adapt-server 0.2.8__tar.gz → 0.3.0__tar.gz

{adapt_server-0.2.8 → adapt_server-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adapt-server
-Version: 0.2.8
+Version: 0.3.0
 Summary: Adaptive file-backed FastAPI server that turns datasets into CRUD APIs and UIs.
 Author-email: notesofcliff <notesofcliff@gmail.com>
 License-Expression: MIT
@@ -28,6 +28,7 @@ Requires-Dist: pendulum
 Requires-Dist: watchfiles
 Requires-Dist: jinja2
 Requires-Dist: openpyxl
+Requires-Dist: xlrd>=2.0.2
 Requires-Dist: markdown
 Requires-Dist: python-multipart
 Requires-Dist: mutagen
@@ -40,6 +41,7 @@ Requires-Dist: mcp<2,>=1.28
 Provides-Extra: dev
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: httpx; extra == "dev"
+Requires-Dist: httpx2; extra == "dev"
 Requires-Dist: build; extra == "dev"
 Requires-Dist: twine; extra == "dev"
 Dynamic: license-file
@@ -48,7 +50,8 @@ Dynamic: license-file
 
 Adapt is a FastAPI server that turns files in a directory into APIs and UIs.
 
-- Datasets (`.csv`, `.xlsx`, `.parquet`) become CRUD endpoints and DataTables UIs
+- Datasets (`.csv`, `.xlsx`, `.xls`, `.parquet`) become API endpoints and DataTables UIs
+- Legacy `.xls` workbooks are read-only. Modern `.xlsx` workbooks support CRUD operations.
 - Markdown/HTML become browsable pages
 - Media files become streaming endpoints and player/gallery UIs
 - Python files can register custom routers
@@ -71,6 +74,9 @@ adapt admin create-permissions /path/to/docroot __all__
 # Create a regular user
 adapt admin create-user --username editor --password secret /path/to/docroot
 
+# Reset an existing password and revoke that user's browser sessions
+adapt admin change-password --username editor /path/to/docroot
+
 # By default, the editor user has no permissions.
 # See available groups (created by `adapt admin create-permissions`) and assign user to desired group
 adapt admin list-groups /path/to/docroot
@@ -116,16 +122,17 @@ This reflects the current implementation in the codebase.
 
 ### In Place
 
-- **Authentication:** session cookies and API keys (`X-API-Key`)
+- **Authentication:** session cookies, API keys (`X-API-Key`), and inactive-user enforcement
 - **Authorization:** RBAC (users, groups, permissions), plus superuser bypass
 - **Password security:** PBKDF2 hashing with per-user salts
+- **Password changes:** self-service and administrator resets revoke all browser sessions for the user
 - **Session security:** expiration enforcement, sliding renewal, cleanup task
 - **CSRF protection:** enforced for cookie-authenticated unsafe methods (`POST/PUT/PATCH/DELETE`), including mixed session + API-key requests
 - **Redirect hardening:** login `next` paths are validated as local relative paths
 - **Response hardening:** CSP, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`, HSTS (when TLS is enabled)
 - **Host header hardening:** Trusted Host middleware
 - **Data integrity:** lock-based, atomic writes for mutable dataset plugins
-- **Auditability:** admin/audit logging for security-relevant actions
+- **Auditability:** audit records for authentication, administration, and successful dataset mutations
 - **Sensitive response cleanup:** admin user APIs no longer expose `password_hash`
 
