bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #11 from bsodfather/feat/settings-live-flow

Browse Source
This commit is contained in:
a.tolmachev
2026-03-31 08:59:00 +03:00
parent 61718bce5a 44363c0b1c
commit 3065b3100b
13 changed files with 502 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TASKS.md
+4 -5
View File
@@ -2,19 +2,18 @@
## Current
### `feat/wizard-live-flow`
### `feat/settings-live-flow`
Status: completed
DoD:
- `apps/ui/html/wizard/index.html` и `apps/ui/js/wizard.js` работают без локальных draft override-костылей
- `test run`, `publish`, `import/export`, `sample upload`, `draft generation` и `gRPC descriptor` flow подключены к live backend
- wizard для `REST`, `GraphQL` и `gRPC` использует один реальный end-to-end контракт
- `apps/ui/html/settings.html` и `apps/ui/js/settings.js` используют live backend для `profile` и `password`
- `profile` перестает читать данные из `localStorage` как source of truth
- security-block больше не притворяется готовой интеграцией там, где backend-контракта еще нет
- `test-ui` остается нетронутым как fallback
## Next
- `feat/settings-live-flow`
- `feat/workspace-access-polish`
- `feat/alpine-polish`
apps/admin-api/src/app.rs
+83 -3
View File
@@ -14,7 +14,7 @@ use crate::{
create_agent, delete_agent, get_agent, get_agent_version, list_agents, publish_agent,
save_agent_bindings, update_agent,
},
auth::{get_session, login, logout},
auth::{change_password, get_profile, get_session, login, logout, update_profile},
auth_profiles::{create_auth_profile, get_auth_profile, list_auth_profiles},
observability::{get_agent_usage, get_log, get_operation_usage, get_usage, list_logs},
operations::{
@@ -137,14 +137,23 @@ pub fn build_app(state: AppState) -> Router {
let admin_router = workspace_root_router.merge(workspace_scoped_router);
let protected_auth_router = Router::new()
.route("/logout", post(logout))
.route("/session", get(get_session))
.route("/profile", get(get_profile).patch(update_profile))
.route("/password", post(change_password))
.layer(middleware::from_fn_with_state(
state.clone(),
require_session,
));
Router::new()
.route("/health", get(crate::routes::health))
.nest(
"/api/auth",
Router::new()
.route("/login", post(login))
.route("/logout", post(logout))
.route("/session", get(get_session)),
.merge(protected_auth_router),
)
.nest("/api/admin", admin_router)
.with_state(state)
@@ -756,6 +765,77 @@ mod tests {
assert_eq!(delete_key_status, reqwest::StatusCode::NO_CONTENT);
}
#[tokio::test(flavor = "multi_thread")]
#[serial]
async fn updates_profile_and_changes_password() {
let registry = test_registry().await;
let storage_root = test_storage_root("settings_profile");
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
let root_url = base_url
.as_ref()
.split("/api/admin/workspaces/")
.next()
.unwrap()
.to_owned();
let client = authorized_client(&base_url).await;
let profile = assert_success_json(
client
.get(format!("{root_url}/api/auth/profile"))
.send()
.await
.unwrap(),
)
.await;
assert_eq!(profile["user"]["email"], TEST_AUTH_EMAIL);
let updated_profile = assert_success_json(
client
.patch(format!("{root_url}/api/auth/profile"))
.json(&json!({
"display_name": "Updated Owner",
"email": "updated-owner@crank.local"
}))
.send()
.await
.unwrap(),
)
.await;
assert_eq!(updated_profile["user"]["display_name"], "Updated Owner");
assert_eq!(
updated_profile["user"]["email"],
"updated-owner@crank.local"
);
let password_status = client
.post(format!("{root_url}/api/auth/password"))
.json(&json!({
"current_password": TEST_AUTH_PASSWORD,
"new_password": "updated-password-123"
}))
.send()
.await
.unwrap()
.status();
assert_eq!(password_status, reqwest::StatusCode::NO_CONTENT);
let relogin_client = reqwest::Client::builder()
.cookie_store(true)
.build()
.unwrap();
let relogin_status = relogin_client
.post(format!("{root_url}/api/auth/login"))
.json(&json!({
"email": "updated-owner@crank.local",
"password": "updated-password-123"
}))
.send()
.await
.unwrap()
.status();
assert_eq!(relogin_status, reqwest::StatusCode::OK);
