#533 Wave 1: local accounts in every auth mode — stores, wiring, admin API (v0.6.194) #545

Merged

Cordy merged 8 commits from fix-533a into main

2026-09-14 15:35:46 +00:00

Cordy commented

2026-09-14 15:34:39 +00:00

Owner

Backend of the approved #533 mockup:

LocalStore grows List / Delete / SetPassword / SetAdmin / NoteSignIn (15-min-throttled last-sign-in stamp) and the hard 50-account cap; new AdminStore persists dashboard admin grants for directory accounts. Both ride the #153 state-in-backend set (statePaths + config adminsPath default).
Every auth mode owns local accounts now: the store and the #51 /setup wizard gate exist beside any IdP. OIDC mode stacks Multi{appPasswords, pwLogin(local), oidc} — cheap prefix check first, local cookie+Basic second, IdP last so the browser challenge stays the OIDC redirect; only POST /auth/password is added (the IdP flow owns /auth/logout). LDAP mode gets local break-glass via Multi{ldap, local}.
WithAdminFlagRuntime unions config allow-list + admin groups + runtime grants; /api/v1/admin/access now carries localUsers + localLimit and counts local/runtime admins in the admins list.
New API: /api/v1/admin/local-users (list/create/delete + {name}/password + {name}/role), /api/v1/admin/directory-admins, /api/v1/me/password. Guards: never below one administrator in total, never yourself. Audited as user-create, user-remove, user-password-reset, admin-promote, admin-demote — literals at call sites after the #433 guard rejected the parameterized helper (that guard has now earned its keep twice today).

TDD: compile-red witnessed, full suite green. CHANGELOG v0.6.194. UI follows in waves 2 (login/setup pages) and 3 (Access tab).

Backend of the approved #533 mockup: - **LocalStore** grows List / Delete / SetPassword / SetAdmin / NoteSignIn (15-min-throttled last-sign-in stamp) and the **hard 50-account cap**; new **AdminStore** persists dashboard admin grants for directory accounts. Both ride the #153 state-in-backend set (`statePaths` + config `adminsPath` default). - **Every auth mode owns local accounts now**: the store and the #51 `/setup` wizard gate exist beside any IdP. OIDC mode stacks `Multi{appPasswords, pwLogin(local), oidc}` — cheap prefix check first, local cookie+Basic second, IdP last so the browser challenge stays the OIDC redirect; only `POST /auth/password` is added (the IdP flow owns `/auth/logout`). LDAP mode gets local break-glass via `Multi{ldap, local}`. - **WithAdminFlagRuntime** unions config allow-list + admin groups + runtime grants; `/api/v1/admin/access` now carries `localUsers` + `localLimit` and counts local/runtime admins in the admins list. - **New API**: `/api/v1/admin/local-users` (list/create/delete + `{name}/password` + `{name}/role`), `/api/v1/admin/directory-admins`, `/api/v1/me/password`. Guards: never below one administrator in total, never yourself. Audited as `user-create`, `user-remove`, `user-password-reset`, `admin-promote`, `admin-demote` — literals at call sites after the #433 guard rejected the parameterized helper (that guard has now earned its keep twice today). TDD: compile-red witnessed, full suite green. CHANGELOG v0.6.194. UI follows in waves 2 (login/setup pages) and 3 (Access tab).

Cordy added 8 commits

2026-09-14 15:34:40 +00:00

scout: auth wiring, pwlogin, login/setup pages, adm-users pane (never commits) d9951d6fa6

scout: auth internals + access API (never commits) 77c0d005ee

one-shot: #533a red - local-user CRUD/cap, runtime admins, admin API 715bc5df0a

fix red one-shot: escaped-quote JSON bodies; diag Multi + Bind sites 2479e5300c

test(#533 ): local-user CRUD/cap/persistence, runtime admin store, admin API (red) 8b783de0a4

Compile-red witnessed on the runner (house precedent #428): the
store methods, AdminStore, WithAdminFlagRuntime, LocalUsersAPI and
the handler methods do not exist yet.

one-shot: #533a green - stores, wiring, admin API, verbs (v0.6.194) 5aeca7644d

one-shot: #533a finisher - literal audit verbs at call sites 09ad1017cb

feat(#533 ): local accounts in every auth mode - stores, wiring, admin API

ci / test-and-build (pull_request) Successful in 55s

Details

993dbf9d97

- LocalStore grows List/Delete/SetPassword/SetAdmin/NoteSignIn and the
  hard 50-account cap; AdminStore persists dashboard admin grants for
  directory accounts (both ride the #153 state-in-backend set)
- local store + first-run /setup now exist in every auth mode; OIDC
  gains the password sign-in endpoint via the Multi stack (app
  passwords first, local second, IdP challenge last); LDAP mode gets
  local break-glass via Multi
- WithAdminFlagRuntime unions config allow-list, admin groups and
  runtime grants; /api/v1/admin/access lists local accounts
- /api/v1/admin/local-users CRUD + role + password reset and
  /api/v1/admin/directory-admins, audited (user-create, user-remove,
  user-password-reset, admin-promote, admin-demote; literals at call
  sites per the #433 guard) with last-admin and self guards;
  /api/v1/me/password for locally managed users

CHANGELOG v0.6.194.

Cordy scheduled this pull request to auto merge when all checks succeed

2026-09-14 15:34:45 +00:00