shutro-erp 0.3.4 → 0.3.5

package/dist/settings/app-settings.js

@@ -0,0 +1,518 @@
+import { audit, HttpProblem, publicApiModels, ServerConfigError, } from '../server/index.js';
+const ref = (env, name) => env.model(name);
+const TYPES = new Set(['boolean', 'integer', 'decimal', 'char', 'text', 'selection', 'date']);
+/** Company field kinds a setting may be. */
+const KINDS = {
+    boolean: 'boolean',
+    integer: 'integer',
+    decimal: 'decimal',
+    monetary: 'decimal',
+    float: 'decimal',
+    char: 'char',
+    text: 'text',
+    selection: 'selection',
+    date: 'date',
+};
+export function registerAppSettingsRoutes(context) {
+    const { app, registry } = context;
+    const modules = registry.loaded.modules;
+    const company = publicApiModels(registry).get('res.company');
+    const companyFields = new Map((company?.fields ?? []).map((f) => [f.key, f]));
+    const descriptors = registry.registry.get('res.company').model.fields;
+    const groups = registry.registry.security.groups;
+    // ---- the declarations, checked once at start: a wrong one stops the server, like other manifest errors.
+    const fail = (module, detail) => new ServerConfigError(`The settings of ${module}: ${detail}`, 'Fix the module’s settings declaration.');
+    const fromField = (module, spec, field) => {
+        if (field === undefined || !field.stored)
+            throw fail(module, `'${spec.key}' is not a stored res.company field (add it with extendModel).`);
+        const type = KINDS[field.kind];
+        if (type === undefined)
+            throw fail(module, `'${spec.key}' is a ${field.kind} field: not a setting type.`);
+        const raw = descriptors[spec.key]?.['default'];
+        return {
+            key: spec.key,
+            type,
+            label: spec.label ?? field.label,
+            help: spec.help ?? null,
+            default: spec.default !== undefined
+                ? spec.default
+                : typeof raw === 'string' || typeof raw === 'number' || typeof raw === 'boolean'
+                    ? raw
+                    : null,
+            min: spec.min ?? null,
+            max: spec.max ?? null,
+            options: field.options === null ? null : field.options.map(([value, label]) => ({ value, label })),
+            visibleWhen: spec.visibleWhen ?? null,
+        };
+    };
+    const ownSetting = (module, spec) => {
+        if (spec.type === undefined || !TYPES.has(spec.type) || spec.label === undefined)
+            throw fail(module, `'${spec.key}' needs a type and a label (an installation setting).`);
+        if (spec.type === 'selection' && spec.options === undefined)
+            throw fail(module, `'${spec.key}' is a selection without options.`);
+        return {
+            key: spec.key,
+            type: spec.type,
+            label: spec.label,
+            help: spec.help ?? null,
+            default: spec.default ?? null,
+            min: spec.min ?? null,
+            max: spec.max ?? null,
+            options: spec.options === undefined
+                ? null
+                : Object.entries(spec.options).map(([value, label]) => ({ value, label })),
+            visibleWhen: spec.visibleWhen ?? null,
+        };
+    };
+    const sections = [];
+    const seen = new Set();
+    for (const m of modules)
+        for (const spec of m.settings?.sections ?? []) {
+            if (!/^[a-z][a-z0-9_]*$/.test(spec.key))
+                throw fail(m.name, `the section key '${spec.key}'.`);
+            if (seen.has(`${m.name}.${spec.key}`))
+                throw fail(m.name, `two sections '${spec.key}'.`);
+            seen.add(`${m.name}.${spec.key}`);
+            for (const g of spec.editors ?? [])
