zevairouter 1.0.164 → 1.0.166

package/cli/app/.next-cli-build/static/chunks/app/login/{page-f7df7d9a053d65b7.js → page-e117fe524fd03da3.js}

@@ -1 +1 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[4520],{7911:(e,t,s)=>{Promise.resolve().then(s.bind(s,83016))},83016:(e,t,s)=>{"use strict";s.r(t),s.d(t,{default:()=>l});var a=s(95155),r=s(12115),i=s(35497),n=s(73321);function l(){let[e,t]=(0,r.useState)(""),[s,l]=(0,r.useState)(""),[d,o]=(0,r.useState)(""),[c,x]=(0,r.useState)(0),[h,u]=(0,r.useState)(!1),[m,p]=(0,r.useState)(null),[b,f]=(0,r.useState)(!1),[g,j]=(0,r.useState)("password"),[w,N]=(0,r.useState)(!1),[v,y]=(0,r.useState)("Sign in with OIDC"),S=(0,n.useRouter)();(0,r.useEffect)(()=>{if(c<=0)return;let e=setInterval(()=>x(e=>e>0?e-1:0),1e3);return()=>clearInterval(e)},[c]),(0,r.useEffect)(()=>{!async function(){let e=new AbortController,t=setTimeout(()=>e.abort(),5e3),s=window.location.origin;try{let a=await fetch(`${s}/api/auth/status`,{signal:e.signal});if(clearTimeout(t),a.ok){let e=await a.json();if(!1===e.requireLogin){S.push("/dashboard"),S.refresh();return}p(!!e.hasPassword),f(!0===e.initialPasswordConfigured),j(e.authMode||"password"),N(!0===e.oidcConfigured),y(e.oidcLoginLabel||"Sign in with OIDC")}else p(!0)}catch(e){clearTimeout(t),p(!0)}}()},[S]);let C=async t=>{t.preventDefault(),u(!0),l(""),o("");try{let t=await fetch("/api/auth/login",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({password:e})});if(t.ok)S.push("/dashboard"),S.refresh();else{let e=await t.json();l(e.error||"Invalid password"),e.resetHint&&o(e.resetHint),e.retryAfter&&x(Number(e.retryAfter))}}catch(e){l("An error occurred. Please try again.")}finally{u(!1)}},k=w&&["oidc","both"].includes(g),O="oidc"!==g||!w;return null===m?(0,a.jsx)("div",{className:"min-h-screen flex items-center justify-center bg-bg p-4",children:(0,a.jsxs)("div",{className:"text-center",children:[(0,a.jsx)("div",{className:"inline-block animate-spin rounded-full h-8 w-8 border-b-2 border-primary"}),(0,a.jsx)("p",{className:"text-text-muted mt-4",children:"Loading..."})]})}):(0,a.jsxs)("div",{className:"min-h-screen flex items-center justify-center bg-bg p-4 relative overflow-hidden",children:[(0,a.jsx)("div",{className:"landing-grid absolute inset-0 pointer-events-none","aria-hidden":"true"}),(0,a.jsxs)("div",{className:"relative z-10 w-full max-w-md",children:[(0,a.jsxs)("div",{className:"text-center mb-8",children:[(0,a.jsx)("h1",{className:"text-3xl font-bold text-primary mb-2",children:"ZevaiRouter"}),(0,a.jsx)("p",{className:"text-text-muted",children:"oidc"===g&&w?"Sign in with your OIDC provider to access the dashboard":"Enter your password to access the dashboard"})]}),(0,a.jsx)(i.Zp,{children:(0,a.jsxs)("div",{className:"flex flex-col gap-4",children:[k&&(0,a.jsx)(i.$n,{type:"button",variant:"primary",className:"w-full",onClick:()=>{window.location.href="/api/auth/oidc/start"},children:v}),k&&O&&(0,a.jsx)("div",{className:"h-px bg-border/60"}),O?(0,a.jsxs)("form",{onSubmit:C,className:"flex flex-col gap-4",children:[("oidc"===g&&!w||"both"===g&&!w)&&(0,a.jsx)("p",{className:"text-xs text-amber-600 dark:text-amber-400 text-center",children:"OIDC login is enabled, but the issuer/client fields are not configured yet. Password login is still available for recovery."