src/server/system_services/schemas/account_schema.js (1)

28-29: Formalize deprecation flags on password fields (and consider deprecating has_login).

The comments are helpful. If your schema tooling supports it, set a machine-readable flag to propagate to validators/docs.

Apply:

-        password: { wrapper: SensitiveString }, // bcrypted password - DEPRECATED
-        next_password_change: { date: true }, // DEPRECATED
+        password: { wrapper: SensitiveString, deprecated: true, description: 'bcrypted password - DEPRECATED' },
+        next_password_change: { date: true, deprecated: true, description: 'DEPRECATED' },

Also consider marking has_login as deprecated in this schema (or documenting the new token-only flow where relevant).

Would you like me to scan the codebase for any uses that still rely on has_login/password and open a follow-up?

src/server/system_services/account_server.js (1)

545-545: Reset password endpoint now forbidden—verify UI/clients and consider removing the RPC.

Blocking with FORBIDDEN is fine, but ensure all callers (UI/CLI/automation) have migrated to token-only flows to avoid user-facing errors. Consider removing the RPC/surfacing a clearer NOT_SUPPORTED code if your clients distinguish it.

Would you like a follow-up patch to remove the RPC from the schema and update any UI text?

src/test/system_tests/test_bucket_placement.js (2)

18-18: Importing token generator in tests is fine; keep it test-only.

Ensure make_auth_token usage remains confined to test/CI codepaths to avoid accidental enablement in user-facing tooling.

---

44-48: Avoid hard-coded admin identity; parameterize via argv/env.

This improves portability across environments and clusters.

Apply:

-    const auth_params = {
-        email: 'demo@noobaa.com',
-        role: 'admin',
-        system: 'demo',
-    };
+    const email = argv.email || process.env.NOOBAA_EMAIL || 'demo@noobaa.com';
+    const system = argv.system || process.env.NOOBAA_SYSTEM || 'demo';
+    const role = argv.role || 'admin';
+    const auth_params = { email, role, system };

src/test/pipeline/quota_test.js (1)

226-230: Parameterize credentials; don’t hard-code admin.

Keeps pipeline tests reusable across environments.

-        client.options.auth_token = make_auth_token({
-            email: 'demo@noobaa.com',
-            role: 'admin',
-            system: 'demo',
-        });
+        const email = argv.email || process.env.NOOBAA_EMAIL || 'demo@noobaa.com';
+        const system = argv.system || process.env.NOOBAA_SYSTEM || 'demo';
+        const role = argv.role || 'admin';
+        client.options.auth_token = make_auth_token({ email, role, system });

src/test/utils/basic_server_ops.js (1)

147-153: Centralize token creation to a small helper; reduce duplication.

Many tests repeat the same admin token snippet. Extract to a shared test util to avoid drift.

Example inline tweak (if you prefer not to add a helper yet):

-            const auth_params = {
-                email: 'demo@noobaa.com',
-                role: 'admin',
-                system: 'demo'
-            };
-            client.options.auth_token = make_auth_token(auth_params);
+            const email = process.env.NOOBAA_EMAIL || 'demo@noobaa.com';
+            const system = process.env.NOOBAA_SYSTEM || 'demo';
+            const role = 'admin';
+            client.options.auth_token = make_auth_token({ email, role, system });

If desired, I can propose a src/test/utils/auth.js with get_admin_token() and submit a follow-up patch.

src/test/qa/data_availability_test.js (1)

196-202: Rename or update function intent and parameterize identity.

• The function no longer “creates” via RPC; consider a clearer name (e.g., set_rpc_and_set_auth_token).
• Also remove hard-coded admin.

