@jini-ai/user-management 0.2.0

package/dist/react/testing.d.ts

@@ -0,0 +1,51 @@
+import type { AdminUser, AdminIdentityUser, AdminRole, AdminPolicy, AdminPolicyPermission, AdminMember } from "./models.js";
+import type { LoginPort, UsersPort, RolesPort, MembersPort } from "./ports.js";
+export interface FakeLoginPortOptions {
+    user?: AdminUser | undefined;
+    loginError?: Error | undefined;
+}
+export declare function createFakeLoginPort(_required: Record<string, never>, options?: FakeLoginPortOptions): LoginPort;
+export interface FakeUsersPortOptions {
+    users?: AdminIdentityUser[] | undefined;
+    roles?: AdminRole[] | undefined;
+    policies?: AdminPolicy[] | undefined;
+    meId?: string | undefined;
+    canManageUserTrash?: boolean | undefined;
+    createUserError?: Error | undefined;
+    updateUserError?: Error | undefined;
+    toggleStatusError?: Error | undefined;
+    resetPasswordError?: Error | undefined;
+    assignRoleError?: Error | undefined;
+    attachPolicyError?: Error | undefined;
+    deleteUserError?: Error | undefined;
+}
+export declare function createFakeUsersPort(_required: Record<string, never>, options?: FakeUsersPortOptions): UsersPort & {
+    readonly users: AdminIdentityUser[];
+};
+export interface FakeRolesPortOptions {
+    roles?: AdminRole[] | undefined;
+    policies?: AdminPolicy[] | undefined;
+    createRoleError?: Error | undefined;
+    updateRoleError?: Error | undefined;
+    deleteRoleError?: Error | undefined;
+    createPolicyError?: Error | undefined;
+    updatePolicyError?: Error | undefined;
+    deletePolicyError?: Error | undefined;
+    writePermissionError?: Error | undefined;
+    listPermissionsError?: Error | undefined;
+    removePermissionError?: Error | undefined;
+    initialPolicyPermissions?: AdminPolicyPermission[] | undefined;
+}
+export declare function createFakeRolesPort(_required: Record<string, never>, options?: FakeRolesPortOptions): RolesPort & {
+    readonly roles: AdminRole[];
+    readonly policies: AdminPolicy[];
+    readonly policyPermissions: AdminPolicyPermission[];
+};
+export interface FakeMembersPortOptions {
+    members?: AdminMember[] | undefined;
+}
+export declare function createFakeMembersPort(_required: Record<string, never>, options?: FakeMembersPortOptions): MembersPort & {
+    readonly members: AdminMember[];
+    readonly magicLinkRequests: string[];
+};
+//# sourceMappingURL=testing.d.ts.map

package/dist/react/testing.js

@@ -0,0 +1,275 @@
+const FAKE_USER = { id: "fake-user-1", username: "fake-admin" };
+export function createFakeLoginPort(_required, options = {}) {
+    return {
+        async login() {
+            if (options.loginError)
+                throw options.loginError;
+            return { user: options.user ?? FAKE_USER };
+        },
+    };
+}
+const FAKE_WORKSPACE_ID = "fake-ws";
+function fakeUser(overrides = {}) {
+    return {
+        principalId: overrides.principalId ?? "fake-user-1",
+        workspaceId: FAKE_WORKSPACE_ID,
+        username: "fake",
+        status: "active",
+        createdAt: new Date(0).toISOString(),
+        roleIds: [],
+        policyIds: [],
+        ...overrides,
+    };
+}
+export function createFakeUsersPort(_required, options = {}) {
+    const users = [...(options.users ?? [])];
+    const roles = [...(options.roles ?? [])];
+    const policies = [...(options.policies ?? [])];
+    function requireUser(principalId) {
+        const found = users.find((u) => u.principalId === principalId);
+        if (!found)
+            throw new Error(`fake user not found: ${principalId}`);
+        return found;
+    }
+    function replaceUser(updated) {
+        const index = users.findIndex((u) => u.principalId === updated.principalId);
+        users[index] = updated;
+        return updated;
+    }
+    const meId = options.meId ?? users[0]?.principalId ?? "fake-user-1";
+    const canManageUserTrash = options.canManageUserTrash ?? true;
+    return {
+        users,
+        async me() {
+            return { user: { id: meId }, canManageUserTrash };
+        },
+        async listUsers() {
+            return { users: [...users] };
+        },
+        async listRoles() {
+            return { roles: [...roles] };
+        },
+        async listPolicies() {
+            return { policies: [...policies] };
+        },
+        async createUser(input, opts) {
+            if (options.createUserError)
+                throw options.createUserError;
+            const created = fakeUser({
+                principalId: `fake-user-${users.length + 1}`,
+                username: input.username,
+                email: opts?.email,
+            });
+            users.push(created);
+            return { user: created };
+        },
+        async updateUser(target, opts) {
+            if (options.updateUserError)
+                throw options.updateUserError;
+            const current = requireUser(target.principalId);
+            return { user: replaceUser({ ...current, ...opts }) };