}
#[tokio::test(flavor = "multi_thread")]
#[serial]
async fn exposes_logs_and_usage_from_real_test_runs() {
apps/admin-api/src/error.rs
+6
View File
@@ -121,6 +121,9 @@ impl From<RegistryError> for ApiError {
RegistryError::WorkspaceNotFound { workspace_id } => {
Self::not_found(format!("workspace {workspace_id} was not found"))
}
RegistryError::UserNotFound { user_id } => {
Self::not_found(format!("user {user_id} was not found"))
}
RegistryError::AgentNotFound { agent_id } => {
Self::not_found(format!("agent {agent_id} was not found"))
}
@@ -162,6 +165,9 @@ impl From<RegistryError> for ApiError {
RegistryError::WorkspaceSlugAlreadyExists { slug } => {
Self::conflict(format!("workspace with slug {slug} already exists"))
}
RegistryError::UserEmailAlreadyExists { email } => {
Self::conflict(format!("user with email {email} already exists"))
}
RegistryError::InvalidInitialVersion { .. }
| RegistryError::InvalidVersionSequence { .. }
| RegistryError::ImmutableOperationFieldChanged { .. }
apps/admin-api/src/routes/auth.rs
+36 -3
View File
@@ -1,10 +1,11 @@
use axum::{Json, extract::State, http::StatusCode, response::IntoResponse};
use axum::{Extension, Json, extract::State, http::StatusCode, response::IntoResponse};
use axum_extra::extract::cookie::CookieJar;
use serde_json::json;
use crate::{
auth::{cleared_session_cookie, extract_session_token, session_cookie},
auth::{AuthenticatedSession, cleared_session_cookie, extract_session_token, session_cookie},
error::ApiError,
service::LoginPayload,
service::{ChangePasswordPayload, LoginPayload, UpdateProfilePayload},
state::AppState,
};
@@ -50,3 +51,35 @@ pub async fn get_session(
Ok(Json(serde_json::json!(session)))
}
pub async fn get_profile(
Extension(session): Extension<AuthenticatedSession>,
) -> Result<Json<serde_json::Value>, ApiError> {
Ok(Json(
json!({ "user": session.user, "memberships": session.memberships }),
))
}
pub async fn update_profile(
State(state): State<AppState>,
Extension(session): Extension<AuthenticatedSession>,
Json(payload): Json<UpdateProfilePayload>,
) -> Result<Json<serde_json::Value>, ApiError> {
let updated = state
.service
.update_profile(&session.user.id, payload)
.await?;
Ok(Json(json!(updated)))
}
pub async fn change_password(
State(state): State<AppState>,
Extension(session): Extension<AuthenticatedSession>,
Json(payload): Json<ChangePasswordPayload>,
) -> Result<StatusCode, ApiError> {
state
.service
.change_password(&session.user.id, payload)
.await?;
Ok(StatusCode::NO_CONTENT)
}
apps/admin-api/src/service.rs
+72
View File
@@ -62,6 +62,18 @@ pub struct SessionResponse {
pub memberships: Vec<WorkspaceMembershipRecord>,
}
#[derive(Clone, Debug, Deserialize)]
pub struct UpdateProfilePayload {
pub display_name: String,
pub email: String,
}
#[derive(Clone, Debug, Deserialize)]
pub struct ChangePasswordPayload {
pub current_password: String,
pub new_password: String,
}
#[derive(Clone, Debug, Deserialize, Serialize)]
pub struct OperationPayload {
pub name: String,
@@ -627,6 +639,66 @@ impl AdminService {
}))
}
pub async fn update_profile(
&self,
user_id: &crank_core::UserId,
payload: UpdateProfilePayload,
) -> Result<SessionResponse, ApiError> {
let display_name = payload.display_name.trim();
let email = payload.email.trim().to_ascii_lowercase();
if display_name.is_empty() {
return Err(ApiError::validation("display name is required"));
}
if email.is_empty() || !email.contains('@') {
return Err(ApiError::validation("a valid email address is required"));
}
let user = self
.registry
.update_user_profile(user_id, &email, display_name)
.await?;
let memberships = self.registry.list_workspaces_for_user(user_id).await?;
Ok(SessionResponse { user, memberships })
}
pub async fn change_password(
&self,
user_id: &crank_core::UserId,
payload: ChangePasswordPayload,
) -> Result<(), ApiError> {
if payload.new_password.len() < 12 {
return Err(ApiError::validation(
"new password must be at least 12 characters long",
));
}
let user = self
.registry
.get_auth_user_by_id(user_id)
.await?
