@flowdular/sdk 0.3.1 → 0.3.2

package/modules/system/src/services/database-repository.ts

@@ -0,0 +1,91 @@
+import type { DatabaseHandle } from '@flowdular/sdk/database';
+import { runDatabaseMigrations } from '@flowdular/sdk/database';
+import { databaseMigrations } from './migration.ts';
+import type {
+	ModuleActivationRecord,
+	ModuleActivationRepository,
+} from './repository.ts';
+
+interface ActivationRow {
+	tenant_id: string;
+	module_id: string;
+	active: number | bigint | string;
+	changed_by: string;
+	changed_at: number | bigint | string;
+}
+
+const SQL = {
+	list: `SELECT tenant_id, module_id, active, changed_by, changed_at
+	 FROM system_module_activations
+	 WHERE tenant_id = $1
+	 ORDER BY module_id`,
+	set: `INSERT INTO system_module_activations
+	 (tenant_id, module_id, active, changed_by, changed_at)
+	 VALUES ($1, $2, $3, $4, $5)
+	 ON CONFLICT (tenant_id, module_id) DO UPDATE
+	 SET active = EXCLUDED.active,
+	     changed_by = EXCLUDED.changed_by,
+	     changed_at = EXCLUDED.changed_at
+	 WHERE system_module_activations.tenant_id = $1`,
+} as const;
+
+/* PostgreSQL returns BIGINT as a string, and a flag column as a number this
+   module compares only after normalizing. */
+function integer(value: number | bigint | string, field: string): number {
+	const normalized = Number(value);
+	if (!Number.isSafeInteger(normalized) || normalized < 0) {
+		throw new Error(`The system database returned an invalid ${field}.`);
+	}
+	return normalized;
+}
+
+function fromRow(row: ActivationRow): ModuleActivationRecord {
+	return {
+		tenantId: row.tenant_id,
+		moduleId: row.module_id,
+		active: integer(row.active, 'flag') === 1,
+		changedBy: row.changed_by,
+		changedAt: integer(row.changed_at, 'timestamp'),
+	};
+}
+
+export class DatabaseModuleActivationRepository
+	implements ModuleActivationRepository
+{
+	constructor(private readonly database: DatabaseHandle) {}
+
+	async list(tenantId: string): Promise<readonly ModuleActivationRecord[]> {
+		const result = await this.database.transaction(
+			(transaction) =>
+				transaction.query<ActivationRow>({
+					text: SQL.list,
+					parameters: [tenantId],
+				}),
+			{ access: 'read', tenantId },
+		);
+		return result.rows.map(fromRow);
+	}
+
+	async set(record: ModuleActivationRecord): Promise<void> {
+		await this.database.transaction(
+			(transaction) =>
+				transaction.execute({
+					text: SQL.set,
+					parameters: [
+						record.tenantId,
+						record.moduleId,
+						record.active ? 1 : 0,
+						record.changedBy,
+						record.changedAt,
+					],
+				}),
+			{ access: 'write', tenantId: record.tenantId },
+		);
+	}
+}
+
+export async function migrateSystemDatabase(
+	database: DatabaseHandle,
+): Promise<void> {
+	await runDatabaseMigrations(database, 'system.core', databaseMigrations);
+}

