fix(seed): update credential password on existing accounts — not skip (GRO-1977) #120

2026-06-01T00:07:17Z

The Dogfather commented

2026-06-01 00:07:17 +00:00

Summary

Fix seed.ts credential idempotency bug that caused all UAT persona accounts to return 401 after first seed.

Root cause: seedKnownUsers() skipped credential account inserts when existingAccount was found, permanently freezing the password hash at first-seed. Re-seeding (e.g. after password rotation) had no effect.

Fix: When a credential account already exists, re-hash the current SEED_UAT_*_PASSWORD env var and UPDATE the row instead of skipping.

Changes:

apps/api/src/db/seed.ts — existingAccount branch now calls db.update() with a fresh hashPassword() instead of skipping
apps/api/src/__tests__/seed-uat-credentials.test.ts — added AC-8 asserting that re-seeding updates the stored hash

Acceptance criteria met:

seed.ts updates (does not skip) the credential password on existing accounts
AC-8 test passes; all 540 tests pass
Re-seeding with same password is still idempotent (no duplicate rows, AC-5 still holds)

QA handoff: Please run seed-uat-credentials.test.ts against a clean DB and confirm the new AC-8 test asserts the rotation behavior correctly.

Part of GRO-1977

## Summary Fix seed.ts credential idempotency bug that caused all UAT persona accounts to return 401 after first seed. **Root cause:** `seedKnownUsers()` skipped credential account inserts when `existingAccount` was found, permanently freezing the password hash at first-seed. Re-seeding (e.g. after password rotation) had no effect. **Fix:** When a credential account already exists, re-hash the current `SEED_UAT_*_PASSWORD` env var and UPDATE the row instead of skipping. **Changes:** - `apps/api/src/db/seed.ts` — `existingAccount` branch now calls `db.update()` with a fresh `hashPassword()` instead of skipping - `apps/api/src/__tests__/seed-uat-credentials.test.ts` — added AC-8 asserting that re-seeding updates the stored hash **Acceptance criteria met:** - [x] `seed.ts` updates (does not skip) the credential password on existing accounts - [x] AC-8 test passes; all 540 tests pass - [x] Re-seeding with same password is still idempotent (no duplicate rows, AC-5 still holds) **QA handoff:** Please run `seed-uat-credentials.test.ts` against a clean DB and confirm the new AC-8 test asserts the rotation behavior correctly. Part of [GRO-1977](/GRO/issues/GRO-1977)

The Dogfather added 2 commits 2026-06-01 00:07:18 +00:00

fix: rename 0035→0036 to avoid conflicting migration number (GRO-1971)

CI / Test (pull_request) Successful in 13s

Details

CI / Lint & Typecheck (pull_request) Successful in 20s

Details

CI / Build & Push Docker Images (pull_request) Successful in 47s

Details

82e3807a6a

fix(seed): update credential password on existing accounts — not skip (GRO-1977)

CI / Test (pull_request) Successful in 13s

Details

CI / Lint & Typecheck (pull_request) Successful in 16s

Details

CI / Build & Push Docker Images (pull_request) Successful in 22s

Details

1e2c09e5cd

Previously, seed.ts skip-inserted a credential account if it already existed,
freezing the stored hash at first-seed.  Now it re-hashes the current env var
value and UPDATE the existing row, enabling password rotation without a full DB
wipe.

- AC-8: re-seeding with a changed SEED_UAT_*_PASSWORD updates the stored hash
- AC-5 still passes: re-seeding with the same password is idempotent (no new rows)
- All 540 tests pass

Co-Authored-By: Paperclip <noreply@paperclip.ing>

The Dogfather merged commit b928acf5d6 into dev

2026-06-01 00:08:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/api#120