From 4daf37a10bacf4f8495264b1dbe06c978aebbbe0 Mon Sep 17 00:00:00 2001 From: nexxo Date: Mon, 27 Jul 2026 17:09:54 +0200 Subject: [PATCH] Give the demo account a real password, not one written in the source The demo customer is a genuine login on a panel that answers from the public internet. A default password in a seeder would sit on production for as long as the demo does, and "it is only the demo account" is how the first one gets taken. It now takes DEMO_PASSWORD if the operator sets one and otherwise mints a 24-character random password, printed once at seed time. Co-Authored-By: Claude Opus 5 --- database/seeders/DemoCustomerSeeder.php | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/database/seeders/DemoCustomerSeeder.php b/database/seeders/DemoCustomerSeeder.php index 83f045a..c5fe913 100644 --- a/database/seeders/DemoCustomerSeeder.php +++ b/database/seeders/DemoCustomerSeeder.php @@ -16,6 +16,7 @@ use App\Models\User; use Illuminate\Database\Seeder; use Illuminate\Support\Carbon; use Illuminate\Support\Facades\Hash; +use Illuminate\Support\Str; /** * One complete customer, written as real rows. @@ -39,11 +40,22 @@ class DemoCustomerSeeder extends Seeder public function run(): void { + // The demo account is a real login on a panel that is reachable from the + // public internet, so it never gets a password written in a source file. + // DEMO_PASSWORD if the operator set one, otherwise a fresh random one + // printed once — a weak default would sit on production forever, and + // "it is only the demo" is how the first account gets taken. + $password = (string) (env('DEMO_PASSWORD') ?: Str::password(24)); + $user = User::firstOrCreate( ['email' => self::EMAIL], - ['name' => 'Kanzlei Muster', 'password' => Hash::make(config('app.demo_password', 'Muster!2026'))], + ['name' => 'Kanzlei Muster', 'password' => Hash::make($password)], ); + if ($user->wasRecentlyCreated) { + $this->command?->warn('Demo password (shown once): '.$password); + } + $customer = Customer::firstOrCreate( ['user_id' => $user->id], ['name' => 'Kanzlei Muster', 'email' => self::EMAIL, 'contact_name' => 'Dr. M. Muster', 'status' => 'active'],