feat(console): improve user and project onboarding

.github/scripts/test-nightly-release-workflows.sh

@@ -5,6 +5,7 @@ repository_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 nightly_workflow="$repository_root/.github/workflows/nightly-release.yml"
 release_workflow="$repository_root/.github/workflows/release.yml"
 sandbox_workflow="$repository_root/.github/workflows/sandbox-images-beta.yml"
+e2e_workflow="$repository_root/.github/workflows/e2e-tests.yml"
 decision_script="$repository_root/.github/scripts/nightly-release-decision.sh"
 validation_script="$repository_root/.github/scripts/validate-release-ref.sh"
 
@@ -43,13 +44,18 @@ if [[ "$tag_aware_dispatch_count" -ne 5 ]]; then
   fail "expected release channel and version logic to distinguish dry-runs from tag dispatches"
 fi
 
-ruby - "$repository_root" "$nightly_workflow" "$release_workflow" "$sandbox_workflow" <<'RUBY'
+ruby - "$repository_root" "$nightly_workflow" "$release_workflow" "$sandbox_workflow" "$e2e_workflow" <<'RUBY'
 require "yaml"
 
 repository_root = ARGV[0]
 nightly = YAML.safe_load(File.read(ARGV[1]), aliases: true)
 release = YAML.safe_load(File.read(ARGV[2]), aliases: true)
 sandbox = YAML.safe_load(File.read(ARGV[3]), aliases: true)
+e2e = YAML.safe_load(File.read(ARGV[4]), aliases: true)
+
+e2e_sandbox_channel = e2e.dig("jobs", "e2e-test", "env", "TEMPS_SANDBOX_CHANNEL")
+abort "E2E must pull the beta sandbox images published for main and PR builds" unless
+  e2e_sandbox_channel == "beta"
 
 check_permissions = nightly.dig("jobs", "check-and-tag", "permissions")
 abort "check-and-tag permissions are not read-actions/write-contents" unless

.github/workflows/e2e-tests.yml

@@ -56,6 +56,11 @@ jobs:
       # 0/false/off/no/disabled — see temps-telemetry/src/service.rs.)
       TEMPS_TELEMETRY: "0"
       TEMPS_BIN: ./ci-prebuilt/temps
+      # Main and PR builds exercise the beta binary channel. Point sandbox
+      # pulls at the matching published image set; the default stable tag is
+      # only published by a stable release and otherwise forces a multi-minute
+      # local image build that exceeds Playwright's request timeout.
+      TEMPS_SANDBOX_CHANNEL: beta
 
     steps:
       - name: Free up disk space

crates/temps-agents/src/handlers/definitions.rs

@@ -1613,6 +1613,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,

crates/temps-ai-api-tools/src/caller.rs

@@ -2513,6 +2513,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,
@@ -2553,6 +2554,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,
@@ -2606,6 +2608,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,

crates/temps-ai-api-tools/src/integration_tests.rs

@@ -44,6 +44,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,

crates/temps-ai-chat/src/handlers.rs

@@ -1280,6 +1280,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,

crates/temps-ai-chat/src/pending_actions.rs

@@ -590,6 +590,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,

crates/temps-ai-chat/src/service.rs

@@ -2170,6 +2170,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,

crates/temps-analytics-events/src/handlers/events_handler.rs

@@ -1220,6 +1220,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,

crates/temps-audit/src/handlers/handlers.rs

@@ -154,6 +154,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,

crates/temps-auth/src/apikey_handler.rs

@@ -582,6 +582,7 @@ mod tests {
             email_verification_expires: None,
             password_reset_token: None,
             password_reset_expires: None,
+            must_change_password: false,
             deleted_at: None,
             mfa_secret: None,
             mfa_enabled: false,

crates/temps-auth/src/apikey_types.rs

@@ -94,7 +94,9 @@ impl RoleInfo {
             Role::PlatformAdmin => {
                 "Platform administration (users, settings, system) without deploy access to projects or deployments"
             }
-            Role::User => "Standard user access with ability to manage own resources",
+            Role::User => {
+                "Manage every existing and future project without user or system administration"
+            }
             Role::Reader => "Read-only access to resources",
             Role::ApiReader => "Read-only API access",
             Role::Custom => "Custom role with specific permissions",
@@ -123,3 +125,41 @@ pub fn get_available_permissions() -> AvailablePermissions {
 
     AvailablePermissions { permissions, roles }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashSet;
+
+    #[test]
+    fn role_catalog_exposes_the_exact_permission_set() {
+        let catalog = get_available_permissions();
+        let user = catalog
+            .roles
+            .iter()
+            .find(|role| role.name == "user")
+            .expect("user role is present");
+        let expected: Vec<String> = Role::User
+            .permissions()
+            .iter()
+            .map(ToString::to_string)
+            .collect();
+
+        assert_eq!(user.permissions, expected);
+        assert!(user
+            .description
+            .contains("every existing and future project"));
+    }
+
+    #[test]
+    fn predefined_roles_do_not_report_duplicate_permissions() {
+        for role in Role::all() {
+            let unique: HashSet<_> = role.permissions().iter().collect();
+            assert_eq!(
+                unique.len(),
+                role.permissions().len(),
+                "role {role} contains duplicate permissions"
+            );
+        }
+    }
+}