From c06d7aa787391b847380b3adf4c3cbf76742df1c Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 15 Oct 2025 12:10:56 -0600
Subject: [PATCH 001/180] basic ui updates for system users table

---
 enferno/admin/templates/admin/users.html | 75 ++++++++++++++++--------
 1 file changed, 50 insertions(+), 25 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 466ae96ea..87c87c98a 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -20,17 +20,38 @@
                     >
                         <template v-slot:top>
                             <v-toolbar flat color="white">
-                                <v-toolbar-title>{{ _('System Users') }}</v-toolbar-title>
-
-                                <v-spacer></v-spacer>
-
-                                <v-btn @click.once="forceGlobalReset" class="ma-2" color="error" variant="elevated">
-                                    {{ _('Force Global Password Reset') }}
-                                </v-btn>
-
-                                <v-btn @click="createItem" class="ma-2" color="primary" variant="elevated">
-                                    {{ _('New User') }}
-                                </v-btn>
+                                <div class="d-flex align-center ga-10 w-100 py-2 px-7">
+                                    <v-toolbar-title class="flex-0-0">{{ _('System Users') }}</v-toolbar-title>
+    
+                                    <v-text-field
+                                        class="flex-grow-1"
+                                        variant="outlined"
+                                        density="comfortable"
+                                        hide-details
+                                        prepend-inner-icon="mdi-magnify"
+                                        placeholder="{{ _('Search for a system user') }}"
+                                    ></v-text-field>
+    
+                                    <div class="d-flex align-center ga-3">
+                                        <v-btn
+                                            @click.once="forceGlobalReset"
+                                            color="error"
+                                            variant="elevated"
+                                            prepend-icon="mdi-lock-reset"
+                                        >
+                                            {{ _('Force Global Password Reset') }}
+                                        </v-btn>
+        
+                                        <v-btn
+                                            @click="createItem"
+                                            color="primary"
+                                            variant="elevated"
+                                            prepend-icon="mdi-plus"
+                                        >
+                                            {{ _('New User') }}
+                                        </v-btn>
+                                    </div>
+                                </div>
                             </v-toolbar>
                         </template>
 
@@ -83,22 +104,26 @@
                             <v-tooltip location="top"
                                        :text="item.two_factor_devices && item.two_factor_devices.length > 0 ? '{{ _('2FA Active') }}' : '{{ _('2FA Inactive') }}'">
                                 <template #activator="{props}">
-                                    <v-icon
-                                            v-if="item.two_factor_devices && item.two_factor_devices.length > 0"
+                                    <div v-if="item.two_factor_devices && item.two_factor_devices.length > 0" class="d-flex ga-2 justify-center font-weight-medium text-warning">
+                                        <v-icon
                                             color="success"
                                             v-bind="props"
                                             size="small"
-                                    >
-                                        mdi-lock-check
-                                    </v-icon>
-                                    <v-icon
-                                            v-else
-                                            color="error"
-                                            v-bind="props"
-                                            size="small"
-                                    >
-                                        mdi-lock-open-alert
-                                    </v-icon>
+                                        >
+                                            mdi-lock-check
+                                        </v-icon>
+                                        {{ _('2FA Active') }}
+                                    </div>
+                                    <div v-else class="d-flex ga-2 justify-center font-weight-medium text-warning">
+                                        <v-icon
+                                                color="warning"
+                                                v-bind="props"
+                                                size="small"
+                                        >
+                                            mdi-lock-open-alert
+                                        </v-icon>
+                                        {{ _('2FA Inactive') }}
+                                    </div>
                                 </template>
                             </v-tooltip>
                         </template>
@@ -354,7 +379,7 @@
                     {title: "{{_('Name')}}", value: "name"},
                     {title: "{{_('Account Status')}}", value: "active_status"},
                     {title: "{{_('Groups')}}", value: "roles"},
-                    {title: "{{_('Two Factor Authentication')}}", value: "2fa"},
+                    {title: "{{_('Two-Factor Authentication')}}", value: "2fa"},
                     {title: "{{_('Actions')}}", value: "action", sortable: false}
                 ],
 

From 6701ed008ca29d5b49c95bf2c626db96eaa001e6 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 15 Oct 2025 15:00:32 -0600
Subject: [PATCH 002/180] update create users dialog to match figma design

---
 enferno/admin/templates/admin/users.html     | 326 +++++++++----------
 enferno/static/js/components/ToggleButton.js |  23 ++
 2 files changed, 186 insertions(+), 163 deletions(-)
 create mode 100644 enferno/static/js/components/ToggleButton.js

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 87c87c98a..4db7023ab 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -157,188 +157,173 @@
                         <template v-slot:no-data></template>
                     </v-data-table-server>
                     <v-dialog v-model="dialog" max-width="1200px">
-                        <v-card>
-                        <v-form ref="form" v-model="valid">
-                            <v-toolbar :title="formTitle">
-                                <template #append>
-                                    <v-btn icon @click="close">
+                        <v-toolbar :title="formTitle">
+                            <template #append>
+                                <div class="d-flex align-center ga-2 mr-2">
+                                    <v-btn @click="close" variant="outlined">
+                                        {{ _('Cancel') }}
+                                    </v-btn>
+                                    <v-btn @click="close" prepend-icon="mdi-plus" color="primary" variant="flat">
+                                        {{ _('Add User') }}
+                                    </v-btn>
+                                    <v-btn icon density="comfortable" @click="close">
                                         <v-icon>mdi-close</v-icon>
                                     </v-btn>
-                                </template>
-                            </v-toolbar>
-                            <v-card-text>
-                                <v-container>
-                                    <v-row>
-
-                                        <v-col cols="12" md="4">
-                                            <v-text-field
-                                                    label="{{ _('Full Name') }}"
-                                                    v-model="editedItem.name"
-                                                    :rules="[
-                                                        validationRules.required(),
-                                                    ]"
-                                                    v-bind="serverErrorPropsForField(serverErrors, 'item.name')"
-                                            ></v-text-field>
-
-                                        </v-col>
-                                        <v-col cols="12" md="4">
-
-                                            <div class="d-flex">
-
+                                </div>
+                            </template>
+                        </v-toolbar>
+                        <v-card tile elevation="0">
+                            <v-divider></v-divider>
+                            <v-form ref="form" v-model="valid">
+                                <v-card-text>
+                                    <v-container>
+                                        <div class="mb-3">{{ _('User Details') }}</div>
+                                        <v-row>
+                                            <v-col cols="12" md="6">
                                                 <v-text-field
+                                                        v-model="editedItem.name"
+                                                        :rules="[
+                                                            validationRules.required(),
+                                                        ]"
+                                                        variant="filled"
+                                                        v-bind="serverErrorPropsForField(serverErrors, 'item.name')"
+                                                >
+                                                    <template #label>{{ _('Full Name') }}<span class="text-red">*</span></template>
+                                                </v-text-field>
+                                            </v-col>
+                                            <v-col>
+                                                <div class="d-flex">
+                                                    <v-text-field
+                                                        variant="filled"
+                                                        :class="isUsernameAvailable ? 'text-success' : undefined"
+                                                        :hint="isUsernameAvailable ? '{{ _('Username available') }}' : undefined"
+                                                        :disabled="disableUsername"
+                                                        v-model="editedItem.username"
+                                                        :rules="disableUsername ? [] : [
+                                                            validationRules.required(),
+                                                            validationRules.minLength(4),
+                                                            validationRules.checkUsername({ initialUsername, onResponse: onUsernameCheckResponse })
+                                                        ]"
+                                                        @input="isUsernameAvailable = false"
+                                                        v-bind="serverErrorPropsForField(serverErrors, 'item.username')"
+                                                    >
+                                                        <template #label>{{ _('Username') }}<span class="text-red">*</span></template>
+                                                    </v-text-field>
+                                                    <v-btn @click.stop="enableUsername"
+                                                        v-if="editedItem.id" class="my-auto mx-1"
+                                                        icon="mdi-pencil"
+                                                        size="small"
+                                                        variant="plain"
+                                                    >
+                                                    </v-btn>
+                                                </div>
+                                            </v-col>
+                                            <v-col cols="12" md="6">
+                                                <div class="d-flex">
+                                                    <v-text-field
+                                                        variant="filled"
                                                         label="{{ _('Email') }}"
                                                         :disabled="disableEmail"
                                                         v-model="editedItem.email"
                                                         v-bind="serverErrorPropsForField(serverErrors, 'item.email')"
                                                         type="email"
-                                                ></v-text-field>
-                                                <v-btn @click.stop="enableEmail"
-                                                       v-if="editedItem.id" class="my-auto mx-1"
-                                                       icon="mdi-pencil"
-                                                       size="small"
-                                                       variant="plain"
-                                                >
-
-                                                </v-btn>
-                                            </div>
-                                        </v-col>
-                                        <v-col cols="12" md="4">
-
-                                            <div class="d-flex align-center">
-
-                                                <v-text-field
-                                                        label="{{ _('Password') }}"
+                                                    ></v-text-field>
+                                                    <v-btn @click.stop="enableEmail"
+                                                        v-if="editedItem.id" class="my-auto mx-1"
+                                                        icon="mdi-pencil"
+                                                        size="small"
+                                                        variant="plain"
+                                                    >
+                                                    </v-btn>
+                                                </div>
+                                            </v-col>
+                                            <v-col cols="12" md="6">
+                                                <div class="d-flex align-center">
+                                                    <v-text-field
+                                                        variant="filled"
                                                         :class="isStrongPassword ? 'text-success' : undefined"
                                                         :hint="isStrongPassword ? '{{ _('Strong password') }}' : undefined"
                                                         :disabled="disablePassword"
                                                         v-model="editedItem.password"
-                                                        :append-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
+                                                        :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
                                                         :type="showPassword ? 'text' : 'password'"
-                                                        @click:append="showPassword = !showPassword"
+                                                        @click:append-inner="showPassword = !showPassword"
                                                         :rules="disablePassword ? [] : [
                                                             validationRules.required(),
                                                             validationRules.minLength({{ config.SECURITY_PASSWORD_LENGTH_MIN }}),
                                                             validationRules.checkPassword({ onResponse: onPasswordCheckResponse })
                                                         ]"
                                                         @input="isStrongPassword = false"
-                                                >
-                                                </v-text-field>
-
-                                                <v-btn @click.stop="enablePassword"
-                                                       v-if="editedItem.id" class="mb-3 mx-1"
-                                                       icon="mdi-pencil"
-                                                       size="small"
-                                                       variant="plain"
-                                                >
-
-                                                </v-btn>
-
-                                            </div>
-                                        </v-col>
-                                    </v-row>
-                                    <v-row>
-                                        <v-col>
-                                            <div class="d-flex">
-                                                <v-text-field
-                                                              label="{{ _('Username') }}"
-                                                              :class="isUsernameAvailable ? 'text-success' : undefined"
-                                                              :hint="isUsernameAvailable ? '{{ _('Username available') }}' : undefined"
-                                                              :disabled="disableUsername"
-                                                              v-model="editedItem.username"
-                                                              :rules="disableUsername ? [] : [
-                                                                    validationRules.required(),
-                                                                    validationRules.minLength(4),
-                                                                    validationRules.checkUsername({ initialUsername, onResponse: onUsernameCheckResponse })
-                                                                ]"
-                                                              @input="isUsernameAvailable = false"
-                                                              v-bind="serverErrorPropsForField(serverErrors, 'item.username')"
-                                                ></v-text-field>
-
-                                                <v-btn @click.stop="enableUsername"
-                                                       v-if="editedItem.id" class="my-auto mx-1"
-                                                       icon="mdi-pencil"
-                                                       size="small"
-                                                       variant="plain"
-                                                >
+                                                    >
+                                                        <template #label>{{ _('Password') }}<span class="text-red">*</span></template>
+                                                    </v-text-field>
+                                                    <v-btn @click.stop="enablePassword"
+                                                        v-if="editedItem.id" class="mb-3 mx-1"
+                                                        icon="mdi-pencil"
+                                                        size="small"
+                                                        variant="plain"
+                                                    >
+                                                    </v-btn>
+                                                </div>
+                                            </v-col>
+                                        </v-row>
+                                        <v-switch color="primary" class="text-medium-emphasis" label="{{ _('Account is Active') }}"
+                                                v-model="editedItem.active"></v-switch>
+
+                                        <div class="mb-3">{{ _('User Roles') }}</div>
+                                        <div class="d-flex flex-wrap ga-3 mb-7">
+                                            <toggle-button
+                                                v-for="role in roles"
+                                                :key="role.id"
+                                                :model-value="isRoleSelected(role)"
+                                                @update:model-value="toggleRole(role)"
+                                            >
+                                                ${role.name}
+                                            </toggle-button>
+                                        </div>
+                                        <div class="mb-3">{{ _('User Permissions') }}</div>
+                                        <div class="d-flex flex-wrap ga-3 mb-7">
+                                            <toggle-button v-model="editedItem.view_usernames">
+                                                {{ _('Can View Usernames') }}
+                                            </toggle-button>
+
+                                            <toggle-button v-model="editedItem.view_full_history">
+                                                {{ _('Can View Full History') }}
+                                            </toggle-button>
+
+                                            <toggle-button v-model="editedItem.view_simple_history">
+                                                {{ _('Can View Simple History') }}
+                                            </toggle-button>
+
+                                            <toggle-button v-model="editedItem.can_self_assign">
+                                                {{ _('Can Self-Assign') }}
+                                            </toggle-button>
+
+                                            <toggle-button v-model="editedItem.can_edit_locations">
+                                                {{ _('Can Edit Locations') }}
+                                            </toggle-button>
+
+                                            <toggle-button v-model="editedItem.can_export">
+                                                {{ _('Can Request Exports') }}
+                                            </toggle-button>
+
+                                            <toggle-button v-model="editedItem.can_import_web">
+                                                {{ _('Can Import From Web') }}
+                                            </toggle-button>
+                                        </div>
+                                    </v-container>
+                                </v-card-text>
+                                <v-card-text class="text-center">
+                                    <v-btn v-if="editedItem.two_factor_devices?.length"  prepend-icon="mdi-lock-remove" class="mx-2" @click="revoke2fa(editedItem.id)">
+                                        {{ _('Revoke 2FA') }}
+                                    </v-btn>
 
-                                                </v-btn>
-                                            </div>
-
-
-                                        </v-col>
-                                        <v-col cols="4" md="4">
-                                            <v-select
-                                                    :items="roles"
-                                                    item-title="name"
-                                                    item-value="id"
-                                                    v-model="editedItem.roles"
-                                                    label="{{ _('Groups') }}"
-                                                    return-object
-                                                    multiple
-                                                    @update:model-value="checkRoles"
-                                            ></v-select>
-
-                                        </v-col>
-                                        <v-col cols="12" md="4">
-                                            <v-switch color="primary" label="{{ _('Active') }}"
-                                                      v-model="editedItem.active"></v-switch>
-                                        </v-col>
-                                    </v-row>
-                                    <v-row>
-                                        <v-col cols="12" md="3">
-                                            <v-switch :disabled="isAdmin" color="primary" label="{{ _('Can view usernames') }}"
-                                                      v-model="editedItem.view_usernames"></v-switch>
-                                        </v-col>
-                                        <v-col cols="12" md="3">
-                                            <v-switch :disabled="isAdmin" color="primary" label="{{ _('Can view simple history') }}"
-                                                      v-model="editedItem.view_simple_history"></v-switch>
-                                        </v-col>
-                                        <v-col cols="12" md="3">
-                                            <v-switch :disabled="isAdmin" color="primary" label="{{ _('Can view Full History') }}"
-                                                      v-model="editedItem.view_full_history"></v-switch>
-                                        </v-col>
-                                        <v-col cols="12" md="3">
-                                            <v-switch :disabled="isAdmin" color="primary" label="{{ _('Can self assign') }}"
-                                                      v-model="editedItem.can_self_assign"></v-switch>
-
-                                        </v-col>
-                                        <v-col cols="12" md="3">
-                                            <v-switch :disabled="isAdmin" color="primary" label="{{ _('Can edit Locations') }}"
-                                                      v-model="editedItem.can_edit_locations"></v-switch>
-
-                                        </v-col>
-
-                                        <v-col cols="12" md="3">
-                                            <v-switch :disabled="isAdmin" color="primary" label="{{ _('Can Request Exports') }}"
-                                                      v-model="editedItem.can_export"></v-switch>
-                                        </v-col>
-
-                                        <v-col cols="12" md="3">
-                                            <v-switch :disabled="isAdmin" color="primary" label="{{ _('Can Import from Web') }}"
-                                                      v-model="editedItem.can_import_web"></v-switch>
-                                        </v-col>
-                                    </v-row>
-                                </v-container>
-                            </v-card-text>
-                            <v-card-text class="text-center">
-                                <v-btn v-if="editedItem.two_factor_devices?.length"  prepend-icon="mdi-lock-remove" class="mx-2" @click="revoke2fa(editedItem.id)">
-                                    {{ _('Revoke 2FA') }}
-                                </v-btn>
-
-                                <v-btn v-if="editedItem?.id" @click.once="logoutAllUserSessions(editedItem.id)" color="error">
-                                    <v-icon left>mdi-logout</v-icon>
-                                    {{ _('Logout All Sessions') }}
-                                </v-btn>
-                            </v-card-text>
-
-                            <v-card-actions class="pa-4">
-                                <v-spacer></v-spacer>
-                                <v-btn @click="close" text>{{ _('Close') }}</v-btn>
-                                <v-btn @click="validateFormAndSave" color="primary" variant="elevated">
-                                    {{ _('Save') }}
-                                </v-btn>
-                            </v-card-actions>
-                        </v-form>
+                                    <v-btn v-if="editedItem?.id" @click.once="logoutAllUserSessions(editedItem.id)" color="error">
+                                        <v-icon left>mdi-logout</v-icon>
+                                        {{ _('Logout All Sessions') }}
+                                    </v-btn>
+                                </v-card-text>
+                            </v-form>
                         </v-card>
                     </v-dialog>
 
@@ -354,6 +339,7 @@
 
 {% endblock %} {% block js %}
     <script src="/static/js/components/UserCard.js"></script>
+    <script src="/static/js/components/ToggleButton.js"></script>
 
     <script>
 
@@ -409,7 +395,7 @@
 
             computed: {
                 formTitle() {
-                    return this.editedItem?.id ? "{{_('Edit Item')}}" : "{{_('New Item')}}";
+                    return this.editedItem?.id ? "{{_('Edit User')}}" : "{{_('Add New User')}}";
                 },
             },
 
@@ -711,12 +697,26 @@
                             }).catch(handleError);
                     }
 
+                },
+                isRoleSelected(role) {
+                    return this.editedItem?.roles?.some(r => r.id === role.id)
+                },
+                toggleRole(role) {
+                    if (!this.editedItem?.roles) this.editedItem.roles = []
+
+                    const index = this.editedItem.roles.findIndex(r => r.id === role.id)
+                    if (index !== -1) {
+                        this.editedItem.roles.splice(index, 1) // remove
+                    } else {
+                        this.editedItem.roles.push(role) // add
+                    }
                 }
 
             }
         });
 
         app.component('UserCard', UserCard);
+        app.component('ToggleButton', ToggleButton);
         app.use(router).use(vuetify).mount('#app')
     </script>
 {% endblock %}
diff --git a/enferno/static/js/components/ToggleButton.js b/enferno/static/js/components/ToggleButton.js
new file mode 100644
index 000000000..6b8c97b1b
--- /dev/null
+++ b/enferno/static/js/components/ToggleButton.js
@@ -0,0 +1,23 @@
+const ToggleButton = Vue.defineComponent({
+  props: {
+    modelValue: {
+      type: Boolean,
+      required: true,
+    },
+    activeColor: {
+      type: String,
+      default: 'primary',
+    },
+  },
+  emits: ['update:modelValue'],
+  template: `
+    <v-btn
+      :variant="modelValue ? 'tonal' : 'outlined'"
+      :color="modelValue ? activeColor : undefined"
+      @click="$emit('update:modelValue', !modelValue)"
+    >
+      <v-icon v-if="modelValue" start size="small">mdi-check</v-icon>
+      <slot></slot>
+    </v-btn>
+  `,
+});
\ No newline at end of file

From 3df53324a96a08730e7c681f9f86985d9839b195 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 15 Oct 2025 15:07:30 -0600
Subject: [PATCH 003/180]  add default to toggle button component

---
 enferno/static/js/components/ToggleButton.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/enferno/static/js/components/ToggleButton.js b/enferno/static/js/components/ToggleButton.js
index 6b8c97b1b..dcaa7475c 100644
--- a/enferno/static/js/components/ToggleButton.js
+++ b/enferno/static/js/components/ToggleButton.js
@@ -3,6 +3,7 @@ const ToggleButton = Vue.defineComponent({
     modelValue: {
       type: Boolean,
       required: true,
+      default: false,
     },
     activeColor: {
       type: String,

From 6491bbd12ad89d64f9cb04caa854a828caa909c4 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 15 Oct 2025 15:07:50 -0600
Subject: [PATCH 004/180] Tweak message when new user created

---
 enferno/admin/views.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index a1c914aee..f28e623bd 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5115,7 +5115,7 @@ def api_user_create(
             f"User {username} has been created by {current_user.username} successfully.",
         )
         return HTTPResponse.created(
-            message=f"User {username} has been created successfully",
+            message=f"New User '{user.name}' successfully added!",
             data={"item": user.to_dict()},
         )
     else:

From 9deb93d760f968b9f9b8ff7b8297ae0c465cbe96 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 15 Oct 2025 15:07:58 -0600
Subject: [PATCH 005/180] fix typo on save button

---
 enferno/admin/templates/admin/users.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 4db7023ab..a650ab554 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -163,7 +163,7 @@
                                     <v-btn @click="close" variant="outlined">
                                         {{ _('Cancel') }}
                                     </v-btn>
-                                    <v-btn @click="close" prepend-icon="mdi-plus" color="primary" variant="flat">
+                                    <v-btn @click="validateFormAndSave" prepend-icon="mdi-plus" color="primary" variant="flat">
                                         {{ _('Add User') }}
                                     </v-btn>
                                     <v-btn icon density="comfortable" @click="close">

From aec0d80af2f200befc11806b418ddeee8c32bbaa Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 16 Oct 2025 09:00:49 -0600
Subject: [PATCH 006/180] allow users to use main input for search

---
 enferno/admin/templates/admin/users.html | 37 +++++++++++++++++++-----
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index a650ab554..04d5f5b69 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -24,6 +24,8 @@
                                     <v-toolbar-title class="flex-0-0">{{ _('System Users') }}</v-toolbar-title>
     
                                     <v-text-field
+                                        :model-value="search"
+                                        @update:model-value="searchUsers"
                                         class="flex-grow-1"
                                         variant="outlined"
                                         density="comfortable"
@@ -357,6 +359,7 @@
                 translations: window.translations,
                 validationRules: validationRules,
                 options: {},
+                search: '',
 
                 headers: [
                     {title: "{{_('ID')}}", value: "id"},
@@ -617,14 +620,27 @@
                 refresh(options) {
                     this.options = options || { ...this.options, page: 1 };
                     this.loading = true;
-                    api.get(`/admin/api/users/?page=${this.options.page}&per_page=${this.options.itemsPerPage}`, {search: this.search}).then(res => {
-                        this.items = res.data.items;
-                        this.itemsLength = res.data.total;
-                    }).catch(err => {
-                        console.error(err?.response?.data);
-                    }).finally(() => {
-                        this.loading = false;
+
+                    const params = new URLSearchParams({
+                        page: this.options.page,
+                        per_page: this.options.itemsPerPage,
                     });
+
+                    if (this.options.q) {
+                        params.append('q', this.options.q);
+                    }
+
+                    api.get(`/admin/api/users/?${params.toString()}`)
+                        .then(res => {
+                            this.items = res.data.items;
+                            this.itemsLength = res.data.total;
+                        })
+                        .catch(err => {
+                            console.error(err?.response?.data);
+                        })
+                        .finally(() => {
+                            this.loading = false;
+                        });
                 },
 
                 createItem() {
@@ -710,8 +726,13 @@
                     } else {
                         this.editedItem.roles.push(role) // add
                     }
-                }
+                },
+                searchUsers: debounce(function (evt) {
+                    this.loading = true;
+                    this.search = evt;
 
+                    this.refresh({ q: evt })
+                }, 350),
             }
         });
 

From e02746de22f80efd4f09057438d77a9f3590f0e7 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 16 Oct 2025 09:23:32 -0600
Subject: [PATCH 007/180] update edit user dialog

---
 enferno/admin/templates/admin/users.html | 166 +++++++++--------------
 enferno/admin/views.py                   |   2 +-
 2 files changed, 65 insertions(+), 103 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 04d5f5b69..8497c775b 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -59,9 +59,18 @@
 
 
                         <template v-slot:item.action="{ item }">
-                            <v-icon class="mr-2" @click.stop="editItem(item)">
-                                mdi-pencil
-                            </v-icon>
+                            <v-tooltip location="top" text="{{ _('Edit User') }}">
+                                <template #activator="{props}">
+                                    <div v-bind="props" class="d-inline-block">
+                                        <v-btn
+                                            @click.stop="editItem(item)"
+                                            variant="plain"
+                                            size="small"
+                                            icon="mdi-pencil">
+                                        </v-btn>
+                                    </div>
+                                </template>
+                            </v-tooltip>
                             <v-tooltip location="top"
                                        :text="item.force_reset ? '{{ _('Password reset already requested.') }}' : '{{ _('Force password reset') }}'">
                                 <template #activator="{props}">
@@ -165,9 +174,13 @@
                                     <v-btn @click="close" variant="outlined">
                                         {{ _('Cancel') }}
                                     </v-btn>
-                                    <v-btn @click="validateFormAndSave" prepend-icon="mdi-plus" color="primary" variant="flat">
-                                        {{ _('Add User') }}
-                                    </v-btn>
+                                    <v-btn
+                                        @click="validateFormAndSave"
+                                        :prepend-icon="isNewUser ? 'mdi-plus' : 'mdi-check'"
+                                        color="primary"
+                                        variant="flat"
+                                        :text="isNewUser ? '{{ _('Add User') }}' : '{{ _('Save Changes') }}'"
+                                    ></v-btn>
                                     <v-btn icon density="comfortable" @click="close">
                                         <v-icon>mdi-close</v-icon>
                                     </v-btn>
@@ -194,79 +207,49 @@
                                                 </v-text-field>
                                             </v-col>
                                             <v-col>
-                                                <div class="d-flex">
-                                                    <v-text-field
-                                                        variant="filled"
-                                                        :class="isUsernameAvailable ? 'text-success' : undefined"
-                                                        :hint="isUsernameAvailable ? '{{ _('Username available') }}' : undefined"
-                                                        :disabled="disableUsername"
-                                                        v-model="editedItem.username"
-                                                        :rules="disableUsername ? [] : [
-                                                            validationRules.required(),
-                                                            validationRules.minLength(4),
-                                                            validationRules.checkUsername({ initialUsername, onResponse: onUsernameCheckResponse })
-                                                        ]"
-                                                        @input="isUsernameAvailable = false"
-                                                        v-bind="serverErrorPropsForField(serverErrors, 'item.username')"
-                                                    >
-                                                        <template #label>{{ _('Username') }}<span class="text-red">*</span></template>
-                                                    </v-text-field>
-                                                    <v-btn @click.stop="enableUsername"
-                                                        v-if="editedItem.id" class="my-auto mx-1"
-                                                        icon="mdi-pencil"
-                                                        size="small"
-                                                        variant="plain"
-                                                    >
-                                                    </v-btn>
-                                                </div>
+                                                <v-text-field
+                                                    variant="filled"
+                                                    :class="isUsernameAvailable ? 'text-success' : undefined"
+                                                    :hint="isUsernameAvailable ? '{{ _('Username available') }}' : undefined"
+                                                    v-model="editedItem.username"
+                                                    :rules="[
+                                                        validationRules.required(),
+                                                        validationRules.minLength(4),
+                                                        validationRules.checkUsername({ initialUsername, onResponse: onUsernameCheckResponse })
+                                                    ]"
+                                                    @input="isUsernameAvailable = false"
+                                                    v-bind="serverErrorPropsForField(serverErrors, 'item.username')"
+                                                >
+                                                    <template #label>{{ _('Username') }}<span class="text-red">*</span></template>
+                                                </v-text-field>
                                             </v-col>
-                                            <v-col cols="12" md="6">
-                                                <div class="d-flex">
-                                                    <v-text-field
-                                                        variant="filled"
-                                                        label="{{ _('Email') }}"
-                                                        :disabled="disableEmail"
-                                                        v-model="editedItem.email"
-                                                        v-bind="serverErrorPropsForField(serverErrors, 'item.email')"
-                                                        type="email"
-                                                    ></v-text-field>
-                                                    <v-btn @click.stop="enableEmail"
-                                                        v-if="editedItem.id" class="my-auto mx-1"
-                                                        icon="mdi-pencil"
-                                                        size="small"
-                                                        variant="plain"
-                                                    >
-                                                    </v-btn>
-                                                </div>
+                                            <v-col cols="12" :md="isNewUser ? 6 : 12">
+                                                <v-text-field
+                                                    variant="filled"
+                                                    label="{{ _('Email') }}"
+                                                    v-model="editedItem.email"
+                                                    v-bind="serverErrorPropsForField(serverErrors, 'item.email')"
+                                                    type="email"
+                                                ></v-text-field>
                                             </v-col>
-                                            <v-col cols="12" md="6">
-                                                <div class="d-flex align-center">
-                                                    <v-text-field
-                                                        variant="filled"
-                                                        :class="isStrongPassword ? 'text-success' : undefined"
-                                                        :hint="isStrongPassword ? '{{ _('Strong password') }}' : undefined"
-                                                        :disabled="disablePassword"
-                                                        v-model="editedItem.password"
-                                                        :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
-                                                        :type="showPassword ? 'text' : 'password'"
-                                                        @click:append-inner="showPassword = !showPassword"
-                                                        :rules="disablePassword ? [] : [
-                                                            validationRules.required(),
-                                                            validationRules.minLength({{ config.SECURITY_PASSWORD_LENGTH_MIN }}),
-                                                            validationRules.checkPassword({ onResponse: onPasswordCheckResponse })
-                                                        ]"
-                                                        @input="isStrongPassword = false"
-                                                    >
-                                                        <template #label>{{ _('Password') }}<span class="text-red">*</span></template>
-                                                    </v-text-field>
-                                                    <v-btn @click.stop="enablePassword"
-                                                        v-if="editedItem.id" class="mb-3 mx-1"
-                                                        icon="mdi-pencil"
-                                                        size="small"
-                                                        variant="plain"
-                                                    >
-                                                    </v-btn>
-                                                </div>
+                                            <v-col v-if="isNewUser" cols="12" md="6">
+                                                <v-text-field
+                                                    variant="filled"
+                                                    :class="isStrongPassword ? 'text-success' : undefined"
+                                                    :hint="isStrongPassword ? '{{ _('Strong password') }}' : undefined"
+                                                    v-model="editedItem.password"
+                                                    :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
+                                                    :type="showPassword ? 'text' : 'password'"
+                                                    @click:append-inner="showPassword = !showPassword"
+                                                    :rules="[
+                                                        validationRules.required(),
+                                                        validationRules.minLength({{ config.SECURITY_PASSWORD_LENGTH_MIN }}),
+                                                        validationRules.checkPassword({ onResponse: onPasswordCheckResponse })
+                                                    ]"
+                                                    @input="isStrongPassword = false"
+                                                >
+                                                    <template #label>{{ _('Password') }}<span class="text-red">*</span></template>
+                                                </v-text-field>
                                             </v-col>
                                         </v-row>
                                         <v-switch color="primary" class="text-medium-emphasis" label="{{ _('Account is Active') }}"
@@ -319,11 +302,6 @@
                                     <v-btn v-if="editedItem.two_factor_devices?.length"  prepend-icon="mdi-lock-remove" class="mx-2" @click="revoke2fa(editedItem.id)">
                                         {{ _('Revoke 2FA') }}
                                     </v-btn>
-
-                                    <v-btn v-if="editedItem?.id" @click.once="logoutAllUserSessions(editedItem.id)" color="error">
-                                        <v-icon left>mdi-logout</v-icon>
-                                        {{ _('Logout All Sessions') }}
-                                    </v-btn>
                                 </v-card-text>
                             </v-form>
                         </v-card>
@@ -380,9 +358,6 @@
                 defaultItem: {
                     active: false
                 },
-                disableUsername: true,
-                disablePassword: true,
-                disableEmail: true,
                 isAdmin: false,
                 userDrawer: false,
                 user: null,
@@ -397,8 +372,11 @@
             mixins: [globalMixin],
 
             computed: {
+                isNewUser() {
+                    return !this.editedItem?.id;
+                },
                 formTitle() {
-                    return this.editedItem?.id ? "{{_('Edit User')}}" : "{{_('Add New User')}}";
+                    return this.isNewUser ? "{{_('Add New User')}}" : "{{_('Edit User')}}";
                 },
             },
 
@@ -561,18 +539,6 @@
                     }
                 },
 
-                enableUsername() {
-                    this.disableUsername = false;
-                },
-
-                enablePassword() {
-                    this.disablePassword = false;
-                },
-
-                enableEmail() {
-                    this.disableEmail = false;
-                },
-
                 checkUsername:
                     debounce(function (evt) {
                         api.post('/admin/api/checkuser/', {item: this.editedItem.username}, { suppressGlobalErrorHandler: true }).then(
@@ -645,8 +611,6 @@
 
                 createItem() {
                     this.editedItem = {...this.defaultItem};
-                    // enable fields
-                    this.disableUsername = this.disablePassword = this.disableEmail = false;
                     this.dialog = true;
 
                 },
@@ -657,7 +621,6 @@
                     this.editedItem = {...item};
                     this.isUsernameAvailable = false;
                     this.initialUsername = item.username;
-                    this.disableUsername = this.disablePassword = this.disableEmail = true;
                     this.dialog = true;
                 },
 
@@ -672,7 +635,6 @@
                         this.serverErrors = {};
                         this.isStrongPassword = false;
                         this.editedItem = Object.assign({}, this.defaultItem);
-                        this.disableUsername = this.disablePassword = this.disableEmail = true;
                         this.editedIndex = -1;
                     }, 300);
                 },
diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index f28e623bd..1d3cc794d 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5202,7 +5202,7 @@ def api_user_update(
                 "User Updated",
                 f"User {user.username} has been updated by {current_user.username} successfully.",
             )
-            return HTTPResponse.success(message=f"Saved User {user.id} {user.name}")
+            return HTTPResponse.success(message=f"User '{user.name}' updated successfully.")
         else:
             return HTTPResponse.error(f"Error saving User {user.id} {user.name}", status=500)
     else:

From 25b5f14c84c921c6a88c44ed1ffa35e32cc5a98e Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 16 Oct 2025 14:21:24 -0600
Subject: [PATCH 008/180] when selecting user role mark permissions as selected

---
 enferno/admin/templates/admin/users.html | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 8497c775b..3affe17c2 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -266,33 +266,33 @@
                                                 ${role.name}
                                             </toggle-button>
                                         </div>
-                                        <div class="mb-3">{{ _('User Permissions') }}</div>
+                                        <div class="mb-3">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default )') }}</span></div>
                                         <div class="d-flex flex-wrap ga-3 mb-7">
-                                            <toggle-button v-model="editedItem.view_usernames">
+                                            <toggle-button :model-value="editedItem.view_usernames || editedUserHasAdminRole" @update:model-value="editedItem.view_usernames = $event">
                                                 {{ _('Can View Usernames') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.view_full_history">
+                                            <toggle-button :model-value="editedItem.view_full_history || editedUserHasAdminRole" @update:model-value="editedItem.view_full_history = $event">
                                                 {{ _('Can View Full History') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.view_simple_history">
+                                            <toggle-button :model-value="editedItem.view_simple_history || editedUserHasAdminRole" @update:model-value="editedItem.view_simple_history = $event">
                                                 {{ _('Can View Simple History') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_self_assign">
+                                            <toggle-button :model-value="editedItem.can_self_assign || editedUserHasAdminRole" @update:model-value="editedItem.can_self_assign = $event">
                                                 {{ _('Can Self-Assign') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_edit_locations">
+                                            <toggle-button :model-value="editedItem.can_edit_locations || editedUserHasAdminRole" @update:model-value="editedItem.can_edit_locations = $event">
                                                 {{ _('Can Edit Locations') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_export">
+                                            <toggle-button :model-value="editedItem.can_export || editedUserHasAdminRole" @update:model-value="editedItem.can_export = $event">
                                                 {{ _('Can Request Exports') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_import_web">
+                                            <toggle-button :model-value="editedItem.can_import_web || editedUserHasAdminRole" @update:model-value="editedItem.can_import_web = $event">
                                                 {{ _('Can Import From Web') }}
                                             </toggle-button>
                                         </div>
@@ -372,6 +372,10 @@
             mixins: [globalMixin],
 
             computed: {
+                editedUserHasAdminRole() {
+                    const adminRoleId = 1;
+                    return this.editedItem?.roles?.some(role => role.id === adminRoleId) ?? false;
+                },
                 isNewUser() {
                     return !this.editedItem?.id;
                 },

From 6b5be238f279021461db0f6e52b8cf71f3239cb8 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 16 Oct 2025 14:56:29 -0600
Subject: [PATCH 009/180] allow user to deselect permissions if he has admin
 role

---
 enferno/admin/templates/admin/users.html | 26 ++++++++++++------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 3affe17c2..8ef7137ab 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -268,31 +268,31 @@
                                         </div>
                                         <div class="mb-3">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default )') }}</span></div>
                                         <div class="d-flex flex-wrap ga-3 mb-7">
-                                            <toggle-button :model-value="editedItem.view_usernames || editedUserHasAdminRole" @update:model-value="editedItem.view_usernames = $event">
+                                            <toggle-button v-model="editedItem.view_usernames">
                                                 {{ _('Can View Usernames') }}
                                             </toggle-button>
 
-                                            <toggle-button :model-value="editedItem.view_full_history || editedUserHasAdminRole" @update:model-value="editedItem.view_full_history = $event">
+                                            <toggle-button v-model="editedItem.view_full_history">
                                                 {{ _('Can View Full History') }}
                                             </toggle-button>
 
-                                            <toggle-button :model-value="editedItem.view_simple_history || editedUserHasAdminRole" @update:model-value="editedItem.view_simple_history = $event">
+                                            <toggle-button v-model="editedItem.view_simple_history">
                                                 {{ _('Can View Simple History') }}
                                             </toggle-button>
 
-                                            <toggle-button :model-value="editedItem.can_self_assign || editedUserHasAdminRole" @update:model-value="editedItem.can_self_assign = $event">
+                                            <toggle-button v-model="editedItem.can_self_assign">
                                                 {{ _('Can Self-Assign') }}
                                             </toggle-button>
 
-                                            <toggle-button :model-value="editedItem.can_edit_locations || editedUserHasAdminRole" @update:model-value="editedItem.can_edit_locations = $event">
+                                            <toggle-button v-model="editedItem.can_edit_locations">
                                                 {{ _('Can Edit Locations') }}
                                             </toggle-button>
 
-                                            <toggle-button :model-value="editedItem.can_export || editedUserHasAdminRole" @update:model-value="editedItem.can_export = $event">
+                                            <toggle-button v-model="editedItem.can_export">
                                                 {{ _('Can Request Exports') }}
                                             </toggle-button>
 
-                                            <toggle-button :model-value="editedItem.can_import_web || editedUserHasAdminRole" @update:model-value="editedItem.can_import_web = $event">
+                                            <toggle-button v-model="editedItem.can_import_web">
                                                 {{ _('Can Import From Web') }}
                                             </toggle-button>
                                         </div>
@@ -366,15 +366,15 @@
                 initialUsername: null,
                 isUsernameAvailable: false,
                 isStrongPassword: false,
-                serverErrors: {}
+                serverErrors: {},
+                adminRoleId: 1,
             }),
 
             mixins: [globalMixin],
 
             computed: {
                 editedUserHasAdminRole() {
-                    const adminRoleId = 1;
-                    return this.editedItem?.roles?.some(role => role.id === adminRoleId) ?? false;
+                    return this.editedItem?.roles?.some(role => role.id === this.adminRoleId) ?? false;
                 },
                 isNewUser() {
                     return !this.editedItem?.id;
@@ -390,9 +390,7 @@
 
             watch: {
                 dialog(val) {
-                    if (val) {
-                        this.checkRoles();
-                    } else {
+                    if (!val) {
                         this.close();
                     }
                 },
@@ -691,6 +689,8 @@
                         this.editedItem.roles.splice(index, 1) // remove
                     } else {
                         this.editedItem.roles.push(role) // add
+                        
+                        this.checkRoles();
                     }
                 },
                 searchUsers: debounce(function (evt) {

From b4811c7e73f3e8443654061b93ee3f9dfa248cc3 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 17 Oct 2025 15:00:59 -0500
Subject: [PATCH 010/180] view user updates

---
 enferno/admin/templates/admin/jsapi.jinja2   |   8 +-
 enferno/admin/templates/admin/users.html     | 115 ++++----
 enferno/static/js/components/ToggleButton.js |  18 +-
 enferno/static/js/components/UserCard.js     | 289 +++++++++++--------
 4 files changed, 254 insertions(+), 176 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 8a8a843ab..ee52c552c 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -34,6 +34,9 @@ copiedToClipboard_: "{{ _('Copied to clipboard') }}",
 copyCoordinates_: "{{ _('Copy coordinates') }}",
 failedToCopyCoordinates_: "{{ _('Failed to copy coordinates') }}",
 googleOauth_: "{{ _('Google OAuth') }}",
+editUser_: "{{ _('Edit User') }}",
+userRole_: "{{ _('User Role') }}",
+twoFactorAuthentication_: "{{ _('Two-Factor Authentication') }}",
 
 cancel_ : "{{ _('Cancel') }}",
 titleOrTitleArRequired_ : "{{ _('Title or Title (Ar) is required') }}",
@@ -561,12 +564,13 @@ started_: "{{ _('Started') }}",
 logOffThisDevice_: "{{ _('Log off this device') }}",
 active_: "{{ _('Active') }}",
 inactive_: "{{ _('Inactive') }}",
-logoutAllSessions_: "{{ _('Logout All Sessions') }}",
+logoutAll_: "{{ _('Logout All') }}",
 resetPassword_: "{{ _('Reset password') }}",
 passwordResetAlreadyRequested_: "{{ _('Password reset already requested.') }}",
-passwordResetRequested_: "{{ _('Password reset requested.') }}",
+passwordResetRequested_: "{{ _('Password Reset Requested.') }}",
 forcePasswordReset_: "{{ _('Force password reset') }}",
 revoke2fa_: "{{ _('Revoke 2FA') }}",
+changePassword_: "{{ _('Change Password') }}",
 
 // validations
 mustBeMaxCharactersOrFewer_: (max) => "{{ _('Must be {max} characters or fewer.') }}".replace("{max}", max),
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 8ef7137ab..6612b5564 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -59,63 +59,78 @@
 
 
                         <template v-slot:item.action="{ item }">
-                            <v-tooltip location="top" text="{{ _('Edit User') }}">
-                                <template #activator="{props}">
-                                    <div v-bind="props" class="d-inline-block">
+                            <div class="d-flex">
+                                <v-tooltip location="top" text="{{ _('Edit User') }}">
+                                    <template #activator="{props}">
+                                        <div v-bind="props" class="d-inline-block">
+                                            <v-btn
+                                                @click.stop="editItem(item)"
+                                                variant="plain"
+                                                size="small"
+                                                icon="mdi-pencil">
+                                            </v-btn>
+                                        </div>
+                                    </template>
+                                </v-tooltip>
+                                <v-tooltip
+                                    location="top"
+                                    text="{{ _('Change Password') }}"
+                                >
+                                    <template #activator="{props}">
+                                        <div v-bind="props">
                                         <v-btn
-                                            @click.stop="editItem(item)"
+                                            density="comfortable"
                                             variant="plain"
-                                            size="small"
-                                            icon="mdi-pencil">
-                                        </v-btn>
-                                    </div>
-                                </template>
-                            </v-tooltip>
-                            <v-tooltip location="top"
-                                       :text="item.force_reset ? '{{ _('Password reset already requested.') }}' : '{{ _('Force password reset') }}'">
-                                <template #activator="{props}">
-                                    <div v-bind="props" class="d-inline-block">
+                                            icon="mdi-form-textbox-password"
+                                        ></v-btn>
+                                        </div>
+                                    </template>
+                                </v-tooltip>
+                                <v-tooltip location="top"
+                                        :text="item.force_reset ? '{{ _('Password reset already requested.') }}' : '{{ _('Force password reset') }}'">
+                                    <template #activator="{props}">
+                                        <div v-bind="props" class="d-inline-block">
+                                            <v-btn
+                                                :disabled="item.force_reset != null"
+                                                @click.stop="forcePassReset(item)"
+                                                variant="plain"
+                                                size="small"
+                                                icon="mdi-lock-reset">
+                                            </v-btn>
+                                        </div>
+                                    </template>
+                                </v-tooltip>
+
+                                <v-tooltip location="top"
+                                        v-if="item.two_factor_devices && item.two_factor_devices.length > 0"
+                                        :text="'{{ _('Revoke 2FA') }}'">
+                                    <template #activator="{props}">
                                         <v-btn
-                                            :disabled="item.force_reset != null"
-                                            @click.stop="forcePassReset(item)"
-                                            variant="plain"
-                                            size="small"
-                                            icon="mdi-lock-reset">
+                                                @click.stop="revoke2fa(item.id)"
+                                                variant="plain"
+                                                color="warning"
+                                                v-bind="props"
+                                                size="small"
+                                                icon="mdi-lock-remove">
                                         </v-btn>
-                                    </div>
-                                </template>
-                            </v-tooltip>
-
-                            <v-tooltip location="top"
-                                    v-if="item.two_factor_devices && item.two_factor_devices.length > 0"
-                                    :text="'{{ _('Revoke 2FA') }}'">
-                                <template #activator="{props}">
-                                    <v-btn
-                                            @click.stop="revoke2fa(item.id)"
-                                            variant="plain"
-                                            color="warning"
-                                            v-bind="props"
-                                            size="small"
-                                            icon="mdi-lock-remove">
-                                    </v-btn>
-                                </template>
-                            </v-tooltip>
-
-                            <v-tooltip location="top" text="{{ _('Password reset requested.') }}">
-                                <template #activator="{props}">
-                                    <v-btn icon="mdi-exclamation-thick" size="small" color="error" variant="plain"
-                                           v-bind="props" v-if="item.force_reset">
-                                    </v-btn>
-                                </template>
-                            </v-tooltip>
+                                    </template>
+                                </v-tooltip>
 
+                                <v-tooltip location="top" text="{{ _('Password reset requested.') }}">
+                                    <template #activator="{props}">
+                                        <v-btn icon="mdi-exclamation-thick" size="small" color="error" variant="plain"
+                                            v-bind="props" v-if="item.force_reset">
+                                        </v-btn>
+                                    </template>
+                                </v-tooltip>
+                            </div>
                         </template>
 
