From d08a8a3866cb4477439d969733a930833727d105 Mon Sep 17 00:00:00 2001 From: boban Date: Thu, 2 Jul 2026 22:43:09 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20rename=20the=20generated=20password=20"?= =?UTF-8?q?one-time"=20=E2=86=92=20"initial"=20(rotation=20is=20optional)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Password rotation is a nudge, not a wall (Install sets must_change_password=true but EnsureSecurityOnboarded only prompts and is skippable), so calling the generated credential a "one-time password" wrongly implied forced/single-use rotation. Renamed the user-facing term everywhere: - README + lang/{en,de}/accounts.php: "one-time password" / "Einmal-Passwort" → "initial password" / "Initialpasswort"; temp_intro "must change on first sign-in" → "prompted to change" / "sollte … geändert werden". - Install.php $description: "Standard-Passwort (Zwangswechsel …)" → "zufälligem Initialpasswort (Wechsel empfohlen, nicht erzwungen)". - Install.php / CreateUser.php comments aligned. Kept "one-time backup codes" (2FA codes are single-use) and "shown only once" (the summary is displayed once). Co-Authored-By: Claude Opus 4.8 --- README.md | 6 +++--- app/Console/Commands/Install.php | 6 +++--- app/Livewire/Modals/CreateUser.php | 8 ++++---- lang/de/accounts.php | 8 ++++---- lang/en/accounts.php | 8 ++++---- 5 files changed, 18 insertions(+), 18 deletions(-) diff --git a/README.md b/README.md index a7e35a3..c82dc25 100644 --- a/README.md +++ b/README.md @@ -103,18 +103,18 @@ The installer is **idempotent** (safe to re-run) and, in one pass: `CLUSEV_ADMIN_EMAIL` / an optional `CLUSEV_DOMAIN` from the environment for an unattended install. A domain with automatic HTTPS is set later in the dashboard — see [Access, domain & TLS](#access-domain--tls). 4. Generates all secrets (once — never regenerated on re-run), builds the image, starts the stack, - runs the migrations, and creates the first administrator with a **random one-time password** printed + runs the migrations, and creates the first administrator with a **random initial password** printed in the closing summary. 5. Installs a themed host login banner (MOTD) showing the dashboard address and live stack status. When it finishes, the terminal prints a single summary: the **dashboard URL**, the **admin login** -(your e-mail — `admin@clusev.local` if you left it empty — plus a **random one-time password**), and +(your e-mail — `admin@clusev.local` if you left it empty — plus a **random initial password**), and the **`clusev` host user** + its own random password. Both passwords are shown **only once** — note them down. ### First login -Log in with your admin e-mail and the **one-time password from the installer's summary**. Setting your +Log in with your admin e-mail and the **initial password from the installer's summary**. Setting your own password is **recommended** — a banner keeps reminding you until you do — but no longer forced, so a missed reminder can never lock you out of your own panel. You can change the login e-mail later under **Settings → Profile**. 2FA is **optional but recommended** — enable TOTP and/or a security key from diff --git a/app/Console/Commands/Install.php b/app/Console/Commands/Install.php index 8796647..ad4a8f1 100644 --- a/app/Console/Commands/Install.php +++ b/app/Console/Commands/Install.php @@ -9,7 +9,7 @@ use Illuminate\Support\Str; /** * Idempotent first-run bootstrap (called by install.sh, phase 7). * - * Creates the initial admin with a RANDOM one-time password (printed once by install.sh from the + * Creates the initial admin with a RANDOM initial password (printed once by install.sh from the * CLUSEV_ADMIN_PASSWORD line below) rather than a guessable literal — rotation is optional now, so a * well-known default like "clusev" would be a standing takeover credential. `must_change_password` is * still set (the banner nudges a rotation), but even if kept, the generated secret is not guessable. @@ -29,7 +29,7 @@ class Install extends Command {--email= : Admin-Login + Let's-Encrypt-E-Mail} {--name=Administrator : Anzeigename des Admins}"; - protected $description = 'Idempotenter Erstlauf: legt den ersten Admin mit Standard-Passwort an (Zwangswechsel beim ersten Login)'; + protected $description = 'Idempotenter Erstlauf: legt den ersten Admin mit zufälligem Initialpasswort an (Wechsel empfohlen, nicht erzwungen)'; public function handle(): int { @@ -47,7 +47,7 @@ class Install extends Command return self::FAILURE; } - // Random, non-guessable one-time password (printed once below). Satisfies any policy. + // Random, non-guessable initial password (printed once below). Satisfies any policy. $password = Str::password(16); $user = User::create([ diff --git a/app/Livewire/Modals/CreateUser.php b/app/Livewire/Modals/CreateUser.php index 0c98ff2..7970de3 100644 --- a/app/Livewire/Modals/CreateUser.php +++ b/app/Livewire/Modals/CreateUser.php @@ -13,7 +13,7 @@ use LivewireUI\Modal\ModalComponent; /** * Form modal: add a new administrator account. Every account is a full admin (no roles). The creator - * may set a password directly, or leave it blank — then a strong one-time password is generated, the + * may set a password directly, or leave it blank — then a strong initial password is generated, the * account is flagged `must_change_password`, and the clear-text password is revealed ONCE in the modal * (never persisted or logged). An operator-set password is the user's own, so no forced rotation. */ @@ -23,7 +23,7 @@ class CreateUser extends ModalComponent public string $email = ''; - /** Optional operator-set password; blank = generate a one-time password and reveal it once. */ + /** Optional operator-set password; blank = generate an initial password and reveal it once. */ public string $password = ''; /** Clear-text temp password, held in component state only to reveal it once. */ @@ -75,7 +75,7 @@ class CreateUser extends ModalComponent } // Operator-set password = the user's own login (no forced rotation). Blank = generate a strong - // one-time password that the user must rotate, and reveal it once below. + // initial password that the user is prompted to rotate, and reveal it once below. $operatorSet = $this->password !== ''; $password = $operatorSet ? $this->password : Str::password(16); @@ -103,7 +103,7 @@ class CreateUser extends ModalComponent return; } - // Reveal the generated one-time password ONCE — swaps the form for the reveal panel. + // Reveal the generated initial password ONCE — swaps the form for the reveal panel. $this->createdName = $user->name; $this->tempPassword = $password; } diff --git a/lang/de/accounts.php b/lang/de/accounts.php index 7f27c5d..aa04f83 100644 --- a/lang/de/accounts.php +++ b/lang/de/accounts.php @@ -14,20 +14,20 @@ return [ // Create modal 'create_title' => 'Konto hinzufügen', - 'create_subtitle' => 'Vollwertiger Administrator. Setze ein Passwort — oder lass es leer, dann wird ein Einmal-Passwort erzeugt und einmalig angezeigt.', + 'create_subtitle' => 'Vollwertiger Administrator. Setze ein Passwort — oder lass es leer, dann wird ein Initialpasswort erzeugt und einmalig angezeigt.', 'name_label' => 'Name', 'name_placeholder' => 'Erika Mustermann', 'email_label' => 'E-Mail', 'email_placeholder' => 'erika@example.com', 'password_label' => 'Passwort', - 'password_placeholder' => 'Leer = Einmal-Passwort erzeugen', - 'password_hint' => 'Optional. Min. 6 Zeichen. Leer lassen, um ein sicheres Einmal-Passwort zu erzeugen.', + 'password_placeholder' => 'Leer = Initialpasswort erzeugen', + 'password_hint' => 'Optional. Min. 6 Zeichen. Leer lassen, um ein sicheres Initialpasswort zu erzeugen.', 'created_notify' => 'Konto :name angelegt.', 'create_submit' => 'Konto anlegen', // Temp-password reveal (shown once) 'temp_heading' => 'Konto angelegt', - 'temp_intro' => 'Gib dieses Einmal-Passwort an :name weiter. Es muss beim ersten Anmelden geändert werden.', + 'temp_intro' => 'Gib dieses Initialpasswort an :name weiter. Es sollte beim ersten Anmelden geändert werden.', 'temp_label' => 'Temporäres Passwort', 'temp_warning' => 'Kopiere dieses Passwort jetzt — es wird nur einmal angezeigt und kann später nicht erneut abgerufen werden.', 'temp_copy' => 'Kopieren', diff --git a/lang/en/accounts.php b/lang/en/accounts.php index 86cef08..6151fa0 100644 --- a/lang/en/accounts.php +++ b/lang/en/accounts.php @@ -14,20 +14,20 @@ return [ // Create modal 'create_title' => 'Add account', - 'create_subtitle' => 'Full administrator. Set a password — or leave it blank to generate a one-time password shown once.', + 'create_subtitle' => 'Full administrator. Set a password — or leave it blank to generate a initial password shown once.', 'name_label' => 'Name', 'name_placeholder' => 'Jane Doe', 'email_label' => 'Email', 'email_placeholder' => 'jane@example.com', 'password_label' => 'Password', - 'password_placeholder' => 'Blank = generate a one-time password', - 'password_hint' => 'Optional. Min. 6 characters. Leave blank to generate a secure one-time password.', + 'password_placeholder' => 'Blank = generate a initial password', + 'password_hint' => 'Optional. Min. 6 characters. Leave blank to generate a secure initial password.', 'created_notify' => 'Account :name created.', 'create_submit' => 'Create account', // Temp-password reveal (shown once) 'temp_heading' => 'Account created', - 'temp_intro' => 'Share this one-time password with :name. They must change it on first sign-in.', + 'temp_intro' => 'Share this initial password with :name. They are prompted to change it on first sign-in.', 'temp_label' => 'Temporary password', 'temp_warning' => 'Copy this password now — it is shown only once and cannot be retrieved later.', 'temp_copy' => 'Copy',