feat: add temporary-password onboarding flow

chat_interface.py

@@ -205,6 +205,29 @@ def require_authenticated_email(request: gr.Request = None, user_email: str = No
     )
 
 
+def resolve_app_url_for_invite(request: gr.Request = None) -> str:
+    """Resolve the public app URL for copy/paste onboarding invites."""
+    configured_url = (
+        os.getenv("DEMOPREP_APP_URL", "").strip()
+        or os.getenv("PUBLIC_APP_URL", "").strip()
+        or os.getenv("SPACE_HOST", "").strip()
+    )
+    if configured_url:
+        if configured_url.startswith("http"):
+            return configured_url.rstrip("/")
+        return f"https://{configured_url.strip('/')}"
+
+    try:
+        headers = getattr(request, "headers", {}) if request else {}
+        referer = headers.get("referer") or headers.get("origin") or ""
+        if referer:
+            return referer.split("?")[0].rstrip("/")
+    except Exception:
+        pass
+
+    return "https://thoughtspot-dp-test-demoprep.hf.space"
+
+
 def build_initial_chat_message(company: str, use_case: str) -> str:
     """Build the pre-filled chat message from current settings."""
     if company and use_case:
@@ -264,6 +287,23 @@ class ChatDemoInterface:
         """Resolve and cache effective user identity for settings access."""
         self.user_email = require_authenticated_email(user_email=self.user_email)
         return self.user_email
+
+    def _temporary_password_block_message(self) -> str:
+        """Return a blocking message when a temp-password user tries to run the app."""
+        try:
+            from supabase_client import UserManager
+            user_email = self._get_effective_user_email()
+            um = UserManager()
+            if um.enabled and um.must_change_password(user_email):
+                return (
+                    "🔒 **Password change required**\n\n"
+                    "You are signed in with a temporary password. "
+                    "Open **Settings → Change Password**, set your own password, "
+                    "then come back and run DemoPrep."
+                )
+        except Exception as e:
+            print(f"[Auth] Unable to check temporary-password status: {e}")
+        return ""
     
     def load_default_settings(self):
         """Load settings from Supabase or defaults"""
@@ -408,6 +448,12 @@ I'll research a company, build a Snowflake schema, generate realistic data, and
         # Add user message to history
         chat_history.append((message, None))
 
+        password_block = self._temporary_password_block_message()
+        if password_block and current_stage in {'initialization', 'awaiting_context'}:
+            chat_history[-1] = (message, password_block)
+            yield chat_history, current_stage, current_model, company, use_case, ""
+            return
+
         # If data_adjuster_url is saved in settings and we're at init, inject it as the message
         # so the user lands directly in Data Adjuster without having to paste the URL manually
         da_url = self.settings.get('data_adjuster_url', '').strip()
@@ -1886,6 +1932,12 @@ To change settings, use:
                 model=resolved_model,
                 model_setting=model_setting,
             )
+        password_block = self._temporary_password_block_message()
+        if password_block:
+            if _slog:
+                _slog.log("auth", "temporary password blocked pipeline start")
+            yield password_block
+            return
         _t = _slog.log_start("research") if _slog else None
 
         print(f"\n\n[CACHE DEBUG] === run_research_streaming called ===")
@@ -4913,8 +4965,8 @@ def create_chat_interface():
                             with gr.Column(scale=2):
                                 gr.Markdown("#### Current Users")
                                 user_list_display = gr.Dataframe(
-                                    headers=["Email", "Display Name", "Admin", "Active", "Last Login EST"],
-                                    datatype=["str", "str", "bool", "bool", "str"],
+                                    headers=["Email", "Display Name", "Admin", "Active", "Must Change PW", "Last Login EST"],
+                                    datatype=["str", "str", "bool", "bool", "bool", "str"],
                                     interactive=False,
                                     label="Users"
                                 )
@@ -4923,10 +4975,21 @@ def create_chat_interface():
                             with gr.Column(scale=1):
                                 gr.Markdown("#### Add New User")
                                 new_user_email = gr.Textbox(label="Email", placeholder="user@company.com")
-                                new_user_password = gr.Textbox(label="Password", type="password")
+                                new_user_password = gr.Textbox(
+                                    label="Temporary Password (optional)",
+                                    type="password",
+                                    placeholder="Leave blank to generate one"
+                                )
                                 new_user_display = gr.Textbox(label="Display Name", placeholder="Jane Doe")
                                 new_user_admin = gr.Checkbox(label="Admin?", value=False)
                                 add_user_btn = gr.Button("➕ Add User", variant="primary")
+                                invite_message = gr.Textbox(
+                                    label="Slack invite message",
+                                    lines=9,
+                                    interactive=True,
+                                    show_copy_button=True,
+                                    placeholder="Add a user to generate the message to send in Slack."
+                                )
 
