@objectstack/platform-objects 13.0.0 → 14.5.0

package/dist/identity/index.mjs

@@ -8,6 +8,15 @@ var SysUser = ObjectSchema.create({
   icon: "user",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0092 D4 — the ONE generic affordance opened on an identity table:
+  // standard row editing. Safe because the plugin-auth identity write guard
+  // (ADR-0092 D2) enforces the profile whitelist server-side — a user-context
+  // update may only touch SYS_USER_PROFILE_EDIT_FIELDS ({name, image});
+  // everything else is stripped/rejected regardless of what a form submits.
+  // The permission layer still decides WHO may edit (platform admins only by
+  // default; member/org-admin sets keep allowEdit: false). create / import /
+  // delete stay bucket-default (off).
+  userActions: { edit: true },
   // ADR-0010 §3.7 — identity table is managed by better-auth; schema must not drift.
   protection: {
     lock: "full",
@@ -55,15 +64,17 @@ var SysUser = ObjectSchema.create({
     // These actions hit /api/v1/auth/admin/* endpoints that are only
     // wired when `auth.plugins.admin` is enabled. When the plugin is
     // disabled the actions still render (schema is static) but server
-    // returns 404. UI surfaces them under the row menu so platform
-    // admins can manage accounts without dropping to SQL or
+    // returns 404. UI surfaces them under the row menu AND the
+    // record-detail header (`record_header`, overflowing into the ⋯
+    // "More" menu) so platform admins can manage an account from either
+    // the Users list or an open user record — without dropping to SQL or
     // a custom Setup wizard.
     {
       name: "ban_user",
       label: "Ban User",
       icon: "ban",
       variant: "danger",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/ban-user",
       recordIdParam: "userId",
@@ -79,7 +90,7 @@ var SysUser = ObjectSchema.create({
       label: "Unban User",
       icon: "check-circle-2",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unban-user",
       recordIdParam: "userId",
@@ -94,34 +105,117 @@ var SysUser = ObjectSchema.create({
       label: "Unlock Account",
       icon: "lock-open",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/unlock-user",
       recordIdParam: "userId",
       successMessage: "Account unlocked",
       refreshAfter: true
     },
+    {
+      // #2766 V1 — a platform admin can add a login-capable teammate without
+      // the email-dependent invite flow. Hits the plugin-auth wrapper route
+      // (NOT better-auth's stock /admin/create-user): the wrapper runs the
+      // ADR-0068 admin gate, drives the better-auth pipeline (scrypt hash +
+      // credential sys_account), stamps must_change_password, and — when
+      // "Generate temporary password" is picked — returns the password ONCE
+      // in the response for the result dialog. It is never persisted or logged.
+      name: "create_user",
+      label: "Create User",
+      icon: "user-plus",
+      variant: "secondary",
+      locations: ["list_toolbar"],
+      type: "api",
+      target: "/api/v1/auth/admin/create-user",
+      visible: "features.admin == true",
+      successMessage: "User created",
+      refreshAfter: true,
+      params: [
+        // The endpoint requires email OR phone (phone-only users get a
+        // placeholder address; requires auth.plugins.phoneNumber).
+        { field: "email", required: false },
+        {
+          name: "phoneNumber",
+          label: "Phone Number",
+          type: "text",
+          required: false,
+          helpText: "Sign-in phone number (E.164, e.g. +8613800000000). Required when no email is given."
+        },
+        { field: "name", required: false },
+        {
+          name: "generatePassword",
+          label: "Generate Temporary Password",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        },
+        { name: "password", label: "Password (leave empty to generate)", type: "text", required: false },
+        {
+          name: "mustChangePassword",
+          label: "Require Password Change On First Login",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        }
+      ],
+      resultDialog: {
+        title: "User Created",
+        description: "Copy the temporary password now \u2014 it is shown only once and never stored.",
+        acknowledge: "I have saved this password",
+        fields: [
+          { path: "user.email", label: "Email", format: "text" },
+          { path: "temporaryPassword", label: "Temporary Password", format: "secret" }
+        ]
+      }
+    },
     {
       name: "set_user_password",
       label: "Set Password",
       icon: "key-round",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
+      // #2766 V1 — same path as better-auth's stock route, but served by the
+      // plugin-auth wrapper registered ahead of the catch-all: it accepts the
+      // ADR-0068 platform-admin signals (the stock handler only honors the
+      // legacy role scalar), can mint a temporary password, and stamps
+      // must_change_password.