                         <template v-slot:item.2fa="{ item }">
                             <v-tooltip location="top"
                                        :text="item.two_factor_devices && item.two_factor_devices.length > 0 ? '{{ _('2FA Active') }}' : '{{ _('2FA Inactive') }}'">
                                 <template #activator="{props}">
-                                    <div v-if="item.two_factor_devices && item.two_factor_devices.length > 0" class="d-flex ga-2 justify-center font-weight-medium text-warning">
+                                    <div v-if="item.two_factor_devices && item.two_factor_devices.length > 0" class="d-flex ga-2 font-weight-medium text-warning">
                                         <v-icon
                                             color="success"
                                             v-bind="props"
@@ -125,7 +140,7 @@
                                         </v-icon>
                                         {{ _('2FA Active') }}
                                     </div>
-                                    <div v-else class="d-flex ga-2 justify-center font-weight-medium text-warning">
+                                    <div v-else class="d-flex ga-2 font-weight-medium text-warning">
                                         <v-icon
                                                 color="warning"
                                                 v-bind="props"
@@ -192,7 +207,7 @@
                             <v-form ref="form" v-model="valid">
                                 <v-card-text>
                                     <v-container>
-                                        <div class="mb-3">{{ _('User Details') }}</div>
+                                        <div class="mb-3 text-body-1">{{ _('User Details') }}</div>
                                         <v-row>
                                             <v-col cols="12" md="6">
                                                 <v-text-field
@@ -255,7 +270,7 @@
                                         <v-switch color="primary" class="text-medium-emphasis" label="{{ _('Account is Active') }}"
                                                 v-model="editedItem.active"></v-switch>
 
-                                        <div class="mb-3">{{ _('User Roles') }}</div>
+                                        <div class="mb-3 text-body-1">{{ _('User Roles') }}</div>
                                         <div class="d-flex flex-wrap ga-3 mb-7">
                                             <toggle-button
                                                 v-for="role in roles"
@@ -266,7 +281,7 @@
                                                 ${role.name}
                                             </toggle-button>
                                         </div>
-                                        <div class="mb-3">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default )') }}</span></div>
+                                        <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default )') }}</span></div>
                                         <div class="d-flex flex-wrap ga-3 mb-7">
                                             <toggle-button v-model="editedItem.view_usernames">
                                                 {{ _('Can View Usernames') }}
diff --git a/enferno/static/js/components/ToggleButton.js b/enferno/static/js/components/ToggleButton.js
index dcaa7475c..67ae10b8c 100644
--- a/enferno/static/js/components/ToggleButton.js
+++ b/enferno/static/js/components/ToggleButton.js
@@ -5,19 +5,33 @@ const ToggleButton = Vue.defineComponent({
       required: true,
       default: false,
     },
+    readOnly: {
+      type: Boolean,
+      default: false,
+    },
     activeColor: {
       type: String,
       default: 'primary',
     },
+    hideIcon: {
+      type: Boolean,
+      default: false
+    }
   },
   emits: ['update:modelValue'],
   template: `
     <v-btn
-      :variant="modelValue ? 'tonal' : 'outlined'"
+      :variant="modelValue || (!modelValue && readOnly) ? 'tonal' : 'outlined'"
       :color="modelValue ? activeColor : undefined"
       @click="$emit('update:modelValue', !modelValue)"
+      :class="['font-weight-medium', { 'text-medium-emphasis cursor-default': readOnly }]"
+      read-only
+      :ripple="!readOnly"
     >
-      <v-icon v-if="modelValue" start size="small">mdi-check</v-icon>
+      <template v-if="!hideIcon">
+        <v-icon v-if="modelValue" start size="small">mdi-check</v-icon>
+        <v-icon v-if="!modelValue && readOnly" start size="small">mdi-close</v-icon>
+      </template>
       <slot></slot>
     </v-btn>
   `,
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index c06ca8670..6550587f4 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -115,149 +115,193 @@ const UserCard = Vue.defineComponent({
 
   template: `
       <v-card class="mx-auto">
-        <v-sheet class="px-6 py-4 d-flex align-center">
+        <v-sheet class="px-6 py-5 d-flex align-center">
           <v-toolbar-title>
-            <div class="d-flex flex-wrap ga-2 align-center">
-              {{ user.name }}
+            <div class="d-flex justify-space-between ga-2 align-center">
+              <div class="d-flex flex-column">
+                <div class="d-flex align-center ga-2">
+                  {{ user.name }}
+      
+                  <v-chip color="primary">
+                    <v-icon size="x-large">mdi-identifier</v-icon>
+                    {{ user.id }}
+                  </v-chip>
   
-              <v-chip prepend-icon="mdi-identifier" color="primary">
-                {{ user.id }}
-              </v-chip>
-  
-              <v-chip prepend-icon="mdi-account-circle-outline" color="primary">
-                {{ user.username }}
-              </v-chip>
-  
-              <v-chip v-if="user.email" prepend-icon="mdi-email" color="primary">
-                {{ user.email }}
-              </v-chip>
-  
-              <v-btn
-                variant="tonal"
-                size="small"
-                prepend-icon="mdi-pencil"
-                @click="$emit('edit', user)"
-              >
-                {{ translations.edit_ }}
-              </v-btn>
-  
-              <v-tooltip
-                location="bottom"
-                :disabled="!user.force_reset"
-                :text="translations.passwordResetAlreadyRequested_"
-              >
-                <template #activator="{props}">
-                  <div v-bind="props">
-                    <v-btn
-                      :disabled="user.force_reset != null"
-                      variant="tonal"
-                      size="small"
-                      prepend-icon="mdi-lock-reset"
-                      @click="$emit('resetPassword', user)"
-                    >
-                      {{ translations.forcePasswordReset_ }}
-                    </v-btn>
-                  </div>
-                </template>
-              </v-tooltip>
-              
+                  <v-chip :color="user.active ? 'success' : null">
+                    <v-icon class="mr-1" size="x-large">{{ user.active ? 'mdi-account-check' : 'mdi-account-cancel'}}</v-icon>
+                    {{ user.active ? translations.active_ : translations.inactive_ }}
+                  </v-chip>
+                </div>
+    
+                <div>
+                  <v-chip prepend-icon="mdi-account-circle-outline" variant="plain" class="text-body-2">
+                    {{ user.username }}
+                  </v-chip>
+      
+                  <v-chip v-if="user.email" prepend-icon="mdi-email-outline" variant="plain" class="text-body-2">
+                    {{ user.email }}
+                  </v-chip>
+                </div>
+              </div>
+
               <v-chip
                 v-if="user.force_reset"
                 color="error"
-                variant="tonal"
-                label
-                prepend-icon="mdi-exclamation"
+                variant="text"
+                class="font-weight-medium"
               >
+                <v-icon size="x-large">mdi-exclamation</v-icon>
                 {{ translations.passwordResetRequested_ }}
               </v-chip>
+  
+              <div class="d-flex justify-space-between ga-2 align-center">
+                <v-tooltip
+                  location="bottom"
+                  :text="user.force_reset ? translations.passwordResetAlreadyRequested_ : translations.forcePasswordReset_"
+                >
+                  <template #activator="{props}">
+                    <div v-bind="props">
+                      <v-btn
+                        :disabled="user.force_reset != null"
+                        color="error"
+                        density="comfortable"
+                        icon="mdi-lock-reset"
+                        @click="$emit('resetPassword', user)"
+                      ></v-btn>
+                    </div>
+                  </template>
+                </v-tooltip>
+
+                <v-tooltip
+                  location="bottom"
+                  :text="translations.changePassword_"
+                >
+                  <template #activator="{props}">
+                    <div v-bind="props">
+                      <v-btn
+                        :disabled="user.force_reset != null"
+                        color="warning"
+                        density="comfortable"
+                        icon="mdi-form-textbox-password"
+                        @click="$emit('resetPassword', user)"
+                      ></v-btn>
+                    </div>
+                  </template>
+                </v-tooltip>
+
+                <v-tooltip
+                  v-if="user.two_factor_devices && user.two_factor_devices.length > 0"
+                  location="bottom"
+                  :text="translations.revoke2fa_"
+                >
+                  <template #activator="{props}">
+                    <div v-bind="props">
+                      <v-btn
+                        
+                        @click.stop="$emit('revoke2fa', user.id)"
+                        variant="outlined"
+                        color="warning"
+                        density="comfortable"
+                        icon="mdi-lock-remove"
+                      ></v-btn>
+                    </div>
+                  </template>
+                </v-tooltip>
+
+                <v-tooltip
+                  location="bottom"
+                  :text="translations.editUser_"
+                >
+                  <template #activator="{props}">
+                    <div v-bind="props">
+                      <v-btn
+                        variant="outlined"
+                        density="comfortable"
+                        icon="mdi-pencil"
+                        @click="$emit('edit', user)"
+                      ></v-btn>
+                    </div>
+                  </template>
+                </v-tooltip>
+
+                <v-btn v-if="closable" size="small" variant="flat" icon="mdi-close" @click="$emit('close')"></v-btn>
+              </div>
             </div>
           </v-toolbar-title>
-
-          <v-btn v-if="closable" size="small" variant="flat" icon="mdi-close" @click="$emit('close')"></v-btn>
         </v-sheet>
         <v-divider></v-divider>
 
+        <v-card variant="flat">
+          <v-card-text class="px-6">
+            <v-row>
+              <v-col cols="12" md="6">
+                <div class="mb-3 text-body-1">{{ translations.userRole_ }}</div>
+                <div class="d-flex flex-wrap ga-3">
+                  <toggle-button
+                    v-for="(role, index) in user.roles"
+                    :key="index"
+                    read-only
+                    hide-icon
+                    :model-value="role.id"
+                  >
+                    {{ role.name }}
+                  </toggle-button>
+                </div>
+              </v-col>
+              <v-col cols="12" md="6">
+                <div class="mb-3 text-body-1">{{ translations.twoFactorAuthentication_ }}</div>
+                <div class="d-flex flex-wrap ga-3">
+                  <v-chip
+                    v-for="device in user.two_factor_devices"
+                    :key="device.id"
+                    :prepend-icon="device.type === 'authenticator' ? 'mdi-lock-clock' : 'mdi-usb-flash-drive'"
+                    color="primary"
+                  >
+                    {{ device.name }}
+                  </v-chip>
 
-        <v-card variant="flat" class="mt-3 pa-3">
-
-          <v-label class="ml-3">
-            {{ translations.userPermissions_ }}
-          </v-label>
-          <v-card-text>
-
-            <v-chip
-              v-for="(permission, index) in permissions"
-              :key="index"
-              class="ma-2"
-              :color="permission.value ? 'primary' : 'error'"
-              :prepend-icon="permission.value ? 'mdi-checkbox-marked-circle' : 'mdi-close-circle'">
-              {{ permission.label }}
-            </v-chip>
+                  <v-chip
+                    v-if="user.two_factor_devices.length == 0"
+                    prepend-icon="mdi-lock-open-alert"
+                    color="error"
+                    label
+                  >
+                    {{ translations.noTwoFactorMethods_ }}
+                  </v-chip>
+                </div>
+              </v-col>
+            </v-row>
           </v-card-text>
         </v-card>
 
-        <v-divider></v-divider>
-        
-         <v-card variant="flat" class="mt-3 pa-3">
-
-          <div class="d-flex align-center">
-            <v-label class="ml-3">
-              {{ translations.userTwoFactorMethods_ }}
-            </v-label>
-
-            <v-btn
-              v-if="user.two_factor_devices && user.two_factor_devices.length > 0"
-              @click.stop="$emit('revoke2fa', user.id)"
-              variant="tonal"
-              color="warning"
-              size="small"
-              prepend-icon="mdi-lock-remove"
-              class="ml-2"
-            >
-              {{ translations.revoke2fa_ }}
-            </v-btn>
-          </div>
-
-          <v-card-text class="d-flex ga-3">
-
-            <v-chip
-              v-for="device in user.two_factor_devices"
-              :key="device.id"
-              :prepend-icon="device.type === 'authenticator' ? 'mdi-lock-clock' : 'mdi-usb-flash-drive'"
-              color="primary"
-            >
-              {{ device.name }}
-            </v-chip>
-
-            <v-chip
-              v-if="user.two_factor_devices.length == 0"
-              prepend-icon="mdi-lock-open-alert"
-              color="error"
-              label
-            >
-              {{ translations.noTwoFactorMethods_ }}
-            </v-chip>
-
-
+        <v-card variant="flat">
+          <v-card-text class="px-6">
+            <div class="mb-3 text-body-1">{{ translations.userPermissions_ }}</div>
+            <div class="d-flex flex-wrap ga-3">
+              <toggle-button
+                v-for="(permission, index) in permissions"
+                :key="index"
+                read-only
+                :model-value="permission.value"
+              >
+                {{ permission.label }}
+              </toggle-button>
+            </div>
           </v-card-text>
         </v-card>
 
-        <v-divider></v-divider>
-
         <v-card class="mt-2" variant="flat">
-
-          <v-card-text>
-            <div class="d-flex align-center">
-              <v-label class="ml-3">{{ translations.userSessions_ }}</v-label>
+          <v-card-text class="px-6">
+            <div class="d-flex justify-space-between align-center mb-2">
+              <div class="text-body-1">{{ translations.userSessions_ }}</div>
               <v-btn
+                v-if="sessions.length"
                 @click.stop="$emit('logoutAll', user.id)"
-                variant="tonal"
-                size="small"
+                variant="outlined"
                 prepend-icon="mdi-logout"
                 color="error"
-                class="ml-2"
               >
-                {{ translations.logoutAllSessions_ }}
+                {{ translations.logoutAll_ }}
               </v-btn>
             </div>
 
@@ -303,11 +347,12 @@ const UserCard = Vue.defineComponent({
                 </td>
                 <td class="text-caption">{{ $root.formatDate(session.created_at, $root.dateFormats.standardDatetime, $root.dateOptions.local) }}</td>
                 <td>
-                  <v-btn icon="mdi-logout" variant="plain" v-if="session.details?._fresh"
-                         @click.once="logoutSession(session.id)" :disabled="!session.is_active"
-                         color="error">
-
-                  </v-btn>
+                  <v-btn
+                    icon="mdi-logout"
+                    variant="plain" v-if="session.details?._fresh"
+                    @click.once="logoutSession(session.id)" :disabled="!session.is_active"
+                    color="error"
+                  ></v-btn>
                 </td>
               </tr>
               </tbody>

From e39d98c06b273c9d62bce0339a2df5ec8c463520 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 20 Oct 2025 08:24:29 -0600
Subject: [PATCH 011/180] basic add of change password dialog

---
 .../templates/admin/partials/user_drawer.html |  1 +
 enferno/admin/templates/admin/users.html      | 86 +++++++++++++++++--
 enferno/static/js/components/UserCard.js      |  6 +-
 3 files changed, 85 insertions(+), 8 deletions(-)

diff --git a/enferno/admin/templates/admin/partials/user_drawer.html b/enferno/admin/templates/admin/partials/user_drawer.html
index b6c44ada5..0b9616428 100644
--- a/enferno/admin/templates/admin/partials/user_drawer.html
+++ b/enferno/admin/templates/admin/partials/user_drawer.html
@@ -14,6 +14,7 @@
             @reset-password="forcePassReset"
             @revoke2fa="revoke2fa"
             @logout-all="logoutAllUserSessions"
+            @change-password="openChangePasswordDialog()"
             :user="user"
         ></user-card>
     </v-card>
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 6612b5564..aab079c2b 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -82,6 +82,7 @@
                                             density="comfortable"
                                             variant="plain"
                                             icon="mdi-form-textbox-password"
+                                            @click.stop="openChangePasswordDialog(item)"
                                         ></v-btn>
                                         </div>
                                     </template>
@@ -322,7 +323,36 @@
                         </v-card>
                     </v-dialog>
 
-
+                    <v-dialog v-model="changePasswordDialog" persistent max-width="780">
+                        <v-card rounded="lg">
+                            <v-card-text class="pa-7">
+                                <div class="text-h6 mb-4">{{ _('Change Password for user “Luca Bergström.”') }}</div>
+                                <div class="mb-3">{{ _('Set a temporary password for this user.') }}</div>
+                                <v-text-field
+                                    variant="filled"
+                                    :class="isStrongPassword ? 'text-success' : undefined"
+                                    :hint="isStrongPassword ? '{{ _('Strong password') }}' : undefined"
+                                    v-model="editedItem.password"
+                                    :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
+                                    :type="showPassword ? 'text' : 'password'"
+                                    @click:append="showPassword = !showPassword"
+                                    :rules="[
+                                        validationRules.required(),
+                                        validationRules.minLength({{ config.SECURITY_PASSWORD_LENGTH_MIN }}),
+                                        validationRules.checkPassword({ onResponse: onPasswordCheckResponse })
+                                    ]"
+                                    @input="isStrongPassword = false"
+                            >
+                                <template #label>{{ _('Temporary Password') }}<span class="text-red">*</span></template>
+                            </v-text-field>
+                                <v-checkbox v-model="askUserToChangePassword" color="blue" class="text-medium-emphasis text-body-2" label="{{ _('Ask user to change password when they sign in') }}"></v-checkbox>
+                            </v-card-text>
+                            <v-card-actions class="px-7 pb-7 pt-0">
+                                <v-btn @click="closeChangePasswordDialog()" variant="outlined">{{ _('Cancel') }}</v-btn>
+                                <v-btn @click="validateFormAndSave(askUserToChangePassword ? { callback: api.post('/admin/api/user/force-reset', { item: editedItem }) } : {})" color="primary" variant="flat">{{ _('Change Password') }}</v-btn>
+                            </v-card-actions>
+                        </v-card>
+                    </v-dialog>
                 </v-card-text>
             </v-card>
 
@@ -383,6 +413,7 @@
                 isStrongPassword: false,
                 serverErrors: {},
                 adminRoleId: 1,
+                changePasswordDialog: false,
             }),
 
             mixins: [globalMixin],
@@ -450,10 +481,10 @@
                     this.isStrongPassword = response === true
                 },
 
-                validateFormAndSave() {
+                validateFormAndSave(options) {
                     this.$refs.form.validate().then(({ valid, errors }) => {
                         if (valid) {
-                            this.save();
+                            this.save(options);
                         } else {
                             this.showSnack("{{ _('Please review the form for errors.')}}")
                             scrollToFirstError()
@@ -626,10 +657,15 @@
                         });
                 },
 
+                openChangePasswordDialog(item) {
+                    this.editedItem = { ...(item || {}), password: '' };
+                    this.changePasswordDialog = true;
+                    this.askUserToChangePassword = true;
+                },
+
                 createItem() {
                     this.editedItem = {...this.defaultItem};
                     this.dialog = true;
-
                 },
 
                 editItem(item) {
@@ -656,7 +692,17 @@
                     }, 300);
                 },
 
-                save() {
+                closeChangePasswordDialog() {
+                    this.changePasswordDialog = false;
+                    setTimeout(() => {
+                        this.askUserToChangePassword = true;
+                        this.serverErrors = {};
+                        this.isStrongPassword = false;
+                        this.editedItem = Object.assign({}, this.defaultItem);
+                    }, 300);
+                },
+
+                save(options) {
                     const handleError = (err) => {
                         const usernameAlreadyTaken = err?.response?.status === 409
                         const errors = err?.response?.data?.errors
@@ -679,6 +725,7 @@
                                 this.refresh();
                                 this.showSnack(response.data);
                                 this.close();
+                                options?.callback?.()
                             }).catch(handleError);
 
                     } else {
@@ -692,6 +739,35 @@
                             }).catch(handleError);
                     }
 
+                },
+                changePassword(options) {
+                    const handleError = (err) => {
+                        const usernameAlreadyTaken = err?.response?.status === 409
+                        const errors = err?.response?.data?.errors
+                        if (errors || usernameAlreadyTaken) {
+                            this.serverErrors = errors
+                            // Override email message for something simpler
+                            if (this.serverErrors?.['item.email']) this.serverErrors['item.email'] = [translations.emailInvalid_];
+                            if (this.serverErrors?.['item.username']) this.serverErrors['item.username'] = [translations.usernameInvalid_];
+                            if (usernameAlreadyTaken) this.serverErrors = { ...this.serverErrors, ['item.username']: [translations.usernameAlreadyTaken_]};
+
+                            this.$nextTick(() => scrollToFirstError())
+                            this.showSnack(handleRequestError(err))
+                        }
+                    }
+
+                    if (this.editedItem.id) {
+                        api.put(`/admin/api/user/`, {item: this.editedItem}, { suppressGlobalErrorHandler: true })
+                            .then(response => {
+                                this.showSnack(response.data);
+                                api.post('/admin/api/user/force-reset',
+                                    {item: editItem}
+                                )
+                                this.closeChangePasswordDialog();
+                            }).catch(handleError);
+
+                    }
+
                 },
                 isRoleSelected(role) {
                     return this.editedItem?.roles?.some(r => r.id === role.id)
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 6550587f4..5eaff5ea6 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -1,6 +1,6 @@
 const UserCard = Vue.defineComponent({
   props: ['user', 'closable'],
-  emits: ['close', 'edit', 'resetPassword', 'revoke2fa', 'logoutAll'],
+  emits: ['close', 'edit', 'resetPassword', 'revoke2fa', 'logoutAll', 'changePassword'],
   watch: {
     user: function (val, old) {
       this.resetSessions();
@@ -183,7 +183,7 @@ const UserCard = Vue.defineComponent({
                         color="warning"
                         density="comfortable"
                         icon="mdi-form-textbox-password"
-                        @click="$emit('resetPassword', user)"
+                        @click="$emit('changePassword', user)"
                       ></v-btn>
                     </div>
                   </template>
@@ -242,7 +242,7 @@ const UserCard = Vue.defineComponent({
                     :key="index"
                     read-only
                     hide-icon
-                    :model-value="role.id"
+                    :model-value="true"
                   >
                     {{ role.name }}
                   </toggle-button>

From d9338366556bb93ac70a824ba007a8a86011ee82 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 20 Oct 2025 10:10:47 -0600
Subject: [PATCH 012/180] improvements to form validations on change password
 dialog

---
 enferno/admin/templates/admin/jsapi.jinja2 |  1 +
 enferno/admin/templates/admin/users.html   | 96 +++++++++++-----------
 2 files changed, 49 insertions(+), 48 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index ee52c552c..adc555a38 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -571,6 +571,7 @@ passwordResetRequested_: "{{ _('Password Reset Requested.') }}",
 forcePasswordReset_: "{{ _('Force password reset') }}",
 revoke2fa_: "{{ _('Revoke 2FA') }}",
 changePassword_: "{{ _('Change Password') }}",
+changePasswordForUser_: (name) => "{{ _('Change Password for user “{name}”') }}".replace("{name}", name),
 
 // validations
 mustBeMaxCharactersOrFewer_: (max) => "{{ _('Must be {max} characters or fewer.') }}".replace("{max}", max),
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index aab079c2b..cea315335 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -268,7 +268,7 @@
                                                 </v-text-field>
                                             </v-col>
                                         </v-row>
-                                        <v-switch color="primary" class="text-medium-emphasis" label="{{ _('Account is Active') }}"
+                                        <v-switch color="blue" class="text-medium-emphasis" label="{{ _('Account is Active') }}"
                                                 v-model="editedItem.active"></v-switch>
 
                                         <div class="mb-3 text-body-1">{{ _('User Roles') }}</div>
@@ -325,31 +325,33 @@
 
                     <v-dialog v-model="changePasswordDialog" persistent max-width="780">
                         <v-card rounded="lg">
-                            <v-card-text class="pa-7">
-                                <div class="text-h6 mb-4">{{ _('Change Password for user “Luca Bergström.”') }}</div>
-                                <div class="mb-3">{{ _('Set a temporary password for this user.') }}</div>
-                                <v-text-field
-                                    variant="filled"
-                                    :class="isStrongPassword ? 'text-success' : undefined"
-                                    :hint="isStrongPassword ? '{{ _('Strong password') }}' : undefined"
-                                    v-model="editedItem.password"
-                                    :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
-                                    :type="showPassword ? 'text' : 'password'"
-                                    @click:append="showPassword = !showPassword"
-                                    :rules="[
-                                        validationRules.required(),
-                                        validationRules.minLength({{ config.SECURITY_PASSWORD_LENGTH_MIN }}),
-                                        validationRules.checkPassword({ onResponse: onPasswordCheckResponse })
-                                    ]"
-                                    @input="isStrongPassword = false"
-                            >
-                                <template #label>{{ _('Temporary Password') }}<span class="text-red">*</span></template>
-                            </v-text-field>
-                                <v-checkbox v-model="askUserToChangePassword" color="blue" class="text-medium-emphasis text-body-2" label="{{ _('Ask user to change password when they sign in') }}"></v-checkbox>
-                            </v-card-text>
+                            <v-form ref="changePasswordForm" v-model="valid">
+                                <v-card-text class="pa-7">
+                                    <div class="text-h6 mb-4">${translations.changePasswordForUser_(editedItem.name || user.name)}</div>
+                                    <div class="mb-3">{{ _('Set a temporary password for this user.') }}</div>
+                                    <v-text-field
+                                        variant="filled"
+                                        :class="isStrongPassword ? 'text-success' : undefined"
+                                        :hint="isStrongPassword ? '{{ _('Strong password') }}' : undefined"
+                                        v-model="editedItem.password"
+                                        :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
+                                        :type="showPassword ? 'text' : 'password'"
+                                        @click:append-inner="showPassword = !showPassword"
+                                        :rules="[
+                                            validationRules.required(),
+                                            validationRules.minLength({{ config.SECURITY_PASSWORD_LENGTH_MIN }}),
+                                            validationRules.checkPassword({ onResponse: onPasswordCheckResponse })
+                                        ]"
+                                        @input="isStrongPassword = false"
+                                >
+                                    <template #label>{{ _('Temporary Password') }}<span class="text-red">*</span></template>
+                                </v-text-field>
+                                    <v-checkbox v-model="askUserToChangePassword" color="blue" class="text-medium-emphasis text-body-2" label="{{ _('Ask user to change password when they sign in') }}"></v-checkbox>
+                                </v-card-text>
+                            </v-form>
                             <v-card-actions class="px-7 pb-7 pt-0">
                                 <v-btn @click="closeChangePasswordDialog()" variant="outlined">{{ _('Cancel') }}</v-btn>
-                                <v-btn @click="validateFormAndSave(askUserToChangePassword ? { callback: api.post('/admin/api/user/force-reset', { item: editedItem }) } : {})" color="primary" variant="flat">{{ _('Change Password') }}</v-btn>
+                                <v-btn @click="validateChangePasswordFormAndSave()" color="primary" variant="flat">{{ _('Change Password') }}</v-btn>
                             </v-card-actions>
                         </v-card>
                     </v-dialog>
@@ -414,6 +416,7 @@
                 serverErrors: {},
                 adminRoleId: 1,
                 changePasswordDialog: false,
+                askUserToChangePassword: true,
             }),
 
             mixins: [globalMixin],
@@ -491,6 +494,16 @@
                         }
                     });
                 },
+                validateChangePasswordFormAndSave(options) {
+                    this.$refs.changePasswordForm.validate().then(({ valid, errors }) => {
+                        if (valid) {
+                            this.changePassword(options);
+                        } else {
+                            this.showSnack("{{ _('Please review the form for errors.')}}")
+                            scrollToFirstError()
+                        }
+                    });
+                },
 
                 showUser(user_id) {
                     api.get(`/admin/api/user/${user_id}`).then(response => {
@@ -658,6 +671,7 @@
                 },
 
                 openChangePasswordDialog(item) {
+                    this.refreshUser(item.id);
                     this.editedItem = { ...(item || {}), password: '' };
                     this.changePasswordDialog = true;
                     this.askUserToChangePassword = true;
@@ -740,34 +754,20 @@
                     }
 
                 },
-                changePassword(options) {
-                    const handleError = (err) => {
-                        const usernameAlreadyTaken = err?.response?.status === 409
-                        const errors = err?.response?.data?.errors
-                        if (errors || usernameAlreadyTaken) {
-                            this.serverErrors = errors
-                            // Override email message for something simpler
-                            if (this.serverErrors?.['item.email']) this.serverErrors['item.email'] = [translations.emailInvalid_];
-                            if (this.serverErrors?.['item.username']) this.serverErrors['item.username'] = [translations.usernameInvalid_];
-                            if (usernameAlreadyTaken) this.serverErrors = { ...this.serverErrors, ['item.username']: [translations.usernameAlreadyTaken_]};
+                async changePassword() {
+                    try {
+                        const response = await api.put(`/admin/api/user/`, { item: this.editedItem }, { suppressGlobalErrorHandler: true });
+                        this.showSnack(response.data);
 
-                            this.$nextTick(() => scrollToFirstError())
-                            this.showSnack(handleRequestError(err))
+                        if (this.askUserToChangePassword && this.user?.force_reset === null) {
+                            await api.post('/admin/api/user/force-reset', { item: this.editedItem });
                         }
-                    }
-
-                    if (this.editedItem.id) {
-                        api.put(`/admin/api/user/`, {item: this.editedItem}, { suppressGlobalErrorHandler: true })
-                            .then(response => {
-                                this.showSnack(response.data);
-                                api.post('/admin/api/user/force-reset',
-                                    {item: editItem}
-                                )
-                                this.closeChangePasswordDialog();
-                            }).catch(handleError);
 
+                        await this.refresh();
+                        this.closeChangePasswordDialog();
+                    } catch (err) {
+                        this.showSnack(handleRequestError(err))
                     }
-
                 },
                 isRoleSelected(role) {
                     return this.editedItem?.roles?.some(r => r.id === role.id)

From 3d09347c4be9c0644f310f2c9b92ae8aa745a9b7 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 20 Oct 2025 10:17:55 -0600
Subject: [PATCH 013/180] pass change password evt to dialog and use edited
 item to check force_reset flag

---
 enferno/admin/templates/admin/partials/user_drawer.html | 2 +-
 enferno/admin/templates/admin/users.html                | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/enferno/admin/templates/admin/partials/user_drawer.html b/enferno/admin/templates/admin/partials/user_drawer.html
index 0b9616428..8478c1894 100644
--- a/enferno/admin/templates/admin/partials/user_drawer.html
+++ b/enferno/admin/templates/admin/partials/user_drawer.html
@@ -14,7 +14,7 @@
             @reset-password="forcePassReset"
             @revoke2fa="revoke2fa"
             @logout-all="logoutAllUserSessions"
-            @change-password="openChangePasswordDialog()"
+            @change-password="openChangePasswordDialog($event)"
             :user="user"
         ></user-card>
     </v-card>
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index cea315335..70a237db9 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -671,7 +671,6 @@
                 },
 
                 openChangePasswordDialog(item) {
-                    this.refreshUser(item.id);
                     this.editedItem = { ...(item || {}), password: '' };
                     this.changePasswordDialog = true;
                     this.askUserToChangePassword = true;
@@ -759,7 +758,7 @@
                         const response = await api.put(`/admin/api/user/`, { item: this.editedItem }, { suppressGlobalErrorHandler: true });
                         this.showSnack(response.data);
 
-                        if (this.askUserToChangePassword && this.user?.force_reset === null) {
+                        if (this.askUserToChangePassword && this.editedItem?.force_reset === null) {
                             await api.post('/admin/api/user/force-reset', { item: this.editedItem });
                         }
 

From 07b43d4a41d67cd23c429425a6ac510c677acfe3 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 20 Oct 2025 10:33:55 -0600
Subject: [PATCH 014/180] add saving flag to create user button

---
 enferno/admin/templates/admin/users.html | 30 ++++++++++++++----------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 70a237db9..e4b3719ac 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -88,7 +88,7 @@
                                     </template>
                                 </v-tooltip>
                                 <v-tooltip location="top"
-                                        :text="item.force_reset ? '{{ _('Password reset already requested.') }}' : '{{ _('Force password reset') }}'">
+                                        :text="item.force_reset ? '{{ _('Password reset already requested.') }}' : '{{ _('Force Password Reset') }}'">
                                     <template #activator="{props}">
                                         <div v-bind="props" class="d-inline-block">
                                             <v-btn
@@ -98,6 +98,7 @@
                                                 size="small"
                                                 icon="mdi-lock-reset">
                                             </v-btn>
+                                            <v-icon v-if="item.force_reset" class="ml-n3" color="error">mdi-exclamation-thick</v-icon>
                                         </div>
                                     </template>
                                 </v-tooltip>
@@ -109,19 +110,11 @@
                                         <v-btn
                                                 @click.stop="revoke2fa(item.id)"
                                                 variant="plain"
-                                                color="warning"
                                                 v-bind="props"
                                                 size="small"
                                                 icon="mdi-lock-remove">
                                         </v-btn>
-                                    </template>
-                                </v-tooltip>
-
-                                <v-tooltip location="top" text="{{ _('Password reset requested.') }}">
-                                    <template #activator="{props}">
-                                        <v-btn icon="mdi-exclamation-thick" size="small" color="error" variant="plain"
-                                            v-bind="props" v-if="item.force_reset">
-                                        </v-btn>
+                                        
                                     </template>
                                 </v-tooltip>
                             </div>
@@ -131,7 +124,7 @@
                             <v-tooltip location="top"
                                        :text="item.two_factor_devices && item.two_factor_devices.length > 0 ? '{{ _('2FA Active') }}' : '{{ _('2FA Inactive') }}'">
                                 <template #activator="{props}">
-                                    <div v-if="item.two_factor_devices && item.two_factor_devices.length > 0" class="d-flex ga-2 font-weight-medium text-warning">
+                                    <div v-if="item.two_factor_devices && item.two_factor_devices.length > 0" class="d-flex ga-2 font-weight-medium text-success">
                                         <v-icon
                                             color="success"
                                             v-bind="props"
@@ -196,6 +189,7 @@
                                         color="primary"
                                         variant="flat"
                                         :text="isNewUser ? '{{ _('Add User') }}' : '{{ _('Save Changes') }}'"
+                                        :loading="saving"
                                     ></v-btn>
                                     <v-btn icon density="comfortable" @click="close">
                                         <v-icon>mdi-close</v-icon>
@@ -379,6 +373,7 @@
             data: () => ({
                 dialog: dialog,
                 loading: true,
+                saving: false,
                 showPassword: false,
                 drawer: drawer,
                 translations: window.translations,
@@ -731,6 +726,8 @@
                         }
                     }
 
+                    this.saving = true;
+
                     // edit mode
                     if (this.editedItem.id) {
                         api.put(`/admin/api/user/`, {item: this.editedItem}, { suppressGlobalErrorHandler: true })
@@ -739,7 +736,10 @@
                                 this.showSnack(response.data);
                                 this.close();
                                 options?.callback?.()
-                            }).catch(handleError);
+                            }).catch(handleError)
+                            .finally(() => {
+                                this.saving = false;
+                            });
 
                     } else {
                         // create mode
@@ -749,7 +749,11 @@
                                 this.refresh();
                                 this.showSnack(response.data);
                                 this.close();
-                            }).catch(handleError);
+                            })
+                            .catch(handleError)
+                            .finally(() => {
+                                this.saving = false;
+                            });;
                     }
 
                 },

From b709d57b62c78131cac5c510ad2f873b3f152e3e Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 20 Oct 2025 10:36:21 -0600
Subject: [PATCH 015/180] add saving flag to change password dialog

---
 enferno/admin/templates/admin/users.html | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index e4b3719ac..f71b74189 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -104,7 +104,7 @@
                                 </v-tooltip>
 
                                 <v-tooltip location="top"
-                                        v-if="item.two_factor_devices && item.two_factor_devices.length > 0"
+                                        v-if="item?.two_factor_devices?.length > 0"
                                         :text="'{{ _('Revoke 2FA') }}'">
                                     <template #activator="{props}">
                                         <v-btn
@@ -345,7 +345,7 @@
                             </v-form>
                             <v-card-actions class="px-7 pb-7 pt-0">
                                 <v-btn @click="closeChangePasswordDialog()" variant="outlined">{{ _('Cancel') }}</v-btn>
-                                <v-btn @click="validateChangePasswordFormAndSave()" color="primary" variant="flat">{{ _('Change Password') }}</v-btn>
+                                <v-btn @click="validateChangePasswordFormAndSave()" :loading="saving" color="primary" variant="flat">{{ _('Change Password') }}</v-btn>
                             </v-card-actions>
                         </v-card>
                     </v-dialog>
@@ -759,6 +759,7 @@
                 },
                 async changePassword() {
                     try {
+                        this.saving = true;
                         const response = await api.put(`/admin/api/user/`, { item: this.editedItem }, { suppressGlobalErrorHandler: true });
                         this.showSnack(response.data);
 
@@ -770,6 +771,8 @@
                         this.closeChangePasswordDialog();
                     } catch (err) {
                         this.showSnack(handleRequestError(err))
+                    } finally {
+                        this.saving = false;
                     }
                 },
                 isRoleSelected(role) {

From 73643d2b323ce590d7441cfb97983f156ba203d3 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 20 Oct 2025 12:24:42 -0600
Subject: [PATCH 016/180] tweak 2fa badge on drawer

---
 enferno/admin/templates/admin/jsapi.jinja2 |  1 -
 enferno/static/js/components/UserCard.js   | 36 +++++++++++++---------
 2 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index adc555a38..44b55ab0b 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -371,7 +371,6 @@ noLogs: "{{ _('No log files available') }}",
 URGENT_: "{{ _('URGENT') }}",
 noNotificationsYet_: "{{ _('No notifications yet') }}",
 noNotificationsYetDescription_: "{{ _("You haven't received any notifications yet. When you do, they'll appear here.") }}",
-loadMore_: "{{ _('Load more') }}",
 noMoreNotificationsToLoad_: "{{ _('No more notifications to load.') }}",
 notificationsCouldNotBeLoaded_: "{{ _('Oops! Notifications couldn’t be loaded') }}",
 weAreHavingTroubleFetchingNotifications_: "{{ _('We’re having trouble fetching your notifications right now. Check your connection or refresh the page.') }}",
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 5eaff5ea6..59798677a 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -251,23 +251,31 @@ const UserCard = Vue.defineComponent({
               <v-col cols="12" md="6">
                 <div class="mb-3 text-body-1">{{ translations.twoFactorAuthentication_ }}</div>
                 <div class="d-flex flex-wrap ga-3">
-                  <v-chip
-                    v-for="device in user.two_factor_devices"
-                    :key="device.id"
-                    :prepend-icon="device.type === 'authenticator' ? 'mdi-lock-clock' : 'mdi-usb-flash-drive'"
-                    color="primary"
+                  <div
+                    v-if="user?.two_factor_devices?.length > 0"
+                    class="d-flex flex-column ga-2 font-weight-medium text-success"
                   >
-                    {{ device.name }}
-                  </v-chip>
+                    <div
+                      v-for="device in user.two_factor_devices"
+                      :key="device.id"
+                      class="d-flex align-center ga-2"
+                    >
+                      <v-icon
+                        :icon="device.type === 'authenticator' ? 'mdi-lock-clock' : 'mdi-usb-flash-drive'"
+                        color="success"
+                        size="small"
+                      />
+                      {{ device.name }}
+                    </div>
+                  </div>
 
-                  <v-chip
-                    v-if="user.two_factor_devices.length == 0"
-                    prepend-icon="mdi-lock-open-alert"
-                    color="error"
-                    label
+                  <div
+                    v-else
+                    class="d-flex align-center ga-2 font-weight-medium text-warning"
                   >
+                    <v-icon color="warning" size="small">mdi-lock-open-alert</v-icon>
                     {{ translations.noTwoFactorMethods_ }}
-                  </v-chip>
+                  </div>
                 </div>
               </v-col>
             </v-row>
@@ -359,7 +367,7 @@ const UserCard = Vue.defineComponent({
             </v-table>
           </v-card-text>
           <v-card-text class="text-center">
-            <v-btn icon="mdi-dots-horizontal" variant="plain" v-if="more" fab small @click="fetchSessions(page, perPage)"></v-btn>
+            <v-btn variant="outlined" v-if="more" @click="fetchSessions(page, perPage)">{{ translations.loadMore_ }}</v-btn>
           </v-card-text>
         </v-card>
       </v-card>

From 24c879f4ea68017a8c0f4ccf70497c1bd4ebec2c Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 20 Oct 2025 12:40:14 -0600
Subject: [PATCH 017/180] add force password confirmation to users table

---
 enferno/admin/templates/admin/jsapi.jinja2    |  1 +
 .../templates/admin/partials/user_drawer.html |  8 +--
 enferno/admin/templates/admin/users.html      | 62 ++++++++++++++-----
 enferno/admin/views.py                        |  2 +-
 4 files changed, 51 insertions(+), 22 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 44b55ab0b..fca598006 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -571,6 +571,7 @@ forcePasswordReset_: "{{ _('Force password reset') }}",
 revoke2fa_: "{{ _('Revoke 2FA') }}",
 changePassword_: "{{ _('Change Password') }}",
 changePasswordForUser_: (name) => "{{ _('Change Password for user “{name}”') }}".replace("{name}", name),
+youreAboutToForceAPasswordResetForUser_: (name) => "{{ _('You’re about to force a password reset for user “{name}”') }}".replace("{name}", name),
 
 // validations
 mustBeMaxCharactersOrFewer_: (max) => "{{ _('Must be {max} characters or fewer.') }}".replace("{max}", max),
diff --git a/enferno/admin/templates/admin/partials/user_drawer.html b/enferno/admin/templates/admin/partials/user_drawer.html
index 8478c1894..29cee9fa3 100644
--- a/enferno/admin/templates/admin/partials/user_drawer.html
+++ b/enferno/admin/templates/admin/partials/user_drawer.html
@@ -10,10 +10,10 @@
             v-if="user && userDrawer"
             :closable="true"
             @close="userDrawer=false"
-            @edit="editItem"
-            @reset-password="forcePassReset"
-            @revoke2fa="revoke2fa"
-            @logout-all="logoutAllUserSessions"
+            @edit="editItem($event)"
+            @reset-password="openForceResetDialog($event)"
+            @revoke2fa="revoke2fa($event)"
+            @logout-all="logoutAllUserSessions($event)"
             @change-password="openChangePasswordDialog($event)"
             :user="user"
         ></user-card>
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index f71b74189..2163825ba 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -93,7 +93,7 @@
                                         <div v-bind="props" class="d-inline-block">
                                             <v-btn
                                                 :disabled="item.force_reset != null"
-                                                @click.stop="forcePassReset(item)"
+                                                @click.stop="openForceResetDialog(item)"
                                                 variant="plain"
                                                 size="small"
                                                 icon="mdi-lock-reset">
@@ -321,7 +321,7 @@
                         <v-card rounded="lg">
                             <v-form ref="changePasswordForm" v-model="valid">
                                 <v-card-text class="pa-7">
-                                    <div class="text-h6 mb-4">${translations.changePasswordForUser_(editedItem.name || user.name)}</div>
+                                    <div class="text-h6 mb-4">${translations.changePasswordForUser_(editedItem.name)}</div>
                                     <div class="mb-3">{{ _('Set a temporary password for this user.') }}</div>
                                     <v-text-field
                                         variant="filled"
@@ -349,6 +349,22 @@
                             </v-card-actions>
                         </v-card>
                     </v-dialog>
+
+                    <v-dialog v-model="forceResetDialog" persistent max-width="780">
+                        <v-card rounded="lg">
+                            <v-form ref="forceResetForm" v-model="valid">
+                                <v-card-text class="pa-7">
+                                    <div class="text-h6 mb-4">${translations.youreAboutToForceAPasswordResetForUser_(editedItem.name)}</div>
+                                    <div class="mb-6">{{ _('After this action, user will be required to set a new password at their next sign-in. This will not affect any user data or settings.') }}</div>
+                                    <div class="mb-3">{{ _('Do you want to continue?') }}</div>
+                                </v-card-text>
+                            </v-form>
+                            <v-card-actions class="px-7 pb-7 pt-0">
+                                <v-btn @click="closeForceResetDialog()" variant="outlined">{{ _('Cancel') }}</v-btn>
+                                <v-btn @click="forcePasswordReset(editedItem)" :loading="saving" color="error" variant="flat">{{ _('Force Password Reset') }}</v-btn>
+                            </v-card-actions>
+                        </v-card>
+                    </v-dialog>
                 </v-card-text>
             </v-card>
 
@@ -412,6 +428,7 @@
                 adminRoleId: 1,
                 changePasswordDialog: false,
                 askUserToChangePassword: true,
+                forceResetDialog: false,
             }),
 
             mixins: [globalMixin],
@@ -543,21 +560,20 @@
 
                 },
 
-                forcePassReset(item) {
-                    if (confirm(`{{ _('Are you sure you want to force password reset for user ')}}${item.username}?`)) {
-                        api.post('/admin/api/user/force-reset',
-                            {item: item}
-                        ).then(res => {
-                            this.showSnack(res.data);
-                            this.refresh();
-                            this.close();
-                            if (this.userDrawer) this.refreshUser(item.id);
-                        }).catch(err => {
-                            console.error(err?.response?.data);
-                            this.showsnack(this.parseValidationError(err?.response?.data));
-                        })
-                    }
-
+                forcePasswordReset(item) {
+                    this.saving = true
+                    api.post('/admin/api/user/force-reset',
+                        {item: item}
+                    ).then(res => {
+                        this.showSnack(res.data);
+                        this.refresh();
+                        this.closeForceResetDialog();
+                        if (this.userDrawer) this.refreshUser(item.id);
+                    }).catch(err => {
+                        console.error(err?.response?.data);
+                    }).finally(() => {
+                        this.saving = false;
+                    })
                 },
 
                 forceGlobalReset() {
@@ -671,6 +687,11 @@
                     this.askUserToChangePassword = true;
                 },
 
+                openForceResetDialog(item) {
+                    this.editedItem = { ...(item || {}), password: '' };
+                    this.forceResetDialog = true;
+                },
+
                 createItem() {
                     this.editedItem = {...this.defaultItem};
                     this.dialog = true;
@@ -710,6 +731,13 @@
                     }, 300);
                 },
 
+                closeForceResetDialog() {
+                    this.forceResetDialog = false;
+                    setTimeout(() => {
+                        this.editedItem = Object.assign({}, this.defaultItem);
+                    }, 300);
+                },
+
                 save(options) {
                     const handleError = (err) => {
                         const usernameAlreadyTaken = err?.response?.status === 409
diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 1d3cc794d..d8040fb80 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5251,7 +5251,7 @@ def api_user_force_reset(validated_data: dict) -> Response:
         message = f"Forced password reset already requested: {reset_key}"
         return HTTPResponse.error(message)
     user.set_security_reset_key()
-    message = f"Forced password reset has been set for user {user.username}"
+    message = f"User ‘{user.name}’ will reset password at next sign-in."
     return HTTPResponse.success(message=message)
 
 

From 5d9406f21f78893b44bdeafac5f3744847c5a2d5 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 20 Oct 2025 13:02:04 -0600
Subject: [PATCH 018/180] tweak translation

---
 enferno/admin/templates/admin/users.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 2163825ba..c8265055b 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -276,7 +276,7 @@
                                                 ${role.name}
                                             </toggle-button>
                                         </div>
-                                        <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default )') }}</span></div>
+                                        <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default)') }}</span></div>
                                         <div class="d-flex flex-wrap ga-3 mb-7">
                                             <toggle-button v-model="editedItem.view_usernames">
                                                 {{ _('Can View Usernames') }}

From ba338aa5ad8ec6a76601b7f7fdad5b0cd9ed5e85 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 20 Oct 2025 14:34:25 -0600
Subject: [PATCH 019/180] add basic filtering ui

---
 enferno/admin/templates/admin/users.html | 159 ++++++++++++++++++++++-
 1 file changed, 154 insertions(+), 5 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index c8265055b..613b6a2d0 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -19,10 +19,10 @@
                             class="elevation-1"
                     >
                         <template v-slot:top>
-                            <v-toolbar flat color="white">
-                                <div class="d-flex align-center ga-10 w-100 py-2 px-7">
+                            <div class="d-flex flex-column ga-10 w-100 py-2 px-7">
+                                <div class="d-flex align-center ga-10 w-100">
                                     <v-toolbar-title class="flex-0-0">{{ _('System Users') }}</v-toolbar-title>
-    
+
                                     <v-text-field
                                         :model-value="search"
                                         @update:model-value="searchUsers"
@@ -33,7 +33,7 @@
                                         prepend-inner-icon="mdi-magnify"
                                         placeholder="{{ _('Search for a system user') }}"
                                     ></v-text-field>
-    
+
                                     <div class="d-flex align-center ga-3">
                                         <v-btn
                                             @click.once="forceGlobalReset"
@@ -54,7 +54,128 @@
                                         </v-btn>
                                     </div>
                                 </div>
-                            </v-toolbar>
+                                <div class="d-flex align-center ga-5 w-100">
+                                    <div>{{ _('Filter') }}
+                                        <v-tooltip v-if="activeCount('twoFactor') || activeCount('roles') || activeCount('accountStatus')" location="top" text="{{ _('Clear filters') }}">
+                                            <template #activator="{props}">
+                                                <v-btn v-bind="props" icon="mdi-filter-off-outline" size="small"
+                                                    @click="filters = { accountStatus: null, roles: [], twoFactor: null }"
+                                                ></v-btn>
+                                            </template>
+                                        </v-tooltip>
+                                    </div>
+
+                                    <!-- Account Status -->
+                                    <v-menu>
+                                        <template #activator="{ props }">
+                                            <v-btn
+                                                variant="outlined"
+                                                append-icon="mdi-menu-down"
+                                                v-bind="props"
+                                            >
+                                            <v-badge
+                                                v-if="activeCount('accountStatus')"
+                                                location="top right"
+                                                :offset-x="-14"
+                                                :offset-y="4"
+                                                color="primary"
+                                                dot
+                                                class="mr-4"
+                                            >
+                                                {{ _('Account Status') }}
+                                            </v-badge>
+                                            <template v-else>{{ _('Account Status') }}</template>
+                                            </v-btn>
+                                        </template>
+
+                                        <v-list>
+                                            <v-list-item
+                                                v-for="option in accountStatusOptions"
+                                                :key="option.value"
+                                                @click="filters.accountStatus = option.value"
+                                                :active="filters.accountStatus === option.value"
+                                            >
+                                                <v-list-item-title>${option.title}</v-list-item-title>
+                                            </v-list-item>
+                                        </v-list>
+                                    </v-menu>
+
+                                    <!-- Roles (multi-select) -->
+                                    <v-menu>
+                                        <template #activator="{ props }">
+                                            <v-btn
+                                                variant="outlined"
+                                                append-icon="mdi-menu-down"
+                                                v-bind="props"
+                                            >
+                                            <v-badge
+                                                v-if="activeCount('roles')"
+                                                location="top right"
+                                                :offset-x="-14"
+                                                :offset-y="activeCount('roles') === 1 ? 4 : 5"
+                                                color="primary"
+                                                :content="activeCount('roles')"
+                                                :dot="activeCount('roles') === 1"
+                                                class="mr-4"
+                                            >
+                                                {{ _('Roles') }}
+                                            </v-badge>
+                                            <template v-else>{{ _('Roles') }}</template>
+                                            </v-btn>
+                                        </template>
+
+                                        <v-list>
+                                            <v-list-item
+                                                v-for="role in roles"
+                                                :key="role.id"
+                                                @click="setRoleFilters(role.id)"
+                                                :active="filters.roles.includes(role.id)"
+                                            >
+                                            <v-checkbox
+                                                :model-value="filters.roles.includes(role.id)"
+                                                :label="role.name"
+                                                hide-details
+                                            />
+                                            </v-list-item>
+                                        </v-list>
+                                    </v-menu>
+
+                                    <!-- Two-Factor Authentication -->
+                                    <v-menu>
+                                        <template #activator="{ props }">
+                                            <v-btn
+                                            variant="outlined"
+                                            append-icon="mdi-menu-down"
+                                            v-bind="props"
+                                            >
+                                            <v-badge
+                                                v-if="activeCount('twoFactor')"
+                                                location="top right"
+                                                :offset-x="-14"
+                                                :offset-y="4"
+                                                color="primary"
+                                                dot
+                                                class="mr-4"
+                                            >
+                                                {{ _('Two-Factor Authentication') }}
+                                            </v-badge>
+                                            <template v-else>{{ _('Two-Factor Authentication') }}</template>
+                                            </v-btn>
+                                        </template>
+
+                                        <v-list>
+                                            <v-list-item
+                                                v-for="option in twoFactorOptions"
+                                                :key="option.value"
+                                                @click="filters.twoFactor = option.value"
+                                                :active="filters.twoFactor === option.value"
+                                            >
+                                                <v-list-item-title>${option.title}</v-list-item-title>
+                                            </v-list-item>
+                                        </v-list>
+                                    </v-menu>
+                                </div>
+                            </div>
                         </template>
 
 
@@ -429,6 +550,20 @@
                 changePasswordDialog: false,
                 askUserToChangePassword: true,
                 forceResetDialog: false,
+
+                filters: {
+                    accountStatus: null,
+                    roles: [],
+                    twoFactor: null,
+                },
+                accountStatusOptions: [
+                    { title: 'Active', value: 'active' },
+                    { title: 'Inactive', value: 'inactive' },
+                ],
+                twoFactorOptions: [
+                    { title: 'Active', value: 'active' },
+                    { title: 'Inactive', value: 'inactive' },
+                ],
             }),
 
             mixins: [globalMixin],
@@ -485,6 +620,20 @@
 
 
             methods: {
+                activeCount(key) {
+                    const val = this.filters[key]
+                    if (Array.isArray(val)) return val.length
+                    return val ? 1 : 0
+                },
+                setRoleFilters(role) {
+                    const roles = this.filters.roles
+                    if (roles.includes(role)) {
+                        this.filters.roles = roles.filter((r) => r !== role)
+                    } else {
+                        this.filters.roles.push(role)
+                    }
+
+                },
                 onUsernameCheckResponse(response) {
                     if (this.editedItem.username === this.initialUsername) {
                         this.isUsernameAvailable = false

From 8e85235debdf6060906a52e548e750fe360a3188 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 09:42:27 -0600
Subject: [PATCH 020/180] copy confirmation dialog from form builder branch

---
 enferno/static/js/components/ConfirmDialog.js | 116 ++++++++++++++++++
 enferno/static/js/components/Toast.js         |  65 ++++++++++
 enferno/static/js/mixins/global-mixin.js      |  12 +-
 enferno/templates/layout.html                 |   9 +-
 4 files changed, 197 insertions(+), 5 deletions(-)
 create mode 100644 enferno/static/js/components/ConfirmDialog.js
 create mode 100644 enferno/static/js/components/Toast.js

diff --git a/enferno/static/js/components/ConfirmDialog.js b/enferno/static/js/components/ConfirmDialog.js
new file mode 100644
index 000000000..41775d7a8
--- /dev/null
+++ b/enferno/static/js/components/ConfirmDialog.js
@@ -0,0 +1,116 @@
+const ConfirmDialog = Vue.defineComponent({
+  data() {
+    return {
+      open: false,
+      title: '',
+      message: '',
+      loading: false,
+      dialogProps: {},
+
+      cancelProps: { text: 'Cancel', variant: 'outlined' },
+      acceptProps: { text: 'Confirm', color: 'primary', variant: 'flat' },
+
+      onAccept: null,
+      onReject: null,
+
+      resolvePromise: null,
+      rejectPromise: null,
+    };
+  },
+  methods: {
+    show({
+      title = 'Confirmation',
+      message = 'Are you sure you want to proceed?',
+      cancelProps = {},
+      acceptProps = {},
+      dialogProps = {},
+      onAccept = null,
+      onReject = null,
+    } = {}) {
+      Object.assign(this, {
+        title,
+        message,
+        dialogProps: { ...dialogProps },
+        cancelProps: { text: 'Cancel', variant: 'outlined', ...cancelProps },
+        acceptProps: { text: 'Confirm', color: 'primary', variant: 'flat', ...acceptProps },
+        onAccept,
+        onReject,
+        loading: false,
+        open: true,
+      });
+
+      return new Promise((resolve, rejectPromise) => {
+        this.resolvePromise = resolve;
+        this.rejectPromise = rejectPromise;
+      });
+    },
+
+    async cancel() {
+      await this.onReject?.();
+      this.open = false;
+      this.resolvePromise?.(false);
+      this.cleanup();
+    },
+
+    async ok() {
+      this.loading = true;
+      
+      try {
+        await this.onAccept?.(); // if this throws, code below won't run
+        this.open = false;
+        this.resolvePromise?.(true);
+        this.cleanup();
+      } catch (error) {
+        console.log('Something failed when confirming dialog', error)
+      } finally {
+        this.loading = false;
+      }
+    },
+
+    cleanup() {
+      setTimeout(() => {
+        this.loading = false;
+        this.onAccept = null;
+        this.onReject = null;
+        this.resolvePromise = null;
+        this.rejectPromise = null;
+        this.cancelProps = { text: 'Cancel', variant: 'outlined' };
+        this.acceptProps = { text: 'Confirm', color: 'primary', variant: 'flat' };
+        this.dialogProps = {};
+      }, 300)
+    },
+  },
+  template: `
+    <v-dialog v-model="open" v-bind="{ persistent: loading, ...dialogProps}">
+      <v-card rounded="12">
+        <v-card-title class="px-7 pt-6 pb-0">
+          <slot name="title">{{ title }}</slot>
+        </v-card-title>
+
+        <v-card-text class="px-7 pb-7 pt-2 text-pre-wrap">
+          <slot>{{ message }}</slot>
+        </v-card-text>
+
+        <v-card-actions class="justify-end pb-7 px-7 pt-0">
+          <slot name="actions">
+            <v-btn
+              :disabled="loading"
+              @click="cancel"
+              v-bind="cancelProps"
+            >
+              {{ cancelProps.text }}
+            </v-btn>
+
+            <v-btn
+              :loading="loading"
+              @click="ok"
+              v-bind="acceptProps"
+            >
+              {{ acceptProps.text }}
+            </v-btn>
+          </slot>
+        </v-card-actions>
+      </v-card>
+    </v-dialog>
+  `,
+});
diff --git a/enferno/static/js/components/Toast.js b/enferno/static/js/components/Toast.js
new file mode 100644
index 000000000..e88a4a8d5
--- /dev/null
+++ b/enferno/static/js/components/Toast.js
@@ -0,0 +1,65 @@
+const Toast = Vue.defineComponent({
+  data() {
+    return {
+      open: false,
+      message: '',
+      hideActions: false,
+      iconProps: null,
+      snackbarProps: {
+        multiLine: true,
+        variant: 'flat',
+        rounded: 'lg',
+        minHeight: 38,
+      },
+    };
+  },
+  methods: {
+    show({
+      message = '',
+      hideActions = false,
+      iconProps,
+      snackbarProps = {},
+    } = {}) {
+      Object.assign(this, {
+        message,
+        hideActions,
+        iconProps,
+        snackbarProps: {
+          multiLine: true,
+          variant: 'flat',
+          rounded: 'lg',
+          minHeight: 38, ...snackbarProps
+        },
+        open: true,
+      });
+    },
+
+    async close() {
+      this.open = false;
+      this.cleanup();
+    },
+
+    cleanup() {
+      setTimeout(() => {
+        this.message = '';
+        this.hideActions = false;
+        this.iconProps = null;
+        this.snackbarProps = {
+          multiLine: true,
+          variant: 'flat',
+          rounded: 'lg',
+          minHeight: 38,
+        };
+      }, 300)
+    },
+  },
+  template: `
+    <v-snackbar v-model="open" multi-line v-bind="snackbarProps">
+      <v-icon v-if="iconProps" class="mr-2" v-bind="iconProps"></v-icon>
+      <span v-html="message"></span>
+      <template v-if="!hideActions" #actions>
+          <v-btn icon="mdi-close" variant="text" @click="close"></v-btn>
+      </template>
+    </v-snackbar>
+  `,
+});
diff --git a/enferno/static/js/mixins/global-mixin.js b/enferno/static/js/mixins/global-mixin.js
index 54625c7a6..65bcfc06c 100644
--- a/enferno/static/js/mixins/global-mixin.js
+++ b/enferno/static/js/mixins/global-mixin.js
@@ -1,5 +1,9 @@
 const globalMixin = {
   mixins: [reauthMixin, notificationMixin],
+  components: {
+    'ConfirmDialog': ConfirmDialog,
+    'Toast': Toast,
+  },
   data: () => ({
     snackbar: false,
     snackMessage: '',
@@ -147,9 +151,15 @@ const globalMixin = {
       this.settings.language = l
       this.saveSettings();
       setTimeout(() => {
-          window.location.reload();
+        window.location.reload();
       }, 1000);
     },
+    $confirm(options) {
+      return this.$root.$refs.confirmDialog.show(options)
+    },
+    $toast(options) {
+      return this.$root.$refs.toast.show(options)
+    },
     serverErrorPropsForField(serverErrors, key) {
       return {
         "error-messages": serverErrors?.[key],
diff --git a/enferno/templates/layout.html b/enferno/templates/layout.html
index 9cac3d828..29407d433 100644
--- a/enferno/templates/layout.html
+++ b/enferno/templates/layout.html
@@ -65,19 +65,18 @@
             {% endblock %}
 
         <v-snackbar v-model="snackbar" multi-line>
-
                 <span v-html="snackMessage"></span>
-
             <template #actions>
                 <v-btn icon="mdi-close" variant="text" @click="snackbar = false"></v-btn>
-
             </template>
         </v-snackbar>
 
         {% include 'login_dialog.html' %}
         {% include 'reauth_dialog.html' %}
     </v-app>
-
+    
+    <confirm-dialog ref="confirmDialog"></confirm-dialog>
+    <toast ref="toast"></toast>
 </div>
 
 {% block outside %}
@@ -130,6 +129,8 @@
     {%  include 'admin/jsapi.jinja2' %}
 </script>
 <script src="/static/js/components/NotificationsList.js"></script>
+<script src="/static/js/components/ConfirmDialog.js"></script>
+<script src="/static/js/components/Toast.js"></script>
 <script src="/static/js/common/config.js"></script>
 <script src="/static/js/mixins/reauth-mixin.js"></script>
 <script src="/static/js/mixins/notification-mixin.js"></script>

From 1fc275f6dcf28e4c554eb7ac9567c6c81e2e4e35 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 11:03:07 -0600
Subject: [PATCH 021/180] refactor password reset to use new global confirm
 dialog

---
 .../templates/admin/partials/user_drawer.html |  2 +-
 enferno/admin/templates/admin/users.html      | 40 +++++--------------
 2 files changed, 12 insertions(+), 30 deletions(-)

diff --git a/enferno/admin/templates/admin/partials/user_drawer.html b/enferno/admin/templates/admin/partials/user_drawer.html
index 29cee9fa3..30d90bc93 100644
--- a/enferno/admin/templates/admin/partials/user_drawer.html
+++ b/enferno/admin/templates/admin/partials/user_drawer.html
@@ -11,7 +11,7 @@
             :closable="true"
             @close="userDrawer=false"
             @edit="editItem($event)"
-            @reset-password="openForceResetDialog($event)"
+            @reset-password="openForcePasswordResetDialog($event)"
             @revoke2fa="revoke2fa($event)"
             @logout-all="logoutAllUserSessions($event)"
             @change-password="openChangePasswordDialog($event)"
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 613b6a2d0..f6ce728c2 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -214,7 +214,7 @@
                                         <div v-bind="props" class="d-inline-block">
                                             <v-btn
                                                 :disabled="item.force_reset != null"
-                                                @click.stop="openForceResetDialog(item)"
+                                                @click.stop="openForcePasswordResetDialog(item)"
                                                 variant="plain"
                                                 size="small"
                                                 icon="mdi-lock-reset">
@@ -470,22 +470,6 @@
                             </v-card-actions>
                         </v-card>
                     </v-dialog>
-
-                    <v-dialog v-model="forceResetDialog" persistent max-width="780">
-                        <v-card rounded="lg">
-                            <v-form ref="forceResetForm" v-model="valid">
-                                <v-card-text class="pa-7">
-                                    <div class="text-h6 mb-4">${translations.youreAboutToForceAPasswordResetForUser_(editedItem.name)}</div>
-                                    <div class="mb-6">{{ _('After this action, user will be required to set a new password at their next sign-in. This will not affect any user data or settings.') }}</div>
-                                    <div class="mb-3">{{ _('Do you want to continue?') }}</div>
-                                </v-card-text>
-                            </v-form>
-                            <v-card-actions class="px-7 pb-7 pt-0">
-                                <v-btn @click="closeForceResetDialog()" variant="outlined">{{ _('Cancel') }}</v-btn>
-                                <v-btn @click="forcePasswordReset(editedItem)" :loading="saving" color="error" variant="flat">{{ _('Force Password Reset') }}</v-btn>
-                            </v-card-actions>
-                        </v-card>
-                    </v-dialog>
                 </v-card-text>
             </v-card>
 
@@ -549,7 +533,6 @@
                 adminRoleId: 1,
                 changePasswordDialog: false,
                 askUserToChangePassword: true,
-                forceResetDialog: false,
 
                 filters: {
                     accountStatus: null,
@@ -716,7 +699,6 @@
                     ).then(res => {
                         this.showSnack(res.data);
                         this.refresh();
-                        this.closeForceResetDialog();
                         if (this.userDrawer) this.refreshUser(item.id);
                     }).catch(err => {
                         console.error(err?.response?.data);
@@ -836,9 +818,16 @@
                     this.askUserToChangePassword = true;
                 },
 
-                openForceResetDialog(item) {
-                    this.editedItem = { ...(item || {}), password: '' };
-                    this.forceResetDialog = true;
+                openForcePasswordResetDialog(item) {
+                    this.$root.$confirm({
+                        title: translations.youreAboutToForceAPasswordResetForUser_(item.name),
+                        message: "{{ _('After this action, user will be required to set a new password at their next sign-in. This will not affect any user data or settings.') }}\r\n\r\n{{ _('Do you want to continue?') }}",
+                        acceptProps: { text: "{{ _('Force Password Reset') }}", color: 'error' },
+                        dialogProps: { width: 780 },
+                        onAccept: () => {
+                            this.forcePasswordReset(item);
+                        },
+                    });
                 },
 
                 createItem() {
@@ -880,13 +869,6 @@
                     }, 300);
                 },
 
-                closeForceResetDialog() {
-                    this.forceResetDialog = false;
-                    setTimeout(() => {
-                        this.editedItem = Object.assign({}, this.defaultItem);
-                    }, 300);
-                },
-
                 save(options) {
                     const handleError = (err) => {
                         const usernameAlreadyTaken = err?.response?.status === 409

From 6a7bf953d6d59647aa11d0eafed12147c796b34e Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 11:10:11 -0600
Subject: [PATCH 022/180] add confirmation dialog for global password reset

---
 enferno/admin/templates/admin/users.html | 42 +++++++++++-------------
 1 file changed, 20 insertions(+), 22 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index f6ce728c2..3ddca7e86 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -36,7 +36,7 @@
 
                                     <div class="d-flex align-center ga-3">
                                         <v-btn
-                                            @click.once="forceGlobalReset"
+                                            @click.once="openForcePasswordResetAllDialog()"
                                             color="error"
                                             variant="elevated"
                                             prepend-icon="mdi-lock-reset"
@@ -707,27 +707,6 @@
                     })
                 },
 
-                forceGlobalReset() {
-                    if (confirm("{{_('Are you sure you want to force a password reset for all users?')}}")) {
-                        this.loading = true;
-                        api.post('/admin/api/user/force-reset-all').then(
-                            res => {
-
-                                this.showSnack(res.data);
-                            }
-                        ).catch(
-                            err => {
-                                console.error(err?.response?.data);
-                            }
-                        ).finally(
-                            () => {
-                                this.loading = false;
-                            }
-                        )
-
-                    }
-                },
-
                 logoutAllUserSessions(userId) {
                     if (window.confirm(this.translations.logoutConfirmation_)) {
                         axios
@@ -830,6 +809,25 @@
                     });
                 },
 
+                openForcePasswordResetAllDialog() {
+                    this.$root.$confirm({
+                        title: "{{ _('You’re about to force a password reset for all users') }}",
+                        message: "{{ _('After this action, all users will be required to set a new password at their next sign-in. This will not affect any user data or settings.') }}\r\n\r\n{{ _('Do you want to continue?') }}",
+                        acceptProps: { text: "{{ _('Force All Password Resets') }}", color: 'error' },
+                        dialogProps: { width: 780 },
+                        onAccept: () => {
+                            this.loading = true;
+                            api.post('/admin/api/user/force-reset-all').then(res => {
+                                this.showSnack(res.data);
+                            }).catch(err => {
+                                console.error(err?.response?.data);
+                            }).finally(() => {
+                                this.loading = false;
+                            })
+                        },
+                    });
+                },
+
                 createItem() {
                     this.editedItem = {...this.defaultItem};
                     this.dialog = true;

From 0a93b8a5e0d45635fb87c85a59fa35950c561b7d Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 11:35:25 -0600
Subject: [PATCH 023/180] add confirmations dialog to logout user sessions

---
 enferno/admin/templates/admin/jsapi.jinja2    |  4 ++
 .../templates/admin/partials/user_drawer.html |  2 +-
 enferno/admin/templates/admin/users.html      | 32 +++++++-----
 enferno/static/js/components/UserCard.js      | 49 ++++++++++---------
 4 files changed, 52 insertions(+), 35 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index fca598006..bbb1b6876 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -37,6 +37,10 @@ googleOauth_: "{{ _('Google OAuth') }}",
 editUser_: "{{ _('Edit User') }}",
 userRole_: "{{ _('User Role') }}",
 twoFactorAuthentication_: "{{ _('Two-Factor Authentication') }}",
+youreAboutToEndThisSession_: "{{ _('You\'re about to end this session') }}",
+afterThisActionTheUserWillBeSignedOut_: "{{ _('After this action, the user will be signed out from this device. This will not affect other active sessions, user data, or settings.') }}",
+doYouWantToContinue_: "{{ _('Do you want to continue?') }}",
+endSession_: "{{ _('End Session') }}",
 
 cancel_ : "{{ _('Cancel') }}",
 titleOrTitleArRequired_ : "{{ _('Title or Title (Ar) is required') }}",
diff --git a/enferno/admin/templates/admin/partials/user_drawer.html b/enferno/admin/templates/admin/partials/user_drawer.html
index 30d90bc93..bfe2b69ce 100644
--- a/enferno/admin/templates/admin/partials/user_drawer.html
+++ b/enferno/admin/templates/admin/partials/user_drawer.html
@@ -13,7 +13,7 @@
             @edit="editItem($event)"
             @reset-password="openForcePasswordResetDialog($event)"
             @revoke2fa="revoke2fa($event)"
-            @logout-all="logoutAllUserSessions($event)"
+            @logout-all="openLogoutAllUserSessionsDialog($event)"
             @change-password="openChangePasswordDialog($event)"
             :user="user"
         ></user-card>
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 3ddca7e86..a10e89e0c 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -708,17 +708,27 @@
                 },
 
                 logoutAllUserSessions(userId) {
-                    if (window.confirm(this.translations.logoutConfirmation_)) {
-                        axios
-                            .delete(`/admin/api/user/${userId}/sessions/logout`)
-                            .then((response) => {
-                                console.log('All sessions logged out successfully for user ID:', userId);
-                                this.$root.showSnack(this.translations.allSessionsLoggedOut_);
-                            })
-                            .catch((err) => {
-                                console.error('Error logging out all sessions for user ID:', userId, err);
-                            });
-                    }
+                    axios
+                        .delete(`/admin/api/user/${userId}/sessions/logout`)
+                        .then((response) => {
+                            console.log('All sessions logged out successfully for user ID:', userId);
+                            this.$root.showSnack(this.translations.allSessionsLoggedOut_);
+                        })
+                        .catch((err) => {
+                            console.error('Error logging out all sessions for user ID:', userId, err);
+                        });
+                },
+
+                openLogoutAllUserSessionsDialog(userId) {
+                    this.$root.$confirm({
+                        title: "{{ _('You’re about to log out all active sessions for this user') }}",
+                        message: "{{ _('After this action, the user will be signed out from all devices and will need to log in again. This will not affect their data or settings.') }}\r\n\r\n{{ _('Do you want to continue?') }}",
+                        acceptProps: { text: "{{ _('Log Out All Sessions') }}", color: 'error' },
+                        dialogProps: { width: 780 },
+                        onAccept: () => {
+                            this.logoutAllUserSessions(userId);
+                        },
+                    });
                 },
 
                 checkUsername:
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 59798677a..63789e14a 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -77,28 +77,31 @@ const UserCard = Vue.defineComponent({
         });
     },
 
-    logoutSession(id) {
-      if (window.confirm(this.translations.logoutSessionConfirmation_)) {
-        axios
-          .delete('/admin/api/session/logout', {
-            data: {
-              sessid: id,
-            },
-          })
-          .then((response) => {
-            console.log('Logged out session');
-            if (response.data.redirect) {
-              // Perform the redirection to the root path
-              window.location.href = '/';
-            } else {
-              this.resetSessions();
-              this.fetchSessions();
-            }
-          })
-          .catch((err) => {
-            console.error('Error logging out session', err);
-          });
-      }
+    openLogoutSessionDialog(id) {
+      this.$root.$confirm({
+        title: translations.youreAboutToEndThisSession_,
+        message: `${translations.afterThisActionTheUserWillBeSignedOut_}\r\n\r\n${translations.doYouWantToContinue_}`,
+        acceptProps: { text: translations.endSession_, color: 'error' },
+        dialogProps: { width: 780 },
+        onAccept: () => {
+          axios
+            .delete('/admin/api/session/logout', {
+              data: { sessid: id },
+            })
+            .then((response) => {
+              console.log('Logged out session');
+              if (response.data.redirect) {
+                window.location.href = '/';
+              } else {
+                this.resetSessions();
+                this.fetchSessions();
+              }
+            })
+            .catch((err) => {
+              console.error('Error logging out session', err);
+            });
+        },
+      });
     },
   },
 
@@ -358,7 +361,7 @@ const UserCard = Vue.defineComponent({
                   <v-btn
                     icon="mdi-logout"
                     variant="plain" v-if="session.details?._fresh"
-                    @click.once="logoutSession(session.id)" :disabled="!session.is_active"
+                    @click.once="openLogoutSessionDialog(session.id)" :disabled="!session.is_active"
                     color="error"
                   ></v-btn>
                 </td>

From fcfaa92db3b6d1941d391251e098defc118a0ff0 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 11:41:33 -0600
Subject: [PATCH 024/180] fix card rounded edges

---
 enferno/admin/templates/admin/users.html | 42 ++++++++++++------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index a10e89e0c..1fa7aaa24 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -298,27 +298,27 @@
                         <template v-slot:no-data></template>
                     </v-data-table-server>
                     <v-dialog v-model="dialog" max-width="1200px">
-                        <v-toolbar :title="formTitle">
-                            <template #append>
-                                <div class="d-flex align-center ga-2 mr-2">
-                                    <v-btn @click="close" variant="outlined">
-                                        {{ _('Cancel') }}
-                                    </v-btn>
-                                    <v-btn
-                                        @click="validateFormAndSave"
-                                        :prepend-icon="isNewUser ? 'mdi-plus' : 'mdi-check'"
-                                        color="primary"
-                                        variant="flat"
-                                        :text="isNewUser ? '{{ _('Add User') }}' : '{{ _('Save Changes') }}'"
-                                        :loading="saving"
-                                    ></v-btn>
-                                    <v-btn icon density="comfortable" @click="close">
-                                        <v-icon>mdi-close</v-icon>
-                                    </v-btn>
-                                </div>
-                            </template>
-                        </v-toolbar>
-                        <v-card tile elevation="0">
+                        <v-card rounded="lg">
+                            <v-toolbar :title="formTitle">
+                                <template #append>
+                                    <div class="d-flex align-center ga-2 mr-2">
+                                        <v-btn @click="close" variant="outlined">
+                                            {{ _('Cancel') }}
+                                        </v-btn>
+                                        <v-btn
+                                            @click="validateFormAndSave"
+                                            :prepend-icon="isNewUser ? 'mdi-plus' : 'mdi-check'"
+                                            color="primary"
+                                            variant="flat"
+                                            :text="isNewUser ? '{{ _('Add User') }}' : '{{ _('Save Changes') }}'"
+                                            :loading="saving"
+                                        ></v-btn>
+                                        <v-btn icon density="comfortable" @click="close">
+                                            <v-icon>mdi-close</v-icon>
+                                        </v-btn>
+                                    </div>
+                                </template>
+                            </v-toolbar>
                             <v-divider></v-divider>
                             <v-form ref="form" v-model="valid">
                                 <v-card-text>

From e5b700a86a292c6013a1063d0b3668e97ba48570 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 11:50:12 -0600
Subject: [PATCH 025/180] hide active account switch if user edits it's own
 account

---
 enferno/admin/templates/admin/users.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 1fa7aaa24..526b21a92 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -383,7 +383,7 @@
                                                 </v-text-field>
                                             </v-col>
                                         </v-row>
-                                        <v-switch color="blue" class="text-medium-emphasis" label="{{ _('Account is Active') }}"
+                                        <v-switch v-if="editedItem.id !== {{ current_user.id }}" color="blue" class="text-medium-emphasis" label="{{ _('Account is Active') }}"
                                                 v-model="editedItem.active"></v-switch>
 
                                         <div class="mb-3 text-body-1">{{ _('User Roles') }}</div>

From 3c157b57ddf44dcf2b80259050c2ddc58e3bdc83 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 11:57:27 -0600
Subject: [PATCH 026/180] reuse existing function

---
 enferno/admin/templates/admin/users.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 526b21a92..f72043322 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -931,7 +931,7 @@
                         this.showSnack(response.data);
 
                         if (this.askUserToChangePassword && this.editedItem?.force_reset === null) {
-                            await api.post('/admin/api/user/force-reset', { item: this.editedItem });
+                            await this.forcePasswordReset({ item: this.editedItem });
                         }
 
                         await this.refresh();

From 9ede225204031e5b49fb29d2d62e699cacdf958c Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 12:12:25 -0600
Subject: [PATCH 027/180] if no role assigned show view only text

---
 enferno/admin/templates/admin/jsapi.jinja2 |  1 +
 enferno/static/js/components/UserCard.js   | 29 +++++++++++++++-------
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index bbb1b6876..91bcd25a9 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -41,6 +41,7 @@ youreAboutToEndThisSession_: "{{ _('You\'re about to end this session') }}",
 afterThisActionTheUserWillBeSignedOut_: "{{ _('After this action, the user will be signed out from this device. This will not affect other active sessions, user data, or settings.') }}",
 doYouWantToContinue_: "{{ _('Do you want to continue?') }}",
 endSession_: "{{ _('End Session') }}",
+viewOnly_: "{{ _('View Only') }}",
 
 cancel_ : "{{ _('Cancel') }}",
 titleOrTitleArRequired_ : "{{ _('Title or Title (Ar) is required') }}",
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 63789e14a..a90990015 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -240,15 +240,26 @@ const UserCard = Vue.defineComponent({
               <v-col cols="12" md="6">
                 <div class="mb-3 text-body-1">{{ translations.userRole_ }}</div>
                 <div class="d-flex flex-wrap ga-3">
-                  <toggle-button
-                    v-for="(role, index) in user.roles"
-                    :key="index"
-                    read-only
-                    hide-icon
-                    :model-value="true"
-                  >
-                    {{ role.name }}
-                  </toggle-button>
+                  <template v-if="user.roles.length">
+                    <toggle-button
+                      v-for="(role, index) in user.roles"
+                      :key="index"
+                      read-only
+                      hide-icon
+                      :model-value="true"
+                    >
+                      {{ role.name }}
+                    </toggle-button>
+                  </template>
+                  <template v-else>
+                    <toggle-button
+                      read-only
+                      hide-icon
+                      :model-value="true"
+                    >
+                      {{ translations.viewOnly_ }}
+                    </toggle-button>
+                  </template>
                 </div>
               </v-col>
               <v-col cols="12" md="6">

From 3ca85ebf1e24c69130a78cad6a94e2e3a93d98ae Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 12:37:08 -0600
Subject: [PATCH 028/180] update revoke2fa to use dialog confirmation

---
 .../templates/admin/partials/user_drawer.html |  2 +-
 enferno/admin/templates/admin/users.html      | 42 +++++++++++--------
 2 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/enferno/admin/templates/admin/partials/user_drawer.html b/enferno/admin/templates/admin/partials/user_drawer.html
index bfe2b69ce..0e23cf7f8 100644
--- a/enferno/admin/templates/admin/partials/user_drawer.html
+++ b/enferno/admin/templates/admin/partials/user_drawer.html
@@ -12,7 +12,7 @@
             @close="userDrawer=false"
             @edit="editItem($event)"
             @reset-password="openForcePasswordResetDialog($event)"
-            @revoke2fa="revoke2fa($event)"
+            @revoke2fa="openRevoke2FADialog($event)"
             @logout-all="openLogoutAllUserSessionsDialog($event)"
             @change-password="openChangePasswordDialog($event)"
             :user="user"
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index f72043322..78ed9e6d6 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -229,7 +229,7 @@
                                         :text="'{{ _('Revoke 2FA') }}'">
                                     <template #activator="{props}">
                                         <v-btn
-                                                @click.stop="revoke2fa(item.id)"
+                                                @click.stop="openRevoke2FADialog(item.id)"
                                                 variant="plain"
                                                 v-bind="props"
                                                 size="small"
@@ -430,7 +430,7 @@
                                     </v-container>
                                 </v-card-text>
                                 <v-card-text class="text-center">
-                                    <v-btn v-if="editedItem.two_factor_devices?.length"  prepend-icon="mdi-lock-remove" class="mx-2" @click="revoke2fa(editedItem.id)">
+                                    <v-btn v-if="editedItem.two_factor_devices?.length"  prepend-icon="mdi-lock-remove" class="mx-2" @click="openRevoke2FADialog(editedItem.id)">
                                         {{ _('Revoke 2FA') }}
                                     </v-btn>
                                 </v-card-text>
@@ -664,23 +664,29 @@
                     })
                 },
 
-                revoke2fa(userId) {
-                    if (confirm(`{{ _('Are you sure you want to revoke 2FA for this user?') }}`)) {
-                        api.delete(`/admin/api/user/revoke_2fa`, {
-                            params: {user_id: userId}
-                        })
-                            .then(response => {
-                                this.showSnack(response.data);
-                                this.refresh();
-                                this.dialog = false;
-
-                                if (this.userDrawer) this.refreshUser(userId);
+                openRevoke2FADialog(userId) {
+                    this.$root.$confirm({
+                        title: "{{ _('You’re about to revoke two-factor authentication for this user') }}",
+                        message: "{{ _('After this action, the user’s registered 2FA devices will be removed. They will no longer be required to use two-factor authentication until it is reconfigured.') }}\r\n\r\n{{ _('Do you want to continue?') }}",
+                        acceptProps: { text: "{{ _('Revoke 2FA') }}", color: 'error' },
+                        dialogProps: { width: 780 },
+                        onAccept: () => {
+                            api.delete(`/admin/api/user/revoke_2fa`, {
+                                params: {user_id: userId}
                             })
-                            .catch(err => {
-                                console.error(err);
-                                this.showSnack(this.parseValidationError(err?.response?.data));
-                            });
-                    }
+                                .then(response => {
+                                    this.showSnack(response.data);
+                                    this.refresh();
+                                    this.dialog = false;
+
+                                    if (this.userDrawer) this.refreshUser(userId);
+                                })
+                                .catch(err => {
+                                    console.error(err);
+                                    this.showSnack(this.parseValidationError(err?.response?.data));
+                                });
+                        },
+                    });
                 },
 
 

From b0bd0a9e55e26bba4fa4088fa8d29d4c1d74d32c Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 13:24:15 -0600
Subject: [PATCH 029/180] disable toggle button if user is admin

---
 enferno/admin/templates/admin/users.html     | 16 ++++++++--------
 enferno/static/js/components/ToggleButton.js |  3 +--
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 78ed9e6d6..096758a51 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -399,31 +399,31 @@
                                         </div>
                                         <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default)') }}</span></div>
                                         <div class="d-flex flex-wrap ga-3 mb-7">
-                                            <toggle-button v-model="editedItem.view_usernames">
+                                            <toggle-button v-model="editedItem.view_usernames" :read-only="editedUserHasAdminRole">
                                                 {{ _('Can View Usernames') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.view_full_history">
+                                            <toggle-button v-model="editedItem.view_full_history" :read-only="editedUserHasAdminRole">
                                                 {{ _('Can View Full History') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.view_simple_history">
+                                            <toggle-button v-model="editedItem.view_simple_history" :read-only="editedUserHasAdminRole">
                                                 {{ _('Can View Simple History') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_self_assign">
+                                            <toggle-button v-model="editedItem.can_self_assign" :read-only="editedUserHasAdminRole">
                                                 {{ _('Can Self-Assign') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_edit_locations">
+                                            <toggle-button v-model="editedItem.can_edit_locations" :read-only="editedUserHasAdminRole">
                                                 {{ _('Can Edit Locations') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_export">
+                                            <toggle-button v-model="editedItem.can_export" :read-only="editedUserHasAdminRole">
                                                 {{ _('Can Request Exports') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_import_web">
+                                            <toggle-button v-model="editedItem.can_import_web" :read-only="editedUserHasAdminRole">
                                                 {{ _('Can Import From Web') }}
                                             </toggle-button>
                                         </div>
@@ -767,7 +767,7 @@
                 },
 
                 checkRoles() {
-                    this.isAdmin = this.editedItem.roles?.some(r => r.name === "Admin") || false;
+                    this.isAdmin = this.editedUserHasAdminRole;
                     if (this.isAdmin) {
                         this.editedItem.view_usernames = true;
                         this.editedItem.view_simple_history = true;
diff --git a/enferno/static/js/components/ToggleButton.js b/enferno/static/js/components/ToggleButton.js
index 67ae10b8c..3251bd7eb 100644
--- a/enferno/static/js/components/ToggleButton.js
+++ b/enferno/static/js/components/ToggleButton.js
@@ -25,8 +25,7 @@ const ToggleButton = Vue.defineComponent({
       :color="modelValue ? activeColor : undefined"
       @click="$emit('update:modelValue', !modelValue)"
       :class="['font-weight-medium', { 'text-medium-emphasis cursor-default': readOnly }]"
-      read-only
-      :ripple="!readOnly"
+      :readonly="readOnly"
     >
       <template v-if="!hideIcon">
         <v-icon v-if="modelValue" start size="small">mdi-check</v-icon>

From 7039b85a7df73ef817f3212fe8731fbad1f30a9d Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 13:44:16 -0600
Subject: [PATCH 030/180] tweak user preview table columns

---
 enferno/admin/templates/admin/jsapi.jinja2 | 2 ++
 enferno/static/js/components/UserCard.js   | 8 ++++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 91bcd25a9..8ef825761 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -436,6 +436,8 @@ canSelfAssign_: "{{ _('Can Self Assign') }}",
 cannotSelfAssign_: "{{ _('Cannot Self Assign') }}",
 userSessions_: "{{ _('User Sessions') }}",
 session_: "{{ _('Session') }}",
+browser_: "{{ _('Browser') }}",
+device_: "{{ _('Device') }}",
 ip_: "{{ _('IP') }}",
 userAgent_: "{{ _('User Agent') }}",
 started_: "{{ _('Started') }}",
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index a90990015..879eaed5a 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -331,8 +331,8 @@ const UserCard = Vue.defineComponent({
               <thead>
               <tr>
                 <th class="text-left">{{ translations.session_ }}</th>
-                <th class="text-left">{{ translations.ip_ }}</th>
-                <th class="text-left">{{ translations.userAgent_ }}</th>
+                <th class="text-left">{{ translations.device_ }}</th>
+                <th class="text-left">{{ translations.browser_ }}</th>
                 <th class="text-left">{{ translations.started_ }}</th>
                 <th class="text-left">{{ translations.logOffThisDevice_ }}</th>
               </tr>
@@ -362,10 +362,10 @@ const UserCard = Vue.defineComponent({
 
                 </td>
                 <td>
-                  <v-chip label>{{ session.ip_address }}</v-chip>
+                  {{ session.meta.os }}
                 </td>
                 <td class="text-caption">
-                  {{ session.meta.device }}
+                  {{ session.meta.browser }}
                 </td>
                 <td class="text-caption">{{ $root.formatDate(session.created_at, $root.dateFormats.standardDatetime, $root.dateOptions.local) }}</td>
                 <td>

From ef1f775199f3a3d4e8e48433c343a5696409fced Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 14:31:41 -0600
Subject: [PATCH 031/180] adjustment to translations

---
 enferno/admin/templates/admin/actors.html     |  2 +-
 enferno/admin/templates/admin/bulletins.html  |  2 +-
 enferno/admin/templates/admin/incidents.html  |  2 +-
 enferno/admin/templates/admin/jsapi.jinja2    |  5 ++-
 enferno/admin/templates/admin/locations.html  |  2 +-
 enferno/admin/templates/admin/users.html      | 41 ++++++++++---------
 enferno/static/js/components/ConfirmDialog.js | 17 ++++----
 enferno/static/js/components/GeoLocations.js  |  2 +-
 .../static/js/components/ShortActorDialog.js  |  2 +-
 enferno/static/js/mixins/relations-mixin.js   |  2 +-
 10 files changed, 42 insertions(+), 35 deletions(-)

diff --git a/enferno/admin/templates/admin/actors.html b/enferno/admin/templates/admin/actors.html
index e59d7be4f..837bb68eb 100644
--- a/enferno/admin/templates/admin/actors.html
+++ b/enferno/admin/templates/admin/actors.html
@@ -1513,7 +1513,7 @@
 
 
                 confirmClose() {
-                    if (confirm(translations.confirm_)) {
+                    if (confirm(translations.areYouSure_)) {
                         this.close();
                     }
                 },
diff --git a/enferno/admin/templates/admin/bulletins.html b/enferno/admin/templates/admin/bulletins.html
index 49f4ad157..42d334d5b 100644
--- a/enferno/admin/templates/admin/bulletins.html
+++ b/enferno/admin/templates/admin/bulletins.html
@@ -1556,7 +1556,7 @@
                     },
 
                     confirmClose() {
-                        if (confirm(translations.confirm_)) {
+                        if (confirm(translations.areYouSure_)) {
                             this.close();
                         }
                     },
diff --git a/enferno/admin/templates/admin/incidents.html b/enferno/admin/templates/admin/incidents.html
index 64d130baa..dc1ee1bfa 100644
--- a/enferno/admin/templates/admin/incidents.html
+++ b/enferno/admin/templates/admin/incidents.html
@@ -1389,7 +1389,7 @@
                 },
 
                 confirmClose() {
-                    if (confirm(translations.confirm_)) {
+                    if (confirm(translations.areYouSure_)) {
                         this.close();
                     }
                 },
diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 8ef825761..27ca49332 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -188,7 +188,10 @@ locationType_: "{{ _('Location Type') }}",
 adminLevel_: "{{ _('Admin Level') }}",
 country_: "{{ _('Country') }}",
 estimated_: "{{ _('Estimated') }}",
-confirm_: "{{ _('Are you sure?')}}",
+confirm_: "{{ _('Confirm')}}",
+areYouSure_: "{{ _('Are you sure?')}}",
+confirmation_: "{{ _('Confirmation')}}",
+areYouSureYouWantToProceed_: "{{ _('Are you sure you want to proceed?')}}",
 markAsRead_: "{{ _('Mark as read')}}",
 inApp_: "{{ _('In-app')}}",
 
diff --git a/enferno/admin/templates/admin/locations.html b/enferno/admin/templates/admin/locations.html
index e6d6029fb..114df5781 100644
--- a/enferno/admin/templates/admin/locations.html
+++ b/enferno/admin/templates/admin/locations.html
@@ -466,7 +466,7 @@
                 },
 
                 confirmClose() {
-                    if (confirm(translations.confirm_)) {
+                    if (confirm(translations.areYouSure_)) {
                         this.dialog = false;
                         setTimeout(() => {
                             this.editedItem = Object.assign({}, this.defaultItem);
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 096758a51..4a4e67eba 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -783,28 +783,31 @@
 
                 refresh(options) {
                     this.options = options || { ...this.options, page: 1 };
-                    this.loading = true;
-
-                    const params = new URLSearchParams({
-                        page: this.options.page,
-                        per_page: this.options.itemsPerPage,
-                    });
 
-                    if (this.options.q) {
-                        params.append('q', this.options.q);
+                    if (this.advSearchOpen) {
+                        this.advSearchOpen = false;
                     }
 
-                    api.get(`/admin/api/users/?${params.toString()}`)
-                        .then(res => {
-                            this.items = res.data.items;
-                            this.itemsLength = res.data.total;
-                        })
-                        .catch(err => {
-                            console.error(err?.response?.data);
-                        })
-                        .finally(() => {
-                            this.loading = false;
-                        });
+                    this.loading = true;
+
+                    api.post(`/admin/api/users/`, {
+                        q: {
+                            ...(this.q || {}),
+                            ...(this.filters || {}),
+                        },
+                        page: this.options?.page ?? 1,
+                        per_page: this.options?.itemsPerPage ?? 10,
+                    })
+                    .then(res => {
+                        this.items = res.data.items;
+                        this.itemsLength = res.data.total;
+                    })
+                    .catch(err => {
+                        console.error(err?.response?.data || err);
+                    })
+                    .finally(() => {
+                        this.loading = false;
+                    });
                 },
 
                 openChangePasswordDialog(item) {
diff --git a/enferno/static/js/components/ConfirmDialog.js b/enferno/static/js/components/ConfirmDialog.js
index 41775d7a8..a0ad1d7c9 100644
--- a/enferno/static/js/components/ConfirmDialog.js
+++ b/enferno/static/js/components/ConfirmDialog.js
@@ -1,14 +1,15 @@
 const ConfirmDialog = Vue.defineComponent({
   data() {
     return {
+      translations: window.translations,
       open: false,
       title: '',
       message: '',
       loading: false,
       dialogProps: {},
 