+        },
+        async disableUser({ principalId }) {
+            if (options.toggleStatusError)
+                throw options.toggleStatusError;
+            const current = requireUser(principalId);
+            return { user: replaceUser({ ...current, status: "disabled" }) };
+        },
+        async enableUser({ principalId }) {
+            if (options.toggleStatusError)
+                throw options.toggleStatusError;
+            const current = requireUser(principalId);
+            return { user: replaceUser({ ...current, status: "active" }) };
+        },
+        async resetUserPassword() {
+            if (options.resetPasswordError)
+                throw options.resetPasswordError;
+        },
+        async assignRole(input) {
+            if (options.assignRoleError)
+                throw options.assignRoleError;
+            const current = requireUser(input.principalId);
+            replaceUser({ ...current, roleIds: [...current.roleIds, input.roleId] });
+            return { assignment: {} };
+        },
+        async attachPolicy(input) {
+            if (options.attachPolicyError)
+                throw options.attachPolicyError;
+            const current = requireUser(input.principalId);
+            replaceUser({ ...current, policyIds: [...current.policyIds, input.policyId] });
+            return { attachment: {} };
+        },
+        async deleteUser({ principalId }) {
+            if (options.deleteUserError)
+                throw options.deleteUserError;
+            requireUser(principalId);
+            const index = users.findIndex((u) => u.principalId === principalId);
+            users.splice(index, 1);
+        },
+    };
+}
+function fakeRole(overrides = {}) {
+    return {
+        id: overrides.id ?? "fake-role-1",
+        workspaceId: FAKE_WORKSPACE_ID,
+        name: "Fake role",
+        isBuiltin: false,
+        ...overrides,
+    };
+}
+function fakePolicy(overrides = {}) {
+    return {
+        id: overrides.id ?? "fake-policy-1",
+        workspaceId: FAKE_WORKSPACE_ID,
+        name: "Fake policy",
+        isBuiltin: false,
+        isFrozen: false,
+        ...overrides,
+    };
+}
+export function createFakeRolesPort(_required, options = {}) {
+    const roles = [...(options.roles ?? [])];
+    const policies = [...(options.policies ?? [])];
+    const policyPermissions = [...(options.initialPolicyPermissions ?? [])];
+    function requireRole(roleId) {
+        const found = roles.find((r) => r.id === roleId);
+        if (!found)
+            throw new Error(`fake role not found: ${roleId}`);
+        return found;
+    }
+    function requirePolicy(policyId) {
+        const found = policies.find((p) => p.id === policyId);
+        if (!found)
+            throw new Error(`fake policy not found: ${policyId}`);
+        return found;
+    }
+    return {
+        roles,
+        policies,
+        policyPermissions,
+        async listRoles() {
+            return { roles: [...roles] };
+        },
+        async listPolicies() {
+            return { policies: [...policies] };
+        },
+        async createRole({ name }) {
+            if (options.createRoleError)
+                throw options.createRoleError;
+            const created = fakeRole({ id: `fake-role-${roles.length + 1}`, name });
+            roles.push(created);
+            return { role: created };
+        },
+        async updateRole(input) {
+            if (options.updateRoleError)
+                throw options.updateRoleError;
+            const index = roles.findIndex((r) => r.id === input.roleId);
+            if (index < 0)
+                throw new Error(`fake role not found: ${input.roleId}`);
+            const updated = { ...roles[index], name: input.name };
+            roles[index] = updated;
+            return { role: updated };
+        },
+        async deleteRole({ roleId }) {
+            if (options.deleteRoleError)
+                throw options.deleteRoleError;
+            requireRole(roleId);
+            const index = roles.findIndex((r) => r.id === roleId);
+            roles.splice(index, 1);
+        },
+        async createPolicy(input, opts) {
+            if (options.createPolicyError)
+                throw options.createPolicyError;
+            const created = fakePolicy({
+                id: `fake-policy-${policies.length + 1}`,
+                name: input.name,
+                description: opts?.description,
+            });
+            policies.push(created);
+            return { policy: created };
+        },
+        async updatePolicy(target, opts) {
+            if (options.updatePolicyError)
+                throw options.updatePolicyError;
+            const index = policies.findIndex((p) => p.id === target.policyId);
+            if (index < 0)
+                throw new Error(`fake policy not found: ${target.policyId}`);
+            const current = policies[index];
+            // Optional updates must retain the required name when it is omitted or undefined.
