@open-mercato/cli 0.10.1-develop.7994.1.c9f31972aa → 0.10.1-develop.8004.1.a8a79ee43f

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.10.1-develop.7994.1.c9f31972aa",
+  "version": "0.10.1-develop.8004.1.a8a79ee43f",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/events": "0.10.1-develop.7994.1.c9f31972aa",
-    "@open-mercato/queue": "0.10.1-develop.7994.1.c9f31972aa",
-    "@open-mercato/shared": "0.10.1-develop.7994.1.c9f31972aa",
-    "@open-mercato/telemetry": "0.10.1-develop.7994.1.c9f31972aa",
+    "@open-mercato/events": "0.10.1-develop.8004.1.a8a79ee43f",
+    "@open-mercato/queue": "0.10.1-develop.8004.1.a8a79ee43f",
+    "@open-mercato/shared": "0.10.1-develop.8004.1.a8a79ee43f",
+    "@open-mercato/telemetry": "0.10.1-develop.8004.1.a8a79ee43f",
     "cross-spawn": "^7.0.6",
     "minisearch": "7.2.0",
     "pg": "8.23.0",
@@ -75,10 +75,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7994.1.c9f31972aa"
+    "@open-mercato/shared": "0.10.1-develop.8004.1.a8a79ee43f"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7994.1.c9f31972aa",
+    "@open-mercato/shared": "0.10.1-develop.8004.1.a8a79ee43f",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"

package/src/__tests__/mercato.test.ts

@@ -1112,6 +1112,47 @@ describe('init command failure output', () => {
     )
   }
 
+  it.each(['--reinstall', '--no-demo-users'])('rejects unsafe production init before side effects with %s', async (flag) => {
+    const previousEnv = { ...process.env }
+    jest.spyOn(console, 'error').mockImplementation()
+    jest.spyOn(console, 'log').mockImplementation()
+    const authSetup = jest.fn().mockResolvedValue(undefined)
+    mockInitDependencies({ authSetup })
+    process.env.NODE_ENV = 'production'
+    process.env.OM_INIT_SUPERADMIN_PASSWORD = 'password'
+    try {
+      const mercato = await import('../mercato')
+      expect(await mercato.run(['node', 'mercato', 'init', flag, '--skip-password-policy'])).toBe(1)
+      const { Client } = await import('pg')
+      const { generateEntityIds } = await import('../lib/generators')
+      const { dbMigrate } = await import('../lib/db')
+      expect(Client).not.toHaveBeenCalled()
+      expect(generateEntityIds).not.toHaveBeenCalled()
+      expect(dbMigrate).not.toHaveBeenCalled()
+      expect(authSetup).not.toHaveBeenCalled()
+    } finally {
+      process.env = previousEnv
+    }
+  })
+
+  it('passes valid production credentials to auth setup without bypassing policy', async () => {
+    const previousEnv = { ...process.env }
+    jest.spyOn(console, 'error').mockImplementation()
+    jest.spyOn(console, 'log').mockImplementation()
+    const authSetup = jest.fn().mockResolvedValue(undefined)
+    mockInitDependencies({ authSetup })
+    process.env.NODE_ENV = 'production'
+    process.env.OM_INIT_SUPERADMIN_PASSWORD = 'Unique-Owner-937!'
+    try {
+      const mercato = await import('../mercato')
+      expect(await mercato.run(['node', 'mercato', 'init', '--no-demo-users', '--skip-password-policy'])).toBe(0)
+      expect(authSetup).toHaveBeenCalledWith(expect.arrayContaining(['--password', 'Unique-Owner-937!']))
+      expect(authSetup.mock.calls[0][0]).not.toContain('--skip-password-policy')
+    } finally {
+      process.env = previousEnv
+    }
+  })
+
   it('passes --include-demo-users to auth setup by default', async () => {
     const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
     const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
@@ -1336,6 +1377,22 @@ describe('init on an already initialized database', () => {
     consoleLogSpy.mockRestore()
   })
 
+  it('skips an initialized production database without bootstrap credentials', async () => {
+    const previousEnv = { ...process.env }
+    jest.spyOn(console, 'error').mockImplementation()
+    jest.spyOn(console, 'log').mockImplementation()
+    const { generateEntityIds } = mockSeededDatabase('3')
+    process.env.NODE_ENV = 'production'
+    delete process.env.OM_INIT_SUPERADMIN_PASSWORD
+    try {
+      const mercato = await import('../mercato')
+      expect(await mercato.run(['node', 'mercato', 'init', '--skip-if-initialized'])).toBe(0)
+      expect(generateEntityIds).not.toHaveBeenCalled()
+    } finally {
+      process.env = previousEnv
+    }
+  })
+
   it('keeps the data, names the target database and exits 0 with --skip-if-initialized', async () => {
     const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
     const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()