-      cancelProps: { text: 'Cancel', variant: 'outlined' },
-      acceptProps: { text: 'Confirm', color: 'primary', variant: 'flat' },
+      cancelProps: { text: translations.cancel_, variant: 'outlined' },
+      acceptProps: { text: translations.confirm_, color: 'primary', variant: 'flat' },
 
       onAccept: null,
       onReject: null,
@@ -19,8 +20,8 @@ const ConfirmDialog = Vue.defineComponent({
   },
   methods: {
     show({
-      title = 'Confirmation',
-      message = 'Are you sure you want to proceed?',
+      title = translations.confirmation_,
+      message = translations.areYouSureYouWantToProceed_,
       cancelProps = {},
       acceptProps = {},
       dialogProps = {},
@@ -31,8 +32,8 @@ const ConfirmDialog = Vue.defineComponent({
         title,
         message,
         dialogProps: { ...dialogProps },
-        cancelProps: { text: 'Cancel', variant: 'outlined', ...cancelProps },
-        acceptProps: { text: 'Confirm', color: 'primary', variant: 'flat', ...acceptProps },
+        cancelProps: { text: translations.cancel_, variant: 'outlined', ...cancelProps },
+        acceptProps: { text: translations.confirm_, color: 'primary', variant: 'flat', ...acceptProps },
         onAccept,
         onReject,
         loading: false,
@@ -74,8 +75,8 @@ const ConfirmDialog = Vue.defineComponent({
         this.onReject = null;
         this.resolvePromise = null;
         this.rejectPromise = null;
-        this.cancelProps = { text: 'Cancel', variant: 'outlined' };
-        this.acceptProps = { text: 'Confirm', color: 'primary', variant: 'flat' };
+        this.cancelProps = { text: translations.cancel_, variant: 'outlined' };
+        this.acceptProps = { text: translations.confirm_, color: 'primary', variant: 'flat' };
         this.dialogProps = {};
       }, 300)
     },
diff --git a/enferno/static/js/components/GeoLocations.js b/enferno/static/js/components/GeoLocations.js
index ff6cc10d8..dabfd7e93 100644
--- a/enferno/static/js/components/GeoLocations.js
+++ b/enferno/static/js/components/GeoLocations.js
@@ -94,7 +94,7 @@ const GeoLocations = Vue.defineComponent({
     },
 
     removeLocation(i) {
-      if (confirm(this.translations.confirm_)) {
+      if (confirm(this.translations.areYouSure_)) {
         this.locations.splice(i, 1);
         this.$emit('update:modelValue', this.locations);
       }
diff --git a/enferno/static/js/components/ShortActorDialog.js b/enferno/static/js/components/ShortActorDialog.js
index e8e06124c..9f8199c08 100644
--- a/enferno/static/js/components/ShortActorDialog.js
+++ b/enferno/static/js/components/ShortActorDialog.js
@@ -118,7 +118,7 @@ const ShortActorDialog = Vue.defineComponent({
       return this.profileModes.find((x) => x.id === mode).fields.includes(fieldName);
     },
     confirmClose() {
-      if (confirm(translations.confirm_)) {
+      if (confirm(translations.areYouSure_)) {
         this.close();
       }
     },
diff --git a/enferno/static/js/mixins/relations-mixin.js b/enferno/static/js/mixins/relations-mixin.js
index e0b9fc79d..27c5c7abe 100644
--- a/enferno/static/js/mixins/relations-mixin.js
+++ b/enferno/static/js/mixins/relations-mixin.js
@@ -86,7 +86,7 @@ const relationsMixin = {
     },
 
     removeFromRelationList({ relationList = [], index } = {}) {
-      if (confirm(translations.confirm_)) {
+      if (confirm(translations.areYouSure_)) {
         relationList.splice(index, 1);
       }
     },

From 70ba7a1ab5dc521fc6c522d50e4cf8c6e6173a7f Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 14:34:18 -0600
Subject: [PATCH 032/180] add asterisk to change password page

---
 enferno/templates/security/change_password.html | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/enferno/templates/security/change_password.html b/enferno/templates/security/change_password.html
index 5804800b2..49d37e905 100755
--- a/enferno/templates/security/change_password.html
+++ b/enferno/templates/security/change_password.html
@@ -13,11 +13,10 @@
           {% if active_password %}
           <v-text-field
             v-model="form.password"
-            label="{{ _('Current Password') }}"
             type="password"
             name="password"
             :rules="[validationRules.required()]"
-          ></v-text-field>
+          ><template #label>{{ _('Current Password') }}<span class="text-red">*</span></template></v-text-field>
           {% else %}
           <v-card-title>
             {{ _fsdomain('You do not currently have a password - this will add one.') }}
@@ -26,7 +25,6 @@
 
           <v-text-field
             v-model="form.new_password"
-            label="{{ _('New Password') }}"
             type="password"
             name="new_password"
             :class="isStrongPassword ? 'text-success' : undefined"
@@ -37,15 +35,14 @@
                 validationRules.checkPassword({ onResponse: onPasswordCheckResponse })
             ]"
             @input="isStrongPassword = false"
-          ></v-text-field>
+          ><template #label>{{ _('New Password') }}<span class="text-red">*</span></template></v-text-field>
 
           <v-text-field
             v-model="form.new_password_confirm"
-            label="{{ _('Retype Password') }}"
             type="password"
             name="new_password_confirm"
             :rules="[validationRules.matchesField(form.new_password)]"
-          ></v-text-field>
+          ><template #label>{{ _('Retype Password') }}<span class="text-red">*</span></template></v-text-field>
         </v-card-text>
 
         <v-card-actions class="pa-4 justify-end">

From bcbc76b987371a4472285e17c7bbb218252916a2 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 21 Oct 2025 14:57:12 -0600
Subject: [PATCH 033/180] remove root property since users page is already on
 root

---
 enferno/admin/templates/admin/users.html | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 4a4e67eba..34ac01812 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -665,7 +665,7 @@
                 },
 
                 openRevoke2FADialog(userId) {
-                    this.$root.$confirm({
+                    this.$confirm({
                         title: "{{ _('You’re about to revoke two-factor authentication for this user') }}",
                         message: "{{ _('After this action, the user’s registered 2FA devices will be removed. They will no longer be required to use two-factor authentication until it is reconfigured.') }}\r\n\r\n{{ _('Do you want to continue?') }}",
                         acceptProps: { text: "{{ _('Revoke 2FA') }}", color: 'error' },
@@ -718,7 +718,7 @@
                         .delete(`/admin/api/user/${userId}/sessions/logout`)
                         .then((response) => {
                             console.log('All sessions logged out successfully for user ID:', userId);
-                            this.$root.showSnack(this.translations.allSessionsLoggedOut_);
+                            this.showSnack(this.translations.allSessionsLoggedOut_);
                         })
                         .catch((err) => {
                             console.error('Error logging out all sessions for user ID:', userId, err);
@@ -726,7 +726,7 @@
                 },
 
                 openLogoutAllUserSessionsDialog(userId) {
-                    this.$root.$confirm({
+                    this.$confirm({
                         title: "{{ _('You’re about to log out all active sessions for this user') }}",
                         message: "{{ _('After this action, the user will be signed out from all devices and will need to log in again. This will not affect their data or settings.') }}\r\n\r\n{{ _('Do you want to continue?') }}",
                         acceptProps: { text: "{{ _('Log Out All Sessions') }}", color: 'error' },
@@ -817,7 +817,7 @@
                 },
 
                 openForcePasswordResetDialog(item) {
-                    this.$root.$confirm({
+                    this.$confirm({
                         title: translations.youreAboutToForceAPasswordResetForUser_(item.name),
                         message: "{{ _('After this action, user will be required to set a new password at their next sign-in. This will not affect any user data or settings.') }}\r\n\r\n{{ _('Do you want to continue?') }}",
                         acceptProps: { text: "{{ _('Force Password Reset') }}", color: 'error' },
@@ -829,7 +829,7 @@
                 },
 
                 openForcePasswordResetAllDialog() {
-                    this.$root.$confirm({
+                    this.$confirm({
                         title: "{{ _('You’re about to force a password reset for all users') }}",
                         message: "{{ _('After this action, all users will be required to set a new password at their next sign-in. This will not affect any user data or settings.') }}\r\n\r\n{{ _('Do you want to continue?') }}",
                         acceptProps: { text: "{{ _('Force All Password Resets') }}", color: 'error' },

From 32a4f50d9e431d08ef6cbb6313364c4018bc8236 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 22 Oct 2025 08:23:33 -0600
Subject: [PATCH 034/180] tweak height of users table

---
 enferno/admin/templates/admin/users.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 34ac01812..8c6bd5dfe 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -7,7 +7,7 @@
             <v-card>
                 <v-card-text>
                     <v-data-table-server
-                            height="calc(100vh - 260px)"
+                            height="calc(100vh - 331px)"
                             fixed-header
                             :headers="headers"
                             :items="items"
@@ -792,8 +792,8 @@
 
                     api.post(`/admin/api/users/`, {
                         q: {
-                            ...(this.q || {}),
                             ...(this.filters || {}),
+                            ...(this.search ? { search: this.search } : {}),
                         },
                         page: this.options?.page ?? 1,
                         per_page: this.options?.itemsPerPage ?? 10,

From 007dd81cac98942fd968165c699c793f7aa73e86 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 22 Oct 2025 08:27:10 -0600
Subject: [PATCH 035/180] remove .once modifier from logout session and force
 global password reset

---
 enferno/admin/templates/admin/users.html | 3 ++-
 enferno/static/js/components/UserCard.js | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 8c6bd5dfe..d9879c307 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -36,7 +36,7 @@
 
                                     <div class="d-flex align-center ga-3">
                                         <v-btn
-                                            @click.once="openForcePasswordResetAllDialog()"
+                                            @click="openForcePasswordResetAllDialog()"
                                             color="error"
                                             variant="elevated"
                                             prepend-icon="mdi-lock-reset"
@@ -829,6 +829,7 @@
                 },
 
                 openForcePasswordResetAllDialog() {
+                    console.log('Opening force password reset all dialog');
                     this.$confirm({
                         title: "{{ _('You’re about to force a password reset for all users') }}",
                         message: "{{ _('After this action, all users will be required to set a new password at their next sign-in. This will not affect any user data or settings.') }}\r\n\r\n{{ _('Do you want to continue?') }}",
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 879eaed5a..44fbe3d4f 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -372,7 +372,7 @@ const UserCard = Vue.defineComponent({
                   <v-btn
                     icon="mdi-logout"
                     variant="plain" v-if="session.details?._fresh"
-                    @click.once="openLogoutSessionDialog(session.id)" :disabled="!session.is_active"
+                    @click="openLogoutSessionDialog(session.id)" :disabled="!session.is_active"
                     color="error"
                   ></v-btn>
                 </td>

From 069399c2778207bdec1a2ccdc43464e39b74f94a Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 22 Oct 2025 08:57:52 -0600
Subject: [PATCH 036/180] remove extra 2fa button

---
 enferno/admin/templates/admin/users.html | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index d9879c307..ecdce65b1 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -429,11 +429,6 @@
                                         </div>
                                     </v-container>
                                 </v-card-text>
-                                <v-card-text class="text-center">
-                                    <v-btn v-if="editedItem.two_factor_devices?.length"  prepend-icon="mdi-lock-remove" class="mx-2" @click="openRevoke2FADialog(editedItem.id)">
-                                        {{ _('Revoke 2FA') }}
-                                    </v-btn>
-                                </v-card-text>
                             </v-form>
                         </v-card>
                     </v-dialog>
@@ -790,14 +785,7 @@
 
                     this.loading = true;
 
-                    api.post(`/admin/api/users/`, {
-                        q: {
-                            ...(this.filters || {}),
-                            ...(this.search ? { search: this.search } : {}),
-                        },
-                        page: this.options?.page ?? 1,
-                        per_page: this.options?.itemsPerPage ?? 10,
-                    })
+                    api.get(`/admin/api/users/`)
                     .then(res => {
                         this.items = res.data.items;
                         this.itemsLength = res.data.total;

From 92a90ab61f93d36dce213ae66ce1721a0c79b5a1 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 22 Oct 2025 08:59:07 -0600
Subject: [PATCH 037/180] remove debug logs

---
 enferno/admin/templates/admin/users.html | 2 --
 1 file changed, 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index ecdce65b1..f0a9f877c 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -712,7 +712,6 @@
                     axios
                         .delete(`/admin/api/user/${userId}/sessions/logout`)
                         .then((response) => {
-                            console.log('All sessions logged out successfully for user ID:', userId);
                             this.showSnack(this.translations.allSessionsLoggedOut_);
                         })
                         .catch((err) => {
@@ -817,7 +816,6 @@
                 },
 
                 openForcePasswordResetAllDialog() {
-                    console.log('Opening force password reset all dialog');
                     this.$confirm({
                         title: "{{ _('You’re about to force a password reset for all users') }}",
                         message: "{{ _('After this action, all users will be required to set a new password at their next sign-in. This will not affect any user data or settings.') }}\r\n\r\n{{ _('Do you want to continue?') }}",

From a5c6dd75aba88c828f7bffe261bfe14d51391a3d Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 22 Oct 2025 16:14:10 -0600
Subject: [PATCH 038/180] add new access roles and allow only selecting one
 sustem role

---
 enferno/admin/templates/admin/users.html     | 42 ++++++++++++++++----
 enferno/static/js/components/ToggleButton.js | 29 +++++---------
 enferno/static/js/components/UserCard.js     |  4 +-
 3 files changed, 47 insertions(+), 28 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index f0a9f877c..3fb24fd96 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -386,17 +386,34 @@
                                         <v-switch v-if="editedItem.id !== {{ current_user.id }}" color="blue" class="text-medium-emphasis" label="{{ _('Account is Active') }}"
                                                 v-model="editedItem.active"></v-switch>
 
-                                        <div class="mb-3 text-body-1">{{ _('User Roles') }}</div>
+                                        <div class="mb-3 text-body-1">{{ _('System Role') }}</div>
                                         <div class="d-flex flex-wrap ga-3 mb-7">
                                             <toggle-button
                                                 v-for="role in roles"
                                                 :key="role.id"
                                                 :model-value="isRoleSelected(role)"
                                                 @update:model-value="toggleRole(role)"
+                                                :closable="isRoleSelected(role)"
+                                                :disabled="Boolean(editedItem.roles?.length && editedItem.roles?.some(r => r.id !== role.id))"
+                                                @close="editedItem.roles = []"
+                                                hide-left-icon
                                             >
                                                 ${role.name}
                                             </toggle-button>
                                         </div>
+
+                                        <div class="mb-3 text-body-1">{{ _('Access Role') }}</div>
+                                        <div class="d-flex flex-wrap ga-3 mb-7">
+                                            <toggle-button
+                                                v-for="role in accessRoles"
+                                                :key="role.id"
+                                                :model-value="isAccessRoleSelected(role)"
+                                                @update:model-value="toggleAccessRole(role)"
+                                            >
+                                                ${role.title}
+                                            </toggle-button>
+                                        </div>
+
                                         <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default)') }}</span></div>
                                         <div class="d-flex flex-wrap ga-3 mb-7">
                                             <toggle-button v-model="editedItem.view_usernames" :read-only="editedUserHasAdminRole">
@@ -529,6 +546,11 @@
                 changePasswordDialog: false,
                 askUserToChangePassword: true,
 
+                accessRoles: [
+                    { title: "{{ _('Incident Access') }}", value: 'incident_access' },
+                    { title: "{{ _('Actor Access') }}", value: 'actor_access' },
+                    { title: "{{ _('Bulletin Access') }}", value: 'bulletin_access' },
+                ],
                 filters: {
                     accountStatus: null,
                     roles: [],
@@ -943,14 +965,20 @@
                 },
                 toggleRole(role) {
                     if (!this.editedItem?.roles) this.editedItem.roles = []
-
-                    const index = this.editedItem.roles.findIndex(r => r.id === role.id)
+                    this.editedItem.roles = [role]
+                    this.checkRoles();
+                },
+                isAccessRoleSelected(role) {
+                    return this.editedItem?.access_roles?.some(r => r.value === role.value)
+                },
+                toggleAccessRole(role) {
+                    if (!this.editedItem?.access_roles) this.editedItem.access_roles = []
+                    
+                    const index = this.editedItem.access_roles.findIndex(r => r.value === role.value)
                     if (index !== -1) {
-                        this.editedItem.roles.splice(index, 1) // remove
+                        this.editedItem.access_roles.splice(index, 1) // remove
                     } else {
-                        this.editedItem.roles.push(role) // add
-                        
-                        this.checkRoles();
+                        this.editedItem.access_roles.push(role) // add
                     }
                 },
                 searchUsers: debounce(function (evt) {
diff --git a/enferno/static/js/components/ToggleButton.js b/enferno/static/js/components/ToggleButton.js
index 3251bd7eb..fdcf80dc7 100644
--- a/enferno/static/js/components/ToggleButton.js
+++ b/enferno/static/js/components/ToggleButton.js
@@ -1,24 +1,13 @@
 const ToggleButton = Vue.defineComponent({
   props: {
-    modelValue: {
-      type: Boolean,
-      required: true,
-      default: false,
-    },
-    readOnly: {
-      type: Boolean,
-      default: false,
-    },
-    activeColor: {
-      type: String,
-      default: 'primary',
-    },
-    hideIcon: {
-      type: Boolean,
-      default: false
-    }
+    modelValue: { type: Boolean, required: true, default: false },
+    readOnly: { type: Boolean, default: false },
+    activeColor: { type: String, default: 'primary' },
+    hideLeftIcon: { type: Boolean, default: false },
+    closable: { type: Boolean, default: false },
+    disabled: { type: Boolean, default: false },
   },
-  emits: ['update:modelValue'],
+  emits: ['update:modelValue', 'close'],
   template: `
     <v-btn
       :variant="modelValue || (!modelValue && readOnly) ? 'tonal' : 'outlined'"
@@ -26,12 +15,14 @@ const ToggleButton = Vue.defineComponent({
       @click="$emit('update:modelValue', !modelValue)"
       :class="['font-weight-medium', { 'text-medium-emphasis cursor-default': readOnly }]"
       :readonly="readOnly"
+      :disabled="disabled"
     >
-      <template v-if="!hideIcon">
+      <template v-if="!hideLeftIcon">
         <v-icon v-if="modelValue" start size="small">mdi-check</v-icon>
         <v-icon v-if="!modelValue && readOnly" start size="small">mdi-close</v-icon>
       </template>
       <slot></slot>
+      <v-icon v-if="closable" @click.stop="$emit('close', modelValue)" end size="small">mdi-close-circle</v-icon>
     </v-btn>
   `,
 });
\ No newline at end of file
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 44fbe3d4f..51519531a 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -245,7 +245,7 @@ const UserCard = Vue.defineComponent({
                       v-for="(role, index) in user.roles"
                       :key="index"
                       read-only
-                      hide-icon
+                      hide-left-icon
                       :model-value="true"
                     >
                       {{ role.name }}
@@ -254,7 +254,7 @@ const UserCard = Vue.defineComponent({
                   <template v-else>
                     <toggle-button
                       read-only
-                      hide-icon
+                      hide-left-icon
                       :model-value="true"
                     >
                       {{ translations.viewOnly_ }}

From 663b94376c40405a2a488034cd7c9f268c7b2777 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 22 Oct 2025 16:27:54 -0600
Subject: [PATCH 039/180] mark all access roles as checked if user is admin

---
 enferno/admin/templates/admin/users.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 3fb24fd96..9e9cf977f 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -792,6 +792,7 @@
                         this.editedItem.can_edit_locations = true;
                         this.editedItem.can_export = true;
                         this.editedItem.can_import_web = true;
+                        this.editedItem.access_roles = [...this.accessRoles];
                         return true;
                     }
                     return false;

From 15dc2556e93be6156d08a044b76be5b202231d25 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 22 Oct 2025 16:29:32 -0600
Subject: [PATCH 040/180] replace title for name key

---
 enferno/admin/templates/admin/users.html | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 9e9cf977f..7662d4aff 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -410,7 +410,7 @@
                                                 :model-value="isAccessRoleSelected(role)"
                                                 @update:model-value="toggleAccessRole(role)"
                                             >
-                                                ${role.title}
+                                                ${role.name}
                                             </toggle-button>
                                         </div>
 
@@ -547,9 +547,9 @@
                 askUserToChangePassword: true,
 
                 accessRoles: [
-                    { title: "{{ _('Incident Access') }}", value: 'incident_access' },
-                    { title: "{{ _('Actor Access') }}", value: 'actor_access' },
-                    { title: "{{ _('Bulletin Access') }}", value: 'bulletin_access' },
+                    { name: "{{ _('Incident Access') }}", value: 'incident_access' },
+                    { name: "{{ _('Actor Access') }}", value: 'actor_access' },
+                    { name: "{{ _('Bulletin Access') }}", value: 'bulletin_access' },
                 ],
                 filters: {
                     accountStatus: null,

From 5b31a550abcf124018d62adc1df709b17a40c600 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 23 Oct 2025 19:36:46 +0500
Subject: [PATCH 041/180] Add filtering support to users API endpoint

  - Search across username, email, and name fields
  - Filter by account status (active/inactive)
  - Filter by 2FA status (enabled/disabled)
  - Multi-select filter by roles

Supports frontend user dashboard filter UI implementation
---
 enferno/admin/views.py | 45 ++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 43 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index d8040fb80..234cd209d 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -4834,7 +4834,15 @@ def api_locationhistory(locationid: t.id) -> Response:
 @roles_accepted("Admin", "Mod")
 def api_users() -> Response:
     """
-    API endpoint to feed users data in json format , supports paging and search.
+    API endpoint to feed users data in json format, supports paging, search, and filtering.
+
+    Query Parameters:
+        - page: Page number (default: 1)
+        - per_page: Items per page (default: PER_PAGE)
+        - q: Search term (searches username, email, name)
+        - active: Filter by account status (true/false)
+        - twoFactor: Filter by 2FA status (true/false)
+        - roles: Comma-separated role IDs for filtering
 
     Returns:
         - json feed of users / error.
@@ -4842,9 +4850,42 @@ def api_users() -> Response:
     page = request.args.get("page", 1, int)
     per_page = request.args.get("per_page", PER_PAGE, int)
     q = request.args.get("q")
+    active = request.args.get("active")
+    two_factor = request.args.get("twoFactor")
+    roles = request.args.get("roles")
+
     query = []
+
+    # Search filter (username, email, name)
     if q is not None:
-        query.append(User.name.ilike("%" + q + "%"))
+        search_term = f"%{q}%"
+        query.append(
+            or_(
+                User.username.ilike(search_term),
+                User.email.ilike(search_term),
+                User.name.ilike(search_term),
+            )
+        )
+
+    # Account status filter
+    if active is not None:
+        is_active = active.lower() == "true"
+        query.append(User.active == is_active)
+
+    # 2FA status filter
+    if two_factor is not None:
+        has_2fa = two_factor.lower() == "true"
+        if has_2fa:
+            query.append(or_(User.tf_primary_method.isnot(None), User.webauthn.any()))
+        else:
+            query.append(User.tf_primary_method.is_(None), ~User.webauthn.any())
+
+    # Roles filter (multi-select)
+    if roles:
+        role_ids = [int(r.strip()) for r in roles.split(",") if r.strip().isdigit()]
+        if role_ids:
+            query.append(User.roles.any(Role.id.in_(role_ids)))
+
     result = (
         User.query.filter(*query)
         .order_by(User.username)

From 1dc2e351df33c6affadfa9e1e125d1a14acd0e71 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 23 Oct 2025 09:00:48 -0600
Subject: [PATCH 042/180] Change add user button to simply show save changes

---
 enferno/admin/templates/admin/users.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 7662d4aff..e83e6b01a 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -307,10 +307,10 @@
                                         </v-btn>
                                         <v-btn
                                             @click="validateFormAndSave"
-                                            :prepend-icon="isNewUser ? 'mdi-plus' : 'mdi-check'"
+                                            prepend-icon="mdi-check"
                                             color="primary"
                                             variant="flat"
-                                            :text="isNewUser ? '{{ _('Add User') }}' : '{{ _('Save Changes') }}'"
+                                            text="{{ _('Save Changes') }}"
                                             :loading="saving"
                                         ></v-btn>
                                         <v-btn icon density="comfortable" @click="close">

From f0e6f2d655654f697f10ee86081e5a83c2d3205a Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 23 Oct 2025 09:46:27 -0600
Subject: [PATCH 043/180] fix filters on users page so it actually makes a
 request to backend

---
 enferno/admin/templates/admin/users.html | 85 ++++++++++++------------
 1 file changed, 43 insertions(+), 42 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index e83e6b01a..32df87e89 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -56,10 +56,10 @@
                                 </div>
                                 <div class="d-flex align-center ga-5 w-100">
                                     <div>{{ _('Filter') }}
-                                        <v-tooltip v-if="activeCount('twoFactor') || activeCount('roles') || activeCount('accountStatus')" location="top" text="{{ _('Clear filters') }}">
+                                        <v-tooltip v-if="activeCount('twoFactor') || activeCount('roles') || activeCount('active')" location="top" text="{{ _('Clear filters') }}">
                                             <template #activator="{props}">
                                                 <v-btn v-bind="props" icon="mdi-filter-off-outline" size="small"
-                                                    @click="filters = { accountStatus: null, roles: [], twoFactor: null }"
+                                                    @click="options = {}; refresh()"
                                                 ></v-btn>
                                             </template>
                                         </v-tooltip>
@@ -74,7 +74,7 @@
                                                 v-bind="props"
                                             >
                                             <v-badge
-                                                v-if="activeCount('accountStatus')"
+                                                v-if="activeCount('active')"
                                                 location="top right"
                                                 :offset-x="-14"
                                                 :offset-y="4"
@@ -92,10 +92,10 @@
                                             <v-list-item
                                                 v-for="option in accountStatusOptions"
                                                 :key="option.value"
-                                                @click="filters.accountStatus = option.value"
-                                                :active="filters.accountStatus === option.value"
+                                                @click="options.active = option.value; refresh()"
+                                                :active="options.active === option.value"
                                             >
-                                                <v-list-item-title>${option.title}</v-list-item-title>
+                                                <v-list-item-title>${option.name}</v-list-item-title>
                                             </v-list-item>
                                         </v-list>
                                     </v-menu>
@@ -128,11 +128,11 @@
                                             <v-list-item
                                                 v-for="role in roles"
                                                 :key="role.id"
-                                                @click="setRoleFilters(role.id)"
-                                                :active="filters.roles.includes(role.id)"
+                                                @click="setRoleFilters(role.id); refresh()"
+                                                :active="Boolean(options?.roles?.includes(role.id))"
                                             >
                                             <v-checkbox
-                                                :model-value="filters.roles.includes(role.id)"
+                                                :model-value="Boolean(options?.roles?.includes(role.id))"
                                                 :label="role.name"
                                                 hide-details
                                             />
@@ -167,10 +167,10 @@
                                             <v-list-item
                                                 v-for="option in twoFactorOptions"
                                                 :key="option.value"
-                                                @click="filters.twoFactor = option.value"
-                                                :active="filters.twoFactor === option.value"
+                                                @click="options.twoFactor = option.value; refresh()"
+                                                :active="options.twoFactor === option.value"
                                             >
-                                                <v-list-item-title>${option.title}</v-list-item-title>
+                                                <v-list-item-title>${option.name}</v-list-item-title>
                                             </v-list-item>
                                         </v-list>
                                     </v-menu>
@@ -551,18 +551,13 @@
                     { name: "{{ _('Actor Access') }}", value: 'actor_access' },
                     { name: "{{ _('Bulletin Access') }}", value: 'bulletin_access' },
                 ],
-                filters: {
-                    accountStatus: null,
-                    roles: [],
-                    twoFactor: null,
-                },
                 accountStatusOptions: [
-                    { title: 'Active', value: 'active' },
-                    { title: 'Inactive', value: 'inactive' },
+                    { name: 'Active', value: 'true' },
+                    { name: 'Inactive', value: 'false' },
                 ],
                 twoFactorOptions: [
-                    { title: 'Active', value: 'active' },
-                    { title: 'Inactive', value: 'inactive' },
+                    { name: 'Active', value: 'true' },
+                    { name: 'Inactive', value: 'false' },
                 ],
             }),
 
@@ -621,18 +616,19 @@
 
             methods: {
                 activeCount(key) {
-                    const val = this.filters[key]
+                    const val = this.options?.[key]
                     if (Array.isArray(val)) return val.length
                     return val ? 1 : 0
                 },
                 setRoleFilters(role) {
-                    const roles = this.filters.roles
+                    if (!this.options?.roles) this.options.roles = []
+
+                    const roles = this.options.roles
                     if (roles.includes(role)) {
-                        this.filters.roles = roles.filter((r) => r !== role)
+                        this.options.roles = roles.filter((r) => r !== role)
                     } else {
-                        this.filters.roles.push(role)
+                        this.options.roles.push(role)
                     }
-
                 },
                 onUsernameCheckResponse(response) {
                     if (this.editedItem.username === this.initialUsername) {
@@ -800,24 +796,29 @@
 
                 refresh(options) {
                     this.options = options || { ...this.options, page: 1 };
-
-                    if (this.advSearchOpen) {
-                        this.advSearchOpen = false;
-                    }
-
                     this.loading = true;
 
-                    api.get(`/admin/api/users/`)
-                    .then(res => {
-                        this.items = res.data.items;
-                        this.itemsLength = res.data.total;
-                    })
-                    .catch(err => {
-                        console.error(err?.response?.data || err);
-                    })
-                    .finally(() => {
-                        this.loading = false;
+                    const params = new URLSearchParams({
+                        page: this.options?.page ?? 1,
+                        per_page: this.options.itemsPerPage ?? 10,
                     });
+
+                    if (this.options?.q) params.append('q', this.options.q);
+                    if (this.options?.active) params.append('active', this.options.active);
+                    if (this.options?.roles?.length) params.append('roles', this.options.roles);
+                    if (this.options?.twoFactor) params.append('twoFactor', this.options.twoFactor);
+
+                    api.get(`/admin/api/users/?${params.toString()}`)
+                        .then(res => {
+                            this.items = res.data.items;
+                            this.itemsLength = res.data.total;
+                        })
+                        .catch(err => {
+                            console.error(err?.response?.data);
+                        })
+                        .finally(() => {
+                            this.loading = false;
+                        });
                 },
 
                 openChangePasswordDialog(item) {
@@ -986,7 +987,7 @@
                     this.loading = true;
                     this.search = evt;
 
-                    this.refresh({ q: evt })
+                    this.refresh({ ...this.options, q: evt })
                 }, 350),
             }
         });

From 5fccc718c7cbd326838c38f762b84bcf839c98cd Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 23 Oct 2025 09:48:47 -0600
Subject: [PATCH 044/180] make search clearable and remove useless vars

---
 enferno/admin/templates/admin/users.html | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 32df87e89..3e5941383 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -24,7 +24,7 @@
                                     <v-toolbar-title class="flex-0-0">{{ _('System Users') }}</v-toolbar-title>
 
                                     <v-text-field
-                                        :model-value="search"
+                                        v-model="search"
                                         @update:model-value="searchUsers"
                                         class="flex-grow-1"
                                         variant="outlined"
@@ -32,6 +32,7 @@
                                         hide-details
                                         prepend-inner-icon="mdi-magnify"
                                         placeholder="{{ _('Search for a system user') }}"
+                                        clearable
                                     ></v-text-field>
 
                                     <div class="d-flex align-center ga-3">
@@ -984,9 +985,6 @@
                     }
                 },
                 searchUsers: debounce(function (evt) {
-                    this.loading = true;
-                    this.search = evt;
-
                     this.refresh({ ...this.options, q: evt })
                 }, 350),
             }

From f287600347e2627908cb274981e92ff33538ae49 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 23 Oct 2025 09:59:53 -0600
Subject: [PATCH 045/180] add view only role with id 0

---
 enferno/admin/templates/admin/users.html | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 3e5941383..fa8a66869 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -773,8 +773,12 @@
 
                     api.get(`/admin/api/roles/`).then(response => {
 
-
-                        this.roles = response.data.items;
+                        this.roles = [{
+                            "id": 0,
+                            "name": "View Only",
+                            "description": "System role with read-only access",
+                            "color": ""
+                        }, ...response.data.items];
                     });
 
                 },

From 7e4da19aed037758281ca7b0e451df9ab2a8209e Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 23 Oct 2025 21:43:54 +0500
Subject: [PATCH 046/180] Enhance users API filtering capabilities

- Added support for filtering users without roles using role ID 0
- Updated logic to handle cases where users may have no roles or selected roles
- Fix twoFactor filter bug when passed as false
---
 enferno/admin/views.py | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 234cd209d..3c5cc9e0b 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -17,7 +17,7 @@
 from flask_babel import gettext
 from flask_security import logout_user
 from flask_security.decorators import auth_required, current_user, roles_accepted, roles_required
-from sqlalchemy import desc, or_, select, func, text
+from sqlalchemy import desc, or_, and_, select, func, text
 from sqlalchemy.orm import joinedload
 from werkzeug.utils import safe_join, secure_filename
 from zxcvbn import zxcvbn
@@ -4842,7 +4842,7 @@ def api_users() -> Response:
         - q: Search term (searches username, email, name)
         - active: Filter by account status (true/false)
         - twoFactor: Filter by 2FA status (true/false)
-        - roles: Comma-separated role IDs for filtering
+        - roles: Comma-separated role IDs for filtering (use 0 for users without roles)
 
     Returns:
         - json feed of users / error.
@@ -4878,13 +4878,26 @@ def api_users() -> Response:
         if has_2fa:
             query.append(or_(User.tf_primary_method.isnot(None), User.webauthn.any()))
         else:
-            query.append(User.tf_primary_method.is_(None), ~User.webauthn.any())
+            query.append(and_(User.tf_primary_method.is_(None), ~User.webauthn.any()))
 
     # Roles filter (multi-select)
     if roles:
         role_ids = [int(r.strip()) for r in roles.split(",") if r.strip().isdigit()]
         if role_ids:
-            query.append(User.roles.any(Role.id.in_(role_ids)))
+            # Support id 0 for users without roles
+            if 0 in role_ids:
+                actual_role_ids = [rid for rid in role_ids if rid > 0]
+                if actual_role_ids:
+                    # Users with no roles OR users with selected roles
+                    query.append(
+                        or_(~User.roles.any(), User.roles.any(Role.id.in_(actual_role_ids)))
+                    )
+                else:
+                    # Only users with no roles
+                    query.append(~User.roles.any())
+            else:
+                # Only users with selected roles
+                query.append(User.roles.any(Role.id.in_(role_ids)))
 
     result = (
         User.query.filter(*query)

From 0ffcebd0454a19e291b0f2130fcfded7811604cd Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 23 Oct 2025 11:03:17 -0600
Subject: [PATCH 047/180] add view only role to filter dropdown and not user
 create/edit dialog

---
 enferno/admin/templates/admin/users.html | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index fa8a66869..51bbbef0b 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -127,7 +127,7 @@
 
                                         <v-list>
                                             <v-list-item
-                                                v-for="role in roles"
+                                                v-for="role in [{ 'id': 0, 'name': 'View Only'}, ...roles]"
                                                 :key="role.id"
                                                 @click="setRoleFilters(role.id); refresh()"
                                                 :active="Boolean(options?.roles?.includes(role.id))"
@@ -773,12 +773,7 @@
 
                     api.get(`/admin/api/roles/`).then(response => {
 
-                        this.roles = [{
-                            "id": 0,
-                            "name": "View Only",
-                            "description": "System role with read-only access",
-                            "color": ""
-                        }, ...response.data.items];
+                        this.roles = response.data.items;
                     });
 
                 },

From a6ae1015b94996914041f11e9a2554d28c440ec8 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 23 Oct 2025 11:58:48 -0600
Subject: [PATCH 048/180] fix missing components error

---
 enferno/templates/setup_wizard.html | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/enferno/templates/setup_wizard.html b/enferno/templates/setup_wizard.html
index b893a9537..fe329e3ca 100644
--- a/enferno/templates/setup_wizard.html
+++ b/enferno/templates/setup_wizard.html
@@ -463,6 +463,10 @@ <h2 class="mt-1 subtitle-2 mb-2">{{ _('Two Factor Authentication Policies') }}</
     {% include 'admin/jsapi.jinja2' %}
 </script>
 
+<!-- Confirm & Toast components can be removed once PR #100 is merged -->
+<script src="/static/js/components/ConfirmDialog.js"></script> 
+<script src="/static/js/components/Toast.js"></script>
+
 <script src="/static/js/components/NotificationsList.js"></script>
 <script src="/static/js/vuetify.min.js"></script>
 <script src="/static/js/axios.min.js"></script>

From b1756f49ad7f68008efee1244b1abff856781559 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 24 Oct 2025 10:57:24 -0600
Subject: [PATCH 049/180] Mark with a checkmark and primary color selected
 filters

---
 enferno/admin/templates/admin/users.html | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 51bbbef0b..4ce768c17 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -95,8 +95,9 @@
                                                 :key="option.value"
                                                 @click="options.active = option.value; refresh()"
                                                 :active="options.active === option.value"
+                                                color="primary"
                                             >
-                                                <v-list-item-title>${option.name}</v-list-item-title>
+                                                <v-list-item-title><v-icon v-if="options.active === option.value" start>mdi-check</v-icon>${option.name}</v-list-item-title>
                                             </v-list-item>
                                         </v-list>
                                     </v-menu>
@@ -131,6 +132,7 @@
                                                 :key="role.id"
                                                 @click="setRoleFilters(role.id); refresh()"
                                                 :active="Boolean(options?.roles?.includes(role.id))"
+                                                color="primary"
                                             >
                                             <v-checkbox
                                                 :model-value="Boolean(options?.roles?.includes(role.id))"
@@ -170,8 +172,9 @@
                                                 :key="option.value"
                                                 @click="options.twoFactor = option.value; refresh()"
                                                 :active="options.twoFactor === option.value"
+                                                color="primary"
                                             >
-                                                <v-list-item-title>${option.name}</v-list-item-title>
+                                                <v-list-item-title><v-icon v-if="options.twoFactor === option.value" start>mdi-check</v-icon>${option.name}</v-list-item-title>
                                             </v-list-item>
                                         </v-list>
                                     </v-menu>

From 36f738b55aa08ba35f046d8bdbac6b9067114c76 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 24 Oct 2025 13:52:02 -0600
Subject: [PATCH 050/180] make user dialog fullscreen and add new access level
 buttons

---
 enferno/admin/templates/admin/users.html | 166 +++++++++++++++--------
 1 file changed, 106 insertions(+), 60 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 4ce768c17..b2fb88ec3 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -301,18 +301,15 @@
 
                         <template v-slot:no-data></template>
                     </v-data-table-server>
-                    <v-dialog v-model="dialog" max-width="1200px">
+
+                    <v-dialog v-model="dialog" fullscreen>
                         <v-card rounded="lg">
-                            <v-toolbar :title="formTitle">
+                            <v-toolbar :title="formTitle" color="dark-primary">
                                 <template #append>
                                     <div class="d-flex align-center ga-2 mr-2">
-                                        <v-btn @click="close" variant="outlined">
-                                            {{ _('Cancel') }}
-                                        </v-btn>
                                         <v-btn
                                             @click="validateFormAndSave"
                                             prepend-icon="mdi-check"
-                                            color="primary"
                                             variant="flat"
                                             text="{{ _('Save Changes') }}"
                                             :loading="saving"
@@ -387,67 +384,87 @@
                                                 </v-text-field>
                                             </v-col>
                                         </v-row>
-                                        <v-switch v-if="editedItem.id !== {{ current_user.id }}" color="blue" class="text-medium-emphasis" label="{{ _('Account is Active') }}"
-                                                v-model="editedItem.active"></v-switch>
 
-                                        <div class="mb-3 text-body-1">{{ _('System Role') }}</div>
-                                        <div class="d-flex flex-wrap ga-3 mb-7">
-                                            <toggle-button
-                                                v-for="role in roles"
-                                                :key="role.id"
-                                                :model-value="isRoleSelected(role)"
-                                                @update:model-value="toggleRole(role)"
-                                                :closable="isRoleSelected(role)"
-                                                :disabled="Boolean(editedItem.roles?.length && editedItem.roles?.some(r => r.id !== role.id))"
-                                                @close="editedItem.roles = []"
-                                                hide-left-icon
-                                            >
-                                                ${role.name}
-                                            </toggle-button>
+                                        <div class="mb-3 text-body-1">{{ _('Access Levels') }}</div>
+                                        <div class="mb-7">
+                                            <div class="d-flex flex-wrap ga-3 mb-2">
+                                                <v-btn-toggle
+                                                    :model-value="Math.max(accessLevels.findIndex(level => level.value === editedItem?.access_level?.value), 0)"
+                                                    @update:model-value="updateAccessLevel($event)"
+                                                    variant="outlined"
+                                                    divided
+                                                    color="primary"
+                                                >
+                                                    <v-btn v-for="(accessLevel) in accessLevels" :key="accessLevel.value">${accessLevel.name}</v-btn>
+                                                </v-btn-toggle>
+                                            </div>
+                                            <span class="text-caption text-medium-emphasis">${editedItem.access_level?.description || accessLevels[0]?.description}</span>
                                         </div>
 
-                                        <div class="mb-3 text-body-1">{{ _('Access Role') }}</div>
-                                        <div class="d-flex flex-wrap ga-3 mb-7">
-                                            <toggle-button
-                                                v-for="role in accessRoles"
-                                                :key="role.id"
-                                                :model-value="isAccessRoleSelected(role)"
-                                                @update:model-value="toggleAccessRole(role)"
-                                            >
-                                                ${role.name}
-                                            </toggle-button>
-                                        </div>
+                                        <v-row>
+                                            <v-col v-if="['full_access'].includes(editedItem.access_level?.value)" cols="12" md="6">
+                                                <div class="mb-3 text-body-1">{{ _('System Role') }}</div>
+                                                <div class="d-flex flex-wrap ga-3 mb-7">
+                                                    <toggle-button
+                                                        v-for="role in roles"
+                                                        :key="role.id"
+                                                        :model-value="isRoleSelected(role)"
+                                                        @update:model-value="toggleRole(role)"
+                                                        @close="editedItem.roles = []"
+                                                        hide-left-icon
+                                                    >
+                                                        ${role.name}
+                                                    </toggle-button>
+                                                </div>
+                                            </v-col>
+                                            <v-col v-if="['view_only', 'full_access'].includes(editedItem.access_level?.value)" cols="12" md="6">
+                                                <div class="mb-3 text-body-1">{{ _('Access Role') }}</div>
+                                                <div class="d-flex flex-wrap ga-3 mb-7">
+                                                    <toggle-button
+                                                        v-for="role in accessRoles"
+                                                        :key="role.id"
+                                                        :model-value="isAccessRoleSelected(role)"
+                                                        @update:model-value="toggleAccessRole(role)"
+                                                    >
+                                                        ${role.name}
+                                                    </toggle-button>
+                                                </div>
+                                            </v-col>
+                                        </v-row>
 
-                                        <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default)') }}</span></div>
-                                        <div class="d-flex flex-wrap ga-3 mb-7">
-                                            <toggle-button v-model="editedItem.view_usernames" :read-only="editedUserHasAdminRole">
-                                                {{ _('Can View Usernames') }}
-                                            </toggle-button>
 
-                                            <toggle-button v-model="editedItem.view_full_history" :read-only="editedUserHasAdminRole">
-                                                {{ _('Can View Full History') }}
-                                            </toggle-button>
+                                        <template v-if="['view_only', 'full_access'].includes(editedItem.access_level?.value)">
+                                            <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default)') }}</span></div>
+                                            <div class="d-flex flex-wrap ga-3 mb-7">
+                                                <toggle-button v-model="editedItem.view_usernames" :read-only="editedUserHasAdminRole">
+                                                    {{ _('Can View Usernames') }}
+                                                </toggle-button>
 
-                                            <toggle-button v-model="editedItem.view_simple_history" :read-only="editedUserHasAdminRole">
-                                                {{ _('Can View Simple History') }}
-                                            </toggle-button>
+                                                <toggle-button v-model="editedItem.view_full_history" :read-only="editedUserHasAdminRole">
+                                                    {{ _('Can View Full History') }}
+                                                </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_self_assign" :read-only="editedUserHasAdminRole">
-                                                {{ _('Can Self-Assign') }}
-                                            </toggle-button>
+                                                <toggle-button v-model="editedItem.view_simple_history" :read-only="editedUserHasAdminRole">
+                                                    {{ _('Can View Simple History') }}
+                                                </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_edit_locations" :read-only="editedUserHasAdminRole">
-                                                {{ _('Can Edit Locations') }}
-                                            </toggle-button>
+                                                <toggle-button v-model="editedItem.can_self_assign" :read-only="editedUserHasAdminRole">
+                                                    {{ _('Can Self-Assign') }}
+                                                </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_export" :read-only="editedUserHasAdminRole">
-                                                {{ _('Can Request Exports') }}
-                                            </toggle-button>
+                                                <toggle-button v-model="editedItem.can_edit_locations" :read-only="editedUserHasAdminRole">
+                                                    {{ _('Can Edit Locations') }}
+                                                </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_import_web" :read-only="editedUserHasAdminRole">
-                                                {{ _('Can Import From Web') }}
-                                            </toggle-button>
-                                        </div>
+                                                <toggle-button v-model="editedItem.can_export" :read-only="editedUserHasAdminRole">
+                                                    {{ _('Can Request Exports') }}
+                                                </toggle-button>
+
+                                                <toggle-button v-model="editedItem.can_import_web" :read-only="editedUserHasAdminRole">
+                                                    {{ _('Can Import From Web') }}
+                                                </toggle-button>
+                                            </div>
+                                        </template>
                                     </v-container>
                                 </v-card-text>
                             </v-form>
@@ -550,6 +567,12 @@
                 changePasswordDialog: false,
                 askUserToChangePassword: true,
 
+                accessLevels: [
+                    { name: "{{ _('Disabled') }}", value: 'disabled', description: "{{ _('User cannot access Bayanat unless their access level is changed.') }}" },
+                    { name: "{{ _('Write Only') }}", value: 'write_only', description: "{{ _('Users can add items in Actors, Bulletins, and Incidents but cannot view existing database content.') }}" },
+                    { name: "{{ _('View Only') }}", value: 'view_only', description: "{{ _('Users can view items in Actors, Bulletins, and Incidents but cannot edit or add new items.') }}" },
+                    { name: "{{ _('Full Access') }}", value: 'full_access', description: "{{ _('User can view, add, and modify data in the database according to their system role.') }}" },
+                ],
                 accessRoles: [
                     { name: "{{ _('Incident Access') }}", value: 'incident_access' },
                     { name: "{{ _('Actor Access') }}", value: 'actor_access' },
@@ -918,9 +941,11 @@
 
                     this.saving = true;
 