 ### Important Deployment Notes
@@ -202,11 +209,12 @@ claude mcp add --transport http adapt http://localhost:8000/mcp \
 }
 ```
 
-MCP requires an API key on every call — there's no session-cookie or
-anonymous path, since MCP has no concept of a browser session. Set
+MCP checks authentication when a tool runs. Tool calls use the shared
+authentication resolver, which accepts a session cookie or an API key. API
+keys are the supported and recommended mechanism for MCP clients. Set
 `mcp_enabled: false` in `.adapt/conf.json` (or `ADAPT_MCP_ENABLED=false`) to
-remove `/mcp` entirely. Full walkthrough, troubleshooting, and the tool
-reference table: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md).
+remove `/mcp` entirely. For setup and troubleshooting, read the
+[MCP guide](docs/manual/mcp_guide.md).
 For dataset reads, `sort` is the column name and `order` must be `asc` or
 `desc`.
 
@@ -235,6 +243,9 @@ adapt admin list-resources <root>
 adapt admin create-permissions <root> __all__
 ```
 
+Use `--reload` during development. Uvicorn watches Python files in the document
+root and restarts Adapt after a change.
+
 ## Documentation
 
 Detailed docs live under `docs/manual/`.
@@ -246,6 +257,7 @@ Detailed docs live under `docs/manual/`.
 - API reference: [docs/manual/api_reference.md](docs/manual/api_reference.md)
 - MCP guide: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md)
 - Plugin development: [docs/manual/plugin_development.md](docs/manual/plugin_development.md)
+- Known limitations: [docs/manual/known_limitations.md](docs/manual/known_limitations.md)
 
 ## License
 

{adapt_server-0.2.8 → adapt_server-0.3.0}/README.md

@@ -2,7 +2,8 @@
 
 Adapt is a FastAPI server that turns files in a directory into APIs and UIs.
 
-- Datasets (`.csv`, `.xlsx`, `.parquet`) become CRUD endpoints and DataTables UIs
+- Datasets (`.csv`, `.xlsx`, `.xls`, `.parquet`) become API endpoints and DataTables UIs
+- Legacy `.xls` workbooks are read-only. Modern `.xlsx` workbooks support CRUD operations.
 - Markdown/HTML become browsable pages
 - Media files become streaming endpoints and player/gallery UIs
 - Python files can register custom routers
@@ -25,6 +26,9 @@ adapt admin create-permissions /path/to/docroot __all__
 # Create a regular user
 adapt admin create-user --username editor --password secret /path/to/docroot
 
+# Reset an existing password and revoke that user's browser sessions
+adapt admin change-password --username editor /path/to/docroot
+
 # By default, the editor user has no permissions.
 # See available groups (created by `adapt admin create-permissions`) and assign user to desired group
 adapt admin list-groups /path/to/docroot
@@ -70,16 +74,17 @@ This reflects the current implementation in the codebase.
 
 ### In Place
 
-- **Authentication:** session cookies and API keys (`X-API-Key`)
+- **Authentication:** session cookies, API keys (`X-API-Key`), and inactive-user enforcement
 - **Authorization:** RBAC (users, groups, permissions), plus superuser bypass
 - **Password security:** PBKDF2 hashing with per-user salts
+- **Password changes:** self-service and administrator resets revoke all browser sessions for the user
 - **Session security:** expiration enforcement, sliding renewal, cleanup task
 - **CSRF protection:** enforced for cookie-authenticated unsafe methods (`POST/PUT/PATCH/DELETE`), including mixed session + API-key requests
 - **Redirect hardening:** login `next` paths are validated as local relative paths
 - **Response hardening:** CSP, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`, HSTS (when TLS is enabled)
 - **Host header hardening:** Trusted Host middleware
 - **Data integrity:** lock-based, atomic writes for mutable dataset plugins
-- **Auditability:** admin/audit logging for security-relevant actions
+- **Auditability:** audit records for authentication, administration, and successful dataset mutations
 - **Sensitive response cleanup:** admin user APIs no longer expose `password_hash`
 
