From f9887c2a76c7b31366e47dc9af1970a0bb05c36c Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Mon, 6 Jul 2026 15:41:40 +0200 Subject: [PATCH] fix(server): seed-admin self-heals the admin role + signs a ledger event MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Field failure on park-buzi: reset-db --users wipes the roles table and points to seed-admin — which inserted the user with roleId "admin" without recreating the role row (migration 0007 never re-runs), dying on the role_id FOREIGN KEY. The script now upserts the built-in admin role first (the row alone suffices — admin permissions resolve in code). It also appends a SIGNED config_change (admin.passwordReset / admin.seeded, operator console:seed-admin) via the server's compiled EventLog + signer: a console seed/reset by the Linux admin can't be gated by the app, but it stays attributable in the chain. Best-effort — no build/signing key warns loudly and proceeds (locking an admin out to protect an audit line would invert the priority). Both paths verified against a scratch DB reproducing the post-reset state. Runbook: appliance-provisioning §7e — lost app-admin password reset via FORCE=1 (interactive preferred; sessions not revoked → rotate JWT_SECRET if theft suspected); §7d notes the FK failure + self-heal. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V --- apps/server/scripts/seed-admin.mjs | 36 ++++++++++++++++++- wiki/decisions/appliance-provisioning.md | 39 ++++++++++++++++++-- wiki/log.md | 45 ++++++++++++++++++++++++ 3 files changed, 116 insertions(+), 4 deletions(-) diff --git a/apps/server/scripts/seed-admin.mjs b/apps/server/scripts/seed-admin.mjs index 035d2df..1c35594 100644 --- a/apps/server/scripts/seed-admin.mjs +++ b/apps/server/scripts/seed-admin.mjs @@ -16,7 +16,7 @@ import { createRequire } from "node:module"; const require = createRequire(import.meta.url); const bcrypt = require("bcrypt"); -const { createDb, users, eq } = require("@parking/db"); +const { createDb, users, roles, eq } = require("@parking/db"); const DEFAULT_USERNAME = "admin"; @@ -53,6 +53,14 @@ if (!password || password.length < 8) { } const db = createDb(); + +// Self-heal the built-in `admin` ROLE row. Migration 0007 seeds it once, but the +// training reset (reset-db.mjs --users/--all) wipes the roles table and points here +// to re-seed — without this, the user insert dies on the role_id FOREIGN KEY (field +// failure 2026-07-06). The admin permission SET is resolved in code (auth.ts), so +// the row alone is all the FK needs. +await db.insert(roles).values({ id: "admin", name: "Admin", builtin: 1 }).onConflictDoNothing(); + const existing = await db.select().from(users).where(eq(users.username, username)).get(); if (existing && process.env.FORCE !== "1") { console.error(`user "${username}" already exists (set FORCE=1 to reset the password)`); @@ -73,4 +81,30 @@ if (existing) { }); console.log(`created admin "${username}"`); } + +// Record the action into the SIGNED ledger (config_change). A console seed/reset is +// a Linux-admin action the app can't gate — but it must stay ATTRIBUTABLE after the +// fact (the chain is the audit record; whoever holds root can reset a password, they +// can't do it silently). Uses the server's own compiled EventLog + signer from dist/ +// (present in the container; in a dev checkout run `pnpm build` first). Best-effort: +// a missing build or signing key WARNS loudly but never blocks the seed — locking an +// admin out to protect an audit line would invert the priority. +try { + const { EventLog } = await import("../dist/event-log.js"); + const { buildSigner } = await import("../dist/signer.js"); + const log = new EventLog(db, buildSigner()); + await log.append({ + type: "config_change", + source: "manual", + identity: `user:${username}`, + payload: { + setting: existing ? "admin.passwordReset" : "admin.seeded", + username, + operator: "console:seed-admin", + }, + }); + console.log("recorded to the signed ledger (config_change)"); +} catch (err) { + console.warn(`WARNING: NOT recorded to the signed ledger: ${err.message}`); +} process.exit(0); diff --git a/wiki/decisions/appliance-provisioning.md b/wiki/decisions/appliance-provisioning.md index feda482..16d2c09 100644 --- a/wiki/decisions/appliance-provisioning.md +++ b/wiki/decisions/appliance-provisioning.md @@ -2,7 +2,7 @@ type: reference tags: [parking, deployment, appliance, hardening, runbook, offline-first] sources: [] -updated: 2026-06-30 +updated: 2026-07-06 status: settled --- @@ -384,8 +384,41 @@ docker exec -it \ > setup only). It is a **training/demo** tool — never run on a production booth's data. After `--users`/`--all` (users cleared), re-seed the first admin exactly as in §7b -(`docker exec … node scripts/seed-admin.mjs`) so someone can log back in. For dev (where `pnpm` exists) -the same script is `pnpm db:reset --financial` — see [[local-dev-workflow]]. +(`docker exec … node scripts/seed-admin.mjs`) so someone can log back in. Since 2026-07-06 the seed +script **self-heals the built-in `admin` role row** that this reset also wipes — before that fix the +documented re-seed died on a `role_id` FOREIGN KEY error (field failure on `park-buzi`). For dev +(where `pnpm` exists) the same script is `pnpm db:reset --financial` — see [[local-dev-workflow]]. + +### 7e. Lost APP admin password — reset from the Linux admin account (2026-07-06) + +The app's admin password lives only as a bcrypt hash in the booth DB; there is no in-app recovery +(nobody above the admin exists to send a reset). The recovery path is the **Linux `admin` account** +(the only user in the `docker` group): the seed script doubles as the password-reset tool via +`FORCE=1` — on an existing username it RESETS that user's password (and restores `roleId: admin`, +so it also rescues a demoted admin). + +```bash +# Interactive (preferred — the password never lands in shell history): +docker exec -it -e FORCE=1 park-buzi-server-1 node scripts/seed-admin.mjs +# → prompts: username (Enter = admin), new password (min 8 chars) + +# Non-interactive (scripted; NB the password enters the HOST's shell history): +docker exec -e FORCE=1 -e ADMIN_USER=admin -e ADMIN_PASS='new-strong-pass' \ + park-buzi-server-1 node scripts/seed-admin.mjs +``` + +- **Attributable, not gated.