migration

2026-10-07 20:20:27 +03:30
parent 92831ed33e
commit 8c5d971d1f
17 changed files with 286 additions and 57 deletions
@@ -12,6 +12,13 @@ import * as bcrypt from 'bcryptjs';
 */
 export const OTP_ONLY_PASSWORD_HASH = '!OTP_ONLY_NO_PASSWORD_LOGIN';

+/**
+ * Same idea for an admin account created before anyone has issued it a
+ * password (e.g. a workshop supervisor added from the branch form): it cannot
+ * sign in until a password is set through the users screen.
+ */
+export const NO_PASSWORD_YET_HASH = '!NO_PASSWORD_SET_YET';
+
 /**
 * A real bcrypt hash always starts with `$2` ($2a$, $2b$, or PHP's $2y$ from
 * the legacy server — all three verify with bcryptjs). Anything else is not a