From e42386a5eea785fee56497fb912fbafc6617c779 Mon Sep 17 00:00:00 2001
From: safavimohadeseh78 <safavimohadeseh78@gmail.com>
Date: Wed, 5 Aug 2026 08:21:04 +0200
Subject: [PATCH] fix(auth): reset demo password only outside production

Keep demo login predictable in development without overwriting stored hashes when NODE_ENV is production.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/auth/auth.service.ts | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/auth/auth.service.ts b/src/auth/auth.service.ts
index 1a6c2c2..8ceb5a7 100644
--- a/src/auth/auth.service.ts
+++ b/src/auth/auth.service.ts
@@ -99,14 +99,25 @@ export class AuthService {
   }
 
   seedDemoAccount(): void {
+    const demoPasswordHash = bcrypt.hashSync('123456', 10)
     const demo = this.findAccountByUsername('demo')
-    if (demo) return
+
+    if (demo) {
+      // Dev DB may retain a stale hash after recovery/migration — keep demo login predictable.
+      if (process.env.NODE_ENV !== 'production') {
+        this.database
+          .getDb()
+          .prepare('UPDATE auth_accounts SET password_hash = ? WHERE username = ?')
+          .run(demoPasswordHash, 'demo')
+      }
+      return
+    }
 
     this.users.ensureUser('demo')
     const account: AuthAccount = {
       id: randomUUID(),
       username: 'demo',
-      passwordHash: bcrypt.hashSync('123456', 10),
+      passwordHash: demoPasswordHash,
       userId: 'demo',
       createdAt: new Date().toISOString(),
     }