paul/picpeak

Fork 0

Files

T

paul 0d33f21ee6

Test Gitea Actions / test (push) Successful in 18s

Details

continuous-integration/drone/push Build is passing

Details

fix(security): eliminate default admin password vulnerability

BREAKING CHANGE: Admin password is now auto-generated on first setup

Security improvements:
- Remove hardcoded 'admin123' password completely
- Generate secure random password on first installation
- Save credentials to ADMIN_CREDENTIALS.txt (git-ignored)
- Force password change on first login
- Implement strong password requirements (12+ chars, mixed case, numbers, special)
- Add password strength validation
- Increase bcrypt rounds from 10 to 12

New features:
- Password generator utility with secure random generation
- Human-readable password format (e.g., SwiftEagle3847\!)
- Password reset script for existing installations
- Comprehensive admin setup documentation
- Must-change-password flag in database

Migration guide:
- New installations: Check ADMIN_CREDENTIALS.txt for generated password
- Existing installations: Run scripts/reset-admin-password.js
- All users must change password on first login after update

This fixes a critical vulnerability where all installations used the same
default admin password, allowing unauthorized access.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

2025-07-12 23:50:21 +02:00

2.8 KiB

Raw Blame History

🚀 Quick Local Development Setup

Get the photo sharing platform running locally in under 2 minutes!

Prerequisites

Docker Desktop installed and running
Git
4GB RAM available

Quick Start

# 1. Clone the repository
git clone <your-repo-url>
cd picpeak

# 2. Start everything
./start-local.sh

That's it! 🎉

What You Get

Service	URL	Description
Frontend (Dev)	http://localhost:3002	React app with hot reload
Frontend (Prod)	http://localhost:3000	Production build
Backend API	http://localhost:3001	Express API
Mailhog	http://localhost:8025	Email testing UI

Default Credentials

Admin Login: Check ADMIN_CREDENTIALS.txt after first setup
Test Gallery:
- Create via Admin Panel
- Set your own secure password

Common Tasks

View Logs

docker-compose -f docker-compose.local.yml logs -f

Stop Everything

./stop-local.sh

Reset Database

docker-compose -f docker-compose.local.yml exec backend npm run migrate

Add Test Photos

Create a gallery in the admin panel
Get the gallery slug (e.g., wedding-smith-2024)
Add photos to: ./storage/events/active/wedding-smith-2024/
Photos appear automatically!

Access Backend Shell

docker-compose -f docker-compose.local.yml exec backend sh

Development Workflow

Frontend Development (Port 3002)
- Hot reload enabled
- Edit files in ./frontend/src
- Changes appear instantly
Backend Development (Port 3001)
- Nodemon watches for changes
- Edit files in ./backend/src
- Server restarts automatically
Email Testing
- All emails go to Mailhog
- View at http://localhost:8025
- No real emails sent!

Troubleshooting

Backend won't start

# Check logs
docker-compose -f docker-compose.local.yml logs backend

# Rebuild
docker-compose -f docker-compose.local.yml build backend

Frontend build issues

# Clear cache and rebuild
docker-compose -f docker-compose.local.yml exec frontend-dev npm run build

Port conflicts

Edit docker-compose.local.yml and change the port mappings:

Backend: Change 3001:3000 to XXXX:3000
Frontend: Change 3002:5173 to YYYY:5173

Reset everything

# Stop and remove all data
docker-compose -f docker-compose.local.yml down -v
rm -rf data storage logs
./start-local.sh

Tips

📧 Check Mailhog for all emails
🔄 Frontend auto-refreshes on save
📁 SQLite DB at ./data/photo_sharing.db
🖼️ Photos in ./storage/events/active/
📝 Logs in ./logs/

Next Steps

Create your first gallery via Admin Panel
Upload some test photos
Test the gallery with password
Check expiration warnings
View emails in Mailhog

Happy coding! 🎨

2.8 KiB Raw Blame History