SUBTASK #86: Manage user accounts (admin)

Open
  • Is something wrong?
#92 0 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@Edgeless6 is already working on this.

Since Nov 2, 2026.

Assessment

Difficulty
4/5
Estimated time
Over a week
Newbie friendliness
20/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
javascript, python
Domain
authorization, backend, frontend

Research direction

Start in backend/services/access_control/access_control_service.py to add set_role, set_status and reset_password, each passing changed_by to UserStore.store, then read the tests in tests/services/access_control/. The API routes come from #50, and the Users page is frontend/app/src/pages/UsersPage.jsx. Done means a new viewer can sign in but not change anything, a disabled user gets 401 on their next request, and the audit log names the admin for each change. This issue depends on #89, #90 and #91, which are not yet finished, so check those first.

Written by the indexing model from the issue text.

Description

backend Medium Priority subtask

What to do

Let an admin list accounts, add one, change a role, disable or re-enable an account and reset a password, through the API and a Users screen. Let every user change their own password.

Background

  • Spec SEC-03, POL-01, POL-02, CP-02
  • UserStore.store(user, changed_by) audits every change with the admin who made it, and records a password change as {"password_changed": true}, never the hash (#17)
  • Sessions reload the user on every request (subtask 4), so changes take effect on that user's next click

Steps

  • AccessControlService: set_role, set_status and reset_password, each with changed_by= the admin
  • Safety rules, each refused with a reason:
    • An admin can't disable or demote themselves
    • The last active admin can't be disabled or demoted (otherwise nobody could manage accounts again)
  • API, every route @requires(Permission.MANAGE_USERS):
    • GET /api/users
    • POST /api/users with {username, password, role}
    • PUT /api/users/<id>/role, PUT /api/users/<id>/status, PUT /api/users/<id>/password
  • PUT /api/me/password with {current_password, new_password} for any signed-in user
  • Users screen at /users, shown in the menu only to admins:
    • A table of username, role and status
    • An add-user form, a role picker, Disable / Enable, and Reset password
  • A Change password form in the header menu for every user
  • Unit tests:
    • Self-demotion and the last admin rules
    • An editor gets 403 on every /api/users route
    • Each change makes an audit entry naming the admin
    • No response contains a hash
    • A disabled user's next request gives 401

Where

  • backend/services/access_control/access_control_service.py
  • The Application Controller routes from #50
  • frontend/app/src/pages/UsersPage.jsx, and a change-password form in the header
  • tests/services/access_control/ and tests/controller/

Done when

  • An admin can add a viewer, who can sign in and browse but not change anything
  • Disabling that viewer signs them out on their next click
  • The audit log shows each account change with the admin who made it
  • All unit tests pass without a database

Depends on

  • Sign in and account rules (#89), Sessions and route protection (#90), Login screen (#91)
Dominant language
Python
Stars
1
Forks
1
Avg merge
8h 51m
Merged PRs (30d)
39

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Bearkat-Professionals/Software-Engineering-Project

All issues in Bearkat-Professionals/Software-Engineering-Project

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.