@flowdular/sdk 0.3.0 → 0.3.2

package/modules/system/src/services/module-activation-service.ts

@@ -0,0 +1,245 @@
+import type { AuthActor } from '@flowdular/sdk/modules/auth';
+import {
+	activeModuleIds,
+	dependentsOf,
+	isRequiredModule,
+	type ComposedModule,
+	type ModuleActivationChange,
+	type ModuleActivationEntry,
+} from '../domain/modules.ts';
+import type { ModuleActivationRepository } from './repository.ts';
+
+export type ModuleActivationErrorCode =
+	| 'MODULE_UNKNOWN'
+	| 'MODULE_REQUIRED'
+	| 'MODULE_HAS_ACTIVE_DEPENDENTS'
+	| 'MODULE_DEPENDENCY_INACTIVE';
+
+export class ModuleActivationError extends Error {
+	readonly code: ModuleActivationErrorCode;
+	readonly status: number;
+	/** The modules a refusal names: active dependents or inactive dependencies. */
+	readonly modules: readonly string[];
+
+	constructor(
+		code: ModuleActivationErrorCode,
+		message: string,
+		status: number,
+		modules: readonly string[] = [],
+	) {
+		super(message);
+		this.name = 'ModuleActivationError';
+		this.code = code;
+		this.status = status;
+		this.modules = modules;
+	}
+}
+
+export interface ModuleActivationServiceOptions {
+	readonly repository: ModuleActivationRepository;
+	/** The modules the application composes; read once per call, never cached here. */
+	readonly modules: () => readonly ComposedModule[];
+	readonly audit?: (
+		actor: AuthActor,
+		change: ModuleActivationChange,
+	) => Promise<void>;
+	readonly now?: () => number;
+	/** How long a workspace snapshot answers before it is read again. */
+	readonly snapshotTtlMs?: number;
+	readonly maxTenants?: number;
+}
+
+interface Snapshot {
+	readonly inactive: ReadonlySet<string>;
+	readonly expiresAt: number;
+}
+
+export const DEFAULT_SNAPSHOT_TTL_MS = 30_000;
+export const DEFAULT_SNAPSHOT_TENANTS = 1024;
+
+/**
+ * Per-workspace activation of the modules the application composes. Every
+ * composed module is active until an owner deactivates it; a required module
+ * and a module another active module depends on stay active. Reads come from
+ * a memoised per-tenant snapshot so a request costs no query of its own.
+ */
+export class ModuleActivationService {
+	readonly #repository: ModuleActivationRepository;
+	readonly #modules: () => readonly ComposedModule[];
+	readonly #audit: ModuleActivationServiceOptions['audit'];
+	readonly #now: () => number;
+	readonly #ttlMs: number;
+	readonly #maxTenants: number;
+	readonly #snapshots = new Map<string, Promise<Snapshot>>();
+
+	constructor(options: ModuleActivationServiceOptions) {
+		this.#repository = options.repository;
+		this.#modules = options.modules;
+		this.#audit = options.audit;
+		this.#now = options.now ?? Date.now;
+		this.#ttlMs = options.snapshotTtlMs ?? DEFAULT_SNAPSHOT_TTL_MS;
+		this.#maxTenants = options.maxTenants ?? DEFAULT_SNAPSHOT_TENANTS;
+	}
+
+	/** Composed optional module ids an owner deactivated for the workspace. */
+	async inactive(tenantId: string): Promise<ReadonlySet<string>> {
+		const cached = this.#snapshots.get(tenantId);
+		if (cached) {
+			const snapshot = await cached;
+			if (snapshot.expiresAt > this.#now()) return snapshot.inactive;
+		}
+		const loading = this.#load(tenantId);
+		this.#snapshots.delete(tenantId);
+		this.#snapshots.set(tenantId, loading);
+		while (this.#snapshots.size > this.#maxTenants) {
+			const oldest = this.#snapshots.keys().next().value;
+			if (oldest === undefined) break;
+			this.#snapshots.delete(oldest);
+		}
+		try {
+			return (await loading).inactive;
+		} catch (error) {
+			if (this.#snapshots.get(tenantId) === loading) {
+				this.#snapshots.delete(tenantId);
+			}
+			throw error;
+		}
+	}
+
+	invalidate(tenantId: string): void {
+		this.#snapshots.delete(tenantId);
+	}
+
+	async isActive(tenantId: string, moduleId: string): Promise<boolean> {
+		if (isRequiredModule(moduleId)) return true;
