@andrian.yablonskyy/thub-coordinator 1.0.42 → 1.1.0

package/test/users.test.js

@@ -0,0 +1,269 @@
+/**
+ * @file        packages/coordinator/test/users.test.js
+ * @description Tests: user management (§10.3) — migration, roles, blocking, the last admin, access keys, the Agent API and the dashboard
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  os = require('node:os'),
+  path = require('node:path'),
+  { spawnSync } = require('node:child_process'),
+  Database = require('better-sqlite3'),
+  { openDb } = require('../src/db'),
+  { hashToken } = require('../src/services/tokens'),
+  { loadConfig } = require('../src/config'),
+  { buildServices, createApp } = require('../src/server');
+
+const MIGRATIONS = path.join(__dirname, '..', 'src', 'db', 'migrations');
+
+test('migration: dashboard accounts and developer tokens become users; every existing key keeps working', () => {
+  const file = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'thub-mig-')), 'thub.db'),
+    old = new Database(file);
+  // The schema just before user management.
+  old.exec('CREATE TABLE schema_migrations (id TEXT PRIMARY KEY, applied_at TEXT NOT NULL)');
+  for (const f of fs.readdirSync(MIGRATIONS).filter((n) => n.endsWith('.sql') && n < '026').sort()){
+    old.exec(fs.readFileSync(path.join(MIGRATIONS, f), 'utf8'));
+    old.prepare('INSERT INTO schema_migrations VALUES (?, ?)').run(f, 'x');
+  }
+  const t = '2026-01-01T00:00:00.000Z',
+    addAccount = (id, username, role) => old
+      .prepare('INSERT INTO admin_users (id, username, password_hash, role, created_at) VALUES (?, ?, ?, ?, ?)')
+      .run(id, username, 'salt:hash', role, t),
+    addAgent = (id, name, kind, token, revoked = null, created = t) => old.prepare(
+      'INSERT INTO agents (id, name, kind, token_hash, created_at, revoked_at) VALUES (?, ?, ?, ?, ?, ?)'
+    ).run(id, name, kind, hashToken(token), created, revoked);
+  addAccount('usr_a', 'admin', 'admin');
+  addAccount('usr_v', 'vera', 'viewer');
+  addAgent('agt_aaaaaaaa-1', 'alice', 'cli', 'agt_key-alice');
+  addAgent('agt_bbbbbbbb-2', 'alice', 'cli', 'agt_key-alice-2', null, '2026-02-01T00:00:00.000Z'); // same name, later
+  addAgent('agt_cccccccc-3', 'admin', 'cli', 'agt_key-taken'); // clashes with a dashboard account
+  addAgent('agt_dddddddd-4', 'bob', 'cli', 'agt_key-bob', '2026-03-01T00:00:00.000Z'); // revoked
+  addAgent('agt_eeeeeeee-5', 'pipeline', 'ci', 'agt_key-ci');
+  old.close();
+
+  const db = openDb(file),
+    users = Object.fromEntries(db.prepare('SELECT * FROM users').all().map((u) => [u.username, u]));
+  assert.equal(users.admin.role, 'admin');
+  assert.equal(users.vera.role, 'maintainer'); // viewer → maintainer
+  assert.equal(users.alice.role, 'user');
+  assert.ok(users['alice-bbbbbb'], 'a second "alice" gets a suffix');
+  assert.ok(users['admin-cccccc'], 'a token named like a dashboard account gets a suffix');
+  assert.equal(users.bob.blocked_at, '2026-03-01T00:00:00.000Z'); // revoked → blocked, kept for history
+  assert.equal(users.alice.password_hash, null); // no dashboard
+  // The keys: still the same agents rows, now owned by their users; CI stays a CI token.
+  const owner = (token) => db.prepare('SELECT a.kind, u.username FROM agents a LEFT JOIN users u ON u.id = a.user_id WHERE token_hash = ?')