}),"both"===g&&w&&(0,a.jsx)("p",{className:"text-xs text-text-muted text-center",children:"Password and OIDC login are both enabled."}),(0,a.jsxs)("div",{className:"flex flex-col gap-2",children:[(0,a.jsx)("label",{className:"text-sm font-medium",children:"Password"}),(0,a.jsx)(i.pd,{type:"password",placeholder:"Enter password",value:e,onChange:e=>t(e.target.value),required:!0,autoFocus:!k}),s&&(0,a.jsx)("p",{className:"text-xs text-red-500",children:s}),c>0&&(0,a.jsxs)("p",{className:"text-xs text-amber-600 dark:text-amber-400",children:["Locked. Retry in ",(0,a.jsxs)("span",{className:"font-mono",children:[c,"s"]}),"."]}),d&&(0,a.jsxs)("p",{className:"text-xs text-text-muted",children:["Forgot password? Open ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"zevai"})," CLI on the host → ",(0,a.jsx)("b",{children:"Settings"})," → ",(0,a.jsx)("b",{children:"Reset Password to Default"}),"."]})]}),(0,a.jsx)(i.$n,{type:"submit",variant:"primary",className:"w-full",loading:h,disabled:c>0,children:c>0?`Wait ${c}s`:"Login"}),!1===m&&(0,a.jsx)("p",{className:"text-xs text-center text-text-muted",children:b?(0,a.jsxs)(a.Fragment,{children:["Use the initial password printed by the installer. On systemd hosts it is stored in the root-only ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"/etc/zevairouter/zevairouter.env"})," file."]}):(0,a.jsxs)(a.Fragment,{children:["Default local password: ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"123456"}),". Change it after signing in."]})})]}):s&&(0,a.jsx)("p",{className:"text-xs text-red-500",children:s})]})})]})]})}}},e=>{e.O(0,[2574,3862,3745,9802,620,5497,8441,3794,7358],()=>e(e.s=7911)),_N_E=e.O()}]);
+(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[4520],{7911:(e,t,s)=>{Promise.resolve().then(s.bind(s,83016))},83016:(e,t,s)=>{"use strict";s.r(t),s.d(t,{default:()=>l});var a=s(95155),r=s(12115),i=s(35497),n=s(73321);function l(){let[e,t]=(0,r.useState)(""),[s,l]=(0,r.useState)(""),[d,o]=(0,r.useState)(""),[c,x]=(0,r.useState)(0),[h,u]=(0,r.useState)(!1),[m,p]=(0,r.useState)(null),[b,f]=(0,r.useState)(!1),[g,j]=(0,r.useState)("password"),[w,N]=(0,r.useState)(!1),[v,y]=(0,r.useState)("Sign in with OIDC"),S=(0,n.useRouter)();(0,r.useEffect)(()=>{if(c<=0)return;let e=setInterval(()=>x(e=>e>0?e-1:0),1e3);return()=>clearInterval(e)},[c]),(0,r.useEffect)(()=>{!async function(){let e=new AbortController,t=setTimeout(()=>e.abort(),5e3),s=window.location.origin;try{let a=await fetch(`${s}/api/auth/status`,{signal:e.signal});if(clearTimeout(t),a.ok){let e=await a.json();if(!1===e.requireLogin){S.push("/dashboard"),S.refresh();return}p(!!e.hasPassword),f(!0===e.initialPasswordConfigured),j(e.authMode||"password"),N(!0===e.oidcConfigured),y(e.oidcLoginLabel||"Sign in with OIDC")}else p(!0)}catch(e){clearTimeout(t),p(!0)}}()},[S]);let C=async t=>{t.preventDefault(),u(!0),l(""),o("");try{let t=await fetch("/api/auth/login",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({password:e})});if(t.ok)S.push("/dashboard"),S.refresh();else{let e=await t.json();l(e.error||"Invalid password"),e.resetHint&&o(e.resetHint),e.retryAfter&&x(Number(e.retryAfter))}}catch(e){l("An error occurred. Please try again.")}finally{u(!1)}},I=w&&["oidc","both"].includes(g),O="oidc"!==g||!w;return null===m?