@marinoscar/platform-web 0.1.0-next.3 → 0.1.0-next.4

package/dist/identity/ui/users/AllowlistTable.js

@@ -0,0 +1,115 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useMemo, useState } from 'react';
+import { Alert, Box, Button, Paper, Stack, Typography } from '@mui/material';
+import { Add as AddIcon, Delete as DeleteIcon } from '@mui/icons-material';
+import { IdentityTable as DataTable } from '../table.js';
+import { useAllowlist } from '../../headless/index.js';
+import { usePermissions } from '../../headless/index.js';
+import { useIdentityApi } from '../../headless/index.js';
+import { AddEmailDialog } from './AddEmailDialog.js';
+import { TABLE_ID, asAllowlistSortField, buildAllowlistColumns } from './allowlistColumns.js';
+/** The `status` query param, read out of the filter model as a SCALAR. */
+function readStatusFilter(filters) {
+    const found = filters.find((filter) => filter.columnId === 'status' && filter.operator === 'is');
+    return found?.value === 'pending' || found?.value === 'claimed' ? found.value : 'all';
+}
+/**
+ * The email allowlist: paging, search, the pending/claimed filter, add and
+ * remove (`allowlist:write`). The Allowlist tab of {@link UsersPage}.
+ *
+ * @returns the component.
+ *
+ * @stability stable
+ */
+export function AllowlistTable() {
+    const { entries, total, isLoading, error, fetchAllowlist, addEmail, removeEmail } = useAllowlist();
+    const identity = useIdentityApi();
+    const { hasPermission } = usePermissions();
+    const [search, setSearch] = useState('');
+    const [page, setPage] = useState(0);
+    const [pageSize, setPageSize] = useState(10);
+    const [sort, setSort] = useState(null);
+    const [filters, setFilters] = useState([]);
+    const [dialogOpen, setDialogOpen] = useState(false);
+    const columns = useMemo(() => buildAllowlistColumns(), []);
+    // --- Query params, flattened to scalars ------------------------------------
+    const status = useMemo(() => readStatusFilter(filters), [filters]);
+    const sortField = asAllowlistSortField(sort?.field);
+    const sortDirection = sort?.direction;
+    useEffect(() => {
+        fetchAllowlist({
+            page: page + 1,
+            pageSize,
+            search: search || undefined,
+            status,
+            ...(sortField ? { sortBy: sortField, sortOrder: sortDirection } : {}),
+        });
+        // Scalars only — `entries` is replaced on every fetch, so nothing here may
+        // depend on a row object.
+    }, [page, pageSize, search, status, sortField, sortDirection, fetchAllowlist]);
+    // --- Row actions ------------------------------------------------------------
+    const canWrite = hasPermission('allowlist:write');
+    const rowActions = useMemo(() => {
+        // DELETE /api/allowlist/{id} enforces allowlist:write. Gating the ARRAY (as
+        // opposed to a rendered `<TableCell>`) removes the control from the grid,
+        // the tablet row expander and the card header in one move.
+        if (!canWrite)
+            return [];
+        return [
+            {
+                id: 'remove',
+                label: 'Remove',
+                icon: _jsx(DeleteIcon, { fontSize: "small" }),
+                destructive: true,
+                // The server refuses this too (`allowlist.service.ts` raises 400 on a
+                // claimed entry); disabling keeps the control and its tooltip
+                // discoverable rather than making the row silently actionless.
+                disabled: (entry) => Boolean(entry.claimedBy),
+                confirm: {
+                    title: 'Remove from allowlist?',
+                    description: (entry) => `${entry.email} will no longer be able to sign in. This cannot be undone.`,
+                    confirmLabel: 'Remove',
+                },
+                onClick: (entry) => {
+                    void removeEmail(entry.id).catch(() => {
+                        /* surfaced through the hook's `error` */
+                    });
+                },
+            },
+        ];
+    }, [canWrite, removeEmail]);
+    const emptyState = useMemo(() => (_jsx(Typography, { color: "text.secondary", children: search ? 'No emails found matching your search' : 'No emails in allowlist' })), [search]);
+    return (_jsxs(Paper, { sx: { width: '100%', p: 2 }, children: [_jsxs(Stack, { direction: { xs: 'column', sm: 'row' }, spacing: 1, sx: { mb: 2, alignItems: { sm: 'center' }, justifyContent: 'space-between' }, children: [_jsx(Typography, { variant: "h6", component: "h2", children: "Email allowlist" }), canWrite && (_jsx(Button, { variant: "contained", startIcon: _jsx(AddIcon, {}), onClick: () => setDialogOpen(true), children: "Add Email" }))] }), error && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error })), _jsx(Box, { sx: { minWidth: 0 }, children: _jsx(DataTable, { tableId: TABLE_ID, "data-testid": "admin-allowlist-table", ariaLabel: "Email allowlist", columns: columns, rows: entries, rowId: (entry) => entry.id, loading: isLoading, emptyState: emptyState, pagination: {
+                        page,
+                        pageSize,
+                        total,
+                        pageSizeOptions: [5, 10, 25, 50],
+                        onPaginationChange: (next) => {
+                            setPage(next.page);
+                            setPageSize(next.pageSize);
+                        },
+                    }, sort: { sort, onSortChange: setSort }, filters: filters, onFiltersChange: (next) => {
+                        setFilters(next);
+                        setPage(0);
+                    }, quickSearch: {
+                        value: search,
+                        ariaLabel: 'Search by email',
+                        placeholder: 'Search by email',
+                        onChange: (next) => {
+                            setSearch(next);
+                            setPage(0);
+                        },
+                    }, rowActions: rowActions, csvExport: {
+                        filename: 'allowlist',
+                        fetchAllRows: async ({ page: exportPage, pageSize: exportPageSize }) => {
+                            const response = await identity.getAllowlist({
+                                page: exportPage + 1,
+                                pageSize: exportPageSize,
+                                search: search || undefined,
+                                status,
+                            });
+                            return response.items;
+                        },
+                    } }) }), _jsx(AddEmailDialog, { open: dialogOpen, onClose: () => setDialogOpen(false), onAdd: addEmail })] }));
+}
+//# sourceMappingURL=AllowlistTable.js.map

