gaard-api 0.2.8__tar.gz → 0.2.9__tar.gz

{gaard_api-0.2.8/src/gaard_api.egg-info → gaard_api-0.2.9}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: gaard-api
-Version: 0.2.8
+Version: 0.2.9
 Summary: GAARD backend web services providing admin interface
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-Requires-Dist: gaard-core==0.2.8
-Requires-Dist: gaard-connectors==0.2.8
-Requires-Dist: gaard-llm==0.2.8
-Requires-Dist: gaard-plugin-api<0.3.0,>=0.2.8
+Requires-Dist: gaard-core==0.2.9
+Requires-Dist: gaard-connectors==0.2.9
+Requires-Dist: gaard-llm==0.2.9
+Requires-Dist: gaard-plugin-api<0.3.0,>=0.2.9
 Requires-Dist: fastapi>=0.111.0
 Requires-Dist: uvicorn[standard]>=0.30.0
 Requires-Dist: pydantic>=2.7.0

{gaard_api-0.2.8 → gaard_api-0.2.9}/pyproject.toml

@@ -4,16 +4,16 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gaard-api"
-version = "0.2.8"
+version = "0.2.9"
 description = "GAARD backend web services providing admin interface"
 readme = "README.md"
 requires-python = ">=3.11"
 
 dependencies = [
-    "gaard-core==0.2.8",
-    "gaard-connectors==0.2.8",
-    "gaard-llm==0.2.8",
-    "gaard-plugin-api>=0.2.8,<0.3.0",
+    "gaard-core==0.2.9",
+    "gaard-connectors==0.2.9",
+    "gaard-llm==0.2.9",
+    "gaard-plugin-api>=0.2.9,<0.3.0",
     "fastapi>=0.111.0",
     "uvicorn[standard]>=0.30.0",
     "pydantic>=2.7.0",

{gaard_api-0.2.8 → gaard_api-0.2.9}/src/gaard_api/admin/database.py

@@ -1,6 +1,7 @@
 from collections.abc import Iterator
 import json
 import threading
+from datetime import UTC, datetime, timedelta
 
 from sqlalchemy import create_engine, delete, select
 from sqlalchemy.engine import Engine
@@ -97,8 +98,24 @@ def init_metadata_store() -> None:
             session.commit()
 
 
+def clear_expired_admin_sessions(session: Session) -> int:
+    """Remove sessions inactive for 30 days; called once during application startup."""
+    cutoff = datetime.now(UTC) - timedelta(days=30)
+    result = session.execute(
+        delete(AdminSession)
+        .where(AdminSession.last_seen < cutoff)
+        .execution_options(synchronize_session=False)
+    )
+    return int(result.rowcount or 0)
+
+
 def seed_admin_user(session: Session) -> None:
-    user = session.scalar(select(AdminUser).where(AdminUser.username == "admin"))
+    user = session.scalar(
+        select(AdminUser).where(
+            AdminUser.username == "admin",
+            AdminUser.auth_provider == "local",
+        )
+    )
 
     if user is not None:
         return
@@ -108,6 +125,8 @@ def seed_admin_user(session: Session) -> None:
             username="admin",
             password_hash=hash_password("admin"),
             must_change_password=True,
+            is_system_admin=True,
+            enterprise_access=True,
         )
     )
 
