feat: let organization owners create users with password setup links #64

Merged

morten-olsen merged 6 commits from feat/ed3ebb61-user-setup into main 2026-10-20 13:04:51 +02:00

Conversation 1 Commits 6 Files changed 59 +2723 -11

morten-olsen commented 2026-10-20 11:31:32 +02:00

Owner

• Copy link
• Copy Markdown

Summary

Human organization owners can create users from Settings → Members without opening public registration. The new user and member membership commit together; the recipient chooses their own password using a single-use link. Existing users keep their credentials and use the existing add-member flow.

Members → Create user (name, login)
  → transaction: pending user + member + SHA-256 verifier
  → copy/share /set-password#capability (24-hour expiry)
  → recipient submission: password + activation + consumption, one transaction
Members → Awaiting password setup → Replace / Revoke link

Only direct human owners in the creating organization can create, list, replace or revoke links. Activated users remain ineligible even if they later clear their password. Opening/inspection does not consume; successful submission does. Replacement and revocation immediately invalidate the prior verifier. Removing the originating membership revokes its link, so re-adding cannot revive it.

Capabilities stay out of logs, GET URLs, routing state, analytics, replicas and React Query caches. The fragment is captured before platform/routing imports, including same-tab navigation. Setup responses are no-store; the public page is no-referrer. Password work is bounded to two submissions, with 429/retry instead of a password-bearing queue.

Depends on preparatory PR #65. Its normal main server image will be retained and tested as the migration-aware rollback artifact before this feature is released. Both changes need Security Engineer review before merge. Morten approved the exact schema on task ed3ebb61 at 10:01 UTC on 20 October 2026.

Evidence

• Before: Live registration returned closed; fresh phone/desktop browsers offered only sign-in. The live server remains 0.47.0.
  After: Six real-browser tests pass at 390×844 and 1440×900, with registration closed: creation pending/success, keyboard fields, duplicate fallback, list/create error retries, copy success/denial, recipient mismatch/network retry/success, same-tab reopening, replacement and revocation. Saved links are masked. Screenshots and acceptance record.
• Local task ci:quality passed 822 tests across 122 files, type checks, ESLint, dependency rules, formatting and pipeline renderings. The final added bounded-work API test and native-window guard tests also pass (9 focused tests). Final head 0a54835 passed push 444 and PR 445, including all 823 tests in 122 files, docs and both image builds. Preparation #65 passed pipelines 440/441 with 798 tests.
• Real SQLite tests cover rollback at membership/setup/password writes, duplicate accounts, owner and organization isolation, stale/delegated contexts, expiry/boundary/deletion, concurrent redemption/replacement/revocation, and alternate password/token/refresh denial. A trace-level log capture proves credential/token input is absent. A populated migration-035 fixture preserves old credential rows after 036.
• The Android Metro/Hermes bundle exports successfully. Shared app/session types remain compatible. Unverified: native clipboard/share, physical Android installation and device login; no device rollout was performed. Native window aliases without browser APIs have a dedicated guard test.

Merge danger

Door: one-way for the database relative to the old stock image. The schema is approved; no down migration, data deletion or restore is included.

Blast radius: app

Merge preparation #65 first, retain its server digest and verify that image against an already-upgraded disposable database before publishing the feature release. The eventual single-writer Recreate rollout briefly interrupts the server. Main builds alone do not update the pinned live workload. Do not release until required security findings and rollout prerequisites are resolved.

Rollback and verification

• Roll back: Use the verified preparatory server image with migration registration and pending-user safeguards retained, preserving the additive schema and provenance. The old stock 0.47.0 binary rejects an unknown applied migration and cannot start. Keep the compatible agent pin; do not automatically drop tables or restore data.
• Verify after rollout: Follow release images/updater, the apps push mirror, expected ArgoCD revision, actual server/agent digests and readiness; verify closed registration and the owner-created-user/password-setup flow. A real owner session is needed for live provisioning; a role token must not impersonate one. Record evidence without links/credentials.
• Reviewers: Security Engineer: owner scope and delegated/agent denial, pending-user invariants, token generation/storage/lifecycle/races, credential bypass prevention, logs/routing/cache/replica privacy, bounded hashing and the two-PR rollback plan. No Designer sign-off requested.

