RBAC admin UI: user and role management

[kentcdodds]

Summary

Phase 2 of the RBAC plan (stacked on the core PR; implemented by a composer 2.5 subagent).

• /admin route group: /admin/users (paginated list, assign/remove roles), /admin/roles (read-only roles + permissions view), with .json APIs guarded per-action by requireUserWithPermission and HTML shells by requireUserWithRole('admin').
• Privacy boundary enforced structurally: admin queries select explicit columns from users/user_roles/roles only; the users payload is exactly id, username, email, created_at, updated_at, roles, pinned by a unit shape test so accidental widening fails validate.
• Last-admin guardrail: removing the admin role from the final admin returns a clear error.
• Role changes audit-logged via logAuditEvent (category admin).
• "Admin" nav link rendered only for admins (pure userHasRole on the session payload; server re-checks everything).
• Playwright E2E (e2e/admin-rbac.spec.ts) with new assignRole / seedE2eUser fixtures: non-admin 403 + hidden nav link, admin role assignment round-trip, metadata-only visibility for a user who owns a seeded secret.

System recap — extends app-ui with guarded admin routes (medium risk)

Mode: recap · Base: cursor/rbac-core-66a6 · Head: 67b7a49

Classification: extends — new admin surface composed from the rbac guards introduced in the base PR.

Primitives touched

Primitive	Group	Impact
app-ui	surfaces	extends — /admin/users, /admin/roles + JSON APIs
rbac	auth	composes — first consumers of the request guards

Invariants

Touches per-user-isolation: this is where access='any' is first honored — restricted to account metadata (users, roles). Admin queries never join content tables; a shape test pins the payload.

Testing

• ✅ npm run validate (all six checks green; 370 unit tests, smoke + admin-rbac E2E)
• ✅ Full GUI walkthrough recorded on the integration PR: admin login, role assignment/removal, guardrail error, non-admin 403

  

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 82717a44-4b56-4c9f-a99d-b264ffac88e3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/rbac-admin-ui-66a6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kody-bot]

Superseded by #596, which combines the full RBAC stack (proposal, core, admin UI, privacy page, MCP context, and docs) into a single PR targeting main.