Why: entering the forced-change gate with an API-key credential always
fails 401 (passwords are session-owned), and the gate mapped every 401
to "Incorrect username or password", masking the real reason and hiding
the self-service exit; admins got locked out before reaching user
management.
Evidence: npx vitest run green (20 files / 93 tests incl. new
test/loginpage.test.ts); tsc -b and check-knip green.
Impact: App boot routes key+mustChange to the login page (key cleared);
the API-key tab advises password login for must-change accounts; the
gate maps backend error strings to distinct actionable messages; api.me
type gains authVia.
Refs: Dev task feature/admin-auth-gate-fix.
weichen
merged commit fcf40ff75f into main2026-10-11 13:52:15 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: API-key 凭证进强制改密门必然 401（改密只认会话登录），且门内所有 401 都显示「用户名或密码不正确」，掩盖真实原因；管理员被锁在进入用户管理之前。
改动：
api.me类型增加authViaEvidence：
npx vitest run20 文件 93 测试全绿（含新增 test/loginpage.test.ts）；tsc -b、check-knip 绿（SELF，待 CI GATE）。Refs： Dev 任务 feature/admin-auth-gate-fix；依赖 Backend PR #153 的 authVia 字段。