@strapi-community/plugin-better-auth-dashboard 1.0.0-beta.1 → 1.0.0

package/dist/admin/index-D9ttdrT3.js

@@ -0,0 +1,2716 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const jsxRuntime = require("react/jsx-runtime");
+const designSystem = require("@strapi/design-system");
+const icons = require("@strapi/icons");
+const admin = require("@strapi/strapi/admin");
+const react = require("react");
+const reactIntl = require("react-intl");
+const reactQuery = require("react-query");
+const index = require("./index-BCBu-0nr.js");
+const Avatar = require("./Avatar-CdT7eBCh.js");
+const useModelSchema = require("./useModelSchema-BogQah8f.js");
+function useUsers(options = {}) {
+  const { limit = 25, offset = 0, search } = options;
+  const { formatMessage } = reactIntl.useIntl();
+  return reactQuery.useQuery({
+    queryKey: ["dash-users", limit, offset, search],
+    queryFn: async () => {
+      const whereClause = search ? JSON.stringify([
+        {
+          field: "email",
+          operator: "contains",
+          value: search,
+          connector: "OR"
+        },
+        {
+          field: "name",
+          operator: "contains",
+          value: search,
+          connector: "OR"
+        }
+      ]) : void 0;
+      const result = await index.client.dash.listUsers({
+        query: {
+          limit,
+          offset,
+          sortBy: "createdAt",
+          sortOrder: "desc",
+          ...whereClause ? { where: whereClause } : {}
+        }
+      });
+      if (result.error) {
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("common.errors.loadUsers"),
+            defaultMessage: "Failed to load users"
+          })
+        );
+      }
+      return result.data;
+    },
+    keepPreviousData: true
+  });
+}
+function CreateUserDialog({ onClose }) {
+  const { formatMessage } = reactIntl.useIntl();
+  const qc = reactQuery.useQueryClient();
+  const { toggleNotification } = admin.useNotification();
+  const [name, setName] = react.useState("");
+  const [email, setEmail] = react.useState("");
+  const [image, setImage] = react.useState("");
+  const [password, setPassword] = react.useState("");
+  const [generatePassword, setGeneratePassword] = react.useState(false);
+  const [emailVerified, setEmailVerified] = react.useState(false);
+  const [sendVerificationEmail, setSendVerificationEmail] = react.useState(false);
+  const createMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const result = await index.client.dash.createUser({
+        name,
+        email,
+        ...image ? { image } : {},
+        ...generatePassword ? { generatePassword: true } : password ? { password } : {},
+        emailVerified,
+        sendVerificationEmail
+      });
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("users.create.errors.createFailed"),
+            defaultMessage: "Create failed"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ["dash-users"] });
+      qc.invalidateQueries({ queryKey: ["dash-user-stats"] });
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("users.create.notifications.success"),
+          defaultMessage: "User created successfully"
+        })
+      });
+      onClose();
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("users.create.notifications.error"),
+          defaultMessage: "Failed to create user"
+        })
+      });
+    }
+  });
+  const footer = /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { variant: "tertiary", onClick: onClose, children: formatMessage({
+      id: index.getTranslation("users.create.cancel"),
+      defaultMessage: "Cancel"
+    }) }),
+    /* @__PURE__ */ jsxRuntime.jsx(
+      designSystem.Button,
+      {
+        loading: createMutation.isLoading,
+        onClick: () => createMutation.mutate(),
+        disabled: !name || !email,
+        "data-testid": "create-user-submit",
+        children: formatMessage({
+          id: index.getTranslation("users.create.submit"),
+          defaultMessage: "Create user"
+        })
+      }
+    )
+  ] });
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    useModelSchema.SheetDialog,
+    {
+      title: formatMessage({
+        id: index.getTranslation("users.create.title"),
+        defaultMessage: "Create user"
+      }),
+      actionButtons: footer,
+      onClose,
+      "data-testid": "create-user-drawer",
+      children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 5, children: [
+        /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+          /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+            id: index.getTranslation("users.create.sections.personal"),
+            defaultMessage: "Personal information"
+          }) }),
+          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, required: true, children: [
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: formatMessage({
+              id: index.getTranslation("users.create.fields.name.label"),
+              defaultMessage: "Full name"
+            }) }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.TextInput,
+              {
+                name: "name",
+                value: name,
+                onChange: (e) => setName(e.target.value),
+                placeholder: formatMessage({
+                  id: index.getTranslation("users.create.fields.name.placeholder"),
+                  defaultMessage: "Jane Smith"
+                }),
+                "data-testid": "new-user-name"
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, required: true, children: [
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: formatMessage({
+              id: index.getTranslation("users.create.fields.email.label"),
+              defaultMessage: "Email address"
+            }) }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.TextInput,
+              {
+                name: "email",
+                type: "email",
+                value: email,
+                onChange: (e) => setEmail(e.target.value),
+                placeholder: formatMessage({
+                  id: index.getTranslation("users.create.fields.email.placeholder"),
+                  defaultMessage: "jane@example.com"
+                }),
+                "data-testid": "new-user-email"
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            useModelSchema.MediaPickerField,
+            {
+              label: formatMessage({
+                id: index.getTranslation("users.create.fields.image.label"),
+                defaultMessage: "Avatar URL"
+              }),
+              name: "image",
+              value: image,
+              onChange: setImage,
+              placeholder: formatMessage({
+                id: index.getTranslation("users.create.fields.image.placeholder"),
+                defaultMessage: "https://example.com/avatar.png"
+              }),
+              hint: formatMessage({
+                id: index.getTranslation("users.create.fields.image.hint"),
+                defaultMessage: "Optional — publicly accessible image URL"
+              })
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+          /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+            id: index.getTranslation("users.create.sections.password"),
+            defaultMessage: "Password"
+          }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Checkbox,
+            {
+              name: "generatePassword",
+              checked: generatePassword,
+              onCheckedChange: (checked) => {
+                setGeneratePassword(checked);
+                if (checked) setPassword("");
+              },
+              children: formatMessage({
+                id: index.getTranslation("users.create.fields.generatePassword"),
+                defaultMessage: "Generate a random password"
+              })
+            }
+          ),
+          !generatePassword && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, children: [
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: formatMessage({
+              id: index.getTranslation("users.create.fields.password.label"),
+              defaultMessage: "Password"
+            }) }),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.TextInput,
+              {
+                name: "password",
+                type: "password",
+                value: password,
+                onChange: (e) => setPassword(e.target.value),
+                placeholder: formatMessage({
+                  id: index.getTranslation(
+                    "users.create.fields.password.placeholder"
+                  ),
+                  defaultMessage: "Leave blank for a passwordless account"
+                })
+              }
+            )
+          ] })
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+          /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+            id: index.getTranslation("users.create.sections.emailVerification"),
+            defaultMessage: "Email verification"
+          }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Checkbox,
+            {
+              name: "emailVerified",
+              checked: emailVerified,
+              onCheckedChange: (checked) => {
+                setEmailVerified(checked);
+                if (checked) setSendVerificationEmail(false);
+              },
+              children: formatMessage({
+                id: index.getTranslation("users.create.fields.emailVerified"),
+                defaultMessage: "Mark email as already verified"
+              })
+            }
+          ),
+          !emailVerified && /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Checkbox,
+            {
+              name: "sendVerificationEmail",
+              checked: sendVerificationEmail,
+              onCheckedChange: (checked) => setSendVerificationEmail(checked),
+              children: formatMessage({
+                id: index.getTranslation("users.create.fields.sendVerificationEmail"),
+                defaultMessage: "Send a verification email to the user"
+              })
+            }
+          ),
+          emailVerified && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "success600", children: formatMessage({
+            id: index.getTranslation("users.create.fields.emailVerifiedHint"),
+            defaultMessage: "The user will be able to sign in immediately without verifying their email."