+    .get(hashToken(token));
+  assert.deepEqual({ ...owner('agt_key-alice') }, { kind: 'cli', username: 'alice' });
+  assert.deepEqual({ ...owner('agt_key-ci') }, { kind: 'ci', username: null });
+  assert.equal(db.prepare('SELECT COUNT(*) AS n FROM sqlite_master WHERE name = \'admin_users\'').get().n, 0);
+});
+
+function start(t, extra = {}){
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'thub-users-')),
+    file = path.join(dir, 'coordinator.json');
+  fs.writeFileSync(file, JSON.stringify({ dataDir: path.join(dir, 'data'), updates: { checkIntervalMin: 0 }, rateLimit: { loginPerMinute: 0 }, ...extra }));
+  const config = loadConfig(file),
+    services = buildServices(config),
+    server = createApp(config, services).listen(0, '127.0.0.1');
+  t.after(() => new Promise((r) => {
+    server.closeAllConnections?.();
+    server.close(r);
+  }));
+  return new Promise((r) => server.on('listening', () => r({ base: `http://127.0.0.1:${server.address().port}`, services, file })));
+}
+
+test('users: temporary passwords, the last admin can\'t be locked out, delete keeps job history', async (t) => {
+  const { services } = await start(t),
+    u = services.adminUsers,
+    root = u.create({ username: 'root', email: 'root@example.com', role: 'admin', password: 'pw' }),
+    ops = u.create({ username: 'ops', email: 'ops@example.com', role: 'maintainer' }),
+    dev = u.create({ username: 'dev', email: 'dev@example.com', role: 'user' });
+
+  assert.ok(ops.tempPassword); // maintainers get one to change
+  assert.equal(u.getById(ops.id).mustChangePassword, true);
+  assert.equal(dev.tempPassword, null); // a user has no dashboard password
+  assert.throws(() => u.create({ username: 'x', role: 'user', requireEmail: true }), /Email/);
+  assert.throws(() => u.create({ username: 'y', email: 'ROOT@example.com', role: 'user' }), /already used/);
+  assert.throws(() => u.create({ username: 'bad name', email: 'z@example.com', role: 'user' }), /Username/);
+
+  // The only admin: not blockable, demotable or deletable — not even by themselves.
+  assert.throws(() => u.setBlocked(root.id, true, { actorId: ops.id }), /last active admin/);
+  assert.throws(() => u.update(root.id, { role: 'maintainer' }, { actorId: ops.id }), /last active admin/);
+  assert.throws(() => u.remove(root.id, { actorId: root.id }), /your own account/);
+  // With a second admin, the first can go — by someone else.
+  u.update(ops.id, { role: 'admin' }, { actorId: root.id });
+  u.setBlocked(root.id, true, { actorId: ops.id });
+  assert.equal(u.getById(root.id).blocked, true);
+
+  // Delete: the account goes, the key row stays (revoked) under the name.
+  const key = u.issueKey(dev.id),
+    keyRow = u.keyOf(dev.id);
+  assert.ok(key.startsWith('thk_'));
+  u.remove(dev.id, { actorId: ops.id });
+  const kept = services.db.prepare('SELECT * FROM agents WHERE id = ?').get(keyRow.id);
+  assert.equal(kept.name, 'dev');
+  assert.ok(kept.revoked_at);
+  assert.equal(kept.user_id, null);
+  // The audit log has it.
+  assert.ok(u.recentEvents().some((e) => e.type === 'user.deleted' && e.data.username === 'dev'));
+});
+
+test('Agent API: a user sees and cancels only their own jobs; maintainers all; blocked keys stop; keys rotate', async (t) => {
+  const { base, services } = await start(t),
+    u = services.adminUsers,
+    alice = u.create({ username: 'alice', email: 'a@example.com', role: 'user' }),
+    bob = u.create({ username: 'bob', email: 'b@example.com', role: 'user' }),
+    maint = u.create({ username: 'mo', email: 'm@example.com', role: 'maintainer', password: 'pw' }),
+    keys = { alice: u.issueKey(alice.id), bob: u.issueKey(bob.id), mo: u.issueKey(maint.id) },
+    call = async (key, method, url, body) => {
+      const res = await fetch(`${base}/api/v1${url}`, {
+        method, headers: { authorization: `Bearer ${key}`, ...(body ? { 'content-type': 'application/json' } : {}) }, body: body && JSON.stringify(body)
+      });
+      return { status: res.status, body: await res.json().catch(() => null) };
+    };
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+  const submit = async (key) => (await call(key, 'POST', '/jobs', { target: { type: 'sw' }, command: './t.sh' })).body.jobId,
+    aliceJob = await submit(keys.alice),
+    bobJob = await submit(keys.bob);
+
+  assert.equal((await call(keys.alice, 'GET', `/jobs/${aliceJob}`)).status, 200);
+  assert.equal((await call(keys.alice, 'GET', `/jobs/${bobJob}`)).status, 404); // like an unknown id
+  assert.deepEqual((await call(keys.alice, 'GET', '/jobs')).body.jobs.map((j) => j.id), [aliceJob]);
+  assert.equal((await call(keys.mo, 'GET', `/jobs/${bobJob}`)).status, 200); // a maintainer sees all
+  assert.equal((await call(keys.mo, 'POST', `/jobs/${bobJob}/cancel`)).status, 200); // …and cancels any
+
+  // whoami / key show.
