Add local account management controls - #978
Open
CoderLuii wants to merge 1 commit into
Open
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds local account settings with logout and password change controls, a change-password API and service flow, active-user persistence operations, and JWT token-generation rotation that invalidates prior sessions. ChangesAccount Settings and Change Password
Sequence Diagram(s)sequenceDiagram
participant AccountSettingsTab
participant AuthContext
participant AuthRoute
participant AuthService
participant UserDb
participant AppConfigDb
AccountSettingsTab->>AuthContext: Submit current and new passwords
AuthContext->>AuthRoute: POST /api/auth/change-password
AuthRoute->>AuthService: Validate and change password
AuthService->>UserDb: Read user and update password hash
AuthService->>AppConfigDb: Store new token generation
AuthService-->>AuthContext: Return success or error
AuthContext-->>AccountSettingsTab: Clear session or display error
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
server/routes/auth.js (1)
38-40: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueMessage text drifts from
PASSWORD_MIN_LENGTH.The validations use
PASSWORD_MIN_LENGTH, but the error strings hardcode"6 characters"(Line 39 and Line 148). If the constant changes, the messages will be misleading. Consider interpolating the constant.♻️ Interpolate the constant
- return res.status(400).json({ error: 'New password must be at least 6 characters' }); + return res.status(400).json({ error: `New password must be at least ${PASSWORD_MIN_LENGTH} characters` });Line 39 (registration) can be updated similarly.
Also applies to: 147-149
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/routes/auth.js` around lines 38 - 40, The validation error messages in the auth flow are hardcoding the password length instead of reflecting PASSWORD_MIN_LENGTH. Update the response strings in the registration and related checks within auth.js to interpolate PASSWORD_MIN_LENGTH so the message stays aligned with the actual validation logic. Use the existing validation branches around the username/password checks and keep the wording consistent across both occurrences.src/components/settings/view/tabs/AccountSettingsTab.tsx (1)
28-30: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winReuse a shared minimum-length constant instead of hardcoding
6.The length check and its message hardcode
6, while the server validates againstPASSWORD_MIN_LENGTH(server/routes/auth.js). If that constant changes, this client validation and copy silently drift out of sync. Consider importing/deriving a shared constant and interpolating it into the message.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/components/settings/view/tabs/AccountSettingsTab.tsx` around lines 28 - 30, The password validation in AccountSettingsTab is hardcoding the minimum length, which can drift from the server’s PASSWORD_MIN_LENGTH. Update the logic in the validation flow that checks formState.newPassword so it uses a shared minimum-length constant instead of a literal 6, and make the returned error message interpolate that same constant. Keep the client-side check and copy aligned with the server-side password rule.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/settings/types/types.ts`:
- Line 6: The settings tab normalization is missing the new 'account' tab, so
URL/command-palette navigation falls back to 'agents' instead of opening
account. Update the KNOWN_MAIN_TABS array in useSettingsController.ts to include
'account' so normalizeMainTab recognizes it, and keep it aligned with the
SettingsMainTab union in types.ts.
In `@src/components/settings/view/tabs/AccountSettingsTab.tsx`:
- Around line 153-157: The error message in AccountSettingsTab is only visible
and not announced to assistive tech. Update the error container rendered in the
error && block to use an alert announcement pattern, such as adding role="alert"
or an appropriate aria-live region, so validation and submission failures are
surfaced by screen readers. Keep the change localized to the error UI in
AccountSettingsTab.
---
Nitpick comments:
In `@server/routes/auth.js`:
- Around line 38-40: The validation error messages in the auth flow are
hardcoding the password length instead of reflecting PASSWORD_MIN_LENGTH. Update
the response strings in the registration and related checks within auth.js to
interpolate PASSWORD_MIN_LENGTH so the message stays aligned with the actual
validation logic. Use the existing validation branches around the
username/password checks and keep the wording consistent across both
occurrences.
In `@src/components/settings/view/tabs/AccountSettingsTab.tsx`:
- Around line 28-30: The password validation in AccountSettingsTab is hardcoding
the minimum length, which can drift from the server’s PASSWORD_MIN_LENGTH.
