@andrian.yablonskyy/thub-coordinator 1.0.43 → 1.1.0

package/views/help/_agent-setup.pug

@@ -10,40 +10,42 @@
   p.small.
     In CI you don't need a global install: #[code npx -y @andrian.yablonskyy/thub-agent run …].
 
-  h3.h6 Get a token
+  h3.h6 Get your access key
   p.small.
-    An admin registers an agent on #[a(href="/admin/agents") Agents] (or with #[code thub-admin agent add]) and passes you
-    its token, which is shown only once. The agent's #[strong kind] decides the job id prefix, the default priority and which jobs it can see:
+    Every person has a user with one #[strong access key]. An admin creates you on #[a(href="/admin/users") Users]
+    (or with #[code thub-admin user add]) and hands you the key, which is shown only once. Maintainers and admins can also
+    create or replace their own on their #[a(href="/profile") profile]. Your #[strong role] decides what you can do:
   table.table.table-sm.small.w-auto
     thead
       tr
-        th Kind
-        th For
-        th Job ids
-        th Default priority
-        th Can see
+        th Role
+        th Agent
+        th Dashboard
     tbody
       tr
-        td: code ci
-        td Pipelines
-        td: code A-00001…
-        td 50
-        td every job (details, log)
+        td: strong User
+        td submits jobs, sees and cancels only their own
+        td no
       tr
-        td: code cli
-        td Developers
-        td: code M-00001…
-        td 60 (so a busy pipeline doesn't starve them)
-        td only the jobs it submitted
+        td: strong Maintainer
+        td submits jobs, sees and cancels every job
+        td yes, without Users, Settings and CI tokens
+      tr
+        td: strong Admin
+        td like a Maintainer
+        td everything
+  p.small.
+    Pipelines use a #[strong CI token] instead (#[a(href="/admin/agents") CI tokens], admins): their jobs get A- ids and they
+    read every job. People's jobs get M- ids.
 
   h3.h6 Configure
   +code('Save the settings once').
     thub config set url   #{coordinatorUrl}
-    thub config set token agt_…
+    thub config set key   thk_…
     thub config set user  "Your Name"      # optional: job owner label
     thub config set group <groupId>       # optional: default --group
   p.small.
-    These are saved in #[code ~/.config/thub/agent.json]. Order of precedence: flags (#[code --url], #[code --token]) →
+    These are saved in #[code ~/.config/thub/agent.json]. Order of precedence: flags (#[code --url], #[code --key]) →
     environment → config file.
   table.table.table-sm.small
     thead
@@ -55,8 +57,8 @@
         td: code THUB_URL
         td Coordinator URL, e.g. #[code #{coordinatorUrl}]
       tr
-        td: code THUB_TOKEN
-        td Agent token. Keep it in your CI's secret store.
+        td: code THUB_KEY
+        td Your access key, or a CI token in a pipeline. Keep it in your CI's secret store. (#[code THUB_TOKEN], #[code --token] and a saved #[code token] still work: the old names.)
       tr
         td: code THUB_GROUP
         td Default #[code --group]
@@ -66,7 +68,10 @@
       tr
         td: code THUB_NO_SELF_UPDATE=1
         td Don't install admin-requested Agent updates on this machine
-  +code('Check the connection').
+  +code('Check the connection and your key').
+    thub whoami             # jane (user) <jane@example.com>
+    thub key show           # your key's last characters, created, last used
+    thub key rotate         # replace it — the old one stops at once; saved to the config file if it came from there
     thub resources          # lists the Clients and their status
     thub jobs --mine        # your recent jobs
   p.small.mb-0.

