security(demo): deactivate default-credential demo users on production install + drop Production/Stable#341
Draft
gonzalesedwin1123 wants to merge 6 commits into
Draft
Conversation
… install Add safety tests for spp_demo and spp_farmer_registry_demo: the default- credential users (shared password 'demo', incl. sppadmin) must be archived when demo data is disabled (production-style install) and left active when demo data is enabled, plus a guard that neither module is marked Production/Stable.
…n install The demo bundles ship active res.users with the well-known password 'demo' (including sppadmin with SPP admin rights) in their data section, so the accounts are created on every install. Marked Production/Stable, the modules signalled production-readiness, so an operator could install a demo bundle on an internet-facing instance and expose those default credentials to login. Add a post_init_hook to spp_demo (shared helper) and spp_farmer_registry_demo that archives the default-credential users when the database has no demo data (a production-style install); on demo/evaluation databases the users stay active so demos and generators are unaffected. Also lower development_status from Production/Stable to Alpha and add a DEMO-ONLY warning to each summary.
spp_demo 19.0.2.1.0 -> 19.0.2.1.1; spp_farmer_registry_demo 19.0.2.1.1 -> 19.0.2.1.3 (skips .1.2 taken by the in-flight force-unlock PR #336 on the same module). README.rst / index.html regenerated from CI's pinned generator.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 19.0 #341 +/- ##
==========================================
- Coverage 74.28% 69.30% -4.99%
==========================================
Files 372 148 -224
Lines 25385 14131 -11254
==========================================
- Hits 18857 9793 -9064
+ Misses 6528 4338 -2190
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Generated files applied verbatim from CI's pinned oca-gen-addon-readme output for spp_demo (19.0.2.1.1) and spp_farmer_registry_demo (19.0.2.1.3).
…oupling From staff review: the helper tests hard-coded demo_enabled, leaving the load-bearing demo_data_enabled() detection and the manifest hook wiring untested. Add assertions that demo_data_enabled matches the module's real demo flag and that both manifests register post_init_hook. Also document in users_data.xml that the archived-user safety depends on these records carrying no active field (the hook runs on install only).
Member
Author
|
Staff review (verdict SHIP) — folded in the MEDIUM test-coverage gap (assert |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The demo bundles ship active
res.userswith the well-known, documented passworddemoin theirdatasection (loaded on every install, not gated on demo mode):spp_demo/data/users_data.xml—demo_viewer/demo_officer/demo_supervisor/demo_manager,and
sppadmininspp_security.group_spp_admin(SPP admin).spp_farmer_registry_demo/data/demo_users.xml— re-roles the above and addsdemo_user_cr_local_validator/_cr_hq_validator/_program_manager/_cycle_approver(all password
demo).Both modules were marked
development_status: "Production/Stable"andinstallable: True. Thatproduction-readiness signal invites an operator to install a demo bundle on a real deployment;
installation then creates the default-credential accounts, and on an internet-facing instance an
unauthenticated attacker can try the documented credentials and gain access (up to SPP admin).
spp_demois the systemic root — every demo bundle depends on it and re-uses its users. Severity:medium (requires installing a
*_demomodule in production, which the status signal encourages).Fix
Defense-in-depth at the point the accounts would become dangerous, plus removing the misleading signal:
post_init_hookonspp_demo(shared helperdeactivate_default_demo_users) andspp_farmer_registry_demo: when the database has no demo data (a production-style install), thedefault-credential users are archived (
active=False) so their known password cannot log in.On a demo/evaluation database (demo data enabled) they are left active, so demos and the
generators (which
env.refthese users) are unaffected. Demo-enabled is detected viair.module.module.demo.development_statusloweredProduction/Stable→Alphaon both modules, and aDEMO ONLY … never install on a production/internet-facing instancewarning added to eachsummary.This keeps the users in the
datasection (no load-order/behavioral churn); the idiomaticdata→demorestructure across the whole demo family is filed as a follow-up.Tests
Test-first (red → green). New
test_demo_user_safety.pyin each module:demo_enabled=False);Production/Stable../spp t spp_demo→ 0 failed of 124;./spp t spp_farmer_registry_demo→ 0 failed of 135(existing generator tests that reference the demo users stay green — test DBs load demo data). No
existing tests removed or modified.
Scope / notes
spp_farmer_registry_demoto
19.0.2.1.2; this PR uses19.0.2.1.3(no logic conflict — security(programs): enforce system-admin authorization on Force Unlock #336 edits the generator).Whoever merges second re-conflicts on manifest/HISTORY/README (trivial re-merge).
spp_mis_demo_v2,spp_grm_demo,spp_case_demo)carry the same
Production/Stable+data-section demo users; and the idiomaticdata→demorestructure across the family. Scoped out here to keep this PR reviewable and matching the report.
README.rst/static/description/index.htmlfor both modules to be regenerated from CI's pinned generator.Merge order
Per the cross-PR interaction analysis (2026-07-24,
internal/plans/security-prs-interaction-analysis.md): merge after #336 onspp_farmer_registry_demo— this PR's19.0.2.1.3already reserves.1.2for #336, and its HISTORY entry assumes that sequence. Re-merge this branch when #336 lands (metadata-only conflict: manifest/HISTORY/README). No semantic interaction: this PR's user archiving only runs on no-demo-data DBs where the generator doesn't run,env.refstill resolves archived users, and the approval loop has a sudo fallback.