Update the logic in the validation flow that checks formState.newPassword so it
uses a shared minimum-length constant instead of a literal 6, and make the
returned error message interpolate that same constant. Keep the client-side
check and copy aligned with the server-side password rule.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 8d89ef01-1cf3-4fa2-927e-8de224179af0
📒 Files selected for processing (13)
server/middleware/auth.jsserver/modules/database/repositories/app-config.tsserver/modules/database/repositories/users.tsserver/routes/auth.jssrc/components/auth/context/AuthContext.tsxsrc/components/auth/types.tssrc/components/settings/constants/constants.tssrc/components/settings/types/types.tssrc/components/settings/view/Settings.tsxsrc/components/settings/view/SettingsMainTabs.tsxsrc/components/settings/view/SettingsSidebar.tsxsrc/components/settings/view/tabs/AccountSettingsTab.tsxsrc/utils/api.js
CoderLuii
force-pushed
the
agent/local-account-management
branch
from
July 29, 2026 17:06
60c9003 to
14218c5
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
src/components/settings/hooks/useSettingsController.test.ts (1)
5-9: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winReplace source-text assertions with behavioral tests. Both tests can pass while the corresponding runtime behavior is broken because they only search for string literals and markup in source files.
src/components/settings/hooks/useSettingsController.test.ts#L5-L9: executenormalizeMainTab('account')and assert it returns'account'.src/components/settings/view/tabs/AccountSettingsTab.test.ts#L5-L15: render and submit the form, then assert validation and accessible error announcements through the user-visible DOM.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/components/settings/hooks/useSettingsController.test.ts` around lines 5 - 9, Replace the source-text assertion in src/components/settings/hooks/useSettingsController.test.ts lines 5-9 with a behavioral test that calls normalizeMainTab('account') and asserts it returns 'account'. In src/components/settings/view/tabs/AccountSettingsTab.test.ts lines 5-15, replace source inspection with a rendered form submission test that verifies validation messages and accessible error announcements through the user-visible DOM.server/routes/auth.account-management.test.js (1)
5-8: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftTest the route behavior instead of source text.
This passes even if password verification, hash persistence, or token rotation is broken. Add route-level tests for successful change, wrong current password, validation failures, platform mode, and generation rotation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/routes/auth.account-management.test.js` around lines 5 - 8, Replace the source-text assertion in the registration/password-change test with route-level tests exercising the auth account-management handlers. Cover successful password changes, rejection of an incorrect current password, validation failures, platform-mode behavior, and generation/token rotation, verifying persisted hashes and issued or invalidated tokens where applicable.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/settings/view/tabs/AccountSettingsTab.tsx`:
- Around line 62-71: Update the password-save flow around changePassword so
rejected promises are handled and setIsSaving(false) always executes via a
finally block. Preserve the existing unsuccessful-result error handling and
successful form reset behavior, while ensuring the saving state is cleared for
both resolved and rejected requests.
---
Nitpick comments:
In `@server/routes/auth.account-management.test.js`:
- Around line 5-8: Replace the source-text assertion in the
registration/password-change test with route-level tests exercising the auth
account-management handlers. Cover successful password changes, rejection of an
incorrect current password, validation failures, platform-mode behavior, and
generation/token rotation, verifying persisted hashes and issued or invalidated
tokens where applicable.