package/views/help/_ci.pug

@@ -1,8 +1,8 @@
 +section('ci', 'CI/CD integration (GitHub Actions)', 'github')
   p.
     The test job only needs the Agent and HTTPS access to the Coordinator, so it runs on an ordinary hosted runner.
-    Create a #[strong ci]-kind agent on #[a(href="/admin/agents") Agents] and store its token as the repository secret
-    #[code THUB_AGENT_TOKEN].
+    Create a #[strong CI token] on #[a(href="/admin/agents") CI tokens] (admins) and store it as the repository secret
+    #[code THUB_CI_TOKEN].
   +code('.github/workflows/firmware.yml').
     name: firmware
     on: [push, pull_request]
@@ -27,7 +27,7 @@
         runs-on: ubuntu-latest
         env:
           THUB_URL: #{coordinatorUrl}
-          THUB_TOKEN: ${{ secrets.THUB_AGENT_TOKEN }}
+          THUB_KEY: ${{ secrets.THUB_CI_TOKEN }}
         steps:
           - run: |
               npx -y @andrian.yablonskyy/thub-agent run \
@@ -41,4 +41,4 @@
     li The step's exit code is the verdict (#[a(href="#agent-cli") exit codes]), so the workflow fails exactly when the tests do.
     li If the workflow is canceled, the Agent (in #[code --wait] mode) cancels the TestHub job, so abandoned runs don't hold hardware.
     li Downloads carry no credentials. Publish the image to a URL the Client can read, or fetch it in #[code --command] with a token passed as #[code --env].
-    li Other CI systems (GitLab CI, Jenkins, Azure Pipelines) work the same way: install Node.js, set #[code THUB_URL]/#[code THUB_TOKEN] and run #[code thub run … --wait].
+    li Other CI systems (GitLab CI, Jenkins, Azure Pipelines) work the same way: install Node.js, set #[code THUB_URL]/#[code THUB_KEY] and run #[code thub run … --wait].

package/views/help/_coordinator.pug

@@ -114,10 +114,11 @@
   p.small.
     #[code thub-admin] works directly on the database. Run it on the Coordinator host as the service user.
   +code('Coordinator host').
-    thub-admin create-admin alice 's3cret' --role admin     # or --role viewer (read-only dashboard)
+    thub-admin user add alice --email alice@example.com --role admin --password 's3cret'
+    thub-admin user add bob --email bob@example.com --key   # role user (Agent only); prints his key once
+    thub-admin user list | block | unblock | role | password | key | delete …
     thub-admin join-key generate                            # → clientJoinKey here, joinKey on every Client
-    thub-admin agent add ci-firmware --kind ci              # CI token: job ids A-00001…
-    thub-admin agent add alice-laptop --kind cli            # developer token: job ids M-00001…
+    thub-admin agent add ci-firmware                        # CI token for a pipeline: job ids A-00001…
     thub-admin group add ci-nightly --comment "nightly pool" # → a group id for thub run --group
     thub-admin resource maintenance <resourceId> --on
     thub-admin jobs reset --yes                             # cancel every active job

package/views/help/_env.pug

@@ -68,7 +68,7 @@
             td: code.text-nowrap= v[1]
             td= v[2]
   p.small.
-    #[code --url], #[code --token], #[code --wait], #[code --detach], #[code --json] and #[code --dry-run] only affect the Agent and
+    #[code --url], #[code --key], #[code --wait], #[code --detach], #[code --json] and #[code --dry-run] only affect the Agent and
     have no variable. The Client's own git commands also get #[code GIT_TERMINAL_PROMPT=0] and #[code GIT_ALLOW_PROTOCOL=http:https:ssh:git].
 
   h3.h6 Your own variables: #[code --env]

package/views/help/_overview.pug

@@ -37,7 +37,7 @@
 
   h3.h6 How a job flows
   ol.small
-    li #[code thub run …] submits a job spec (type, labels, command, inputs) with an agent token.
+    li #[code thub run …] submits a job spec (type, labels, command, inputs) with your access key (or a pipeline's CI token).
     li The Coordinator queues it (#[code QUEUED]) and the scheduler assigns it to an idle Client whose type, labels and group match.
     li The Client accepts it, clones #[code --git-repo], downloads #[code --download-file] files and prepares the DUT (#[code PREPARING]).
     li It runs #[code --command] with #[code sh -c], and output streams live to the Agent and the dashboard (#[code RUNNING]).