-async function set_rpc_and_create_auth_token() {
-    const auth_params = {
-        email: 'demo@noobaa.com',
-        system: 'demo',
-        role: 'admin',
-    };
-    client.options.auth_token = make_auth_token(auth_params);
-}
+async function set_rpc_and_set_auth_token() {
+    const email = argv.email || process.env.NOOBAA_EMAIL || 'demo@noobaa.com';
+    const system = argv.system || process.env.NOOBAA_SYSTEM || 'demo';
+    const role = argv.role || 'admin';
+    client.options.auth_token = make_auth_token({ email, role, system });
+}

Remember to update its call site accordingly.

src/test/system_tests/test_s3_authentication.js (1)

35-42: Make auth configurable and future-proof against token expiry.

• Parameterize identity; avoid hard-coded admin.
• If tests can run long, ensure token TTL is sufficient or refresh on 401.

 function authenticate() {
-    const auth_params = {
-        email: 'demo@noobaa.com',
-        role: 'admin',
-        system: 'demo',
-    };
-    client.options.auth_token = make_auth_token(auth_params);
+    const email = argv.email || process.env.NOOBAA_EMAIL || 'demo@noobaa.com';
+    const system = argv.system || process.env.NOOBAA_SYSTEM || 'demo';
+    const role = argv.role || 'admin';
+    client.options.auth_token = make_auth_token({ email, role, system });
 }

If make_auth_token supports TTL, consider passing an explicit value suitable for the test duration.

src/test/external_tests/external_tests_utils.js (3)

25-28: Validate required env before using it.

Fail fast with a clear message when email is missing.

 async function get_authenticated_global_rpc_client() {
-    const global_rpc_client = await get_rpc_client_by_email_and_password(process.env.email, process.env.password);
+    if (!process.env.email) throw new Error('Missing required env var: email');
+    const global_rpc_client = await get_rpc_client_by_email_and_password(process.env.email, process.env.password);
     return global_rpc_client;
 }

---

62-69: Guard against accounts with no access keys.

Prevents TypeError when the list is empty and yields a clearer error.

 async function get_account_access_keys(account_name) {
     const account = is_containerized_deployment() ?
         await get_account_by_name(account_name) :
         await get_account(account_name);
-    const access_keys = account.access_keys[0];
+    if (!account.access_keys || account.access_keys.length === 0) {
+        throw new Error(`Account "${account_name}" has no access keys`);
+    }
+    const access_keys = account.access_keys[0];
     const access_key = new SensitiveString(access_keys.access_key).unwrap();
     const secret_key = new SensitiveString(access_keys.secret_key).unwrap();
     return { access_key, secret_key };
 }

---

116-116: Remove leftover debug log.

Avoid leaking internal objects to stdout in CI.

-    console.log(test_pool);

src/test/pipeline/account_test.js (2)

75-83: Drop stale 'reset_password' case from reporter.

This case no longer exists and skews reporting.

 const cases = [
     'create_account',
     'delete_account',
     'regenerate_s3Access',
     'edit_s3Access',
     'edit_bucket_creation',
     'restrict_ip_access',
-    'reset_password'
 ];

---

142-150: Use the function argument instead of the global for s3_access.

The parameter is currently ignored.

 function set_account_details(has_login, account_name, email, s3_access) {
     return {
         name: account_name,
         email,
         password: TEST_CFG.password,
         has_login,
-        s3_access: TEST_CFG.s3_access,
+        s3_access,
     };
 }

src/test/integration_tests/internal/test_system_servers.js (1)

287-292: Reset token back to original system after rename.

Avoid mismatched system claim for subsequent calls.

         rpc_client.options.auth_token = make_auth_token({
             email: EMAIL,
             system: SYS1,
             role: 'admin'
         });
         await rpc_client.system.update_system({ name: SYSTEM });
+        // Reset token to match reverted system name
+        rpc_client.options.auth_token = make_auth_token({
+            email: EMAIL,
+            system: SYSTEM,
+            role: 'admin'
+        });

src/test/qa/rebuild_replicas_test.js (2)

12-12: Avoid coupling tests to server internals for token minting

Importing make_auth_token directly from server code makes tests depend on server internals. Prefer consuming a token from env (e.g., NB_ADMIN_TOKEN) and only fall back to local minting, to keep tests flexible across environments.

