From b6f22b141251d596f8709cec4604ea26fb045fb1 Mon Sep 17 00:00:00 2001
From: aiyimickey <39365912+aiyimickey@users.noreply.github.com>
Date: Fri, 3 Jul 2026 14:13:24 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20localadmin=20=E5=AF=86=E7=A0=81=E6=AF=8F?=
 =?UTF-8?q?=E6=AC=A1=E9=83=A8=E7=BD=B2=E6=9B=B4=E6=96=B0=EF=BC=88INSERT/UP?=
 =?UTF-8?q?DATE=20=E6=9B=BF=E4=BB=A3=20INSERT=20OR=20IGNORE=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/lib/db.ts | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/lib/db.ts b/src/lib/db.ts
index 92fbbfd..a7dceb4 100644
--- a/src/lib/db.ts
+++ b/src/lib/db.ts
@@ -38,9 +38,13 @@ function ensureDb() {
     execRaw(`CREATE TABLE IF NOT EXISTS role_permissions (id INTEGER PRIMARY KEY AUTOINCREMENT, role TEXT NOT NULL, permission_key TEXT NOT NULL REFERENCES permissions(key), created_at TEXT DEFAULT (datetime('now', '+8 hours')), UNIQUE(role, permission_key))`)
     const bcrypt = require('bcryptjs')
     const pwdHash = bcrypt.hashSync(config.localadminPassword, 10)
-    // 设计决策：INSERT OR IGNORE 确保只在首次初始化时写入 localadmin 密码。
-    // 如果 LOCALADMIN_PASSWORD 环境变量变更，需要通过管理后台手动修改密码。
-    execRaw(`INSERT OR IGNORE INTO users (username, display_name, role, password_hash) VALUES ('localadmin', '超级管理员', 'admin', '${pwdHash.replace(/'/g, "''")}')`)
+    // 每次部署更新 localadmin 密码（确保 .env 中的密码始终生效）
+    const existing = execFileSync('sqlite3', ['-json', DB_PATH, "SELECT id FROM users WHERE username = 'localadmin'"], { encoding: 'utf-8', timeout: 10000 }).trim()
+    if (existing) {
+      execRaw(`UPDATE users SET password_hash = '${pwdHash.replace(/'/g, "''")}', updated_at = datetime('now', '+8 hours') WHERE username = 'localadmin'`)
+    } else {
+      execRaw(`INSERT INTO users (username, display_name, role, password_hash, is_active, created_at, updated_at) VALUES ('localadmin', '超级管理员', 'admin', '${pwdHash.replace(/'/g, "''")}', 1, datetime('now', '+8 hours'), datetime('now', '+8 hours'))`)
+    }
     const raw = execFileSync('sqlite3', ['-json', DB_PATH, 'SELECT id FROM alert_channels'], { encoding: 'utf-8', timeout: 10000 }).trim()
     const channels = raw ? JSON.parse(raw) : []
     if (channels.length === 0) {