…h token lifetime (#1, #15) (#586) #1 — Default admin secret was "password" The previous default of "password" for --admin-secret meant any deployment that forgot to override it ran with a publicly known credential. Worse, applyFlagDefaults() actively reset empty values back to "password", so operators who tried to disable it by passing --admin-secret="" got the default silently restored. Fix: - Remove the default. The flag now defaults to "" with an explicit help string warning that it is required. - Remove the applyFlagDefaults() reset. - runRoot() refuses to start (os.Exit 1) when admin secret is empty OR literally equals "password" — defends against both legacy configs and weak operator choices. The error message tells the user how to generate a strong value (openssl rand -hex 32). - This applies in ALL modes; there is no dev-mode carve-out. #15 — Refresh token lifetime hardcoded to 30 days internal/token/auth_token.go::CreateRefreshToken hardcoded a 30-day expiry, with no way for operators to shorten or extend the lifetime. Fix: - Add Config.RefreshTokenExpiresIn (int64 seconds). - Add CLI flag --refresh-token-expires-in (default 2592000 = 30 days). - CreateRefreshToken reads from config; falls back to 30 days when zero or unset to preserve backward compatibility for in-process callers.

Uh oh!

Create server boilerplate #1

Description

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions