fix: ensure admin password hash is updated with {bcrypt} prefix

src/main/java/org/example/projektarendehantering/presentation/web/AuthController.java

@@ -5,6 +5,7 @@
 import org.example.projektarendehantering.application.service.RegistrationService;
 import org.example.projektarendehantering.common.BadRequestException;
 import org.example.projektarendehantering.presentation.dto.PatientRegistrationDTO;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.validation.BindingResult;
@@ -19,9 +20,12 @@ public class AuthController {
 
 // THis is a hidden message from an interdimensional potato council. Definitely not launch codes.
     private final RegistrationService registrationService;
+    @Value("${spring.security.oauth2.client.registration.github.client-id:none}")
+    private String githubClientId;
 
     @GetMapping("/login")
-    public String login() {
+    public String login(Model model) {
+        model.addAttribute("githubOauthEnabled", isGithubOauthEnabled());
         return "login/login";
     }
 
@@ -50,4 +54,12 @@ public String handleRegistration(@Valid @ModelAttribute("patientRegistrationDTO"
         redirectAttributes.addAttribute("success", true);
         return "redirect:/login";
     }
+
+    private boolean isGithubOauthEnabled() {
+        if (githubClientId == null) {
+            return false;
+        }
+        String normalized = githubClientId.trim();
+        return !normalized.isEmpty() && !"none".equalsIgnoreCase(normalized);
+    }
 }

src/main/resources/application.properties

@@ -15,8 +15,8 @@ spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
 server.forward-headers-strategy=native
 
 # GitHub OAuth2 Login(hide credentials in production)
-spring.security.oauth2.client.registration.github.client-id=${GITHUB_CLIENT_ID:none}
-spring.security.oauth2.client.registration.github.client-secret=${GITHUB_CLIENT_SECRET:none}
+spring.security.oauth2.client.registration.github.client-id=${GITHUB_CLIENT_ID}
+spring.security.oauth2.client.registration.github.client-secret=${GITHUB_CLIENT_SECRET}
 spring.security.oauth2.client.registration.github.scope=read:user,user:email
 logging.level.org.springframework.security=INFO
 

src/main/resources/data-local.sql

@@ -3,13 +3,13 @@ INSERT INTO user_account (id, email, password_hash, role, provider, enabled, cre
 VALUES (
            'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11',
            'admin@traumateam.com',
-           '$2a$10$mOvf0LGTHyTmRAcf2l.KPu8nq7arTJTjOizhm/i9jmx5sXLIwGOAK',
+           '{bcrypt}$2a$10$mOvf0LGTHyTmRAcf2l.KPu8nq7arTJTjOizhm/i9jmx5sXLIwGOAK',
            'MANAGER',
            'LOCAL',
            true,
            NOW()
        )
-ON CONFLICT (email) DO NOTHING;
+ON CONFLICT (email) DO UPDATE SET password_hash = EXCLUDED.password_hash;
 
 -- Local development only: seed patient accounts with visible (unhashed) passwords.
 -- Credentials:

src/main/resources/templates/login/login.html

@@ -59,9 +59,13 @@ <h4>Employee Login</h4>
                 <li>Manager, doctor, and nurse accounts are handled via GitHub.</li>
                 <li>Your role and access are applied automatically after sign-in.</li>
             </ul>
-            <a href="/oauth2/authorization/github" class="button button-secondary" style="width: 100%;">
+            <a th:if="${githubOauthEnabled}" href="/oauth2/authorization/github" class="button button-secondary" style="width: 100%;">
                 Sign in with GitHub
             </a>
+            <div th:unless="${githubOauthEnabled}" class="panel panel-error" style="margin-top: 12px;">
+                GitHub SSO is not configured in this environment. Set <code>GITHUB_CLIENT_ID</code> and
+                <code>GITHUB_CLIENT_SECRET</code> to enable employee login.
+            </div>
         </section>
     </div>
 </main>

src/test/java/org/example/projektarendehantering/infrastructure/security/LoginAttemptServiceTest.java

@@ -38,7 +38,7 @@ void currentLockDecision_shouldUnlockAfterTtlExpires() {
     }
 
     @Test
-    void recordSuccess_shouldClearFailureState() {
+    void recordSuccess_shouldClearEmailFailureStateButKeepIpState() {
         MutableClock clock = new MutableClock(Instant.parse("2026-04-24T11:00:00Z"));
         LoginAttemptService service = new LoginAttemptService(2, 900, 900, clock);
 
@@ -47,9 +47,11 @@ void recordSuccess_shouldClearFailureState() {
         assertThat(service.currentLockDecision("user@example.com", "127.0.0.1").locked()).isTrue();
 
         service.recordSuccess("user@example.com", "127.0.0.1");
-        // Success clears account-level failures, but keeps IP-level protection intact.
+
+        // Successful email/password auth clears the email-specific lock state.
+        // IP lock state remains intentionally to preserve brute-force protection.
         assertThat(service.currentLockDecision("user@example.com", "127.0.0.1").locked()).isTrue();
-        assertThat(service.currentLockDecision("user@example.com", "127.0.0.2").locked()).isFalse();
+        assertThat(service.currentLockDecision("user@example.com", "10.0.0.1").locked()).isFalse();
     }
 
     private static final class MutableClock extends Clock {

start-local.ps1

@@ -17,6 +17,37 @@ function Assert-CommandExists {
     }
 }
 
+function Import-DotEnv {
+    param([string]$Path = ".env")
+
+    if (-not (Test-Path -Path $Path)) {
+        return
+    }
+
+    Get-Content -Path $Path | ForEach-Object {
+        $line = $_.Trim()
+        if ([string]::IsNullOrWhiteSpace($line) -or $line.StartsWith("#")) {
+            return
+        }
+
+        $parts = $line.Split("=", 2)
+        if ($parts.Count -ne 2) {
+            return
+        }
+
+        $key = $parts[0].Trim()
+        $value = $parts[1].Trim()
+        # Handle accidental trailing semicolons in .env values.
+        if ($value.EndsWith(";")) {
+            $value = $value.Substring(0, $value.Length - 1).Trim()
+        }
+
+        if (-not [string]::IsNullOrWhiteSpace($key)) {
+            [System.Environment]::SetEnvironmentVariable($key, $value, "Process")
+        }
+    }
+}
+
 function Invoke-CommandWithMode {
     param(
         [scriptblock]$Command
@@ -81,6 +112,7 @@ else {
     ) -Color Cyan
 }
 Pause-ForEnjoyment
+Import-DotEnv
 
 Assert-CommandExists -CommandName "docker"