catborise 0b5eb990ed fix(admin): a forced password change cannot trap a user or be skipped with a token ... - The administrator's password form took "password-based authentication: Disabled" with "must change it at the next login": the change form asks for the old password, which the user then never had, so they could not get past it. That combination is refused, and an administrator cannot disable their own password. - A user who must change the password could still use the API with their tokens. A token is now refused until they change it, as the pages are.		2026-10-26 10:12:53 +03:00
..
__init__.py	test: each app keeps its tests in a tests package	2026-10-12 15:17:30 +03:00
test_audit_rows.py	fix(logs): blocking a blocked user writes no row; one upload submit path	2026-10-23 14:23:32 +03:00
test_logs_page.py	feat(admin): the Logs page searches every row, shows failures and downloads them	2026-10-25 23:08:42 +03:00
test_tombstones.py	test: each app keeps its tests in a tests package	2026-10-12 15:17:30 +03:00
test_user_create.py	test: each app keeps its tests in a tests package	2026-10-12 15:17:30 +03:00
test_user_pages.py	fix(admin): a forced password change cannot trap a user or be skipped with a token	2026-10-26 10:12:53 +03:00
test_user_update_next.py	test: each app keeps its tests in a tests package	2026-10-12 15:17:30 +03:00
test_views.py	feat(logs): admin changes and logins are recorded on the Logs page	2026-10-23 10:30:48 +03:00