Game guide · source of truth
Ledger

WEB-204

Admin System: staff list/invite/roles/disable/MFA reset, accept-invite flow, owner bootstrap command, role × permission matrix

← Ledger

donestatus · web-admin
3✓ tests passed / failed
5.88Mtokens · 10 min
11evidence files · 1.4 MB

Evidence

From logs/evidence/WEB-204/. Click a thumbnail for the full image.

Images (11)

desktop/overview-light.png
desktop/overview-light.png · 68 kB
desktop/overview.png
desktop/overview.png · 68 kB
mobile/overview.png
mobile/overview.png · 88 kB
tablet/overview.png
tablet/overview.png · 63 kB
desktop/command-menu.png
desktop/command-menu.png · 90 kB
desktop/enrol.png
desktop/enrol.png · 122 kB
desktop/roles.png
desktop/roles.png · 140 kB
desktop/staff.png
desktop/staff.png · 183 kB
mobile/drawer.png
mobile/drawer.png · 141 kB
mobile/roles.png
mobile/roles.png · 261 kB
tablet/roles.png
tablet/roles.png · 132 kB

Tests

pass pgTAP: staff management + all (110 tests) · 1.6 s · raw log$ pnpm -s db:test
pass admin e2e: staff invite→accept→enrol→roles→disable lockout, roles matrix, RBAC · 281.4 s · raw log$ cd apps/admin && pnpm build >/dev/null 2>&1 && ZOEN_EVIDENCE_TASK=WEB-204 pnpm exec playwright test tests/e2e/staff.spec.ts tests/e2e/shell.spec.ts --reporter=line
pass db integration: owner bootstrap · 9.6 s · raw log$ cd packages/db && node --test tests/bootstrap.int.test.mjs

Notes

2026-10-04 17:16 UTC · Evidence logs/evidence/WEB-204: enrol screen, staff list, roles matrix. Owner bootstrap: `pnpm admin:bootstrap-owner` (owner runs; hidden password prompt; refuses a second real owner without --add; integration-tested with @zoen.test). Invites: service-key invite e-mail (Mailpit locally) with custom template → /login/accept (token spent on submit, not on open) → password → TOTP enrol → activate_self. Roles/status/MFA reset are critical (reason + step-up); disable also bans at the auth server; last active owner protected (pgTAP 090). Stack restarted to load the invite template.