@ketvietlab/ketsuite 0.1.25 → 0.1.30

package/dist/modules/user_backend/routes.js

@@ -1,8 +1,11 @@
-import { accessRoutes, renderAccess } from './access-routes.js';
+import { managedRoleRoutes } from './managed-role-routes.js';
+import { accessPolicyRoutes } from './access-policy-routes.js';
+import { rowListSearch } from '../backend/row-list.js';
+import { userListSearch } from './search.js';
 import { randomUUID } from 'node:crypto';
 import { text } from '@ketvietlab/ketjs';
 import { readForm, seeOther } from '../backend/forms.js';
-import { presetsScreen, profileScreen, rolesScreen, roleScreen, userFormScreen, usersScreen, } from './screens/index.js';
+import { profileScreen, usersScreen } from './screens/index.js';
 import { recordModalCreateHref, recordModalHref } from '../../ui/record-modal.js';
 import { adminPage, inLocale } from '../backend/screen.js';
 import { PAGE_SIZE, pageOf, pager, searchOf, withParam } from '../backend/paging.js';
@@ -40,6 +43,22 @@ const withUserReturnTo = (url, path, returnTo) => {
     return `${target.pathname}${target.search}`;
 };
 const userDetailPath = (url, id, returnTo) => withUserReturnTo(url, `/admin/users/${encodeURIComponent(id)}`, returnTo);
+/**
+ * One narrowing question, offered beside paging.
+ *
+ * Choosing the row that is already chosen clears it, so the menu is both how a
+ * filter is set and how it is dropped.
+ */
+const listFilterMenu = (url, param, label, current, options) => ({
+    id: param,
+    label,
+    items: options.map((option) => ({
+        id: `${param}:${String(option.id)}`,
+        label: String(option.name ?? option.id),
+        path: withParam(url, param, current === String(option.id) ? null : String(option.id)),
+        active: current === String(option.id),
+    })),
+});
 const translatedErrors = (ctx, url, req, result) => {
     const _ = ctx.translate(ctx.localeOf(url, req));
     return (result?.errors ?? []).map((error) => `${error.field ? `${error.field}: ` : ''}${_(error.code ?? 'user.error.required')}`);
@@ -53,7 +72,10 @@ const accessOptions = async (ctx, url, req) => {
     ]);
     const branches = (await Promise.all(companies.map((company) => ctx.call('company.listBranches', { companyId: company.id, includeArchived: false }, url, req)))).flat();
     return {
-        companies: companies.map((company) => ({ value: String(company.id), label: String(company.name) })),
+        companies: companies.map((company) => ({
+            value: String(company.id),
+            label: String(company.name),
+        })),
         branches: branches.map((branch) => ({
             value: String(branch.id),
             label: `${String(branch.code)} · ${String(branch.name)}`,
@@ -76,100 +98,30 @@ const sessionRows = async (ctx, url, req, userId) => {
         expiresAt: row.expiresAt,
     }));
 };
-const renderUser = async (ctx, url, req, id, state = {}) => {
-    const _ = ctx.translate(ctx.localeOf(url, req));
-    const [row, options, sessions, effectiveAccess] = await Promise.all([
-        userOf(ctx, url, req, id),
-        accessOptions(ctx, url, req),
-        sessionRows(ctx, url, req, id),
-        ctx.call('user.effectiveAccess', { userId: id }, url, req),
-    ]);
-    if (!row)
-        return text(_('user_backend.error.notFound'), { status: 404 });
-    const returnTo = safeUserReturnTo(url, state.returnTo ?? url.searchParams.get('returnTo'));
-    const values = { ...row, ...state.values, id: row.id };
-    const externalIdentities = await ctx.joint(url, req, 'user_backend:user.external-identities', {
-        userId: id,
-    });
-    return adminPage(ctx, url, req, {
-        title: row.name,
-        translate: false,
-        active: '/admin/users',
-        body: (_, frame) => userFormScreen(_, values, {
-            mode: 'detail',
-            action: userDetailPath(url, row.id, returnTo),
-            cancelHref: returnTo,
-            ...options,
-            sessions,
-            errors: state.errors,
-            oneTimeLink: state.oneTimeLink,
-            companiesAction: withUserReturnTo(url, `/admin/users/${encodeURIComponent(row.id)}/companies`, returnTo),
-            branchesAction: withUserReturnTo(url, `/admin/users/${encodeURIComponent(row.id)}/branches`, returnTo),
-            rolesAction: withUserReturnTo(url, `/admin/users/${encodeURIComponent(row.id)}/roles`, returnTo),
-            scopedRolesAction: withUserReturnTo(url, `/admin/users/${encodeURIComponent(row.id)}/scoped-roles`, returnTo),
-            effectiveAccess,
