codexLB-up 1.25.0b10__py3-none-any.whl

app/modules/dashboard_roles/api.py

@@ -0,0 +1,64 @@
+"""Read-only roles API. Reading roles is part of managing users (``users:manage``);
+writing roles (``roles:manage``) arrives with the custom-role editor."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends
+
+from app.core.auth.dashboard_access import Permission, RoleKind
+from app.core.auth.dependencies import require_dashboard_permission, set_dashboard_error_format
+from app.dependencies import DashboardRolesContext, get_dashboard_roles_context
+from app.modules.dashboard_roles.schemas import DashboardRoleResponse, PermissionDescriptorResponse, RoleGrantResponse
+from app.modules.dashboard_roles.service import (
+    permission_descriptors,
+    resolve_role_grants,
+    role_assignable_to_users,
+)
+
+router = APIRouter(
+    prefix="/api/dashboard-roles",
+    tags=["dashboard"],
+    dependencies=[Depends(require_dashboard_permission(Permission.USERS_MANAGE)), Depends(set_dashboard_error_format)],
+)
+
+
+@router.get("", response_model=list[DashboardRoleResponse])
+async def list_roles(
+    context: DashboardRolesContext = Depends(get_dashboard_roles_context),
+) -> list[DashboardRoleResponse]:
+    users_by_role = await context.repository.users_count_by_role()
+    responses: list[DashboardRoleResponse] = []
+    for role in await context.repository.list_roles():
+        is_preset = RoleKind(role.kind) is RoleKind.PRESET
+        responses.append(
+            DashboardRoleResponse(
+                id=role.id,
+                slug=role.slug,
+                name=role.name,
+                description=role.description,
+                kind=role.kind,
+                locked=is_preset,
+                # Code is the truth for presets: the row's flag only mirrors it.
+                assignable_to_users=role_assignable_to_users(role),
+                grants=[
+                    RoleGrantResponse(permission=permission.value, scope=scope.value)
+                    for permission, scope in sorted(resolve_role_grants(role).items(), key=lambda item: item[0].value)
+                ],
+                users_count=users_by_role.get(role.id, 0),
+            )
+        )
+    return responses
+
+
+@router.get("/permissions", response_model=list[PermissionDescriptorResponse])
+async def list_permissions() -> list[PermissionDescriptorResponse]:
+    return [
+        PermissionDescriptorResponse(
+            permission=descriptor.permission.value,
+            description=descriptor.description,
+            implies=[dependency.value for dependency in descriptor.implies],
+            own_supported=descriptor.own_supported,
+            privileged=descriptor.privileged,
+        )
+        for descriptor in permission_descriptors()
+    ]

app/modules/dashboard_roles/repository.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
+
+from app.core.auth.dashboard_access import PRESET_ROLE_IDS, PresetRoleSlug, RoleKind
+from app.db.models import DashboardRoleRecord, DashboardUser
+
+
+class DashboardRolesRepository:
+    def __init__(self, session: AsyncSession) -> None:
+        self._session = session
+
+    async def list_roles(self) -> Sequence[DashboardRoleRecord]:
+        stmt = (
+            select(DashboardRoleRecord)
+            .options(selectinload(DashboardRoleRecord.grants))
+            .order_by(DashboardRoleRecord.kind.desc(), DashboardRoleRecord.slug.asc())
+        )
+        return (await self._session.execute(stmt)).scalars().all()
+
+    async def get_role(self, role_id: str) -> DashboardRoleRecord | None:
+        stmt = (
+            select(DashboardRoleRecord)
+            .options(selectinload(DashboardRoleRecord.grants))
+            .where(DashboardRoleRecord.id == role_id)
+        )
+        return (await self._session.execute(stmt)).scalar_one_or_none()
+
+    async def get_role_by_slug(self, slug: str) -> DashboardRoleRecord | None:
+        stmt = (
+            select(DashboardRoleRecord)
+            .options(selectinload(DashboardRoleRecord.grants))
+            .where(DashboardRoleRecord.slug == slug)
+        )
+        return (await self._session.execute(stmt)).scalar_one_or_none()
+
+    async def get_preset_role(self, slug: PresetRoleSlug) -> DashboardRoleRecord | None:
+        return await self.get_role(PRESET_ROLE_IDS[slug])
+
+    async def count_custom_roles(self) -> int:
+        stmt = (
+            select(func.count())
+            .select_from(DashboardRoleRecord)
+            .where(DashboardRoleRecord.kind == RoleKind.CUSTOM.value)
+        )
+        return int((await self._session.execute(stmt)).scalar_one())
+
+    async def users_count_by_role(self) -> dict[str, int]:
+        stmt = select(DashboardUser.role_id, func.count()).group_by(DashboardUser.role_id)
+        return {str(role_id): int(count) for role_id, count in (await self._session.execute(stmt)).all()}

app/modules/dashboard_roles/schemas.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from app.modules.shared.schemas import DashboardModel
+
+
+class RoleGrantResponse(DashboardModel):
+    permission: str
+    scope: str
+
+
+class DashboardRoleResponse(DashboardModel):
+    id: str
+    slug: str
+    name: str
+    description: str | None = None
+    kind: str
+    #: Presets are defined by the product and cannot be edited by anyone.
