@hilbras/omnihilbras 2.9.2 → 2.9.4

package/src/cli/menus/settings.js

@@ -13,8 +13,6 @@ const COLORS = {
   cyan: "\x1b[36m"
 };
 
-const DEFAULT_PASSWORD = "123456";
-
 /**
  * Show settings menu (tunnel + RTK + reset password)
  * @param {Array<string>} breadcrumb - Breadcrumb path
@@ -83,7 +81,7 @@ async function showSettingsMenu(breadcrumb = []) {
         action: async (d) => { await toggleHeadroom(d?.settings?.headroomEnabled === true); return true; }
       },
       {
-        label: "🔑 Reset Password to Default",
+        label: "🔑 Reset Password",
         action: async () => { await resetPassword(); return true; }
       },
       {
@@ -181,22 +179,32 @@ async function toggleHeadroom(currentlyOn) {
 }
 
 /**
- * Reset dashboard password to default via server API (writes the live SQLite DB).
- * After reset, user can log in with the default password "123456".
+ * Reset the dashboard password.
+ *
+ * It used to clear the stored hash, which put the install back on the public
+ * default — a password that is in every screenshot of this project. It now
+ * generates a new one and shows it, once.
  */
 async function resetPassword() {
-  const ok = await confirm(`Reset dashboard password to default "${DEFAULT_PASSWORD}"?`);
+  const ok = await confirm("Reset the dashboard password? A new one is generated and shown once.");
   if (!ok) {
     showStatus("Cancelled", "info");
     await pause();
     return;
   }
 
-  const result = await api.resetPassword();
-  if (result.success) {
-    showStatus(`Password reset. Default: ${DEFAULT_PASSWORD}`, "success");
-  } else {
-    showStatus(`Failed to reset password: ${result.error}`, "error");
+  try {
+    // setInitialPassword generates a real password, hashes and stores it, writes
+    // it to the operator-readable file once, and returns the plaintext so the
+    // CLI can show it. (The old api.resetPassword() returned { success } with no
+    // password, so result.password was always undefined here.)
+    const { setInitialPassword } = await import("../../../../src/lib/auth/initialPassword.js");
+    const password = await setInitialPassword();
+    showStatus("Password reset.", "success");
+    console.log(`\n  🔑 New dashboard password: ${password}`);
+    console.log("     Change it in the dashboard (Profile → Security).\n");
+  } catch (err) {
+    showStatus(`Failed to reset password: ${err.message}`, "error");
   }
   await pause();
 }

package/src/cli/utils/initialPassword.js

@@ -0,0 +1,22 @@
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+/**
+ * The initial dashboard password, if the gateway has not been given one yet.
+ *
+ * A fresh install gets a password that nobody else knows: the gateway
+ * generates it on the first boot, stores the hash, and writes the plain text
+ * next to its other secrets (0600). The CLI shows it, so the operator does not
+ * have to go looking for the file.
+ */
+function readInitialPassword() {
+  try {
+    const dataDir = process.env.DATA_DIR || path.join(os.homedir(), ".omnihilbras");
+    return fs.readFileSync(path.join(dataDir, "initial-password"), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { readInitialPassword };