#597 UI: departed-owners tab, transfer dialog, revoke-all, delete preview #628

Merged

Cordy merged 9 commits from fix-597-ui into main

2026-09-18 21:38:14 +00:00

Cordy commented

2026-09-18 21:35:08 +00:00

Owner

UI slice of #597, per the approved rev-1 mockup (decisions: revoke-all as a new atomic endpoint; account picker for the transfer target; honest empty text on unverifiable instances).

Backend additions:

FileStore.DeleteByCreator — all-or-nothing removal of every record (grants and links) by one creator, rollback on failed save.
POST /api/v1/admin/owners/revoke (requireAdmin) — 409 while the account still resolves; audit verb owner-revoke; returns {revoked, grants, links}.
Departed listing response gains verifiable (local mode, or oidc with admin client) and directory (answers come from an IdP) flags; wired in main.go.

Frontend (index.html):

Third tab "Departed owners" under Administration › Sharing (ADM_TABS, pane, activation hook): rows with owner, grant/link counts, ≤3 sample paths (+N more), frozen-count chip, per-row Transfer/Revoke-all link-buttons; empty state honest per verifiable; outage hint when directory.
Transfer dialog #ownxferdlg: datalist picker fed by local-users + license seats, live consequence facts (move path, grants follow, links break, holds/quota/versions note), API refusal sentences shown inline, disabled until the plan is valid.
Revoke-all rides askConfirm with the counted, permanence-noting message.
Local-account delete now fetches /admin/owners/preview and folds the freeze counts into the confirm (silent when the account shared nothing).
Pure block pure:departed (row model, empty key, transfer plan, picker filter) + web/test/departed.test.js (14 asserts). i18n ×4 for all 24 new keys.

Red-green on the runner: RED (compile-fail on missing endpoint/fields) confirmed, then full go vet + go test + extract fence + all web suites green (commit 517d1ae).

UI slice of #597, per the approved rev-1 mockup (decisions: revoke-all as a new atomic endpoint; account picker for the transfer target; honest empty text on unverifiable instances). Backend additions: - `FileStore.DeleteByCreator` — all-or-nothing removal of every record (grants and links) by one creator, rollback on failed save. - `POST /api/v1/admin/owners/revoke` (requireAdmin) — 409 while the account still resolves; audit verb `owner-revoke`; returns {revoked, grants, links}. - Departed listing response gains `verifiable` (local mode, or oidc with admin client) and `directory` (answers come from an IdP) flags; wired in main.go. Frontend (index.html): - Third tab "Departed owners" under Administration › Sharing (`ADM_TABS`, pane, activation hook): rows with owner, grant/link counts, ≤3 sample paths (+N more), frozen-count chip, per-row Transfer/Revoke-all link-buttons; empty state honest per `verifiable`; outage hint when `directory`. - Transfer dialog `#ownxferdlg`: datalist picker fed by local-users + license seats, live consequence facts (move path, grants follow, links break, holds/quota/versions note), API refusal sentences shown inline, disabled until the plan is valid. - Revoke-all rides `askConfirm` with the counted, permanence-noting message. - Local-account delete now fetches `/admin/owners/preview` and folds the freeze counts into the confirm (silent when the account shared nothing). - Pure block `pure:departed` (row model, empty key, transfer plan, picker filter) + `web/test/departed.test.js` (14 asserts). i18n ×4 for all 24 new keys. Red-green on the runner: RED (compile-fail on missing endpoint/fields) confirmed, then full go vet + go test + extract fence + all web suites green (commit 517d1ae).

Cordy added 9 commits

2026-09-18 21:35:09 +00:00