(0,a.jsx)("div",{className:"min-h-screen flex items-center justify-center bg-bg p-4",children:(0,a.jsxs)("div",{className:"text-center",children:[(0,a.jsx)("div",{className:"inline-block animate-spin rounded-full h-8 w-8 border-b-2 border-primary"}),(0,a.jsx)("p",{className:"text-text-muted mt-4",children:"Loading..."})]})}):(0,a.jsxs)("div",{className:"min-h-screen flex items-center justify-center bg-bg p-4 relative overflow-hidden",children:[(0,a.jsx)("div",{className:"landing-grid absolute inset-0 pointer-events-none","aria-hidden":"true"}),(0,a.jsxs)("div",{className:"relative z-10 w-full max-w-md",children:[(0,a.jsxs)("div",{className:"text-center mb-8",children:[(0,a.jsx)("h1",{className:"text-3xl font-bold text-primary mb-2",children:"ZevaiRouter"}),(0,a.jsx)("p",{className:"text-text-muted",children:"oidc"===g&&w?"Sign in with your OIDC provider to access the dashboard":"Enter your password to access the dashboard"})]}),(0,a.jsx)(i.Zp,{children:(0,a.jsxs)("div",{className:"flex flex-col gap-4",children:[I&&(0,a.jsx)(i.$n,{type:"button",variant:"primary",className:"w-full",onClick:()=>{window.location.href="/api/auth/oidc/start"},children:v}),I&&O&&(0,a.jsx)("div",{className:"h-px bg-border/60"}),O?(0,a.jsxs)("form",{onSubmit:C,className:"flex flex-col gap-4",children:[("oidc"===g&&!w||"both"===g&&!w)&&(0,a.jsx)("p",{className:"text-xs text-amber-600 dark:text-amber-400 text-center",children:"OIDC login is enabled, but the issuer/client fields are not configured yet. Password login is still available for recovery."}),"both"===g&&w&&(0,a.jsx)("p",{className:"text-xs text-text-muted text-center",children:"Password and OIDC login are both enabled."}),(0,a.jsxs)("div",{className:"flex flex-col gap-2",children:[(0,a.jsx)("label",{className:"text-sm font-medium",children:"Password"}),(0,a.jsx)(i.pd,{type:"password",placeholder:"Enter password",value:e,onChange:e=>t(e.target.value),required:!0,autoFocus:!I}),s&&(0,a.jsx)("p",{className:"text-xs text-red-500",children:s}),c>0&&(0,a.jsxs)("p",{className:"text-xs text-amber-600 dark:text-amber-400",children:["Locked. Retry in ",(0,a.jsxs)("span",{className:"font-mono",children:[c,"s"]}),"."]}),d&&(0,a.jsxs)("p",{className:"text-xs text-text-muted",children:["Forgot password? Open ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"zevai"})," CLI on the host → ",(0,a.jsx)("b",{children:"Settings"})," → ",(0,a.jsx)("b",{children:"Reset Password to Default"}),"."]})]}),(0,a.jsx)(i.$n,{type:"submit",variant:"primary",className:"w-full",loading:h,disabled:c>0,children:c>0?`Wait ${c}s`:"Login"}),!1===m&&(0,a.jsx)("p",{className:"text-xs text-center text-text-muted",children:b?(0,a.jsxs)(a.Fragment,{children:["Use the initial password printed by the installer. On systemd hosts, you may also paste the value or the complete ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"INITIAL_PASSWORD=..."})," line from the root-only ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"/etc/zevairouter/zevairouter.env"})," file."]}):(0,a.jsxs)(a.Fragment,{children:["Default local password: ",(0,a.jsx)("code",{className:"bg-sidebar px-1 rounded",children:"123456"}),". Change it after signing in."]})})]}):s&&(0,a.jsx)("p",{className:"text-xs text-red-500",children:s})]})})]})]})}}},e=>{e.O(0,[2574,3862,3745,9802,620,5497,8441,3794,7358],()=>e(e.s=7911)),_N_E=e.O()}]);