-            scopedRoleOperationId: state.scopedRoleOperationId ?? randomUUID(),
-            scopedRoleRemovalId: randomUUID(),
-            scopedRoleValues: state.scopedRoleValues,
-            tokenAction: withUserReturnTo(url, `/admin/users/${encodeURIComponent(row.id)}/token`, returnTo),
-            sessionAction: (session) => withUserReturnTo(url, `/admin/users/${encodeURIComponent(row.id)}/sessions/${encodeURIComponent(session.id)}`, returnTo),
-            integration: state.integration ? [externalIdentities, state.integration] : externalIdentities,
-        }, frame),
-    });
+const userSearchFunctions = {
+    apply: 'user_backend.applySearchFilter',
+    saveFavorite: 'user_backend.saveSearchFavorite',
+    deleteFavorite: 'user_backend.deleteSearchFavorite',
+    setDefaultFavorite: 'user_backend.setDefaultSearchFavorite',
 };
-const permissionGroups = async (ctx, url, req, grants) => {
-    const _ = ctx.translate(ctx.localeOf(url, req));
-    const catalogue = (await ctx.call('user.permissionCatalogue', {}, url, req));
-    const held = new Set(grants.map((grant) => grant.fnKey));
-    const grouped = new Map();
-    for (const permission of catalogue) {
-        const key = `${permission.module}:${permission.task}`;
-        grouped.set(key, [...(grouped.get(key) ?? []), permission]);
-    }
-    return [...grouped.entries()].map(([key, items]) => ({
-        key,
-        module: items[0].module,
-        moduleLabel: _(`${items[0].module}.app.title`),
-        task: items[0].task,
-        label: _(`user_backend.task.${items[0].task}`),
-        checked: items.every((item) => held.has(item.key)),
-    }));
-};
-const renderRole = async (ctx, url, req, id, state = {}) => {
-    const _ = ctx.translate(ctx.localeOf(url, req));
-    const [row, authorizationState] = await Promise.all([
-        ctx.call('user.getRole', { id }, url, req),
-        ctx.call('user.authorizationState', {}, url, req),
-    ]);
-    if (!row)
-        return text(_('user_backend.error.roleNotFound'), { status: 404 });
-    return adminPage(ctx, url, req, {
-        title: state.values?.name ?? row.name,
-        translate: false,
-        active: '/admin/roles',
-        body: async (_, frame) => roleScreen(_, { ...row, ...state.values, id: row.id }, {
-            mode: 'detail',
-            action: inLocale(url, `/admin/roles/${encodeURIComponent(row.id)}`),
-            cancelHref: inLocale(url, '/admin/roles'),
-            permissionsAction: row.mode === 'managed'
-                ? undefined
-                : inLocale(url, `/admin/roles/${encodeURIComponent(row.id)}/permissions`),
-            permissions: row.mode === 'managed' ? undefined : await permissionGroups(ctx, url, req, row.grants ?? []),
-            cloneAction: row.mode === 'managed'
-                ? inLocale(url, `/admin/roles/${encodeURIComponent(row.id)}/clone`)
-                : undefined,
-            cloneId: row.mode === 'managed' ? randomUUID() : undefined,
-            authorizationRevision: authorizationState.revision,
-            errors: state.errors,
-        }, frame),
-    });
+/** An access kind, a role source, or a boolean column, in the reader's language. */
+const userGroupLabel = (_, key, value) => {
+    const raw = value == null ? '' : String(value);
+    if (key === 'active')
+        return _(`user_backend.state.${raw === 'false' ? 'archived' : 'active'}`);
+    if (key === 'passwordReady')
+        return _(`user_backend.state.${raw === 'false' ? 'invitationPending' : 'passwordReady'}`);
+    if (!raw)
+        return _('backend.chrome.groupEmpty');
+    if (key === 'accessKind' && _.resolves(`user_backend.access.${raw}`))
+        return _(`user_backend.access.${raw}`);
+    if (key === 'mode' && _.resolves(`user_backend.role.${raw}`))
+        return _(`user_backend.role.${raw}`);
+    return raw;
 };
-const desired = (form, prefix) => Object.keys(form)
-    .filter((key) => key.startsWith(`${prefix}.`))
-    .map((key) => key.slice(prefix.length + 1));
-const failure = (ctx, url, req, result) => text(translatedErrors(ctx, url, req, result).join('\n'), { status: 400 });
 export const routes = {
-    ...accessRoutes,
+    ...accessPolicyRoutes,
+    ...managedRoleRoutes,
     '/admin/users': (ctx) => async (url, req) => {
         if (req.method !== 'GET')
             return text('GET', { status: 405 });
@@ -180,340 +132,89 @@ export const routes = {
         // deployments without one open the create action in the record modal.
