@

hub v0.54.0: change operator login password from the Configuration UI

Adds a "Login password" card on /configuration. The password was previously
settable only via the hub-config ConfigMap (auth.password_hash) + redeploy.

- store: hub_settings key operator_password_hash + Get/SetOperatorPasswordHash
- server: passwordHash field -> configPasswordHash (seed); new
  effectivePasswordHash() (DB override wins, else seed) is now the single
  source for the CSRF gate, RequireAuth, and handleLogin
- POST /configuration/password (handleChangePassword): requires current
  password, 8-72 byte new + confirm, bcrypt cost 10, persists DB override;
  existing sessions kept valid; ConfigMap stays the break-glass reset path
- UI: current/new/confirm form + inline mismatch pre-check + 6 flashes
- tests + red-proofs: override precedence, happy-path via handleLogin,
  wrong-current rejection, mismatch/too-short/no-op, template render
- docs: CHANGELOG, README (auth+config), REUSE, REPORT

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LbMm4T7Ayzs1unB9pN6Uqd
@

hub/README.md

@@ -215,6 +215,7 @@ Protected by bcrypt password + session cookie (7-day expiry).
 - Cookie attributes: `SameSite=Lax`, `Secure` (when TLS), `HttpOnly`, 7-day `Max-Age`.
 - `RequireAuth` middleware validates the session token with `subtle.ConstantTimeCompare` and redirects to `/login` on failure.
 - `CleanupSessions(ctx)` goroutine runs hourly to purge expired sessions.
+- **Login password source (v0.54.0)** — the bcrypt hash checked at login comes from `effectivePasswordHash()`: a `hub_settings.operator_password_hash` DB override (set via **Configuration → Login password**) wins, otherwise the `auth.password_hash` seed from `hub.yaml`. The ConfigMap value is the break-glass reset path (blank the DB row / edit the manifest + redeploy). Changing the password (`POST /configuration/password`) requires the current password and leaves existing sessions valid.
 
 ### CSRF Protection (`internal/web/server.go`)
 
@@ -313,7 +314,10 @@ A manual "Refresh Assets from Image" button is available on the **Configuration*
 ```yaml
 # hub.yaml
 auth:
-  password_hash: ""           # bcrypt hash for dashboard login (empty = no auth)
+  password_hash: ""           # bcrypt SEED for dashboard login (empty = no auth). Since v0.54.0 this
+                              # is only the fallback: a hub_settings DB override set via
+                              # Configuration → Login password wins. This value stays the break-glass
+                              # reset path (blank the DB row / edit here + redeploy to recover a lost pw).
 
 api:
   report_api_key: ""          # Bearer token for API auth