+            const updated = { ...current, ...opts, name: opts?.name ?? current.name };
+            policies[index] = updated;
+            return { policy: updated };
+        },
+        async deletePolicy({ policyId }) {
+            if (options.deletePolicyError)
+                throw options.deletePolicyError;
+            requirePolicy(policyId);
+            const index = policies.findIndex((p) => p.id === policyId);
+            policies.splice(index, 1);
+        },
+        async writePolicyPermission(input, opts) {
+            if (options.writePermissionError)
+                throw options.writePermissionError;
+            requirePolicy(input.policyId);
+            const created = {
+                id: `fake-perm-${policyPermissions.length + 1}`,
+                workspaceId: FAKE_WORKSPACE_ID,
+                policyId: input.policyId,
+                permission: input.permission,
+                resourceType: opts?.resourceType ?? null,
+                constraintJson: null,
+            };
+            policyPermissions.push(created);
+            return { policyPermission: created };
+        },
+        async listPolicyPermissions({ policyId }) {
+            if (options.listPermissionsError)
+                throw options.listPermissionsError;
+            requirePolicy(policyId);
+            return { policyPermissions: policyPermissions.filter((row) => row.policyId === policyId) };
+        },
+        async removePolicyPermission(input) {
+            if (options.removePermissionError)
+                throw options.removePermissionError;
+            requirePolicy(input.policyId);
+            const index = policyPermissions.findIndex((row) => row.id === input.policyPermissionId && row.policyId === input.policyId);
+            if (index < 0) {
+                throw new Error(`policy permission '${input.policyPermissionId}' was not found on policy '${input.policyId}'`);
+            }
+            policyPermissions.splice(index, 1);
+        },
+    };
+}
+export function createFakeMembersPort(_required, options = {}) {
+    const members = [...(options.members ?? [])];
+    const magicLinkRequests = [];
+    function findOrThrow(id) {
+        const member = members.find((m) => m.id === id);
+        if (!member)
+            throw new Error(`fake member not found: ${id}`);
+        return member;
+    }
+    return {
+        members,
+        magicLinkRequests,
+        async listMembers() {
+            return { members: [...members] };
+        },
+        async getMember({ id }) {
+            return { member: findOrThrow(id) };
+        },
+        async disableMember({ id }) {
+            const index = members.findIndex((m) => m.id === id);
+            if (index < 0)
+                throw new Error(`fake member not found: ${id}`);
+            const updated = { ...members[index], status: "disabled" };
+            members[index] = updated;
+            return { member: updated };
+        },
+        async requestMemberMagicLink({ email }) {
+            magicLinkRequests.push(email);
+            return { delivered: true };
+        },
+    };
+}
+//# sourceMappingURL=testing.js.map

package/dist/react/users/Users.d.ts

@@ -0,0 +1,72 @@
+import type { Translate } from "@jini-ai/ui/panel-kit";
+import { type Dispatch, type SetStateAction } from "react";
+import type { AdminIdentityUser, AdminPolicy, AdminRole } from "../models.js";
+import { useUsers, type UsersDependencies, type UsersOptions } from "./hooks/use-users.hooks.js";
+export interface UsersProps extends UsersDependencies, UsersOptions {
+    useUsersHook?: typeof useUsers | undefined;
+    openOwnPasswordReset?: boolean | undefined;
+}
+export interface GrantOption {
+    id: string;
+    name: string;
+    isBuiltin: boolean;
+}
+export interface GrantSelectController {
+    options: GrantOption[];
+    pendingId: string;
+    setPendingId: Dispatch<SetStateAction<string>>;
+    submit: (required: {
+        principalId: string;
+    }) => Promise<void>;
+}
+export interface UserManageController {
+    error: string | null;
+    saving: boolean;
+    email: {
+        value: string;
+        set: Dispatch<SetStateAction<string>>;
+        saving: boolean;
+        save: (required: {
+            principalId: string;
+        }) => Promise<void>;
+    };
+    roleGrant: GrantSelectController;
+    policyGrant: GrantSelectController;
+}
+export interface UserManagePanelProps {
+    principalId: string;
+    manage: UserManageController;
+    t: (key: string) => string;
+}
+export declare function UserManagePanel({ principalId, manage, t }: UserManagePanelProps): import("react").JSX.Element;
+export interface UserRowActionsController {
+    expandedId: string | null;
+    toggleExpanded: (user: AdminIdentityUser) => void;
+    savingId: string | null;
+    requestDisable: (user: AdminIdentityUser) => void;