Task: ed3ebb61-7698-4856-a06d-ac0f5ae2ca3c. Feature branch: feat/ed3ebb61-user-setup; preparation: feat/ed3ebb61-user-setup-schema.

## Summary Human organization owners can create users from Settings → Members without opening public registration. The new user and member membership commit together; the recipient chooses their own password using a single-use link. Existing users keep their credentials and use the existing add-member flow. ```text Members → Create user (name, login) → transaction: pending user + member + SHA-256 verifier → copy/share /set-password#capability (24-hour expiry) → recipient submission: password + activation + consumption, one transaction Members → Awaiting password setup → Replace / Revoke link ``` Only direct human owners in the creating organization can create, list, replace or revoke links. Activated users remain ineligible even if they later clear their password. Opening/inspection does not consume; successful submission does. Replacement and revocation immediately invalidate the prior verifier. Removing the originating membership revokes its link, so re-adding cannot revive it. Capabilities stay out of logs, GET URLs, routing state, analytics, replicas and React Query caches. The fragment is captured before platform/routing imports, including same-tab navigation. Setup responses are no-store; the public page is no-referrer. Password work is bounded to two submissions, with 429/retry instead of a password-bearing queue. Depends on preparatory PR https://code.olsen.cloud/ai/mission-control/pulls/65. Its normal main server image will be retained and tested as the migration-aware rollback artifact before this feature is released. Both changes need Security Engineer review before merge. Morten approved the exact schema on task ed3ebb61 at 10:01 UTC on 20 October 2026. ## Evidence - **Before:** Live registration returned `closed`; fresh phone/desktop browsers offered only sign-in. The live server remains 0.47.0. **After:** Six real-browser tests pass at **390×844** and **1440×900**, with registration closed: creation pending/success, keyboard fields, duplicate fallback, list/create error retries, copy success/denial, recipient mismatch/network retry/success, same-tab reopening, replacement and revocation. Saved links are masked. [Screenshots and acceptance record](https://code.olsen.cloud/ai/mission-control/src/branch/feat/ed3ebb61-user-setup/docs/review/user-setup/README.md). - Local `task ci:quality` passed 822 tests across 122 files, type checks, ESLint, dependency rules, formatting and pipeline renderings. The final added bounded-work API test and native-window guard tests also pass (9 focused tests). Final head `0a54835` passed [push 444](https://woodpecker.olsen.cloud/repos/32/pipeline/444) and [PR 445](https://woodpecker.olsen.cloud/repos/32/pipeline/445), including all **823 tests in 122 files**, docs and both image builds. Preparation #65 passed pipelines 440/441 with 798 tests. - Real SQLite tests cover rollback at membership/setup/password writes, duplicate accounts, owner and organization isolation, stale/delegated contexts, expiry/boundary/deletion, concurrent redemption/replacement/revocation, and alternate password/token/refresh denial. A trace-level log capture proves credential/token input is absent. A populated migration-035 fixture preserves old credential rows after 036. - The Android Metro/Hermes bundle exports successfully. Shared app/session types remain compatible. **Unverified:** native clipboard/share, physical Android installation and device login; no device rollout was performed. Native `window` aliases without browser APIs have a dedicated guard test. ## Merge danger **Door:** one-way for the database relative to the old stock image. The schema is approved; no down migration, data deletion or restore is included. **Blast radius:** app Merge preparation #65 first, retain its server digest and verify that image against an already-upgraded disposable database before publishing the feature release. The eventual single-writer Recreate rollout briefly interrupts the server. Main builds alone do not update the pinned live workload. Do not release until required security findings and rollout prerequisites are resolved. ## Rollback and verification - **Roll back:** Use the verified preparatory server image with migration registration and pending-user safeguards retained, preserving the additive schema and provenance. The old stock 0.47.0 binary rejects an unknown applied migration and cannot start. Keep the compatible agent pin; do not automatically drop tables or restore data. - **Verify after rollout:** Follow release images/updater, the apps push mirror, expected ArgoCD revision, actual server/agent digests and readiness; verify closed registration and the owner-created-user/password-setup flow. A real owner session is needed for live provisioning; a role token must not impersonate one. Record evidence without links/credentials. - **Reviewers:** Security Engineer: owner scope and delegated/agent denial, pending-user invariants, token generation/storage/lifecycle/races, credential bypass prevention, logs/routing/cache/replica privacy, bounded hashing and the two-PR rollback plan. No Designer sign-off requested. Task: ed3ebb61-7698-4856-a06d-ac0f5ae2ca3c. Feature branch: `feat/ed3ebb61-user-setup`; preparation: `feat/ed3ebb61-user-setup-schema`.