In `@src/components/settings/hooks/useSettingsController.test.ts`:
- Around line 5-9: Replace the source-text assertion in
src/components/settings/hooks/useSettingsController.test.ts lines 5-9 with a
behavioral test that calls normalizeMainTab('account') and asserts it returns
'account'. In src/components/settings/view/tabs/AccountSettingsTab.test.ts lines
5-15, replace source inspection with a rendered form submission test that
verifies validation messages and accessible error announcements through the
user-visible DOM.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 83ac9376-eae2-4d32-bdb5-a7be7da3c82e
📒 Files selected for processing (17)
server/middleware/auth.jsserver/modules/database/repositories/app-config.tsserver/modules/database/repositories/users.tsserver/routes/auth.account-management.test.jsserver/routes/auth.jssrc/components/auth/context/AuthContext.tsxsrc/components/auth/types.tssrc/components/settings/constants/constants.tssrc/components/settings/hooks/useSettingsController.test.tssrc/components/settings/hooks/useSettingsController.tssrc/components/settings/types/types.tssrc/components/settings/view/Settings.tsxsrc/components/settings/view/SettingsMainTabs.tsxsrc/components/settings/view/SettingsSidebar.tsxsrc/components/settings/view/tabs/AccountSettingsTab.test.tssrc/components/settings/view/tabs/AccountSettingsTab.tsxsrc/utils/api.js
🚧 Files skipped from review as they are similar to previous changes (9)
- src/components/auth/types.ts
- src/components/settings/view/Settings.tsx
- server/middleware/auth.js
- src/components/settings/view/SettingsMainTabs.tsx
- server/modules/database/repositories/users.ts
- src/utils/api.js
- src/components/auth/context/AuthContext.tsx
- src/components/settings/view/SettingsSidebar.tsx
- server/modules/database/repositories/app-config.ts
CoderLuii
force-pushed
the
agent/local-account-management
branch
from
July 29, 2026 18:45
14218c5 to
7faf587
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/settings/hooks/normalizeMainTab.ts`:
- Line 3: Update the KNOWN_MAIN_TABS allowlist to include the existing 'voice'
SettingsMainTab value, and extend the normalizeMainTab test coverage to verify
that 'voice' remains unchanged instead of normalizing to 'agents'.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c4730149-77f8-4b0b-9753-018f790493d5
📒 Files selected for processing (20)
server/middleware/auth.jsserver/modules/database/repositories/app-config.tsserver/modules/database/repositories/users.tsserver/routes/auth.account-management.platform.test.jsserver/routes/auth.account-management.test.jsserver/routes/auth.jssrc/components/auth/context/AuthContext.tsxsrc/components/auth/types.tssrc/components/settings/constants/constants.tssrc/components/settings/hooks/normalizeMainTab.tssrc/components/settings/hooks/useSettingsController.test.tssrc/components/settings/hooks/useSettingsController.tssrc/components/settings/types/types.tssrc/components/settings/view/Settings.tsxsrc/components/settings/view/SettingsMainTabs.tsxsrc/components/settings/view/SettingsSidebar.tsxsrc/components/settings/view/tabs/AccountSettingsTab.test.tssrc/components/settings/view/tabs/AccountSettingsTab.tsxsrc/components/settings/view/tabs/accountSettings.tssrc/utils/api.js
🚧 Files skipped from review as they are similar to previous changes (11)
- src/components/settings/view/Settings.tsx
- server/modules/database/repositories/app-config.ts
- src/components/settings/view/tabs/AccountSettingsTab.test.ts
- src/components/settings/view/SettingsMainTabs.tsx
- server/middleware/auth.js
- src/components/auth/types.ts
- server/modules/database/repositories/users.ts
- server/routes/auth.js
- src/components/settings/constants/constants.ts
- src/utils/api.js
- src/components/auth/context/AuthContext.tsx
CoderLuii
force-pushed
the
agent/local-account-management
branch
from
July 29, 2026 19:01
7faf587 to
1503296
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@server/routes/auth.account-management.platform.test.js`:
- Around line 9-29: Update the test “rejects password changes in platform mode”
so it captures the original DATABASE_PATH and VITE_IS_PLATFORM values, performs
all database, import, user, server, and address setup inside the guaranteed
try/finally cleanup path, and conditionally closes the server when startup
succeeded. Restore each environment variable to its prior value, deleting it
