bvandeusenandClaude Opus 5.5
2b6e12859a
The operator's ask: an invite link sent by mail, the key in the URL, and the new user choosing their own username, password and email. - user_invites (migration 0037): the key's sha256 only, the address, the role and days the admin chose, who sent it, used/revoked. - core/invites: create (revokes an older open invite to the address), renew (new key, new clock), find_pending, the four states, signup checks. - /invite/<key>, outside sign-in and throttled like login: the invitee's username, email (prefilled, theirs to change) and password; the account takes the admin's role, the key is used up in the same transaction and they are signed in. A bad key gets one plain message. - Settings › Users: Invite by email (address, role, 1/7/30 days), sent from the admin in their zone; without a mail server, or if sending fails, the link is shown once to copy. Invites not yet used are listed with Resend and Withdraw. - Audit: user.invited, user.invite_resent, user.invite_revoked, user.joined. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
67 lines
3.4 KiB
HTML
67 lines
3.4 KiB
HTML
{# settings/users.html — Settings › Users (#5336): every account, active ones
|
||
first. A row opens the account's page. #}
|
||
{% extends "base.html" %}
|
||
{% from "_macros.html" import crumbs, page_header, status_badge %}
|
||
{% from "settings/_tabs.html" import settings_tabs %}
|
||
{% block title %}Settings — Users — Steward{% endblock %}
|
||
{% block section_tabs %}{{ settings_tabs("users") }}{% endblock %}
|
||
{% block breadcrumb %}{{ crumbs([("Settings", "/settings/"), ("Users", "")]) }}{% endblock %}
|
||
{% block content %}
|
||
{% call page_header("Users") %}<a href="/settings/users/invite" class="btn">Invite by email</a><a href="/settings/users/new" class="btn btn-ghost">Add user</a>{% endcall %}
|
||
|
||
{% if done %}<div class="alert alert-success" role="status">{{ done }}</div>{% endif %}
|
||
|
||
<p class="page-verdict">
|
||
{{ users|length }} account{{ 's' if users|length != 1 }}
|
||
· {{ admins }} active admin{{ 's' if admins != 1 }}
|
||
{%- if disabled %} · <span class="tone-muted">{{ disabled }} disabled</span>{% endif %}
|
||
</p>
|
||
|
||
<div class="card-flush">
|
||
<table class="table">
|
||
<thead><tr><th>User</th><th>Signs in with</th><th>Role</th><th>Emailed</th><th>Last sign-in</th><th class="num">AI tokens</th></tr></thead>
|
||
<tbody>
|
||
{% for u in users %}
|
||
<tr class="row-link{% if not u.is_active %} row-off{% endif %}">
|
||
<td class="cell-name">
|
||
<a class="row-target" href="/settings/users/{{ u.id }}">{{ u.username }}</a>
|
||
{%- if u.id == session.user_id %} <span class="tone-dim">(you)</span>{% endif %}
|
||
<div class="cell-sub">{{ u.email }}</div>
|
||
</td>
|
||
<td>{{ sources.get(u.auth_source, u.auth_source) }}</td>
|
||
<td>{{ u.role.value|capitalize }}{% if not u.is_active %} {{ status_badge("inactive", "Disabled") }}{% endif %}</td>
|
||
<td>{% if u.id not in reachable %}<span class="tone-warn" title="{{ u.email }} isn't an address mail can reach">no address</span>
|
||
{%- elif gets[u.id] %}{{ gets[u.id]|join(", ") }}{% else %}—{% endif %}</td>
|
||
<td class="nowrap">{% if last.get(u.id) %}{{ last[u.id]|ago }}{% else %}—{% endif %}</td>
|
||
<td class="num">{{ tokens.get(u.id, 0) or "—" }}</td>
|
||
</tr>
|
||
{% endfor %}
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
{% if invites %}
|
||
<div class="card-flush">
|
||
<table class="table">
|
||
<caption class="table-caption">Invites not yet used</caption>
|
||
<thead><tr><th>Sent to</th><th>Role</th><th>Sent by</th><th>Link works until</th><th class="num">Actions</th></tr></thead>
|
||
<tbody>
|
||
{% for i, state, by in invites %}
|
||
<tr>
|
||
<td>{{ i.email }}</td>
|
||
<td>{{ i.role.value|capitalize }}</td>
|
||
<td>{{ by }}</td>
|
||
<td class="nowrap">{% if state == "expired" %}{{ status_badge("inactive", "Expired") }}{% else %}{{ i.expires_at|when }}{% endif %}</td>
|
||
<td class="num nowrap">
|
||
<form method="post" action="/settings/users/invites/{{ i.id }}/resend" class="inline-form">{{ csrf_field() }}<button type="submit" class="btn btn-ghost btn-sm">Resend</button></form>
|
||
<form method="post" action="/settings/users/invites/{{ i.id }}/revoke" class="inline-form"
|
||
data-confirm="Withdraw the invite to {{ i.email }}? Its link stops working.">{{ csrf_field() }}<button type="submit" class="btn btn-ghost btn-sm">Withdraw</button></form>
|
||
</td>
|
||
</tr>
|
||
{% endfor %}
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
{% endif %}
|
||
<p class="field-hint">Accounts that sign in with LDAP or single sign-on are added at their first sign-in, with the role their provider's groups give them (Settings › <a href="/settings/auth/">Authentication</a>).</p>
|
||
{% endblock %}
|