package/cli/app/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Unreleased
 
+# v1.0.166 (2026-07-29)
+
+## Fixes
+- **Consistent default dashboard password**: local, systemd/VPS, and fresh Docker installs now use `123456` when `INITIAL_PASSWORD` is unset, restoring the original first-login flow while preserving explicit or previously stored values.
+
+# v1.0.165 (2026-07-29)
+
+## Fixes
+- **Reliable systemd dashboard login recovery**: first-login auth accepts either the initial password value or its quoted/full `INITIAL_PASSWORD=...` EnvironmentFile form, new installers write copy-safe hexadecimal entries, and the CLI reset now clears the active SQLite password hash before reporting the actual configured fallback.
+
 # v1.0.164 (2026-07-28)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.164",
+  "version": "1.0.166",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.164",
+  "version": "1.0.166",
   "private": true,
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {

package/cli/src/cli/menus/settings.js

@@ -2,6 +2,7 @@ const path = require("path");
 const fs = require("fs");
 const os = require("os");
 const api = require("../api/client");
+const { clearDashboardPasswordFromStore, getInitialPasswordInfo } = require("../passwordReset");
 const { confirm, pause } = require("../utils/input");
 const { showStatus } = require("../utils/display");
 const { showMenuWithBack } = require("../utils/menuHelper");
@@ -16,8 +17,6 @@ const COLORS = {
   cyan: "\x1b[36m"
 };
 
-const DEFAULT_PASSWORD = "123456";
-
 // Resolve db.json path (matches app/src/lib/dataDir.js convention)
 function getDbPath() {
   return process.platform === "win32"
@@ -84,7 +83,7 @@ async function showSettingsMenu(breadcrumb = []) {
         action: async (d) => { await toggleRtk(d?.settings?.rtkEnabled !== false); return true; }
       },
       {
-        label: "🔑 Reset Password to Default",
+        label: "🔑 Reset Password to Initial",
         action: async () => { await resetPassword(); return true; }
       },
       {
@@ -175,19 +174,10 @@ async function toggleRtk(currentlyOn) {
 }
 
 /**
- * Reset dashboard password by clearing the hash in db.json (Phase B).
- * After reset, user can log in with the default password "123456".
+ * Clear the custom dashboard hash so auth falls back to INITIAL_PASSWORD.
  */
 async function resetPassword() {
-  const dbPath = getDbPath();
-
-  if (!fs.existsSync(dbPath)) {
-    showStatus(`db.json not found at ${dbPath}`, "error");
-    await pause();
-    return;
-  }
-
-  const ok = await confirm(`Reset dashboard password to default "${DEFAULT_PASSWORD}"?`);
+  const ok = await confirm("Reset dashboard password to the configured initial password?");
   if (!ok) {
     showStatus("Cancelled", "info");
     await pause();
@@ -195,13 +185,13 @@ async function resetPassword() {
   }
 
   try {
-    const raw = fs.readFileSync(dbPath, "utf-8");
-    const db = JSON.parse(raw);
-    if (db.settings && Object.prototype.hasOwnProperty.call(db.settings, "password")) {
-      delete db.settings.password;
+    clearDashboardPasswordFromStore();
+    const initial = getInitialPasswordInfo();
+    if (initial.password) {
+      showStatus(`Password reset. Initial password: ${initial.password}`, "success");
+    } else {
+      showStatus(`Password reset. Read INITIAL_PASSWORD as root from ${initial.source}.`, "success");
     }
-    fs.writeFileSync(dbPath, JSON.stringify(db, null, 2));
-    showStatus(`Password reset. Default: ${DEFAULT_PASSWORD}`, "success");
   } catch (err) {
     showStatus(`Failed to reset password: ${err.message}`, "error");
   }

