fix(security): eliminate default admin password vulnerability

BREAKING CHANGE: Admin password is now auto-generated on first setup

Security improvements:
- Remove hardcoded 'admin123' password completely
- Generate secure random password on first installation
- Save credentials to ADMIN_CREDENTIALS.txt (git-ignored)
- Force password change on first login
- Implement strong password requirements (12+ chars, mixed case, numbers, special)
- Add password strength validation
- Increase bcrypt rounds from 10 to 12

New features:
- Password generator utility with secure random generation
- Human-readable password format (e.g., SwiftEagle3847\!)
- Password reset script for existing installations
- Comprehensive admin setup documentation
- Must-change-password flag in database

Migration guide:
- New installations: Check ADMIN_CREDENTIALS.txt for generated password
- Existing installations: Run scripts/reset-admin-password.js
- All users must change password on first login after update

This fixes a critical vulnerability where all installations used the same
default admin password, allowing unauthorized access.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

backend/src/routes/adminAuth.js

@@ -4,13 +4,14 @@ const { body, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { endSession } = require('../middleware/sessionTimeout');
+const { validatePasswordStrength } = require('../utils/passwordGenerator');
 const router = express.Router();
 
 // Change password
 router.post('/change-password', [
   adminAuth,
   body('currentPassword').notEmpty().withMessage('Current password is required'),
-  body('newPassword').isLength({ min: 6 }).withMessage('New password must be at least 6 characters')
+  body('newPassword').isLength({ min: 12 }).withMessage('New password must be at least 12 characters')
 ], async (req, res) => {
   try {
     const errors = validationResult(req);
@@ -21,6 +22,15 @@ router.post('/change-password', [
     const { currentPassword, newPassword } = req.body;
     const userId = req.admin.id; // Changed from req.user.id to req.admin.id
 
+    // Validate new password strength
+    const passwordValidation = validatePasswordStrength(newPassword);
+    if (!passwordValidation.isValid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.messages
+      });
+    }
+
     // Get user from database
     const user = await db('admin_users')
       .where('id', userId)
@@ -36,14 +46,15 @@ router.post('/change-password', [
       return res.status(400).json({ error: 'Current password is incorrect' });
     }
 
-    // Hash new password
-    const newPasswordHash = await bcrypt.hash(newPassword, 10);
+    // Hash new password with more rounds
+    const newPasswordHash = await bcrypt.hash(newPassword, 12);
 
-    // Update password
+    // Update password and clear must_change_password flag
     await db('admin_users')
       .where('id', userId)
       .update({
         password_hash: newPasswordHash,
+        must_change_password: false,
         updated_at: new Date()
       });
 

backend/src/routes/auth.js

@@ -41,14 +41,15 @@ router.post('/admin/login', [
     // Update last login
     await db('admin_users').where('id', admin.id).update({ last_login: new Date() });
     
-    const token = jwt.sign({ id: admin.id }, process.env.JWT_SECRET, { expiresIn: '24h' });
+    const token = jwt.sign({ id: admin.id, type: 'admin' }, process.env.JWT_SECRET, { expiresIn: '24h' });
     
     res.json({
       token,
       user: {
         id: admin.id,
         username: admin.username,
-        email: admin.email
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
       }
     });
   } catch (error) {

backend/src/utils/passwordGenerator.js

@@ -1,39 +1,122 @@
+const crypto = require('crypto');
+
 /**
  * Generate a secure random password
- * @param {number} length - Password length (default 12)
+ * @param {number} length - Password length (default: 16)
  * @returns {string} Generated password
  */
-function generatePassword(length = 12) {
+function generateSecurePassword(length = 16) {
+  const charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+-=[]{}|;:,.<>?';
+  let password = '';
+  
+  // Ensure at least one of each required character type
   const lowercase = 'abcdefghijklmnopqrstuvwxyz';
   const uppercase = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
   const numbers = '0123456789';
-  const symbols = '!@#$%&*';
+  const special = '!@#$%^&*()_+-=[]{}|;:,.<>?';
   