+    locked: bool
+    assignable_to_users: bool
+    grants: list[RoleGrantResponse]
+    users_count: int
+
+
+class PermissionDescriptorResponse(DashboardModel):
+    permission: str
+    description: str
+    implies: list[str]
+    own_supported: bool
+    privileged: bool

app/modules/dashboard_roles/seed.py

@@ -0,0 +1,80 @@
+"""Idempotent seeding of the preset ``dashboard_roles`` rows.
+
+The Alembic revision (with its own revision-pinned table definition) and the
+test schema reset (which builds the schema with ``create_all`` instead of
+Alembic) both call this so the five preset rows exist wherever the table does. Rows are inserted with
+"do nothing on conflict" semantics and are never updated: preset grants live
+in code (``PRESET_ROLE_GRANTS``), so there is nothing version-dependent to
+reconcile and a replica running older code can never strip a newer grant.
+"""
+
+from __future__ import annotations
+
+from sqlalchemy import Table, select
+from sqlalchemy.dialects import postgresql, sqlite
+from sqlalchemy.engine import Connection
+from sqlalchemy.ext.asyncio import AsyncConnection
+
+from app.core.auth.dashboard_access import (
+    ASSIGNABLE_PRESET_ROLES,
+    PRESET_ROLE_IDS,
+    PRESET_ROLE_NAMES,
+    PresetRoleSlug,
+    RoleKind,
+)
+from app.db.models import Base, DashboardRoleRecord
+
+_ROLES_TABLE: Table = Base.metadata.tables[DashboardRoleRecord.__tablename__]
+
+_PRESET_DESCRIPTIONS: dict[PresetRoleSlug, str] = {
+    PresetRoleSlug.ADMIN: "Everything: users, security settings, credentials export, conversations, audit.",
+    PresetRoleSlug.OPERATOR: "Day-to-day operations: accounts, all API keys, model sources, automations.",
+    PresetRoleSlug.MEMBER: "Own API keys and own usage only.",
+    PresetRoleSlug.VIEWER: "Read-only dashboard, reports and account status.",
+    PresetRoleSlug.GUEST: "Anonymous shared read-only session; cannot be assigned to a user.",
+}
+
+
+def preset_role_rows() -> list[dict[str, object]]:
+    return [
+        {
+            "id": PRESET_ROLE_IDS[slug],
+            "slug": slug.value,
+            "name": PRESET_ROLE_NAMES[slug],
+            "description": _PRESET_DESCRIPTIONS[slug],
+            "kind": RoleKind.PRESET.value,
+            "assignable_to_users": slug in ASSIGNABLE_PRESET_ROLES,
+            "permissions_version": 1,
+        }
+        for slug in PresetRoleSlug
+    ]
+
+
+def _insert_ignore(connection: Connection, table: Table, rows: list[dict[str, object]]) -> None:
+    dialect = connection.dialect.name
+    if dialect == "postgresql":
+        stmt = postgresql.insert(table).values(rows).on_conflict_do_nothing(index_elements=["id"])
+        connection.execute(stmt)
+        return
+    if dialect == "sqlite":
+        stmt = sqlite.insert(table).values(rows).on_conflict_do_nothing(index_elements=["id"])
+        connection.execute(stmt)
+        return
+    existing = {row[0] for row in connection.execute(select(table.c.id)).all()}
+    missing = [row for row in rows if row["id"] not in existing]
+    if missing:
+        connection.execute(table.insert().values(missing))
+
+
+def seed_preset_dashboard_roles(connection: Connection, table: Table = _ROLES_TABLE) -> None:
+    """Insert any missing preset role row using a synchronous connection.
