feat(server): prepare pending-user schema and activation guards #65

Merged

morten-olsen merged 1 commit from feat/ed3ebb61-user-setup-schema into main 2026-10-20 12:57:20 +02:00

Conversation 1 Commits 1 Files changed 12 +253 -1

morten-olsen commented 2026-10-20 12:34:02 +02:00

Owner

• Copy link
• Copy Markdown

Summary

Prepare the approved user-setup schema while preserving the current app behavior. A stock older server cannot start after a new migration is recorded; this preparatory main image will be the migration-aware rollback artifact for feature PR #64.

current app + migration 036 + pending-user safeguards
    -> ordinary main server image, retained by digest
    -> feature #64 adds owner provisioning and setup screens afterward

The migration adds users.activation_pending (default 0), private userPasswordSetups and its organization index, exactly as Morten approved on task ed3ebb61 at 10:01 UTC on 20 October 2026. Existing users, including passwordless users, remain activated. Pending users cannot obtain/use user tokens, refresh, gain organization access or bypass setup through general password changes. Removing an originating membership revokes its current verifier atomically.

This PR adds no provisioning/setup HTTP routes or UI. It must merge before #64; the feature stays blocked from rollout until this image has been tested against a disposable upgraded fixture.

Evidence

• Before: A real migration fixture proves that Kysely rejects an applied migration missing from an older registration list.
  After: The registered migration upgrades a populated schema at 035 without changing existing credential rows; all existing users default to activated, and the registered server can reopen the migration ledger.
• 22 focused migration, pending-user, user and membership tests passed. Server type check, relevant ESLint and diff checks passed. CI results are on this PR and will be recorded on the task before merge.

Merge danger

Door: one-way for the database relative to the old stock image. Morten has approved this schema for tests and eventual live startup after feature CI, Security review and a verified rollback artifact. No down migration, data deletion or restore is included.

Blast radius: app

Main builds publish an image but do not update the pinned live Deployment. Keep this schema-only image available before publishing the feature release. The eventual single-writer Recreate rollout briefly interrupts the server.

Rollback and verification

• Roll back: Before live migration, the existing deployed image is unchanged. After live migration, use the verified image from this preparation, retaining the schema, migration registration and pending-user safeguards. A plain revert to the old stock image cannot start.
• Verify after rollout: Retain the exact preparation server digest; test it against an isolated already-upgraded database with existing and pending users. Confirm readiness, existing sign-in, pending-user/token/password denial and absence of provisioning routes. Follow the final feature's mirror/ArgoCD/live-flow verification on the parent task.
• Reviewers: Security Engineer, covering pending-user authorization and credential safeguards, alongside final feature PR #64 before either merges.

Task: ed3ebb61-7698-4856-a06d-ac0f5ae2ca3c. Branch: feat/ed3ebb61-user-setup-schema.

## Summary Prepare the approved user-setup schema while preserving the current app behavior. A stock older server cannot start after a new migration is recorded; this preparatory main image will be the migration-aware rollback artifact for feature PR #64. ```text current app + migration 036 + pending-user safeguards -> ordinary main server image, retained by digest -> feature #64 adds owner provisioning and setup screens afterward ``` The migration adds `users.activation_pending` (default 0), private `userPasswordSetups` and its organization index, exactly as Morten approved on task ed3ebb61 at 10:01 UTC on 20 October 2026. Existing users, including passwordless users, remain activated. Pending users cannot obtain/use user tokens, refresh, gain organization access or bypass setup through general password changes. Removing an originating membership revokes its current verifier atomically. This PR adds no provisioning/setup HTTP routes or UI. It must merge before https://code.olsen.cloud/ai/mission-control/pulls/64; the feature stays blocked from rollout until this image has been tested against a disposable upgraded fixture. ## Evidence - **Before:** A real migration fixture proves that Kysely rejects an applied migration missing from an older registration list. **After:** The registered migration upgrades a populated schema at 035 without changing existing credential rows; all existing users default to activated, and the registered server can reopen the migration ledger. - 22 focused migration, pending-user, user and membership tests passed. Server type check, relevant ESLint and diff checks passed. CI results are on this PR and will be recorded on the task before merge. ## Merge danger **Door:** one-way for the database relative to the old stock image. Morten has approved this schema for tests and eventual live startup after feature CI, Security review and a verified rollback artifact. No down migration, data deletion or restore is included. **Blast radius:** app Main builds publish an image but do not update the pinned live Deployment. Keep this schema-only image available before publishing the feature release. The eventual single-writer Recreate rollout briefly interrupts the server. ## Rollback and verification - **Roll back:** Before live migration, the existing deployed image is unchanged. After live migration, use the verified image from this preparation, retaining the schema, migration registration and pending-user safeguards. A plain revert to the old stock image cannot start. - **Verify after rollout:** Retain the exact preparation server digest; test it against an isolated already-upgraded database with existing and pending users. Confirm readiness, existing sign-in, pending-user/token/password denial and absence of provisioning routes. Follow the final feature's mirror/ArgoCD/live-flow verification on the parent task. - **Reviewers:** Security Engineer, covering pending-user authorization and credential safeguards, alongside final feature PR #64 before either merges. Task: ed3ebb61-7698-4856-a06d-ac0f5ae2ca3c. Branch: `feat/ed3ebb61-user-setup-schema`.

