Users and access
Without signing in, only the sign-in page and /api/health are available. Roles include one another:
| Role | Can |
|---|---|
| Viewer | see everything, pick cases by changes without creating a run |
| Tester | + create and execute runs, assign people, import JUnit |
| Editor | + cases, suites, hygiene, tsmc push, deleting runs |
| Administrator | + projects, API tokens, users, milestones and sprints |
- Passwords are stored as scrypt hashes, sessions as SHA-256 hashes of the cookie (HttpOnly, SameSite=Lax, 30 days).
- Requests from the browser that change data must carry the
X-Requested-With: tsmcheader (CSRF protection). - After 5 failed sign-in attempts the “address + email” pair is locked for 15 minutes.
- Every case version records its author and the channel of the change (interface, API token,
tsmc push, JUnit import); the version history shows what changed from the previous version: fields and steps (added, removed, changed). - The audit log (administrators only, “Audit” in the header): sign-ins and failed attempts, users and roles,
tokens, creating and deleting projects, suites, cases and runs, archiving and pinning runs, milestones and
sprints, push and import — who, when, from which address. Passwords never get into the log. API:
GET /api/audit?action=run&project=SHOP&before=<id>. - Accounts are not deleted but disabled, so names stay in the history of results. Changing a password or disabling an account ends all of the user’s sessions. The last administrator cannot be demoted or disabled.
- A project API token acts as an editor and only within its project. The CLI (
tsmc) works with a token only. - In a run, a case has an assignee (the “Mine” filter) and every result has an author.
When opening the server to the network, put a reverse proxy with HTTPS in front of it (nginx, Caddy) and set
TSMC_SECURE_COOKIES=1, TSMC_TRUST_PROXY=1.