Password reset and disabling/deleting accounts #23

New issue

Closed

opened 2026-10-14 23:49:06 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-14 23:49:06 -04:00

Owner

Follow-up to #15 / PR #22.

Gaps

No "forgot password": a user who forgets their password needs the administrator, and the administrator has no reset action either.
Accounts can't be disabled or deleted, so someone who leaves keeps access to every project they belong to.

Plan

Admin: disable/enable and delete accounts (PATCH/DELETE /users/:id); disabling bumps tokenVersion so sessions end immediately. Deleting must handle projects where they are the last owner.
Admin: set a temporary password for a user.
Self-service reset by email once a system sender is configured (User already has a Token model with password_reset purpose).

Follow-up to #15 / PR #22. **Gaps** - No "forgot password": a user who forgets their password needs the administrator, and the administrator has no reset action either. - Accounts can't be disabled or deleted, so someone who leaves keeps access to every project they belong to. **Plan** - Admin: disable/enable and delete accounts (`PATCH/DELETE /users/:id`); disabling bumps `tokenVersion` so sessions end immediately. Deleting must handle projects where they are the last owner. - Admin: set a temporary password for a user. - Self-service reset by email once a system sender is configured (`User` already has a `Token` model with `password_reset` purpose).

vmanne-poc added this to the Phase 9: Migrations & bounce handling milestone

2026-10-14 23:49:06 -04:00

vmanne-poc added the

feature

security

labels

2026-10-14 23:49:06 -04:00

vmanne-poc referenced this issue

2026-10-14 23:54:20 -04:00

Phase 8: dependency security upgrades, user management, unsubscribe compliance #22

vmanne-poc referenced this issue from a commit

2026-10-15 00:59:25 -04:00