-  // Ensure at least one character from each set
-  const requiredChars = [
-    lowercase[Math.floor(Math.random() * lowercase.length)],
-    uppercase[Math.floor(Math.random() * uppercase.length)],
-    numbers[Math.floor(Math.random() * numbers.length)],
-    symbols[Math.floor(Math.random() * symbols.length)]
-  ];
+  // Add one of each required type
+  password += lowercase[crypto.randomInt(lowercase.length)];
+  password += uppercase[crypto.randomInt(uppercase.length)];
+  password += numbers[crypto.randomInt(numbers.length)];
+  password += special[crypto.randomInt(special.length)];
   
-  // Fill the rest with random characters from all sets
-  const allChars = lowercase + uppercase + numbers + symbols;
-  const remainingLength = length - requiredChars.length;
-  
-  let password = '';
-  for (let i = 0; i < remainingLength; i++) {
-    password += allChars[Math.floor(Math.random() * allChars.length)];
+  // Fill the rest randomly
+  for (let i = password.length; i < length; i++) {
+    password += charset[crypto.randomInt(charset.length)];
   }
   
-  // Combine and shuffle
-  const passwordArray = [...requiredChars, ...password];
-  for (let i = passwordArray.length - 1; i > 0; i--) {
-    const j = Math.floor(Math.random() * (i + 1));
-    [passwordArray[i], passwordArray[j]] = [passwordArray[j], passwordArray[i]];
-  }
-  
-  return passwordArray.join('');
+  // Shuffle the password
+  return password.split('').sort(() => crypto.randomInt(3) - 1).join('');
 }
 
-module.exports = { generatePassword };
+/**
+ * Generate a human-readable password using words and numbers
+ * @returns {string} Generated password
+ */
+function generateReadablePassword() {
+  const adjectives = [
+    'Swift', 'Bright', 'Strong', 'Happy', 'Clever',
+    'Brave', 'Noble', 'Quick', 'Sharp', 'Bold'
+  ];
+  
+  const nouns = [
+    'Eagle', 'Mountain', 'River', 'Thunder', 'Forest',
+    'Ocean', 'Falcon', 'Dragon', 'Phoenix', 'Tiger'
+  ];
+  
+  const adjective = adjectives[crypto.randomInt(adjectives.length)];
+  const noun = nouns[crypto.randomInt(nouns.length)];
+  const number = crypto.randomInt(1000, 9999);
+  const special = '!@#$%'[crypto.randomInt(5)];
+  
+  return `${adjective}${noun}${number}${special}`;
+}
+
+/**
+ * Validate password strength
+ * @param {string} password - Password to validate
+ * @returns {object} Validation result with score and messages
+ */
+function validatePasswordStrength(password) {
+  const result = {
+    score: 0,
+    messages: [],
+    isValid: false
+  };
+  
+  // Length check
+  if (password.length < 8) {
+    result.messages.push('Password must be at least 8 characters long');
+  } else if (password.length < 12) {
+    result.score += 1;
+  } else {
+    result.score += 2;
+  }
+  
+  // Character type checks
+  if (!/[a-z]/.test(password)) {
+    result.messages.push('Password must contain lowercase letters');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[A-Z]/.test(password)) {
+    result.messages.push('Password must contain uppercase letters');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[0-9]/.test(password)) {
+    result.messages.push('Password must contain numbers');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(password)) {
+    result.messages.push('Password must contain special characters');
+  } else {
+    result.score += 1;
+  }
+  
+  // Common password check
+  const commonPasswords = [
+    'password', 'admin123', '12345678', 'qwerty', 'abc123',
+    'password123', 'admin', 'letmein', 'welcome', 'monkey'
+  ];
+  
+  if (commonPasswords.includes(password.toLowerCase())) {
+    result.score = 0;
+    result.messages.push('Password is too common');
+  }
+  
+  result.isValid = result.score >= 4 && result.messages.length === 0;
+  
+  return result;
+}
+
+module.exports = {
+  generateSecurePassword,
+  generateReadablePassword,
+  validatePasswordStrength
+};