From 2ef91d348bf78b25f5cffc2d452abe303247895b Mon Sep 17 00:00:00 2001
From: KingKDot <why_are_you_looking_at_this@stoppeeping.com>
Date: Fri, 8 May 2026 14:30:39 -0500
Subject: [PATCH] fix compose user password not working

---
 Overlord-Server/src/config.ts |  9 ++++++++-
 Overlord-Server/src/users.ts  | 15 +++++++++++----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/Overlord-Server/src/config.ts b/Overlord-Server/src/config.ts
index ccb88c8..7637d04 100644
--- a/Overlord-Server/src/config.ts
+++ b/Overlord-Server/src/config.ts
@@ -8,6 +8,7 @@ export interface Config {
   auth: {
     username: string;
     password: string;
+    passwordIsUserSupplied: boolean;
     jwtSecret: string;
     agentToken: string;
   };
@@ -80,6 +81,7 @@ const DEFAULT_CONFIG: Config = {
   auth: {
     username: "admin",
     password: "admin",
+    passwordIsUserSupplied: false,
     jwtSecret: "",
     agentToken: "",
   },
@@ -296,11 +298,15 @@ export function loadConfig(): Config {
 
   const passwordFromEnv = process.env.OVERLORD_PASS;
   const passwordFromConfig = fileConfig.auth?.password;
+  const passwordFromSaved = savedSecrets.auth?.bootstrapPassword;
   let finalBootstrapPassword =
     passwordFromEnv ||
     passwordFromConfig ||
-    savedSecrets.auth?.bootstrapPassword ||
+    passwordFromSaved ||
     DEFAULT_CONFIG.auth.password;
+  const passwordIsUserSupplied =
+    Boolean(passwordFromEnv) ||
+    Boolean(passwordFromConfig);
 
   const keywordsEnv = process.env.OVERLORD_NOTIFICATION_KEYWORDS;
   const keywordsFromEnv = keywordsEnv
@@ -317,6 +323,7 @@ export function loadConfig(): Config {
         fileConfig.auth?.username ||
         DEFAULT_CONFIG.auth.username,
       password: finalBootstrapPassword,
+      passwordIsUserSupplied,
       jwtSecret: finalJwtSecret,
       agentToken: finalAgentToken,
     },
diff --git a/Overlord-Server/src/users.ts b/Overlord-Server/src/users.ts
index de6217b..ef68d96 100644
--- a/Overlord-Server/src/users.ts
+++ b/Overlord-Server/src/users.ts
@@ -296,6 +296,7 @@ if (userCount.count === 0) {
   const config = getConfig();
   const initialUsername = (config.auth.username || "admin").trim() || "admin";
   const initialPassword = config.auth.password;
+  const mustChangePassword = config.auth.passwordIsUserSupplied ? 0 : 1;
 
   logger.info("[users] No users found, creating default admin account");
   const defaultPassword = await Bun.password.hash(initialPassword, {
@@ -305,7 +306,7 @@ if (userCount.count === 0) {
 
   db.prepare(
     "INSERT INTO users (username, password_hash, role, created_at, created_by, must_change_password, client_scope, plugin_scope, can_build, can_upload_files) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
-  ).run(initialUsername, defaultPassword, "admin", Date.now(), "system", 1, "all", "all", 1, 1);
+  ).run(initialUsername, defaultPassword, "admin", Date.now(), "system", mustChangePassword, "all", "all", 1, 1);
 
   const createdUser = db
     .prepare("SELECT * FROM users WHERE username = ?")
@@ -316,9 +317,15 @@ if (userCount.count === 0) {
   );
 
   logger.info(`[users] Initial admin account created (username: ${initialUsername})`);
-  logger.warn(
-    "[users] SECURITY WARNING: A default admin account has been created. Sign in and rotate the password immediately. Bootstrap credentials default to admin/admin unless overridden by configuration; the password is not logged.",
-  );
+  if (mustChangePassword) {
+    logger.warn(
+      "[users] SECURITY WARNING: A default admin account has been created with the fallback password. Sign in and rotate the password immediately. Bootstrap credentials default to admin/admin unless overridden by configuration; the password is not logged.",
+    );
+  } else {
+    logger.info(
+      "[users] Initial admin account uses the operator-supplied password; first-login rotation is not required.",
+    );
+  }
 }
 
 export function getUserById(id: number): User | null {