@@ -117,12 +136,35 @@ def ensure_admin_user_schema(engine: Engine) -> None:
     additions = {
         "display_name": "ALTER TABLE admin_users ADD COLUMN display_name VARCHAR(255) NOT NULL DEFAULT ''",
         "auth_provider": "ALTER TABLE admin_users ADD COLUMN auth_provider VARCHAR(255) NOT NULL DEFAULT 'local'",
+        "role": "ALTER TABLE admin_users ADD COLUMN role VARCHAR(50) NOT NULL DEFAULT 'admin'",
+        "is_system_admin": "ALTER TABLE admin_users ADD COLUMN is_system_admin BOOLEAN NOT NULL DEFAULT 0",
+        "enterprise_access": "ALTER TABLE admin_users ADD COLUMN enterprise_access BOOLEAN NOT NULL DEFAULT 0",
         "is_provisioned": "ALTER TABLE admin_users ADD COLUMN is_provisioned BOOLEAN NOT NULL DEFAULT 0",
     }
     with engine.begin() as connection:
         for name, sql in additions.items():
             if name not in columns:
                 connection.execute(text(sql))
+        # Existing installations predate the explicit system-admin marker.  The
+        # first local administrator is the account created during initialization.
+        connection.execute(text("""
+            UPDATE admin_users
+            SET is_system_admin = 1
+            WHERE id = (
+                SELECT id FROM admin_users
+                WHERE auth_provider = 'local' AND role = 'admin'
+                ORDER BY id
+                LIMIT 1
+            )
+            AND NOT EXISTS (
+                SELECT 1 FROM admin_users WHERE is_system_admin = 1
+            )
+        """))
+        # The system administrator is the sole account with permanent Enterprise
+        # access. Other administrators receive a seat explicitly, like users.
+        connection.execute(text(
+            "UPDATE admin_users SET enterprise_access = 1 WHERE is_system_admin = 1"
+        ))
         if engine.dialect.name == "sqlite" and (
             admin_user_has_global_username_constraint(engine)
             or not admin_user_has_provider_username_constraint(engine)
@@ -175,6 +217,9 @@ def rebuild_sqlite_admin_users(connection) -> None:
             username VARCHAR(255) NOT NULL,
             display_name VARCHAR(255) NOT NULL DEFAULT '',
             auth_provider VARCHAR(255) NOT NULL DEFAULT 'local',
+            role VARCHAR(50) NOT NULL DEFAULT 'admin',
+            is_system_admin BOOLEAN NOT NULL DEFAULT 0,
+            enterprise_access BOOLEAN NOT NULL DEFAULT 0,
             password_hash TEXT NOT NULL,
             must_change_password BOOLEAN NOT NULL,
             is_provisioned BOOLEAN NOT NULL DEFAULT 0,
@@ -185,7 +230,7 @@ def rebuild_sqlite_admin_users(connection) -> None:
     """))
     connection.execute(text("""
         INSERT INTO admin_users__migrated
-            (id, username, display_name, auth_provider, password_hash, must_change_password, is_provisioned, created_at, updated_at)
+            (id, username, display_name, auth_provider, role, is_system_admin, enterprise_access, password_hash, must_change_password, is_provisioned, created_at, updated_at)
         SELECT
             id,
             CASE WHEN password_hash = 'external$disabled' AND instr(username, ':') > 0
@@ -194,6 +239,9 @@ def rebuild_sqlite_admin_users(connection) -> None:
             display_name,
             CASE WHEN auth_provider = 'local' AND password_hash = 'external$disabled' AND instr(username, ':') > 0
                 THEN substr(username, 1, instr(username, ':') - 1) ELSE auth_provider END,
+            role,
+            is_system_admin,
+            enterprise_access,
             password_hash, must_change_password, 0, created_at, updated_at
         FROM admin_users
     """))
@@ -593,12 +641,20 @@ def ensure_admin_session_schema(engine: Engine) -> None:
         "auth_provider": (
             "ALTER TABLE admin_sessions ADD COLUMN auth_provider VARCHAR(255) DEFAULT 'local'"
         ),
+        # SQLite cannot add a column with CURRENT_TIMESTAMP as its default.  Backfill
+        # legacy rows below, while newly created sessions use the ORM default.
+        "last_seen": "ALTER TABLE admin_sessions ADD COLUMN last_seen DATETIME",
     }
     with engine.begin() as connection:
         for column_name, sql in additions.items():
             if column_name not in columns:
                 connection.execute(text(sql))
 
+        if "last_seen" not in columns:
+            connection.execute(
+                text("UPDATE admin_sessions SET last_seen = created_at WHERE last_seen IS NULL")
+            )
+
         session_table = cast(Table, AdminSession.__table__)
         for index in session_table.indexes:
             index.create(bind=connection, checkfirst=True)