       target: "/api/v1/auth/admin/set-user-password",
       recordIdParam: "userId",
       successMessage: "Password updated",
       refreshAfter: false,
       params: [
-        { name: "newPassword", label: "New Password", type: "text", required: true }
-      ]
+        {
+          name: "generatePassword",
+          label: "Generate Temporary Password",
+          type: "boolean",
+          required: false,
+          defaultValue: false
+        },
+        { name: "newPassword", label: "New Password (leave empty to generate)", type: "text", required: false },
+        {
+          name: "mustChangePassword",
+          label: "Require Password Change On Next Login",
+          type: "boolean",
+          required: false,
+          defaultValue: true
+        }
+      ],
+      resultDialog: {
+        title: "Password Updated",
+        description: "If a temporary password was generated, copy it now \u2014 it is shown only once and never stored.",
+        acknowledge: "Done",
+        fields: [
+          { path: "temporaryPassword", label: "Temporary Password", format: "secret" }
+        ]
+      }
     },
     {
       name: "set_user_role",
       label: "Set Platform Role",
       icon: "shield-check",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/set-role",
       recordIdParam: "userId",
@@ -136,7 +230,7 @@ var SysUser = ObjectSchema.create({
       label: "Impersonate User",
       icon: "user-cog",
       variant: "secondary",
-      locations: ["list_item"],
+      locations: ["list_item", "record_header"],
       type: "api",
       target: "/api/v1/auth/admin/impersonate-user",
       recordIdParam: "userId",
@@ -360,20 +454,28 @@ var SysUser = ObjectSchema.create({
       maxLength: 255,
       group: "Identity"
     }),
+    // ADR-0092 D4 — with the generic edit affordance open, every non-profile
+    // field is readonly so the standard edit form renders it non-editable.
+    // This is UX only; the server boundary is the plugin-auth identity write
+    // guard (ADR-0092 D2), which strips/rejects these regardless.
     email: Field.email({
       label: "Email",
       required: true,
+      readonly: true,
+      // login identity — change flows through better-auth change-email verification
       searchable: true,
       group: "Identity"
     }),
     email_verified: Field.boolean({
       label: "Email Verified",
       defaultValue: false,
+      readonly: true,
       group: "Identity"
     }),
     two_factor_enabled: Field.boolean({
       label: "Two-Factor Enabled",
       defaultValue: false,
+      readonly: true,
       group: "Identity",
       description: "Whether two-factor authentication is enabled for this user. Maintained by the better-auth `twoFactor` plugin."
     }),
@@ -381,6 +483,8 @@ var SysUser = ObjectSchema.create({
     role: Field.text({
       label: "Platform Role",
       required: false,
+      readonly: true,
+      // ADR-0092 — set via the Set Platform Role action, never the edit form
       maxLength: 64,
       group: "Admin",
       description: "Platform-level role (admin, user, \u2026). Set via the Set Platform Role action."
@@ -388,18 +492,24 @@ var SysUser = ObjectSchema.create({
     banned: Field.boolean({
       label: "Banned",
       defaultValue: false,
+      readonly: true,
+      // ADR-0092 — toggled via Ban/Unban actions (session side effects)
       group: "Admin",
       description: "When true, the user cannot sign in. Toggle via Ban User / Unban User actions."
     }),
     ban_reason: Field.text({
       label: "Ban Reason",
       required: false,
+      readonly: true,
+      // ADR-0092 — written by the Ban User action
       maxLength: 255,
       group: "Admin"
     }),
     ban_expires: Field.datetime({
       label: "Ban Expires",
       required: false,
+      readonly: true,
+      // ADR-0092 — written by the Ban User action
       group: "Admin",
       description: "When set, the ban auto-clears at this time."
     }),
@@ -433,6 +543,37 @@ var SysUser = ObjectSchema.create({
       group: "Admin",
       description: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
     }),
+    // #2766 V1.5 — phone-number sign-in identifier (better-auth phoneNumber
+    // plugin, mapped via buildPhoneNumberPluginSchema). Unique when present;
+    // null for email-only accounts. Written through better-auth, not CRUD.
+    phone_number: Field.text({
+      label: "Phone Number",
+      required: false,
+      readonly: true,
+      searchable: true,
+      maxLength: 32,
+      group: "Account",
+      description: "Sign-in phone number (E.164 recommended). Unique per user; managed by better-auth when the phoneNumber plugin is enabled."
+    }),
+    phone_number_verified: Field.boolean({
+      label: "Phone Verified",
+      defaultValue: false,
+      readonly: true,
+      group: "Account",
+      description: "Whether the phone number has been verified (OTP verification requires SMS infrastructure; false until that ships). System-managed."
+    }),
+    // #2766 V1 — admin-issued "must change password on next sign-in" flag.
+    // Set by the /admin/create-user and /admin/set-user-password routes when
+    // a temporary password is issued; enforced through the ADR-0069 authGate
+    // (surfaces as PASSWORD_EXPIRED); cleared by stampPasswordChangedAt once
+    // the user completes a password change.