+                if (!groups.has(g))
+                    throw fail(m.name, `the editor group '${g}' is not defined.`);
+            const keys = new Set();
+            const settings = spec.fields.map((f) => {
+                if (keys.has(f.key))
+                    throw fail(m.name, `'${f.key}' twice in '${spec.key}'.`);
+                keys.add(f.key);
+                return spec.scope === 'company'
+                    ? fromField(m.name, f, companyFields.get(f.key))
+                    : ownSetting(m.name, f);
+            });
+            for (const s of settings)
+                if (s.visibleWhen !== null && !keys.has(s.visibleWhen.key))
+                    throw fail(m.name, `'${s.key}' depends on '${s.visibleWhen.key}', not in its section.`);
+            sections.push({ app: m.name, spec, settings });
+        }
+    /** The groups that open an app: its access levels' groups. */
+    const openers = new Map(modules.map((m) => [
+        m.name,
+        new Set(Object.values(m.accessLevels ?? {}).flatMap((l) => [...l.groups])),
+    ]));
+    const mayView = (env, module) => env.administrator || [...(openers.get(module) ?? [])].some((g) => env.groups.has(g));
+    const mayEdit = (env, section) => env.administrator || (section.spec.editors ?? []).some((g) => env.groups.has(g));
+    const label = (module) => {
+        const m = modules.find((x) => x.name === module);
+        return { label: m?.app?.label ?? module, icon: m?.app?.icon ?? null };
+    };
+    const storedKey = (section, key) => `${section.app}.${key}`;
+    /** The current values of a section: the company's fields, or the installation's records. */
+    const valuesOf = async (su, section, companyId) => {
+        if (section.spec.scope === 'company') {
+            const keys = section.settings.map((s) => s.key);
+            const [row] = (await ref(su, 'res.company').browse([companyId]).load(keys)).read(keys);
+            return Object.fromEntries(keys.map((k) => [k, normalize(row?.[k])]));
+        }
+        const found = await ref(su, 'kosh.setting').search({
+            where: { key: { in: section.settings.map((s) => storedKey(section, s.key)) } },
+        });
+        const rows = found.length === 0 ? [] : (await found.load(['key', 'value'])).read(['key', 'value']);
+        const stored = new Map(rows.map((r) => [String(r['key']), r['value']]));
+        return Object.fromEntries(section.settings.map((s) => [
+            s.key,
+            stored.has(storedKey(section, s.key))
+                ? stored.get(storedKey(section, s.key))
+                : s.default,
+        ]));
+    };
+    /** A value checked against its setting. @throws {HttpProblem} 422 */
+    const check = (s, value) => {
+        const bad = (detail) => new HttpProblem(422, 'invalid-setting', 'Invalid setting', `${s.label}: ${detail}`);
+        if (value === null || value === '') {
+            if (s.type === 'boolean')
+                throw bad('yes or no.');
+            return null;
+        }
+        switch (s.type) {
+            case 'boolean':
+                if (typeof value !== 'boolean')
+                    throw bad('yes or no.');
+                return value;
+            case 'integer': {
+                if (!Number.isSafeInteger(value))
+                    throw bad('a whole number.');
+                const n = value;
+                if ((s.min !== null && n < s.min) || (s.max !== null && n > s.max))
+                    throw bad(`from ${s.min ?? '…'} to ${s.max ?? '…'}.`);
+                return n;
+            }
+            case 'decimal': {
+                // Money and quantities stay strings (Shutro Decimal), never JS numbers.
