naprawa hasła

backend/src/main/java/pl/polskalokalnie/config/DataSeeder.java

@@ -1,6 +1,8 @@
 package pl.polskalokalnie.config;
 
 import java.math.BigDecimal;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.CommandLineRunner;
 import org.springframework.security.crypto.password.PasswordEncoder;
@@ -26,6 +28,8 @@ import pl.polskalokalnie.user.UserRepository;
 @Component
 public class DataSeeder implements CommandLineRunner {
 
+    private static final Logger log = LoggerFactory.getLogger(DataSeeder.class);
+
     private final UserRepository userRepository;
     private final ListingRepository listingRepository;
     private final BannerRepository bannerRepository;
@@ -36,6 +40,7 @@ public class DataSeeder implements CommandLineRunner {
     private final String adminEmail;
     private final String adminPassword;
     private final String adminName;
+    private final boolean adminResetPassword;
 
     public DataSeeder(
             UserRepository userRepository,
@@ -47,7 +52,8 @@ public class DataSeeder implements CommandLineRunner {
             NickService nickService,
             @Value("${app.admin.email:admin@softspm.com}") String adminEmail,
             @Value("${app.admin.password:Admin123!}") String adminPassword,
-            @Value("${app.admin.name:Administrator Polska Lokalnie}") String adminName
+            @Value("${app.admin.name:Administrator Polska Lokalnie}") String adminName,
+            @Value("${app.admin.reset-password:false}") boolean adminResetPassword
     ) {
         this.userRepository = userRepository;
         this.listingRepository = listingRepository;
@@ -59,6 +65,7 @@ public class DataSeeder implements CommandLineRunner {
         this.adminEmail = adminEmail;
         this.adminPassword = adminPassword;
         this.adminName = adminName;
+        this.adminResetPassword = adminResetPassword;
     }
 
     @Override
@@ -135,19 +142,45 @@ public class DataSeeder implements CommandLineRunner {
         return banner;
     }
 
+    /**
+     * Konto administratora z konfiguracji (APP_ADMIN_EMAIL / APP_ADMIN_PASSWORD).
+     *
+     * Gdy konta o tym adresie jeszcze nie ma - zakladamy je. Gdy juz istnieje, haslo z konfiguracji
+     * jest ignorowane, bo inaczej kazdy restart cofalby haslo zmienione w ustawieniach konta.
+     * Swiadome nadpisanie wlacza APP_ADMIN_RESET_PASSWORD=true - to jedyna droga odzyskania dostepu,
+     * gdy haslo administratora zostalo zgubione.
+     */
     private void seedAdmin() {
-        if (userRepository.existsByEmailIgnoreCase(adminEmail)) {
+        String email = adminEmail.trim().toLowerCase();
+        AppUser existing = userRepository.findByEmailIgnoreCase(email).orElse(null);
+
+        if (existing == null) {
+            AppUser admin = new AppUser();
+            admin.setEmail(email);
+            admin.setFullName(adminName);
+            admin.setNick(nickService.generateUnique(email.split("@")[0]));
+            admin.setPasswordHash(passwordEncoder.encode(adminPassword));
+            admin.setRole(Role.ADMIN);
+            admin.setProvider(AuthProvider.LOCAL);
+            admin.setVerified(true);
+            userRepository.save(admin);
+            log.info("Utworzono konto administratora {}", email);
             return;
         }
-        AppUser admin = new AppUser();
-        admin.setEmail(adminEmail.toLowerCase());
-        admin.setFullName(adminName);
-        admin.setNick(nickService.generateUnique(adminEmail.split("@")[0]));
-        admin.setPasswordHash(passwordEncoder.encode(adminPassword));
-        admin.setRole(Role.ADMIN);
-        admin.setProvider(AuthProvider.LOCAL);
-        admin.setVerified(true);
-        userRepository.save(admin);
+
+        if (!adminResetPassword) {
+            return;
+        }
+
+        // Awaryjne przywrocenie dostepu: haslo, rola i aktywacja wracaja do stanu z konfiguracji.
+        // Blokada konta tez znika - inaczej reset hasla nie przywrocilby logowania.
+        existing.setPasswordHash(passwordEncoder.encode(adminPassword));
+        existing.setRole(Role.ADMIN);
+        existing.setVerified(true);
+        existing.setBlocked(false);
+        userRepository.save(existing);
+        log.warn("APP_ADMIN_RESET_PASSWORD=true - ustawiono haslo z konfiguracji dla konta {}."
+                + " Wylacz te zmienna po odzyskaniu dostepu.", email);
     }
 
     private void seedDemoListings() {