+    must_change_password: Field.boolean({
+      label: "Must Change Password",
+      defaultValue: false,
+      readonly: true,
+      group: "Admin",
+      description: "When true, the user is blocked (403 PASSWORD_EXPIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
+    }),
     // ADR-0069 D3 — when enforced MFA first applied to this user; starts the
     // grace clock. Stamped lazily at session validation; system-managed.
     mfa_required_at: Field.datetime({
@@ -464,6 +605,8 @@ var SysUser = ObjectSchema.create({
     ai_access: Field.boolean({
       label: "AI Access",
       defaultValue: false,
+      readonly: true,
+      // ADR-0092 — a licensed-seat grant; flows through the AiSeatPlugin enforcement path
       group: "Admin",
       description: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
     }),
@@ -477,12 +620,16 @@ var SysUser = ObjectSchema.create({
     manager_id: Field.lookup("sys_user", {
       label: "Manager",
       required: false,
+      readonly: true,
+      // ADR-0092 — drives own_and_reports RLS scope; org-structure maintenance is its own surface
       group: "Organization",
       description: "This user's direct manager. Forms the reporting chain the `own_and_reports` hierarchy scope walks (ADR-0057 / @objectstack/security-enterprise)."
     }),
     primary_business_unit_id: Field.lookup("sys_business_unit", {
       label: "Primary Business Unit",
       required: false,
+      readonly: true,
+      // ADR-0092 — denormalised projection maintained by plugin-sharing; never hand-edited
       group: "Organization",
       description: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
     }),
@@ -530,7 +677,10 @@ var SysUser = ObjectSchema.create({
   },
   indexes: [
     { fields: ["email"], unique: true },
-    { fields: ["created_at"], unique: false }
+    { fields: ["created_at"], unique: false },
+    // #2766 V1.5 — phone sign-in identifier; unique when present (null for
+    // email-only accounts), also the upsert match key for identity import.
+    { fields: ["phone_number"], unique: true }
   ],
   enable: {
     trackHistory: true,
@@ -2499,6 +2649,12 @@ var SysDeviceCode = ObjectSchema.create({
   icon: "key-round",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0057: device codes are dead the moment `expires_at` passes — keep a
+  // 1d grace for post-mortem, then reap.
+  lifecycle: {
+    class: "transient",
+    ttl: { field: "expires_at", expireAfter: "1d" }
+  },
   // [ADR-0066 D2/④] Secure-by-default: rows are LIVE pending device-grant
   // codes — reading `user_code`/`device_code` lets an attacker hijack a
   // pending CLI login. Not covered by the wildcard `'*'` grant; admins retain
@@ -3517,9 +3673,13 @@ var SysSsoProvider = ObjectSchema.create({
       // for a one-time DNS-TXT challenge and reveals the ready-to-paste record
       // ONCE via `resultDialog`. Routed through the env bridge (plugin-auth /
       // cloud AuthProxyPlugin) which reshapes the `{domainVerificationToken}`
-      // response into the `{ data: { dnsRecordName, dnsRecordValue } }` envelope
-      // the dialog reads. When the feature is OFF the bridge returns a clear
-      // "not enabled for this environment" error instead of a bare 404.
+      // response into a `{ success, data: { dnsRecordName, dnsRecordValue } }`
+      // envelope. The console action runtime unwraps that envelope, so the
+      // `resultDialog` field paths are relative to the inner `data` payload
+      // (`dnsRecordName`, not `data.dnsRecordName`) — consistent with every
+      // other object's resultDialog (create_user, two-factor, OAuth). When the
+      // feature is OFF the bridge returns a clear "not enabled for this
+      // environment" error instead of a bare 404.
       target: "/api/v1/auth/admin/sso/request-domain-verification",
       params: [
         { name: "providerId", field: "provider_id", defaultFromRow: true, required: true },
@@ -3530,9 +3690,9 @@ var SysSsoProvider = ObjectSchema.create({
         description: "Add the DNS TXT record below at your domain\u2019s DNS provider, then run \u201CVerify Domain\u201D. The token is shown once.",
         acknowledge: "Done",
         fields: [
-          { path: "data.dnsRecordType", label: "Record type", format: "text" },
-          { path: "data.dnsRecordName", label: "Name / Host", format: "secret" },
-          { path: "data.dnsRecordValue", label: "Value", format: "secret" }
+          { path: "dnsRecordType", label: "Record type", format: "text" },
+          { path: "dnsRecordName", label: "Name / Host", format: "secret" },
+          { path: "dnsRecordValue", label: "Value", format: "secret" }
         ]
       }
     },