{gaard_api-0.2.8 → gaard_api-0.2.9}/src/gaard_api/admin/models.py

@@ -35,6 +35,13 @@ class AdminUser(Base):
     username: Mapped[str] = mapped_column(String(255), index=True)
     display_name: Mapped[str] = mapped_column(String(255), default="")
     auth_provider: Mapped[str] = mapped_column(String(255), index=True, default="local")
+    role: Mapped[str] = mapped_column(String(50), index=True, default="admin")
+    # The administrator created while initializing a GAARD installation.
+    # This flag is immutable through identity management.
+    is_system_admin: Mapped[bool] = mapped_column(Boolean, default=False)
+    # Enterprise access is assigned explicitly to every human identity except
+    # the system administrator, which always retains it.
+    enterprise_access: Mapped[bool] = mapped_column(Boolean, default=False)
     password_hash: Mapped[str] = mapped_column(Text)
     must_change_password: Mapped[bool] = mapped_column(Boolean, default=True)
     # Provider refreshes create provisional records so they can be assigned before login.
@@ -58,6 +65,9 @@ class AdminSession(Base):
     role: Mapped[str] = mapped_column(String(50), index=True, default="admin")
     auth_provider: Mapped[str] = mapped_column(String(255), index=True, default="local")
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utc_now)
+    last_seen: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), index=True, default=utc_now
+    )
 
 
 class AdminAuditLog(Base):