+  const me = (await call(keys.alice, 'GET', '/me')).body;
+  assert.deepEqual(me.user, { username: 'alice', email: 'a@example.com', role: 'user' });
+  assert.equal(me.key.hint, keys.alice.slice(-4));
+
+  // Rotate: the old key stops at once, the new one works — and the jobs stay hers.
+  const rotated = (await call(keys.alice, 'POST', '/me/key/rotate')).body.key;
+  assert.equal((await call(keys.alice, 'GET', '/me')).status, 401);
+  assert.equal((await call(rotated, 'GET', `/jobs/${aliceJob}`)).status, 200);
+
+  // Blocked: the key stops; unblocked: it works again.
+  u.setBlocked(alice.id, true);
+  const blocked = await call(rotated, 'GET', '/me');
+  assert.equal(blocked.status, 401);
+  assert.match(blocked.body.error, /alice is blocked/);
+  u.setBlocked(alice.id, false);
+  assert.equal((await call(rotated, 'GET', '/me')).status, 200);
+
+  // A CI token isn't rotated by itself.
+  const ci = services.agents.create({ name: 'pipeline', kind: 'ci' }).token;
+  assert.equal((await call(ci, 'POST', '/me/key/rotate')).status, 403);
+  assert.equal((await call(ci, 'GET', `/jobs/${bobJob}`)).status, 200); // CI reads every job, as before
+});
+
+test('dashboard: only maintainers and admins sign in; security pages are admins\'; blocking signs out at once', async (t) => {
+  const { base, services } = await start(t),
+    u = services.adminUsers,
+    admin = u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' }),
+    maint = u.create({ username: 'mo', email: 'm@example.com', role: 'maintainer', password: 'pw' }),
+    temp = u.create({ username: 'newbie', email: 'n@example.com', role: 'maintainer' }),
+    signIn = async (username, password) => {
+      const res = await fetch(`${base}/login`, { method: 'POST', body: new URLSearchParams({ username, password }), redirect: 'manual' });
+      return { status: res.status, location: res.headers.get('location'), cookie: res.headers.get('set-cookie')?.split(';')[0], text: await res.text() };
+    },
+    get = (cookie, url) => fetch(`${base}${url}`, { headers: { cookie }, redirect: 'manual' });
+  u.create({ username: 'dev', email: 'd@example.com', role: 'user', password: 'pw' });
+
+  const dev = await signIn('dev', 'pw');
+  assert.equal(dev.status, 403);
+  assert.match(dev.text, /no dashboard access/);
+
+  const mo = await signIn('mo', 'pw');
+  assert.equal((await get(mo.cookie, '/resources')).status, 200);
+  for (const url of ['/admin/users', '/admin/settings', '/admin/agents']){
+    assert.equal((await get(mo.cookie, url)).status, 403, url);
+  }
+  const root = await signIn('root', 'pw');
+  assert.equal((await get(root.cookie, '/admin/users')).status, 200);
+
+  // Blocked while signed in: the next click goes to the sign-in page.
+  u.setBlocked(maint.id, true, { actorId: admin.id });
+  const after = await get(mo.cookie, '/resources');
+  assert.equal(after.status, 302);
+  assert.equal(after.headers.get('location'), '/login');
+  assert.match((await signIn('mo', 'pw')).text, /blocked/);
+
+  // A temporary password: the profile first, until it's changed.
