@andrian.yablonskyy/thub-coordinator 1.1.2 → 1.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {

package/src/auth.js

@@ -120,7 +120,9 @@ function requireAdminSession(req, res, next){
   next();
 }
 
-// The dashboard's security features (§10.3): Users, Settings, CI tokens…
+// The dashboard's security features (§10.3): Settings, restarting and
+// updating the Coordinator, rotating a Client's token. (Users and CI tokens
+// are maintainers' too, within web/routes.js managesUser.)
 function requireAdminRole(req, res, next){
   if (req.session?.user?.role !== 'admin'){
     const text = 'Only admins can open this — it\'s one of the Coordinator\'s security features.';

package/src/web/routes.js

@@ -30,7 +30,7 @@ const fs = require('node:fs'),
   search = require('../services/search'),
   { createLoginGuard } = require('../login-guard'),
   { formatBytes } = require('../services/job-artifacts'),
-  { roleLabel } = require('../services/admin-users');
+  { roleLabel, normalizeRole } = require('../services/admin-users');
 
 // When this process started: the settings page tells a restart happened by it changing.
 const STARTED_AT = new Date().toISOString(),
@@ -858,13 +858,13 @@ function createWebRouter({ services, config }){
     return `Requested update to client v${version} — it starts on the Client's next heartbeat.`;
   }));
 
-  router.post('/admin/agents/update-all', requireAdminRole, updateAction(async () => {
+  router.post('/admin/agents/update-all', updateAction(async () => {
     const version = await services.updates.targetVersion('agent'),
       n = services.agents.requestUpdateAll(version);
     return `Requested update to agent v${version} for ${n} agent(s) — each updates on its next run.`;
   }));
 
-  router.post('/admin/agents/:id/update', requireAdminRole, updateAction(async (req) => {
+  router.post('/admin/agents/:id/update', updateAction(async (req) => {
     if (req.body.cancel === '1'){
       services.agents.setUpdateTo(req.params.id, null);
       return 'Update request canceled.';
@@ -1198,19 +1198,40 @@ function createWebRouter({ services, config }){
       role: (u) => ROLE_ORDER[u.role],
       status: (u) => (u.blocked ? 1 : 0),
       used: (u) => u.key?.lastUsedAt || null
-    };
+    },
+    // Who manages whom on Users (§10.3): an admin everyone; a maintainer
+    // Agent-only users and their own account. Admins and other maintainers
+    // aren't even listed for them, and only an admin gives anyone a
+    // dashboard role.
+    isAdmin = (actor) => actor.role === 'admin',
+    managesUser = (actor, u) => Boolean(u) && (isAdmin(actor) || u.role === 'user' || u.id === actor.id),
+    userFiltersFor = (actor) => (isAdmin(actor) ? USER_ROLE_FILTERS : ['user', 'blocked']);
+
+  // A maintainer's Recent activity: about the users they see, and deleted
+  // ones that were Agent-only users when created — nothing about admins or
+  // other maintainers.
+  function visibleEvents(me, visibleIds){
+    const events = services.adminUsers.recentEvents(500),
+      existing = new Set(services.adminUsers.list().map((u) => u.id)),
+      createdAsUser = new Set(events.filter((e) => e.type === 'user.created' && e.data.role === 'user').map((e) => e.entity_id));
+    return events.filter((e) => visibleIds.has(e.entity_id) || (!existing.has(e.entity_id) && createdAsUser.has(e.entity_id))).slice(0, 30);
+  }
 
