From 5f6987b84be22fcbd1077b6a48e238f8fd632d75 Mon Sep 17 00:00:00 2001
From: Sean O'Connor <sean@soconnor.dev>
Date: Sat, 15 Aug 2026 00:17:57 -0400
Subject: [PATCH] Restore public demo review password

---
 README.md                                    |  6 ++++--
 drizzle/0028_enable_public_demo_password.sql | 16 ++++++++++++++++
 drizzle/meta/_journal.json                   |  7 +++++++
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 drizzle/0028_enable_public_demo_password.sql

diff --git a/README.md b/README.md
index bacfeb7..89a4ecf 100644
--- a/README.md
+++ b/README.md
@@ -82,13 +82,15 @@ bun run db:push      # fast iteration during development
 # bun run db:migrate # same migrations the Docker image runs in production
 ```
 
-**Demo account.** For App Store review and local testing, `bun run db:migrate` creates a pre-populated but locked `demo@example.com` account (`db:push` does not). Provision a private, temporary password when review access is needed:
+**Demo account.** For App Store review and local testing, `bun run db:migrate` creates a pre-populated `demo@example.com` account (`db:push` does not) with the public password `demo123`.
+
+To rotate the credential temporarily, provision a private password:
 
 ```bash
 DEMO_ACCOUNT_PASSWORD='<private 12+ character password>' bun run demo:provision
 ```
 
-Provisioning rotates the credential and invalidates prior sessions. Do not commit or publish the password. Re-run the command to rotate it; migration 0027 disables the previously public credential. The account includes a sample business, clients, and invoices (draft, sent, and paid).
+Provisioning rotates the credential and invalidates prior sessions. Do not commit or publish a private replacement password. The account includes a sample business, clients, and invoices (draft, sent, and paid).
 
 ### 4. Run
 
diff --git a/drizzle/0028_enable_public_demo_password.sql b/drizzle/0028_enable_public_demo_password.sql
new file mode 100644
index 0000000..98296f1
--- /dev/null
+++ b/drizzle/0028_enable_public_demo_password.sql
@@ -0,0 +1,16 @@
+-- Restore the public App Store review credential for the seeded demo account.
+-- Password: demo123
+UPDATE "beenvoice_user"
+SET "password" = '$2b$12$90U31okgkhOwSQD5RDqHwO0QpcC.pkKsqKb1IPnHfKUZm/2A9hzs6',
+    "updatedAt" = NOW()
+WHERE "id" = 'a0000000-0000-4000-8000-000000000001'
+  AND "email" = 'demo@example.com';
+
+UPDATE "beenvoice_account"
+SET "password" = '$2b$12$90U31okgkhOwSQD5RDqHwO0QpcC.pkKsqKb1IPnHfKUZm/2A9hzs6',
+    "updatedAt" = NOW()
+WHERE "userId" = 'a0000000-0000-4000-8000-000000000001'
+  AND "providerId" = 'credential';
+
+DELETE FROM "beenvoice_session"
+WHERE "userId" = 'a0000000-0000-4000-8000-000000000001';
diff --git a/drizzle/meta/_journal.json b/drizzle/meta/_journal.json
index e4dbc88..3539d1f 100644
--- a/drizzle/meta/_journal.json
+++ b/drizzle/meta/_journal.json
@@ -197,6 +197,13 @@
       "when": 1786740000000,
       "tag": "0027_disable_public_demo_password",
       "breakpoints": true
+    },
+    {
+      "idx": 28,
+      "version": "7",
+      "when": 1786766968000,
+      "tag": "0028_enable_public_demo_password",
+      "breakpoints": true
     }
   ]
 }