+		return !(await this.inactive(tenantId)).has(moduleId);
+	}
+
+	async activeIds(tenantId: string): Promise<readonly string[]> {
+		return activeModuleIds(this.#modules(), await this.inactive(tenantId));
+	}
+
+	async list(tenantId: string): Promise<readonly ModuleActivationEntry[]> {
+		const modules = this.#modules();
+		const inactive = await this.inactive(tenantId);
+		return modules.map((module) => this.#entry(modules, module, inactive));
+	}
+
+	async activate(
+		actor: AuthActor,
+		moduleId: string,
+	): Promise<ModuleActivationEntry> {
+		const modules = this.#modules();
+		const module = this.#composed(modules, moduleId);
+		const inactive = await this.inactive(actor.tenantId);
+		if (!inactive.has(moduleId)) {
+			return this.#entry(modules, module, inactive);
+		}
+		const missing = module.dependencies.filter(
+			(dependency) => !isRequiredModule(dependency) && inactive.has(dependency),
+		);
+		if (missing.length > 0) {
+			throw new ModuleActivationError(
+				'MODULE_DEPENDENCY_INACTIVE',
+				`${moduleId} needs ${missing.join(', ')} active first.`,
+				409,
+				missing,
+			);
+		}
+		return this.#write(actor, modules, module, true);
+	}
+
+	async deactivate(
+		actor: AuthActor,
+		moduleId: string,
+	): Promise<ModuleActivationEntry> {
+		const modules = this.#modules();
+		const module = this.#composed(modules, moduleId);
+		if (isRequiredModule(moduleId)) {
+			throw new ModuleActivationError(
+				'MODULE_REQUIRED',
+				`${moduleId} is required by every workspace and cannot be deactivated.`,
+				409,
+			);
+		}
+		const inactive = await this.inactive(actor.tenantId);
+		if (inactive.has(moduleId)) {
+			return this.#entry(modules, module, inactive);
+		}
+		const dependents = dependentsOf(modules, moduleId).filter(
+			(dependent) => isRequiredModule(dependent) || !inactive.has(dependent),
+		);
+		if (dependents.length > 0) {
+			throw new ModuleActivationError(
+				'MODULE_HAS_ACTIVE_DEPENDENTS',
+				`${moduleId} is a dependency of ${dependents.join(', ')}; deactivate those first.`,
+				409,
+				dependents,
+			);
+		}
+		return this.#write(actor, modules, module, false);
+	}
+
+	#composed(
+		modules: readonly ComposedModule[],
+		moduleId: string,
+	): ComposedModule {
+		const module = modules.find((candidate) => candidate.id === moduleId);
+		if (!module) {
+			throw new ModuleActivationError(
+				'MODULE_UNKNOWN',
+				`${moduleId} is not composed in this application.`,
+				404,
+			);
+		}
+		return module;
+	}
+
+	#entry(
+		modules: readonly ComposedModule[],
+		module: ComposedModule,
+		inactive: ReadonlySet<string>,
+	): ModuleActivationEntry {
+		const optional = !isRequiredModule(module.id);
+		return {
+			id: module.id,
+			version: module.version,
+			active: !optional || !inactive.has(module.id),
+			optional,
+			dependents: dependentsOf(modules, module.id),
+		};
+	}
+
+	async #write(
+		actor: AuthActor,
+		modules: readonly ComposedModule[],
+		module: ComposedModule,
+		active: boolean,
+	): Promise<ModuleActivationEntry> {
+		await this.#repository.set({
+			tenantId: actor.tenantId,
+			moduleId: module.id,
+			active,
+			changedBy: actor.accountId,
+			changedAt: this.#now(),
+		});
+		this.invalidate(actor.tenantId);
+		await this.#audit?.(actor, { moduleId: module.id, active });
+		return this.#entry(modules, module, await this.inactive(actor.tenantId));
+	}
+
+	async #load(tenantId: string): Promise<Snapshot> {
+		const composed = new Set(this.#modules().map((module) => module.id));
+		const inactive = new Set<string>();
+		for (const record of await this.#repository.list(tenantId)) {
+			if (
+				!record.active &&
+				composed.has(record.moduleId) &&
+				!isRequiredModule(record.moduleId)
+			) {
+				inactive.add(record.moduleId);
+			}
+		}
+		return { inactive, expiresAt: this.#now() + this.#ttlMs };
+	}
+}

