Update src/landppt/auth/auth_service.py

src/landppt/auth/auth_service.py

@@ -628,25 +628,45 @@ def get_auth_service() -> AuthService:
 
 
 def init_default_admin(db: Session) -> None:
-    """Optionally bootstrap an admin user when explicitly configured."""
-    if not app_config.bootstrap_admin_enabled:
-        return
-
-    user_count = db.query(User).count()
-    if user_count != 0:
-        return
-
-    bootstrap_username = (app_config.bootstrap_admin_username or "").strip()
-    bootstrap_password = app_config.bootstrap_admin_password or ""
+    """Bootstrap an admin user when configured, without overwriting changed passwords."""
+    explicit_bootstrap = bool(app_config.bootstrap_admin_enabled)
+    configured_username = (app_config.bootstrap_admin_username or "").strip()
+    configured_password = app_config.bootstrap_admin_password or ""
 
-    if not bootstrap_username or not bootstrap_password:
+    if explicit_bootstrap and (not configured_username or not configured_password):
         logger.warning(
             "Skipping admin bootstrap because LANDPPT_BOOTSTRAP_ADMIN_USERNAME or "
             "LANDPPT_BOOTSTRAP_ADMIN_PASSWORD is missing."
         )
         return
 
+    bootstrap_username = configured_username or "admin"
+    bootstrap_password = configured_password or "admin123456"
+    using_builtin_bootstrap = (
+        not explicit_bootstrap
+        and not configured_username
+        and not configured_password
+        and bootstrap_username == "admin"
+        and bootstrap_password == "admin123456"
+    )
+
+    if not explicit_bootstrap and not using_builtin_bootstrap:
+        return
+
     try:
+        existing = db.query(User).filter(User.username == bootstrap_username).first()
+        if existing:
+            if not existing.is_admin or not existing.is_active:
+                existing.is_admin = True
+                existing.is_active = True
+                db.commit()
+                logger.info("Ensured bootstrap admin user is active: %s", bootstrap_username)
+            return
+
+        user_count = db.query(User).count()
+        if user_count != 0 and not explicit_bootstrap:
+            return
+
         auth_service.create_user(
             db=db,
             username=bootstrap_username,
@@ -655,6 +675,7 @@ def init_default_admin(db: Session) -> None:
         )
         logger.info("Bootstrapped initial admin user: %s", bootstrap_username)
     except Exception as e:
+        db.rollback()
         logger.error("Failed to bootstrap initial admin user: %s", e)