@aiquants/auth-react-router 0.4.0 → 0.5.0

package/README.md

@@ -20,8 +20,9 @@ export const authServer = createAuthServer({
     google: { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET, redirectURI: env.GOOGLE_OAUTH_REDIRECT_URL },
     session: { secrets: [env.REMIX_SESSION_SECRET] },
     isEmailAllowed: emailDomainAllowlist(parseAllowlistCsv(env.ALLOWED_EMAILS), parseAllowlistCsv(env.ALLOWED_DOMAINS)),
+    isUserActive: async (profile) => isAccountEnabled(profile),   // optional: deactivation revokes live sessions
     backendAuth: { verify: verifyBackend, signup: (p, t) => signupBackend(p, t) },      // FastAPI verify/signup
-    getUserPhoto: async (openid) => (await getOpenids({ openid }))[0]?.picture ?? "",   // drizzle TDOpenid
+    getUserPhoto: async (openid) => (await getOpenids({ openid }))[0]?.picture ?? "",   // your identity store
     warmup: async () => { await Promise.all([ensurePrimaryConnection(), ensureSecondaryConnection()]) },
     mockUser: mockUserPort,   // test backdoor (E2E) — omit in production-only apps
 })
@@ -35,6 +36,38 @@ import { GoogleForm } from "@aiquants/auth-react-router/client"
 <GoogleForm />   // <Form method="POST"> + _action="Sign In with Google"
 ```
 
+## User administration surface (`/admin`)
+
+A splat-mounted admin UI for users, groups, group members, and the sign-in allowlist — the identity-side counterpart to `@aiquants/authz-react-router`.
+
+```ts
+import { createUserAdminApp, jaUserAdminLabels } from "@aiquants/auth-react-router/admin"
+
+export const userAdminApp = createUserAdminApp({
+    store: myUserAdminStore,          // you implement UserAdminStore against your DB
+    labels: jaUserAdminLabels,        // optional; package default is English
+    guards: {                         // REQUIRED — see below
+        requireAccess: async (request, { action }) => {
+            await requireUser(request)
+            await requirePermission(request, { resourceKey: "user_admin", action })
+        },
+    },
+})
+```
+
+```tsx
+import { AuthUserAdminAppView } from "@aiquants/auth-react-router/admin"
+export const loader = userAdminApp.loader
+export const action = userAdminApp.action
+export default () => <AuthUserAdminAppView />
+```
+
+- **`guards` is mandatory** — this surface lists every user and mutates group membership, so an unguarded mount is an account-enumeration and privilege-escalation path. Allow by returning, deny by throwing (`Response` / `redirect` / `Error`); the return value is `void` by contract, so a predicate-style guard that returns `false` cannot silently fail open.
+- **Per-operation authorization**: the guard receives the CRUD verb each intent actually performs (`read` / `create` / `update` / `delete`), so a principal holding only `update` cannot delete. Membership add/remove map to `create`/`delete` because they add and remove rows.
+- Unknown intents reach neither the guard nor the store (the intent table is a `Map`, so prototype keys such as `constructor` do not resolve).
+- Store errors (e.g. "cannot remove the last administrator") are returned as `{ ok: false, error }` and rendered by the views; guard rejections propagate untouched.
+- Labels default to **English** (`defaultUserAdminLabels`); inject `jaUserAdminLabels` or a partial override via `resolveUserAdminLabels`.
+
 Styling: this package has **no hand-written component CSS** (the `GoogleForm` classes are plain Tailwind utilities), so it ships **no components-only artifact** — only a standalone build. Two consumption modes, never mixed:
 
 - **Tailwind v4 host** — add `@source "../node_modules/@aiquants/auth-react-router/src/**/*.{ts,tsx}";` (monorepo: `../../../../packages/auth-react-router/src/**/*.{ts,tsx}`) so the `GoogleForm` classes are generated in the host's own canonical build; `src` ships in the published package.
@@ -61,6 +94,11 @@ Never mix the two: importing the standalone utility CSS next to a host Tailwind
 | `mockUser` | `mock_user_id` cookie parse + name map | fixed id |
 | `warmup` | 2 pools | 1 pool |
 | `backendAuth` | primary-api | secondary-api |
+| `isUserActive` | DB lookup + allowlist re-check | omitted (always active) |
+
+`isUserActive` is evaluated at login **and on every session resolution**, so disabling an account revokes already-issued session cookies. Return `false` only for a *known-disabled* account — returning `false` for an unknown identity would block first-time sign-up.