+                    const payload = this.applyAccessLevelRules({...this.editedItem});
+
                     // edit mode
-                    if (this.editedItem.id) {
-                        api.put(`/admin/api/user/`, {item: this.editedItem}, { suppressGlobalErrorHandler: true })
+                    if (payload.id) {
+                        api.put(`/admin/api/user/`, {item: payload}, { suppressGlobalErrorHandler: true })
                             .then(response => {
                                 this.refresh();
                                 this.showSnack(response.data);
@@ -934,7 +959,7 @@
                     } else {
                         // create mode
                         axios
-                            .post("/admin/api/user/", {item: this.editedItem}, { suppressGlobalErrorHandler: true })
+                            .post("/admin/api/user/", {item: payload}, { suppressGlobalErrorHandler: true })
                             .then(response => {
                                 this.refresh();
                                 this.showSnack(response.data);
@@ -989,6 +1014,27 @@
                 searchUsers: debounce(function (evt) {
                     this.refresh({ ...this.options, q: evt })
                 }, 350),
+                updateAccessLevel(index) {
+                    const selectedAccessLevel = this.accessLevels[index] || this.accessLevels[0];
+                    this.editedItem.access_level = selectedAccessLevel;
+                },
+                applyAccessLevelRules(item) {
+                    const { value } = item.access_level;
+
+                    if (value === 'disabled') {
+                        item.active = false;
+                        item.roles = [];
+                    } else if (value === 'view_only') {
+                        item.active = true;
+                        item.roles = [];
+                    } else if (value === 'write_only') {
+                        item.active = true;
+                    } else if (value === 'full_access') {
+                        item.active = true;
+                    }
+
+                    return item
+                }
             }
         });
 

From 6ad1e5f57345ca82b78f18a0afcd891be1f02980 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 24 Oct 2025 13:59:24 -0600
Subject: [PATCH 051/180] if user is admin dont allow to deselect access roles

---
 enferno/admin/templates/admin/users.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index b2fb88ec3..31109f33e 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -425,6 +425,7 @@
                                                         :key="role.id"
                                                         :model-value="isAccessRoleSelected(role)"
                                                         @update:model-value="toggleAccessRole(role)"
+                                                        :read-only="editedUserHasAdminRole"
                                                     >
                                                         ${role.name}
                                                     </toggle-button>

From 3dc4c8f44651900186e8290f43cf697a144778aa Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 24 Oct 2025 14:54:08 -0600
Subject: [PATCH 052/180] render access level and role on table and drawer

---
 enferno/admin/templates/admin/jsapi.jinja2 |  5 +-
 enferno/admin/templates/admin/users.html   | 41 +++++------
 enferno/static/js/components/UserCard.js   | 81 ++++++++++++++++------
 3 files changed, 85 insertions(+), 42 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 27ca49332..9a82dfb84 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -35,7 +35,10 @@ copyCoordinates_: "{{ _('Copy coordinates') }}",
 failedToCopyCoordinates_: "{{ _('Failed to copy coordinates') }}",
 googleOauth_: "{{ _('Google OAuth') }}",
 editUser_: "{{ _('Edit User') }}",
-userRole_: "{{ _('User Role') }}",
+systemRole_: "{{ _('System Role') }}",
+accessLevel_: "{{ _('Access Level') }}",
+accessRole_: "{{ _('Access Role') }}",
+disabled_: "{{ _('Disabled') }}",
 twoFactorAuthentication_: "{{ _('Two-Factor Authentication') }}",
 youreAboutToEndThisSession_: "{{ _('You\'re about to end this session') }}",
 afterThisActionTheUserWillBeSignedOut_: "{{ _('After this action, the user will be signed out from this device. This will not affect other active sessions, user data, or settings.') }}",
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 31109f33e..3cce1e1f8 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -273,30 +273,25 @@
                             </v-tooltip>
                         </template>
 
-                        <template v-slot:item.active_status="{ item }">
-                            <v-tooltip location="top"
-                                       :text="item.active === true ? '{{ _('Active') }}' : '{{ _('Inactive') }}'">
-                                <template #activator="{props}">
-                                    <v-icon
-                                        :color="item.active ? 'success' : 'grey'"
-                                        :icon="item.active ? 'mdi-account-check' : 'mdi-account-cancel'"
-                                        v-bind="props"
-                                        size="small"
-                                    />
-                                </template>
-                            </v-tooltip>
+                        <template v-slot:item.access_level="{ item }">
+                            <template v-if="item.access_level">
+                                <v-chip v-for="level in item?.access_level" class="ma-1">
+                                    <v-icon start size="x-large">${getIconFromAccessLevel(level)}</v-icon>
+                                    ${level.name}
+                                </v-chip>
+                            </template>
+                            <template v-else>
+                                <v-chip class="ma-1">
+                                    <v-icon start size="x-large">mdi-account-cancel</v-icon>
+                                    {{ _('Disabled') }}
+                                </v-chip>
+                            </template>
                         </template>
 
                         <template v-slot:item.roles="{ item }">
-
-                            <v-chip size="small" v-for="role in item.roles" class="ma-1">
+                            <v-chip v-for="role in item.roles" class="ma-1">
                                 ${role.name}
                             </v-chip>
-                            <v-chip class="ma-1" v-if="!item.roles.length" size="small" color="grey"
-                            >{{ _('View Only') }}
-                            </v-chip>
-
-
                         </template>
 
                         <template v-slot:no-data></template>
@@ -541,7 +536,7 @@
                     {title: "{{_('Username')}}", value: "username"},
                     {title: "{{_('Email')}}", value: "email"},
                     {title: "{{_('Name')}}", value: "name"},
-                    {title: "{{_('Account Status')}}", value: "active_status"},
+                    {title: "{{_('Access Level')}}", value: "access_level"},
                     {title: "{{_('Groups')}}", value: "roles"},
                     {title: "{{_('Two-Factor Authentication')}}", value: "2fa"},
                     {title: "{{_('Actions')}}", value: "action", sortable: false}
@@ -643,6 +638,12 @@
 
 
             methods: {
+                getIconFromAccessLevel(level) {
+                    if (level.value === 'disabled') return 'mdi-account-cancel';
+                    if (level.value === 'view_only') return 'mdi-eye';
+                    if (level.value === 'write_only') return 'mdi-pencil';
+                    if (level.value === 'full_access') return 'mdi-account-key';
+                },
                 activeCount(key) {
                     const val = this.options?.[key]
                     if (Array.isArray(val)) return val.length
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 51519531a..d2209224f 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -237,8 +237,33 @@ const UserCard = Vue.defineComponent({
         <v-card variant="flat">
           <v-card-text class="px-6">
             <v-row>
-              <v-col cols="12" md="6">
-                <div class="mb-3 text-body-1">{{ translations.userRole_ }}</div>
+              <v-col cols="12" sm="6" md="4">
+                <div class="mb-3 text-body-1">{{ translations.accessLevel_ }}</div>
+                <div class="d-flex flex-wrap ga-3">
+                  <template v-if="user?.access_level">
+                    <toggle-button
+                      read-only
+                      hide-left-icon
+                      :model-value="true"
+                    >
+                      <v-icon start size="x-large">{{ $root.getIconFromAccessLevel(user?.access_level) }}</v-icon>
+                      {{ user?.access_level?.name }}
+                    </toggle-button>
+                  </template>
+                  <template v-else>
+                    <toggle-button
+                      read-only
+                      hide-left-icon
+                      :model-value="true"
+                    >
+                      <v-icon start size="x-large">mdi-account-cancel</v-icon>
+                      {{ translations.disabled_ }}
+                    </toggle-button>
+                  </template>
+                </div>
+              </v-col>
+              <v-col cols="12" sm="6" md="4">
+                <div class="mb-3 text-body-1">{{ translations.systemRole_ }}</div>
                 <div class="d-flex flex-wrap ga-3">
                   <template v-if="user.roles.length">
                     <toggle-button
@@ -251,18 +276,48 @@ const UserCard = Vue.defineComponent({
                       {{ role.name }}
                     </toggle-button>
                   </template>
-                  <template v-else>
+                </div>
+              </v-col>
+              <v-col cols="12" sm="6" md="4">
+                <div class="mb-3 text-body-1">{{ translations.accessRole_ }}</div>
+                <div class="d-flex flex-wrap ga-3">
+                  <template v-if="user?.access_roles?.length">
                     <toggle-button
+                      v-for="(role, index) in user.access_roles"
+                      :key="index"
                       read-only
                       hide-left-icon
                       :model-value="true"
                     >
-                      {{ translations.viewOnly_ }}
+                      {{ role.name }}
                     </toggle-button>
                   </template>
                 </div>
               </v-col>
-              <v-col cols="12" md="6">
+            </v-row>
+          </v-card-text>
+        </v-card>
+
+        <v-card variant="flat">
+          <v-card-text class="px-6">
+            <div class="mb-3 text-body-1">{{ translations.userPermissions_ }}</div>
+            <div class="d-flex flex-wrap ga-3">
+              <toggle-button
+                v-for="(permission, index) in permissions"
+                :key="index"
+                read-only
+                :model-value="permission.value"
+              >
+                {{ permission.label }}
+              </toggle-button>
+            </div>
+          </v-card-text>
+        </v-card>
+
+        <v-card variant="flat">
+          <v-card-text class="px-6">
+            <v-row>
+              <v-col cols="12" md="4">
                 <div class="mb-3 text-body-1">{{ translations.twoFactorAuthentication_ }}</div>
                 <div class="d-flex flex-wrap ga-3">
                   <div
@@ -296,22 +351,6 @@ const UserCard = Vue.defineComponent({
           </v-card-text>
         </v-card>
 
-        <v-card variant="flat">
-          <v-card-text class="px-6">
-            <div class="mb-3 text-body-1">{{ translations.userPermissions_ }}</div>
-            <div class="d-flex flex-wrap ga-3">
-              <toggle-button
-                v-for="(permission, index) in permissions"
-                :key="index"
-                read-only
-                :model-value="permission.value"
-              >
-                {{ permission.label }}
-              </toggle-button>
-            </div>
-          </v-card-text>
-        </v-card>
-
         <v-card class="mt-2" variant="flat">
           <v-card-text class="px-6">
             <div class="d-flex justify-space-between align-center mb-2">

From e8142e1a1c34c6ad7657254283831bd14ff24d7b Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 27 Oct 2025 08:54:56 -0600
Subject: [PATCH 053/180] access level is now computed on frontend

---
 enferno/admin/templates/admin/users.html | 48 ++++++++++++++++++++----
 1 file changed, 41 insertions(+), 7 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 3cce1e1f8..c155674d8 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -275,9 +275,9 @@
 
                         <template v-slot:item.access_level="{ item }">
                             <template v-if="item.access_level">
-                                <v-chip v-for="level in item?.access_level" class="ma-1">
-                                    <v-icon start size="x-large">${getIconFromAccessLevel(level)}</v-icon>
-                                    ${level.name}
+                                <v-chip class="ma-1">
+                                    <v-icon start size="x-large">${getIconFromAccessLevel(item?.access_level)}</v-icon>
+                                    ${item?.access_level?.name}
                                 </v-chip>
                             </template>
                             <template v-else>
@@ -837,9 +837,12 @@
                     if (this.options?.twoFactor) params.append('twoFactor', this.options.twoFactor);
 
                     api.get(`/admin/api/users/?${params.toString()}`)
-                        .then(res => {
-                            this.items = res.data.items;
-                            this.itemsLength = res.data.total;
+                        .then(response => {
+                            this.items = response.data.items.map(user => ({
+                                ...user,
+                                access_level: this.computeAccessLevel(user)
+                            }))
+                            this.itemsLength = response.data.total;
                         })
                         .catch(err => {
                             console.error(err?.response?.data);
@@ -894,7 +897,10 @@
                 editItem(item) {
                     this.userDrawer = false;
                     this.editedIndex = this.items.indexOf(item);
-                    this.editedItem = {...item};
+                    this.editedItem = {
+                        ...item,
+                        access_level: this.computeAccessLevel(item)
+                    };
                     this.isUsernameAvailable = false;
                     this.initialUsername = item.username;
                     this.dialog = true;
@@ -944,6 +950,8 @@
                     this.saving = true;
 
                     const payload = this.applyAccessLevelRules({...this.editedItem});
+                    if (payload.access_level) delete payload.access_level; // 👈 access_level is only used on frontend
+                    if (payload.access_roles) delete payload.access_roles; // 👈 TODO: Remove this line once it's supported by backend
 
                     // edit mode
                     if (payload.id) {
@@ -1017,8 +1025,18 @@
                     this.refresh({ ...this.options, q: evt })
                 }, 350),
                 updateAccessLevel(index) {
+                    if (typeof index === 'undefined') return;
                     const selectedAccessLevel = this.accessLevels[index] || this.accessLevels[0];
                     this.editedItem.access_level = selectedAccessLevel;
+
+                    if (selectedAccessLevel.value === 'full_access') {
+                        this.roles.find(role => {
+                            if (role.name.toLowerCase() === 'admin') {
+                                this.editedItem.roles = [role];
+                                this.checkRoles();
+                            }
+                        });
+                    }
                 },
                 applyAccessLevelRules(item) {
                     const { value } = item.access_level;
@@ -1036,6 +1054,22 @@
                     }
 
                     return item
+                },
+                computeAccessLevel(user) {
+                    if (!user.active) {
+                        return { name: "Disabled", value: "disabled" };
+                    }
+
+                    const hasSystemRole = Array.isArray(user.roles) && user.roles.length > 0;
+
+                    if (hasSystemRole) {
+                        return { name: "Full Access", value: "full_access" };
+                    } else {
+                        return { name: "Read Only", value: "view_only" };
+                    }
+
+                    // Future support
+                    // if (someCondition) return { name: "Write Only", value: "write_only" };
                 }
             }
         });

From 39e12eebb72908e06ea53862fc447357c571ad84 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 27 Oct 2025 09:04:56 -0600
Subject: [PATCH 054/180] tweaks to compute access level on frontend

---
 enferno/admin/templates/admin/users.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index c155674d8..3cbbf4c24 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -693,7 +693,7 @@
 
                 showUser(user_id) {
                     api.get(`/admin/api/user/${user_id}`).then(response => {
-                        this.user = response.data;
+                        this.user = { ...response.data, access_level: this.computeAccessLevel(response.data) };
                         this.userDrawer = true;
                     }).catch(err => {
                         console.error(err);
@@ -702,7 +702,7 @@
                 },
                 refreshUser(user_id) {
                     api.get(`/admin/api/user/${user_id}`).then(response => {
-                        this.user = response.data;
+                        this.user = { ...response.data, access_level: this.computeAccessLevel(response.data) };
                     })
                 },
 
@@ -1036,6 +1036,8 @@
                                 this.checkRoles();
                             }
                         });
+                    } else {
+                        this.editedItem.roles = []
                     }
                 },
                 applyAccessLevelRules(item) {

From a07f5ca7361b0efdf05ec499954e7e4ce49058a0 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 27 Oct 2025 12:47:49 -0600
Subject: [PATCH 055/180] update system role to use btn-toggle, change icon
 size, and update read only to be view only text

---
 enferno/admin/templates/admin/users.html | 39 +++++++++++-------------
 enferno/static/js/components/UserCard.js |  4 +--
 2 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 3cbbf4c24..793e3fb55 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -274,15 +274,15 @@
                         </template>
 
                         <template v-slot:item.access_level="{ item }">
-                            <template v-if="item.access_level">
+                            <template v-if="item?.access_level">
                                 <v-chip class="ma-1">
-                                    <v-icon start size="x-large">${getIconFromAccessLevel(item?.access_level)}</v-icon>
+                                    <v-icon start size="large">${getIconFromAccessLevel(item?.access_level)}</v-icon>
                                     ${item?.access_level?.name}
                                 </v-chip>
                             </template>
                             <template v-else>
                                 <v-chip class="ma-1">
-                                    <v-icon start size="x-large">mdi-account-cancel</v-icon>
+                                    <v-icon start size="large">mdi-account-cancel</v-icon>
                                     {{ _('Disabled') }}
                                 </v-chip>
                             </template>
@@ -400,16 +400,15 @@
                                             <v-col v-if="['full_access'].includes(editedItem.access_level?.value)" cols="12" md="6">
                                                 <div class="mb-3 text-body-1">{{ _('System Role') }}</div>
                                                 <div class="d-flex flex-wrap ga-3 mb-7">
-                                                    <toggle-button
-                                                        v-for="role in roles"
-                                                        :key="role.id"
-                                                        :model-value="isRoleSelected(role)"
-                                                        @update:model-value="toggleRole(role)"
-                                                        @close="editedItem.roles = []"
-                                                        hide-left-icon
+                                                    <v-btn-toggle
+                                                        :model-value="Math.max(roles.findIndex(role => editedItem?.roles?.some(r => r?.id === role?.id)), 0)"
+                                                        @update:model-value="updateSystemRole($event)"
+                                                        variant="outlined"
+                                                        divided
+                                                        color="primary"
                                                     >
-                                                        ${role.name}
-                                                    </toggle-button>
+                                                        <v-btn v-for="(role) in roles" :key="role?.id">${role.name}</v-btn>
+                                                    </v-btn-toggle>
                                                 </div>
                                             </v-col>
                                             <v-col v-if="['view_only', 'full_access'].includes(editedItem.access_level?.value)" cols="12" md="6">
@@ -588,7 +587,7 @@
 
             computed: {
                 editedUserHasAdminRole() {
-                    return this.editedItem?.roles?.some(role => role.id === this.adminRoleId) ?? false;
+                    return this.editedItem?.roles?.some(role => role?.id === this.adminRoleId) ?? false;
                 },
                 isNewUser() {
                     return !this.editedItem?.id;
@@ -1000,12 +999,10 @@
                         this.saving = false;
                     }
                 },
-                isRoleSelected(role) {
-                    return this.editedItem?.roles?.some(r => r.id === role.id)
-                },
-                toggleRole(role) {
+                updateSystemRole(index) {
+                    const selectedRole = this.roles?.[index] || this.roles[0];
                     if (!this.editedItem?.roles) this.editedItem.roles = []
-                    this.editedItem.roles = [role]
+                    this.editedItem.roles = [selectedRole];
                     this.checkRoles();
                 },
                 isAccessRoleSelected(role) {
@@ -1041,9 +1038,9 @@
                     }
                 },
                 applyAccessLevelRules(item) {
-                    const { value } = item.access_level;
+                    const { value } = item?.access_level || {};
 
-                    if (value === 'disabled') {
+                    if (!value || value === 'disabled') {
                         item.active = false;
                         item.roles = [];
                     } else if (value === 'view_only') {
@@ -1067,7 +1064,7 @@
                     if (hasSystemRole) {
                         return { name: "Full Access", value: "full_access" };
                     } else {
-                        return { name: "Read Only", value: "view_only" };
+                        return { name: "View Only", value: "view_only" };
                     }
 
                     // Future support
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index d2209224f..d60795e2c 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -246,7 +246,7 @@ const UserCard = Vue.defineComponent({
                       hide-left-icon
                       :model-value="true"
                     >
-                      <v-icon start size="x-large">{{ $root.getIconFromAccessLevel(user?.access_level) }}</v-icon>
+                      <v-icon start size="large">{{ $root.getIconFromAccessLevel(user?.access_level) }}</v-icon>
                       {{ user?.access_level?.name }}
                     </toggle-button>
                   </template>
@@ -256,7 +256,7 @@ const UserCard = Vue.defineComponent({
                       hide-left-icon
                       :model-value="true"
                     >
-                      <v-icon start size="x-large">mdi-account-cancel</v-icon>
+                      <v-icon start size="large">mdi-account-cancel</v-icon>
                       {{ translations.disabled_ }}
                     </toggle-button>
                   </template>

From 56db40b51165e41abc84c79788409a287a3c98d8 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 27 Oct 2025 12:49:29 -0600
Subject: [PATCH 056/180] hide permissions from view only role

---
 enferno/admin/templates/admin/users.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 793e3fb55..7910e5413 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -428,7 +428,7 @@
                                         </v-row>
 
 
-                                        <template v-if="['view_only', 'full_access'].includes(editedItem.access_level?.value)">
+                                        <template v-if="['full_access'].includes(editedItem.access_level?.value)">
                                             <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default)') }}</span></div>
                                             <div class="d-flex flex-wrap ga-3 mb-7">
                                                 <toggle-button v-model="editedItem.view_usernames" :read-only="editedUserHasAdminRole">

From 675b2eb009ea3429d54f8823b7da06eb7ecf9421 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 18:31:34 +0400
Subject: [PATCH 057/180] feat: add UserHistory model for tracking user
 revisions

Introduces a new SQL Alchemy model, UserHistory, to maintain a history of user revisions. This model includes fields for target user ID, user ID, and a JSON column for storing revision data. It also provides methods for serialization and restricted data access, enhancing the auditing capabilities of user changes.
---
 enferno/admin/models/UserHistory.py | 58 +++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 enferno/admin/models/UserHistory.py

diff --git a/enferno/admin/models/UserHistory.py b/enferno/admin/models/UserHistory.py
new file mode 100644
index 000000000..b40bfe253
--- /dev/null
+++ b/enferno/admin/models/UserHistory.py
@@ -0,0 +1,58 @@
+import json
+from typing import Any
+
+from sqlalchemy import JSON
+
+from enferno.admin.models.utils import check_history_access
+from enferno.extensions import db
+from enferno.utils.base import BaseMixin
+from enferno.utils.date_helper import DateHelper
+from enferno.utils.logging_utils import get_logger
+
+logger = get_logger()
+
+
+class UserHistory(db.Model, BaseMixin):
+    """
+    SQL Alchemy model for user revisions
+    """
+
+    id = db.Column(db.Integer, primary_key=True)
+    target_user_id = db.Column(db.Integer, db.ForeignKey("user.id"), index=True)
+    target_user = db.relationship(
+        "User",
+        backref=db.backref("history", order_by="UserHistory.updated_at"),
+        foreign_keys=[target_user_id],
+    )
+    data = db.Column(JSON)
+    # user tracking - who made the change
+    user_id = db.Column(db.Integer, db.ForeignKey("user.id"))
+    user = db.relationship("User", foreign_keys=[user_id])
+
+    @property
+    def restricted_data(self):
+        return {
+            "name": self.data.get("name"),
+            "username": self.data.get("username"),
+            "email": self.data.get("email"),
+            "active": self.data.get("active"),
+            "roles": self.data.get("roles"),
+        }
+
+    # serialize
+    @check_history_access
+    def to_dict(self, full=False) -> dict[str, Any]:
+        """Return a dictionary representation of the user revision."""
+        return {
+            "id": self.id,
+            "data": self.data if full else self.restricted_data,
+            "created_at": DateHelper.serialize_datetime(self.created_at),
+            "user": self.user.to_compact() if self.user else None,
+        }
+
+    def to_json(self) -> str:
+        """Return a JSON representation of the user revision."""
+        return json.dumps(self.to_dict(), sort_keys=True)
+
+    def __repr__(self):
+        return "<UserHistory {} -- Target {}>".format(self.id, self.target_user_id)

From ca9880d874a7768a8b3d512ef790780662ff8883 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 18:32:52 +0400
Subject: [PATCH 058/180] add create_revision method to User model for tracking
 changes

---
 enferno/user/models.py | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index b4bc13e91..3b15a4473 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -385,6 +385,24 @@ def from_json(self, item: dict) -> "User":
         self.active = item.get("active")
         return self
 
+    def create_revision(self, user_id: int = None, created: datetime = None) -> None:
+        """
+        Create a new revision in the history table.
+
+        Args:
+            - user_id: the id of the user making the change.
+            - created: the created date.
+        """
+        from enferno.admin.models import UserHistory
+
+        if not user_id:
+            user_id = getattr(current_user, "id", 1)
+        h = UserHistory(target_user_id=self.id, data=self.to_dict(), user_id=user_id)
+        if created:
+            h.created_at = created
+            h.updated_at = created
+        h.save()
+
     @property
     def two_factor_devices(self) -> Dict[str, Any]:
         """

From 3b498f34f72b64278088b675f18b4b0286d2e1c1 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 18:33:05 +0400
Subject: [PATCH 059/180] Register UserHistory model in admin models for user
 revision tracking

---
 enferno/admin/models/__init__.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/enferno/admin/models/__init__.py b/enferno/admin/models/__init__.py
index dcdd02047..a89613acc 100644
--- a/enferno/admin/models/__init__.py
+++ b/enferno/admin/models/__init__.py
@@ -43,3 +43,4 @@
 from .Source import Source
 from .WorkflowStatus import WorkflowStatus
 from .Notification import Notification
+from .UserHistory import UserHistory

From 1717e169d27ffcff828977b40409fa0235feeaaa Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 18:37:55 +0400
Subject: [PATCH 060/180] add API endpoint for user history retrieval

---
 enferno/admin/views.py | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 54c1c86bb..b1948ed62 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -35,6 +35,7 @@
     BulletinHistory,
     ActorHistory,
     LocationHistory,
+    UserHistory,
     PotentialViolation,
     ClaimedViolation,
     Activity,
@@ -4853,6 +4854,35 @@ def api_locationhistory(locationid: t.id) -> Response:
     return HTTPResponse.success(data=response)
 
 
+# User History Helpers
+
+
+@admin.route("/api/userhistory/<int:userid>")
+@require_view_history
+def api_userhistory(userid: t.id) -> Response:
+    """
+    Endpoint to get revision history of a user.
+
+    Args:
+        - userid: id of the user.
+
+    Returns:
+        - json feed of user's history / error.
+    """
+    result = (
+        db.session.execute(
+            select(UserHistory)
+            .where(UserHistory.target_user_id == userid)
+            .order_by(desc(UserHistory.created_at))
+        )
+        .scalars()
+        .all()
+    )
+    # For standardization
+    response = {"items": [item.to_dict() for item in result]}
+    return HTTPResponse.success(data=response)
+
+
 # user management routes
 
 
@@ -5214,6 +5244,8 @@ def api_user_update(
 
         user = user.from_json(u)
         if user.save():
+            # Create history revision
+            user.create_revision()
             # Record activity
             Activity.create(
                 current_user,

From b0c62d36df1e708263fb1bd5362efe0c7f9a8fbd Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 22:29:24 +0400
Subject: [PATCH 061/180] add API endpoint to temporarily suspend user accounts

---
 enferno/admin/views.py | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index b1948ed62..1a0807698 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5329,6 +5329,47 @@ def api_user_force_reset_all() -> Response:
     return HTTPResponse.success(message="Forced password reset has been set for all users")
 
 
+@admin.post("/api/user/<int:id>/suspend")
+@roles_required("Admin")
+def api_user_suspend(id: int) -> Response:
+    """
+    Temporarily suspend a user account.
+
+    Args:
+        - id: id of the user to suspend.
+
+    Returns:
+        - success/error response.
+    """
+    user = db.session.get(User, id)
+    if not user:
+        return HTTPResponse.not_found("User not found")
+
+    if not user.active:
+        return HTTPResponse.error("User is already suspended or disabled")
+
+    user.active = False
+    user.save()
+    user.logout_other_sessions()
+
+    Activity.create(
+        current_user,
+        Activity.ACTION_UPDATE,
+        Activity.STATUS_SUCCESS,
+        user.to_mini(),
+        "user",
+        details={"action": "suspended"},
+    )
+
+    Notification.send_admin_notification_for_event(
+        Constants.NotificationEvent.ITEM_UPDATED,
+        "User Suspended",
+        f"User {user.username} has been suspended by {current_user.username}.",
+    )
+
+    return HTTPResponse.success(message=f"User {user.username} suspended successfully")
+
+
 @admin.delete("/api/user/<int:id>")
 @roles_required("Admin")
 def api_user_delete(

From 306dfe3f34ead938acc90454e65c2ae4a322800b Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 22:41:24 +0400
Subject: [PATCH 062/180] add API endpoint to reactivate suspended user
 accounts + bug fixes

---
 enferno/admin/views.py | 47 ++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 45 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 1a0807698..e7a1d0327 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5358,11 +5358,11 @@ def api_user_suspend(id: int) -> Response:
         Activity.STATUS_SUCCESS,
         user.to_mini(),
         "user",
-        details={"action": "suspended"},
+        details="suspended",
     )
 
     Notification.send_admin_notification_for_event(
-        Constants.NotificationEvent.ITEM_UPDATED,
+        Constants.NotificationEvent.UPDATE_USER,
         "User Suspended",
         f"User {user.username} has been suspended by {current_user.username}.",
     )
@@ -5370,6 +5370,49 @@ def api_user_suspend(id: int) -> Response:
     return HTTPResponse.success(message=f"User {user.username} suspended successfully")
 
 
+@admin.post("/api/user/<int:id>/reactivate")
+@roles_required("Admin")
+def api_user_reactivate(id: int) -> Response:
+    """
+    Reactivate a suspended user account.
+
+    Args:
+        - id: id of the user to reactivate.
+
+    Returns:
+        - success/error response.
+    """
+    user = db.session.get(User, id)
+    if not user:
+        return HTTPResponse.not_found("User not found")
+
+    if user.deleted:
+        return HTTPResponse.forbidden("Cannot reactivate a disabled user")
+
+    if user.active:
+        return HTTPResponse.error("User is already active")
+
+    user.active = True
+    user.save()
+
+    Activity.create(
+        current_user,
+        Activity.ACTION_UPDATE,
+        Activity.STATUS_SUCCESS,
+        user.to_mini(),
+        "user",
+        details="reactivated",
+    )
+
+    Notification.send_admin_notification_for_event(
+        Constants.NotificationEvent.UPDATE_USER,
+        "User Reactivated",
+        f"User {user.username} has been reactivated by {current_user.username}.",
+    )
+
+    return HTTPResponse.success(message=f"User {user.username} reactivated successfully")
+
+
 @admin.delete("/api/user/<int:id>")
 @roles_required("Admin")
 def api_user_delete(

From 2f5039a7cf7f5d7906e28327f53a6c43a7684f16 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 22:48:25 +0400
Subject: [PATCH 063/180] add API endpoint to disable user accounts

---
 enferno/admin/views.py | 54 ++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 52 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index e7a1d0327..049e2f34f 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5346,7 +5346,7 @@ def api_user_suspend(id: int) -> Response:
         return HTTPResponse.not_found("User not found")
 
     if not user.active:
-        return HTTPResponse.error("User is already suspended or disabled")
+        return HTTPResponse.success(message="User is already suspended or disabled")
 
     user.active = False
     user.save()
@@ -5390,7 +5390,7 @@ def api_user_reactivate(id: int) -> Response:
         return HTTPResponse.forbidden("Cannot reactivate a disabled user")
 
     if user.active:
-        return HTTPResponse.error("User is already active")
+        return HTTPResponse.success(message="User is already active")
 
     user.active = True
     user.save()
@@ -5413,6 +5413,56 @@ def api_user_reactivate(id: int) -> Response:
     return HTTPResponse.success(message=f"User {user.username} reactivated successfully")
 
 
+@admin.post("/api/user/<int:id>/disable")
+@roles_required("Admin")
+def api_user_disable(id: int) -> Response:
+    """
+    Disable account for user leaving organization.
+
+    Args:
+        - id: id of the user to disable.
+
+    Returns:
+        - success/error response.
+    """
+    user = db.session.get(User, id)
+    if not user:
+        return HTTPResponse.not_found("User not found")
+
+    if user.deleted:
+        return HTTPResponse.success(message="User is already disabled")
+
+    user.active = False
+    user.deleted = True
+    user.roles = []
+    user.view_usernames = False
+    user.view_simple_history = False
+    user.view_full_history = False
+    user.can_self_assign = False
+    user.can_edit_locations = False
+    user.can_export = False
+    user.can_import_web = False
+    user.save()
+    user.logout_other_sessions()
+
+    Activity.create(
+        current_user,
+        Activity.ACTION_UPDATE,
+        Activity.STATUS_SUCCESS,
+        user.to_mini(),
+        "user",
+        details="disabled",
+    )
+
+    Notification.send_admin_notification_for_event(
+        Constants.NotificationEvent.UPDATE_USER,
+        "User Disabled",
+        f"User {user.username} has been disabled by {current_user.username}.",
+    )
+
+    return HTTPResponse.success(message=f"User {user.username} disabled successfully")
+
+
 @admin.delete("/api/user/<int:id>")
 @roles_required("Admin")
 def api_user_delete(

From 3db72e7fe7aa0fb25bf5bf6c7357d83070419020 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 22:50:54 +0400
Subject: [PATCH 064/180] add API endpoint to enable user accounts

---
 enferno/admin/views.py | 43 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 049e2f34f..dd6dc5956 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5463,6 +5463,49 @@ def api_user_disable(id: int) -> Response:
     return HTTPResponse.success(message=f"User {user.username} disabled successfully")
 
 
+@admin.post("/api/user/<int:id>/enable")
+@roles_required("Admin")
+def api_user_enable(id: int) -> Response:
+    """
+    Re-enable a disabled account.
+
+    Args:
+        - id: id of the user to enable.
+
+    Returns:
+        - success/error response.
+    """
+    user = db.session.get(User, id)
+    if not user:
+        return HTTPResponse.not_found("User not found")
+
+    if not user.deleted:
+        return HTTPResponse.success(message="User is already enabled")
+
+    user.active = True
+    user.deleted = False
+    user.save()
+
+    Activity.create(
+        current_user,
+        Activity.ACTION_UPDATE,
+        Activity.STATUS_SUCCESS,
+        user.to_mini(),
+        "user",
+        details="enabled",
+    )
+
+    Notification.send_admin_notification_for_event(
+        Constants.NotificationEvent.UPDATE_USER,
+        "User Enabled",
+        f"User {user.username} has been enabled by {current_user.username}.",
+    )
+
+    return HTTPResponse.success(
+        message=f"User {user.username} enabled successfully. Admin must assign roles."
+    )
+
+
 @admin.delete("/api/user/<int:id>")
 @roles_required("Admin")
 def api_user_delete(

From daf7eeab026ed0d63177dc78d2c52172b54d9737 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 23:01:19 +0400
Subject: [PATCH 065/180] Implement sql migration script to efactor system
 roles in database

- Renamed existing roles: 'Mod' to 'Moderator' and 'DA' to 'Analyst'.
- Introduced a new 'View' role with read-only permissions.
- Added rollback script for potential reversions.
---
 .../20251105_225708_refactor_system_roles.sql | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 enferno/migrations/20251105_225708_refactor_system_roles.sql

diff --git a/enferno/migrations/20251105_225708_refactor_system_roles.sql b/enferno/migrations/20251105_225708_refactor_system_roles.sql
new file mode 100644
index 000000000..b0c6335bc
--- /dev/null
+++ b/enferno/migrations/20251105_225708_refactor_system_roles.sql
@@ -0,0 +1,21 @@
+-- Migration: Refactor System Roles
+-- Add new 'View' role and rename existing system roles
+
+-- 1. Rename existing roles
+UPDATE role SET name = 'Moderator' WHERE name = 'Mod';
+UPDATE role SET name = 'Analyst' WHERE name = 'DA';
+
+-- 2. Add new 'View' role (read-only permissions)
+INSERT INTO role (name, description, view_simple_history, view_bulletin, edit_bulletin, delete_bulletin)
+VALUES ('View', 'System Role', true, true, false, false)
+ON CONFLICT DO NOTHING;
+
+-- Verify changes and display the results
+SELECT id, name, description FROM role ORDER BY id;
+
+-- Rollback script:
+/*
+UPDATE role SET name = 'Mod' WHERE name = 'Moderator';
+UPDATE role SET name = 'DA' WHERE name = 'Analyst';
+DELETE FROM role WHERE name = 'View';
+*/

From 6c9b44aa786f5e2c4627c0bb2dba5202054e6b3e Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 5 Nov 2025 23:10:38 +0400
Subject: [PATCH 066/180] Refactor role generation in data_helpers.py

- Consolidated role creation logic into a loop for better maintainability.
- Updated roles to include 'Admin', 'Analyst', 'Moderator', and 'View' with a unified description.
- Removed redundant code for individual role checks and creation.
---
 enferno/utils/data_helpers.py | 31 ++++++++-----------------------
 1 file changed, 8 insertions(+), 23 deletions(-)

diff --git a/enferno/utils/data_helpers.py b/enferno/utils/data_helpers.py
index f7d5d3220..135fbb63e 100644
--- a/enferno/utils/data_helpers.py
+++ b/enferno/utils/data_helpers.py
@@ -86,29 +86,14 @@ def generate_user_roles() -> None:
     """
     Generates standard user roles.
     """
-    # create admin role if it doesn't exist
-    r = Role.query.filter_by(name="Admin").first()
-    if not r:
-        role = Role()
-        role.name = "Admin"
-        role.description = "System Role"
-        role.save()
-
-    # create DA role, if not exists
-    r = Role.query.filter_by(name="DA").first()
-    if not r:
-        role = Role()
-        role.name = "DA"
-        role.description = "System Role"
-        role.save()
-
-    # create MOD role, if not exists
-    r = Role.query.filter_by(name="Mod").first()
-    if not r:
-        role = Role()
-        role.name = "Mod"
-        role.description = "System Role"
-        role.save()
+    roles = ["Admin", "Analyst", "Moderator", "View"]
+
+    for role_name in roles:
+        r = db.session.execute(db.select(Role).filter_by(name=role_name)).scalar_one_or_none()
+
+        if not r:
+            role = Role(name=role_name, description="System Role")
+            role.save()
 
 
 def generate_workflow_statues() -> None:

From d696ea8db4848718f463931bdd97cb2ae3fda6e2 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 6 Nov 2025 14:17:47 -0600
Subject: [PATCH 067/180] remove access level logic and add basic user statuses

---
 enferno/admin/templates/admin/jsapi.jinja2 |   1 -
 enferno/admin/templates/admin/users.html   | 226 ++++++---------------
 enferno/static/js/components/UserCard.js   |  25 ---
 3 files changed, 64 insertions(+), 188 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 2fda07605..eb453e219 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -85,7 +85,6 @@ youreAboutToDeleteAField_: "{{ _('You\'re about to delete a field') }}",
 fieldsSavedSuccessfully_: "{{ _('Fields saved successfully') }}",
 editUser_: "{{ _('Edit User') }}",
 systemRole_: "{{ _('System Role') }}",
-accessLevel_: "{{ _('Access Level') }}",
 accessRole_: "{{ _('Access Role') }}",
 disabled_: "{{ _('Disabled') }}",
 twoFactorAuthentication_: "{{ _('Two-Factor Authentication') }}",
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 7910e5413..8d67c3c34 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -246,46 +246,17 @@
                         </template>
 
                         <template v-slot:item.2fa="{ item }">
-                            <v-tooltip location="top"
-                                       :text="item.two_factor_devices && item.two_factor_devices.length > 0 ? '{{ _('2FA Active') }}' : '{{ _('2FA Inactive') }}'">
-                                <template #activator="{props}">
-                                    <div v-if="item.two_factor_devices && item.two_factor_devices.length > 0" class="d-flex ga-2 font-weight-medium text-success">
-                                        <v-icon
-                                            color="success"
-                                            v-bind="props"
-                                            size="small"
-                                        >
-                                            mdi-lock-check
-                                        </v-icon>
-                                        {{ _('2FA Active') }}
-                                    </div>
-                                    <div v-else class="d-flex ga-2 font-weight-medium text-warning">
-                                        <v-icon
-                                                color="warning"
-                                                v-bind="props"
-                                                size="small"
-                                        >
-                                            mdi-lock-open-alert
-                                        </v-icon>
-                                        {{ _('2FA Inactive') }}
-                                    </div>
-                                </template>
-                            </v-tooltip>
+                            <v-chip variant="text" :color="getUser2FaMeta(item)?.color" class="ma-1">
+                                <v-icon start size="large">${getUser2FaMeta(item)?.icon}</v-icon>
+                                ${getUser2FaMeta(item)?.text}
+                            </v-chip>
                         </template>
 
-                        <template v-slot:item.access_level="{ item }">
-                            <template v-if="item?.access_level">
-                                <v-chip class="ma-1">
-                                    <v-icon start size="large">${getIconFromAccessLevel(item?.access_level)}</v-icon>
-                                    ${item?.access_level?.name}
-                                </v-chip>
-                            </template>
-                            <template v-else>
-                                <v-chip class="ma-1">
-                                    <v-icon start size="large">mdi-account-cancel</v-icon>
-                                    {{ _('Disabled') }}
-                                </v-chip>
-                            </template>
+                        <template v-slot:item.status="{ item }">
+                            <v-chip variant="text" :color="getUserStatusMeta(item)?.color" class="ma-1">
+                                <v-icon start size="large">${getUserStatusMeta(item)?.icon}</v-icon>
+                                ${getUserStatusMeta(item)?.text}
+                            </v-chip>
                         </template>
 
                         <template v-slot:item.roles="{ item }">
@@ -380,38 +351,23 @@
                                             </v-col>
                                         </v-row>
 
-                                        <div class="mb-3 text-body-1">{{ _('Access Levels') }}</div>
-                                        <div class="mb-7">
-                                            <div class="d-flex flex-wrap ga-3 mb-2">
-                                                <v-btn-toggle
-                                                    :model-value="Math.max(accessLevels.findIndex(level => level.value === editedItem?.access_level?.value), 0)"
-                                                    @update:model-value="updateAccessLevel($event)"
-                                                    variant="outlined"
-                                                    divided
-                                                    color="primary"
-                                                >
-                                                    <v-btn v-for="(accessLevel) in accessLevels" :key="accessLevel.value">${accessLevel.name}</v-btn>
-                                                </v-btn-toggle>
-                                            </div>
-                                            <span class="text-caption text-medium-emphasis">${editedItem.access_level?.description || accessLevels[0]?.description}</span>
-                                        </div>
-
                                         <v-row>
-                                            <v-col v-if="['full_access'].includes(editedItem.access_level?.value)" cols="12" md="6">
+                                            <v-col cols="12" md="6">
                                                 <div class="mb-3 text-body-1">{{ _('System Role') }}</div>
                                                 <div class="d-flex flex-wrap ga-3 mb-7">
                                                     <v-btn-toggle
-                                                        :model-value="Math.max(roles.findIndex(role => editedItem?.roles?.some(r => r?.id === role?.id)), 0)"
+                                                        :model-value="Math.max(systemRoles.findIndex(role => editedItem?.roles?.some(r => r?.name?.toLowerCase?.() === role?.value?.toLowerCase?.())), 0)"
                                                         @update:model-value="updateSystemRole($event)"
                                                         variant="outlined"
                                                         divided
                                                         color="primary"
                                                     >
-                                                        <v-btn v-for="(role) in roles" :key="role?.id">${role.name}</v-btn>
+                                                        <v-btn v-for="(role) in systemRoles" :key="role?.value">${role.name}</v-btn>
                                                     </v-btn-toggle>
+                                                    <div class="text-caption text-medium-emphasis">${systemRoles.find(role => editedItem?.roles?.some(r => r?.name?.toLowerCase?.() === role?.value?.toLowerCase?.()))?.description || systemRoles[0]?.description}</div>
                                                 </div>
                                             </v-col>
-                                            <v-col v-if="['view_only', 'full_access'].includes(editedItem.access_level?.value)" cols="12" md="6">
+                                            <v-col cols="12" md="6">
                                                 <div class="mb-3 text-body-1">{{ _('Access Role') }}</div>
                                                 <div class="d-flex flex-wrap ga-3 mb-7">
                                                     <toggle-button
@@ -427,39 +383,36 @@
                                             </v-col>
                                         </v-row>
 
+                                        <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default)') }}</span></div>
+                                        <div class="d-flex flex-wrap ga-3 mb-7">
+                                            <toggle-button v-model="editedItem.view_usernames" :read-only="editedUserHasAdminRole">
+                                                {{ _('Can View Usernames') }}
+                                            </toggle-button>
 
-                                        <template v-if="['full_access'].includes(editedItem.access_level?.value)">
-                                            <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default)') }}</span></div>
-                                            <div class="d-flex flex-wrap ga-3 mb-7">
-                                                <toggle-button v-model="editedItem.view_usernames" :read-only="editedUserHasAdminRole">
-                                                    {{ _('Can View Usernames') }}
-                                                </toggle-button>
+                                            <toggle-button v-model="editedItem.view_full_history" :read-only="editedUserHasAdminRole">
+                                                {{ _('Can View Full History') }}
+                                            </toggle-button>
 
-                                                <toggle-button v-model="editedItem.view_full_history" :read-only="editedUserHasAdminRole">
-                                                    {{ _('Can View Full History') }}
-                                                </toggle-button>
+                                            <toggle-button v-model="editedItem.view_simple_history" :read-only="editedUserHasAdminRole">
+                                                {{ _('Can View Simple History') }}
+                                            </toggle-button>
 
-                                                <toggle-button v-model="editedItem.view_simple_history" :read-only="editedUserHasAdminRole">
-                                                    {{ _('Can View Simple History') }}
-                                                </toggle-button>
+                                            <toggle-button v-model="editedItem.can_self_assign" :read-only="editedUserHasAdminRole">
+                                                {{ _('Can Self-Assign') }}
+                                            </toggle-button>
 
-                                                <toggle-button v-model="editedItem.can_self_assign" :read-only="editedUserHasAdminRole">
-                                                    {{ _('Can Self-Assign') }}
-                                                </toggle-button>
+                                            <toggle-button v-model="editedItem.can_edit_locations" :read-only="editedUserHasAdminRole">
+                                                {{ _('Can Edit Locations') }}
+                                            </toggle-button>
 
-                                                <toggle-button v-model="editedItem.can_edit_locations" :read-only="editedUserHasAdminRole">
-                                                    {{ _('Can Edit Locations') }}
-                                                </toggle-button>
+                                            <toggle-button v-model="editedItem.can_export" :read-only="editedUserHasAdminRole">
+                                                {{ _('Can Request Exports') }}
+                                            </toggle-button>
 
-                                                <toggle-button v-model="editedItem.can_export" :read-only="editedUserHasAdminRole">
-                                                    {{ _('Can Request Exports') }}
-                                                </toggle-button>
-
-                                                <toggle-button v-model="editedItem.can_import_web" :read-only="editedUserHasAdminRole">
-                                                    {{ _('Can Import From Web') }}
-                                                </toggle-button>
-                                            </div>
-                                        </template>
+                                            <toggle-button v-model="editedItem.can_import_web" :read-only="editedUserHasAdminRole">
+                                                {{ _('Can Import From Web') }}
+                                            </toggle-button>
+                                        </div>
                                     </v-container>
                                 </v-card-text>
                             </v-form>
@@ -532,11 +485,10 @@
 
                 headers: [
                     {title: "{{_('ID')}}", value: "id"},
-                    {title: "{{_('Username')}}", value: "username"},
-                    {title: "{{_('Email')}}", value: "email"},
                     {title: "{{_('Name')}}", value: "name"},
-                    {title: "{{_('Access Level')}}", value: "access_level"},
-                    {title: "{{_('Groups')}}", value: "roles"},
+                    {title: "{{_('Username')}}", value: "username"},
+                    {title: "{{_('Status')}}", value: "status"},
+                    {title: "{{_('System role')}}", value: "roles"},
                     {title: "{{_('Two-Factor Authentication')}}", value: "2fa"},
                     {title: "{{_('Actions')}}", value: "action", sortable: false}
                 ],
@@ -562,11 +514,11 @@
                 changePasswordDialog: false,
                 askUserToChangePassword: true,
 