 ### Important Deployment Notes
@@ -156,11 +161,12 @@ claude mcp add --transport http adapt http://localhost:8000/mcp \
 }
 ```
 
-MCP requires an API key on every call — there's no session-cookie or
-anonymous path, since MCP has no concept of a browser session. Set
+MCP checks authentication when a tool runs. Tool calls use the shared
+authentication resolver, which accepts a session cookie or an API key. API
+keys are the supported and recommended mechanism for MCP clients. Set
 `mcp_enabled: false` in `.adapt/conf.json` (or `ADAPT_MCP_ENABLED=false`) to
-remove `/mcp` entirely. Full walkthrough, troubleshooting, and the tool
-reference table: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md).
+remove `/mcp` entirely. For setup and troubleshooting, read the
+[MCP guide](docs/manual/mcp_guide.md).
 For dataset reads, `sort` is the column name and `order` must be `asc` or
 `desc`.
 
@@ -189,6 +195,9 @@ adapt admin list-resources <root>
 adapt admin create-permissions <root> __all__
 ```
 
+Use `--reload` during development. Uvicorn watches Python files in the document
+root and restarts Adapt after a change.
+
 ## Documentation
 
 Detailed docs live under `docs/manual/`.
@@ -200,6 +209,7 @@ Detailed docs live under `docs/manual/`.
 - API reference: [docs/manual/api_reference.md](docs/manual/api_reference.md)
 - MCP guide: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md)
 - Plugin development: [docs/manual/plugin_development.md](docs/manual/plugin_development.md)
+- Known limitations: [docs/manual/known_limitations.md](docs/manual/known_limitations.md)
 
 ## License
 

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/__init__.py

@@ -1,3 +1,3 @@
 """Adapt package namespace."""
 
-__version__ = "0.2.8"
+__version__ = "0.3.0"

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/admin/models.py

@@ -11,6 +11,16 @@ class UserCreate(BaseModel):
     password: str
     is_superuser: bool = False
 
+
+class PasswordReset(BaseModel):
+    """Model for replacing a user's password."""
+    new_password: str
+
+
+class UserStatusUpdate(BaseModel):
+    """Model for activating or deactivating a user."""
+    is_active: bool
+
 class GroupCreate(BaseModel):
     """Model for creating a new group."""
     name: str
@@ -52,4 +62,4 @@ class APIKeyCreate(BaseModel):
     """Model for creating a new API key."""
     user_id: int
     description: Optional[str] = None
-    expires_in_days: Optional[int] = None
+    expires_in_days: Optional[int] = None

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/admin/users.py

@@ -6,11 +6,14 @@ from fastapi import Depends, HTTPException, Request, Query
 from sqlmodel import Session, select
 
 from ..auth import require_superuser, hash_password
+from ..auth.password import update_password
+from ..commands.passwords import is_weak_password
 from ..storage import User, get_db_session
+from ..users import set_user_active
 from ..utils.query import apply_filter, apply_sort, apply_pagination
 from ..audit import log_action
 from . import router
-from .models import UserCreate, UserPublic
+from .models import PasswordReset, UserCreate, UserPublic, UserStatusUpdate
 
 logger = logging.getLogger(__name__)
 
@@ -103,6 +106,66 @@ def create_user(user_data: UserCreate, request: Request, db: Session = Depends(g
         created_at=new_user.created_at,
     )
 
