fix: fail closed weak password opt-in

2026-09-22 17:16:02 -03:00
parent ab3aaaae8a
commit de571e3ac2
2 changed files with 17 additions and 1 deletions
@@ -40,7 +40,7 @@ def create_admin(session, username: str, password: str):
    if len(username) < 3:
        raise ValueError("username must have 3 characters")
    environment = os.getenv("APP_ENV") or settings.environment
-    weak_passwords_allowed = os.getenv("ALLOW_WEAK_DEV_PASSWORD", "1" if settings.allow_weak_dev_password else "0") == "1"
+    weak_passwords_allowed = os.getenv("ALLOW_WEAK_DEV_PASSWORD", "0") == "1"
    if len(password) < 12 and (environment.strip().lower() == "production" or not weak_passwords_allowed):
        raise ValueError("password must have 12 characters")
    if session.scalar(select(AdminUser).where(AdminUser.username == username)):