+  const nb = await signIn('newbie', temp.tempPassword);
+  assert.equal(nb.location, '/profile');
+  assert.equal((await get(nb.cookie, '/jobs')).headers.get('location'), '/profile');
+  await fetch(`${base}/profile/password`, {
+    method: 'POST', headers: { cookie: nb.cookie }, redirect: 'manual',
+    body: new URLSearchParams({ currentPassword: temp.tempPassword, newPassword: 'mine-now', confirmPassword: 'mine-now' })
+  });
+  assert.equal((await get(nb.cookie, '/jobs')).status, 200);
+
+  // The Users page creates a user and shows their key once.
+  const created = await (await fetch(`${base}/admin/users`, {
+    method: 'POST', headers: { cookie: root.cookie },
+    body: new URLSearchParams({ username: 'carol', email: 'c@example.com', role: 'user', issueKey: '1' })
+  })).text();
+  assert.match(created, /User carol created/);
+  assert.match(created, /value="thk_[A-Za-z0-9_-]+"/);
+});
+
+test('thub-admin user: add, list, block, key — from the Coordinator host', async (t) => {
+  const { file } = await start(t),
+    run = (...args) => spawnSync(process.execPath, [path.join(__dirname, '..', 'bin', 'thub-admin.js'), 'user', ...args], {
+      env: { ...process.env, THUB_COORDINATOR_CONFIG: file }, encoding: 'utf8'
+    }),
+    added = run('add', 'ops', '--email', 'ops@example.com', '--role', 'maintainer', '--key');
+  assert.match(added.stdout, /Created Maintainer "ops"/);
+  assert.match(added.stdout, /Temporary password \(shown once/);
+  assert.match(added.stdout, /Access key \(shown once\): thk_/);
+  assert.match(run('list').stdout, /ops\s+Maintainer\s+active\s+ops@example\.com\s+key: …/);
+  assert.match(run('block', 'ops').stdout, /Blocked "ops"/);
+  assert.match(run('add', 'x').stderr + run('add', 'x').stdout, /Usage|email/);
+});
+
+test('Users page: quick filter by role with counts, sorting and pages; role descriptions under the picker', async (t) => {
+  const { base, services } = await start(t),
+    u = services.adminUsers;
+  u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' });
+  for (let i = 1; i <= 12; i++){
+    u.create({ username: `dev${String(i).padStart(2, '0')}`, email: `d${i}@example.com`, role: 'user' });
+  }
+  const mo = u.create({ username: 'mo', email: 'm@example.com', role: 'maintainer' });
+  u.setBlocked(mo.id, true);
+  const cookie = (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'root', password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    page = (q) => fetch(`${base}/admin/users${q}`, { headers: { cookie } }).then((r) => r.text()),
+    names = (html) => [...html.matchAll(/<div class="fw-medium">([^<]+)/g)].map((m) => m[1]),
+
+    users = await page('?role=user&size=10');
+  assert.match(users, /Showing 1–10 of 12 users/); // before the two below are added
+  assert.deepEqual(names(users).slice(0, 2), ['dev01', 'dev02']);
+  u.create({ username: 'dev9', email: 'd9x@example.com', role: 'user' });
+  u.create({ username: 'dev100', email: 'd100x@example.com', role: 'user' });
+  const natural = names(await page('?role=user&size=all')).filter((n) => ['dev9', 'dev100', 'dev12'].includes(n));
+  assert.deepEqual(natural, ['dev9', 'dev12', 'dev100']); // natural order
+  assert.ok(names(users).every((n) => n.startsWith('dev')));
+  assert.match(users, /aria-current="page"[^>]*>User<span class="badge text-bg-light ms-1">12/); // the active filter, with its count
+  assert.match(users, /href="\/admin\/users\?role=user&amp;size=10&amp;sort=username&amp;dir=asc&amp;page=2"/); // pages keep the filter
+  assert.deepEqual(names(await page('?role=blocked')), ['mo']);
+  assert.match(users, />Maintainer<span class="badge/); // filter buttons
+  assert.match(users, /href="[^"]*role=maintainer/); // …while values stay lowercase
+  assert.deepEqual(names(await page('?role=admin&size=all')), ['root']);
+  assert.deepEqual(names(await page('?role=&sort=role&dir=desc&size=all')).slice(0, 2), ['root', 'mo']); // admin, maintainer, users…
+
+  // The role picker: names only, the chosen role's description below it.