         const deploymentCreatesAccounts = !!live.routes[accountCreationRoute];
         const _ = ctx.translate(ctx.localeOf(url, req));
+        const companyFilter = url.searchParams.get('company') ?? '';
+        const roleFilter = url.searchParams.get('role') ?? '';
+        const [companies, roles] = (await Promise.all([
+            ctx.call('company.listCompanies', {}, url, req),
+            ctx.call('user.listRoles', {}, url, req),
+        ]));
+        // The create action is offered to whoever the create modal would answer; a
+        // viewer who may only read people is not shown a button that opens a refusal.
+        const mayCreate = await ctx.allows('user.createUser', url, req);
         const includeArchived = url.searchParams.get('archived') === '1';
-        const search = searchOf(url) ?? '';
-        const currentPage = pageOf(url);
-        const locale = ctx.localeOf(url, req);
-        const needle = search.toLocaleLowerCase(locale);
-        const allRows = (await ctx.call('user.listUsers', { includeArchived }, url, req));
-        const matching = (needle
-            ? allRows.filter((row) => [row.name, row.login, row.email, row.accessKind].some((value) => String(value ?? '')
-                .toLocaleLowerCase(locale)
-                .includes(needle)))
-            : allRows).sort((left, right) => left.name.localeCompare(right.name, locale) || left.login.localeCompare(right.login, locale));
-        const rows = matching.slice((currentPage - 1) * PAGE_SIZE, currentPage * PAGE_SIZE);
+        const allRows = (await ctx.call('user.listUsers', {
+            includeArchived,
+            companyId: url.searchParams.get('company') || undefined,
+            roleId: url.searchParams.get('role') || undefined,
+        }, url, req));
         return adminPage(ctx, url, req, {
             title: 'user_backend.users.title',
             active: '/admin/users',
-            body: (_, frame) => {
-                frame.chrome = {
-                    search: {
-                        name: 'q',
-                        value: search,
-                        placeholder: _('user_backend.search.users'),
-                        keep: {
-                            ...(includeArchived ? { archived: '1' } : {}),
-                            ...(url.searchParams.get('lang') ? { lang: url.searchParams.get('lang') } : {}),
-                        },
-                    },
-                    pager: pager(url, currentPage, rows.length, matching.length),
-                };
+            body: async (_, frame) => {
                 const returnTo = safeUserReturnTo(url, `${url.pathname}${url.search}`);
-                return usersScreen(_, frame, {
-                    rows: rows.map((row) => ({
+                const search = await rowListSearch(ctx, url, req, {
+                    spec: userListSearch,
+                    rows: allRows.map((row) => ({
                         ...row,
                         // A row opens the person in the record modal; the collection behind it
-                        // keeps its search, page and archive state.
+                        // keeps its query, page and archive state.
                         detailHref: recordModalHref(`${url.pathname}${url.search}`, {
                             kind: 'user.user',
                             id: row.id,
                         }),
                     })),
-                    total: matching.length,
-                    createHref: deploymentCreatesAccounts
-                        ? withUserReturnTo(url, '/admin/users/new', returnTo)
-                        : recordModalCreateHref(`${url.pathname}${url.search}`, { kind: 'user.user' }),
-                    toggleHref: withParam(url, 'archived', includeArchived ? null : '1'),
-                    includeArchived,
+                    frame,
+                    name: 'user-people-filter',
+                    bodyId: 'user-people-list',
+                    functions: userSearchFunctions,
+                    labels: { searchPlaceholder: _('user_backend.search.users') },
+                    groupLabel: (key, value) => userGroupLabel(_, key, value),
+                });
+                search.frame.chrome = {
+                    ...search.frame.chrome,
+                    tailMenus: [
+                        listFilterMenu(url, 'company', _('user_backend.field.company'), companyFilter, companies),
+                        listFilterMenu(url, 'role', _('user_backend.field.role'), roleFilter, roles),
+                    ],
+                };
+                return usersScreen(_, search.frame, {
+                    clearHref: companyFilter || roleFilter || url.searchParams.get('q') ? inLocale(url, '/admin/users') : null,
+                    rows: search.rows,
+                    total: search.groups
+                        ? search.groups.reduce((sum, group) => sum + group.count, 0)
+                        : search.rows.length,
+                    createHref: !mayCreate
+                        ? null
+                        : deploymentCreatesAccounts
+                            ? withUserReturnTo(url, '/admin/users/new', returnTo)
+                            : recordModalCreateHref(`${url.pathname}${url.search}`, {
+                                kind: 'user.user',
+                            }),
+                    ...(search.groups ? { table: { groups: search.groups } } : {}),
                 });
             },
         });
     },
     '/admin/users/new': (ctx) => async (url, req) => {
-        // Identity adapters own this optional account-creation extension route.
