36 lines
2.1 KiB
Markdown
36 lines
2.1 KiB
Markdown
# Password accounts and personal agent keys — 14 October 2026
|
|
|
|
Implemented username/password login in the library and admin surfaces, administrator
|
|
account creation/disable, self-service password changes and `/agents` for personal
|
|
agent keys. The development proxy preserves the public Host to fix the reported
|
|
same-origin login failure. Existing bearer credentials remain usable for setup.
|
|
An initial administrator account was created at the owner's request; no password or
|
|
bearer token is recorded in this evidence document.
|
|
|
|
PASS:
|
|
|
|
- Full backend suite: 181 tests.
|
|
- Web check: TypeScript, ESLint and 19 component tests.
|
|
- Production web build; Ruff check/format, mypy, boundary and agent manifest checks.
|
|
- Account API scenarios: hashed passwords, generic input errors without secrets,
|
|
HTTPS/origin/CSRF/body limits, login throttling, password change invalidates all
|
|
sessions, wrong-password rejection, agent identity isolation, owner-only key
|
|
listing/revocation, grant escalation denial, read-only user limitations, account
|
|
disable cascades to agent revocation, self-disable rejection and durable accounts.
|
|
- Added targeted coverage for owned-key rotation and legacy account-key revocation
|
|
cascading to the user's agent keys.
|
|
- Live HTTPS smoke check: password login 200, Secure session cookie, authorized user
|
|
list 200, CSRF-protected sign-out 200. The test session was revoked afterward.
|
|
- Public-origin requests now pass through the development proxy; attacker-origin
|
|
requests still fail with the same-origin error.
|
|
|
|
LIMITED: the shared preview switched between clients, stale pages and renderer
|
|
errors. The fixture page loaded, but the full visual/keyboard/password walkthrough
|
|
could not be completed reliably. The component and API tests cover the behavior;
|
|
no screen-reader or axe pass is claimed. Temporary fixture HTTPS forwarding and
|
|
server processes were removed. Native agent-host setup remains outside this slice.
|
|
|
|
Existing dirty/untracked application state was preserved, no commit was made, and
|
|
no knowledge records were changed. Account migration adds tables and a nullable
|
|
credential owner column; no existing bearer secret is rotated during migration.
|