SimplicityGuy
diff --git a/‎api/admin_setup.py‎
Lines changed: 33 additions & 9 deletions b/‎api/admin_setup.py‎
Lines changed: 33 additions & 9 deletions
diff --git a/‎api/api.py‎
Lines changed: 14 additions & 2 deletions b/‎api/api.py‎
Lines changed: 14 additions & 2 deletions
diff --git a/‎api/app_tokens.py‎
Lines changed: 21 additions & 9 deletions b/‎api/app_tokens.py‎
Lines changed: 21 additions & 9 deletions
diff --git a/‎api/dependencies.py‎
Lines changed: 13 additions & 1 deletion b/‎api/dependencies.py‎
Lines changed: 13 additions & 1 deletion
diff --git a/‎api/notifications.py‎
Lines changed: 6 additions & 6 deletions b/‎api/notifications.py‎
Lines changed: 6 additions & 6 deletions
diff --git a/‎api/routers/admin.py‎
Lines changed: 3 additions & 3 deletions b/‎api/routers/admin.py‎
Lines changed: 3 additions & 3 deletions
@@ -1,13 +1,21 @@
 """CLI tool for managing admin accounts.
 
 Usage:
-    admin-setup --email admin@example.com --password mysecretpw
+    admin-setup --email admin@example.com          # prompts for the password
     admin-setup --list
+
+The password may also come from the ADMIN_PASSWORD (or ADMIN_PASSWORD_FILE)
+environment variable for non-interactive/scripted use. A bare --password
+CLI argument is intentionally NOT offered: command-line arguments are
+world-readable via /proc/*/cmdline for the life of the process and land
+verbatim in shell history, leaking the highest-privilege credential in the
+system (discogsography-dir0).
 """
 
 from __future__ import annotations
 
 import argparse
+import getpass
 from os import getenv
 import sys
 
@@ -64,32 +72,48 @@ def list_admins(conninfo: str) -> None:
         print(f"{email:<40} {status:<8} {created_at}")
 
 
+def _resolve_password() -> str:
+    """Resolve the admin password WITHOUT ever accepting it as a CLI argument.
+
+    Command-line arguments are world-readable via /proc/*/cmdline for the life
+    of the process (`ps aux`, `docker container top`) and land verbatim in
+    shell history — for the highest-privilege account in the system, that is
+    an unconditional credential leak on every invocation (discogsography-dir0).
+    ADMIN_PASSWORD / ADMIN_PASSWORD_FILE (via the repo's standard `get_secret`
+    Docker-secrets convention) covers scripted/non-interactive use; an
+    interactive getpass prompt (never echoed, never in argv or history)
+    covers everything else.
+    """
+    return get_secret("ADMIN_PASSWORD") or getpass.getpass("Admin password (min 8 chars): ")
+
+
 def main() -> None:
     """Entry point for the admin-setup CLI tool."""
     parser = argparse.ArgumentParser(
         prog="admin-setup",
         description="Manage admin accounts for the dashboard.",
     )
     parser.add_argument("--email", metavar="EMAIL", help="Admin email address")
-    parser.add_argument("--password", metavar="PW", help="Admin password (min 8 chars)")
     parser.add_argument("--list", action="store_true", help="List existing admin accounts")
 
     args = parser.parse_args()
 
-    if not args.list and not (args.email and args.password):
+    if not args.list and not args.email:
         parser.print_help()
         sys.exit(1)
 
-    if args.password and len(args.password) < 8:
-        print("❌ Password must be at least 8 characters.")
-        sys.exit(1)
-
     conninfo = _build_conninfo()
 
     if args.list:
         list_admins(conninfo)
-    else:
-        add_admin(conninfo, args.email, args.password)
+        return
+
+    password = _resolve_password()
+    if len(password) < 8:
+        print("❌ Password must be at least 8 characters.")
+        sys.exit(1)
+
+    add_admin(conninfo, args.email, password)
 
 
 if __name__ == "__main__":
 
@@ -375,13 +375,25 @@ async def security_headers(request: Request, call_next: Any) -> Any:
 
