From 433bdef5d0bf553fc737946d1afc6d0b4a2ec451 Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Fri, 31 Jul 2026 18:28:26 +0000 Subject: [PATCH] fix(auth): remove redundant startup bootstrap user creation The login endpoint already provisions the first admin user on demand with a proper password_hash. The startup block in main.py created the user without a password_hash, causing the login endpoint to see has_admins=True and reject bootstrap credentials with 403. Fix: remove the startup user-creation block so the login endpoint's bootstrap path runs first and provisions the user correctly. --- backend/app/main.py | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/backend/app/main.py b/backend/app/main.py index 438e0cd..10ca14f 100644 --- a/backend/app/main.py +++ b/backend/app/main.py @@ -178,26 +178,6 @@ async def lifespan(app: FastAPI): except Exception as e: print(f" WARNING: Failed to write theme.json on startup: {e}") - # Bootstrap admin user if configured - if settings.ADMIN_USERNAME and settings.ADMIN_PASSWORD: - async with async_session() as session: - result = await session.execute( - select(User).where( - User.email == f"{settings.ADMIN_USERNAME}@local", - User.auth_provider == "local", - ) - ) - if result.scalar_one_or_none() is None: - admin_user = User( - email=f"{settings.ADMIN_USERNAME}@local", - display_name=settings.ADMIN_USERNAME, - auth_provider="local", - is_admin=True, - ) - session.add(admin_user) - await session.commit() - print(f" → Bootstrap admin created: {settings.ADMIN_USERNAME}") - # Check GeoLite2 database geo_db = settings.GEOLITE2_DB_PATH if os.path.exists(geo_db):