refactor(config): check admin password strength at startup

[madhavilosetty-intel]

Warn when the configured admin password falls short of a length (8-32) and complexity rule. Startup continues.

Generated passwords now draw one character from each required class and shuffle with crypto/rand, so a fresh install satisfies the same rule the warning describes. The generated special set omits $ and ! because the printed password is pasted into AUTH_ADMIN_PASSWORD in .env and compose files, where they expand; both stay accepted when an operator sets them.

Existing passwords are untouched: the generator only runs when no password is configured, and a weak value only warns.

[codecov]

Codecov Report

❌ Patch coverage is 81.25000% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.19%. Comparing base (2296f65) to head (452bc8d).

Files with missing lines	Patch %	Lines
cmd/app/main.go	81.25%	4 Missing and 5 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1193      +/-   ##
==========================================
+ Coverage   50.09%   50.19%   +0.10%     
==========================================
  Files         146      146              
  Lines       13552    13596      +44     
==========================================
+ Hits         6789     6825      +36     
- Misses       6171     6175       +4     
- Partials      592      596       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR adds an admin-password strength policy check during startup (warn-only) and updates the admin password generator to reliably produce passwords that satisfy the same policy, keeping existing installations unblocked.

Changes:

• Add a startup warning for weak configured admin passwords (length and per-class complexity).
• Update generated admin passwords to include at least one character from each required class and then shuffle using crypto/rand.
• Add unit tests to lock generator output to the policy checker and validate warning behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
cmd/app/main.go	Adds password policy constants/checker, warn-only startup logging, and updates password generation to be policy-aware.
cmd/app/main_test.go	Adds tests for policy compliance, shell-safe generation constraints, length errors, and startup warning logging.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rsdmike]

Hi Madhavi, thanks for this! The new generator logic looks good — crypto/rand, shuffle, one char per class all check out. A few things to look at before merge:

1. # is still not safe. The PR removes $ and ! for paste safety, but # is also a problem — our own Makefile loads .env, and make cuts the value at # (quotes don't help there, make ignores them). Also %, ^, & break on Windows set VAR=.... Maybe just use letters + digits + @ * for generated passwords?

2. Warning text suggests $ and !. The warning tells users to pick from !@#$%^&* and put it in AUTH_ADMIN_PASSWORD — but in .env, compose expands $ unless the value is in single quotes. Maybe add a small note about quoting, or don't name specific chars.

3. Strong passwords get flagged. A 40-char password, or one using - or _ as its special, will warn as "weak". Since this password never goes to AMT (the comment says so too), maybe don't cap at 32 and accept more special chars?

Small nits: allGenChars could be strings.Join(genPasswordClasses, "") so the lists can't drift, and the comment at line 32 points to ValidateAMTPasswordComplexity for the 8–32 bounds, but those actually live in the binding tags.

Thanks again — happy to help with any of these!

[madhavilosetty-intel]

Thanks for the review @rsdmike, all four are fixed in the latest push.