.ok_or_else(|| {
ApiError::not_found(format!("user {} was not found", user_id.as_str()))
})?;
if !verify_password(
&payload.current_password,
&self.auth_settings.password_pepper,
&user.password_hash,
) {
return Err(ApiError::unauthorized("current password is invalid"));
}
let password_hash =
hash_password(&payload.new_password, &self.auth_settings.password_pepper)?;
self.registry
.update_user_password(user_id, &password_hash)
.await?;
Ok(())
}
pub async fn get_workspace(
&self,
workspace_id: &WorkspaceId,
apps/ui/html/settings.html
+20 -51
View File
@@ -211,13 +211,13 @@
<div class="section-card-body">
<div class="avatar-upload">
<div class="avatar-large" id="profile-avatar">AT</div>
<div class="avatar-upload-actions">
<div class="avatar-name" id="profile-display-name">Operator</div>
<div class="avatar-sub" id="profile-email">operator@acme-workspace</div>
<button class="btn-secondary" type="button" style="padding:5px 12px;font-size:12.5px;">Change photo</button>
</div>
<div class="avatar-upload-actions">
<div class="avatar-name" id="profile-display-name">Operator</div>
<div class="avatar-sub" id="profile-email">operator@acme-workspace</div>
<div class="field-hint">Profile photo upload is not available yet.</div>
</div>
<div class="field-hint" style="margin-bottom:16px;">Avatar will appear in the console and team views.</div>
</div>
<div class="field-hint" style="margin-bottom:16px;">Your name and email are stored on the backend and used across the console.</div>
<div class="field-row">
<div class="field-group">
@@ -233,11 +233,12 @@
<div class="field-group">
<label class="field-label">Email address</label>
<input class="field-input" id="field-email" type="email" value="operator@acme.com" autocomplete="email">
<div class="field-hint">Changing email requires re-verification. You'll receive a confirmation link.</div>
<div class="field-hint">Changing email updates the login identity for the current account.</div>
</div>
<div class="field-hint" id="settings-profile-status" style="margin-bottom:12px;"></div>
<div style="display:flex;justify-content:flex-end;">
<button class="btn-primary" type="button">Save profile</button>
<button class="btn-primary" id="settings-profile-save-btn" type="button">Save profile</button>
</div>
</div>
</div>
@@ -442,75 +443,42 @@
<div class="section-card-body" style="padding-bottom:8px;">
<div class="field-group">
<label class="field-label">Current password</label>
<input class="field-input" type="password" placeholder="••••••••" autocomplete="current-password">
<input class="field-input" id="security-current-password" type="password" placeholder="••••••••" autocomplete="current-password">
</div>
<div class="field-row">
<div class="field-group">
<label class="field-label">New password</label>
<input class="field-input" type="password" placeholder="min. 12 characters" autocomplete="new-password">
<input class="field-input" id="security-new-password" type="password" placeholder="min. 12 characters" autocomplete="new-password">
</div>
<div class="field-group">
<label class="field-label">Confirm new password</label>
<input class="field-input" type="password" placeholder="••••••••" autocomplete="new-password">
<input class="field-input" id="security-confirm-password" type="password" placeholder="••••••••" autocomplete="new-password">
</div>
</div>
<div class="field-hint" id="settings-password-status" style="margin-bottom:12px;"></div>
<div style="display:flex;justify-content:flex-end;padding-bottom:8px;">
<button class="btn-primary" type="button">Change password</button>
<button class="btn-primary" id="settings-password-save-btn" type="button">Change password</button>
</div>
</div>
<div style="padding: 4px 20px 16px;">
<div class="settings-section-divider" style="margin-top:0;"></div>