package/modules/system/src/services/migration.ts

@@ -0,0 +1,39 @@
+import type { DatabaseMigration } from '@flowdular/sdk/database';
+import { postgresTenantTableState } from '@flowdular/sdk/database';
+
+/* Mirrors migrations/0001_system_module_activations.up.sql byte for byte;
+   tests/migrations.test.ts fails on drift. */
+export const SYSTEM_MIGRATION_001 = `-- One row per module whose activation an owner changed for a workspace. A
+-- composed module without a row is active; the row keeps the last decision and
+-- who made it. The primary key is the only lookup: the snapshot reads every row
+-- of one tenant at once.
+CREATE TABLE IF NOT EXISTS system_module_activations (
+  tenant_id TEXT NOT NULL,
+  module_id TEXT NOT NULL CHECK (length(module_id) BETWEEN 1 AND 128),
+  active SMALLINT NOT NULL CHECK (active IN (0, 1)),
+  changed_by TEXT NOT NULL CHECK (length(changed_by) BETWEEN 1 AND 64),
+  changed_at BIGINT NOT NULL,
+  PRIMARY KEY (tenant_id, module_id)
+);
+ALTER TABLE system_module_activations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE system_module_activations FORCE ROW LEVEL SECURITY;
+CREATE POLICY system_module_activations_tenant_policy ON system_module_activations
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+`;
+
+/** Every tenant table of this module, with the policy each one must carry. */
+export const SYSTEM_TENANT_TABLES = ['system_module_activations'] as const;
+
+export const databaseMigrations: readonly DatabaseMigration[] = [
+	{
+		id: '0001_system_module_activations',
+		sql: { postgresql: SYSTEM_MIGRATION_001 },
+		inspectExisting: (database) =>
+			postgresTenantTableState(
+				database,
+				'system_module_activations',
+				'system_module_activations_tenant_policy',
+			),
+	},
+];

