Admin Users

Creating an admin user involves initializing the logical L2 storage tree and generating a sealed SCRAM password verifier to ensure secure authentication. The system automatically handles workspace file operations to build the full user directory structure.

Resetting an admin password securely requires generating a new sealed SCRAM password verifier and clearing the logins.json file to revoke all active sessions. This prevents unauthorized access by ensuring previous session tokens are invalidated.

User lifecycle management removes admin accounts by deleting the user's root directory, which cleanly removes the entire local account tree including metadata and verifiers. Group membership configurations must be adjusted separately after deletion.

Yes, you can update user metadata fields such as full_name by reading, parsing, and rewriting the user.yaml file. The system ensures the canonical layout is preserved during metadata updates without manual intervention.

Yes, verifying _admin membership is required to perform administrative user management tasks. This permission check ensures only authorized operators can execute space.api calls for user creation, updates, and removal.