artifacty 0.9.0 → 0.10.0

package/README.md

@@ -92,6 +92,21 @@ artifacty serve --host 10.0.0.50 --share-mode team --api-token "$ARTIFACTY_BOOTS
 artifacty install all --mcp-url http://10.0.0.50:8787/mcp --api-token "$ARTIFACTY_PERSONAL_TOKEN"
 ```
 
+Administrators can create users individually at `/admin/users` or import them
+from CSV. Use `email,name,role,password,password_reset_required` headers. If
+`password` is empty, Artifacty generates a temporary password, shows it once in
+the import result, and requires the user to change it on first sign-in.
+
+```csv
+email,name,role
+user@example.com,User,user
+admin2@example.com,Admin Two,admin
+```
+
+```bash
+artifacty users import --file users.csv
+```
+
 Run diagnostics for the local runtime, store, server, service definitions, and MCP discovery:
 
 ```bash

package/docs/central-team-deployment-design.md

@@ -121,9 +121,12 @@ artifacty serve \
 
 Open `/login` after the server starts. If no users exist, the first successful
 login form creates an administrator. Administrators can create users from
-`/admin/users`, and every user can create or revoke personal API tokens from
-`/account`. Use those personal tokens for `artifacty install ... --api-token`
-so MCP and API audit logs record the user's email as `actor`.
+`/admin/users`, paste-import users from CSV, and every user can create or
+revoke personal API tokens from `/account`. CSV imports support
+`email,name,role,password,password_reset_required`; blank passwords are
+generated once and require a password change on first sign-in. Use personal
+tokens for `artifacty install ... --api-token` so MCP and API audit logs record
+the user's email as `actor`.
 
 Production-like internal deployments should run Artifacty behind a TLS reverse
 proxy, keep `ARTIFACTY_ENABLE_REACT_RENDERER` disabled unless the team trusts
@@ -185,7 +188,8 @@ token rotation policy, and SSO/OIDC.
 - `artifacty install <agent> --mcp-url ... --api-token ...` writes bridge env
   config for Claude, Codex, Gemini, GitHub Copilot, and Cursor.
 - `/login`, `/account`, and `/admin/users` provide server-side user management,
-  administrator/user roles, and personal token issue/revoke flows.
+  administrator/user roles, CSV user import, required password reset, password
+  change, and personal token issue/revoke flows.
 - Remote MCP requests use header auth and never put tokens in URLs.
 - Tests cover direct HTTP MCP calls and stdio bridge calls to a token-protected
   central server.

package/docs/integrations.md

@@ -103,6 +103,23 @@ node src/cli.js install all \
   --api-token "$ARTIFACTY_PERSONAL_TOKEN"
 ```
 
+Administrators can create users one at a time from `/admin/users` or import a
+CSV from the same page. The CLI can import the same file when run on the server:
+
+```csv
+email,name,role,password,password_reset_required
+user@example.com,User,user,,
+admin2@example.com,Admin Two,admin,temporary-password,true
+```
+
+```bash
+artifacty users import --file users.csv
+```
+
+Rows without a password receive a generated temporary password. Generated
+passwords are shown only in the import result, and imported users must change
+their password before they can continue to `/account` and issue MCP/API tokens.
+
 - Claude: writes project `.mcp.json`. Claude Code's startup timeout is controlled by the parent `MCP_TIMEOUT` environment variable and defaults to 30 seconds, so Artifacty does not add a per-server `.mcp.json` `timeout` field.
 - Codex: writes or replaces the `[mcp_servers.artifacty]` block in `~/.codex/config.toml` unless `--config` is provided. The generated block uses a 30 second startup timeout so slower Windows or cold-start environments can load the MCP server reliably.