+                const text = typeof value === 'number' ? String(value) : String(value);
+                if (!/^-?\d+(\.\d+)?$/.test(text))
+                    throw bad('a number.');
+                return text;
+            }
+            case 'selection':
+                if (typeof value !== 'string' || !(s.options ?? []).some((o) => o.value === value))
+                    throw bad('one of the choices.');
+                return value;
+            case 'date':
+                if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value))
+                    throw bad('a date (YYYY-MM-DD).');
+                return value;
+            default:
+                if (typeof value !== 'string' || value.length > (s.type === 'char' ? 500 : 20_000))
+                    throw bad('text.');
+                return value;
+        }
+    };
+    const sectionOf = (request) => {
+        const { app: module, section } = request.params;
+        const found = sections.find((s) => s.app === module && s.spec.key === section);
+        if (found === undefined)
+            throw new HttpProblem(404, 'missing-record', 'Not found', `There are no settings ${module}/${section}.`);
+        return found;
+    };
+    const shape = (section, values, editable) => ({
+        key: section.spec.key,
+        label: section.spec.label,
+        description: section.spec.description ?? null,
+        scope: section.spec.scope,
+        editable,
+        settings: section.settings.map((s) => ({
+            ...s,
+            value: values[s.key] ?? null,
+            changed: (values[s.key] ?? null) !== s.default,
+        })),
+    });
+    app.get('/api/v1/settings/app-settings', async (request) => request.env(async (env) => {
+        const apps = [...new Set(sections.map((s) => s.app))].filter((m) => mayView(env, m));
+        return {
+            administrator: env.administrator,
+            apps: apps.map((m) => ({
+                app: m,
+                ...label(m),
+                sections: sections
+                    .filter((s) => s.app === m)
+                    .map((s) => ({
+                    key: s.spec.key,
+                    label: s.spec.label,
+                    description: s.spec.description ?? null,
+                    keywords: [s.spec.keywords ?? '', ...s.settings.map((x) => x.label)].join(' '),
+                })),
+            })),
+        };
+    }));
+    app.get('/api/v1/settings/app-settings/:app', async (request) => {
+        const module = request.params.app ?? '';
+        return request.env(async (env) => {
+            const mine = sections.filter((s) => s.app === module);
+            if (mine.length === 0 || !mayView(env, module))
+                throw new HttpProblem(404, 'missing-record', 'Not found', `There are no settings for ${module}.`);
+            return env.asSuperuser({ reason: 'app settings' }, async (su) => ({
+                app: module,
+                ...label(module),
+                company: env.companyId,
+                sections: await Promise.all(mine.map(async (s) => shape(s, await valuesOf(su, s, env.companyId), mayEdit(env, s)))),
+            }));
+        }, { write: true });
+    });
+    /** Writes `changes` to the section's store for `companyId` and audits them with the old and new values. */
+    const apply = async (env, su, section, changes, companyId, how, extra, ip) => {
+        if (section.spec.scope === 'company')
+            await ref(su, 'res.company')
+                .browse([companyId])
+                .write(Object.fromEntries(Object.entries(changes).map(([k, c]) => [k, c.to])));
+        else
+            for (const [k, c] of Object.entries(changes)) {
+                const key = storedKey(section, k);
+                const existing = await ref(su, 'kosh.setting').search({ where: { key } });
+                if (existing.length > 0)
+                    await existing.write({ value: c.to });
+                else
+                    await ref(su, 'kosh.setting').create([{ key, value: c.to }]);
+            }
+        await audit(env, {
+            kind: 'settings.changed',
+            summary: `${label(section.app).label} › ${section.spec.label}: ${Object.keys(changes).join(', ')} ${how}.`,
+            details: {
+                app: section.app,
+                section: section.spec.key,
+                scope: section.spec.scope,
+                changes,
+                ...extra,
+            },
+            company: companyId,
+            ip,
+        });
+    };
+    /** Writes `next` (only the keys that changed), audited with the old and new values. */
+    const save = (request, section, next) => request.env(async (env) => {
+        if (!mayView(env, section.app) || !mayEdit(env, section))
+            throw new HttpProblem(403, 'access', 'App settings', `Changing ${section.spec.label} needs ${(section.spec.editors ?? []).length === 0
+                ? 'the Administrator role'
+                : `one of: ${(section.spec.editors ?? []).join(', ')}`}.`);
+        return env.asSuperuser({ reason: 'app settings' }, async (su) => {
+            const old = await valuesOf(su, section, env.companyId);
+            const wanted = next(old);
+            const changes = Object.fromEntries(Object.entries(wanted)
+                .filter(([k, v]) => old[k] !== v)
+                .map(([k, v]) => [k, { from: old[k] ?? null, to: v }]));
+            if (Object.keys(changes).length > 0) {
+                await apply(env, su, section, changes, env.companyId, 'changed', {}, request.ip);
+                await su.flush();
+            }
+            return shape(section, { ...old, ...wanted }, true);
+        });
+    }, { write: true });
+    app.patch('/api/v1/settings/app-settings/:app/:section', async (request) => {
+        const section = sectionOf(request);
+        const body = (request.body ?? {});
+        const values = body['values'];
+        if (typeof values !== 'object' || values === null || Array.isArray(values))
+            throw new HttpProblem(422, 'invalid-setting', 'Invalid setting', 'values is { key: value }.');
+        const checked = {};
+        for (const [key, value] of Object.entries(values)) {
+            const s = section.settings.find((x) => x.key === key);
+            if (s === undefined)
+                throw new HttpProblem(422, 'invalid-setting', 'Invalid setting', `'${key}' is not in ${section.spec.label}.`);
+            checked[key] = check(s, value);
+        }
+        return save(request, section, () => checked);
+    });
+    app.post('/api/v1/settings/app-settings/:app/:section/reset', async (request) => {
+        const section = sectionOf(request);
+        const keys = request.body?.['keys'];
+        const chosen = Array.isArray(keys) ? keys.map(String) : section.settings.map((s) => s.key);
+        const defaults = {};
+        for (const key of chosen) {
+            const s = section.settings.find((x) => x.key === key);
+            if (s === undefined)
+                throw new HttpProblem(422, 'invalid-setting', 'Invalid setting', `'${key}' is not in ${section.spec.label}.`);
+            defaults[key] = s.default;
+        }
+        return save(request, section, () => defaults);
+    });
+    // ---- step 2: history, copy between companies, export and import.
