agentic-mobile-control/openspec/changes/remove-static-cloud-credentials/specs/cloud-operator-authentication/spec.md

ADDED Requirements

Requirement: Cloud operator sessions are the only human API authentication path

The system SHALL authorize human Cloud API operations through persistent Cloud user sessions and SHALL not require configured static bearer credentials for production startup or normal Console operation.

Scenario: Production starts without credential JSON

• WHEN the Cloud API starts in production with a current database schema and no configured public, Host, or enrollment credential JSON
• THEN the application starts, exposes health and authentication routes, and rejects unauthenticated protected API requests

Scenario: Signed-in operator uses a protected API route

• WHEN an enabled Cloud user has a valid session and calls an operation allowed by the user's role scopes
• THEN the operation is authorized without an Authorization bearer header

Requirement: The Console contains no token or user-directory management surface

The Console SHALL offer login, logout, current-account display, and password change, and SHALL not render bearer-token controls, token persistence, Users navigation, or user-management forms.

Scenario: Unauthenticated operator opens the Console

• WHEN no valid user session exists
• THEN the Console presents the username/password login flow without an API token alternative

Scenario: Administrator opens the Console

• WHEN an administrator signs in
• THEN the Console presents normal authorized operational views but no user-directory navigation or account lifecycle form

Requirement: Account provisioning and recovery remain interactive administration operations

The system SHALL retain interactive, non-echoed administration CLI commands to create, reset, enable, and revoke Cloud user accounts without accepting passwords through Compose configuration or command-line arguments.

Scenario: Initial administrator is created after deployment

• WHEN an operator runs device-cloud-admin users create against the migrated Cloud database and completes the password prompts
• THEN an enabled administrator account is created without a deployment token or plaintext password in process arguments