weichen/Agent-System-Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add one-time login keys, restricted sessions, and OpenExisting #171

Merged
weichen merged 2 commits from feature/svc-deploy-u4-login-key into main 2026-10-12 05:00:47 +00:00
Conversation 0 Commits 2 Files Changed 13
+821 -85
weichen commented 2026-10-12 03:52:45 +00:00
Owner
Copy Link
Copy Source

Summary

  • Store: login_keys migration, nullable password_hash, session scope, OpenExisting*
  • CLI/HTTP: passwordless user create + activate key, redeem, revoke, bootstrap-admin, --open-existing
  • Middleware: restricted / must_change allowlist; changePassword + reloginRequired
  • Tests: U4 T1–T11 (SQLite) + admin e2e aligned to gate; PG NOT_RUN without env

Why

Implements U4 of svc unified deploy proposal (Dev task feature/svc-deploy-u4-login-key).

Evidence

SELF: go test ./internal/store/ ./internal/server/ ./internal/app/ on HEAD 47463a9 (also recorded in Dev task card).

Impact

U1 svc user consumes --open-existing. U5 will consume redeem HTTP. Long-lived api_keys semantics unchanged.

Refs

Do not merge — owner double-key.

## Summary - Store: `login_keys` migration, nullable `password_hash`, session `scope`, `OpenExisting*` - CLI/HTTP: passwordless user create + activate key, redeem, revoke, bootstrap-admin, `--open-existing` - Middleware: restricted / must_change allowlist; changePassword + `reloginRequired` - Tests: U4 T1–T11 (SQLite) + admin e2e aligned to gate; PG NOT_RUN without env ## Why Implements U4 of svc unified deploy proposal (Dev task `feature/svc-deploy-u4-login-key`). ## Evidence SELF: `go test ./internal/store/ ./internal/server/ ./internal/app/` on HEAD `47463a9` (also recorded in Dev task card). ## Impact U1 `svc user` consumes `--open-existing`. U5 will consume redeem HTTP. Long-lived `api_keys` semantics unchanged. ## Refs - Proposal r1 §7 U4 / `docs/svc-deploy/u4-one-time-login-key.md` - Sibling Dev: `feature/svc-deploy-u4-login-key`, `feature/svc-deploy-u1-account-binding` - Backend PR: https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Backend/pulls/171 **Do not merge** — owner double-key.
weichen added 1 commit 2026-10-12 03:52:46 +00:00
Add one-time login keys, restricted sessions, and OpenExisting
ci / vet-and-test (pull_request) Failing after 56s
Details
1ba7225e83 
Why: passwordless activation/recovery must redeem only into a
set-password session; account ops must not create empty stores.
Evidence: SELF go test store/server login-key and OpenExisting cases.
Impact: auth middleware gates; CLI user create defaults to activate key.
Refs: docs/svc-deploy/u4-one-time-login-key.md

Co-authored-by: Cursor <cursoragent@cursor.com>
weichen added 1 commit 2026-10-12 03:55:03 +00:00
Align admin account e2e with must-change password gate
ci / vet-and-test (pull_request) Failing after 1m25s
Details
47463a9623 
Why: U4 middleware restricts must_change sessions to me/password/logout;
the legacy e2e expected admin create before first password change.
Evidence: go test ./internal/store/ ./internal/server/ ./internal/app/
Impact: TestAdminAccountFlow matches set-password + reloginRequired.
Refs: docs/svc-deploy/u4-one-time-login-key.md §5–6

Co-authored-by: Cursor <cursoragent@cursor.com>
weichen merged commit 1d9e8f4a79 into main 2026-10-12 05:00:47 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
weichen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: weichen/Agent-System-Backend#171