ADMIN_USERNAME/ADMIN_PASSWORD_HASH now optionally extends to _2, _3, ... for additional accounts (e.g. a second login for Lara), all with equal access - no roles, still no self-service password reset. Falls back to a dummy bcrypt compare on unknown usernames to keep login timing consistent. Verified locally: both users log in, wrong password and unknown usernames are rejected, and single-user setups still work unchanged (backward compatible). Also documents the optional second-user setup in DEPLOYMENT_ADMIN.md (B6/B7). |
||
|---|---|---|
| .. | ||
| auth.js | ||
| build.js | ||
| content-store.js | ||
| fonts.js | ||
| schema.js | ||
| validate.js | ||