@andrian.yablonskyy/thub-coordinator 1.1.1 → 1.1.3

package/README.md

@@ -14,7 +14,7 @@ This gives you two global commands: `thub-coordinator` (the server itself) and `
 
 - `~/.config/thub/coordinator.json` with every default option (see Configuration below), if it doesn't exist yet.
 - `~/var/lib/thub` (the `dataDir`: SQLite DB, uploaded artifacts, avatars) with its `artifacts/`, `avatars/` and `work/` subdirectories.
-- On Linux as root: `/etc/systemd/system/thub-coordinator.service`, enabled and started, so the Coordinator runs now and on every boot. A re-install/upgrade restarts it on the new code.
+- On Linux as root: `/etc/systemd/system/thub-coordinator.service` (`ProtectSystem=strict` with a private writable `/tmp`, which SQLite needs), enabled and started, so the Coordinator runs now and on every boot. A re-install/upgrade restarts it on the new code.
 
 Under `sudo`, `~` means the home of the user who ran `sudo` (`SUDO_USER`), not `/root`. That user owns the config and data and the service runs as them. Without root the config and directories are still created; the systemd step is skipped.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {

package/src/auth.js

@@ -120,7 +120,9 @@ function requireAdminSession(req, res, next){
   next();
 }
 
-// The dashboard's security features (§10.3): Users, Settings, CI tokens…
+// The dashboard's security features (§10.3): Settings, restarting and
+// updating the Coordinator, rotating a Client's token. (Users and CI tokens
+// are maintainers' too, within web/routes.js managesUser.)
 function requireAdminRole(req, res, next){
   if (req.session?.user?.role !== 'admin'){
     const text = 'Only admins can open this — it\'s one of the Coordinator\'s security features.';

package/src/web/routes.js

@@ -30,7 +30,7 @@ const fs = require('node:fs'),
   search = require('../services/search'),
   { createLoginGuard } = require('../login-guard'),
   { formatBytes } = require('../services/job-artifacts'),
-  { roleLabel } = require('../services/admin-users');
+  { roleLabel, normalizeRole } = require('../services/admin-users');
 
 // When this process started: the settings page tells a restart happened by it changing.
 const STARTED_AT = new Date().toISOString(),
@@ -858,13 +858,13 @@ function createWebRouter({ services, config }){
     return `Requested update to client v${version} — it starts on the Client's next heartbeat.`;
   }));
 
-  router.post('/admin/agents/update-all', requireAdminRole, updateAction(async () => {
+  router.post('/admin/agents/update-all', updateAction(async () => {
     const version = await services.updates.targetVersion('agent'),
       n = services.agents.requestUpdateAll(version);
     return `Requested update to agent v${version} for ${n} agent(s) — each updates on its next run.`;
   }));
 
-  router.post('/admin/agents/:id/update', requireAdminRole, updateAction(async (req) => {
+  router.post('/admin/agents/:id/update', updateAction(async (req) => {
     if (req.body.cancel === '1'){
       services.agents.setUpdateTo(req.params.id, null);
       return 'Update request canceled.';
@@ -1189,26 +1189,49 @@ function createWebRouter({ services, config }){
   // the page the action returns — never stored anywhere.
   // Searched (?q=), filtered by role (?role=user|maintainer|admin|blocked),
   // sorted and paged like the other lists (§10.1).
-  const USER_ROLE_FILTERS = ['user', 'maintainer', 'admin', 'blocked'],
+  const USER_ROLE_FILTERS = ['admin', 'maintainer', 'user', 'blocked'],
     ROLE_ORDER = { user: 0, maintainer: 1, admin: 2 },
+    // What the User column shows: first and last name, else the username.
+    userDisplayName = (u) => `${u.firstName || ''} ${u.lastName || ''}`.trim() || u.username,
     USER_SORT_VALUE = {
-      username: (u) => u.username.toLowerCase(),
+      username: (u) => userDisplayName(u).toLowerCase(),
       role: (u) => ROLE_ORDER[u.role],
       status: (u) => (u.blocked ? 1 : 0),
       used: (u) => u.key?.lastUsedAt || null
-    };
+    },
+    // Who manages whom on Users (§10.3): an admin everyone; a maintainer
+    // Agent-only users and their own account. Admins and other maintainers
+    // aren't even listed for them, and only an admin gives anyone a
+    // dashboard role.
+    isAdmin = (actor) => actor.role === 'admin',
+    managesUser = (actor, u) => Boolean(u) && (isAdmin(actor) || u.role === 'user' || u.id === actor.id),
+    userFiltersFor = (actor) => (isAdmin(actor) ? USER_ROLE_FILTERS : ['user', 'blocked']);
+
+  // A maintainer's Recent activity: about the users they see, and deleted
+  // ones that were Agent-only users when created — nothing about admins or
+  // other maintainers.
+  function visibleEvents(me, visibleIds){
+    const events = services.adminUsers.recentEvents(500),
+      existing = new Set(services.adminUsers.list().map((u) => u.id)),
+      createdAsUser = new Set(events.filter((e) => e.type === 'user.created' && e.data.role === 'user').map((e) => e.entity_id));
+    return events.filter((e) => visibleIds.has(e.entity_id) || (!existing.has(e.entity_id) && createdAsUser.has(e.entity_id))).slice(0, 30);
+  }
 