+
+    The migration passes its own revision-pinned table so it stays frozen
+    when the ORM model evolves; every other caller uses the current model.
+    """
+
+    _insert_ignore(connection, table, preset_role_rows())
+
+
+async def ensure_preset_dashboard_roles(connection: AsyncConnection) -> None:
+    await connection.run_sync(seed_preset_dashboard_roles)

app/modules/dashboard_roles/service.py

@@ -0,0 +1,142 @@
+"""Resolve a role row into the grant table the authorization layer consumes."""
+
+from __future__ import annotations
+
+import logging
+from collections.abc import Iterable
+from dataclasses import dataclass
+from types import MappingProxyType
+
+from app.core.auth.dashboard_access import (
+    ASSIGNABLE_PRESET_ROLES,
+    OWN_SCOPED_PERMISSIONS,
+    PERMISSION_IMPLIES,
+    PRESET_ROLE_GRANTS,
+    PRIVILEGED_PERMISSIONS,
+    Grants,
+    Permission,
+    PresetRoleSlug,
+    RoleKind,
+    Scope,
+)
+from app.db.models import DashboardRoleGrant, DashboardRoleRecord
+from app.modules.dashboard_roles.repository import DashboardRolesRepository
+
+logger = logging.getLogger(__name__)
+
+
+def grants_from_rows(rows: Iterable[DashboardRoleGrant]) -> Grants:
+    """Build a grant table from custom-role rows.
+
+    Unknown permission or scope strings are skipped, not raised: during a
+    rolling upgrade a newer replica may have written a permission this
+    replica's vocabulary does not know yet, and that must not break every
+    request for holders of the role.
+    """
+
+    grants: dict[Permission, Scope] = {}
+    for row in rows:
+        try:
+            permission = Permission(row.permission)
+            scope = Scope(row.scope)
+        except ValueError:
+            logger.warning(
+                "dashboard_role_grant_ignored role_id=%s permission=%s scope=%s",
+                row.role_id,
+                row.permission,
+                row.scope,
+            )
+            continue
+        grants[permission] = scope
+    return MappingProxyType(grants)
+
+
+def resolve_role_grants(role: DashboardRoleRecord) -> Grants:
+    """Preset roles resolve from code; custom roles from their stored grant rows.
+
+    An unknown ``kind`` or an unknown preset slug raises: preset rows are only
+    written by the migration, so such a row is a provisioning error and must
+    not fall back to a quiet default.
+    """
+
+    if RoleKind(role.kind) is RoleKind.PRESET:
+        return PRESET_ROLE_GRANTS[PresetRoleSlug(role.slug)]
+    return grants_from_rows(role.grants)
+
+
+class RoleNotAssignableError(ValueError):
+    pass
+
+
+#: Presets a person may hold. Code is the truth; the row's flag only mirrors it.
+_ASSIGNABLE_PRESET_SLUGS = frozenset(slug.value for slug in ASSIGNABLE_PRESET_ROLES)
+
+
+def role_assignable_to_users(role: DashboardRoleRecord) -> bool:
+    """Whether this role may be given to a person, presets from code and custom roles from the row.
+
+    One predicate for every surface that hands a role out or offers one, so a
+    picker can never list a role the write path would refuse.
+    """
+
+    if RoleKind(role.kind) is RoleKind.PRESET:
+        return role.slug in _ASSIGNABLE_PRESET_SLUGS
+    return role.assignable_to_users
+
+
+async def resolve_assignable_role(roles: DashboardRolesRepository, role_id: str) -> DashboardRoleRecord:
+    """The role row a person may be given: an assignable preset or an assignable custom role.
+
+    Used wherever a role is handed out (account creation and edits, the role
+    an unknown identity receives) so every path applies the same rule.
+    """
+
+    role = await roles.get_role(role_id)
+    if role is None:
+        raise RoleNotAssignableError("Unknown role")
+    if not role_assignable_to_users(role):
+        raise RoleNotAssignableError(f"Role '{role.slug}' cannot be assigned to an account")
+    return role
+
+
+#: One plain sentence per permission for role pickers and the editor grid.
+#: The grant tables themselves stay in ``dashboard_access``; this only describes them.