morten-olsen added 1 commit 2026-10-20 12:34:02 +02:00

feat(server): prepare pending-user schema and activation guards 66dbca6810

morten-olsen referenced this pull request 2026-10-20 12:45:07 +02:00

feat: let organization owners create users with password setup links #64

morten-olsen reviewed 2026-10-20 12:56:36 +02:00

morten-olsen left a comment

• Copy link
• Copy Markdown

Standards: no blocking findings at 66dbca6. Migration 036 matches approved additive SQL; existing users default activated, including passwordless users. Pending password/token/refresh/organization-access guards and atomic membership-removal revocation remain in this prior-routes/UI baseline. Forge statuses 440/441 are green. Spec: no blocking findings. NON-BLOCKING release prerequisite: merge this PR first, retain its published main image by digest and run the attached rollback-smoke against that actual image before feature release. The reviewed script uses a disposable persisted fixture, restarts the server and verifies readiness, existing sign-in/passwordless self-service, pending denials and absent provisioning routes. Temporary Pod must use emptyDir only, no Service/PVC/Secrets/host access, explicit automountServiceAccountToken:false, UID/GID10001, RuntimeDefault, read-only root, no escalation, drop ALL and existing resource bounds. Roll back only to this verified baseline with schema/pending state retained and compatible agent pin; stock 0.47.0 cannot start after 036. Independently passed 28 focused tests across feature/migration/privacy/safeguards. Live remains 0.47.0. Findings per axis: Standards 0; Spec 1 non-blocking delivery prerequisite. No merge/deploy performed.

Standards: no blocking findings at 66dbca6. Migration 036 matches approved additive SQL; existing users default activated, including passwordless users. Pending password/token/refresh/organization-access guards and atomic membership-removal revocation remain in this prior-routes/UI baseline. Forge statuses 440/441 are green. Spec: no blocking findings. NON-BLOCKING release prerequisite: merge this PR first, retain its published main image by digest and run the attached rollback-smoke against that actual image before feature release. The reviewed script uses a disposable persisted fixture, restarts the server and verifies readiness, existing sign-in/passwordless self-service, pending denials and absent provisioning routes. Temporary Pod must use emptyDir only, no Service/PVC/Secrets/host access, explicit automountServiceAccountToken:false, UID/GID10001, RuntimeDefault, read-only root, no escalation, drop ALL and existing resource bounds. Roll back only to this verified baseline with schema/pending state retained and compatible agent pin; stock 0.47.0 cannot start after 036. Independently passed 28 focused tests across feature/migration/privacy/safeguards. Live remains 0.47.0. Findings per axis: Standards 0; Spec 1 non-blocking delivery prerequisite. No merge/deploy performed.

morten-olsen changed title from WIP: feat(server): prepare pending-user schema and activation guards to feat(server): prepare pending-user schema and activation guards 2026-10-20 12:57:19 +02:00

morten-olsen merged commit 66dbca6810 into main 2026-10-20 12:57:20 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

ai/mission-control!65

No description provided.