 - Gemini: writes project `.gemini/settings.json` with a 30 second timeout.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/cli.js

@@ -8,6 +8,7 @@ import {
   createArtifact,
   createStore,
   getArtifact,
+  importUsersFromCsv,
   listAuditEvents,
   listArtifactsPage,
   rebuildSearchIndex,
@@ -300,6 +301,18 @@ async function main() {
     return;
   }
 
+  if (command === "users") {
+    const action = options._[0];
+    if (action === "import") {
+      const csv = await readContent(options);
+      printJson(await importUsersFromCsv(store, csv, {
+        passwordResetRequired: !options.noPasswordReset
+      }));
+      return;
+    }
+    throw new Error("users requires an action: import");
+  }
+
   if (command === "service") {
     const action = options._[0] || "plist";
     printJson(await serviceCommand(action, {
@@ -351,7 +364,7 @@ function parseArgs(args) {
     }
 
     const key = arg.slice(2);
-    if (key === "raw" || key === "dry-run" || key === "trust" || key === "include-archived" || key === "allow-secrets" || key === "generate-token" || key === "detach" || key === "foreground" || key === "force" || key === "skip-mcp" || key === "mcp-http") {
+    if (key === "raw" || key === "dry-run" || key === "trust" || key === "include-archived" || key === "allow-secrets" || key === "generate-token" || key === "detach" || key === "foreground" || key === "force" || key === "skip-mcp" || key === "mcp-http" || key === "no-password-reset") {
       options[toCamelCase(key)] = true;
       continue;
     }
@@ -453,6 +466,7 @@ Usage:
   artifacty export --file <path>
   artifacty backup [--file <path>]
   artifacty import-store --file <path>
+  artifacty users import --file <path.csv> [--no-password-reset]
   artifacty service plist|unit|task|install|uninstall [--platform macos|linux|windows] [--dry-run] [--path <path>] [--mcp-http]
   artifacty list [--query text] [--tag tag] [--source agent] [--limit 50] [--offset 0] [--include-archived]
   artifacty show <id> [--version n] [--raw]

package/src/lib/render.js

@@ -321,6 +321,7 @@ export function renderAccountPage({ baseUrl, user, tokens = [], createdToken = "
         <nav>
           <a href="${view.href("/")}">${view.text("nav.index")}</a>
           ${user.role === "admin" ? `<a href="/admin/users">Users</a>` : ""}
+          <a href="/account/password">Password</a>
           <form class="nav-form" method="post" action="/logout"><button type="submit">Sign out</button></form>
           ${languageSwitcher(view)}
         </nav>
@@ -357,14 +358,60 @@ export function renderAccountPage({ baseUrl, user, tokens = [], createdToken = "
   });
 }
 
-export function renderAdminUsersPage({ baseUrl, user, users = [], locale = DEFAULT_LOCALE, currentPath = "/admin/users" }) {
+export function renderPasswordPage({ baseUrl, user, required = false, error = "", success = "", locale = DEFAULT_LOCALE, currentPath = "/account/password" }) {
+  const view = viewContext(locale, currentPath);
+  return pageShell({
+    title: "Change Password",
+    body: `
+      <header class="topbar">
+        <div>
+          <h1>Change Password</h1>
+          <p>${escapeHtml(user.email)} · ${escapeHtml(baseUrl)}</p>
+        </div>
+        <nav>
+          <a href="${view.href("/")}">${view.text("nav.index")}</a>
+          ${required ? "" : `<a href="/account">Account</a>`}
+          <form class="nav-form" method="post" action="/logout"><button type="submit">Sign out</button></form>
+          ${languageSwitcher(view)}
+        </nav>
+      </header>
+      <main class="artifact-editor auth-panel">
+        ${required ? `<p class="auth-warning">Password change is required before continuing.</p>` : ""}
+        ${error ? `<p class="auth-error">${escapeHtml(error)}</p>` : ""}
+        ${success ? `<p class="auth-success">${escapeHtml(success)}</p>` : ""}
