shaw 6e315616ed fix(setup): stop shipping guessable admin credentials on fresh installs (fixes #7850) ...

Fresh Docker installs created the admin as admin@sub2api.local and accepted
any ADMIN_PASSWORD (e.g. "123456"), making them easy brute-force targets.

- Generate a random admin-<12 hex>@sub2api.local login email when
  ADMIN_EMAIL is empty; drop the fixed default from .env.example and the
  compose files, and have docker-deploy.sh write a random ADMIN_EMAIL.
- Validate user-supplied ADMIN_PASSWORD (8-72 bytes) and ADMIN_EMAIL on the
  auto-setup path, only when an admin is actually about to be created, so
  existing deployments are never blocked at startup.
- Align validateEmail with the login endpoint's email binding so setup can no
  longer create an admin that can never log in (e.g. "a@b", "Name <a@b.com>").
- Cap validatePassword at bcrypt's 72-byte limit; the CLI reuses it and now
  defaults to a random admin email instead of admin@example.com.
- Update READMEs/deploy docs to stop suggesting guessable credentials.

2026-10-07 09:27:36 +08:00

..

e2e_gateway_test.go

test: 完善自动化测试体系（7个模块，73个任务）

2026-02-08 12:05:39 +08:00

e2e_helpers_test.go

test: 完善自动化测试体系（7个模块，73个任务）

2026-02-08 12:05:39 +08:00

e2e_user_flow_test.go

fix(setup): stop shipping guessable admin credentials on fresh installs (fixes #7850)

2026-10-07 09:27:36 +08:00