+  assert.match(users, /<option value="user" selected="selected" data-help="Agent only[^"]*">User<\/option>/);
+  assert.match(users, /<div class="form-text" id="new-role-help" aria-live="polite">Agent only/);
+});

package/test/views.test.js

@@ -39,7 +39,9 @@ test('every view compiles', () => {
 // mixin or a broken include, so render the whole page.
 test('help page renders every section with this Coordinator\'s URL', () => {
   const html = pug.renderFile(path.join(VIEWS, 'help', 'index.pug'), {
-    user: { username: 'viewer', role: 'viewer', theme: 'auto' },
+    user: { username: 'maint', role: 'maintainer', theme: 'auto', canUseDashboard: true },
+    can: { operate: true, admin: false },
+    roleLabel: (r) => r.charAt(0).toUpperCase() + r.slice(1),
     updates: {},
     messages: [],
     currentPath: '/help',

package/views/admin/agents.pug

@@ -4,8 +4,8 @@ include ../mixins/list-controls
 
 block content
   .d-flex.justify-content-between.align-items-center.mb-3
-    h1.h4.mb-0 Agents (CI / developers)
-    button.btn.btn-primary.btn-sm(type="button" data-bs-toggle="modal" data-bs-target="#addAgentModal") Register agent
+    h1.h4.mb-0 CI tokens
+    button.btn.btn-primary.btn-sm(type="button" data-bs-toggle="modal" data-bs-target="#addAgentModal") New CI token
   .d-flex.flex-wrap.align-items-center.gap-2.mb-3
     +updatesToolbar('agent', 'agents', list.pageUrl())
   .d-flex.flex-wrap.align-items-center.gap-2.mb-3
@@ -90,16 +90,15 @@ block content
       .modal-content
         form(method="post" action="/admin/agents")
           .modal-header
-            h5.modal-title Register agent
+            h5.modal-title New CI token
             button.btn-close(type="button" data-bs-dismiss="modal")
           .modal-body
             .mb-3
               label.form-label Name
-              input.form-control(type="text" name="name" placeholder="ci-firmware or jane.dev" required)
+              input.form-control(type="text" name="name" placeholder="ci-firmware" required)
             .mb-3
-              label.form-label Kind
-              select.form-select(name="kind")
-                option(value="ci") ci
-                option(value="cli") cli
+              p.small.text-body-secondary.mb-0.
+                For a pipeline: its jobs get A- ids and it can read every job. People use their own access key
+                instead (#[a(href="/admin/users") Users]).
           .modal-footer
             button.btn.btn-primary(type="submit") Create

package/views/admin/users.pug

@@ -0,0 +1,249 @@
+extends ../layout
+include ../mixins/list-controls
+
+//- Users (§10.3, admins). Roles: user — the Agent only; maintainer — the
+//- dashboard without its security features; admin — everything.
+//- Role picker: names in the list, the chosen role's description below it
+//- (kept in step by public/js/actions.js, select[data-describe]).
+mixin roleSelect(id, selected)
+  select.form-select(id=id name="role" data-describe=`#${id}-help`)
+    each r in roles
+      option(value=r selected=r === selected data-help=roleHelp[r])= roleLabel(r)
+  .form-text(id=`${id}-help` aria-live="polite")= roleHelp[selected]
+
+block content
+  .d-flex.justify-content-between.align-items-center.mb-3
+    h1.h4.mb-0 Users
+    button.btn.btn-primary.btn-sm(type="button" data-bs-toggle="modal" data-bs-target="#addUserModal")
+      i.bi.bi-person-plus.me-1
+      | New user
+
+  if secret
+    //- Shown once: nothing below keeps it.
+    .alert.alert-warning(role="alert")
+      h2.h6.alert-heading
+        i.bi.bi-shield-lock.me-1
+        = secret.title
+      p.small.mb-2 Shown only now — copy it and hand it to #{secret.username} securely. It can't be shown again (a new one can be issued).
+      if secret.key
+        .input-group.input-group-sm.mb-2
+          span.input-group-text Access key
+          input.form-control.font-monospace(type="text" value=secret.key readonly aria-label="Access key")
+          button.btn.btn-outline-secondary(type="button" data-copy=secret.key aria-label="Copy access key")
+            i.bi.bi-clipboard
+        p.small.mb-2
+          | With the Agent: #[code thub config set key …] (or #[code THUB_KEY], or #[code --key]).
