Users

The users page at /permissions/users lists the accounts and manages two things per user: which role they hold, and (for administrators) their password.

Reading the list

Each row shows the user’s username, email, and role, and whether the caller outranks the user. The server enforces the same ranking before changing a role or resetting a password, so users the caller cannot edit are shown without those controls.

Assigning a role

POST /permissions/users/role sends username and role and calls AssignUserRole. Only roles the caller outranks are offered, which keeps roles the server would refuse out of the picker.

Resetting a password

POST /permissions/users/password sends username, new_password, and new_password_confirmation and calls ResetUserPassword. The backend’s role hierarchy decides which users an administrator may reset.

Both writes redirect back to /permissions/users?updated=true on success, and render the failure inline otherwise.

Note

This is the administrator reset path. A signed-in user changes their own password at /password — see Authentication and accounts.