+        if (req.method !== 'GET')
+            return text('GET', { status: 405 });
         if ((await ctx.live(req)).routes[accountCreationRoute])
             return seeOther(inLocale(url, accountCreationRoute));
-        const _ = ctx.translate(ctx.localeOf(url, req));
-        if (req.method !== 'GET' && req.method !== 'POST')
-            return text('GET or POST', { status: 405 });
-        if (req.method === 'POST' && crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const returnTo = safeUserReturnTo(url, url.searchParams.get('returnTo'));
-        const options = await accessOptions(ctx, url, req);
-        if (req.method === 'POST') {
-            const form = await readForm(req);
-            if (form.action !== 'save')
-                return text('invalid action', { status: 400 });
-            const id = validCreateId(form.id) ? form.id : randomUUID();
-            const result = await ctx.call('user.createUser', {
-                id,
-                login: form.login ?? '',
-                name: form.name ?? '',
-                email: form.email || null,
-                partnerId: form.partnerId || null,
-                accessKind: form.accessKind ?? 'internal',
-                superuser: form.superuser === '1',
-            }, url, req);
-            if (result.ok)
-                return seeOther(userDetailPath(url, id, returnTo));
-            return adminPage(ctx, url, req, {
-                title: 'user_backend.users.create',
-                active: '/admin/users',
-                body: (_, frame) => userFormScreen(_, { ...form, id }, {
-                    mode: 'create',
-                    action: withUserReturnTo(url, '/admin/users/new', returnTo),
-                    cancelHref: returnTo,
-                    ...options,
-                    errors: translatedErrors(ctx, url, req, result),
-                }, frame),
-            });
-        }
-        const id = randomUUID();
-        return adminPage(ctx, url, req, {
-            title: 'user_backend.users.create',
-            active: '/admin/users',
-            body: (_, frame) => userFormScreen(_, { id }, {
-                mode: 'create',
-                action: withUserReturnTo(url, '/admin/users/new', returnTo),
-                cancelHref: returnTo,
-                ...options,
-            }, frame),
-        });
+        return seeOther(recordModalCreateHref(new URL(safeUserReturnTo(url, url.searchParams.get('returnTo')), url), {
+            kind: 'user.user',
+        }));
     },
     '/admin/users/{id}': (ctx) => async (url, req, params) => {
-        if (req.method === 'GET')
-            return renderAccess(ctx, url, req, params.id);
-        if (req.method !== 'POST')
-            return text('GET or POST', { status: 405 });
-        if (crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const before = await userOf(ctx, url, req, params.id);
-        if (!before)
-            return text('Not found', { status: 404 });
-        const form = await readForm(req);
-        if (form.action && form.action !== 'save')
-            return text('invalid action', { status: 400 });
-        const returnTo = safeUserReturnTo(url, url.searchParams.get('returnTo'));
-        const result = (await ctx.call('user.saveUser', {
+        if (req.method !== 'GET')
+            return text('GET', { status: 405 });
+        const user = await ctx.call('user.getUser', { id: params.id }, url, req);
+        if (!user)
+            return text('not found', { status: 404 });
+        return seeOther(recordModalHref(new URL(safeUserReturnTo(url, url.searchParams.get('returnTo')), url), {
+            kind: 'user.user',
             id: params.id,
-            login: form.login ?? '',
-            name: form.name ?? '',
-            email: form.email || null,
-            partnerId: form.partnerId || null,
-            accessKind: form.accessKind ?? 'internal',
-            active: form.active === '1',
-            superuser: before.superuser === true,
-        }, url, req));
-        if (!result.ok)
-            return renderUser(ctx, url, req, params.id, {
-                errors: translatedErrors(ctx, url, req, result),
-                values: form,
-                returnTo,
-            });
-        if (Number(result.securityVersion) !== Number(before.securityVersion)) {
-            const sessions = await ctx.sessionsOf(url, req);
-            await sessions?.endUser(params.id);
-        }
-        return seeOther(userDetailPath(url, params.id, returnTo));
-    },
-    '/admin/users/{id}/companies': (ctx) => async (url, req, params) => {
-        if (req.method !== 'POST')
-            return text('POST', { status: 405 });
-        if (crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const row = await userOf(ctx, url, req, params.id);
-        if (!row)
-            return text(ctx.translate(ctx.localeOf(url, req))('user_backend.error.notFound'), { status: 404 });
-        const form = await readForm(req);
-        if (form.action !== 'save')
-            return text('invalid action', { status: 400 });
-        const selected = desired(form, 'company');
-        if (!selected.length)
-            return text(ctx.translate(ctx.localeOf(url, req))('user_backend.error.companyRequired'), {
-                status: 400,
-            });
-        for (const companyId of selected) {
-            const result = await ctx.call('user.grantCompany', { id: randomUUID(), userId: params.id, companyId }, url, req);
-            if (!result.ok)
