@andrian.yablonskyy/thub-coordinator 1.1.2 → 1.1.4

package/bin/thub-admin.js

@@ -37,8 +37,21 @@ const { loadConfig } = require('../src/config'),
   { roleLabel, normalizeRole } = require('../src/services/admin-users'),
   { PACKAGES, fetchLatestVersion, isNewer, isValidVersion, npmBin, formatDateTime, parseDateTime } = require('@andrian.yablonskyy/thub-common'),
   { spawnSync } = require('node:child_process'),
+  os = require('node:os'),
   { version: installedVersion } = require('../package.json');
 
+// Who the audit log names for a change made here: the OS user running it.
+function cliActor(){
+  let name = process.env.SUDO_USER || '';
+  try {
+    name ||= os.userInfo().username;
+  }
+  catch {
+    // no passwd entry (a container's random uid)
+  }
+  return name ? `thub-admin (${name})` : 'thub-admin';
+}
+
 function usage(){
   console.log(`Usage:
   thub-admin user add <username> --email <email> [--role user|maintainer|admin] [--password <p>] [--key]
@@ -174,7 +187,7 @@ function main(){
   if (cmd === 'user'){
     const { positional, flags } = parseFlags(rest),
       [username, arg] = positional,
-      by = 'thub-admin',
+      by = cliActor(),
       need = (u) => {
         const row = adminUsers.getByUsername(u || '');
         if (!row){
@@ -221,7 +234,7 @@ function main(){
         if (!arg){
           return usage(), process.exit(4);
         }
-        adminUsers.resetPassword({ username: target.username, password: arg });
+        adminUsers.resetPassword({ username: target.username, password: arg }, { by });
         console.log(`Password of "${target.username}" set`);
       }
       else if (sub === 'key'){
@@ -252,7 +265,7 @@ function main(){
     if (!username || !password){
       return usage(), process.exit(4);
     }
-    adminUsers.create({ username, password, role: flags.role || 'admin' });
+    adminUsers.create({ username, password, role: flags.role || 'admin' }, { by: cliActor() });
     console.log(`Created ${roleLabel(normalizeRole(flags.role || 'admin'))} user "${username}"`);
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-coordinator",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "TestHub Coordinator — job queue, resource registry, scheduler, heartbeat monitor, log/artifact store and web dashboard",
   "main": "src/server.js",
   "engines": {

package/src/auth.js

@@ -120,7 +120,9 @@ function requireAdminSession(req, res, next){
   next();
 }
 
-// The dashboard's security features (§10.3): Users, Settings, CI tokens…
+// The dashboard's security features (§10.3): Settings, restarting and
+// updating the Coordinator, rotating a Client's token. (Users and CI tokens
+// are maintainers' too, within web/routes.js managesUser.)
 function requireAdminRole(req, res, next){
   if (req.session?.user?.role !== 'admin'){
     const text = 'Only admins can open this — it\'s one of the Coordinator\'s security features.';

package/src/server.js

@@ -247,7 +247,7 @@ function ensureBootstrapAdmin(services){
     return;
   }
   const username = process.env.THUB_BOOTSTRAP_ADMIN_USER || 'admin';
-  services.adminUsers.resetPassword({ username, password });
+  services.adminUsers.resetPassword({ username, password }, { by: 'system (THUB_BOOTSTRAP_ADMIN_PASSWORD)' });
   console.log(`Reset password for admin user "${username}" from THUB_BOOTSTRAP_ADMIN_PASSWORD`);
 }
 

package/src/services/admin-users.js

@@ -123,7 +123,10 @@ function parseListPrefs(json){
 // access key for the Agent for anyone. `events` (the audit log) is optional
 // so the profile/password functions can be used on their own (tests).
 function createAdminUsersService(db, { events } = {}){
-  const audit = (id, type, data) => events?.record('user', id, type, data);
+  // Every user event names who did it (`by`): a username, `thub-admin
+  // (<os user>)`, or `system` for what no person did (the bootstrap reset,
+  // internal callers that pass none).
+  const audit = (id, type, data) => events?.record('user', id, type, { ...data, by: data.by || 'system' });
 
   function getByUsername(username){
     return db.prepare('SELECT * FROM users WHERE username = ?').get(username);
@@ -228,13 +231,14 @@ function createAdminUsersService(db, { events } = {}){
   // silently promote anyone to admin), or creates one as admin if the
   // named account doesn't exist yet — the original first-run bootstrap
   // case, now handled by the same path.
-  function resetPassword({ username, password, role = 'admin' }){
+  function resetPassword({ username, password, role = 'admin' }, { by } = {}){
     const existing = getByUsername(username);
     if (existing){
       db.prepare('UPDATE users SET password_hash = ?, must_change_password = 0 WHERE id = ?').run(hashPassword(password), existing.id);
+      audit(existing.id, 'user.password_set', { by });
       return { id: existing.id, username, role: existing.role };
     }
-    return create({ username, password, role });
+    return create({ username, password, role }, { by });
   }
 
