sjg/trx-rs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Block password changes while Guest role is active #65

Merged
sjg merged 1 commits from agent/disable-guest-password-changes into main 2026-08-12 18:49:12 +02:00
Conversation 0 Commits 1 Files Changed 4
+52 -1
sjg commented 2026-08-11 22:48:19 +02:00
Owner
Copy Link
Copy Source

Summary

  • disable and clear managed-user password fields while Guest is selected
  • reject Guest password updates in the backend even when the UI is bypassed
  • cover existing Guest users and live role selection with browser regression tests
  • regenerate the committed frontend bundle

Why

Guest accounts are restricted shared-access accounts. Although self-service password changes were already blocked, an administrator could still submit a password update for a managed user while Guest remained active.

Impact

Guest creation still requires an initial password. Existing Guest passwords cannot be changed until an administrator removes the Guest role; changing to a non-Guest role and supplying a replacement password remains supported.

Validation

  • npm run typecheck
  • npm run lint
  • npm test (64 passed)
  • cargo fmt --all -- --check
  • cargo test -p trx-frontend-http auth::tests --lib (18 passed)
  • node tests/account-management.mjs with installed Chrome
## Summary - disable and clear managed-user password fields while Guest is selected - reject Guest password updates in the backend even when the UI is bypassed - cover existing Guest users and live role selection with browser regression tests - regenerate the committed frontend bundle ## Why Guest accounts are restricted shared-access accounts. Although self-service password changes were already blocked, an administrator could still submit a password update for a managed user while Guest remained active. ## Impact Guest creation still requires an initial password. Existing Guest passwords cannot be changed until an administrator removes the Guest role; changing to a non-Guest role and supplying a replacement password remains supported. ## Validation - `npm run typecheck` - `npm run lint` - `npm test` (64 passed) - `cargo fmt --all -- --check` - `cargo test -p trx-frontend-http auth::tests --lib` (18 passed) - `node tests/account-management.mjs` with installed Chrome
sjg added 1 commit 2026-08-11 22:48:19 +02:00
[fix](trx-frontend-http): block Guest password changes
CI / lint (pull_request) Successful in 2m25s
Details
CI / test (pull_request) Successful in 9m5s
Details
CI / frontend (pull_request) Successful in 5m23s
Details
CI / reuse (pull_request) Successful in 5s
Details
CI / lint (push) Successful in 2m24s
Details
CI / test (push) Successful in 9m11s
Details
CI / frontend (push) Successful in 5m22s
Details
CI / reuse (push) Successful in 5s
Details
b037225a05
sjg marked the pull request as ready for review 2026-08-12 18:49:09 +02:00
sjg merged commit b037225a05 into main 2026-08-12 18:49:12 +02:00
sjg deleted branch agent/disable-guest-password-changes 2026-08-12 18:49:12 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
sjg (Stan Grams)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sjg/trx-rs#65