[cristim]

Summary

setupAdmin forwarded the base64-encoded password straight to the auth
service instead of decoding it first, so the bootstrap admin's stored
bcrypt hash covered the base64 text instead of the real password. Every
later login (which does decode) then failed, locking the bootstrap admin
out permanently.

Root cause

The frontend base64-encodes the setup-admin password identically to how it
encodes the login password (frontend/src/api/auth.ts). login decodes
with decodeBase64Password before calling auth.Login
(internal/api/handler_auth.go), but setupAdmin passed setupReq
straight through to auth.SetupAdmin, which bcrypt-hashes whatever it is
given. The base64-password guard test (internal/api/base64_password_guard_test.go)
had a knownExemptFunctions entry for setupAdmin with a justification
that did not actually address the encoding mismatch.

Fix

• internal/api/handler_auth.go: setupAdmin now calls
  decodeBase64Password(setupReq.Password) before calling
  h.auth.SetupAdmin, exactly like login and resetPassword.
• internal/api/base64_password_guard_test.go: removed the stale
  setupAdmin exemption; knownExemptFunctions is now empty, and the
  guard test itself catches a future regression of this class.
• Updated TestHandler_setupAdmin_Success and the router coverage test to
  send a base64-encoded password body, matching the real frontend contract.

Regression test

Added TestSetupAdminThenLogin_RoundTrip in internal/server/adapter_test.go.
It drives the real request path (api.Router.Route -> api.Handler.setupAdmin
/ login -> authServiceAdapter -> the real *auth.Service, backed by an
auth.MockStore that persists the user setupAdmin creates and hands it
back to login), so the actual bcrypt hash setupAdmin produces is
exercised by login's bcrypt compare.

Proof it fails pre-fix: stashed internal/api/handler_auth.go (reverting
just the decode call) and reran the test -- login failed with
ErrInvalidCredentials-class error because the stored hash covered the
base64 text. Restoring the fix makes it pass.

Verification

• go build ./...
• go vet ./internal/api/... ./internal/server/... ./internal/auth/...
• go test -race -short ./internal/api/... ./internal/server/... ./internal/auth/... -- 3529 passed
• golangci-lint run at the CI-pinned v2.10.1 -- 0 issues
• go mod tidy -diff -- empty

Closes #224

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 5 billable files and costs up to $1.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 3 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available. Your 37 included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 16a1d9aa-fff7-45a7-b872-8194106cda8d

📥 Commits

Reviewing files that changed from the base of the PR and between 80088de and 3fa4ccc.

📒 Files selected for processing (5)

• internal/api/base64_password_guard_test.go
• internal/api/handler_auth.go
• internal/api/handler_auth_test.go
• internal/api/handler_coverage_test.go
• internal/server/adapter_test.go

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent adversarial review + local verification: MERGE at 3fa4ccc. setupAdmin now decodes the base64 password with the same strict decoder login uses, so the bootstrap admin can log in; no double-decode path; CLI/MCP have no setup flow. Round-trip test fails pre-fix and passes; checks green incl. E2E.