   // Users page: a new temporary password for someone who lost theirs.
@@ -266,7 +270,7 @@ function createAdminUsersService(db, { events } = {}){
       throw bad('Choose a password different from the current one');
     }
     db.prepare('UPDATE users SET password_hash = ?, must_change_password = 0 WHERE id = ?').run(await hashPasswordAsync(newPassword), id);
-    audit(id, 'user.password_changed', {});
+    audit(id, 'user.password_changed', { by: row.username });
   }
 
   // Async (thread pool); the same work whether or not the user exists, or

package/src/web/routes.js

@@ -30,7 +30,7 @@ const fs = require('node:fs'),
   search = require('../services/search'),
   { createLoginGuard } = require('../login-guard'),
   { formatBytes } = require('../services/job-artifacts'),
-  { roleLabel } = require('../services/admin-users');
+  { roleLabel, normalizeRole } = require('../services/admin-users');
 
 // When this process started: the settings page tells a restart happened by it changing.
 const STARTED_AT = new Date().toISOString(),
@@ -858,13 +858,13 @@ function createWebRouter({ services, config }){
     return `Requested update to client v${version} — it starts on the Client's next heartbeat.`;
   }));
 
-  router.post('/admin/agents/update-all', requireAdminRole, updateAction(async () => {
+  router.post('/admin/agents/update-all', updateAction(async () => {
     const version = await services.updates.targetVersion('agent'),
       n = services.agents.requestUpdateAll(version);
     return `Requested update to agent v${version} for ${n} agent(s) — each updates on its next run.`;
   }));
 
-  router.post('/admin/agents/:id/update', requireAdminRole, updateAction(async (req) => {
+  router.post('/admin/agents/:id/update', updateAction(async (req) => {
     if (req.body.cancel === '1'){
       services.agents.setUpdateTo(req.params.id, null);
       return 'Update request canceled.';
@@ -1198,19 +1198,91 @@ function createWebRouter({ services, config }){
       role: (u) => ROLE_ORDER[u.role],
       status: (u) => (u.blocked ? 1 : 0),
       used: (u) => u.key?.lastUsedAt || null
-    };
+    },
+    // Who manages whom on Users (§10.3): an admin everyone; a maintainer
+    // Agent-only users and their own account. Admins and other maintainers
+    // aren't even listed for them, and only an admin gives anyone a
+    // dashboard role.
+    isAdmin = (actor) => actor.role === 'admin',
+    managesUser = (actor, u) => Boolean(u) && (isAdmin(actor) || u.role === 'user' || u.id === actor.id),
+    userFiltersFor = (actor) => (isAdmin(actor) ? USER_ROLE_FILTERS : ['user', 'blocked']),
+    // The audit log's Action column names changed fields like this.
+    FIELD_LABEL = { username: 'username', email: 'email', role: 'role', first_name: 'first name', last_name: 'last name' };
+
+  // The audit log's Action column: what was done, to whom. `nameOf` gives
+  // the account's current username (else the one its events recorded).
+  function describeUserEvent(e, nameOf){
+    const name = nameOf(e.entity_id),
+      whose = e.data.by === name ? 'their own' : `${name}'s`;
+    switch (e.type){
+      case 'user.created': return `Created ${name} (${roleLabel(e.data.role)})`;
+      case 'user.updated': {
+        const parts = [];
+        if (e.data.role?.from){
+          parts.push(`role ${roleLabel(e.data.role.from)} → ${roleLabel(e.data.role.to)}`);
+        }
+        const fields = (e.data.changed || []).filter((f) => f !== 'role').map((f) => FIELD_LABEL[f] || f);
+        if (fields.length){
+          parts.push(fields.join(', '));
+        }
+        return `Edited ${name}${parts.length ? `: ${parts.join('; ')}` : ''}`;
+      }
+      case 'user.blocked': return `Blocked ${name}`;
+      case 'user.unblocked': return `Unblocked ${name}`;
+      case 'user.deleted': return `Deleted ${name}`;
+      case 'user.password_reset': return `Issued a temporary password for ${name}`;
+      case 'user.password_set': return `Set ${whose} password`;
+      case 'user.password_changed': return `Changed ${whose} password`;
+      case 'user.key_created': return `Created ${whose} access key`;
+      case 'user.key_rotated': return `Replaced ${whose} access key`;
+      case 'user.key_revoked': return `Revoked ${whose} access key`;
+      default: return `${e.type.replace('user.', '').replace(/_/g, ' ')} ${name}`;
+    }
+  }
+
+  // Rows for the audit log: Timestamp, User (who did it — always shown;
+  // events from before it was recorded for everything say `system`, or the
+  // account itself for its own password change), Action.
+  function auditRows(events){
+    const names = new Map(services.adminUsers.list().map((u) => [u.id, u.username]));
+    for (const e of services.adminUsers.recentEvents(1000)){
+      if (!names.has(e.entity_id) && e.data.username){
+        names.set(e.entity_id, e.data.username);
+      }
+    }
+    const nameOf = (id) => names.get(id) || id;
+    return events.map((e) => ({
+      ts: e.ts,
+      by: e.data.by || (e.type === 'user.password_changed' ? nameOf(e.entity_id) : 'system'),
+      action: describeUserEvent(e, nameOf)
+    }));
+  }
+
+  // A maintainer's Recent activity: about the users they see, and deleted
+  // ones that were Agent-only users when created — nothing about admins or
+  // other maintainers.
+  function visibleEvents(me, visibleIds){
+    const events = services.adminUsers.recentEvents(500),
+      existing = new Set(services.adminUsers.list().map((u) => u.id)),
+      createdAsUser = new Set(events.filter((e) => e.type === 'user.created' && e.data.role === 'user').map((e) => e.entity_id));
+    return events.filter((e) => visibleIds.has(e.entity_id) || (!existing.has(e.entity_id) && createdAsUser.has(e.entity_id))).slice(0, 30);
+  }
 