-                return failure(ctx, url, req, result);
-        }
-        if (!selected.includes(String(row.defaultCompanyId ?? ''))) {
-            const companyId = selected[0];
-            const branches = (await ctx.call('company.listBranches', { companyId }, url, req));
-            const root = branches.find((branch) => branch.isRoot === true);
-            if (!root)
-                return text(ctx.translate(ctx.localeOf(url, req))('user_backend.error.rootMissing'), {
-                    status: 409,
-                });
-            const result = await ctx.call('user.setDefaultContext', { userId: params.id, companyId, branchId: root.id }, url, req);
-            if (!result.ok)
-                return failure(ctx, url, req, result);
-        }
-        for (const membership of row.memberships ?? [])
-            if (!selected.includes(membership.companyId)) {
-                const result = await ctx.call('user.revokeCompany', { userId: params.id, companyId: membership.companyId }, url, req);
-                if (!result.ok)
-                    return failure(ctx, url, req, result);
-            }
-        return seeOther(userDetailPath(url, params.id, safeUserReturnTo(url, url.searchParams.get('returnTo'))));
-    },
-    '/admin/users/{id}/branches': (ctx) => async (url, req, params) => {
-        if (req.method !== 'POST')
-            return text('POST', { status: 405 });
-        if (crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const row = await userOf(ctx, url, req, params.id);
-        if (!row)
-            return text(ctx.translate(ctx.localeOf(url, req))('user_backend.error.notFound'), { status: 404 });
-        const form = await readForm(req);
-        if (form.action !== 'save')
-            return text('invalid action', { status: 400 });
-        const selected = desired(form, 'branch');
-        for (const branchId of selected) {
-            const result = await ctx.call('user.grantBranch', { id: randomUUID(), userId: params.id, branchId }, url, req);
-            if (!result.ok)
-                return failure(ctx, url, req, result);
-        }
-        if (!selected.includes(String(row.defaultBranchId ?? ''))) {
-            const options = await accessOptions(ctx, url, req);
-            const branch = options.branches.find((item) => selected.includes(item.value) && item.companyId === row.defaultCompanyId);
-            if (!branch)
-                return text(ctx.translate(ctx.localeOf(url, req))('user_backend.error.branchDefaultRequired'), {
-                    status: 400,
-                });
-            const result = await ctx.call('user.setDefaultContext', { userId: params.id, companyId: row.defaultCompanyId, branchId: branch.value }, url, req);
-            if (!result.ok)
-                return failure(ctx, url, req, result);
-        }
-        for (const membership of row.branchMemberships ?? [])
-            if (!selected.includes(membership.branchId)) {
-                const result = await ctx.call('user.revokeBranch', { userId: params.id, branchId: membership.branchId }, url, req);
-                if (!result.ok)
-                    return failure(ctx, url, req, result);
-            }
-        return seeOther(userDetailPath(url, params.id, safeUserReturnTo(url, url.searchParams.get('returnTo'))));
-    },
-    '/admin/users/{id}/roles': (ctx) => async (url, req, params) => {
-        if (req.method !== 'POST')
-            return text('POST', { status: 405 });
-        if (crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const row = await userOf(ctx, url, req, params.id);
-        if (!row)
-            return text(ctx.translate(ctx.localeOf(url, req))('user_backend.error.notFound'), { status: 404 });
-        const form = await readForm(req);
-        if (form.action !== 'save')
-            return text('invalid action', { status: 400 });
-        const selected = desired(form, 'role');
-        for (const roleId of selected) {
-            const result = await ctx.call('user.assignRole', { id: randomUUID(), userId: params.id, roleId }, url, req);
-            if (!result.ok)
-                return failure(ctx, url, req, result);
-        }
-        for (const assignment of row.assignments ?? [])
-            if (!selected.includes(assignment.roleId))
-                await ctx.call('user.unassignRole', { userId: params.id, roleId: assignment.roleId }, url, req);
-        return seeOther(userDetailPath(url, params.id, safeUserReturnTo(url, url.searchParams.get('returnTo'))));
-    },
-    '/admin/users/{id}/scoped-roles': (ctx) => async (url, req, params) => {
-        if (req.method !== 'POST')
-            return text('POST', { status: 405 });
-        if (crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const row = await userOf(ctx, url, req, params.id);
-        if (!row)
-            return text(ctx.translate(ctx.localeOf(url, req))('user_backend.error.notFound'), { status: 404 });
-        const form = await readForm(req);
-        if (form.action !== 'assign' && form.action !== 'unassign')
-            return text('invalid action', { status: 400 });
-        const effective = (await ctx.call('user.effectiveAccess', { userId: params.id }, url, req));
-        const operationId = validCreateId(form.id) ? form.id : randomUUID();
-        // Taking a role away is the same act as giving one, and it needs the same
-        // record: an operation id to be replayed against, the revision the reader
-        // was looking at, and a reason. Without this the screen could only add.
-        if (form.action === 'unassign') {
-            // The screen names the assignment, not the pair behind it: a reader
-            // picks the row they can see, and which role at which scope that was is
-            // read back from the record rather than round-tripped through the form.
-            const held = (row.assignments ?? []).find((assignment) => String(assignment.id ?? '') === (form.assignmentId ?? ''));
-            if (!held)
-                return text('unknown assignment', { status: 400 });
-            const removal = await ctx.call('user.unassignScopedRole', {
-                userId: params.id,
-                roleId: held.roleId,
-                scopeKey: held.scopeKey ?? 'tenant',
-                expectedAuthorizationRevision: Number(form.expectedAuthorizationRevision ?? effective.revision),
-                idempotencyKey: form.idempotencyKey ?? operationId,
-                reason: form.reason ?? '',
-            }, url, req);
-            if (!removal.ok)
-                return renderUser(ctx, url, req, params.id, {
-                    errors: translatedErrors(ctx, url, req, removal),
-                    scopedRoleOperationId: operationId,
-                    returnTo: safeUserReturnTo(url, url.searchParams.get('returnTo')),
-                });
-            return seeOther(userDetailPath(url, params.id, safeUserReturnTo(url, url.searchParams.get('returnTo'))));
-        }
-        const result = await ctx.call('user.assignScopedRole', {
-            id: operationId,
-            userId: params.id,
-            roleId: form.roleId ?? '',
-            scopeKind: form.scopeKind ?? 'tenant',
-            companyId: form.companyId || null,
-            branchId: form.branchId || null,
-            expectedAuthorizationRevision: Number(form.expectedAuthorizationRevision ?? effective.revision),
-            idempotencyKey: form.idempotencyKey ?? form.id ?? randomUUID(),
-            reason: form.reason ?? '',
-        }, url, req);
-        if (!result.ok)
-            return renderUser(ctx, url, req, params.id, {
-                errors: translatedErrors(ctx, url, req, result),
-                scopedRoleOperationId: operationId,
-                scopedRoleValues: {
-                    roleId: form.roleId,
-                    scopeKind: form.scopeKind,
-                    companyId: form.companyId,
-                    branchId: form.branchId,
-                    reason: form.reason,
-                },
-                returnTo: safeUserReturnTo(url, url.searchParams.get('returnTo')),
-            });
-        return seeOther(userDetailPath(url, params.id, safeUserReturnTo(url, url.searchParams.get('returnTo'))));
-    },
-    '/admin/users/{id}/token': (ctx) => async (url, req, params) => {
-        if (req.method !== 'POST')
-            return text('POST', { status: 405 });
-        if (crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const form = await readForm(req);
-        const kind = form.action ?? '';
-        if (kind !== 'invitation' && kind !== 'reset')
-            return text('invalid action', { status: 400 });
-        const result = (await ctx.call('user.issueAuthToken', { userId: params.id, kind, realm: 'backend' }, url, req));
-        if (!result.ok || !result.token)
-            return renderUser(ctx, url, req, params.id, {
-                errors: translatedErrors(ctx, url, req, result),
-                returnTo: safeUserReturnTo(url, url.searchParams.get('returnTo')),
-            });
-        if (kind === 'reset')
-            await (await ctx.sessionsOf(url, req))?.endUser(params.id);
-        await ctx.call('user.recordSecurityEvent', { event: kind === 'reset' ? 'password.reset.issue' : 'invitation.issue', userId: params.id }, url, req);
-        const path = `/auth/${kind}?token=${encodeURIComponent(result.token)}`;
-        const live = await ctx.live(req);
-        const mailConnected = live.fills.some((fill) => fill.joint === 'user:auth.mail');
-        const integration = mailConnected
-            ? await ctx.joint(url, req, 'user:auth.mail', {
-                userId: params.id,
-                kind,
-                token: result.token,
-                expiresAt: result.expiresAt,
-            })
-            : undefined;
-        return renderUser(ctx, url, req, params.id, {
-            oneTimeLink: mailConnected ? null : path,
-            integration,
-            returnTo: safeUserReturnTo(url, url.searchParams.get('returnTo')),
-        });
+            tab: url.searchParams.get('tab') ?? 'overview',
+        }));
     },
     '/admin/users/{id}/sessions/{sessionId}': (ctx) => async (url, req, params) => {
         if (req.method !== 'POST')
@@ -531,11 +232,9 @@ export const routes = {
         const current = await sessions.of(req);
         if (!current)
             return text(ctx.translate(ctx.localeOf(url, req))('user_backend.error.unauthorized'), { status: 401 });
-        // Self-service may revoke another session of the same account. Looking at
-        // somebody else's sessions is an administrative operation and must cross
-        // the same permission boundary as the User detail screen.
+        // Session management remains self-service; administrators use password reset.
         if (params.id !== current.userId)
-            await ctx.call('user.getUser', { id: params.id }, url, req);
+            return text('Forbidden', { status: 403 });
         const held = (await sessions.store.listUser(params.id)).find((row) => row.id === params.sessionId);
         if (held)
             await sessions.store.destroy(held.id);
@@ -544,167 +243,6 @@ export const routes = {
             ? inLocale(url, '/admin/profile')
             : userDetailPath(url, params.id, safeUserReturnTo(url, url.searchParams.get('returnTo'))));
     },
-    '/admin/roles': (ctx) => async (url, req) => {
-        if (req.method !== 'GET')
-            return text('GET', { status: 405 });
-        const _ = ctx.translate(ctx.localeOf(url, req));
-        return adminPage(ctx, url, req, {
-            title: 'user_backend.roles.title',
-            active: '/admin/roles',
-            body: async (_, frame) => rolesScreen(_, frame, {
-                rows: (await rolesOf(ctx, url, req)).map((row) => ({
-                    ...row,
-                    detailHref: inLocale(url, `/admin/roles/${encodeURIComponent(row.id)}`),
-                })),
-                createHref: inLocale(url, '/admin/roles/new'),
-                presetsHref: inLocale(url, '/admin/permission-presets'),
-            }),
-        });
-    },
-    '/admin/roles/new': (ctx) => async (url, req) => {
-        const _ = ctx.translate(ctx.localeOf(url, req));
-        if (req.method === 'POST') {
-            if (crossSite(req))
-                return text('Forbidden', { status: 403 });
-            const form = await readForm(req);
-            if (form.action !== 'save')
-                return text('invalid action', { status: 400 });
-            const id = validCreateId(form.id) ? form.id : randomUUID();
-            const result = await ctx.call('user.saveRole', { id, name: form.name ?? '', description: form.description || null }, url, req);
-            if (result.ok)
-                return seeOther(inLocale(url, `/admin/roles/${encodeURIComponent(id)}`));
-            return adminPage(ctx, url, req, {
-                title: 'user_backend.roles.create',
-                active: '/admin/roles',
-                body: (_, frame) => roleScreen(_, { ...form, id }, {
-                    mode: 'create',
-                    action: inLocale(url, '/admin/roles/new'),
-                    cancelHref: inLocale(url, '/admin/roles'),
-                    errors: translatedErrors(ctx, url, req, result),
-                }, frame),
-            });
-        }
-        if (req.method !== 'GET')
-            return text('GET or POST', { status: 405 });
-        const id = randomUUID();
-        return adminPage(ctx, url, req, {
-            title: 'user_backend.roles.create',
-            active: '/admin/roles',
-            body: (_, frame) => roleScreen(_, { id }, {
-                mode: 'create',
-                action: inLocale(url, '/admin/roles/new'),
-                cancelHref: inLocale(url, '/admin/roles'),
-            }, frame),
-        });
-    },
-    '/admin/roles/{id}': (ctx) => async (url, req, params) => {
-        if (req.method === 'GET')
-            return renderRole(ctx, url, req, params.id);
-        if (req.method !== 'POST')
-            return text('GET or POST', { status: 405 });
-        if (crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const form = await readForm(req);
-        if (form.action && form.action !== 'save')
-            return text('invalid action', { status: 400 });
-        const result = await ctx.call('user.saveRole', { id: params.id, name: form.name ?? '', description: form.description || null }, url, req);
-        return result.ok
-            ? seeOther(inLocale(url, `/admin/roles/${encodeURIComponent(params.id)}`))
-            : renderRole(ctx, url, req, params.id, {
-                errors: translatedErrors(ctx, url, req, result),
-                values: form,
-            });
-    },
-    '/admin/roles/{id}/clone': (ctx) => async (url, req, params) => {
-        if (req.method !== 'POST')
-            return text('POST', { status: 405 });
-        if (crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const form = await readForm(req);
-        if (form.action !== 'clone')
-            return text('invalid action', { status: 400 });
-        const id = validCreateId(form.id) ? form.id : randomUUID();