package/dist/identity/ui/users/AllowlistTable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AllowlistTable.js","sourceRoot":"","sources":["../../../../src/identity/ui/users/AllowlistTable.tsx"],"names":[],"mappings":";AA2BA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,aAAa,CAAC;AAMzD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI9F,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,OAA8B;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CACrE,CAAC;IACF,OAAO,KAAK,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,GAC/E,YAAY,EAAE,CAAC;IACjB,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;IAE3C,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAA4B,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAwB,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,qBAAqB,EAAE,EAAE,EAAE,CAAC,CAAC;IAE3D,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,EAAE,SAAS,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,cAAc,CAAC;YACb,IAAI,EAAE,IAAI,GAAG,CAAC;YACd,QAAQ;YACR,MAAM,EAAE,MAAM,IAAI,SAAS;YAC3B,MAAM;YACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,2EAA2E;QAC3E,0BAA0B;IAC5B,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IAE/E,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9B,4EAA4E;QAC5E,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,CAAC,QAAQ;YAAE,OAAO,EAA6C,CAAC;QAEpE,OAAO;YACL;gBACE,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,KAAC,UAAU,IAAC,QAAQ,EAAC,OAAO,GAAG;gBACrC,WAAW,EAAE,IAAI;gBACjB,sEAAsE;gBACtE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC7C,OAAO,EAAE;oBACP,KAAK,EAAE,wBAAwB;oBAC/B,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,GAAG,KAAK,CAAC,KAAK,4DAA4D;oBAC5E,YAAY,EAAE,QAAQ;iBACvB;gBACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;wBACpC,yCAAyC;oBAC3C,CAAC,CAAC,CAAC;gBACL,CAAC;aACF;SACgD,CAAC;IACtD,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAE5B,MAAM,UAAU,GAAG,OAAO,CACxB,GAAG,EAAE,CAAC,CACJ,KAAC,UAAU,IAAC,KAAK,EAAC,gBAAgB,YAC/B,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,wBAAwB,GAChE,CACd,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,CACL,MAAC,KAAK,IAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,aAEhC,MAAC,KAAK,IACJ,SAAS,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EACtC,OAAO,EAAE,CAAC,EACV,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,aAE5E,KAAC,UAAU,IAAC,OAAO,EAAC,IAAI,EAAC,SAAS,EAAC,IAAI,gCAE1B,EACZ,QAAQ,IAAI,CACX,KAAC,MAAM,IACL,OAAO,EAAC,WAAW,EACnB,SAAS,EAAE,KAAC,OAAO,KAAG,EACtB,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,0BAG3B,CACV,IACK,EAEP,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAClC,KAAK,GACA,CACT,EAED,KAAC,GAAG,IAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,YACtB,KAAC,SAAS,IACR,OAAO,EAAE,QAAQ,iBACL,uBAAuB,EACnC,SAAS,EAAC,iBAAiB,EAC3B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAC1B,OAAO,EAAE,SAAS,EAClB,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE;wBACV,IAAI;wBACJ,QAAQ;wBACR,KAAK;wBACL,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;wBAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE;4BAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4BACnB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC7B,CAAC;qBACF,EACD,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EACrC,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE;wBACxB,UAAU,CAAC,IAAI,CAAC,CAAC;wBACjB,OAAO,CAAC,CAAC,CAAC,CAAC;oBACb,CAAC,EACD,WAAW,EAAE;wBACX,KAAK,EAAE,MAAM;wBACb,SAAS,EAAE,iBAAiB;wBAC5B,WAAW,EAAE,iBAAiB;wBAC9B,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;4BACjB,SAAS,CAAC,IAAI,CAAC,CAAC;4BAChB,OAAO,CAAC,CAAC,CAAC,CAAC;wBACb,CAAC;qBACF,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE;wBACT,QAAQ,EAAE,WAAW;wBACrB,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE;4BACrE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;gCAC3C,IAAI,EAAE,UAAU,GAAG,CAAC;gCACpB,QAAQ,EAAE,cAAc;gCACxB,MAAM,EAAE,MAAM,IAAI,SAAS;gCAC3B,MAAM;6BACP,CAAC,CAAC;4BACH,OAAO,QAAQ,CAAC,KAAK,CAAC;wBACxB,CAAC;qBACF,GACD,GACE,EAEN,KAAC,cAAc,IACb,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EACnC,KAAK,EAAE,QAAQ,GACf,IACI,CACT,CAAC;AACJ,CAAC"}