+    const administrators = (env) => {
+        if (!env.administrator)
+            throw new HttpProblem(403, 'access', 'App settings', 'This needs the Administrator role.');
+    };
+    /** Whether `companyId` is one of the user's companies. */
+    const memberOf = async (su, uid, companyId) => (await ref(su, 'res.users').search({
+        where: { id: uid, companies: { any: { id: companyId } } },
+    })).length > 0;
+    const companyOf = async (su, id) => {
+        const [row] = (await ref(su, 'res.company').browse([id]).load(['name'])).read(['name']);
+        if (row === undefined)
+            throw new HttpProblem(404, 'missing-record', 'Not found', `There is no company ${id}.`);
+        return { id, name: String(row['name']) };
+    };
+    const sectionKey = (s) => `${s.app}.${s.spec.key}`;
+    const describeChanges = (s, changes) => ({
+        app: s.app,
+        appLabel: label(s.app).label,
+        section: s.spec.key,
+        label: s.spec.label,
+        scope: s.spec.scope,
+        changes: Object.entries(changes).map(([key, c]) => ({
+            key,
+            label: s.settings.find((x) => x.key === key)?.label ?? key,
+            from: c.from,
+            to: c.to,
+        })),
+    });
+    app.get('/api/v1/settings/app-settings/export', async (request) => request.env(async (env) => {
+        administrators(env);
+        return env.asSuperuser({ reason: 'app settings export' }, async (su) => {
+            const installation = {};
+            const companySettings = {};
+            for (const s of sections)
+                (s.spec.scope === 'company' ? companySettings : installation)[sectionKey(s)] =
+                    await valuesOf(su, s, env.companyId);
+            await audit(env, {
+                kind: 'settings.exported',
+                summary: 'App settings exported.',
+                ip: request.ip,
+            });
+            return {
+                kosh: 'app-settings',
+                version: 1,
+                exportedAt: new Date().toISOString(),
+                company: await companyOf(su, env.companyId),
+                installation,
+                companySettings,
+            };
+        });
+    }, { write: true }));
+    app.get('/api/v1/settings/app-settings/:app/:section/history', async (request) => {
+        const section = sectionOf(request);
+        const key = request.query.key;
+        return request.env(async (env) => {
+            if (!mayView(env, section.app))
+                throw new HttpProblem(404, 'missing-record', 'Not found', 'There are no such settings.');
+            return env.asSuperuser({ reason: 'app settings history' }, async (su) => {
+                const found = await ref(su, 'audit.event').search({
+                    where: {
+                        kind: 'settings.changed',
+                        ...(section.spec.scope === 'company' ? { company: env.companyId } : {}),
+                    },
+                    order: ['id desc'],
+                    limit: 500,
+                });
+                const rows = found.length === 0
+                    ? []
+                    : (await found.load(['actor', 'createdAt', 'details'])).read([
+                        'actor',
+                        'createdAt',
+                        'details',
+                    ]);
+                const events = rows
+                    .map((r) => {
+                    const details = (r['details'] ?? {});
+                    const actor = r['actor'];
+                    return {
+                        actor: typeof actor === 'object' && actor !== null ? actor.id : actor,
+                        actorName: typeof actor === 'object' && actor !== null ? (actor.name ?? null) : null,
+                        at: r['createdAt'] instanceof Date
+                            ? r['createdAt'].toISOString()
+                            : String(r['createdAt']),
+                        details,
+                    };
+                })
+                    .filter((e) => e.details.app === section.app &&
+                    e.details.section === section.spec.key &&
+                    (key === undefined || key in (e.details.changes ?? {})))
+                    .slice(0, 50);
+                const unnamed = [
+                    ...new Set(events
+                        .filter((e) => e.actor !== null && e.actorName === null)
+                        .map((e) => e.actor)),
+                ];
+                const users = ref(su, 'res.users').browse(unnamed);
+                const names = new Map(unnamed.length === 0
+                    ? []
+                    : (await users.load(['name']))
+                        .read(['name'])
+                        .map((r, i) => [users.ids[i], String(r['name'])]));