+    toggleStatus: (user: AdminIdentityUser) => Promise<void>;
+    openResetPassword: (user: AdminIdentityUser) => void;
+    canDelete: boolean;
+    requestDelete: (user: AdminIdentityUser) => void;
+}
+export interface UserRowProps {
+    user: AdminIdentityUser;
+    roleById: ReadonlyMap<string, AdminRole>;
+    policyById: ReadonlyMap<string, AdminPolicy>;
+    actions: UserRowActionsController;
+    manage: UserManageController;
+    agentBase: string;
+    t: (key: string) => string;
+    translate: Translate;
+}
+export interface UsersTableProps {
+    users: AdminIdentityUser[];
+    roles: AdminRole[];
+    policies: AdminPolicy[];
+    actions: UserRowActionsController;
+    manage: UserManageController;
+    t: (key: string) => string;
+    translate: Translate;
+}
+export declare function Users({ useUsersHook, port, translate: injectedTranslate, queryScope, openOwnPasswordReset, onOwnPasswordResetClosed }: UsersProps): import("react").JSX.Element;
+//# sourceMappingURL=Users.d.ts.map

package/dist/react/users/Users.js

@@ -0,0 +1,129 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Fragment } from "react";
+import { RowMenu, ConfirmDialog } from "@jini-ai/admin/react";
+import { agentHandle } from "@jini-ai/agentic";
+import { buildAgentListHandles } from "@jini-ai/ui/panel-kit";
+import { formatGrantLabel, userRowMenuItems } from "./rules.js";
+import { useUsers } from "./hooks/use-users.hooks.js";
+import { InfoTip } from "@jini-ai/ui/admin-widgets";
+import { useResetPasswordFields } from "./hooks/use-reset-password-fields.hooks.js";
+function NewUserForm({ username, setUsername, email, setEmail, password, setPassword, saving, formError, onCreate, t }) {
+    return (_jsxs("form", { onSubmit: onCreate, className: "notice integrations-form form-measure", children: [formError ? _jsx("span", { className: "save-error", children: formError }) : null, _jsxs("label", { children: [t("Username"), _jsx("input", { value: username, onChange: (e) => setUsername(e.target.value), required: true, ...agentHandle({ handle: "users-new-username" }, { role: "field", label: t("The new user's username") }) })] }), _jsxs("label", { children: [t("Email (optional)"), _jsx("input", { type: "email", value: email, onChange: (e) => setEmail(e.target.value), ...agentHandle({ handle: "users-new-email" }, { role: "field", label: t("The new user's email address") }) })] }), _jsxs("label", { children: [t("Password"), _jsx("input", { type: "password", autoComplete: "new-password", value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 1, ...agentHandle({ handle: "users-new-password" }, {
+                            role: "field",
+                            label: t("The new user's password — a credential field, so only a human can fill it"),
+                        }) })] }), _jsx("button", { type: "submit", disabled: saving, ...agentHandle({ handle: "users-new-submit" }, { role: "button", label: t("Create this operator account") }), children: saving ? t("Creating…") : t("Create user") })] }));
+}
+function GrantSelect({ principalId, label, placeholder, submitLabel, grant, saving, agentBase, t }) {
+    return (_jsxs("label", { children: [label, _jsxs("span", { className: "editor-actions", children: [_jsxs("select", { value: grant.pendingId, onChange: (e) => grant.setPendingId(e.target.value), ...agentHandle({ handle: `${agentBase}-select` }, {
+                            role: "field",
+                            label: t(`${label} — set with page.select_option, not click`),
+                        }), children: [_jsx("option", { value: "", children: placeholder }), grant.options.map((option) => (_jsxs("option", { value: option.id, children: [option.name, option.isBuiltin ? ` ${t("(built-in)")}` : ""] }, option.id)))] }), _jsx("button", { type: "button", disabled: !grant.pendingId || saving, onClick: () => grant.submit({ principalId }), ...agentHandle({ handle: `${agentBase}-submit` }, { role: "button", label: t(`${submitLabel} the selected option to this user`) }), children: saving ? t("Saving…") : submitLabel })] })] }));
+}
+export function UserManagePanel({ principalId, manage, t }) {
+    return (_jsx("tr", { children: _jsx("td", { colSpan: 6, children: _jsxs("div", { className: "notice integrations-form", children: [manage.error ? _jsx("span", { className: "save-error", children: manage.error }) : null, _jsxs("label", { children: [t("Email"), _jsxs("span", { className: "editor-actions", children: [_jsx("input", { type: "email", value: manage.email.value, onChange: (e) => manage.email.set(e.target.value), placeholder: t("(none)"), ...agentHandle({ handle: "user-manage-email" }, { role: "field", label: t("This user's email address") }) }), _jsx("button", { type: "button", disabled: manage.email.saving, onClick: () => manage.email.save({ principalId }), ...agentHandle({ handle: "user-manage-email-save" }, { role: "button", label: t("Save this user's email address") }), children: manage.email.saving ? t("Saving…") : t("Save email") })] })] }), _jsx(GrantSelect, { principalId: principalId, label: t("Assign role"), placeholder: t("Select a role…"), submitLabel: t("Assign"), grant: manage.roleGrant, saving: manage.saving, agentBase: "user-manage-role", t: t }), _jsx(GrantSelect, { principalId: principalId, label: t("Attach policy"), placeholder: t("Select a policy…"), submitLabel: t("Attach"), grant: manage.policyGrant, saving: manage.saving, agentBase: "user-manage-policy", t: t })] }) }) }));