   function renderUsers(req, res, extra = {}){
-    const q = search.normalizeQuery(req.query.q),
+    const me = req.session.user,
+      filters = userFiltersFor(me),
+      q = search.normalizeQuery(req.query.q),
       terms = search.parseTerms(q),
-      role = USER_ROLE_FILTERS.includes(req.query.role) ? req.query.role : undefined,
+      role = filters.includes(req.query.role) ? req.query.role : undefined,
       view = listView(req, res, 'users', { q, role }),
       { sort, dir, size } = view.prefs,
       value = USER_SORT_VALUE[sort],
-      searched = services.adminUsers.list()
+      visible = services.adminUsers.list().filter((u) => managesUser(me, u)),
+      visibleIds = new Set(visible.map((u) => u.id)),
+      searched = visible
         .filter((u) => search.matches([u.username, u.email, u.firstName, u.lastName, u.role, u.blocked ? 'blocked' : 'active'], terms)),
       // Counts for the filter buttons: within the search, before the role filter.
-      roleCounts = Object.fromEntries(USER_ROLE_FILTERS.map((r) => [r, searched.filter((u) => (r === 'blocked' ? u.blocked : u.role === r)).length])),
+      roleCounts = Object.fromEntries(filters.map((r) => [r, searched.filter((u) => (r === 'blocked' ? u.blocked : u.role === r)).length])),
       sorted = searched
         .filter((u) => !role || (role === 'blocked' ? u.blocked : u.role === role))
         .sort((a, b) => {
@@ -1231,46 +1252,64 @@ function createWebRouter({ services, config }){
       users: sorted.slice(pagination.offset, pagination.offset + pagination.limit),
       total: searched.length,
       roleFilter: role,
-      roleFilters: USER_ROLE_FILTERS,
+      roleFilters: filters,
       userDisplayName,
       roleCounts,
       list: { ...view, pagination, pageUrl, q },
       q,
-      me: req.session.user,
-      roles: services.adminUsers.ROLES,
+      me,
+      // The roles this admin or maintainer may give.
+      roles: isAdmin(me) ? services.adminUsers.ROLES : ['user'],
       roleHelp: {
         user: 'Agent only: submits jobs, reads their own results; no dashboard',
-        maintainer: 'Agent + the dashboard, without Users, Settings and CI tokens; sees and cancels every job',
+        maintainer: 'Agent + the dashboard without Settings; manages Agent-only users and CI tokens; sees and cancels every job',
         admin: 'Everything'
       },
       roleTone: { user: 'secondary', maintainer: 'info', admin: 'primary' },
-      events: services.adminUsers.recentEvents(30),
+      events: isAdmin(me) ? services.adminUsers.recentEvents(30) : visibleEvents(me, visibleIds),
       ...extra
     });
   }
 
   const userAction = (fn) => (req, res) => {
-    const by = req.session.user.username,
-      actorId = req.session.user.id;
-    try {
-      const result = fn(req, { by, actorId });
-      if (result?.secret){
-        return renderUsers(req, res, { secret: result.secret });
+      const actor = req.session.user,
+        by = actor.username,
+        actorId = actor.id;
+      try {
+      // Someone this admin or maintainer may not manage answers like an
+      // unknown id.
+        if (req.params.id && !managesUser(actor, services.adminUsers.getById(req.params.id))){
+          throw Object.assign(new Error('Unknown user'), { status: 404 });
+        }
+        const result = fn(req, { by, actorId, actor });
+        if (result?.secret){
+          return renderUsers(req, res, { secret: result.secret });
+        }
+        if (result?.message){
+          flash(req, 'success', result.message);
+        }
       }
-      if (result?.message){
-        flash(req, 'success', result.message);
+      catch (err){
+        flash(req, 'danger', err.message);
       }
-    }
-    catch (err){
-      flash(req, 'danger', err.message);
-    }
-    res.redirect(returnTo(req, '/admin/users')); // the same filter, sort and page
-  };
+      res.redirect(returnTo(req, '/admin/users')); // the same filter, sort and page
+    },
+    notOwnAccount = (req, { actorId }, what) => {
+      if (req.params.id === actorId){
+        throw Object.assign(new Error(`You can't ${what} your own account.`), { status: 409 });
+      }
+    };
 
-  router.get('/admin/users', requireAdminRole, (req, res) => renderUsers(req, res));
+  // Users and CI tokens: admins and maintainers (everyone who has a
+  // dashboard session), each within managesUser.
+  router.get('/admin/users', (req, res) => renderUsers(req, res));
 
-  router.post('/admin/users', requireAdminRole, userAction((req, ctx) => {
-    const { username, email, role, firstName, lastName } = req.body,
+  router.post('/admin/users', userAction((req, ctx) => {
+    const { username, email, role, firstName, lastName } = req.body;
+    if (!isAdmin(ctx.actor) && normalizeRole(role) !== 'user'){
+      throw new Error('Only an admin can create a maintainer or an admin.');
+    }
+    const
       created = services.adminUsers.create({ username, email, role, firstName, lastName, requireEmail: true }, ctx),
       key = req.body.issueKey === '1' ? services.adminUsers.issueKey(created.id, ctx) : null;
     if (!key && !created.tempPassword){
@@ -1279,31 +1318,36 @@ function createWebRouter({ services, config }){
     return { secret: { title: `User ${created.username} created`, key, password: created.tempPassword, username: created.username } };
   }));
 