   function renderUsers(req, res, extra = {}){
-    const q = search.normalizeQuery(req.query.q),
+    const me = req.session.user,
+      filters = userFiltersFor(me),
+      q = search.normalizeQuery(req.query.q),
       terms = search.parseTerms(q),
-      role = USER_ROLE_FILTERS.includes(req.query.role) ? req.query.role : undefined,
+      role = filters.includes(req.query.role) ? req.query.role : undefined,
       view = listView(req, res, 'users', { q, role }),
       { sort, dir, size } = view.prefs,
       value = USER_SORT_VALUE[sort],
-      searched = services.adminUsers.list()
+      visible = services.adminUsers.list().filter((u) => managesUser(me, u)),
+      visibleIds = new Set(visible.map((u) => u.id)),
+      searched = visible
         .filter((u) => search.matches([u.username, u.email, u.firstName, u.lastName, u.role, u.blocked ? 'blocked' : 'active'], terms)),
       // Counts for the filter buttons: within the search, before the role filter.
-      roleCounts = Object.fromEntries(USER_ROLE_FILTERS.map((r) => [r, searched.filter((u) => (r === 'blocked' ? u.blocked : u.role === r)).length])),
+      roleCounts = Object.fromEntries(filters.map((r) => [r, searched.filter((u) => (r === 'blocked' ? u.blocked : u.role === r)).length])),
       sorted = searched
         .filter((u) => !role || (role === 'blocked' ? u.blocked : u.role === role))
         .sort((a, b) => {
@@ -1229,45 +1252,64 @@ function createWebRouter({ services, config }){
       users: sorted.slice(pagination.offset, pagination.offset + pagination.limit),
       total: searched.length,
       roleFilter: role,
-      roleFilters: USER_ROLE_FILTERS,
+      roleFilters: filters,
+      userDisplayName,
       roleCounts,
       list: { ...view, pagination, pageUrl, q },
       q,
-      me: req.session.user,
-      roles: services.adminUsers.ROLES,
+      me,
+      // The roles this admin or maintainer may give.
+      roles: isAdmin(me) ? services.adminUsers.ROLES : ['user'],
       roleHelp: {
         user: 'Agent only: submits jobs, reads their own results; no dashboard',
-        maintainer: 'Agent + the dashboard, without Users, Settings and CI tokens; sees and cancels every job',
+        maintainer: 'Agent + the dashboard without Settings; manages Agent-only users and CI tokens; sees and cancels every job',
         admin: 'Everything'
       },
       roleTone: { user: 'secondary', maintainer: 'info', admin: 'primary' },
-      events: services.adminUsers.recentEvents(30),
+      events: isAdmin(me) ? services.adminUsers.recentEvents(30) : visibleEvents(me, visibleIds),
       ...extra
     });
   }
 
   const userAction = (fn) => (req, res) => {
-    const by = req.session.user.username,
-      actorId = req.session.user.id;
-    try {
-      const result = fn(req, { by, actorId });
-      if (result?.secret){
-        return renderUsers(req, res, { secret: result.secret });
+      const actor = req.session.user,
+        by = actor.username,
+        actorId = actor.id;
+      try {
+      // Someone this admin or maintainer may not manage answers like an
+      // unknown id.
+        if (req.params.id && !managesUser(actor, services.adminUsers.getById(req.params.id))){
+          throw Object.assign(new Error('Unknown user'), { status: 404 });
+        }
+        const result = fn(req, { by, actorId, actor });
+        if (result?.secret){
+          return renderUsers(req, res, { secret: result.secret });
+        }
+        if (result?.message){
+          flash(req, 'success', result.message);
+        }
       }
-      if (result?.message){
-        flash(req, 'success', result.message);
+      catch (err){
+        flash(req, 'danger', err.message);
       }
-    }
-    catch (err){
-      flash(req, 'danger', err.message);
-    }
-    res.redirect(returnTo(req, '/admin/users')); // the same filter, sort and page
-  };
+      res.redirect(returnTo(req, '/admin/users')); // the same filter, sort and page
+    },
+    notOwnAccount = (req, { actorId }, what) => {
+      if (req.params.id === actorId){
+        throw Object.assign(new Error(`You can't ${what} your own account.`), { status: 409 });
+      }
+    };
 
