TODO: Admin user mgmt page — QA nits from PR #11
TODO: Admin user mgmt page — QA nits from PR #11
Source
QA review of westside-app PR #11 (merged 2026-03-14). Non-blocking nits deferred to follow-up.
Items
- userId UUID validation — validate UUID format before passing to Keycloak Admin API. Prevents malformed IDs from reaching the API.
- Admin self-demotion protection — prevent an admin from removing their own admin role via the role dropdown. Could lock everyone out.
- Password-in-response documentation — document that the reset password is returned in the SvelteKit form action result (server-side only, not leaked to client network tab). Confirm Auth.js session doesn't cache it.
Priority
Low — non-blocking nits. The first two are defensive hardening. The third is documentation only.