fix(passwd): also reset The Lounge web-login password

passwd@ reset the IRC SASL credential (Ergo store + The Lounge saslPassword) but
NOT The Lounge's own web-login password (the bcrypt field used to sign in to
chat.<domain> itself). So a member who reset their password could connect to IRC
but got "auth failed" at chat.profullstack.com/sign-in.

set-irc-password.sh now sets all THREE chat credentials to the new password:
Ergo SASL, the Lounge saslPassword, and the Lounge web-login password via
`thelounge reset <member>` (AGENTBBS_LOUNGE_RESET_CMD, default targets the
dockerized The Lounge). The password is piped on stdin to `thelounge reset`, so
it never lands on a command line. Best-effort: a Lounge web-reset failure warns
but doesn't fail the run (Ergo SASL stays the primary IRC secret).

Bumped ircpass SetPassword's context timeout 20s→60s since the helper now also
runs a `docker exec thelounge ...` step.

Verified live on bbs.profullstack.com: the modified helper sets all three for an
existing member (web bcrypt match + saslPassword + Ergo store), and the affected
member's web login was reconciled.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-27 16:37:09 +00:00
parent 54ede811f9
commit a69d702ea4
3 changed files with 72 additions and 11 deletions

View file

@ -74,7 +74,9 @@ func (c Config) SetPassword(member, password string) error {
args = []string{"-n", c.Script, member, "-"}
}
ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
// Generous: the helper also resets The Lounge web-login password via a
// `docker exec thelounge ...` which can take a few seconds on a busy box.
ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
defer cancel()
cmd := exec.CommandContext(ctx, name, args...)
// Never let the helper inherit the BBS environment wholesale; pass only the