+        <form class="editor-form auth-form" method="post" action="/account/password">
+          <section class="editor-fields">
+            <label class="field">
+              <span>Current password</span>
+              <input type="password" name="currentPassword" autocomplete="current-password" required>
+            </label>
+            <label class="field">
+              <span>New password</span>
+              <input type="password" name="newPassword" autocomplete="new-password" minlength="8" required>
+            </label>
+            <label class="field">
+              <span>Confirm password</span>
+              <input type="password" name="confirmPassword" autocomplete="new-password" minlength="8" required>
+            </label>
+          </section>
+          <footer class="editor-actions">
+            <button type="submit">Change password</button>
+          </footer>
+        </form>
+      </main>
+    `,
+    locale: view.locale
+  });
+}
+
+export function renderAdminUsersPage({ baseUrl, user, users = [], importResult = null, importError = "", locale = DEFAULT_LOCALE, currentPath = "/admin/users" }) {
   const view = viewContext(locale, currentPath);
   const rows = users.map((item) => `
     <tr>
       <td>${escapeHtml(item.email)}</td>
       <td>${escapeHtml(item.name)}</td>
       <td>${escapeHtml(item.role)}</td>
-      <td>${item.active ? "Active" : "Disabled"}</td>
+      <td>${item.active ? "Active" : "Disabled"}${item.passwordResetRequired ? " · Reset required" : ""}</td>
       <td>${escapeHtml(item.createdAt)}</td>
       <td>
         ${item.id === user.id ? "" : `<form method="post" action="/admin/users/${encodeURIComponent(item.id)}/${item.active ? "disable" : "enable"}">
@@ -373,6 +420,38 @@ export function renderAdminUsersPage({ baseUrl, user, users = [], locale = DEFAU
       </td>
     </tr>
   `).join("");
+  const createdRows = (importResult?.created || []).map((item) => `
+    <tr>
+      <td>${escapeHtml(item.user.email)}</td>
+      <td>${escapeHtml(item.user.role)}</td>
+      <td>${item.user.passwordResetRequired ? "Yes" : "No"}</td>
+      <td>${item.passwordGenerated ? `<code>${escapeHtml(item.temporaryPassword)}</code>` : "Provided in CSV"}</td>
+    </tr>
+  `).join("");
+  const skippedRows = (importResult?.skipped || []).map((item) => `
+    <tr><td>${escapeHtml(item.row)}</td><td>${escapeHtml(item.email)}</td><td>${escapeHtml(item.reason)}</td></tr>
+  `).join("");
+  const failedRows = (importResult?.failed || []).map((item) => `
+    <tr><td>${escapeHtml(item.row)}</td><td>${escapeHtml(item.email)}</td><td>${escapeHtml(item.error)}</td></tr>
+  `).join("");
+  const importSummary = importResult ? `
+    <section class="meta-card">
+      <h2>Import results</h2>
+      <p class="muted">${importResult.created.length} created, ${importResult.skipped.length} skipped, ${importResult.failed.length} failed.</p>
+      ${createdRows ? `<table class="data-table">
+        <thead><tr><th>Email</th><th>Role</th><th>Reset required</th><th>Temporary password</th></tr></thead>
+        <tbody>${createdRows}</tbody>
+      </table>` : ""}
+      ${skippedRows ? `<h3>Skipped</h3><table class="data-table">
+        <thead><tr><th>Row</th><th>Email</th><th>Reason</th></tr></thead>
+        <tbody>${skippedRows}</tbody>
+      </table>` : ""}
+      ${failedRows ? `<h3>Failed</h3><table class="data-table">
+        <thead><tr><th>Row</th><th>Email</th><th>Error</th></tr></thead>
+        <tbody>${failedRows}</tbody>
+      </table>` : ""}
+    </section>
+  ` : "";
 
   return pageShell({
     title: "Users",
@@ -397,10 +476,24 @@ export function renderAdminUsersPage({ baseUrl, user, users = [], locale = DEFAU
               <label class="field"><span>Name</span><input name="name"></label>
               <label class="field"><span>Role</span><select name="role"><option value="user">user</option><option value="admin">admin</option></select></label>
