Refine admin workflows and team access

Backend/Data/AwardsDbContext.cs

@@ -103,6 +103,7 @@ public sealed class AwardsDbContext(DbContextOptions<AwardsDbContext> options) :
 
         modelBuilder.Entity<VoteBallot>(entity =>
         {
+            entity.HasIndex(item => new { item.SeasonId, item.SubmittedByTwitchId }).IsUnique();
             entity.Property(item => item.SubmittedByTwitchId).HasMaxLength(120);
             entity.Property(item => item.Status).HasMaxLength(30);
         });

Backend/Data/TeamAccountBootstrapper.cs

@@ -17,7 +17,7 @@ public static class TeamAccountBootstrapper
             defaultLogin: "jayuhime",
             defaultDisplayName: "Jayuhime",
             role: AdminRoles.Owner,
-            fallbackPassword: configuration["VTSA_DEMO_ADMIN_PASSWORD"] ?? configuration["DemoAdmin:Password"]);
+            fallbackPassword: null);
 
         var creatorSeed = BuildSeed(
             configuration,
@@ -33,6 +33,11 @@ public static class TeamAccountBootstrapper
             await EnsureMemberAsync(db, seed);
         }
 
+        await DeactivateDemoBackedSeedAccountAsync(
+            db,
+            ownerSeed,
+            configuration["VTSA_DEMO_ADMIN_PASSWORD"] ?? configuration["DemoAdmin:Password"]);
+
         await db.SaveChangesAsync();
     }
 
@@ -80,6 +85,18 @@ public static class TeamAccountBootstrapper
             changed = true;
         }
 
+        if (member.CreatedByTwitchId == SeedActor
+            && (string.IsNullOrWhiteSpace(member.UpdatedByTwitchId)
+                || string.Equals(member.UpdatedByTwitchId, SeedActor, StringComparison.Ordinal))
+            && (!string.Equals(member.PasswordHash, seed.Credentials.Value.Hash, StringComparison.Ordinal)
+                || !string.Equals(member.PasswordSalt, seed.Credentials.Value.Salt, StringComparison.Ordinal)))
+        {
+            member.PasswordHash = seed.Credentials.Value.Hash;
+            member.PasswordSalt = seed.Credentials.Value.Salt;
+            member.MustChangePassword = false;
+            changed = true;
+        }
+
         if (changed)
         {
             member.UpdatedAt = DateTimeOffset.UtcNow;
@@ -87,6 +104,26 @@ public static class TeamAccountBootstrapper
         }
     }
 
+    private static async Task DeactivateDemoBackedSeedAccountAsync(AwardsDbContext db, TeamAccountSeed seed, string? demoPassword)
+    {
+        if (seed.Credentials is not null || string.IsNullOrWhiteSpace(demoPassword))
+        {
+            return;
+        }
+
+        var member = await db.TeamMembers.FirstOrDefaultAsync(item => item.Login == seed.Login);
+        if (member is null
+            || member.CreatedByTwitchId != SeedActor
+            || !DemoCredentialHasher.VerifyPassword(demoPassword, member.PasswordHash, member.PasswordSalt))
+        {
+            return;
+        }
+
+        member.IsActive = false;
+        member.UpdatedAt = DateTimeOffset.UtcNow;
+        member.UpdatedByTwitchId = SeedActor;
+    }
+
     private static TeamAccountSeed BuildSeed(
         IConfiguration configuration,
         string sectionName,