T0-E1.1 Credential Path Inventory

Metadata	Value
Mode	Server development /home/scola/odoo
Docs read	workspace-governance.md, development-guide.md, architecture-api.md, T0-E1.1-preflight.md, T0-D-DEC-014.md, T0-D-credential-surface-inventory.md
Tranche	T0-E1.1 (corrective; does not claim T0 closed)
Denominator	custom_addons_scola/gcgscola/scripts/golden/credential_contract_cases.json

V1 contract (DEC-014 — stated for E1.1)

Flow	V1 mechanism
Admin / school provision	Server-generated temporary password + scola_must_change_password=True (V1 chosen for admin provision surfaces)
Public recovery	Scola password-reset tokens (purpose=password_reset) via /api/auth/password-reset/*
Activation token	purpose=activation / admin_reset remains an allowed DEC-014 alternative; product call sites must use it or temporary+must_change — not unused purpose alone
Rejected	Caller-chosen reusable initial passwords; shared school defaults; native Odoo /web/reset_password / /web/signup as customer lifecycle; SPMB OTP as password-reset substitute

No unclassified production-capable credential path may remain.

Classification legend

Code	Meaning
CANONICAL_CREATE	Retained V1 establishment / provision path
CANONICAL_RECOVERY	Retained V1 recovery / admin-reset / force-change path
TEST_FIXTURE_ONLY	Golden/demo seed only; must not activate in production provisioning
INTERNAL_PROVIDER_ONLY	Platform/foundation/ops bootstrap — not school self-service recovery
DISABLED_LEGACY	Previously reachable; now blocked/disabled (expect deny/404/410)
REMOVE	Dead stub / leftover; delete or stop exposing
DECISION_REQUIRED	Needs explicit product/security follow-up outside V1 freeze

---

Inventory

Surface ID	Path / entry	Actor	Classification	V1 notes
USER-CREATE	POST /api/v1/users	school/platform admin with user-mgmt	CANONICAL_CREATE	Server-generated temporary + must_change; caller password ignored
UNIT-CREATE-ADMIN	POST /api/school/units/users/create-admin	platform / elevated	INTERNAL_PROVIDER_ONLY	Temporary + must_change; not school self-service recovery
ACCT-GEN-STUDENTS	POST /api/v1/admin/accounts/generate-students	school admin	CANONICAL_CREATE	Random temps + must_change
ACCT-GEN-PARENTS	POST /api/v1/admin/accounts/generate-parents	school admin	CANONICAL_CREATE	Random temps + must_change; no shared defaults
FACULTY-AUTO-USER	op.faculty auto-create user	system/admin	CANONICAL_CREATE	Random password; no plaintext log
ACCT-BULK-PARENT-RESET	POST /api/v1/admin/accounts/reset-parent-passwords	—	DISABLED_LEGACY	410 Gone (T0F-005 / T0F-014 denominator)
NATIVE-RESET	GET/POST /web/reset_password	public	DISABLED_LEGACY	ICP off + native_reset_block → 404
NATIVE-SIGNUP	GET /web/signup?token=…	public	DISABLED_LEGACY	Blocked → 404; not a second DEC-014 lifecycle
PWD-ADMIN-RESET	POST /api/v1/users/<id>/reset-password	admin with scope	CANONICAL_RECOVERY	DEC-014 §D: admin-provided ≥8 + must_change; no plaintext in response (admin already chose value); tenant-scoped
PWD-RESET-REQUEST	POST /api/auth/password-reset/request	public	CANONICAL_RECOVERY	Anti-enumeration; recovery token issue
PWD-RESET-CONFIRM	POST /api/auth/password-reset/confirm	public	CANONICAL_RECOVERY	Single-use password-reset token consume
PWD-CHANGE-SELF	POST /api/auth/change-password	authed	CANONICAL_RECOVERY	Clears must_change; revokes other sessions
SPMB-OTP	/api/SPMB/account/* OTP register/verify	applicant	CANONICAL_CREATE	Not password-reset; separate activation channel
DEMO-SEED-SCRIPTS	Golden/demo provision scripts (scripts/golden/seed_*, ops onboard)	ops/QA	TEST_FIXTURE_ONLY	Secrets via env; never production defaults
PLAT-SCHOOL-ADMIN-CREATE	POST /api/v1/platform/school-admins/create	platform_operator	INTERNAL_PROVIDER_ONLY	Temporary + must_change in response
FOUND-HR-LINK-OR-CREATE	POST /api/v1/foundation/hr/users/link-or-create	foundation HR	INTERNAL_PROVIDER_ONLY	Temporary + must_change on create
FOUND-PWD-RESET-DEAD	registry/FE dead foundation reset	—	REMOVE	Do not resurrect without DEC; use admin reset
PWD-REGISTER-STUB	FE /register	public	REMOVE	Stub; not V1
BREAK-GLASS-CUSTOMER	customer login-as / break-glass	—	DISABLED_LEGACY	Must stay absent/denied on customer surface
ACTIVATION-TOKEN-PURPOSE	scola.credential.recovery.token purpose=activation	system	CANONICAL_CREATE	Allowed DEC-014 path; must have real call site if claimed
IMPORT-BULK-CREDENTIAL	admin import creating users	admin	DECISION_REQUIRED	Must map to temporary+must_change or be denied; no plaintext defaults

---

Classification summary

Classification	Surfaces
CANONICAL_CREATE	/api/v1/users, generate students/parents, faculty auto-user, SPMB OTP (separate), activation token purpose
CANONICAL_RECOVERY	public reset request/confirm, self change-password, admin reset
INTERNAL_PROVIDER_ONLY	school-unit create-admin, platform school-admin create, foundation HR link-or-create
TEST_FIXTURE_ONLY	demo/Golden seed scripts
DISABLED_LEGACY	bulk parent reset 410, native reset, native signup
REMOVE	foundation dead reset route, /register stub
DECISION_REQUIRED	import/bulk credential establishment mapping completeness

---

Explicit non-claims

• This inventory does not declare T0 closed.
• SPMB OTP is not a password-reset recovery path.
• Native Odoo signup/reset remain outside the customer DEC-014 lifecycle.