feat(admin): edit email, force-verify, and clear 2FA on user detail #155
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/BUNYIP-119-admin-user-edit-email-2fa"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The admin User detail surface showed email, email_verified, and two_factor_enabled read-only with no way to act on them (BUNYIP-119). An admin could not correct a user's address, force-verify it, or clear a stuck second factor.
Add three admin endpoints on bunyip-api: PUT /admin/users/{id}/email (normalizes + validates the address, rejects a collision with another live account, optionally marks it verified), POST /admin/users/{id}/email/verify (force-verify), and POST /admin/users/{id}/two-factor/reset (delete the TOTP secret + recovery codes and clear the flag so a locked-out user can re-enrol). Each writes an audit-log entry via three new admin AuditAction variants.
Wire the matching bunyip-web BFF client calls, POST handlers, and routes, and add an "Identity & security" card to the user-detail page with an inline email-edit form (plus a "mark verified" checkbox), a Force-verify button shown only while the address is unverified, and a Clear 2FA button shown only while a second factor is enabled.
#BUNYIP-119
The admin User detail surface showed email, email_verified, and two_factor_enabled read-only with no way to act on them (BUNYIP-119). An admin could not correct a user's address, force-verify it, or clear a stuck second factor. Add three admin endpoints on bunyip-api: PUT /admin/users/{id}/email (normalizes + validates the address, rejects a collision with another live account, optionally marks it verified), POST /admin/users/{id}/email/verify (force-verify), and POST /admin/users/{id}/two-factor/reset (delete the TOTP secret + recovery codes and clear the flag so a locked-out user can re-enrol). Each writes an audit-log entry via three new admin AuditAction variants. Wire the matching bunyip-web BFF client calls, POST handlers, and routes, and add an "Identity & security" card to the user-detail page with an inline email-edit form (plus a "mark verified" checkbox), a Force-verify button shown only while the address is unverified, and a Clear 2FA button shown only while a second factor is enabled. #BUNYIP-119