+
+@router.put("/users/{user_id}/password")
+def reset_user_password(
+    user_id: int,
+    password_data: PasswordReset,
+    request: Request,
+    db: Session = Depends(get_db_session),
+    user: User = Depends(require_superuser),
+):
+    """Replace a user's password and revoke their browser sessions."""
+    if request.app.state.config.readonly:
+        raise HTTPException(status_code=405, detail="Server is in read-only mode")
+
+    target = db.get(User, user_id)
+    if not target:
+        raise HTTPException(status_code=404, detail="User not found")
+    if is_weak_password(password_data.new_password, username=target.username):
+        raise HTTPException(status_code=400, detail="New password is too weak")
+
+    update_password(db, target, password_data.new_password)
+    log_action(
+        request,
+        "reset_password",
+        "user",
+        f"Reset password for user {target.username}",
+        user.id,
+    )
+    logger.info("User %s reset the password for user %s", user.username, target.username)
+    return {"success": True, "sessions_revoked": True}
+
+
+@router.put("/users/{user_id}/status")
+def update_user_status(
+    user_id: int,
+    status_data: UserStatusUpdate,
+    request: Request,
+    db: Session = Depends(get_db_session),
+    user: User = Depends(require_superuser),
+):
+    """Activate or deactivate a user account."""
+    if request.app.state.config.readonly:
+        raise HTTPException(status_code=405, detail="Server is in read-only mode")
+
+    target = db.get(User, user_id)
+    if not target:
+        raise HTTPException(status_code=404, detail="User not found")
+    if target.id == user.id and not status_data.is_active:
+        raise HTTPException(status_code=400, detail="Cannot deactivate yourself")
+
+    revoked_sessions = set_user_active(db, target, status_data.is_active)
+    action = "activate_user" if status_data.is_active else "deactivate_user"
+    state = "Activated" if status_data.is_active else "Deactivated"
+    log_action(request, action, "user", f"{state} user {target.username}", user.id)
+    logger.info("%s user %s by %s", state, target.username, user.username)
+    return {
+        "success": True,
+        "is_active": target.is_active,
+        "sessions_revoked": revoked_sessions,
+    }
+
 @router.delete("/users/{user_id}")
 def delete_user(user_id: int, request: Request, db: Session = Depends(get_db_session), user: User = Depends(require_superuser)):
     """Delete a user by ID."""
@@ -124,4 +187,4 @@ def delete_user(user_id: int, request: Request, db: Session = Depends(get_db_ses
     log_action(request, "delete_user", "user", f"Deleted user {target.username}", user.id)
     logger.info("Deleted user %s", target.username)
     
-    return {"success": True}
+    return {"success": True}

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/api_keys.py

@@ -41,6 +41,11 @@ def verify_api_key(db: Session, raw_key: str) -> User | None:
     if not api_key.is_active:
         logger.warning("API key verification failed: key is inactive")
         return None
+
+    user = db.get(User, api_key.user_id)
+    if not user or not user.is_active:
+        logger.warning("API key verification failed: user is inactive or missing")
+        return None
         
     # Check expiration
     if api_key.expires_at:
@@ -59,7 +64,7 @@ def verify_api_key(db: Session, raw_key: str) -> User | None:
     db.commit()
     
     logger.info(f"API key verified successfully for user {api_key.user_id}")
-    return db.get(User, api_key.user_id)
+    return user
 
 def create_api_key_record(
     db: Session,

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/audit.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 
 import logging
 from datetime import datetime, timezone
+from sqlalchemy.engine import Engine
 from sqlmodel import Session
 from fastapi import Request
 
@@ -16,12 +17,14 @@ def log_action(
     action: str,
     resource: str | None = None,
     details: str | None = None,
-    user_id: int | None = None
+    user_id: int | None = None,
+    engine: Engine | None = None,
 ):
     """Log an action to the audit log."""
     logger.debug(f"Logging action: {action} on {resource}")
     try:
-        engine = request.app.state.db_engine
+        if engine is None:
+            engine = request.app.state.db_engine
         
         # Try to get user_id from request state if not provided
         if user_id is None:

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/auth/dependencies.py

@@ -96,15 +96,16 @@ def permission_dependency(action_param: str, resource: str):
         with Session(request.app.state.db_engine) as db:
             try:
                 if not check_permission(user, db, action, resource):
-                     logger.warning("Permission denied for user %s: %s on %s", user.username, action, resource)
-                     raise HTTPException(
+                    logger.warning("Permission denied for user %s: %s on %s", user.username, action, resource)
+                    raise HTTPException(
                         status_code=status.HTTP_403_FORBIDDEN, 
                         detail=f"Permission denied: {action} on {resource}"
                     )
+                request.state.user = user
                 db.commit()  # Commit if successful
                 logger.debug("Permission granted for user %s: %s on %s", user.username, action, resource)
                 return user
             except Exception:
                 db.rollback()  # Rollback on error
                 raise
-    return check
+    return check