-  router.post('/admin/users/:id', requireAdminRole, userAction((req, ctx) => {
-    const { username, email, role, firstName, lastName } = req.body,
+  router.post('/admin/users/:id', userAction((req, ctx) => {
+    const { username, email, role, firstName, lastName } = req.body;
+    if (!isAdmin(ctx.actor) && role !== undefined && normalizeRole(role) !== services.adminUsers.getById(req.params.id).role){
+      throw new Error('Only an admin can change a role.');
+    }
+    const
       { user, tempPassword } = services.adminUsers.update(req.params.id, { username, email, role, firstName, lastName }, ctx);
     return tempPassword
       ? { secret: { title: `${user.username} can now use the dashboard`, password: tempPassword, username: user.username } }
       : { message: `Saved ${user.username}.` };
   }));
 
-  router.post('/admin/users/:id/block', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/block', userAction((req, ctx) => {
+    notOwnAccount(req, ctx, 'block');
     const u = services.adminUsers.setBlocked(req.params.id, true, ctx);
     return { message: `Blocked ${u.username}: no sign-in, and their access key stops working.` };
   }));
 
-  router.post('/admin/users/:id/unblock', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/unblock', userAction((req, ctx) => {
     const u = services.adminUsers.setBlocked(req.params.id, false, ctx);
     return { message: `Unblocked ${u.username}.` };
   }));
 
-  router.post('/admin/users/:id/reset-password', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/reset-password', userAction((req, ctx) => {
     const u = services.adminUsers.getById(req.params.id),
       password = services.adminUsers.adminResetPassword(req.params.id, ctx);
     return { secret: { title: `New temporary password for ${u.username}`, password, username: u.username } };
   }));
 
-  router.post('/admin/users/:id/key', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/key', userAction((req, ctx) => {
     const u = services.adminUsers.getById(req.params.id);
     if (!u){
       throw Object.assign(new Error('Unknown user'), { status: 404 });
@@ -1315,27 +1359,28 @@ function createWebRouter({ services, config }){
     return { secret: { title, key, username: u.username } };
   }));
 
-  router.post('/admin/users/:id/key/revoke', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/key/revoke', userAction((req, ctx) => {
     const u = services.adminUsers.getById(req.params.id);
     services.adminUsers.revokeKey(req.params.id, ctx);
     return { message: `Revoked the access key of ${u?.username}.` };
   }));
 
-  router.post('/admin/users/:id/delete', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/delete', userAction((req, ctx) => {
+    notOwnAccount(req, ctx, 'delete');
     const u = services.adminUsers.getById(req.params.id);
     services.adminUsers.remove(req.params.id, ctx);
     return { message: `Deleted ${u?.username}. Their jobs stay, listed under their name.` };
   }));
 
-  router.get('/admin/agents', requireAdminRole, (req, res) => renderAgents(req, res));
+  router.get('/admin/agents', (req, res) => renderAgents(req, res));
 
-  router.post('/admin/agents', requireAdminRole, (req, res) => {
+  router.post('/admin/agents', (req, res) => {
     // CI tokens only; people get their key from their user (§10.3).
     const { token } = services.agents.create({ name: req.body.name, kind: 'ci' });
     renderAgents(req, res, { newToken: token });
   });
 
-  router.post('/admin/agents/:id/rename', requireAdminRole, (req, res) => {
+  router.post('/admin/agents/:id/rename', (req, res) => {
     try {
       const before = services.agents.get(req.params.id)?.name,
         agent = services.agents.rename(req.params.id, req.body.name);
@@ -1349,7 +1394,7 @@ function createWebRouter({ services, config }){
     res.redirect(returnTo(req, '/admin/agents'));
   });
 
-  router.post('/admin/agents/:id/revoke', requireAdminRole, (req, res) => {
+  router.post('/admin/agents/:id/revoke', (req, res) => {
     services.agents.revoke(req.params.id);
     res.redirect(returnTo(req, '/admin/agents'));
   });

package/test/users.test.js

@@ -186,8 +186,9 @@ test('dashboard: only maintainers and admins sign in; security pages are admins\
 