   function renderUsers(req, res, extra = {}){
-    const q = search.normalizeQuery(req.query.q),
+    const me = req.session.user,
+      filters = userFiltersFor(me),
+      q = search.normalizeQuery(req.query.q),
       terms = search.parseTerms(q),
-      role = USER_ROLE_FILTERS.includes(req.query.role) ? req.query.role : undefined,
+      role = filters.includes(req.query.role) ? req.query.role : undefined,
       view = listView(req, res, 'users', { q, role }),
       { sort, dir, size } = view.prefs,
       value = USER_SORT_VALUE[sort],
-      searched = services.adminUsers.list()
+      visible = services.adminUsers.list().filter((u) => managesUser(me, u)),
+      visibleIds = new Set(visible.map((u) => u.id)),
+      searched = visible
         .filter((u) => search.matches([u.username, u.email, u.firstName, u.lastName, u.role, u.blocked ? 'blocked' : 'active'], terms)),
       // Counts for the filter buttons: within the search, before the role filter.
-      roleCounts = Object.fromEntries(USER_ROLE_FILTERS.map((r) => [r, searched.filter((u) => (r === 'blocked' ? u.blocked : u.role === r)).length])),
+      roleCounts = Object.fromEntries(filters.map((r) => [r, searched.filter((u) => (r === 'blocked' ? u.blocked : u.role === r)).length])),
       sorted = searched
         .filter((u) => !role || (role === 'blocked' ? u.blocked : u.role === role))
         .sort((a, b) => {
@@ -1231,46 +1303,64 @@ function createWebRouter({ services, config }){
       users: sorted.slice(pagination.offset, pagination.offset + pagination.limit),
       total: searched.length,
       roleFilter: role,
-      roleFilters: USER_ROLE_FILTERS,
+      roleFilters: filters,
       userDisplayName,
       roleCounts,
       list: { ...view, pagination, pageUrl, q },
       q,
-      me: req.session.user,
-      roles: services.adminUsers.ROLES,
+      me,
+      // The roles this admin or maintainer may give.
+      roles: isAdmin(me) ? services.adminUsers.ROLES : ['user'],
       roleHelp: {
         user: 'Agent only: submits jobs, reads their own results; no dashboard',
-        maintainer: 'Agent + the dashboard, without Users, Settings and CI tokens; sees and cancels every job',
+        maintainer: 'Agent + the dashboard without Settings; manages Agent-only users and CI tokens; sees and cancels every job',
         admin: 'Everything'
       },
       roleTone: { user: 'secondary', maintainer: 'info', admin: 'primary' },
-      events: services.adminUsers.recentEvents(30),
+      audit: auditRows(isAdmin(me) ? services.adminUsers.recentEvents(30) : visibleEvents(me, visibleIds)),
       ...extra
     });
   }
 
   const userAction = (fn) => (req, res) => {
-    const by = req.session.user.username,
-      actorId = req.session.user.id;
-    try {
-      const result = fn(req, { by, actorId });
-      if (result?.secret){
-        return renderUsers(req, res, { secret: result.secret });
+      const actor = req.session.user,
+        by = actor.username,
+        actorId = actor.id;
+      try {
+      // Someone this admin or maintainer may not manage answers like an
+      // unknown id.
+        if (req.params.id && !managesUser(actor, services.adminUsers.getById(req.params.id))){
+          throw Object.assign(new Error('Unknown user'), { status: 404 });
+        }
+        const result = fn(req, { by, actorId, actor });
+        if (result?.secret){
+          return renderUsers(req, res, { secret: result.secret });
+        }
+        if (result?.message){
+          flash(req, 'success', result.message);
+        }
       }
-      if (result?.message){
-        flash(req, 'success', result.message);
+      catch (err){
+        flash(req, 'danger', err.message);
       }
-    }
-    catch (err){
-      flash(req, 'danger', err.message);
-    }
-    res.redirect(returnTo(req, '/admin/users')); // the same filter, sort and page
-  };
+      res.redirect(returnTo(req, '/admin/users')); // the same filter, sort and page
+    },
+    notOwnAccount = (req, { actorId }, what) => {
+      if (req.params.id === actorId){
+        throw Object.assign(new Error(`You can't ${what} your own account.`), { status: 409 });
+      }
+    };
 