package/modules/system/src/services/repository.ts

@@ -0,0 +1,17 @@
+export interface ModuleActivationRecord {
+	readonly tenantId: string;
+	readonly moduleId: string;
+	readonly active: boolean;
+	readonly changedBy: string;
+	readonly changedAt: number;
+}
+
+/**
+ * The per-workspace activation overrides, and nothing else: which modules are
+ * composed comes from the workspace manifests, and a module without a row is
+ * active.
+ */
+export interface ModuleActivationRepository {
+	list(tenantId: string): Promise<readonly ModuleActivationRecord[]>;
+	set(record: ModuleActivationRecord): Promise<void>;
+}

package/modules/system/translations/en.json

@@ -12,6 +12,9 @@
 	"action.clear": "Clear",
 	"action.save": "Save",
 	"action.reset": "Reset",
+	"action.activate": "Activate",
+	"action.deactivate": "Deactivate",
+	"action.cancel": "Cancel",
 	"denied.title": "Access denied",
 	"denied.hint": "Reading the module catalog needs the system.modules.read scope.",
 	"tab.label": "Administration views",
@@ -33,12 +36,13 @@
 	"table.title": "Module catalog",
 	"table.caption": "Modules",
 	"table.actions": "Module actions",
-	"table.count": "{enabled} enabled · {total} in workspace",
+	"table.count": "{active} active · {enabled} enabled · {total} in workspace",
 	"table.module": "Module",
 	"table.version": "Version",
 	"table.specVersion": "spec {version}",
 	"table.platform": "Platform",
 	"table.permissions": "Permissions",
+	"table.dependents": "Dependents",
 	"table.status": "Status",
 	"table.loading": "Loading modules…",
 	"table.emptyTitle": "No modules found",
@@ -48,6 +52,9 @@
 	"table.cliNote": "Change the enabled set with the CLI:",
 	"status.enabled": "Enabled",
 	"status.available": "Available",
+	"status.active": "Active",
+	"status.inactive": "Inactive",
+	"status.required": "Required",
 	"drawer.module": "Module",
 	"detail.overview": "Overview",
 	"detail.specVersion": "Spec version",
@@ -77,5 +84,14 @@
 	"settings.mfaKeyRequired": "Required multi-factor authentication needs a deployment MFA encryption key.",
 	"settings.timeZone.label": "Workspace time zone",
 	"settings.timeZone.description": "IANA zone name such as Europe/Warsaw. Modules that show or schedule local times read it; the default is UTC.",
+	"activation.notComposed": "This module is not enabled in the application; enable it with the CLI first.",
+	"activation.deniedManage": "Changing module activation needs the system.settings.manage scope.",
+	"activation.required": "A required module is active in every workspace.",
+	"activation.dependents": "Active modules depend on it: {modules}.",
+	"activation.confirmActivateTitle": "Activate {module}?",
+	"activation.confirmActivate": "Its screens, API and agent tools become available to this workspace again.",
+	"activation.confirmDeactivateTitle": "Deactivate {module}?",
+	"activation.confirmDeactivate": "Its screens disappear from this workspace and its API answers 403 MODULE_INACTIVE until it is activated again. Stored data is kept.",
+	"error.activation": "Could not change the module activation.",
 	"error.catalog": "Could not load the module catalog."
 }