 @app.middleware("http")
 async def metrics_middleware(request: Request, call_next: Any) -> Any:
-    """Record per-request timing for endpoint performance metrics."""
+    """Record per-request timing for endpoint performance metrics.
+
+    Keys on the matched route's path TEMPLATE (e.g. ``/api/artists/{id}``),
+    not the raw request URL. Requests that never matched a route (unknown
+    paths — attacker-controlled cardinality, wrong HTTP method) collapse into
+    a single ``<unmatched>`` bucket instead of each becoming a distinct key.
+    Previously this keyed on ``normalize_path(request.url.path)``, a regex
+    reconstruction that only collapses pure-integer/UUID segments — an
+    unauthenticated flood of distinct junk paths (``/a1``, ``/a2``, ...) could
+    fill the whole 10k-entry MetricsBuffer and evict every real endpoint's
+    samples (discogsography-jlei).
+    """
     import time as _time  # noqa: PLC0415
 
-    path = normalize_path(request.url.path)
     start = _time.monotonic()
     response = await call_next(request)
     elapsed_ms = (_time.monotonic() - start) * 1000
+    route = request.scope.get("route")
+    path = normalize_path(route.path) if route is not None else "<unmatched>"
     if hasattr(app.state, "metrics_buffer"):
         app.state.metrics_buffer.record(path, response.status_code, elapsed_ms)
     return response
 
@@ -172,7 +172,15 @@ def _parse_bearer(credentials: HTTPAuthorizationCredentials | None) -> str:
 
 
 async def _lookup_active_token(token_hash: str) -> dict[str, Any] | None:
-    """Fetch the active row for a token_hash, or None if missing/revoked."""
+    """Fetch the active row for a token_hash, or None if missing/revoked/for a deactivated user.
+
+    Joins `users` so a deactivated account's app tokens stop authenticating —
+    mirroring the `is_active` check every JWT-based admin/user path already
+    enforces (discogsography-ci4a). Also projects the row's own `token_hash`
+    so callers can do a real defense-in-depth comparison against it, instead
+    of recomputing the same value they already used for the WHERE clause and
+    comparing it to itself (discogsography-osoc).
+    """
     if _pool is None:
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
@@ -181,9 +189,10 @@ async def _lookup_active_token(token_hash: str) -> dict[str, Any] | None:
     async with _pool.connection() as conn, conn.cursor(row_factory=dict_row) as cur:
         await cur.execute(
             """
-            SELECT id, user_id, name, scope
-            FROM app_tokens
-            WHERE token_hash = %s AND revoked_at IS NULL
+            SELECT t.id, t.user_id, t.name, t.scope, t.token_hash
+            FROM app_tokens t
+            JOIN users u ON u.id = t.user_id
+            WHERE t.token_hash = %s AND t.revoked_at IS NULL AND u.is_active = TRUE
             """,
             (token_hash,),
         )
@@ -222,11 +231,14 @@ async def dependency(
                 headers={"WWW-Authenticate": "Bearer"},
             )
 
-        # Defense in depth: hmac.compare_digest on the canonical hash even though
-        # the WHERE clause already filtered. Guards against any future fast-path
-        # that bypasses the index (e.g. column rename, query restructure).
-        stored_hash = hash_token(plaintext)
-        if not hmac.compare_digest(stored_hash, token_hash):
+        # Defense in depth: compare the row's OWN persisted token_hash (now
+        # projected by _lookup_active_token) against the hash we looked up
+        # with. Previously this recomputed hash_token(plaintext) on both
+        # sides of compare_digest — comparing a value to itself, an
+        # unreachable guard (discogsography-osoc). Comparing against the
+        # stored column actually catches a future fast-path query that
+        # bypasses the WHERE clause (e.g. column rename, query restructure).
+        if not hmac.compare_digest(row["token_hash"], token_hash):
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail="Invalid app token",
 
