axiodb 22.14.1 → 22.16.0

package/README.md

@@ -114,17 +114,22 @@ Node.js ≥20 and npm are required; the command offers platform-specific
 installation help when they are missing.
 
 ```bash
-axiodb serve http       # HTTP API only: http://localhost:27018/api
-axiodb serve tcp        # TCP without authentication: axiodb://localhost:27019
-axiodb serve tcp-auth   # TCP authentication only
-axiodb serve full       # HTTP + authenticated TCP, GUI disabled
+axiodb serve http                 # HTTP API only: http://localhost:27018/api
+axiodb serve tcp                  # TCP without authentication: axiodb://localhost:27019
+axiodb serve tcp-auth             # TCP authentication only
+axiodb serve full                 # HTTP + authenticated TCP, GUI disabled
+axiodb serve tcp-auth mypassword  # same, seeding admin with mypassword
 ```
 
-The HTTP and TCP ports are fixed at `27018` and `27019`. The `tcp-auth` preset
-seeds `admin/admin`, but the server requires the first password change through
-HTTP/GUI and TCP currently has no password-change command, so this preset is
-intended for inspecting the authentication server setup rather than immediate
-authenticated client access.
+The HTTP and TCP ports are fixed at `27018` and `27019`. The `http`, `tcp-auth`
+and `full` presets seed the shared `admin` account; pass an optional password as
+the second argument to choose it yourself and skip the forced first-login change.
+Without one, `admin/admin` is seeded and TCP refuses it until the password is
+changed through HTTP/GUI, since TCP has no password-change command. The `tcp`
+preset creates no admin account and rejects the password argument.
+
+When embedding, the same option is `AdminPassword` in the `AxioDB` constructor.
+In Docker it is `AXIODB_ADMIN_PASSWORD`.
 
 
 ## Basic CRUD

package/lib/Services/Auth/AuthSeeder.service.d.ts

@@ -7,7 +7,8 @@ import { AxioDB } from "../Indexation.operation";
  */
 export default class AuthSeeder {
     private readonly axioDBInstance;
-    constructor(axioDBInstance: AxioDB);
+    private readonly adminPassword?;
+    constructor(axioDBInstance: AxioDB, adminPassword?: string);
     seedIfNeeded(): Promise<void>;
     private seedPermissions;
     private seedRoles;

package/lib/Services/Auth/AuthSeeder.service.js

@@ -23,8 +23,9 @@ const Permissions_1 = require("../../config/Keys/Permissions");
  * where seeding itself is a no-op but the cache still needs rebuilding).
  */
 class AuthSeeder {
-    constructor(axioDBInstance) {
+    constructor(axioDBInstance, adminPassword) {
         this.axioDBInstance = axioDBInstance;
+        this.adminPassword = adminPassword;
     }
     seedIfNeeded() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -72,12 +73,13 @@ class AuthSeeder {
     }
     seedDefaultAdmin(usersCollection) {
         return __awaiter(this, void 0, void 0, function* () {
-            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(Permissions_1.DEFAULT_ADMIN_PASSWORD);
+            const password = this.adminPassword || Permissions_1.DEFAULT_ADMIN_PASSWORD;
+            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(password);
             const document = {
                 username: Permissions_1.DEFAULT_ADMIN_USERNAME,
                 passwordHash,
                 role: Permissions_1.SUPER_ADMIN_ROLE,
-                mustChangePassword: true,
+                mustChangePassword: !this.adminPassword,
                 isActive: true,
                 createdAt: new Date().toISOString(),
             };

package/lib/Services/Indexation.operation.d.ts

@@ -34,6 +34,7 @@ export declare class AxioDB {
     private HTTP;
     private TCP;
     private TCPAuth;
+    private readonly AdminPassword?;
     private TLS;
     private ready;
     private _initializing;

package/lib/Services/Indexation.operation.js

@@ -63,7 +63,7 @@ class AxioDB {
             throw new Error("Only one instance of AxioDB is allowed.");
         }
         AxioDB._instance = this;
-        const { GUI, RootName, CustomPath, TCP, TCPAuth, TLS, TLSCertPath, TLSKeyPath, Cache, minTTL, maxTTL, cacheClearUp } = options;
+        const { GUI, RootName, CustomPath, TCP, TCPAuth, AdminPassword, TLS, TLSCertPath, TLSKeyPath, Cache, minTTL, maxTTL, cacheClearUp } = options;
         this.RootName = RootName || Keys_1.General.DBMS_Name;
         this.currentPATH = path_1.default.resolve(CustomPath || ".");
         this.fileManager = new FileManager_1.default();
@@ -81,6 +81,7 @@ class AxioDB {
         this.HTTP = options.HTTP !== undefined ? options.HTTP : (this.GUI ? true : false);
         this.TCP = TCP !== undefined ? TCP : false;
         this.TCPAuth = TCPAuth !== undefined ? TCPAuth : false;
+        this.AdminPassword = AdminPassword;
         this.TLS = TLS !== undefined ? TLS : false;
         this.TLSCertPath = TLSCertPath;
         this.TLSKeyPath = TLSKeyPath;
@@ -125,7 +126,7 @@ class AxioDB {
                 }
             }
             if (this.GUI || this.HTTP || (this.TCP && this.TCPAuth)) {
-                yield new AuthSeeder_service_1.default(this).seedIfNeeded();
+                yield new AuthSeeder_service_1.default(this, this.AdminPassword).seedIfNeeded();
                 LoginRateLimiter_service_1.default.startCleanupSweep();
             }
             if (this.HTTP) {

package/lib/config/Interfaces/Operation/Indexation.operation.interface.d.ts

@@ -8,6 +8,12 @@ export interface AxioDBOptions {
     TCP?: boolean;
     /** Require username/password authentication (same RBAC users as the GUI) for TCP connections. Defaults to false. */
     TCPAuth?: boolean;
+    /**
+     * Initial password for the seeded `admin` account, applied only when the `config` database
+     * is first created. Sets `mustChangePassword: false` so the account is immediately usable
+     * over TCP; omitting it keeps the default `admin`/`admin` and the existing rotation gate.
+     */
+    AdminPassword?: string;
     /** Encrypt TCP connections with TLS instead of plaintext. Requires `TLSCertPath` and `TLSKeyPath`. Defaults to false - existing plaintext deployments are unaffected unless this is explicitly turned on. */
     TLS?: boolean;
     /** Path to a PEM-encoded TLS certificate file. Required when `TLS: true`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axiodb",
-  "version": "22.14.1",
+  "version": "22.16.0",
   "description": "The embedded database for Node.js. Replaces SQLite, LowDB, NeDB & raw JSON files with MongoDB-style queries, ACID transactions, zero native dependencies, and built-in InMemoryCache. No compilation, no platform issues. Perfect for desktop apps, CLI tools, and embedded systems.",
   "main": "./lib/config/DB.js",
   "types": "./lib/config/DB.d.ts",