Backlog/v11 local user creation

[AlexSanchez-bit]

Main changes

• added local user creation endpoint
• added auto enabled user creation on that endpoint
• added a check option to locally create users on frontend

[github-actions]

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

🛑 architecture (silas-1.7-pro) — blocking — must fix before merge

Summary: Adds admin local user creation with password, bypassing activation and duplicating validation; touches auth/user provisioning and secret handling.

• high backend/src/main/java/com/park/utmstack/web/rest/UserResource.java:135 — New /api/users/local endpoint creates activated users with a supplied local password, bypassing the reset key/email activation flow. This is auth/user-provisioning logic and should be reviewed for consistency with existing authentication policies, role constraints, and audit requirements.
• high backend/src/main/java/com/park/utmstack/web/rest/UserResource.java:156 — Local password validation only requires length greater than 4, which is weak for account creation and may diverge from the system’s password policy. Centralize password validation in a shared auth/service layer instead of the REST controller.
• medium backend/src/main/java/com/park/utmstack/web/rest/UserResource.java:147 — The new endpoint repeats ID, login, and email uniqueness checks that are likely present in the existing user creation path. Move shared validation to UserService or a common provisioning component to avoid duplicated business logic across endpoints.
• medium backend/src/main/java/com/park/utmstack/service/UserService.java:139 — createUser(UserDTO, String localPassword) introduces a second provisioning mode inside the service. If local creation becomes more common, consider an explicit provisioning strategy or parameter object to keep activation, reset, and password rules in one place.
• low frontend/src/app/core/user/user.service.ts:22 — createLocal() is an additive client method and backward-compatible. No architectural breakage is expected, but keep user-management endpoint paths versioned or centrally defined if external integrations consume the API.

⚠️ bugs (silas-1.7-pro) — non-blocking warnings

Summary: No blocking defects found; local-user creation has validation/message mismatches and an inaccurate 400 toast.

• medium frontend/src/app/admin/user/user-update/user-management-update.component.html:144 — Local password input uses minlength='4' and the error says at least 4 characters, but UserResource rejects passwords with length <= 4. A 4-character password passes the form and then fails with a 400; align validation to require 5+ characters.
• medium frontend/src/app/admin/user/user-update/user-management-update.component.ts:86 — onSaveError treats every 400 as admin role removal. The new /users/local endpoint can return 400 for invalid password or existing ID/email, so users see the wrong toast. Inspect error details or message before choosing the toast.
• low frontend/src/app/admin/user/user-update/user-management-update.component.html:107 — Email input maxlength is 254, but the validation message says it cannot be longer than 100 characters.
• low frontend/src/app/admin/user/user-update/user-management-update.component.html:174 — Label 'Rol' appears to be a misspelling of 'Role' in the English user-management form.

🛑 security (silas-1.7-pro) — blocking — must fix before merge

Summary: New admin-only local user creation touches authentication/user provisioning and enforces only a >4-character password before activating the account.

• low backend/src/main/java/com/park/utmstack/web/rest/UserResource.java:156 — The /users/local endpoint allows creating fully activated users with passwords only longer than 4 characters. Enforce a stronger password policy (minimum length, complexity, and maximum length) and review whether immediate activation for locally created accounts is intended.

[utmstackprapprover]

Changes requested — Go dependencies check failed (see above).

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.

[AlexSanchez-bit]

• this dont bypass current flows cause activates the user in time
• dont interfere with activation logic cause created email is not the logged in user
• password valdiation is weak but follows platform password validatin policy
• state is cleared every timr form is open

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.

[github-actions]

❌ Go dependencies check failed

There are outdated Go dependencies, or modules that could not be inspected.
Run bash .github/scripts/go-deps.sh --update --discover locally and
commit the updated go.mod / go.sum files.

Script output

🔍 Discovered 25 Go projects

📦 Dependencies with updates available:

  📁 ./utmstack-collector:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/gcp:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/aws:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/alerts:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/events:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/inputs:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/stats:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/rule-flood-guard:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/o365:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/modules-config:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/config:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/soc-ai:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/sophos:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/azure:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/crowdstrike:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/bitdefender:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./plugins/geolocation:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./agent-manager:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./agent:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./as400:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

  📁 ./as400/updater:
     - github.com/threatwinds/go-sdk: v1.1.34 → v1.1.35

�[0;31m❌ Please update dependencies before merging.�[0m

[utmstackprapprover]

Changes requested — Go dependencies check failed (see above).