package/views/help/_quick-start.pug

@@ -9,7 +9,7 @@
         thub-admin join-key generate          # → put it in clientJoinKey
         nano ~/.config/thub/coordinator.json  # publicUrl, clientJoinKey
         sudo systemctl restart thub-coordinator
-        thub-admin create-admin admin 'a-strong-password'
+        thub-admin user add admin --email you@example.com --role admin --password 'a-strong-password'
     li
       strong Install a Client
       |  on each lab machine, with the same join key (#[a(href="#client-setup") Client setup]):
@@ -20,16 +20,16 @@
         sudo systemctl enable --now thub-client@client
       | It shows up on #[a(href="/resources") Resources] by itself, usually within 10 s.
     li
-      strong Issue an agent token
-      |  on #[a(href="/admin/agents") Agents] (admins), or on the Coordinator host with
-      |  #[code thub-admin agent add <name> --kind ci|cli]. The token is shown once.
+      strong Create users and their access keys
+      |  on #[a(href="/admin/users") Users] (admins), or on the Coordinator host with
+      |  #[code thub-admin user add <name> --email <email> --key]. The key is shown once.
     li
       strong Install and configure the Agent
       |  (#[a(href="#agent-setup") Agent setup]):
       +code('Developer machine').
         npm i -g @andrian.yablonskyy/thub-agent
         thub config set url #{coordinatorUrl}
-        thub config set token agt_…
+        thub config set key thk_…
     li
       strong Run a job
       |  (#[a(href="#agent-cli") Agent CLI reference]):

package/views/help/_troubleshooting.pug

@@ -20,6 +20,7 @@
       ['Where are a job\'s test reports and output files?', 'The Coordinator keeps only the log and the result (verdict, exit code, JUnit test counts). Files the job creates stay in its workspace on the Client and are deleted when the job ends. To keep them, publish them from `--command`, e.g. `curl -fsS -H "Authorization: Bearer $ART_TOKEN" -T results/report.xml "https://artifactory.example.com/qa/$THUB_JOB_ID/report.xml"` with `--env ART_TOKEN`. To show them on the job page and in `thub status`, list them in `$THUB_ARTIFACTS_FILE` as `[{"name", "size", "link", "timestamp"}]` — only that metadata is kept. The full log is always available from the job page\'s Raw button.'],
       ['429 Too Many Requests', 'A caller went over `rateLimit.requestsPerMinute` (per agent or resource token, per dashboard user, else per IP; default 500). The Agent and Client wait for `Retry-After` and retry by themselves; a script calling the API should do the same. Raise the limit in the config file or on Settings if your normal traffic needs more (a Client streaming logs makes up to ~240 requests a minute). Too many sign-in attempts from one address: wait a minute (`rateLimit.loginPerMinute`).'],
       ['Sign-in says “Too many failed sign-ins”', 'After repeated wrong passwords the Coordinator makes each further attempt wait, doubling each time: per address from the 5th failure (up to 15 min), per username from the 10th from any address (up to 5 min). Wait the time shown, or sign in from another address; a successful sign-in clears it, and an hour without failures forgets it. The Coordinator never tells whether a username exists.'],
+      ['Agent says “Invalid or revoked access key” or “… is blocked”', 'The key was replaced (`thub key rotate`, an admin, your profile) or revoked, or your user is blocked. Ask an admin for a new key (Users), or create one on your profile if you can sign in. Then `thub config set key <key>`; `thub whoami` checks it.'],
       ['Locked out of the dashboard', 'Restart the Coordinator once with `THUB_BOOTSTRAP_ADMIN_PASSWORD=<new>` (resets the `admin` user), then unset it.']
     ]
     const withCode = (text) => text

package/views/index.pug

@@ -42,7 +42,7 @@ block content
   each r in resources
     +resourceCard(r, groupsById, '/')
 