Apply within set_rpc_and_create_auth_token:

-    client.options.auth_token = make_auth_token(auth_params);
+    client.options.auth_token = process.env.NB_ADMIN_TOKEN || make_auth_token(auth_params);

---

255-262: Name mismatch: function now “sets” not “creates” an auth token

Minor: set_rpc_and_create_auth_token no longer creates a token via RPC. Consider renaming to reflect behavior (e.g., set_rpc_and_apply_auth_token) to avoid confusion.

src/test/integration_tests/nsfs/test_nsfs_integration.js (1)

279-283: Prefer env-provided admin token; fall back to local minting

This keeps tests portable across CI/prod-like environments where only a pre-minted token should be used.

-        rpc_client.options.auth_token = make_auth_token({
+        rpc_client.options.auth_token = process.env.NB_ADMIN_TOKEN || make_auth_token({
             email: EMAIL,
             role: 'admin',
             system: SYSTEM,
         });

src/test/pipeline/namespace_test.js (1)

281-287: Make token source configurable (env first), then mint locally

Improves portability and reduces tight coupling on server internals in pipeline runs.

-    client.options.auth_token = make_auth_token(auth_params);
+    client.options.auth_token = process.env.NB_ADMIN_TOKEN || make_auth_token(auth_params);

src/cmd/backingstore.js (2)

105-110: Validate required env before minting an admin token

If CREATE_SYS_NAME or CREATE_SYS_EMAIL are unset, make_auth_token may create an unusable token; fail fast with a clear error.

-        client.options.auth_token = make_auth_token({
-            system: process.env.CREATE_SYS_NAME,
-            role: 'admin',
-            email: process.env.CREATE_SYS_EMAIL
-        });
+        const { CREATE_SYS_NAME, CREATE_SYS_EMAIL } = process.env;
+        if (!CREATE_SYS_NAME || !CREATE_SYS_EMAIL) {
+            throw new Error('backingstore: CREATE_SYS_NAME and CREATE_SYS_EMAIL env vars are required to mint admin token');
+        }
+        client.options.auth_token = make_auth_token({
+            system: CREATE_SYS_NAME,
+            role: 'admin',
+            email: CREATE_SYS_EMAIL,
+        });

---

105-110: Security check: ensure make_auth_token is safe in this context

Local admin-token minting in a CLI path can be risky if not backed by a server-held signing key, short TTL, and proper audience. Please confirm:

• Tokens are signed with a server-private key not shipped to clients.
• Tokens have short expiration and audience bound to the target address/cluster.
• This path is intended for controlled environments (e.g., DEV/CI).

src/test/external_tests/ceph_s3_tests/test_ceph_s3_config_setup.js (1)

39-41: Guard missing email env

If process.env.email is unset, auth_params.email becomes undefined. Add an explicit check to fail early with a clear error.

-        const auth_params = { email: process.env.email, system: 'noobaa', role: 'admin' };
+        const email = process.env.email;
+        if (!email) throw new Error('Ceph S3 setup: missing required env var "email" for admin auth');
+        const auth_params = { email, system: 'noobaa', role: 'admin' };
         client.options.auth_token = make_auth_token(auth_params);

src/test/utils/agent_functions.js (1)

8-8: DRY: centralize token assignment

Repeated make_auth_token(auth_params) calls can be wrapped to reduce duplication.

-        client.options.auth_token = make_auth_token(auth_params);
+        set_admin_token(client);

Repeat similarly for Lines 40, 87, 133.

Add helper (outside the changed ranges):

function set_admin_token(client) {
    client.options.auth_token = make_auth_token(auth_params);
}

Also applies to: 15-17, 31-31, 40-40, 87-87, 133-133

src/test/system_tests/test_bucket_access.js (1)

21-21: Local admin token generation looks correct; minor polish possible

Import + make_auth_token usage is consistent with the new flow. Since authenticate() is now synchronous, awaiting it later is redundant (optional cleanup).