+          }) }) })
+        ] })
+      ] })
+    }
+  );
+}
+function usePluginSettings() {
+  const { get } = admin.useFetchClient();
+  return reactQuery.useQuery({
+    queryKey: ["dash-plugin-settings"],
+    queryFn: async () => {
+      const { data } = await get(
+        "/better-auth-dashboard/settings"
+      );
+      return data;
+    },
+    staleTime: 5 * 60 * 1e3
+  });
+}
+function ReadOnlyField({ label, value }) {
+  return /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { width: "100%", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: label }),
+    /* @__PURE__ */ jsxRuntime.jsx(designSystem.TextInput, { readOnly: true, value })
+  ] });
+}
+function BackupCodes({ codes }) {
+  return /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Root, { gap: 2, gridCols: 2, children: codes.map((code) => /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 1, children: /* @__PURE__ */ jsxRuntime.jsx(
+    designSystem.Box,
+    {
+      width: "100%",
+      background: "neutral0",
+      borderColor: "neutral200",
+      borderStyle: "solid",
+      borderWidth: "1px",
+      hasRadius: true,
+      padding: 2,
+      textAlign: "center",
+      children: /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.Code, { variant: "omega", fontWeight: "semiBold", textColor: "neutral800", children: code })
+    }
+  ) }, code)) });
+}
+const STANDARD_FIELDS = /* @__PURE__ */ new Set([
+  "id",
+  "name",
+  "email",
+  "emailVerified",
+  "image",
+  "banned",
+  "banReason",
+  "banExpires",
+  "createdAt",
+  "updatedAt"
+]);
+function UserDetailDrawer({
+  userId,
+  banEnabled,
+  emailVerificationEnabled,
+  twoFactorEnabled,
+  onClose
+}) {
+  const { formatMessage } = reactIntl.useIntl();
+  const qc = reactQuery.useQueryClient();
+  const { toggleNotification } = admin.useNotification();
+  const { get, put } = admin.useFetchClient();
+  const schemaQuery = useModelSchema.useModelSchema("user");
+  const settingsQuery = usePluginSettings();
+  const emailCallbackUrl = settingsQuery.data?.email_callback_url ?? null;
+  const userQuery = reactQuery.useQuery({
+    queryKey: ["dash-user", userId],
+    queryFn: async () => {
+      const result = await index.client.dash.user(
+        {},
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.loadUserFailed"),
+            defaultMessage: "Failed to load user"
+          })
+        );
+      return result.data;
+    }
+  });
+  const orgsQuery = reactQuery.useQuery({
+    queryKey: ["dash-user-orgs", userId],
+    queryFn: async () => {
+      const result = await index.client.dash.userOrganizations(
+        {},
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.failed"),
+            defaultMessage: "Failed"
+          })
+        );
+      return result.data?.organizations ?? [];
+    }
+  });
+  const sessionsQuery = reactQuery.useQuery({
+    queryKey: ["dash-user-sessions", userId],
+    queryFn: async () => {
+      const { data } = await get(
+        `/better-auth-dashboard/db?uid=plugin::better-auth.session&filters[userId][$eq]=${userId}&sort[0]=createdAt:desc&pagination[pageSize]=50`
+      );
+      return data.results ?? [];
+    }
+  });
+  const strapiUserQuery = reactQuery.useQuery({
+    queryKey: ["dash-strapi-user", userId],
+    enabled: !!schemaQuery.data,
+    queryFn: async () => {
+      const relationFields = Object.entries(schemaQuery.data).filter(([, attr]) => attr.type === "relation").map(([fieldName]) => fieldName);
+      const populateParam = relationFields.length > 0 ? `&populate=${encodeURIComponent(relationFields.join(","))}` : "";
+      const { data } = await get(
+        `/better-auth-dashboard/db?uid=plugin::better-auth.user&filters[id][$eq]=${userId}&pagination[pageSize]=1${populateParam}`
+      );
+      return data.results?.[0] ?? null;
+    }
+  });
+  const [activeTab, setActiveTab] = react.useState("profile");
+  const [editName, setEditName] = react.useState(void 0);
+  const [editEmail, setEditEmail] = react.useState(void 0);
+  const [editEmailVerified, setEditEmailVerified] = react.useState(void 0);
+  const [editImage, setEditImage] = react.useState(void 0);
+  const [editExtra, setEditExtra] = react.useState({});
+  const [newPassword, setNewPassword] = react.useState("");
+  const [banReason, setBanReason] = react.useState("");
+  const [banExpiresDays, setBanExpiresDays] = react.useState("");
+  const [confirmRevokeAll, setConfirmRevokeAll] = react.useState(false);
+  const [confirmRevokeSessionId, setConfirmRevokeSessionId] = react.useState(null);
+  const [confirmBan, setConfirmBan] = react.useState(false);
+  const [confirmUnban, setConfirmUnban] = react.useState(false);
+  const [confirmUnlinkAccountId, setConfirmUnlinkAccountId] = react.useState(null);
+  const [confirmDisable2FA, setConfirmDisable2FA] = react.useState(false);
+  const [showTotpModal, setShowTotpModal] = react.useState(false);
+  const [showBackupCodesModal, setShowBackupCodesModal] = react.useState(false);
+  const [confirmRegenerateBackupCodes, setConfirmRegenerateBackupCodes] = react.useState(false);
+  const [twoFactorData, setTwoFactorData] = react.useState(null);
+  const [totpUriData, setTotpUriData] = react.useState(null);
+  const [backupCodesData, setBackupCodesData] = react.useState(null);
+  const user = userQuery.data;
+  const displayName = editName ?? user?.name ?? "";
+  const displayEmail = editEmail ?? user?.email ?? "";
+  const displayEmailVerified = editEmailVerified ?? user?.emailVerified ?? false;
+  const displayImage = editImage ?? user?.image ?? "";
+  const handleExtraChange = (name, value) => {
+    setEditExtra((prev) => ({ ...prev, [name]: value }));
+  };
+  const extraData = {
+    ...strapiUserQuery.data ?? {},
+    ...editExtra
+  };
+  const updateMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const body = {};
+      if (editName !== void 0) body.name = editName;
+      if (editEmail !== void 0) body.email = editEmail;
+      if (editEmailVerified !== void 0)
+        body.emailVerified = editEmailVerified;
+      if (editImage !== void 0) body.image = editImage;
+      const documentId = strapiUserQuery.data?.documentId;
+      if (!documentId)
+        throw new Error(
+          formatMessage({
+            id: index.getTranslation("userDetail.errors.documentIdMissing"),
+            defaultMessage: "Could not resolve documentId for user"
+          })
+        );
+      const updateUser = await index.client.dash.updateUser(
+        { userId, ...body },
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (!updateUser.data)
+        throw new Error(
+          formatMessage({
+            id: index.getTranslation("userDetail.common.updateFailed"),
+            defaultMessage: "Update failed"
+          })
+        );
+      if (Object.keys(editExtra).length > 0) {
+        await put(
+          `/better-auth-dashboard/db/${documentId}?uid=plugin::better-auth.user`,
+          editExtra
+        );
+      }
+    },
+    onSuccess: async () => {
+      await qc.invalidateQueries({ queryKey: ["dash-strapi-user", userId] });
+      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
+      qc.invalidateQueries({ queryKey: ["dash-users"] });
+      setEditName(void 0);
+      setEditEmail(void 0);
+      setEditEmailVerified(void 0);
+      setEditImage(void 0);
+      setEditExtra({});
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.updated"),
+          defaultMessage: "User updated successfully"
+        })
+      });
+      onClose();
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.updateFailed"),
+          defaultMessage: "Update failed"
+        })
+      });
+    }
+  });
+  const revokeSessionMutation = reactQuery.useMutation({
+    mutationFn: async (sessionId) => {
+      const result = await index.client.dash.sessions.revoke(
+        {},
+        useModelSchema.withContext({ sessionId, userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.revokeFailed"),
+            defaultMessage: "Revoke failed"
+          })
+        );
+    },
+    onSuccess: () => {
+      setConfirmRevokeSessionId(null);
+      qc.invalidateQueries({ queryKey: ["dash-user-sessions", userId] });
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.sessionRevoked"),
+          defaultMessage: "Session revoked"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.notifications.revokeSessionError"),
+          defaultMessage: "Failed to revoke session"
+        })
+      });
+    }
+  });
+  const passwordMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const result = await index.client.dash.setPassword(
+        { password: newPassword },
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.passwordUpdateFailed"),
+            defaultMessage: "Password update failed"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: () => {
+      setNewPassword("");
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.passwordUpdated"),
+          defaultMessage: "Password updated successfully"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.passwordUpdateFailed"),
+          defaultMessage: "Password update failed"
+        })
+      });
+    }
+  });
+  const banMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const body = {};
+      if (banReason) body.banReason = banReason;
+      if (banExpiresDays) {
+        const days = parseInt(banExpiresDays, 10);
+        if (!Number.isNaN(days)) body.banExpires = Date.now() + days * 864e5;
+      }
+      const result = await index.client.dash.banUser(
+        body,
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.banFailed"),
+            defaultMessage: "Ban failed"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: () => {
+      setConfirmBan(false);
+      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
+      qc.invalidateQueries({ queryKey: ["dash-users"] });
+      setBanReason("");
+      setBanExpiresDays("");
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.banned"),
+          defaultMessage: "User has been banned"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.banFailed"),
+          defaultMessage: "Ban failed"
+        })
+      });
+    }
+  });
+  const unbanMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const result = await index.client.dash.unbanUser(
+        {},
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.unbanFailed"),
+            defaultMessage: "Unban failed"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: () => {
+      setConfirmUnban(false);
+      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
+      qc.invalidateQueries({ queryKey: ["dash-users"] });
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.unbanned"),
+          defaultMessage: "Ban has been lifted"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.unbanFailed"),
+          defaultMessage: "Unban failed"
+        })
+      });
+    }
+  });
+  const unlinkAccountMutation = reactQuery.useMutation({
+    mutationFn: async (providerId) => {
+      const result = await index.client.dash.unlinkAccount(
+        { providerId },
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.unlinkFailed"),
+            defaultMessage: "Failed to unlink account"
+          })
+        );
+    },
+    onSuccess: () => {
+      setConfirmUnlinkAccountId(null);
+      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.accountUnlinked"),
+          defaultMessage: "Account unlinked"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.unlinkFailed"),
+          defaultMessage: "Failed to unlink account"
+        })
+      });
+    }
+  });
+  const revokeAllMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const result = await index.client.dash.sessions.revokeAll(
+        { userId },
+        useModelSchema.withContext({}, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.revokeFailed"),
+            defaultMessage: "Revoke failed"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: () => {
+      setConfirmRevokeAll(false);
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.allSessionsRevoked"),
+          defaultMessage: "All sessions revoked"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.notifications.revokeAllError"),
+          defaultMessage: "Failed to revoke sessions"
+        })
+      });
+    }
+  });
+  const sendVerificationMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      if (!emailCallbackUrl) {
+        throw new Error(
+          formatMessage({
+            id: index.getTranslation("userDetail.common.callbackUrlMissing"),
+            defaultMessage: "Set `email_callback_url` in the better-auth-dashboard plugin config to enable this action."
+          })
+        );
+      }
+      const result = await index.client.dash.sendVerificationEmail(
+        { callbackUrl: emailCallbackUrl },
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.failed"),
+            defaultMessage: "Failed"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: () => {
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.verificationSent"),
+          defaultMessage: "Verification email sent"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.sendEmailFailed"),
+          defaultMessage: "Failed to send email"
+        })
+      });
+    }
+  });
+  const sendResetPasswordMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      if (!emailCallbackUrl) {
+        throw new Error(
+          formatMessage({
+            id: index.getTranslation("userDetail.common.callbackUrlMissing"),
+            defaultMessage: "Set `email_callback_url` in the better-auth-dashboard plugin config to enable this action."
