Remove default admin password

[jmattheis]

Is your feature request related to a problem? Please describe.
Forcing the administrator to configure a secure password on first run, may increase security in case the administrator doesn't follow the first login instructions.

Describe the solution you'd like
On first run, the user must configure GOTIFY_DEFAULTUSER_PASS. Without it being configured gotify/server shouldn't start because no default user could be created.
Maybe we should provide a flag, to disable creating the default user in case all users are managed by OIDC. See #1007

[eternal-flame-AD]

Maybe we should provide a flag, to disable creating the default user in case all users are managed by OIDC.

We will probably need an admin flag claim mapping right? Otherwise it might conflict with our current policy that at least one admin user must be present. (This part is probably dup of #1007

---

Another concern is it might be disruptive to workflows that already package gotify and the app store might have no way to ask the user to provide a password. The packager might have little option except just hardcode a new default password which defeat the purpose of this change.

I think a good implementation pattern that can let us get rid of the concern of account lockout and race condition during setup is a "first setup" flag in the data directory or database, which works something like this:

• this flag is set by either discovering that user table is empty on startup, or a command like "gotify setup-admin"
• gotify report the status of this flag in a metadata endpoint
• if this flag is present the UI shows a prompt to setup a new (admin) account - we can reuse the registration endpoint for this so it doesn't create too much additional code
• gotify tries to clear this flag, if the clear is successful then this registration will be granted.

I believe this is pretty standard for web stuff because it doesn't rely on the operator being able to reach into the logs (which can be difficult in PaaS or other managed hosting situations).

[jmattheis]

Yeah, you're right. Most packagers would just set another default value there.

How about gotify instead saves a "change password" flag on the user. If set, the user is prompted to change their password when logging into the web ui. I think grafana works this way. This feature could be used normally by admins when they manually reset the users password.

I'm also okay with overloading the create user endpoint and allowing unauthenticated user creation, when no other users exists. So I think I prefer the "change password" flag, as it has multiple use-cases.