Optional diff (outside this hunk) to drop the unnecessary await:

-    await authenticate();
+    authenticate();

Also applies to: 79-83

src/test/system_tests/test_md_aggregator.js (1)

16-16: Auth shift is fine; consider renaming and simplifying call chain

Switch to make_auth_token is good. create_auth() is now synchronous—rename to authenticate() and remove the promise hop for clarity.

Suggested refactor (outside this hunk):

-function create_auth() {
+function authenticate() {
   const auth_params = {
     email: 'demo@noobaa.com',
     role: 'admin',
     system: 'demo',
   };
   client.options.auth_token = make_auth_token(auth_params);
 }
 
 // in run_test()
 return control_services('stop', ['bg_workers'])
-  .then(() => create_auth())
+  .then(() => { authenticate(); })
   .then(() => prepare_buckets_with_objects())

Also applies to: 33-39

src/test/qa/agents_matrix.js (1)

48-49: Good switch; update stale error message

The token setup is correct. The catch block still logs “create_auth_token has failed”. Update to reflect make_auth_token.

-    } catch (e) {
-        console.error(`create_auth_token has failed`, e);
+    } catch (e) {
+        console.error(`make_auth_token failed`, e);

Also applies to: 108-113

src/test/system_tests/test_node_failure.js (1)

17-17: Auth change looks good; await is unnecessary now

make_auth_token usage is consistent. Since authenticate() is synchronous, you can drop the await at its call site for clarity.

Optional diff (outside this hunk):

-        await authenticate();
+        authenticate();

Also applies to: 53-58

src/test/pipeline/run_dataset.js (1)

62-70: Update error message to reflect local token generation.

Message still references create_auth_token; adjust for make_auth_token to reduce confusion.

-        } catch (e) {
-            console.error(`create_auth_token has failed`, e);
+        } catch (e) {
+            console.error(`make_auth_token (local token generation) failed`, e);
             process.exit(1);
         }

src/test/qa/reclaim_test.js (1)

158-165: Rename helper to reflect behavior change.

set_rpc_and_create_auth_token no longer “creates” via RPC; consider set_rpc_and_set_auth_token for clarity.

src/test/utils/server_functions.js (1)

49-55: Deduplicate token setup in tests.

Token building and assignment are duplicated; extract a small helper (e.g., get_admin_token(client)) to reduce repetition and make role/system easy to adjust.

Example:

function set_admin_token(client, { email = 'demo@noobaa.com', system = 'demo' } = {}) {
    client.options.auth_token = make_auth_token({ email, system, role: 'admin' });
}

Also applies to: 71-76

src/tools/md_blow_lifecycle.js (1)

9-9: Gate local admin-token minting to dev/test.

Minting admin tokens client-side is dangerous if this tool ships in prod. Add an explicit env guard.

@@
-        client.options.auth_token = make_auth_token(auth_params);
+        if (process.env.NOOBAA_ALLOW_LOCAL_ADMIN_TOKEN !== '1') {
+            throw new Error('Local admin token minting disabled. Set NOOBAA_ALLOW_LOCAL_ADMIN_TOKEN=1 for dev/test only.');
+        }
+        client.options.auth_token = make_auth_token(auth_params);

src/tools/md_blow.js (1)

36-42: Token flow looks correct; mirror the dev/test guard and remove password vestiges.

You already load master keys; add the safety guard and drop the unused password arg to avoid confusion.

@@
-argv.password = argv.password || 'DeMo1';
@@
-        client.options.auth_token = make_auth_token(auth_params);
+        if (process.env.NOOBAA_ALLOW_LOCAL_ADMIN_TOKEN !== '1') {
+            throw new Error('Local admin token minting disabled. Set NOOBAA_ALLOW_LOCAL_ADMIN_TOKEN=1 for dev/test only.');
+        }
+        client.options.auth_token = make_auth_token(auth_params);

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

src/test/pipeline/system_config.js (2)

37-37: Remove password from help text

CLI no longer accepts/uses password; drop this line from usage().

