[valthon]

Auth collections now have collection-scoped account management at /_/#/users/<collection>, with credentials and custom profile fields in the same form. The sidebar groups collections by type, and ordinary collections keep the generic record editor.

Admin UI

• Collection-scoped links, reloads and browser history keep the selected collection. Legacy auth record URLs redirect to the same collection's Users page, and collection settings and Users link to each other.
• Create and edit forms cover credentials and custom profile fields, including required fields, JSON, rich text, relations, multiple selections and file uploads, with accessible shared controls.
• Editing sends only changed fields and credentials. JSON comparison ignores object-member order but not array order, so concurrent API or hook updates and untouched legacy gaps survive a credential reset.
• One guarded refresh owns collection metadata, so only the latest request publishes results and a failed lookup does not block later routes. A failed lookup retries when its route is next visited, rather than in a loop, and its error shows only on the route it was for.
• A select declaring an empty option keeps it distinct from no selection, in JSON and multipart saves alike.
• Record and account drawers load the current collection definition when opened and block saves while it is loading or failed. Password length uses UTF-8 bytes to match the server, and a zero minimum is preserved.

Record and collection input

• An empty multipart value clears a single-valued select or relation. A single select that declares "" as an option keeps it as a value and is cleared with null instead, unless null is also an option.
• Float fields accept integral JSON numbers beyond the i64 range and apply their bounds to them. Number bounds in schema JSON accept the same tokens and refuse strings and non-finite values.
• The collection API returns a field error unless minPasswordLength is an integer from 0 through 255.

The series is two commits: the input parsing, then the admin UI that depends on it.

Fixes #478.

Validation on Zig 0.16.0, on main at 7e212f30:

• zig build test --summary all returned 0 at both commits.
• tests/admin with -n 4: 665 passed, 154 skipped.
• check-gating, allocator contracts, disabled agent CLI, error-code ledger, doctor ledger and changelog assembly passed.

The zap transport re-pin, its changelog fragment and the tests/admin fixture and diagnostics work that were previously on this branch are removed, as they do not belong to this issue. The prior head is preserved on codex-does-too-much-481.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HTAHrkfe1L2hfpLeP1CQAS

[Copilot]

🟡 Changes recommended

Account profile saves can silently retain cleared values, alter JSON types, and drop existing relations, while float inputs and unset required booleans can cause validation failures.

4 open issues

• Preserve clears and JSON types in multipart account updates · New
• Convert float inputs to numbers before JSON serialization · New
• Retain existing relations beyond the first page · New
• Initialize new boolean fields to false · New

What changed in this PR

This PR gives auth collections a single, collection-scoped account workspace in Users, addressing #478 while retaining ordinary record management for data collections.

Changes:

• Groups navigation by collection type, preserves scoped links, and redirects legacy auth-record URLs.
• Extends account forms with shared profile-field editors, validation, and file handling.
• Adds browser regressions and documents the unified workflow.

File	Description
tests/​admin/​test_shell.py	Updates the built-in account navigation smoke test.
tests/​admin/​test_auth_navigation.py	Adds navigation, account-form, and system-protection regressions.
src/​admin/​views/​users.js	Adds collection-scoped Users pages and custom profile fields.
src/​admin/​views/​collections.js	Shares field controls and serialization; adds Users handoffs.
src/​admin/​lib/​api.js	Enables multipart account creation and updates.
src/​admin/​app.js	Groups sidebar links and routes auth collections to Users.
docs/​framework.md	Documents account navigation and editing capabilities.
changelog.d/​auth-users-navigation.md	Records the navigation and account-form changes.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Active issues block valid non-ASCII passwords in the user form and prevent file changes from saving when an optional single-select field is unset.

2 open issues

• File changes serialize unset single-select values as empty strings · New
• Password minlength uses UTF-16 instead of server UTF-8 byte count · New

4 resolved since last review

• Initialize new boolean fields to false
• Retain existing relations beyond the first page
• Convert float inputs to numbers before JSON serialization
• Preserve clears and JSON types in multipart account updates

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Clearing an optional single select sends an empty string instead of null when no file changes, causing the server to reject the save.