-  router.get('/admin/users', requireAdminRole, (req, res) => renderUsers(req, res));
+  // Users and CI tokens: admins and maintainers (everyone who has a
+  // dashboard session), each within managesUser.
+  router.get('/admin/users', (req, res) => renderUsers(req, res));
 
-  router.post('/admin/users', requireAdminRole, userAction((req, ctx) => {
-    const { username, email, role, firstName, lastName } = req.body,
+  router.post('/admin/users', userAction((req, ctx) => {
+    const { username, email, role, firstName, lastName } = req.body;
+    if (!isAdmin(ctx.actor) && normalizeRole(role) !== 'user'){
+      throw new Error('Only an admin can create a maintainer or an admin.');
+    }
+    const
       created = services.adminUsers.create({ username, email, role, firstName, lastName, requireEmail: true }, ctx),
       key = req.body.issueKey === '1' ? services.adminUsers.issueKey(created.id, ctx) : null;
     if (!key && !created.tempPassword){
@@ -1276,31 +1318,36 @@ function createWebRouter({ services, config }){
     return { secret: { title: `User ${created.username} created`, key, password: created.tempPassword, username: created.username } };
   }));
 
-  router.post('/admin/users/:id', requireAdminRole, userAction((req, ctx) => {
-    const { username, email, role, firstName, lastName } = req.body,
+  router.post('/admin/users/:id', userAction((req, ctx) => {
+    const { username, email, role, firstName, lastName } = req.body;
+    if (!isAdmin(ctx.actor) && role !== undefined && normalizeRole(role) !== services.adminUsers.getById(req.params.id).role){
+      throw new Error('Only an admin can change a role.');
+    }
+    const
       { user, tempPassword } = services.adminUsers.update(req.params.id, { username, email, role, firstName, lastName }, ctx);
     return tempPassword
       ? { secret: { title: `${user.username} can now use the dashboard`, password: tempPassword, username: user.username } }
       : { message: `Saved ${user.username}.` };
   }));
 
-  router.post('/admin/users/:id/block', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/block', userAction((req, ctx) => {
+    notOwnAccount(req, ctx, 'block');
     const u = services.adminUsers.setBlocked(req.params.id, true, ctx);
     return { message: `Blocked ${u.username}: no sign-in, and their access key stops working.` };
   }));
 
-  router.post('/admin/users/:id/unblock', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/unblock', userAction((req, ctx) => {
     const u = services.adminUsers.setBlocked(req.params.id, false, ctx);
     return { message: `Unblocked ${u.username}.` };
   }));
 
-  router.post('/admin/users/:id/reset-password', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/reset-password', userAction((req, ctx) => {
     const u = services.adminUsers.getById(req.params.id),
       password = services.adminUsers.adminResetPassword(req.params.id, ctx);
     return { secret: { title: `New temporary password for ${u.username}`, password, username: u.username } };
   }));
 
-  router.post('/admin/users/:id/key', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/key', userAction((req, ctx) => {
     const u = services.adminUsers.getById(req.params.id);
     if (!u){
       throw Object.assign(new Error('Unknown user'), { status: 404 });
@@ -1312,27 +1359,28 @@ function createWebRouter({ services, config }){
     return { secret: { title, key, username: u.username } };
   }));
 
-  router.post('/admin/users/:id/key/revoke', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/key/revoke', userAction((req, ctx) => {
     const u = services.adminUsers.getById(req.params.id);
     services.adminUsers.revokeKey(req.params.id, ctx);
     return { message: `Revoked the access key of ${u?.username}.` };
   }));
 
-  router.post('/admin/users/:id/delete', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/delete', userAction((req, ctx) => {
+    notOwnAccount(req, ctx, 'delete');
     const u = services.adminUsers.getById(req.params.id);
     services.adminUsers.remove(req.params.id, ctx);
     return { message: `Deleted ${u?.username}. Their jobs stay, listed under their name.` };
   }));
 
-  router.get('/admin/agents', requireAdminRole, (req, res) => renderAgents(req, res));
+  router.get('/admin/agents', (req, res) => renderAgents(req, res));
 
-  router.post('/admin/agents', requireAdminRole, (req, res) => {
+  router.post('/admin/agents', (req, res) => {
     // CI tokens only; people get their key from their user (§10.3).
     const { token } = services.agents.create({ name: req.body.name, kind: 'ci' });
     renderAgents(req, res, { newToken: token });
   });
 
-  router.post('/admin/agents/:id/rename', requireAdminRole, (req, res) => {
+  router.post('/admin/agents/:id/rename', (req, res) => {
     try {
       const before = services.agents.get(req.params.id)?.name,
         agent = services.agents.rename(req.params.id, req.body.name);
@@ -1346,7 +1394,7 @@ function createWebRouter({ services, config }){
     res.redirect(returnTo(req, '/admin/agents'));
   });
 