-        const result = await ctx.call('user.cloneManagedRole', {
-            id,
-            sourceRoleId: params.id,
-            name: form.name ?? '',
-            expectedAuthorizationRevision: Number(form.expectedAuthorizationRevision ?? 0),
-            idempotencyKey: form.idempotencyKey ?? id,
-            reason: form.reason ?? '',
-        }, url, req);
-        return result.ok
-            ? seeOther(inLocale(url, `/admin/roles/${encodeURIComponent(id)}`))
-            : renderRole(ctx, url, req, params.id, {
-                errors: translatedErrors(ctx, url, req, result),
-            });
-    },
-    '/admin/roles/{id}/permissions': (ctx) => async (url, req, params) => {
-        if (req.method !== 'POST')
-            return text('POST', { status: 405 });
-        if (crossSite(req))
-            return text('Forbidden', { status: 403 });
-        const form = await readForm(req);
-        if (form.action && form.action !== 'save')
-            return text('invalid action', { status: 400 });
-        const moduleName = form.module ?? '';
-        const selected = new Set(desired(form, 'permission'));
-        const catalogue = (await ctx.call('user.permissionCatalogue', {}, url, req));
-        const role = (await ctx.call('user.getRole', { id: params.id }, url, req));
-        const held = new Set(role.grants?.map((grant) => grant.fnKey) ?? []);
-        for (const permission of catalogue.filter((item) => item.module === moduleName)) {
-            const group = `${permission.module}:${permission.task}`;
-            if (selected.has(group) && !held.has(permission.key))
-                await ctx.call('user.grantFunction', { id: randomUUID(), roleId: params.id, fnKey: permission.key }, url, req);
-            if (!selected.has(group) && held.has(permission.key))
-                await ctx.call('user.revokeFunction', { roleId: params.id, fnKey: permission.key }, url, req);
-        }
-        return seeOther(inLocale(url, `/admin/roles/${encodeURIComponent(params.id)}`));
-    },
-    '/admin/permission-presets': (ctx) => async (url, req) => {
-        const _ = ctx.translate(ctx.localeOf(url, req));
-        const catalogue = (await ctx.call('user.permissionCatalogue', {}, url, req));
-        const moduleNames = [...new Set(catalogue.map((item) => item.module))];
-        const modules = moduleNames.map((name) => ({
-            value: name,
-            label: _(`${name}.app.title`),
-        }));
-        if (req.method === 'POST') {
-            if (crossSite(req))
-                return text('Forbidden', { status: 403 });
-            const form = await readForm(req);
-            if (form.action !== 'save')
-                return text('invalid action', { status: 400 });
-            const result = (await ctx.call('user.applyPreset', { module: form.module ?? '', level: form.level ?? '' }, url, req));
-            if (!result.ok)
-                return adminPage(ctx, url, req, {
-                    title: 'user_backend.presets.title',
-                    active: '/admin/roles',
-                    body: (_, frame) => presetsScreen(_, frame, {
-                        modules,
-                        action: inLocale(url, '/admin/permission-presets'),
-                        values: form,
-                        errors: translatedErrors(ctx, url, req, result),
-                    }),
-                });
-            const next = new URL(inLocale(url, '/admin/permission-presets'), url);
-            next.searchParams.set('appliedRole', result.roleId ?? '');
-            next.searchParams.set('granted', String(result.granted ?? 0));
-            return seeOther(`${next.pathname}${next.search}`);
-        }
-        else if (req.method !== 'GET')
-            return text('GET or POST', { status: 405 });
-        const appliedRole = url.searchParams.get('appliedRole');
-        const granted = url.searchParams.get('granted');
-        return adminPage(ctx, url, req, {
-            title: 'user_backend.presets.title',
-            active: '/admin/roles',
-            body: (_, frame) => presetsScreen(_, frame, {
-                modules,
-                action: inLocale(url, '/admin/permission-presets'),
-                result: appliedRole ? `${appliedRole}: ${granted ?? 0}` : undefined,
-            }),
-        });
-    },
     '/admin/profile': (ctx) => async (url, req) => {
         if (req.method !== 'GET')
             return text('GET', { status: 405 });