package/modules/system/translations/pl.json

@@ -12,6 +12,9 @@
 	"action.clear": "Wyczyść",
 	"action.save": "Zapisz",
 	"action.reset": "Przywróć domyślne",
+	"action.activate": "Aktywuj",
+	"action.deactivate": "Dezaktywuj",
+	"action.cancel": "Anuluj",
 	"denied.title": "Brak dostępu",
 	"denied.hint": "Odczyt katalogu modułów wymaga uprawnienia system.modules.read.",
 	"tab.label": "Widoki administracyjne",
@@ -33,12 +36,13 @@
 	"table.title": "Katalog modułów",
 	"table.caption": "Moduły",
 	"table.actions": "Akcje modułu",
-	"table.count": "Włączone: {enabled} · wszystkie: {total}",
+	"table.count": "{active} aktywnych · {enabled} włączonych · {total} w przestrzeni",
 	"table.module": "Moduł",
 	"table.version": "Wersja",
 	"table.specVersion": "spec {version}",
 	"table.platform": "Platforma",
 	"table.permissions": "Uprawnienia",
+	"table.dependents": "Zależne",
 	"table.status": "Status",
 	"table.loading": "Wczytywanie modułów…",
 	"table.emptyTitle": "Nie znaleziono modułów",
@@ -48,6 +52,9 @@
 	"table.cliNote": "Zmieniaj zestaw włączonych modułów przez CLI:",
 	"status.enabled": "Włączony",
 	"status.available": "Dostępny",
+	"status.active": "Aktywny",
+	"status.inactive": "Nieaktywny",
+	"status.required": "Wymagany",
 	"drawer.module": "Moduł",
 	"detail.overview": "Przegląd",
 	"detail.specVersion": "Wersja specyfikacji",
@@ -77,5 +84,14 @@
 	"settings.mfaKeyRequired": "Wymagane uwierzytelnianie dwuskładnikowe potrzebuje klucza szyfrującego MFA skonfigurowanego we wdrożeniu.",
 	"settings.timeZone.label": "Strefa czasowa obszaru roboczego",
 	"settings.timeZone.description": "Nazwa strefy IANA, na przykład Europe/Warsaw. Moduły, które pokazują lub planują czas lokalny, odczytują tę wartość; domyślnie UTC.",
+	"activation.notComposed": "Ten moduł nie jest włączony w aplikacji; najpierw włącz go przez CLI.",
+	"activation.deniedManage": "Zmiana aktywacji modułu wymaga zakresu system.settings.manage.",
+	"activation.required": "Moduł wymagany jest aktywny w każdej przestrzeni.",
+	"activation.dependents": "Zależą od niego aktywne moduły: {modules}.",
+	"activation.confirmActivateTitle": "Aktywować {module}?",
+	"activation.confirmActivate": "Jego ekrany, API i narzędzia agentów znów będą dostępne w tej przestrzeni.",
+	"activation.confirmDeactivateTitle": "Dezaktywować {module}?",
+	"activation.confirmDeactivate": "Jego ekrany znikną z tej przestrzeni, a API będzie odpowiadać 403 MODULE_INACTIVE do ponownej aktywacji. Zapisane dane zostają.",
+	"error.activation": "Nie udało się zmienić aktywacji modułu.",
 	"error.catalog": "Nie udało się wczytać katalogu modułów."
 }

package/modules/users/module.json

@@ -3,7 +3,7 @@
 	"schemaVersion": 1,
 	"id": "users.core",
 	"package": "@flowdular/module-users",
-	"version": "0.9.8",
+	"version": "0.11.0",
 	"profile": "full",
 	"capabilities": ["api", "client", "translations"],
 	"platform": {
@@ -13,7 +13,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/users/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-users",
-	"version": "0.9.8",
+	"version": "0.11.0",
 	"type": "module",
 	"exports": {
 		".": "./src/index.ts",