-                accessLevels: [
-                    { name: "{{ _('Disabled') }}", value: 'disabled', description: "{{ _('User cannot access Bayanat unless their access level is changed.') }}" },
-                    { name: "{{ _('Write Only') }}", value: 'write_only', description: "{{ _('Users can add items in Actors, Bulletins, and Incidents but cannot view existing database content.') }}" },
-                    { name: "{{ _('View Only') }}", value: 'view_only', description: "{{ _('Users can view items in Actors, Bulletins, and Incidents but cannot edit or add new items.') }}" },
-                    { name: "{{ _('Full Access') }}", value: 'full_access', description: "{{ _('User can view, add, and modify data in the database according to their system role.') }}" },
+                systemRoles: [
+                    { name: "{{ _('View') }}", value: 'view', description: "{{ _('Users can view items in Actors, Bulletins, and Incidents but cannot edit or add new items.') }}" },
+                    { name: "{{ _('Data Analyst') }}", value: 'da', description: "{{ _('User can view all items and edit only those assigned to them. User can review assigned items for peer review.') }}" },
+                    { name: "{{ _('Moderator') }}", value: 'mod', description: "{{ _('User can manage system data, edit assigned items, and perform bulk updates.') }}" },
+                    { name: "{{ _('Administrator') }}", value: 'admin', description: "{{ _('Full access to all items and actions, including Activity Monitor and user management across the system.') }}" },
                 ],
                 accessRoles: [
                     { name: "{{ _('Incident Access') }}", value: 'incident_access' },
@@ -637,11 +589,14 @@
 
 
             methods: {
-                getIconFromAccessLevel(level) {
-                    if (level.value === 'disabled') return 'mdi-account-cancel';
-                    if (level.value === 'view_only') return 'mdi-eye';
-                    if (level.value === 'write_only') return 'mdi-pencil';
-                    if (level.value === 'full_access') return 'mdi-account-key';
+                getUser2FaMeta(user) {
+                    if (user.two_factor_devices && user.two_factor_devices.length > 0) return { color: 'success', text: "{{ _('2FA Active') }}", icon: 'mdi-lock-check' }
+                    return { color: 'warning', text: "{{ _('2FA Inactive') }}", icon: 'mdi-lock-open-alert' }
+                },
+                getUserStatusMeta(user) {
+                    if (user.active && !user?.deleted) return { color: 'success', text: "{{ _('Active') }}", icon: 'mdi-account-check' }
+                    if (!user.active && !user?.deleted) return { color: 'warning', text: "{{ _('Suspended') }}", icon: 'mdi-account-clock' }
+                    if (!user.active && user?.deleted) return { text: "{{ _('Disabled') }}", icon: 'mdi-account-cancel' }
                 },
                 activeCount(key) {
                     const val = this.options?.[key]
@@ -692,7 +647,7 @@
 
                 showUser(user_id) {
                     api.get(`/admin/api/user/${user_id}`).then(response => {
-                        this.user = { ...response.data, access_level: this.computeAccessLevel(response.data) };
+                        this.user = response.data;
                         this.userDrawer = true;
                     }).catch(err => {
                         console.error(err);
@@ -701,7 +656,7 @@
                 },
                 refreshUser(user_id) {
                     api.get(`/admin/api/user/${user_id}`).then(response => {
-                        this.user = { ...response.data, access_level: this.computeAccessLevel(response.data) };
+                        this.user = response.data;
                     })
                 },
 
@@ -837,10 +792,7 @@
 
                     api.get(`/admin/api/users/?${params.toString()}`)
                         .then(response => {
-                            this.items = response.data.items.map(user => ({
-                                ...user,
-                                access_level: this.computeAccessLevel(user)
-                            }))
+                            this.items = response.data.items;
                             this.itemsLength = response.data.total;
                         })
                         .catch(err => {
@@ -896,10 +848,7 @@
                 editItem(item) {
                     this.userDrawer = false;
                     this.editedIndex = this.items.indexOf(item);
-                    this.editedItem = {
-                        ...item,
-                        access_level: this.computeAccessLevel(item)
-                    };
+                    this.editedItem = { ...item };
                     this.isUsernameAvailable = false;
                     this.initialUsername = item.username;
                     this.dialog = true;
@@ -948,8 +897,7 @@
 
                     this.saving = true;
 
-                    const payload = this.applyAccessLevelRules({...this.editedItem});
-                    if (payload.access_level) delete payload.access_level; // 👈 access_level is only used on frontend
+                    const payload = {...this.editedItem};
                     if (payload.access_roles) delete payload.access_roles; // 👈 TODO: Remove this line once it's supported by backend
 
                     // edit mode
@@ -1000,9 +948,12 @@
                     }
                 },
                 updateSystemRole(index) {
-                    const selectedRole = this.roles?.[index] || this.roles[0];
+                    if (index === null || index === undefined) return;
+                    const systemRole = this.systemRoles?.[index] || this.systemRoles[0];
                     if (!this.editedItem?.roles) this.editedItem.roles = []
-                    this.editedItem.roles = [selectedRole];
+                    const selectedRole = this.roles.find(r => r.name.toLowerCase() === systemRole.value.toLowerCase());
+
+                    this.editedItem.roles = systemRole ? [selectedRole] : [];
                     this.checkRoles();
                 },
                 isAccessRoleSelected(role) {
@@ -1021,55 +972,6 @@
                 searchUsers: debounce(function (evt) {
                     this.refresh({ ...this.options, q: evt })
                 }, 350),
-                updateAccessLevel(index) {
-                    if (typeof index === 'undefined') return;
-                    const selectedAccessLevel = this.accessLevels[index] || this.accessLevels[0];
-                    this.editedItem.access_level = selectedAccessLevel;
-
-                    if (selectedAccessLevel.value === 'full_access') {
-                        this.roles.find(role => {
-                            if (role.name.toLowerCase() === 'admin') {
-                                this.editedItem.roles = [role];
-                                this.checkRoles();
-                            }
-                        });
-                    } else {
-                        this.editedItem.roles = []
-                    }
-                },
-                applyAccessLevelRules(item) {
-                    const { value } = item?.access_level || {};
-
-                    if (!value || value === 'disabled') {
-                        item.active = false;
-                        item.roles = [];
-                    } else if (value === 'view_only') {
-                        item.active = true;
-                        item.roles = [];
-                    } else if (value === 'write_only') {
-                        item.active = true;
-                    } else if (value === 'full_access') {
-                        item.active = true;
-                    }
-
-                    return item
-                },
-                computeAccessLevel(user) {
-                    if (!user.active) {
-                        return { name: "Disabled", value: "disabled" };
-                    }
-
-                    const hasSystemRole = Array.isArray(user.roles) && user.roles.length > 0;
-
-                    if (hasSystemRole) {
-                        return { name: "Full Access", value: "full_access" };
-                    } else {
-                        return { name: "View Only", value: "view_only" };
-                    }
-
-                    // Future support
-                    // if (someCondition) return { name: "Write Only", value: "write_only" };
-                }
             }
         });
 
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index d60795e2c..80167dbc5 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -237,31 +237,6 @@ const UserCard = Vue.defineComponent({
         <v-card variant="flat">
           <v-card-text class="px-6">
             <v-row>
-              <v-col cols="12" sm="6" md="4">
-                <div class="mb-3 text-body-1">{{ translations.accessLevel_ }}</div>
-                <div class="d-flex flex-wrap ga-3">
-                  <template v-if="user?.access_level">
-                    <toggle-button
-                      read-only
-                      hide-left-icon
-                      :model-value="true"
-                    >
-                      <v-icon start size="large">{{ $root.getIconFromAccessLevel(user?.access_level) }}</v-icon>
-                      {{ user?.access_level?.name }}
-                    </toggle-button>
-                  </template>
-                  <template v-else>
-                    <toggle-button
-                      read-only
-                      hide-left-icon
-                      :model-value="true"
-                    >
-                      <v-icon start size="large">mdi-account-cancel</v-icon>
-                      {{ translations.disabled_ }}
-                    </toggle-button>
-                  </template>
-                </div>
-              </v-col>
               <v-col cols="12" sm="6" md="4">
                 <div class="mb-3 text-body-1">{{ translations.systemRole_ }}</div>
                 <div class="d-flex flex-wrap ga-3">

From 0d84bc2fd1564214e01de68284bf06e1786ef0a0 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 6 Nov 2025 17:40:01 -0600
Subject: [PATCH 068/180] add new translations

---
 enferno/admin/templates/admin/jsapi.jinja2 | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index eb453e219..8365354bf 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -86,13 +86,18 @@ fieldsSavedSuccessfully_: "{{ _('Fields saved successfully') }}",
 editUser_: "{{ _('Edit User') }}",
 systemRole_: "{{ _('System Role') }}",
 accessRole_: "{{ _('Access Role') }}",
+manageAccount_: "{{ _('Manage Account') }}",
 disabled_: "{{ _('Disabled') }}",
 twoFactorAuthentication_: "{{ _('Two-Factor Authentication') }}",
 youreAboutToEndThisSession_: "{{ _('You\'re about to end this session') }}",
 afterThisActionTheUserWillBeSignedOut_: "{{ _('After this action, the user will be signed out from this device. This will not affect other active sessions, user data, or settings.') }}",
 doYouWantToContinue_: "{{ _('Do you want to continue?') }}",
 endSession_: "{{ _('End Session') }}",
-viewOnly_: "{{ _('View Only') }}",
+view_: "{{ _('View') }}",
+reactivateAccount_: "{{ _('Reactivate Account') }}",
+suspendAccount_: "{{ _('Suspend Account') }}",
+enableAccount_: "{{ _('Enable Account') }}",
+disableAccount_: "{{ _('Disable Account') }}",
 
 cancel_ : "{{ _('Cancel') }}",
 titleOrTitleArRequired_ : "{{ _('Title or Title (Ar) is required') }}",
@@ -475,7 +480,7 @@ loggedOut_: "{{ _('You have been logged out. Please log in again.') }}",
 confirmLogout_: "{{ _('Are you sure you want to log out all sessions for this user?') }}",
 userPermissions_: "{{ _('User Permissions') }}",
 userTwoFactorMethods_: "{{ _('User 2FA Methods') }}",
-noTwoFactorMethods_: "{{ _('2FA Inactive') }}",
+twoFaInactive_: "{{ _('2FA Inactive') }}",
 canViewUsernames_: "{{ _('Can View Usernames') }}",
 cannotViewUsernames_: "{{ _('Cannot View Usernames') }}",
 canViewSimpleHistory_: "{{ _('Can View Simple History') }}",

From 85b729a9aa4d16ce7e5a30dfe5268a0f63c45f2f Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 6 Nov 2025 17:40:46 -0600
Subject: [PATCH 069/180] tweaks to roles sections and two fa

---
 enferno/admin/templates/admin/users.html | 62 +++++++++++++----
 enferno/static/js/components/UserCard.js | 84 ++++++++++++++----------
 2 files changed, 97 insertions(+), 49 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 8d67c3c34..5cfbe2012 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -128,7 +128,7 @@
 
                                         <v-list>
                                             <v-list-item
-                                                v-for="role in [{ 'id': 0, 'name': 'View Only'}, ...roles]"
+                                                v-for="role in [{ 'id': 0, 'name': 'View'}, ...roles]"
                                                 :key="role.id"
                                                 @click="setRoleFilters(role.id); refresh()"
                                                 :active="Boolean(options?.roles?.includes(role.id))"
@@ -246,14 +246,14 @@
                         </template>
 
                         <template v-slot:item.2fa="{ item }">
-                            <v-chip variant="text" :color="getUser2FaMeta(item)?.color" class="ma-1">
+                            <v-chip variant="text" :color="getUser2FaMeta(item)?.color" class="ma-1 font-weight-medium">
                                 <v-icon start size="large">${getUser2FaMeta(item)?.icon}</v-icon>
                                 ${getUser2FaMeta(item)?.text}
                             </v-chip>
                         </template>
 
                         <template v-slot:item.status="{ item }">
-                            <v-chip variant="text" :color="getUserStatusMeta(item)?.color" class="ma-1">
+                            <v-chip variant="text" :color="getUserStatusMeta(item)?.color" class="ma-1 font-weight-medium">
                                 <v-icon start size="large">${getUserStatusMeta(item)?.icon}</v-icon>
                                 ${getUserStatusMeta(item)?.text}
                             </v-chip>
@@ -261,7 +261,7 @@
 
                         <template v-slot:item.roles="{ item }">
                             <v-chip v-for="role in item.roles" class="ma-1">
-                                ${role.name}
+                                ${systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name}
                             </v-chip>
                         </template>
 
@@ -352,11 +352,11 @@
                                         </v-row>
 
                                         <v-row>
-                                            <v-col cols="12" md="6">
+                                            <v-col cols="12" lg="6">
                                                 <div class="mb-3 text-body-1">{{ _('System Role') }}</div>
                                                 <div class="d-flex flex-wrap ga-3 mb-7">
                                                     <v-btn-toggle
-                                                        :model-value="Math.max(systemRoles.findIndex(role => editedItem?.roles?.some(r => r?.name?.toLowerCase?.() === role?.value?.toLowerCase?.())), 0)"
+                                                        :model-value="selectedRoleIndex"
                                                         @update:model-value="updateSystemRole($event)"
                                                         variant="outlined"
                                                         divided
@@ -364,10 +364,10 @@
                                                     >
                                                         <v-btn v-for="(role) in systemRoles" :key="role?.value">${role.name}</v-btn>
                                                     </v-btn-toggle>
-                                                    <div class="text-caption text-medium-emphasis">${systemRoles.find(role => editedItem?.roles?.some(r => r?.name?.toLowerCase?.() === role?.value?.toLowerCase?.()))?.description || systemRoles[0]?.description}</div>
+                                                    <div class="text-caption text-medium-emphasis">${selectedRole?.description}</div>
                                                 </div>
                                             </v-col>
-                                            <v-col cols="12" md="6">
+                                            <v-col cols="12" lg="6">
                                                 <div class="mb-3 text-body-1">{{ _('Access Role') }}</div>
                                                 <div class="d-flex flex-wrap ga-3 mb-7">
                                                     <toggle-button
@@ -547,6 +547,25 @@
                 formTitle() {
                     return this.isNewUser ? "{{_('Add New User')}}" : "{{_('Edit User')}}";
                 },
+                selectedRoleIndex() {
+                    // No roles means "no role yet" → null
+                    if (!this.editedItem?.roles) return null;
+
+                    // roles = [] → View only → index 0
+                    if (this.editedItem.roles.length === 0) return 0;
+
+                    const index = this.systemRoles.findIndex(role =>
+                        this.editedItem.roles.some(r => r?.name?.toLowerCase() === role?.value?.toLowerCase())
+                    );
+
+                    // No match → View only (index 0)
+                    return index >= 0 ? index : 0;
+                },
+                selectedRole() {
+                    return this.selectedRoleIndex != null
+                        ? this.systemRoles[this.selectedRoleIndex]
+                        : null
+                }
             },
 
             created() {
@@ -947,15 +966,32 @@
                         this.saving = false;
                     }
                 },
-                updateSystemRole(index) {
+               updateSystemRole(index) {
                     if (index === null || index === undefined) return;
-                    const systemRole = this.systemRoles?.[index] || this.systemRoles[0];
-                    if (!this.editedItem?.roles) this.editedItem.roles = []
-                    const selectedRole = this.roles.find(r => r.name.toLowerCase() === systemRole.value.toLowerCase());
 
-                    this.editedItem.roles = systemRole ? [selectedRole] : [];
+                    // default to view-only
+                    const systemRole = this.systemRoles?.[index] ?? this.systemRoles[0];
+
+                    // Ensure roles array exists
+                    if (!Array.isArray(this.editedItem?.roles)) {
+                        this.editedItem.roles = [];
+                    }
+
+                    const selectedRole = this.roles?.find(
+                        r => r?.name?.toLowerCase() === systemRole?.value?.toLowerCase()
+                    );
+
+                    // If no match, treat as view-only (empty)
+                    if (!selectedRole) {
+                        this.editedItem.roles = [];
+                    } else {
+                        this.editedItem.roles = [selectedRole];
+                    }
+
+                    this.editedItem.active = true;
                     this.checkRoles();
                 },
+
                 isAccessRoleSelected(role) {
                     return this.editedItem?.access_roles?.some(r => r.value === role.value)
                 },
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 80167dbc5..620632915 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -103,6 +103,10 @@ const UserCard = Vue.defineComponent({
         },
       });
     },
+    getTwoFactorDeviceMeta(device) {
+      if (device.type === 'authenticator') return { icon: 'mdi-lock-clock', color: 'success', text: device.name };
+      return { icon: 'mdi-lock-clock', color: 'success', text: device.name };
+    },
   },
 
   data: function () {
@@ -130,9 +134,9 @@ const UserCard = Vue.defineComponent({
                     {{ user.id }}
                   </v-chip>
   
-                  <v-chip :color="user.active ? 'success' : null">
-                    <v-icon class="mr-1" size="x-large">{{ user.active ? 'mdi-account-check' : 'mdi-account-cancel'}}</v-icon>
-                    {{ user.active ? translations.active_ : translations.inactive_ }}
+                  <v-chip :color="$root.getUserStatusMeta(user)?.color">
+                    <v-icon class="mr-1" size="x-large">{{ $root.getUserStatusMeta(user)?.icon }}</v-icon>
+                    {{ $root.getUserStatusMeta(user)?.text }}
                   </v-chip>
                 </div>
     
@@ -248,7 +252,16 @@ const UserCard = Vue.defineComponent({
                       hide-left-icon
                       :model-value="true"
                     >
-                      {{ role.name }}
+                      {{ $root.systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name }}
+                    </toggle-button>
+                  </template>
+                  <template v-else>
+                    <toggle-button
+                      read-only
+                      hide-left-icon
+                      :model-value="true"
+                    >
+                      {{ translations.view_ }}
                     </toggle-button>
                   </template>
                 </div>
@@ -269,6 +282,30 @@ const UserCard = Vue.defineComponent({
                   </template>
                 </div>
               </v-col>
+              <v-col cols="12" sm="6" md="4">
+                <div class="mb-3 text-body-1">{{ translations.twoFactorAuthentication_ }}</div>
+                <div class="d-flex flex-wrap ga-3">
+                  <div
+                    v-if="user?.two_factor_devices?.length > 0"
+                    class="d-flex flex-column ga-2 font-weight-medium text-success"
+                  >
+                    <v-chip v-for="device in user.two_factor_devices" :key="device.id" :color="getTwoFactorDeviceMeta(device)?.color" variant="text" class="font-weight-medium">
+                      <v-icon start size="large">{{ getTwoFactorDeviceMeta(device)?.icon }}</v-icon>
+                      {{ getTwoFactorDeviceMeta(device)?.text }}
+                    </v-chip>
+                  </div>
+
+                  <v-chip
+                    v-else
+                    color="warning"
+                    variant="text"
+                    class="font-weight-medium"
+                  >
+                    <v-icon start size="large">mdi-lock-open-alert</v-icon>
+                    {{ translations.twoFaInactive_ }}
+                  </div>
+                </div>
+              </v-col>
             </v-row>
           </v-card-text>
         </v-card>
@@ -291,38 +328,13 @@ const UserCard = Vue.defineComponent({
 
         <v-card variant="flat">
           <v-card-text class="px-6">
-            <v-row>
-              <v-col cols="12" md="4">
-                <div class="mb-3 text-body-1">{{ translations.twoFactorAuthentication_ }}</div>
-                <div class="d-flex flex-wrap ga-3">
-                  <div
-                    v-if="user?.two_factor_devices?.length > 0"
-                    class="d-flex flex-column ga-2 font-weight-medium text-success"
-                  >
-                    <div
-                      v-for="device in user.two_factor_devices"
-                      :key="device.id"
-                      class="d-flex align-center ga-2"
-                    >
-                      <v-icon
-                        :icon="device.type === 'authenticator' ? 'mdi-lock-clock' : 'mdi-usb-flash-drive'"
-                        color="success"
-                        size="small"
-                      />
-                      {{ device.name }}
-                    </div>
-                  </div>
-
-                  <div
-                    v-else
-                    class="d-flex align-center ga-2 font-weight-medium text-warning"
-                  >
-                    <v-icon color="warning" size="small">mdi-lock-open-alert</v-icon>
-                    {{ translations.noTwoFactorMethods_ }}
-                  </div>
-                </div>
-              </v-col>
-            </v-row>
+            <div class="mb-3 text-body-1">{{ translations.manageAccount_ }}</div>
+            <div class="d-flex flex-wrap ga-3">
+              <v-btn>{{ translations.reactivateAccount_ }}</v-btn>
+              <v-btn>{{ translations.suspendAccount_ }}</v-btn>
+              <v-btn>{{ translations.enableAccount_ }}</v-btn>
+              <v-btn>{{ translations.disableAccount_ }}</v-btn>
+            </div>
           </v-card-text>
         </v-card>
 

From fae509d131c15f6ee206e9c0a2f50cb58a0f19b0 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Fri, 7 Nov 2025 13:33:05 +0400
Subject: [PATCH 070/180] enforce system role requirement for login

- override User.is_active to require at least one role
- add login form validation to log and notify admins when user without role attempts login
- users without roles cannot login and admins are notified
---
 enferno/user/forms.py  | 36 ++++++++++++++++++++++++++++++++++--
 enferno/user/models.py |  6 ++++++
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/enferno/user/forms.py b/enferno/user/forms.py
index b2d883878..883ed0e0b 100644
--- a/enferno/user/forms.py
+++ b/enferno/user/forms.py
@@ -4,10 +4,17 @@
 from flask_security.webauthn import WebAuthnRegisterForm
 from wtforms import StringField
 from wtforms.validators import ValidationError
-from enferno.admin.models import Notification
+
 from enferno.admin.constants import Constants
-from flask_wtf import RecaptchaField
+from enferno.admin.models import Notification
+from enferno.admin.models.Activity import Activity
+from enferno.extensions import db
+from enferno.user.models import User
+from enferno.utils.logging_utils import get_logger
 from enferno.utils.validation_utils import validate_password_policy, validate_webauthn_device_name
+from flask_wtf import RecaptchaField
+
+logger = get_logger()
 
 
 class ExtendedRegisterForm(RegisterForm):
@@ -23,6 +30,31 @@ def validate_password(self, field):
 class ExtendedLoginForm(LoginForm):
     recaptcha = RecaptchaField()
 
+    def validate(self, **kwargs):
+        # Log and notify admins when user without role attempts login
+        if self.username.data:
+            user = db.session.execute(
+                db.select(User).filter(User.username == self.username.data)
+            ).scalar_one_or_none()
+
+            # Active user with no roles - will be blocked by is_active property
+            if user and user.active and not user.roles:
+                logger.warning(f"User {user.username} blocked - no system role")
+
+                Activity.create(
+                    user_id=user.id,
+                    action="Login blocked - no system role",
+                    details=f"User attempted login without assigned role",
+                )
+
+                Notification.send_admin_notification_for_event(
+                    Constants.NotificationEvent.GENERAL,
+                    "User Login Blocked - No System Role",
+                    f"{user.username} attempted login without assigned role. Please assign appropriate role.",
+                )
+
+        return super().validate(**kwargs)
+
 
 class SanitizedWebAuthnRegisterForm(WebAuthnRegisterForm):
     """Custom WebAuthn registration form with plain text validation for device names"""
diff --git a/enferno/user/models.py b/enferno/user/models.py
index 3b15a4473..5d616892d 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -181,6 +181,12 @@ class User(UserMixin, db.Model, BaseMixin):
         "Role", secondary=roles_users, backref=db.backref("users", lazy="dynamic")
     )
 
+    @property
+    def is_active(self):
+        """User is active only if active flag is True AND user has at least one role."""
+        # Require both active=True and at least one role
+        return self.active and len(self.roles) > 0
+
     # email confirmation
     confirmed_at = db.Column(db.DateTime())
     # tracking

From 983eadbd13d600f5867e5d60ad1ee3ef123c202c Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Fri, 7 Nov 2025 13:35:09 +0400
Subject: [PATCH 071/180] add database migration for system roles refactor

- rename Mod to Moderator and DA to Analyst
- add new View role with read-only permissions
- assign View role to active users without roles to prevent lockout
---
 .../20251105_225708_refactor_system_roles.sql | 27 +++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/enferno/migrations/20251105_225708_refactor_system_roles.sql b/enferno/migrations/20251105_225708_refactor_system_roles.sql
index b0c6335bc..bbe6a27f6 100644
--- a/enferno/migrations/20251105_225708_refactor_system_roles.sql
+++ b/enferno/migrations/20251105_225708_refactor_system_roles.sql
@@ -1,5 +1,5 @@
 -- Migration: Refactor System Roles
--- Add new 'View' role and rename existing system roles
+-- Add new 'View' role, rename existing system roles, and assign View role to users without roles
 
 -- 1. Rename existing roles
 UPDATE role SET name = 'Moderator' WHERE name = 'Mod';
@@ -10,12 +10,35 @@ INSERT INTO role (name, description, view_simple_history, view_bulletin, edit_bu
 VALUES ('View', 'System Role', true, true, false, false)
 ON CONFLICT DO NOTHING;
 
--- Verify changes and display the results
+-- 3. Assign View role to active users without any roles
+INSERT INTO roles_users (user_id, role_id)
+SELECT u.id, r.id
+FROM "user" u
+CROSS JOIN role r
+WHERE r.name = 'View'
+  AND u.active = true
+  AND NOT EXISTS (
+    SELECT 1 FROM roles_users ru WHERE ru.user_id = u.id
+  );
+
+-- Verify changes
 SELECT id, name, description FROM role ORDER BY id;
+SELECT u.id, u.username, u.active, COUNT(ru.role_id) as role_count
+FROM "user" u
+LEFT JOIN roles_users ru ON u.id = ru.user_id
+GROUP BY u.id, u.username, u.active
+ORDER BY role_count, u.id;
 
 -- Rollback script:
 /*
 UPDATE role SET name = 'Mod' WHERE name = 'Moderator';
 UPDATE role SET name = 'DA' WHERE name = 'Analyst';
+DELETE FROM roles_users
+WHERE role_id = (SELECT id FROM role WHERE name = 'View')
+  AND user_id IN (
+    SELECT u.id FROM "user" u
+    WHERE u.active = true
+    AND (SELECT COUNT(*) FROM roles_users WHERE user_id = u.id) = 1
+  );
 DELETE FROM role WHERE name = 'View';
 */

From 34232128d21d515fac42b8b7be5dd8641f2b21e0 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Fri, 7 Nov 2025 13:41:31 +0400
Subject: [PATCH 072/180] update role names in decorators

rename 'Mod' to 'Moderator' and 'DA' to 'Analyst' in all role decorators
---
 enferno/admin/views.py         | 84 +++++++++++++++++-----------------
 enferno/deduplication/views.py |  2 +-
 2 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index dd6dc5956..ae4ff8835 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -245,7 +245,7 @@ def ctx() -> dict:
 
 # Labels routes
 @admin.route("/labels/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 def labels() -> str:
     """
     Endpoint to render the labels backend page.
@@ -312,7 +312,7 @@ def api_labels() -> Response:
 
 
 @admin.post("/api/label/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(LabelRequestModel)
 def api_label_create(
     validated_data: dict,
@@ -342,7 +342,7 @@ def api_label_create(
 
 
 @admin.put("/api/label/<int:id>")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(LabelRequestModel)
 def api_label_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -418,7 +418,7 @@ def api_label_import() -> str:
 
 # EventType routes
 @admin.route("/eventtypes/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 def eventtypes() -> str:
     """
     Endpoint to render event types backend
@@ -462,7 +462,7 @@ def api_eventtypes() -> Response:
 
 
 @admin.post("/api/eventtype/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(EventtypeRequestModel)
 def api_eventtype_create(
     validated_data: dict,
@@ -495,7 +495,7 @@ def api_eventtype_create(
 
 
 @admin.put("/api/eventtype/<int:id>")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(EventtypeRequestModel)
 def api_eventtype_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -609,7 +609,7 @@ def api_potentialviolations(page: int) -> Response:
 
 
 @admin.post("/api/potentialviolation/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(PotentialViolationRequestModel)
 def api_potentialviolation_create(
     validated_data: dict,
@@ -642,7 +642,7 @@ def api_potentialviolation_create(
 
 
 @admin.put("/api/potentialviolation/<int:id>")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(PotentialViolationRequestModel)
 def api_potentialviolation_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -755,7 +755,7 @@ def api_claimedviolations(page: int) -> Response:
 
 
 @admin.post("/api/claimedviolation/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(ClaimedViolationRequestModel)
 def api_claimedviolation_create(
     validated_data: dict,
@@ -788,7 +788,7 @@ def api_claimedviolation_create(
 
 
 @admin.put("/api/claimedviolation/<int:id>")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(ClaimedViolationRequestModel)
 def api_claimedviolation_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -873,7 +873,7 @@ def api_claimedviolation_import() -> Response:
 
 # Sources routes
 @admin.route("/sources/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 def sources() -> str:
     """
     Endpoint to render sources backend page.
@@ -921,7 +921,7 @@ def api_sources() -> Response:
 
 
 @admin.post("/api/source/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(SourceRequestModel)
 def api_source_create(
     validated_data: dict,
@@ -953,7 +953,7 @@ def api_source_create(
 
 
 @admin.put("/api/source/<int:id>")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(SourceRequestModel)
 def api_source_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -1041,7 +1041,7 @@ def api_source_import() -> Response:
 
 @admin.route("/locations/", defaults={"id": None})
 @admin.route("/locations/<int:id>")
-@roles_accepted("Admin", "Mod", "DA")
+@roles_accepted("Admin", "Moderator", "Analyst")
 def locations(id: Optional[t.id]) -> str:
     """
     Endpoint for locations management.
@@ -1090,7 +1090,7 @@ def api_locations(validated_data: dict) -> Response:
 
 
 @admin.post("/api/location/")
-@roles_accepted("Admin", "Mod", "DA")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(LocationRequestModel)
 def api_location_create(
     validated_data: dict,
@@ -1104,7 +1104,7 @@ def api_location_create(
     Returns:
         - success/error string based on the operation result.
     """
-    if not current_user.roles_in(["Admin", "Mod"]) and not current_user.can_edit_locations:
+    if not current_user.roles_in(["Admin", "Moderator"]) and not current_user.can_edit_locations:
         return HTTPResponse.forbidden("User not allowed to create Locations")
 
     location = Location()
@@ -1127,7 +1127,7 @@ def api_location_create(
 
 
 @admin.put("/api/location/<int:id>")
-@roles_accepted("Admin", "Mod", "DA")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(LocationRequestModel)
 def api_location_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -1140,7 +1140,7 @@ def api_location_update(id: t.id, validated_data: dict) -> Response:
     Returns:
         - success/error string based on the operation result.
     """
-    if not current_user.roles_in(["Admin", "Mod"]) and not current_user.can_edit_locations:
+    if not current_user.roles_in(["Admin", "Moderator"]) and not current_user.can_edit_locations:
         return HTTPResponse.forbidden("User not allowed to create Locations")
 
     location = Location.query.get(id)
@@ -3280,7 +3280,7 @@ def api_bulletins(validated_data: dict) -> Response:
 
 
 @admin.post("/api/bulletin/")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @can_assign_roles
 @validate_with(BulletinRequestModel)
 def api_bulletin_create(
@@ -3327,7 +3327,7 @@ def api_bulletin_create(
 
 
 @admin.put("/api/bulletin/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(BulletinRequestModel)
 def api_bulletin_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -3397,7 +3397,7 @@ def api_bulletin_update(id: t.id, validated_data: dict) -> Response:
 
 # Add/Update review bulletin endpoint
 @admin.put("/api/bulletin/review/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(BulletinReviewRequestModel)
 def api_bulletin_review_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -3476,7 +3476,7 @@ def api_bulletin_review_update(id: t.id, validated_data: dict) -> Response:
 
 # bulk update bulletin endpoint
 @admin.put("/api/bulletin/bulk/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(BulletinBulkUpdateRequestModel)
 def api_bulletin_bulk_update(
     validated_data: dict,
@@ -3624,7 +3624,7 @@ def api_bulletin_import() -> Response:
 
 
 @admin.put("/api/bulletin/assign/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(BulletinSelfAssignRequestModel)
 def api_bulletin_self_assign(id: t.id, validated_data: dict) -> Response:
     """
@@ -3690,7 +3690,7 @@ def api_bulletin_self_assign(id: t.id, validated_data: dict) -> Response:
 
 
 @admin.put("/api/actor/assign/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(ActorSelfAssignRequestModel)
 def api_actor_self_assign(id: t.id, validated_data: dict) -> Response:
     """
@@ -3747,7 +3747,7 @@ def api_actor_self_assign(id: t.id, validated_data: dict) -> Response:
 
 
 @admin.put("/api/incident/assign/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(IncidentSelfAssignRequestModel)
 def api_incident_self_assign(id: t.id, validated_data: dict) -> Response:
     """
@@ -3811,7 +3811,7 @@ def api_incident_self_assign(id: t.id, validated_data: dict) -> Response:
 
 
 @admin.post("/api/media/chunk")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 def api_medias_chunk() -> Response:
     """
     Endpoint for uploading media files based on file system settings.
@@ -3931,7 +3931,7 @@ def api_medias_chunk() -> Response:
 
 
 @admin.post("/api/media/upload/")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 def api_medias_upload() -> Response:
     """
     Endpoint to upload screenshots based on file system settings.
@@ -4126,7 +4126,7 @@ def api_local_serve_media(
 
 
 @admin.post("/api/inline/upload")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 def api_inline_medias_upload() -> Response:
     """
     Endpoint to upload inline media files.
@@ -4167,7 +4167,7 @@ def api_local_serve_inline_media(filename: str) -> Response:
 
 
 @admin.put("/api/media/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(MediaRequestModel)
 def api_media_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -4372,7 +4372,7 @@ def api_actors(validated_data: dict) -> Response:
 
 # create actor endpoint
 @admin.post("/api/actor/")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(ActorRequestModel)
 @can_assign_roles
 def api_actor_create(
@@ -4418,7 +4418,7 @@ def api_actor_create(
 
 # update actor endpoint
 @admin.put("/api/actor/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(ActorRequestModel)
 def api_actor_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -4492,7 +4492,7 @@ def api_actor_update(id: t.id, validated_data: dict) -> Response:
 
 # Add/Update review actor endpoint
 @admin.put("/api/actor/review/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(ActorReviewRequestModel)
 def api_actor_review_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -4558,7 +4558,7 @@ def api_actor_review_update(id: t.id, validated_data: dict) -> Response:
 
 # bulk update actor endpoint
 @admin.put("/api/actor/bulk/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(ActorBulkUpdateRequestModel)
 def api_actor_bulk_update(
     validated_data: dict,
@@ -4887,7 +4887,7 @@ def api_userhistory(userid: t.id) -> Response:
 
 
 @admin.route("/api/users/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 def api_users() -> Response:
     """
     API endpoint to feed users data in json format , supports paging and search.
@@ -5637,7 +5637,7 @@ def api_role_update(id: t.id, validated_data: dict) -> Response:
     if role is None:
         return HTTPResponse.not_found("Role not found")
 
-    if role.name in ["Admin", "Mod", "DA"]:
+    if role.name in ["Admin", "Moderator", "Analyst"]:
         return HTTPResponse.forbidden("Cannot edit System Roles")
 
     role = role.from_json(validated_data["item"])
@@ -5669,7 +5669,7 @@ def api_role_delete(
         return HTTPResponse.not_found("Role not found")
 
     # forbid deleting system roles
-    if role.name in ["Admin", "Mod", "DA"]:
+    if role.name in ["Admin", "Moderator", "Analyst"]:
         return HTTPResponse.forbidden("Cannot delete System Roles")
     # forbid delete roles assigned to restricted items
     if role.bulletins.first() or role.actors.first() or role.incidents.first():
@@ -5876,7 +5876,7 @@ def api_incidents(validated_data: dict) -> Response:
 
 
 @admin.post("/api/incident/")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @can_assign_roles
 @validate_with(IncidentRequestModel)
 def api_incident_create(
@@ -5926,7 +5926,7 @@ def api_incident_create(
 
 # update incident endpoint
 @admin.put("/api/incident/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(IncidentRequestModel)
 def api_incident_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -6002,7 +6002,7 @@ def api_incident_update(id: t.id, validated_data: dict) -> Response:
 
 # Add/Update review incident endpoint
 @admin.put("/api/incident/review/<int:id>")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(IncidentReviewRequestModel)
 def api_incident_review_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -6067,7 +6067,7 @@ def api_incident_review_update(id: t.id, validated_data: dict) -> Response:
 
 # bulk update incident endpoint
 @admin.put("/api/incident/bulk/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 @validate_with(IncidentBulkUpdateRequestModel)
 def api_incident_bulk_update(
     validated_data: dict,
@@ -6282,7 +6282,7 @@ def api_activities(validated_data: dict) -> Response:
 
 
 @admin.route("/api/bulk/status/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 def bulk_status() -> Response:
     """Endpoint to get status update about background bulk operations."""
     uid = current_user.id
@@ -6793,7 +6793,7 @@ def api_mark_all_notifications_read():
 
 
 @admin.post("/api/bulletin/web")
-@roles_accepted("Admin", "DA")
+@roles_accepted("Admin", "Analyst")
 @validate_with(WebImportValidationModel)
 def api_bulletin_web_import(validated_data: dict) -> Response:
     """Import bulletin from web URL"""
diff --git a/enferno/deduplication/views.py b/enferno/deduplication/views.py
index 90b23474b..165c0368b 100644
--- a/enferno/deduplication/views.py
+++ b/enferno/deduplication/views.py
@@ -48,7 +48,7 @@ def deduplication_app_context() -> dict:
 
 
 @deduplication.route("/dashboard/")
-@roles_accepted("Admin", "Mod")
+@roles_accepted("Admin", "Moderator")
 def deduplication_dash() -> str:
     """
     Endpoint for rendering deduplication dashboard page.

From 97c7a29b51d155b114a9e7bfdc5bd17c9946b4cc Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Fri, 7 Nov 2025 13:42:05 +0400
Subject: [PATCH 073/180] update role names in templates

update all has_role() and roles_in() calls to use new role names (Moderator, Analyst)
---
 enferno/admin/templates/admin/actors.html     | 8 ++++----
 enferno/admin/templates/admin/bulletins.html  | 8 ++++----
 enferno/admin/templates/admin/eventtypes.html | 2 +-
 enferno/admin/templates/admin/incidents.html  | 8 ++++----
 enferno/admin/templates/admin/labels.html     | 2 +-
 enferno/admin/templates/admin/locations.html  | 4 ++--
 enferno/admin/templates/admin/sources.html    | 2 +-
 enferno/templates/nav-drawer.html             | 6 +++---
 8 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/enferno/admin/templates/admin/actors.html b/enferno/admin/templates/admin/actors.html
index d9b648bb1..2cbb0a453 100644
--- a/enferno/admin/templates/admin/actors.html
+++ b/enferno/admin/templates/admin/actors.html
@@ -84,7 +84,7 @@
 
 
                                 <v-spacer></v-spacer>
-                                {% if current_user.roles_in(['Admin','DA']) %}
+                                {% if current_user.roles_in(['Admin','Analyst']) %}
                                     <v-btn @click="editItem" color="primary" variant="elevated"
                                            class="ma-2">{{ _('New Actor') }}</v-btn>
                                 {% endif %}
@@ -567,7 +567,7 @@
                     {title: "{{_('ID')}}", value: "id", width: 12, sortable: false},
                     {title: "{{_('Type')}}", value: "type", width: 20, sortable: false},
                     {title: "{{_('Name')}}", value: "name", width: 300, sortable: false},
-                    {% if (current_user.has_role('Admin') or current_user.has_role('DA')) %}
+                    {% if (current_user.has_role('Admin') or current_user.has_role('Analyst')) %}
                         {title: "{{_('Assigned To')}}", value: "assigned_to.name", width: 130, sortable: false},
                         {title: "{{_('Access Groups')}}", value: "roles", width: 130, sortable: false},
                     {% endif %}
@@ -1341,7 +1341,7 @@
                 },
 
                 bulkAllowed() {
-                    return this.has_role(this.currentUser, 'Admin') || this.has_role(this.currentUser, 'Mod');
+                    return this.has_role(this.currentUser, 'Admin') || this.has_role(this.currentUser, 'Moderator');
                 },
 
                 exportAllowed() {
@@ -1365,7 +1365,7 @@
                     if (this.has_role(this.currentUser, 'Admin')) {
                         return true;
                     }
-                    if (!this.has_role(this.currentUser, 'DA')) {
+                    if (!this.has_role(this.currentUser, 'Analyst')) {
                         return false;
                     }
                     const statuses = ['Human Created', 'Assigned', 'Updated', 'Peer Reviewed', 'Revisited'];
diff --git a/enferno/admin/templates/admin/bulletins.html b/enferno/admin/templates/admin/bulletins.html
index da5cd3620..c9a194e3c 100644
--- a/enferno/admin/templates/admin/bulletins.html
+++ b/enferno/admin/templates/admin/bulletins.html
@@ -93,7 +93,7 @@
                                 ></v-text-field>
 
                                 <v-spacer></v-spacer>
-                                {% if current_user.roles_in(['Admin','DA']) %}
+                                {% if current_user.roles_in(['Admin','Analyst']) %}
                                     <v-btn
                                             @click="editItem"
                                             color="primary"
@@ -643,7 +643,7 @@
                         {title: "{{_('ID')}}", value: "id", width: 12, sortable: true},
                         {title: "{{_('Title')}}", value: "title", width: 300, sortable: false},
 
-                        {% if (current_user.has_role('Admin') or current_user.has_role('DA')) %}
+                        {% if (current_user.has_role('Admin') or current_user.has_role('Analyst')) %}
                             {title: "{{_('Assigned To')}}", value: "assigned_to.name", width: 130, sortable: false},
                             {title: "{{_('Access Groups')}}", value: "roles", width: 130, sortable: false},
                         {% endif %}
@@ -1372,7 +1372,7 @@
                         if (this.has_role(this.currentUser, 'Admin')) {
                             return true;
                         }
-                        if (this.has_role(this.currentUser, 'Mod')) {
+                        if (this.has_role(this.currentUser, 'Moderator')) {
                             return true;
                         }
                         return false;
@@ -1399,7 +1399,7 @@
                         if (this.has_role(this.currentUser, 'Admin')) {
                             return true;
                         }
-                        if (!this.has_role(this.currentUser, 'DA')) {
+                        if (!this.has_role(this.currentUser, 'Analyst')) {
                             return false;
                         }
                         const statuses = ['Human Created', 'Assigned', 'Updated', 'Peer Reviewed', 'Revisited'];
diff --git a/enferno/admin/templates/admin/eventtypes.html b/enferno/admin/templates/admin/eventtypes.html
index e98aabb79..589065370 100644
--- a/enferno/admin/templates/admin/eventtypes.html
+++ b/enferno/admin/templates/admin/eventtypes.html
@@ -212,7 +212,7 @@
                     {title: "{{_('For Actors')}}", value: "for_actor"},
                     {title: "{{_('For Bulletins')}}", value: "for_bulletin"},
                     {title: "{{_('Comments')}}", value: "comments"},
-                    {% if current_user.roles_in(['Admin','Mod']) %}
+                    {% if current_user.roles_in(['Admin','Moderator']) %}
                         {title: "{{_('Actions')}}", value: "action", sortable: false}
                     {% endif %}
                 ],
diff --git a/enferno/admin/templates/admin/incidents.html b/enferno/admin/templates/admin/incidents.html
index e277b96a1..bfd8269c3 100644
--- a/enferno/admin/templates/admin/incidents.html
+++ b/enferno/admin/templates/admin/incidents.html
@@ -84,7 +84,7 @@
 
 
                                 <v-spacer></v-spacer>
-                                {% if current_user.roles_in(['Admin','DA']) %}
+                                {% if current_user.roles_in(['Admin','Analyst']) %}
                                     <v-btn @click="editItem" color="primary" variant="elevated" class="ma-2"
                                     >{{ _('New Incident') }}</v-btn
                                     >
@@ -534,7 +534,7 @@
                 headers: [
                     {title: "{{_('ID')}}", value: "id", width: 12, sortable: false},
                     {title: "{{_('Title')}}", value: "title", width: 300, sortable: false},
-                    {% if (current_user.has_role('Admin') or current_user.has_role('DA')) %}
+                    {% if (current_user.has_role('Admin') or current_user.has_role('Analyst')) %}
                         {title: "{{_('Assigned To')}}", value: "assigned_to.name", width: 130, sortable: false},
                         {title: "{{_('Access Groups')}}", value: "roles", width: 130, sortable: false},
                     {% endif %}
@@ -1171,7 +1171,7 @@
                     if (this.has_role(this.currentUser, 'Admin')) {
                         return true;
                     }
-                    if (this.has_role(this.currentUser, 'Mod')) {
+                    if (this.has_role(this.currentUser, 'Moderator')) {
                         return true;
                     }
                     return false;
@@ -1196,7 +1196,7 @@
                     if (this.has_role(this.currentUser, 'Admin')) {
                         return true;
                     }
-                    if (!this.has_role(this.currentUser, 'DA')) {
+                    if (!this.has_role(this.currentUser, 'Analyst')) {
                         return false;
                     }
                     const statuses = ['Human Created', 'Assigned', 'Updated', 'Peer Reviewed', 'Revisited'];
diff --git a/enferno/admin/templates/admin/labels.html b/enferno/admin/templates/admin/labels.html
index a8e57061f..8377d547e 100644
--- a/enferno/admin/templates/admin/labels.html
+++ b/enferno/admin/templates/admin/labels.html
@@ -279,7 +279,7 @@
                     {title: "{{_('Actor')}}", value: "for_actor"},
                     {title: "{{_('Incident')}}", value: "for_incident"},
                     {title: "{{_('Offline')}}", value: "for_offline"},
-                    {% if current_user.roles_in(['Admin','Mod']) %}
+                    {% if current_user.roles_in(['Admin','Moderator']) %}
                         {title: "{{_('Actions')}}", value: "action", sortable: false}
                     {% endif %}
                 ],
diff --git a/enferno/admin/templates/admin/locations.html b/enferno/admin/templates/admin/locations.html
index e6d6029fb..c33858f54 100644
--- a/enferno/admin/templates/admin/locations.html
+++ b/enferno/admin/templates/admin/locations.html
@@ -210,7 +210,7 @@
                     {title: "{{_('Location Type')}}", value: "location_type.title"},
                     {title: "{{_('Admin Level')}}", value: "admin_level.title"},
 
-                    {% if current_user.roles_in(['Admin','Mod']) or current_user.can_edit_locations %}
+                    {% if current_user.roles_in(['Admin','Moderator']) or current_user.can_edit_locations %}
                         {title: "{{_('Actions')}}", value: "action", sortable: false}
                     {% endif %}
                 ],
@@ -375,7 +375,7 @@
                 editAllowed() {
                     if (this.has_role(this.currentUser, 'Admin')) {
                         return true;
-                    } else if (this.has_role(this.currentUser, 'Mod')) {
+                    } else if (this.has_role(this.currentUser, 'Moderator')) {
                         return true;
                     } else if (this.currentUser.can_edit_locations) {
                         return true
diff --git a/enferno/admin/templates/admin/sources.html b/enferno/admin/templates/admin/sources.html
index 1bd3e6e2f..c50393b95 100644
--- a/enferno/admin/templates/admin/sources.html
+++ b/enferno/admin/templates/admin/sources.html
@@ -222,7 +222,7 @@
                     {title: "{{_('Comments')}}", value: "comments"},
                     {title: "{{_('Parent')}}", value: "parent.title"},
 