+}
+function UserRow({ user, roleById, policyById, actions, manage, agentBase, t, translate }) {
+    const roleLabel = formatGrantLabel({ ids: user.roleIds, byId: roleById });
+    const policyLabel = formatGrantLabel({ ids: user.policyIds, byId: policyById });
+    return (_jsxs(_Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx("button", { type: "button", className: "link-button", onClick: () => actions.toggleExpanded(user), "aria-expanded": actions.expandedId === user.principalId, ...agentHandle({ handle: `${agentBase}-manage` }, {
+                                role: "button",
+                                label: t("Open this user's Manage panel — edit email, assign a role, attach a policy"),
+                            }), children: user.username }) }), _jsx("td", { children: user.email ?? _jsx("span", { className: "muted-cell", children: "\u2014" }) }), _jsx("td", { children: _jsx("span", { className: `status status-${user.status}`, children: t(user.status) }) }), _jsx("td", { children: roleLabel !== null ? t(roleLabel) : _jsx("span", { className: "muted-cell", children: t("none") }) }), _jsx("td", { children: policyLabel !== null ? policyLabel : _jsx("span", { className: "muted-cell", children: t("none") }) }), _jsx("td", { children: _jsx(RowMenu, { triggerLabel: `${t("Actions for user")} "${user.username}"`, agentHandle: `${agentBase}-menu`, items: userRowMenuItems({
+                                user,
+                                toggleSaving: actions.savingId === user.principalId,
+                                handlers: {
+                                    onRequestDisable: actions.requestDisable,
+                                    onEnable: (u) => void actions.toggleStatus(u),
+                                    onManage: actions.toggleExpanded,
+                                    onResetPassword: actions.openResetPassword,
+                                    onRequestDelete: actions.requestDelete,
+                                },
+                                translate,
+                                canDelete: actions.canDelete,
+                            }) }) })] }), actions.expandedId === user.principalId ? (_jsx(UserManagePanel, { principalId: user.principalId, manage: manage, t: t })) : null] }));
+}
+function UsersTable({ users, roles, policies, actions, manage, t, translate }) {
+    if (users.length === 0) {
+        return (_jsx("div", { className: "card", children: _jsxs("div", { className: "empty-state", children: [_jsx("p", { children: t("No users yet.") }), _jsx("p", { className: "page-description", children: t("Create your first operator account to get started.") })] }) }));
+    }
+    const roleById = new Map(roles.map((role) => [role.id, role]));
+    const policyById = new Map(policies.map((policy) => [policy.id, policy]));
+    const rowHandles = buildAgentListHandles({ prefix: "users-row", ids: users.map((user) => user.principalId) });
+    return (_jsx("div", { className: "table-scroll", children: _jsxs("table", { className: "list-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: t("Username") }), _jsx("th", { children: t("Email") }), _jsx("th", { children: t("Status") }), _jsx("th", { children: t("Roles") }), _jsx("th", { children: t("Policies") }), _jsx("th", { children: t("More") })] }) }), _jsx("tbody", { children: users.map((user, index) => (_jsx(Fragment, { children: _jsx(UserRow, { user: user, roleById: roleById, policyById: policyById, actions: actions, manage: manage, agentBase: rowHandles[index], t: t, translate: translate }) }, user.principalId))) })] }) }));
+}
+function UserDisableDialog({ confirmingDisable, setConfirmingDisable, toggleSavingId, confirmDisable, t }) {
+    return (_jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: confirmingDisable !== null, agentHandle: "users-disable", title: t("Disable this user?"), body: confirmingDisable ? (_jsxs("p", { children: [t("Disable"), " \"", confirmingDisable.username, "\"? ", t("They will not be able to sign in until re-enabled.")] })) : null, confirmLabel: t("Disable"), tone: "warning", pending: confirmingDisable !== null && toggleSavingId === confirmingDisable.principalId, onConfirm: confirmDisable, onCancel: () => setConfirmingDisable(null) }));
