feat(auth): add persistent users and first-run star:intel login #97

Merged

lost-rob0t merged 19 commits from feature/auth-users-bootstrap into master

2026-08-12 10:17:42 +00:00

lost-rob0t commented

2026-08-12 03:54:48 +00:00

(Migrated from github.com)

Summary

Adds persistent human users on top of StarIntel's existing opaque API-key authentication model.

First-run account

fresh auth user store creates star:intel
- username: star
- password: intel
- administrator principal with admin scope
- must_change_password=true
the short built-in password is allowed only for first-run bootstrap; normal user passwords use the configured minimum length
first-run username/password can be overridden through environment/file settings

User lifecycle

POST /auth/login authenticates username/password and mints the existing star_sk_v1_... bearer credential
admin POST /auth/users creates users
admin GET /auth/users lists redacted metadata
admin POST /auth/users/:username/password resets passwords
authenticated POST /auth/password changes the current human user's password
user records persist in the separate StarIntel auth CouchDB database
passwords are stored as PBKDF2-SHA256 combined hashes using Ironclad, with the server auth pepper mixed into the password material

Tests / CI

adds hermetic tests for first-run idempotence, redaction, password policy, login-to-bearer conversion, self password changes, and admin resets
makes the new suite mandatory in the canonical unit runner
extends the full Nix-built container stack test to prove:
- fresh star:intel login
- admin-created user login
- default password change and rejection of old star:intel
- persistence of both users/password changes across restart
upgrades Nix setup in smoke CI, adds nix flake check, a server build gate, job timeouts, least-privilege workflow permissions, and stale-run cancellation

Safety

star:intel is intentionally a first-run default and should be changed immediately before exposing a deployment beyond a trusted/local environment. The initial password can be overridden before first startup.

## Summary Adds persistent human users on top of StarIntel's existing opaque API-key authentication model. ### First-run account - fresh auth user store creates `star:intel` - username: `star` - password: `intel` - administrator principal with `admin` scope - `must_change_password=true` - the short built-in password is allowed only for first-run bootstrap; normal user passwords use the configured minimum length - first-run username/password can be overridden through environment/file settings ### User lifecycle - `POST /auth/login` authenticates username/password and mints the existing `star_sk_v1_...` bearer credential - admin `POST /auth/users` creates users - admin `GET /auth/users` lists redacted metadata - admin `POST /auth/users/:username/password` resets passwords - authenticated `POST /auth/password` changes the current human user's password - user records persist in the separate StarIntel auth CouchDB database - passwords are stored as PBKDF2-SHA256 combined hashes using Ironclad, with the server auth pepper mixed into the password material ### Tests / CI - adds hermetic tests for first-run idempotence, redaction, password policy, login-to-bearer conversion, self password changes, and admin resets - makes the new suite mandatory in the canonical unit runner - extends the full Nix-built container stack test to prove: - fresh `star:intel` login - admin-created user login - default password change and rejection of old `star:intel` - persistence of both users/password changes across restart - upgrades Nix setup in smoke CI, adds `nix flake check`, a server build gate, job timeouts, least-privilege workflow permissions, and stale-run cancellation ### Safety `star:intel` is intentionally a first-run default and should be changed immediately before exposing a deployment beyond a trusted/local environment. The initial password can be overridden before first startup.