From 32c0f40021fab8c63ceb3fb2358dac7bad2c1cc5 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouzapw@users.noreply.github.com>
Date: Mon, 16 Feb 2026 11:24:15 -0300
Subject: [PATCH] fix: auto-skip onboarding and enforce login on VM deployments

- getSettings() auto-sets setupComplete=true when INITIAL_PASSWORD env is set
- proxy.js middleware enforces login when INITIAL_PASSWORD exists (even without DB hash)
- Settings API reports hasPassword=true when INITIAL_PASSWORD is configured
- Login page hides '123456' default hint when a custom password is set

Fixes fresh Docker/VM deployments getting stuck on onboarding wizard
and being accessible without authentication.
---
 .gitignore                    |  2 ++
 src/app/api/settings/route.js |  2 +-
 src/app/login/page.js         |  8 +++++---
 src/lib/db/settings.js        | 14 ++++++++++++++
 src/proxy.js                  |  4 ++--
 5 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 2d8a42772c..f083d9eb20 100644
--- a/.gitignore
+++ b/.gitignore
@@ -80,3 +80,5 @@ test-results/
 playwright-report/
 blob-report/
 cloud/
+omnirouteCloud/
+omnirouteSite/
diff --git a/src/app/api/settings/route.js b/src/app/api/settings/route.js
index 13aff77650..9e427f1639 100644
--- a/src/app/api/settings/route.js
+++ b/src/app/api/settings/route.js
@@ -13,7 +13,7 @@ export async function GET() {
     return NextResponse.json({
       ...safeSettings,
       enableRequestLogs,
-      hasPassword: !!password,
+      hasPassword: !!password || !!process.env.INITIAL_PASSWORD,
     });
   } catch (error) {
     console.log("Error getting settings:", error);
diff --git a/src/app/login/page.js b/src/app/login/page.js
index f114147c7a..104161f32f 100644
--- a/src/app/login/page.js
+++ b/src/app/login/page.js
@@ -108,9 +108,11 @@ export default function LoginPage() {
               Login
             </Button>
 
-            <p className="text-xs text-center text-text-muted mt-2">
-              Default password is <code className="bg-sidebar px-1 rounded">123456</code>
-            </p>
+            {!hasPassword && (
+              <p className="text-xs text-center text-text-muted mt-2">
+                Default password is <code className="bg-sidebar px-1 rounded">123456</code>
+              </p>
+            )}
 
             <p className="text-xs text-center mt-1">
               <a href="/forgot-password" className="text-primary hover:underline">
diff --git a/src/lib/db/settings.js b/src/lib/db/settings.js
index 53c48ee0b6..1dea219436 100644
--- a/src/lib/db/settings.js
+++ b/src/lib/db/settings.js
@@ -15,6 +15,20 @@ export async function getSettings() {
   for (const row of rows) {
     settings[row.key] = JSON.parse(row.value);
   }
+
+  // Auto-complete onboarding for pre-configured deployments (Docker/VM)
+  // If INITIAL_PASSWORD is set via env, this is a headless deploy — skip the wizard
+  if (!settings.setupComplete && process.env.INITIAL_PASSWORD) {
+    settings.setupComplete = true;
+    settings.requireLogin = true;
+    db.prepare(
+      "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('settings', 'setupComplete', 'true')"
+    ).run();
+    db.prepare(
+      "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('settings', 'requireLogin', 'true')"
+    ).run();
+  }
+
   return settings;
 }
 
diff --git a/src/proxy.js b/src/proxy.js
index 6140c1e428..a0895a5649 100644
--- a/src/proxy.js
+++ b/src/proxy.js
@@ -49,9 +49,9 @@ export async function proxy(request) {
       if (settings.requireLogin === false) {
         return response;
       }
-      // Skip auth if no password has been set yet (fresh install)
+      // Skip auth if no password has been set yet (fresh install with no env override)
       // This prevents an unresolvable loop where requireLogin=true but no password exists
-      if (!settings.password) {
+      if (!settings.password && !process.env.INITIAL_PASSWORD) {
         return response;
       }
     } catch (err) {