+          })
+        );
+      }
+      const result = await index.client.dash.sendResetPasswordEmail(
+        { callbackUrl: emailCallbackUrl },
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.failed"),
+            defaultMessage: "Failed"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: () => {
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.resetPasswordSent"),
+          defaultMessage: "Password reset email sent"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.sendEmailFailed"),
+          defaultMessage: "Failed to send email"
+        })
+      });
+    }
+  });
+  const enableTwoFactorMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const result = await index.client.dash.enableTwoFactor(
+        {},
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.enableTwoFactorFailed"),
+            defaultMessage: "Failed to enable 2FA"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: (data) => {
+      if (data) setTwoFactorData(data);
+      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.twoFactorEnabled"),
+          defaultMessage: "Two-factor authentication enabled"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.enableTwoFactorFailed"),
+          defaultMessage: "Failed to enable 2FA"
+        })
+      });
+    }
+  });
+  const disableTwoFactorMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const result = await index.client.dash.disableTwoFactor(
+        {},
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.disableTwoFactorFailed"),
+            defaultMessage: "Failed to disable 2FA"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: () => {
+      setConfirmDisable2FA(false);
+      setTwoFactorData(null);
+      setTotpUriData(null);
+      setBackupCodesData(null);
+      qc.invalidateQueries({ queryKey: ["dash-user", userId] });
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.twoFactorDisabled"),
+          defaultMessage: "Two-factor authentication disabled"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.disableTwoFactorFailed"),
+          defaultMessage: "Failed to disable 2FA"
+        })
+      });
+    }
+  });
+  const viewTotpUriMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const result = await index.client.dash.viewTwoFactorTotpUri(
+        {},
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.loadTotpUriFailed"),
+            defaultMessage: "Failed to load TOTP URI"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: (data) => {
+      if (data) {
+        setTotpUriData(data);
+        setShowTotpModal(true);
+      }
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.loadTotpUriFailed"),
+          defaultMessage: "Failed to load TOTP URI"
+        })
+      });
+    }
+  });
+  const viewBackupCodesMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const result = await index.client.dash.viewBackupCodes(
+        {},
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.loadBackupCodesFailed"),
+            defaultMessage: "Failed to load backup codes"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: (data) => {
+      if (data) {
+        setBackupCodesData(data.backupCodes);
+        setShowBackupCodesModal(true);
+      }
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.loadBackupCodesFailed"),
+          defaultMessage: "Failed to load backup codes"
+        })
+      });
+    }
+  });
+  const generateBackupCodesMutation = reactQuery.useMutation({
+    mutationFn: async () => {
+      const result = await index.client.dash.generateBackupCodes(
+        {},
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("userDetail.common.generateBackupCodesFailed"),
+            defaultMessage: "Failed to generate backup codes"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: (data) => {
+      setConfirmRegenerateBackupCodes(false);
+      if (data) {
+        setBackupCodesData(data.backupCodes);
+        setShowBackupCodesModal(true);
+      }
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("userDetail.notifications.backupCodesGenerated"),
+          defaultMessage: "New backup codes generated"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("userDetail.common.generateBackupCodesFailed"),
+          defaultMessage: "Failed to generate backup codes"
+        })
+      });
+    }
+  });
+  const hasEdits = editName !== void 0 || editEmail !== void 0 || editEmailVerified !== void 0 || editImage !== void 0 || Object.keys(editExtra).length > 0;
+  const customFields = Object.entries(schemaQuery.data ?? {}).filter(([name]) => !STANDARD_FIELDS.has(name)).map(([name, attribute]) => ({ name, attribute }));
+  const banExpiryPreview = banExpiresDays && !Number.isNaN(parseInt(banExpiresDays, 10)) ? new Date(
+    Date.now() + parseInt(banExpiresDays, 10) * 864e5
+  ).toLocaleDateString(void 0, {
+    weekday: "long",
+    year: "numeric",
+    month: "long",
+    day: "numeric"
+  }) : null;
+  const drawerTitle = /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { tag: "span", gap: 3, alignItems: "center", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(Avatar.Avatar, { name: user?.name ?? "?", src: user?.image, size: 32 }),
+    /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { tag: "span", direction: "column", alignItems: "flex-start", children: [
+      /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "bold", textColor: "neutral800", children: user?.name ?? formatMessage({
+        id: index.getTranslation("userDetail.header.fallbackName"),
+        defaultMessage: "User"
+      }) }),
+      user?.email && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", children: user.email })
+    ] }),
+    user?.banned && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { variant: "danger", size: "S", children: formatMessage({
+      id: index.getTranslation("userDetail.header.banned"),
+      defaultMessage: "Banned"
+    }) })
+  ] });
+  const profileFooter = activeTab === "profile" ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(
+      designSystem.Button,
+      {
+        variant: "tertiary",
+        onClick: () => {
+          setEditName(void 0);
+          setEditEmail(void 0);
+          setEditEmailVerified(void 0);
+          setEditImage(void 0);
+          setEditExtra({});
+          onClose();
+        },
+        children: formatMessage({
+          id: index.getTranslation("userDetail.footer.discard"),
+          defaultMessage: "Discard"
+        })
+      }
+    ),
+    /* @__PURE__ */ jsxRuntime.jsx(
+      designSystem.Button,
+      {
+        disabled: !hasEdits,
+        loading: updateMutation.isLoading,
+        onClick: () => updateMutation.mutate(),
+        "data-testid": "save-user-btn",
+        children: formatMessage({
+          id: index.getTranslation("userDetail.footer.save"),
+          defaultMessage: "Save changes"
+        })
+      }
+    )
+  ] }) : void 0;
+  return /* @__PURE__ */ jsxRuntime.jsxs(
+    useModelSchema.SheetDialog,
+    {
+      title: drawerTitle,
+      actionButtons: profileFooter,
+      onClose,
+      "data-testid": "user-detail-drawer",
+      children: [
+        userQuery.isLoading ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", padding: 8, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Loader, { children: formatMessage({
+          id: index.getTranslation("userDetail.loadingUser"),
+          defaultMessage: "Loading user…"
+        }) }) }) : userQuery.isError ? /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Alert,
+          {
+            closeLabel: formatMessage({
+              id: index.getTranslation("userDetail.common.close"),
+              defaultMessage: "Close"
+            }),
+            title: formatMessage({
+              id: index.getTranslation("userDetail.common.loadUserFailed"),
+              defaultMessage: "Failed to load user"
+            }),
+            variant: "danger",
+            children: userQuery.error instanceof Error ? userQuery.error.message : formatMessage({
+              id: index.getTranslation("userDetail.errors.generic"),
+              defaultMessage: "An error occurred"
+            })
+          }
+        ) : /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Tabs.Root, { defaultValue: "profile", onValueChange: setActiveTab, children: [
+          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Tabs.List, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "profile", children: formatMessage({
+              id: index.getTranslation("userDetail.tabs.profile"),
+              defaultMessage: "Profile"
+            }) }),
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "security", children: formatMessage({
+              id: index.getTranslation("userDetail.tabs.security"),
+              defaultMessage: "Security"
+            }) }),
+            banEnabled && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "ban", children: formatMessage({
+              id: index.getTranslation("userDetail.tabs.ban"),
+              defaultMessage: "Ban"
+            }) }),
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "sessions", children: formatMessage({
+              id: index.getTranslation("userDetail.tabs.sessions"),
+              defaultMessage: "Sessions"
+            }) }),
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Trigger, { value: "organizations", children: formatMessage({
+              id: index.getTranslation("userDetail.tabs.organizations"),
+              defaultMessage: "Organizations"
+            }) })
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "profile", children: /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.EditLayout, { children: [
+            /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 5, children: [
+              /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+                  id: index.getTranslation("userDetail.profile.personalInfo"),
+                  defaultMessage: "Personal information"
+                }) }),
+                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: formatMessage({
+                    id: index.getTranslation("userDetail.profile.fullName"),
+                    defaultMessage: "Full name"
+                  }) }),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.TextInput,
+                    {
+                      value: displayName,
+                      onChange: (e) => setEditName(e.target.value),
+                      "data-testid": "user-name-input"
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { style: { width: "100%" }, children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: formatMessage({
+                    id: index.getTranslation("userDetail.profile.email"),
+                    defaultMessage: "Email address"
+                  }) }),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.TextInput,
+                    {
+                      type: "email",
+                      value: displayEmail,
+                      onChange: (e) => setEditEmail(e.target.value)
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxRuntime.jsx(
+                  designSystem.Checkbox,
+                  {
+                    checked: displayEmailVerified,
+                    onCheckedChange: (checked) => setEditEmailVerified(checked),
+                    children: formatMessage({
+                      id: index.getTranslation("userDetail.profile.markVerified"),
+                      defaultMessage: "Mark email as verified"
+                    })
+                  }
+                ),
+                /* @__PURE__ */ jsxRuntime.jsx(
+                  useModelSchema.MediaPickerField,
+                  {
+                    label: formatMessage({
+                      id: index.getTranslation("userDetail.profile.avatar.label"),
+                      defaultMessage: "Avatar URL"
+                    }),
+                    name: "image",
+                    value: displayImage,
+                    onChange: setEditImage,
+                    placeholder: formatMessage({
+                      id: index.getTranslation(
+                        "userDetail.profile.avatar.placeholder"
+                      ),
+                      defaultMessage: "https://example.com/avatar.png"
+                    }),
+                    hint: formatMessage({
+                      id: index.getTranslation("userDetail.profile.avatar.hint"),
+                      defaultMessage: "Optional — publicly accessible image URL"
+                    })
+                  }
+                )
+              ] }),
+              /* @__PURE__ */ jsxRuntime.jsx(
+                useModelSchema.CustomFieldsSection,
+                {
+                  fields: customFields,
+                  data: extraData,
+                  onChange: handleExtraChange
+                }
+              )
+            ] }),
+            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.EditSidebar, { children: [
+              /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+                  id: index.getTranslation("userDetail.profile.details"),
+                  defaultMessage: "Details"
+                }) }),
+                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Grid.Root, { gap: 3, gridCols: 2, children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 2, children: /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.MetaItem, { children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaKey, { children: formatMessage({
+                      id: index.getTranslation("userDetail.profile.userId"),
+                      defaultMessage: "User ID"
+                    }) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MonoChip, { children: user?.id })
+                  ] }) }),
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 1, children: /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.MetaItem, { children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaKey, { children: formatMessage({
+                      id: index.getTranslation("userDetail.profile.created"),
+                      defaultMessage: "Created"
+                    }) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaVal, { children: user?.createdAt ? new Date(user.createdAt).toLocaleString() : "—" })
+                  ] }) }),
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 1, children: /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.MetaItem, { children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaKey, { children: formatMessage({
+                      id: index.getTranslation(
+                        "userDetail.profile.lastUpdated"
+                      ),
+                      defaultMessage: "Last updated"
+                    }) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MetaVal, { children: user?.updatedAt ? new Date(user.updatedAt).toLocaleString() : "—" })
+                  ] }) })
+                ] })
+              ] }),
+              emailVerificationEnabled && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", alignItems: "stretch", gap: 2, children: [
+                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+                  id: index.getTranslation(
+                    "userDetail.profile.emailActions.title"
+                  ),
+                  defaultMessage: "Email actions"
+                }) }),
+                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", alignItems: "stretch", gap: 2, children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.Button,
+                    {
+                      variant: "secondary",
+                      size: "S",
+                      fullWidth: true,
+                      loading: sendVerificationMutation.isLoading,
+                      disabled: !emailCallbackUrl || user?.emailVerified,
+                      onClick: () => sendVerificationMutation.mutate(),
+                      children: formatMessage({
+                        id: index.getTranslation(
+                          "userDetail.profile.emailActions.sendVerification"
+                        ),
+                        defaultMessage: "Send verification email"
+                      })
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.Button,
+                    {
+                      variant: "secondary",
+                      size: "S",
+                      fullWidth: true,
+                      loading: sendResetPasswordMutation.isLoading,
+                      disabled: !emailCallbackUrl,
+                      onClick: () => sendResetPasswordMutation.mutate(),
+                      children: formatMessage({
+                        id: index.getTranslation(
+                          "userDetail.profile.emailActions.sendReset"
+                        ),
+                        defaultMessage: "Send password reset"
+                      })
+                    }
+                  ),
+                  !settingsQuery.isLoading && !emailCallbackUrl && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", children: formatMessage({
+                    id: index.getTranslation(
+                      "userDetail.profile.emailActions.callbackUrlHint"
+                    ),
+                    defaultMessage: "Set `email_callback_url` in the better-auth-dashboard plugin config to enable these actions."
