Edu-Carone-SA makes Mike an admin-provisioned system

This fork turns account access from self-service signup into a controlled administrative workflow.

securityworkflow

The team has added a proper control point for who gets into Mike and what they can do once inside. Public signup is switched off, so new accounts must be created by an administrator.

Administrators can now:

Create, disable and re-enable user accounts.
Reset passwords and revoke active sessions when access needs to be cut off.
Change user roles, with protection against removing the last administrator.
Review an audit trail of account and access changes.

The fork also includes a separate database-migration container for one-off deployment tasks, after staging issues with secure connections and machine architecture. An early form-submission fault that made valid user details appear invalid has been corrected.

Managing partners, GCs and legal-ops teams should care if controlled onboarding and a clear access trail matter more than open registration.

So what This is a useful pattern for organisations that need named accountability over access before they put legal work into the system.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

2 commits from Edu-Carone-SA/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`b107b864`	MIKE-05: User Administration - admin-only user management (#13)	EduardoCarone	2026-07-12	↗ GitHub
commit body * feat(db): add user administration schema - role, status, audit log * feat(api): add admin endpoints for user management * feat(ui): add user administration page and disable public signup * test(admin): cover requireAdmin middleware - role, status, error cases * docs(sprint): document MIKE-05 user administration checkpoint * fix(admin): POST endpoints, last-admin protection, disabled user check, audit fields, confirmations, docs * feat(infra): dedicated db-migrate image with psql for ECS migrations - postgres:17-alpine base with psql - run-migrations.sh uses DATABASE_URL via Secrets Manager - PGSSLMODE=require for RDS SSL enforcement - ON_ERROR_STOP=1 for non-zero exit on SQL error - Schema validation built into the script - Fixes: SSL_ERROR (RDS force_ssl=1), ARCHITECTURE_MISMATCH (wrong image) --------- Co-authored-by: Januário <januario@Januarios-Mac-mini.local>
`ade0a0dd`	fix(api): add Content-Type header to POST/PATCH requests (#18)	EduardoCarone	2026-07-12	↗ GitHub
commit body * ci(deploy): fix VPC_SUBNETS to comma-separated for run-task AWS CLI run-task expects comma-separated subnet IDs in awsvpcConfiguration, not space-separated. * fix(api): add Content-Type: application/json to all POST/PATCH requests The apiRequest function was not setting Content-Type header. Express.json() middleware only parses body when Content-Type is application/json, so POST /admin/users received an empty body, causing 'Valid email is required' even for valid emails. This affected all POST/PATCH admin endpoints (create user, change role, disable, enable, reset password, revoke sessions). --------- Co-authored-by: Januário <januario@Januarios-Mac-mini.local>

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-970.md from inside the repo you want the changes in.

⬇ Download capture-thread-970.md