[DavidCockerill]

⊙ Problem

Studio has no page for staff to look a user up, see their organizations, or deactivate them; that takes hand-written requests to the central manager.

🤔 Who should see the page?

Only accounts holding user:status, which among staff roles only fabric_admin has, plus the two reads its details lookup needs. Read-only staff can read users, but the page was asked for as fabric_admin-only, so user:read alone doesn't show it.

💡 Solution

Admin → Users:

• Search by email or user ID; either way you land on /admin/users/<id>. The address never reaches the URL.
• A profile header with copyable email and id and tiles for organizations, clusters, activity and age; each organization a collapsible card of its live clusters.
• A settings gear opens Deactivate…: a dialog that offers to leave organizations or only deactivate, needs the email typed, then shows what the server did. A deactivated account gets Reactivate….

Needs HarperFast/central-manager#1021 deployed first.

⚖️ Alternatives

• Compose clusters in Studio from /Admin/Organization/{id} — gated on org:read rather than cluster:read, and one more request per organization.
• Ask central manager whether it supports removeMemberships — not needed: central-manager#1021 squash-merges, so the details view this page requires and the flag land in one commit.

🤔 Skip the details and only deactivate?

A lookup plus a Deactivate button that reports what happened would be about half the code. The details show staff, before they act, which organizations keep a sole admin and which clusters those organizations run, and they were asked for.

🔧 Changes

• src/features/admin/users/index.tsx — the search layout: a search card above the routed page, and an empty state on the index. A pasted id opens directly. An email lookup is dropped if anything changed while it was out: a newer lookup, a URL change (not a reload in place), or unmount; the form then resets. A failed, duplicate or empty lookup closes the open account. Failures reach RUM with the central manager's reason. Looking up the open account again refreshes it.
• src/features/admin/users/UserDetails.tsx — the details route, keyed by user id so moving to another account drops an open dialog. A failed refresh keeps the loaded account on screen; an unknown id says so; loading shows a shaped skeleton. It holds the deactivate and reactivate dialogs.
• components/UserProfileCard.tsx — initials, status badge, copy buttons, stat tiles with relative times, and the settings menu.
• components/UserActionsMenu.tsx — the gear's items: Reactivate… for a deactivated account, then the deactivation item, named and enabled by status: Deactivate…, disabled for a deleted account, and for a deactivated one Remove from organizations…, since its memberships may have been kept on purpose.
• components/Deactivation.tsx — the dialog: the status-only choice (locked while the request is out; not offered when only cleanup is left, which it names), the preview, the typed email compared the way central manager stores it, with Enter submitting once it matches. The result's title follows what the server removed; it reports on the choice sent and on what the server said; a failed PATCH closes it, and an answer without the lists shows Not reported.
• components/Reactivation.tsx — the confirm for setting the status back to ACTIVE, which says removed memberships are not restored.
• components/OrganizationCard.tsx — role chips, status dots and cluster rows whose whole row is the link.
• components/EmptyState.tsx — the dashed placeholder for the search, an unknown id and no organizations.
• src/features/admin/users/userAdminApi.ts — the /Admin/User calls. Details cache under their own key segment, apart from the API Tokens page's staff-user names. The email lookup refuses a blank address and a non-list answer, skips DELETED rows and refuses a duplicate. The details read maps 404 to "no account" and refuses a central manager without the details view, or one that doesn't say where the account is the last admin. Deactivation sends removeMemberships: false only for status-only, normalizes the result and refetches the details either way; reactivation sends status: ACTIVE.
• src/features/admin/routes.ts — the users layout with an index and a $userId child, mounted under it.
• src/features/admin/components/AdminShell.tsx — the Users rail item, gated on user:status and the reads its details lookup needs, which the rail checks with an item's main permission.
• src/integrations/api/api.patch.d.ts — adds user:read and user:status to StaffPermission.
• src/lib/string/entityId.ts — usr- ids join the shared detector; the organization and host searches still act only on the kinds they handle.

