From 6d3fbd62b4fdb8a077170db53f329946b6653d3e Mon Sep 17 00:00:00 2001
From: qubiaobiao <3294694717@qq.com>
Date: Wed, 14 Oct 2026 10:22:53 +0800
Subject: [PATCH] =?UTF-8?q?security(seeders):=20=E5=88=9D=E5=A7=8B?=
 =?UTF-8?q?=E7=AE=A1=E7=90=86=E5=91=98=20seeder=20=E6=94=AF=E6=8C=81=20ADM?=
 =?UTF-8?q?IN=5FINIT=5FPASSWORD=20=E8=A6=86=E7=9B=96=EF=BC=88R110-B5?=
 =?UTF-8?q?=E2=91=A0b=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 002-seed-admin.js：口令改为「内置 bcrypt 哈希默认 + ADMIN_INIT_PASSWORD 环境变量覆盖」；
  提供环境变量时以 bcrypt.hashSync(值,10) 重算哈希、salt 取哈希前 29 字符（bcrypt 盐前缀）。
- 默认分支保持原哈希不变 ⇒ 既有开发/演示链路（admin123）零回归。
- 本文件⛔不落盘任何明文口令（铁律 25）；凭据扫描 CAND 计数 2 → 2（零新增，可见性无损）。
---
 database/seeders/002-seed-admin.js | 56 ++++++++++++++++++------------
 1 file changed, 33 insertions(+), 23 deletions(-)

diff --git a/database/seeders/002-seed-admin.js b/database/seeders/002-seed-admin.js
index 9235333..c40ed19 100644
--- a/database/seeders/002-seed-admin.js
+++ b/database/seeders/002-seed-admin.js
@@ -1,31 +1,41 @@
 'use strict';
 
+// 初始管理员账号。
+// 口令：下方内置 bcrypt 哈希仅为**开发/演示**默认值（对应公开弱口令，仅供本机初始化）。
+// 正式初始化（生产等）时应通过环境变量 ADMIN_INIT_PASSWORD 注入真实口令 ——
+// 本文件⛔不落盘任何明文口令（铁律 25）。
 module.exports = {
   up: async (queryInterface, Sequelize) => {
     const now = new Date();
-    await queryInterface.bulkInsert('accounts', [
-      {
-        role: 'admin',
-        name_cn: '系统管理员',
-        name_en: 'Administrator',
-        gender: null,
-        phone: null,
-        email: 'admin@competition.com',
-        id_number: '000000000000000000',
-        password: '$2b$10$Nc6PCJItIwuOzpM22dTiAezB.jZMI8mzkCbg3oRZkAWx.QaI4co9.',
-        salt: '$2b$10$Nc6PCJItIwuOzpM22dTiAe',
-        position: '系统管理员',
-        major: null,
-        country: '中国',
-        region: null,
-        organization_cn: '赛事组委会',
-        organization_en: 'Competition Committee',
-        activated: 1,
-        score: null,
-        created_at: now,
-        updated_at: now,
-      },
-    ], {});
+    const row = {
+      role: 'admin',
+      name_cn: '系统管理员',
+      name_en: 'Administrator',
+      gender: null,
+      phone: null,
+      email: 'admin@competition.com',
+      id_number: '000000000000000000',
+      password: '$2b$10$Nc6PCJItIwuOzpM22dTiAezB.jZMI8mzkCbg3oRZkAWx.QaI4co9.',
+      salt: '$2b$10$Nc6PCJItIwuOzpM22dTiAe',
+      position: '系统管理员',
+      major: null,
+      country: '中国',
+      region: null,
+      organization_cn: '赛事组委会',
+      organization_en: 'Competition Committee',
+      activated: 1,
+      score: null,
+      created_at: now,
+      updated_at: now,
+    };
+    // 若提供 ADMIN_INIT_PASSWORD，则以之为准重算 bcrypt 哈希（salt 取哈希前 29 字符的 bcrypt 盐前缀）。
+    const initPwd = process.env.ADMIN_INIT_PASSWORD;
+    if (initPwd) {
+      const hash = require('bcrypt').hashSync(String(initPwd), 10);
+      row.password = hash;
+      row.salt = hash.slice(0, 29);
+    }
+    await queryInterface.bulkInsert('accounts', [row], {});
   },
 
   down: async (queryInterface, Sequelize) => {