package/modules/system/src/services/module-activation-service.ts

@@ -0,0 +1,245 @@
+import type { AuthActor } from '@flowdular/sdk/modules/auth';
+import {
+	activeModuleIds,
+	dependentsOf,
+	isRequiredModule,
+	type ComposedModule,
+	type ModuleActivationChange,
+	type ModuleActivationEntry,
+} from '../domain/modules.ts';
+import type { ModuleActivationRepository } from './repository.ts';
+
+export type ModuleActivationErrorCode =
+	| 'MODULE_UNKNOWN'
+	| 'MODULE_REQUIRED'
+	| 'MODULE_HAS_ACTIVE_DEPENDENTS'
+	| 'MODULE_DEPENDENCY_INACTIVE';
+
+export class ModuleActivationError extends Error {
+	readonly code: ModuleActivationErrorCode;
+	readonly status: number;
+	/** The modules a refusal names: active dependents or inactive dependencies. */
+	readonly modules: readonly string[];
+
+	constructor(
+		code: ModuleActivationErrorCode,
+		message: string,
+		status: number,
+		modules: readonly string[] = [],
+	) {
+		super(message);
+		this.name = 'ModuleActivationError';
+		this.code = code;
+		this.status = status;
+		this.modules = modules;
+	}
+}
+
+export interface ModuleActivationServiceOptions {
+	readonly repository: ModuleActivationRepository;
+	/** The modules the application composes; read once per call, never cached here. */
+	readonly modules: () => readonly ComposedModule[];
+	readonly audit?: (
+		actor: AuthActor,
+		change: ModuleActivationChange,
+	) => Promise<void>;
+	readonly now?: () => number;
+	/** How long a workspace snapshot answers before it is read again. */
+	readonly snapshotTtlMs?: number;
+	readonly maxTenants?: number;
+}
+
+interface Snapshot {
+	readonly inactive: ReadonlySet<string>;
+	readonly expiresAt: number;
+}
+
+export const DEFAULT_SNAPSHOT_TTL_MS = 30_000;
+export const DEFAULT_SNAPSHOT_TENANTS = 1024;
+
+/**
+ * Per-workspace activation of the modules the application composes. Every
+ * composed module is active until an owner deactivates it; a required module
+ * and a module another active module depends on stay active. Reads come from
+ * a memoised per-tenant snapshot so a request costs no query of its own.
+ */
+export class ModuleActivationService {
+	readonly #repository: ModuleActivationRepository;
+	readonly #modules: () => readonly ComposedModule[];
+	readonly #audit: ModuleActivationServiceOptions['audit'];
+	readonly #now: () => number;
+	readonly #ttlMs: number;
+	readonly #maxTenants: number;
+	readonly #snapshots = new Map<string, Promise<Snapshot>>();
+
+	constructor(options: ModuleActivationServiceOptions) {
+		this.#repository = options.repository;
+		this.#modules = options.modules;
+		this.#audit = options.audit;
+		this.#now = options.now ?? Date.now;
+		this.#ttlMs = options.snapshotTtlMs ?? DEFAULT_SNAPSHOT_TTL_MS;
+		this.#maxTenants = options.maxTenants ?? DEFAULT_SNAPSHOT_TENANTS;
+	}
+
+	/** Composed optional module ids an owner deactivated for the workspace. */
+	async inactive(tenantId: string): Promise<ReadonlySet<string>> {
+		const cached = this.#snapshots.get(tenantId);
+		if (cached) {
+			const snapshot = await cached;
+			if (snapshot.expiresAt > this.#now()) return snapshot.inactive;
+		}
+		const loading = this.#load(tenantId);
+		this.#snapshots.delete(tenantId);
+		this.#snapshots.set(tenantId, loading);
+		while (this.#snapshots.size > this.#maxTenants) {
+			const oldest = this.#snapshots.keys().next().value;
+			if (oldest === undefined) break;
+			this.#snapshots.delete(oldest);
+		}
+		try {
+			return (await loading).inactive;
+		} catch (error) {
+			if (this.#snapshots.get(tenantId) === loading) {
+				this.#snapshots.delete(tenantId);
+			}
+			throw error;
+		}
+	}
+
+	invalidate(tenantId: string): void {
+		this.#snapshots.delete(tenantId);
+	}
+
+	async isActive(tenantId: string, moduleId: string): Promise<boolean> {
+		if (isRequiredModule(moduleId)) return true;
+		return !(await this.inactive(tenantId)).has(moduleId);
+	}
+
+	async activeIds(tenantId: string): Promise<readonly string[]> {
+		return activeModuleIds(this.#modules(), await this.inactive(tenantId));
+	}
+
+	async list(tenantId: string): Promise<readonly ModuleActivationEntry[]> {
+		const modules = this.#modules();
+		const inactive = await this.inactive(tenantId);
+		return modules.map((module) => this.#entry(modules, module, inactive));
+	}
+
+	async activate(
+		actor: AuthActor,
+		moduleId: string,
+	): Promise<ModuleActivationEntry> {
+		const modules = this.#modules();
+		const module = this.#composed(modules, moduleId);
+		const inactive = await this.inactive(actor.tenantId);
+		if (!inactive.has(moduleId)) {
+			return this.#entry(modules, module, inactive);
+		}
+		const missing = module.dependencies.filter(
+			(dependency) => !isRequiredModule(dependency) && inactive.has(dependency),
+		);
+		if (missing.length > 0) {
+			throw new ModuleActivationError(
+				'MODULE_DEPENDENCY_INACTIVE',
+				`${moduleId} needs ${missing.join(', ')} active first.`,
+				409,
+				missing,
+			);
+		}
+		return this.#write(actor, modules, module, true);
+	}
+
+	async deactivate(
+		actor: AuthActor,
+		moduleId: string,
+	): Promise<ModuleActivationEntry> {
+		const modules = this.#modules();
+		const module = this.#composed(modules, moduleId);
+		if (isRequiredModule(moduleId)) {
+			throw new ModuleActivationError(
+				'MODULE_REQUIRED',
+				`${moduleId} is required by every workspace and cannot be deactivated.`,
+				409,
+			);
+		}
+		const inactive = await this.inactive(actor.tenantId);
+		if (inactive.has(moduleId)) {
+			return this.#entry(modules, module, inactive);
+		}
+		const dependents = dependentsOf(modules, moduleId).filter(
+			(dependent) => isRequiredModule(dependent) || !inactive.has(dependent),
+		);
+		if (dependents.length > 0) {
+			throw new ModuleActivationError(
+				'MODULE_HAS_ACTIVE_DEPENDENTS',
+				`${moduleId} is a dependency of ${dependents.join(', ')}; deactivate those first.`,
+				409,
+				dependents,
+			);
+		}
+		return this.#write(actor, modules, module, false);
+	}
+
+	#composed(
+		modules: readonly ComposedModule[],
+		moduleId: string,
+	): ComposedModule {
+		const module = modules.find((candidate) => candidate.id === moduleId);
+		if (!module) {
+			throw new ModuleActivationError(
+				'MODULE_UNKNOWN',
+				`${moduleId} is not composed in this application.`,
+				404,
+			);
+		}
+		return module;
+	}
+
+	#entry(
+		modules: readonly ComposedModule[],
+		module: ComposedModule,
+		inactive: ReadonlySet<string>,
+	): ModuleActivationEntry {
+		const optional = !isRequiredModule(module.id);
+		return {
+			id: module.id,
+			version: module.version,
+			active: !optional || !inactive.has(module.id),
+			optional,
+			dependents: dependentsOf(modules, module.id),
+		};
+	}
+
+	async #write(
+		actor: AuthActor,
+		modules: readonly ComposedModule[],
+		module: ComposedModule,
+		active: boolean,
+	): Promise<ModuleActivationEntry> {
+		await this.#repository.set({
+			tenantId: actor.tenantId,
+			moduleId: module.id,
+			active,
+			changedBy: actor.accountId,
+			changedAt: this.#now(),
+		});
+		this.invalidate(actor.tenantId);
+		await this.#audit?.(actor, { moduleId: module.id, active });
+		return this.#entry(modules, module, await this.inactive(actor.tenantId));
+	}
+
+	async #load(tenantId: string): Promise<Snapshot> {
+		const composed = new Set(this.#modules().map((module) => module.id));
+		const inactive = new Set<string>();
+		for (const record of await this.#repository.list(tenantId)) {
+			if (
+				!record.active &&
+				composed.has(record.moduleId) &&
+				!isRequiredModule(record.moduleId)
+			) {
+				inactive.add(record.moduleId);
+			}
+		}
+		return { inactive, expiresAt: this.#now() + this.#ttlMs };
+	}
+}