2 open issues

• Send null when clearing an optional single-select · New
• File changes serialize unset single-select values as empty strings

1 resolved since last review

• Password minlength uses UTF-16 instead of server UTF-8 byte count

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved issues misdirect collection user-management links, block account updates for server-accepted internationalized email addresses, and cause inconsistent numeric validation between JSON and multipart submissions.

3 open issues

• Use the persisted collection name for the Manage users link · New
• Normalize numeric values consistently across file and JSON submissions · New
• Allow internationalized email addresses in profile forms · New

2 resolved since last review

• Send null when clearing an optional single-select
• File changes serialize unset single-select values as empty strings

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Cleanup omits rep_setup, so a fixture setup failure while the server is still running can delete server.log without emitting diagnostics.

1 open issue

• Preserve server diagnostics when dependent fixture setup fails · New

3 resolved since last review

• Allow internationalized email addresses in profile forms
• Normalize numeric values consistently across file and JSON submissions
• Use the persisted collection name for the Manage users link

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Profile-field labels are not associated with their controls, leaving required and other inputs unnamed for screen-reader users.

1 open issue

• Associate profile field labels with their controls · New

1 resolved since last review

• Preserve server diagnostics when dependent fixture setup fails

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved issues can overwrite untouched null rich-text values, block empty passwords permitted by collection policy, and hide unexpected test-server exits.

3 open issues

• Avoid overwriting untouched null rich-text fields · New
• Only require passwords when the configured minimum is positive · New
• Fail teardown when the server exits unexpectedly · New

1 resolved since last review

• Associate profile field labels with their controls

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block approval of the collection-scoped account-management changes.

No open issues 🎉

1 resolved since last review

• Skip collection-list fetch for the synthetic new route

_{Review effort: Balanced}

[valthon]

This re-review covers e37f4570. I reviewed by reading the code; I did not run it.

All seven issues from the previous review are addressed: changed-fields-only PATCH, no hang on '…', rich-text cleanup on blur, blank username omitted, a shared system-field helper, the zero password minimum, and reuse of the Shell's metadata. Thanks.

Changes requested (blocking). GitHub doesn't allow a formal "Request changes" on your own PR, so this review is a comment, but every item below must be resolved before merge:

1. Regression: the record drawer hides email, username, verified and token_epoch on base collections. This breaks creating and editing _suppressions and _sender_identities records.
2. Correctness: one failed cache-miss refresh leaves err set, blocking later refreshes and showing a false error on every records page.
3. Required refactor: replace the Shell's metadata-refresh state machine with a single refreshCollections() (details inline). Item 2 comes from its complexity, and we don't want to keep that much interdependent state in the admin shell.
4. Correctness: RecordsTable now reads an outdated schema snapshot, so fields added elsewhere are missing from the drawer until a reload.
5. Correctness: minPasswordLength accepts out-of-range or non-integer values that the server silently drops.

Please add browser regressions for 1, 2 and 4. As CLAUDE.md notes, zig build test won't catch them.

---

Generated by Claude Code

[Copilot]

🟡 Changes recommended

The boundary-case tests use an arena that masks potential allocation leaks in parseCollectionInput, leaving the required raw testing-allocator coverage for owned results missing.

1 open issue

• Use the raw testing allocator to detect leaked collection allocations · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because an unpublished finding indicates that cached metadata lookup failures can keep New record disabled even after the API recovers.

No open issues 🎉

1 resolved since last review

• Use the raw testing allocator to detect leaked collection allocations

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Single-select handling conflates empty-string options with null during saves, risking incorrect stored values, while navigation to cached auth collections leaves stale lookup errors visible.

3 open issues

• Clear lookup errors when navigating to cached collections · New
• Distinguish null from empty-string multipart values · New
• Preserve empty-string options in single selects · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

A delayed lookup failure can incorrectly appear on the members page and sidebar after navigation, requiring a current-route guard and a delayed-failure regression test.

1 open issue

• Prevent stale lookup errors from appearing on the current page · New

3 resolved since last review

• Preserve empty-string options in single selects
• Distinguish null from empty-string multipart values
• Clear lookup errors when navigating to cached collections

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

There are no active review issues for the collection-scoped account management changes.

No open issues 🎉

1 resolved since last review

• Prevent stale lookup errors from appearing on the current page

_{Review effort: Balanced}