Server Manager (Gyannetra) 0c2a2275ce security(admin): harden admin API surface — role guard, secret fail-closed, env-based credentials ...

Removes the unauthenticated admin API hole verified live in the 2026-09-26 audit:

- Add require_admin dependency; apply to ALL 17 /api/admin/* endpoints.
  8 of them previously had NO auth dependency at all (bulk register/delete,
  student toggle, test upload, coupons); the rest accepted any logged-in
  student's JWT via get_current_user.
- Remove the 'super-secret-pragativeer-key' JWT fallback: backend now
  refuses to start without JWT_SECRET_KEY (fail-closed, no insecure default).
- Admin login no longer returns the opaque 5-char token 'admin'; it now
  verifies ADMIN_PASSWORD from env and returns a real JWT for the DB admin
  user. The opaque token shim (get_current_user/tier_checker) now only
  accepts the env-configured ADMIN_TOKEN (backwards-compat until frontend
  tokens are rotated).
- Replace all hardcoded 'Pv9#kL2$mQ8!vX4@' literals with env-derived
  DEMO_PASSWORD (login, change-password, ensure_demo_user seed hash) so
  rotation is a .env edit, not a code change.
- Frontend login: stop special-casing cookie token='admin'; store the real
  JWT for admin logins too.
- Add backend/.env.example documenting JWT_SECRET_KEY, ADMIN_PASSWORD,
  ADMIN_TOKEN, DEMO_PASSWORD.

Verified: AST parse clean; student-facing routes untouched; /api/tests and
profile/billing endpoints still authenticate via get_current_user.

Ops (deploy checklist, NOT code): set JWT_SECRET_KEY + ADMIN_PASSWORD +
ADMIN_TOKEN in backend/.env before restarting, or the backend will fail
closed. Old issued JWTs remain valid until the secret is rotated.

2026-09-26 07:19:37 +00:00

80 KiB

Raw Blame History

View Raw