 'proxyadmin2', while migrations/permission_bootstrap.js
grants the global-admin permission to conf.auth.adminUsers[0]. An
operator who customized adminUsers away from the default ended up
with a bootstrapped account that had no admin permissions -- a
silent lockout. user_redis.js now derives the bootstrap username the
same way permission_bootstrap.js does.

Also corrected a secrets.js.example comment that claimed the
bootstrap password defaults to the username itself (it actually
generates and logs a random password), and refreshed all README
screenshots against the current UI, including a new load-balancing
screenshot.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-21 02:04:26 -04:00
parent 93cf034e61
commit bb1b84b56d
10 changed files with 29 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/models/user_redis.js
+5 -1
View File
@@ -87,7 +87,11 @@ class User extends Table{
User.register();
(async function(){
var defaultUser = 'proxyadmin2'
// Matches migrations/permission_bootstrap.js: the anti-lockout account is
// the first entry in conf.auth.adminUsers (default 'proxyadmin2'), NOT a
// hardcoded name -- otherwise an operator who customizes adminUsers ends
// up with a bootstrap account that has no admin permissions.
var defaultUser = (conf.auth && conf.auth.adminUsers && conf.auth.adminUsers[0]) || 'proxyadmin2';
// Optional: an orchestrator (e.g. theta-env's setup.sh) can set
// auth.localAdminPass in proxy-secrets.js to a generated password so this
// bootstrap account isn't left at a well-known default. Only used on first