docs: rename the generated password "one-time" → "initial" (rotation is optional)
Password rotation is a nudge, not a wall (Install sets must_change_password=true
but EnsureSecurityOnboarded only prompts and is skippable), so calling the
generated credential a "one-time password" wrongly implied forced/single-use
rotation. Renamed the user-facing term everywhere:
- README + lang/{en,de}/accounts.php: "one-time password" / "Einmal-Passwort"
→ "initial password" / "Initialpasswort"; temp_intro "must change on first
sign-in" → "prompted to change" / "sollte … geändert werden".
- Install.php $description: "Standard-Passwort (Zwangswechsel …)" → "zufälligem
Initialpasswort (Wechsel empfohlen, nicht erzwungen)".
- Install.php / CreateUser.php comments aligned.
Kept "one-time backup codes" (2FA codes are single-use) and "shown only once"
(the summary is displayed once).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat/v1-foundation
boban
parent
657e659d76
commit
d08a8a3866
|
|
@ -103,18 +103,18 @@ The installer is **idempotent** (safe to re-run) and, in one pass:
|
|||
`CLUSEV_ADMIN_EMAIL` / an optional `CLUSEV_DOMAIN` from the environment for an unattended install. A
|
||||
domain with automatic HTTPS is set later in the dashboard — see [Access, domain & TLS](#access-domain--tls).
|
||||
4. Generates all secrets (once — never regenerated on re-run), builds the image, starts the stack,
|
||||
runs the migrations, and creates the first administrator with a **random one-time password** printed
|
||||
runs the migrations, and creates the first administrator with a **random initial password** printed
|
||||
in the closing summary.
|
||||
5. Installs a themed host login banner (MOTD) showing the dashboard address and live stack status.
|
||||
|
||||
When it finishes, the terminal prints a single summary: the **dashboard URL**, the **admin login**
|
||||
(your e-mail — `admin@clusev.local` if you left it empty — plus a **random one-time password**), and
|
||||
(your e-mail — `admin@clusev.local` if you left it empty — plus a **random initial password**), and
|
||||
the **`clusev` host user** + its own random password. Both passwords are shown **only once** — note
|
||||
them down.
|
||||
|
||||
### First login
|
||||
|
||||
Log in with your admin e-mail and the **one-time password from the installer's summary**. Setting your
|
||||
Log in with your admin e-mail and the **initial password from the installer's summary**. Setting your
|
||||
own password is **recommended** — a banner keeps reminding you until you do — but no longer forced, so a
|
||||
missed reminder can never lock you out of your own panel. You can change the login e-mail later under
|
||||
**Settings → Profile**. 2FA is **optional but recommended** — enable TOTP and/or a security key from
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ use Illuminate\Support\Str;
|
|||
/**
|
||||
* Idempotent first-run bootstrap (called by install.sh, phase 7).
|
||||
*
|
||||
* Creates the initial admin with a RANDOM one-time password (printed once by install.sh from the
|
||||
* Creates the initial admin with a RANDOM initial password (printed once by install.sh from the
|
||||
* CLUSEV_ADMIN_PASSWORD line below) rather than a guessable literal — rotation is optional now, so a
|
||||
* well-known default like "clusev" would be a standing takeover credential. `must_change_password` is
|
||||
* still set (the banner nudges a rotation), but even if kept, the generated secret is not guessable.
|
||||
|
|
@ -29,7 +29,7 @@ class Install extends Command
|
|||
{--email= : Admin-Login + Let's-Encrypt-E-Mail}
|
||||
{--name=Administrator : Anzeigename des Admins}";
|
||||
|
||||
protected $description = 'Idempotenter Erstlauf: legt den ersten Admin mit Standard-Passwort an (Zwangswechsel beim ersten Login)';
|
||||
protected $description = 'Idempotenter Erstlauf: legt den ersten Admin mit zufälligem Initialpasswort an (Wechsel empfohlen, nicht erzwungen)';
|
||||
|
||||
public function handle(): int
|
||||
{
|
||||
|
|
@ -47,7 +47,7 @@ class Install extends Command
|
|||
return self::FAILURE;
|
||||
}
|
||||
|
||||
// Random, non-guessable one-time password (printed once below). Satisfies any policy.
|
||||
// Random, non-guessable initial password (printed once below). Satisfies any policy.
|
||||
$password = Str::password(16);
|
||||
|
||||
$user = User::create([
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ use LivewireUI\Modal\ModalComponent;
|
|||
|
||||
/**
|
||||
* Form modal: add a new administrator account. Every account is a full admin (no roles). The creator
|
||||
* may set a password directly, or leave it blank — then a strong one-time password is generated, the
|
||||
* may set a password directly, or leave it blank — then a strong initial password is generated, the
|
||||
* account is flagged `must_change_password`, and the clear-text password is revealed ONCE in the modal
|
||||
* (never persisted or logged). An operator-set password is the user's own, so no forced rotation.