package/modules/system/src/services/repository.ts

@@ -0,0 +1,17 @@
+export interface ModuleActivationRecord {
+	readonly tenantId: string;
+	readonly moduleId: string;
+	readonly active: boolean;
+	readonly changedBy: string;
+	readonly changedAt: number;
+}
+
+/**
+ * The per-workspace activation overrides, and nothing else: which modules are
+ * composed comes from the workspace manifests, and a module without a row is
+ * active.
+ */
+export interface ModuleActivationRepository {
+	list(tenantId: string): Promise<readonly ModuleActivationRecord[]>;
+	set(record: ModuleActivationRecord): Promise<void>;
+}

package/modules/system/translations/en.json

@@ -12,6 +12,9 @@
 	"action.clear": "Clear",
 	"action.save": "Save",
 	"action.reset": "Reset",
+	"action.activate": "Activate",
+	"action.deactivate": "Deactivate",
+	"action.cancel": "Cancel",
 	"denied.title": "Access denied",
 	"denied.hint": "Reading the module catalog needs the system.modules.read scope.",
 	"tab.label": "Administration views",
@@ -33,12 +36,13 @@
 	"table.title": "Module catalog",
 	"table.caption": "Modules",
 	"table.actions": "Module actions",
-	"table.count": "{enabled} enabled · {total} in workspace",
+	"table.count": "{active} active · {enabled} enabled · {total} in workspace",
 	"table.module": "Module",
 	"table.version": "Version",
 	"table.specVersion": "spec {version}",
 	"table.platform": "Platform",
 	"table.permissions": "Permissions",
+	"table.dependents": "Dependents",
 	"table.status": "Status",
 	"table.loading": "Loading modules…",
 	"table.emptyTitle": "No modules found",
@@ -48,6 +52,9 @@
 	"table.cliNote": "Change the enabled set with the CLI:",
 	"status.enabled": "Enabled",
 	"status.available": "Available",
+	"status.active": "Active",
+	"status.inactive": "Inactive",
+	"status.required": "Required",
 	"drawer.module": "Module",
 	"detail.overview": "Overview",
 	"detail.specVersion": "Spec version",
@@ -77,5 +84,14 @@
 	"settings.mfaKeyRequired": "Required multi-factor authentication needs a deployment MFA encryption key.",
 	"settings.timeZone.label": "Workspace time zone",
 	"settings.timeZone.description": "IANA zone name such as Europe/Warsaw. Modules that show or schedule local times read it; the default is UTC.",
+	"activation.notComposed": "This module is not enabled in the application; enable it with the CLI first.",
+	"activation.deniedManage": "Changing module activation needs the system.settings.manage scope.",
+	"activation.required": "A required module is active in every workspace.",
+	"activation.dependents": "Active modules depend on it: {modules}.",
+	"activation.confirmActivateTitle": "Activate {module}?",
+	"activation.confirmActivate": "Its screens, API and agent tools become available to this workspace again.",
+	"activation.confirmDeactivateTitle": "Deactivate {module}?",
+	"activation.confirmDeactivate": "Its screens disappear from this workspace and its API answers 403 MODULE_INACTIVE until it is activated again. Stored data is kept.",
+	"error.activation": "Could not change the module activation.",
 	"error.catalog": "Could not load the module catalog."
 }

