Why: user decision 2026-09-30 — no self registration; admins create accounts with initial passwords; first login after creation or reset forces a change.
Evidence: migration v10 (users password/must_change/is_admin + sessions); argon2id PHC hash; e2e TestAdminAccountFlow covers static-page reachability, 401/429 paths, cookie session, admin create (409 dup), non-admin 403, forced change lifecycle, reset revoking sessions, API-key compat; full go test green after tavily rebase.
Impact: middleware accepts Bearer key OR session cookie, exempts static + login; CLI gains user create/reset-password/list. Embedded mode unchanged.
Why: user decision 2026-09-30 — no self registration; admins create accounts with initial passwords; first login after creation or reset forces a change.
Evidence: migration v10 (users password/must_change/is_admin + sessions); argon2id PHC hash; e2e TestAdminAccountFlow covers static-page reachability, 401/429 paths, cookie session, admin create (409 dup), non-admin 403, forced change lifecycle, reset revoking sessions, API-key compat; full go test green after tavily rebase.
Impact: middleware accepts Bearer key OR session cookie, exempts static + login; CLI gains user create/reset-password/list. Embedded mode unchanged.
Why: the user ruled out self-registration (2026-09-30): accounts are
created only by admins who set an initial password; first login (and
first login after any admin reset) must force a password change.
Evidence:
- migration v10 auth_accounts (users password/must_change/is_admin +
sessions table; upgrade test walks v1<->v10 both directions).
- argon2id hash/verify with PHC encoding; store tests cover hash
roundtrip, duplicate-owner conflict, must-change lifecycle, session
keep/except semantics.
- e2e TestAdminAccountFlow: static login page reachable without auth,
wrong password 401, login sets HttpOnly cookie + mustChangePassword,
admin creates user (409 on duplicate), non-admin create 403, forced
change clears flag and old password dies, admin reset revokes sessions
and re-arms forced change, API-key channel untouched, 5-fail backoff
429, logout kills session. Full go test ./... green.
Impact: middleware now accepts Bearer key OR session cookie and exempts
static + /api/auth/login (also fixes the latent case where the login
page itself could 401). Embedded no-auth mode unchanged.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md section 5 (admin-issued
variant, user decision 2026-09-30)
weichen
merged commit cad6c2bf15 into main2026-09-30 11:16:08 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: user decision 2026-09-30 — no self registration; admins create accounts with initial passwords; first login after creation or reset forces a change.
Evidence: migration v10 (users password/must_change/is_admin + sessions); argon2id PHC hash; e2e TestAdminAccountFlow covers static-page reachability, 401/429 paths, cookie session, admin create (409 dup), non-admin 403, forced change lifecycle, reset revoking sessions, API-key compat; full go test green after tavily rebase.
Impact: middleware accepts Bearer key OR session cookie, exempts static + login; CLI gains user create/reset-password/list. Embedded mode unchanged.