+      if secret.password
+        .input-group.input-group-sm
+          span.input-group-text Temporary password
+          input.form-control.font-monospace(type="text" value=secret.password readonly aria-label="Temporary password")
+          button.btn.btn-outline-secondary(type="button" data-copy=secret.password aria-label="Copy password")
+            i.bi.bi-clipboard
+        p.small.mt-2.mb-0 They sign in with it and must choose their own password right away.
+
+  .d-flex.flex-wrap.align-items-center.gap-2.mb-3
+    +searchForm(q, 'Search users: name, email, role, blocked', list.urlFor({ q: '' }))
+    .ms-auto
+      +pageSizePicker(list)
+
+  //- Quick filter by role (counts within the search).
+  nav.btn-group.btn-group-sm.flex-wrap.mb-3(role="group" aria-label="Filter by role")
+    a.btn(href=list.urlFor({ role: '' }) class=!roleFilter ? 'btn-secondary' : 'btn-outline-secondary' aria-current=!roleFilter ? 'page' : false)
+      | All #[span.badge.text-bg-light.ms-1= total]
+    each r in roleFilters
+      a.btn(href=list.urlFor({ role: r }) class=roleFilter === r ? 'btn-secondary' : 'btn-outline-secondary' aria-current=roleFilter === r ? 'page' : false)
+        = roleLabel(r)
+        span.badge.text-bg-light.ms-1= roleCounts[r]
+
+  +listToolbar(list, roleFilter ? `${roleFilter === 'blocked' ? 'blocked users' : `${roleFilter}s`}` : 'users')
+
+  table.table.table-hover.align-middle
+    thead
+      tr
+        +sortHeader(list, 'username', 'User')
+        +sortHeader(list, 'role', 'Role')
+        +sortHeader(list, 'status', 'Status')
+        +sortHeader(list, 'used', 'Access key', 'desc')
+        th.text-end
+    tbody
+      each u in users
+        tr(class=u.blocked ? 'opacity-50' : '')
+          td
+            .fw-medium
+              = u.username
+              if u.id === me.id
+                span.badge.text-bg-light.border.ms-1 you
+            if u.firstName || u.lastName
+              .small= `${u.firstName || ''} ${u.lastName || ''}`.trim()
+            if u.email
+              .small.text-body-secondary= u.email
+            else
+              span.badge.text-bg-warning(data-bs-toggle="tooltip" data-bs-title="Every user needs an email — add it with Edit") no email
+          td
+            span.badge(class=`text-bg-${roleTone[u.role]}` data-bs-toggle="tooltip" data-bs-title=roleHelp[u.role])= roleLabel(u.role)
+          td
+            if u.blocked
+              span.badge.text-bg-danger(data-bs-toggle="tooltip" data-bs-title=`Since ${fmtDate(u.blockedAt)}`) blocked
+            else
+              span.badge.text-bg-success active
+            if u.mustChangePassword
+              span.badge.text-bg-light.border.ms-1(data-bs-toggle="tooltip" data-bs-title="Signs in with a temporary password and must change it") temporary password
+          td.small
+            if u.key
+              code= `…${u.key.hint || '????'}`
+              .text-body-secondary
+                | last used #{fmtDate(u.key.lastUsedAt, 'never')}
+                if u.key.version
+                  = ` · Agent v${u.key.version}`
+            else
+              span.text-body-secondary none
+          td.text-end.text-nowrap
+            button.btn.btn-sm.btn-outline-secondary(type="button" data-bs-toggle="modal" data-bs-target=`#editUser-${u.id}` aria-label=`Edit ${u.username}`) Edit
+            form.d-inline.ms-1(
+              method="post"
+              action=`/admin/users/${u.id}/key`
+              data-confirm=u.key ? `Issue a new access key for ${u.username}? Their current key stops working at once.` : `Create an access key for ${u.username}?`
+              data-confirm-title=u.key ? 'Replace access key?' : 'Create access key?'
