Anso c261fbc327 fix(rbac): harden user management with token versioning, session invalidation, and test coverage (#558) ...

Security fixes:
- Map deploy-only API tokens to deployer role (not admin)
- Add token versioning to invalidate sessions on password/role changes
- Reject deleted users immediately in auth middleware (no 24h JWT grace)
- Use DB role instead of JWT role so changes take effect instantly
- Block password setting on SSO-provisioned users
- Check proxy variant in scoped permission resolver

Cleanup and logging:
- Remove orphaned role assignments when stacks/nodes are deleted
- Add standard logging for login, user CRUD, role assignments, password changes
- Add diagnostic logging gated behind developer_mode setting
- Extract issueSessionCookie helper (DRY across 5 JWT signing sites)

Frontend:
- Replace Select with Combobox in UsersSection (design system compliance)
- Add strokeWidth={1.5} to Lucide icons
- Hide password fields for SSO-provisioned users

Testing:
- Add 42-test RBAC suite covering user CRUD, token versioning, scoped
  assignments, permissions endpoint, password management, seat limits,
  last-admin protection, and orphan cleanup

2026-04-13 14:31:34 -04:00

..

role-selector-dropdown.png

fix(rbac): harden user management with token versioning, session invalidation, and test coverage (#558)

2026-04-13 14:31:34 -04:00

user-create-form.png

fix(rbac): harden user management with token versioning, session invalidation, and test coverage (#558)

2026-04-13 14:31:34 -04:00

users-list.png

fix(rbac): harden user management with token versioning, session invalidation, and test coverage (#558)

2026-04-13 14:31:34 -04:00