-  router.get('/admin/users', requireAdminRole, (req, res) => renderUsers(req, res));
+  // Users and CI tokens: admins and maintainers (everyone who has a
+  // dashboard session), each within managesUser.
+  router.get('/admin/users', (req, res) => renderUsers(req, res));
 
-  router.post('/admin/users', requireAdminRole, userAction((req, ctx) => {
-    const { username, email, role, firstName, lastName } = req.body,
+  router.post('/admin/users', userAction((req, ctx) => {
+    const { username, email, role, firstName, lastName } = req.body;
+    if (!isAdmin(ctx.actor) && normalizeRole(role) !== 'user'){
+      throw new Error('Only an admin can create a maintainer or an admin.');
+    }
+    const
       created = services.adminUsers.create({ username, email, role, firstName, lastName, requireEmail: true }, ctx),
       key = req.body.issueKey === '1' ? services.adminUsers.issueKey(created.id, ctx) : null;
     if (!key && !created.tempPassword){
@@ -1279,31 +1369,36 @@ function createWebRouter({ services, config }){
     return { secret: { title: `User ${created.username} created`, key, password: created.tempPassword, username: created.username } };
   }));
 
-  router.post('/admin/users/:id', requireAdminRole, userAction((req, ctx) => {
-    const { username, email, role, firstName, lastName } = req.body,
+  router.post('/admin/users/:id', userAction((req, ctx) => {
+    const { username, email, role, firstName, lastName } = req.body;
+    if (!isAdmin(ctx.actor) && role !== undefined && normalizeRole(role) !== services.adminUsers.getById(req.params.id).role){
+      throw new Error('Only an admin can change a role.');
+    }
+    const
       { user, tempPassword } = services.adminUsers.update(req.params.id, { username, email, role, firstName, lastName }, ctx);
     return tempPassword
       ? { secret: { title: `${user.username} can now use the dashboard`, password: tempPassword, username: user.username } }
       : { message: `Saved ${user.username}.` };
   }));
 
-  router.post('/admin/users/:id/block', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/block', userAction((req, ctx) => {
+    notOwnAccount(req, ctx, 'block');
     const u = services.adminUsers.setBlocked(req.params.id, true, ctx);
     return { message: `Blocked ${u.username}: no sign-in, and their access key stops working.` };
   }));
 
-  router.post('/admin/users/:id/unblock', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/unblock', userAction((req, ctx) => {
     const u = services.adminUsers.setBlocked(req.params.id, false, ctx);
     return { message: `Unblocked ${u.username}.` };
   }));
 
-  router.post('/admin/users/:id/reset-password', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/reset-password', userAction((req, ctx) => {
     const u = services.adminUsers.getById(req.params.id),
       password = services.adminUsers.adminResetPassword(req.params.id, ctx);
     return { secret: { title: `New temporary password for ${u.username}`, password, username: u.username } };
   }));
 
-  router.post('/admin/users/:id/key', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/key', userAction((req, ctx) => {
     const u = services.adminUsers.getById(req.params.id);
     if (!u){
       throw Object.assign(new Error('Unknown user'), { status: 404 });
@@ -1315,27 +1410,28 @@ function createWebRouter({ services, config }){
     return { secret: { title, key, username: u.username } };
   }));
 
-  router.post('/admin/users/:id/key/revoke', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/key/revoke', userAction((req, ctx) => {
     const u = services.adminUsers.getById(req.params.id);
     services.adminUsers.revokeKey(req.params.id, ctx);
     return { message: `Revoked the access key of ${u?.username}.` };
   }));
 
-  router.post('/admin/users/:id/delete', requireAdminRole, userAction((req, ctx) => {
+  router.post('/admin/users/:id/delete', userAction((req, ctx) => {
+    notOwnAccount(req, ctx, 'delete');
     const u = services.adminUsers.getById(req.params.id);
     services.adminUsers.remove(req.params.id, ctx);
     return { message: `Deleted ${u?.username}. Their jobs stay, listed under their name.` };
   }));
 
-  router.get('/admin/agents', requireAdminRole, (req, res) => renderAgents(req, res));
+  router.get('/admin/agents', (req, res) => renderAgents(req, res));
 
-  router.post('/admin/agents', requireAdminRole, (req, res) => {
+  router.post('/admin/agents', (req, res) => {
     // CI tokens only; people get their key from their user (§10.3).
     const { token } = services.agents.create({ name: req.body.name, kind: 'ci' });
     renderAgents(req, res, { newToken: token });
   });
 
-  router.post('/admin/agents/:id/rename', requireAdminRole, (req, res) => {
+  router.post('/admin/agents/:id/rename', (req, res) => {
     try {
       const before = services.agents.get(req.params.id)?.name,
         agent = services.agents.rename(req.params.id, req.body.name);
@@ -1349,7 +1445,7 @@ function createWebRouter({ services, config }){
     res.redirect(returnTo(req, '/admin/agents'));
   });
 
