feat(users): passwordless user creation via emailed set-password link, display full name instead of username

Admins now create users with a name + email (no password) and role;
a Send Email action (per-user, also reusable for resets) issues a
one-time token and POSTs it to an admin-configurable webhook URL —
intended for a Power Automate flow that delivers the actual email.
The old admin-sets-the-password flow is kept server-side
(LegacyUserCreateWithPassword) but no longer wired into the UI.

Every user-facing surface (top bar, sidebar, user management, audit
log, assignee pickers, dispute notifications) now shows full_name
instead of username, falling back to username when unset.

Also fixes long attack_procedure/expected_detection/suggested_text
text overflowing its container in the template review panels and
Red/Blue team fields (missing break-words on whitespace-pre-wrap
blocks).

backend/tests/test_password_setup_flow.py

@@ -0,0 +1,132 @@
+"""End-to-end coverage for the passwordless user creation + emailed
+set-password-link flow (also reused for password resets).
+"""
+
+import uuid
+from unittest.mock import patch
+
+import pytest
+
+
+@pytest.fixture
+def new_user_id(api, auth_headers):
+    resp = api(
+        "post", "/api/v1/users", auth_headers,
+        json={"full_name": "Set Password User", "email": "setpw@test.com", "role": "viewer"},
+    )
+    assert resp.status_code == 201, resp.text
+    return resp.json()["id"]
+
+
+def test_send_password_email_requires_webhook_configured(api, auth_headers, new_user_id):
+    resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+    assert resp.status_code == 400
+    assert "webhook" in resp.text.lower()
+
+
+def test_admin_can_configure_password_webhook(api, auth_headers):
+    resp = api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["configured"] is True
+
+    get_resp = api("get", "/api/v1/system/password-webhook-config", auth_headers)
+    assert get_resp.json()["url"] == "https://example.com/power-automate-hook"
+
+
+def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_headers, new_user_id):
+    api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+
+    with patch("app.services.password_setup_service.requests.post") as mock_post:
+        resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+    assert resp.status_code == 200, resp.text
+    mock_post.assert_called_once()
+    call_kwargs = mock_post.call_args
+    assert call_kwargs.args[0] == "https://example.com/power-automate-hook"
+    assert call_kwargs.kwargs["json"]["email"] == "setpw@test.com"
+    assert "token=" in call_kwargs.kwargs["json"]["set_password_url"]
+
+    from app.models.password_setup_token import PasswordSetupToken
+    token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()
+    assert token_row is not None
+    assert token_row.used_at is None
+
+
+def test_set_password_with_valid_token_succeeds(api, db, auth_headers, new_user_id):
+    api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+    with patch("app.services.password_setup_service.requests.post"):
+        api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+
+    from app.models.password_setup_token import PasswordSetupToken
+    token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()
+
+    validate = api("get", f"/api/v1/auth/set-password/validate?token={token_row.token}", {})
+    assert validate.status_code == 200
+    assert validate.json()["valid"] is True
+    assert validate.json()["full_name"] == "Set Password User"
+
+    resp = api(
+        "post", "/api/v1/auth/set-password", {},
+        json={"token": token_row.token, "new_password": "BrandNewPass123!@#"},
+    )
+    assert resp.status_code == 200, resp.text
+
+    login = api(
+        "post", "/api/v1/auth/login", {},
+        data={"username": "setpw@test.com", "password": "BrandNewPass123!@#"},
+    )
+    assert login.status_code == 200, login.text
+
+
+def test_set_password_token_cannot_be_reused(api, db, auth_headers, new_user_id):
+    api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+    with patch("app.services.password_setup_service.requests.post"):
+        api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+
+    from app.models.password_setup_token import PasswordSetupToken
+    token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()
+
+    first = api(
+        "post", "/api/v1/auth/set-password", {},
+        json={"token": token_row.token, "new_password": "BrandNewPass123!@#"},
+    )
+    assert first.status_code == 200
+
+    second = api(
+        "post", "/api/v1/auth/set-password", {},
+        json={"token": token_row.token, "new_password": "AnotherPass456!@#"},
+    )
+    assert second.status_code == 400
+
+
+def test_set_password_invalid_token_rejected(api):
+    validate = api("get", "/api/v1/auth/set-password/validate?token=not-a-real-token", {})
+    assert validate.status_code == 200
+    assert validate.json()["valid"] is False
+
+    resp = api(
+        "post", "/api/v1/auth/set-password", {},
+        json={"token": "not-a-real-token", "new_password": "BrandNewPass123!@#"},
+    )
+    assert resp.status_code == 404
+
+
+def test_password_webhook_config_requires_admin(api, red_lead_headers):
+    resp = api("get", "/api/v1/system/password-webhook-config", red_lead_headers)
+    assert resp.status_code == 403
+
+
+def test_send_password_email_requires_admin(api, red_lead_headers, new_user_id):
+    resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", red_lead_headers)
+    assert resp.status_code == 403

