From 58eb0aeb6a2005c7287c75afd5b192cebc4a4bf3 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 02:59:35 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL]?=
 =?UTF-8?q?=20Fix=20Hardcoded=20Admin=20Credentials?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Removed hardcoded 'admin' and 'admin123' from `backend/auth.py`.
- Replaced with secure environment variable fetch (`os.environ.get`).
- Added robust error handling (`500 HTTPException`) for missing configurations to prevent insecure fallbacks.
- Replaced standard string equality checks (`==`) with `secrets.compare_digest` encoded to `utf-8` to prevent timing attacks and handle potential non-ASCII TypeErrors.
- Updated `.jules/sentinel.md` with findings and learning.

Co-authored-by: shadowcoder8 <185462083+shadowcoder8@users.noreply.github.com>
---
 .jules/sentinel.md | 13 +++++++++++++
 backend/auth.py    | 15 +++++++++++++--
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 518c5af..948e31d 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -9,3 +9,16 @@ Always use an environment variable (like `ALLOWED_ORIGINS`) to strictly define a
 **Prevention:**
 1. Do not use wildcard `["*"]` for CORS in production setups, especially with authenticated routes.
 2. Verify CORS setups using testing frameworks like Pytest or by configuring restricted inputs dynamically through the `.env` configuration.
+
+## 2024-08-01 - Hardcoded Admin Credentials Removed
+
+**Vulnerability:**
+The `authenticate_admin` function in `backend/auth.py` used hardcoded credentials (`admin` / `admin123`) to authenticate admins. This creates a severe security risk by embedding sensitive secrets directly in the source code, exposing them to anyone with repository access.
+
+**Learning:**
+Never hardcode secrets. Always use environment variables for sensitive configuration like passwords and API keys. Additionally, using standard string equality checks (`==`) for passwords enables timing attacks; use `secrets.compare_digest` instead.
+
+**Prevention:**
+1. Use `os.environ.get()` to securely retrieve configuration variables.
+2. Use `secrets.compare_digest()` after encoding strings to `utf-8` to perform constant-time comparisons.
+3. Fail securely (e.g., return a `500 Internal Server Error` if configuration is missing, rather than allowing a default fallback).
\ No newline at end of file
diff --git a/backend/auth.py b/backend/auth.py
index 1f396ff..1aad896 100644
--- a/backend/auth.py
+++ b/backend/auth.py
@@ -1,7 +1,18 @@
+import os
+import secrets
 from fastapi import HTTPException
 
 def authenticate_admin(username: str, password: str):
-    # Dummy authentication logic
-    if username != "admin" or password != "admin123":
+    admin_username = os.environ.get("ADMIN_USERNAME")
+    admin_password = os.environ.get("ADMIN_PASSWORD")
+
+    if not admin_username or not admin_password:
+        raise HTTPException(status_code=500, detail="Server configuration error: Admin credentials not set.")
+
+    username_match = secrets.compare_digest(username.encode("utf-8"), admin_username.encode("utf-8"))
+    password_match = secrets.compare_digest(password.encode("utf-8"), admin_password.encode("utf-8"))
+
+    if not (username_match and password_match):
         raise HTTPException(status_code=401, detail="Invalid username or password")
+
     return {"message": "Login successful"}