   const mo = await signIn('mo', 'pw');
   assert.equal((await get(mo.cookie, '/resources')).status, 200);
-  for (const url of ['/admin/users', '/admin/settings', '/admin/agents']){
-    assert.equal((await get(mo.cookie, url)).status, 403, url);
+  assert.equal((await get(mo.cookie, '/admin/settings')).status, 403); // admins' only
+  for (const url of ['/admin/users', '/admin/agents']){
+    assert.equal((await get(mo.cookie, url)).status, 200, url); // within limits — see below
   }
   const root = await signIn('root', 'pw');
   assert.equal((await get(root.cookie, '/admin/users')).status, 200);
@@ -286,3 +287,100 @@ test('Users page: the User column shows first and last name, sorts by it, and op
   assert.equal(cells[2][1], zed.id);
   assert.match(html, new RegExp(`id="editUser-${zed.id}"`)); // the modal it opens
 });
+
+test('maintainers manage Agent-only users, their own account and CI tokens — never admins or other maintainers', async (t) => {
+  const { base, services } = await start(t),
+    u = services.adminUsers,
+    root = u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' }),
+    ops = u.create({ username: 'ops', email: 'o@example.com', role: 'maintainer', password: 'pw' }),
+    ops2 = u.create({ username: 'ops2', email: 'o2@example.com', role: 'maintainer', password: 'pw' }),
+    dev = u.create({ username: 'dev', email: 'd@example.com', role: 'user' }),
+    cookie = (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'ops', password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    get = (p) => fetch(`${base}${p}`, { headers: { cookie } }).then((r) => r.text()),
+    post = (p, body = {}) => fetch(`${base}${p}`, { method: 'POST', headers: { cookie }, body: new URLSearchParams(body), redirect: 'manual' })
+      .then(async (r) => (r.status === 302 ? get(r.headers.get('location')) : r.text()));
+
+  // The list: Agent-only users and themselves; filters without Admin/Maintainer; only User to give.
+  let page = await get('/admin/users?size=all');
+  assert.match(page, /href="\/admin\/users"[^>]*>(<i [^>]*><\/i>)?Users</); // in the navbar
+  assert.match(page, /href="\/admin\/agents"[^>]*>(<i [^>]*><\/i>)?CI tokens</);
+  assert.doesNotMatch(page, /href="\/admin\/settings"/);
+  const ids = [...page.matchAll(/href="#editUser-([^"]+)"/g)].map((m) => m[1]).sort();
+  assert.deepEqual(ids, [ops.id, dev.id].sort());
+  const filterNav = page.slice(page.indexOf('aria-label="Filter by role"'), page.indexOf('</nav>', page.indexOf('aria-label="Filter by role"')));
+  assert.deepEqual([...filterNav.matchAll(/<a [^>]*>([^<]+)</g)].map((m) => m[1].trim()), ['All', 'User', 'Blocked']);
+  assert.doesNotMatch(page.slice(page.indexOf('id="addUserModal"')), /<option value="(maintainer|admin)"/);
+  assert.match(page, new RegExp(`id="u-${ops.id}-role" value="Maintainer" disabled`)); // their own role, no picker
+
+  // Users: create, edit, key, block, delete.
+  page = await post('/admin/users', { username: 'dev2', email: 'd2@example.com', role: 'user', issueKey: '1' });
+  assert.match(page, /User dev2 created/);
+  assert.match(page, /value="thk_/);
+  const dev2 = u.getByUsername('dev2');
+  assert.match(await post(`/admin/users/${dev2.id}`, { username: 'dev2', email: 'd2@example.com', role: 'user', firstName: 'Dee' }), /Saved dev2/);
+  assert.match(await post(`/admin/users/${dev.id}/key`), /Access key for dev/);
+  assert.match(await post(`/admin/users/${dev.id}/key/revoke`), /Revoked the access key of dev/);
+  assert.match(await post(`/admin/users/${dev.id}/block`), /Blocked dev/);
+  assert.match(await post(`/admin/users/${dev.id}/unblock`), /Unblocked dev/);
+  assert.match(await post(`/admin/users/${dev2.id}/delete`), /Deleted dev2/);
