Class AdminAccountChanges

java.lang.Object
com.iizix.server.user.AdminAccountChanges
public final class AdminAccountChanges extends Object
What an administrator changes on another user's account in ServerAdmin's Edit user (CC-ACCOUNT-EMAIL-PASSWORD, the owner's rulings AE-1 to AE-5 of 2026-10-11): the password and the registered e-mail address. The administrator's OWN account is refused here with a message that points to Sign-in & security, where the current password is asked (AE-2).

The password (AE-1). Checked against the password policy that applies to the user and against the user's password history exactly as the SignIn module's change of password checks them (PasswordPolicy.check, BasicUserInfo.isPasswordInHistory with the policy's history length), then written with "must change at next sign-in" as the administrator ticked it (BasicUserInfo.writePasswordSetByAdministrator(Connection, String, boolean, int)): the failed sign-ins are forgotten and every device token of the user is revoked, as every change of a password does. The administrator's authority: a disabled user's password may be set (the user still cannot sign in while disabled). An external Sign In Provider's account has no password and is refused. The password is never logged and never put in a message.

The address (AE-3). Takes effect at once, unverified (AccountEmailChange.writeEmail(Connection, BasicUserInfo, String, boolean, long): the one write), refused when it has not the form of an address, for an external account, and when the user name is the current address (a rename, out of scope); a shared address is allowed (EM-D-1, CC-FIX-SIGNIN-ACCOUNT-MAIL). A verification mail goes to the new address and a notice to the old one when a mail sender is configured; a mail that cannot be sent does not undo the change, it is reported to the administrator.

Audit and notice (AE-5). One INFO line per change names the administrator, the user and what changed; never a password, never a full address (EmailAddressForm.masked(String)). A notice is mailed to the user's address when the password was set, and to the old address when the address was set, both through AccountNotices in the user's language with when, where and by whom (SD-D-3); a failed notice is logged at WARNING and changes nothing.

Sign out of all devices (DV-1) and reset the sign-in methods (DV-2) (CC-SERVERADMIN-SIGNOUT-DEVICES, the owner's ruling of 2026-10-13 04:20). signOutEverywhere(IAuthenticatedUser, BasicUserInfo, AdminAccountChanges.ISessionEnder, MailSender, AccountEmailChange.IMailStep, AccountNotices.Context) forgets every device the user stays signed in on and every device trusted for the second step (DeviceTokenStore.revokeAll(Connection,long)) and ends the user's open sessions in every application now (AdminAccountChanges.ISessionEnder, UserSessionEnder in the server); the password, the passkeys and the authenticator app are kept. resetSignInMethods(IAuthenticatedUser, BasicUserInfo, AdminAccountChanges.ISessionEnder, MailSender, AccountEmailChange.IMailStep, AccountNotices.Context) does that and deletes the user's passkeys (PasskeyStore.removeAll(Connection, long)), authenticator app and recovery codes (MFAStore.remove(Connection, long)), the stores emptied in ONE transaction, with one WARNING in the log that carries counts and no secret. Both are refused on the administrator's own account (AE-2) and tell the user by mail (AccountNotices: the reset is a critical notice, the sign-out is not).

The mails go through a delivery step so that the engine is proven without a mail server (AdminAccountChangesTest); ServerAdmin passes Mail::queue.

Author:
Christopher Mindus

  • Field Details

    • OWN_ACCOUNT

      public static final String OWN_ACCOUNT
      The refusal of the administrator's own account (AE-2).
      See Also:

    • NOTHING

      public static final AdminAccountChanges.Outcome NOTHING
      The outcome of a change that was not asked for: nothing to do, nothing to report.

    • OWN_ACCOUNT_DEVICES

      public static final String OWN_ACCOUNT_DEVICES
      The refusal of the administrator's own account for the device actions (AE-2).
      See Also:

  • Method Details

    • isOwnAccount

      public static boolean isOwnAccount(IAuthenticatedUser admin, BasicUserInfo user)
      Checks if the user is the administrator's own account.
      Parameters:
      admin - The administrator, null for none signed in.
      user - The user edited.
      Returns:
      true for the own account.