+                  }) })
+                ] })
+              ] }),
+              /* @__PURE__ */ jsxRuntime.jsx(
+                useModelSchema.EditViewSidePanels,
+                {
+                  model: "plugin::better-auth.user",
+                  documentId: strapiUserQuery.data?.documentId,
+                  document: strapiUserQuery.data ?? void 0
+                }
+              )
+            ] })
+          ] }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "security", children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 5, paddingTop: 6, children: [
+            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+              /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+                id: index.getTranslation("userDetail.security.password.title"),
+                defaultMessage: "Password"
+              }) }),
+              /* @__PURE__ */ jsxRuntime.jsxs(
+                designSystem.Field.Root,
+                {
+                  hint: formatMessage({
+                    id: index.getTranslation("userDetail.security.password.hint"),
+                    defaultMessage: "The user will be able to sign in with this new password"
+                  }),
+                  children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: formatMessage({
+                      id: index.getTranslation("userDetail.security.password.label"),
+                      defaultMessage: "New password"
+                    }) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.TextInput,
+                      {
+                        type: "password",
+                        value: newPassword,
+                        onChange: (e) => setNewPassword(e.target.value),
+                        placeholder: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.security.password.placeholder"
+                          ),
+                          defaultMessage: "Enter a strong password…"
+                        })
+                      }
+                    ),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Hint, {})
+                  ]
+                }
+              ),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { children: /* @__PURE__ */ jsxRuntime.jsx(
+                designSystem.Button,
+                {
+                  disabled: !newPassword,
+                  loading: passwordMutation.isLoading,
+                  onClick: () => passwordMutation.mutate(),
+                  children: formatMessage({
+                    id: index.getTranslation("userDetail.security.password.submit"),
+                    defaultMessage: "Set password"
+                  })
+                }
+              ) })
+            ] }),
+            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+              /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+                id: index.getTranslation(
+                  "userDetail.security.linkedAccounts.title"
+                ),
+                defaultMessage: "Linked accounts"
+              }) }),
+              user?.account && user.account.length > 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 2, children: user.account.map((acc) => /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
+                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.ProviderBadge, { children: acc.providerId }),
+                /* @__PURE__ */ jsxRuntime.jsx(
+                  designSystem.Button,
+                  {
+                    variant: "danger-light",
+                    size: "S",
+                    onClick: () => setConfirmUnlinkAccountId(acc.providerId),
+                    children: formatMessage({
+                      id: index.getTranslation("userDetail.common.unlink"),
+                      defaultMessage: "Unlink"
+                    })
+                  }
+                )
+              ] }, acc.id)) }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: formatMessage({
+                id: index.getTranslation(
+                  "userDetail.security.linkedAccounts.empty"
+                ),
+                defaultMessage: "No linked OAuth accounts."
+              }) })
+            ] }),
+            twoFactorEnabled && /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+              /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { justifyContent: "space-between", alignItems: "center", children: [
+                /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+                  id: index.getTranslation(
+                    "userDetail.security.twoFactor.title"
+                  ),
+                  defaultMessage: "Two-factor authentication"
+                }) }),
+                /* @__PURE__ */ jsxRuntime.jsx(
+                  designSystem.Badge,
+                  {
+                    size: "S",
+                    variant: user?.twoFactorEnabled ? "success" : "neutral",
+                    children: user?.twoFactorEnabled ? formatMessage({
+                      id: index.getTranslation(
+                        "userDetail.security.twoFactor.status.enabled"
+                      ),
+                      defaultMessage: "Enabled"
+                    }) : formatMessage({
+                      id: index.getTranslation(
+                        "userDetail.security.twoFactor.status.disabled"
+                      ),
+                      defaultMessage: "Not enabled"
+                    })
+                  }
+                )
+              ] }),
+              user?.twoFactorEnabled ? /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 2, children: [
+                /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
+                  /* @__PURE__ */ jsxRuntime.jsxs(
+                    designSystem.Flex,
+                    {
+                      direction: "column",
+                      gap: 1,
+                      alignItems: "flex-start",
+                      children: [
+                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.common.totpAuthenticator"
+                          ),
+                          defaultMessage: "TOTP authenticator"
+                        }) }),
+                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.security.twoFactor.totp.description"
+                          ),
+                          defaultMessage: "View the URI and secret for this user's authenticator app."
+                        }) })
+                      ]
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.Button,
+                    {
+                      variant: "secondary",
+                      size: "S",
+                      loading: viewTotpUriMutation.isLoading,
+                      onClick: () => viewTotpUriMutation.mutate(),
+                      children: totpUriData ? formatMessage({
+                        id: index.getTranslation("userDetail.common.refresh"),
+                        defaultMessage: "Refresh"
+                      }) : formatMessage({
+                        id: index.getTranslation("userDetail.common.view"),
+                        defaultMessage: "View"
+                      })
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
+                  /* @__PURE__ */ jsxRuntime.jsxs(
+                    designSystem.Flex,
+                    {
+                      direction: "column",
+                      gap: 1,
+                      alignItems: "flex-start",
+                      children: [
+                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.common.backupCodes"
+                          ),
+                          defaultMessage: "Backup codes"
+                        }) }),
+                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.security.twoFactor.backupCodes.description"
+                          ),
+                          defaultMessage: "View or regenerate the user's recovery codes."
+                        }) })
+                      ]
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.Button,
+                      {
+                        variant: "secondary",
+                        size: "S",
+                        loading: viewBackupCodesMutation.isLoading,
+                        onClick: () => viewBackupCodesMutation.mutate(),
+                        children: backupCodesData ? formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.common.refresh"
+                          ),
+                          defaultMessage: "Refresh"
+                        }) : formatMessage({
+                          id: index.getTranslation("userDetail.common.view"),
+                          defaultMessage: "View"
+                        })
+                      }
+                    ),
+                    /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.Button,
+                      {
+                        variant: "secondary",
+                        size: "S",
+                        onClick: () => setConfirmRegenerateBackupCodes(true),
+                        children: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.common.regenerate"
+                          ),
+                          defaultMessage: "Regenerate"
+                        })
+                      }
+                    )
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.DangerRow, { children: [
+                  /* @__PURE__ */ jsxRuntime.jsxs(
+                    designSystem.Flex,
+                    {
+                      direction: "column",
+                      gap: 1,
+                      alignItems: "flex-start",
+                      children: [
+                        /* @__PURE__ */ jsxRuntime.jsx(
+                          designSystem.Typography,
+                          {
+                            variant: "omega",
+                            fontWeight: "semiBold",
+                            textColor: "danger600",
+                            children: formatMessage({
+                              id: index.getTranslation(
+                                "userDetail.common.disableTwoFactorTitle"
+                              ),
+                              defaultMessage: "Disable two-factor authentication"
+                            })
+                          }
+                        ),
+                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "danger500", children: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.security.twoFactor.disable.description"
+                          ),
+                          defaultMessage: "The user will no longer need a second factor to sign in."
+                        }) })
+                      ]
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.Button,
+                    {
+                      variant: "danger-light",
+                      size: "S",
+                      onClick: () => setConfirmDisable2FA(true),
+                      children: formatMessage({
+                        id: index.getTranslation(
+                          "userDetail.common.disableTwoFactor"
+                        ),
+                        defaultMessage: "Disable 2FA"
+                      })
+                    }
+                  )
+                ] })
+              ] }) : /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 2, children: [
+                twoFactorData && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", alignItems: "stretch", gap: 3, children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", children: formatMessage({
+                    id: index.getTranslation(
+                      "userDetail.security.twoFactor.setup.instructions"
+                    ),
+                    defaultMessage: "Scan the TOTP URI with an authenticator app, or enter the secret key manually."