backend/tests/test_security_validators.py

@@ -10,7 +10,7 @@ if backend_dir not in sys.path:
 import pytest
 from pydantic import ValidationError
 
-from app.schemas.user import UserCreate
+from app.schemas.user import LegacyUserCreateWithPassword as UserCreate
 
 
 # ── Username validation ──────────────────────────────────────────────

backend/tests/test_user_api_validation.py

@@ -1,28 +1,30 @@
-"""API-level validation tests for user creation (SEC-004, SEC-007)."""
+"""API-level validation tests for user creation (SEC-004, SEC-007).
+
+Users are created with a name + email — no password (see
+password_setup_service for the emailed set-password link flow) and no
+admin-supplied username (username is auto-derived from email).
+"""
 
 
-def test_create_user_weak_password_rejected(client, admin_user, admin_token):
+def test_create_user_missing_full_name_rejected(client, admin_user, admin_token):
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "newuser",
-            "password": "123",
+            "full_name": "",
             "email": "new@test.com",
             "role": "viewer",
         },
         headers={"Authorization": f"Bearer {admin_token}"},
     )
     assert response.status_code == 422
-    assert "password" in response.text.lower()
 
 
-def test_create_user_reserved_username(client, admin_user, admin_token):
+def test_create_user_invalid_email_rejected(client, admin_user, admin_token):
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "system",
-            "password": "SecurePass123!@#",
-            "email": "sys@test.com",
+            "full_name": "New User",
+            "email": "not-an-email",
             "role": "viewer",
         },
         headers={"Authorization": f"Bearer {admin_token}"},
@@ -30,33 +32,21 @@ def test_create_user_reserved_username(client, admin_user, admin_token):
     assert response.status_code == 422
 
 
-def test_create_user_invalid_username_chars(client, admin_user, admin_token):
+def test_create_user_valid_request_accepted(client, admin_user, admin_token):
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "../admin",
-            "password": "SecurePass123!@#",
-            "email": "bad@test.com",
-            "role": "viewer",
-        },
-        headers={"Authorization": f"Bearer {admin_token}"},
-    )
-    assert response.status_code == 422
-
-
-def test_create_user_valid_password_accepted(client, admin_user, admin_token):
-    response = client.post(
-        "/api/v1/users",
-        json={
-            "username": "validuser99",
-            "password": "ValidPass123!@#",
+            "full_name": "Valid User",
             "email": "valid@test.com",
             "role": "viewer",
         },
         headers={"Authorization": f"Bearer {admin_token}"},
     )
-    assert response.status_code == 201
-    assert response.json()["username"] == "validuser99"
+    assert response.status_code == 201, response.text
+    body = response.json()
+    assert body["full_name"] == "Valid User"
+    assert body["username"] == "valid@test.com"
+    assert body["must_change_password"] is True
 
 
 def test_create_user_with_manager_role_accepted(client, admin_user, admin_token):
@@ -65,8 +55,7 @@ def test_create_user_with_manager_role_accepted(client, admin_user, admin_token)
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "newmanager",
-            "password": "ValidPass123!@#",
+            "full_name": "New Manager",
             "email": "newmanager@test.com",
             "role": "manager",
         },
@@ -80,8 +69,7 @@ def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "badroleuser",
-            "password": "ValidPass123!@#",
+            "full_name": "Bad Role User",
             "email": "badrole@test.com",
             "role": "superuser",
         },
@@ -89,3 +77,20 @@ def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
     )
     assert response.status_code == 400
     assert "Invalid role" in response.text
+
+
+def test_create_user_duplicate_email_rejected(client, admin_user, admin_token):
+    payload = {
+        "full_name": "Dup User",
+        "email": "dup@test.com",
+        "role": "viewer",
+    }
+    first = client.post(
+        "/api/v1/users", json=payload, headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert first.status_code == 201, first.text
+
+    second = client.post(
+        "/api/v1/users", json=payload, headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert second.status_code == 409