               <label class="field"><span>Password</span><input type="password" name="password" minlength="8" required></label>
+              <label class="check-field"><input type="checkbox" name="passwordResetRequired"> Require password change</label>
             </section>
             <footer class="editor-actions"><button type="submit">Create user</button></footer>
           </form>
         </section>
+        <section class="meta-card">
+          <h2>Import users from CSV</h2>
+          <p class="muted">Use headers: email, name, role, password, password_reset_required. Missing passwords are generated and must be changed at first sign-in.</p>
+          ${importError ? `<p class="auth-error">${escapeHtml(importError)}</p>` : ""}
+          <form class="editor-form" method="post" action="/admin/users/import">
+            <label class="field content-field">
+              <span>CSV</span>
+              <textarea class="compact-textarea" name="csv" spellcheck="false" placeholder="email,name,role&#10;user@example.com,User,user" required></textarea>
+            </label>
+            <footer class="editor-actions"><button type="submit">Import users</button></footer>
+          </form>
+        </section>
+        ${importSummary}
         <section class="meta-card">
           <h2>Existing users</h2>
           <table class="data-table">
@@ -980,6 +1073,8 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
       grid-template-columns: minmax(220px, 1fr);
     }
     .auth-error,
+    .auth-success,
+    .auth-warning,
     .token-once {
       border: 1px solid var(--line);
       border-radius: 8px;
@@ -991,6 +1086,16 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
       background: #fef2f2;
       border-color: #fecaca;
     }
+    .auth-success {
+      color: #166534;
+      background: #f0fdf4;
+      border-color: #bbf7d0;
+    }
+    .auth-warning {
+      color: #92400e;
+      background: #fffbeb;
+      border-color: #fde68a;
+    }
     .muted {
       color: var(--muted);
     }
@@ -1049,6 +1154,19 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
       text-transform: uppercase;
       color: var(--faint);
     }
+    .check-field {
+      display: flex;
+      gap: 8px;
+      align-items: center;
+      min-height: 38px;
+      color: var(--muted);
+      font-size: 13px;
+    }
+    .check-field input {
+      width: auto;
+      min-height: 0;
+      padding: 0;
+    }
     input,
     select,
     textarea {
@@ -1077,6 +1195,9 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
       white-space: pre;
       overflow: auto;
     }
+    .compact-textarea {
+      min-height: 160px;
+    }
     .textarea-enhanced {
       display: none;
     }

package/src/lib/storage.js

@@ -664,36 +664,12 @@ export async function countUsers(store = createStore()) {
 }
 
 export async function createUser(store = createStore(), input = {}) {
-  const email = normalizeEmail(input.email);
-  const password = String(input.password || "");
-  if (!email) {
-    throw Object.assign(new Error("User email is required"), { statusCode: 400, code: "USER_EMAIL_REQUIRED" });
-  }
-  if (password.length < 8) {
-    throw Object.assign(new Error("User password must be at least 8 characters"), { statusCode: 400, code: "USER_PASSWORD_WEAK" });
-  }
-  const role = normalizeUserRole(input.role || "user");
-  const name = normalizeOptionalString(input.name) || email;
-  const now = new Date().toISOString();
-  const user = {
-    id: randomUUID(),
-    email,
-    name,
-    role,
-    active: true,
-    createdAt: now,
-    updatedAt: now
-  };
   const db = openDatabase(store);
   try {
-    db.prepare(`
-      INSERT INTO users (id, email, name, role, password_hash, active, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, 1, ?, ?)
