91beb8c2dc
Production correct-credential login returned auth_unavailable 503 because Flask's SECRET_KEY was unset: wrong-password probes stopped at 401 before CSRF token issuance, while valid credentials reached _csrf_serializer() and crashed. App factory now rejects absent/short (<32 char) SECRET_KEY at startup, and docker_entrypoint.sh fails fast before migration/services. Bootstrap no longer passes ADMIN_PASSWORD in process arguments; env-only. Tests: app-factory + entrypoint regression (5 focused passed), full backend suite 204 passed. Independent review PASS.
11 lines
365 B
Python
11 lines
365 B
Python
from pathlib import Path
|
|
|
|
|
|
ENTRYPOINT = Path(__file__).resolve().parents[1] / "docker_entrypoint.sh"
|
|
|
|
|
|
def test_entrypoint_never_exposes_admin_password_in_process_arguments():
|
|
source = ENTRYPOINT.read_text(encoding="utf-8")
|
|
assert '--password "${ADMIN_PASSWORD}"' not in source
|
|
assert 'uv run --frozen python scripts/bootstrap_super_admin.py' in source
|