feat(admin): provision a user with an emailed password reset instead of a set password

[waleedlatif1]

Summary

• Add-user modal gets a Credentials choice: Set a password (as before) or Email a reset link
• On the email path, Better Auth creates the user with no credential account and we immediately request the standard password reset email — so we never pick, type, or hold someone else's password
• The password field is now masked: dots while unfocused, revealed on focus, re-masked on blur, with an eye toggle to pin the reveal. Same treatment as the secrets tab and the SSO client secret
• Added a Reset password action on each admin user row, so a reset can be re-sent (also the recovery path if the email fails during creation)

Type of Change

• New feature

Testing

• ChipModalField inputType='password' unit tests cover mask-on-blur, reveal-on-focus, the read-only-until-focus anti-autofill guard, and the eye toggle
• addUser unit tests cover both paths: password omitted → reset email requested; create failure → no email sent; email failure → error names the row action
• Modal tests cover the field dropping out of the form and submitting without a password
• Not exercised in a running browser — the dev server here serves the main checkout, not this worktree

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 6, 2026 6:10pm

[cursor]

PR Summary

Medium Risk
Changes admin user creation and password-reset email flows in the client, but reuses the existing forget-password contract and treats partial success (user created, email failed) explicitly rather than altering server auth logic in this diff.

Overview
Admins can provision users without setting a password: the add-user modal adds a Credentials choice between Set a password and Email a reset link. On the email path, addUser creates the Better Auth user without a password and immediately calls the same forget-password API the login page uses; success still closes the modal and surfaces the new user, while a failed reset email returns resetEmailError instead of failing the whole create so operators can retry from the user list.

The admin users table adds a per-row Reset password action (with sending/sent feedback) and widens the actions column; create-time reset failures show a provisionWarning that points operators to that action.

ChipModalField with inputType='password' now uses a dedicated masked text input (reveal on focus, eye toggle, read-only-until-focus) instead of a native password field, aligned with secrets/SSO fields elsewhere in the UI.

^{Reviewed by Cursor Bugbot for commit 6d04bce. Configure here.}

[greptile-apps]

Greptile Summary

The PR adds password-reset-link provisioning and per-user reset actions to the admin interface, while introducing a reusable masked password treatment for chip-modal inputs.

• Supports creating users without an administrator-selected password and sends the standard reset email afterward.
• Preserves successful account creation when email delivery fails and surfaces a retry path on the user row.
• Adds focus, mouse, and keyboard coverage for password reveal and remasking behavior.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/workspace/[workspaceId]/settings/components/admin/add-user-modal.tsx	Adds credential-mode selection and propagates partial reset-email failures after successful user creation.
apps/sim/app/workspace/[workspaceId]/settings/components/admin/admin.tsx	Adds row-level password-reset actions and clearly surfaces provisioning-email failures.
apps/sim/hooks/queries/admin-users.ts	Supports passwordless provisioning followed by a reset-email request while preserving the created-user result on delivery failure.
packages/emcn/src/components/chip-modal/chip-modal.tsx	Adds the masked password control and contains the corrected mouse focus handling and dedicated props interface.
packages/emcn/src/components/chip-modal/chip-modal.test.tsx	Covers masking, focus transitions, mouse activation, and keyboard toggle behavior.

Sequence Diagram

sequenceDiagram
  participant Admin
  participant Modal as Add-user modal
  participant Auth as Better Auth
  participant Reset as Password reset endpoint
  Admin->>Modal: Choose Email a reset link
  Modal->>Auth: Create user without password
  Auth-->>Modal: Created user
  Modal->>Reset: Request reset email
  alt Email sent
    Reset-->>Modal: Success
    Modal-->>Admin: Show created user
  else Email failed
    Reset-->>Modal: Error
    Modal-->>Admin: Show user and retry warning
  end

Loading

_{Reviews (4): Last reviewed commit: "test(emcn): cover keyboard activation of..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8dadbec. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 29fa87a. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6d04bce. Configure here.}