package/dist/identity/ui/users/ManageRolesDialog.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Admin → Users: the "Manage roles" dialog (issue #67, epic #51).
+ *
+ * ## Why a dialog and not the nested menu it replaces
+ *
+ * `UserList` used to open a `Menu`, then a SECOND `Menu` anchored to the same
+ * element, holding one checkbox per role. That shape has no card equivalent:
+ * the mobile renderer gives a row exactly one trailing control, and a submenu
+ * anchored to a menu item is not a thing a card header can host. Rather than
+ * teach the card renderer about nested menus, the multi-select becomes what it
+ * always was — a small form — and the row action that opens it is a single
+ * `DataTableRowAction`, identical in all three layouts.
+ *
+ * ## Why the validation moved inside
+ *
+ * The old code called `window.alert('User must have at least one role')` from
+ * the menu's click handler. A native alert is unstyled, unreachable by the
+ * assistive-technology conventions the rest of the app follows, blocks the
+ * event loop, and — the practical problem — cannot be asserted on without
+ * stubbing a global. The rule lives here now as inline validation: the empty
+ * selection is describable, the Save button is disabled, and the message is in
+ * the accessibility tree next to the control that caused it.
+ *
+ * The API enforces the same rule (`updateUserRolesSchema` requires
+ * `min(1)`), so this is a second line, not the only one.
+ */
+import type { RoleDescriptor, UserListItem } from '../../headless/index.js';
+export interface ManageRolesDialogProps {
+    /** The user being edited, or `null` when the dialog is closed. */
+    user: UserListItem | null;
+    /**
+     * The roles offered: the ones the API says may be assigned
+     * (`GET /api/roles`, `assignable` only). A role the user holds that is not
+     * in this list (the `org_admin` an administrator is listed with, a role the
+     * application manages itself) is neither shown nor sent back.
+     */
+    roles: readonly RoleDescriptor[];
+    onClose: () => void;
+    onSave: (userId: string, roles: string[]) => Promise<void>;
+}
+export declare function ManageRolesDialog({ user, roles, onClose, onSave }: ManageRolesDialogProps): import("react").JSX.Element;
+//# sourceMappingURL=ManageRolesDialog.d.ts.map

package/dist/identity/ui/users/ManageRolesDialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ManageRolesDialog.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/users/ManageRolesDialog.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAgBH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5E,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAID,wBAAgB,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,sBAAsB,+BA8FzF"}

package/dist/identity/ui/users/ManageRolesDialog.js

@@ -0,0 +1,73 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Admin → Users: the "Manage roles" dialog (issue #67, epic #51).
+ *
+ * ## Why a dialog and not the nested menu it replaces
+ *
+ * `UserList` used to open a `Menu`, then a SECOND `Menu` anchored to the same
+ * element, holding one checkbox per role. That shape has no card equivalent:
+ * the mobile renderer gives a row exactly one trailing control, and a submenu
+ * anchored to a menu item is not a thing a card header can host. Rather than
+ * teach the card renderer about nested menus, the multi-select becomes what it
+ * always was — a small form — and the row action that opens it is a single
+ * `DataTableRowAction`, identical in all three layouts.
+ *
+ * ## Why the validation moved inside
+ *
+ * The old code called `window.alert('User must have at least one role')` from
+ * the menu's click handler. A native alert is unstyled, unreachable by the
+ * assistive-technology conventions the rest of the app follows, blocks the
+ * event loop, and — the practical problem — cannot be asserted on without
+ * stubbing a global. The rule lives here now as inline validation: the empty
+ * selection is describable, the Save button is disabled, and the message is in
+ * the accessibility tree next to the control that caused it.
+ *
+ * The API enforces the same rule (`updateUserRolesSchema` requires
+ * `min(1)`), so this is a second line, not the only one.
+ */
+import { useEffect, useState } from 'react';
+import { Alert, Button, Checkbox, Dialog, DialogActions, DialogContent, DialogContentText, DialogTitle, FormControlLabel, FormGroup, Stack, } from '@mui/material';
+const EMPTY_ROLES_MESSAGE = 'User must have at least one role';
+export function ManageRolesDialog({ user, roles, onClose, onSave }) {
+    const [selected, setSelected] = useState([]);
+    const [saving, setSaving] = useState(false);
+    const [error, setError] = useState(null);
+    // Re-seed whenever a different user is opened. Keyed on the user ID (a
+    // scalar), never on the user OBJECT: `useUsers` replaces every row object on
+    // each refetch, and keying on identity would wipe an in-progress edit on the
+    // next poll.
+    const userId = user?.id ?? null;
+    const rolesKey = user?.roles.join(',') ?? '';
+    const offeredKey = roles.map((role) => role.id).join(',');
+    useEffect(() => {
+        // Only the roles this dialog offers. The API also reports the org role an
+        // administrator holds alongside `admin` (`org_admin`, issue #723), which is
+        // implied by `admin` and is not assigned here; carrying it through a save
+        // would keep it after `admin` is unticked.
+        const offered = offeredKey ? offeredKey.split(',') : [];
+        setSelected(rolesKey ? rolesKey.split(',').filter((role) => offered.includes(role)) : []);
+        setError(null);
+    }, [userId, rolesKey, offeredKey]);
+    const toggle = (role) => {
+        setSelected((current) => current.includes(role) ? current.filter((r) => r !== role) : [...current, role]);
+    };
+    const isEmpty = selected.length === 0;
+    const handleSave = async () => {
+        if (!user || isEmpty)
+            return;
+        setSaving(true);
+        setError(null);
+        try {
+            await onSave(user.id, selected);
+            onClose();
+        }
+        catch (err) {
+            setError(err instanceof Error ? err.message : 'Failed to update roles');
+        }
+        finally {
+            setSaving(false);
+        }
+    };
+    return (_jsxs(Dialog, { open: Boolean(user), onClose: saving ? undefined : onClose, maxWidth: "xs", fullWidth: true, children: [_jsx(DialogTitle, { children: "Manage roles" }), _jsx(DialogContent, { children: _jsxs(Stack, { spacing: 2, sx: { pt: 1 }, children: [_jsx(DialogContentText, { children: user ? `Choose the roles for ${user.email}.` : '' }), error && _jsx(Alert, { severity: "error", children: error }), isEmpty && (_jsx(Alert, { severity: "warning", id: "manage-roles-empty", children: EMPTY_ROLES_MESSAGE })), _jsx(FormGroup, { "aria-label": "Roles", "aria-describedby": isEmpty ? 'manage-roles-empty' : undefined, children: roles.map((role) => (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: selected.includes(role.id), onChange: () => toggle(role.id), disabled: saving }), label: role.label }, role.id))) })] }) }), _jsxs(DialogActions, { children: [_jsx(Button, { onClick: onClose, disabled: saving, children: "Cancel" }), _jsx(Button, { variant: "contained", onClick: handleSave, disabled: isEmpty || saving, children: saving ? 'Saving…' : 'Save roles' })] })] }));
+}
+//# sourceMappingURL=ManageRolesDialog.js.map

