create-windy 0.2.6 → 0.2.7

package/README.md

@@ -99,9 +99,14 @@ bun run dev
 ```
 
 create-windy 会生成仅供本机使用、被 Git 忽略且权限为 `0600` 的 `.env`，其中数据库
-与管理员开发密码均为随机值。`bun run dev` 会通过 Docker Compose 等待 PostgreSQL、
-执行 migration，再启动 Server 与 Web；首次运行前需安装并启动 Docker 与 Docker
-Compose。
+与管理员开发密码均为随机值。全新数据库的初始平台账号固定为 `admin`，初始密码查看
+`.env` 中的 `WINDY_BOOTSTRAP_ADMIN_PASSWORD`；创建器只提示密码位置，不会把随机密码
+直接打印在终端。首次登录必须修改密码，新密码需要 12-128 个字符，且不能与当前密码
+相同。
+
+`bun run dev` 会通过 Docker Compose 等待 PostgreSQL、执行 migration，再启动 Server
+与 Web；首次运行前需安装并启动 Docker 与 Docker Compose。环境变量只负责初始化全新
+数据库，数据库已有管理员后，重启服务不会重新覆盖其密码。
 
 只调试单个应用时可分别使用 `bun run dev:web` 和 `bun run dev:server`。`dev:web` 不会
 隐式启动后端；`dev:server` 也不会自动启动 PostgreSQL 或执行 migration。

package/dist/cli.js

@@ -1443,6 +1443,14 @@ bun run dev:server
 
 ## 页面与登录
 
+全新数据库的初始平台账号为 \`admin\`。初始密码不是所有项目共用的固定值，而是
+create-windy 在本机 \`.env\` 中随机生成的 \`WINDY_BOOTSTRAP_ADMIN_PASSWORD\`；该文件已
+被 Git 忽略，请在本机直接查看，不要把密码提交到仓库或复制到文档。首次登录会要求
+立即修改密码，新密码必须为 12-128 个字符，且不能与当前密码相同。
+
+\`.env\` 只负责全新数据库的首次初始化。账号密码写入数据库后，重启不会用环境变量
+覆盖已有密码；如果已经完成首次改密，应使用修改后的密码登录。
+
 | 路径 | 访问要求 | 说明 |
 | ---- | -------- | ---- |
 | \`/login\` | 公开 | 登录成功后回到安全的站内目标，默认进入 \`/\` |
@@ -1907,6 +1915,8 @@ async function createProject(options, dependencies = {}) {
   log(`运行时：Bun ${bunVersion}`);
   log(options.initializeGit ? gitInitialized ? "Git：已创建 main 分支和首次提交" : "Git：项目已保留，请按上述提示完成初始化" : "Git：已按 --no-git 跳过");
   log(localEnvironment === "created" ? "本地 .env：已生成随机开发密码（权限 0600）" : "本地 .env：已存在，未覆盖");
+  log("初始平台账号：admin");
+  log("初始平台密码：查看 .env 中的 WINDY_BOOTSTRAP_ADMIN_PASSWORD（首次登录后必须修改）");
   log("下一步（启动数据库、迁移、后端与前端）：");
   log(`  cd ${options.projectName}`);
   log("  bun run dev");
@@ -3897,7 +3907,8 @@ var recipes = [
   { id: "starter-0.2.2-to-0.2.3", from: "0.2.2", to: "0.2.3" },
   { id: "starter-0.2.3-to-0.2.4", from: "0.2.3", to: "0.2.4" },
   { id: "starter-0.2.4-to-0.2.5", from: "0.2.4", to: "0.2.5" },
-  { id: "starter-0.2.5-to-0.2.6", from: "0.2.5", to: "0.2.6" }
+  { id: "starter-0.2.5-to-0.2.6", from: "0.2.5", to: "0.2.6" },
+  { id: "starter-0.2.6-to-0.2.7", from: "0.2.6", to: "0.2.7" }
 ];
 function resolveRecipeChain(sourceVersion, targetVersion) {
   if (sourceVersion === targetVersion)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-windy",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "创建单组织、单租户、私有部署优先的 Windy 企业 Dashboard Starter",
   "type": "module",
   "bin": {

package/template/.windy-template.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "templateCommit": "8b44208f73dcd5879232b3151c5344abfaeff53e",
-  "generatorVersion": "0.2.6",
+  "templateCommit": "93d68f895e71560c1f85d283dce5d8b94edfd09f",
+  "generatorVersion": "0.2.7",
   "modules": [
     {
       "name": "system",

package/template/README.md

@@ -52,6 +52,14 @@ bun run dev:server
 
 ## 页面与登录
 
+全新数据库的初始平台账号为 `admin`。初始密码不是所有项目共用的固定值，而是
+create-windy 在本机 `.env` 中随机生成的 `WINDY_BOOTSTRAP_ADMIN_PASSWORD`；该文件已
+被 Git 忽略，请在本机直接查看，不要把密码提交到仓库或复制到文档。首次登录会要求
+立即修改密码，新密码必须为 12-128 个字符，且不能与当前密码相同。
+
+`.env` 只负责全新数据库的首次初始化。账号密码写入数据库后，重启不会用环境变量