-  router.post('/admin/agents/:id/revoke', requireAdminRole, (req, res) => {
+  router.post('/admin/agents/:id/revoke', (req, res) => {
     services.agents.revoke(req.params.id);
     res.redirect(returnTo(req, '/admin/agents'));
   });

package/test/users.test.js

@@ -186,8 +186,9 @@ test('dashboard: only maintainers and admins sign in; security pages are admins\
 
   const mo = await signIn('mo', 'pw');
   assert.equal((await get(mo.cookie, '/resources')).status, 200);
-  for (const url of ['/admin/users', '/admin/settings', '/admin/agents']){
-    assert.equal((await get(mo.cookie, url)).status, 403, url);
+  assert.equal((await get(mo.cookie, '/admin/settings')).status, 403); // admins' only
+  for (const url of ['/admin/users', '/admin/agents']){
+    assert.equal((await get(mo.cookie, url)).status, 200, url); // within limits — see below
   }
   const root = await signIn('root', 'pw');
   assert.equal((await get(root.cookie, '/admin/users')).status, 200);
@@ -286,3 +287,154 @@ test('Users page: the User column shows first and last name, sorts by it, and op
   assert.equal(cells[2][1], zed.id);
   assert.match(html, new RegExp(`id="editUser-${zed.id}"`)); // the modal it opens
 });
+
+test('maintainers manage Agent-only users, their own account and CI tokens — never admins or other maintainers', async (t) => {
+  const { base, services } = await start(t),
+    u = services.adminUsers,
+    root = u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' }),
+    ops = u.create({ username: 'ops', email: 'o@example.com', role: 'maintainer', password: 'pw' }),
+    ops2 = u.create({ username: 'ops2', email: 'o2@example.com', role: 'maintainer', password: 'pw' }),
+    dev = u.create({ username: 'dev', email: 'd@example.com', role: 'user' }),
+    cookie = (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: 'ops', password: 'pw' }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    get = (p) => fetch(`${base}${p}`, { headers: { cookie } }).then((r) => r.text()),
+    post = (p, body = {}) => fetch(`${base}${p}`, { method: 'POST', headers: { cookie }, body: new URLSearchParams(body), redirect: 'manual' })
+      .then(async (r) => (r.status === 302 ? get(r.headers.get('location')) : r.text()));
+
+  // The list: Agent-only users and themselves; filters without Admin/Maintainer; only User to give.
+  let page = await get('/admin/users?size=all');
+  assert.match(page, /href="\/admin\/users"[^>]*>(<i [^>]*><\/i>)?Users</); // in the navbar
+  assert.match(page, /href="\/admin\/agents"[^>]*>(<i [^>]*><\/i>)?CI tokens</);
+  assert.doesNotMatch(page, /href="\/admin\/settings"/);
+  const ids = [...page.matchAll(/href="#editUser-([^"]+)"/g)].map((m) => m[1]).sort();
+  assert.deepEqual(ids, [ops.id, dev.id].sort());
+  const filterNav = page.slice(page.indexOf('aria-label="Filter by role"'), page.indexOf('</nav>', page.indexOf('aria-label="Filter by role"')));
+  assert.deepEqual([...filterNav.matchAll(/<a [^>]*>([^<]+)</g)].map((m) => m[1].trim()), ['All', 'User', 'Blocked']);
+  assert.doesNotMatch(page.slice(page.indexOf('id="addUserModal"')), /<option value="(maintainer|admin)"/);
+  assert.match(page, new RegExp(`id="u-${ops.id}-role" value="Maintainer" disabled`)); // their own role, no picker
+
+  // Users: create, edit, key, block, delete.
+  page = await post('/admin/users', { username: 'dev2', email: 'd2@example.com', role: 'user', issueKey: '1' });
+  assert.match(page, /User dev2 created/);
+  assert.match(page, /value="thk_/);
+  const dev2 = u.getByUsername('dev2');
+  assert.match(await post(`/admin/users/${dev2.id}`, { username: 'dev2', email: 'd2@example.com', role: 'user', firstName: 'Dee' }), /Saved dev2/);
+  assert.match(await post(`/admin/users/${dev.id}/key`), /Access key for dev/);
+  assert.match(await post(`/admin/users/${dev.id}/key/revoke`), /Revoked the access key of dev/);
+  assert.match(await post(`/admin/users/${dev.id}/block`), /Blocked dev/);
+  assert.match(await post(`/admin/users/${dev.id}/unblock`), /Unblocked dev/);
+  assert.match(await post(`/admin/users/${dev2.id}/delete`), /Deleted dev2/);
+
+  // …but never a dashboard role.
+  assert.match(await post('/admin/users', { username: 'boss', email: 'b@example.com', role: 'admin' }), /Only an admin can create a maintainer or an admin/);
+  assert.match(await post('/admin/users', { username: 'm2', email: 'm2@example.com', role: 'maintainer' }), /Only an admin can create/);
+  assert.equal(u.getByUsername('boss'), undefined);
+  assert.match(await post(`/admin/users/${dev.id}`, { username: 'dev', email: 'd@example.com', role: 'maintainer' }), /Only an admin can change a role/);
+  assert.equal(u.getById(dev.id).role, 'user');
+
+  // Admins and other maintainers: as if they didn't exist.
+  for (const other of [root, ops2]){
+    for (const action of ['', '/block', '/reset-password', '/key', '/key/revoke', '/delete']){
+      assert.match(await post(`/admin/users/${other.id}${action}`, { username: 'x', email: 'x@example.com' }), /Unknown user/, `${other.username}${action}`);
+    }
+  }
+  assert.equal(u.getById(root.id).blocked, false);
+  assert.equal(u.getById(ops2.id).username, 'ops2');
+
+  // Their own account: edit, key, new temporary password — not block or delete, not a new role.
+  assert.match(await post(`/admin/users/${ops.id}`, { username: 'ops', email: 'o@example.com', firstName: 'Olga' }), /Saved ops/);
+  assert.equal(u.getById(ops.id).role, 'maintainer');
+  assert.match(await post(`/admin/users/${ops.id}`, { username: 'ops', email: 'o@example.com', role: 'admin' }), /Only an admin can change a role/);