gaard_api-0.2.9/src/gaard_api/admin-web/assets/identity.js

@@ -0,0 +1,211 @@
+export function createIdentityModule({ api, escapeHtml, state, render, setMessage }) {
+  let selected = null;
+  let paneWidth = 420;
+  let loaded = false;
+  let editAction = null;
+  let createError = "";
+  let temporaryPassword = "";
+  let refreshOnAttach = false;
+  let pageResizeObserver = null;
+  let enterpriseAccessEventsAttached = false;
+
+  function providerSpecific(user) {
+    const entries = Object.entries(user.attributes || {});
+    if (!entries.length) return "";
+    return `<h3>Provider specific</h3><table class="identity-provider-table"><tbody>${entries.map(([key, value]) => `<tr><th>${escapeHtml(key)}</th><td>${escapeHtml(Array.isArray(value) ? value.join(", ") : value)}</td></tr>`).join("")}</tbody></table>`;
+  }
+
+  function actionButton(action, label, enabled) {
+    return `<button type="button" data-identity-action="${action}" ${enabled ? "" : "disabled"}>${label}</button>`;
+  }
+
+  function builtinUserExtension() {
+    return (state.identityExtensions || []).find((extension) => extension.builtinUserManagement);
+  }
+
+  function canManageIdentities() {
+    return state.canManageIdentities === true;
+  }
+
+  function builtinUserId(user) {
+    return String(user.id || "").replace(/^local:/, "");
+  }
+
+  function canManageBuiltinAccount(user) {
+    return Boolean(
+      builtinUserExtension()
+      && user.provider_id === "local"
+      && !user.is_system_admin
+    );
+  }
+
+  function canChangeOwnAdminPassword(user) {
+    return Boolean(
+      user.provider_id === "local"
+      && user.role === "admin"
+      && user.username === state.username
+    );
+  }
+
+  function identityManagementPath(user) {
+    const extension = builtinUserExtension();
+    if (extension && canManageBuiltinAccount(user)) {
+      return `${extension.usersPath}/${encodeURIComponent(builtinUserId(user))}`;
+    }
+    return `/api/v1/admin/identities/${encodeURIComponent(user.id)}`;
+  }
+
+  function userDashboards(user) {
+    const dashboards = user.dashboards || [];
+    if (!dashboards.length) return `<h3>Dashboards</h3><p class="identity-empty">No dashboards created.</p>`;
+    return `<h3>Dashboards</h3><table class="identity-provider-table"><thead><tr><th>Name</th><th>Last updated</th></tr></thead><tbody>${dashboards.map((dashboard) => `<tr><td><strong>${escapeHtml(dashboard.name || "Untitled dashboard")}</strong>${dashboard.description ? `<br><span class="identity-dashboard-description">${escapeHtml(dashboard.description)}</span>` : ""}</td><td>${escapeHtml(dashboard.updated_at || "-")}</td></tr>`).join("")}</tbody></table>`;
+  }
+
+  function enterpriseLicenseControl(user, compact = false) {
+    const editable = canManageIdentities() && !user.is_system_admin;
+    return `<label class="identity-license-toggle${compact ? " identity-license-toggle-compact" : ""}" data-identity-enterprise-toggle><input type="checkbox" data-identity-enterprise-access data-identity-id="${escapeHtml(user.id)}" ${user.enterprise_access ? "checked" : ""} ${editable ? "" : "disabled"} /><span>${compact ? "" : "Enterprise license"}</span></label>`;
+  }
+
+  function renderPane(user) {
+    const managedBuiltinAccount = canManageBuiltinAccount(user);
+    const ownAdminPassword = canChangeOwnAdminPassword(user);
+    const editable = canManageIdentities() && Boolean(
+      managedBuiltinAccount || (!user.is_system_admin && (user.editable_name || user.editable_password))
+    );
+    const deletable = canManageIdentities() && managedBuiltinAccount;
+    const canClearSessions = canManageIdentities() && (!user.is_system_admin || user.username === state.username);
+    const enterpriseLicense = enterpriseLicenseControl(user);
+    return `<aside class="identity-pane" style="width:${paneWidth}px">
+      <div class="identity-resizer" id="identity-resizer" title="Drag to resize"></div>
+      <header><div><h2>${escapeHtml(user.name || user.username)}</h2><p>${escapeHtml(user.provider)}</p></div><button id="identity-close" type="button" aria-label="Close">×</button></header>
+      <div class="identity-pane-content">
+        <dl class="identity-basics"><dt>Name</dt><dd>${escapeHtml(user.name || user.username)}</dd><dt>Username</dt><dd>${escapeHtml(user.username)}${user.overshadowed ? ` <span class="identity-warning" title="Overshadowed by ${escapeHtml(user.overshadowed_by?.username || "another user")} from ${escapeHtml(user.overshadowed_by?.provider || "another provider")}">⚠️</span>` : ""}</dd></dl>
+        ${enterpriseLicense}
+        <div class="identity-sessions"><div class="identity-sessions-summary"><span>Active sessions</span><strong>${escapeHtml(user.sessions_count ?? 0)}</strong></div>${actionButton("sessions", "Clear sessions", canClearSessions && Number(user.sessions_count || 0) > 0)}</div>