+覆盖已有密码；如果已经完成首次改密，应使用修改后的密码登录。
+
 | 路径 | 访问要求 | 说明 |
 | ---- | -------- | ---- |
 | `/login` | 公开 | 登录成功后回到安全的站内目标，默认进入 `/` |

package/template/apps/server/src/auth/password.ts

@@ -1,9 +1,7 @@
 import argon2, { argon2id } from "argon2";
+import { PASSWORD_POLICY } from "@windy/shared";
 
-export const PASSWORD_POLICY = {
-  minLength: 12,
-  maxLength: 128,
-} as const;
+export { PASSWORD_POLICY } from "@windy/shared";
 
 const ARGON2_OPTIONS = {
   type: argon2id,

package/template/apps/web/src/components/auth/PasswordChangeForm.vue

@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import { computed, shallowRef } from "vue";
 import { KeyRoundIcon, LoaderCircleIcon } from "@lucide/vue";
+import { PASSWORD_POLICY } from "@windy/shared";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import type { PasswordChangeInput } from "@/services/auth-api";
@@ -11,7 +12,20 @@ const emit = defineEmits<{ submit: [input: PasswordChangeInput] }>();
 const currentPassword = shallowRef("");
 const newPassword = shallowRef("");
 const confirmation = shallowRef("");
-const localError = computed(() => {
+const newPasswordError = computed(() => {
+  if (!newPassword.value) return "";
+  if (newPassword.value.length < PASSWORD_POLICY.minLength) {
+    return `新密码至少需要 ${PASSWORD_POLICY.minLength} 个字符，当前为 ${newPassword.value.length} 个。`;
+  }
+  if (newPassword.value.length > PASSWORD_POLICY.maxLength) {
+    return `新密码不能超过 ${PASSWORD_POLICY.maxLength} 个字符。`;
+  }
+  if (currentPassword.value && newPassword.value === currentPassword.value) {
+    return "新密码不能与当前密码相同。";
+  }
+  return "";
+});
+const confirmationError = computed(() => {
   if (confirmation.value && confirmation.value !== newPassword.value) {
     return "两次输入的新密码不一致";
   }
@@ -21,7 +35,9 @@ const canSubmit = computed(
   () =>
     !props.loading &&
     currentPassword.value.length > 0 &&
-    newPassword.value.length >= 12 &&
+    newPassword.value.length > 0 &&
+    !newPasswordError.value &&
+    !confirmationError.value &&
     newPassword.value === confirmation.value,
 );
 
@@ -54,12 +70,31 @@ function submit() {
         v-model="newPassword"
         type="password"
         autocomplete="new-password"
-        minlength="12"
-        maxlength="128"
+        :minlength="PASSWORD_POLICY.minLength"
+        :maxlength="PASSWORD_POLICY.maxLength"
+        :aria-describedby="
+          newPasswordError
+            ? 'new-password-help new-password-error'
+            : 'new-password-help'
+        "
+        :aria-invalid="Boolean(newPasswordError)"
         :disabled="loading"
         required
       />
-      <p class="text-xs text-muted-foreground">请输入 12-128 个字符。</p>
+      <p id="new-password-help" class="text-xs text-muted-foreground">
+        密码要求：{{ PASSWORD_POLICY.minLength }}-{{
+          PASSWORD_POLICY.maxLength
+        }}
+        个字符，且不能与当前密码相同。
+      </p>
+      <p
+        v-if="newPasswordError"
+        id="new-password-error"
+        class="text-sm text-destructive"
+        role="alert"
+      >
+        {{ newPasswordError }}