package/src/i18n/de.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "Das Superadmin-Passwort für die Produktion erfüllt die konfigurierte Passwortrichtlinie nicht. Flags zum Umgehen der Passwortrichtlinie gelten nur außerhalb der Produktion.",
+  "cli.init.errors.superadminPasswordRequired": "Die Produktionsinitialisierung erfordert ein eindeutiges Superadmin-Passwort über OM_INIT_SUPERADMIN_PASSWORD oder --password; integrierte Platzhalter sind nicht zulässig."
+}

package/src/i18n/en.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "Production superadmin password does not meet the configured password policy. Password-policy bypass flags apply only outside production.",
+  "cli.init.errors.superadminPasswordRequired": "Production initialization requires a unique superadmin password via OM_INIT_SUPERADMIN_PASSWORD or --password; built-in placeholders are not allowed."
+}

package/src/i18n/es.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "La contraseña de superadministrador en producción no cumple la política de contraseñas configurada. Las opciones para omitir la política solo se aplican fuera de producción.",
+  "cli.init.errors.superadminPasswordRequired": "La inicialización en producción requiere una contraseña única de superadministrador mediante OM_INIT_SUPERADMIN_PASSWORD o --password; no se permiten los valores predeterminados de ejemplo."
+}

package/src/i18n/ko.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "프로덕션 슈퍼관리자 비밀번호가 설정된 비밀번호 정책을 충족하지 않습니다. 비밀번호 정책 우회 플래그는 프로덕션 외 환경에서만 적용됩니다.",
+  "cli.init.errors.superadminPasswordRequired": "프로덕션 초기화에는 OM_INIT_SUPERADMIN_PASSWORD 또는 --password로 지정한 고유한 슈퍼관리자 비밀번호가 필요합니다. 기본 예시 비밀번호는 사용할 수 없습니다."
+}

package/src/i18n/pl.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "Hasło superadministratora w środowisku produkcyjnym nie spełnia skonfigurowanej polityki haseł. Flagi pomijające politykę haseł działają tylko poza środowiskiem produkcyjnym.",
+  "cli.init.errors.superadminPasswordRequired": "Inicjalizacja produkcyjna wymaga unikalnego hasła superadministratora podanego przez OM_INIT_SUPERADMIN_PASSWORD lub --password; wbudowane hasła przykładowe są niedozwolone."
+}

package/src/lib/__tests__/init-secrets.test.ts

@@ -1,4 +1,6 @@
-import { resolveInitDerivedSecrets } from '../init-secrets'
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+import { resolveInitDerivedSecrets, resolveInitSuperadminCredentials } from '../init-secrets'
 
 describe('resolveInitDerivedSecrets', () => {
   it("seeds the well-known 'secret' password in non-production when no env overrides are set", () => {
@@ -77,3 +79,85 @@ describe('resolveInitDerivedSecrets', () => {
   })
 })
 
