Harden demo access and restore clean checks

2026-08-14 16:45:02 -04:00
parent 29d7b498ae
commit 66a53f25f2
10 changed files with 114 additions and 11 deletions
@@ -82,12 +82,13 @@ bun run db:push      # fast iteration during development
 # bun run db:migrate # same migrations the Docker image runs in production
 ```

-**Demo account.** For App Store review and local testing, `bun run db:migrate` applies `0014_seed_demo_account.sql`, which creates a pre-populated user (`db:push` does not). Sign in at `/auth/login`:
+**Demo account.** For App Store review and local testing, `bun run db:migrate` creates a pre-populated but locked `demo@example.com` account (`db:push` does not). Provision a private, temporary password when review access is needed:

- Email: `demo@example.com`
- Password: `demo123`
+```bash
+DEMO_ACCOUNT_PASSWORD='<private 12+ character password>' bun run demo:provision
+```

-The account includes a sample business, clients, and invoices (draft, sent, and paid).
+Provisioning rotates the credential and invalidates prior sessions. Do not commit or publish the password. Re-run the command to rotate it; migration 0027 disables the previously public credential. The account includes a sample business, clients, and invoices (draft, sent, and paid).

 ### 4. Run