✅ Verification

• index.test.tsx (37 cases) drives the real nested routes: lookups by email and id and every way one is dropped, tiles and links, folding, the cache collision, the menu's states, the typed-email gate, status-only, cleanup and reactivation dialogs, and failed or unreported results. Removing each guard fails its case.
• admin-users.anon.spec.ts runs the page in Chromium against a mocked central manager and screenshots search, details, menu, confirm (both choices), result and reactivation in light, dark and at 390 px with no horizontal scroll.
• Route, rail-visibility and entity-id tests extended. Full vitest run: 6,077 pass; tsc -p tsconfig.app.json, oxlint and dprint are clean.
• Deployed to the local rig against central-manager#1021; not clicked through there with a real sign-in yet.

Refs #1997

🤖 Generated with Claude Code

Related PRs: #1988 overlaps (both add an admin route), #1992 overlaps (both change the admin rail's expected labels)
Complexity: medium

Deferred findings

• 8b0955349454f051 nit maintainability — src/features/admin/users/index.tsx — Project-local imports omit file extensions — NOT FILED
• 12f52d66f6797fa5 nit maintainability — src/features/admin/users/userAdminApi.ts — Project-local imports omit file extensions — NOT FILED

_{Review-Coverage: authored=claude; ran=codex,gemini; adjudicated=domain; blocked=muse(failed); declined=cursor-grok,cursor-composer; rounds=15; full=2 @ 56c345d}

_{Review-Attention: study ~9m (decisions: do-less-alternative, strict-details-shape, users-page-needs-three-permissions, reactivate-plain-confirm, reactivate-leaves-memberships-removed, ignore-not-abort, removal-is-the-default) @ 56c345d}

[gemini-code-assist]

Code Review

This pull request introduces a new 'Users' admin section to Harper Fabric, allowing administrators with the user:status permission to look up users by email, view their organization memberships, and deactivate accounts. The changes include new routing, UI components, API integrations, and comprehensive test coverage. Feedback on the changes suggests improving type safety by validating the shape of parsed API responses instead of using unsafe type assertions, and adding a guard against empty or whitespace-only inputs in the email lookup form to avoid unnecessary refetching.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	82.29%	16881 / 20514
🔵	Statements	82.18%	17923 / 21807
🔵	Functions	77.74%	4610 / 5930
🔵	Branches	77.25%	13500 / 17475

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/features/admin/routes.ts	64.86%	100%	50%	64.86%	33-34, 40-41, 47-48, 54-55, 61, 68-69, 75-76
src/features/admin/components/AdminShell.tsx	36.84%	66.66%	66.66%	46.66%	65-87
src/features/admin/users/UserDetails.tsx	100%	93.75%	100%	100%
src/features/admin/users/index.tsx	97.56%	100%	87.5%	97.43%	140-143
src/features/admin/users/userAdminApi.ts	100%	100%	100%	100%
src/features/admin/users/components/Deactivation.tsx	96.29%	90.19%	91.66%	95.65%	48
src/features/admin/users/components/EmptyState.tsx	100%	100%	100%	100%
src/features/admin/users/components/OrganizationCard.tsx	100%	76.19%	100%	100%
src/features/admin/users/components/Reactivation.tsx	85.71%	28.57%	75%	85.71%	27
src/features/admin/users/components/UserActionsMenu.tsx	100%	100%	100%	100%
src/features/admin/users/components/UserProfileCard.tsx	100%	54.54%	100%	100%
src/lib/string/entityId.ts	100%	100%	100%	100%

Generated in workflow #2486 for commit 56c345d by the Vitest Coverage Report Action

[dawsontoth]

Cool beans

[cb1kenobi]

Looks good. Wish we had preview deployments.

[kriszyp]

_{🤖 Reviewed with Muse}

[DavidCockerill]

Thanks for the review, @kriszyp! All three points were right. They're fixed in 56c345d with a test for each, and each test fails on the previous commit. Replies are in the threads.

_{🤖 Generated by Claude (Anthropic); posted via @DavidCockerill.}

[kriszyp]

Great!

_{🤖 Reviewed with Cursor-grok}

[kriszyp]

[nit] A non-last-admin entry in retainedIn is labelled “last admin”; use neutral wording for results that do not establish that distinction

[kriszyp]

[nit] organizations containing null produce a raw TypeError instead of the intended compatibility refusal; guard each membership before reading its fields