kevinveenbirkenbachandClaude Opus 5 cc3a995584 fix(web-app-socialhome): realign the administrator password a rotation never reached ...

SH_ADMIN_PASSWORD seeds the administrator on first boot only: upstream provision_admin early-returns once platform_users holds a row. The rotation gate regenerates users.platform_administrator.password, the container keeps the old hash, and the household theme token request fails. The 31 retries then drained the 5-per-15-min budget upstream enforces on /api/auth/token, so every attempt after the fifth answered 429 and hid the underlying 401.

realign_admin_password.py runs inside the container, resolves the database through the config helper the application itself exposes, and rewrites platform_users.password_hash with the scrypt helper the application itself exposes when the declared password no longer verifies. It writes that one column, because set_password would also write is_admin and demote the administrator.

The token request drops its retries. 31 attempts into a five-per-window budget also poisons the bucket the Playwright design spec shares, and 0 is the only value multiply-timeouts.sh cannot inflate.

Proven by a two-pass compose deploy of variant 0, the row that failed in CI and the only one with design enabled: pass 1 [UNCHANGED], pass 2 [CHANGED] after the rotation, and the token task that failed in CI with 31 attempts and status 429 answering on attempt 1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-10-16 18:57:37 +02:00

..

files

fix(web-app-socialhome): realign the administrator password a rotation never reached

2026-10-16 18:57:37 +02:00

__init__.py

fix(web-app-socialhome): realign the administrator password a rotation never reached

2026-10-16 18:57:37 +02:00