+
+describe('production bootstrap superadmin credentials', () => {
+  const production = { NODE_ENV: 'production' }
+
+  it.each([undefined, '', '   ', 'secret', 'password', ' PASSWORD ', 'changeme', 'change-me', 'replace_me'])(
+    'rejects an absent or placeholder production password: %s', (password) => {
+      expect(() => resolveInitSuperadminCredentials([], {
+        ...production, OM_INIT_SUPERADMIN_PASSWORD: password,
+      })).toThrow('requires a unique superadmin password')
+    },
+  )
+
+  it.each(['--skip-password-policy', '--skip-password-policy=true', '--allow-weak-password', '--allow-weak-password=true'])(
+    'enforces production policy despite %s', (flag) => {
+      expect(() => resolveInitSuperadminCredentials([flag, '--password=weak'], production))
+        .toThrow('does not meet the configured password policy')
+      expect(resolveInitSuperadminCredentials([flag, '--password=Unique-Owner-937!'], production).skipPasswordPolicy).toBe(false)
+    },
+  )
+
+  it('uses the configured policy and never includes the password in errors', () => {
+    const password = 'Unique-Owner-937!'
+    expect(() => resolveInitSuperadminCredentials([`--password=${password}`], {
+      ...production, OM_PASSWORD_MIN_LENGTH: '40',
+    })).toThrow('does not meet the configured password policy')
+    try {
+      resolveInitSuperadminCredentials([`--password=${password}`], { ...production, OM_PASSWORD_MIN_LENGTH: '40' })
+    } catch (error) {
+      expect(String(error)).not.toContain(password)
+    }
+  })
+
+  it('rejects placeholders even with a relaxed policy', () => {
+    expect(() => resolveInitSuperadminCredentials([], {
+      ...production, OM_INIT_SUPERADMIN_PASSWORD: 'password', OM_PASSWORD_REQUIRE_DIGIT: 'false',
+      OM_PASSWORD_REQUIRE_UPPERCASE: 'false', OM_PASSWORD_REQUIRE_SPECIAL: 'false',
+    })).toThrow('requires a unique superadmin password')
+  })
+
+  it('prefers command arguments over environment overrides', () => {
+    expect(resolveInitSuperadminCredentials(['--email=owner@example.test', '--password=Unique-Owner-937!'], {
+      NODE_ENV: ' Production ', OM_INIT_SUPERADMIN_PASSWORD: 'password', OM_INIT_SUPERADMIN_EMAIL: 'other@example.test',
+    })).toEqual({ email: 'owner@example.test', password: 'Unique-Owner-937!', skipPasswordPolicy: false })
+  })
+
+  it('uses the CLI locale for operator-facing production diagnostics', () => {
+    expect(() => resolveInitSuperadminCredentials([], { ...production, LC_ALL: 'pl_PL.UTF-8' }))
+      .toThrow('Inicjalizacja produkcyjna wymaga')
+    expect(() => resolveInitSuperadminCredentials([], { ...production, LC_ALL: 'unknown' }))
+      .toThrow('Production initialization requires')
+  })
+
+  it('accepts a policy-compliant environment password', () => {
+    expect(resolveInitSuperadminCredentials([], {
+      ...production, OM_INIT_SUPERADMIN_PASSWORD: 'Unique-Owner-937!',
+    }).password).toBe('Unique-Owner-937!')
+  })
+
+  it.each([undefined, 'development', 'test', 'staging'])('preserves non-production defaults for %s', (nodeEnv) => {
+    expect(resolveInitSuperadminCredentials([], { NODE_ENV: nodeEnv })).toEqual({
+      email: 'superadmin@acme.com', password: 'secret', skipPasswordPolicy: true,
+    })
+    expect(resolveInitSuperadminCredentials([], { NODE_ENV: nodeEnv, OM_INIT_SUPERADMIN_PASSWORD: 'password' }).password).toBe('password')
+    expect(resolveInitSuperadminCredentials(['--skip-password-policy=false'], { NODE_ENV: nodeEnv }).skipPasswordPolicy).toBe(false)
+  })
+})
+
+describe('full-app Compose bootstrap defaults', () => {
+  it.each(['starters/docker/compose.fullapp.yml', 'packages/create-app/template/docker-compose.fullapp.yml'])(
+    '%s cannot bootstrap predictable production credentials', (composePath) => {
+      const compose = readFileSync(path.resolve(__dirname, '../../../../..', composePath), 'utf8')
+      const fallback = compose.match(/OM_INIT_SUPERADMIN_PASSWORD: \$\{OM_INIT_SUPERADMIN_PASSWORD:-(.*?)\}/)?.[1]
+      expect(fallback).toBeDefined()
+      expect(() => resolveInitSuperadminCredentials([], {
+        NODE_ENV: 'production', OM_INIT_SUPERADMIN_PASSWORD: fallback,
+      })).toThrow('requires a unique superadmin password')
+      expect(resolveInitSuperadminCredentials([], {
+        NODE_ENV: 'development', OM_INIT_SUPERADMIN_PASSWORD: fallback,
+      }).password).toBe(fallback)
+    },
+  )
+})

package/src/lib/init-secrets.ts

@@ -1,5 +1,17 @@
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { randomBytes } from 'node:crypto'
+import { createTranslator } from '@open-mercato/shared/lib/i18n/translate'
+import { createRequire } from 'node:module'
+
+const requireLocale = createRequire(import.meta.url)
+
+function initTranslator(env: NodeJS.ProcessEnv) {
+  const locale = (env.LC_ALL || env.LC_MESSAGES || env.LANG || 'en').split(/[_.-]/)[0].toLowerCase()
+  const supportedLocale = ['en', 'pl', 'es', 'de', 'ko'].includes(locale) ? locale : 'en'
+  const dictionary: Record<string, string> = requireLocale(`../i18n/${supportedLocale}.json`)
+  return createTranslator(dictionary)
+}
 