+PERMISSION_DESCRIPTIONS: dict[Permission, str] = {
+    Permission.DASHBOARD_READ: "Read the dashboard overview, reports, request logs and the model catalog.",
+    Permission.ACCOUNTS_READ: "See upstream accounts and their usage windows.",
+    Permission.ACCOUNTS_WRITE: "Add, edit, pause and remove upstream accounts and their routing.",
+    Permission.ACCOUNTS_EXPORT: "Export upstream account credentials.",
+    Permission.API_KEYS_READ: "See API keys, their policies and their usage.",
+    Permission.API_KEYS_WRITE: "Create, edit, rotate and delete API keys.",
+    Permission.API_KEYS_ASSIGN: "Assign upstream accounts, model sources and owners to API keys.",
+    Permission.OPS_WRITE: "Change operational settings such as model sources, automations and the quota planner.",
+    Permission.SECURITY_WRITE: "Change security settings: guest access, firewall, upstream proxy credentials.",
+    Permission.USERS_MANAGE: "Invite, edit, disable and remove dashboard accounts.",
+    Permission.ROLES_MANAGE: "Create, edit and delete custom roles.",
+    Permission.CONVERSATIONS_READ: "Read conversation contents and archives.",
+    Permission.AUDIT_READ: "Read the audit log.",
+}
+
+
+@dataclass(frozen=True, slots=True)
+class PermissionDescriptor:
+    permission: Permission
+    description: str
+    implies: tuple[Permission, ...]
+    own_supported: bool
+    privileged: bool
+
+
+def permission_descriptors() -> list[PermissionDescriptor]:
+    """The permission vocabulary with its rules, derived from the single code source."""
+
+    return [
+        PermissionDescriptor(
+            permission=permission,
+            description=PERMISSION_DESCRIPTIONS[permission],
+            implies=tuple(sorted(PERMISSION_IMPLIES.get(permission, frozenset()), key=lambda dep: dep.value)),
+            own_supported=permission in OWN_SCOPED_PERMISSIONS,
+            privileged=permission in PRIVILEGED_PERMISSIONS,
+        )
+        for permission in Permission
+    ]

app/modules/dashboard_users/api.py

@@ -0,0 +1,278 @@
+"""Account management API (``users:manage``).
+
+Every mutation additionally requires the caller to *be* an account
+(``principal.user_id``): the implicit local admin, the disabled-auth principal
+and a trusted-header principal without an account row get
+``409 admin_account_required`` instead of creating people nobody can attribute.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from contextlib import contextmanager
+
+from fastapi import APIRouter, Body, Depends, Request, Response
+
+from app.core.auth.dashboard_access import DashboardPrincipal, InsufficientDelegationError, Permission
+from app.core.auth.dependencies import require_dashboard_permission, set_dashboard_error_format
+from app.core.exceptions import (
+    AppError,
+    DashboardConflictError,
+    DashboardNotFoundError,
+    DashboardPermissionError,
+    DashboardValidationError,
+)
+from app.db.models import DashboardUser, DashboardUserInvite
+from app.dependencies import DashboardUsersContext, get_dashboard_users_context
+from app.modules.dashboard_auth.service import role_summary
+from app.modules.dashboard_roles.service import RoleNotAssignableError
+from app.modules.dashboard_users.break_glass import BreakGlassRoleRequiredError, LastBreakGlassProtectedError
+from app.modules.dashboard_users.credentials import CredentialRequiredError
+from app.modules.dashboard_users.schemas import (
+    DashboardUserCreateRequest,
+    DashboardUserCreateResponse,
+    DashboardUserResponse,
+    DashboardUserUpdateRequest,
+    IssuedInviteResponse,
+    PendingInviteResponse,
+    PendingInviteSummary,
+    ReactivateKeysResponse,
+)
+from app.modules.dashboard_users.service import (
+    AdminAccountRequiredError,
+    EmailTakenError,
+    ForceWithoutRoleChangeError,
+    IdentityTakenError,
+    InvalidEmailError,
+    InvalidUsernameError,
+    InviteNotPendingError,
+    InvitePendingError,
+    IssuedInvite,
+    LastAdminProtectedError,
+    RoleManagedExternallyError,
+    SelfModificationForbiddenError,
+    SsoNotAvailableError,
+    SsoOnlyInviteError,
+    UsernameTakenError,
+    UserNotActiveError,
+    UserNotFoundError,
+    as_utc,
+)
+
+router = APIRouter(
+    prefix="/api/dashboard-users",
+    tags=["dashboard"],
+    dependencies=[Depends(require_dashboard_permission(Permission.USERS_MANAGE)), Depends(set_dashboard_error_format)],
+)
+
+_ERROR_MAP: dict[type[Exception], tuple[type[AppError], str]] = {
+    AdminAccountRequiredError: (DashboardConflictError, "admin_account_required"),
