fix(#83): address Copilot review on #84

- Lint: golangci-lint's `unused` check runs without the `dev` build tag,
  so the shared constants in dev_bypass.go were flagged. Delete the
  shared file and inline the two constants into dev_bypass_on.go where
  they are actually referenced.

- Doc accuracy (Copilot #1, #2): the `-tags dev` flag is set by the
  `dev:` target in gearbox/Makefile via `air --build.cmd "$(DEV_BUILD_CMD)"`,
  not by `.air.toml` (which is gitignored per-developer). Update the
  package doc and four function/header comments in dev_bypass_on.go,
  and the corresponding section in gearbox/docs/development.md, to
  reference the Makefile and drop the broken `../.air.toml` link.

- Security (Copilot #3): EnsureDevUserExists previously returned early
  if a `dev` row already existed, leaving its password_hash untouched.
  A developer who manually set a password on that row could then form-
  login as a `dev` admin, contradicting the "form-login can never
  authenticate as this user" claim. Always rewrite password_hash to
  the caller-supplied dummyPasswordHash, plus reset status and
  must_change_password back to the safe defaults, on every call.
  Other fields (role, names) are still preserved across runs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

gearbox/docs/development.md

@@ -125,10 +125,13 @@ See [VS Code Integration](#vs-code-integration) below for debugger support.
 
 ## Dev-Only Loopback Auto-Login
 
-`make dev` builds with `-tags dev` (see [.air.toml](../.air.toml)), which
-compiles in a localhost-only auto-login bypass. When all three of these
-conditions hold, the request is auto-authenticated as the seeded `dev`
-user — no login screen, no cookie management:
+`make dev` builds with `-tags dev` — the flag is set by the `dev:` target
+in [gearbox/Makefile](../Makefile), which overrides air's build command
+via `air --build.cmd "$(DEV_BUILD_CMD)"`. (`.air.toml` is per-developer
+and gitignored, so the build flag intentionally lives in the Makefile.)
+The tag compiles in a localhost-only auto-login bypass. When all three
+of these conditions hold, the request is auto-authenticated as the
+seeded `dev` user — no login screen, no cookie management:
 
 1. The binary was built with `-tags dev`.
 2. The environment variable `GEARBOX_DEV_AUTO_LOGIN=1` is set.

gearbox/internal/framework/auth/dev_bypass.go

@@ -1,8 +1,11 @@
 //go:build dev
 
 // Dev-only loopback auto-login bypass. Compiled in only when the binary
-// is built with `-tags dev` (see gearbox/.air.toml and the production
-// build path which deliberately omits the tag). See issue #83.
+// is built with `-tags dev`. The tag is set by the `dev:` target in
+// gearbox/Makefile via `air --build.cmd "$(DEV_BUILD_CMD)"`; the
+// production build paths (`make build`, `make deploy-build`) deliberately
+// omit it, so this file and its symbols are not in release binaries at
+// all. See issue #83.
 
 package auth
 
@@ -17,12 +20,26 @@ import (
 	"github.com/sarg3nt/gearbox/internal/framework/models"
 )
 
+const (
+	// devBypassEnvVar gates whether the bypass is allowed to fire even
+	// when the binary was built with `-tags dev`. Set to "1" to enable.
+	devBypassEnvVar = "GEARBOX_DEV_AUTO_LOGIN"
+
+	// devBypassEmail is the email/username of the seeded dev account that
+	// the bypass auto-authenticates as. The account must exist (and be
+	// active) in the users table; the bypass never creates sessions or
+	// auto-promotes a non-existent user.
+	devBypassEmail = "dev"
+)
+
 var devBypassBannerOnce sync.Once
 
 // tryDevBypass returns the seeded `dev` user when ALL of these hold:
 //
-//  1. The binary was built with `-tags dev` (this file is compiled in;
-//     the production sibling dev_bypass_off.go is not).
+//  1. The binary was built with `-tags dev` (gearbox/Makefile's `dev:`
+//     target adds the tag via `air --build.cmd "$(DEV_BUILD_CMD)"`; this
+//     file is compiled in. The production sibling dev_bypass_off.go is
+//     compiled in for tag-less builds and provides a no-op stub.).
 //  2. GEARBOX_DEV_AUTO_LOGIN=1 is set in the process environment.
 //  3. r.RemoteAddr is a loopback address (127.0.0.0/8 or ::1).
 //
@@ -92,7 +109,9 @@ func SeedDevUserIfEnabled(db *database.DB, logger *slog.Logger) error {
 // Designed to be impossible to miss in logs so an operator never confuses
 // a dev binary for a production one.
 //
-// Production builds replace this with a no-op (dev_bypass_off.go).
+// Production builds replace this with a no-op (dev_bypass_off.go) — the
+// production build targets in gearbox/Makefile (`build`, `deploy-build`)
+// omit `-tags dev`, so this banner cannot fire on a release artifact.
 func LogDevBypassStartupBanner(logger *slog.Logger) {
 	if os.Getenv(devBypassEnvVar) != "1" {
 		logger.Info("dev auto-login: bypass compiled in (`-tags dev`) but disabled — set GEARBOX_DEV_AUTO_LOGIN=1 to enable")

gearbox/internal/framework/auth/dev_bypass_on.go

@@ -14,24 +14,45 @@ import (
 	"github.com/sarg3nt/gearbox/internal/framework/models"
 )
 
-// EnsureDevUserExists creates the seeded `dev` user used by the dev
-// auto-login bypass if it doesn't already exist. The password hash is
-// expected to be the package-level dummyPasswordHash from auth, so the
-// form-login path can never authenticate as this user — only the
-// loopback bypass can.
+// EnsureDevUserExists ensures the seeded `dev` user exists for the dev
+// auto-login bypass AND that its password hash is the caller-supplied
+// `passwordHash` (the package-level dummyPasswordHash from auth). The
+// hash is rewritten unconditionally on every call so a row left over
+// from a prior manual setup — where a developer may have set a real
+// bcrypt-able password for testing — cannot be authenticated via the
+// form-login path. Only the loopback bypass can authenticate as `dev`.
 //
-// Returns (created, error) — `created` is true only on the first call
-// that actually inserted a row.
+// Returns (created, error) — `created` is true only on the call that
+// inserted the row; subsequent calls return false but still rewrite the
+// hash, status, and must_change_password fields back to the safe
+// defaults. Other fields (role, names) are not overwritten so a
+// developer can still adjust the dev user's display info without losing
+// it on next startup.
 func (d *DB) EnsureDevUserExists(email, passwordHash string) (bool, error) {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 
 	var existingID string
 	err := d.db.QueryRow(`SELECT id FROM users WHERE email = ? LIMIT 1`, email).Scan(&existingID)
-	if err == nil {
+	switch {
+	case err == nil:
+		// Row exists. Force the hash + status + must_change_password back to
+		// the safe defaults so the form-login path remains unable to
+		// authenticate as this user even if the row was tampered with.
+		_, err := d.db.Exec(`
+			UPDATE users
+			SET password_hash = ?,
+			    status = ?,
+			    must_change_password = 0,
+			    updated_at = ?
+			WHERE id = ?`,
+			passwordHash, models.UserStatusActive, time.Now(), existingID,
+		)
+		if err != nil {
+			return false, fmt.Errorf("failed to reset dev user safety fields: %w", err)
+		}
 		return false, nil
-	}
-	if err != sql.ErrNoRows {
+	case err != sql.ErrNoRows:
 		return false, err
 	}