+                  }) }),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    ReadOnlyField,
+                    {
+                      label: formatMessage({
+                        id: index.getTranslation("userDetail.common.totpUri"),
+                        defaultMessage: "TOTP URI"
+                      }),
+                      value: twoFactorData.totpURI
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    ReadOnlyField,
+                    {
+                      label: formatMessage({
+                        id: index.getTranslation("userDetail.common.secretKey"),
+                        defaultMessage: "Secret key"
+                      }),
+                      value: twoFactorData.secret
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", alignItems: "stretch", gap: 2, children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+                      id: index.getTranslation(
+                        "userDetail.common.backupCodes"
+                      ),
+                      defaultMessage: "Backup codes"
+                    }) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(BackupCodes, { codes: twoFactorData.backupCodes })
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
+                  /* @__PURE__ */ jsxRuntime.jsxs(
+                    designSystem.Flex,
+                    {
+                      direction: "column",
+                      gap: 1,
+                      alignItems: "flex-start",
+                      children: [
+                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.security.twoFactor.enable.title"
+                          ),
+                          defaultMessage: "Enable two-factor authentication"
+                        }) }),
+                        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.security.twoFactor.enable.description"
+                          ),
+                          defaultMessage: "Add an extra layer of security to this account."
+                        }) })
+                      ]
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.Button,
+                    {
+                      size: "S",
+                      loading: enableTwoFactorMutation.isLoading,
+                      onClick: () => enableTwoFactorMutation.mutate(),
+                      children: formatMessage({
+                        id: index.getTranslation(
+                          "userDetail.security.twoFactor.enable.submit"
+                        ),
+                        defaultMessage: "Enable 2FA"
+                      })
+                    }
+                  )
+                ] })
+              ] })
+            ] })
+          ] }) }),
+          banEnabled && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "ban", children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 5, paddingTop: 6, children: user?.banned ? /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+              id: index.getTranslation("userDetail.ban.status.title"),
+              defaultMessage: "Ban status"
+            }) }),
+            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.WarnCard, { children: [
+              /* @__PURE__ */ jsxRuntime.jsx(
+                designSystem.Typography,
+                {
+                  variant: "omega",
+                  fontWeight: "semiBold",
+                  textColor: "danger600",
+                  children: formatMessage({
+                    id: index.getTranslation("userDetail.ban.status.current"),
+                    defaultMessage: "This user is currently banned"
+                  })
+                }
+              ),
+              user.banReason && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "danger600", children: formatMessage(
+                {
+                  id: index.getTranslation(
+                    "userDetail.ban.status.reason"
+                  ),
+                  defaultMessage: "Reason: {reason}"
+                },
+                { reason: user.banReason }
+              ) }),
+              user.banExpires ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "danger600", children: formatMessage(
+                {
+                  id: index.getTranslation(
+                    "userDetail.ban.status.expires"
+                  ),
+                  defaultMessage: "Expires: {date}"
+                },
+                {
+                  date: new Date(
+                    user.banExpires
+                  ).toLocaleDateString(void 0, {
+                    weekday: "long",
+                    year: "numeric",
+                    month: "long",
+                    day: "numeric"
+                  })
+                }
+              ) }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "danger600", children: formatMessage({
+                id: index.getTranslation(
+                  "userDetail.ban.status.permanent"
+                ),
+                defaultMessage: "Duration: Permanent"
+              }) })
+            ] }),
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { children: /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.Button,
+              {
+                variant: "secondary",
+                onClick: () => setConfirmUnban(true),
+                children: formatMessage({
+                  id: index.getTranslation("userDetail.common.liftBan"),
+                  defaultMessage: "Lift ban"
+                })
+              }
+            ) })
+          ] }) : /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+              id: index.getTranslation("userDetail.ban.apply.title"),
+              defaultMessage: "Apply ban"
+            }) }),
+            /* @__PURE__ */ jsxRuntime.jsxs(
+              designSystem.Field.Root,
+              {
+                hint: formatMessage({
+                  id: index.getTranslation("userDetail.ban.apply.reason.hint"),
+                  defaultMessage: "Optional — will be shown to the user"
+                }),
+                style: { width: "100%" },
+                children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: formatMessage({
+                    id: index.getTranslation(
+                      "userDetail.ban.apply.reason.label"
+                    ),
+                    defaultMessage: "Reason"
+                  }) }),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.TextInput,
+                    {
+                      value: banReason,
+                      onChange: (e) => setBanReason(e.target.value),
+                      placeholder: formatMessage({
+                        id: index.getTranslation(
+                          "userDetail.ban.apply.reason.placeholder"
+                        ),
+                        defaultMessage: "e.g. Violated terms of service"
+                      })
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Hint, {})
+                ]
+              }
+            ),
+            /* @__PURE__ */ jsxRuntime.jsxs(
+              designSystem.Field.Root,
+              {
+                hint: formatMessage({
+                  id: index.getTranslation(
+                    "userDetail.ban.apply.duration.hint"
+                  ),
+                  defaultMessage: "Leave empty for a permanent ban"
+                }),
+                style: { width: "100%" },
+                children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: formatMessage({
+                    id: index.getTranslation(
+                      "userDetail.ban.apply.duration.label"
+                    ),
+                    defaultMessage: "Duration (days)"
+                  }) }),
+                  /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 4, alignItems: "center", children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { flex: 1, children: /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.NumberInput,
+                      {
+                        value: banExpiresDays ? Number(banExpiresDays) : void 0,
+                        onValueChange: (v) => setBanExpiresDays(
+                          v === void 0 ? "" : String(v)
+                        ),
+                        placeholder: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.ban.apply.duration.placeholder"
+                          ),
+                          defaultMessage: "e.g. 30"
+                        })
+                      }
+                    ) }),
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { shrink: 0, children: /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.PreviewPill, { children: banExpiryPreview ? formatMessage(
+                      {
+                        id: index.getTranslation(
+                          "userDetail.ban.apply.preview.expires"
+                        ),
+                        defaultMessage: "Expires {date}"
+                      },
+                      { date: banExpiryPreview }
+                    ) : formatMessage({
+                      id: index.getTranslation(
+                        "userDetail.ban.apply.preview.permanent"
+                      ),
+                      defaultMessage: "Permanent ban"
+                    }) }) })
+                  ] }),
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Hint, {})
+                ]
+              }
+            ),
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { children: /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.Button,
+              {
+                variant: "danger",
+                onClick: () => setConfirmBan(true),
+                children: formatMessage({
+                  id: index.getTranslation("userDetail.common.banUser"),
+                  defaultMessage: "Ban user"
+                })
+              }
+            ) })
+          ] }) }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "sessions", children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 5, paddingTop: 6, children: [
+            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+              /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+                id: index.getTranslation("userDetail.sessions.management"),
+                defaultMessage: "Session management"
+              }) }),
+              /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.AccountRow, { children: [
+                /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", gap: 1, alignItems: "flex-start", children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: formatMessage({
+                    id: index.getTranslation(
+                      "userDetail.common.revokeAllSessions"
+                    ),
+                    defaultMessage: "Revoke all sessions"
+                  }) }),
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: formatMessage({
+                    id: index.getTranslation(
+                      "userDetail.sessions.revokeAll.description"
+                    ),
+                    defaultMessage: "Signs the user out immediately on all devices."
+                  }) })
+                ] }),
+                /* @__PURE__ */ jsxRuntime.jsx(
+                  designSystem.Button,
+                  {
+                    variant: "danger-light",
+                    size: "S",
+                    onClick: () => setConfirmRevokeAll(true),
+                    style: { flexShrink: 0 },
+                    children: formatMessage({
+                      id: index.getTranslation("userDetail.common.revokeAll"),
+                      defaultMessage: "Revoke all"
+                    })
+                  }
+                )
+              ] })
+            ] }),
+            /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+              /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+                id: index.getTranslation("userDetail.sessions.active"),
+                defaultMessage: "Active sessions"
+              }) }),
+              sessionsQuery.isLoading ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", padding: 4, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Loader, { children: formatMessage({
+                id: index.getTranslation("userDetail.sessions.loading"),
+                defaultMessage: "Loading sessions…"
+              }) }) }) : (sessionsQuery.data ?? []).length === 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: formatMessage({
+                id: index.getTranslation("userDetail.sessions.empty"),
+                defaultMessage: "No active sessions."
+              }) }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 2, alignItems: "stretch", children: (sessionsQuery.data ?? []).map((session) => /* @__PURE__ */ jsxRuntime.jsxs(
+                useModelSchema.AccountRow,
+                {
+                  alignItems: "flex-start",
+                  children: [
+                    /* @__PURE__ */ jsxRuntime.jsxs(
+                      designSystem.Flex,
+                      {
+                        direction: "column",
+                        alignItems: "flex-start",
+                        gap: 1,
+                        flex: 1,
+                        minWidth: 0,
+                        children: [
+                          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, alignItems: "center", wrap: "wrap", children: [
+                            session.ipAddress && /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.MonoChip, { children: session.ipAddress }),
+                            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral600", children: formatMessage(
+                              {
+                                id: index.getTranslation(
+                                  "userDetail.sessions.timestamps"
+                                ),
+                                defaultMessage: "Created {createdAt} · Expires {expiresAt}"
+                              },
+                              {
+                                createdAt: new Date(
+                                  session.createdAt
+                                ).toLocaleString(),
+                                expiresAt: new Date(
+                                  session.expiresAt
+                                ).toLocaleString()
+                              }
+                            ) })
+                          ] }),
+                          session.userAgent && /* @__PURE__ */ jsxRuntime.jsx(
+                            designSystem.Typography,
+                            {
+                              variant: "pi",
+                              textColor: "neutral500",
+                              ellipsis: true,
+                              width: "100%",
+                              children: session.userAgent
+                            }
+                          )
+                        ]
+                      }
+                    ),
+                    /* @__PURE__ */ jsxRuntime.jsx(
+                      designSystem.IconButton,
+                      {
+                        label: formatMessage({
+                          id: index.getTranslation(
+                            "userDetail.common.revokeSession"
+                          ),
+                          defaultMessage: "Revoke session"
+                        }),
+                        onClick: () => setConfirmRevokeSessionId(String(session.id)),
+                        children: /* @__PURE__ */ jsxRuntime.jsx(icons.Trash, {})
+                      }
+                    )
+                  ]
+                },
+                session.documentId
+              )) })
+            ] })
+          ] }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tabs.Content, { value: "organizations", children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 5, paddingTop: 6, children: /* @__PURE__ */ jsxRuntime.jsxs(useModelSchema.FormSection, { children: [
+            /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.SectionLabel, { children: formatMessage({
+              id: index.getTranslation("userDetail.organizations.memberships"),
+              defaultMessage: "Memberships"
+            }) }),
+            orgsQuery.isLoading ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", padding: 4, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Loader, { small: true, children: formatMessage({
+              id: index.getTranslation("userDetail.organizations.loading"),
+              defaultMessage: "Loading…"
+            }) }) }) : (orgsQuery.data ?? []).length === 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: formatMessage({
+              id: index.getTranslation("userDetail.organizations.empty"),
+              defaultMessage: "Not a member of any organizations."