+  assert.match(await post(`/admin/users/${ops.id}/key`), /Access key for ops/);
+  assert.match(await post(`/admin/users/${ops.id}/block`), /can&#39;t block your own account|can't block your own account/);
+  assert.match(await post(`/admin/users/${ops.id}/delete`), /can&#39;t delete your own account|can't delete your own account/);
+
+  // Recent activity: nothing about admins or other maintainers.
+  page = await get('/admin/users');
+  const activity = page.slice(page.indexOf('Recent activity'), page.indexOf('id="addUserModal"'));
+  assert.doesNotMatch(activity, /\b(root|ops2)\b/);
+  assert.match(activity, /dev2/);
+
+  // CI tokens: issue, rename, revoke.
+  page = await post('/admin/agents', { name: 'ci-nightly' });
+  assert.match(page, /Token \(shown once\):[\s\S]*?<code>agt_/);
+  const ci = services.agents.list().find((a) => a.name === 'ci-nightly');
+  await post(`/admin/agents/${ci.id}/rename`, { name: 'ci-night' });
+  await post(`/admin/agents/${ci.id}/revoke`);
+  assert.equal(services.agents.get(ci.id).name, 'ci-night');
+  assert.ok(services.agents.get(ci.id).revoked_at);
+
+  // Still admin-only: Settings.
+  assert.equal((await fetch(`${base}/admin/settings`, { headers: { cookie } })).status, 403);
+
+  // Every job and its details, whoever submitted it.
+  services.registry.registerAuto({ clientId: 'c1', name: 'lab-sw-01', type: 'sw', labels: [] });
+  const ciAgent = services.agents.create({ name: 'ci-x', kind: 'ci' }).agent,
+    ciJob = services.jobs.create({ agentId: ciAgent.id, source: 'ci', spec: { target: { type: 'sw' }, command: './ci.sh' } }),
+    devKey = u.issueKey(dev.id, { by: 'root' }),
+    devAgent = services.agents.list().find((a) => a.user_id === dev.id),
+    devJob = services.jobs.create({ agentId: devAgent.id, source: 'cli', spec: { target: { type: 'sw' }, command: './dev.sh' } });
+  assert.ok(devKey);
+  const jobs = await get('/jobs?size=all');
+  assert.ok(jobs.includes(ciJob.id) && jobs.includes(devJob.id));
+  for (const job of [devJob, ciJob]){
+    const r = await fetch(`${base}/jobs/${job.id}`, { headers: { cookie } });
+    assert.equal(r.status, 200);
+    assert.match(await r.text(), new RegExp(`<title>${job.id} `));
+  }
+});
+
+test('audit log: Timestamp, User (who did it — always), Action — from the dashboard, the profile, the Agent and thub-admin', async (t) => {
+  const { base, services, file } = await start(t),
+    u = services.adminUsers;
+  u.create({ username: 'root', email: 'r@example.com', role: 'admin', password: 'pw' }, { by: 'root' });
+  const login = async (name, pw) => (await fetch(`${base}/login`, {
+      method: 'POST', body: new URLSearchParams({ username: name, password: pw }), redirect: 'manual'
+    })).headers.get('set-cookie').split(';')[0],
+    root = await login('root', 'pw'),
+    post = (cookie, p, body = {}) => fetch(`${base}${p}`, { method: 'POST', headers: { cookie }, body: new URLSearchParams(body), redirect: 'manual' });
+
+  // Dashboard (an admin), then the profile (the user themselves).
+  await post(root, '/admin/users', { username: 'dev', email: 'd@example.com', role: 'user', issueKey: '1' });
+  const dev = u.getByUsername('dev');
+  await post(root, '/admin/users', { username: 'ops', email: 'o@example.com', role: 'maintainer' });
+  const ops = u.getByUsername('ops');
+  await post(root, `/admin/users/${ops.id}`, { username: 'ops', email: 'ops@example.com', role: 'admin', firstName: 'Olga' });
+  const temp = u.adminResetPassword(ops.id, { by: 'root' }),
+    opsCookie = await login('ops', temp);
+  await post(opsCookie, '/profile/password', { currentPassword: temp, newPassword: 'Ops-own-1', confirmPassword: 'Ops-own-1' });
+
+  // The Agent rotating its own key.
+  const devKey = u.issueKey(dev.id, { by: 'root' });
+  assert.equal((await fetch(`${base}/api/v1/me/key/rotate`, { method: 'POST', headers: { authorization: `Bearer ${devKey}` } })).status, 200);
+
+  // thub-admin on the Coordinator host, and an internal call naming no one.
+  const cli = spawnSync(process.execPath, [path.join(__dirname, '..', 'bin', 'thub-admin.js'), 'user', 'block', 'dev'], {
+    env: { ...process.env, THUB_COORDINATOR_CONFIG: file, SUDO_USER: 'alice' }, encoding: 'utf8'
+  });
+  assert.match(cli.stdout, /Blocked "dev"/);
+  u.setBlocked(dev.id, false);
+
+  // Every recorded event names who did it.
+  assert.ok(u.recentEvents(100).every((e) => e.data.by), 'every user event has `by`');
+
+  const html = await (await fetch(`${base}/admin/users`, { headers: { cookie: root } })).text(),
+    log = html.slice(html.indexOf('Recent activity'), html.indexOf('id="addUserModal"')),
+    rows = [...log.matchAll(/<tr><td[^>]*>[^<]*<\/td><td[^>]*>([^<]*)<\/td><td>([^<]*)<\/td><\/tr>/g)]
+      .map((m) => [m[1], m[2].replace(/&#39;/g, '\'').replace(/&gt;/g, '>')]).reverse(); // oldest first
+  assert.match(log, /<th class="text-nowrap">Timestamp<\/th><th>User<\/th><th>Action<\/th>/);
+  assert.deepEqual(rows, [
+    ['root', 'Created root (Admin)'],
+    ['root', 'Created dev (User)'],
+    ['root', 'Created dev\'s access key'],
+    ['root', 'Created ops (Maintainer)'],
+    ['root', 'Edited ops: role Maintainer → Admin; email, first name'],
+    ['root', 'Issued a temporary password for ops'],
+    ['ops', 'Changed their own password'],
+    ['root', 'Replaced dev\'s access key'],
+    ['dev', 'Replaced their own access key'],
+    ['thub-admin (alice)', 'Blocked dev'],
+    ['system', 'Unblocked dev']
+  ]);
+});