-  router.post('/admin/agents/:id/revoke', requireAdminRole, (req, res) => {
+  router.post('/admin/agents/:id/revoke', (req, res) => {
     services.agents.revoke(req.params.id);
     res.redirect(returnTo(req, '/admin/agents'));
   });

package/systemd/thub-coordinator.service

@@ -16,6 +16,10 @@ Restart=always
 RestartSec=2
 NoNewPrivileges=yes
 ProtectSystem=strict
+# A private, writable /tmp: ProtectSystem=strict makes the shared one
+# read-only, and SQLite needs temp files for big sorts (a migration that
+# rebuilds a table and its index) — without them: SQLITE_IOERR_GETTEMPPATH.
+PrivateTmp=yes
 ReadWritePaths=/var/lib/thub/var/lib/thub
 
 [Install]

package/test/systemd-unit.test.js

@@ -0,0 +1,25 @@
+/**
+ * @file        packages/coordinator/test/systemd-unit.test.js
+ * @description Tests: the shipped systemd unit lets SQLite write its temp files
+ *
+ * @author      Andrian Yablonskyy
+ * @copyright   Copyright (c) 2026 Andrian Yablonskyy. All rights reserved.
+ *
+ * This file is part of TestHub and is proprietary and confidential.
+ * Unauthorized copying, modification, distribution, or use of this file,
+ * via any medium, is strictly prohibited without prior written permission
+ * from AdSystem.PRO.
+ */
+
+'use strict';
+
+const test = require('node:test'),
+  assert = require('node:assert/strict'),
+  fs = require('node:fs'),
+  path = require('node:path');
+
+test('systemd unit: ProtectSystem=strict comes with a private writable /tmp (SQLITE_IOERR_GETTEMPPATH)', () => {
+  const unit = fs.readFileSync(path.join(__dirname, '../systemd/thub-coordinator.service'), 'utf8');
+  assert.match(unit, /^ProtectSystem=strict$/m);
+  assert.match(unit, /^PrivateTmp=yes$/m);
+});

package/test/users.test.js

@@ -186,8 +186,9 @@ test('dashboard: only maintainers and admins sign in; security pages are admins\
 
   const mo = await signIn('mo', 'pw');
   assert.equal((await get(mo.cookie, '/resources')).status, 200);
-  for (const url of ['/admin/users', '/admin/settings', '/admin/agents']){
-    assert.equal((await get(mo.cookie, url)).status, 403, url);
+  assert.equal((await get(mo.cookie, '/admin/settings')).status, 403); // admins' only
+  for (const url of ['/admin/users', '/admin/agents']){
+    assert.equal((await get(mo.cookie, url)).status, 200, url); // within limits — see below
   }
   const root = await signIn('root', 'pw');
   assert.equal((await get(root.cookie, '/admin/users')).status, 200);
@@ -245,7 +246,7 @@ test('Users page: quick filter by role with counts, sorting and pages; role desc
       method: 'POST', body: new URLSearchParams({ username: 'root', password: 'pw' }), redirect: 'manual'
     })).headers.get('set-cookie').split(';')[0],
     page = (q) => fetch(`${base}/admin/users${q}`, { headers: { cookie } }).then((r) => r.text()),
-    names = (html) => [...html.matchAll(/<div class="fw-medium">([^<]+)/g)].map((m) => m[1]),
+    names = (html) => [...html.matchAll(/<a class="fw-medium" href="#editUser-[^"]+"[^>]*>([^<]+)/g)].map((m) => m[1]),
 