+            }) }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { direction: "column", gap: 2, children: (orgsQuery.data ?? []).map(
+              (org) => org ? /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.AccountRow, { children: /* @__PURE__ */ jsxRuntime.jsxs(
+                designSystem.Flex,
+                {
+                  direction: "column",
+                  gap: 1,
+                  alignItems: "flex-start",
+                  children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", fontWeight: "semiBold", children: org.name }),
+                    /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, alignItems: "center", children: [
+                      /* @__PURE__ */ jsxRuntime.jsx(useModelSchema.RoleBadge, { memberRole: org.role, children: org.role }),
+                      org.teams.length > 0 && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", textColor: "neutral500", children: formatMessage(
+                        {
+                          id: index.getTranslation(
+                            "userDetail.organizations.teams"
+                          ),
+                          defaultMessage: "{count, plural, one {# team} other {# teams}}"
+                        },
+                        { count: org.teams.length }
+                      ) })
+                    ] })
+                  ]
+                }
+              ) }, org.id) : null
+            ) })
+          ] }) }) })
+        ] }),
+        confirmRevokeAll && /* @__PURE__ */ jsxRuntime.jsx(
+          useModelSchema.ConfirmDialog,
+          {
+            title: formatMessage({
+              id: index.getTranslation("userDetail.common.revokeAllSessions"),
+              defaultMessage: "Revoke all sessions"
+            }),
+            message: formatMessage({
+              id: index.getTranslation("userDetail.confirm.revokeAll.message"),
+              defaultMessage: "Are you sure you want to revoke all sessions for this user? They will be signed out on all devices."
+            }),
+            confirmLabel: formatMessage({
+              id: index.getTranslation("userDetail.common.revokeAll"),
+              defaultMessage: "Revoke all"
+            }),
+            loading: revokeAllMutation.isLoading,
+            onConfirm: () => revokeAllMutation.mutate(),
+            onCancel: () => setConfirmRevokeAll(false)
+          }
+        ),
+        confirmRevokeSessionId && /* @__PURE__ */ jsxRuntime.jsx(
+          useModelSchema.ConfirmDialog,
+          {
+            title: formatMessage({
+              id: index.getTranslation("userDetail.common.revokeSession"),
+              defaultMessage: "Revoke session"
+            }),
+            message: formatMessage({
+              id: index.getTranslation("userDetail.confirm.revokeSession.message"),
+              defaultMessage: "Are you sure you want to revoke this session? The user will be signed out on this device."
+            }),
+            confirmLabel: formatMessage({
+              id: index.getTranslation("userDetail.confirm.revokeSession.confirm"),
+              defaultMessage: "Revoke"
+            }),
+            loading: revokeSessionMutation.isLoading,
+            onConfirm: () => revokeSessionMutation.mutate(confirmRevokeSessionId),
+            onCancel: () => setConfirmRevokeSessionId(null)
+          }
+        ),
+        confirmBan && /* @__PURE__ */ jsxRuntime.jsx(
+          useModelSchema.ConfirmDialog,
+          {
+            title: formatMessage({
+              id: index.getTranslation("userDetail.common.banUser"),
+              defaultMessage: "Ban user"
+            }),
+            message: banReason ? formatMessage(
+              {
+                id: index.getTranslation(
+                  "userDetail.confirm.ban.messageWithReason"
+                ),
+                defaultMessage: 'Ban this user for the following reason: "{reason}"? They will be prevented from signing in.'
+              },
+              { reason: banReason }
+            ) : formatMessage({
+              id: index.getTranslation("userDetail.confirm.ban.message"),
+              defaultMessage: "Are you sure you want to ban this user? They will be prevented from signing in."
+            }),
+            confirmLabel: formatMessage({
+              id: index.getTranslation("userDetail.common.banUser"),
+              defaultMessage: "Ban user"
+            }),
+            variant: "danger",
+            loading: banMutation.isLoading,
+            onConfirm: () => banMutation.mutate(),
+            onCancel: () => setConfirmBan(false)
+          }
+        ),
+        confirmUnban && /* @__PURE__ */ jsxRuntime.jsx(
+          useModelSchema.ConfirmDialog,
+          {
+            title: formatMessage({
+              id: index.getTranslation("userDetail.common.liftBan"),
+              defaultMessage: "Lift ban"
+            }),
+            message: formatMessage({
+              id: index.getTranslation("userDetail.confirm.unban.message"),
+              defaultMessage: "Are you sure you want to lift the ban on this user? They will be able to sign in again."
+            }),
+            confirmLabel: formatMessage({
+              id: index.getTranslation("userDetail.common.liftBan"),
+              defaultMessage: "Lift ban"
+            }),
+            variant: "default",
+            loading: unbanMutation.isLoading,
+            onConfirm: () => unbanMutation.mutate(),
+            onCancel: () => setConfirmUnban(false)
+          }
+        ),
+        confirmUnlinkAccountId && /* @__PURE__ */ jsxRuntime.jsx(
+          useModelSchema.ConfirmDialog,
+          {
+            title: formatMessage({
+              id: index.getTranslation("userDetail.confirm.unlink.title"),
+              defaultMessage: "Unlink account"
+            }),
+            message: formatMessage(
+              {
+                id: index.getTranslation("userDetail.confirm.unlink.message"),
+                defaultMessage: 'Are you sure you want to unlink the "{provider}" provider from this user?'
+              },
+              { provider: confirmUnlinkAccountId }
+            ),
+            confirmLabel: formatMessage({
+              id: index.getTranslation("userDetail.common.unlink"),
+              defaultMessage: "Unlink"
+            }),
+            loading: unlinkAccountMutation.isLoading,
+            onConfirm: () => unlinkAccountMutation.mutate(confirmUnlinkAccountId),
+            onCancel: () => setConfirmUnlinkAccountId(null)
+          }
+        ),
+        confirmDisable2FA && /* @__PURE__ */ jsxRuntime.jsx(
+          useModelSchema.ConfirmDialog,
+          {
+            title: formatMessage({
+              id: index.getTranslation("userDetail.common.disableTwoFactorTitle"),
+              defaultMessage: "Disable two-factor authentication"
+            }),
+            message: formatMessage({
+              id: index.getTranslation("userDetail.confirm.disableTwoFactor.message"),
+              defaultMessage: "Are you sure you want to disable 2FA for this user? They will no longer need a second factor to sign in."
+            }),
+            confirmLabel: formatMessage({
+              id: index.getTranslation("userDetail.common.disableTwoFactor"),
+              defaultMessage: "Disable 2FA"
+            }),
+            loading: disableTwoFactorMutation.isLoading,
+            onConfirm: () => disableTwoFactorMutation.mutate(),
+            onCancel: () => setConfirmDisable2FA(false)
+          }
+        ),
+        confirmRegenerateBackupCodes && /* @__PURE__ */ jsxRuntime.jsx(
+          useModelSchema.ConfirmDialog,
+          {
+            title: formatMessage({
+              id: index.getTranslation(
+                "userDetail.confirm.regenerateBackupCodes.title"
+              ),
+              defaultMessage: "Regenerate backup codes"
+            }),
+            message: formatMessage({
+              id: index.getTranslation(
+                "userDetail.confirm.regenerateBackupCodes.message"
+              ),
+              defaultMessage: "This will invalidate all existing backup codes. New codes will be shown once after generation. Are you sure?"
+            }),
+            confirmLabel: formatMessage({
+              id: index.getTranslation("userDetail.common.regenerate"),
+              defaultMessage: "Regenerate"
+            }),
+            loading: generateBackupCodesMutation.isLoading,
+            onConfirm: () => generateBackupCodesMutation.mutate(),
+            onCancel: () => setConfirmRegenerateBackupCodes(false)
+          }
+        ),
+        showTotpModal && totpUriData && /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Modal.Root,
+          {
+            defaultOpen: true,
+            onOpenChange: (open) => !open && setShowTotpModal(false),
+            children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Modal.Content, { children: [
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Header, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Title, { children: formatMessage({
+                id: index.getTranslation("userDetail.common.totpAuthenticator"),
+                defaultMessage: "TOTP authenticator"
+              }) }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Body, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", alignItems: "stretch", gap: 4, children: [
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", textColor: "neutral600", children: formatMessage({
+                  id: index.getTranslation("userDetail.totpModal.description"),
+                  defaultMessage: "Share these details with the user to set up their authenticator app."
+                }) }),
+                /* @__PURE__ */ jsxRuntime.jsx(
+                  ReadOnlyField,
+                  {
+                    label: formatMessage({
+                      id: index.getTranslation("userDetail.common.totpUri"),
+                      defaultMessage: "TOTP URI"
+                    }),
+                    value: totpUriData.totpURI
+                  }
+                ),
+                /* @__PURE__ */ jsxRuntime.jsx(
+                  ReadOnlyField,
+                  {
+                    label: formatMessage({
+                      id: index.getTranslation("userDetail.common.secretKey"),
+                      defaultMessage: "Secret key"
+                    }),
+                    value: totpUriData.secret
+                  }
+                )
+              ] }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Footer, { children: /* @__PURE__ */ jsxRuntime.jsx(
+                designSystem.Button,
+                {
+                  variant: "tertiary",
+                  onClick: () => setShowTotpModal(false),
+                  children: formatMessage({
+                    id: index.getTranslation("userDetail.common.close"),
+                    defaultMessage: "Close"
+                  })
+                }
+              ) })
+            ] })
+          }
+        ),
+        showBackupCodesModal && backupCodesData && /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Modal.Root,
+          {
+            defaultOpen: true,
+            onOpenChange: (open) => !open && setShowBackupCodesModal(false),
+            children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Modal.Content, { children: [
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Header, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Title, { children: formatMessage({
+                id: index.getTranslation("userDetail.common.backupCodes"),
+                defaultMessage: "Backup codes"
+              }) }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Body, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", alignItems: "stretch", gap: 4, children: [
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "omega", textColor: "neutral600", children: formatMessage({
+                  id: index.getTranslation(
+                    "userDetail.backupCodesModal.description"
+                  ),
+                  defaultMessage: "Each code can only be used once. Store them somewhere safe."
