homeio

1#!/usr/bin/env bash
2# Homeio emergency password reset
3#
4# Resets the password for an existing Homeio user directly in the database.
5# Use this when you are locked out after a restore or have forgotten your
6# password and cannot log in through the UI.
7#
8# Usage:
9#   sudo bash scripts/reset-password.sh
10#
11# Requirements:
12#   - Node.js 22.x must be in PATH
13#   - The DATABASE_URL environment variable must be set, OR a .env.local file
14#     must exist in the same directory as this script (the project root).
15
16set -euo pipefail
17
18SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
19PROJECT_ROOT="$(dirname "${SCRIPT_DIR}")"
20ENV_FILE="${PROJECT_ROOT}/.env.local"
21
22# ── Load DATABASE_URL from .env.local if not already set ──────────────────────
23if [ -z "${DATABASE_URL:-}" ] && [ -f "${ENV_FILE}" ]; then
24  DATABASE_URL="$(grep -E '^DATABASE_URL=' "${ENV_FILE}" | head -1 | cut -d= -f2-)"
25  export DATABASE_URL
26fi
27
28if [ -z "${DATABASE_URL:-}" ]; then
29  echo "Error: DATABASE_URL is not set and could not be loaded from ${ENV_FILE}" >&2
30  exit 1
31fi
32
33# ── Prompt for username and new password ──────────────────────────────────────
34echo ""
35echo "Homeio — Emergency Password Reset"
36echo "──────────────────────────────────"
37echo ""
38
39read -rp "Username to reset: " TARGET_USERNAME
40if [ -z "${TARGET_USERNAME}" ]; then
41  echo "Error: username cannot be empty." >&2
42  exit 1
43fi
44
45read -rsp "New password: " NEW_PASSWORD
46echo ""
47if [ -z "${NEW_PASSWORD}" ]; then
48  echo "Error: password cannot be empty." >&2
49  exit 1
50fi
51
52read -rsp "Confirm new password: " CONFIRM_PASSWORD
53echo ""
54if [ "${NEW_PASSWORD}" != "${CONFIRM_PASSWORD}" ]; then
55  echo "Error: passwords do not match." >&2
56  exit 1
57fi
58
59# ── Hash password and update DB using Node.js inline script ───────────────────
60# Uses the same scrypt parameters as lib/server/modules/auth/password.ts
61node --input-type=module <<EOF
62import { randomBytes, scrypt as scryptCallback } from "node:crypto";
63import { promisify } from "node:util";
64import pg from "pg";
65
66const scrypt = promisify(scryptCallback);
67const SCRYPT_KEY_LENGTH = 64;
68
69const username = ${JSON.stringify(TARGET_USERNAME)};
70const plainPassword = ${JSON.stringify(NEW_PASSWORD)};
71const databaseUrl = process.env.DATABASE_URL;
72
73const salt = randomBytes(16).toString("hex");
74const derived = await scrypt(plainPassword, salt, SCRYPT_KEY_LENGTH);
75const hash = \`\${salt}:\${derived.toString("hex")}\`;
76
77const client = new pg.Client({ connectionString: databaseUrl });
78await client.connect();
79
80try {
81  const result = await client.query(
82    "UPDATE users SET password_hash = \$1 WHERE username = \$2 RETURNING id",
83    [hash, username]
84  );
85
86  if (result.rowCount === 0) {
87    console.error(\`Error: user "\${username}" not found in the database.\`);
88    process.exitCode = 1;
89  } else {
90    console.log(\`Password for "\${username}" has been reset successfully.\`);
91    console.log("You can now log in with the new password.");
92  }
93} finally {
94  await client.end();
95}
96EOF
97