package/modules/users/spec/module.yaml

@@ -1,6 +1,6 @@
 schemaVersion: 2
 id: users.core
-specVersion: 0.9.8
+specVersion: 0.11.0
 status: approved
 name: User Management Core
 description: Provides the tenant-scoped user directory and member administration (creation, display name, role assignment, per-member scopes, account status, password reset, session revocation, removal) through the public auth administration port.
@@ -11,7 +11,7 @@ capabilities:
   - translations
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
   - id: search.core
@@ -56,7 +56,7 @@ dataOwnership:
 entities:
   - id: member
     name: Workspace member
-    description: One membership of the active workspace as the auth administration port answers it; auth.core owns the row and users.core reads and writes it only through the port, never through a table of its own.
+    description: One membership of the active workspace as the auth administration port answers it; auth.core owns the row and users.core reads and writes it only through the port, never through a table of its own. The joined-at instant the Members screen and the export show is the createdAt of the membership row, which auth.core owns and answers with every member.
     fields:
       - id: accountId
         type: string
@@ -146,6 +146,7 @@ screens:
       - status
       - passwordChangeRequired
       - scopes
+      - createdAt
     filters:
       - displayName
       - email
@@ -200,7 +201,7 @@ actions:
     kind: custom
     risk: read
     idempotent: true
-    description: Answer what the Members screen needs beside the page, namely the workspace roles, the grantable scopes, the acting principal's account id and role, the shared password minimum length and the member count.
+    description: Answer what the Members screen needs beside the page, namely the workspace roles, the grantable scopes, the acting principal's account id and role, the shared password minimum length, the member count and the owner count, both counted in the database.
   - id: create-member
     entity: member
     permission: users.members.manage
@@ -287,15 +288,11 @@ decisions:
     question: How are the two bulk actions of the Members screen declared?
     answer: As the actions set-status-many and assign-role-many, each behind users.members.manage and each applied one id at a time through the single-row path, with the USERS-STATUS-MANY and USERS-ROLE-MANY scenarios as their evidence.
     decidedBy: default
-  - id: D-USERS-JOINED-AT
-    question: Why does the member entity not declare the joined-at instant the export carries?
-    answer: The instant is auth.core's createdAt column, and createdAt is a field id every tenant table owns, so the specification cannot declare it; the export list still carries it as documented in the invariants.
-    decidedBy: default
 acceptanceScenarios:
   - id: USERS-LIST
     given: An authenticated principal has users.members.read in an active tenant.
     when: The principal requests the user directory.
-    then: Only memberships from the active tenant are returned without credential or session material, one page at a time, and the roles, grantable scopes, acting principal and member count the screen needs come from the separate context read.
+    then: Only memberships from the active tenant are returned without credential or session material, one page at a time, and the roles, grantable scopes, acting principal, member count and owner count the screen needs come from the separate context read.
   - id: USERS-PAGE
     given: A workspace holding more members than one page carries, and another workspace with members of its own.
     when: A screen lists the members with a page limit of at most 200, follows the cursor it receives to the end sorted by display name or by e-mail in either direction, narrows by a name or address prefix and by membership status, and presents a cursor this server did not sign, one of the other workspace, or one issued for another sort or filter.