+                }) }),
+                /* @__PURE__ */ jsxRuntime.jsx(BackupCodes, { codes: backupCodesData })
+              ] }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Footer, { children: /* @__PURE__ */ jsxRuntime.jsx(
+                designSystem.Button,
+                {
+                  variant: "tertiary",
+                  onClick: () => setShowBackupCodesModal(false),
+                  children: formatMessage({
+                    id: index.getTranslation("userDetail.common.close"),
+                    defaultMessage: "Close"
+                  })
+                }
+              ) })
+            ] })
+          }
+        )
+      ]
+    }
+  );
+}
+const PAGE_SIZE = 25;
+function UsersPage({ config }) {
+  const { formatMessage } = reactIntl.useIntl();
+  const rbac = admin.useRBAC(index.PERMISSIONS.user);
+  const qc = reactQuery.useQueryClient();
+  const { toggleNotification } = admin.useNotification();
+  const banEnabled = index.hasPlugin(config, "admin");
+  const emailVerificationEnabled = config.emailVerification.sendVerificationEmailEnabled;
+  const twoFactorEnabled = index.hasPlugin(config, "two-factor");
+  const [page, setPage] = react.useState(1);
+  const [search, setSearch] = react.useState("");
+  const [searchInput, setSearchInput] = react.useState("");
+  const [selected, setSelected] = react.useState(/* @__PURE__ */ new Set());
+  const [showCreate, setShowCreate] = react.useState(false);
+  const [detailUserId, setDetailUserId] = react.useState(null);
+  const [confirmDelete, setConfirmDelete] = react.useState(null);
+  const [confirmDeleteMany, setConfirmDeleteMany] = react.useState(false);
+  const [confirmBanMany, setConfirmBanMany] = react.useState(false);
+  const offset = (page - 1) * PAGE_SIZE;
+  const { data, isLoading, isError, error } = useUsers({
+    limit: PAGE_SIZE,
+    offset,
+    search: search || void 0
+  });
+  const users = data?.users ?? [];
+  const total = data?.total ?? 0;
+  const pageCount = Math.ceil(total / PAGE_SIZE);
+  const deleteMutation = reactQuery.useMutation({
+    mutationFn: async (userId) => {
+      const result = await index.client.dash.deleteUser(
+        {},
+        useModelSchema.withContext({ userId }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("users.list.errors.deleteFailed"),
+            defaultMessage: "Delete failed"
+          })
+        );
+    },
+    onSuccess: () => {
+      setConfirmDelete(null);
+      qc.invalidateQueries({ queryKey: ["dash-users"] });
+      qc.invalidateQueries({ queryKey: ["dash-user-stats"] });
+      toggleNotification({
+        type: "success",
+        message: formatMessage({
+          id: index.getTranslation("users.list.notifications.deleted"),
+          defaultMessage: "User deleted"
+        })
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("users.list.notifications.deleteError"),
+          defaultMessage: "Failed to delete user"
+        })
+      });
+    }
+  });
+  const deleteManyMutation = reactQuery.useMutation({
+    mutationFn: async (userIds) => {
+      const result = await index.client.dash.deleteManyUsers(
+        {},
+        useModelSchema.withContext({ userIds }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("users.list.errors.deleteFailed"),
+            defaultMessage: "Delete failed"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: (_data, userIds) => {
+      setConfirmDeleteMany(false);
+      setSelected(/* @__PURE__ */ new Set());
+      qc.invalidateQueries({ queryKey: ["dash-users"] });
+      qc.invalidateQueries({ queryKey: ["dash-user-stats"] });
+      toggleNotification({
+        type: "success",
+        message: formatMessage(
+          {
+            id: index.getTranslation("users.list.notifications.deletedMany"),
+            defaultMessage: "{count, plural, one {# user} other {# users}} deleted"
+          },
+          { count: userIds.length }
+        )
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("users.list.notifications.deleteManyError"),
+          defaultMessage: "Failed to delete users"
+        })
+      });
+    }
+  });
+  const banManyMutation = reactQuery.useMutation({
+    mutationFn: async (userIds) => {
+      const result = await index.client.dash.banManyUsers(
+        {},
+        useModelSchema.withContext({ userIds }, index.getAuthHeaders())
+      );
+      if (result.error)
+        throw new Error(
+          result.error.message ?? formatMessage({
+            id: index.getTranslation("users.list.errors.banFailed"),
+            defaultMessage: "Ban failed"
+          })
+        );
+      return result.data;
+    },
+    onSuccess: (_data, userIds) => {
+      setConfirmBanMany(false);
+      setSelected(/* @__PURE__ */ new Set());
+      qc.invalidateQueries({ queryKey: ["dash-users"] });
+      toggleNotification({
+        type: "success",
+        message: formatMessage(
+          {
+            id: index.getTranslation("users.list.notifications.bannedMany"),
+            defaultMessage: "{count, plural, one {# user} other {# users}} banned"
+          },
+          { count: userIds.length }
+        )
+      });
+    },
+    onError: (err) => {
+      toggleNotification({
+        type: "danger",
+        message: err.message ?? formatMessage({
+          id: index.getTranslation("users.list.notifications.banManyError"),
+          defaultMessage: "Failed to ban users"
+        })
+      });
+    }
+  });
+  const toggleSelect = (id) => {
+    setSelected((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  };
+  const allSelected = users.length > 0 && users.every((u) => selected.has(u.id));
+  const someSelected = selected.size > 0;
+  const handleSelectAll = () => {
+    if (allSelected) {
+      setSelected(/* @__PURE__ */ new Set());
+    } else {
+      setSelected(new Set(users.map((u) => u.id)));
+    }
+  };
+  const handleSearch = (e) => {
+    e.preventDefault();
+    setSearch(searchInput);
+    setPage(1);
+  };
+  const canSelect = rbac.allowedActions.canDelete || rbac.allowedActions.canUpdate;
+  const colCount = canSelect ? 6 : 5;
+  return /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Main, { "data-testid": "users-page", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(
+      admin.Layouts.Header,
+      {
+        title: formatMessage({
+          id: index.getTranslation("users.list.header.title"),
+          defaultMessage: "Users"
+        }),
+        subtitle: data?.onlineUsers ? formatMessage(
+          {
+            id: index.getTranslation("users.list.header.subtitleWithOnline"),
+            defaultMessage: "{total} total · {online} online"
+          },
+          { total: total.toLocaleString(), online: data.onlineUsers }
+        ) : formatMessage(
+          {
+            id: index.getTranslation("users.list.header.subtitle"),
+            defaultMessage: "{total} total"
+          },
+          { total: total.toLocaleString() }
+        ),
+        primaryAction: rbac.allowedActions.canCreate && /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Button,
+          {
+            startIcon: /* @__PURE__ */ jsxRuntime.jsx(icons.Plus, {}),
+            onClick: () => setShowCreate(true),
+            "data-testid": "create-user-btn",
+            children: formatMessage({
+              id: index.getTranslation("users.list.header.create"),
+              defaultMessage: "Create user"
+            })
+          }
+        )
+      }
+    ),
+    /* @__PURE__ */ jsxRuntime.jsx(
+      admin.Layouts.Action,
+      {
+        startActions: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, children: [
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.SearchForm, { onSubmit: handleSearch, children: /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Searchbar,
+            {
+              clearLabel: formatMessage({
+                id: index.getTranslation("users.list.search.clear"),
+                defaultMessage: "Clear"
+              }),
+              name: "search",
+              placeholder: formatMessage({
+                id: index.getTranslation("users.list.search.placeholder"),
+                defaultMessage: "Search by email…"
+              }),
+              value: searchInput,
+              onChange: (e) => setSearchInput(e.target.value),
+              onClear: () => {
+                setSearchInput("");
+                setSearch("");
+                setPage(1);
+              },
+              "data-testid": "user-search",
+              children: formatMessage({
+                id: index.getTranslation("users.list.search.label"),
+                defaultMessage: "Search users"
+              })
+            }
+          ) }),
+          someSelected && rbac.allowedActions.canDelete && /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Button,
+            {
+              variant: "danger-light",
+              size: "S",
+              onClick: () => setConfirmDeleteMany(true),
+              "data-testid": "delete-selected-btn",
+              children: formatMessage(
+                {
+                  id: index.getTranslation("users.list.actions.deleteSelected"),
+                  defaultMessage: "Delete {count} selected"
+                },
+                { count: selected.size }
+              )
+            }
+          ),
+          someSelected && banEnabled && rbac.allowedActions.canUpdate && /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Button,
+            {
+              variant: "secondary",
+              size: "S",
+              onClick: () => setConfirmBanMany(true),
+              children: formatMessage(
+                {
+                  id: index.getTranslation("users.list.actions.banSelected"),
+                  defaultMessage: "Ban {count} selected"
+                },
+                { count: selected.size }
+              )
+            }
+          )
+        ] })
+      }
+    ),
+    /* @__PURE__ */ jsxRuntime.jsx(admin.Layouts.Content, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", alignItems: "stretch", gap: 4, children: [
+      isError && /* @__PURE__ */ jsxRuntime.jsx(
+        designSystem.Alert,
+        {
+          closeLabel: formatMessage({
+            id: index.getTranslation("users.list.alert.close"),
+            defaultMessage: "Close"
+          }),
+          title: formatMessage({
+            id: index.getTranslation("users.list.alert.error"),
+            defaultMessage: "Error"
+          }),
+          variant: "danger",
+          children: error?.message
+        }
+      ),
+      isLoading ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", padding: 8, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Loader, { children: formatMessage({
+        id: index.getTranslation("users.list.loading"),
+        defaultMessage: "Loading users…"
+      }) }) }) : /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Table, { colCount, rowCount: users.length + 1, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Thead, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Tr, { children: [
+          canSelect && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Checkbox,
+            {
+              checked: allSelected ? true : someSelected ? "indeterminate" : false,
+              onCheckedChange: handleSelectAll,
+              "aria-label": formatMessage({
+                id: index.getTranslation("users.list.table.selectAll"),
+                defaultMessage: "Select all"
+              })
+            }
+          ) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", children: formatMessage({