+
+  // …but never a dashboard role.
+  assert.match(await post('/admin/users', { username: 'boss', email: 'b@example.com', role: 'admin' }), /Only an admin can create a maintainer or an admin/);
+  assert.match(await post('/admin/users', { username: 'm2', email: 'm2@example.com', role: 'maintainer' }), /Only an admin can create/);
+  assert.equal(u.getByUsername('boss'), undefined);
+  assert.match(await post(`/admin/users/${dev.id}`, { username: 'dev', email: 'd@example.com', role: 'maintainer' }), /Only an admin can change a role/);
+  assert.equal(u.getById(dev.id).role, 'user');
+
+  // Admins and other maintainers: as if they didn't exist.
+  for (const other of [root, ops2]){
+    for (const action of ['', '/block', '/reset-password', '/key', '/key/revoke', '/delete']){
+      assert.match(await post(`/admin/users/${other.id}${action}`, { username: 'x', email: 'x@example.com' }), /Unknown user/, `${other.username}${action}`);
+    }
+  }
+  assert.equal(u.getById(root.id).blocked, false);
+  assert.equal(u.getById(ops2.id).username, 'ops2');
+
+  // Their own account: edit, key, new temporary password — not block or delete, not a new role.
+  assert.match(await post(`/admin/users/${ops.id}`, { username: 'ops', email: 'o@example.com', firstName: 'Olga' }), /Saved ops/);
+  assert.equal(u.getById(ops.id).role, 'maintainer');
+  assert.match(await post(`/admin/users/${ops.id}`, { username: 'ops', email: 'o@example.com', role: 'admin' }), /Only an admin can change a role/);
+  assert.match(await post(`/admin/users/${ops.id}/key`), /Access key for ops/);
+  assert.match(await post(`/admin/users/${ops.id}/block`), /can&#39;t block your own account|can't block your own account/);
+  assert.match(await post(`/admin/users/${ops.id}/delete`), /can&#39;t delete your own account|can't delete your own account/);
+
+  // Recent activity: nothing about admins or other maintainers.
+  page = await get('/admin/users');
+  const activity = page.slice(page.indexOf('Recent activity'), page.indexOf('id="addUserModal"'));
+  assert.doesNotMatch(activity, /\b(root|ops2)\b/);
+  assert.match(activity, /dev2/);
+
+  // CI tokens: issue, rename, revoke.
+  page = await post('/admin/agents', { name: 'ci-nightly' });
+  assert.match(page, /Token \(shown once\):[\s\S]*?<code>agt_/);
+  const ci = services.agents.list().find((a) => a.name === 'ci-nightly');
+  await post(`/admin/agents/${ci.id}/rename`, { name: 'ci-night' });
+  await post(`/admin/agents/${ci.id}/revoke`);
+  assert.equal(services.agents.get(ci.id).name, 'ci-night');
+  assert.ok(services.agents.get(ci.id).revoked_at);
+
+  // Still admin-only: Settings.
+  assert.equal((await fetch(`${base}/admin/settings`, { headers: { cookie } })).status, 403);
+
+  // Every job and its details, whoever submitted it.
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+  const ciAgent = services.agents.create({ name: 'ci-x', kind: 'ci' }).agent,
+    ciJob = services.jobs.create({ agentId: ciAgent.id, source: 'ci', spec: { target: { type: 'sw' }, command: './ci.sh' } }),
+    devKey = u.issueKey(dev.id, { by: 'root' }),
+    devAgent = services.agents.list().find((a) => a.user_id === dev.id),
+    devJob = services.jobs.create({ agentId: devAgent.id, source: 'cli', spec: { target: { type: 'sw' }, command: './dev.sh' } });
+  assert.ok(devKey);
+  const jobs = await get('/jobs?size=all');
+  assert.ok(jobs.includes(ciJob.id) && jobs.includes(devJob.id));
+  for (const job of [devJob, ciJob]){
+    const r = await fetch(`${base}/jobs/${job.id}`, { headers: { cookie } });
+    assert.equal(r.status, 200);
+    assert.match(await r.text(), new RegExp(`<title>${job.id} `));
+  }
+});