+              data-confirm-ok=u.key ? 'Replace key' : 'Create key'
+              data-confirm-tone="primary"
+            )
+              input(type="hidden" name="returnTo" value=list.pageUrl())
+              button.btn.btn-sm.btn-outline-primary(type="submit" aria-label=u.key ? 'New access key' : 'Create access key' data-bs-toggle="tooltip" data-bs-title=u.key ? 'Issue a new access key (the old one stops working)' : 'Create an access key')
+                i.bi.bi-key
+            if u.key
+              form.d-inline.ms-1(
+                method="post"
+                action=`/admin/users/${u.id}/key/revoke`
+                data-confirm=`Revoke ${u.username}'s access key? Their Agent stops working until they get a new one.`
+                data-confirm-title="Revoke access key?"
+                data-confirm-ok="Revoke key"
+              )
+                input(type="hidden" name="returnTo" value=list.pageUrl())
+                button.btn.btn-sm.btn-outline-warning(type="submit" aria-label="Revoke access key" data-bs-toggle="tooltip" data-bs-title="Revoke the access key")
+                  i.bi.bi-key-fill
+            if u.canUseDashboard
+              form.d-inline.ms-1(
+                method="post"
+                action=`/admin/users/${u.id}/reset-password`
+                data-confirm=`Give ${u.username} a new temporary password? Their current one stops working; they must change it at their next sign-in.`
+                data-confirm-title="Reset password?"
+                data-confirm-ok="Reset password"
+                data-confirm-tone="warning"
+              )
+                input(type="hidden" name="returnTo" value=list.pageUrl())
+                button.btn.btn-sm.btn-outline-secondary(type="submit" aria-label="Reset password" data-bs-toggle="tooltip" data-bs-title="New temporary password")
+                  i.bi.bi-asterisk
+            if u.id !== me.id
+              if u.blocked
+                form.d-inline.ms-1(method="post" action=`/admin/users/${u.id}/unblock`)
+                  input(type="hidden" name="returnTo" value=list.pageUrl())
+                  button.btn.btn-sm.btn-outline-success(type="submit" aria-label="Unblock" data-bs-toggle="tooltip" data-bs-title="Unblock: sign-in and access key work again")
+                    i.bi.bi-unlock
+              else
+                form.d-inline.ms-1(
+                  method="post"
+                  action=`/admin/users/${u.id}/block`
+                  data-confirm=`Block ${u.username}? They're signed out at once and their access key stops working. Their jobs keep running.`
+                  data-confirm-title="Block user?"
+                  data-confirm-ok="Block"
+                )
+                  input(type="hidden" name="returnTo" value=list.pageUrl())
+                  button.btn.btn-sm.btn-outline-danger(type="submit" aria-label="Block" data-bs-toggle="tooltip" data-bs-title="Block: no sign-in, no access key")
+                    i.bi.bi-lock
+              form.d-inline.ms-1(
+                method="post"
+                action=`/admin/users/${u.id}/delete`
+                data-confirm=`Delete ${u.username}? Their account and access key are gone for good; their jobs stay, listed under their name.`
+                data-confirm-title="Delete user?"
+                data-confirm-ok="Delete user"
+              )
+                input(type="hidden" name="returnTo" value=list.pageUrl())
+                button.btn.btn-sm.btn-outline-danger(type="submit" aria-label="Delete" data-bs-toggle="tooltip" data-bs-title="Delete the user")
+                  i.bi.bi-trash
+
+            .modal.text-start(tabindex="-1" id=`editUser-${u.id}` aria-labelledby=`editUserTitle-${u.id}`)
+              .modal-dialog
+                .modal-content
+                  form(method="post" action=`/admin/users/${u.id}`)
+                    input(type="hidden" name="returnTo" value=list.pageUrl())
+                    .modal-header
+                      h5.modal-title(id=`editUserTitle-${u.id}`)= `Edit ${u.username}`
+                      button.btn-close(type="button" data-bs-dismiss="modal" aria-label="Close")
+                    .modal-body
+                      .row.g-2
+                        .col-sm-6
+                          label.form-label(for=`u-${u.id}-username`) Username
+                          input.form-control(id=`u-${u.id}-username` name="username" value=u.username required maxlength="64" pattern="[A-Za-z0-9._@+\\-]{1,64}")
+                        .col-sm-6
+                          label.form-label(for=`u-${u.id}-email`) Email
+                          input.form-control(id=`u-${u.id}-email` type="email" name="email" value=u.email required)
+                        .col-sm-6
+                          label.form-label(for=`u-${u.id}-first`) First name
+                          input.form-control(id=`u-${u.id}-first` name="firstName" value=u.firstName || '')
+                        .col-sm-6
+                          label.form-label(for=`u-${u.id}-last`) Last name
+                          input.form-control(id=`u-${u.id}-last` name="lastName" value=u.lastName || '')
+                        .col-12
+                          label.form-label(for=`u-${u.id}-role`) Role
+                          +roleSelect(`u-${u.id}-role`, u.role)
+                          if !u.canUseDashboard
+                            .form-text Making them a maintainer or admin gives them a temporary password for the dashboard.