-    --password              -   noobaa management Credentials (password)

---

205-214: Rename to reflect behavior (no server create); update call sites

Function now sets, not creates, a token. Rename for clarity and consistency.

-async function set_rpc_and_create_auth_token() {
+async function set_rpc_and_set_auth_token() {
@@
-    client.options.auth_token = make_auth_token(auth_params);
+    client.options.auth_token = make_auth_token(auth_params);
 }
@@
-        await set_rpc_and_create_auth_token();
+        await set_rpc_and_set_auth_token();

src/server/system_services/account_server.js (1)

1276-1288: Return the promise from make_changes to avoid race

Without returning/awaiting, callers may proceed before the support account persists.

-            system_store.make_changes({
+            return system_store.make_changes({
                 insert: {
                     accounts: [support_account]
                 }
             }).then(() => console.log('SUPPORT ACCOUNT CREATED'));

src/tools/md_blow_lifecycle.js (2)

21-24: Remove hard-coded default password; require explicit if still needed

Defaulting to 'DeMo1' is insecure and misleading post-password-removal.

 argv.email = argv.email || 'admin@noobaa.io';
-argv.password = argv.password || 'DeMo1';
 argv.system = argv.system || 'noobaa';
+
+if (!argv.password) {
+    console.error('Error: --password is required');
+    process.exit(1);
+}

---

59-65: Load root/master keys before minting token

Preload keys to avoid signing failures when calling make_auth_token.

-        await system_store.load();
+        const mkm = system_store.master_key_manager;
+        await mkm.load_root_keys_from_mount();
+        await system_store.load();

src/tools/nbcat.js (1)

71-78: init_api must return a Promise

Call sites use .then(...); make init_api async (or return a resolved Promise).

-function init_api() {
+async function init_api() {
     const auth_params = {
         email: 'demo@noobaa.com',
         role: 'admin',
         system: 'demo',
     };
     client.options.auth_token = make_auth_token(auth_params);
 }

src/test/system_tests/test_cloud_pools.js (1)

145-152: Broken promise chain: authenticate() is sync but run_test() still calls .then()

authenticate() no longer returns a Promise; run_test()’s authenticate().then(...) will throw. Make authenticate async (preferred) or return Promise.resolve().

Apply one of:

-function authenticate() {
+async function authenticate() {
   const auth_params = {
     email: 'demo@noobaa.com',
-    role: 'admin',
-    system: 'demo',
+    role: 'admin',
+    system: 'demo',
   };
   client.options.auth_token = make_auth_token(auth_params);
 }

Alternative:

 function authenticate() {
   const auth_params = {
     email: 'demo@noobaa.com',
     role: 'admin',
     system: 'demo',
   };
   client.options.auth_token = make_auth_token(auth_params);
+  return Promise.resolve();
 }

Also applies to: 214-218

src/agent/block_store_speed.js (1)

39-44: Do not auto-mint admin tokens in the agent; require explicit token (security).

If the signing secret is present, any agent run can mint admin tokens. Require a provided token (flag/env), or gate minting behind an explicit DEV flag.

Minimal secure change (require explicit token, no minting):

-const { make_auth_token } = require('../server/common_services/auth_server');
+// Intentionally avoid importing make_auth_token here to prevent local minting.

@@
-    const token = argv.token || make_auth_token({
-        system: argv.system,
-        role: 'admin',
-        email: argv.email,
-    });
+    const token = argv.token || process.env.NOOBAA_AUTH_TOKEN;
+    if (!token) {
+        console.error('Missing auth token. Pass --token or set NOOBAA_AUTH_TOKEN.');
+        process.exit(2);
+    }

If you insist on supporting local minting for dev: guard it explicitly:

-    const token = argv.token || make_auth_token({
-        system: argv.system,
-        role: 'admin',
-        email: argv.email,
-    });
+    const isDev = argv.dev === true || process.env.DEV_MODE === 'true';
+    const token = argv.token || process.env.NOOBAA_AUTH_TOKEN ||
+        (isDev ? require('../server/common_services/auth_server').make_auth_token({
+            system: argv.system, role: 'admin', email: argv.email,
+        }) : null);
+    if (!token) {
+        console.error('Missing auth token. Pass --token, set NOOBAA_AUTH_TOKEN, or use --dev.');
+        process.exit(2);
+    }

src/server/common_services/auth_server.js (2)

37-37: Return RpcError instead of generic Error from create_auth.