package/modules/system/translations/pl.json

@@ -12,6 +12,9 @@
 	"action.clear": "Wyczyść",
 	"action.save": "Zapisz",
 	"action.reset": "Przywróć domyślne",
+	"action.activate": "Aktywuj",
+	"action.deactivate": "Dezaktywuj",
+	"action.cancel": "Anuluj",
 	"denied.title": "Brak dostępu",
 	"denied.hint": "Odczyt katalogu modułów wymaga uprawnienia system.modules.read.",
 	"tab.label": "Widoki administracyjne",
@@ -33,12 +36,13 @@
 	"table.title": "Katalog modułów",
 	"table.caption": "Moduły",
 	"table.actions": "Akcje modułu",
-	"table.count": "Włączone: {enabled} · wszystkie: {total}",
+	"table.count": "{active} aktywnych · {enabled} włączonych · {total} w przestrzeni",
 	"table.module": "Moduł",
 	"table.version": "Wersja",
 	"table.specVersion": "spec {version}",
 	"table.platform": "Platforma",
 	"table.permissions": "Uprawnienia",
+	"table.dependents": "Zależne",
 	"table.status": "Status",
 	"table.loading": "Wczytywanie modułów…",
 	"table.emptyTitle": "Nie znaleziono modułów",
@@ -48,6 +52,9 @@
 	"table.cliNote": "Zmieniaj zestaw włączonych modułów przez CLI:",
 	"status.enabled": "Włączony",
 	"status.available": "Dostępny",
+	"status.active": "Aktywny",
+	"status.inactive": "Nieaktywny",
+	"status.required": "Wymagany",
 	"drawer.module": "Moduł",
 	"detail.overview": "Przegląd",
 	"detail.specVersion": "Wersja specyfikacji",
@@ -77,5 +84,14 @@
 	"settings.mfaKeyRequired": "Wymagane uwierzytelnianie dwuskładnikowe potrzebuje klucza szyfrującego MFA skonfigurowanego we wdrożeniu.",
 	"settings.timeZone.label": "Strefa czasowa obszaru roboczego",
 	"settings.timeZone.description": "Nazwa strefy IANA, na przykład Europe/Warsaw. Moduły, które pokazują lub planują czas lokalny, odczytują tę wartość; domyślnie UTC.",
+	"activation.notComposed": "Ten moduł nie jest włączony w aplikacji; najpierw włącz go przez CLI.",
+	"activation.deniedManage": "Zmiana aktywacji modułu wymaga zakresu system.settings.manage.",
+	"activation.required": "Moduł wymagany jest aktywny w każdej przestrzeni.",
+	"activation.dependents": "Zależą od niego aktywne moduły: {modules}.",
+	"activation.confirmActivateTitle": "Aktywować {module}?",
+	"activation.confirmActivate": "Jego ekrany, API i narzędzia agentów znów będą dostępne w tej przestrzeni.",
+	"activation.confirmDeactivateTitle": "Dezaktywować {module}?",
+	"activation.confirmDeactivate": "Jego ekrany znikną z tej przestrzeni, a API będzie odpowiadać 403 MODULE_INACTIVE do ponownej aktywacji. Zapisane dane zostają.",
+	"error.activation": "Nie udało się zmienić aktywacji modułu.",
 	"error.catalog": "Nie udało się wczytać katalogu modułów."
 }