-    `).run(user.id, user.email, user.name, user.role, hashPassword(password), now, now);
-    return user;
+    return insertUser(db, input);
   } catch (error) {
     if (/UNIQUE/i.test(error.message)) {
-      throw Object.assign(new Error(`User already exists: ${email}`), { statusCode: 409, code: "USER_EXISTS" });
+      throw Object.assign(new Error(`User already exists: ${normalizeEmail(input.email)}`), { statusCode: 409, code: "USER_EXISTS" });
     }
     throw error;
   } finally {
@@ -701,11 +677,81 @@ export async function createUser(store = createStore(), input = {}) {
   }
 }
 
+export async function importUsersFromCsv(store = createStore(), csv, options = {}) {
+  const records = parseUserCsv(csv);
+  const result = {
+    created: [],
+    skipped: [],
+    failed: [],
+    totalRows: records.length
+  };
+  const db = openDatabase(store);
+  try {
+    for (const record of records) {
+      const email = normalizeEmail(record.email);
+      if (!email) {
+        result.failed.push({
+          row: record.row,
+          email: "",
+          error: "User email is required",
+          code: "USER_EMAIL_REQUIRED"
+        });
+        continue;
+      }
+
+      const providedPassword = normalizeOptionalString(record.password || record.temporary_password);
+      const password = providedPassword || generateTemporaryPassword();
+      const resetFromCsv = firstDefined(
+        record.password_reset_required,
+        record.require_password_reset,
+        record.force_password_reset,
+        record.reset_required
+      );
+      const passwordResetRequired = !providedPassword || (resetFromCsv === undefined
+        ? options.passwordResetRequired !== false
+        : parseBooleanOption(resetFromCsv));
+
+      try {
+        const user = insertUser(db, {
+          email,
+          name: record.name || email,
+          role: record.role || "user",
+          password,
+          passwordResetRequired
+        });
+        result.created.push({
+          user,
+          passwordGenerated: !providedPassword,
+          temporaryPassword: !providedPassword ? password : undefined
+        });
+      } catch (error) {
+        if (error.code === "USER_EXISTS" || /UNIQUE/i.test(error.message)) {
+          result.skipped.push({
+            row: record.row,
+            email,
+            reason: "User already exists"
+          });
+          continue;
+        }
+        result.failed.push({
+          row: record.row,
+          email,
+          error: error.message,
+          code: error.code || "USER_IMPORT_FAILED"
+        });
+      }
+    }
+    return result;
+  } finally {
+    db.close();
+  }
+}
+
 export async function listUsers(store = createStore()) {
   const db = openDatabase(store);
   try {
     return db.prepare(`
-      SELECT id, email, name, role, active, created_at, updated_at
+      SELECT id, email, name, role, active, password_reset_required, created_at, updated_at
       FROM users
       ORDER BY created_at ASC
     `).all().map(userFromRow);
@@ -723,18 +769,48 @@ export async function setUserActive(store = createStore(), id, active) {
       throw Object.assign(new Error(`User not found: ${id}`), { statusCode: 404, code: "USER_NOT_FOUND" });
     }
     return userFromRow(db.prepare(`
-      SELECT id, email, name, role, active, created_at, updated_at FROM users WHERE id = ?
+      SELECT id, email, name, role, active, password_reset_required, created_at, updated_at FROM users WHERE id = ?
     `).get(id));
   } finally {
     db.close();
   }
 }
 
+export async function changeUserPassword(store = createStore(), userId, input = {}) {
+  const password = String(input.password || input.newPassword || "");
+  if (password.length < 8) {
+    throw Object.assign(new Error("User password must be at least 8 characters"), { statusCode: 400, code: "USER_PASSWORD_WEAK" });
+  }
+  const db = openDatabase(store);
+  try {
+    const existing = db.prepare("SELECT password_hash FROM users WHERE id = ?").get(userId);
+    if (!existing) {
+      throw Object.assign(new Error(`User not found: ${userId}`), { statusCode: 404, code: "USER_NOT_FOUND" });
+    }
+    if (input.currentPassword !== undefined && !verifyPassword(input.currentPassword, existing.password_hash)) {
+      throw Object.assign(new Error("Current password is incorrect"), { statusCode: 400, code: "CURRENT_PASSWORD_INVALID" });
+    }
+    const now = new Date().toISOString();
+    db.prepare(`
+      UPDATE users
+      SET password_hash = ?, password_reset_required = ?, updated_at = ?
+      WHERE id = ?
+    `).run(hashPassword(password), input.passwordResetRequired ? 1 : 0, now, userId);
+    return userFromRow(db.prepare(`
+      SELECT id, email, name, role, active, password_reset_required, created_at, updated_at
+      FROM users
+      WHERE id = ?
+    `).get(userId));
+  } finally {
+    db.close();
+  }
+}
+
 export async function verifyUserPassword(store = createStore(), email, password) {
   const db = openDatabase(store);
   try {
     const row = db.prepare(`
-      SELECT id, email, name, role, password_hash, active, created_at, updated_at
+      SELECT id, email, name, role, password_hash, active, password_reset_required, created_at, updated_at
       FROM users
       WHERE email = ?
