enable-admnn

src/server/utils/auth.py

@@ -27,21 +27,6 @@ Base.metadata.create_all(bind=engine)
 # Password hashing
 pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
 
-# Seed initial data (optional)
-def seed_initial_data():
-    db = SessionLocal()
-    if not db.query(User).filter_by(username="testuser").first():
-        hashed_password = pwd_context.hash("password123")
-        db.add(User(username="testuser", password=hashed_password, is_admin=False))
-        db.commit()
-    if not db.query(User).filter_by(username="admin").first():
-        hashed_password = pwd_context.hash("adminpass")
-        db.add(User(username="admin", password=hashed_password, is_admin=True))
-        db.commit()
-    db.close()
-
-seed_initial_data()
-
 class Settings(BaseSettings):
     api_key_secret: str = Field(..., env="API_KEY_SECRET")
     token_expiration_minutes: int = Field(30, env="TOKEN_EXPIRATION_MINUTES")
@@ -55,6 +40,9 @@ class Settings(BaseSettings):
     external_asr_url: str = Field(..., env="EXTERNAL_ASR_URL")
     external_text_gen_url: str = Field(..., env="EXTERNAL_TEXT_GEN_URL")
     external_audio_proc_url: str = Field(..., env="EXTERNAL_AUDIO_PROC_URL")
+    # Admin credentials required from environment variables, no defaults
+    default_admin_username: str = Field(..., env="DHWANI_ADMIN_USERNAME")
+    default_admin_password: str = Field(..., env="DHWANI_ADMIN_PASSWORD")
 
     class Config:
         env_file = ".env"
@@ -63,6 +51,26 @@ class Settings(BaseSettings):
 settings = Settings()
 logger.info(f"Loaded API_KEY_SECRET at startup: {settings.api_key_secret}")
 
+# Seed initial data (optional)
+def seed_initial_data():
+    db = SessionLocal()
+    # Seed test user (non-admin)
+    if not db.query(User).filter_by(username="testuser").first():
+        hashed_password = pwd_context.hash("password123")
+        db.add(User(username="testuser", password=hashed_password, is_admin=False))
+        db.commit()
+    # Seed admin user using environment variables
+    admin_username = settings.default_admin_username
+    admin_password = settings.default_admin_password
+    if not db.query(User).filter_by(username=admin_username).first():
+        hashed_password = pwd_context.hash(admin_password)
+        db.add(User(username=admin_username, password=hashed_password, is_admin=True))
+        db.commit()
+    db.close()
+    logger.info(f"Seeded initial data: admin user '{admin_username}'")
+
+seed_initial_data()
+
 # Use HTTPBearer
 bearer_scheme = HTTPBearer()