                                 gr.Markdown("---")
                                 gr.Markdown("#### User Actions")
@@ -4965,26 +5028,50 @@ def create_chat_interface():
                                         u.get('display_name', ''),
                                         u.get('is_admin', False),
                                         u.get('is_active', True),
+                                        u.get('must_change_password', False),
                                         last_login_str
                                     ])
                                 return rows
                             except Exception as e:
-                                return [[f"Error: {e}", "", False, False, ""]]
+                                return [[f"Error: {e}", "", False, False, False, ""]]
                 
-                        def add_user_handler(email, password, display_name, is_admin):
+                        def add_user_handler(email, password, display_name, is_admin, request: gr.Request = None):
                             """Add a new user."""
-                            if not email or not password:
-                                return load_user_list(), "Email and password are required."
+                            if not email:
+                                return load_user_list(), "Email is required.", ""
                             try:
                                 from supabase_client import UserManager
                                 um = UserManager()
-                                success = um.add_user(email, password, display_name, is_admin)
+                                temp_password = password or um.generate_temp_password()
+                                success = um.add_user(
+                                    email,
+                                    temp_password,
+                                    display_name,
+                                    is_admin,
+                                    must_change_password=True,
+                                )
                                 if success:
-                                    return load_user_list(), f"User {email} added successfully."
+                                    clean_email = email.lower().strip()
+                                    display = (display_name or clean_email.split("@")[0]).strip()
+                                    app_url = resolve_app_url_for_invite(request)
+                                    invite = (
+                                        f"Hi {display} - you now have access to DemoPrep.\n\n"
+                                        f"App: {app_url}\n"
+                                        f"Username: {clean_email}\n"
+                                        f"Temporary password: {temp_password}\n\n"
+                                        "Please sign in and immediately change your password in "
+                                        "Settings -> Change Password before running demos."
+                                    )
+                                    if not um._supports_must_change_password():
+                                        invite += (
+                                            "\n\nAdmin note: temporary-password enforcement is not active "
+                                            "until the demoprep_users.must_change_password migration is applied."
+                                        )
+                                    return load_user_list(), f"User {clean_email} added. Slack invite generated below.", invite
                                 else:
-                                    return load_user_list(), f"Failed to add user {email}."
+                                    return load_user_list(), f"Failed to add user {email}.", ""
                             except Exception as e:
-                                return load_user_list(), f"Error: {e}"
+                                return load_user_list(), f"Error: {e}", ""
 
                         def deactivate_handler(email):
                             if not email:
@@ -5014,13 +5101,13 @@ def create_chat_interface():
                             try:
                                 from supabase_client import UserManager
                                 um = UserManager()
-                                um.reset_password(email, new_pw)
+                                um.reset_password(email, new_pw, must_change_password=True)
                                 return f"Password reset for {email}."
                             except Exception as e:
                                 return f"Error: {e}"
 
                         refresh_users_btn.click(fn=load_user_list, inputs=[], outputs=[user_list_display])
-                        add_user_btn.click(fn=add_user_handler, inputs=[new_user_email, new_user_password, new_user_display, new_user_admin], outputs=[user_list_display, user_mgmt_status])
+                        add_user_btn.click(fn=add_user_handler, inputs=[new_user_email, new_user_password, new_user_display, new_user_admin], outputs=[user_list_display, user_mgmt_status, invite_message])
                         deactivate_btn.click(fn=deactivate_handler, inputs=[action_email], outputs=[user_list_display, user_mgmt_status])
                         activate_btn.click(fn=activate_handler, inputs=[action_email], outputs=[user_list_display, user_mgmt_status])
                         reset_pw_btn.click(fn=reset_password_handler, inputs=[action_email, new_password], outputs=[user_mgmt_status])
@@ -6581,6 +6668,7 @@ def create_settings_tab():
             if not um.authenticate(user_email, current):
                 return "❌ Current password is incorrect."
             um.reset_password(user_email, new_pw)
+            um.clear_must_change_password(user_email)
             return "✅ Password changed successfully. Use your new password next time you sign in."
         except Exception as e:
             return f"❌ Error: {e}"

