From e01982c40ffbd853b012355d481364ca53674f83 Mon Sep 17 00:00:00 2001
From: Pulse Monitor <pulse@pulse-monitor.dev>
Date: Thu, 14 Aug 2025 11:37:52 +0000
Subject: [PATCH] fix: critical auth persistence bug in Docker Quick Security
 Setup

- Docker containers were not saving credentials to persistent storage
- Non-Docker setups were saving plain text instead of hashed credentials
- After container restart, saved credentials would not work

This fixes issue #314 where users couldn't login after setting up security
in Docker containers. The Quick Security Setup now:
1. Properly hashes passwords and tokens before saving
2. Saves to /etc/pulse/.env for persistence in Docker volumes
3. Correctly loads credentials after container restart
---
 internal/api/router.go | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/internal/api/router.go b/internal/api/router.go
index 18b299031..fae383aa1 100644
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -351,13 +351,34 @@ echo "You will need to log in with your saved credentials."
 				json.NewEncoder(w).Encode(response)
 				
 			} else if isDocker {
-				// For Docker, we can't modify the running container
-				// But we can save settings and provide docker run command
+				// For Docker, save credentials to persistent storage
+				// Docker containers need to persist auth config to /etc/pulse
+				envPath := filepath.Join(r.config.ConfigPath, ".env")
+				envContent := fmt.Sprintf(`# Auto-generated by Pulse Quick Security Setup
+# Generated on %s
+PULSE_AUTH_USER=%s
+PULSE_AUTH_PASS=%s
+API_TOKEN=%s
+ENABLE_AUDIT_LOG=true
+`, time.Now().Format(time.RFC3339), setupRequest.Username, hashedPassword, hashedToken)
+				
+				// Ensure directory exists
+				os.MkdirAll(r.config.ConfigPath, 0755)
+				
+				if err := os.WriteFile(envPath, []byte(envContent), 0600); err != nil {
+					log.Error().Err(err).Str("path", envPath).Msg("Failed to write .env file in Docker")
+					http.Error(w, "Failed to save security configuration", http.StatusInternalServerError)
+					return
+				}
+				
+				log.Info().Str("path", envPath).Msg("Docker security configuration saved")
+				
 				response := map[string]interface{}{
 					"success": true,
 					"method": "docker",
 					"requiresManualRestart": true,
-					"message": "Security configuration generated. Restart your Docker container with the environment variables shown.",
+					"message": "Security configuration saved. Restart your Docker container to apply settings.",
+					"note": "Your credentials have been saved and will persist after restart.",
 				}
 				
 				w.Header().Set("Content-Type", "application/json")
@@ -368,11 +389,12 @@ echo "You will need to log in with your saved credentials."
 				// Save to .env file for next restart
 				envPath := filepath.Join(r.config.ConfigPath, ".env")
 				envContent := fmt.Sprintf(`# Auto-generated by Pulse Quick Security Setup
+# Generated on %s
 PULSE_AUTH_USER=%s
 PULSE_AUTH_PASS=%s
 API_TOKEN=%s
 ENABLE_AUDIT_LOG=true
-`, setupRequest.Username, setupRequest.Password, setupRequest.APIToken)
+`, time.Now().Format(time.RFC3339), setupRequest.Username, hashedPassword, hashedToken)
 				
 				if err := os.WriteFile(envPath, []byte(envContent), 0600); err != nil {
 					log.Error().Err(err).Msg("Failed to write .env file")