     `).get(normalizeEmail(email));
@@ -776,7 +852,7 @@ export async function getSessionUser(store = createStore(), token) {
   const db = openDatabase(store);
   try {
     const row = db.prepare(`
-      SELECT s.id AS session_id, s.expires_at, u.id, u.email, u.name, u.role, u.active, u.created_at, u.updated_at
+      SELECT s.id AS session_id, s.expires_at, u.id, u.email, u.name, u.role, u.active, u.password_reset_required, u.created_at, u.updated_at
       FROM sessions s
       JOIN users u ON u.id = s.user_id
       WHERE s.token_hash = ? AND s.revoked_at IS NULL
@@ -866,7 +942,7 @@ export async function authenticateApiToken(store = createStore(), token) {
   try {
     const tokenHash = hashToken(token);
     const row = db.prepare(`
-      SELECT t.id AS token_id, t.name AS token_name, u.id, u.email, u.name, u.role, u.active, u.created_at, u.updated_at
+      SELECT t.id AS token_id, t.name AS token_name, u.id, u.email, u.name, u.role, u.active, u.password_reset_required, u.created_at, u.updated_at
       FROM api_tokens t
       JOIN users u ON u.id = t.user_id
       WHERE t.token_hash = ? AND t.revoked_at IS NULL
@@ -1039,6 +1115,7 @@ function initializeSchema(db) {
       role TEXT NOT NULL DEFAULT 'user',
       password_hash TEXT NOT NULL,
       active INTEGER NOT NULL DEFAULT 1,
+      password_reset_required INTEGER NOT NULL DEFAULT 0,
       created_at TEXT NOT NULL,
       updated_at TEXT NOT NULL
     );
@@ -1075,6 +1152,7 @@ function initializeSchema(db) {
   ensureColumn(db, "artifacts", "artifact_type", "TEXT NOT NULL DEFAULT 'document'");
   ensureColumn(db, "artifacts", "schema_version", "INTEGER NOT NULL DEFAULT 1");
   ensureColumn(db, "artifacts", "archived_at", "TEXT");
+  ensureColumn(db, "users", "password_reset_required", "INTEGER NOT NULL DEFAULT 0");
   db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('store_version', ?)").run(String(STORE_VERSION));
   ensureSearchTable(db);
 }
@@ -1380,6 +1458,7 @@ function userFromRow(row) {
     name: row.name,
     role: row.role,
     active: Boolean(row.active),
+    passwordResetRequired: Boolean(row.password_reset_required),
     createdAt: row.created_at,
     updatedAt: row.updated_at
   };
@@ -1587,6 +1666,156 @@ function normalizeUserRole(value) {
   return role;
 }
 
+function insertUser(db, input = {}) {
+  const email = normalizeEmail(input.email);
+  const password = String(input.password || "");
+  if (!email) {
+    throw Object.assign(new Error("User email is required"), { statusCode: 400, code: "USER_EMAIL_REQUIRED" });
+  }
+  if (password.length < 8) {
+    throw Object.assign(new Error("User password must be at least 8 characters"), { statusCode: 400, code: "USER_PASSWORD_WEAK" });
+  }
+  const role = normalizeUserRole(input.role || "user");
+  const name = normalizeOptionalString(input.name) || email;
+  const now = new Date().toISOString();
+  const user = {
+    id: randomUUID(),
+    email,
+    name,
+    role,
+    active: true,
+    passwordResetRequired: Boolean(input.passwordResetRequired),
+    createdAt: now,
+    updatedAt: now
+  };
+  try {
+    db.prepare(`
+      INSERT INTO users (id, email, name, role, password_hash, active, password_reset_required, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)
+    `).run(
+      user.id,
+      user.email,
+      user.name,
+      user.role,
+      hashPassword(password),
+      user.passwordResetRequired ? 1 : 0,
+      now,
+      now
+    );
+    return user;
+  } catch (error) {
+    if (/UNIQUE/i.test(error.message)) {
+      throw Object.assign(new Error(`User already exists: ${email}`), { statusCode: 409, code: "USER_EXISTS" });
+    }
+    throw error;
+  }
+}
+
+function parseUserCsv(csv) {
+  const rows = parseCsvRows(csv).filter((row) => row.some((cell) => normalizeOptionalString(cell)));
+  if (rows.length === 0) {
+    return [];
+  }
+  const headers = rows[0].map(normalizeCsvHeader);