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/auth/password.py

@@ -2,6 +2,10 @@ import secrets
 import hashlib
 import logging
 
+from sqlmodel import Session, delete
+
+from ..storage import DBSession, User
+
 logger = logging.getLogger(__name__)
 
 def hash_password(password: str) -> str:
@@ -21,4 +25,13 @@ def verify_password(password: str, hashed: str) -> bool:
     new_digest = hashlib.pbkdf2_hmac("sha256", password.encode(), salt.encode(), 100_000).hex()
     result = secrets.compare_digest(new_digest, digest)
     logger.debug("Password verification %s", "successful" if result else "failed")
-    return result
+    return result
+
+
+def update_password(db: Session, user: User, password: str) -> None:
+    """Replace a user's password and revoke all of their browser sessions."""
+    user.password_hash = hash_password(password)
+    db.add(user)
+    db.exec(delete(DBSession).where(DBSession.user_id == user.id))
+    db.commit()
+    logger.info("Updated password and revoked sessions for user %s", user.username)

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/auth/routes.py

@@ -9,7 +9,8 @@ from ..storage import User, DBSession, APIKey, get_db_session
 from ..audit import log_action
 from ..api_keys import create_api_key_record, revoke_api_key_record
 from ..utils import build_accessible_ui_links
-from .password import verify_password
+from .password import update_password, verify_password
+from ..commands.passwords import is_weak_password
 from .session import create_session, SESSION_COOKIE
 from .dependencies import require_auth
 from . import router
@@ -20,6 +21,11 @@ class APIKeyCreateRequest(BaseModel):
     description: str | None = None
     expires_in_days: int | None = None
 
+
+class PasswordChangeRequest(BaseModel):
+    current_password: str
+    new_password: str
+
 @router.get("/auth/login")
 def login_page(request: Request):
     """Render the login page."""
@@ -35,7 +41,7 @@ def login(form: OAuth2PasswordRequestForm = Depends(), request: Request = None,
     with Session(db_engine) as db:
         stmt = select(User).where(User.username == form.username)
         user = db.exec(stmt).first()
-        if not user or not verify_password(form.password, user.password_hash):
+        if not user or not user.is_active or not verify_password(form.password, user.password_hash):
             logger.warning("Failed login attempt for username %s", form.username)
             raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
         token = create_session(db, user.id)
@@ -89,7 +95,31 @@ def profile_page(request: Request, user: User = Depends(require_auth)):
 def me(user: User = Depends(require_auth)):
     """Get current user information."""
     logger.debug("User %s requested their info", user.username)
-    return {"username": user.username, "is_superuser": getattr(user, "is_superuser", False)}
+    return {"id": user.id, "username": user.username, "is_superuser": getattr(user, "is_superuser", False)}
+
+
+@router.put("/auth/password")
+def change_password(
+    password_data: PasswordChangeRequest,
+    request: Request,
+    response: Response,
+    user: User = Depends(require_auth),
+    db: Session = Depends(get_db_session),
+):
+    """Change the current user's password and revoke their browser sessions."""
+    if request.app.state.config.readonly:
+        raise HTTPException(status_code=405, detail="Server is in read-only mode")
+    if not verify_password(password_data.current_password, user.password_hash):
+        raise HTTPException(status_code=400, detail="Current password is incorrect")
+    if verify_password(password_data.new_password, user.password_hash):
+        raise HTTPException(status_code=400, detail="New password must be different")
+    if is_weak_password(password_data.new_password, username=user.username):
+        raise HTTPException(status_code=400, detail="New password is too weak")
+
+    update_password(db, user, password_data.new_password)
+    log_action(request, "change_password", "auth", "User changed password", user.id)
+    response.delete_cookie(key=SESSION_COOKIE)
+    return {"message": "Password changed. Sign in again."}
 