+      </p>
     </div>
     <div class="space-y-2">
       <label for="confirm-password" class="text-sm font-medium"
@@ -70,12 +105,22 @@ function submit() {
         v-model="confirmation"
         type="password"
         autocomplete="new-password"
+        :aria-describedby="confirmationError ? 'confirmation-error' : undefined"
+        :aria-invalid="Boolean(confirmationError)"
         :disabled="loading"
         required
       />
+      <p
+        v-if="confirmationError"
+        id="confirmation-error"
+        class="text-sm text-destructive"
+        role="alert"
+      >
+        {{ confirmationError }}
+      </p>
     </div>
-    <p v-if="localError || error" class="text-sm text-destructive" role="alert">
-      {{ localError || error }}
+    <p v-if="error" class="text-sm text-destructive" role="alert">
+      {{ error }}
     </p>
     <Button type="submit" class="w-full" :disabled="!canSubmit">
       <LoaderCircleIcon

package/template/apps/web/src/components/auth/PasswordChangeForm.webtest.ts

@@ -0,0 +1,43 @@
+import { mount } from "@vue/test-utils";
+import { describe, expect, test } from "vitest";
+import PasswordChangeForm from "./PasswordChangeForm.vue";
+
+describe("首次改密表单", () => {
+  test("输入过短密码时立即说明原因并保持提交禁用", async () => {
+    const wrapper = mount(PasswordChangeForm);
+
+    await wrapper.get("#current-password").setValue("initial-password");
+    await wrapper.get("#new-password").setValue("weak");
+    await wrapper.get("#confirm-password").setValue("weak");
+
+    expect(wrapper.get("[role='alert']").text()).toBe(
+      "新密码至少需要 12 个字符，当前为 4 个。",
+    );
+    expect(wrapper.get("button[type='submit']").attributes()).toHaveProperty(
+      "disabled",
+    );
+    expect(wrapper.emitted("submit")).toBeUndefined();
+  });
+
+  test("满足规则且两次一致后允许提交", async () => {
+    const wrapper = mount(PasswordChangeForm);
+
+    await wrapper.get("#current-password").setValue("initial-password");
+    await wrapper.get("#new-password").setValue("new-password-2026");
+    await wrapper.get("#confirm-password").setValue("new-password-2026");
+
+    expect(wrapper.find("[role='alert']").exists()).toBe(false);
+    expect(
+      wrapper.get("button[type='submit']").attributes("disabled"),
+    ).toBeUndefined();
+    await wrapper.get("form").trigger("submit");
+    expect(wrapper.emitted("submit")).toEqual([
+      [
+        {
+          currentPassword: "initial-password",
+          newPassword: "new-password-2026",
+        },
+      ],
+    ]);
+  });
+});

package/template/packages/shared/index.ts

@@ -6,6 +6,7 @@ export * from "./src/license.js";
 export * from "./src/module-configuration.js";
 export * from "./src/correlation.js";
 export * from "./src/notification.js";
+export * from "./src/password.js";
 export * from "./src/platform-settings.js";
 export * from "./src/profile.js";
 export * from "./src/primitives.js";

package/template/packages/shared/src/password.ts

@@ -0,0 +1,4 @@
+export const PASSWORD_POLICY = {
+  minLength: 12,
+  maxLength: 128,
+} as const;