Improve login page security by dynamically showing default credentials

Adds API endpoint to check default admin password status and hides credentials.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 91318273-c764-4fd4-be04-bdc12c38af32
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/0715008c-7244-40f4-befc-26c014852236/22c32c18-bf03-4830-a5c9-ef4544d0e27f.jpg

server/routes.ts

@@ -105,6 +105,17 @@ export async function registerRoutes(app: Express): Promise<Server> {
     });
   });
 
+  // Check if default admin credentials are still in use
+  app.get('/api/auth/default-credentials-status', async (req, res) => {
+    try {
+      const isUsingDefault = await storage.isUsingDefaultPassword();
+      res.json({ showDefaultCredentials: isUsingDefault });
+    } catch (error) {
+      console.error('Default credentials check error:', error);
+      res.status(500).json({ error: "Failed to check default credentials status" });
+    }
+  });
+
   app.get('/api/auth/me', requireAuth, async (req, res) => {
     try {
       const user = await storage.getUser(req.session.userId!);

server/storage.ts

@@ -39,6 +39,7 @@ export interface IStorage {
   authenticateUser(username: string, password: string): Promise<User | null>;
   hashPassword(password: string): Promise<string>;
   initializeDefaults(): Promise<{ defaultAdminCredentials?: { username: string; password: string } }>;
+  isUsingDefaultPassword(): Promise<boolean>;
 }
 
 export class DatabaseStorage implements IStorage {
@@ -168,6 +169,17 @@ export class DatabaseStorage implements IStorage {
     return await bcrypt.hash(password, 12);
   }
 
+  // Check if admin still uses default password
+  async isUsingDefaultPassword(): Promise<boolean> {
+    const adminUser = await this.getUserByUsername('admin');
+    if (!adminUser) {
+      return false;
+    }
+    
+    // Check if the stored password hash matches the default password "admin123"
+    return await bcrypt.compare('admin123', adminUser.password);
+  }
+
   // Initialize default admin user and store if none exist
   async initializeDefaults(): Promise<{ defaultAdminCredentials?: { username: string; password: string } }> {
     const existingUsers = await this.getAllUsers();