morten-olsen added 1 commit 2026-10-20 11:31:32 +02:00

docs: propose owner-created user setup migration 527a94d30b

morten-olsen added 1 commit 2026-10-20 11:49:32 +02:00

docs: clarify migration-aware user setup rollback d272e6d12d

morten-olsen referenced this pull request 2026-10-20 12:34:02 +02:00

feat(server): prepare pending-user schema and activation guards #65

morten-olsen added 5 commits 2026-10-20 12:44:37 +02:00

feat(server): prepare pending-user schema and activation guards 66dbca6810

feat(server): prepare pending-user schema and activation guards 612fe7476c

feat(server): provision organization users with single-use password setup d594cf6f23

feat(app): add owner user creation and password setup screens d44fed15b8

Merge branch 'feat/ed3ebb61-user-setup-schema' into feat/ed3ebb61-user-setup 0a548350c0

morten-olsen changed title from WIP: docs: propose owner-created user setup migration to WIP: feat: let organization owners create users with password setup links 2026-10-20 12:45:07 +02:00

morten-olsen changed target branch from main to feat/ed3ebb61-user-setup-schema 2026-10-20 12:45:07 +02:00

morten-olsen reviewed 2026-10-20 12:55:45 +02:00

morten-olsen left a comment

• Copy link
• Copy Markdown

Standards: no blocking findings at 0a54835. Direct-owner authorization, immutable organization scope, pending-user guards, atomic capability lifecycle and credential privacy checked in source and tests. Forge statuses 444/445 are green. Spec: no blocking findings. NON-BLOCKING release prerequisite: merge preparation #65 first, retain its published main server digest and pass the attached rollback-smoke against that actual image before feature release. Use only disposable emptyDir data; no Service/PVC/Secrets/host access; disable service-account token mounting; retain existing UID/GID/seccomp/capability/resource bounds. Stock 0.47.0 cannot reopen migration 036. Roll back to verified preparation image, retaining additive schema and pending state plus compatible agent pin. Verify release/mirror/ArgoCD revisions, actual digests/readiness, closed registration and real-owner creation/redemption without recording capabilities. Native physical paths and actual-image execution remain unverified. Full review and local verification limits will be recorded on subtask 16c04c9f. Findings per axis: Standards 0; Spec 1 non-blocking delivery prerequisite.

Standards: no blocking findings at 0a54835. Direct-owner authorization, immutable organization scope, pending-user guards, atomic capability lifecycle and credential privacy checked in source and tests. Forge statuses 444/445 are green. Spec: no blocking findings. NON-BLOCKING release prerequisite: merge preparation #65 first, retain its published main server digest and pass the attached rollback-smoke against that actual image before feature release. Use only disposable emptyDir data; no Service/PVC/Secrets/host access; disable service-account token mounting; retain existing UID/GID/seccomp/capability/resource bounds. Stock 0.47.0 cannot reopen migration 036. Roll back to verified preparation image, retaining additive schema and pending state plus compatible agent pin. Verify release/mirror/ArgoCD revisions, actual digests/readiness, closed registration and real-owner creation/redemption without recording capabilities. Native physical paths and actual-image execution remain unverified. Full review and local verification limits will be recorded on subtask 16c04c9f. Findings per axis: Standards 0; Spec 1 non-blocking delivery prerequisite.

morten-olsen changed title from WIP: feat: let organization owners create users with password setup links to feat: let organization owners create users with password setup links 2026-10-20 12:57:45 +02:00

morten-olsen changed target branch from feat/ed3ebb61-user-setup-schema to main 2026-10-20 12:57:45 +02:00

morten-olsen merged commit 0a548350c0 into main 2026-10-20 13:04:51 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

ai/mission-control!64

No description provided.