Server 0.1.0 open 49% 88 issues (1 closed — 87 open) Related issues Feature #159: User Account Provisioning Actions Feature #160: User Login Actions Feature #161: Session Management Actions Feature #189: Email Notifications Actions Feature #251: Dashboard shell & navigation Actions Feature #261: Validate configuration at startup instead of failing silently Actions Feature #265: Permission catalog Actions Feature #266: Roles Actions Feature #267: Groups Actions Feature #268: Granting access Actions Feature #269: Access decision and enforcement Actions Feature #270: Understanding access Actions Feature #271: User administration Actions Feature #272: Agent identity Actions Feature #273: Module identity Actions Feature #274: Change events for access Actions Feature #305: Bulk operations on users and groups (to be specified) Actions User Story #163: As the instance administrator, I want to complete a first-install setup, so that I get an admin account without relying on insecure default credentials Actions User Story #169: As a new user, I want to register via OAuth/OIDC, so that I can use existing accounts Actions User Story #172: As a user, I want to log in with credentials, so that I can access my account Actions User Story #176: As a user, I want to log in via OAuth/OIDC, so that I can use existing providers Actions User Story #178: As a user, I want my session to remain active, so that I stay logged in Actions User Story #181: As a user, I want to log out, so that I can end my session Actions User Story #193: As a system, I want to send emails on long-term events, so that users receive batch digests Actions User Story #237: As a user, I want to log in using a security key (WebAuthn), so that I can use phishing-resistant MFA Actions User Story #238: As a user, I want to enable and disable TOTP from my profile, so that I can manage my two-factor authentication settings Actions User Story #252: As a user, I want a base dashboard layout with navigation, so that I can move around the app after logging in Actions User Story #253: As a user, I want a settings page reachable from the dashboard, so that I can later manage my account options Actions User Story #263: As an administrator, I want to invite a new user by email, so that they can activate their own account Actions User Story #264: As an administrator, I want to create a user account directly with a temporary password, so that I can onboard someone without sending an email Actions User Story #275: As an administrator, I want to browse every permission the platform knows about, so that I can build roles from real capabilities Actions User Story #276: As an operator, I want the platform's own permissions to be available on a fresh install, so that roles can be built before any module is added Actions User Story #277: As a module author, I want my module to declare its own permissions when it connects, so that its features can be granted without changing the platform Actions User Story #278: As an administrator, I want uninstalling a module to take its permissions and the access granted through them with it, so that nothing dangling is left behind Actions User Story #279: As an administrator, I want to create, edit and delete roles, so that I can describe access once and reuse it Actions User Story #280: As an operator, I want a protected Administrator role to exist from the start, so that the installation always has someone who can run it Actions User Story #281: As an administrator, I want ready-made starter roles, so that I can give sensible access without designing it from scratch Actions User Story #282: As an administrator, I want to create, edit and delete groups, so that I can hand out access to a team instead of to each person Actions User Story #283: As an administrator, I want to manage who belongs to a group, so that access follows people joining and leaving a team Actions User Story #284: As an administrator, I want to give a role to a person or a group across the whole platform, so that they can do their job everywhere it applies Actions User Story #285: As the owner of a server, I want to share it with someone, so that they can help me run it without getting access to anything else Actions User Story #286: As the owner of a server, I want to deny one capability to one person, so that they keep the rest of the access their team has Actions User Story #287: As an administrator, I want to revoke access I previously gave, so that people lose it the moment they should Actions User Story #288: As an operator, I want nobody to be able to hand out access they do not hold, so that managing access cannot be used to become an administrator Actions User Story #289: As an operator, I want every protected action checked before it runs, so that access rules cannot be bypassed by choosing another way in Actions User Story #290: As an administrator, I want one predictable answer when several grants apply at once, so that access never depends on the order things were set up in Actions User Story #291: As an administrator, I want a change to access to take effect straight away, so that revoking someone actually stops them Actions User Story #292: As an administrator, I want to see everything a person can do and where it came from, so that I can check their access at a glance Actions User Story #293: As an administrator, I want to ask why one person was allowed or refused one action, so that I can fix access instead of guessing Actions User Story #294: As the owner of a server, I want to see who has access to it and how, so that I can tell whether it is shared more widely than I thought Actions User Story #295: As a user, I want the interface to only offer me what I can actually do, so that I am not led into refusals Actions User Story #296: As an administrator, I want to find and inspect accounts, so that I can work out who someone is before changing their access Actions User Story #297: As an administrator, I want to correct someone's account details, so that the platform reflects reality Actions User Story #298: As an administrator, I want to suspend and reactivate an account, so that I can cut someone off without losing anything Actions User Story #299: As an administrator, I want deleting an account to be reversible for a while and then final, so that a mistake costs nothing and a departure leaves nothing behind Actions User Story #300: As an administrator, I want to enrol a new node with a one-off token, so that only nodes I invited can join Actions User Story #301: As an administrator, I want to list, rotate and revoke node credentials, so that a decommissioned or compromised node loses access immediately Actions User Story #302: As an operator, I want the platform to be sure which module it is talking to, so that nothing else on the machine can pretend to be one Actions User Story #303: As an administrator, I want to see when a module acted on its own, so that automated changes are not attributed to nobody Actions User Story #304: As an operator, I want every change to access to announce itself, so that an audit trail can be built on it later Actions Sub-Task #164: Validate email format and password strength requirements Actions Sub-Task #165: Hash and securely store credentials Actions Sub-Task #166: Send invitation email with token Actions Sub-Task #170: Integrate OAuth/OIDC providers (Google, Discord, GitHub) Actions Sub-Task #171: Auto-create account on first OAuth/OIDC login Actions Sub-Task #173: Validate credentials against stored hash Actions Sub-Task #174: Generate and store opaque session token server-side Actions Sub-Task #175: Set secure session cookie Actions Sub-Task #179: Implement server-side session storage and validation Actions Sub-Task #182: Invalidate server-side session on logout Actions Sub-Task #194: Implement email template rendering Actions Sub-Task #195: Integrate SMTP provider Actions Sub-Task #239: Generate WebAuthn registration challenge and verify attestation (backend) Actions Sub-Task #240: Generate WebAuthn authentication challenge and verify assertion (backend) Actions Sub-Task #241: Store WebAuthn credentials (public key, credential ID, sign count) in the database Actions Sub-Task #242: Frontend: WebAuthn credential registration flow in user profile Actions Sub-Task #243: Frontend: WebAuthn assertion flow in MFA login step Actions Sub-Task #244: API endpoint: initiate TOTP setup (generate secret, return base32 + otpauth URL) Actions Sub-Task #245: API endpoint: confirm and activate TOTP (verify OTP code before persisting secret) Actions Sub-Task #247: API endpoint: disable TOTP (requires current OTP code or password confirmation) Actions Sub-Task #248: Frontend: TOTP setup wizard (QR code display, manual entry, confirmation code input) Actions Sub-Task #249: Frontend: MFA management section in user profile (enable/disable/status) Actions Sub-Task #254: Backend: OIDC provider configuration Actions Sub-Task #255: Backend: discovery endpoint for login page Actions Sub-Task #256: Backend: OIDC endpoints (login start, callback, session) Actions Sub-Task #257: Frontend: OIDC login integration Actions Epic #49: Implement user, groups and permissions management Actions Epic #188: Notification System Actions