+        <div class="identity-actions">${actionButton("username", "Change username", editable)}${actionButton("password", "Change password", canManageIdentities() && Boolean(user.editable_password || managedBuiltinAccount || ownAdminPassword))}${canManageIdentities() && managedBuiltinAccount ? actionButton("role", "Change role", true) : ""}${deletable ? actionButton("delete", "Delete user", true) : ""}</div>
+        ${userDashboards(user)}
+        ${providerSpecific(user)}
+      </div>
+    </aside>`;
+  }
+
+  function renderEditModal() {
+    if (!editAction || !selected) return "";
+    if (editAction === "delete") return `<div class="modal-backdrop" data-identity-modal-backdrop><section class="modal-panel modal-panel-small" role="dialog" aria-modal="true" aria-labelledby="identity-modal-title"><div class="modal-header"><div><h2 id="identity-modal-title">Delete user</h2><p>Delete ${escapeHtml(selected.name || selected.username)} and their saved application data?</p></div></div><div class="form-actions modal-actions"><button type="button" data-identity-modal-cancel>Cancel</button><button class="danger" type="button" id="identity-delete-confirm">Delete</button></div></section></div>`;
+    if (editAction === "sessions") return `<div class="modal-backdrop" data-identity-modal-backdrop><section class="modal-panel modal-panel-small" role="dialog" aria-modal="true" aria-labelledby="identity-modal-title"><div class="modal-header"><div><h2 id="identity-modal-title">Clear sessions</h2><p>Sign ${escapeHtml(selected.name || selected.username)} out of every other session. The session making this request is kept.</p></div></div><div class="form-actions modal-actions"><button type="button" data-identity-modal-cancel>Cancel</button><button class="danger" type="button" id="identity-sessions-clear-confirm">Clear sessions</button></div></section></div>`;
+    const isPassword = editAction === "password";
+    if (editAction === "role") {
+      return `<div class="modal-backdrop" data-identity-modal-backdrop><section class="modal-panel modal-panel-small" role="dialog" aria-modal="true" aria-labelledby="identity-modal-title"><div class="modal-header"><div><h2 id="identity-modal-title">Change role</h2><p>${escapeHtml(selected.name || selected.username)}</p></div></div><form id="identity-edit-modal-form" class="form-grid"><label>Role<select name="value"><option value="user" ${selected.role === "user" ? "selected" : ""}>User</option><option value="admin" ${selected.role === "admin" ? "selected" : ""}>Administrator</option></select></label><div class="form-actions"><button type="button" data-identity-modal-cancel>Cancel</button><button class="primary" type="submit">Apply now</button></div></form></section></div>`;
+    }
+    if (isPassword && canChangeOwnAdminPassword(selected)) {
+      return `<div class="modal-backdrop" data-identity-modal-backdrop><section class="modal-panel modal-panel-small" role="dialog" aria-modal="true" aria-labelledby="identity-modal-title"><div class="modal-header"><div><h2 id="identity-modal-title">Change password</h2><p>${escapeHtml(selected.name || selected.username)}</p></div></div><form id="identity-edit-modal-form" class="form-grid"><label>Current password<input name="current_password" type="password" autocomplete="current-password" required /></label><label>New password<input name="new_password" type="password" minlength="8" autocomplete="new-password" required /></label><div class="form-actions"><button type="button" data-identity-modal-cancel>Cancel</button><button class="primary" type="submit">Apply now</button></div></form></section></div>`;
+    }
+    const label = isPassword ? "New password" : "New username";
+    const value = isPassword ? "" : escapeHtml(selected.username);
+    return `<div class="modal-backdrop" data-identity-modal-backdrop><section class="modal-panel modal-panel-small" role="dialog" aria-modal="true" aria-labelledby="identity-modal-title"><div class="modal-header"><div><h2 id="identity-modal-title">${isPassword ? "Change password" : "Change username"}</h2><p>${escapeHtml(selected.name || selected.username)}</p></div></div><form id="identity-edit-modal-form" class="form-grid"><label>${label}<input name="value" ${isPassword ? "type=\"password\" minlength=\"8\" autocomplete=\"new-password\"" : "autocomplete=\"username\""} value="${value}" required /></label><div class="form-actions"><button type="button" data-identity-modal-cancel>Cancel</button><button class="primary" type="submit">Apply now</button></div></form></section></div>`;
+  }
+
+  function renderCreateModal() {