-  if user && user.role === 'admin'
+  if can.operate
     +removeResourceModal()
 
 block scripts

package/views/layout.pug

@@ -21,7 +21,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
             data-bs-title=`Coordinator v${coordinatorVersion} · thub-common v${commonVersion} (validates job specs)`
           )
             | ver. #{coordinatorVersion}
-            if user && user.role !== 'admin' && updates.coordinatorUpdate
+            if user && !can.admin && updates.coordinatorUpdate
               span.badge.text-bg-warning.ms-1(
                 data-bs-toggle="tooltip"
                 data-bs-placement="bottom"
@@ -33,7 +33,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
           //- Below lg the menu drops down over the page (thub.css .thub-nav,
           //- closed by public/js/actions.js): pages as a two-column grid with
           //- icons, then the tools in a row, then the account row.
-          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/resources', 'resources', 'Resources', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task']].concat(user.role === 'admin' ? [['/admin/agents', 'agents', 'Agents', 'person-badge'], ['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
+          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/resources', 'resources', 'Resources', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task']].concat(user.role === 'admin' ? [['/admin/users', 'users', 'Users', 'people'], ['/admin/agents', 'agents', 'CI tokens', 'key'], ['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
           ul.navbar-nav.me-auto.thub-nav-pages
             each pg in pages
               li.nav-item
@@ -59,7 +59,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
                 )
                   i.bi.bi-question-circle.me-1
                   | Help
-            if user && user.role === 'admin'
+            if user && can.operate
               li.nav-item.d-flex.align-items-center.me-2
                 form(method="post" action="/updates/check" data-submit-busy)
                   input(type="hidden" name="returnTo" value=currentPath)
@@ -71,7 +71,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
                     data-bs-title=updates.checkedAt ? `Check for updates now — the Coordinator and connected resources (last checked ${fmtDate(updates.checkedAt)})` : 'Check for updates now — the Coordinator and connected resources'
                   )
                     i.bi.bi-arrow-repeat
-            if user && user.role === 'admin' && updates.coordinatorUpdate
+            if user && can.admin && updates.coordinatorUpdate
               li.nav-item.d-flex.align-items-center.me-3
                 if updates.coordinatorPending
                   //- public/js/update-watch.js polls /updates/status and
@@ -118,7 +118,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
                   href="/profile"
                   data-bs-toggle="tooltip"
                   data-bs-placement="bottom"
-                  data-bs-title=`Profile settings (${user.role})`
+                  data-bs-title=`Profile settings (${roleLabel(user.role)})`
                 )
                   if user.avatarPath
                     img.rounded-circle.me-2(src=user.avatarPath width="24" height="24" style="object-fit: cover;")
@@ -126,7 +126,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
                     span.rounded-circle.bg-secondary.text-white.d-inline-flex.align-items-center.justify-content-center.me-2(style="width: 24px; height: 24px; font-size: 12px;")
                       = ((user.firstName ? user.firstName[0] : user.username[0]) + (user.lastName ? user.lastName[0] : '')).toUpperCase()
                   span= user.firstName ? `${user.firstName} ${user.lastName || ''}`.trim() : user.username
-                  span.small.text-body-secondary.ms-2.d-lg-none= `${user.role} · profile`
+                  span.small.text-body-secondary.ms-2.d-lg-none= `${roleLabel(user.role)} · profile`
               li.nav-item.d-flex.align-items-center
                 form(action="/logout" method="post")
                   button.btn.btn-sm.btn-outline-danger(
@@ -194,6 +194,6 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
     script(src="/js/actions.js")
     if user && liveTopics
       script(src="/js/live.js")
-    if user && user.role === 'admin' && updates.coordinatorPending
+    if user && can.admin && updates.coordinatorPending
       script(src="/js/update-watch.js")
     block scripts