package/views/admin/users.pug

@@ -1,8 +1,9 @@
 extends ../layout
 include ../mixins/list-controls
 
-//- Users (§10.3, admins). Roles: user — the Agent only; maintainer — the
-//- dashboard without its security features; admin — everything.
+//- Users (§10.3). Roles: user — the Agent only; maintainer — the dashboard
+//- without its security features; admin — everything. A maintainer sees and
+//- manages Agent-only users and their own account (web/routes.js managesUser).
 //- Role picker: names in the list, the chosen role's description below it
 //- (kept in step by public/js/actions.js, select[data-describe]).
 mixin roleSelect(id, selected)
@@ -153,7 +154,8 @@ block content
                 button.btn.btn-sm.btn-outline-danger(type="submit" aria-label="Delete" data-bs-toggle="tooltip" data-bs-title="Delete the user")
                   i.bi.bi-trash
 
-            .modal.text-start(tabindex="-1" id=`editUser-${u.id}` aria-labelledby=`editUserTitle-${u.id}`)
+            //- Inside the actions cell (text-nowrap): wrap again in here.
+            .modal.text-start.text-wrap(tabindex="-1" id=`editUser-${u.id}` aria-labelledby=`editUserTitle-${u.id}`)
               .modal-dialog
                 .modal-content
                   form(method="post" action=`/admin/users/${u.id}`)
@@ -177,8 +179,14 @@ block content
                           input.form-control(id=`u-${u.id}-last` name="lastName" value=u.lastName || '')
                         .col-12
                           label.form-label(for=`u-${u.id}-role`) Role
-                          +roleSelect(`u-${u.id}-role`, u.role)
-                          if !u.canUseDashboard
+                          //- A maintainer gives no roles but User; their own
+                          //- row shows theirs without a picker (and posts none).
+                          if roles.includes(u.role)
+                            +roleSelect(`u-${u.id}-role`, u.role)
+                          else
+                            input.form-control(id=`u-${u.id}-role` value=roleLabel(u.role) disabled)
+                            .form-text Only an admin can change a role.
+                          if !u.canUseDashboard && roles.length > 1
                             .form-text Making them a maintainer or admin gives them a temporary password for the dashboard.
                     .modal-footer
                       button.btn.btn-secondary(type="button" data-bs-dismiss="modal") Cancel

package/views/help/_ci.pug

@@ -1,7 +1,7 @@
 +section('ci', 'CI/CD integration (GitHub Actions)', 'github')
   p.
     The test job only needs the Agent and HTTPS access to the Coordinator, so it runs on an ordinary hosted runner.
-    Create a #[strong CI token] on #[a(href="/admin/agents") CI tokens] (admins) and store it as the repository secret
+    Create a #[strong CI token] on #[a(href="/admin/agents") CI tokens] (admins and maintainers) and store it as the repository secret
     #[code THUB_CI_TOKEN].
   +code('.github/workflows/firmware.yml').
     name: firmware

package/views/help/_coordinator.pug

@@ -126,8 +126,11 @@
     thub-admin jobs reset --yes                             # cancel every active job
     thub-admin jobs clean --yes --before "01/09/2026 00:00:00"
   p.small.
-    On #[a(href="/admin/users") Users] (admins), click a name to edit that user. The quick filter is
+    On #[a(href="/admin/users") Users], click a name to edit that user. The quick filter is
     #[strong All | Admin | Maintainer | User | Blocked]. The search box also matches usernames and emails.
+    Maintainers use Users too, for Agent-only users and their own account only. They can create, edit, block
+    and delete those users and issue or revoke their keys, but can't create or promote a maintainer or admin.
+    They don't see admins or other maintainers. They also manage #[a(href="/admin/agents") CI tokens].
   +note('warning').
     Forgot the admin password? Start the Coordinator once with #[code THUB_BOOTSTRAP_ADMIN_PASSWORD=…]
     (and optionally #[code THUB_BOOTSTRAP_ADMIN_USER], default #[code admin]). The password is reset on

package/views/help/_quick-start.pug

@@ -21,7 +21,7 @@
       | It shows up on #[a(href="/resources") Resources] by itself, usually within 10 s.
     li
       strong Create users and their access keys
-      |  on #[a(href="/admin/users") Users] (admins), or on the Coordinator host with
+      |  on #[a(href="/admin/users") Users] (admins and maintainers), or on the Coordinator host with
       |  #[code thub-admin user add <name> --email <email> --key]. The key is shown once.
     li
       strong Install and configure the Agent

package/views/layout.pug

@@ -53,7 +53,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
           //- Below lg the menu drops down over the page (thub.css .thub-nav,
           //- closed by public/js/actions.js): pages as a two-column grid with
           //- icons, then the tools in a row, then the account row.
-          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/resources', 'resources', 'Resources', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task']].concat(user.role === 'admin' ? [['/admin/users', 'users', 'Users', 'people'], ['/admin/agents', 'agents', 'CI tokens', 'key'], ['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
+          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/resources', 'resources', 'Resources', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task'], ['/admin/users', 'users', 'Users', 'people'], ['/admin/agents', 'agents', 'CI tokens', 'key']].concat(user.role === 'admin' ? [['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
           ul.navbar-nav.me-auto.thub-nav-pages
             each pg in pages
               li.nav-item