feat: complete 2.0.7.12 platform overhaul

server/unified-management/internal/auth/auth.go

@@ -77,20 +77,16 @@ func NewService(store *db.Store) *Service {
 	}
 }
 
-func (s *Service) Bootstrap(ctx context.Context) (map[string]any, error) {
+func (s *Service) Bootstrap(ctx context.Context, includeSecurityState bool) (map[string]any, error) {
+	payload := map[string]any{"ok": true}
+	if !includeSecurityState {
+		return payload, nil
+	}
 	isDefault, err := s.store.IsDefaultAdminPassword(ctx)
 	if err != nil {
 		return nil, err
 	}
-	payload := map[string]any{
-		"ok":                true,
-		"defaultUsername":   "admin",
-		"defaultPassword":   "",
-		"isDefaultPassword": isDefault,
-	}
-	if isDefault {
-		payload["defaultPassword"] = "admin"
-	}
+	payload["isDefaultPassword"] = isDefault
 	return payload, nil
 }
 

server/unified-management/internal/auth/auth_test.go

@@ -12,7 +12,7 @@ import (
 	"ymhut-box/server/unified-management/internal/db"
 )
 
-func TestBootstrapShowsDefaultPasswordOnlyBeforeChange(t *testing.T) {
+func TestBootstrapOnlyReturnsDefaultPasswordStateToAuthenticatedCaller(t *testing.T) {
 	root := t.TempDir()
 	cfg := &config.Config{
 		StorageDir: root,
@@ -32,22 +32,29 @@ func TestBootstrapShowsDefaultPasswordOnlyBeforeChange(t *testing.T) {
 		t.Fatal(err)
 	}
 	service := NewService(store)
-	payload, err := service.Bootstrap(context.Background())
+	publicPayload, err := service.Bootstrap(context.Background(), false)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if payload["isDefaultPassword"] != true || payload["defaultPassword"] != "admin" {
-		t.Fatalf("unexpected bootstrap payload: %#v", payload)
+	if _, exists := publicPayload["isDefaultPassword"]; exists || publicPayload["defaultPassword"] != nil || publicPayload["defaultUsername"] != nil {
+		t.Fatalf("public bootstrap leaked administrator state: %#v", publicPayload)
+	}
+	payload, err := service.Bootstrap(context.Background(), true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if payload["isDefaultPassword"] != true || payload["defaultPassword"] != nil || payload["defaultUsername"] != nil {
+		t.Fatalf("unexpected authenticated bootstrap payload: %#v", payload)
 	}
 	if err := store.ChangeAdminPassword(context.Background(), "admin", "admin", "changed-password"); err != nil {
 		t.Fatal(err)
 	}
-	payload, err = service.Bootstrap(context.Background())
+	payload, err = service.Bootstrap(context.Background(), true)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if payload["isDefaultPassword"] != false || payload["defaultPassword"] != "" {
-		t.Fatalf("default password leaked after change: %#v", payload)
+	if payload["isDefaultPassword"] != false || payload["defaultPassword"] != nil || payload["defaultUsername"] != nil {
+		t.Fatalf("default password fields leaked after change: %#v", payload)
 	}
 }