From 681561c22af6b0964236d16e9abd1fe6278b84dd Mon Sep 17 00:00:00 2001
From: Macky <macky@localhost>
Date: Fri, 7 Aug 2026 18:04:18 +0700
Subject: [PATCH] docs: update account flow (username admin/1234 + forced
 setup) in README/HANDOFF/engineering-log

---
 README.md                                     |  9 +++---
 docs/HANDOFF.md                               |  3 +-
 docs/engineering-log.md                       |  1 +
 docs/engineering-log/2026-08-07-auth-gitea.md | 32 +++++++++++++++++++
 docs/engineering-log/2026-08-07-build-out.md  |  2 +-
 5 files changed, 41 insertions(+), 6 deletions(-)
 create mode 100644 docs/engineering-log/2026-08-07-auth-gitea.md

diff --git a/README.md b/README.md
index e373b04..a6d9afd 100644
--- a/README.md
+++ b/README.md
@@ -54,7 +54,8 @@ npm install
 npm run dev            # Vite on :3000 -> proxies /api to :5001
 ```
 
-The first run creates a default super-admin: **`admin@salestrainer.local` / `admin123`** (change it!).
+The first run creates a default super-admin: **username `admin` / password `1234`**.
+On first login you'll be **forced to set your email + change the password** before using the app.
 
 ### Docker / EasyPanel
 
@@ -112,8 +113,8 @@ Real-model verification requires a live `LLM_API_KEY` in `.env`.
 
 ## Default accounts
 
-| Role | Email | Password |
-|------|-------|----------|
-| super_admin | `admin@salestrainer.local` | `admin123` (change after first login) |
+| Role | Username | Password |
+|------|----------|----------|
+| super_admin | `admin` | `1234` (forced to set email + change on first login) |
 
 Admins create additional users (users/login has no self-registration).
diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md
index 2e89fb3..708f3ce 100644
--- a/docs/HANDOFF.md
+++ b/docs/HANDOFF.md
@@ -34,7 +34,8 @@ cd frontend && npm run build          # outputs frontend/dist
 ```
 
 ## Default account
-- super_admin: `admin@salestrainer.local` / `admin123` (bootstrap; change in prod).
+- super_admin: `admin` / `1234` (bootstrap). First login FORCES setting email + changing the
+  password (must_setup flow) before use.
 
 ## Key gotchas
 1. **Do NOT invoke `.venv/bin/python <script>` directly** — the tool lifecycle guard crashes
diff --git a/docs/engineering-log.md b/docs/engineering-log.md
index 5e1963a..cbf6eb2 100644
--- a/docs/engineering-log.md
+++ b/docs/engineering-log.md
@@ -34,3 +34,4 @@ Informed by MiroFish (CrowdSight engine) + the hermes-brain-and-tools CrowdSight
 ## Entry index
 - `2026-08-07-build-out.md` — M0–M7 build-out, decisions, verification, current state.
 - `2026-08-07-security-ux.md` — security hardening (path traversal, IDOR, XSS) + UX/UI polish.
+- `2026-08-07-auth-gitea.md` — username login + first-time admin setup + Gitea push.
diff --git a/docs/engineering-log/2026-08-07-auth-gitea.md b/docs/engineering-log/2026-08-07-auth-gitea.md
new file mode 100644
index 0000000..d061ce8
--- /dev/null
+++ b/docs/engineering-log/2026-08-07-auth-gitea.md
@@ -0,0 +1,32 @@
+# 2026-08-07 — Username-based login + first-time admin setup + Gitea push
+
+## Summary
+Changed the account model to **username-based login** (was email-as-id), added mandatory
+first-time admin setup (set email + change password), pushed the repo to Gitea.
+
+## Changes
+1. **User id = username** (was email). Email is now a separate optional field with uniqueness.
+   - `UserStore.create_user(username, email=None, ...)`; login via username; JWT `sub` = username.
+   - Admin user-creation uses `username` (email fallback kept for compatibility).
+2. **Default admin**: `admin` / `1234`, with `must_setup=True`.
+3. **Forced first-time setup**: after login with the default creds, the frontend router guards
+   and sends the user to `/setup` — set email + new password (+ confirm), then `must_setup` clears.
+   - Backend: new `POST /api/auth/setup` (`complete_setup` sets email + password, clears flag).
+   - Login response now includes `must_setup`; `me` includes it too.
+   - Frontend: `Login.vue` uses username, `Setup.vue` (new), router guard, `auth.finishSetup`.
+4. **Docs**: README + HANDOFF + build-out log updated to `admin`/`1234` + setup flow.
+
+## Verification
+- Added `test_setup.py` (admin/1234 → must_setup → set email+password → old pw invalid, new pw
+  works, admin can use app). ALL PASS.
+- Adapted m0/m1/routes/security/e2e to username creds. **All 6 suites PASS.**
+- Frontend `npm run build` ok. Live server: `admin`/`1234` login returns `must_setup=true`,
+  SPA served at `http://localhost:5001`.
+
+## Push
+- Remote added: `origin` = https://git.moreminimore.com/kunthawat/sales-trainer.git
+  (GITEA_TOKEN via env, not committed). Pushed `main` → `eadf4f7..e8a95bf`.
+
+## Next (needs user for live model, no blocker here)
+- Set `LLM_API_KEY` (+ provider) to enable analyze/persona/chat live path.
+- Validate Docker build on EasyPanel.
diff --git a/docs/engineering-log/2026-08-07-build-out.md b/docs/engineering-log/2026-08-07-build-out.md
index 1d197c1..d615177 100644
--- a/docs/engineering-log/2026-08-07-build-out.md
+++ b/docs/engineering-log/2026-08-07-build-out.md
@@ -54,7 +54,7 @@ sessions→debrief(latent reveal+coaching)→one-shot→board→weak-areas→gen
 
 ## Current state / runtime
 - Backend runs via `cd backend && uv run python run.py`; frontend dev via `cd frontend && npm run dev` (proxies /api -> :5001).
-- Default super-admin: `admin@salestrainer.local` / `admin123` (bootstrap; change in prod).
+- Default super-admin: `admin` / `1234` (bootstrap; forces email + password change on first login).
 - Deploy files: root `Dockerfile`, `docker-compose.yml`, `.env.example`; repo-root `frontend/dist` build.
 
 ## Risks / remaining