package/dist/identity/ui/users/ManageRolesDialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ManageRolesDialog.js","sourceRoot":"","sources":["../../../../src/identity/ui/users/ManageRolesDialog.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EACL,KAAK,EACL,MAAM,EACN,QAAQ,EACR,MAAM,EACN,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,KAAK,GACN,MAAM,eAAe,CAAC;AAiBvB,MAAM,mBAAmB,GAAG,kCAAkC,CAAC;AAE/D,MAAM,UAAU,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAA0B;IACxF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAW,EAAE,CAAC,CAAC;IACvD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAExD,uEAAuE;IACvE,6EAA6E;IAC7E,6EAA6E;IAC7E,aAAa;IACb,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,SAAS,CAAC,GAAG,EAAE;QACb,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,2CAA2C;QAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;QAC9B,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,CAChF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IAEtC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,IAAI,CAAC,IAAI,IAAI,OAAO;YAAE,OAAO;QAC7B,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CACL,MAAC,MAAM,IAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAC,IAAI,EAAC,SAAS,mBACzF,KAAC,WAAW,+BAA2B,EACvC,KAAC,aAAa,cACZ,MAAC,KAAK,IAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,aAC9B,KAAC,iBAAiB,cACf,IAAI,CAAC,CAAC,CAAC,wBAAwB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAChC,EAEnB,KAAK,IAAI,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,YAAE,KAAK,GAAS,EAKhD,OAAO,IAAI,CACV,KAAC,KAAK,IAAC,QAAQ,EAAC,SAAS,EAAC,EAAE,EAAC,oBAAoB,YAC9C,mBAAmB,GACd,CACT,EAED,KAAC,SAAS,kBACG,OAAO,sBACA,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,YAE3D,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,KAAC,gBAAgB,IAEf,OAAO,EACL,KAAC,QAAQ,IACP,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EACnC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAC/B,QAAQ,EAAE,MAAM,GAChB,EAEJ,KAAK,EAAE,IAAI,CAAC,KAAK,IARZ,IAAI,CAAC,EAAE,CASZ,CACH,CAAC,GACQ,IACN,GACM,EAChB,MAAC,aAAa,eACZ,KAAC,MAAM,IAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAEjC,EACT,KAAC,MAAM,IAAC,OAAO,EAAC,WAAW,EAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,IAAI,MAAM,YACzE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,GAC3B,IACK,IACT,CACV,CAAC;AACJ,CAAC"}