     users = await page('?role=user&size=10');
   assert.match(users, /Showing 1–10 of 12 users/); // before the two below are added
@@ -259,6 +260,9 @@ test('Users page: quick filter by role with counts, sorting and pages; role desc
   assert.match(users, /href="\/admin\/users\?role=user&amp;size=10&amp;sort=username&amp;dir=asc&amp;page=2"/); // pages keep the filter
   assert.deepEqual(names(await page('?role=blocked')), ['mo']);
   assert.match(users, />Maintainer<span class="badge/); // filter buttons
+  const filterNav = users.slice(users.indexOf('aria-label="Filter by role"'), users.indexOf('</nav>', users.indexOf('aria-label="Filter by role"')));
+  assert.deepEqual([...filterNav.matchAll(/<a [^>]*>([^<]+)</g)].map((m) => m[1].trim()), ['All', 'Admin', 'Maintainer', 'User', 'Blocked']);
+  assert.doesNotMatch(users, /d1@example\.com<\/div>|>Edit<\/button>/); // the name only; it opens Edit
   assert.match(users, /href="[^"]*role=maintainer/); // …while values stay lowercase
   assert.deepEqual(names(await page('?role=admin&size=all')), ['root']);
   assert.deepEqual(names(await page('?role=&sort=role&dir=desc&size=all')).slice(0, 2), ['root', 'mo']); // admin, maintainer, users…
@@ -267,3 +271,116 @@ test('Users page: quick filter by role with counts, sorting and pages; role desc
   assert.match(users, /<option value="user" selected="selected" data-help="Agent only[^"]*">User<\/option>/);
   assert.match(users, /<div class="form-text" id="new-role-help" aria-live="polite">Agent only/);
 });
+
+test('Users page: the User column shows first and last name, sorts by it, and opens Edit', async (t) => {
+  const { base, services } = await start(t),
+    u = services.adminUsers;
+  u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' });
+  const zed = u.create({ username: 'aaa', email: 'a@example.com', role: 'user', firstName: 'Zed', lastName: 'Young' });
+  u.create({ username: 'zzz', email: 'z@example.com', role: 'user', firstName: 'Ann' });
+  const cookie = (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'root', password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    html = await (await fetch(`${base}/admin/users?sort=username&dir=asc&size=all`, { headers: { cookie } })).text(),
+    cells = [...html.matchAll(/<a class="fw-medium" href="#editUser-([^"]+)"[^>]*>([^<]+)/g)];
+  assert.deepEqual(cells.map((m) => m[2]), ['Ann', 'root', 'Zed Young']); // no name → the username
+  assert.equal(cells[2][1], zed.id);
+  assert.match(html, new RegExp(`id="editUser-${zed.id}"`)); // the modal it opens
+});
+
+test('maintainers manage Agent-only users, their own account and CI tokens — never admins or other maintainers', async (t) => {
+  const { base, services } = await start(t),
+    u = services.adminUsers,
+    root = u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' }),
+    ops = u.create({ username: 'ops', email: 'o@example.com', role: 'maintainer', password: 'pw' }),
+    ops2 = u.create({ username: 'ops2', email: 'o2@example.com', role: 'maintainer', password: 'pw' }),
+    dev = u.create({ username: 'dev', email: 'd@example.com', role: 'user' }),
+    cookie = (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'ops', password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    get = (p) => fetch(`${base}${p}`, { headers: { cookie } }).then((r) => r.text()),
+    post = (p, body = {}) => fetch(`${base}${p}`, { method: 'POST', headers: { cookie }, body: new URLSearchParams(body), redirect: 'manual' })
+      .then(async (r) => (r.status === 302 ? get(r.headers.get('location')) : r.text()));
+
+  // The list: Agent-only users and themselves; filters without Admin/Maintainer; only User to give.
+  let page = await get('/admin/users?size=all');
+  assert.match(page, /href="\/admin\/users"[^>]*>(<i [^>]*><\/i>)?Users</); // in the navbar
+  assert.match(page, /href="\/admin\/agents"[^>]*>(<i [^>]*><\/i>)?CI tokens</);
+  assert.doesNotMatch(page, /href="\/admin\/settings"/);
+  const ids = [...page.matchAll(/href="#editUser-([^"]+)"/g)].map((m) => m[1]).sort();
+  assert.deepEqual(ids, [ops.id, dev.id].sort());
+  const filterNav = page.slice(page.indexOf('aria-label="Filter by role"'), page.indexOf('</nav>', page.indexOf('aria-label="Filter by role"')));
+  assert.deepEqual([...filterNav.matchAll(/<a [^>]*>([^<]+)</g)].map((m) => m[1].trim()), ['All', 'User', 'Blocked']);
+  assert.doesNotMatch(page.slice(page.indexOf('id="addUserModal"')), /<option value="(maintainer|admin)"/);
+  assert.match(page, new RegExp(`id="u-${ops.id}-role" value="Maintainer" disabled`)); // their own role, no picker
