security: Secure admin access - Remove regex promotion, seed default admin instead

Author: pavanbadempet

backend/auth.py

@@ -85,8 +85,8 @@ def get_current_user(token: str = Depends(oauth2_scheme), db: Session = Depends(
 
 def is_admin(user: models.User) -> bool:
     """Check if user has admin privileges."""
-    # Check both username='admin' for backward compatibility and role field
-    return user.username == "admin" or user.username.startswith("admin_") or getattr(user, 'role', 'patient') == 'admin'
+    # Strict Role-Based Access Control
+    return getattr(user, 'role', 'patient') == 'admin'
 
 # --- Endpoints ---
 

backend/main.py

@@ -79,9 +79,42 @@ def run_migrations():
 
 run_migrations()
 
+# --- Seeding ---
+def create_default_admin():
+    """Create a default admin user if one does not exist."""
+    session = database.SessionLocal()
+    try:
+        # Check if any admin exists
+        admin = session.query(models.User).filter(models.User.role == "admin").first()
+        if not admin:
+            logger.warning("No admin found. Creating default 'admin' user...")
+            
+            # Secure default admin
+            hashed_pw = auth.get_password_hash("admin123")
+            default_admin = models.User(
+                username="admin", 
+                hashed_password=hashed_pw,
+                email="admin@hospital.com",
+                role="admin",
+                full_name="System Administrator",
+                allow_data_collection=0
+            )
+            session.add(default_admin)
+            session.commit()
+            logger.info("✅ Default Admin Created: username='admin', password='admin123'")
+        else:
+            logger.info("Admin account already exists.")
+    except Exception as e:
+        logger.error(f"Failed to seed admin: {e}")
+    finally:
+        session.close()
+
 # --- App ---
 @asynccontextmanager
 async def lifespan(app: FastAPI):
+    # Run Seeding
+    create_default_admin()
+    
     logger.info("Loading AI models...")
     prediction.initialize_models()
     yield

frontend/components/sidebar.py

@@ -77,7 +77,9 @@ def render_sidebar():
         ]
 
         # Admin option
-        if username == "admin" or username.startswith("admin_"):
+        # Strict Check: Only show if role is explicitly 'admin'
+        user_role = st.session_state.get('role', 'patient')
+        if user_role == 'admin':
             nav_options.append(i18n.get_text("admin"))
             nav_icons.append("shield-lock")