+}
+function UserDeleteDialog({ confirmingDelete, setConfirmingDelete, deleteSaving, confirmDelete, t }) {
+    return (_jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: confirmingDelete !== null, agentHandle: "users-delete", title: t("Delete this user?"), body: confirmingDelete ? (_jsxs("p", { children: [t("Delete"), " \"", confirmingDelete.username, "\"?", " ", t("They will be signed out and moved to the Trash. You can restore them there; they are deleted permanently after 60 days.")] })) : null, confirmLabel: t("Move to trash"), tone: "danger", pending: deleteSaving, onConfirm: confirmDelete, onCancel: () => setConfirmingDelete(null) }));
+}
+function EyeIcon() {
+    return (_jsxs("svg", { viewBox: "0 0 18 18", fill: "none", stroke: "currentColor", strokeWidth: 1.5, "aria-hidden": "true", children: [_jsx("path", { d: "M1.5 9S4.5 4 9 4s7.5 5 7.5 5-3 5-7.5 5-7.5-5-7.5-5Z", strokeLinejoin: "round" }), _jsx("circle", { cx: "9", cy: "9", r: "2" })] }));
+}
+function EyeOffIcon() {
+    return (_jsxs("svg", { viewBox: "0 0 18 18", fill: "none", stroke: "currentColor", strokeWidth: 1.5, "aria-hidden": "true", children: [_jsx("path", { d: "M1.5 9S4.5 4 9 4s7.5 5 7.5 5-3 5-7.5 5-7.5-5-7.5-5Z", strokeLinejoin: "round" }), _jsx("circle", { cx: "9", cy: "9", r: "2" }), _jsx("path", { d: "M3 3 15 15", strokeLinecap: "round" })] }));
+}
+function RevealablePasswordField({ id, label, value, onChange, visible, onToggleVisible, agentBase, t }) {
+    const toggleLabel = visible ? t("Hide password") : t("Show password");
+    return (_jsxs("div", { className: "field", children: [_jsx("label", { className: "field-label", htmlFor: id, children: label }), _jsxs("span", { className: "editor-actions", children: [_jsx("input", { id: id, type: visible ? "text" : "password", autoComplete: "new-password", value: value, onChange: (e) => onChange(e.target.value), style: { flex: "1 1 auto", minWidth: 0 }, ...agentHandle({ handle: agentBase }, {
+                            role: "field",
+                            label: t(`${label} — a credential field, so only a human can fill it`),
+                        }) }), _jsx("button", { type: "button", className: "link-button", "aria-label": toggleLabel, "aria-pressed": visible, title: toggleLabel, onClick: onToggleVisible, ...agentHandle({ handle: `${agentBase}-reveal` }, { role: "button", label: t(`Show or hide the ${label.toLowerCase()} field's characters`) }), children: _jsx("span", { style: { display: "inline-flex", width: 16, height: 16 }, children: visible ? _jsx(EyeOffIcon, {}) : _jsx(EyeIcon, {}) }) })] })] }));
+}
+function resolveResetPasswordFieldsHook(override) {
+    return override ?? useResetPasswordFields;
+}
+function UserResetPasswordDialog({ resetPasswordFor, setResetPasswordFor, newPassword, setNewPassword, passwordError, setPasswordError, passwordSaving, confirmResetPassword, t, useFields: useFieldsProp, }) {
+    const useFields = resolveResetPasswordFieldsHook(useFieldsProp);
+    const fields = useFields({ resetPasswordFor, newPassword });
+    function handleConfirm() {
+        if (fields.mismatch)
+            return;
+        void confirmResetPassword();
+    }
+    return (_jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: resetPasswordFor !== null, agentHandle: "users-reset-password", title: t("Reset password?"), body: resetPasswordFor ? (_jsxs(_Fragment, { children: [_jsxs("p", { children: [t("Set a new password for"), " \"", resetPasswordFor.username, "\".", " ", t("Every active session for this user will be signed out.")] }), _jsx(RevealablePasswordField, { id: "users-reset-password-input", label: t("New password"), value: newPassword, onChange: setNewPassword, visible: fields.showNewPassword, onToggleVisible: fields.toggleShowNewPassword, agentBase: "users-reset-password", t: t }), _jsx(RevealablePasswordField, { id: "users-reset-password-confirm-input", label: t("Confirm new password"), value: fields.confirmPassword, onChange: fields.setConfirmPassword, visible: fields.showConfirmPassword, onToggleVisible: fields.toggleShowConfirmPassword, agentBase: "users-reset-password-retype", t: t }), fields.mismatch ? (_jsx("p", { className: "save-error", role: "alert", children: t("Passwords do not match.") })) : passwordError ? (_jsx("p", { className: "save-error", role: "alert", children: passwordError })) : null] })) : null, confirmLabel: t("Reset password"), tone: "warning", pending: passwordSaving, onConfirm: handleConfirm, onCancel: () => {
+            setResetPasswordFor(null);
+            setNewPassword("");
+            setPasswordError(null);
+        } }));
+}
+function UsersPageHeader({ formOpen, setFormOpen, t }) {