+  if (!headers.includes("email")) {
+    throw Object.assign(new Error("User CSV requires an email header"), {
+      statusCode: 400,
+      code: "USER_CSV_EMAIL_REQUIRED"
+    });
+  }
+  return rows.slice(1).map((row, index) => {
+    const record = { row: index + 2 };
+    headers.forEach((header, columnIndex) => {
+      if (header) {
+        record[header] = normalizeOptionalString(row[columnIndex]);
+      }
+    });
+    return record;
+  });
+}
+
+function parseCsvRows(csv) {
+  const text = String(csv || "").replace(/^\uFEFF/, "");
+  const rows = [];
+  let row = [];
+  let cell = "";
+  let quoted = false;
+
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (quoted) {
+      if (char === "\"" && text[index + 1] === "\"") {
+        cell += "\"";
+        index += 1;
+      } else if (char === "\"") {
+        quoted = false;
+      } else {
+        cell += char;
+      }
+      continue;
+    }
+
+    if (char === "\"") {
+      quoted = true;
+    } else if (char === ",") {
+      row.push(cell);
+      cell = "";
+    } else if (char === "\n") {
+      row.push(cell.replace(/\r$/, ""));
+      rows.push(row);
+      row = [];
+      cell = "";
+    } else {
+      cell += char;
+    }
+  }
+
+  if (quoted) {
+    throw Object.assign(new Error("User CSV has an unterminated quoted field"), {
+      statusCode: 400,
+      code: "USER_CSV_INVALID"
+    });
+  }
+  row.push(cell.replace(/\r$/, ""));
+  rows.push(row);
+  return rows;
+}
+
+function normalizeCsvHeader(value) {
+  const header = normalizeOptionalString(value).toLowerCase().replace(/[\s-]+/g, "_");
+  if (header === "mail" || header === "email_address") {
+    return "email";
+  }
+  if (header === "display_name" || header === "full_name") {
+    return "name";
+  }
+  if (header === "temporary_password" || header === "temp_password") {
+    return "temporary_password";
+  }
+  if (header === "force_reset" || header === "must_change_password") {
+    return "password_reset_required";
+  }
+  return header;
+}
+
+function firstDefined(...values) {
+  return values.find((value) => value !== undefined && value !== "");
+}
+
+function parseBooleanOption(value) {
+  const normalized = normalizeOptionalString(value).toLowerCase();
+  if (["1", "true", "yes", "y", "on"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "n", "off"].includes(normalized)) {
+    return false;
+  }
+  throw Object.assign(new Error(`Invalid boolean value: ${value}`), {
+    statusCode: 400,
+    code: "INVALID_BOOLEAN"
+  });
+}
+
 function normalizeOptionalString(value) {
   if (value === undefined || value === null) {
     return "";
@@ -1594,6 +1823,10 @@ function normalizeOptionalString(value) {
   return String(value).trim();
 }
 
+function generateTemporaryPassword() {
+  return `tmp_${randomBytes(18).toString("base64url")}`;
+}
+
 function generateOpaqueToken(prefix) {
   return `${prefix}_${randomBytes(32).toString("base64url")}`;
 }

package/src/server.js

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import {
   archiveArtifact,
   authenticateApiToken,
+  changeUserPassword,
   countUsers,
   createApiToken,
   createArtifact,
@@ -15,6 +16,7 @@ import {
   createUser,
   getArtifact,
   getSessionUser,
+  importUsersFromCsv,
   listApiTokens,
   listArtifactsPage,
   listAuditEvents,
@@ -40,6 +42,7 @@ import {
   renderArtifactPage,
   renderAccountPage,
   renderAdminUsersPage,
+  renderPasswordPage,
   renderReactFramePage,
   renderDashboard,
   renderDiffPage,
@@ -184,6 +187,9 @@ export async function handleRequest({ request, response, store, host, port, secu
 
   const userCount = await countUsers(store);
   const currentUser = userCount > 0 ? await sessionUserFromRequest(store, request) : null;
+  if (currentUser?.passwordResetRequired && !["/account/password", "/logout"].includes(pathname)) {
+    return sendRedirect(response, "/account/password?required=1");
+  }
 