+
+  // Users: create, edit, key, block, delete.
+  page = await post('/admin/users', { username: 'dev2', email: 'd2@example.com', role: 'user', issueKey: '1' });
+  assert.match(page, /User dev2 created/);
+  assert.match(page, /value="thk_/);
+  const dev2 = u.getByUsername('dev2');
+  assert.match(await post(`/admin/users/${dev2.id}`, { username: 'dev2', email: 'd2@example.com', role: 'user', firstName: 'Dee' }), /Saved dev2/);
+  assert.match(await post(`/admin/users/${dev.id}/key`), /Access key for dev/);
+  assert.match(await post(`/admin/users/${dev.id}/key/revoke`), /Revoked the access key of dev/);
+  assert.match(await post(`/admin/users/${dev.id}/block`), /Blocked dev/);
+  assert.match(await post(`/admin/users/${dev.id}/unblock`), /Unblocked dev/);
+  assert.match(await post(`/admin/users/${dev2.id}/delete`), /Deleted dev2/);
+
+  // …but never a dashboard role.
+  assert.match(await post('/admin/users', { username: 'boss', email: 'b@example.com', role: 'admin' }), /Only an admin can create a maintainer or an admin/);
+  assert.match(await post('/admin/users', { username: 'm2', email: 'm2@example.com', role: 'maintainer' }), /Only an admin can create/);
+  assert.equal(u.getByUsername('boss'), undefined);
+  assert.match(await post(`/admin/users/${dev.id}`, { username: 'dev', email: 'd@example.com', role: 'maintainer' }), /Only an admin can change a role/);
+  assert.equal(u.getById(dev.id).role, 'user');
+
+  // Admins and other maintainers: as if they didn't exist.
+  for (const other of [root, ops2]){
+    for (const action of ['', '/block', '/reset-password', '/key', '/key/revoke', '/delete']){
+      assert.match(await post(`/admin/users/${other.id}${action}`, { username: 'x', email: 'x@example.com' }), /Unknown user/, `${other.username}${action}`);
+    }
+  }
+  assert.equal(u.getById(root.id).blocked, false);
+  assert.equal(u.getById(ops2.id).username, 'ops2');
+
+  // Their own account: edit, key, new temporary password — not block or delete, not a new role.
+  assert.match(await post(`/admin/users/${ops.id}`, { username: 'ops', email: 'o@example.com', firstName: 'Olga' }), /Saved ops/);
+  assert.equal(u.getById(ops.id).role, 'maintainer');
+  assert.match(await post(`/admin/users/${ops.id}`, { username: 'ops', email: 'o@example.com', role: 'admin' }), /Only an admin can change a role/);
+  assert.match(await post(`/admin/users/${ops.id}/key`), /Access key for ops/);
+  assert.match(await post(`/admin/users/${ops.id}/block`), /can&#39;t block your own account|can't block your own account/);
+  assert.match(await post(`/admin/users/${ops.id}/delete`), /can&#39;t delete your own account|can't delete your own account/);
+
+  // Recent activity: nothing about admins or other maintainers.
+  page = await get('/admin/users');
+  const activity = page.slice(page.indexOf('Recent activity'), page.indexOf('id="addUserModal"'));
+  assert.doesNotMatch(activity, /\b(root|ops2)\b/);
+  assert.match(activity, /dev2/);
+
+  // CI tokens: issue, rename, revoke.
+  page = await post('/admin/agents', { name: 'ci-nightly' });
+  assert.match(page, /Token \(shown once\):[\s\S]*?<code>agt_/);
+  const ci = services.agents.list().find((a) => a.name === 'ci-nightly');
+  await post(`/admin/agents/${ci.id}/rename`, { name: 'ci-night' });
+  await post(`/admin/agents/${ci.id}/revoke`);
+  assert.equal(services.agents.get(ci.id).name, 'ci-night');
+  assert.ok(services.agents.get(ci.id).revoked_at);
+
+  // Still admin-only: Settings.
+  assert.equal((await fetch(`${base}/admin/settings`, { headers: { cookie } })).status, 403);
+
+  // Every job and its details, whoever submitted it.
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+  const ciAgent = services.agents.create({ name: 'ci-x', kind: 'ci' }).agent,
+    ciJob = services.jobs.create({ agentId: ciAgent.id, source: 'ci', spec: { target: { type: 'sw' }, command: './ci.sh' } }),
+    devKey = u.issueKey(dev.id, { by: 'root' }),
+    devAgent = services.agents.list().find((a) => a.user_id === dev.id),
+    devJob = services.jobs.create({ agentId: devAgent.id, source: 'cli', spec: { target: { type: 'sw' }, command: './dev.sh' } });
+  assert.ok(devKey);
+  const jobs = await get('/jobs?size=all');
+  assert.ok(jobs.includes(ciJob.id) && jobs.includes(devJob.id));
+  for (const job of [devJob, ciJob]){
+    const r = await fetch(`${base}/jobs/${job.id}`, { headers: { cookie } });
+    assert.equal(r.status, 200);
+    assert.match(await r.text(), new RegExp(`<title>${job.id} `));
+  }
+});

