Harden demo access and restore clean checks

scripts/provision-demo-account.ts

@@ -0,0 +1,61 @@
+import "dotenv/config";
+
+import bcrypt from "bcryptjs";
+import { Pool } from "pg";
+
+const DEMO_USER_ID = "a0000000-0000-4000-8000-000000000001";
+const password = process.env.DEMO_ACCOUNT_PASSWORD?.trim();
+const databaseUrl = process.env.DATABASE_URL?.trim();
+
+if (!databaseUrl) {
+  throw new Error("DATABASE_URL is required");
+}
+
+if (!password || password.length < 12) {
+  throw new Error("DEMO_ACCOUNT_PASSWORD must be at least 12 characters");
+}
+
+const pool = new Pool({ connectionString: databaseUrl, ssl: false });
+
+try {
+  const passwordHash = await bcrypt.hash(password, 12);
+  const client = await pool.connect();
+
+  try {
+    await client.query("BEGIN");
+    const userResult = await client.query(
+      `UPDATE "beenvoice_user"
+       SET "password" = $1, "updatedAt" = NOW()
+       WHERE "id" = $2`,
+      [passwordHash, DEMO_USER_ID],
+    );
+    const accountResult = await client.query(
+      `UPDATE "beenvoice_account"
+       SET "password" = $1, "updatedAt" = NOW()
+       WHERE "userId" = $2 AND "providerId" = 'credential'`,
+      [passwordHash, DEMO_USER_ID],
+    );
+
+    if (userResult.rowCount !== 1 || accountResult.rowCount !== 1) {
+      throw new Error(
+        "Demo account is missing. Apply database migrations before provisioning it.",
+      );
+    }
+
+    await client.query(`DELETE FROM "beenvoice_session" WHERE "userId" = $1`, [
+      DEMO_USER_ID,
+    ]);
+    await client.query("COMMIT");
+  } catch (error) {
+    await client.query("ROLLBACK");
+    throw error;
+  } finally {
+    client.release();
+  }
+
+  console.log(
+    "Demo review account provisioned; previous sessions were invalidated.",
+  );
+} finally {
+  await pool.end();
+}