+    return (_jsxs("div", { className: "page-header", ...agentHandle({ handle: "users-header" }, { role: "region", label: t("Users header — page title and the New user button") }), children: [_jsxs("div", { className: "page-header-text", children: [_jsx("p", { className: "page-kicker", children: t("People") }), _jsxs("h1", { className: "page-title", children: [t("Users"), _jsx(InfoTip, { label: t("No 'forgot password' email yet. If someone is locked out, the owner can reset their password here."), agentHandle: "users-reset-password-info" })] }), _jsx("p", { className: "page-description", children: t("Operator accounts with access to this admin — assign roles and policies, or disable access.") })] }), _jsx("div", { className: "page-actions", children: _jsx("button", { className: formOpen ? "btn-secondary" : undefined, onClick: () => setFormOpen((v) => !v), ...agentHandle({ handle: "users-new-toggle" }, { role: "button", label: t("Open or close the new-user form") }), children: formOpen ? t("Cancel") : t("New user") }) })] }));
+}
+function UsersNotices({ toggleError, notice }) {
+    return (_jsxs(_Fragment, { children: [toggleError ? _jsx("div", { className: "notice error", children: toggleError }) : null, notice ? _jsx("div", { className: "notice", children: notice }) : null] }));
+}
+export function Users({ useUsersHook = useUsers, port, translate: injectedTranslate, queryScope, openOwnPasswordReset, onOwnPasswordResetClosed }) {
+    const { users, roles, policies, error, formOpen, setFormOpen, username, setUsername, email, setEmail, password, setPassword, saving, formError, onCreate, expandedId, toggleExpanded, pendingRoleId, setPendingRoleId, pendingPolicyId, setPendingPolicyId, grantSaving, grantError, onAssignRole, onAttachPolicy, editEmail, setEditEmail, emailSaving, onSaveEmail, toggleSavingId, toggleError, notice, confirmingDisable, setConfirmingDisable, requestDisable, confirmDisable, onToggleStatus, resetPasswordFor, setResetPasswordFor, newPassword, setNewPassword, passwordSaving, passwordError, setPasswordError, openResetPassword, confirmResetPassword, canManageUserTrash, confirmingDelete, setConfirmingDelete, requestDelete, deleteSaving, confirmDelete, t, translate, } = useUsersHook({ port, translate: injectedTranslate, queryScope }, { openOwnPasswordReset, onOwnPasswordResetClosed });
+    if (error)
+        return _jsx("div", { className: "notice error", children: error });
+    if (!users || !roles || !policies)
+        return _jsx("div", { className: "notice", children: t("Loading users…") });
+    return (_jsxs("div", { className: "page", children: [_jsx(UsersPageHeader, { formOpen: formOpen, setFormOpen: setFormOpen, t: t }), formOpen ? (_jsx(NewUserForm, { username: username, setUsername: setUsername, email: email, setEmail: setEmail, password: password, setPassword: setPassword, saving: saving, formError: formError, onCreate: onCreate, t: t })) : null, _jsx(UsersNotices, { toggleError: toggleError, notice: notice }), _jsx(UsersTable, { users: users, roles: roles, policies: policies, actions: {
+                    expandedId,
+                    toggleExpanded,
+                    savingId: toggleSavingId,
+                    requestDisable,
+                    toggleStatus: onToggleStatus,
+                    openResetPassword,
+                    canDelete: canManageUserTrash,
+                    requestDelete,
+                }, manage: {
+                    error: grantError,
+                    saving: grantSaving,
+                    email: { value: editEmail, set: setEditEmail, saving: emailSaving, save: onSaveEmail },
+                    roleGrant: {
+                        options: roles,
+                        pendingId: pendingRoleId,
+                        setPendingId: setPendingRoleId,
+                        submit: onAssignRole,
+                    },
+                    policyGrant: {
+                        options: policies,
+                        pendingId: pendingPolicyId,
+                        setPendingId: setPendingPolicyId,
+                        submit: onAttachPolicy,
+                    },
+                }, t: t, translate: translate }), _jsx(UserDisableDialog, { confirmingDisable: confirmingDisable, setConfirmingDisable: setConfirmingDisable, toggleSavingId: toggleSavingId, confirmDisable: confirmDisable, t: t }), _jsx(UserDeleteDialog, { confirmingDelete: confirmingDelete, setConfirmingDelete: setConfirmingDelete, deleteSaving: deleteSaving, confirmDelete: confirmDelete, t: t }), _jsx(UserResetPasswordDialog, { resetPasswordFor: resetPasswordFor, setResetPasswordFor: setResetPasswordFor, newPassword: newPassword, setNewPassword: setNewPassword, passwordError: passwordError, setPasswordError: setPasswordError, passwordSaving: passwordSaving, confirmResetPassword: confirmResetPassword, t: t })] }));
+}
+//# sourceMappingURL=Users.js.map

package/dist/react/users/hooks/use-reset-password-fields.hooks.d.ts

@@ -0,0 +1,16 @@
+import type { AdminIdentityUser } from "../../models.js";