only when it was originally absent, and retain cleanup for the temporary
directory and database connection.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ee54188b-364b-4794-b8c0-48e81316d1a3
📒 Files selected for processing (20)
server/middleware/auth.jsserver/modules/database/repositories/app-config.tsserver/modules/database/repositories/users.tsserver/routes/auth.account-management.platform.test.jsserver/routes/auth.account-management.test.jsserver/routes/auth.jssrc/components/auth/context/AuthContext.tsxsrc/components/auth/types.tssrc/components/settings/constants/constants.tssrc/components/settings/hooks/normalizeMainTab.tssrc/components/settings/hooks/useSettingsController.test.tssrc/components/settings/hooks/useSettingsController.tssrc/components/settings/types/types.tssrc/components/settings/view/Settings.tsxsrc/components/settings/view/SettingsMainTabs.tsxsrc/components/settings/view/SettingsSidebar.tsxsrc/components/settings/view/tabs/AccountSettingsTab.test.tssrc/components/settings/view/tabs/AccountSettingsTab.tsxsrc/components/settings/view/tabs/accountSettings.tssrc/utils/api.js
🚧 Files skipped from review as they are similar to previous changes (17)
- src/components/settings/hooks/normalizeMainTab.ts
- src/components/settings/hooks/useSettingsController.test.ts
- src/components/settings/types/types.ts
- src/components/auth/types.ts
- src/components/settings/constants/constants.ts
- server/modules/database/repositories/users.ts
- src/components/settings/view/tabs/accountSettings.ts
- src/components/settings/view/SettingsSidebar.tsx
- src/components/settings/view/tabs/AccountSettingsTab.tsx
- server/modules/database/repositories/app-config.ts
- server/routes/auth.account-management.test.js
- src/utils/api.js
- server/routes/auth.js
- src/components/settings/view/SettingsMainTabs.tsx
- src/components/settings/view/tabs/AccountSettingsTab.test.ts
- src/components/settings/hooks/useSettingsController.ts
- src/components/auth/context/AuthContext.tsx
CoderLuii
force-pushed
the
agent/local-account-management
branch
from
July 29, 2026 19:17
1503296 to
d5df608
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
server/modules/auth/auth.service.ts (1)
75-105: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winAsync
hashPasswordruns while a raw SQLite transaction is open.
registercallstransaction.begin()thenawaitshashPasswordbeforecreateUser/commit. SQLiteBEGIN...COMMITtransactions don't nest — a second concurrent call totransaction.begin()on the same shared connection (e.g., a duplicate double-submitted register request racing before the first commits) throwscannot start a transaction within a transactioninstead of the intendedAUTH_USER_ALREADY_CONFIGURED403.changePasswordavoids this correctly by hashing beforebegin()(lines 188-190) — apply the same ordering here.🔧 Proposed fix
- dependencies.transaction.begin(); - try { - if (dependencies.users.hasUsers()) { - throw new AppError('User already exists. This is a single-user system.', { - code: 'AUTH_USER_ALREADY_CONFIGURED', - statusCode: 403, - }); - } - - const passwordHash = await dependencies.hashPassword(password); - const user = dependencies.users.createUser(username, passwordHash); + const passwordHash = await dependencies.hashPassword(password); + dependencies.transaction.begin(); + try { + if (dependencies.users.hasUsers()) { + throw new AppError('User already exists. This is a single-user system.', { + code: 'AUTH_USER_ALREADY_CONFIGURED', + statusCode: 403, + }); + } + + const user = dependencies.users.createUser(username, passwordHash);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/modules/auth/auth.service.ts` around lines 75 - 105, Move the asynchronous dependencies.hashPassword(password) call in register before dependencies.transaction.begin(), then begin the transaction only after hashing completes. Preserve the existing user-existence check, createUser, commit, rollback, and error-mapping behavior while matching the ordering used by changePassword.
🧹 Nitpick comments (2)
server/modules/auth/auth.middleware.ts (1)
8-22: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winShared config key
'auth_token_generation'is duplicated as separate literals across files. Both sites hardcode the same app-config key independently; a rename in either place silently breaks the token-generation invalidation feature with no compile-time signal.
