#212 - WIZ-USERS: Installation wizard – default admin and starting users - kyrylo/vorteq-nas-os

## Goal Build the accounts steps of the installation wizard (front-end + back-end): create the default admin (required) and optionally a number of starting users. The system scripts are written separately. This task is **only the UI and the backend that calls the scripts**. Use mock scripts returning the same JSON until the real ones exist. ## Context - Linux users always get a password; Samba uses its own separate SMB password - Admins belong to the group `nas-admins` - This step runs after the storage step (home directories live on the pool) ## Scripts the backend can use Rules for all scripts: arguments as CLI flags, JSON on stdout, exit code 0 = success, non-zero = failure with `{"error": "..."}`. **Passwords are passed via stdin, never as arguments.** | Script | Input | Output | |---|---|---| | `nas-add-user` | username, `--admin` (adds to `nas-admins`), optional separate SMB password; passwords via stdin | {username, admin, status} | | `nas-set-smb-password` | username; password via stdin | {username, status} | | `nas-common.sh` | shared helpers (username validation, password policy, `nas-admins` constant) | n/a | ## Front-end: what must be shown **Screen A: Create the administrator (required)** - [ ] Fields: username, password, confirm password - [ ] Toggle "Use a different password for network shares (SMB)", off by default; when on, show SMB password + confirm fields - [ ] Username validation: lowercase letters, digits, `-`, `_`, must start with a letter, length limits, reserved names blocked - [ ] Password validation: minimum length (align with the real policy; SMB minimum is currently 4), fields must match, optional strength indicator - [ ] Show/hide password toggle - [ ] Read-only note: the admin is automatically added to `nas-admins` - [ ] Live validation messages; Next disabled until the form is valid **Screen B: Add starting users (optional)** - [ ] "Skip" and "Add user" buttons - [ ] Repeatable user form (add/remove): username, password + confirm, optional separate SMB password - [ ] Checkbox **"Add this user to nas-admins"** per user - [ ] Same validation as the admin screen - [ ] Usernames unique across the admin and all starting users - [ ] Summary of all accounts to be created (name + role Admin/User), passwords not shown ## Back-end: what it must do - [ ] `POST /api/accounts/create` with body: ```json { "admin": { "username": "...", "password": "...", "smbPassword": null }, "users": [ { "username": "...", "password": "...", "smbPassword": "...", "admin": false } ] } ``` - [ ] Optional `POST /api/accounts/validate` (validation without creating anything) - [ ] Server-side validation: username format, uniqueness, reserved names, password policy - [ ] Create the admin first (always in `nas-admins`), then the users in order, using `nas-add-user` - [ ] If `smbPassword` is empty, the SMB password equals the account password (via `nas-set-smb-password`) - [ ] Pass passwords via stdin only; never log them or put them in arguments, URLs or responses; clear them from memory after use - [ ] On failure: report which account failed and why - [ ] Reject the request if the storage has not been provisioned yet

kyrylo commented

2026-10-23 14:55:11 +00:00

Owner

Goal

Build the accounts steps of the installation wizard (front-end + back-end): create the default admin (required) and optionally a number of starting users.

The system scripts are written separately. This task is only the UI and the backend that calls the scripts. Use mock scripts returning the same JSON until the real ones exist.

Context

Linux users always get a password; Samba uses its own separate SMB password
Admins belong to the group nas-admins
This step runs after the storage step (home directories live on the pool)

Scripts the backend can use

Rules for all scripts: arguments as CLI flags, JSON on stdout, exit code 0 = success, non-zero = failure with {"error": "..."}. Passwords are passed via stdin, never as arguments.

Script	Input	Output
`nas-add-user`	username, `--admin` (adds to `nas-admins`), optional separate SMB password; passwords via stdin	{username, admin, status}
`nas-set-smb-password`	username; password via stdin	{username, status}
`nas-common.sh`	shared helpers (username validation, password policy, `nas-admins` constant)	n/a

Front-end: what must be shown

Screen A: Create the administrator (required)

Fields: username, password, confirm password
Toggle "Use a different password for network shares (SMB)", off by default; when on, show SMB password + confirm fields
Username validation: lowercase letters, digits, -, _, must start with a letter, length limits, reserved names blocked
Password validation: minimum length (align with the real policy; SMB minimum is currently 4), fields must match, optional strength indicator
Show/hide password toggle
Read-only note: the admin is automatically added to nas-admins
Live validation messages; Next disabled until the form is valid

Screen B: Add starting users (optional)

"Skip" and "Add user" buttons
Repeatable user form (add/remove): username, password + confirm, optional separate SMB password
Checkbox "Add this user to nas-admins" per user
Same validation as the admin screen
Usernames unique across the admin and all starting users
Summary of all accounts to be created (name + role Admin/User), passwords not shown

Back-end: what it must do

POST /api/accounts/create with body:

{
  "admin": { "username": "...", "password": "...", "smbPassword": null },
  "users": [ { "username": "...", "password": "...", "smbPassword": "...", "admin": false } ]
}

Optional POST /api/accounts/validate (validation without creating anything)
Server-side validation: username format, uniqueness, reserved names, password policy
Create the admin first (always in nas-admins), then the users in order, using nas-add-user
If smbPassword is empty, the SMB password equals the account password (via nas-set-smb-password)
Pass passwords via stdin only; never log them or put them in arguments, URLs or responses; clear them from memory after use
On failure: report which account failed and why
Reject the request if the storage has not been provisioned yet

kyrylo added this to the Kanban project

Rows
Columns

WIZ-USERS: Installation wizard – default admin and starting users #212

Goal

Context

Scripts the backend can use

Front-end: what must be shown

Back-end: what it must do