Description
While the config is in the password_change_required=True state, every AstrBotConfig construction silently regenerates a new random dashboard password and overwrites the stored hash on disk. The new password is never printed outside the startup banner, so the existing password becomes invalid with no notification. Since astrbot/core/init.py:33 constructs AstrBotConfig() at module level, any import astrbot.core (seed script, CLI, second process, test) triggers a rotation.
Root cause: astrbot/core/config/astrbot_config.py:101-108 treats password_change_required=True as a "regenerate password" signal, but it actually means "prompt the user to change the initial password". The rotation re-sets the flag to True (line 122), so there is no one-shot guard — it rotates forever.
Reproduction Steps
import json, tempfile, os
from astrbot.core.config.astrbot_config import AstrBotConfig
d = {"dashboard": {"username": "astrbot", "password": "", "pbkdf2_password": ""}}
fd, path = tempfile.mkstemp(suffix=".json"); os.close(fd)
json.dump({"dashboard": {"username": "astrbot", "password": "",
"pbkdf2_password": "pbkdf2_sha256$600000$00$00",
"password_change_required": True}}, open(path, "w"))
p1 = getattr(AstrBotConfig(config_path=path, default_config=d), "_generated_dashboard_password", None)
p2 = getattr(AstrBotConfig(config_path=path, default_config=d), "_generated_dashboard_password", None)
assert p1 == p2 # FAILS: password silently rotated; p1 no longer valid
Two constructions of the same config silently rotate the password — the first one becomes invalid immediately.
AstrBot Version
4.27.3
Operating System
MacOS
Deployment Method
Source run
Message Platform Adapter
Not applicable
Error Log
No error or warning is logged for the rotation itself — the password swap is silent. The only output during reproduction is the benign check_config_integrity bookkeeping (each construction emits these; the repeated password_change_required / password_storage_upgraded removal lines are caused by the minimal default_config in the repro, not by the bug):
[INFO] Config key removed: dashboard.password_change_required
[INFO] Config key order fixed: dashboard
[INFO] Config key removed: dashboard.password_storage_upgraded
[INFO] Config key removed: dashboard.password_change_required
[INFO] Config key order fixed: dashboard
The stored hash after reproduction matches neither the banner password P nor the default password astrbot, which proves it was silently overwritten by the script-side construction.
Supplementary Information
No response
Checklist
Description
While the config is in the password_change_required=True state, every AstrBotConfig construction silently regenerates a new random dashboard password and overwrites the stored hash on disk. The new password is never printed outside the startup banner, so the existing password becomes invalid with no notification. Since astrbot/core/init.py:33 constructs AstrBotConfig() at module level, any import astrbot.core (seed script, CLI, second process, test) triggers a rotation.
Root cause: astrbot/core/config/astrbot_config.py:101-108 treats password_change_required=True as a "regenerate password" signal, but it actually means "prompt the user to change the initial password". The rotation re-sets the flag to True (line 122), so there is no one-shot guard — it rotates forever.
Reproduction Steps
import json, tempfile, os
from astrbot.core.config.astrbot_config import AstrBotConfig
d = {"dashboard": {"username": "astrbot", "password": "", "pbkdf2_password": ""}}
fd, path = tempfile.mkstemp(suffix=".json"); os.close(fd)
json.dump({"dashboard": {"username": "astrbot", "password": "",
"pbkdf2_password": "pbkdf2_sha256$600000$00$00",
"password_change_required": True}}, open(path, "w"))
p1 = getattr(AstrBotConfig(config_path=path, default_config=d), "_generated_dashboard_password", None)
p2 = getattr(AstrBotConfig(config_path=path, default_config=d), "_generated_dashboard_password", None)
assert p1 == p2 # FAILS: password silently rotated; p1 no longer valid
Two constructions of the same config silently rotate the password — the first one becomes invalid immediately.
AstrBot Version
4.27.3
Operating System
MacOS
Deployment Method
Source run
Message Platform Adapter
Not applicable
Error Log
Supplementary Information
No response
Checklist