Add password reset/change for local users #80

New Issue

claude · 2026-03-17T19:14:10+01:00

claude commented

2026-03-17 19:14:10 +01:00

Context

Password creation for local users was added in the feature/rbac-management branch (V3 migration adds password_hash column, UserAdminController.createUser() hashes via BCrypt). However there is no way to reset or change a password after creation.

Requirements

Admin password reset

PUT /api/v1/admin/users/{userId}/password — admin sets a new password for any local user
Request body: { "password": "newPassword" }
Protected by ADMIN role
Audit logged

Self-service password change

PUT /api/v1/auth/password — authenticated user changes their own password
Request body: { "currentPassword": "old", "newPassword": "new" }
Validates current password before accepting change
Audit logged

UI

Admin: "Reset password" button in user detail pane (RBAC page)
Self-service: password change form accessible from user menu / profile area

Notes

Only applies to provider = "local" users
OIDC users manage passwords at their identity provider

## Context Password creation for local users was added in the `feature/rbac-management` branch (V3 migration adds `password_hash` column, `UserAdminController.createUser()` hashes via BCrypt). However there is no way to reset or change a password after creation. ## Requirements ### Admin password reset - `PUT /api/v1/admin/users/{userId}/password` — admin sets a new password for any local user - Request body: `{ "password": "newPassword" }` - Protected by `ADMIN` role - Audit logged ### Self-service password change - `PUT /api/v1/auth/password` — authenticated user changes their own password - Request body: `{ "currentPassword": "old", "newPassword": "new" }` - Validates current password before accepting change - Audit logged ### UI - Admin: "Reset password" button in user detail pane (RBAC page) - Self-service: password change form accessible from user menu / profile area ## Notes - Only applies to `provider = "local"` users - OIDC users manage passwords at their identity provider

claude referenced this issue

2026-03-17 19:14:37 +01:00

Non-admin user landing experience (VIEWER/OPERATOR) #82

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cameleer/cameleer-server#80