<div style="font-size:13.5px;font-weight:600;color:var(--text-primary);margin-bottom:12px;">Two-factor authentication</div>
<div class="toggle-setting-row">
<div class="toggle-setting-text">
<div class="toggle-setting-label">TOTP authenticator app</div>
<div class="toggle-setting-desc">Use Google Authenticator, 1Password, or any TOTP-compatible app.</div>
</div>
<span class="badge badge-active" style="margin-right:8px;">Enabled</span>
<button class="btn-secondary" type="button" style="padding:5px 12px;font-size:12.5px;">Configure</button>
</div>
<div class="toggle-setting-row">
<div class="toggle-setting-text">
<div class="toggle-setting-label">Hardware security key</div>
<div class="toggle-setting-desc">FIDO2 / WebAuthn passkey or YubiKey.</div>
</div>
<button class="btn-secondary" type="button" style="padding:5px 12px;font-size:12.5px;">Add key</button>
</div>
<div style="font-size:13.5px;font-weight:600;color:var(--text-primary);margin-bottom:12px;">Advanced security</div>
<div class="field-hint" style="margin-bottom:12px;">Two-factor authentication, passkeys and session management are not implemented yet. The current live security flow is password-based login with HttpOnly session cookies.</div>
</div>
</div>
<div class="section-card" style="margin-bottom: 20px;">
<div class="section-card-header">
<div class="section-card-title">Active sessions</div>
<div class="section-card-title">Current session</div>
</div>
<div style="padding: 8px 20px 16px;">
<div class="member-row">
<div class="member-info">
<div class="member-name">Chrome · macOS — <span style="color:var(--green);font-size:12px;">current</span></div>
<div class="member-email">Last active: now · 93.184.216.34 (US)</div>
<div class="member-name">Browser session — <span style="color:var(--green);font-size:12px;">current</span></div>
<div class="member-email">Session expires according to server-side auth settings. Use Log out to revoke the current browser session.</div>
</div>
</div>
<div class="member-row">
<div class="member-info">
<div class="member-name">Safari · iPhone</div>
<div class="member-email">Last active: 2 days ago · 93.184.216.34 (US)</div>
</div>
<button class="btn-icon danger" title="Revoke session">
<svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round"><line x1="1" y1="1" x2="11" y2="11"/><line x1="11" y1="1" x2="1" y2="11"/></svg>
</button>
</div>
<div class="member-row">
<div class="member-info">
<div class="member-name">Firefox · Linux</div>
<div class="member-email">Last active: 8 days ago · 172.16.0.4 (Internal)</div>
</div>
<button class="btn-icon danger" title="Revoke session">
<svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round"><line x1="1" y1="1" x2="11" y2="11"/><line x1="11" y1="1" x2="1" y2="11"/></svg>
</button>
</div>
</div>
</div>
</div>
@@ -557,6 +525,7 @@
</div>
<div class="toggle-sm on" onclick="this.classList.toggle('on')"></div>
</div>
<div class="field-hint" style="margin-top:12px;">Notification preferences are local UI placeholders for now and are not synced to the backend yet.</div>
</div>
</div>
</div>
apps/ui/js/api.js
+17
View File
@@ -145,6 +145,23 @@
getSession: function() {
return request(AUTH_BASE + '/session');
},
getProfile: function() {
return request(AUTH_BASE + '/profile');
},
updateProfile: function(payload) {
return request(AUTH_BASE + '/profile', {
method: 'PATCH',
headers: headers({ 'Content-Type': 'application/json' }),
body: JSON.stringify(payload),
});
},
changePassword: function(payload) {
return request(AUTH_BASE + '/password', {
method: 'POST',
headers: headers({ 'Content-Type': 'application/json' }),
body: JSON.stringify(payload),
});
},
listWorkspaces: function() {
return get('/workspaces');
},
apps/ui/js/auth.js
+9 -5
View File
@@ -56,6 +56,12 @@
