From 22da11514b155ef5b8f5445e387b68c90cd2dce8 Mon Sep 17 00:00:00 2001
From: Pascal Dietrich <cameo007@mintux.de>
Date: Tue, 2 Jun 2026 20:46:30 +0200
Subject: [PATCH] feat: add passwordHashFile to admin.json

---
 lib/admin/migrate.ts  |  2 +-
 lib/admin/password.ts | 18 ++++++++++++++----
 lib/admin/types.ts    |  3 ++-
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/lib/admin/migrate.ts b/lib/admin/migrate.ts
index 39d7b2be..a6188d12 100644
--- a/lib/admin/migrate.ts
+++ b/lib/admin/migrate.ts
@@ -98,7 +98,7 @@ async function migrateAdminJson(): Promise<boolean> {
     lastLogin: data.lastLogin ?? null,
     passwordChangedAt: data.passwordChangedAt ?? now,
   };
-  const configData: AdminConfigData = { passwordHash: data.passwordHash };
+  const configData: AdminConfigData = { passwordHash: data.passwordHash, passwordHashFile: undefined };
 
   await ensureStateDir();
   const statePath = getStatePath('admin-state.json');
diff --git a/lib/admin/password.ts b/lib/admin/password.ts
index 4f4fd7d7..d9dff58a 100644
--- a/lib/admin/password.ts
+++ b/lib/admin/password.ts
@@ -9,6 +9,7 @@ import {
   assertWritable,
 } from './paths';
 import type { AdminConfigData, AdminStateData } from './types';
+import { readFileEnv } from '../read-file-env';
 
 const SCRYPT_KEYLEN = 64;
 const SCRYPT_COST = 16384; // 2^14
@@ -146,7 +147,7 @@ export async function initAdminPassword(): Promise<boolean> {
   }
 
   const hash = isHashed(envPassword) ? envPassword : await hashPassword(envPassword);
-  cachedConfig = { passwordHash: hash };
+  cachedConfig = { passwordHash: hash, passwordHashFile: undefined };
   cachedState = freshState();
   await writeConfigData(cachedConfig);
   await writeStateData(cachedState);
@@ -165,7 +166,16 @@ export async function initAdminPassword(): Promise<boolean> {
 export async function verifyAdminPassword(password: string): Promise<boolean> {
   if (!cachedConfig) cachedConfig = await readConfigData();
   if (!cachedConfig) return false;
-  return verifyPassword(password, cachedConfig.passwordHash);
+  if (cachedConfig.passwordHash) {
+    return verifyPassword(password, cachedConfig.passwordHash);
+  } else if (cachedConfig.passwordHashFile) {
+    let passwordHash = readFileEnv(cachedConfig.passwordHashFile);
+    if (passwordHash) {
+      return verifyPassword(password, passwordHash);
+    }
+  }
+  logger.error('The admin password hash could neither be retrieved from passwordHash nor from passwordHashFile in admin.json');
+  return false;
 }
 
 /**
@@ -176,7 +186,7 @@ export async function changeAdminPassword(currentPassword: string, newPassword:
   if (!valid) return false;
 
   const hash = await hashPassword(newPassword);
-  cachedConfig = { passwordHash: hash };
+  cachedConfig = { passwordHash: hash, passwordHashFile: undefined };
   await writeConfigData(cachedConfig);
 
   cachedState = {
@@ -205,7 +215,7 @@ export async function setInitialAdminPassword(
   const existing = await readConfigData();
   if (existing && !options.allowOverwrite) return false;
   const hash = await hashPassword(newPassword);
-  cachedConfig = { passwordHash: hash };
+  cachedConfig = { passwordHash: hash, passwordHashFile: undefined };
   cachedState = freshState();
   await writeConfigData(cachedConfig);
   await writeStateData(cachedState);
diff --git a/lib/admin/types.ts b/lib/admin/types.ts
index b2a7e8bd..2ea23a3a 100644
--- a/lib/admin/types.ts
+++ b/lib/admin/types.ts
@@ -6,7 +6,8 @@
  * is config; mutable timestamps live in AdminStateData.
  */
 export interface AdminConfigData {
-  passwordHash: string;
+  passwordHash: string | undefined;
+  passwordHashFile: string | undefined;
 }
 
 /**