Initial Admin Password Reset Link Instead of Credentials #369

Merged

notquitenothing merged 1 commit from feature/initial-password-reset into main

2026-04-11 18:48:33 -05:00

notquitenothing commented

2026-04-11 18:09:51 -05:00

(Migrated from github.com)

Description

Initial admin credentials are no longer shown in the logs on first start. Instead, a password reset link is generated and shown.
Login page will now autofill a username when it is in the query parameters, currently only set on successful password reset.
Remove the generate-password packages and use crypto built-in functions to do a similar job.
Do not print error details to logs when OIDC adapter cannot parse a payload. Also when this happens throw the error instead of hiding it silently.
Ensure session domain matching does not return false positives where input domain partially matches (eg. example.com =/= notexample.com even though notexample.com ends with example.com).
Misc improvements and fixes

## Description - Initial admin credentials are no longer shown in the logs on first start. Instead, a password reset link is generated and shown. - Login page will now autofill a username when it is in the query parameters, currently only set on successful password reset. - Remove the generate-password packages and use crypto built-in functions to do a similar job. - Do not print error details to logs when OIDC adapter cannot parse a payload. Also when this happens throw the error instead of hiding it silently. - Ensure session domain matching does not return false positives where input domain partially matches (eg. example.com =/= notexample.com even though notexample.com ends with example.com). - Misc improvements and fixes