+    UserNotFoundError: (DashboardNotFoundError, "user_not_found"),
+    UsernameTakenError: (DashboardConflictError, "username_taken"),
+    EmailTakenError: (DashboardConflictError, "email_taken"),
+    InvalidUsernameError: (DashboardValidationError, "validation_error"),
+    InvalidEmailError: (DashboardValidationError, "validation_error"),
+    RoleNotAssignableError: (DashboardValidationError, "role_not_assignable"),
+    InsufficientDelegationError: (DashboardPermissionError, "insufficient_delegation"),
+    SelfModificationForbiddenError: (DashboardConflictError, "self_modification_forbidden"),
+    LastAdminProtectedError: (DashboardConflictError, "last_admin_protected"),
+    LastBreakGlassProtectedError: (DashboardConflictError, "last_break_glass_protected"),
+    BreakGlassRoleRequiredError: (DashboardValidationError, "validation_error"),
+    InviteNotPendingError: (DashboardConflictError, "invite_not_pending"),
+    InvitePendingError: (DashboardConflictError, "invite_pending"),
+    UserNotActiveError: (DashboardConflictError, "user_not_active"),
+    RoleManagedExternallyError: (DashboardConflictError, "role_managed_externally"),
+    ForceWithoutRoleChangeError: (DashboardValidationError, "validation_error"),
+    CredentialRequiredError: (DashboardConflictError, "credential_required"),
+    SsoNotAvailableError: (DashboardConflictError, "sso_not_available"),
+    IdentityTakenError: (DashboardConflictError, "identity_taken"),
+    SsoOnlyInviteError: (DashboardConflictError, "sso_only_invite"),
+}
+
+
+@contextmanager
+def mapped_user_errors() -> Iterator[None]:
+    """Translate service-level refusals into the dashboard error envelope."""
+
+    try:
+        yield
+    except tuple(_ERROR_MAP) as exc:
+        error_type, code = _ERROR_MAP[type(exc)]
+        raise error_type(str(exc), code=code) from exc
+
+
+async def require_admin_account(
+    principal: DashboardPrincipal = Depends(require_dashboard_permission(Permission.USERS_MANAGE)),
+) -> DashboardPrincipal:
+    if principal.user_id is None:
+        raise DashboardConflictError(
+            "Set a dashboard password and sign in before managing accounts", code="admin_account_required"
+        )
+    return principal
+
+
+def _client_host(request: Request) -> str | None:
+    return request.client.host if request.client else None
+
+
+def pending_invite_summary(invite: DashboardUserInvite | None) -> PendingInviteSummary | None:
+    """An SSO-only account waits for its first sign-in and has no expiry to show."""
+
+    if invite is None:
+        return None
+    return PendingInviteSummary(
+        expires_at=None if invite.sso_only else as_utc(invite.expires_at), sso_only=invite.sso_only
+    )
+
+
+def user_response(user: DashboardUser, *, pending_invite: PendingInviteSummary | None = None) -> DashboardUserResponse:
+    return DashboardUserResponse(
+        id=user.id,
+        username=user.username,
+        display_name=user.display_name,
+        email=user.email,
+        role=role_summary(user),
+        role_source=user.role_source,
+        status=user.status,
+        is_break_glass=user.is_break_glass,
+        totp_configured=user.totp_secret_encrypted is not None,
+        has_password=user.password_hash is not None,
+        created_at=user.created_at,
+        last_login_at=user.last_login_at,
+        pending_invite=pending_invite,
+    )
+
+
+def _invite_response(invite: IssuedInvite) -> IssuedInviteResponse:
+    return IssuedInviteResponse(token=invite.token, expires_at=invite.expires_at)
+
+
+@router.get("", response_model=list[DashboardUserResponse])
+async def list_users(
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> list[DashboardUserResponse]:
+    return [
+        user_response(listing.user, pending_invite=pending_invite_summary(listing.pending_invite))
+        for listing in await context.service.list_users()
+    ]
+
+
+@router.post("", response_model=DashboardUserCreateResponse, status_code=201)
+async def create_user(
+    request: Request,
+    payload: DashboardUserCreateRequest = Body(...),
+    principal: DashboardPrincipal = Depends(require_admin_account),
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> DashboardUserCreateResponse:
+    with mapped_user_errors():
+        created = await context.service.create_user(principal, payload, actor_ip=_client_host(request))
+    # An SSO-only account has no link to hand over: the plaintext token never leaves the server.
