#533/#552: self-service password change, member autocomplete + validation, seat-shadow refusal (v0.6.204) #557

Merged

Cordy merged 6 commits from fix-550i into main

2026-09-15 00:22:20 +00:00

Cordy commented

2026-09-15 00:21:09 +00:00

Owner

Closes out the last #533 build item and two #552 dogfood findings.

Change password in the user menu — dialog with current/new/repeat, inline errors (wrong current, mismatch, too short), backed by the POST /api/v1/me/password endpoint from #533 wave 1; SSO-managed accounts get a friendly "managed by your identity provider" note instead of a raw 409.

Member autocomplete + validation: new GET /api/v1/admin/groups/candidates feeds a datalist on both member inputs (spaces-picker idiom) from every enumerable source — local accounts, seat holders, the realm via the IdP admin client. Adds validate against that universe: unknown names come back in a per-name unknown report (create returns 400 naming them) instead of being silently added. No enumerable source → format-only, matching the picker's free-text degrade.

Seat-shadow refusal: creating a local account named like a seen directory account is a 409 with an inline explanation — the finding was security-shaped, since the shared username would have given password sign-in access to the directory user's identity. Local re-creations and config admins are exempt.

Tests for all three; fence gate + node checks green.

Closes out the last #533 build item and two #552 dogfood findings. **Change password** in the user menu — dialog with current/new/repeat, inline errors (wrong current, mismatch, too short), backed by the `POST /api/v1/me/password` endpoint from #533 wave 1; SSO-managed accounts get a friendly "managed by your identity provider" note instead of a raw 409. **Member autocomplete + validation**: new `GET /api/v1/admin/groups/candidates` feeds a datalist on both member inputs (spaces-picker idiom) from every enumerable source — local accounts, seat holders, the realm via the IdP admin client. Adds validate against that universe: unknown names come back in a per-name `unknown` report (create returns 400 naming them) instead of being silently added. No enumerable source → format-only, matching the picker's free-text degrade. **Seat-shadow refusal**: creating a local account named like a seen directory account is a 409 with an inline explanation — the finding was security-shaped, since the shared username would have given password sign-in access to the directory user's identity. Local re-creations and config admins are exempt. Tests for all three; fence gate + node checks green.

Cordy added 6 commits

2026-09-15 00:21:11 +00:00

scout: #550i - user menu, peering picker, seats accessor, create handler f764e3c38b

scout: #550j - candidates endpoint, create/mePassword handlers, seats accessor fa2df68c39

scout: #550k - remaining backend anchors (unique tmp names) ceaedd8fbb

one-shot: #533/#552 - chpw dialog, member autocomplete+validation, seat-shadow 409 (v0.6.204) 93a1286137

one-shot: v0.6.204 rev2 - paren fix 903e639493

feat(#533/#552): self-service password change, member autocomplete + validation, seat-shadow refusal (v0.6.204)

ci / test-and-build (pull_request) Successful in 56s

Details

048cf3f33d

The user menu gains Change password for local accounts, backed by the
existing POST /api/v1/me/password (wrong-current and SSO-managed map
to clear inline messages). Group member adds autocomplete from a new
/api/v1/admin/groups/candidates endpoint - local accounts, seat
holders, and the realm via the IdP admin client, the spaces-picker
datalist idiom - and unknown names are refused with a per-name
report (create returns 400 naming them); with no enumerable source
validation degrades to format-only. Creating a local account that
shadows a seen directory account is now a 409 with an inline
explanation: same name means same identity, so a password would
have reached the directory user's files. Tests for all three.

Cordy scheduled this pull request to auto merge when all checks succeed

2026-09-15 00:21:17 +00:00