From 33bb1f524d284a3b6d8f3958448bd159b8e9e52b Mon Sep 17 00:00:00 2001
From: wps260 <278816799+wps260@users.noreply.github.com>
Date: Tue, 28 Apr 2026 11:01:15 -0500
Subject: [PATCH] fix: skip DemoFamilyRefreshJob in self-hosted mode (#1578)

DemoFamilyRefreshJob runs daily via cron and recreates a demo family from
scratch. This is a managed-mode-only feature (the public hosted instance),
but the job had no app_mode guard, so self-hosted instances were also
creating and refreshing a demo family every day.

This results in every self-host instance of sure getting the demo family
with the well-known credentials created.

It may be worth considering a separate one-time fix that deactivates the
demo family users, and/or entries in the release notes or a separate
security advisories alerting users that they need to deactivate the demo
users.
---
 app/jobs/demo_family_refresh_job.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/jobs/demo_family_refresh_job.rb b/app/jobs/demo_family_refresh_job.rb
index 2b7d85f17..b30f6cab2 100644
--- a/app/jobs/demo_family_refresh_job.rb
+++ b/app/jobs/demo_family_refresh_job.rb
@@ -2,6 +2,8 @@ class DemoFamilyRefreshJob < ApplicationJob
   queue_as :scheduled
 
   def perform
+    return unless Rails.application.config.app_mode.managed?
+
     period_end = Time.current
     period_start = period_end - 24.hours