Harden demo access and restore clean checks

drizzle/0027_disable_public_demo_password.sql

@@ -0,0 +1,17 @@
+-- The original App Review credential was committed publicly in migration 0014.
+-- Rotate it to an unknown value and invalidate its sessions. Use
+-- `bun run demo:provision` with a private DEMO_ACCOUNT_PASSWORD when review
+-- access is needed.
+UPDATE "beenvoice_user"
+SET "password" = '$2b$12$GyM6.bLv2.sZMsWytNz1L.j7pLwc79a55Nww6bSLQJ9OJarqY9oZW',
+    "updatedAt" = NOW()
+WHERE "id" = 'a0000000-0000-4000-8000-000000000001';
+
+UPDATE "beenvoice_account"
+SET "password" = '$2b$12$GyM6.bLv2.sZMsWytNz1L.j7pLwc79a55Nww6bSLQJ9OJarqY9oZW',
+    "updatedAt" = NOW()
+WHERE "userId" = 'a0000000-0000-4000-8000-000000000001'
+  AND "providerId" = 'credential';
+
+DELETE FROM "beenvoice_session"
+WHERE "userId" = 'a0000000-0000-4000-8000-000000000001';

drizzle/meta/_journal.json

@@ -190,6 +190,13 @@
       "when": 1784000000000,
       "tag": "0026_business_hide_name_with_logo_fix",
       "breakpoints": true
+    },
+    {
+      "idx": 27,
+      "version": "7",
+      "when": 1786740000000,
+      "tag": "0027_disable_public_demo_password",
+      "breakpoints": true
     }
   ]
 }