package/cli/src/cli/passwordReset.js

@@ -0,0 +1,80 @@
+"use strict";
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { DEFAULT_ENV_PATH, readValue } = require("./systemdEnv");
+
+const DEFAULT_PASSWORD = "123456";
+
+function getDataDir() {
+  if (process.env.DATA_DIR) return process.env.DATA_DIR;
+  return process.platform === "win32"
+    ? path.join(process.env.APPDATA || "", "zevai")
+    : path.join(os.homedir(), ".zevai");
+}
+
+function getInitialPasswordInfo(options = {}) {
+  const envPath = options.envPath || DEFAULT_ENV_PATH;
+  try {
+    const contents = fs.readFileSync(envPath, "utf8");
+    const password = readValue(contents, "INITIAL_PASSWORD");
+    if (password) return { password, source: envPath };
+  } catch (error) {
+    if (error?.code !== "ENOENT") {
+      return { password: null, source: envPath, error };
+    }
+  }
+
+  const processPassword = String(process.env.INITIAL_PASSWORD || "").trim();
+  if (processPassword) return { password: processPassword, source: "environment" };
+
+  return { password: DEFAULT_PASSWORD, source: "local default" };
+}
+
+function clearDashboardPasswordFromStore(options = {}) {
+  const dataDir = options.dataDir || getDataDir();
+  const sqlitePath = path.join(dataDir, "db", "data.sqlite");
+  if (fs.existsSync(sqlitePath)) {
+    let DatabaseSync;
+    try {
+      ({ DatabaseSync } = require("node:sqlite"));
+    } catch {
+      throw new Error(`Cannot open active settings database at ${sqlitePath} with this Node.js version`);
+    }
+
+    const db = new DatabaseSync(sqlitePath);
+    try {
+      const row = db.prepare("SELECT data FROM settings WHERE id = 1").get();
+      if (!row?.data) return { cleared: false, store: sqlitePath };
+      const settings = typeof row.data === "string" ? JSON.parse(row.data) : row.data;
+      const cleared = !!settings?.password;
+      if (settings && Object.prototype.hasOwnProperty.call(settings, "password")) {
+        delete settings.password;
+        db.prepare("UPDATE settings SET data = ? WHERE id = 1").run(JSON.stringify(settings));
+      }
+      return { cleared, store: sqlitePath };
+    } finally {
+      try { db.close(); } catch { /* ignore */ }
+    }
+  }
+
+  const legacyPath = path.join(dataDir, "db.json");
+  if (!fs.existsSync(legacyPath)) {
+    throw new Error(`Settings DB not found (${sqlitePath} or ${legacyPath})`);
+  }
+  const db = JSON.parse(fs.readFileSync(legacyPath, "utf8"));
+  const cleared = !!db.settings?.password;
+  if (db.settings && Object.prototype.hasOwnProperty.call(db.settings, "password")) {
+    delete db.settings.password;
+    fs.writeFileSync(legacyPath, JSON.stringify(db, null, 2));
+  }
+  return { cleared, store: legacyPath };
+}
+
+module.exports = {
+  DEFAULT_PASSWORD,
+  clearDashboardPasswordFromStore,
+  getDataDir,
+  getInitialPasswordInfo,
+};

package/cli/src/cli/systemdEnv.js

@@ -5,6 +5,7 @@ const fs = require("fs");
 const path = require("path");
 
 const DEFAULT_ENV_PATH = "/etc/zevairouter/zevairouter.env";
+const DEFAULT_INITIAL_PASSWORD = "123456";
 
 function readValue(contents, key) {
   const prefix = `${key}=`;
@@ -54,7 +55,7 @@ function ensureSystemdEnvFile(options = {}) {
   const passwordCreated = !initialPassword;
   const jwtCreated = !jwtSecret;
 
-  if (passwordCreated) initialPassword = randomBytes(24).toString("hex");
+  if (passwordCreated) initialPassword = DEFAULT_INITIAL_PASSWORD;
   if (jwtCreated) jwtSecret = randomBytes(32).toString("hex");
 
   if (passwordCreated || jwtCreated) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.164",
+  "version": "1.0.166",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"