} catch (_error) {}
}
function replaceSession(session) {
sessionCache = session;
persistUserMirror(session);
return session;
}
async function fetchSession(force) {
if (!force && sessionCache) {
return sessionCache;
@@ -66,9 +72,7 @@
sessionPromise = window.CrankApi.getSession()
.then(function(session) {
sessionCache = session;
persistUserMirror(session);
return session;
return replaceSession(session);
})
.catch(function(error) {
clearUserMirror();
@@ -109,8 +113,7 @@
email: email,
password: password,
});
sessionCache = session;
persistUserMirror(session);
replaceSession(session);
window.location.href = homeUrl();
}
@@ -134,6 +137,7 @@
window.CrankAuth = {
fetchSession: fetchSession,
replaceSession: replaceSession,
guardProtectedPage: guardProtectedPage,
guardLoginPage: guardLoginPage,
login: login,
apps/ui/js/settings.js
+127 -17
View File
@@ -1,24 +1,132 @@
function populateProfile() {
try {
var user = JSON.parse(localStorage.getItem('crank_user'));
if (!user) {
var settingsSession = null;
function initials(displayName, email) {
var source = displayName || email || 'Crank';
return source
.split(/\s+/)
.filter(Boolean)
.slice(0, 2)
.map(function(part) { return part.charAt(0).toUpperCase(); })
.join('') || 'CR';
}
function setStatus(id, text, isError) {
var node = document.getElementById(id);
if (!node) return;
node.textContent = text || '';
node.style.color = text
? (isError ? 'var(--red)' : 'var(--green)')
: 'var(--text-muted)';
}
function populateProfile(session) {
if (!session || !session.user) {
return;
}
var user = session.user;
document.getElementById('profile-avatar').textContent = initials(user.display_name, user.email);
document.getElementById('profile-display-name').textContent = user.display_name || 'Operator';
document.getElementById('profile-email').textContent = user.email || '';
var firstName = document.getElementById('field-firstname');
var email = document.getElementById('field-email');
if (firstName) {
firstName.value = user.display_name || '';
}
if (email) {
email.value = user.email || '';
}
}
async function loadProfile() {
if (!window.CrankAuth || !window.CrankApi) {
return;
}
settingsSession = await window.CrankAuth.fetchSession(true);
populateProfile(settingsSession);
}
function bindProfileSave() {
var button = document.getElementById('settings-profile-save-btn');
if (!button || button.dataset.bound === 'true') {
return;
}
button.dataset.bound = 'true';
button.addEventListener('click', async function() {
var original = button.textContent;
button.disabled = true;
button.textContent = 'Saving…';
setStatus('settings-profile-status', '', false);
try {
var session = await window.CrankApi.updateProfile({
display_name: document.getElementById('field-firstname').value.trim(),
email: document.getElementById('field-email').value.trim(),
});
settingsSession = session;
if (window.CrankAuth && typeof window.CrankAuth.replaceSession === 'function') {
window.CrankAuth.replaceSession(session);
}
populateProfile(session);
setStatus('settings-profile-status', 'Profile saved.', false);
button.textContent = 'Saved ✓';
} catch (error) {
setStatus('settings-profile-status', error.message || 'Failed to save profile', true);
button.textContent = original;
} finally {
setTimeout(function() {
button.disabled = false;
button.textContent = original;
}, 1200);
}
});
}
function bindPasswordSave() {
var button = document.getElementById('settings-password-save-btn');
if (!button || button.dataset.bound === 'true') {
return;
}
button.dataset.bound = 'true';
button.addEventListener('click', async function() {
var currentPassword = document.getElementById('security-current-password').value;
var newPassword = document.getElementById('security-new-password').value;