server/modules/auth/auth.middleware.ts#L8-L22: keepAUTH_TOKEN_GENERATION_KEYhere but export it (or move it to a shared constants module).server/modules/auth/auth.module.ts#L21-L43: import the shared constant instead of re-hardcoding'auth_token_generation'on line 31.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/modules/auth/auth.middleware.ts` around lines 8 - 22, Export the existing AUTH_TOKEN_GENERATION_KEY from server/modules/auth/auth.middleware.ts, then update server/modules/auth/auth.module.ts to import and reuse it instead of hardcoding the 'auth_token_generation' literal. Keep the key definition centralized and preserve existing token-generation behavior at both sites.server/modules/auth/tests/auth.service.test.ts (1)
163-198: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd coverage for
changePassword's auth-guard branches.No test exercises
AUTH_USER_REQUIRED(malformeduserInput) orAUTH_TOKEN_INVALID(authenticated user row missing viagetUserAuthById) — both are security-relevant guards inchangePassword.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/modules/auth/tests/auth.service.test.ts` around lines 163 - 198, Add tests covering the auth-guard branches in changePassword: pass malformed userInput and assert an AppError with code AUTH_USER_REQUIRED, then configure getUserAuthById to return undefined for otherwise valid input and assert AUTH_TOKEN_INVALID. Keep these cases focused on the guards and verify the expected error codes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/settings/view/SettingsSidebar.tsx`:
- Around line 20-21: Update the account entry in NAV_ITEMS within
SettingsSidebar to use the translation key tabs.account via labelKey instead of
the hardcoded Account label, preserving the existing id and icon.
---
Outside diff comments:
In `@server/modules/auth/auth.service.ts`:
- Around line 75-105: Move the asynchronous dependencies.hashPassword(password)
call in register before dependencies.transaction.begin(), then begin the
transaction only after hashing completes. Preserve the existing user-existence
check, createUser, commit, rollback, and error-mapping behavior while matching
the ordering used by changePassword.
---
Nitpick comments:
In `@server/modules/auth/auth.middleware.ts`:
- Around line 8-22: Export the existing AUTH_TOKEN_GENERATION_KEY from
server/modules/auth/auth.middleware.ts, then update
server/modules/auth/auth.module.ts to import and reuse it instead of hardcoding
the 'auth_token_generation' literal. Keep the key definition centralized and
preserve existing token-generation behavior at both sites.
In `@server/modules/auth/tests/auth.service.test.ts`:
- Around line 163-198: Add tests covering the auth-guard branches in
changePassword: pass malformed userInput and assert an AppError with code
AUTH_USER_REQUIRED, then configure getUserAuthById to return undefined for
otherwise valid input and assert AUTH_TOKEN_INVALID. Keep these cases focused on
the guards and verify the expected error codes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ca22b960-ca0f-42b2-beb0-c474c238a043
📒 Files selected for processing (21)
server/modules/auth/auth.middleware.tsserver/modules/auth/auth.module.tsserver/modules/auth/auth.routes.tsserver/modules/auth/auth.service.tsserver/modules/auth/tests/auth.service.test.tsserver/modules/database/repositories/app-config.tsserver/modules/database/repositories/users.tssrc/components/auth/context/AuthContext.tsxsrc/components/auth/types.tssrc/components/settings/constants/constants.tssrc/components/settings/hooks/normalizeMainTab.tssrc/components/settings/hooks/useSettingsController.test.tssrc/components/settings/hooks/useSettingsController.tssrc/components/settings/types/types.tssrc/components/settings/view/Settings.tsxsrc/components/settings/view/SettingsMainTabs.tsxsrc/components/settings/view/SettingsSidebar.tsxsrc/components/settings/view/tabs/AccountSettingsTab.test.tssrc/components/settings/view/tabs/AccountSettingsTab.tsxsrc/components/settings/view/tabs/accountSettings.tssrc/utils/api.js
🚧 Files skipped from review as they are similar to previous changes (15)
- src/components/settings/types/types.ts
- src/components/settings/view/tabs/AccountSettingsTab.test.ts
- src/components/settings/view/Settings.tsx
- src/components/settings/hooks/normalizeMainTab.ts
- src/utils/api.js
- src/components/settings/hooks/useSettingsController.test.ts
