security(CASA-22): remove shared/default accounts from production

backend/alembic/versions/9a977647c5a4_add_is_admin_and_fix_connection_cascade.py

@@ -102,7 +102,12 @@ def upgrade():
     op.execute("UPDATE \"user\" SET is_admin = false")
 
     # Then, set users with @airweave.ai email to is_admin = true
-    op.execute("UPDATE \"user\" SET is_admin = true WHERE email LIKE '%@airweave.ai' OR email = '[email protected]'")
+    # For non-production environments, also grant admin to test account
+    from airweave.core.config import settings
+    if settings.ENVIRONMENT != 'prd':
+        op.execute("UPDATE \"user\" SET is_admin = true WHERE email LIKE '%@airweave.ai' OR email = '[email protected]'")
+    else:
+        op.execute("UPDATE \"user\" SET is_admin = true WHERE email LIKE '%@airweave.ai'")
 
     # Now make the column NOT NULL
     op.alter_column('user', 'is_admin', nullable=False)

backend/alembic/versions/ab5c202f5d68_resolve_migration_conflicts_and_apply_.py

@@ -204,7 +204,12 @@ def upgrade():
         op.execute("UPDATE \"user\" SET is_admin = false")
 
         # Then, set users with @airweave.ai email to is_admin = true
-        op.execute("UPDATE \"user\" SET is_admin = true WHERE email LIKE '%@airweave.ai' OR email = '[email protected]'")
+        # For non-production environments, also grant admin to test account
+        from airweave.core.config import settings
+        if settings.ENVIRONMENT != 'prd':
+            op.execute("UPDATE \"user\" SET is_admin = true WHERE email LIKE '%@airweave.ai' OR email = '[email protected]'")
+        else:
+            op.execute("UPDATE \"user\" SET is_admin = true WHERE email LIKE '%@airweave.ai'")
 
         # Now make the column NOT NULL
         op.alter_column('user', 'is_admin', nullable=False)

docker/docker-compose.test.yml

@@ -81,6 +81,8 @@ services:
       - POSTGRES_USER=airweave
       - POSTGRES_PASSWORD=airweave1234!
       - POSTGRES_DB=airweave
+      # DEV/TEST ONLY: Default superuser credentials for local development and testing
+      # NEVER use these credentials in production - use Azure Key Vault secrets instead
       - [email protected]
       - FIRST_SUPERUSER_PASSWORD=admin
       - ENCRYPTION_KEY="SpgLrrEEgJ/7QdhSMSvagL1juEY5eoyCG0tZN7OSQV0="