package/dist/identity/ui/users/UserList.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Admin → Users (issue #67, epic #51).
+ *
+ * The hand-rolled `TableContainer` / `TablePagination` / `MoreVert` block this
+ * file used to be is gone wholesale — not wrapped — and replaced by the shared
+ * `DataTable`. What remains here is state: the query this page sends, the
+ * selection it holds, and the dialog its row action opens.
+ *
+ * Four rules from the migration brief are load-bearing in this file:
+ *
+ *  1. **The table renders unconditionally; `loading` is a prop.** The previous
+ *     `{isLoading ? <CircularProgress/> : <Table/>}` ternary UNMOUNTED the
+ *     whole table on every refetch, taking row expansion, scroll offset and
+ *     grid focus with it. `DataTable` draws a loading overlay above rows that
+ *     stay on screen.
+ *  2. **Refetch effects key on SCALARS.** Never on `filters` (an array) or on a
+ *     row object: `useUsers` hands back brand-new objects on every fetch, so an
+ *     effect keyed on one would refetch forever.
+ *  3. **The row-action ARRAY is gated, never a rendered control.** A user
+ *     without `users:write` gets an array that does not CONTAIN the activate /
+ *     deactivate actions, so they are absent from the grid, the tablet expander
+ *     and the card header at once. The old code hid a `<TableCell>` — a
+ *     grid-shaped gate no card renderer can reproduce.
+ *  4. **A per-row `disabled` replaces "render nothing".** "Activate user" stays
+ *     visible (and tooltipped) on an already-active user rather than vanishing,
+ *     so the set of actions does not change shape row to row.
+ */
+import type { ReactElement } from 'react';
+import type { TableSlots } from '../../../core/index.js';
+import type { IdentityTableColumn } from '../../headless/index.js';
+import type { UserListItem } from '../../headless/index.js';
+/**
+ * The table slots of {@link UserList} (and, passed through, of `UsersPage`):
+ * the packaged-page table contract over a user row. `Columns` receives the
+ * list's own columns (`buildUserColumns`, plus the `RowActions` and
+ * `DetailPanel` columns when those slots are set) and returns the ones to draw;
+ * `Toolbar` is drawn above the table.
+ *
+ * @example
+ * ```tsx
+ * <UserList slots={{ Columns: (base) => [...base, planColumn] }} />
+ * ```
+ *
+ * @extensionPoint slot
+ * @stability experimental
+ */
+export type UserListSlots = TableSlots<UserListItem, IdentityTableColumn<UserListItem>>;
+/**
+ * Props of {@link UserList}.
+ *
+ * @stability experimental
+ */
+export interface UserListProps {
+    /** Add columns, per-row actions, a detail view or toolbar controls to the table. */
+    slots?: UserListSlots;
+}
+/**
+ * The admin user list: server-side paging, search, sort and filters, the
+ * activate/deactivate actions (`users:write`) and Manage roles (`rbac:manage`).
+ * The Users tab of {@link UsersPage}.
+ *
+ * @param props - see {@link UserListProps}.
+ * @returns the component.
+ *
+ * @stability stable
+ */
+export declare function UserList({ slots }?: UserListProps): ReactElement;
+//# sourceMappingURL=UserList.d.ts.map

package/dist/identity/ui/users/UserList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserList.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/users/UserList.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAO1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EACV,mBAAmB,EAIpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAoB5D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,oFAAoF;IACpF,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAE,aAAkB,GAAG,YAAY,CAmMpE"}