- src/components/settings/view/SettingsMainTabs.tsx
- src/components/auth/types.ts
- src/components/settings/constants/constants.ts
- server/modules/database/repositories/users.ts
- server/modules/database/repositories/app-config.ts
- src/components/auth/context/AuthContext.tsx
- src/components/settings/view/tabs/AccountSettingsTab.tsx
- src/components/settings/hooks/useSettingsController.ts
- src/components/settings/view/tabs/accountSettings.ts
CoderLuii
force-pushed
the
agent/local-account-management
branch
from
July 29, 2026 19:59
d5df608 to
48e7631
Compare
CoderLuii
added a commit
to CoderLuii/HolyClaude
that referenced
this pull request
Jul 30, 2026
Refresh compatible agent CLIs, package tooling, Python libraries, scanners, and immutable release inputs while preserving HolyClaude's Docker interfaces. Rebuild CloudCLI 1.36.3 with the reviewed upload, WebSocket, account-management, and dependency protections, then bind those versions and behaviors to source and image-level tests. Strengthen release evidence, rollback handling, product-fact validation, and rootless documentation without changing ports, volumes, variants, or runtime configuration. Constraint: Keep Node 26.5.0 Bookworm, Debian Chromium 150.0.7871.181, npm 11.18.0, and Playwright 1.61.0 Rejected: Delay compatible dependency and security updates for unavailable Node and Chromium packages | retain the verified base inputs for this release Security: Remove the targeted ws, Multer, DOMPurify, Express, and path-to-regexp findings from the vendored CloudCLI production tree Confidence: high Scope-risk: broad Directive: Promote only the four release-branch candidate digests that pass native builds, security policy, and runtime smokes Tested: 167 Node tests; 5 Python tests; shell syntax; product-facts validation; immutable-input validation; actionlint; no-cache slim and full amd64 builds; browser, persistence, rootless, CloudCLI-volume, and full-only runtime smokes Not-tested: Native arm64 candidates, digest-bound final scans, registry promotion, and post-publish smokes remain gated by GitHub Actions Related: siteboon/claudecodeui#978, siteboon/claudecodeui#1070
CoderLuii
added a commit
to CoderLuii/HolyClaude
that referenced
this pull request
Jul 30, 2026
Refresh compatible agent CLIs, package tooling, Python libraries, scanners, and immutable release inputs while preserving HolyClaude's Docker interfaces. Rebuild CloudCLI 1.36.3 with the reviewed upload, WebSocket, account-management, and dependency protections, then bind those versions and behaviors to source and image-level tests. Strengthen release evidence, rollback handling, product-fact validation, and rootless documentation without changing ports, volumes, variants, or runtime configuration. Constraint: Keep Node 26.5.0 Bookworm, Debian Chromium 150.0.7871.181, npm 11.18.0, and Playwright 1.61.0 Rejected: Delay compatible dependency and security updates for unavailable Node and Chromium packages | retain the verified base inputs for this release Security: Remove the targeted ws, Multer, DOMPurify, Express, and path-to-regexp findings from the vendored CloudCLI production tree Confidence: high Scope-risk: broad Directive: Promote only the four release-branch candidate digests that pass native builds, security policy, and runtime smokes Tested: 167 Node tests; 5 Python tests; shell syntax; product-facts validation; immutable-input validation; actionlint; no-cache slim and full amd64 builds; browser, persistence, rootless, CloudCLI-volume, and full-only runtime smokes Not-tested: Native arm64 candidates, digest-bound final scans, registry promotion, and post-publish smokes remain gated by GitHub Actions Related: siteboon/claudecodeui#978, siteboon/claudecodeui#1070
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
Local installs can create an account during setup, but they had no UI path to log out or change that password afterward. Deleting local authentication state is not a safe account-management workflow.
Fixes #797.
Validation
npm cinpx tsx --tsconfig server/tsconfig.json --test server/modules/auth/tests/auth.service.test.ts(9 tests)npx tsx --test src/components/settings/hooks/useSettingsController.test.ts src/components/settings/view/tabs/AccountSettingsTab.test.ts(5 tests)npm run typechecknpm run buildnpm run lint(0 errors; existing warnings remain)git diff --check