 type EnvReader = (key: string) => string | undefined
 
@@ -71,3 +83,28 @@ export function resolveInitDerivedSecrets(options: {
     employeePassword: resolvePassword('OM_INIT_EMPLOYEE_PASSWORD', employeeEmail),
   }
 }
+
+export function resolveInitSuperadminCredentials(args: string[], env: NodeJS.ProcessEnv = process.env) {
+  const argValue = (name: string) => args.find((arg) => arg.startsWith(`${name}=`))?.slice(name.length + 1) || undefined
+  const email = argValue('--email') ?? readEnvValue(env, 'OM_INIT_SUPERADMIN_EMAIL') ?? 'superadmin@acme.com'
+  const suppliedPassword = argValue('--password') ?? readEnvValue(env, 'OM_INIT_SUPERADMIN_PASSWORD')
+  const isProduction = (env.NODE_ENV ?? '').trim().toLowerCase() === 'production'
+  const skipPolicyArg = args.find((arg) =>
+    arg === '--skip-password-policy' || arg.startsWith('--skip-password-policy=') ||
+    arg === '--allow-weak-password' || arg.startsWith('--allow-weak-password='),
+  )
+  const skipPasswordPolicy = !isProduction && (skipPolicyArg
+    ? parseBooleanToken(skipPolicyArg.split('=')[1] ?? 'true') ?? true
+    : true)
+  if (isProduction) {
+    const t = initTranslator(env)
+    const placeholder = suppliedPassword?.trim().toLowerCase()
+    if (!suppliedPassword || !placeholder || ['secret', 'password', 'changeme', 'change-me', 'change_me', 'replace-me', 'replace_me'].includes(placeholder)) {
+      throw new Error(t('cli.init.errors.superadminPasswordRequired'))
+    }
+    if (!validatePassword(suppliedPassword, getPasswordPolicy(env)).ok) {
+      throw new Error(t('cli.init.errors.superadminPasswordPolicy'))
+    }
+  }
+  return { email, password: suppliedPassword ?? 'secret', skipPasswordPolicy }
+}

package/src/mercato.ts

@@ -10,7 +10,7 @@ import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { getSslConfig } from '@open-mercato/shared/lib/db/ssl'
 import { getRedisUrl, getRedisUrlOrThrow, parseRedisUrl } from '@open-mercato/shared/lib/redis/connection'
 import { formatInitSummary } from './lib/init-summary'
-import { resolveInitDerivedSecrets } from './lib/init-secrets'
+import { resolveInitDerivedSecrets, resolveInitSuperadminCredentials } from './lib/init-secrets'
 import { decideExistingDatabase, formatSkipIfInitializedMessage } from './lib/init-existing-database'
 import {
   resolveAutoSpawnWorkersMode,
@@ -1032,6 +1032,7 @@ export async function run(argv = process.argv) {
         delete process.env.OM_INIT_REINSTALL
       }
       const skipIfInitialized = initArgs.includes('--skip-if-initialized')
+      const credentials = skipIfInitialized && !reinstall ? undefined : resolveInitSuperadminCredentials(initArgs)
       const skipExamples = initArgs.includes('--no-examples')
       const skipDemoUsers = initArgs.includes('--no-demo-users')
       const stressTestEnabled =
@@ -1209,6 +1210,8 @@ export async function run(argv = process.argv) {
         }
       }
 
+      const { email, password, skipPasswordPolicy } = credentials ?? resolveInitSuperadminCredentials(initArgs)
+
       // Step 1: Run generators directly (no process spawn)
       console.log('🔧 Preparing modules (registry, entities, DI)...')
       const { createResolver } = await import('./lib/resolver')
@@ -1257,16 +1260,7 @@ export async function run(argv = process.argv) {
         }
         return fallback
       }
-      const readEnvDefault = (key: string) => {
-        const value = process.env[key]
-        if (typeof value === 'string' && value.trim().length > 0) return value.trim()
-        return undefined
-      }
-      const defaultEmail = readEnvDefault('OM_INIT_SUPERADMIN_EMAIL') ?? 'superadmin@acme.com'
-      const defaultPassword = readEnvDefault('OM_INIT_SUPERADMIN_PASSWORD') ?? 'secret'
       const orgName = findArgValue(['--org=', '--orgName='], 'Acme Corp')
-      const email = findArgValue(['--email='], defaultEmail)
-      const password = findArgValue(['--password='], defaultPassword)
       const derivedSecrets = resolveInitDerivedSecrets({ email, env: process.env })
       const adminEmailDerived = derivedSecrets.adminEmail
       const employeeEmailDerived = derivedSecrets.employeeEmail
@@ -1300,16 +1294,6 @@ export async function run(argv = process.argv) {
         process.env.OM_INIT_EMPLOYEE_EMAIL = employeeEmailDerived
       }
       const roles = findArgValue(['--roles='], 'superadmin,admin,employee')
-      const skipPasswordPolicyRaw = initArgs.find((arg) =>
-        arg === '--skip-password-policy' ||
-        arg.startsWith('--skip-password-policy=') ||
-        arg === '--allow-weak-password' ||
-        arg.startsWith('--allow-weak-password=')
-      )
-      const skipPasswordPolicy = skipPasswordPolicyRaw
-        ? parseBooleanToken(skipPasswordPolicyRaw.split('=')[1] ?? 'true') ?? true
-        : true
-
       console.log('🔐 Setting up RBAC and users...')
       // Run auth setup command via CLI
       const setupArgs = [