package/modules/users/module.json

@@ -3,7 +3,7 @@
 	"schemaVersion": 1,
 	"id": "users.core",
 	"package": "@flowdular/module-users",
-	"version": "0.9.8",
+	"version": "0.11.0",
 	"profile": "full",
 	"capabilities": ["api", "client", "translations"],
 	"platform": {
@@ -13,7 +13,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/users/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-users",
-	"version": "0.9.8",
+	"version": "0.11.0",
 	"type": "module",
 	"exports": {
 		".": "./src/index.ts",

package/modules/users/spec/module.yaml

@@ -1,6 +1,6 @@
 schemaVersion: 2
 id: users.core
-specVersion: 0.9.8
+specVersion: 0.11.0
 status: approved
 name: User Management Core
 description: Provides the tenant-scoped user directory and member administration (creation, display name, role assignment, per-member scopes, account status, password reset, session revocation, removal) through the public auth administration port.
@@ -11,7 +11,7 @@ capabilities:
   - translations
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
   - id: search.core
@@ -56,7 +56,7 @@ dataOwnership:
 entities:
   - id: member
     name: Workspace member
-    description: One membership of the active workspace as the auth administration port answers it; auth.core owns the row and users.core reads and writes it only through the port, never through a table of its own.
+    description: One membership of the active workspace as the auth administration port answers it; auth.core owns the row and users.core reads and writes it only through the port, never through a table of its own. The joined-at instant the Members screen and the export show is the createdAt of the membership row, which auth.core owns and answers with every member.
     fields:
       - id: accountId
         type: string
@@ -146,6 +146,7 @@ screens:
       - status
       - passwordChangeRequired
       - scopes
+      - createdAt
     filters:
       - displayName
       - email
@@ -200,7 +201,7 @@ actions:
     kind: custom
     risk: read
     idempotent: true
-    description: Answer what the Members screen needs beside the page, namely the workspace roles, the grantable scopes, the acting principal's account id and role, the shared password minimum length and the member count.
+    description: Answer what the Members screen needs beside the page, namely the workspace roles, the grantable scopes, the acting principal's account id and role, the shared password minimum length, the member count and the owner count, both counted in the database.
   - id: create-member
     entity: member
     permission: users.members.manage
@@ -287,15 +288,11 @@ decisions:
     question: How are the two bulk actions of the Members screen declared?
     answer: As the actions set-status-many and assign-role-many, each behind users.members.manage and each applied one id at a time through the single-row path, with the USERS-STATUS-MANY and USERS-ROLE-MANY scenarios as their evidence.
     decidedBy: default
-  - id: D-USERS-JOINED-AT
-    question: Why does the member entity not declare the joined-at instant the export carries?
-    answer: The instant is auth.core's createdAt column, and createdAt is a field id every tenant table owns, so the specification cannot declare it; the export list still carries it as documented in the invariants.
-    decidedBy: default
 acceptanceScenarios:
   - id: USERS-LIST
     given: An authenticated principal has users.members.read in an active tenant.
     when: The principal requests the user directory.
-    then: Only memberships from the active tenant are returned without credential or session material, one page at a time, and the roles, grantable scopes, acting principal and member count the screen needs come from the separate context read.
+    then: Only memberships from the active tenant are returned without credential or session material, one page at a time, and the roles, grantable scopes, acting principal, member count and owner count the screen needs come from the separate context read.
   - id: USERS-PAGE
     given: A workspace holding more members than one page carries, and another workspace with members of its own.
     when: A screen lists the members with a page limit of at most 200, follows the cursor it receives to the end sorted by display name or by e-mail in either direction, narrows by a name or address prefix and by membership status, and presents a cursor this server did not sign, one of the other workspace, or one issued for another sort or filter.