 
 @router.post("/api/apikeys", status_code=201)
@@ -165,4 +195,4 @@ def revoke_api_key(
         raise HTTPException(status_code=404, detail="API key not found")
 
     log_action(req, "revoke_api_key", "apikey", f"Revoked API key {key_id} for user {user.username}", user.id)
-    logger.info("User %s revoked API key %d", user.username, key_id)
+    logger.info("User %s revoked API key %d", user.username, key_id)

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/auth/session.py

@@ -4,7 +4,7 @@ from datetime import datetime, timedelta, timezone
 from sqlmodel import Session, select
 import logging
 
-from ..storage import DBSession
+from ..storage import DBSession, User
 
 logger = logging.getLogger(__name__)
 
@@ -33,8 +33,10 @@ def get_session(db: Session, token: str) -> DBSession | None:
     now = datetime.now(tz=timezone.utc)
     stmt = (
         select(DBSession)
+        .join(User, User.id == DBSession.user_id)
         .where(DBSession.token == token)
         .where(DBSession.expires_at > now)  # Enforce expiration
+        .where(User.is_active == True)  # noqa: E712 - SQL expression
     )
     session = db.exec(stmt).first()
     
@@ -50,4 +52,4 @@ def get_session(db: Session, token: str) -> DBSession | None:
         hmac.new(b"dummy_key", token.encode(), "sha256").digest()
         logger.debug("Session not found or expired for token")
     
-    return session
+    return session

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/cli.py

@@ -43,7 +43,7 @@ def main() -> None:
         help="Allow a weak password without the safety confirmation prompt",
     )
 
-    list_parser = subparsers.add_parser("list-endpoints", help="List the auto-generated REST/UI endpoints")
+    list_parser = subparsers.add_parser("list-endpoints", help="List generated resource endpoints")
     list_parser.add_argument("root", nargs="?", default=".", help="Document root to inspect")
 
     reindex_parser = subparsers.add_parser("reindex", help="Rebuild the full-text search index")
@@ -83,6 +83,25 @@ def main() -> None:
     admin_delete_user_parser.add_argument("root", nargs="?", default=".", help="Document root")
     admin_delete_user_parser.add_argument("--username", required=True, help="Username")
 
+    admin_change_password_parser = admin_subparsers.add_parser("change-password", help="Change a user password")
+    admin_change_password_parser.add_argument("root", nargs="?", default=".", help="Document root")
+    admin_change_password_parser.add_argument("--username", required=True, help="Username")
+    admin_change_password_parser.add_argument("--password", help="New password (will prompt if missing)")
+    admin_change_password_parser.add_argument("--password-confirm", help="Password confirmation for non-interactive use")
+    admin_change_password_parser.add_argument(
+        "--allow-weak-password",
+        action="store_true",
+        help="Allow a weak password without the safety confirmation prompt",
+    )
+
+    admin_activate_user_parser = admin_subparsers.add_parser("activate-user", help="Activate a user")
+    admin_activate_user_parser.add_argument("root", nargs="?", default=".", help="Document root")
+    admin_activate_user_parser.add_argument("--username", required=True, help="Username")
+
+    admin_deactivate_user_parser = admin_subparsers.add_parser("deactivate-user", help="Deactivate a user")
+    admin_deactivate_user_parser.add_argument("root", nargs="?", default=".", help="Document root")
+    admin_deactivate_user_parser.add_argument("--username", required=True, help="Username")
+
     admin_create_group_parser = admin_subparsers.add_parser("create-group", help="Create group")
     admin_create_group_parser.add_argument("root", nargs="?", default=".", help="Document root")
     admin_create_group_parser.add_argument("--name", required=True, help="Group name")