+            id: index.getTranslation("users.list.table.headers.name"),
+            defaultMessage: "Name"
+          }) }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", children: formatMessage({
+            id: index.getTranslation("users.list.table.headers.email"),
+            defaultMessage: "Email"
+          }) }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", children: formatMessage({
+            id: index.getTranslation("users.list.table.headers.status"),
+            defaultMessage: "Status"
+          }) }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", children: formatMessage({
+            id: index.getTranslation("users.list.table.headers.created"),
+            defaultMessage: "Created"
+          }) }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.VisuallyHidden, { children: formatMessage({
+            id: index.getTranslation("users.list.table.headers.actions"),
+            defaultMessage: "Actions"
+          }) }) })
+        ] }) }),
+        /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tbody, { children: users.length === 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tr, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { colSpan: colCount, children: /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Flex,
+          {
+            justifyContent: "center",
+            padding: 8,
+            "data-testid": "users-empty",
+            children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral600", children: search ? formatMessage(
+              {
+                id: index.getTranslation("users.list.empty.search"),
+                defaultMessage: 'No users matching "{search}"'
+              },
+              { search }
+            ) : formatMessage({
+              id: index.getTranslation("users.list.empty.default"),
+              defaultMessage: "No users found"
+            }) })
+          }
+        ) }) }) : users.map((user) => /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Tr, { "data-testid": "user-row", children: [
+          canSelect && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(
+            designSystem.Checkbox,
+            {
+              checked: selected.has(user.id),
+              onCheckedChange: () => toggleSelect(user.id),
+              "aria-label": formatMessage(
+                {
+                  id: index.getTranslation(
+                    "users.list.table.selectRow"
+                  ),
+                  defaultMessage: "Select {name}"
+                },
+                { name: user.name }
+              )
+            }
+          ) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { alignItems: "center", gap: 2, children: [
+            /* @__PURE__ */ jsxRuntime.jsx(
+              Avatar.Avatar,
+              {
+                name: user.name ?? "",
+                src: user.image,
+                size: 28
+              }
+            ),
+            /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.Typography,
+              {
+                fontWeight: "semiBold",
+                textColor: "neutral800",
+                children: user.name
+              }
+            )
+          ] }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral800", children: user.email }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 1, children: [
+            user.emailVerified ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { variant: "success", size: "S", children: formatMessage({
+              id: index.getTranslation(
+                "users.list.status.verified"
+              ),
+              defaultMessage: "Verified"
+            }) }) : /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { variant: "neutral", size: "S", children: formatMessage({
+              id: index.getTranslation(
+                "users.list.status.unverified"
+              ),
+              defaultMessage: "Unverified"
+            }) }),
+            user.banned && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { variant: "danger", size: "S", children: formatMessage({
+              id: index.getTranslation("users.list.status.banned"),
+              defaultMessage: "Banned"
+            }) })
+          ] }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral800", children: new Date(user.createdAt).toLocaleDateString() }) }),
+          /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 1, justifyContent: "flex-end", children: [
+            rbac.allowedActions.canUpdate && /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.IconButton,
+              {
+                label: formatMessage({
+                  id: index.getTranslation("users.list.table.editUser"),
+                  defaultMessage: "Edit user"
+                }),
+                variant: "ghost",
+                onClick: () => setDetailUserId(user.id),
+                "data-testid": "edit-user-btn",
+                children: /* @__PURE__ */ jsxRuntime.jsx(icons.Pencil, {})
+              }
+            ),
+            rbac.allowedActions.canDelete && /* @__PURE__ */ jsxRuntime.jsx(
+              designSystem.IconButton,
+              {
+                label: formatMessage({
+                  id: index.getTranslation(
+                    "users.list.table.deleteUser"
+                  ),
+                  defaultMessage: "Delete user"
+                }),
+                variant: "ghost",
+                onClick: () => setConfirmDelete(user.id),
+                "data-testid": "delete-user-btn",
+                children: /* @__PURE__ */ jsxRuntime.jsx(icons.Trash, {})
+              }
+            )
+          ] }) })
+        ] }, user.id)) })
+      ] }),
+      pageCount > 1 && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { justifyContent: "flex-end", gap: 2, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Button,
+          {
+            variant: "tertiary",
+            size: "S",
+            disabled: page === 1,
+            onClick: () => setPage((p) => p - 1),
+            children: formatMessage({
+              id: index.getTranslation("users.list.pagination.previous"),
+              defaultMessage: "Previous"
+            })
+          }
+        ),
+        /* @__PURE__ */ jsxRuntime.jsx(
+          designSystem.Button,
+          {
+            variant: "tertiary",
+            size: "S",
+            disabled: page >= pageCount,
+            onClick: () => setPage((p) => p + 1),
+            children: formatMessage({
+              id: index.getTranslation("users.list.pagination.next"),
+              defaultMessage: "Next"
+            })
+          }
+        )
+      ] })
+    ] }) }),
+    rbac.allowedActions.canCreate && showCreate && /* @__PURE__ */ jsxRuntime.jsx(CreateUserDialog, { onClose: () => setShowCreate(false) }),
+    rbac.allowedActions.canUpdate && detailUserId && /* @__PURE__ */ jsxRuntime.jsx(
+      UserDetailDrawer,
+      {
+        userId: detailUserId,
+        banEnabled,
+        emailVerificationEnabled,
+        twoFactorEnabled,
+        onClose: () => setDetailUserId(null)
+      }
+    ),
+    rbac.allowedActions.canDelete && confirmDelete && /* @__PURE__ */ jsxRuntime.jsx(
+      useModelSchema.ConfirmDialog,
+      {
+        title: formatMessage({
+          id: index.getTranslation("users.list.confirmDelete.title"),
+          defaultMessage: "Delete user"
+        }),
+        message: formatMessage({
+          id: index.getTranslation("users.list.confirmDelete.message"),
+          defaultMessage: "Are you sure you want to delete this user? This action cannot be undone."
+        }),
+        confirmLabel: formatMessage({
+          id: index.getTranslation("users.list.confirmDelete.confirm"),
+          defaultMessage: "Delete"
+        }),
+        loading: deleteMutation.isLoading,
+        onConfirm: () => deleteMutation.mutate(confirmDelete),
+        onCancel: () => setConfirmDelete(null)
+      }
+    ),
+    rbac.allowedActions.canDelete && confirmDeleteMany && /* @__PURE__ */ jsxRuntime.jsx(
+      useModelSchema.ConfirmDialog,
+      {
+        title: formatMessage(
+          {
+            id: index.getTranslation("users.list.confirmDeleteMany.title"),
+            defaultMessage: "Delete {count, plural, one {# user} other {# users}}"
+          },
+          { count: selected.size }
+        ),
+        message: formatMessage(
+          {
+            id: index.getTranslation("users.list.confirmDeleteMany.message"),
+            defaultMessage: "Are you sure you want to delete {count, plural, one {# user} other {# users}}? This action cannot be undone."
+          },
+          { count: selected.size }
+        ),
+        confirmLabel: formatMessage({
+          id: index.getTranslation("users.list.confirmDeleteMany.confirm"),
+          defaultMessage: "Delete all"
+        }),
+        loading: deleteManyMutation.isLoading,
+        onConfirm: () => deleteManyMutation.mutate([...selected]),
+        onCancel: () => setConfirmDeleteMany(false)
+      }
+    ),
+    rbac.allowedActions.canUpdate && confirmBanMany && /* @__PURE__ */ jsxRuntime.jsx(
+      useModelSchema.ConfirmDialog,
+      {
+        title: formatMessage(
+          {
+            id: index.getTranslation("users.list.confirmBanMany.title"),
+            defaultMessage: "Ban {count, plural, one {# user} other {# users}}"
+          },
+          { count: selected.size }
+        ),
+        message: formatMessage(
+          {
+            id: index.getTranslation("users.list.confirmBanMany.message"),
+            defaultMessage: "Are you sure you want to ban {count, plural, one {# user} other {# users}}? They will be prevented from signing in."
+          },
+          { count: selected.size }
+        ),
+        confirmLabel: formatMessage({
+          id: index.getTranslation("users.list.confirmBanMany.confirm"),
+          defaultMessage: "Ban all"
+        }),
+        variant: "danger",
+        loading: banManyMutation.isLoading,
+        onConfirm: () => banManyMutation.mutate([...selected]),
+        onCancel: () => setConfirmBanMany(false)
+      }
+    )
+  ] });
+}
+function ProtectedUsersPage() {
+  const { formatMessage } = reactIntl.useIntl();
+  const { data: config, isError, error } = index.useDashConfig();
+  if (isError) {
+    return /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { padding: 6, children: /* @__PURE__ */ jsxRuntime.jsx(
+      designSystem.Alert,
+      {
+        closeLabel: formatMessage({
+          id: index.getTranslation("users.config.close"),
+          defaultMessage: "Close"
+        }),
+        title: formatMessage({
+          id: index.getTranslation("users.config.errorTitle"),
+          defaultMessage: "Error loading configuration"
+        }),
+        variant: "danger",
+        children: error.message
+      }
+    ) });
+  }
+  if (!config) {
+    return /* @__PURE__ */ jsxRuntime.jsx(designSystem.Flex, { justifyContent: "center", alignItems: "center", padding: 12, children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Loader, { children: formatMessage({
+      id: index.getTranslation("users.config.loading"),
+      defaultMessage: "Loading user configuration…"
+    }) }) });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    admin.Page.Protect,
+    {
+      permissions: index.PERMISSIONS.user.filter(
+        (p) => p.action === `plugin::${index.PLUGIN_ID}.user.read`
+      ),
+      children: /* @__PURE__ */ jsxRuntime.jsx(UsersPage, { config })
+    }
+  );
+}
+exports.UsersPage = UsersPage;
+exports.default = ProtectedUsersPage;