From 818721ae5c45d7784a4a74f353d9c1cbb1cfd936 Mon Sep 17 00:00:00 2001
From: Mike Teehan <mike.teehan@gmail.com>
Date: Wed, 12 Aug 2026 18:21:05 +0000
Subject: [PATCH] Fix incorrect password log path in _seed_builtin_admin

The warning message referenced 'data/auth.log' but the actual file is
/var/log/vacuum-wall/auth.log. Also add error logging when the write
fails, instead of silently swallowing the OSError.
---
 lib/db.py | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/lib/db.py b/lib/db.py
index f49fd15..eff93c4 100644
--- a/lib/db.py
+++ b/lib/db.py
@@ -307,12 +307,8 @@ def _seed_builtin_admin(db: Database) -> None:
         for subsystem in ALL_SUBSYSTEMS:
             tx.run(Q_UPSERT_PERMISSION, (BUILTIN_ADMIN_USERNAME, subsystem, "rw"))
 
-    logger.warning(
-        "Builtin admin user created. THIS IS A FALLBACK — bootstrap_auth.py "
-        "should have run during install. Admin password: %s... (check data/auth.log)",
-        random_password[:6],
-    )
     auth_log = Path("/var/log/vacuum-wall/auth.log")
+    auth_log_written = False
     try:
         auth_log.write_text(
             f"Builtin admin password: {random_password}\n", encoding="utf-8"
@@ -320,8 +316,17 @@ def _seed_builtin_admin(db: Database) -> None:
         import os as _os
 
         _os.chmod(str(auth_log), 0o600)
+        auth_log_written = True
     except OSError:
-        pass
+        logger.error("Could not write admin password to %s", auth_log)
+    logger.warning(
+        "Builtin admin user created. THIS IS A FALLBACK — bootstrap_auth.py "
+        "should have run during install. Admin password: %s... (%s)",
+        random_password[:6],
+        "see /var/log/vacuum-wall/auth.log for the full password"
+        if auth_log_written
+        else "full password NOT written — check the error above",
+    )
 
 
 def reset_db_for_test() -> None: