@@ -191,10 +201,164 @@ function Users() {
)}
+
+ {editing && (
+ setEditing(null)} />
+ )}
)
}
+/**
+ * The Users-tab row pencil. Resolves the name from user_id and the current role
+ * from role_id, and persists a change through PUT /users/assign-role — or
+ * /users/remove-role when the role is cleared.
+ *
+ * SINGLE select, deliberately: `users.role_id` is one nullable FK and
+ * Users.update_user does `setattr(user, 'role_id', v)`, so N roles written in a
+ * loop would leave only the last one. Multi-role needs a user_roles join table.
+ *
+ * Saving needs rbac_users.manage on top of the route's rbac_users.edit, and the
+ * server refuses to hand out permissions the caller does not already hold. Both
+ * come back as 403 detail strings, which friendlyAuthError surfaces verbatim.
+ */
+function AssignRoleModal({ user, users, onClose }) {
+ const { toast } = useToast()
+ const { can } = usePermission()
+ const qc = useQueryClient()
+
+ const form = useFormState({
+ user_id: String(user.id),
+ role_id: user.role_id == null ? '' : String(user.role_id),
+ })
+
+ // Same key as Access Control, so this is served from cache after visiting it.
+ const rolesQuery = useQuery({
+ queryKey: qk.roles.list(),
+ queryFn: () => rolesApi.listRoles().then((r) => r.data ?? []),
+ })
+
+ // Inactive roles are an option the server can only 400 on — see the is_active
+ // check in users/views.py _check_role_assignment.
+ const roles = (rolesQuery.data ?? []).filter((r) => r.is_active)
+
+ const target = users.find((u) => String(u.id) === form.values.user_id) ?? user
+ const currentRoleId = target.role_id == null ? '' : String(target.role_id)
+ const clearing = form.values.role_id === ''
+ const dirty = form.values.role_id !== currentRoleId
+
+ // Re-point the role select at THAT user's role, so the two fields can never
+ // end up describing different people.
+ function pickUser(id) {
+ const next = users.find((u) => String(u.id) === id)
+ form.setValues({
+ user_id: id,
+ role_id: next?.role_id == null ? '' : String(next.role_id),
+ })
+ }
+
+ const save = useMutation({
+ mutationFn: () =>
+ clearing
+ ? usersApi.removeRole(form.values.user_id)
+ : usersApi.assignRole(form.values.user_id, Number(form.values.role_id)),
+ onSuccess: () => {
+ qc.invalidateQueries({ queryKey: qk.users.all() })
+ const picked = roles.find((r) => String(r.id) === form.values.role_id)
+ toast(
+ clearing
+ ? `Role removed from ${target.name}`
+ : `${target.name} is now ${picked?.role_name ?? 'assigned'}`,
+ 'success',
+ )
+ onClose()
+ },
+ onError: (err) => toast(friendlyAuthError(err, 'Could not update the role.'), 'error'),
+ })
+
+ const busy = save.isPending
+
+ function submit() {
+ if (!dirty) {
+ onClose()
+ return
+ }
+ save.mutate()
+ }
+
+ return (
+
+
+
+
+ }
+ >
+
+
+ )
+}
+
function Roles() {
const { toast } = useToast()
return (