Follow-up to PR #341 (security(demo): deactivate default-credential demo users on production install), which fixed spp_demo and spp_farmer_registry_demo but was deliberately scoped to keep the PR reviewable and matching the reported issue.
Severity: Medium (same class as #341 — default privileged credentials reachable if a demo bundle is installed on a production/internet-facing instance)
Problem
Other demo/config modules ship active res.users with the well-known password demo via their data section (created on every install), and some still signal production-readiness. None have the post_init_hook guard added in #341:
spp_mis_demo_v2 — 7 demo users; development_status: "Production/Stable"; has a post_init_hook for other purposes that does NOT deactivate the users.spp_grm_demo — 2 demo users; Production/Stable; no hook.spp_drims_sl_demo — 6 demo users; Alpha; no hook.spp_drims_sl — a non-demo config module with ~10 demo-password users; Alpha; no hook. (Worth confirming whether these belong in a demo module at all.)
Suggested fix
Two parts, mirroring #341:
- Guard: reuse
spp_demo's shared helper deactivate_default_demo_users(env, xmlids, demo_data_enabled(env, module_name)) in a post_init_hook for each module (for spp_mis_demo_v2, fold it into the existing hook). Enumerate each module's own default-credential user xmlids.
- Signal: lower
spp_mis_demo_v2 / spp_grm_demo from Production/Stable to Alpha and add the DEMO-ONLY warning to their summaries.
Add the same test_demo_user_safety.py coverage (deactivated when demo disabled, active when enabled, not Production/Stable, demo_data_enabled matches the module flag, hook wired) to each.
Broader hardening (separate, larger)
The idiomatic end-state is to move the default-credential users from the data section to the demo section across the whole demo family, so a --without-demo production DB never creates them. This is all-or-nothing across spp_demo + every bundle's demo_users.xml override (load-order coupling) and needs full-stack verification — track as its own PR.
Origin
Follow-up to PR #341 (
security(demo): deactivate default-credential demo users on production install), which fixedspp_demoandspp_farmer_registry_demobut was deliberately scoped to keep the PR reviewable and matching the reported issue.Severity: Medium (same class as #341 — default privileged credentials reachable if a demo bundle is installed on a production/internet-facing instance)
Problem
Other demo/config modules ship active
res.userswith the well-known passworddemovia theirdatasection (created on every install), and some still signal production-readiness. None have thepost_init_hookguard added in #341:spp_mis_demo_v2— 7 demo users;development_status: "Production/Stable"; has apost_init_hookfor other purposes that does NOT deactivate the users.spp_grm_demo— 2 demo users;Production/Stable; no hook.spp_drims_sl_demo— 6 demo users;Alpha; no hook.spp_drims_sl— a non-demo config module with ~10demo-password users;Alpha; no hook. (Worth confirming whether these belong in a demo module at all.)Suggested fix
Two parts, mirroring #341:
spp_demo's shared helperdeactivate_default_demo_users(env, xmlids, demo_data_enabled(env, module_name))in apost_init_hookfor each module (forspp_mis_demo_v2, fold it into the existing hook). Enumerate each module's own default-credential user xmlids.spp_mis_demo_v2/spp_grm_demofromProduction/StabletoAlphaand add the DEMO-ONLY warning to their summaries.Add the same
test_demo_user_safety.pycoverage (deactivated when demo disabled, active when enabled, not Production/Stable,demo_data_enabledmatches the module flag, hook wired) to each.Broader hardening (separate, larger)
The idiomatic end-state is to move the default-credential users from the
datasection to thedemosection across the whole demo family, so a--without-demoproduction DB never creates them. This is all-or-nothing acrossspp_demo+ every bundle'sdemo_users.xmloverride (load-order coupling) and needs full-stack verification — track as its own PR.Origin
internal/plans/sec-demo-default-credentials-stable.md; found during the staff-engineer review of security(demo): deactivate default-credential demo users on production install + drop Production/Stable #341.