package/dist/identity/ui/users/UserList.js

@@ -0,0 +1,169 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useMemo, useState } from 'react';
+import { Alert, Box, Paper, Typography } from '@mui/material';
+import CheckCircleIcon from '@mui/icons-material/CheckCircle';
+import BlockIcon from '@mui/icons-material/Block';
+import SecurityIcon from '@mui/icons-material/Security';
+import { useTableSlotColumns } from '../../../core/index.js';
+import { IdentityTable as DataTable } from '../table.js';
+import { useOptionalAuth, useRoles, useUsers } from '../../headless/index.js';
+import { usePermissions } from '../../headless/index.js';
+import { useIdentityApi } from '../../headless/index.js';
+import { ManageRolesDialog } from './ManageRolesDialog.js';
+import { TABLE_ID, asUserSortField, buildUserColumns } from './userListColumns.js';
+/** The org role an administrator holds because of `admin`; set by the API, not offered here. */
+const IMPLIED_BY_ADMIN = 'org_admin';
+/**
+ * Read a single-operand `is` filter out of the model as a plain string.
+ *
+ * Returning a SCALAR (not the filter object) is what lets the refetch effect
+ * below depend on it directly — see rule 2 in the module docblock.
+ */
+function readIsFilter(filters, columnId) {
+    const found = filters.find((filter) => filter.columnId === columnId && filter.operator === 'is');
+    return typeof found?.value === 'string' && found.value ? found.value : undefined;
+}
+/**
+ * The admin user list: server-side paging, search, sort and filters, the
+ * activate/deactivate actions (`users:write`) and Manage roles (`rbac:manage`).
+ * The Users tab of {@link UsersPage}.
+ *
+ * @param props - see {@link UserListProps}.
+ * @returns the component.
+ *
+ * @stability stable
+ */
+export function UserList({ slots } = {}) {
+    const { users, total, isLoading, error, fetchUsers, updateUser, updateUserRoles } = useUsers();
+    const identity = useIdentityApi();
+    const { hasPermission } = usePermissions();
+    const [search, setSearch] = useState('');
+    const [page, setPage] = useState(0);
+    const [pageSize, setPageSize] = useState(10);
+    const [sort, setSort] = useState(null);
+    const [filters, setFilters] = useState([]);
+    const [selectedIds, setSelectedIds] = useState(new Set());
+    const [rolesDialogUser, setRolesDialogUser] = useState(null);
+    // The roles come from the API (`GET /api/roles`), never from a list in this
+    // file: the system roles, and, outside multi-organization mode, the org roles
+    // too (`PUT /users/:id/roles` sets the default-organization membership role in
+    // single mode). `org_admin` is not offered: `admin` implies it.
+    const tenancyMode = useOptionalAuth()?.user?.tenancyMode;
+    const systemRoles = useRoles('system');
+    const orgRoles = useRoles('org', { enabled: tenancyMode !== 'multi' });
+    const knownRoles = useMemo(() => [...systemRoles.roles, ...orgRoles.roles.filter((role) => role.id !== IMPLIED_BY_ADMIN)], [systemRoles.roles, orgRoles.roles]);
+    const offeredRoles = useMemo(() => knownRoles.filter((role) => role.assignable), [knownRoles]);
+    const baseColumns = useMemo(() => buildUserColumns(knownRoles), [knownRoles]);
+    // PP-14.25: the app's table slots. With none, `columns` IS `baseColumns`.
+    const columns = useTableSlotColumns(baseColumns, slots);
+    const Toolbar = slots?.Toolbar;
+    // --- Query params, flattened to scalars ------------------------------------
+    const roleFilter = useMemo(() => readIsFilter(filters, 'roles'), [filters]);
+    const statusFilter = useMemo(() => readIsFilter(filters, 'isActive'), [filters]);
+    // Narrowed against the endpoint's `sortBy` enum: a stored layout is
+    // user-writable JSON, so an unrecognised field is dropped rather than sent.
+    const sortField = asUserSortField(sort?.field);
+    const sortDirection = sort?.direction;
+    useEffect(() => {
+        fetchUsers({
+            page: page + 1, // the table is zero-based, the API is one-based
+            pageSize,
+            search: search || undefined,
+            role: roleFilter,
+            isActive: statusFilter === undefined ? undefined : statusFilter === 'active',
+            ...(sortField ? { sortBy: sortField, sortOrder: sortDirection } : {}),
+        });
+        // Every dependency is a scalar. `fetchUsers` is `useCallback([])`-stable.
+    }, [
+        page,
+        pageSize,
+        search,
+        roleFilter,
+        statusFilter,
+        sortField,
+        sortDirection,
+        fetchUsers,
+    ]);
+    // --- Row actions ------------------------------------------------------------
+    // `hasPermission` is memoized by `usePermissions`, so keying this on it is
+    // safe and the array keeps its identity between renders.
+    const rowActions = useMemo(() => {
+        const actions = [];
+        // PATCH /api/users/{id} enforces users:read + users:write.
+        if (hasPermission('users:write')) {
+            actions.push({
+                id: 'activate',
+                label: 'Activate user',
+                icon: _jsx(CheckCircleIcon, { fontSize: "small" }),
+                disabled: (user) => user.isActive,
+                onClick: (user) => {
+                    void updateUser(user.id, { isActive: true }).catch(() => {
+                        /* surfaced through the hook's `error` */
+                    });
+                },
+            }, {
+                id: 'deactivate',
+                label: 'Deactivate user',
+                icon: _jsx(BlockIcon, { fontSize: "small" }),
+                destructive: true,
+                disabled: (user) => !user.isActive,
+                onClick: (user) => {
+                    void updateUser(user.id, { isActive: false }).catch(() => {
+                        /* surfaced through the hook's `error` */
+                    });
+                },
+            });
+        }
+        // PUT /api/users/{id}/roles enforces rbac:manage — a different permission
+        // from the two above, so it is a separate gate rather than one `isAdmin`.
+        if (hasPermission('rbac:manage')) {
+            actions.push({
+                id: 'manage-roles',
+                label: 'Manage roles',
+                icon: _jsx(SecurityIcon, { fontSize: "small" }),
+                onClick: (user) => setRolesDialogUser(user),
+            });
+        }
+        return actions;
+    }, [hasPermission, updateUser]);
+    const emptyState = useMemo(() => (_jsx(Typography, { color: "text.secondary", children: search ? 'No users found matching your search' : 'No users found' })), [search]);
+    return (_jsxs(Paper, { sx: { width: '100%', p: 2 }, children: [error && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error })), Toolbar && _jsx(Toolbar, {}), _jsx(Box, { sx: { minWidth: 0 }, children: _jsx(DataTable, { tableId: TABLE_ID, "data-testid": "admin-users-table", ariaLabel: "Users", columns: columns, rows: users, rowId: (user) => user.id, loading: isLoading, emptyState: emptyState, pagination: {
+                        page,
+                        pageSize,
+                        total,
+                        pageSizeOptions: [5, 10, 25, 50],
+                        onPaginationChange: (next) => {
+                            setPage(next.page);
+                            setPageSize(next.pageSize);
+                        },
+                    }, sort: { sort, onSortChange: setSort }, filters: filters, onFiltersChange: (next) => {
+                        setFilters(next);
+                        setPage(0);
+                    }, quickSearch: {
+                        value: search,
+                        ariaLabel: 'Search by email or name',
+                        placeholder: 'Search by email or name',
+                        onChange: (next) => {
+                            setSearch(next);
+                            setPage(0);
+                        },
+                    }, selection: {
+                        selectedIds,
+                        onSelectionChange: setSelectedIds,
+                    }, rowActions: rowActions, csvExport: {
+                        filename: 'users',
+                        // Replays THIS page's own query, so an export can only ever contain
+                        // what the user's own list request already returns.
+                        fetchAllRows: async ({ page: exportPage, pageSize: exportPageSize }) => {
+                            const response = await identity.getUsers({
+                                page: exportPage + 1,
+                                pageSize: exportPageSize,
+                                search: search || undefined,
+                                role: roleFilter,
+                                isActive: statusFilter === undefined ? undefined : statusFilter === 'active',
+                            });
+                            return response.items;
+                        },
+                    } }) }), _jsx(ManageRolesDialog, { user: rolesDialogUser, roles: offeredRoles, onClose: () => setRolesDialogUser(null), onSave: updateUserRoles })] }));
+}
+//# sourceMappingURL=UserList.js.map