-                    {% if current_user.roles_in(['Admin','Mod']) %}
+                    {% if current_user.roles_in(['Admin','Moderator']) %}
                         {title: "{{_('Actions')}}", value: "action", sortable: false}
                     {% endif %}
                 ],
diff --git a/enferno/templates/nav-drawer.html b/enferno/templates/nav-drawer.html
index 606daa013..7638967b4 100644
--- a/enferno/templates/nav-drawer.html
+++ b/enferno/templates/nav-drawer.html
@@ -9,13 +9,13 @@
         <v-list-item prepend-icon="mdi-hazard-lights" title="{{ _('Incidents') }}" href="/admin/incidents/"
                      key="incidents"></v-list-item>
 
-        {% if current_user.has_role('Admin') or current_user.has_role('Mod') or current_user.has_role('DA') %}
+        {% if current_user.has_role('Admin') or current_user.has_role('Moderator') or current_user.has_role('Analyst') %}
             <!-- Primary Data (Locations) -->
             <v-list-item prepend-icon="mdi-folder-marker" title="{{ _('Locations') }}" href="/admin/locations/"
                          key="locations"></v-list-item>
         {% endif %}
 
-        {% if current_user.has_role('Admin') or current_user.has_role('Mod') %}
+        {% if current_user.has_role('Admin') or current_user.has_role('Moderator') %}
             <v-list-item prepend-icon="mdi-google-circles-extended" title="{{ _('Sources') }}" href="/admin/sources/"
                          key="sources"></v-list-item>
 
@@ -53,7 +53,7 @@
         {% endif %}
 
         {% if deduplication %}
-            {% if current_user.has_role('Admin') or current_user.has_role('Mod') %}
+            {% if current_user.has_role('Admin') or current_user.has_role('Moderator') %}
                 <v-list-item prepend-icon="mdi-link-variant-plus" title="{{ _('Deduplication') }}"
                              href="/deduplication/dashboard/" key="deduplication"></v-list-item>
             {% endif %}

From fdff15f5c38f48d45a1e64d4dcf3a100d657036d Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 7 Nov 2025 08:51:02 -0600
Subject: [PATCH 074/180] fix typo

---
 enferno/static/js/components/UserCard.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 620632915..390e814f1 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -303,7 +303,7 @@ const UserCard = Vue.defineComponent({
                   >
                     <v-icon start size="large">mdi-lock-open-alert</v-icon>
                     {{ translations.twoFaInactive_ }}
-                  </div>
+                  </v-chip>
                 </div>
               </v-col>
             </v-row>

From 7a56bca64980d6dab441a04934bfe3483e56c911 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 7 Nov 2025 08:51:26 -0600
Subject: [PATCH 075/180] add missing key to loop and render chip if user has
 [] permissions

---
 enferno/admin/templates/admin/users.html | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 5cfbe2012..ea52a49bb 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -260,8 +260,13 @@
                         </template>
 
                         <template v-slot:item.roles="{ item }">
-                            <v-chip v-for="role in item.roles" class="ma-1">
-                                ${systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name}
+                            <template v-if="item.roles.length">
+                                <v-chip v-for="role in item.roles" :key="role.id" class="ma-1">
+                                    ${systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name}
+                                </v-chip>
+                            </template>
+                            <v-chip v-else-if="!item.deleted" class="ma-1">
+                                ${systemRoles[0].name}
                             </v-chip>
                         </template>
 

From 346c596a0053922643850c2e4e983ae564a56464 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 7 Nov 2025 13:22:17 -0600
Subject: [PATCH 076/180] move mixin declaration to top

---
 enferno/admin/templates/admin/users.html | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index ea52a49bb..067def7ce 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -477,6 +477,7 @@
 
         const app = createApp({
             delimiters: delimiters,
+            mixins: [globalMixin],
             data: () => ({
                 dialog: dialog,
                 loading: true,
@@ -539,9 +540,6 @@
                     { name: 'Inactive', value: 'false' },
                 ],
             }),
-
-            mixins: [globalMixin],
-
             computed: {
                 editedUserHasAdminRole() {
                     return this.editedItem?.roles?.some(role => role?.id === this.adminRoleId) ?? false;
@@ -595,7 +593,6 @@
 
             },
             mounted() {
-
                 if (this.$route.params.id) {
                     this.showUser(this.$route.params.id);
                 }

From da09f59d9681cdb5aac69bc4d6aa0dec6fcaaebc Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 7 Nov 2025 13:22:43 -0600
Subject: [PATCH 077/180] add reusable confirm dialog for account manipulation

---
 enferno/static/js/components/UserCard.js | 325 +++++++++++++++--------
 1 file changed, 209 insertions(+), 116 deletions(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 390e814f1..1179244bf 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -1,40 +1,87 @@
+const actionSections = {
+  suspend: {
+    title: (name) => `You're about to suspend the account for user \"${name}\"`,
+    confirmationText: (name) => `By entering your password, you will confirm the suspend action for user \"${name}\"`,
+    acceptButtonText: "Suspend Account",
+    acceptButtonColor: "warning",
+    blocks: [
+      { icon: "mdi-account-circle", title: "Intended for", description: "Temporary suspensions, such as during internal investigations or when the user is on leave." },
+      { icon: "mdi-account-key", title: "Roles and Access Removal", bullets: ["The user will no longer be able to log in to Bayanat.", "Their system roles, access permissions, and assigned items will remain unchanged."] },
+    ],
+  },
+  reactivate: {
+    title: (name) => `You're about to reactivate user \"${name}\"`,
+    confirmationText: (name) => `By entering your password, you will confirm the reactivation for user \"${name}\"`,
+    acceptButtonText: "Reactivate Account",
+    acceptButtonColor: "success",
+    blocks: [
+      { icon: "mdi-account", title: "Roles and Access Restoration", bullets: ["Previous system roles and access permissions will be restored.", "User can log in to Bayanat and perform actions allowed by their roles."] },
+      { icon: "mdi-key", title: "Profile and Contributions", bullets: ["The user will be able to view and edit items they previously had access to."] },
+    ],
+  },
+  disable: {
+    title: (name) => `You're about to disable the account for user \"${name}\"`,
+    confirmationText: (name) => `By entering your password, you will confirm the disable action for user \"${name}\"`,
+    acceptButtonText: "Disable Account",
+    acceptButtonColor: "error",
+    blocks: [
+      { icon: "mdi-account-circle", title: "Intended for", description: "Permanently ending a user's access to Bayanat, such as when they leave the organization." },
+      { icon: "mdi-account-key", title: "Roles and Access Removal", bullets: ["The user will no longer be able to log in to Bayanat.", "All system roles and access permissions will be removed.", "Items assigned to the user will be unassigned and available for reassignment."] },
+      { icon: "mdi-briefcase-clock-outline", title: "Profile and Contributions", bullets: ["The user's profile will be retained for archival purposes.", "Items created or updated by the user will remain in Bayanat.", "Activity history will continue to reflect the user's contributions."] },
+    ],
+  },
+  enable: {
+    title: (name) => `You're about to enable the account for user \"${name}\"`,
+    confirmationText: (name) => `By entering your password, you will confirm enabling the account for user \"${name}\"`,
+    acceptButtonText: "Enable Account",
+    acceptButtonColor: "success",
+    blocks: [
+      { icon: "mdi-account", title: "Roles and Access Restoration", bullets: ["The user will be able to log in once a system role is assigned.", "User can use their existing password to access Bayanat."] },
+      { icon: "mdi-key", title: "Profile and Contributions", bullets: ["The user's previous profile and contributions remain intact."] },
+    ],
+  },
+}
+
 const UserCard = Vue.defineComponent({
   props: ['user', 'closable'],
   emits: ['close', 'edit', 'resetPassword', 'revoke2fa', 'logoutAll', 'changePassword'],
-  watch: {
-    user: function (val, old) {
-      this.resetSessions();
-      this.fetchSessions();
-    },
+  components: { ConfirmDialog },
+  data() {
+    return {
+      translations: window.translations,
+      show: false,
+      sessions: [],
+      page: 1,
+      perPage: 5,
+      more: true,
+      actionSections,
+    };
   },
   computed: {
+    isUserSuspended() {
+      return !this.user.active && !this.user?.deleted;
+    },
+    isUserDisabled() {
+      return !this.user.active && this.user?.deleted;
+    },
+    isUserEnabled() {
+      return !this.user?.deleted;
+    },
     permissions() {
-      return [
-        {
-          value: this.user.view_usernames,
-          label: this.user.view_usernames ? this.translations.canViewUsernames_ : this.translations.cannotViewUsernames_
-        },
-        {
-          value: this.user.view_simple_history,
-          label: this.user.view_simple_history ? this.translations.canViewSimpleHistory_ : this.translations.cannotViewSimpleHistory_
-        },
-        {
-          value: this.user.view_full_history,
-          label: this.user.view_full_history ? this.translations.canViewFullHistory_ : this.translations.cannotViewFullHistory_
-        },
-        {
-          value: this.user.can_edit_locations,
-          label: this.user.can_edit_locations ? this.translations.canEditLocations_ : this.translations.cannotEditLocations_
-        },
-        {
-          value: this.user.can_export,
-          label: this.user.can_export ? this.translations.canExport_ : this.translations.cannotExport_
-        },
-        {
-          value: this.user.can_self_assign,
-          label: this.user.can_self_assign ? this.translations.canSelfAssign_ : this.translations.cannotSelfAssign_
-        }
+      // [permissionKey, translationIfAllowed, translationIfDenied]
+      const rows = [
+        ['view_usernames', 'canViewUsernames_', 'cannotViewUsernames_'],
+        ['view_simple_history', 'canViewSimpleHistory_', 'cannotViewSimpleHistory_'],
+        ['view_full_history', 'canViewFullHistory_', 'cannotViewFullHistory_'],
+        ['can_edit_locations', 'canEditLocations_', 'cannotEditLocations_'],
+        ['can_export', 'canExport_', 'cannotExport_'],
+        ['can_self_assign', 'canSelfAssign_', 'cannotSelfAssign_'],
       ];
+
+      return rows.map(([key, yes, no]) => ({
+        value: this.user[key],
+        label: this.user[key] ? this.translations[yes] : this.translations[no],
+      }));
     }
   },
   mounted() {
@@ -104,23 +151,67 @@ const UserCard = Vue.defineComponent({
       });
     },
     getTwoFactorDeviceMeta(device) {
-      if (device.type === 'authenticator') return { icon: 'mdi-lock-clock', color: 'success', text: device.name };
-      return { icon: 'mdi-lock-clock', color: 'success', text: device.name };
+      return { icon: device.type === 'authenticator' ? 'mdi-lock-clock' : 'mdi-usb-flash-drive', color: 'success', text: device.name };
+    },
+    openAccountDialog(mode) {
+      this.$refs.accountActionDialog.show({
+        dialogProps: { width: 691 },
+        data: { mode },
+        acceptProps: { text: actionSections[mode].acceptButtonText, color: actionSections[mode].acceptButtonColor },
+        onAccept: async () => {
+          console.log(`${mode} account...`)
+        }
+      })
     },
-  },
 
-  data: function () {
-    return {
-      translations: window.translations,
-      show: false,
-      sessions: [],
-      page: 1,
-      perPage: 5,
-      more: true,
-    };
+    suspendAccount() {
+      this.openAccountDialog("suspend");
+    },
+    disableAccount() {
+      this.openAccountDialog("disable");
+    },
+    reactivateAccount() {
+      this.openAccountDialog("reactivate");
+    },
+    enableAccount() {
+      this.openAccountDialog("enable");
+    },
+  },
+  watch: {
+    user(val, old) {
+      this.resetSessions();
+      this.fetchSessions();
+    },
   },
-
   template: `
+      <confirm-dialog ref="accountActionDialog">
+        <template #title="{ data }">
+          {{ actionSections[data.mode].title(user.name) }}
+        </template>
+        <template #default="{ data }">
+          <div class="text-body-2 mb-6 mt-3">What you should know</div>
+          <div class="d-flex flex-column ga-6">
+            <div v-for="(block, index) in actionSections[data.mode].blocks" :key="index" class="d-flex">
+              <v-avatar color="white">
+                <v-icon color="primary" size="x-large">{{ block.icon }}</v-icon>
+              </v-avatar>
+    
+              <div class="ml-3">
+                <h4 class="text-primary">{{ block.title }}</h4>
+                <div v-if="block?.description" class="text-body-2">{{ block.description }}</div>
+                <ul v-if="block?.bullets" class="text-body-2 pl-5">
+                  <li v-for="(bullet, index) in block.bullets" :key="index">{{ bullet }}</li>
+                </ul>
+              </div>
+            </div>
+          </div>
+          <div class="text-body-2 mt-6">
+            {{ actionSections[data.mode].confirmationText(user.name) }}
+            <v-text-field variant="filled" class="mt-3"></v-text-field>
+          </div>
+        </template>
+      </confirm-dialog>
+
       <v-card class="mx-auto">
         <v-sheet class="px-6 py-5 d-flex align-center">
           <v-toolbar-title>
@@ -152,7 +243,7 @@ const UserCard = Vue.defineComponent({
               </div>
 
               <v-chip
-                v-if="user.force_reset"
+                v-if="user.force_reset && isUserEnabled"
                 color="error"
                 variant="text"
                 class="font-weight-medium"
@@ -162,74 +253,76 @@ const UserCard = Vue.defineComponent({
               </v-chip>
   
               <div class="d-flex justify-space-between ga-2 align-center">
-                <v-tooltip
-                  location="bottom"
-                  :text="user.force_reset ? translations.passwordResetAlreadyRequested_ : translations.forcePasswordReset_"
-                >
-                  <template #activator="{props}">
-                    <div v-bind="props">
-                      <v-btn
-                        :disabled="user.force_reset != null"
-                        color="error"
-                        density="comfortable"
-                        icon="mdi-lock-reset"
-                        @click="$emit('resetPassword', user)"
-                      ></v-btn>
-                    </div>
-                  </template>
-                </v-tooltip>
+                <template v-if="isUserEnabled">
+                  <v-tooltip
+                    location="bottom"
+                    :text="user.force_reset ? translations.passwordResetAlreadyRequested_ : translations.forcePasswordReset_"
+                  >
+                    <template #activator="{props}">
+                      <div v-bind="props">
+                        <v-btn
+                          :disabled="user.force_reset != null"
+                          color="error"
+                          density="comfortable"
+                          icon="mdi-lock-reset"
+                          @click="$emit('resetPassword', user)"
+                        ></v-btn>
+                      </div>
+                    </template>
+                  </v-tooltip>
 
-                <v-tooltip
-                  location="bottom"
-                  :text="translations.changePassword_"
-                >
-                  <template #activator="{props}">
-                    <div v-bind="props">
-                      <v-btn
-                        :disabled="user.force_reset != null"
-                        color="warning"
-                        density="comfortable"
-                        icon="mdi-form-textbox-password"
-                        @click="$emit('changePassword', user)"
-                      ></v-btn>
-                    </div>
-                  </template>
-                </v-tooltip>
+                  <v-tooltip
+                    location="bottom"
+                    :text="translations.changePassword_"
+                  >
+                    <template #activator="{props}">
+                      <div v-bind="props">
+                        <v-btn
+                          :disabled="user.force_reset != null"
+                          color="warning"
+                          density="comfortable"
+                          icon="mdi-form-textbox-password"
+                          @click="$emit('changePassword', user)"
+                        ></v-btn>
+                      </div>
+                    </template>
+                  </v-tooltip>
 
-                <v-tooltip
-                  v-if="user.two_factor_devices && user.two_factor_devices.length > 0"
-                  location="bottom"
-                  :text="translations.revoke2fa_"
-                >
-                  <template #activator="{props}">
-                    <div v-bind="props">
-                      <v-btn
-                        
-                        @click.stop="$emit('revoke2fa', user.id)"
-                        variant="outlined"
-                        color="warning"
-                        density="comfortable"
-                        icon="mdi-lock-remove"
-                      ></v-btn>
-                    </div>
-                  </template>
-                </v-tooltip>
+                  <v-tooltip
+                    v-if="user.two_factor_devices && user.two_factor_devices.length > 0"
+                    location="bottom"
+                    :text="translations.revoke2fa_"
+                  >
+                    <template #activator="{props}">
+                      <div v-bind="props">
+                        <v-btn
+                          
+                          @click.stop="$emit('revoke2fa', user.id)"
+                          variant="outlined"
+                          color="warning"
+                          density="comfortable"
+                          icon="mdi-lock-remove"
+                        ></v-btn>
+                      </div>
+                    </template>
+                  </v-tooltip>
 
-                <v-tooltip
-                  location="bottom"
-                  :text="translations.editUser_"
-                >
-                  <template #activator="{props}">
-                    <div v-bind="props">
-                      <v-btn
-                        variant="outlined"
-                        density="comfortable"
-                        icon="mdi-pencil"
-                        @click="$emit('edit', user)"
-                      ></v-btn>
-                    </div>
-                  </template>
-                </v-tooltip>
+                  <v-tooltip
+                    location="bottom"
+                    :text="translations.editUser_"
+                  >
+                    <template #activator="{props}">
+                      <div v-bind="props">
+                        <v-btn
+                          variant="outlined"
+                          density="comfortable"
+                          icon="mdi-pencil"
+                          @click="$emit('edit', user)"
+                        ></v-btn>
+                      </div>
+                    </template>
+                  </v-tooltip>
+                </template>
 
                 <v-btn v-if="closable" size="small" variant="flat" icon="mdi-close" @click="$emit('close')"></v-btn>
               </div>
@@ -238,7 +331,7 @@ const UserCard = Vue.defineComponent({
         </v-sheet>
         <v-divider></v-divider>
 
-        <v-card variant="flat">
+        <v-card v-if="isUserEnabled" variant="flat">
           <v-card-text class="px-6">
             <v-row>
               <v-col cols="12" sm="6" md="4">
@@ -310,7 +403,7 @@ const UserCard = Vue.defineComponent({
           </v-card-text>
         </v-card>
 
-        <v-card variant="flat">
+        <v-card v-if="isUserEnabled" variant="flat">
           <v-card-text class="px-6">
             <div class="mb-3 text-body-1">{{ translations.userPermissions_ }}</div>
             <div class="d-flex flex-wrap ga-3">
@@ -330,15 +423,15 @@ const UserCard = Vue.defineComponent({
           <v-card-text class="px-6">
             <div class="mb-3 text-body-1">{{ translations.manageAccount_ }}</div>
             <div class="d-flex flex-wrap ga-3">
-              <v-btn>{{ translations.reactivateAccount_ }}</v-btn>
-              <v-btn>{{ translations.suspendAccount_ }}</v-btn>
-              <v-btn>{{ translations.enableAccount_ }}</v-btn>
-              <v-btn>{{ translations.disableAccount_ }}</v-btn>
+              <v-btn v-if="isUserSuspended" @click="reactivateAccount()" variant="outlined" color="success" prepend-icon="mdi-play-circle">{{ translations.reactivateAccount_ }}</v-btn>
+              <v-btn v-if="!isUserSuspended" @click="suspendAccount()" variant="outlined" color="warning" prepend-icon="mdi-pause-circle">{{ translations.suspendAccount_ }}</v-btn>
+              <v-btn v-if="isUserDisabled" @click="enableAccount()" variant="outlined" color="success" prepend-icon="mdi-arrow-down-thin-circle-outline">{{ translations.enableAccount_ }}</v-btn>
+              <v-btn v-if="!isUserDisabled" @click="disableAccount()" variant="outlined" color="error" prepend-icon="mdi-minus-circle">{{ translations.disableAccount_ }}</v-btn>
             </div>
           </v-card-text>
         </v-card>
 
-        <v-card class="mt-2" variant="flat">
+        <v-card v-if="isUserEnabled" class="mt-2" variant="flat">
           <v-card-text class="px-6">
             <div class="d-flex justify-space-between align-center mb-2">
               <div class="text-body-1">{{ translations.userSessions_ }}</div>

From a0ca527122afd3688ee6f07ebf382df951a7c912 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 7 Nov 2025 15:46:25 -0600
Subject: [PATCH 078/180] remove payload constant

---
 enferno/admin/templates/admin/users.html | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 067def7ce..880aac45d 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -918,12 +918,9 @@
 
                     this.saving = true;
 
-                    const payload = {...this.editedItem};
-                    if (payload.access_roles) delete payload.access_roles; // 👈 TODO: Remove this line once it's supported by backend
-
                     // edit mode
                     if (payload.id) {
-                        api.put(`/admin/api/user/`, {item: payload}, { suppressGlobalErrorHandler: true })
+                        api.put(`/admin/api/user/`, {item: this.editedItem}, { suppressGlobalErrorHandler: true })
                             .then(response => {
                                 this.refresh();
                                 this.showSnack(response.data);

From c6cacd69d4a1e15e75ed78a8818e837ab867549f Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 7 Nov 2025 15:46:39 -0600
Subject: [PATCH 079/180] allow disabling accept button from prop

---
 enferno/static/js/components/ConfirmDialog.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/enferno/static/js/components/ConfirmDialog.js b/enferno/static/js/components/ConfirmDialog.js
index c2e2224a7..c5ed90e17 100644
--- a/enferno/static/js/components/ConfirmDialog.js
+++ b/enferno/static/js/components/ConfirmDialog.js
@@ -1,4 +1,10 @@
 const ConfirmDialog = Vue.defineComponent({
+  props: {
+    disabledAccept: {
+      type: Boolean,
+      default: false,
+    }
+  },
   data() {
     return {
       translations: window.translations,
@@ -107,9 +113,10 @@ const ConfirmDialog = Vue.defineComponent({
             </v-btn>
 
             <v-btn
+              v-bind="acceptProps"
               :loading="loading"
+              :disabled="disabledAccept || acceptProps.disabled"
               @click="ok"
-              v-bind="acceptProps"
             >
               {{ acceptProps.text }}
             </v-btn>

From b560a9300d0ecf3ed00bb9afedbd508e090e85db Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 7 Nov 2025 15:47:34 -0600
Subject: [PATCH 080/180] wire up password field and account manipulation
 requests

---
 enferno/static/js/components/UserCard.js | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 1179244bf..be6f3796d 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -55,6 +55,8 @@ const UserCard = Vue.defineComponent({
       perPage: 5,
       more: true,
       actionSections,
+      showPassword: false,
+      password: '',
     };
   },
   computed: {
@@ -159,7 +161,14 @@ const UserCard = Vue.defineComponent({
         data: { mode },
         acceptProps: { text: actionSections[mode].acceptButtonText, color: actionSections[mode].acceptButtonColor },
         onAccept: async () => {
-          console.log(`${mode} account...`)
+          await api.post(`/admin/api/user/${this.user.id}/${mode}`, { password: this.password });
+          await this.$root.refreshUser(this.user.id);
+          this.showPassword = false;
+          this.password = '';
+        },
+        onReject() {
+          this.showPassword = false;
+          this.password = '';
         }
       })
     },
@@ -184,7 +193,7 @@ const UserCard = Vue.defineComponent({
     },
   },
   template: `
-      <confirm-dialog ref="accountActionDialog">
+      <confirm-dialog ref="accountActionDialog" :disabled-accept="!password">
         <template #title="{ data }">
           {{ actionSections[data.mode].title(user.name) }}
         </template>
@@ -207,7 +216,15 @@ const UserCard = Vue.defineComponent({
           </div>
           <div class="text-body-2 mt-6">
             {{ actionSections[data.mode].confirmationText(user.name) }}
-            <v-text-field variant="filled" class="mt-3"></v-text-field>
+            <v-text-field
+              v-model="password"
+              label="Confirm with your password"
+              :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
+              :type="showPassword ? 'text' : 'password'"
+              @click:append-inner="showPassword = !showPassword"
+              variant="filled"
+              class="mt-3"
+            ></v-text-field>
           </div>
         </template>
       </confirm-dialog>

From 7b86575efba53fe32b798261bfbd3b9aec9b2107 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 7 Nov 2025 19:03:17 -0600
Subject: [PATCH 081/180] initial try to merge both system and access roles
 into one array

---
 enferno/admin/templates/admin/users.html | 69 +++++++++++-------------
 enferno/static/js/components/UserCard.js |  8 +--
 2 files changed, 36 insertions(+), 41 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 880aac45d..2e0402508 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -128,7 +128,7 @@
 
                                         <v-list>
                                             <v-list-item
-                                                v-for="role in [{ 'id': 0, 'name': 'View'}, ...roles]"
+                                                v-for="role in [...roles]"
                                                 :key="role.id"
                                                 @click="setRoleFilters(role.id); refresh()"
                                                 :active="Boolean(options?.roles?.includes(role.id))"
@@ -522,15 +522,10 @@
 
                 systemRoles: [
                     { name: "{{ _('View') }}", value: 'view', description: "{{ _('Users can view items in Actors, Bulletins, and Incidents but cannot edit or add new items.') }}" },
-                    { name: "{{ _('Data Analyst') }}", value: 'da', description: "{{ _('User can view all items and edit only those assigned to them. User can review assigned items for peer review.') }}" },
-                    { name: "{{ _('Moderator') }}", value: 'mod', description: "{{ _('User can manage system data, edit assigned items, and perform bulk updates.') }}" },
+                    { name: "{{ _('Data Analyst') }}", value: 'analyst', description: "{{ _('User can view all items and edit only those assigned to them. User can review assigned items for peer review.') }}" },
+                    { name: "{{ _('Moderator') }}", value: 'moderator', description: "{{ _('User can manage system data, edit assigned items, and perform bulk updates.') }}" },
                     { name: "{{ _('Administrator') }}", value: 'admin', description: "{{ _('Full access to all items and actions, including Activity Monitor and user management across the system.') }}" },
                 ],
-                accessRoles: [
-                    { name: "{{ _('Incident Access') }}", value: 'incident_access' },
-                    { name: "{{ _('Actor Access') }}", value: 'actor_access' },
-                    { name: "{{ _('Bulletin Access') }}", value: 'bulletin_access' },
-                ],
                 accountStatusOptions: [
                     { name: 'Active', value: 'true' },
                     { name: 'Inactive', value: 'false' },
@@ -541,6 +536,18 @@
                 ],
             }),
             computed: {
+                accessRoles() {
+                    return this.roles?.filter(role => !this.systemRoles.some(systemRole => systemRole.value === role.name.toLowerCase()));
+                },
+                editedItemAccessRoles() {
+                    return this.editedItem.roles?.filter(role => this.accessRoles?.some(accessRole => accessRole.name.toLowerCase() === role.name.toLowerCase()));
+                },
+                userAccessRoles() {
+                    return this.user.roles?.filter(role => this.accessRoles?.some(accessRole => accessRole.name.toLowerCase() === role.name.toLowerCase()));
+                },
+                userSystemRoles() {
+                    return this.user.roles?.filter(role => this.systemRoles?.some(systemRole => systemRole.value.toLowerCase() === role.name.toLowerCase()));
+                },
                 editedUserHasAdminRole() {
                     return this.editedItem?.roles?.some(role => role?.id === this.adminRoleId) ?? false;
                 },
@@ -551,18 +558,11 @@
                     return this.isNewUser ? "{{_('Add New User')}}" : "{{_('Edit User')}}";
                 },
                 selectedRoleIndex() {
-                    // No roles means "no role yet" → null
-                    if (!this.editedItem?.roles) return null;
-
-                    // roles = [] → View only → index 0
-                    if (this.editedItem.roles.length === 0) return 0;
+                    if (!this.editedItem?.roles?.length) return null;
 
-                    const index = this.systemRoles.findIndex(role =>
+                    return this.systemRoles.findIndex(role =>
                         this.editedItem.roles.some(r => r?.name?.toLowerCase() === role?.value?.toLowerCase())
-                    );
-
-                    // No match → View only (index 0)
-                    return index >= 0 ? index : 0;
+                    ) || 0;
                 },
                 selectedRole() {
                     return this.selectedRoleIndex != null
@@ -791,7 +791,7 @@
                         this.editedItem.can_edit_locations = true;
                         this.editedItem.can_export = true;
                         this.editedItem.can_import_web = true;
-                        this.editedItem.access_roles = [...this.accessRoles];
+                        this.editedItem.roles = [this.roles[0], ...this.accessRoles];
                         return true;
                     }
                     return false;
@@ -919,7 +919,7 @@
                     this.saving = true;
 
                     // edit mode
-                    if (payload.id) {
+                    if (this.editedItem.id) {
                         api.put(`/admin/api/user/`, {item: this.editedItem}, { suppressGlobalErrorHandler: true })
                             .then(response => {
                                 this.refresh();
@@ -934,7 +934,7 @@
                     } else {
                         // create mode
                         axios
-                            .post("/admin/api/user/", {item: payload}, { suppressGlobalErrorHandler: true })
+                            .post("/admin/api/user/", {item: this.editedItem}, { suppressGlobalErrorHandler: true })
                             .then(response => {
                                 this.refresh();
                                 this.showSnack(response.data);
@@ -968,40 +968,35 @@
                updateSystemRole(index) {
                     if (index === null || index === undefined) return;
 
-                    // default to view-only
-                    const systemRole = this.systemRoles?.[index] ?? this.systemRoles[0];
+                    const systemRole = this.systemRoles?.[index];
 
-                    // Ensure roles array exists
-                    if (!Array.isArray(this.editedItem?.roles)) {
-                        this.editedItem.roles = [];
-                    }
+                    if (!Array.isArray(this.editedItem?.roles)) this.editedItem.roles = [];
 
                     const selectedRole = this.roles?.find(
                         r => r?.name?.toLowerCase() === systemRole?.value?.toLowerCase()
                     );
 
-                    // If no match, treat as view-only (empty)
+                    const preservedRoles = this.editedItem.roles.filter(r => this.accessRoles.some(ar => ar.name.toLowerCase() === r.name.toLowerCase()));
+
                     if (!selectedRole) {
-                        this.editedItem.roles = [];
+                        this.editedItem.roles = [...preservedRoles];
                     } else {
-                        this.editedItem.roles = [selectedRole];
+                        this.editedItem.roles = [selectedRole, ...preservedRoles];
                     }
 
                     this.editedItem.active = true;
                     this.checkRoles();
                 },
-
                 isAccessRoleSelected(role) {
-                    return this.editedItem?.access_roles?.some(r => r.value === role.value)
+                    return this.editedItemAccessRoles?.some(r => r.name === role.name)
                 },
                 toggleAccessRole(role) {
-                    if (!this.editedItem?.access_roles) this.editedItem.access_roles = []
-                    
-                    const index = this.editedItem.access_roles.findIndex(r => r.value === role.value)
+                    const index = this.editedItem.roles.findIndex(r => r.name.toLowerCase() === role.name.toLowerCase())
+                    console.log({ index });
                     if (index !== -1) {
-                        this.editedItem.access_roles.splice(index, 1) // remove
+                        this.editedItem.roles.splice(index, 1) // remove
                     } else {
-                        this.editedItem.access_roles.push(role) // add
+                        this.editedItem.roles.push(role) // add
                     }
                 },
                 searchUsers: debounce(function (evt) {
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index be6f3796d..75e64a4ae 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -354,9 +354,9 @@ const UserCard = Vue.defineComponent({
               <v-col cols="12" sm="6" md="4">
                 <div class="mb-3 text-body-1">{{ translations.systemRole_ }}</div>
                 <div class="d-flex flex-wrap ga-3">
-                  <template v-if="user.roles.length">
+                  <template v-if="$root.userSystemRoles?.length">
                     <toggle-button
-                      v-for="(role, index) in user.roles"
+                      v-for="(role, index) in $root.userSystemRoles"
                       :key="index"
                       read-only
                       hide-left-icon
@@ -379,9 +379,9 @@ const UserCard = Vue.defineComponent({
               <v-col cols="12" sm="6" md="4">
                 <div class="mb-3 text-body-1">{{ translations.accessRole_ }}</div>
                 <div class="d-flex flex-wrap ga-3">
-                  <template v-if="user?.access_roles?.length">
+                  <template v-if="$root.userAccessRoles?.length">
                     <toggle-button
-                      v-for="(role, index) in user.access_roles"
+                      v-for="(role, index) in $root.userAccessRoles"
                       :key="index"
                       read-only
                       hide-left-icon

From 4ab7d2719e801683a70e05cca2f4c41a3b7aa872 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Sat, 8 Nov 2025 14:31:49 +0400
Subject: [PATCH 082/180] Simplify is_active property to use bool for roles
 check

---
 enferno/user/models.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index 5d616892d..d5d263e27 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -184,8 +184,7 @@ class User(UserMixin, db.Model, BaseMixin):
     @property
     def is_active(self):
         """User is active only if active flag is True AND user has at least one role."""
-        # Require both active=True and at least one role
-        return self.active and len(self.roles) > 0
+        return self.active and bool(self.roles)
 
     # email confirmation
     confirmed_at = db.Column(db.DateTime())

From 4fb3aea29034fc31c7bba1794ebf93313db4eaf7 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Sat, 8 Nov 2025 14:32:09 +0400
Subject: [PATCH 083/180] Update user role names in test fixtures for clarity:
 changed 'DA' to 'Analyst' and 'Mod' to 'Moderator'.

---
 tests/conftest.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/conftest.py b/tests/conftest.py
index 7a5cd29e9..10d2084fe 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -210,8 +210,8 @@ def users(session):
     from enferno.admin.models import Activity
 
     admin_role = Role.query.filter(Role.name == "Admin").first()
-    da_role = Role.query.filter(Role.name == "DA").first()
-    mod_role = Role.query.filter(Role.name == "Mod").first()
+    da_role = Role.query.filter(Role.name == "Analyst").first()
+    mod_role = Role.query.filter(Role.name == "Moderator").first()
     admin_user = User(username="TestAdmin", password="password", active=1)
     admin_user.roles.append(admin_role)
     admin_user.name = "Admin"
@@ -223,7 +223,7 @@ def users(session):
     admin_user_sa.fs_uniquifier = uuid4().hex
     da_user = User(username="TestDA", password="password", active=1)
     da_user.roles.append(da_role)
-    da_user.name = "DA"
+    da_user.name = "Analyst"
     da_user.fs_uniquifier = uuid4().hex
     da_user_sa = User(username="TestDASA", password="password", active=1)
     da_user_sa.roles.append(da_role)
@@ -232,7 +232,7 @@ def users(session):
     da_user_sa.fs_uniquifier = uuid4().hex
     mod_user = User(username="TestMod", password="password", active=1)
     mod_user.roles.append(mod_role)
-    mod_user.name = "Mod"
+    mod_user.name = "Moderator"
     mod_user.fs_uniquifier = uuid4().hex
     mod_user_sa = User(username="TestModSA", password="password", active=1)
     mod_user_sa.roles.append(mod_role)

From 30a98418d9b6bf0fbcd05f7cb30b106db6cf73a1 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Sat, 8 Nov 2025 14:32:39 +0400
Subject: [PATCH 084/180] Update role names in test fixture to reflect current
 terminology: changed 'DA' to 'Analyst' and 'Mod' to 'Moderator'.

---
 tests/admin/test_roles.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/admin/test_roles.py b/tests/admin/test_roles.py
index 223537eb1..c859ded81 100644
--- a/tests/admin/test_roles.py
+++ b/tests/admin/test_roles.py
@@ -27,7 +27,9 @@ def create_role(session):
 
 @pytest.fixture(scope="function")
 def clean_slate_roles(session):
-    Role.query.filter(not_(Role.name.in_(["Admin", "DA", "Mod"]))).delete(synchronize_session=False)
+    Role.query.filter(not_(Role.name.in_(["Admin", "Analyst", "Moderator"]))).delete(
+        synchronize_session=False
+    )
 
 
 @pytest.fixture(scope="function")

From a4ce4bfb4212a01b3657718e53e99cefff658843 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Sat, 8 Nov 2025 16:17:40 +0400
Subject: [PATCH 085/180] Add 'deleted' field to User model serialization

---
 enferno/user/models.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index d5d263e27..cee8082ce 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -455,6 +455,7 @@ def to_compact(self) -> dict:
             "name": self.secure_name,
             "username": self.secure_username,
             "active": self.active,
+            "deleted": self.deleted,
         }
 
     def to_dict(self) -> dict:
@@ -468,6 +469,7 @@ def to_dict(self) -> dict:
             "email": self.secure_email,
             "username": self.secure_username,
             "active": self.active,
+            "deleted": self.deleted,
             "roles": [role.to_dict() for role in self.roles],
             "view_usernames": self.view_usernames,
             "view_simple_history": self.view_simple_history,

From 82a2aeb4b1932d103954b655c509016e0bcc7293 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 08:50:14 -0600
Subject: [PATCH 086/180] replace older role names with new ones

---
 enferno/admin/templates/admin/roles.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/roles.html b/enferno/admin/templates/admin/roles.html
index b1a9cf095..80c423363 100644
--- a/enferno/admin/templates/admin/roles.html
+++ b/enferno/admin/templates/admin/roles.html
@@ -170,7 +170,7 @@
 
                                 </template>
                                 <template v-slot:item.action="{ item }">
-                                    <template v-if="!['Admin','Mod','DA'].includes(item.name)">
+                                    <template v-if="!['Admin','Moderator','Analyst'].includes(item.name)">
                                         <v-icon small class="mr-2" @click="editItem(item)">
                                             mdi-pencil
                                         </v-icon>

From 60fa47752eac1a942e3881865cc50dcd59a2a326 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 08:52:25 -0600
Subject: [PATCH 087/180] Prevent user from deleting view role as it's a
 default field

---
 enferno/admin/templates/admin/roles.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/roles.html b/enferno/admin/templates/admin/roles.html
index 80c423363..9fc8e2ea2 100644
--- a/enferno/admin/templates/admin/roles.html
+++ b/enferno/admin/templates/admin/roles.html
@@ -170,7 +170,7 @@
 
                                 </template>
                                 <template v-slot:item.action="{ item }">
-                                    <template v-if="!['Admin','Moderator','Analyst'].includes(item.name)">
+                                    <template v-if="!['Admin','Moderator','Analyst','View'].includes(item.name)">
                                         <v-icon small class="mr-2" @click="editItem(item)">
                                             mdi-pencil
                                         </v-icon>

From bcec960104be74d8aa87241b287569b1ce8ade9d Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 09:31:20 -0600
Subject: [PATCH 088/180] if user is disabled hide suspended button

---
 enferno/static/js/components/UserCard.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 75e64a4ae..44f16db76 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -440,8 +440,10 @@ const UserCard = Vue.defineComponent({
           <v-card-text class="px-6">
             <div class="mb-3 text-body-1">{{ translations.manageAccount_ }}</div>
             <div class="d-flex flex-wrap ga-3">
-              <v-btn v-if="isUserSuspended" @click="reactivateAccount()" variant="outlined" color="success" prepend-icon="mdi-play-circle">{{ translations.reactivateAccount_ }}</v-btn>
-              <v-btn v-if="!isUserSuspended" @click="suspendAccount()" variant="outlined" color="warning" prepend-icon="mdi-pause-circle">{{ translations.suspendAccount_ }}</v-btn>
+              <template v-if="isUserEnabled">
+                <v-btn v-if="isUserSuspended" @click="reactivateAccount()" variant="outlined" color="success" prepend-icon="mdi-play-circle">{{ translations.reactivateAccount_ }}</v-btn>
+                <v-btn v-if="!isUserSuspended" @click="suspendAccount()" variant="outlined" color="warning" prepend-icon="mdi-pause-circle">{{ translations.suspendAccount_ }}</v-btn>
+              </template>
               <v-btn v-if="isUserDisabled" @click="enableAccount()" variant="outlined" color="success" prepend-icon="mdi-arrow-down-thin-circle-outline">{{ translations.enableAccount_ }}</v-btn>
               <v-btn v-if="!isUserDisabled" @click="disableAccount()" variant="outlined" color="error" prepend-icon="mdi-minus-circle">{{ translations.disableAccount_ }}</v-btn>
             </div>

From 4b75fdb03e33f7d3e7dd751cd92fc580e661ba12 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 09:35:04 -0600
Subject: [PATCH 089/180] change user disabled rule in computed

---
 enferno/static/js/components/UserCard.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 44f16db76..974037ebb 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -64,7 +64,7 @@ const UserCard = Vue.defineComponent({
       return !this.user.active && !this.user?.deleted;
     },
     isUserDisabled() {
-      return !this.user.active && this.user?.deleted;
+      return this.user?.deleted;
     },
     isUserEnabled() {
       return !this.user?.deleted;

From 011a64b2da8be354d6bc251dbe597c042387c515 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 09:35:57 -0600
Subject: [PATCH 090/180] tweak table and role display, remove deleted field
 before saving and update table record when refreshing user

---
 enferno/admin/templates/admin/users.html | 30 +++++++++++++++---------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 2e0402508..fce7c4068 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -184,7 +184,7 @@
 
 
                         <template v-slot:item.action="{ item }">
-                            <div class="d-flex">
+                            <div v-if="!item?.deleted" class="d-flex">
                                 <v-tooltip location="top" text="{{ _('Edit User') }}">
                                     <template #activator="{props}">
                                         <div v-bind="props" class="d-inline-block">
@@ -246,7 +246,7 @@
                         </template>
 
                         <template v-slot:item.2fa="{ item }">
-                            <v-chip variant="text" :color="getUser2FaMeta(item)?.color" class="ma-1 font-weight-medium">
+                            <v-chip v-if="!item?.deleted" variant="text" :color="getUser2FaMeta(item)?.color" class="ma-1 font-weight-medium">
                                 <v-icon start size="large">${getUser2FaMeta(item)?.icon}</v-icon>
                                 ${getUser2FaMeta(item)?.text}
                             </v-chip>
@@ -260,14 +260,11 @@
                         </template>
 
                         <template v-slot:item.roles="{ item }">
-                            <template v-if="item.roles.length">
-                                <v-chip v-for="role in item.roles" :key="role.id" class="ma-1">
+                            <template v-if="getUserSystemRoles(item).length">
+                                <v-chip v-for="role in getUserSystemRoles(item)" :key="role.id" class="ma-1">
                                     ${systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name}
                                 </v-chip>
                             </template>
-                            <v-chip v-else-if="!item.deleted" class="ma-1">
-                                ${systemRoles[0].name}
-                            </v-chip>
                         </template>
 
                         <template v-slot:no-data></template>
@@ -546,7 +543,7 @@
                     return this.user.roles?.filter(role => this.accessRoles?.some(accessRole => accessRole.name.toLowerCase() === role.name.toLowerCase()));
                 },
                 userSystemRoles() {
-                    return this.user.roles?.filter(role => this.systemRoles?.some(systemRole => systemRole.value.toLowerCase() === role.name.toLowerCase()));
+                    return this.getUserSystemRoles(this.user);
                 },
                 editedUserHasAdminRole() {
                     return this.editedItem?.roles?.some(role => role?.id === this.adminRoleId) ?? false;
@@ -610,6 +607,9 @@
 
 
             methods: {
+                getUserSystemRoles(user) {
+                    return user.roles?.filter(role => this.systemRoles?.some(systemRole => systemRole.value.toLowerCase() === role.name.toLowerCase())) ?? [];
+                },
                 getUser2FaMeta(user) {
                     if (user.two_factor_devices && user.two_factor_devices.length > 0) return { color: 'success', text: "{{ _('2FA Active') }}", icon: 'mdi-lock-check' }
                     return { color: 'warning', text: "{{ _('2FA Inactive') }}", icon: 'mdi-lock-open-alert' }
@@ -678,6 +678,12 @@
                 refreshUser(user_id) {
                     api.get(`/admin/api/user/${user_id}`).then(response => {
                         this.user = response.data;
+                        
+                        // Update existing user in the items list
+                        const index = this.items.findIndex(u => u.id === user_id);
+                        if (index !== -1) {
+                            this.items[index] = { ...this.items[index], ...response.data };
+                        }
                     })
                 },
 
@@ -917,10 +923,12 @@
                     }
 
                     this.saving = true;
+                    const payload = { ...this.editedItem };
+                    delete payload.deleted; // Remove deleted field from payload
 
                     // edit mode
-                    if (this.editedItem.id) {
-                        api.put(`/admin/api/user/`, {item: this.editedItem}, { suppressGlobalErrorHandler: true })
+                    if (payload.id) {
+                        api.put(`/admin/api/user/`, {item: payload}, { suppressGlobalErrorHandler: true })
                             .then(response => {
                                 this.refresh();
                                 this.showSnack(response.data);
@@ -934,7 +942,7 @@
                     } else {
                         // create mode
                         axios
-                            .post("/admin/api/user/", {item: this.editedItem}, { suppressGlobalErrorHandler: true })
+                            .post("/admin/api/user/", {item: payload}, { suppressGlobalErrorHandler: true })
                             .then(response => {
                                 this.refresh();
                                 this.showSnack(response.data);

From e78b54204c431121eccc4b0d8c4ddd3642c35a1d Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 09:39:40 -0600
Subject: [PATCH 091/180] remove default logic to view role

---
 enferno/static/js/components/UserCard.js | 29 ++++++++----------------
 1 file changed, 9 insertions(+), 20 deletions(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 974037ebb..3f69268cb 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -354,26 +354,15 @@ const UserCard = Vue.defineComponent({
               <v-col cols="12" sm="6" md="4">
                 <div class="mb-3 text-body-1">{{ translations.systemRole_ }}</div>
                 <div class="d-flex flex-wrap ga-3">
-                  <template v-if="$root.userSystemRoles?.length">
-                    <toggle-button
-                      v-for="(role, index) in $root.userSystemRoles"
-                      :key="index"
-                      read-only
-                      hide-left-icon
-                      :model-value="true"
-                    >
-                      {{ $root.systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name }}
-                    </toggle-button>
-                  </template>
-                  <template v-else>
-                    <toggle-button
-                      read-only
-                      hide-left-icon
-                      :model-value="true"
-                    >
-                      {{ translations.view_ }}
-                    </toggle-button>
-                  </template>
+                  <toggle-button
+                    v-for="(role, index) in $root.userSystemRoles"
+                    :key="index"
+                    read-only
+                    hide-left-icon
+                    :model-value="true"
+                  >
+                    {{ $root.systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name }}
+                  </toggle-button>
                 </div>
               </v-col>
               <v-col cols="12" sm="6" md="4">

From 0811a870660dbb87ad49f1b9b3ae6781b31c7bc1 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 09:39:53 -0600
Subject: [PATCH 092/180] remove useless template

---
 enferno/admin/templates/admin/users.html | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index fce7c4068..83c6fd23d 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -260,11 +260,9 @@
                         </template>
 
                         <template v-slot:item.roles="{ item }">
-                            <template v-if="getUserSystemRoles(item).length">
-                                <v-chip v-for="role in getUserSystemRoles(item)" :key="role.id" class="ma-1">
-                                    ${systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name}
-                                </v-chip>
-                            </template>
+                            <v-chip v-for="role in getUserSystemRoles(item)" :key="role.id" class="ma-1">
+                                ${systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name}
+                            </v-chip>
                         </template>
 