+    if (temporaryPassword) return `<div class="modal-backdrop" data-identity-modal-backdrop><section class="modal-panel modal-panel-small" role="dialog" aria-modal="true" aria-labelledby="identity-modal-title"><div class="modal-header"><div><h2 id="identity-modal-title">User created</h2><p>Share this temporary password securely. The user must change it after signing in.</p></div></div><div class="form-grid modal-form-content"><label>Temporary password<input value="${escapeHtml(temporaryPassword)}" readonly /></label></div><div class="form-actions modal-actions"><button class="primary" type="button" data-identity-modal-cancel>Done</button></div></section></div>`;
+    if (editAction !== "create") return "";
+    return `<div class="modal-backdrop" data-identity-modal-backdrop><section class="modal-panel modal-panel-small" role="dialog" aria-modal="true" aria-labelledby="identity-modal-title"><div class="modal-header"><div><h2 id="identity-modal-title">Create user</h2></div></div><form id="identity-create-modal-form" class="form-grid"><label>Name<input name="display_name" maxlength="255" autocomplete="name" /></label><label>Username<input name="username" maxlength="255" autocomplete="username" required /></label><label>Role<select name="role"><option value="user">User</option><option value="admin">Administrator</option></select></label>${createError ? `<div class="error" role="alert">${escapeHtml(createError)}</div>` : ""}<div class="form-actions"><button type="button" data-identity-modal-cancel>Cancel</button><button class="primary" type="submit">Create user</button></div></form></section></div>`;
+  }
+
+  function renderIdentity() {
+    const rows = (state.identities || []).map((user) => `<tr class="identity-table-row${selected?.id === user.id ? " selected" : ""}" data-identity-id="${escapeHtml(user.id)}"><td>${escapeHtml(user.name || user.username)}</td><td>${escapeHtml(user.username)}${user.overshadowed ? ` <span class="identity-warning" title="Overshadowed by ${escapeHtml(user.overshadowed_by?.username || "another user")} from ${escapeHtml(user.overshadowed_by?.provider || "another provider")}">⚠️</span>` : ""}</td><td>${escapeHtml(user.role)}</td><td>${escapeHtml(user.provider)}</td><td>${enterpriseLicenseControl(user, true)}</td></tr>`).join("");
+    const createButton = builtinUserExtension() && canManageIdentities()
+      ? `<button id="identity-create" class="primary" type="button">Create user</button>`
+      : "";
+    return `<section class="panel identities-page"><div class="panel-header"><h2>Identities</h2><div class="form-actions">${createButton}<button id="identity-refresh" type="button">Refresh</button></div></div><div class="table-wrap"><table><thead><tr><th>Name</th><th>Username</th><th>Role</th><th>Provider</th><th>Enterprise</th></tr></thead><tbody>${rows || `<tr><td colspan="5">No users found.</td></tr>`}</tbody></table></div>${selected ? renderPane(selected) : ""}</section>${renderEditModal()}${renderCreateModal()}`;
+  }
+
+  function clampPaneWidth() {
+    const page = document.querySelector(".identities-page");
+    const pane = document.querySelector(".identity-pane");
+    if (!page || !pane) return;
+    const maximum = Math.max(320, Math.floor(page.getBoundingClientRect().width));
+    paneWidth = Math.min(paneWidth, maximum);
+    pane.style.width = `${paneWidth}px`;
+  }
+
+  function observePageWidth() {
+    const page = document.querySelector(".identities-page");
+    if (!page || !window.ResizeObserver) return;
+    pageResizeObserver?.disconnect();
+    pageResizeObserver = new ResizeObserver(clampPaneWidth);
+    pageResizeObserver.observe(page);
+  }
+
+  async function load(refresh = false, refreshAfterLoad = false) {
+    try {
+      const result = await api(`/api/v1/admin/identities${refresh ? "?refresh=true" : ""}`);
+      state.identities = result.items || [];
+      state.canManageIdentities = result.can_manage_identities === true;
+      if (selected) selected = state.identities.find((item) => item.id === selected.id) || null;
+      loaded = true;
+      render();
+      if (refreshAfterLoad) void load(true);
+    } catch (error) { setMessage("error", error.message); }
+  }
+
+  function attachResize() {
+    clampPaneWidth(); observePageWidth();
+    document.querySelector("#identity-resizer")?.addEventListener("pointerdown", (event) => {
+      event.preventDefault(); const startX = event.clientX; const startWidth = paneWidth;
+      const move = (moveEvent) => { const page = document.querySelector(".identities-page"); const maximum = Math.max(320, Math.floor(page?.getBoundingClientRect().width || 320)); paneWidth = Math.min(maximum, Math.max(320, startWidth + startX - moveEvent.clientX)); clampPaneWidth(); };
+      const stop = () => { window.removeEventListener("pointermove", move); };
+      window.addEventListener("pointermove", move); window.addEventListener("pointerup", stop, { once: true });
+    });
+  }
+
+  function attachModal() {
+    document.querySelector("[data-identity-modal-cancel]")?.addEventListener("click", () => { editAction = null; createError = ""; temporaryPassword = ""; render(); });