package/dist/identity/ui/users/UserList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserList.js","sourceRoot":"","sources":["../../../../src/identity/ui/users/UserList.tsx"],"names":[],"mappings":";AA6BA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,eAAe,MAAM,iCAAiC,CAAC;AAC9D,OAAO,SAAS,MAAM,2BAA2B,CAAC;AAClD,OAAO,YAAY,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,aAAa,CAAC;AAOzD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,gGAAgG;AAChG,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAA8B,EAAE,QAAgB;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CACrE,CAAC;IACF,OAAO,OAAO,KAAK,EAAE,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AA6BD;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAE,KAAK,KAAoB,EAAE;IACpD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,GAC/E,QAAQ,EAAE,CAAC;IACb,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;IAE3C,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAA4B,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAwB,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAc,IAAI,GAAG,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAElF,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,gEAAgE;IAChE,MAAM,WAAW,GAAG,eAAe,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC;IACzD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,EAAE,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,CACxB,GAAG,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,gBAAgB,CAAC,CAAC,EAC9F,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CACpC,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAE/F,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,mBAAmB,CAAkD,WAAW,EAAE,KAAK,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAE/B,8EAA8E;IAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,oEAAoE;IACpE,4EAA4E;IAC5E,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAI,EAAE,SAAS,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,UAAU,CAAC;YACT,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,gDAAgD;YAChE,QAAQ;YACR,MAAM,EAAE,MAAM,IAAI,SAAS;YAC3B,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ;YAC5E,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,0EAA0E;IAC5E,CAAC,EAAE;QACD,IAAI;QACJ,QAAQ;QACR,MAAM;QACN,UAAU;QACV,YAAY;QACZ,SAAS;QACT,aAAa;QACb,UAAU;KACX,CAAC,CAAC;IAEH,+EAA+E;IAC/E,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9B,MAAM,OAAO,GAAuC,EAAE,CAAC;QAEvD,2DAA2D;QAC3D,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV;gBACE,EAAE,EAAE,UAAU;gBACd,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,KAAC,eAAe,IAAC,QAAQ,EAAC,OAAO,GAAG;gBAC1C,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ;gBACjC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;oBAChB,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;wBACtD,yCAAyC;oBAC3C,CAAC,CAAC,CAAC;gBACL,CAAC;aACF,EACD;gBACE,EAAE,EAAE,YAAY;gBAChB,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,KAAC,SAAS,IAAC,QAAQ,EAAC,OAAO,GAAG;gBACpC,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;gBAClC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;oBAChB,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;wBACvD,yCAAyC;oBAC3C,CAAC,CAAC,CAAC;gBACL,CAAC;aACF,CACF,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,cAAc;gBAClB,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,KAAC,YAAY,IAAC,QAAQ,EAAC,OAAO,GAAG;gBACvC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;IAEhC,MAAM,UAAU,GAAG,OAAO,CACxB,GAAG,EAAE,CAAC,CACJ,KAAC,UAAU,IAAC,KAAK,EAAC,gBAAgB,YAC/B,MAAM,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,gBAAgB,GACvD,CACd,EACD,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,CACL,MAAC,KAAK,IAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,aAC/B,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,QAAQ,EAAC,OAAO,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAClC,KAAK,GACA,CACT,EAEA,OAAO,IAAI,KAAC,OAAO,KAAG,EAEvB,KAAC,GAAG,IAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,YACtB,KAAC,SAAS,IACR,OAAO,EAAE,QAAQ,iBACL,mBAAmB,EAC/B,SAAS,EAAC,OAAO,EACjB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,KAAK,EACX,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EACxB,OAAO,EAAE,SAAS,EAClB,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE;wBACV,IAAI;wBACJ,QAAQ;wBACR,KAAK;wBACL,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;wBAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE;4BAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4BACnB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC7B,CAAC;qBACF,EACD,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EACrC,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE;wBACxB,UAAU,CAAC,IAAI,CAAC,CAAC;wBACjB,OAAO,CAAC,CAAC,CAAC,CAAC;oBACb,CAAC,EACD,WAAW,EAAE;wBACX,KAAK,EAAE,MAAM;wBACb,SAAS,EAAE,yBAAyB;wBACpC,WAAW,EAAE,yBAAyB;wBACtC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;4BACjB,SAAS,CAAC,IAAI,CAAC,CAAC;4BAChB,OAAO,CAAC,CAAC,CAAC,CAAC;wBACb,CAAC;qBACF,EACD,SAAS,EAAE;wBACT,WAAW;wBACX,iBAAiB,EAAE,cAAc;qBAClC,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE;wBACT,QAAQ,EAAE,OAAO;wBACjB,oEAAoE;wBACpE,oDAAoD;wBACpD,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE;4BACrE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gCACvC,IAAI,EAAE,UAAU,GAAG,CAAC;gCACpB,QAAQ,EAAE,cAAc;gCACxB,MAAM,EAAE,MAAM,IAAI,SAAS;gCAC3B,IAAI,EAAE,UAAU;gCAChB,QAAQ,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ;6BAC7E,CAAC,CAAC;4BACH,OAAO,QAAQ,CAAC,KAAK,CAAC;wBACxB,CAAC;qBACF,GACD,GACE,EAEN,KAAC,iBAAiB,IAChB,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EACvC,MAAM,EAAE,eAAe,GACvB,IACI,CACT,CAAC;AACJ,CAAC"}

