Clear initial admin password after provisioning

kubetix-api/main.py

@@ -102,35 +102,42 @@ async def lifespan(app: FastAPI):
         init_db()
 
     _admin_password = _os.environ.get("INITIAL_ADMIN_PASSWORD", "").strip()
-    if not _admin_password:
-        import logging
-
-        logging.warning(
-            "KubeTix startup: no INITIAL_ADMIN_PASSWORD set. "
-            "The API will run without a default admin account. "
-            "Create the first admin via /users registration or by setting "
-            "INITIAL_ADMIN_PASSWORD=<strong-password> in production."
-        )
-    else:
-        from kubetix_api.database import SessionLocal
-        from kubetix_api.models import User
-        from kubetix_api.auth import get_password_hash
-
-        db = SessionLocal()
-        try:
-            admin = db.query(User).filter(User.email == "admin@kubetix.local").first()
-            if not admin:
-                admin = User(
-                    id=__import__("secrets").token_urlsafe(16),
-                    email="admin@kubetix.local",
-                    hashed_password=get_password_hash(_admin_password),
-                    full_name="Admin User",
-                    is_admin=True,
+    try:
+        if not _admin_password:
+            import logging
+
+            logging.warning(
+                "KubeTix startup: no INITIAL_ADMIN_PASSWORD set. "
+                "The API will run without a default admin account. "
+                "Create the first admin via /users registration or by setting "
+                "INITIAL_ADMIN_PASSWORD=<strong-password> in production."
+            )
+        else:
+            from kubetix_api.database import SessionLocal
+            from kubetix_api.models import User
+            from kubetix_api.auth import get_password_hash
+
+            db = SessionLocal()
+            try:
+                admin = (
+                    db.query(User).filter(User.email == "admin@kubetix.local").first()
                 )
-                db.add(admin)
-                db.commit()
-        finally:
-            db.close()
+                if not admin:
+                    admin = User(
+                        id=__import__("secrets").token_urlsafe(16),
+                        email="admin@kubetix.local",
+                        hashed_password=get_password_hash(_admin_password),
+                        full_name="Admin User",
+                        is_admin=True,
+                    )
+                    db.add(admin)
+                    db.commit()
+            finally:
+                db.close()
+    finally:
+        # Clear sensitive credential from the environment and local variable.
+        _os.environ.pop("INITIAL_ADMIN_PASSWORD", None)
+        _admin_password = ""
     yield
     # Shutdown: signal background tasks to stop and wait for them.
     _cleanup_stop.set()

tests/unit/test_initial_admin_password.py

@@ -0,0 +1,42 @@
+"""Regression tests for startup handling of the initial admin password."""
+
+import asyncio
+import os
+
+import main
+from kubetix_api import cleanup, database
+
+
+def test_initial_admin_password_is_removed_after_startup(monkeypatch):
+    """The bootstrap password must not remain in the process environment."""
+    monkeypatch.setenv("INITIAL_ADMIN_PASSWORD", "bootstrap-secret")
+    monkeypatch.setenv("TESTING", "1")
+
+    class ExistingAdminQuery:
+        def filter(self, _condition):
+            return self
+
+        def first(self):
+            return object()
+
+    class FakeSession:
+        def query(self, _model):
+            return ExistingAdminQuery()
+
+        def close(self):
+            pass
+
+    session = FakeSession()
+    monkeypatch.setattr(database, "SessionLocal", lambda: session)
+
+    async def fake_cleanup_loop(stop_event):
+        await stop_event.wait()
+
+    monkeypatch.setattr(cleanup, "run_grant_cleanup_loop", fake_cleanup_loop)
+
+    async def run_lifespan():
+        async with main.lifespan(main.app):
+            assert "INITIAL_ADMIN_PASSWORD" not in os.environ
+
+    asyncio.run(run_lifespan())
+    assert "INITIAL_ADMIN_PASSWORD" not in os.environ