refactor: consolidate multiple passwords into a single master password for frontend actions

packages/amplify/amplify/backend.ts

@@ -217,17 +217,9 @@ TelemetryECSTaskDefinition.addContainer("TheContainer", {
     PRIVATE_KEY: ecs.Secret.fromSecretsManager(
       TelemetryBackendSecretsManagerPrivKey,
     ),
-    DRIVER_NAME_UPDATE_PASSWORD: ecs.Secret.fromSecretsManager(
+    UI_MASTER_PASSWORD: ecs.Secret.fromSecretsManager(
       HeliosPasswords,
-      "DRIVER_NAME_UPDATE_PASSWORD",
-    ),
-    FINISH_LINE_UPDATE_PASSWORD: ecs.Secret.fromSecretsManager(
-      HeliosPasswords,
-      "FINISH_LINE_UPDATE_PASSWORD",
-    ),
-    SNAPSHOT_PASSWORD: ecs.Secret.fromSecretsManager(
-      HeliosPasswords,
-      "SNAPSHOT_PASSWORD",
+      "MASTER_PASSWORD",
     ),
   },
 });

packages/server/.env.example

@@ -22,9 +22,8 @@ MQTT_PASSWORD=changeme
 ########################
 # App secrets
 ########################
-DRIVER_NAME_UPDATE_PASSWORD=changeme
-FINISH_LINE_UPDATE_PASSWORD=changeme
-SNAPSHOT_PASSWORD=changeme
+# Single master password shared across all frontend actions
+UI_MASTER_PASSWORD=changeme
 
 ########################
 # Machine Learning

packages/server/src/controllers/LapController/LapController.ts

@@ -8,6 +8,7 @@ import {
   convertToDecimalDegrees,
 } from "@/utils/lapCalculations";
 import { createLightweightApplicationLogger } from "@/utils/logger";
+import { validateMasterPassword } from "@/utils/validatePassword";
 
 import {
   FINISH_LINE_LOCATION,
@@ -137,8 +138,7 @@ export class LapController implements LapControllerType {
   ): CoordUpdateResponse {
     logger.info(JSON.stringify(newCoordInfo));
     const { lat, long, password } = newCoordInfo;
-    if (password !== process.env.FINISH_LINE_UPDATE_PASSWORD) {
-      logger.error("Invalid Password: " + password);
+    if (!validateMasterPassword(password)) {
       return { error: "Invalid Password", invalidFields: ["password"] };
     }
     try {

packages/server/src/controllers/routeControllers/driver.controller.ts

@@ -3,7 +3,7 @@ import { BackendController } from "../BackendController/BackendController";
 import { type Request, type Response } from "express";
 
 import { createApplicationLogger } from "@/utils/logger";
-import { validateDriverUpdatePassword } from "@/utils/validatePassword";
+import { validateMasterPassword } from "@/utils/validatePassword";
 
 import {
   type DriverHealthResponseDTO,
@@ -111,7 +111,7 @@ export const updateDriverInfo = async (
   }
 
   // Validate password
-  if (!validateDriverUpdatePassword(password)) {
+  if (!validateMasterPassword(password)) {
     logger.warn(`Invalid password attempt for driver update - Rfid: ${Rfid}`);
     return response.status(401).json({
       error: "Invalid password",

packages/server/src/controllers/routeControllers/snapshot.controller.ts

@@ -3,7 +3,7 @@ import type { BackendController } from "../BackendController/BackendController";
 import { type Request, type Response } from "express";
 
 import { createApplicationLogger } from "@/utils/logger";
-import { validateSnapshotPassword } from "@/utils/validatePassword";
+import { validateMasterPassword } from "@/utils/validatePassword";
 
 import type {
   CreateSnapshotRequestDTO,
@@ -82,7 +82,7 @@ export const createSnapshot = async (
       .json({ error: "snapshot_from and snapshot_to must be valid ISO date strings" });
   }
 
-  if (!validateSnapshotPassword(password)) {
+  if (!validateMasterPassword(password)) {
     logger.warn("Invalid password attempt for snapshot creation");
     return response.status(401).json({ error: "Invalid password" });
   }

packages/server/src/utils/validatePassword.ts

@@ -1,7 +1,7 @@
-const validPassword = process.env.MQTT_PASSWORD;
+const validPassword = process.env.UI_MASTER_PASSWORD;
 
 if (!validPassword) {
-  throw new Error("MQTT_PASSWORD environment variable is not configured");
+  throw new Error("UI_MASTER_PASSWORD environment variable is not configured");
 }
 
 /**
@@ -12,32 +12,21 @@ if (!validPassword) {
  */
 
 /**
- * Validates the driver update password against the configured environment variable.
+ * Validates a password against the shared master password.
  *
- * This password is required for sensitive operations like updating driver information
- * in the database. The password is stored in the MQTT_PASSWORD environment variable.
+ * Used by sensitive operations. Backed by the UI_MASTER_PASSWORD environment
+ * variable.
  *
  * @param password - The password to validate
  * @returns true if the password matches the configured password, false otherwise
  *
  * @example
  * ```typescript
- * if (!validateDriverUpdatePassword(req.body.password)) {
+ * if (!validateMasterPassword(req.body.password)) {
  *   return res.status(401).json({ error: "Invalid password" });
  * }
  * ```
  */
-export function validateDriverUpdatePassword(password: string): boolean {
+export function validateMasterPassword(password: string): boolean {
   return password === validPassword;
 }
-
-/**
- * Validates the snapshot management password against SNAPSHOT_PASSWORD env var.
- */
-export function validateSnapshotPassword(password: string): boolean {
-  const snapshotPassword = process.env.SNAPSHOT_PASSWORD;
-  if (!snapshotPassword) {
-    throw new Error("SNAPSHOT_PASSWORD environment variable is not configured");
-  }
-  return password === snapshotPassword;
-}