package/views/admin/users.pug

@@ -1,8 +1,9 @@
 extends ../layout
 include ../mixins/list-controls
 
-//- Users (§10.3, admins). Roles: user — the Agent only; maintainer — the
-//- dashboard without its security features; admin — everything.
+//- Users (§10.3). Roles: user — the Agent only; maintainer — the dashboard
+//- without its security features; admin — everything. A maintainer sees and
+//- manages Agent-only users and their own account (web/routes.js managesUser).
 //- Role picker: names in the list, the chosen role's description below it
 //- (kept in step by public/js/actions.js, select[data-describe]).
 mixin roleSelect(id, selected)
@@ -153,7 +154,8 @@ block content
                 button.btn.btn-sm.btn-outline-danger(type="submit" aria-label="Delete" data-bs-toggle="tooltip" data-bs-title="Delete the user")
                   i.bi.bi-trash
 
-            .modal.text-start(tabindex="-1" id=`editUser-${u.id}` aria-labelledby=`editUserTitle-${u.id}`)
+            //- Inside the actions cell (text-nowrap): wrap again in here.
+            .modal.text-start.text-wrap(tabindex="-1" id=`editUser-${u.id}` aria-labelledby=`editUserTitle-${u.id}`)
               .modal-dialog
                 .modal-content
                   form(method="post" action=`/admin/users/${u.id}`)
@@ -177,8 +179,14 @@ block content
                           input.form-control(id=`u-${u.id}-last` name="lastName" value=u.lastName || '')
                         .col-12
                           label.form-label(for=`u-${u.id}-role`) Role
-                          +roleSelect(`u-${u.id}-role`, u.role)
-                          if !u.canUseDashboard
+                          //- A maintainer gives no roles but User; their own
+                          //- row shows theirs without a picker (and posts none).
+                          if roles.includes(u.role)
+                            +roleSelect(`u-${u.id}-role`, u.role)
+                          else
+                            input.form-control(id=`u-${u.id}-role` value=roleLabel(u.role) disabled)
+                            .form-text Only an admin can change a role.
+                          if !u.canUseDashboard && roles.length > 1
                             .form-text Making them a maintainer or admin gives them a temporary password for the dashboard.
                     .modal-footer
                       button.btn.btn-secondary(type="button" data-bs-dismiss="modal") Cancel
@@ -187,21 +195,22 @@ block content
         tr
           td.text-body-secondary(colspan="5")= q || roleFilter ? 'No user matches.' : 'No users yet.'
 
