Add fj admin and fj profile #280

Merged

stephen merged 1 commit from feat/spec-parity-admin-profile into feat/spec-parity-fjord

2026-10-08 19:42:38 +00:00

stephen commented

2026-10-08 19:18:53 +00:00

Owner

Four fjord-client-spec requirements with nothing behind them on main:
three under forge-instance-administration and one under profiles.

fj admin settings reads the four /settings/* sections and prints only
what the server sent; a section answering 404, 405 or 501 is labelled
unavailable. fj admin cron list reads /admin/cron. A 403 is never
folded into "unavailable": it reads as "requires an instance
administrator" and keeps exit code 4. Both are read-only.

fj admin user create needs exactly one of --password-stdin,
--password-prompt or --no-password, and explicit --send-notify and
--must-change-password choices. There is no --password flag. Stdin on a
TTY and a prompt without one are both refused, so it can neither echo
nor hang. /admin/users joins the sensitive paths, which keeps the
request body out of --debug, and credential-shaped keys are stripped
from the response before anything prints.

fj admin unadopted list|adopt|delete page the unadopted repositories.
The two mutations print the repository and the consequence, ask for the
name to be typed back, refuse a non-TTY run without --yes, and only say
"Server confirmed" after the 204.

fj profile view|edit, fj profile email list|add|remove and
fj profile avatar set|delete. An edit sends only the fields that were
passed and warns about any the response does not reflect. Email
verification state comes from the server and prints "unknown" when it is
not reported. An avatar is checked for size and image magic bytes before
it is uploaded.

scripts/e2e-smoke.sh now runs profile view and profile email list,
so the smoke token needs the read:user scope.

Covered by unit and wiremock tests only; nothing here was run against a live forge, and the admin routes need a site administrator to check for real. The CI smoke token needs read:user before the two new profile lines in scripts/e2e-smoke.sh pass.

Part 3 of 8 in the spec-parity stack. Based on feat/spec-parity-fjord, so the diff here is this slice alone; it needs a rebase onto main once the PR below it is squash-merged.

Verified on macOS at this commit: cargo fmt --all clean, cargo clippy --all-targets --all-features -- -D warnings clean, cargo test --all green.

Four fjord-client-spec requirements with nothing behind them on main: three under forge-instance-administration and one under profiles. `fj admin settings` reads the four /settings/* sections and prints only what the server sent; a section answering 404, 405 or 501 is labelled unavailable. `fj admin cron list` reads /admin/cron. A 403 is never folded into "unavailable": it reads as "requires an instance administrator" and keeps exit code 4. Both are read-only. `fj admin user create` needs exactly one of --password-stdin, --password-prompt or --no-password, and explicit --send-notify and --must-change-password choices. There is no --password flag. Stdin on a TTY and a prompt without one are both refused, so it can neither echo nor hang. /admin/users joins the sensitive paths, which keeps the request body out of --debug, and credential-shaped keys are stripped from the response before anything prints. `fj admin unadopted list|adopt|delete` page the unadopted repositories. The two mutations print the repository and the consequence, ask for the name to be typed back, refuse a non-TTY run without --yes, and only say "Server confirmed" after the 204. `fj profile view|edit`, `fj profile email list|add|remove` and `fj profile avatar set|delete`. An edit sends only the fields that were passed and warns about any the response does not reflect. Email verification state comes from the server and prints "unknown" when it is not reported. An avatar is checked for size and image magic bytes before it is uploaded. scripts/e2e-smoke.sh now runs `profile view` and `profile email list`, so the smoke token needs the read:user scope. Covered by unit and wiremock tests only; nothing here was run against a live forge, and the admin routes need a site administrator to check for real. The CI smoke token needs `read:user` before the two new `profile` lines in `scripts/e2e-smoke.sh` pass. Part 3 of 8 in the spec-parity stack. Based on `feat/spec-parity-fjord`, so the diff here is this slice alone; it needs a rebase onto main once the PR below it is squash-merged. Verified on macOS at this commit: `cargo fmt --all` clean, `cargo clippy --all-targets --all-features -- -D warnings` clean, `cargo test --all` green.

stephen added 1 commit

2026-10-08 19:18:53 +00:00

Add fj admin and fj profile 6fd306d09b

Four fjord-client-spec requirements with nothing behind them on main:
three under forge-instance-administration and one under profiles.

`fj admin settings` reads the four /settings/* sections and prints only
what the server sent; a section answering 404, 405 or 501 is labelled
unavailable. `fj admin cron list` reads /admin/cron. A 403 is never
folded into "unavailable": it reads as "requires an instance
administrator" and keeps exit code 4. Both are read-only.

`fj admin user create` needs exactly one of --password-stdin,
--password-prompt or --no-password, and explicit --send-notify and
--must-change-password choices. There is no --password flag. Stdin on a
TTY and a prompt without one are both refused, so it can neither echo
nor hang. /admin/users joins the sensitive paths, which keeps the
request body out of --debug, and credential-shaped keys are stripped
from the response before anything prints.

`fj admin unadopted list|adopt|delete` page the unadopted repositories.
The two mutations print the repository and the consequence, ask for the
name to be typed back, refuse a non-TTY run without --yes, and only say
"Server confirmed" after the 204.

`fj profile view|edit`, `fj profile email list|add|remove` and
`fj profile avatar set|delete`. An edit sends only the fields that were
passed and warns about any the response does not reflect. Email
verification state comes from the server and prints "unknown" when it is
not reported. An avatar is checked for size and image magic bytes before
it is uploaded.

scripts/e2e-smoke.sh now runs `profile view` and `profile email list`,
so the smoke token needs the read:user scope.

stephen merged commit 6c0aa3d3a7 into feat/spec-parity-fjord

2026-10-08 19:42:38 +00:00

stephen deleted branch feat/spec-parity-admin-profile

2026-10-08 19:42:38 +00:00

stephen referenced this pull request from a commit

2026-10-08 19:42:40 +00:00

Add fj admin and fj profile (#280)