From df48de11401054d062d7a5a1d3c5d60cf858b171 Mon Sep 17 00:00:00 2001
From: saubyk <39208279+saubyk@users.noreply.github.com>
Date: Wed, 15 Jul 2026 23:59:53 -0700
Subject: [PATCH] Fix the regtest fixture using a password RTL blacklists

The fixture added in #1621 set multiPass to "password". RTL blacklists weak
passwords (PASSWORD_BLACKLIST in consts-enums-functions.ts: 'password',
'changeme', 'moneyprintergobrrr') and forces a change when one is used:
login.component.ts sets defaultPassword: true, and app.component.ts then
redirects to /rtl/settings/auth.

So every login with the documented password was bounced to the change
password screen and never reached the dashboard. The check is session based
rather than first run only, so this happened on every fresh browser session,
not just the first.

Password is now 'rtldev'. .env documents why it must stay off the blacklist.
---
 docker/.env                        | 7 +++++--
 docker/README.md                   | 2 +-
 docker/rtl/RTL-Config.regtest.json | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/docker/.env b/docker/.env
index 0ecf69d6..9bfd439a 100644
--- a/docker/.env
+++ b/docker/.env
@@ -24,6 +24,9 @@ ALICE_REST_PORT=8081
 BOB_REST_PORT=8082
 CAROL_REST_PORT=8083
 
-# RTL
+# RTL. Must not be one of RTL's blacklisted weak passwords
+# ('password', 'changeme', 'moneyprintergobrrr') or RTL forces a password change
+# on every login and parks you on the auth settings screen. Set in
+# rtl/RTL-Config.regtest.json as multiPass; this is only used for messages.
 RTL_PORT=3000
-RTL_PASSWORD=password
+RTL_PASSWORD=rtldev
diff --git a/docker/README.md b/docker/README.md
index 48533f9e..3f35c750 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -28,7 +28,7 @@ docker compose up -d          # bitcoind, alice, bob, carol, rtl
 ./scripts/seed.sh             # fund, connect, open channels, make payments
 ```
 
-Then open <http://localhost:3000> — password `password`. All three nodes appear in
+Then open <http://localhost:3000> — password `rtldev`. All three nodes appear in
 the node switcher.
 
 Tear down, discarding all state:
diff --git a/docker/rtl/RTL-Config.regtest.json b/docker/rtl/RTL-Config.regtest.json
index 0be5d6f7..927280a4 100644
--- a/docker/rtl/RTL-Config.regtest.json
+++ b/docker/rtl/RTL-Config.regtest.json
@@ -1,5 +1,5 @@
 {
-  "multiPass": "password",
+  "multiPass": "rtldev",
   "port": "3000",
   "defaultNodeIndex": 1,
   "dbDirectoryPath": "/RTL/database",