{adapt_server-0.2.8 → adapt_server-0.3.0}/adapt/commands/admin/__init__.py

@@ -8,6 +8,8 @@ from .list_groups import run_list_groups
 from .list_users import run_list_users
 from .create_user import run_create_user
 from .delete_user import run_delete_user
+from .change_password import run_change_password
+from .set_user_active import run_set_user_active
 from .create_group import run_create_group
 from .delete_group import run_delete_group
 from .add_to_group import run_add_to_group
@@ -58,6 +60,19 @@ def run_admin(args):
     elif args.admin_command == "delete-user":
         logger.debug("Running admin command: delete-user for username=%s", args.username)
         run_delete_user(Path(args.root).resolve(), args.username)
+    elif args.admin_command == "change-password":
+        logger.debug("Running admin command: change-password for username=%s", args.username)
+        run_change_password(
+            root=Path(args.root).resolve(),
+            username=args.username,
+            password=args.password,
+            password_confirm=args.password_confirm,
+            allow_weak_password=args.allow_weak_password,
+        )
+    elif args.admin_command in ("activate-user", "deactivate-user"):
+        is_active = args.admin_command == "activate-user"
+        logger.debug("Running admin command: %s for username=%s", args.admin_command, args.username)
+        run_set_user_active(Path(args.root).resolve(), args.username, is_active)
     elif args.admin_command == "create-group":
         logger.debug("Running admin command: create-group for name=%s", args.name)
         run_create_group(Path(args.root).resolve(), args.name, args.description)

adapt_server-0.3.0/adapt/commands/admin/change_password.py

@@ -0,0 +1,43 @@
+from pathlib import Path
+import logging
+
+from sqlmodel import Session, select
+
+from ...auth.password import update_password
+from ...config import AdaptConfig
+from ...storage import User, init_database
+from ..passwords import resolve_password
+
+logger = logging.getLogger(__name__)
+
+
+def run_change_password(
+    root: Path,
+    username: str,
+    password: str | None,
+    password_confirm: str | None = None,
+    allow_weak_password: bool = False,
+) -> None:
+    """Change a user password and revoke all browser sessions."""
+    config = AdaptConfig(root=root)
+    engine = init_database(config.db_path)
+
+    password = resolve_password(
+        username=username,
+        password=password,
+        password_confirm=password_confirm,
+        allow_weak_password=allow_weak_password,
+    )
+    if password is None:
+        logger.warning("Aborted password change for %s due to password validation", username)
+        return
+
+    with Session(engine) as db:
+        user = db.exec(select(User).where(User.username == username)).first()
+        if not user:
+            logger.warning("User '%s' not found", username)
+            print(f"User '{username}' not found")
+            return
+        update_password(db, user, password)
+
+    print(f"Changed password for user '{username}' and revoked all browser sessions")

adapt_server-0.3.0/adapt/commands/admin/set_user_active.py

@@ -0,0 +1,32 @@
+from pathlib import Path
+import logging
+
+from sqlmodel import Session, select
+
+from ...config import AdaptConfig
+from ...storage import User, init_database
+from ...users import set_user_active
+
+logger = logging.getLogger(__name__)
+
+
+def run_set_user_active(root: Path, username: str, is_active: bool) -> None:
+    """Activate or deactivate a user account by username."""
+    config = AdaptConfig(root=root)
+    engine = init_database(config.db_path)
+
+    with Session(engine) as db:
+        user = db.exec(select(User).where(User.username == username)).first()
+        if not user:
+            logger.warning("User '%s' not found", username)
+            print(f"User '{username}' not found")
+            return
+
+        revoked_sessions = set_user_active(db, user, is_active)
+
+    status = "Activated" if is_active else "Deactivated"
+    logger.info("%s user '%s'", status, username)
+    if is_active:
+        print(f"Activated user '{username}'")
+    else:
+        print(f"Deactivated user '{username}' and revoked {revoked_sessions} browser session(s)")