pal-e-docs

Phase 21: Enterprise Auth — Self-Service Password Management

phase-wkq-21-enterprise-auth Phase

phase
Project
Goal: Enterprise-grade auth. No generated passwords. Self-service everything.
Owner: Dev agent
Repo: forgejo_admin/basketball-api, forgejo_admin/westside-app
Depends on: Phase 28: Keycloak SMTP (plan-pal-e-platform)
Existing issue: basketball-api #129

Scope

  • Change create_keycloak_user() to skip password generation
  • Use Keycloak execute-actions-email API for "set your own password" flow (net-new integration)
  • Remove plaintext passwords from announcement email templates
  • Backfill script: trigger password setup email for all existing parents
  • basketball-api #132 custom flow stays as branded UX enhancement
  • Keycloak native flow works as fallback
Independent of Phase 22 (Capacitor Init) — can run in parallel.

Acceptance Criteria

  • New registrations: no password generated, parent receives "set your password" email
  • Existing parents: backfill script triggers password setup for all accounts
  • Announcement emails contain no plaintext passwords
  • "Forgot Password?" works via both Keycloak native AND custom flow (#132)