+
+> ⚠️ `isEmailAllowed` may return a `Promise` (to consult a database as well as env vars). Callers **must** `await` it: a `Promise` is always truthy, so a missing `await` makes the allowlist fail **open**, and the type checker cannot catch it.
 
 ## Intentional Changes vs Original (§8, approved)
 

package/dist/admin.d.mts

@@ -0,0 +1,268 @@
+import { AuthUser, AuthGroup, AuthGroupMember, AuthAllowlistEntry } from '@aiquants/auth-core';
+import { LoaderFunctionArgs, ActionFunctionArgs } from 'react-router';
+import React__default from 'react';
+
+/**
+ * Labels and i18n strings for the user administration UI.
+ * ユーザー管理 UI で使用するラベルと i18n 文字列の定義。
+ *
+ * パッケージ既定は **英語** ([defaultUserAdminLabels])。日本語で使う場合はアプリ側が
+ * [jaUserAdminLabels] を明示的に注入する (認可管理 `@aiquants/authz-react-router` と同じ規約)。
+ * UI 文字列はすべて本モジュールに集約し、コンポーネント側へ直書きしないこと — 直書きすると
+ * 日本語以外の利用者がその箇所を差し替えられなくなる。
+ */
+type UserAdminLabels = {
+    title: string;
+    /** シェル (タブ枠) の見出し。 */
+    heading: string;
+    tabs: {
+        users: string;
+        groups: string;
+        groupMembers: string;
+        allowlist: string;
+    };
+    usersView: {
+        title: string;
+        searchPlaceholder: string;
+        addUser: string;
+        editUser: string;
+        id: string;
+        displayName: string;
+        email: string;
+        status: string;
+        active: string;
+        inactive: string;
+        actions: string;
+        edit: string;
+        activate: string;
+        deactivate: string;
+        empty: string;
+        save: string;
+        cancel: string;
+    };
+    groupsView: {
+        title: string;
+        searchPlaceholder: string;
+        addGroup: string;
+        editGroup: string;
+        id: string;
+        groupKey: string;
+        name: string;
+        description: string;
+        memberCount: string;
+        status: string;
+        actions: string;
+        edit: string;
+        delete: string;
+        confirmDelete: string;
+        noDescription: string;
+        groupKeyPlaceholder: string;
+        namePlaceholder: string;
+        empty: string;
+        save: string;
+        cancel: string;
+    };
+    groupMembersView: {
+        selectGroup: string;
+        selectPrompt: string;
+        actionAdd: string;
+        actionRemove: string;
+    };
+    allowlistView: {
+        title: string;
+        addEntry: string;
+        pattern: string;
+        type: string;
+        emailType: string;
+        domainType: string;
+        /** 一覧のバッジ表示 (短縮形)。 */
+        emailTypeShort: string;
+        domainTypeShort: string;
+        description: string;
+        actions: string;
+        /** 変更不能な供給元 (環境変数など) 由来の行に出す表示。 */
+        readOnly: string;
+        delete: string;
+        empty: string;
+        save: string;
+        cancel: string;
+    };
+};
+/**
+ * Package default labels (English).
+ * パッケージ既定ラベル (英語)。
+ */
+declare const defaultUserAdminLabels: UserAdminLabels;
+/**
+ * Standard Japanese labels for user administration (opt-in).
+ * ユーザー管理の標準日本語ラベル (アプリ側で明示注入して使う)。
+ */
+declare const jaUserAdminLabels: UserAdminLabels;
+/** セクション単位の部分上書き。 */
+type PartialUserAdminLabels = {
+    title?: string;
+    heading?: string;
+    tabs?: Partial<UserAdminLabels["tabs"]>;
+    usersView?: Partial<UserAdminLabels["usersView"]>;
+    groupsView?: Partial<UserAdminLabels["groupsView"]>;
+    groupMembersView?: Partial<UserAdminLabels["groupMembersView"]>;
+    allowlistView?: Partial<UserAdminLabels["allowlistView"]>;
+};
+/**
+ * Shallow per-section merge over the English defaults.
+ * 英語既定に対してセクション単位で浅くマージする処理。
+ */
+declare function resolveUserAdminLabels(over?: PartialUserAdminLabels): UserAdminLabels;
+
+/**
+ * Server store interface for managing users, groups, memberships, and allowlists.
