Secure image access and bootstrap admin

backend/database.js

@@ -38,13 +38,44 @@ db.serialize(() => {
         UNIQUE(user_id, image_name)
     )`);
 
-    // Default-Admin erstellen wenn keiner existiert
-    db.get('SELECT * FROM users WHERE username = ?', ['admin'], (err, row) => {
-        if (!row) {
-            const hash = bcrypt.hashSync('admin123', 10);
-            db.run('INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)', ['admin', hash, 'admin']);
-            console.log('Default admin created: admin / admin123');
+    // Initialen Admin nur mit expliziten Credentials aus der Umgebung anlegen.
+    db.serialize(() => {
+        const username = process.env.INITIAL_ADMIN_USERNAME;
+        const password = process.env.INITIAL_ADMIN_PASSWORD;
+        const passwordHash = process.env.INITIAL_ADMIN_PASSWORD_HASH || (password ? bcrypt.hashSync(password, 10) : null);
+        if (!username || !passwordHash) {
+            console.warn('Set INITIAL_ADMIN_USERNAME with INITIAL_ADMIN_PASSWORD or INITIAL_ADMIN_PASSWORD_HASH to bootstrap an admin.');
+            return;
         }
+
+        db.get('SELECT id FROM users WHERE username = ?', [username], (err, row) => {
+            if (err || row) return;
+
+            db.run(
+                'INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)',
+                [username, passwordHash, 'admin'],
+                (insertErr) => {
+                    if (insertErr) {
+                        console.error('Failed to create initial admin:', insertErr.message);
+                        return;
+                    }
+                    console.log(`Initial admin created: ${username}`);
+                }
+            );
+        });
+
+        db.get('SELECT id, role FROM users WHERE username = ?', [username], (err, row) => {
+            if (err || !row || row.role === 'admin') return;
+
+            db.run('UPDATE users SET role = ? WHERE id = ?', ['admin', row.id], (updateErr) => {
+                if (updateErr) {
+                    console.error('Failed to promote initial admin:', updateErr.message);
+                    return;
+                }
+                console.log(`Initial admin promoted: ${username}`);
+            }
+            );
+        });
     });
 });