package/modules/users/src/client/UsersView.tsrx

@@ -49,6 +49,7 @@ import {
 	loadedListing,
 	memberSort,
 	membershipStatusMessage,
+	ownerCountAfter,
 	pageCursor,
 	replaceMember,
 	resetPageCursors,
@@ -88,6 +89,7 @@ export function UsersView(props: UsersViewProps) @{
 	const [actor] = useValue(usersState.state.actor);
 	const [passwordMinLength] = useValue(usersState.state.passwordMinLength);
 	const [memberCount, setMemberCount] = useValue(usersState.state.memberCount);
+	const [ownerCount, setOwnerCount] = useValue(usersState.state.ownerCount);
 	const actorIsOwner = actor?.role === 'owner';
 	const [status, setStatus] = useValue(usersState.state.status);
 	const [error, setError] = useValue(usersState.state.error);
@@ -217,6 +219,7 @@ export function UsersView(props: UsersViewProps) @{
 					context.passwordMinLength,
 				);
 				transaction.set(usersState.state.memberCount, context.memberCount);
+				transaction.set(usersState.state.ownerCount, context.ownerCount);
 				transaction.set(usersState.state.exportStarted, false);
 			}, 'users/context-loaded');
 			return true;
@@ -290,13 +293,17 @@ export function UsersView(props: UsersViewProps) @{
 		try {
 			const member = await run();
 			if (member) {
-				usersState.store.act(
-					(transaction) => transaction.set(
-						usersState.state.users,
-						replaceMember(users, member),
-					),
-					'users/member-updated',
-				);
+				usersState.store.act((transaction) => {
+					transaction.set(usersState.state.users, replaceMember(users, member));
+					transaction.set(
+						usersState.state.ownerCount,
+						ownerCountAfter(
+							ownerCount,
+							users.find((user) => user.accountId === member.accountId),
+							member,
+						),
+					);
+				}, 'users/member-updated');
 			}
 			setNotice(done);
 			setStatus('idle');
@@ -350,6 +357,7 @@ export function UsersView(props: UsersViewProps) @{
 			setFormSession((current) => current + 1);
 			setFormOpen(false);
 			setMemberCount(memberCount + 1);
+			if (user.role === 'owner') setOwnerCount(ownerCount + 1);
 			/* The new row belongs wherever the order puts it; the first page of
    the listing shows it or the page it is on does. */
 			await load(firstPage({}));
@@ -436,11 +444,13 @@ export function UsersView(props: UsersViewProps) @{
 		const role = bulkRole || (assignableRoles[0]?.key ?? '');
 		setRoleDialogOpen(false);
 		if (role === '') return;
-		void applyMany(
-			(ids) => assignRoleMany(ids, role, props.csrfToken),
-			'users.notice.roleAssignedMany',
-			'users.error.roleMany',
-		);
+		/* A role handed to several rows moves the owner count by an amount only
+   the server knows, so the context is read again with the page. */
+		void applyMany(async (ids) => {
+			const outcomes = await assignRoleMany(ids, role, props.csrfToken);
+			await loadContext();
+			return outcomes;
+		}, 'users.notice.roleAssignedMany', 'users.error.roleMany');
 	};
 
 	const openMember = (accountId: string) => {
@@ -466,6 +476,7 @@ export function UsersView(props: UsersViewProps) @{
 			await removeMember(accountId, props.csrfToken);
 			setSelectedAccountId(null);
 			setMemberCount(memberCount - 1);
+			if (selected.role === 'owner') setOwnerCount(ownerCount - 1);
 			await load(listing());
 		} catch (removeError) {
 			setError(message(removeError, t('users.error.remove')));
@@ -545,7 +556,10 @@ export function UsersView(props: UsersViewProps) @{
 				}
 				<TableCard
 					title={t('users.table.title')}
-					count={t('users.table.count', { accounts: memberCount })}
+					count={t('users.table.count', {
+						accounts: memberCount,
+						owners: ownerCount,
+					})}
 					search={<SearchField
 						value={query}
 						placeholder={t('users.search.placeholder')}

package/modules/users/src/client/member-columns.tsrx

@@ -11,14 +11,14 @@ export function memberColumns(
 		{
 			key: 'displayName',
 			header: t('users.table.user'),
-			width: '22%',
+			width: '20%',
 			value: (user) => user.displayName,
 			cell: (user) => <b>{user.displayName}</b>,
 		},
 		{
 			key: 'email',
 			header: t('users.table.email'),
-			width: '24%',
+			width: '22%',
 			value: (user) => user.email,
 			cell: (user) => <span>{user.email}</span>,
 		},
@@ -34,7 +34,7 @@ export function memberColumns(
 		{
 			key: 'status',
 			header: t('users.table.status'),
-			width: '28%',
+			width: '22%',
 			cell: (user) => <span class="ui-table__state">
 				<Tag
 					tone={user.membershipStatus === 'active' ? 'success' : 'neutral'}
@@ -55,11 +55,20 @@ export function memberColumns(
 		{
 			key: 'scopes',
 			header: t('users.table.scopes'),
-			width: '12%',
+			width: '10%',
 			numeric: true,
 			cell: (user) => new Intl.NumberFormat(activeLocale()).format(
 				user.scopes.length,
 			),
 		},
+		/* No `value`: the server's sorted read has no keyset over created_at. */
+		{
+			key: 'createdAt',
+			header: t('users.table.joined'),
+			width: '12%',
+			cell: (user) => new Intl.DateTimeFormat(activeLocale(), {
+				dateStyle: 'medium',
+			}).format(user.createdAt),
+		},
 	];
 }