package/views/admin/users.pug

@@ -1,8 +1,9 @@
 extends ../layout
 include ../mixins/list-controls
 
-//- Users (§10.3, admins). Roles: user — the Agent only; maintainer — the
-//- dashboard without its security features; admin — everything.
+//- Users (§10.3). Roles: user — the Agent only; maintainer — the dashboard
+//- without its security features; admin — everything. A maintainer sees and
+//- manages Agent-only users and their own account (web/routes.js managesUser).
 //- Role picker: names in the list, the chosen role's description below it
 //- (kept in step by public/js/actions.js, select[data-describe]).
 mixin roleSelect(id, selected)
@@ -68,17 +69,10 @@ block content
     tbody
       each u in users
         tr(class=u.blocked ? 'opacity-50' : '')
+          //- Just the name (the username until one is set); it opens Edit,
+          //- where the username, email and the rest are.
           td
-            .fw-medium
-              = u.username
-              if u.id === me.id
-                span.badge.text-bg-light.border.ms-1 you
-            if u.firstName || u.lastName
-              .small= `${u.firstName || ''} ${u.lastName || ''}`.trim()
-            if u.email
-              .small.text-body-secondary= u.email
-            else
-              span.badge.text-bg-warning(data-bs-toggle="tooltip" data-bs-title="Every user needs an email — add it with Edit") no email
+            a.fw-medium(href=`#editUser-${u.id}` data-bs-toggle="modal" role="button")= userDisplayName(u)
           td
             span.badge(class=`text-bg-${roleTone[u.role]}` data-bs-toggle="tooltip" data-bs-title=roleHelp[u.role])= roleLabel(u.role)
           td
@@ -98,8 +92,7 @@ block content
             else
               span.text-body-secondary none
           td.text-end.text-nowrap
-            button.btn.btn-sm.btn-outline-secondary(type="button" data-bs-toggle="modal" data-bs-target=`#editUser-${u.id}` aria-label=`Edit ${u.username}`) Edit
-            form.d-inline.ms-1(
+            form.d-inline(
               method="post"
               action=`/admin/users/${u.id}/key`
               data-confirm=u.key ? `Issue a new access key for ${u.username}? Their current key stops working at once.` : `Create an access key for ${u.username}?`
@@ -161,7 +154,8 @@ block content
                 button.btn.btn-sm.btn-outline-danger(type="submit" aria-label="Delete" data-bs-toggle="tooltip" data-bs-title="Delete the user")
                   i.bi.bi-trash
 
-            .modal.text-start(tabindex="-1" id=`editUser-${u.id}` aria-labelledby=`editUserTitle-${u.id}`)
+            //- Inside the actions cell (text-nowrap): wrap again in here.
+            .modal.text-start.text-wrap(tabindex="-1" id=`editUser-${u.id}` aria-labelledby=`editUserTitle-${u.id}`)
               .modal-dialog
                 .modal-content
                   form(method="post" action=`/admin/users/${u.id}`)
@@ -185,8 +179,14 @@ block content
                           input.form-control(id=`u-${u.id}-last` name="lastName" value=u.lastName || '')
                         .col-12
                           label.form-label(for=`u-${u.id}-role`) Role
-                          +roleSelect(`u-${u.id}-role`, u.role)
-                          if !u.canUseDashboard
+                          //- A maintainer gives no roles but User; their own
+                          //- row shows theirs without a picker (and posts none).
+                          if roles.includes(u.role)
+                            +roleSelect(`u-${u.id}-role`, u.role)
+                          else
+                            input.form-control(id=`u-${u.id}-role` value=roleLabel(u.role) disabled)
+                            .form-text Only an admin can change a role.
+                          if !u.canUseDashboard && roles.length > 1
                             .form-text Making them a maintainer or admin gives them a temporary password for the dashboard.
                     .modal-footer
                       button.btn.btn-secondary(type="button" data-bs-dismiss="modal") Cancel

package/views/help/_ci.pug

@@ -1,7 +1,7 @@
 +section('ci', 'CI/CD integration (GitHub Actions)', 'github')
   p.
     The test job only needs the Agent and HTTPS access to the Coordinator, so it runs on an ordinary hosted runner.
-    Create a #[strong CI token] on #[a(href="/admin/agents") CI tokens] (admins) and store it as the repository secret
+    Create a #[strong CI token] on #[a(href="/admin/agents") CI tokens] (admins and maintainers) and store it as the repository secret
     #[code THUB_CI_TOKEN].
   +code('.github/workflows/firmware.yml').
     name: firmware

package/views/help/_client-setup.pug

@@ -103,7 +103,10 @@
   p.small.
     SW Clients have no settings of their own: they run whatever DUT image a job brings (#[code --docker-image]).
     Admins can also edit an HW Client's devices from its resource card (#[strong ST-Link | UART | DUT USB]
-    tabs). #[strong Connected USB devices → Import to config] fills them from the host's #[code lsusb].
+    tabs). The tabs show the config the Client runs, as it reported it at its last start, or a saved
+    change it hasn't applied yet. #[strong Connected USB devices → Import to config] fills them from the host's #[code lsusb].
+    There's no ST-Link serial field: the job's #[code --command] picks the probe
+    (#[code $THUB_DUT_STLINK_<n>]), and the Client reads each serial from its udev symlink.
 
   h3.h6 Several DUT slots on one machine
   +code('One instance per slot').

