v0.72.0: fix admin login — re-seed scrypt digest computed by verifyPassword() call #149

2026-09-24T13:45:18+02:00

kamilkrzywda commented

2026-09-24 13:45:18 +02:00

The v0.71.0 seeded admin digest was computed with different scrypt parameters than the verifier (verifyPassword() passes the salt as a plain string to scryptSync(pw, saltHex, 32)), so real logins failed with 401.

Re-seed ADMIN_SEED_HASH with a digest produced by exactly that call (plaintext still nowhere in repo).
Idempotent boot-time rotation: UPDATE users SET password_hash = ? WHERE id = 'admin-kamilkrzywda' AND password_hash != ? — heals pre-v0.72.0 databases on every open(), no-op once healed.
Unit tests: new digest constant + rotate-on-open test (legacy file heals; second open is a no-op).

Version 0.71.0 → 0.72.0.

The v0.71.0 seeded admin digest was computed with different scrypt parameters than the verifier (verifyPassword() passes the salt as a plain string to scryptSync(pw, saltHex, 32)), so real logins failed with 401. - Re-seed ADMIN_SEED_HASH with a digest produced by exactly that call (plaintext still nowhere in repo). - Idempotent boot-time rotation: UPDATE users SET password_hash = ? WHERE id = 'admin-kamilkrzywda' AND password_hash != ? — heals pre-v0.72.0 databases on every open(), no-op once healed. - Unit tests: new digest constant + rotate-on-open test (legacy file heals; second open is a no-op). Version 0.71.0 → 0.72.0.

kamilkrzywda added 1 commit 2026-09-24 13:45:18 +02:00

v0.72.0: fix admin login — re-seed scrypt digest computed by verifyPassword() call

CI / build + unit + e2e (pull_request) Successful in 14m7s

Details

b5bb0d01ce

kamilkrzywda scheduled this pull request to auto merge when all checks succeed 2026-09-24 13:48:18 +02:00

kamilkrzywda merged commit 1a1834abc7 into master

2026-09-24 13:59:28 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: OpenCode/Flight-Ops#149