var confirmPassword = document.getElementById('security-confirm-password').value;
if (newPassword !== confirmPassword) {
setStatus('settings-password-status', 'New password and confirmation do not match.', true);
return;
}
document.getElementById('profile-avatar').textContent = user.initials || 'AT';
document.getElementById('profile-display-name').textContent = user.name || 'Operator';
document.getElementById('profile-email').textContent = user.email || '';
var original = button.textContent;
button.disabled = true;
button.textContent = 'Saving…';
setStatus('settings-password-status', '', false);
var firstName = document.getElementById('field-firstname');
var email = document.getElementById('field-email');
if (firstName && user.name) {
firstName.value = user.name;
try {
await window.CrankApi.changePassword({
current_password: currentPassword,
new_password: newPassword,
});
document.getElementById('security-current-password').value = '';
document.getElementById('security-new-password').value = '';
document.getElementById('security-confirm-password').value = '';
setStatus('settings-password-status', 'Password updated.', false);
button.textContent = 'Saved ✓';
} catch (error) {
setStatus('settings-password-status', error.message || 'Failed to change password', true);
button.textContent = original;
} finally {
setTimeout(function() {
button.disabled = false;
button.textContent = original;
}, 1200);
}
if (email && user.email) {
email.value = user.email;
}
} catch (_error) {
}
});
}
function injectLanguageSwitcher() {
@@ -161,8 +269,10 @@ async function loadWorkspaceSettings() {
}
document.addEventListener('DOMContentLoaded', function () {
populateProfile();
injectLanguageSwitcher();
bindSectionNavigation();
loadProfile();
bindProfileSave();
bindPasswordSave();
loadWorkspaceSettings();
});
crates/crank-registry/src/error.rs
+4
View File
@@ -10,6 +10,10 @@ pub enum RegistryError {
WorkspaceNotFound { workspace_id: String },
#[error("workspace with slug {slug} already exists")]
WorkspaceSlugAlreadyExists { slug: String },
#[error("user {user_id} was not found")]
UserNotFound { user_id: String },
#[error("user with email {email} already exists")]
UserEmailAlreadyExists { email: String },
#[error("invitation {invitation_id} was not found")]
InvitationNotFound { invitation_id: String },
#[error("platform api key {key_id} was not found")]
crates/crank-registry/src/postgres.rs
+102 -7
View File
@@ -178,6 +178,81 @@ impl PostgresRegistry {
row.as_ref().map(map_auth_user_record).transpose()
}
pub async fn get_auth_user_by_id(
&self,
user_id: &UserId,
) -> Result<Option<AuthUserRecord>, RegistryError> {
let row = sqlx::query(
"select
id,
email,
display_name,
password_hash,
status,
to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at
from users
where id = $1
limit 1",
)
.bind(user_id.as_str())
.fetch_optional(&self.pool)
.await?;
row.as_ref().map(map_auth_user_record).transpose()
}
pub async fn update_user_profile(
&self,
user_id: &UserId,
email: &str,
display_name: &str,
) -> Result<User, RegistryError> {
let row = sqlx::query(
"update users
set email = $2,
display_name = $3
where id = $1
returning
id,
email,
display_name,
status,
to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at",
)
.bind(user_id.as_str())
.bind(email)
.bind(display_name)
.fetch_one(&self.pool)
.await
.map_err(|error| map_user_update_error(error, user_id, email))?;
map_user(&row)
}
pub async fn update_user_password(
&self,
user_id: &UserId,
password_hash: &str,
) -> Result<(), RegistryError> {
let result = sqlx::query(
"update users
set password_hash = $2
where id = $1",
)
.bind(user_id.as_str())
.bind(password_hash)
.execute(&self.pool)
.await?;
if result.rows_affected() == 0 {
return Err(RegistryError::UserNotFound {
user_id: user_id.as_str().to_owned(),
});
}