@@ -2,6 +2,7 @@
 
 import asyncio
 from dataclasses import dataclass
+import hmac
 from typing import Annotated, Any, Literal
 
 from fastapi import Depends, HTTPException, status
@@ -132,13 +133,24 @@ async def dependency(
         # so the JWT path's 503/401 ordering and revocation checks are preserved
         # byte-for-byte for existing clients.
         if credentials is not None and credentials.credentials.startswith(_APP_TOKEN_PREFIX):
-            row = await _lookup_active_token(hash_token(credentials.credentials))
+            token_hash = hash_token(credentials.credentials)
+            row = await _lookup_active_token(token_hash)
             if row is None:
                 raise HTTPException(
                     status_code=status.HTTP_401_UNAUTHORIZED,
                     detail="Invalid or revoked app token",
                     headers={"WWW-Authenticate": "Bearer"},
                 )
+            # Defense in depth: mirrors require_app_token's check against the
+            # row's own persisted token_hash, so the two app-token entry
+            # points stay in lockstep instead of silently diverging
+            # (discogsography-osoc).
+            if not hmac.compare_digest(row["token_hash"], token_hash):
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="Invalid app token",
+                    headers={"WWW-Authenticate": "Bearer"},
+                )
             granted = list(row.get("scope") or [])
             missing = [s for s in required_scopes if s not in granted]
             if missing:
 
@@ -24,9 +24,9 @@ async def send_password_reset(self, email: str, reset_url: str) -> None:
 class LogNotificationChannel:
     """Notification channel that logs messages (development/MVP use)."""
 
-    async def send_password_reset(self, email: str, reset_url: str) -> None:  # noqa: ARG002  # reset_url unused in log channel
-        """Log a password reset link (URL intentionally not logged for security)."""
-        logger.info("🔑 Password reset link generated", email=email)
+    async def send_password_reset(self, email: str, reset_url: str) -> None:  # noqa: ARG002  # email/reset_url unused in log channel
+        """Log a password reset link (email and URL intentionally not logged — PII)."""
+        logger.info("🔑 Password reset link generated")
 
 
 class ResendNotificationChannel:
@@ -58,7 +58,7 @@ async def send_password_reset(self, email: str, reset_url: str) -> None:
             "</body></html>"
         )
 
-        logger.debug("🔑 Sending password reset email", email=email)
+        logger.debug("🔑 Sending password reset email")
         try:
             async with httpx.AsyncClient(timeout=10.0) as client:
                 response = await client.post(
@@ -72,6 +72,6 @@ async def send_password_reset(self, email: str, reset_url: str) -> None:
                     },
                 )
                 response.raise_for_status()
-            logger.info("📧 Password reset email sent", email=email)
+            logger.info("📧 Password reset email sent")
         except Exception:
-            logger.exception("❌ Failed to send password reset email", email=email)
+            logger.exception("❌ Failed to send password reset email")
@@ -118,7 +118,7 @@ async def admin_login(request: Request, body: AdminLoginRequest) -> JSONResponse
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
 
     access_token, expires_in = create_admin_token(str(admin["id"]), admin["email"], _config.jwt_secret_key)
-    logger.info("✅ Admin logged in", email=body.email)
+    logger.info("✅ Admin logged in", user_id=str(admin["id"]))
     await record_audit_entry(pool=_pool, admin_id=str(admin["id"]), action="admin.login", target=body.email, details={"success": True})
 
     return JSONResponse(
@@ -593,8 +593,8 @@ async def purge_dlq(
             detail="RabbitMQ management API unreachable",
         ) from exc
 
-    admin_email = current_admin.get("email", "unknown")
-    logger.info("🗑️ DLQ purged", queue=queue, messages_purged=messages_purged, admin_email=admin_email)
+    admin_id = current_admin.get("sub", "unknown")
+    logger.info("🗑️ DLQ purged", queue=queue, messages_purged=messages_purged, admin_id=admin_id)
     if _pool is not None:
         await record_audit_entry(
             pool=_pool, admin_id=current_admin["sub"], action="dlq.purge", target=queue, details={"purged_count": messages_purged}