+ * ユーザー・グループ・所属・アロワリストを管理するサーバー層ストアのインターフェース。
+ */
+type UserAdminStore = {
+    listUsers: () => Promise<AuthUser[]>;
+    createUser: (data: {
+        displayName: string;
+        email: string;
+    }) => Promise<AuthUser>;
+    updateUser: (id: number, data: {
+        displayName: string;
+        email: string;
+    }) => Promise<AuthUser>;
+    toggleUserActive: (id: number, isActive: boolean) => Promise<AuthUser>;
+    listGroups: () => Promise<AuthGroup[]>;
+    createGroup: (data: {
+        groupKey: string;
+        name: string;
+        description?: string;
+    }) => Promise<AuthGroup>;
+    updateGroup: (id: number, data: {
+        name: string;
+        description?: string;
+    }) => Promise<AuthGroup>;
+    deleteGroup: (id: number) => Promise<void>;
+    listGroupMembers: () => Promise<AuthGroupMember[]>;
+    addGroupMember: (groupId: number, userId: number) => Promise<AuthGroupMember>;
+    removeGroupMember: (groupId: number, userId: number) => Promise<void>;
+    listAllowlist: () => Promise<AuthAllowlistEntry[]>;
+    addAllowlistEntry: (data: {
+        pattern: string;
+        type: "email" | "domain";
+        description?: string;
+    }) => Promise<AuthAllowlistEntry>;
+    removeAllowlistEntry: (id: number) => Promise<void>;
+};
+/**
+ * Creates an in-memory UserAdminStore initialized with optional seed data.
+ * シードデータで初期化されるメモリ上の UserAdminStore を作成する。
+ */
+declare function createInMemoryUserAdminStore(initial?: {
+    users?: AuthUser[];
+    groups?: AuthGroup[];
+    groupMembers?: AuthGroupMember[];
+    allowlist?: AuthAllowlistEntry[];
+}): UserAdminStore;
+/**
+ * The CRUD verb an operation performs. Deliberately a plain string union so this package stays
+ * independent of any particular authorization library.
+ * 操作が行う CRUD 種別。特定の認可ライブラリに依存しないよう素の文字列 union で表現する。
+ */
+type UserAdminAccess = "read" | "create" | "update" | "delete";
+/**
+ * Access guard the user-admin surface is mounted behind. Deny by throwing
+ * (a `Response`/`redirect` or an `Error`); returning normally means "allow".
+ *
+ * ユーザー管理面をマウントする際の必須アクセスガード。拒否は throw で表現する
+ * (`Response` / `redirect` / `Error`)。正常 return は「許可」を意味する。
+ *
+ * 操作ごとの CRUD 種別を受け取るため、呼び出し側は「削除だけ別権限」といった細分化ができる。
+ * `intent` は監査ログ用の補助情報(認可判断は `action` で行うこと)。
+ */
+type UserAdminGuards = {
+    /**
+     * 許可は「正常 return」、拒否は「throw」で表す。返り値は判定に使わない (`void` 契約)。
+     * 述語のつもりで `false` を返す実装を書くと素通りするため、返り値型で明示的に禁じる。
+     */
+    requireAccess: (request: Request, context: {
+        action: UserAdminAccess;
+        intent: string;
+    }) => Promise<void> | void;
+};
+type UserAdminAppConfig = {
+    store: UserAdminStore;
+    /** セクション単位の部分上書き。既定は英語 (`defaultUserAdminLabels`)。 */
+    labels?: PartialUserAdminLabels;
+    /**
+     * Required — omitting a guard would expose the whole user directory and its write actions.
+     * 必須。省略を許すとユーザー名簿と全更新操作が無防備に露出するため、型で強制する。
+     */
+    guards: UserAdminGuards;
+};
+/**
+ * Creates React Router loader & action handler for user administration.
+ * ユーザー管理用 React Router の loader および action ハンドラーを作成する。
+ *
+ * `config.guards` は必須。loader / action の双方が、処理を始める前にガードを通過させる。
+ */
+declare function createUserAdminApp(config: UserAdminAppConfig): {
+    loader: ({ request }: LoaderFunctionArgs) => Promise<{
+        segment: string;
+        users: AuthUser[];
+        groups: AuthGroup[];
+        groupMembers: AuthGroupMember[];
+        allowlist: AuthAllowlistEntry[];
+        labels: UserAdminLabels;
+    }>;
+    action: ({ request }: ActionFunctionArgs) => Promise<{
+        ok: boolean;
+        error?: undefined;
+    } | {
+        ok: boolean;
+        error: string;
+    }>;
+};
+
+type UserAdminShellProps = {
+    children?: React__default.ReactNode;
+    renderHeader?: (props: {
+        title: string;
+        annotation: React__default.ReactNode;
+    }) => React__default.ReactNode;
+};
+/**
+ * Shell layout for user administration pages with header annotation delegation.
