Use init flow by default for admin auth

Author: duanxiaosheng

.env.example

@@ -1,5 +1,11 @@
-ADMIN_PASSWORD=Sheng123..
-SESSION_SECRET=change-this-session-secret-after-deploy
+# Optional: set this only if you want to force a fixed admin password from environment.
+# If omitted, open the site for the first time and initialize the admin password in the UI.
+# ADMIN_PASSWORD=
+
+# Optional: set this only if you need a fixed session secret.
+# If omitted, the app generates one automatically and stores it under data/config/admin-auth.json.
+# SESSION_SECRET=
+
 NODE_ENV=production
 PORT=3000
 DATA_DIR=/app/data

docker-compose.release.yml

@@ -7,8 +7,6 @@ services:
     environment:
       NODE_ENV: ${NODE_ENV:-production}
       PORT: 3000
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-Sheng123..}
-      SESSION_SECRET: ${SESSION_SECRET:-change-this-session-secret-after-deploy}
       DATA_DIR: ${DATA_DIR:-/app/data}
     volumes:
       - ./data:${DATA_DIR:-/app/data}

src/lib/local-admin/auth.ts

@@ -1,13 +1,13 @@
-import { createHash, timingSafeEqual } from 'crypto'
+import { createHash, randomBytes, timingSafeEqual } from 'crypto'
 import { readConfigJson, writeConfigJson } from './storage'
 
 const SESSION_COOKIE = 'blog_admin_session'
-const DEFAULT_SESSION_SECRET = 'blog-local-secret-change-me'
 const ADMIN_CONFIG_FILE = 'admin-auth.json'
 
 type AdminAuthConfig = {
 	passwordHash?: string
 	initializedAt?: string
+	sessionSecret?: string
 }
 
 function sha256(input: string) {
@@ -37,8 +37,13 @@ export async function initializeAdminPassword(password: string) {
 	return next
 }
 
-export function getSessionSecret() {
-	return process.env.SESSION_SECRET || DEFAULT_SESSION_SECRET
+export async function getSessionSecret() {
+	if (process.env.SESSION_SECRET) return process.env.SESSION_SECRET
+	const config = await getAdminAuthConfig()
+	if (config.sessionSecret) return config.sessionSecret
+	const sessionSecret = randomBytes(32).toString('hex')
+	await writeConfigJson(ADMIN_CONFIG_FILE, { ...config, sessionSecret })
+	return sessionSecret
 }
 
 export function getSessionCookieName() {
@@ -61,9 +66,10 @@ export async function verifyAdminPassword(password: string) {
 
 export async function createSessionToken() {
 	const passwordHash = (await getStoredAdminPasswordHash()) || 'uninitialized'
-	return sha256(`${getSessionSecret()}:${passwordHash}`)
+	return sha256(`${await getSessionSecret()}:${passwordHash}`)
 }
 
+
 export async function verifySessionToken(token?: string | null) {
 	if (!token) return false
 	const expectedToken = await createSessionToken()