Throwing Error produces 500; use a stable UNAUTHORIZED RpcError with guidance.

-function create_auth(req) {
-    throw new Error('TODO @tangledbytes');
-}
+function create_auth(req) {
+    throw new RpcError('UNAUTHORIZED', 'Password-based auth is disabled. Use make_auth_token or create_k8s_auth.');
+}

---

401-410: Harden account/system resolution; support legacy fields and normalize email.

Direct map indexing is brittle and case-sensitive. Use getters and normalize email; accept system_name or legacy system.

     req.load_auth = function() {
         if (req.auth) {
-            if (req.auth.account_id) req.account = system_store.data.get_by_id(req.auth.account_id);
-            else if (req.auth.email) req.account = system_store.data.accounts_by_email[req.auth.email];
+            if (req.auth.account_id) {
+                req.account = system_store.data.get_by_id(req.auth.account_id);
+            } else if (req.auth.email) {
+                const email = new SensitiveString(String(req.auth.email).trim().toLowerCase());
+                req.account = system_store.get_account_by_email(email);
+            }
 
-            if (req.auth.system_id) req.system = system_store.data.get_by_id(req.auth.system_id);
-            else if (req.auth.system_name) req.system = system_store.data.systems_by_name[req.auth.system_name];
+            if (req.auth.system_id) {
+                req.system = system_store.data.get_by_id(req.auth.system_id);
+            } else if (req.auth.system_name || req.auth.system) {
+                const name = String(req.auth.system_name || req.auth.system);
+                req.system = system_store.data.systems_by_name[name];
+            }
 
             req.role = req.auth.role;
         }
     };

src/test/pipeline/system_config.js (1)

138-138: Fix log to print actual max

Hard-coded 60500 in the message; use the passed max.

-        console.log(`The tcp port range is: ${min} to ${60500} - as should`);
+        console.log(`The tcp port range is: ${min} to ${max} - as should`);

src/server/system_services/account_server.js (2)

203-211: Remove password/has_login from external user creation

Passwords are deprecated; this still sets them and can confuse callers.

-    Object.assign(req.rpc_params, {
-        is_external: true,
-        password: new SensitiveString(chance.string({ length: 16 })),
-        must_change_password: false,
-        has_login: true,
-        s3_access: true,
-        allow_bucket_creation: true,
-        default_resource: default_resource.name
-    });
+    Object.assign(req.rpc_params, {
+        is_external: true,
+        s3_access: true,
+        allow_bucket_creation: true,
+        default_resource: default_resource.name
+    });

---

1356-1377: Drop password validation branch

has_login/password validation is dead code after removing password auth; consider deleting to prevent inconsistent states.

-    if (req.rpc_params.has_login) {
-        if (!req.rpc_params.password) {
-            throw new RpcError('BAD_REQUEST', 'Password is missing');
-        }
-        …
-    } else if (req.rpc_params.password) {
-        throw new RpcError('BAD_REQUEST', 'Password should not be sent');
-    }
+    // Password-based login removed; no password checks.

src/tools/md_blow_lifecycle.js (1)

185-186: Fix debug log: id is undefined

Use multipart_id or obj_id.