package/views/mixins/client-config.pug

@@ -106,7 +106,7 @@ mixin configTabItems(r)
 //- at once.
 mixin groupsPane(r, returnTo, groupsById)
   - const p = `cfg-${r.id}`
-  - const canEdit = user.role === 'admin'
+  - const canEdit = can.operate
   - const pending = r.config_import && r.config_import.revision > r.config_applied_revision && r.config_import.fields && r.config_import.fields.groups
   - const all = Object.values(groupsById).sort((a, b) => a.name.localeCompare(b.name))
   - const unknown = r.group_ids.filter((id) => !groupsById[id])
@@ -163,7 +163,7 @@ mixin groupsPane(r, returnTo, groupsById)
 mixin configPanes(r, returnTo, groupsById)
   - const p = `cfg-${r.id}`
   - const current = r.config_desired || r.client_config
-  - const canEdit = user.role === 'admin'
+  - const canEdit = can.operate
   if r.type !== 'hw'
     //- no device tabs
   else if !current

package/views/mixins/resource.pug

@@ -25,22 +25,24 @@ mixin resourceActions(r, returnTo)
         data-bs-title="Take this resource out of rotation for maintenance — the scheduler will skip it"
       )
         i.bi.bi-tools
-  form.d-inline.ms-1(
-    method="post"
-    action=`/resources/${r.id}/rotate-token`
-    data-confirm=`Issue a new token for ${r.name}? Its current token stops working at once, and the Client won't reconnect until it has the new one.`
-    data-confirm-title="Rotate resource token?"
-    data-confirm-ok="Rotate token"
-    data-confirm-tone="warning"
-  )
-    input(type="hidden" name="returnTo" value=returnTo)
-    button.btn.btn-sm.btn-outline-warning(
-      type="submit"
-      aria-label="Rotate token"
-      data-bs-toggle="tooltip"
-      data-bs-title="Invalidate the current resource token and issue a new one — the Client won't reconnect until it has it"
+  //- Credentials: admins only (§10.3).
+  if can.admin
+    form.d-inline.ms-1(
+      method="post"
+      action=`/resources/${r.id}/rotate-token`
+      data-confirm=`Issue a new token for ${r.name}? Its current token stops working at once, and the Client won't reconnect until it has the new one.`
+      data-confirm-title="Rotate resource token?"
+      data-confirm-ok="Rotate token"
+      data-confirm-tone="warning"
     )
-      i.bi.bi-arrow-repeat
+      input(type="hidden" name="returnTo" value=returnTo)
+      button.btn.btn-sm.btn-outline-warning(
+        type="submit"
+        aria-label="Rotate token"
+        data-bs-toggle="tooltip"
+        data-bs-title="Invalidate the current resource token and issue a new one — the Client won't reconnect until it has it"
+      )
+        i.bi.bi-arrow-repeat
   +removeResourceButton(r, returnTo)
 
 //- Remove: a plain confirm when the resource is idle; with a running job,
@@ -188,7 +190,7 @@ mixin uptimeRows(r, returnTo)
         span.text-body-secondary.small.ms-1 (at last heartbeat)
     else
       span.text-body-secondary —
-    if user.role === 'admin'
+    if can.operate
       +cancelActivityButton(r, returnTo)
 