docs/onboarding_auth_migration.md

@@ -0,0 +1,10 @@
+# Onboarding Auth Migration
+
+Run this once against the Supabase database that backs DemoPrep auth before onboarding users with temporary passwords:
+
+```sql
+alter table demoprep_users
+add column if not exists must_change_password boolean not null default false;
+```
+
+Without this column, admins can still add users and generate Slack invite text, but the app cannot enforce the first-login password change.

supabase_client.py

@@ -18,6 +18,8 @@ Usage:
 
 import os
 import json
+import string
+import secrets
 from typing import Dict, List, Optional, Any
 from datetime import datetime
 from dotenv import load_dotenv
@@ -328,8 +330,11 @@ class UserManager:
         is_active BOOLEAN DEFAULT TRUE
         created_at TIMESTAMPTZ DEFAULT now()
         last_login TIMESTAMPTZ
+        must_change_password BOOLEAN DEFAULT FALSE
     """
 
+    _must_change_password_supported: Optional[bool] = None
+
     def __init__(self):
         self.client = None
         self.enabled = False
@@ -371,6 +376,36 @@ class UserManager:
         pw_hash = hashlib.pbkdf2_hmac('sha256', password.encode(), salt.encode(), 100000)
         return pw_hash.hex() == expected_hash
 
+    def _supports_must_change_password(self) -> bool:
+        """Return whether demoprep_users has the onboarding password flag."""
+        if not self.enabled:
+            return False
+        if UserManager._must_change_password_supported is not None:
+            return UserManager._must_change_password_supported
+
+        try:
+            self.client.table("demoprep_users") \
+                .select("must_change_password") \
+                .limit(1) \
+                .execute()
+            UserManager._must_change_password_supported = True
+        except Exception:
+            UserManager._must_change_password_supported = False
+        return UserManager._must_change_password_supported
+
+    def generate_temp_password(self, length: int = 16) -> str:
+        """Generate a Slack-friendly temporary password."""
+        alphabet = string.ascii_letters + string.digits + "!@#$%&*?"
+        while True:
+            password = ''.join(secrets.choice(alphabet) for _ in range(length))
+            if (
+                any(c.islower() for c in password)
+                and any(c.isupper() for c in password)
+                and any(c.isdigit() for c in password)
+                and any(c in "!@#$%&*?" for c in password)
+            ):
+                return password
+
     def authenticate(self, email: str, password: str) -> Optional[Dict]:
         """
         Authenticate a user by email and password.
@@ -416,6 +451,7 @@ class UserManager:
                 "display_name": user.get("display_name", ""),
                 "is_admin": user.get("is_admin", False),
                 "is_active": user.get("is_active", True),
+                "must_change_password": user.get("must_change_password", False),
             }
 
         except Exception as e:
@@ -423,7 +459,7 @@ class UserManager:
             return None
 
     def add_user(self, email: str, password: str, display_name: str = "",
-                 is_admin: bool = False) -> bool:
+                 is_admin: bool = False, must_change_password: bool = False) -> bool:
         """Add a new user. Returns True if successful."""
         if not self.enabled:
             return False
@@ -437,6 +473,8 @@ class UserManager:
                 "is_active": True,
                 "created_at": datetime.utcnow().isoformat(),
             }
+            if self._supports_must_change_password():
+                data["must_change_password"] = must_change_password
             self.client.table("demoprep_users").insert(data).execute()
             print(f"UserManager: Added user {email} (admin={is_admin})")
             return True
@@ -450,8 +488,11 @@ class UserManager:
             return []
 
         try:
+            fields = "email, display_name, is_admin, is_active, created_at, last_login"
+            if self._supports_must_change_password():
+                fields += ", must_change_password"
             result = self.client.table("demoprep_users") \
-                .select("email, display_name, is_admin, is_active, created_at, last_login") \
+                .select(fields) \
                 .order("created_at") \
                 .execute()
             return result.data or []
@@ -480,14 +521,17 @@ class UserManager:
             print(f"UserManager: Error updating user {email}: {e}")
             return False
 
