Admin can create user accounts directly (#331) #333

fable-5 · 2026-08-05T12:23:33+02:00

fable-5 commented

2026-08-05 12:23:33 +02:00

Implements #331.

POST /api/v1/admin/users (Site-Admin guard, class level -> route-permissions fence covered): same field rules as self-registration (adminCreateUserSchema in shared), account is ACTIVE immediately, personal pond provisioned like the verify-email path.
User manager: create dialog (modal focus trap, Field wiring, flat RHF names -> #322 lesson), i18n de+en.
Audit: user.created_by_admin (notice), catalogue 1.9, doc row added.
Tests: api e2e-db (create + immediate login + personal pond; duplicate -> 409 field conflict; non-admin -> 403), web e2e creates through the UI and logs in as the new user, admin a11y scan now opens the dialog (light+dark).
Local verification: full api suite green (106 files / 602 tests, fresh DB), typecheck/lint/i18n green, admin-users + a11y(admin) packs green against a fresh local stack.
Rate-limit budget of the admin-users pack: now 5 logins / window of 10; resets exist before and after the pack in ci.yml.

Merge only on Stefan's go (fast-forward-only).

Implements #331. - `POST /api/v1/admin/users` (Site-Admin guard, class level -> route-permissions fence covered): same field rules as self-registration (`adminCreateUserSchema` in shared), account is ACTIVE immediately, personal pond provisioned like the verify-email path. - User manager: create dialog (modal focus trap, Field wiring, flat RHF names -> #322 lesson), i18n de+en. - Audit: `user.created_by_admin` (notice), catalogue **1.9**, doc row added. - Tests: api e2e-db (create + immediate login + personal pond; duplicate -> 409 field conflict; non-admin -> 403), web e2e creates through the UI and logs in as the new user, admin a11y scan now opens the dialog (light+dark). - Local verification: full api suite green (106 files / 602 tests, fresh DB), typecheck/lint/i18n green, admin-users + a11y(admin) packs green against a fresh local stack. - Rate-limit budget of the admin-users pack: now 5 logins / window of 10; resets exist before and after the pack in ci.yml. Merge only on Stefan's go (fast-forward-only).

fable-5 added 1 commit 2026-08-05 12:23:33 +02:00

Admin can create user accounts directly (#331 )

CI / Lint, typecheck, test (pull_request) Successful in 6m47s

Details

CI / Build container images (pull_request) Successful in 3m59s

Details

CI / Auth e2e pack (pull_request) Successful in 9m7s

Details

CI / Import/export fidelity gate (pull_request) Successful in 57s

Details

CD / Deploy to Test (push) Blocked by required conditions

Details

CD / Smoke tests against Test (push) Blocked by required conditions

Details

CD / Promote to Int (push) Blocked by required conditions

Details

CI / Build container images (push) Blocked by required conditions

Details

CI / Lint, typecheck, test (push) Has been cancelled

Details

CI / Auth e2e pack (push) Blocked by required conditions

Details

CI / Import/export fidelity gate (push) Blocked by required conditions

Details

CD / Build and push images (push) Has been cancelled

Details

9cf7b85b93

POST /admin/users (Site-Admin guard) creates an account with the same
field rules as self-registration, but active immediately: the admin
vouches for the address, so the e-mail is marked verified and the
personal pond is provisioned exactly like the verify-email path does
(markEmailVerified alone would skip the pond).

The user manager gains a create dialog (useModalFocus/useDismissable,
Field wiring, flat RHF field names per the #322 lesson). New audit
action user.created_by_admin, catalogue bumped to 1.9.

Tests: api e2e-db (create + immediate login + personal pond, duplicate
username 409, non-admin 403), web e2e through the dialog, and the
admin a11y scan now opens the dialog too. Both packs verified locally
against a fresh stack.

Closes #331

fable-5 referenced this pull request

2026-08-05 12:44:39 +02:00

Invitation flow with per-user quota (#332) #334

fable-5 merged commit 9cf7b85b93 into main

2026-08-05 13:40:31 +02:00

Sign in to join this conversation.

No reviewers