 //- Scheduled host reboot (cron, in the Client host's local time): what's
@@ -226,7 +228,7 @@ mixin rebootScheduleRow(r, returnTo)
         data-bs-toggle="tooltip"
         data-bs-title="This host has no reboot helper (thub-client-reboot.path), so the schedule can't reboot it — reinstall the Client as root: sudo npm i -g @andrian.yablonskyy/thub-client"
       ) can't reboot
-    if user.role === 'admin'
+    if can.operate
       form.d-flex.gap-1.mt-1(
         method="post"
         action=`/resources/${r.id}/reboot-schedule`
@@ -338,7 +340,7 @@ mixin usbScanPane(r)
   - const importWhy = r.type !== 'hw' ? 'Only HW Clients have USB device lists to import into' : !(r.config_desired || r.client_config) ? 'This Client is too old to report its config — update it first' : null
   div(data-usb-scan=`/resources/${r.id}/usb-scan` data-pending=r.usb_scan_request_id ? '1' : null data-requested-at=r.usb_scan_requested_at)
     .d-flex.align-items-center.gap-2.mb-2
-      if user.role === 'admin'
+      if can.operate
         if offline
           span.d-inline-block(tabindex="0" data-bs-toggle="tooltip" data-bs-title="Offline — a Client can only be scanned while it's connected")
             button.btn.btn-sm.btn-outline-primary(type="button" disabled style="pointer-events: none;")
@@ -366,7 +368,7 @@ mixin usbScanPane(r)
         if scan
           = `lsusb -tvv at ${fmtDate(scan.at)}`
         else
-          | Not scanned yet#{user.role === 'admin' ? ' — press Refresh to run lsusb -tvv on the Client' : ''}.
+          | Not scanned yet#{can.operate ? ' — press Refresh to run lsusb -tvv on the Client' : ''}.
     .alert.alert-danger.py-2.small(data-usb-error class=scan && scan.error ? null : 'd-none')= scan && scan.error || ''
     pre.bg-body-tertiary.p-2.rounded.small.mb-0(data-usb-output style="max-height: 360px; overflow: auto;" class=scan && scan.output ? null : 'd-none')= scan && scan.output || ''
 
@@ -453,7 +455,7 @@ mixin resourceDetails(r, groupsById, returnTo, local, external)
           data-bs-toggle="tooltip"
           data-bs-title="Renamed on the dashboard; this is the name the Client itself reports"
         )= `(Client: ${r.reported_name})`
-      if user.role === 'admin'
+      if can.operate
         button.btn.btn-sm.btn-link.p-0.ms-2.align-baseline(
           type="button"
           data-bs-toggle="collapse"
@@ -513,7 +515,7 @@ mixin resourceDetails(r, groupsById, returnTo, local, external)
     dd.col-sm-8= r.busy_source ? `${r.busy_source}${r.busy_reason ? ' — ' + r.busy_reason : ''}` : '—'
     dt.col-sm-4 Last heartbeat
     dd.col-sm-8= fmtDate(r.last_heartbeat_at, 'never')
-    if user.role === 'admin'
+    if can.operate
       dt.col-sm-4 Actions
       dd.col-sm-8.mb-0
         +resourceActions(r, returnTo)

package/views/mixins/updates.pug

@@ -25,7 +25,7 @@ mixin versionCell(current, latest, updateTo)
 //- an update). Agents table, Resources table, resource card.
 mixin versionWithUpdate(current, latest, updateTo, action, returnTo, canUpdate = true, holding = false)
   +versionCell(current, latest, updateTo)
-  if user.role === 'admin' && canUpdate && (updateTo || holding || (current && isNewer(latest, current)))
+  if can.operate && canUpdate && (updateTo || holding || (current && isNewer(latest, current)))
     +updateButton(action, updateTo || (holding ? true : null), returnTo)
 
 //- Latest published version of `app` (agent | client), "check now" and,
@@ -40,7 +40,7 @@ mixin updatesToolbar(app, label, returnTo)
         = ` · checked ${fmtDate(updates.checkedAt)}`
       if updates.error
         i.bi.bi-exclamation-triangle.text-warning.ms-1(data-bs-toggle="tooltip" data-bs-title=updates.error)
-    if user.role === 'admin'
+    if can.operate
       form.d-inline(method="post" action="/updates/check")
         input(type="hidden" name="returnTo" value=returnTo)
         button.btn.btn-sm.btn-outline-secondary(type="submit")