+                return {
+                    events: events.map((e) => ({
+                        at: e.at,
+                        actor: e.actor === null
+                            ? null
+                            : { id: e.actor, name: e.actorName ?? names.get(e.actor) ?? String(e.actor) },
+                        how: e.details.copiedFrom !== undefined
+                            ? 'copied'
+                            : e.details.imported === true
+                                ? 'imported'
+                                : 'changed',
+                        changes: Object.entries(e.details.changes ?? {})
+                            .filter(([k]) => key === undefined || k === key)
+                            .map(([k, c]) => ({
+                            key: k,
+                            label: section.settings.find((x) => x.key === k)?.label ?? k,
+                            from: c.from,
+                            to: c.to,
+                        })),
+                    })),
+                };
+            });
+        }, { write: true });
+    });
+    app.post('/api/v1/settings/app-settings/copy', async (request) => {
+        const body = (request.body ?? {});
+        const from = Number(body['from']);
+        const to = Number(body['to']);
+        const preview = body['preview'] === true;
+        const chosen = Array.isArray(body['sections']) ? body['sections'].map(String) : null;
+        if (!Number.isInteger(from) || !Number.isInteger(to) || from === to)
+            throw new HttpProblem(422, 'invalid-copy', 'Copy settings', 'Give two different companies.');
+        return request.env(async (env) => {
+            administrators(env);
+            return env.asSuperuser({ reason: 'app settings copy' }, async (su) => {
+                for (const c of [from, to])
+                    if (!(await memberOf(su, env.uid, c)))
+                        throw new HttpProblem(403, 'access', 'Copy settings', `Company ${c} is not one of yours.`);
+                const source = await companyOf(su, from);
+                const target = await companyOf(su, to);
+                const picked = sections.filter((s) => s.spec.scope === 'company' && (chosen === null || chosen.includes(sectionKey(s))));
+                const out = [];
+                for (const s of picked) {
+                    const a = await valuesOf(su, s, from);
+                    const b = await valuesOf(su, s, to);
+                    const changes = Object.fromEntries(s.settings
+                        .filter((x) => (a[x.key] ?? null) !== (b[x.key] ?? null))
+                        .map((x) => [x.key, { from: b[x.key] ?? null, to: a[x.key] ?? null }]));
+                    if (Object.keys(changes).length === 0)
+                        continue;
+                    out.push(describeChanges(s, changes));
+                    if (!preview)
+                        await apply(env, su, s, changes, to, `copied from ${source.name}`, { copiedFrom: from }, request.ip);
+                }
+                if (!preview)
+                    await su.flush();
+                return { preview, from: source, to: target, sections: out };
+            });
+        }, { write: true });
+    });
+    app.post('/api/v1/settings/app-settings/import', async (request) => {
+        const body = (request.body ?? {});
+        const file = body['file'];
+        const preview = body['preview'] === true;
+        if (typeof file !== 'object' || file === null || file['kosh'] !== 'app-settings')
+            throw new HttpProblem(422, 'invalid-file', 'Import settings', 'Not an app settings export.');
+        const given = [
+            ['installation', file['installation']],
+            ['company', file['companySettings']],
+        ];
+        return request.env(async (env) => {
+            administrators(env);
+            return env.asSuperuser({ reason: 'app settings import' }, async (su) => {
+                const skipped = [];
+                const plan = [];
+                for (const [scope, part] of given) {
+                    if (typeof part !== 'object' || part === null)
+                        continue;
+                    for (const [k, values] of Object.entries(part)) {
+                        const s = sections.find((x) => sectionKey(x) === k && x.spec.scope === scope);
+                        if (s === undefined || typeof values !== 'object' || values === null) {
+                            skipped.push(k);
+                            continue;
+                        }
+                        const current = await valuesOf(su, s, env.companyId);
+                        const changes = {};
+                        for (const [key, value] of Object.entries(values)) {