Ok(())
}
pub async fn create_user_session(
&self,
session_id: &UserSessionId,
@@ -2686,17 +2761,37 @@ fn map_membership_record(row: &PgRow) -> Result<MembershipRecord, RegistryError>
fn map_auth_user_record(row: &PgRow) -> Result<AuthUserRecord, RegistryError> {
Ok(AuthUserRecord {
user: User {
id: UserId::new(row.try_get::<String, _>("id")?),
email: row.try_get("email")?,
display_name: row.try_get("display_name")?,
status: deserialize_enum_text(&row.try_get::<String, _>("status")?, "status")?,
created_at: row.try_get("created_at")?,
},
user: map_user(row)?,
password_hash: row.try_get("password_hash")?,
})
}
fn map_user(row: &PgRow) -> Result<User, RegistryError> {
Ok(User {
id: UserId::new(row.try_get::<String, _>("id")?),
email: row.try_get("email")?,
display_name: row.try_get("display_name")?,
status: deserialize_enum_text(&row.try_get::<String, _>("status")?, "status")?,
created_at: row.try_get("created_at")?,
})
}
fn map_user_update_error(error: sqlx::Error, user_id: &UserId, email: &str) -> RegistryError {
match error {
sqlx::Error::RowNotFound => RegistryError::UserNotFound {
user_id: user_id.as_str().to_owned(),
},
sqlx::Error::Database(database_error)
if database_error.code().as_deref() == Some("23505") =>
{
RegistryError::UserEmailAlreadyExists {
email: email.to_owned(),
}
}
other => RegistryError::Storage(other),
}
}
fn map_invitation_record(row: &PgRow) -> Result<InvitationRecord, RegistryError> {
Ok(InvitationRecord {
invitation: InvitationToken {
docs/admin-api.md
+6
View File
@@ -66,12 +66,18 @@
- `POST /api/auth/login`
- `POST /api/auth/logout`
- `GET /api/auth/session`
- `GET /api/auth/profile`
- `PATCH /api/auth/profile`
- `POST /api/auth/password`
Контракт:
- `POST /login` принимает `email` и `password`;
- при успешном логине backend выставляет `HttpOnly` session cookie;
- `GET /session` возвращает текущего пользователя и memberships;
- `GET /profile` возвращает текущего пользователя и memberships для settings UI;
- `PATCH /profile` обновляет `display_name` и `email` текущего пользователя;
- `POST /password` меняет пароль текущего пользователя после проверки `current_password`;
- `POST /logout` инвалидирует текущую session.
### 5.3. Operations
docs/alpine-ui-integration-plan.md
+16 -11
View File
@@ -340,29 +340,34 @@ UI-файлы:
Что уже можно подключить:
- `GET /api/auth/session`
- `GET /api/auth/profile`
- `PATCH /api/auth/profile`
- `POST /api/auth/password`
- workspace block через `GET /api/admin/workspaces/{workspace_id}`
- `PATCH /api/admin/workspaces/{workspace_id}`
Что еще не хватает:
- current user endpoint;
- user profile update endpoint;
- preferences endpoint;
- security/auth settings model
- полноценный advanced security model (`2FA`, passkeys, session inventory);
- session-aware current workspace model вместо client-side `localStorage`.
Отдельный конфликт:
- UI считает, что у нас уже есть app-level user profile;
- backend пока не имеет session/user profile API;
- страницу стоит разбить:
- workspace settings подключать раньше;
- profile/security оставить временно mock или read-only.
- UI исторически притворялся, что `2FA`, passkeys и active sessions уже реализованы;
- backend пока дает только live `profile` и `password change`, без advanced security lifecycle;
- поэтому страница должна честно разделять:
- live `profile`;
- live `password change`;
- read-only/security roadmap блоки без fake data.
Простой итог:
- workspace block уже можно держать live;
- profile/security остаются временно mock/read-only;
- страницу целиком считать интегрированной пока нельзя.
- workspace block уже live;
- profile и password change уже live;
- notifications остаются локальным placeholder;
- страницу теперь можно считать частично интегрированной без ложных mock-сценариев.
### 4.9. Login