+export interface ResetPasswordFieldsInput {
+    resetPasswordFor: AdminIdentityUser | null;
+    newPassword: string;
+}
+export interface ResetPasswordFieldsController {
+    confirmPassword: string;
+    setConfirmPassword: (value: string) => void;
+    mismatch: boolean;
+    showNewPassword: boolean;
+    toggleShowNewPassword: () => void;
+    showConfirmPassword: boolean;
+    toggleShowConfirmPassword: () => void;
+}
+export declare function useResetPasswordFields({ resetPasswordFor, newPassword }: ResetPasswordFieldsInput): ResetPasswordFieldsController;
+//# sourceMappingURL=use-reset-password-fields.hooks.d.ts.map

package/dist/react/users/hooks/use-reset-password-fields.hooks.js

@@ -0,0 +1,21 @@
+import { useEffect, useState } from "react";
+export function useResetPasswordFields({ resetPasswordFor, newPassword }) {
+    const [confirmPassword, setConfirmPassword] = useState("");
+    const [showNewPassword, setShowNewPassword] = useState(false);
+    const [showConfirmPassword, setShowConfirmPassword] = useState(false);
+    useEffect(() => {
+        setConfirmPassword("");
+        setShowNewPassword(false);
+        setShowConfirmPassword(false);
+    }, [resetPasswordFor?.principalId]);
+    return {
+        confirmPassword,
+        setConfirmPassword,
+        mismatch: newPassword !== confirmPassword,
+        showNewPassword,
+        toggleShowNewPassword: () => setShowNewPassword((visible) => !visible),
+        showConfirmPassword,
+        toggleShowConfirmPassword: () => setShowConfirmPassword((visible) => !visible),
+    };
+}
+//# sourceMappingURL=use-reset-password-fields.hooks.js.map

package/dist/react/users/hooks/use-users.hooks.d.ts

@@ -0,0 +1,77 @@
+import type { Translate } from "@jini-ai/ui/panel-kit";
+import { type Dispatch, type FormEvent, type SetStateAction } from "react";
+import { type AdminIdentityUser, type AdminPolicy, type AdminRole } from "../../models.js";
+import type { UsersPort } from "../../ports.js";
+export interface UsersController {
+    users: AdminIdentityUser[] | null;
+    roles: AdminRole[] | null;
+    policies: AdminPolicy[] | null;
+    error: string | null;
+    formOpen: boolean;
+    setFormOpen: Dispatch<SetStateAction<boolean>>;
+    username: string;
+    setUsername: Dispatch<SetStateAction<string>>;
+    email: string;
+    setEmail: Dispatch<SetStateAction<string>>;
+    password: string;
+    setPassword: Dispatch<SetStateAction<string>>;
+    saving: boolean;
+    formError: string | null;
+    onCreate: (e: FormEvent) => Promise<void>;
+    expandedId: string | null;
+    toggleExpanded: (user: AdminIdentityUser) => void;
+    pendingRoleId: string;
+    setPendingRoleId: Dispatch<SetStateAction<string>>;
+    pendingPolicyId: string;
+    setPendingPolicyId: Dispatch<SetStateAction<string>>;
+    grantSaving: boolean;
+    grantError: string | null;
+    onAssignRole: (required: {
+        principalId: string;
+    }) => Promise<void>;
+    onAttachPolicy: (required: {
+        principalId: string;
+    }) => Promise<void>;
+    editEmail: string;
+    setEditEmail: Dispatch<SetStateAction<string>>;
+    emailSaving: boolean;
+    onSaveEmail: (required: {
+        principalId: string;
+    }) => Promise<void>;
+    toggleSavingId: string | null;
+    toggleError: string | null;
+    notice: string | null;
+    confirmingDisable: AdminIdentityUser | null;
+    setConfirmingDisable: Dispatch<SetStateAction<AdminIdentityUser | null>>;
+    requestDisable: (user: AdminIdentityUser) => void;
+    confirmDisable: () => Promise<void>;
+    onToggleStatus: (user: AdminIdentityUser) => Promise<void>;
+    resetPasswordFor: AdminIdentityUser | null;
+    setResetPasswordFor: Dispatch<SetStateAction<AdminIdentityUser | null>>;
+    newPassword: string;
+    setNewPassword: Dispatch<SetStateAction<string>>;
+    passwordSaving: boolean;
+    passwordError: string | null;
+    setPasswordError: Dispatch<SetStateAction<string | null>>;
+    openResetPassword: (user: AdminIdentityUser) => void;
+    confirmResetPassword: () => Promise<void>;
+    canManageUserTrash: boolean;
+    confirmingDelete: AdminIdentityUser | null;
+    setConfirmingDelete: Dispatch<SetStateAction<AdminIdentityUser | null>>;
+    requestDelete: (user: AdminIdentityUser) => void;
+    deleteSaving: boolean;
+    confirmDelete: () => Promise<void>;
+    t: (key: string) => string;
+    translate: Translate;
+}
+export interface UsersDependencies {
+    port: UsersPort;
+    translate: Translate;
+    queryScope: string;
+}
+export interface UsersOptions {
+    openOwnPasswordReset?: boolean | undefined;
+    onOwnPasswordResetClosed?: (() => void) | undefined;
+}
+export declare function useUsers({ port, translate, queryScope }: UsersDependencies, { openOwnPasswordReset, onOwnPasswordResetClosed }?: UsersOptions): UsersController;
+//# sourceMappingURL=use-users.hooks.d.ts.map