-    def reset_password(self, email: str, new_password: str) -> bool:
+    def reset_password(self, email: str, new_password: str, must_change_password: Optional[bool] = None) -> bool:
         """Reset a user's password."""
         if not self.enabled:
             return False
 
         try:
+            update_data = {"password_hash": self._hash_password(new_password)}
+            if must_change_password is not None and self._supports_must_change_password():
+                update_data["must_change_password"] = must_change_password
             self.client.table("demoprep_users") \
-                .update({"password_hash": self._hash_password(new_password)}) \
+                .update(update_data) \
                 .eq("email", email.lower().strip()) \
                 .execute()
             return True
@@ -495,6 +539,35 @@ class UserManager:
             print(f"UserManager: Error resetting password for {email}: {e}")
             return False
 
+    def must_change_password(self, email: str) -> bool:
+        """Check whether a user must change a temporary password."""
+        if not self.enabled or not self._supports_must_change_password():
+            return False
+        try:
+            result = self.client.table("demoprep_users") \
+                .select("must_change_password") \
+                .eq("email", email.lower().strip()) \
+                .execute()
+            if result.data and len(result.data) > 0:
+                return bool(result.data[0].get("must_change_password", False))
+            return False
+        except Exception:
+            return False
+
+    def clear_must_change_password(self, email: str) -> bool:
+        """Mark a user's password as no longer temporary."""
+        if not self.enabled or not self._supports_must_change_password():
+            return True
+        try:
+            self.client.table("demoprep_users") \
+                .update({"must_change_password": False}) \
+                .eq("email", email.lower().strip()) \
+                .execute()
+            return True
+        except Exception as e:
+            print(f"UserManager: Error clearing temporary password flag for {email}: {e}")
+            return False
+
     def deactivate_user(self, email: str) -> bool:
         """Deactivate a user (soft delete)."""
         return self.update_user(email, is_active=False)
@@ -842,4 +915,4 @@ if __name__ == "__main__":
         settings.delete_setting(test_email, "test_setting")
         print("\n✅ All tests completed!")
     else:
-        print("❌ Supabase not configured. Add SUPABASE_URL and SUPABASE_ANON_KEY to .env file.")
+        print("❌ Supabase not configured. Add SUPABASE_URL and SUPABASE_ANON_KEY to .env file.")

tests/e2e_quality.py

@@ -1410,11 +1410,14 @@ def run_single_test(page: Page, test_case: dict, config: dict) -> dict:
         last_change_time = time.time()
         STUCK_THRESHOLD  = 20 * 60  # 20 min with no stage change → bail early
         PIPELINE_ERROR_INDICATORS = [
+            "Research failed",
             "pipeline has been interrupted",
             "An unexpected error occurred",
             "Population failed",
             "Pipeline failed",
             "Something went wrong during the pipeline",
+            "Traceback (most recent call last)",
+            "NameError:",
         ]
         while time.time() - start < timeout_sec:
             time.sleep(poll_interval)

tests/test_research_logging_regression.py

@@ -0,0 +1,33 @@
+"""Regression checks for research-phase session logging."""
+
+import ast
+from pathlib import Path
+
+
+def test_fresh_research_binds_slog_before_use():
+    """Catch the UI-only NameError where _slog was referenced before assignment."""
+    source = Path("chat_interface.py").read_text()
+    module = ast.parse(source)
+    target = next(
+        node
+        for node in module.body
+        if isinstance(node, ast.ClassDef) and node.name == "ChatDemoInterface"
+    )
+    method = next(
+        node
+        for node in target.body
+        if isinstance(node, ast.FunctionDef) and node.name == "_run_fresh_research"
+    )
+
+    saw_assignment = False
+    for node in ast.walk(method):
+        if isinstance(node, ast.Name) and node.id == "_slog" and isinstance(node.ctx, ast.Load):
+            assert saw_assignment, "_slog is read before it is assigned in _run_fresh_research"
+            return
+        if isinstance(node, ast.Assign):
+            saw_assignment = any(
+                isinstance(target, ast.Name) and target.id == "_slog"
+                for target in node.targets
+            ) or saw_assignment
+
+    raise AssertionError("_run_fresh_research does not read _slog; regression test needs updating")