+                    .modal-footer
+                      button.btn.btn-secondary(type="button" data-bs-dismiss="modal") Cancel
+                      button.btn.btn-primary(type="submit") Save
+      else
+        tr
+          td.text-body-secondary(colspan="5")= q || roleFilter ? 'No user matches.' : 'No users yet.'
+
+  h2.h6.mt-4 Recent activity
+  if events.length
+    ul.list-group.list-group-flush.small.mb-4
+      each e in events
+        li.list-group-item.px-0
+          span.text-body-secondary.me-2= fmtDate(e.ts)
+          strong= e.type.replace('user.', '').replace(/_/g, ' ')
+          if e.data.username
+            = ` ${e.data.username}`
+          if e.data.role && e.data.role.from
+            = ` — ${roleLabel(e.data.role.from)} → ${roleLabel(e.data.role.to)}`
+          else if e.data.role
+            = ` (${roleLabel(e.data.role)})`
+          if e.data.by
+            span.text-body-secondary= ` by ${e.data.by}`
+  else
+    p.small.text-body-secondary Nothing yet.
+
+  .modal(tabindex="-1" id="addUserModal" aria-labelledby="addUserTitle")
+    .modal-dialog
+      .modal-content
+        form(method="post" action="/admin/users")
+          .modal-header
+            h5.modal-title#addUserTitle New user
+            button.btn-close(type="button" data-bs-dismiss="modal" aria-label="Close")
+          .modal-body
+            .row.g-2
+              .col-sm-6
+                label.form-label(for="new-username") Username
+                input.form-control#new-username(name="username" required maxlength="64" pattern="[A-Za-z0-9._@+\\-]{1,64}" placeholder="jane.doe")
+              .col-sm-6
+                label.form-label(for="new-email") Email
+                input.form-control#new-email(type="email" name="email" required placeholder="jane@example.com")
+              .col-sm-6
+                label.form-label(for="new-first") First name
+                input.form-control#new-first(name="firstName")
+              .col-sm-6
+                label.form-label(for="new-last") Last name
+                input.form-control#new-last(name="lastName")
+              .col-12
+                label.form-label(for="new-role") Role
+                +roleSelect('new-role', 'user')
+              .col-12
+                .form-check.mt-1
+                  input.form-check-input#new-key(type="checkbox" name="issueKey" value="1" checked)
+                  label.form-check-label(for="new-key") Create their access key now
+            p.small.text-body-secondary.mt-3.mb-0.
+              Maintainers and admins get a temporary password, to change at their first sign-in. The key and the password are
+              shown once, after Create.
+          .modal-footer
+            button.btn.btn-secondary(type="button" data-bs-dismiss="modal") Cancel
+            button.btn.btn-primary(type="submit") Create

package/views/help/_agent-cli.pug

@@ -6,11 +6,13 @@
     thub cancel   <jobId>                   Cancel a job
     thub resources [--json]                 Clients and their status
     thub jobs     [--mine] [--state <s>] [--json]   Recent jobs (a cli token: only its own)
-    thub config   set <url|token|group|user> <value>
+    thub config   set <url|key|group|user> <value>
+    thub whoami                             Whose access key this is
+    thub key show|rotate                    Your key's details / replace it (the old one stops at once)
     thub check-update                       Compare with the latest published Agent
     thub self-update [--to <x.y.z>]         Update with npm i -g
     thub --version
-    Global: --url <url>  --token <token>   (override THUB_URL / THUB_TOKEN / config file)
+    Global: --url <url>  --key <key>   (override THUB_URL / THUB_KEY / config file)
 
   h3.h6 #[code thub run] options
   -