+                            const setting = s.settings.find((x) => x.key === key);
+                            if (setting === undefined) {
+                                skipped.push(`${k}.${key}`);
+                                continue;
+                            }
+                            const checked = check(setting, value);
+                            if (checked !== (current[key] ?? null))
+                                changes[key] = { from: current[key] ?? null, to: checked };
+                        }
+                        if (Object.keys(changes).length > 0)
+                            plan.push({ section: s, changes });
+                    }
+                }
+                if (!preview) {
+                    for (const { section, changes } of plan)
+                        await apply(env, su, section, changes, env.companyId, 'imported', { imported: true }, request.ip);
+                    await su.flush();
+                }
+                return {
+                    preview,
+                    skipped,
+                    sections: plan.map(({ section, changes }) => describeChanges(section, changes)),
+                };
+            });
+        }, { write: true });
+    });
+}
+/** Database values as settings carry them: dates as YYYY-MM-DD, decimals as strings. */
+function normalize(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (value instanceof Date)
+        return value.toISOString().slice(0, 10);
+    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    return String(value);
+}

package/dist/settings/index.d.ts

@@ -1,6 +1,7 @@
 import { type KoshModule } from '../modules-sdk/index.js';
 import { orm } from '../server/orm.js';
 import { type PeopleOptions } from './people.js';
+export { registerAppSettingsRoutes } from './app-settings.js';
 export { type CompanyDetail, type CompanySettings, registerCompanyRoutes } from './company.js';
 export { type Assignment, INVITATION_DAYS, type PeopleOptions, registerPeopleRoutes, } from './people.js';
 export { type AppInfo, type PlanInfo, PROTECTED_APPS, registerAppRoutes } from './routes.js';

package/dist/settings/index.js

@@ -11,10 +11,12 @@ import { mailerFromEnv } from '../mail/index.js';
 import { defineModule } from '../modules-sdk/index.js';
 import { base, baseShutro } from '../server/index.js';
 import { orm } from '../server/orm.js';
+import { registerAppSettingsRoutes } from './app-settings.js';
 import { registerCompanyRoutes } from './company.js';
 import { registerPeopleRoutes } from './people.js';
 import { registerAppRoutes } from './routes.js';
 import { registerSecurityRoutes } from './security.js';
+export { registerAppSettingsRoutes } from './app-settings.js';
 export { registerCompanyRoutes } from './company.js';
 export { INVITATION_DAYS, registerPeopleRoutes, } from './people.js';
 export { PROTECTED_APPS, registerAppRoutes } from './routes.js';
@@ -76,6 +78,11 @@ export function settingsModule(options = {}) {
         actions: {
             'settings.action_overview': { type: 'client', page: 'settings.Overview', label: 'Settings' },
             'settings.action_apps': { type: 'client', page: 'settings.Apps', label: 'Apps' },
+            'settings.action_app_settings': {
+                type: 'client',
+                page: 'settings.AppSettings',
+                label: 'App settings',
+            },
             'settings.action_company': { type: 'client', page: 'settings.Company', label: 'Company' },
             'settings.action_companies': {
                 type: 'client',
@@ -164,11 +171,19 @@ export function settingsModule(options = {}) {
                 action: 'settings.action_apps',
                 sequence: 1,
             },
+            {
+                id: 'settings.app_settings',
+                parent: 'settings.group_apps',
+                label: 'App settings',
+                action: 'settings.action_app_settings',
+                sequence: 2,
+            },
         ],
         routes: (context) => {
             registerAppRoutes(context);
             registerCompanyRoutes(context);
             registerSecurityRoutes(context);
+            registerAppSettingsRoutes(context);
             registerPeopleRoutes(context, {
                 baseUrl: options.baseUrl ?? process.env['KOSH_BASE_URL'] ?? 'http://localhost:5173',
                 mailer: 'mailer' in options ? options.mailer : mailerFromEnv(),

package/dist/settings/people.js

@@ -280,16 +280,29 @@ export function registerPeopleRoutes(context, options) {
             };
         });
     });
+    // An invitation (the person chooses their password), or — with `password` — a person added directly: the
+    // manager sets the password and passes it on; the login may then be a plain name (`rahim`) and the email optional.