package/modules/users/src/client/UsersView.tsrx

@@ -49,6 +49,7 @@ import {
 	loadedListing,
 	memberSort,
 	membershipStatusMessage,
+	ownerCountAfter,
 	pageCursor,
 	replaceMember,
 	resetPageCursors,
@@ -88,6 +89,7 @@ export function UsersView(props: UsersViewProps) @{
 	const [actor] = useValue(usersState.state.actor);
 	const [passwordMinLength] = useValue(usersState.state.passwordMinLength);
 	const [memberCount, setMemberCount] = useValue(usersState.state.memberCount);
+	const [ownerCount, setOwnerCount] = useValue(usersState.state.ownerCount);
 	const actorIsOwner = actor?.role === 'owner';
 	const [status, setStatus] = useValue(usersState.state.status);
 	const [error, setError] = useValue(usersState.state.error);
@@ -217,6 +219,7 @@ export function UsersView(props: UsersViewProps) @{
 					context.passwordMinLength,
 				);
 				transaction.set(usersState.state.memberCount, context.memberCount);
+				transaction.set(usersState.state.ownerCount, context.ownerCount);
 				transaction.set(usersState.state.exportStarted, false);
 			}, 'users/context-loaded');
 			return true;
@@ -290,13 +293,17 @@ export function UsersView(props: UsersViewProps) @{
 		try {
 			const member = await run();
 			if (member) {
-				usersState.store.act(
-					(transaction) => transaction.set(
-						usersState.state.users,
-						replaceMember(users, member),
-					),
-					'users/member-updated',
-				);
+				usersState.store.act((transaction) => {
+					transaction.set(usersState.state.users, replaceMember(users, member));
+					transaction.set(
+						usersState.state.ownerCount,
+						ownerCountAfter(
+							ownerCount,
+							users.find((user) => user.accountId === member.accountId),
+							member,
+						),
+					);
+				}, 'users/member-updated');
 			}
 			setNotice(done);
 			setStatus('idle');
@@ -350,6 +357,7 @@ export function UsersView(props: UsersViewProps) @{
 			setFormSession((current) => current + 1);
 			setFormOpen(false);
 			setMemberCount(memberCount + 1);
+			if (user.role === 'owner') setOwnerCount(ownerCount + 1);
 			/* The new row belongs wherever the order puts it; the first page of
    the listing shows it or the page it is on does. */
 			await load(firstPage({}));
@@ -436,11 +444,13 @@ export function UsersView(props: UsersViewProps) @{
 		const role = bulkRole || (assignableRoles[0]?.key ?? '');
 		setRoleDialogOpen(false);
 		if (role === '') return;
-		void applyMany(
-			(ids) => assignRoleMany(ids, role, props.csrfToken),
-			'users.notice.roleAssignedMany',
-			'users.error.roleMany',
-		);
+		/* A role handed to several rows moves the owner count by an amount only
+   the server knows, so the context is read again with the page. */
+		void applyMany(async (ids) => {
+			const outcomes = await assignRoleMany(ids, role, props.csrfToken);
+			await loadContext();
+			return outcomes;
+		}, 'users.notice.roleAssignedMany', 'users.error.roleMany');
 	};
 
 	const openMember = (accountId: string) => {
@@ -466,6 +476,7 @@ export function UsersView(props: UsersViewProps) @{
 			await removeMember(accountId, props.csrfToken);
 			setSelectedAccountId(null);
 			setMemberCount(memberCount - 1);
+			if (selected.role === 'owner') setOwnerCount(ownerCount - 1);
 			await load(listing());
 		} catch (removeError) {
 			setError(message(removeError, t('users.error.remove')));
@@ -545,7 +556,10 @@ export function UsersView(props: UsersViewProps) @{
 				}
 				<TableCard
 					title={t('users.table.title')}
-					count={t('users.table.count', { accounts: memberCount })}
+					count={t('users.table.count', {
+						accounts: memberCount,
+						owners: ownerCount,
+					})}
 					search={<SearchField
 						value={query}
 						placeholder={t('users.search.placeholder')}