|
||||
*/
|
||||
|
|
@ -23,7 +23,7 @@ class CreateUser extends ModalComponent
|
|||
|
||||
public string $email = '';
|
||||
|
||||
/** Optional operator-set password; blank = generate a one-time password and reveal it once. */
|
||||
/** Optional operator-set password; blank = generate an initial password and reveal it once. */
|
||||
public string $password = '';
|
||||
|
||||
/** Clear-text temp password, held in component state only to reveal it once. */
|
||||
|
|
@ -75,7 +75,7 @@ class CreateUser extends ModalComponent
|
|||
}
|
||||
|
||||
// Operator-set password = the user's own login (no forced rotation). Blank = generate a strong
|
||||
// one-time password that the user must rotate, and reveal it once below.
|
||||
// initial password that the user is prompted to rotate, and reveal it once below.
|
||||
$operatorSet = $this->password !== '';
|
||||
$password = $operatorSet ? $this->password : Str::password(16);
|
||||
|
||||
|
|
@ -103,7 +103,7 @@ class CreateUser extends ModalComponent
|
|||
return;
|
||||
}
|
||||
|
||||
// Reveal the generated one-time password ONCE — swaps the form for the reveal panel.
|
||||
// Reveal the generated initial password ONCE — swaps the form for the reveal panel.
|
||||
$this->createdName = $user->name;
|
||||
$this->tempPassword = $password;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -14,20 +14,20 @@ return [
|
|||
|
||||
// Create modal
|
||||
'create_title' => 'Konto hinzufügen',
|
||||
'create_subtitle' => 'Vollwertiger Administrator. Setze ein Passwort — oder lass es leer, dann wird ein Einmal-Passwort erzeugt und einmalig angezeigt.',
|
||||
'create_subtitle' => 'Vollwertiger Administrator. Setze ein Passwort — oder lass es leer, dann wird ein Initialpasswort erzeugt und einmalig angezeigt.',
|
||||
'name_label' => 'Name',
|
||||
'name_placeholder' => 'Erika Mustermann',
|
||||
'email_label' => 'E-Mail',
|
||||
'email_placeholder' => 'erika@example.com',
|
||||
'password_label' => 'Passwort',
|
||||
'password_placeholder' => 'Leer = Einmal-Passwort erzeugen',
|
||||
'password_hint' => 'Optional. Min. 6 Zeichen. Leer lassen, um ein sicheres Einmal-Passwort zu erzeugen.',
|
||||
'password_placeholder' => 'Leer = Initialpasswort erzeugen',
|
||||
'password_hint' => 'Optional. Min. 6 Zeichen. Leer lassen, um ein sicheres Initialpasswort zu erzeugen.',
|
||||
'created_notify' => 'Konto :name angelegt.',
|
||||
'create_submit' => 'Konto anlegen',
|
||||
|
||||
// Temp-password reveal (shown once)
|
||||
'temp_heading' => 'Konto angelegt',
|
||||
'temp_intro' => 'Gib dieses Einmal-Passwort an :name weiter. Es muss beim ersten Anmelden geändert werden.',
|
||||
'temp_intro' => 'Gib dieses Initialpasswort an :name weiter. Es sollte beim ersten Anmelden geändert werden.',
|
||||
'temp_label' => 'Temporäres Passwort',
|
||||
'temp_warning' => 'Kopiere dieses Passwort jetzt — es wird nur einmal angezeigt und kann später nicht erneut abgerufen werden.',
|
||||
'temp_copy' => 'Kopieren',
|
||||
|
|
|
|||
|
|
@ -14,20 +14,20 @@ return [
|
|||
|
||||
// Create modal
|
||||
'create_title' => 'Add account',
|
||||
'create_subtitle' => 'Full administrator. Set a password — or leave it blank to generate a one-time password shown once.',
|
||||
'create_subtitle' => 'Full administrator. Set a password — or leave it blank to generate a initial password shown once.',
|
||||
'name_label' => 'Name',
|
||||
'name_placeholder' => 'Jane Doe',
|
||||
'email_label' => 'Email',
|
||||
'email_placeholder' => 'jane@example.com',
|
||||
'password_label' => 'Password',
|
||||
'password_placeholder' => 'Blank = generate a one-time password',
|
||||
'password_hint' => 'Optional. Min. 6 characters. Leave blank to generate a secure one-time password.',
|
||||
'password_placeholder' => 'Blank = generate a initial password',
|
||||
'password_hint' => 'Optional. Min. 6 characters. Leave blank to generate a secure initial password.',
|
||||
'created_notify' => 'Account :name created.',
|
||||
'create_submit' => 'Create account',
|
||||
|
||||
// Temp-password reveal (shown once)
|
||||
'temp_heading' => 'Account created',
|
||||
'temp_intro' => 'Share this one-time password with :name. They must change it on first sign-in.',
|
||||
'temp_intro' => 'Share this initial password with :name. They are prompted to change it on first sign-in.',
|
||||
'temp_label' => 'Temporary password',
|
||||
'temp_warning' => 'Copy this password now — it is shown only once and cannot be retrieved later.',
|
||||
'temp_copy' => 'Copy',
|
||||
|
|
|
|||
Loading…
Reference in New Issue