     app.post('/api/v1/settings/people', async (request, reply) => {
         const body = (request.body ?? {});
         const name = String(body['name'] ?? '').trim();
-        const login = String(body['email'] ?? '')
+        const address = String(body['email'] ?? '')
             .trim()
             .toLowerCase();
+        const password = typeof body['password'] === 'string' ? body['password'] : undefined;
+        const direct = password !== undefined;
+        const login = direct
+            ? String(body['login'] ?? address)
+                .trim()
+                .toLowerCase()
+            : address;
         if (name === '' || name.length > 200)
             throw bad('The name is 1–200 characters.');
-        if (!EMAIL.test(login))
+        if (!direct && !EMAIL.test(login))
             throw bad('The email is their login and where the invitation goes.');
+        if (direct && !/^[a-z0-9._@+-]{3,100}$/.test(login))
+            throw bad('The login is 3–100 letters, digits, or . _ @ + -.');
+        if (direct && address !== '' && !EMAIL.test(address))
+            throw bad('The email is not valid.');
         const made = await guarded(request, async (env, su, manager) => {
             const assignments = await checkAssignments(su, body['assignments'] ?? [], manager);
             const taken = await ref(withArchived(su), 'res.users').search({ where: { login }, limit: 1 });
@@ -303,16 +316,27 @@ export function registerPeopleRoutes(context, options) {
                 {
                     login,
                     name,
-                    email: login,
+                    email: address === '' ? null : address,
                     company: home,
                     companies: { set: companies.length === 0 ? [env.companyId] : companies },
                 },
             ]);
             const user = created.ids[0];
-            // No usable password until the invitation is used.
-            await auth.setPassword(su, user, randomBytes(32).toString('base64url'));
+            // Added directly: the manager's password (checked for length); invited: none usable until the link is used.
+            await auth.setPassword(su, user, password ?? randomBytes(32).toString('base64url'));
             if (assignments.length > 0)
                 await ref(su, 'auth.user_group').create(assignments.map((a) => ({ user, group: a.group, company: a.company })));
+            if (direct) {
+                await audit(env, {
+                    kind: 'people.created',
+                    summary: `${name} (${login}) added with a password and ${assignments.length} role(s).`,
+                    targetModel: 'res.users',
+                    targetId: user,
+                    details: { assignments },
+                    ip: request.ip,
+                });
+                return { id: user, login, activationUrl: null, expiresAt: null, emailed: false };
+            }
             const link = await invite(su, user, env.uid);
             await audit(env, {
                 kind: 'people.invited',

package/dist/settings/web/AppSettingsPage.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Settings › App settings (RFC 0020): the apps' own settings, declared in their manifests. The apps you may see on
+ * the left; an app's sections as cards — each setting with its help, a mark when it differs from the default with
+ * *Reset*, and *Save* per section, sending only what changed. Company settings name the company they apply to. The
+ * server checks every value and who may change it, and audits each change. Each setting opens its history (who, when,
+ * old → new); administrators copy a company's settings to another, export them as a file and import one, every one
+ * of those previewed before anything is written.
+ */
+import { type PageProps } from '../../ui/index.js';
+import { type ReactElement } from 'react';
+export declare function AppSettingsPage({ api }: PageProps): ReactElement;