+ * ヘッダー注釈委譲を備えたユーザー管理ページのシェルレイアウト。
+ */
+declare function UserAdminShell({ children, renderHeader }: UserAdminShellProps): React__default.JSX.Element;
+
+type UserAdminLoaderData = {
+    segment: string;
+    users: AuthUser[];
+    groups: AuthGroup[];
+    groupMembers: AuthGroupMember[];
+    allowlist: AuthAllowlistEntry[];
+    labels?: UserAdminLabels;
+};
+declare function UsersView(): React__default.JSX.Element;
+/**
+ * View for managing user groups (create, edit, delete).
+ * ユーザーグループ管理ビュー (作成・編集・削除)。
+ */
+declare function GroupsView(): React__default.JSX.Element;
+/**
+ * View for managing group member assignments.
+ * グループメンバー割り当て管理ビュー。
+ */
+declare function GroupMembersView(): React__default.JSX.Element;
+/**
+ * View for managing authentication allowlist entries.
+ * アクセス許可リスト (Allowlist) 管理ビュー。
+ */
+declare function AllowlistView(): React__default.JSX.Element;
+type AuthUserAdminAppViewProps = UserAdminShellProps;
+/**
+ * Top-level application view component for the user administration UI (`/users/*`).
+ * ユーザー管理 UI 全体を描画するトップレベルコンポーネント。
+ */
+declare function AuthUserAdminAppView({ renderHeader }?: AuthUserAdminAppViewProps): React__default.JSX.Element;
+
+export { AllowlistView, AuthUserAdminAppView, type AuthUserAdminAppViewProps, GroupMembersView, GroupsView, type PartialUserAdminLabels, type UserAdminAccess, type UserAdminAppConfig, type UserAdminGuards, type UserAdminLabels, type UserAdminLoaderData, UserAdminShell, type UserAdminShellProps, type UserAdminStore, UsersView, createInMemoryUserAdminStore, createUserAdminApp, defaultUserAdminLabels, jaUserAdminLabels, resolveUserAdminLabels };

package/dist/admin.d.ts

@@ -0,0 +1,268 @@
+import { AuthUser, AuthGroup, AuthGroupMember, AuthAllowlistEntry } from '@aiquants/auth-core';
+import { LoaderFunctionArgs, ActionFunctionArgs } from 'react-router';
+import React__default from 'react';
+
+/**
+ * Labels and i18n strings for the user administration UI.
+ * ユーザー管理 UI で使用するラベルと i18n 文字列の定義。
+ *
+ * パッケージ既定は **英語** ([defaultUserAdminLabels])。日本語で使う場合はアプリ側が
+ * [jaUserAdminLabels] を明示的に注入する (認可管理 `@aiquants/authz-react-router` と同じ規約)。
+ * UI 文字列はすべて本モジュールに集約し、コンポーネント側へ直書きしないこと — 直書きすると
+ * 日本語以外の利用者がその箇所を差し替えられなくなる。
+ */
+type UserAdminLabels = {
+    title: string;
+    /** シェル (タブ枠) の見出し。 */
+    heading: string;
+    tabs: {
+        users: string;
+        groups: string;
+        groupMembers: string;
+        allowlist: string;
+    };
+    usersView: {
+        title: string;
+        searchPlaceholder: string;
+        addUser: string;
+        editUser: string;
+        id: string;
+        displayName: string;
+        email: string;
+        status: string;
+        active: string;
+        inactive: string;
+        actions: string;
+        edit: string;
+        activate: string;
+        deactivate: string;
+        empty: string;
+        save: string;
+        cancel: string;
+    };
+    groupsView: {
+        title: string;
+        searchPlaceholder: string;
+        addGroup: string;
+        editGroup: string;
+        id: string;
+        groupKey: string;
+        name: string;
+        description: string;
+        memberCount: string;
+        status: string;
+        actions: string;
+        edit: string;
+        delete: string;
+        confirmDelete: string;
+        noDescription: string;
+        groupKeyPlaceholder: string;
+        namePlaceholder: string;
+        empty: string;
+        save: string;
+        cancel: string;
+    };
+    groupMembersView: {
+        selectGroup: string;
+        selectPrompt: string;
+        actionAdd: string;
+        actionRemove: string;
+    };
+    allowlistView: {
+        title: string;
+        addEntry: string;
+        pattern: string;
+        type: string;
+        emailType: string;
+        domainType: string;
+        /** 一覧のバッジ表示 (短縮形)。 */
+        emailTypeShort: string;
+        domainTypeShort: string;
+        description: string;
+        actions: string;
+        /** 変更不能な供給元 (環境変数など) 由来の行に出す表示。 */
+        readOnly: string;
+        delete: string;
+        empty: string;
+        save: string;
+        cancel: string;
+    };
+};
+/**
+ * Package default labels (English).