-    dbg.log0('complete_multipart', params.id);
+    dbg.log0('complete_multipart', complete_params.multipart_id);

src/test/system_tests/sanity_build_test.js (1)

220-228: Align test accounts with password removal

Avoid setting passwords/has_login in test data unless explicitly required by server validation.

     const ac4 = {
         name: "ac_haslogin",
         email: "ac_haslogin@noobaa.com",
-        has_login: true,
-        password: "c1QiGkl2",
+        has_login: false,
         must_change_password: false,
         s3_access: true,
         default_resource: 'COMP-S3-V2-Resource',
         allow_bucket_creation: true
     };

src/server/common_services/auth_server.js (1)

619-633: Document new token fields in make_auth_token JSDoc and validate inputs.

You added email/system_name to the payload; update JSDoc and consider basic validation.

  *      - role
  *      - extra
  *      - expiry
+ *      - authorized_by
+ *      - email
+ *      - system_name

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

src/test/external_tests/external_tests_utils.js (1)

36-40: Do not embed plaintext password in JWT payload; make role optional with sane default.

This reintroduces sensitive data into signed tokens and contradicts the bcrypt/password removal goal. Keep the password param for backward compatibility but ignore it; default role to 'admin'.

-async function get_rpc_client_by_email_and_password(email, password) {
+async function get_rpc_client_by_email_and_password(email, _password, role = 'admin') {
     const rpc_client = get_global_rpc_client();
-    const auth_params = { email, password, system: 'noobaa', role: 'admin' };
-    rpc_client.options.auth_token = make_auth_token(auth_params);
+    const auth_params = { email, system: 'noobaa', ...(role ? { role } : {}) };
+    rpc_client.options.auth_token = make_auth_token(auth_params);
     return rpc_client;
 }

Run to find and clean any remaining password fields in token payloads and any lingering create_auth_token calls:

#!/bin/bash
set -euo pipefail
echo "Calls to removed client.create_auth_token:"
rg -nP --glob 'src/**' '\bcreate_auth_token\s*\(' -C2 || true

echo -e "\nAuth tokens that still include password fields:"
rg -nP --glob 'src/**' '(auth_params|{)[^}]*password\s*:' -C2 || true

echo -e "\nHardcoded demo password occurrences:"
rg -n --glob 'src/**' 'DeMo1' || true

src/server/common_services/auth_server.js (2)

36-38: Return RpcError instead of throwing a generic Error (avoid 500s; clearly deprecate).

Throwing Error will surface as HTTP 500 and break legacy clients still calling this RPC. Return a stable RpcError('UNAUTHORIZED', ...) with guidance.

 function create_auth(req) {
-    throw new Error('TODO @tangledbytes');
+    throw new RpcError('UNAUTHORIZED', 'Password-based auth is disabled. Use make_auth_token or create_k8s_auth.');
 }

Run to confirm no remaining server/client call-sites:

#!/bin/bash
rg -nP -C2 '\bcreate_auth\b|\bcreate_auth_token\b' src

---

401-410: Harden token-to-entity resolution (normalize email; support legacy system name; avoid direct map access).

Directly indexing accounts_by_email/systems_by_name is brittle (case/shape drift) and misses legacy auth.system. Normalize and use store helpers.

     req.load_auth = function() {
         if (req.auth) {
             if (req.auth.account_id) req.account = system_store.data.get_by_id(req.auth.account_id);
-            else if (req.auth.email) req.account = system_store.data.accounts_by_email[req.auth.email];
+            else if (req.auth.email) {
+                const email = String(req.auth.email).trim().toLowerCase();
+                req.account = system_store.get_account_by_email(new SensitiveString(email));
+            }
 
             if (req.auth.system_id) req.system = system_store.data.get_by_id(req.auth.system_id);
-            else if (req.auth.system_name) req.system = system_store.data.systems_by_name[req.auth.system_name];
+            else if (req.auth.system_name || req.auth.system) {
+                const name = String(req.auth.system_name || req.auth.system).trim();
+                req.system = system_store.data.systems_by_name[name];
+            }
 
             req.role = req.auth.role;
         }
     };

src/test/qa/cloud_test.js (1)

160-167: Local token generation OK; make role/system configurable via params (keep safe defaults).

Avoid hardcoding; let callers override without touching call sites.