** Whoever holds Linux root owns the DB file — the app cannot defend + against that actor and doesn't pretend to. What it CAN do: the script appends a **signed + `config_change` ledger event** (`admin.passwordReset` / `admin.seeded` on first seed, operator + `console:seed-admin`) so a console reset stays visible in the chain afterwards. If the signing key + is unavailable (e.g. a dev shell), it warns loudly and proceeds — locking an admin out to protect + an audit line would invert the priority. The [[threat-model]] adversary remains the *operator*, + who has no Linux account at all. +- **Sessions are NOT revoked** by a password reset — issued JWT cookies ride to expiry. A *forgotten* + password needs nothing more; a *suspected-stolen* one should also rotate the booth's `JWT_SECRET` + (Komodo Variables → redeploy), which invalidates every session instantly. +- Works on a fresh/reset DB too (the role-row self-heal above), so §7b first-seed, §7d post-reset + re-seed, and this recovery are all the same one command. ### Healthy startup + web-access diff --git a/wiki/log.md b/wiki/log.md index ab52955..438a5cb 100644 --- a/wiki/log.md +++ b/wiki/log.md @@ -2414,3 +2414,48 @@ printer routing is role + failoverRank (printer-routing.ts). Wizard now skips th hides the "Cilën barrierë shërben kjo pajisje?" panel, and stops persisting the binding for printers (a stale pre-fix binding drops off on next edit); the device list shows the printer's ROLE instead of a bogus amber "unbound". Server never required it (no validation change). + +## [2026-07-06] update | Tariff Lab: fee breakdown — "how is this sum produced" + +Operator: a lab outcome of "ALL 740 / 3h 2m" gave no derivation. Added explainFee to +@parking/shared: the SAME computeFee walk with an optional trace collector (zero fee change — +golden V1 regression still green), so Σ line items ≡ the amount by construction. Items: banded +same-price increment runs (time window · N × unit · card name), window-package occurrences, +stepped day totals (top-tier repeat flagged), daily-cap clamps as NEGATIVE adjustments, entry +grace. /api/tariff/simulate returns `breakdown` (null when settled); the lab's Outcome panel +renders it as a lined table with the rounding note (raw min → billed min at the increment) and a +total row. 4 new engine tests pin the sum invariant + item shapes. This also largely delivers the +wiki's open "composer price preview" item — see [[tariff]]. + +## [2026-07-06] update | Composer: increment-unit price labels + ≠60 warning (the 60→10 trap) + +Operator walked into the sharp edge the wiki flat-rate warning had already named: ladder/flat +prices are PER BILLING INCREMENT, so changing "Intervali i faturimit" 60→10 silently multiplies +every price ×6, while the price header just said "Çmimi / interval". Composer now: price labels +are DYNAMIC ("Çmimi / orë" at 60, "Çmimi / {{N}} min" otherwise — same for the flat-mode radio), +and an amber warning appears whenever the increment ≠ 60 ("çdo çmim faturohet për çdo N minuta, +JO për orë"). Band DURATIONS stay in hours — they're real wall time, increment-independent (the +operator asked if "orë" there was wrong; it isn't). See [[tariff]] (§increment). + +## [2026-07-06] update | UI-wide date standard ("25 Qer") + currency-scaled composer examples + +Two operator UX complaints. (1) Dates were a mix of browser-locale "7/6/2026" (raw +toLocaleString) and catalog "25 Qershor" — unified: formatDate/formatDateTime/formatClock in +lib/format.ts using new common.monthsShort ("25 Qer 14:30", year only when ≠ current, 24h clock); +formatRelativeDateTime switched to short months; ALL ~20 raw toLocale* date call sites swept +(shifts, subs, plans, drawer, snapshots, device footer, event detail, tariff composer + lab incl. +the fee-breakdown row times). Number toLocaleString (thousand separators on money) untouched. +(2) Composer example defaults were euro-scaled ("2.00"/hour ≈ 2 lekë) — now currency-aware +(ALL: 200/100 ladder, 200/500 steps, 2000 lost ticket; EUR/USD keep 2/1/2/5/20), threaded through +emptyForm/emptyLadder/emptyTier/pricingFromCard so a mode switch on an ALL card also shows lek- +plausible templates. Blank-form currency stays ALL. + +## [2026-07-06] update | seed-admin signs a ledger event; lost-app-admin-password runbook (§7e) + +Follow-through on the FK fix: seed-admin.mjs now appends a signed config_change +(admin.passwordReset / admin.seeded, operator console:seed-admin) via the server's compiled +EventLog + signer from dist/ — a console reset by the Linux admin can't gate on the app, but it +stays attributable in the chain. Best-effort: no build/key → loud warning, seed still proceeds +(verified both paths on a scratch DB). [[appliance-provisioning]] gained §7e: FORCE=1 reset +commands (interactive preferred — keeps the password out of shell history), sessions-not-revoked +caveat + JWT_SECRET rotation for suspected theft, role-row self-heal note added to §7d.