hidden-admin-auth

Hidden Admin Auth Setup

Use this skill when you want to keep /product as a private admin utility. It sets up env-driven auth; the operator rotates credentials by updating .env using instructions in .envTemplate.

CRITICAL: Security Rules

Credentials exist ONLY in .env. The skill never receives or writes credentials. It sets up infrastructure; the operator updates .env themselves using instructions in .envTemplate.

File	Allowed	Forbidden
.env	Operator updates manually (gitignored)	Skill does not modify
.envTemplate	Template values: ADMIN_USERNAME=test + salt/hash for test	Any real credentials
Code (auth.ts, playwright.config, etc.)	Read from process.env; no hardcoded creds	Any credentials
Docs (AGENTS.md, README, AUTHENTICATION.md, playwright/README)	Generic text: "configure via .env", "template default: test/test"	Actual credentials or password hints
CHANGELOG	Generic: "credentials moved to env vars"	Any credentials or password hints

Goal

1. Move auth to env vars (ADMIN_USERNAME, ADMIN_PASSWORD_SALT, ADMIN_PASSWORD_HASH).
2. Add .envTemplate with safe template values (test/test) and instructions for the operator to update .env.
3. Remove the login link from the public header.
4. Update docs generically—never expose credentials.

Files To Update

1) src/server/services/auth.ts

• Read admin user from process.env.ADMIN_USERNAME, ADMIN_PASSWORD_SALT, ADMIN_PASSWORD_HASH.
• If these env vars are set, use them for verifyUser. Otherwise fall back to the existing fakeUser (test/test) for backwards compatibility.
• Remove or keep fakeUser only as fallback when env vars are absent.

2) .envTemplate

Add the Hidden Admin Auth block only if it does not exist. Use these template values:

• ADMIN_USERNAME=test
• ADMIN_PASSWORD_SALT and ADMIN_PASSWORD_HASH: generate for password test using the hash command.
• Optional: TEST_USERNAME and TEST_PASSWORD (for E2E when credentials differ from template; defaults to test/test).