ADMIN_USERNAME/ADMIN_PASSWORD_HASH now optionally extends to _2, _3, ... for additional accounts (e.g. a second login for Lara), all with equal access - no roles, still no self-service password reset. Falls back to a dummy bcrypt compare on unknown usernames to keep login timing consistent. Verified locally: both users log in, wrong password and unknown usernames are rejected, and single-user setups still work unchanged (backward compatible). Also documents the optional second-user setup in DEPLOYMENT_ADMIN.md (B6/B7). |
||
|---|---|---|
| .. | ||
| lib | ||
| public | ||
| .env.example | ||
| hash-password.js | ||
| package-lock.json | ||
| package.json | ||
| server.js | ||