package/dist/identity/ui/users/UsersPage.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Admin → Settings → Users & Allowlist (`/admin/settings/users`).
+ *
+ * Issue #92, epic #90. This is the former `pages/UserManagementPage.tsx`, moved
+ * under the Console's route tree so the hub card, the rail row and the route
+ * all address the same path. `/admin/users` still resolves — `App.tsx` keeps it
+ * as a real `<Navigate replace>` route so a bookmark lands here rather than
+ * falling through the `*` catch-all to `/`.
+ *
+ * IT KEEPS ITS TWO TABS, unlike `SystemSettingsPage`, whose three became three
+ * routes. That is not an inconsistency: Users and Allowlist are two views of
+ * the same question — who may use this application — and they are PARALLEL
+ * content, which is what a tab strip is for. The three system-settings tabs
+ * were hierarchical content wearing a tab strip, which is the mistake epic #90
+ * is fixing. Two tabs also sit nowhere near the ~5 where a strip degrades.
+ *
+ * The nested gate below is unchanged and load-bearing; see its own comment.
+ *
+ * PP-14.25: the page takes the packaged-page slot contract (`PageSlotsBase`,
+ * the user table's slots, and `Tabs`). `Tabs` only APPENDS tabs after the two
+ * above and is for content that is parallel to them (another answer to "who may
+ * use this application"); a new settings page is a card in the registry, never
+ * a tab here (CLAUDE.md, Settings UI Pattern, rule 2).
+ */
+import type { ReactElement, ReactNode } from 'react';
+import type { PageSlot, PageSlotsBase } from '../../../core/index.js';
+import type { UserListSlots } from './UserList.js';
+/**
+ * A tab an app appends to {@link UsersPage} after Users and Allowlist.
+ *
+ * Only for content PARALLEL to those two (another view of "who may use this
+ * application"): the Settings UI rule is that a tab strip holds parallel
+ * content and a new settings page is a registry card.
+ *
+ * @stability experimental
+ */
+export interface UsersPageTab {
+    /** A stable id (the tab's key). */
+    id: string;
+    /** The tab's label. */
+    label: ReactNode;
+    /** The tab's content. Rendered only while the tab is selected, inside the page's tab panel. */
+    Panel: PageSlot<object>;
+    /**
+     * Show the tab only to a viewer holding this permission. This hides a control;
+     * the API behind the panel enforces the permission.
+     */
+    permission?: string;
+}
+/**
+ * The slots of {@link UsersPage}: the page-slot contract, the user table's
+ * slots (passed to the Users tab's list) and `Tabs`.
+ *
+ * `Sections` is drawn at both ends of the page body, outside the tab strip.
+ * `Tabs` is a list of tabs appended after Users and Allowlist; it cannot remove
+ * or reorder those two. Keep it a module constant.
+ *
+ * @example
+ * ```tsx
+ * <UsersPage slots={{ Columns: (base) => [...base, planColumn], Tabs: [{ id: 'domains', label: 'Domains', Panel: DomainsPanel }] }} />
+ * ```
+ *
+ * @extensionPoint slot
+ * @stability experimental
+ */
+export interface UsersPageSlots extends PageSlotsBase, UserListSlots {
+    /** Tabs appended after Users and Allowlist, for content parallel to them. */
+    Tabs?: readonly UsersPageTab[];
+}
+/**
+ * Props of {@link UsersPage}.
+ *
+ * @stability experimental
+ */
+export interface UsersPageProps {
+    /** Add to the page without a fork. */
+    slots?: UsersPageSlots;
+}
+/**
+ * The admin `Users & Allowlist` page (`/admin/settings/users`): the Users tab
+ * and, gated on `allowlist:read` inside the page, the Allowlist tab.
+ *
+ * @param props - see {@link UsersPageProps}.
+ * @returns the page.
+ *
+ * @extensionPoint component
+ * @stability stable
+ */
+export declare function UsersPage({ slots }?: UsersPageProps): ReactElement;
+//# sourceMappingURL=UsersPage.d.ts.map

package/dist/identity/ui/users/UsersPage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UsersPage.d.ts","sourceRoot":"","sources":["../../../../src/identity/ui/users/UsersPage.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAKtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAwBnD;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,mCAAmC;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,KAAK,EAAE,SAAS,CAAC;IACjB,+FAA+F;IAC/F,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,cAAe,SAAQ,aAAa,EAAE,aAAa;IAClE,6EAA6E;IAC7E,IAAI,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,sCAAsC;IACtC,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,KAAK,EAAE,GAAE,cAAmB,GAAG,YAAY,CA2FtE"}