Skip to content

Feat user management#40

Merged
dominikletica merged 81 commits into
dev-latestfrom
feat-user-management
May 31, 2026
Merged

Feat user management#40
dominikletica merged 81 commits into
dev-latestfrom
feat-user-management

Conversation

@dominikletica

Copy link
Copy Markdown
Member

Summary

Adds the user-management foundation and hardening slice: durable account tokens, invitation-first onboarding, registration modes, password reset, profile/password/API-key flows, account closure, deleted-account reactivation, Admin User/ACL management, review queue, ACL impact review, mailer-shaped message-log delivery, setup seed centralization, translation cache warmup, and APP_SECRET rotation handling for API keys.

The branch keeps the implementation modular: account tokens, delivery, ACL policy, lifecycle side effects, ACL apply operations, state markers, setup seed data, and mail-flow metadata live behind focused service boundaries instead of controller-only logic.

Testing

  • bin/phpunit: OK (679 tests, 4325 assertions)
  • Other (describe):
    • php bin/console lint:container --env=test: OK
    • php bin/console lint:twig templates/backend/admin/users --env=test: OK
    • php bin/console lint:yaml --parse-tags config/services.yaml translations/languages/en/admin.yaml translations/languages/de/admin.yaml --env=test: OK
    • php .codex/compare_translations.php: OK
    • git diff --check dev-latest...HEAD: OK
    • Focused User/Admin controller tests: OK

Documentation

  • Updated project readme (README.md)
  • Updated feature drafts (dev/draft/*.md)
  • Updated class map (dev/CLASSMAP.md)
  • Updated worklog (dev/WORKLOG.md)
  • Updated dev/user manuals (dev/manual/*.md / docs/*.md)

Additional Checks

  • Security/privacy considerations
  • Follow-up tasks captured in WORKLOG
  • Linked issues / discussions
  • Updated / aligned translations

Review Notes

  • Account links and one-time tokens are intentionally written into the DEBUG message-log payload while no real mailer exists. This is a deliberate local/test debug path, not an accidental token leak. Production mail delivery should replace or explicitly gate this stub before release.
  • The branch intentionally continues using the consolidated baseline migration only. This project is still pre-1.0 and does not preserve backwards-compatible migration history yet.
  • UI/UX polish and smoke refinements are intentionally deferred to the dedicated UI/UX PR.
  • Rate limiting, blocking, and suspicious visitor/user detection are intentionally deferred to the next security branch.
  • The future mailer design notes are now captured in dev/draft/0.4.x-MailerDeliveryContract.md.

@dominikletica dominikletica self-assigned this May 28, 2026
@dominikletica dominikletica added the enhancement New feature or request label May 28, 2026
@dominikletica dominikletica added this to the 0.1-dev – Functional basic backend features milestone May 28, 2026
@dominikletica
dominikletica marked this pull request as ready for review May 28, 2026 15:13

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 58231d8360

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/Security/UserFlowConfig.php
Comment thread src/Controller/UserPasswordRecoveryController.php Outdated
Comment thread src/Controller/UserRegistrationController.php Outdated
Comment thread src/Controller/UserController.php
@dominikletica
dominikletica marked this pull request as ready for review May 31, 2026 00:54

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 91d616b0a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/Security/AclGroupApplyService.php Outdated
Comment thread src/Controller/UserRegistrationController.php
Comment thread src/Command/AccountTokenCleanupCommand.php
Comment thread src/Security/AdminUserAccessPolicy.php
Comment thread src/Controller/AdminAclGroupController.php
Comment thread src/Controller/UserController.php

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3fbd80c18c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/Security/AclGroupImpactService.php Outdated
Comment thread src/Core/Config/Settings/CoreSettingsFormHandler.php
Comment thread src/Core/Config/Settings/CoreSettingsRegistry.php
Comment thread migrations/Version20260530230000.php Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 72b1c46b76

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/Controller/UserRegistrationController.php

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 14e46592aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/Core/State/StateMarkerRecorder.php Outdated
Comment thread templates/backend/admin/users/group-review.html.twig Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

'SELECT COUNT(*) FROM messenger_messages WHERE queue_name = :queue_name AND delivered_at IS NULL AND available_at <= :now',
[
'queue_name' => $this->transportName,
'now' => new DateTimeImmutable(),

P2 Badge Check the Doctrine queue name before draining

In the checked messenger config, the async transport uses %env(MESSENGER_TRANSPORT_DSN)%, while .env sets doctrine://default?auto_setup=0 without queue_name; Symfony's Doctrine transport stores those rows under the default queue name default, not the transport name async. This query therefore sees zero pending rows and never starts the terminate-time consumer, so queued package discovery/rebuild messages sit in messenger_messages until an external worker is run; use the DSN queue name or configure the DSN with queue_name=async.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/Security/DeletedUserCleanup.php
Comment thread migrations/Version20260530230000.php
Comment thread config/packages/translation.yaml
@dominikletica
dominikletica merged commit d2c967e into dev-latest May 31, 2026
1 check passed
@dominikletica
dominikletica deleted the feat-user-management branch May 31, 2026 05:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request performance Something affects performance and should be reviewed immediately security Something is affecting security or data safety

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat-user-management

1 participant