-async function set_rpc_and_create_auth_token(client_to_auth) {
-    const auth_params = {
-        email: 'demo@noobaa.com',
-        system: 'demo',
-        role: 'admin',
-    };
-    client_to_auth.options.auth_token = make_auth_token(auth_params);
+async function set_rpc_and_create_auth_token(
+    client_to_auth,
+    { email = 'demo@noobaa.com', system = 'demo', role = 'admin' } = {}
+) {
+    client_to_auth.options.auth_token = make_auth_token({ email, system, role });
 }

src/test/qa/data_availability_test.js (1)

195-202: Set token locally: good; accept overrides to reduce coupling to 'demo' and 'admin'.

Keep defaults but allow callers/CI to pass different values.

-async function set_rpc_and_create_auth_token() {
-    const auth_params = {
-        email: 'demo@noobaa.com',
-        system: 'demo',
-        role: 'admin',
-    };
-    client.options.auth_token = make_auth_token(auth_params);
+async function set_rpc_and_create_auth_token(
+    { email = 'demo@noobaa.com', system = 'demo', role = 'admin' } = {}
+) {
+    client.options.auth_token = make_auth_token({ email, system, role });
 }

src/tools/md_blow.js (1)

36-42: Token creation is fine; drop unused password option to avoid confusion.

argv.password is no longer used. Remove its default and any help text mentioning it.

Example change outside the diff hunk:

// Remove this line near the args defaults:
// argv.password = argv.password || 'DeMo1';

src/test/utils/server_functions.js (2)

49-55: OK to use locally signed admin token while polling for readiness.

Small nit: consider lifting auth_params to a helper to avoid duplication and ease future changes.

---

70-76: Same here: local token use LGTM; minor duplication nit.

Factor a tiny helper for auth param assembly to keep consistency across tests.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

src/tools/nbcat.js (1)

71-78: Fix: init_api must return a Promise; callers use .then()

init_api() is sync and returns undefined; every call site chains .then(), causing a runtime TypeError.

-function init_api() {
+async function init_api() {
     const auth_params = {
         email: 'demo@noobaa.com',
         role: 'admin',
         system: 'demo',
     };
     client.options.auth_token = make_auth_token(auth_params);
 }

src/server/system_services/account_server.js (1)

1276-1288: Support account creation: minimal fields OK; verify no code needs master_key_id/roles. Good on returning the promise.

Nice job returning the promise from make_changes; that fixes the race noted earlier. Confirm no code path accesses support account’s master_key_id or expects roles; otherwise, create and attach a master key at creation.

Optional enhancement (only if any path needs encryption under support account):

             console.log('CREATING SUPPORT ACCOUNT...');
             const support_account = {
                 _id: system_store.new_system_store_id(),
                 name: new SensitiveString('Support'),
                 email: new SensitiveString('support@noobaa.com'),
                 has_login: false,
                 is_support: true,
             };

-            return system_store.make_changes({
+            // Optional: provision a master key for the support account to avoid NPEs in crypto flows.
+            // const support_mkey = system_store.master_key_manager.new_master_key({
+            //     description: `master key of ${support_account._id} account`,
+            //     cipher_type: system_store.data.systems[0].master_key_id.cipher_type,
+            //     master_key_id: system_store.data.systems[0].master_key_id._id
+            // });
+            // support_account.master_key_id = support_mkey._id;
+
+            return system_store.make_changes({
                 insert: {
-                    accounts: [support_account]
+                    accounts: [support_account],
+                    // master_keys: [support_mkey] // if the optional block above is enabled
                 }
             }).then(() => console.log('SUPPORT ACCOUNT CREATED'));

Verify assumptions:

#!/bin/bash
set -euo pipefail

echo "=== Accesses that may require an account.master_key_id ==="
rg -nP -C2 '(req\.account|account)\.master_key_id' src || true

echo
echo "=== is_support usage hot spots ==="
rg -nP -C2 '\bis_support\b' src || true