package/views/help/_coordinator.pug

@@ -13,6 +13,8 @@
     #[code ~/.config/thub/coordinator.json] (with a random #[code sessionSecret]) and
     #[code ~/var/lib/thub] (database, avatars). It installs, enables and starts
     #[code thub-coordinator.service], plus the root helper behind the navbar's #[strong Update app] button.
+    The unit uses #[code ProtectSystem=strict] with #[code PrivateTmp=yes], so the data directory and a
+    private #[code /tmp] (SQLite's temp files) are the only places the service can write.
 
   h3.h6 2. Configure
   p.small.
@@ -123,6 +125,12 @@
     thub-admin resource maintenance <resourceId> --on
     thub-admin jobs reset --yes                             # cancel every active job
     thub-admin jobs clean --yes --before "01/09/2026 00:00:00"
+  p.small.
+    On #[a(href="/admin/users") Users], click a name to edit that user. The quick filter is
+    #[strong All | Admin | Maintainer | User | Blocked]. The search box also matches usernames and emails.
+    Maintainers use Users too, for Agent-only users and their own account only. They can create, edit, block
+    and delete those users and issue or revoke their keys, but can't create or promote a maintainer or admin.
+    They don't see admins or other maintainers. They also manage #[a(href="/admin/agents") CI tokens].
   +note('warning').
     Forgot the admin password? Start the Coordinator once with #[code THUB_BOOTSTRAP_ADMIN_PASSWORD=…]
     (and optionally #[code THUB_BOOTSTRAP_ADMIN_USER], default #[code admin]). The password is reset on

package/views/help/_quick-start.pug

@@ -21,7 +21,7 @@
       | It shows up on #[a(href="/resources") Resources] by itself, usually within 10 s.
     li
       strong Create users and their access keys
-      |  on #[a(href="/admin/users") Users] (admins), or on the Coordinator host with
+      |  on #[a(href="/admin/users") Users] (admins and maintainers), or on the Coordinator host with
       |  #[code thub-admin user add <name> --email <email> --key]. The key is shown once.
     li
       strong Install and configure the Agent

package/views/help/_troubleshooting.pug

@@ -21,6 +21,7 @@
       ['429 Too Many Requests', 'A caller went over `rateLimit.requestsPerMinute` (per agent or resource token, per dashboard user, else per IP; default 500). The Agent and Client wait for `Retry-After` and retry by themselves; a script calling the API should do the same. Raise the limit in the config file or on Settings if your normal traffic needs more (a Client streaming logs makes up to ~240 requests a minute). Too many sign-in attempts from one address: wait a minute (`rateLimit.loginPerMinute`).'],
       ['Sign-in says “Too many failed sign-ins”', 'After repeated wrong passwords the Coordinator makes each further attempt wait, doubling each time: per address from the 5th failure (up to 15 min), per username from the 10th from any address (up to 5 min). Wait the time shown, or sign in from another address; a successful sign-in clears it, and an hour without failures forgets it. The Coordinator never tells whether a username exists.'],
       ['Agent says “Invalid or revoked access key” or “… is blocked”', 'The key was replaced (`thub key rotate`, an admin, your profile) or revoked, or your user is blocked. Ask an admin for a new key (Users), or create one on your profile if you can sign in. Then `thub config set key <key>`; `thub whoami` checks it.'],
+      ['The Coordinator won\'t start after an upgrade: `SqliteError: disk I/O error` (`SQLITE_IOERR_GETTEMPPATH`)', 'Its systemd unit is older than 1.1.1: it has `ProtectSystem=strict` without `PrivateTmp=yes`, so SQLite has no writable temp directory for a large migration. The migration rolls back, so no data is lost. Install the latest version with `sudo npm i -g @andrian.yablonskyy/thub-coordinator` (the dashboard can\'t update a Coordinator that\'s down), or run `sudo systemctl edit thub-coordinator`, add `[Service]` and `PrivateTmp=yes`, then `sudo systemctl restart thub-coordinator`.'],
       ['Locked out of the dashboard', 'Restart the Coordinator once with `THUB_BOOTSTRAP_ADMIN_PASSWORD=<new>` (resets the `admin` user), then unset it.']
     ]
     const withCode = (text) => text

package/views/layout.pug

@@ -53,7 +53,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
           //- Below lg the menu drops down over the page (thub.css .thub-nav,
           //- closed by public/js/actions.js): pages as a two-column grid with
           //- icons, then the tools in a row, then the account row.
-          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/resources', 'resources', 'Resources', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task']].concat(user.role === 'admin' ? [['/admin/users', 'users', 'Users', 'people'], ['/admin/agents', 'agents', 'CI tokens', 'key'], ['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
+          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/resources', 'resources', 'Resources', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task'], ['/admin/users', 'users', 'Users', 'people'], ['/admin/agents', 'agents', 'CI tokens', 'key']].concat(user.role === 'admin' ? [['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
           ul.navbar-nav.me-auto.thub-nav-pages
             each pg in pages
               li.nav-item