    • setPassword

      public static AdminAccountChanges.Outcome setPassword(IAuthenticatedUser admin, BasicUserInfo user, String password, boolean mustChange, PasswordPolicy policy, MailSender sender, AccountEmailChange.IMailStep deliver, AccountNotices.Context context)
      Sets the password of another user (AE-1).
      Parameters:
      admin - The administrator making the change.
      user - The user whose password is set.
      password - The new password, in clear; never logged.
      mustChange - true when the user must change it at the next sign-in.
      policy - The password policy that applies to the user.
      sender - The mail sender for the notice to the user, null for none configured.
      deliver - The delivery step of the notice.
      context - Where the administrator acts from, for the notice.
      Returns:
      The outcome: the refusal, or done with a notice when the user could not be told.
      Throws:
      NullPointerException - If the user, the password, the policy, the delivery step or the context is null.

    • setEmail

      public static AdminAccountChanges.Outcome setEmail(IAuthenticatedUser admin, BasicUserInfo user, String newEmail, MailSender sender, AccountEmailChange.IMailStep deliver, Function<String,String> verificationLink, AccountNotices.Context context)
      Sets the registered e-mail address of another user (AE-3): at once, unverified.
      Parameters:
      admin - The administrator making the change.
      user - The user whose address is set; its email is final, the caller re-reads the user afterwards (the cached user is refreshed here).
      newEmail - The new address, as typed (trimmed here).
      sender - The mail sender for the verification mail and the notice, null for none configured.
      deliver - The delivery step of the mails.
      verificationLink - Makes the sealed verification link of an address, null when none can be made (the server has no external URL or no key).
      context - Where the administrator acts from, for the notice to the old address.
      Returns:
      The outcome: the refusal, or done with a notice when a mail could not be sent; NOTHING when the address is the current one.
      Throws:
      NullPointerException - If the user, the address, the delivery step or the context is null.

    • signOutEverywhere

      public static AdminAccountChanges.DevicesOutcome signOutEverywhere(IAuthenticatedUser admin, BasicUserInfo user, AdminAccountChanges.ISessionEnder ender, MailSender sender, AccountEmailChange.IMailStep deliver, AccountNotices.Context context)
      Signs another user out of every device (DV-1): every device token of the user is deleted - the devices that stay signed in and the devices trusted for the second step alike - in one transaction, then the user's open sessions in every application are ended. The password, the passkeys and the authenticator app are kept. One INFO line names the administrator, the user and the counts; the user is told by mail unless the notices are off (AM-1).
      Parameters:
      admin - The administrator making the change.
      user - The user signed out.
      ender - Ends the user's open sessions.
      sender - The mail sender for the notice to the user, null for none configured.
      deliver - The delivery step of the notice.
      context - Where the administrator acts from, for the notice.
      Returns:
      The outcome: the refusal, or done with a notice when the user could not be told.
      Throws:
      NullPointerException - If the user, the ender, the delivery step or the context is null.

    • resetSignInMethods

      public static AdminAccountChanges.DevicesOutcome resetSignInMethods(IAuthenticatedUser admin, BasicUserInfo user, AdminAccountChanges.ISessionEnder ender, MailSender sender, AccountEmailChange.IMailStep deliver, AccountNotices.Context context)
      Resets the sign-in methods of another user (DV-2): in ONE transaction the authenticator app and the recovery codes (MFAStore.remove(Connection, long)), the passkeys (PasskeyStore.removeAll(Connection, long)) and every device token (DeviceTokenStore.revokeAll(Connection,long)) are deleted - a store the database does not have is looked for, never created - then the user's open sessions in every application are ended. The password and the profile are kept: the user signs in with the password and sets the methods up again. One WARNING names the administrator, the user and the counts, never a secret; the user is told by mail whatever the notices setting (AM-1).
      Parameters:
      admin - The administrator making the change.
      user - The user whose methods are reset.
      ender - Ends the user's open sessions.
      sender - The mail sender for the notice to the user, null for none configured.
      deliver - The delivery step of the notice.
      context - Where the administrator acts from, for the notice.
      Returns:
      The outcome: the refusal, or done with a notice when the user could not be told.
      Throws:
      NullPointerException - If the user, the ender, the delivery step or the context is null.