+    document.querySelector("[data-identity-modal-backdrop]")?.addEventListener("click", (event) => { if (event.target === event.currentTarget) { editAction = null; createError = ""; temporaryPassword = ""; render(); } });
+    document.querySelector("#identity-edit-modal-form")?.addEventListener("submit", async (event) => { event.preventDefault(); const form = new FormData(event.currentTarget); try { if (editAction === "password" && canChangeOwnAdminPassword(selected)) { const result = await api("/api/v1/admin/auth/change-password", { method: "POST", body: JSON.stringify({ current_password: form.get("current_password"), new_password: form.get("new_password") }) }); state.mustChangePassword = result.must_change_password; localStorage.setItem("gaard_admin_must_change", String(result.must_change_password)); editAction = null; setMessage("success", "Password changed."); await load(); return; } const value = String(form.get("value") || ""); const body = editAction === "password" ? { new_password: value } : editAction === "role" ? { role: value } : { username: value }; await api(identityManagementPath(selected), { method: "PATCH", body: JSON.stringify(body) }); editAction = null; setMessage("success", "Identity updated. The affected user has been signed out."); await load(); } catch (error) { setMessage("error", error.message); } });
+    document.querySelector("#identity-create-modal-form")?.addEventListener("submit", async (event) => { event.preventDefault(); const form = new FormData(event.currentTarget); createError = ""; try { const result = await api(builtinUserExtension().usersPath, { method: "POST", body: JSON.stringify({ display_name: form.get("display_name"), username: form.get("username"), role: form.get("role") }) }); temporaryPassword = result.temporary_password || ""; await load(); } catch (error) { createError = error.message; render(); } });
+    document.querySelector("#identity-delete-confirm")?.addEventListener("click", async () => { try { await api(identityManagementPath(selected), { method: "DELETE" }); selected = null; editAction = null; setMessage("success", "Built-in user deleted."); await load(); } catch (error) { setMessage("error", error.message); } });
+    document.querySelector("#identity-sessions-clear-confirm")?.addEventListener("click", async () => { try { const result = await api(`/api/v1/admin/identities/${encodeURIComponent(selected.id)}/sessions`, { method: "DELETE" }); editAction = null; setMessage("success", `${result.cleared_sessions || 0} session(s) cleared.`); await load(); } catch (error) { setMessage("error", error.message); } });
+    document.querySelectorAll("[data-identity-enterprise-toggle]").forEach((toggle) => {
+      toggle.addEventListener("click", (event) => event.stopPropagation());
+    });
+    attachEnterpriseAccessEvents();
+  }
+
+  function attachEnterpriseAccessEvents() {
+    if (enterpriseAccessEventsAttached) return;
+    enterpriseAccessEventsAttached = true;
+    document.addEventListener("change", async (event) => {
+      const checkbox = event.target.closest("[data-identity-enterprise-access]");
+      if (!checkbox) return;
+      const identity = state.identities.find((item) => item.id === checkbox.dataset.identityId);
+      if (!identity) return;
+      try {
+        await api(`/api/v1/admin/identities/${encodeURIComponent(identity.id)}/enterprise-access`, {
+          method: "PATCH",
+          body: JSON.stringify({ enterprise_access: checkbox.checked })
+        });
+        setMessage("success", "Enterprise license assignment updated.");
+        await load();
+      } catch (error) {
+        setMessage("error", error.message);
+        await load();
+      }
+    });
+  }
+
+  function attach() {
+    document.querySelector("#identity-create")?.addEventListener("click", () => { editAction = "create"; createError = ""; temporaryPassword = ""; render(); });
+    document.querySelector("#identity-refresh")?.addEventListener("click", () => void load(true));
+    document.querySelectorAll(".identity-table-row").forEach((row) => row.addEventListener("click", () => { selected = state.identities.find((item) => item.id === row.dataset.identityId) || null; render(); }));
+    document.querySelector("#identity-close")?.addEventListener("click", () => { selected = null; render(); });
+    document.querySelectorAll("[data-identity-action]").forEach((button) => button.addEventListener("click", () => { editAction = button.dataset.identityAction; render(); }));
+    attachResize(); attachModal();
+    if (!loaded || refreshOnAttach) {
+      const loadFromCacheFirst = (state.identities || []).length === 0;
+      refreshOnAttach = false;
+      void load(!loadFromCacheFirst, loadFromCacheFirst);
+    }
+  }
+  function activate() { refreshOnAttach = true; }
+  return { render: renderIdentity, attach, activate };
+}