fix(admin): require ADMIN_PASSWORD instead of a hardcoded default (#47)

.env.example

@@ -11,3 +11,6 @@ CIRCLE_USDC_TOKEN_ID=15dc2b5d-0994-58b0-bf8c-3a0501148ee8
 
 # Misc
 ADMIN_EMAIL=admin@admin.com
+# Required to auto-provision the admin user. Must be strong (>= 8 chars, not a
+# common password). Leave blank to skip automatic admin creation.
+ADMIN_PASSWORD=

README.md

@@ -114,6 +114,7 @@ CIRCLE_USDC_TOKEN_ID=
 
 # Misc
 ADMIN_EMAIL=admin@admin.com
+ADMIN_PASSWORD=
 ```
 
 | Variable                              | Scope       | Purpose                                                                  |
@@ -125,16 +126,19 @@ ADMIN_EMAIL=admin@admin.com
 | `CIRCLE_ENTITY_SECRET`                | Server-side | Circle entity secret for wallet operations.                              |
 | `CIRCLE_BLOCKCHAIN`                   | Server-side | Blockchain network identifier (e.g., "ARC-TESTNET").                     |
 | `CIRCLE_USDC_TOKEN_ID`                | Server-side | USDC token ID for the specified blockchain. Pre-filled for ARC-TESTNET.  |
-| `ADMIN_EMAIL`                         | Server-side | Admin user email address.                                                |
+| `ADMIN_EMAIL`                         | Server-side | Admin user email address. Defaults to `admin@admin.com`.                 |
+| `ADMIN_PASSWORD`                      | Server-side | Password for the auto-provisioned admin user. Required to create it; must be strong (>= 8 chars, not a common password). Leave blank to skip admin creation. |
 
 ## User Accounts
 
 ### Admin Account
 
-On first startup, an admin user is automatically created with the following credentials:
+On first startup, an admin user is automatically created **only if** `ADMIN_PASSWORD` is set to a strong value (see the environment table above):
 
-- **Email:** `admin@admin.com`
-- **Password:** `123456`
+- **Email:** `ADMIN_EMAIL` (defaults to `admin@admin.com`)
+- **Password:** the value of `ADMIN_PASSWORD` — choose a strong, unique password
+
+If `ADMIN_PASSWORD` is unset, or weak (shorter than 8 characters or a well-known password), admin creation is skipped and a message is logged — so a publicly reachable deployment never ships with a guessable default.
 
 The admin account has access to the **Admin Dashboard**, which provides an overview of all users, wallets, and transactions in the system.
 

lib/supabase/initialize-admin-user.ts

@@ -40,13 +40,51 @@ if (supabaseUrl && supabaseServiceRoleKey) {
   );
 }
 
+// Passwords that must never guard a privileged account, even if set explicitly.
+const COMMON_WEAK_PASSWORDS = new Set([
+  "123456",
+  "12345678",
+  "123456789",
+  "password",
+  "admin",
+  "admin123",
+  "qwerty",
+  "letmein",
+  "changeme",
+  "welcome",
+]);
+
+const isWeakPassword = (password: string): boolean =>
+  password.length < 8 || COMMON_WEAK_PASSWORDS.has(password.toLowerCase());
+
 const createAdminUserIfNotExists = async () => {
   if (!adminAuthClient) {
     return;
   }
 
-  const adminEmail = "admin@admin.com";
-  const adminPassword = "123456";
+  // Never provision the admin account with a hardcoded, publicly known
+  // password. Require the deployment to supply one explicitly via
+  // ADMIN_PASSWORD and reject obviously weak values, so an exposed instance
+  // cannot be taken over with a guessable default. ADMIN_EMAIL keeps its
+  // documented default because the database RLS policies key off that address.
+  const adminEmail = process.env.ADMIN_EMAIL ?? "admin@admin.com";
+  const adminPassword = process.env.ADMIN_PASSWORD;
+
+  if (!adminPassword) {
+    console.warn(
+      "ADMIN_PASSWORD is not set. Skipping admin user creation. " +
+        "Set a strong ADMIN_PASSWORD to enable automatic admin provisioning."
+    );
+    return;
+  }
+
+  if (isWeakPassword(adminPassword)) {
+    console.error(
+      "ADMIN_PASSWORD is too weak (must be at least 8 characters and not a " +
+        "well-known password). Skipping admin user creation."
+    );
+    return;
+  }
 
   // We call our custom database function via RPC (Remote Procedure Call).
   // This is a single, fast, and scalable database query.

types/environment.d.ts

@@ -31,5 +31,6 @@ namespace NodeJS {
 
     // Misc
     ADMIN_EMAIL: string
+    ADMIN_PASSWORD?: string
   }
 }