GEWU/docs/acceptance/2026-10-14-user-accounts.md

Password accounts and personal agent keys — 14 October 2026

Implemented username/password login in the library and admin surfaces, administrator account creation/disable, self-service password changes and /agents for personal agent keys. The development proxy preserves the public Host to fix the reported same-origin login failure. Existing bearer credentials remain usable for setup. An initial administrator account was created at the owner's request; no password or bearer token is recorded in this evidence document.

PASS:

• Full backend suite: 181 tests.
• Web check: TypeScript, ESLint and 19 component tests.
• Production web build; Ruff check/format, mypy, boundary and agent manifest checks.
• Account API scenarios: hashed passwords, generic input errors without secrets, HTTPS/origin/CSRF/body limits, login throttling, password change invalidates all sessions, wrong-password rejection, agent identity isolation, owner-only key listing/revocation, grant escalation denial, read-only user limitations, account disable cascades to agent revocation, self-disable rejection and durable accounts.
• Added targeted coverage for owned-key rotation and legacy account-key revocation cascading to the user's agent keys.
• Live HTTPS smoke check: password login 200, Secure session cookie, authorized user list 200, CSRF-protected sign-out 200. The test session was revoked afterward.
• Public-origin requests now pass through the development proxy; attacker-origin requests still fail with the same-origin error.

LIMITED: the shared preview switched between clients, stale pages and renderer errors. The fixture page loaded, but the full visual/keyboard/password walkthrough could not be completed reliably. The component and API tests cover the behavior; no screen-reader or axe pass is claimed. Temporary fixture HTTPS forwarding and server processes were removed. Native agent-host setup remains outside this slice.

Existing dirty/untracked application state was preserved, no commit was made, and no knowledge records were changed. Account migration adds tables and a nullable credential owner column; no existing bearer secret is rotated during migration.