release: v0.0.22 — refuse insecure auth defaults at startup

When AUTH_ENABLED=true the server refuses to start with an empty/default JWT_SECRET or empty/admin ADMIN_PASSWORD, preventing forgeable tokens and the default password in production. Auth-disabled/local dev unaffected; Helm injects random persisted secrets. Config validation tests added.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: SuperMarioYL

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to the Bison project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.22] - 2026-06-19
+
+### Security — Refuse insecure defaults at startup
+
+- When `AUTH_ENABLED=true`, the server now refuses to start if `JWT_SECRET` is empty or still the built-in public default, or if `ADMIN_PASSWORD` is empty or `admin`. This prevents a production deployment from silently running with a forgeable token-signing key or the well-known default password. Auth-disabled and local development are unaffected; the Helm chart already injects randomly generated, persisted secrets. Added table-driven config validation tests.
+
 ## [0.0.21] - 2026-06-19
 
 ### Added — Release test/lint gate

api-server/internal/config/config.go

@@ -36,15 +36,22 @@ type Config struct {
 	LeaderElectionEnabled bool
 }
 
+// Built-in development defaults that MUST NOT be used in production once auth is
+// enabled — startup refuses to proceed if they are left unchanged.
+const (
+	defaultAdminPassword = "admin"
+	defaultJWTSecret     = "bison-secret-key-change-in-production"
+)
+
 // Load reads configuration from environment variables
 func Load() (*Config, error) {
 	cfg := &Config{
 		Port:                  8080,
 		Mode:                  "release",
 		AuthEnabled:           false,
 		AdminUsername:         "admin",
-		AdminPassword:         "admin",
-		JWTSecret:             "bison-secret-key-change-in-production",
+		AdminPassword:         defaultAdminPassword,
+		JWTSecret:             defaultJWTSecret,
 		OpenCostURL:           "",
 		PrometheusURL:         "",
 		CapsuleEnabled:        true,
@@ -102,5 +109,25 @@ func Load() (*Config, error) {
 		}
 	}
 
+	if err := cfg.validate(); err != nil {
+		return nil, err
+	}
+
 	return cfg, nil
 }
+
+// validate refuses to start with insecure defaults once authentication is enabled,
+// so a production deployment cannot accidentally run with the public default JWT
+// signing key or the well-known "admin" password.
+func (c *Config) validate() error {
+	if !c.AuthEnabled {
+		return nil
+	}
+	if c.JWTSecret == "" || c.JWTSecret == defaultJWTSecret {
+		return fmt.Errorf("refusing to start: JWT_SECRET must be set to a non-default value when AUTH_ENABLED=true")
+	}
+	if c.AdminPassword == "" || c.AdminPassword == defaultAdminPassword {
+		return fmt.Errorf("refusing to start: ADMIN_PASSWORD must be set to a non-default value when AUTH_ENABLED=true")
+	}
+	return nil
+}

api-server/internal/config/config_test.go

@@ -0,0 +1,43 @@
+package config
+
+import "testing"
+
+func TestValidate(t *testing.T) {
+	cases := []struct {
+		name    string
+		cfg     Config
+		wantErr bool
+	}{
+		{
+			name: "auth disabled allows defaults",
+			cfg:  Config{AuthEnabled: false, JWTSecret: defaultJWTSecret, AdminPassword: defaultAdminPassword},
+		},
+		{
+			name:    "auth enabled rejects default jwt secret",
+			cfg:     Config{AuthEnabled: true, JWTSecret: defaultJWTSecret, AdminPassword: "strong-pass"},
+			wantErr: true,
+		},
+		{
+			name:    "auth enabled rejects empty jwt secret",
+			cfg:     Config{AuthEnabled: true, JWTSecret: "", AdminPassword: "strong-pass"},
+			wantErr: true,
+		},
+		{
+			name:    "auth enabled rejects default password",
+			cfg:     Config{AuthEnabled: true, JWTSecret: "a-real-secret", AdminPassword: defaultAdminPassword},
+			wantErr: true,
+		},
+		{
+			name: "auth enabled accepts strong values",
+			cfg:  Config{AuthEnabled: true, JWTSecret: "a-real-secret", AdminPassword: "strong-pass"},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.cfg.validate()
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("validate() err=%v, wantErr=%v", err, tc.wantErr)
+			}
+		})
+	}
+}

deploy/charts/bison/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: bison
 description: Bison - GPU 资源计费平台，基于 Capsule 多租户 + OpenCost 成本追踪
 type: application
-version: 0.0.21
-appVersion: "0.0.21"
+version: 0.0.22
+appVersion: "0.0.22"
 keywords:
   - gpu
   - billing

web-ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bison-web-ui",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "private": true,
   "scripts": {
     "dev": "vite",