package/modules/users/src/client/state.ts

@@ -46,6 +46,7 @@ export function createUsersClientState() {
 		actor: cell<UsersContext['actor'] | null>(null),
 		passwordMinLength: 12,
 		memberCount: 0,
+		ownerCount: 0,
 		query: '',
 		/** The term the rows on screen answer; typing moves `query` ahead of it. */
 		appliedQuery: '',
@@ -192,6 +193,21 @@ export function replaceMember(
 	);
 }
 
+/**
+ * The owner count after one row changed on screen: the count is read whole
+ * from the server, so a role change moves it by the difference between the row
+ * the page held and the row the server answered.
+ */
+export function ownerCountAfter(
+	ownerCount: number,
+	previous: TenantMember | undefined,
+	next: TenantMember,
+): number {
+	const before = previous?.role === 'owner' ? 1 : 0;
+	const after = next.role === 'owner' ? 1 : 0;
+	return ownerCount - before + after;
+}
+
 /* The membership route answers with stable codes; each one gets the sentence
    that says what to do instead, and anything else keeps the server message. */
 export function membershipStatusMessage(error: unknown): string {

package/modules/users/src/services/users-service.ts

@@ -54,6 +54,8 @@ export interface UsersContext {
 	readonly passwordMinLength: number;
 	/** Every membership of the workspace, counted in the database. */
 	readonly memberCount: number;
+	/** The memberships holding the owner role, counted the same way. */
+	readonly ownerCount: number;
 }
 
 function actor(principal: AuthPrincipal): AuthActor {
@@ -105,6 +107,7 @@ export class UsersService {
 			actor: { accountId: principal.accountId, role: principal.role },
 			passwordMinLength: this.#auth.settings.passwordMinLength,
 			memberCount: await service.countTenantMembers(principal.tenantId),
+			ownerCount: await service.countTenantOwners(principal.tenantId),
 		};
 	}
 

package/modules/users/translations/en.json

@@ -35,12 +35,13 @@
 	"denied.members": "Reading the user directory needs the users.members.read scope.",
 	"table.title": "Members",
 	"table.caption": "Workspace users",
-	"table.count": "{accounts} accounts",
+	"table.count": "{accounts} accounts, {owners} owners",
 	"table.user": "User",
 	"table.email": "Email",
 	"table.role": "Role",
 	"table.status": "Workspace access",
 	"table.scopes": "Scopes",
+	"table.joined": "Joined",
 	"table.actions": "User actions",
 	"table.loading": "Loading workspace accounts…",
 	"table.emptyTitle": "No accounts yet",

package/modules/users/translations/pl.json

@@ -35,12 +35,13 @@
 	"denied.members": "Odczyt katalogu użytkowników wymaga uprawnienia users.members.read.",
 	"table.title": "Członkowie",
 	"table.caption": "Użytkownicy przestrzeni roboczej",
-	"table.count": "Konta: {accounts}",
+	"table.count": "Konta: {accounts}, właściciele: {owners}",
 	"table.user": "Użytkownik",
 	"table.email": "E-mail",
 	"table.role": "Rola",
 	"table.status": "Dostęp do przestrzeni",
 	"table.scopes": "Zakresy",
+	"table.joined": "Dołączył(a)",
 	"table.actions": "Akcje użytkownika",
 	"table.loading": "Wczytywanie kont…",
 	"table.emptyTitle": "Brak kont",