+    summary = PendingInviteSummary(
+        expires_at=None if created.sso_only else created.invite.expires_at, sso_only=created.sso_only
+    )
+    return DashboardUserCreateResponse(
+        user=user_response(created.user, pending_invite=summary),
+        invite=None if created.sso_only else _invite_response(created.invite),
+    )
+
+
+@router.get("/invites", response_model=list[PendingInviteResponse])
+async def list_pending_invites(
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> list[PendingInviteResponse]:
+    return [
+        PendingInviteResponse(
+            user_id=invite.user_id,
+            username=invite.user.username,
+            role_id=invite.user.role_id,
+            expires_at=None if invite.sso_only else as_utc(invite.expires_at),
+            created_by_user_id=invite.created_by_user_id,
+            sso_only=invite.sso_only,
+        )
+        for invite in await context.service.list_pending_invites()
+    ]
+
+
+@router.patch("/{user_id}", response_model=DashboardUserResponse)
+async def update_user(
+    user_id: str,
+    request: Request,
+    payload: DashboardUserUpdateRequest = Body(...),
+    principal: DashboardPrincipal = Depends(require_admin_account),
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> DashboardUserResponse:
+    with mapped_user_errors():
+        listing = await context.service.update_user(principal, user_id, payload, actor_ip=_client_host(request))
+    return user_response(listing.user, pending_invite=pending_invite_summary(listing.pending_invite))
+
+
+@router.delete("/{user_id}", status_code=204)
+async def delete_user(
+    user_id: str,
+    request: Request,
+    principal: DashboardPrincipal = Depends(require_admin_account),
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> Response:
+    with mapped_user_errors():
+        await context.service.delete_user(principal, user_id, actor_ip=_client_host(request))
+    return Response(status_code=204)
+
+
+@router.post("/{user_id}/invite", response_model=IssuedInviteResponse)
+async def resend_invite(
+    user_id: str,
+    request: Request,
+    principal: DashboardPrincipal = Depends(require_admin_account),
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> IssuedInviteResponse:
+    with mapped_user_errors():
+        invite = await context.service.resend_invite(principal, user_id, actor_ip=_client_host(request))
+    return _invite_response(invite)
+
+
+@router.delete("/{user_id}/invite", status_code=204)
+async def revoke_invite(
+    user_id: str,
+    request: Request,
+    principal: DashboardPrincipal = Depends(require_admin_account),
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> Response:
+    with mapped_user_errors():
+        await context.service.revoke_invite(principal, user_id, actor_ip=_client_host(request))
+    return Response(status_code=204)
+
+
+@router.post("/{user_id}/reset-totp")
+async def reset_totp(
+    user_id: str,
+    request: Request,
+    principal: DashboardPrincipal = Depends(require_admin_account),
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> dict[str, str]:
+    with mapped_user_errors():
+        await context.service.reset_totp(principal, user_id, actor_ip=_client_host(request))
+    return {"status": "ok"}
+
+
+@router.post("/{user_id}/revoke-sessions")
+async def revoke_sessions(
+    user_id: str,
+    request: Request,
+    principal: DashboardPrincipal = Depends(require_admin_account),
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> dict[str, str]:
+    with mapped_user_errors():
+        await context.service.revoke_sessions(principal, user_id, actor_ip=_client_host(request))
+    return {"status": "ok"}
+
+
+@router.post("/{user_id}/reactivate-keys", response_model=ReactivateKeysResponse)
+async def reactivate_keys(
+    user_id: str,
+    request: Request,
+    principal: DashboardPrincipal = Depends(require_admin_account),
+    context: DashboardUsersContext = Depends(get_dashboard_users_context),
+) -> ReactivateKeysResponse:
+    with mapped_user_errors():
+        count = await context.service.reactivate_keys(principal, user_id, actor_ip=_client_host(request))
+    return ReactivateKeysResponse(reactivated=count)