+ * パッケージ既定ラベル (英語)。
+ */
+declare const defaultUserAdminLabels: UserAdminLabels;
+/**
+ * Standard Japanese labels for user administration (opt-in).
+ * ユーザー管理の標準日本語ラベル (アプリ側で明示注入して使う)。
+ */
+declare const jaUserAdminLabels: UserAdminLabels;
+/** セクション単位の部分上書き。 */
+type PartialUserAdminLabels = {
+    title?: string;
+    heading?: string;
+    tabs?: Partial<UserAdminLabels["tabs"]>;
+    usersView?: Partial<UserAdminLabels["usersView"]>;
+    groupsView?: Partial<UserAdminLabels["groupsView"]>;
+    groupMembersView?: Partial<UserAdminLabels["groupMembersView"]>;
+    allowlistView?: Partial<UserAdminLabels["allowlistView"]>;
+};
+/**
+ * Shallow per-section merge over the English defaults.
+ * 英語既定に対してセクション単位で浅くマージする処理。
+ */
+declare function resolveUserAdminLabels(over?: PartialUserAdminLabels): UserAdminLabels;
+
+/**
+ * Server store interface for managing users, groups, memberships, and allowlists.
+ * ユーザー・グループ・所属・アロワリストを管理するサーバー層ストアのインターフェース。
+ */
+type UserAdminStore = {
+    listUsers: () => Promise<AuthUser[]>;
+    createUser: (data: {
+        displayName: string;
+        email: string;
+    }) => Promise<AuthUser>;
+    updateUser: (id: number, data: {
+        displayName: string;
+        email: string;
+    }) => Promise<AuthUser>;
+    toggleUserActive: (id: number, isActive: boolean) => Promise<AuthUser>;
+    listGroups: () => Promise<AuthGroup[]>;
+    createGroup: (data: {
+        groupKey: string;
+        name: string;
+        description?: string;
+    }) => Promise<AuthGroup>;
+    updateGroup: (id: number, data: {
+        name: string;
+        description?: string;
+    }) => Promise<AuthGroup>;
+    deleteGroup: (id: number) => Promise<void>;
+    listGroupMembers: () => Promise<AuthGroupMember[]>;
+    addGroupMember: (groupId: number, userId: number) => Promise<AuthGroupMember>;
+    removeGroupMember: (groupId: number, userId: number) => Promise<void>;
+    listAllowlist: () => Promise<AuthAllowlistEntry[]>;
+    addAllowlistEntry: (data: {
+        pattern: string;
+        type: "email" | "domain";
+        description?: string;
+    }) => Promise<AuthAllowlistEntry>;
+    removeAllowlistEntry: (id: number) => Promise<void>;
+};
+/**
+ * Creates an in-memory UserAdminStore initialized with optional seed data.
+ * シードデータで初期化されるメモリ上の UserAdminStore を作成する。
+ */
+declare function createInMemoryUserAdminStore(initial?: {
+    users?: AuthUser[];
+    groups?: AuthGroup[];
+    groupMembers?: AuthGroupMember[];
+    allowlist?: AuthAllowlistEntry[];
+}): UserAdminStore;
+/**
+ * The CRUD verb an operation performs. Deliberately a plain string union so this package stays
+ * independent of any particular authorization library.
+ * 操作が行う CRUD 種別。特定の認可ライブラリに依存しないよう素の文字列 union で表現する。
+ */
+type UserAdminAccess = "read" | "create" | "update" | "delete";
+/**
+ * Access guard the user-admin surface is mounted behind. Deny by throwing
+ * (a `Response`/`redirect` or an `Error`); returning normally means "allow".