+  //- The audit log: who did what to which account (web/routes.js auditRows).
   h2.h6.mt-4 Recent activity
-  if events.length
-    ul.list-group.list-group-flush.small.mb-4
-      each e in events
-        li.list-group-item.px-0
-          span.text-body-secondary.me-2= fmtDate(e.ts)
-          strong= e.type.replace('user.', '').replace(/_/g, ' ')
-          if e.data.username
-            = ` ${e.data.username}`
-          if e.data.role && e.data.role.from
-            = ` — ${roleLabel(e.data.role.from)} → ${roleLabel(e.data.role.to)}`
-          else if e.data.role
-            = ` (${roleLabel(e.data.role)})`
-          if e.data.by
-            span.text-body-secondary= ` by ${e.data.by}`
+  if audit.length
+    .table-responsive.mb-4
+      table.table.table-sm.small.align-middle
+        thead
+          tr
+            th.text-nowrap Timestamp
+            th User
+            th Action
+        tbody
+          each e in audit
+            tr
+              td.text-nowrap.text-body-secondary= fmtDate(e.ts)
+              td.text-nowrap= e.by
+              td= e.action
   else
     p.small.text-body-secondary Nothing yet.
 

package/views/help/_ci.pug

@@ -1,7 +1,7 @@
 +section('ci', 'CI/CD integration (GitHub Actions)', 'github')
   p.
     The test job only needs the Agent and HTTPS access to the Coordinator, so it runs on an ordinary hosted runner.
-    Create a #[strong CI token] on #[a(href="/admin/agents") CI tokens] (admins) and store it as the repository secret
+    Create a #[strong CI token] on #[a(href="/admin/agents") CI tokens] (admins and maintainers) and store it as the repository secret
     #[code THUB_CI_TOKEN].
   +code('.github/workflows/firmware.yml').
     name: firmware

package/views/help/_coordinator.pug

@@ -126,8 +126,13 @@
     thub-admin jobs reset --yes                             # cancel every active job
     thub-admin jobs clean --yes --before "01/09/2026 00:00:00"
   p.small.
-    On #[a(href="/admin/users") Users] (admins), click a name to edit that user. The quick filter is
+    On #[a(href="/admin/users") Users], click a name to edit that user. The quick filter is
     #[strong All | Admin | Maintainer | User | Blocked]. The search box also matches usernames and emails.
+    Maintainers use Users too, for Agent-only users and their own account only. They can create, edit, block
+    and delete those users and issue or revoke their keys, but can't create or promote a maintainer or admin.
+    They don't see admins or other maintainers. They also manage #[a(href="/admin/agents") CI tokens].
+    #[strong Recent activity] at the bottom of Users is the audit log: #[strong Timestamp | User | Action], where
+    User is who made the change (a username, #[code thub-admin (<OS user>)], or #[code system]).
   +note('warning').
     Forgot the admin password? Start the Coordinator once with #[code THUB_BOOTSTRAP_ADMIN_PASSWORD=…]
     (and optionally #[code THUB_BOOTSTRAP_ADMIN_USER], default #[code admin]). The password is reset on

package/views/help/_quick-start.pug

@@ -21,7 +21,7 @@
       | It shows up on #[a(href="/resources") Resources] by itself, usually within 10 s.
     li
       strong Create users and their access keys
-      |  on #[a(href="/admin/users") Users] (admins), or on the Coordinator host with
+      |  on #[a(href="/admin/users") Users] (admins and maintainers), or on the Coordinator host with
       |  #[code thub-admin user add <name> --email <email> --key]. The key is shown once.
     li
       strong Install and configure the Agent

package/views/layout.pug

@@ -53,7 +53,7 @@ html(lang="en" data-bs-theme=(user && user.theme) || "auto")
           //- Below lg the menu drops down over the page (thub.css .thub-nav,
           //- closed by public/js/actions.js): pages as a two-column grid with
           //- icons, then the tools in a row, then the account row.
-          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/resources', 'resources', 'Resources', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task']].concat(user.role === 'admin' ? [['/admin/users', 'users', 'Users', 'people'], ['/admin/agents', 'agents', 'CI tokens', 'key'], ['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
+          - const pages = user ? [['/', 'overview', 'Overview', 'speedometer2'], ['/resources', 'resources', 'Resources', 'hdd-rack'], ['/groups', 'groups', 'Groups', 'collection'], ['/jobs', 'jobs', 'Jobs', 'list-task'], ['/admin/users', 'users', 'Users', 'people'], ['/admin/agents', 'agents', 'CI tokens', 'key']].concat(user.role === 'admin' ? [['/admin/settings', 'settings', 'Settings', 'gear']] : []) : []
           ul.navbar-nav.me-auto.thub-nav-pages
             each pg in pages
               li.nav-item