package/views/profile.pug

@@ -3,6 +3,24 @@ extends layout
 block content
   h1.h4.mb-3 Profile settings
 
+  if user.mustChangePassword
+    .alert.alert-warning
+      i.bi.bi-shield-exclamation.me-1
+      | You signed in with a temporary password — choose your own below before using the dashboard.
+
+  if secret
+    //- Shown once (§10.3): nothing keeps it.
+    .alert.alert-warning(role="alert")
+      h2.h6.alert-heading
+        i.bi.bi-shield-lock.me-1
+        = secret.title
+      .input-group.input-group-sm.mb-2
+        span.input-group-text Access key
+        input.form-control.font-monospace(type="text" value=secret.key readonly aria-label="Access key")
+        button.btn.btn-outline-secondary(type="button" data-copy=secret.key aria-label="Copy access key")
+          i.bi.bi-clipboard
+      p.small.mb-0 Shown only now. Save it with #[code thub config set key …] (or use #[code THUB_KEY] / #[code --key]).
+
   .row
     .col-md-6
       form(method="post" action="/profile" enctype="multipart/form-data")
@@ -21,6 +39,12 @@ block content
           label.form-label(for="username") Username
           input#username.form-control(type="text" name="username" value=user.username required)
 
+        .mb-3
+          label.form-label(for="email") Email
+          input#email.form-control(type="email" name="email" value=user.email required)
+          if !user.email
+            .form-text.text-warning Every user needs an email — please add yours.
+
         .row
           .col-6.mb-3
             label.form-label(for="firstName") First name
@@ -58,6 +82,38 @@ block content
                 data-set-theme=t
               )= t.charAt(0).toUpperCase() + t.slice(1)
 
+      //- Your access key for the Agent (§10.3); also: thub key show|rotate.
+      .card.mb-3
+        .card-body
+          h6.card-subtitle.mb-3.text-body-secondary My access key
+          if accessKey
+            p.small.mb-2
+              | #[code= `…${accessKey.token_hint || '????'}`] · created #{fmtDate(accessKey.token_created_at || accessKey.created_at)} · last used #{fmtDate(accessKey.last_used_at, 'never')}
+          else
+            p.small.text-body-secondary.mb-2 None yet — create one to use the Agent (thub).
+          .d-flex.gap-2
+            form(
+              method="post"
+              action="/profile/key"
+              data-confirm=accessKey ? 'Replace your access key? The current one stops working at once — everywhere you use it.' : 'Create your access key?'
+              data-confirm-title=accessKey ? 'Replace access key?' : 'Create access key?'
+              data-confirm-ok=accessKey ? 'Replace key' : 'Create key'
+              data-confirm-tone="primary"
+            )
+              button.btn.btn-sm.btn-outline-primary(type="submit")
+                i.bi.bi-key.me-1
+                = accessKey ? 'Replace key' : 'Create key'
+            if accessKey
+              form(
+                method="post"
+                action="/profile/key/revoke"
+                data-confirm="Revoke your access key? The Agent stops working for you until you create a new one."
+                data-confirm-title="Revoke access key?"
+                data-confirm-ok="Revoke key"
+              )
+                button.btn.btn-sm.btn-outline-warning(type="submit") Revoke
+          .form-text.mt-2 From the command line: #[code thub key show] and #[code thub key rotate].
+
       .card
         .card-body
           h6.card-subtitle.mb-3.text-body-secondary Change password

package/views/resources/list.pug

@@ -30,7 +30,7 @@ block content
         th Groups
         th Busy source / reason
         +sortHeader(list, 'heartbeat', 'Last heartbeat', 'desc')
-        if user.role === 'admin'
+        if can.operate
           th Actions
     tbody(data-live="rows")
       each r in resources
@@ -50,14 +50,14 @@ block content
               span.text-body-secondary —
           td= r.busy_source ? `${r.busy_source}${r.busy_reason ? ' — ' + r.busy_reason : ''}` : '—'
           td= fmtDate(r.last_heartbeat_at, 'never')
-          if user.role === 'admin'
+          if can.operate
             td
               +resourceActions(r, list.pageUrl())
 
   each r in resources
     +resourceCard(r, groupsById, list.pageUrl())
 
-  if user && user.role === 'admin'
+  if can.operate
     +removeResourceModal()
 
 block scripts