feat: admin user management API, multi-admin roles, and conditional bootstrap login #2

Open

robot wants to merge 6 commits from feature/multi-admin-roles into main

pull from: feature/multi-admin-roles

merge into: :main

:main

:feature/multi-admin-roles

Conversation 3 Commits 6 Files Changed 19

+1493 -34

6 Commits

Author	SHA1	Message	Date
Hermes Agent	f8a04dba1a	fix(ci): add frontend production build step to catch Angular build failures ... - Add 'frontend-build' job that runs 'npx ng build --configuration production' - Wire frontend-build into quality-gate dependencies - Include feature/multi-admin-roles in CI push branches - Build failures now fail the pipeline instead of being silently missed	2026-07-30 23:50:20 +00:00
Hermes Agent	c74d905378	fix(deps): add bcrypt to requirements.txt for CI test collection	2026-07-30 10:36:21 +00:00
Hermes Agent	ffbc19f16f	fix(auth): only block bootstrap login when admin users exist ... The previous check counted ALL users (func.count(User.id)), which incorrectly blocked bootstrap login if any non-admin user (e.g., Google OAuth sign-in) already existed. The fix queries specifically for admin users using the legacy is_admin flag OR the admin role assignment in user_roles. Also add tests for the non-admin-user-only scenario and fix the stale test_non_admin_user_cannot_login_as_admin assertion (401 not 403 — bootstrap path is still active when no admin exists).	2026-07-30 09:44:42 +00:00
Hermes Agent	f29640eb47	Add admin user management API and frontend UI ... Backend: - /api/admin/users: GET list, POST create, PUT update, DELETE - Admin users can be added with email, display name, and password - Self-deletion and last-admin deletion are blocked - Admin role auto-assigned on creation Frontend: - AdminUsersTabComponent: list + add/delete admin users - AdminUserService: HTTP client for admin user CRUD - AdminUser interface - 'Admins' tab added to admin dashboard Tests: - 10 new tests for admin user management endpoints - 140 total tests pass (130 original + 10 new)	2026-07-30 07:41:23 +00:00
Hermes Agent	f22802658e	feat: add conditional bootstrap login + 23 admin login tests ... - Add hash_password/verify_password to app/auth.py using bcrypt - Fix /login to reject bootstrap creds (403) when admin users exist - Add normal password-based login path for existing admin users - Eagerly load User.roles to avoid lazy-load outside async session - Fix test_user_models.py VARCHAR assertion (SQLAlchemy 2.0 uses 'string') - Use shared-cache SQLite in conftest for endpoint-level tests - Add 23 tests covering all 3 required scenarios plus edge cases: 1. Bootstrap login with hardcoded creds when no admins → PASS (200) 2. Bootstrap login with hardcoded creds when admins exist → FAIL (403) 3. Password login for existing admin with hashed password → PASS (200) - All 130 tests pass (107 existing + 23 new)	2026-07-30 06:35:52 +00:00
Hermes Agent	0eca079f28	feat: add role-based admin support for multiple admin users ... - Add Role model and user_roles association table (many-to-many) - Add password_hash column to User model (nullable, for future bcrypt) - Keep is_admin boolean for backward compatibility - Add is_admin_effective property: true if legacy is_admin OR 'admin' role - Update auth dependency (get_current_admin_user) to use is_admin_effective - Update bootstrap login to auto-create 'admin' role and assign on login - Update Google OAuth login to use is_admin_effective for token creation - Add migrate_roles.py: idempotent migration script to backfill roles - Add unit tests for Role, User, association table, and is_admin_effective	2026-07-30 04:54:30 +00:00