   if (method === "GET" && pathname === "/login") {
     return sendHtml(response, renderLoginPage({
@@ -216,7 +222,7 @@ export async function handleRequest({ request, response, store, host, port, secu
       }), 401);
     }
     const session = await createSession(store, user.id);
-    return sendRedirect(response, "/account", {
+    return sendRedirect(response, user.passwordResetRequired ? "/account/password?required=1" : "/account", {
       "set-cookie": sessionCookie(session.token)
     });
   }
@@ -228,6 +234,61 @@ export async function handleRequest({ request, response, store, host, port, secu
     });
   }
 
+  if (method === "GET" && pathname === "/account/password") {
+    if (!currentUser) {
+      return sendRedirect(response, "/login");
+    }
+    return sendHtml(response, renderPasswordPage({
+      baseUrl,
+      user: currentUser,
+      required: currentUser.passwordResetRequired || url.searchParams.get("required") === "1",
+      locale,
+      currentPath
+    }), 200, headOnly);
+  }
+
+  if (method === "POST" && pathname === "/account/password") {
+    if (!currentUser) {
+      return sendRedirect(response, "/login");
+    }
+    const body = await readFormBody(request);
+    if (body.newPassword !== body.confirmPassword) {
+      return sendHtml(response, renderPasswordPage({
+        baseUrl,
+        user: currentUser,
+        required: currentUser.passwordResetRequired,
+        error: "New password and confirmation do not match.",
+        locale,
+        currentPath
+      }), 400);
+    }
+    try {
+      const updatedUser = await changeUserPassword(store, currentUser.id, {
+        currentPassword: body.currentPassword,
+        newPassword: body.newPassword
+      });
+      return sendHtml(response, renderPasswordPage({
+        baseUrl,
+        user: updatedUser,
+        success: "Password changed.",
+        locale,
+        currentPath
+      }));
+    } catch (error) {
+      if ((error.statusCode || 500) >= 500) {
+        throw error;
+      }
+      return sendHtml(response, renderPasswordPage({
+        baseUrl,
+        user: currentUser,
+        required: currentUser.passwordResetRequired,
+        error: error.message,
+        locale,
+        currentPath
+      }), error.statusCode || 400);
+    }
+  }
+
   if (method === "GET" && pathname === "/account") {
     if (!currentUser) {
       return sendRedirect(response, "/login");
@@ -294,11 +355,45 @@ export async function handleRequest({ request, response, store, host, port, secu
       email: body.email,
       name: body.name || body.email,
       role: body.role || "user",
-      password: body.password
+      password: body.password,
+      passwordResetRequired: body.passwordResetRequired === "on"
     });
     return sendRedirect(response, "/admin/users");
   }
 
+  if (method === "POST" && pathname === "/admin/users/import") {
+    if (!currentUser) {
+      return sendRedirect(response, "/login");
+    }
+    requireAdmin(currentUser);
+    const body = await readFormBody(request);
+    try {
+      const importResult = await importUsersFromCsv(store, body.csv || "", {
+        passwordResetRequired: true
+      });
+      return sendHtml(response, renderAdminUsersPage({
+        baseUrl,
+        user: currentUser,
+        users: await listUsers(store),
+        importResult,
+        locale,
+        currentPath: "/admin/users"
+      }));
+    } catch (error) {
+      if ((error.statusCode || 500) >= 500) {
+        throw error;
+      }
+      return sendHtml(response, renderAdminUsersPage({
+        baseUrl,
+        user: currentUser,
+        users: await listUsers(store),
+        importError: error.message,
+        locale,
+        currentPath: "/admin/users"
+      }), error.statusCode || 400);
+    }
+  }
+
   const userActiveMatch = /^\/admin\/users\/([^/]+)\/(enable|disable)$/.exec(pathname);
   if (userActiveMatch && method === "POST") {
     if (!currentUser) {