+ *
+ * ユーザー管理面をマウントする際の必須アクセスガード。拒否は throw で表現する
+ * (`Response` / `redirect` / `Error`)。正常 return は「許可」を意味する。
+ *
+ * 操作ごとの CRUD 種別を受け取るため、呼び出し側は「削除だけ別権限」といった細分化ができる。
+ * `intent` は監査ログ用の補助情報(認可判断は `action` で行うこと)。
+ */
+type UserAdminGuards = {
+    /**
+     * 許可は「正常 return」、拒否は「throw」で表す。返り値は判定に使わない (`void` 契約)。
+     * 述語のつもりで `false` を返す実装を書くと素通りするため、返り値型で明示的に禁じる。
+     */
+    requireAccess: (request: Request, context: {
+        action: UserAdminAccess;
+        intent: string;
+    }) => Promise<void> | void;
+};
+type UserAdminAppConfig = {
+    store: UserAdminStore;
+    /** セクション単位の部分上書き。既定は英語 (`defaultUserAdminLabels`)。 */
+    labels?: PartialUserAdminLabels;
+    /**
+     * Required — omitting a guard would expose the whole user directory and its write actions.
+     * 必須。省略を許すとユーザー名簿と全更新操作が無防備に露出するため、型で強制する。
+     */
+    guards: UserAdminGuards;
+};
+/**
+ * Creates React Router loader & action handler for user administration.
+ * ユーザー管理用 React Router の loader および action ハンドラーを作成する。
+ *
+ * `config.guards` は必須。loader / action の双方が、処理を始める前にガードを通過させる。
+ */
+declare function createUserAdminApp(config: UserAdminAppConfig): {
+    loader: ({ request }: LoaderFunctionArgs) => Promise<{
+        segment: string;
+        users: AuthUser[];
+        groups: AuthGroup[];
+        groupMembers: AuthGroupMember[];
+        allowlist: AuthAllowlistEntry[];
+        labels: UserAdminLabels;
+    }>;
+    action: ({ request }: ActionFunctionArgs) => Promise<{
+        ok: boolean;
+        error?: undefined;
+    } | {
+        ok: boolean;
+        error: string;
+    }>;
+};
+
+type UserAdminShellProps = {
+    children?: React__default.ReactNode;
+    renderHeader?: (props: {
+        title: string;
+        annotation: React__default.ReactNode;
+    }) => React__default.ReactNode;
+};
+/**
+ * Shell layout for user administration pages with header annotation delegation.
+ * ヘッダー注釈委譲を備えたユーザー管理ページのシェルレイアウト。
+ */
+declare function UserAdminShell({ children, renderHeader }: UserAdminShellProps): React__default.JSX.Element;
+
+type UserAdminLoaderData = {
+    segment: string;
+    users: AuthUser[];
+    groups: AuthGroup[];
+    groupMembers: AuthGroupMember[];
+    allowlist: AuthAllowlistEntry[];
+    labels?: UserAdminLabels;
+};
+declare function UsersView(): React__default.JSX.Element;
+/**
+ * View for managing user groups (create, edit, delete).
+ * ユーザーグループ管理ビュー (作成・編集・削除)。
+ */
+declare function GroupsView(): React__default.JSX.Element;
+/**
+ * View for managing group member assignments.
+ * グループメンバー割り当て管理ビュー。
+ */
+declare function GroupMembersView(): React__default.JSX.Element;
+/**
+ * View for managing authentication allowlist entries.
+ * アクセス許可リスト (Allowlist) 管理ビュー。
+ */
+declare function AllowlistView(): React__default.JSX.Element;
+type AuthUserAdminAppViewProps = UserAdminShellProps;
+/**
+ * Top-level application view component for the user administration UI (`/users/*`).
+ * ユーザー管理 UI 全体を描画するトップレベルコンポーネント。
+ */
+declare function AuthUserAdminAppView({ renderHeader }?: AuthUserAdminAppViewProps): React__default.JSX.Element;
+
+export { AllowlistView, AuthUserAdminAppView, type AuthUserAdminAppViewProps, GroupMembersView, GroupsView, type PartialUserAdminLabels, type UserAdminAccess, type UserAdminAppConfig, type UserAdminGuards, type UserAdminLabels, type UserAdminLoaderData, UserAdminShell, type UserAdminShellProps, type UserAdminStore, UsersView, createInMemoryUserAdminStore, createUserAdminApp, defaultUserAdminLabels, jaUserAdminLabels, resolveUserAdminLabels };