                         <template v-slot:no-data></template>

From 977f8c7e829960db1cfe5a849a448dac740944e6 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 09:51:31 -0600
Subject: [PATCH 093/180] hide x icon on toggle button when editin an admin
 user with incomplete permissions

---
 enferno/admin/templates/admin/users.html | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 83c6fd23d..3633db2a0 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -376,6 +376,7 @@
                                                         :model-value="isAccessRoleSelected(role)"
                                                         @update:model-value="toggleAccessRole(role)"
                                                         :read-only="editedUserHasAdminRole"
+                                                        :hide-left-icon="editedUserHasAdminRole"
                                                     >
                                                         ${role.name}
                                                     </toggle-button>
@@ -385,31 +386,31 @@
 
                                         <div class="mb-3 text-body-1">{{ _('User Permissions') }}<span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">{{ _('(Admins have full permissions by default)') }}</span></div>
                                         <div class="d-flex flex-wrap ga-3 mb-7">
-                                            <toggle-button v-model="editedItem.view_usernames" :read-only="editedUserHasAdminRole">
+                                            <toggle-button v-model="editedItem.view_usernames" :read-only="editedUserHasAdminRole" :hide-left-icon="editedUserHasAdminRole">
                                                 {{ _('Can View Usernames') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.view_full_history" :read-only="editedUserHasAdminRole">
+                                            <toggle-button v-model="editedItem.view_full_history" :read-only="editedUserHasAdminRole" :hide-left-icon="editedUserHasAdminRole">
                                                 {{ _('Can View Full History') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.view_simple_history" :read-only="editedUserHasAdminRole">
+                                            <toggle-button v-model="editedItem.view_simple_history" :read-only="editedUserHasAdminRole" :hide-left-icon="editedUserHasAdminRole">
                                                 {{ _('Can View Simple History') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_self_assign" :read-only="editedUserHasAdminRole">
+                                            <toggle-button v-model="editedItem.can_self_assign" :read-only="editedUserHasAdminRole" :hide-left-icon="editedUserHasAdminRole">
                                                 {{ _('Can Self-Assign') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_edit_locations" :read-only="editedUserHasAdminRole">
+                                            <toggle-button v-model="editedItem.can_edit_locations" :read-only="editedUserHasAdminRole" :hide-left-icon="editedUserHasAdminRole">
                                                 {{ _('Can Edit Locations') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_export" :read-only="editedUserHasAdminRole">
+                                            <toggle-button v-model="editedItem.can_export" :read-only="editedUserHasAdminRole" :hide-left-icon="editedUserHasAdminRole">
                                                 {{ _('Can Request Exports') }}
                                             </toggle-button>
 
-                                            <toggle-button v-model="editedItem.can_import_web" :read-only="editedUserHasAdminRole">
+                                            <toggle-button v-model="editedItem.can_import_web" :read-only="editedUserHasAdminRole" :hide-left-icon="editedUserHasAdminRole">
                                                 {{ _('Can Import From Web') }}
                                             </toggle-button>
                                         </div>
@@ -998,7 +999,6 @@
                 },
                 toggleAccessRole(role) {
                     const index = this.editedItem.roles.findIndex(r => r.name.toLowerCase() === role.name.toLowerCase())
-                    console.log({ index });
                     if (index !== -1) {
                         this.editedItem.roles.splice(index, 1) // remove
                     } else {

From 99e8c66a30f3b25ab62539334e26495eda9c8219 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 10:12:29 -0600
Subject: [PATCH 094/180] add show snack messages

---
 enferno/admin/templates/admin/jsapi.jinja2 |  4 ++++
 enferno/static/js/components/UserCard.js   | 13 +++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 8365354bf..1196ea7ae 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -98,6 +98,10 @@ reactivateAccount_: "{{ _('Reactivate Account') }}",
 suspendAccount_: "{{ _('Suspend Account') }}",
 enableAccount_: "{{ _('Enable Account') }}",
 disableAccount_: "{{ _('Disable Account') }}",
+userHasBeenSuspended_: (name) => "{{ _('User \'{name}\' has been suspended.') }}".replace("{name}", name),
+userHasBeenDisabled_: (name) => "{{ _('User \'{name}\' has been disabled.') }}".replace("{name}", name),
+userHasBeenReactivated_: (name) => "{{ _('User \'{name}\' has been reactivated.') }}".replace("{name}", name),
+userHasBeenEnabled_: (name) => "{{ _('User \'{name}\' has been enabled.') }}".replace("{name}", name),
 
 cancel_ : "{{ _('Cancel') }}",
 titleOrTitleArRequired_ : "{{ _('Title or Title (Ar) is required') }}",
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 3f69268cb..3065bdfb1 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -155,6 +155,18 @@ const UserCard = Vue.defineComponent({
     getTwoFactorDeviceMeta(device) {
       return { icon: device.type === 'authenticator' ? 'mdi-lock-clock' : 'mdi-usb-flash-drive', color: 'success', text: device.name };
     },
+    displayAccountStatusUpdatedMessage(action) {
+      switch (action) {
+        case 'suspend':
+          return this.$root.showSnack(this.translations.userHasBeenSuspended_(this.user.name));
+        case 'reactivate':
+          return this.$root.showSnack(this.translations.userHasBeenReactivated_(this.user.name));
+        case 'enable':
+          return this.$root.showSnack(this.translations.userHasBeenEnabled_(this.user.name));
+        case 'disable':
+          return this.$root.showSnack(this.translations.userHasBeenDisabled_(this.user.name));
+      }
+    },
     openAccountDialog(mode) {
       this.$refs.accountActionDialog.show({
         dialogProps: { width: 691 },
@@ -165,6 +177,7 @@ const UserCard = Vue.defineComponent({
           await this.$root.refreshUser(this.user.id);
           this.showPassword = false;
           this.password = '';
+          this.displayAccountStatusUpdatedMessage(mode);
         },
         onReject() {
           this.showPassword = false;

From e4e7490b77498396673b9935344a19fa675440f6 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 10:32:36 -0600
Subject: [PATCH 095/180] if user has no permissions, or access role, or system
 role add a message on the user card component

---
 enferno/admin/templates/admin/jsapi.jinja2 |  3 ++
 enferno/static/js/components/UserCard.js   | 35 +++++++++++++---------
 2 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 1196ea7ae..3333efb1c 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -98,6 +98,9 @@ reactivateAccount_: "{{ _('Reactivate Account') }}",
 suspendAccount_: "{{ _('Suspend Account') }}",
 enableAccount_: "{{ _('Enable Account') }}",
 disableAccount_: "{{ _('Disable Account') }}",
+assignSystemRole_: "{{ _('Assign System Role') }}",
+assignAccessRole_: "{{ _('Assign Access Role') }}",
+assignUserPermissions_: "{{ _('Assign User Permissions') }}",
 userHasBeenSuspended_: (name) => "{{ _('User \'{name}\' has been suspended.') }}".replace("{name}", name),
 userHasBeenDisabled_: (name) => "{{ _('User \'{name}\' has been disabled.') }}".replace("{name}", name),
 userHasBeenReactivated_: (name) => "{{ _('User \'{name}\' has been reactivated.') }}".replace("{name}", name),
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 3065bdfb1..e1a2ce674 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -366,7 +366,7 @@ const UserCard = Vue.defineComponent({
             <v-row>
               <v-col cols="12" sm="6" md="4">
                 <div class="mb-3 text-body-1">{{ translations.systemRole_ }}</div>
-                <div class="d-flex flex-wrap ga-3">
+                <div v-if="$root.userSystemRoles.length" class="d-flex flex-wrap ga-3">
                   <toggle-button
                     v-for="(role, index) in $root.userSystemRoles"
                     :key="index"
@@ -377,21 +377,25 @@ const UserCard = Vue.defineComponent({
                     {{ $root.systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name }}
                   </toggle-button>
                 </div>
+                <div v-else class="d-flex align-center text-disabled">
+                  <v-icon class="mr-1">mdi-alert-circle-outline</v-icon> {{ this.translations.assignSystemRole_ }}
+                </div>
               </v-col>
               <v-col cols="12" sm="6" md="4">
                 <div class="mb-3 text-body-1">{{ translations.accessRole_ }}</div>
-                <div class="d-flex flex-wrap ga-3">
-                  <template v-if="$root.userAccessRoles?.length">
-                    <toggle-button
-                      v-for="(role, index) in $root.userAccessRoles"
-                      :key="index"
-                      read-only
-                      hide-left-icon
-                      :model-value="true"
-                    >
-                      {{ role.name }}
-                    </toggle-button>
-                  </template>
+                <div v-if="$root.userAccessRoles.length" class="d-flex flex-wrap ga-3">
+                  <toggle-button
+                    v-for="(role, index) in $root.userAccessRoles"
+                    :key="index"
+                    read-only
+                    hide-left-icon
+                    :model-value="true"
+                  >
+                    {{ role.name }}
+                  </toggle-button>
+                </div>
+                <div v-else class="d-flex align-center text-disabled">
+                  <v-icon class="mr-1">mdi-alert-circle-outline</v-icon> {{ this.translations.assignAccessRole_ }}
                 </div>
               </v-col>
               <v-col cols="12" sm="6" md="4">
@@ -425,7 +429,7 @@ const UserCard = Vue.defineComponent({
         <v-card v-if="isUserEnabled" variant="flat">
           <v-card-text class="px-6">
             <div class="mb-3 text-body-1">{{ translations.userPermissions_ }}</div>
-            <div class="d-flex flex-wrap ga-3">
+            <div v-if="permissions.some(p => p.value)" class="d-flex flex-wrap ga-3">
               <toggle-button
                 v-for="(permission, index) in permissions"
                 :key="index"
@@ -435,6 +439,9 @@ const UserCard = Vue.defineComponent({
                 {{ permission.label }}
               </toggle-button>
             </div>
+            <div v-else class="d-flex align-center text-disabled">
+              <v-icon class="mr-1">mdi-alert-circle-outline</v-icon> {{ this.translations.assignUserPermissions_ }}
+            </div>
           </v-card-text>
         </v-card>
 

From 7d3920819a955643bd02ad36254518ac0d7c7ed9 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 10:41:25 -0600
Subject: [PATCH 096/180] remove deleted flag from changePassword method

---
 enferno/admin/templates/admin/users.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 3633db2a0..4bb9daac5 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -957,11 +957,13 @@
                 async changePassword() {
                     try {
                         this.saving = true;
-                        const response = await api.put(`/admin/api/user/`, { item: this.editedItem }, { suppressGlobalErrorHandler: true });
+                        const payload = { ...this.editedItem };
+                        delete payload.deleted; // Remove deleted field from payload
+                        const response = await api.put(`/admin/api/user/`, { item: payload }, { suppressGlobalErrorHandler: true });
                         this.showSnack(response.data);
 
                         if (this.askUserToChangePassword && this.editedItem?.force_reset === null) {
-                            await this.forcePasswordReset({ item: this.editedItem });
+                            await this.forcePasswordReset(payload);
                         }
 
                         await this.refresh();

From 8340c704c6d3df4c052db44f678ff5b3bef89be2 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 10:52:54 -0600
Subject: [PATCH 097/180] add quick access if user has no roles or permissions

---
 enferno/static/js/components/UserCard.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index e1a2ce674..068b9f773 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -377,9 +377,9 @@ const UserCard = Vue.defineComponent({
                     {{ $root.systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name }}
                   </toggle-button>
                 </div>
-                <div v-else class="d-flex align-center text-disabled">
+                <v-btn v-else @click="$emit('edit', user)" variant="plain" class="d-flex align-center text-disabled" style="padding: 0;">
                   <v-icon class="mr-1">mdi-alert-circle-outline</v-icon> {{ this.translations.assignSystemRole_ }}
-                </div>
+                </v-btn>
               </v-col>
               <v-col cols="12" sm="6" md="4">
                 <div class="mb-3 text-body-1">{{ translations.accessRole_ }}</div>
@@ -394,9 +394,9 @@ const UserCard = Vue.defineComponent({
                     {{ role.name }}
                   </toggle-button>
                 </div>
-                <div v-else class="d-flex align-center text-disabled">
+                <v-btn v-else @click="$emit('edit', user)" variant="plain" class="d-flex align-center text-disabled" style="padding: 0;">
                   <v-icon class="mr-1">mdi-alert-circle-outline</v-icon> {{ this.translations.assignAccessRole_ }}
-                </div>
+                </v-btn>
               </v-col>
               <v-col cols="12" sm="6" md="4">
                 <div class="mb-3 text-body-1">{{ translations.twoFactorAuthentication_ }}</div>
@@ -439,9 +439,9 @@ const UserCard = Vue.defineComponent({
                 {{ permission.label }}
               </toggle-button>
             </div>
-            <div v-else class="d-flex align-center text-disabled">
+            <v-btn v-else @click="$emit('edit', user)" variant="plain" class="d-flex align-center text-disabled" style="padding: 0;">
               <v-icon class="mr-1">mdi-alert-circle-outline</v-icon> {{ this.translations.assignUserPermissions_ }}
-            </div>
+            </v-btn>
           </v-card-text>
         </v-card>
 

From 09b7ed5d3a04eb7e999aeb387883acd7cd8ac22f Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 10:53:47 -0600
Subject: [PATCH 098/180] fix issue if user has no access roles yet

---
 enferno/admin/templates/admin/users.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 4bb9daac5..302cc1ecf 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -1000,7 +1000,8 @@
                     return this.editedItemAccessRoles?.some(r => r.name === role.name)
                 },
                 toggleAccessRole(role) {
-                    const index = this.editedItem.roles.findIndex(r => r.name.toLowerCase() === role.name.toLowerCase())
+                    if (!Array.isArray(this.editedItem.roles)) this.editedItem.roles = [];
+                    const index = this.editedItem.roles?.findIndex(r => r.name.toLowerCase() === role.name.toLowerCase())
                     if (index !== -1) {
                         this.editedItem.roles.splice(index, 1) // remove
                     } else {

From c2a2e56b68d4144211060576dbd996bcb1ab176d Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 11:47:29 -0600
Subject: [PATCH 099/180] replace password to confirm logic with username
 instead

---
 enferno/static/js/components/UserCard.js | 30 ++++++++++--------------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 068b9f773..f77d27b4a 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -1,7 +1,7 @@
 const actionSections = {
   suspend: {
     title: (name) => `You're about to suspend the account for user \"${name}\"`,
-    confirmationText: (name) => `By entering your password, you will confirm the suspend action for user \"${name}\"`,
+    confirmationText: (name) => `By entering the user\'s username, you will confirm the suspend action for user \"${name}\"`,
     acceptButtonText: "Suspend Account",
     acceptButtonColor: "warning",
     blocks: [
@@ -11,7 +11,7 @@ const actionSections = {
   },
   reactivate: {
     title: (name) => `You're about to reactivate user \"${name}\"`,
-    confirmationText: (name) => `By entering your password, you will confirm the reactivation for user \"${name}\"`,
+    confirmationText: (name) => `By entering the user\'s username, you will confirm the reactivation for user \"${name}\"`,
     acceptButtonText: "Reactivate Account",
     acceptButtonColor: "success",
     blocks: [
@@ -21,7 +21,7 @@ const actionSections = {
   },
   disable: {
     title: (name) => `You're about to disable the account for user \"${name}\"`,
-    confirmationText: (name) => `By entering your password, you will confirm the disable action for user \"${name}\"`,
+    confirmationText: (name) => `By entering the user\'s username, you will confirm the disable action for user \"${name}\"`,
     acceptButtonText: "Disable Account",
     acceptButtonColor: "error",
     blocks: [
@@ -32,7 +32,7 @@ const actionSections = {
   },
   enable: {
     title: (name) => `You're about to enable the account for user \"${name}\"`,
-    confirmationText: (name) => `By entering your password, you will confirm enabling the account for user \"${name}\"`,
+    confirmationText: (name) => `By entering the user\'s username, you will confirm enabling the account for user \"${name}\"`,
     acceptButtonText: "Enable Account",
     acceptButtonColor: "success",
     blocks: [
@@ -55,8 +55,7 @@ const UserCard = Vue.defineComponent({
       perPage: 5,
       more: true,
       actionSections,
-      showPassword: false,
-      password: '',
+      username: '',
     };
   },
   computed: {
@@ -173,15 +172,13 @@ const UserCard = Vue.defineComponent({
         data: { mode },
         acceptProps: { text: actionSections[mode].acceptButtonText, color: actionSections[mode].acceptButtonColor },
         onAccept: async () => {
-          await api.post(`/admin/api/user/${this.user.id}/${mode}`, { password: this.password });
+          await api.post(`/admin/api/user/${this.user.id}/${mode}`);
           await this.$root.refreshUser(this.user.id);
-          this.showPassword = false;
-          this.password = '';
+          this.username = '';
           this.displayAccountStatusUpdatedMessage(mode);
         },
         onReject() {
-          this.showPassword = false;
-          this.password = '';
+          this.username = '';
         }
       })
     },
@@ -206,7 +203,7 @@ const UserCard = Vue.defineComponent({
     },
   },
   template: `
-      <confirm-dialog ref="accountActionDialog" :disabled-accept="!password">
+      <confirm-dialog ref="accountActionDialog" :disabled-accept="username !== user.username">
         <template #title="{ data }">
           {{ actionSections[data.mode].title(user.name) }}
         </template>
@@ -228,13 +225,10 @@ const UserCard = Vue.defineComponent({
             </div>
           </div>
           <div class="text-body-2 mt-6">
-            {{ actionSections[data.mode].confirmationText(user.name) }}
+            {{ actionSections[data.mode].confirmationText(user.username) }}
             <v-text-field
-              v-model="password"
-              label="Confirm with your password"
-              :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
-              :type="showPassword ? 'text' : 'password'"
-              @click:append-inner="showPassword = !showPassword"
+              v-model="username"
+              label="Enter username to confirm"
               variant="filled"
               class="mt-3"
             ></v-text-field>

From 5040b794a09adc1371386be8b99a9089a876e1c4 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 12:06:00 -0600
Subject: [PATCH 100/180] expose current user id

---
 enferno/templates/layout.html | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/enferno/templates/layout.html b/enferno/templates/layout.html
index 29407d433..10afa8412 100644
--- a/enferno/templates/layout.html
+++ b/enferno/templates/layout.html
@@ -88,6 +88,7 @@
         class="d-none"
         data-settings='{{ current_user.settings|tojson if current_user.settings else '{}' }}'
         data-username="{{ current_user.username|escape }}"
+        data-user-id="{{ current_user.id }}"
     ></div>
 {% else %}
     <div class="d-none" data-settings='{}' data-username=""></div>
@@ -95,6 +96,7 @@
 <div class="d-none" data-lang='{{ session.get('lang','en') }}'></div>
 <div class="d-none" data-maps-api-endpoint='{{ config.MAPS_API_ENDPOINT }}'></div>
 <script>
+    window.__userId__ = Number(document.querySelector('[data-user-id]').dataset.userId);
     window.__username__ = document.querySelector('[data-username]').dataset.username;
     window.__settings__ = JSON.parse(document.querySelector('[data-settings]').dataset.settings);
     window.__lang__ = document.querySelector('[data-lang]').dataset.lang;

From 8918e90878a234a284ae2fa695ec30bf4b512345 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 10 Nov 2025 12:06:41 -0600
Subject: [PATCH 101/180] hide account manipulation buttons if it's from the
 currently signed in user

---
 enferno/admin/templates/admin/users.html |  87 ++++++++--------
 enferno/static/js/components/UserCard.js | 124 ++++++++++++-----------
 2 files changed, 109 insertions(+), 102 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 302cc1ecf..a9f049ad6 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -197,51 +197,53 @@
                                         </div>
                                     </template>
                                 </v-tooltip>
-                                <v-tooltip
-                                    location="top"
-                                    text="{{ _('Change Password') }}"
-                                >
-                                    <template #activator="{props}">
-                                        <div v-bind="props">
-                                        <v-btn
-                                            density="comfortable"
-                                            variant="plain"
-                                            icon="mdi-form-textbox-password"
-                                            @click.stop="openChangePasswordDialog(item)"
-                                        ></v-btn>
-                                        </div>
-                                    </template>
-                                </v-tooltip>
-                                <v-tooltip location="top"
-                                        :text="item.force_reset ? '{{ _('Password reset already requested.') }}' : '{{ _('Force Password Reset') }}'">
-                                    <template #activator="{props}">
-                                        <div v-bind="props" class="d-inline-block">
+                                <template v-if="userId !== item.id">
+                                    <v-tooltip
+                                        location="top"
+                                        text="{{ _('Change Password') }}"
+                                    >
+                                        <template #activator="{props}">
+                                            <div v-bind="props">
                                             <v-btn
-                                                :disabled="item.force_reset != null"
-                                                @click.stop="openForcePasswordResetDialog(item)"
+                                                density="comfortable"
                                                 variant="plain"
-                                                size="small"
-                                                icon="mdi-lock-reset">
-                                            </v-btn>
-                                            <v-icon v-if="item.force_reset" class="ml-n3" color="error">mdi-exclamation-thick</v-icon>
-                                        </div>
-                                    </template>
-                                </v-tooltip>
+                                                icon="mdi-form-textbox-password"
+                                                @click.stop="openChangePasswordDialog(item)"
+                                            ></v-btn>
+                                            </div>
+                                        </template>
+                                    </v-tooltip>
+                                    <v-tooltip location="top"
+                                            :text="item.force_reset ? '{{ _('Password reset already requested.') }}' : '{{ _('Force Password Reset') }}'">
+                                        <template #activator="{props}">
+                                            <div v-bind="props" class="d-inline-block">
+                                                <v-btn
+                                                    :disabled="item.force_reset != null"
+                                                    @click.stop="openForcePasswordResetDialog(item)"
+                                                    variant="plain"
+                                                    size="small"
+                                                    icon="mdi-lock-reset">
+                                                </v-btn>
+                                                <v-icon v-if="item.force_reset" class="ml-n3" color="error">mdi-exclamation-thick</v-icon>
+                                            </div>
+                                        </template>
+                                    </v-tooltip>
 
-                                <v-tooltip location="top"
-                                        v-if="item?.two_factor_devices?.length > 0"
-                                        :text="'{{ _('Revoke 2FA') }}'">
-                                    <template #activator="{props}">
-                                        <v-btn
-                                                @click.stop="openRevoke2FADialog(item.id)"
-                                                variant="plain"
-                                                v-bind="props"
-                                                size="small"
-                                                icon="mdi-lock-remove">
-                                        </v-btn>
-                                        
-                                    </template>
-                                </v-tooltip>
+                                    <v-tooltip location="top"
+                                            v-if="item?.two_factor_devices?.length > 0"
+                                            :text="'{{ _('Revoke 2FA') }}'">
+                                        <template #activator="{props}">
+                                            <v-btn
+                                                    @click.stop="openRevoke2FADialog(item.id)"
+                                                    variant="plain"
+                                                    v-bind="props"
+                                                    size="small"
+                                                    icon="mdi-lock-remove">
+                                            </v-btn>
+                                            
+                                        </template>
+                                    </v-tooltip>
+                                </template>
                             </div>
                         </template>
 
@@ -475,6 +477,7 @@
             delimiters: delimiters,
             mixins: [globalMixin],
             data: () => ({
+                userId: window.__userId__,
                 dialog: dialog,
                 loading: true,
                 saving: false,
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index f77d27b4a..0c6c852c4 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -266,70 +266,74 @@ const UserCard = Vue.defineComponent({
                 </div>
               </div>
 
-              <v-chip
-                v-if="user.force_reset && isUserEnabled"
-                color="error"
-                variant="text"
-                class="font-weight-medium"
-              >
-                <v-icon size="x-large">mdi-exclamation</v-icon>
-                {{ translations.passwordResetRequested_ }}
-              </v-chip>
+              <template v-if="$root.userId !== user.id">
+                <v-chip
+                  v-if="user.force_reset && isUserEnabled"
+                  color="error"
+                  variant="text"
+                  class="font-weight-medium"
+                >
+                  <v-icon size="x-large">mdi-exclamation</v-icon>
+                  {{ translations.passwordResetRequested_ }}
+                </v-chip>
+              </template>
   
               <div class="d-flex justify-space-between ga-2 align-center">
                 <template v-if="isUserEnabled">
-                  <v-tooltip
-                    location="bottom"
-                    :text="user.force_reset ? translations.passwordResetAlreadyRequested_ : translations.forcePasswordReset_"
-                  >
-                    <template #activator="{props}">
-                      <div v-bind="props">
-                        <v-btn
-                          :disabled="user.force_reset != null"
-                          color="error"
-                          density="comfortable"
-                          icon="mdi-lock-reset"
-                          @click="$emit('resetPassword', user)"
-                        ></v-btn>
-                      </div>
-                    </template>
-                  </v-tooltip>
+                  <template v-if="$root.userId !== user.id">
+                    <v-tooltip
+                      location="bottom"
+                      :text="user.force_reset ? translations.passwordResetAlreadyRequested_ : translations.forcePasswordReset_"
+                    >
+                      <template #activator="{props}">
+                        <div v-bind="props">
+                          <v-btn
+                            :disabled="user.force_reset != null"
+                            color="error"
+                            density="comfortable"
+                            icon="mdi-lock-reset"
+                            @click="$emit('resetPassword', user)"
+                          ></v-btn>
+                        </div>
+                      </template>
+                    </v-tooltip>
 
-                  <v-tooltip
-                    location="bottom"
-                    :text="translations.changePassword_"
-                  >
-                    <template #activator="{props}">
-                      <div v-bind="props">
-                        <v-btn
-                          :disabled="user.force_reset != null"
-                          color="warning"
-                          density="comfortable"
-                          icon="mdi-form-textbox-password"
-                          @click="$emit('changePassword', user)"
-                        ></v-btn>
-                      </div>
-                    </template>
-                  </v-tooltip>
+                    <v-tooltip
+                      location="bottom"
+                      :text="translations.changePassword_"
+                    >
+                      <template #activator="{props}">
+                        <div v-bind="props">
+                          <v-btn
+                            :disabled="user.force_reset != null"
+                            color="warning"
+                            density="comfortable"
+                            icon="mdi-form-textbox-password"
+                            @click="$emit('changePassword', user)"
+                          ></v-btn>
+                        </div>
+                      </template>
+                    </v-tooltip>
 
-                  <v-tooltip
-                    v-if="user.two_factor_devices && user.two_factor_devices.length > 0"
-                    location="bottom"
-                    :text="translations.revoke2fa_"
-                  >
-                    <template #activator="{props}">
-                      <div v-bind="props">
-                        <v-btn
-                          
-                          @click.stop="$emit('revoke2fa', user.id)"
-                          variant="outlined"
-                          color="warning"
-                          density="comfortable"
-                          icon="mdi-lock-remove"
-                        ></v-btn>
-                      </div>
-                    </template>
-                  </v-tooltip>
+                    <v-tooltip
+                      v-if="user.two_factor_devices && user.two_factor_devices.length > 0"
+                      location="bottom"
+                      :text="translations.revoke2fa_"
+                    >
+                      <template #activator="{props}">
+                        <div v-bind="props">
+                          <v-btn
+                            
+                            @click.stop="$emit('revoke2fa', user.id)"
+                            variant="outlined"
+                            color="warning"
+                            density="comfortable"
+                            icon="mdi-lock-remove"
+                          ></v-btn>
+                        </div>
+                      </template>
+                    </v-tooltip>
+                  </template>
 
                   <v-tooltip
                     location="bottom"
@@ -439,7 +443,7 @@ const UserCard = Vue.defineComponent({
           </v-card-text>
         </v-card>
 
-        <v-card variant="flat">
+        <v-card v-if="$root.userId !== user.id" variant="flat">
           <v-card-text class="px-6">
             <div class="mb-3 text-body-1">{{ translations.manageAccount_ }}</div>
             <div class="d-flex flex-wrap ga-3">

From 49b79715ce4287833d657b5eea4d02aed5b6f71d Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Tue, 18 Nov 2025 14:38:25 +0400
Subject: [PATCH 102/180] Fix missing and_ import in user filtering logic

---
 enferno/admin/views.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index af06824de..ae4b3dec0 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -14,7 +14,7 @@
 from flask_babel import gettext
 from flask_security import logout_user
 from flask_security.decorators import auth_required, current_user, roles_accepted, roles_required
-from sqlalchemy import desc, or_, asc, select, func
+from sqlalchemy import desc, or_, asc, select, func, and_
 from werkzeug.utils import safe_join, secure_filename
 from flask_security.twofactor import tf_disable
 import shortuuid

From b8cfbdbd37fcdd39c7be28c0c2a24c669f3e31de Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Tue, 18 Nov 2025 15:57:55 +0400
Subject: [PATCH 103/180] Restrict setting active field during user creation
 only; existing users must use dedicated endpoints for status changes

---
 enferno/user/models.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index cee8082ce..9244d29eb 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -387,7 +387,12 @@ def from_json(self, item: dict) -> "User":
         self.can_edit_locations = item.get("can_edit_locations", False)
         self.can_export = item.get("can_export", False)
         self.can_import_web = item.get("can_import_web", False)
-        self.active = item.get("active")
+
+        # active field can only be set during creation (user has no id yet)
+        # For existing users, use dedicated endpoints: suspend, disable, reactivate, enable
+        if not self.id and "active" in item:
+            self.active = item.get("active")
+
         return self
 
     def create_revision(self, user_id: int = None, created: datetime = None) -> None:

From 39af2111f7456f2c91e0a43abae3d73718e5d304 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Tue, 18 Nov 2025 16:51:29 +0400
Subject: [PATCH 104/180] Remove active field from allowed attributes in user
 payload validator

---
 enferno/admin/validation/models.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/validation/models.py b/enferno/admin/validation/models.py
index 555baecf2..9dfd5d5ac 100644
--- a/enferno/admin/validation/models.py
+++ b/enferno/admin/validation/models.py
@@ -1452,6 +1452,8 @@ class ActorReviewRequestModel(BaseValidationModel):
 
 
 class UserValidationModel(StrictValidationModel):
+    """User validation model - restrict active field."""
+
     email: Optional[str] = None
     username: str = Field(min_length=4, max_length=32)
     password: Optional[str] = None  # Optional on PUT, required on POST
@@ -1464,7 +1466,6 @@ class UserValidationModel(StrictValidationModel):
     can_edit_locations: Optional[bool] = None
     can_export: Optional[bool] = None
     can_import_web: Optional[bool] = None
-    active: bool
     force_reset: Optional[str] = None
     google_id: Optional[str] = None
     id: Optional[int] = None
@@ -2053,7 +2054,6 @@ def validate_entity_type(cls, v: str) -> str:
         return v
 
 
-
 class ActivityQueryValidationModel(StrictValidationModel):
     user: Optional[int] = None
     action: Optional[str] = None

From 719027bdfa430ec2a5ad0279a4de02fe4c3ff454 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 18 Nov 2025 08:16:37 -0600
Subject: [PATCH 105/180] remove active flag manipulation

---
 enferno/admin/templates/admin/users.html | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index a9f049ad6..d03c10d8d 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -503,9 +503,6 @@
                 editedIndex: -1,
                 roles: [],
                 editedItem: {},
-                defaultItem: {
-                    active: false
-                },
                 isAdmin: false,
                 userDrawer: false,
                 user: null,
@@ -870,7 +867,7 @@
                 },
 
                 createItem() {
-                    this.editedItem = {...this.defaultItem};
+                    this.editedItem = {};
                     this.dialog = true;
                 },
 
@@ -893,7 +890,7 @@
                     setTimeout(() => {
                         this.serverErrors = {};
                         this.isStrongPassword = false;
-                        this.editedItem = Object.assign({}, this.defaultItem);
+                        this.editedItem = {};
                         this.editedIndex = -1;
                     }, 300);
                 },
@@ -904,7 +901,7 @@
                         this.askUserToChangePassword = true;
                         this.serverErrors = {};
                         this.isStrongPassword = false;
-                        this.editedItem = Object.assign({}, this.defaultItem);
+                        this.editedItem = {};
                     }, 300);
                 },
 
@@ -996,7 +993,6 @@
                         this.editedItem.roles = [selectedRole, ...preservedRoles];
                     }
 
-                    this.editedItem.active = true;
                     this.checkRoles();
                 },
                 isAccessRoleSelected(role) {

From 41e75c7351c0a630c0c01252ecd32e1ea6c28953 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Tue, 18 Nov 2025 18:59:50 +0400
Subject: [PATCH 106/180] Set default active status to True for new users
 during creation, allowing explicit override

---
 enferno/user/models.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index 9244d29eb..5590df12f 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -390,8 +390,9 @@ def from_json(self, item: dict) -> "User":
 
         # active field can only be set during creation (user has no id yet)
         # For existing users, use dedicated endpoints: suspend, disable, reactivate, enable
-        if not self.id and "active" in item:
-            self.active = item.get("active")
+        if not self.id:
+            # Default to True for new users, allow explicit override
+            self.active = item.get("active", True)
 
         return self
 

From 3a8bb1e17d7819c0e9b9fab068d75cf454bdaf3f Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 19 Nov 2025 13:26:15 +0400
Subject: [PATCH 107/180] Fix user test fixtures to properly handle foreign key
 dependencies

---
 tests/admin/test_users.py | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/tests/admin/test_users.py b/tests/admin/test_users.py
index bbad54e77..5e5598a61 100644
--- a/tests/admin/test_users.py
+++ b/tests/admin/test_users.py
@@ -28,6 +28,8 @@
 @pytest.fixture(scope="function")
 def clean_slate_users(session):
     from enferno.extensions import rds
+    from enferno.user.models import roles_users
+    from enferno.admin.models.UserHistory import UserHistory
 
     # Clear Redis security keys to prevent persistence between tests
     try:
@@ -38,8 +40,14 @@ def clean_slate_users(session):
     except Exception:
         pass  # Redis might not be available in some test environments
 
+    # Delete in order of dependencies
+    session.query(UserHistory).delete(synchronize_session=False)
     session.query(Activity).delete(synchronize_session=False)
     session.query(Notification).delete(synchronize_session=False)
+    session.query(Session).delete(synchronize_session=False)
+    session.query(WebAuthn).delete(synchronize_session=False)
+    # Delete roles_users associations before deleting users
+    session.execute(roles_users.delete())
     session.query(User).delete(synchronize_session=False)
     session.commit()
     yield
@@ -47,16 +55,32 @@ def clean_slate_users(session):
 
 @pytest.fixture(scope="function")
 def create_user(session):
+    from enferno.admin.models.UserHistory import UserHistory
+    from enferno.user.models import roles_users
+
     user = UserFactory()
     session.add(user)
     session.commit()
     yield user
     try:
+        # Delete dependencies first and commit
+        session.query(UserHistory).filter(UserHistory.target_user_id == user.id).delete(
+            synchronize_session=False
+        )
+        session.query(UserHistory).filter(UserHistory.user_id == user.id).delete(
+            synchronize_session=False
+        )
         session.query(Activity).filter(Activity.user_id == user.id).delete(
             synchronize_session=False
         )
-        session.delete(user)
+        session.execute(roles_users.delete().where(roles_users.c.user_id == user.id))
         session.commit()
+        # Refresh session and delete the user
+        session.expire_all()
+        user_to_delete = session.query(User).get(user.id)
+        if user_to_delete:
+            session.delete(user_to_delete)
+            session.commit()
     except:
         pass
 

From ffb7ba156576a63b3906a4350babfa84cae3f9cf Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 19 Nov 2025 13:26:50 +0400
Subject: [PATCH 108/180] Add proper cleanup of user dependencies in users
 fixture

---
 tests/conftest.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/tests/conftest.py b/tests/conftest.py
index 10d2084fe..b60d096a5 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -251,13 +251,26 @@ def users(session):
     self_assign_dict["mod"] = mod_user_sa
     self_assign_dict["da"] = da_user_sa
     yield admin_user, da_user, mod_user, self_assign_dict
+    from enferno.admin.models.UserHistory import UserHistory
+    from enferno.user.models import roles_users
+
     user_ids = [admin_user.id, da_user.id, mod_user.id] + [
         user.id for user in self_assign_dict.values()
     ]
+    # Delete dependencies first
+    session.query(UserHistory).filter(UserHistory.target_user_id.in_(user_ids)).delete(
+        synchronize_session=False
+    )
+    session.query(UserHistory).filter(UserHistory.user_id.in_(user_ids)).delete(
+        synchronize_session=False
+    )
     session.query(Activity).filter(Activity.user_id.in_(user_ids)).delete(synchronize_session=False)
     session.query(Notification).filter(Notification.user_id.in_(user_ids)).delete(
         synchronize_session=False
     )
+    session.execute(roles_users.delete().where(roles_users.c.user_id.in_(user_ids)))
+    session.commit()
+    # Now delete users
     session.delete(admin_user)
     session.delete(da_user)
     session.delete(mod_user)

From 91d2d824146a471cee828855b67dbd18a15dd6eb Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Wed, 19 Nov 2025 13:31:25 +0400
Subject: [PATCH 109/180] Remove active field from user test payload to match
 validation model

---
 tests/admin/test_users.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/admin/test_users.py b/tests/admin/test_users.py
index 5e5598a61..0760b86b3 100644
--- a/tests/admin/test_users.py
+++ b/tests/admin/test_users.py
@@ -142,7 +142,6 @@ def user_to_dict(user):
     return {
         "name": user.name,
         "username": user.username,
-        "active": user.active,
         "password": user.password,
         "email": user.email,
     }

From 8d17af6bb657e4b543e2cdcf0b4a2d94b93689e4 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 11:23:01 +0200
Subject: [PATCH 110/180] Add UserStatus enum to define user account statuses

---
 enferno/user/models.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index 5590df12f..88b406627 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -1,3 +1,4 @@
+import enum
 import json
 from typing import Any, Dict
 from datetime import datetime
@@ -23,6 +24,14 @@
 logger = get_logger()
 
 
+class UserStatus(str, enum.Enum):
+    """User account status enum."""
+
+    ACTIVE = "active"
+    SUSPENDED = "suspended"
+    DISABLED = "disabled"
+
+
 class MutableList(Mutable, list):
     """Custom Mutable List class to track changes in the list."""
 

From 5bdd9bcce15d00fa04cf9c79ec7c7b5bee4c86ab Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 11:32:34 +0200
Subject: [PATCH 111/180] Implement user account status field and update
 is_active logic to reflect new status system

---
 enferno/user/models.py | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index 88b406627..d41bdc986 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -185,15 +185,26 @@ class User(UserMixin, db.Model, BaseMixin):
     email = db.Column(db.String(255), nullable=True)
     username = db.Column(db.String(255), nullable=True, unique=True)
     password = db.Column(db.String(255), nullable=False)
+
+    # User account status - single source of truth
+    status = db.Column(
+        db.Enum(UserStatus, values_callable=lambda x: [e.value for e in x]),
+        default=UserStatus.ACTIVE,
+        nullable=False,
+        index=True,
+    )
+
+    # DEPRECATED: Keep during migration, sync with status field
     active = db.Column(db.Boolean, default=False)
+
     roles = db.relationship(
         "Role", secondary=roles_users, backref=db.backref("users", lazy="dynamic")
     )
 
     @property
     def is_active(self):
-        """User is active only if active flag is True AND user has at least one role."""
-        return self.active and bool(self.roles)
+        """Flask-Security requires this. User can login if status is ACTIVE and has roles."""
+        return self.status == UserStatus.ACTIVE and bool(self.roles)
 
     # email confirmation
     confirmed_at = db.Column(db.DateTime())

From 5d21a23ba3731b5fa2d7754905475ece438f6987 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 11:37:10 +0200
Subject: [PATCH 112/180] Add set_status method to manage user status with
 validation and side effects

---
 enferno/user/models.py | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index d41bdc986..fa22fb3b1 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -259,6 +259,40 @@ def unset_security_reset_key(self) -> None:
         key = f"{SECURITY_KEY_NAMESPACE}:{self.id}"
         rds.delete(key)
 
+    def set_status(self, new_status: UserStatus) -> None:
+        """
+        Set user status with validation and side effects.
+
+        Args:
+            new_status: The new UserStatus to set.
+
+        Raises:
+            ValueError: If trying to activate a user without roles.
+        """
+        if new_status == UserStatus.ACTIVE and not self.roles:
+            raise ValueError("Cannot activate user without roles")
+
+        old_status = self.status
+        self.status = new_status
+
+        # Sync deprecated active field
+        self.active = new_status == UserStatus.ACTIVE
+
+        # Side effects based on new status
+        if new_status == UserStatus.DISABLED:
+            self.roles = []
+            self.view_usernames = False
+            self.view_simple_history = False
+            self.view_full_history = False
+            self.can_self_assign = False
+            self.can_edit_locations = False
+            self.can_export = False
+            self.can_import_web = False
+            self.logout_other_sessions()
+        elif old_status != new_status:
+            # Logout on any status change (suspend or reactivate)
+            self.logout_other_sessions()
+
     def roles_in(self, roles: list) -> bool:
         chk = [self.has_role(r) for r in roles]
         return any(chk)

From f01291387e74eaf2e6c23a2ec50fe7f05ef8132c Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 11:57:20 +0200
Subject: [PATCH 113/180] Update user model to replace active and deleted
 fields with a unified status field in user payloads

---
 enferno/user/models.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index fa22fb3b1..615f66a12 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -514,8 +514,7 @@ def to_compact(self) -> dict:
             "id": self.id,
             "name": self.secure_name,
             "username": self.secure_username,
-            "active": self.active,
-            "deleted": self.deleted,
+            "status": self.status.value,
         }
 
     def to_dict(self) -> dict:
@@ -528,8 +527,7 @@ def to_dict(self) -> dict:
             "google_id": self.google_id,
             "email": self.secure_email,
             "username": self.secure_username,
-            "active": self.active,
-            "deleted": self.deleted,
+            "status": self.status.value,
             "roles": [role.to_dict() for role in self.roles],
             "view_usernames": self.view_usernames,
             "view_simple_history": self.view_simple_history,

From 442575ab2858dfa3ce27e9fdbd9e3620419a76be Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 11:59:47 +0200
Subject: [PATCH 114/180] Refactor user model to set status during creation,
 replacing active field logic with status synchronization

---
 enferno/user/models.py | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index 615f66a12..14b2d8363 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -442,11 +442,16 @@ def from_json(self, item: dict) -> "User":
         self.can_export = item.get("can_export", False)
         self.can_import_web = item.get("can_import_web", False)
 
-        # active field can only be set during creation (user has no id yet)
-        # For existing users, use dedicated endpoints: suspend, disable, reactivate, enable
+        # Status can only be set during creation (user has no id yet)
+        # For existing users, use set_status() or dedicated endpoints
         if not self.id:
-            # Default to True for new users, allow explicit override
-            self.active = item.get("active", True)
+            status_str = item.get("status", "active")
+            try:
+                self.status = UserStatus(status_str)
+            except ValueError:
+                self.status = UserStatus.ACTIVE
+            # Sync deprecated active field
+            self.active = self.status == UserStatus.ACTIVE
 
         return self
 

From e8b86f3f69cb47240db6dae2899ecb538887d267 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 12:03:06 +0200
Subject: [PATCH 115/180] Update user suspension logic to utilize UserStatus
 enum, ensuring proper handling of suspended and disabled states

---
 enferno/admin/views.py | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index ae4b3dec0..cdff0146b 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -118,7 +118,7 @@
     generate_graph,
     regenerate_locations,
 )
-from enferno.user.models import User, Role, Session
+from enferno.user.models import User, Role, Session, UserStatus
 from enferno.utils.config_utils import ConfigManager
 from enferno.utils.data_helpers import get_file_hash
 from enferno.utils.form_history_utils import record_form_history
@@ -5399,12 +5399,14 @@ def api_user_suspend(id: int) -> Response:
     if not user:
         return HTTPResponse.not_found("User not found")
 
-    if not user.active:
-        return HTTPResponse.success(message="User is already suspended or disabled")
+    if user.status == UserStatus.SUSPENDED:
+        return HTTPResponse.success(message="User is already suspended")
 
-    user.active = False
+    if user.status == UserStatus.DISABLED:
+        return HTTPResponse.bad_request("Cannot suspend a disabled user. Enable first.")
+
+    user.set_status(UserStatus.SUSPENDED)
     user.save()
-    user.logout_other_sessions()
 
     Activity.create(
         current_user,

From 713643a2b41ba9c25aca94584f990a12c848cffa Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 12:19:53 +0200
Subject: [PATCH 116/180] Refine user reactivation and suspension error
 handling to improve clarity and enforce status checks using UserStatus enum

---
 enferno/admin/views.py | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index cdff0146b..b8b2be1f8 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5403,7 +5403,7 @@ def api_user_suspend(id: int) -> Response:
         return HTTPResponse.success(message="User is already suspended")
 
     if user.status == UserStatus.DISABLED:
-        return HTTPResponse.bad_request("Cannot suspend a disabled user. Enable first.")
+        return HTTPResponse.error("Cannot suspend a disabled user")
 
     user.set_status(UserStatus.SUSPENDED)
     user.save()
@@ -5442,14 +5442,17 @@ def api_user_reactivate(id: int) -> Response:
     if not user:
         return HTTPResponse.not_found("User not found")
 
-    if user.deleted:
-        return HTTPResponse.forbidden("Cannot reactivate a disabled user")
+    if user.status == UserStatus.DISABLED:
+        return HTTPResponse.error("Cannot reactivate a disabled user. Use enable instead.")
 
-    if user.active:
+    if user.status == UserStatus.ACTIVE:
         return HTTPResponse.success(message="User is already active")
 
-    user.active = True
-    user.save()
+    try:
+        user.set_status(UserStatus.ACTIVE)
+        user.save()
+    except ValueError as e:
+        return HTTPResponse.error(str(e))
 
     Activity.create(
         current_user,

From 094c46372083146f35973548636c21fe36349f68 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 12:21:18 +0200
Subject: [PATCH 117/180] Refactor user disable logic to utilize UserStatus
 enum, replacing direct field manipulation with set_status method for improved
 clarity and consistency

---
 enferno/admin/views.py | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index b8b2be1f8..b3fa3b6a6 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5488,21 +5488,11 @@ def api_user_disable(id: int) -> Response:
     if not user:
         return HTTPResponse.not_found("User not found")
 
-    if user.deleted:
+    if user.status == UserStatus.DISABLED:
         return HTTPResponse.success(message="User is already disabled")
 
-    user.active = False
-    user.deleted = True
-    user.roles = []
-    user.view_usernames = False
-    user.view_simple_history = False
-    user.view_full_history = False
-    user.can_self_assign = False
-    user.can_edit_locations = False
-    user.can_export = False
-    user.can_import_web = False
+    user.set_status(UserStatus.DISABLED)
     user.save()
-    user.logout_other_sessions()
 
     Activity.create(
         current_user,

From 9e12bf11b2e94562ad532adba979bbcfbecb2cd9 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 12:24:07 +0200
Subject: [PATCH 118/180] Enhance user reactivation process by clarifying
 status changes; now sets status to SUSPENDED instead of ACTIVE, requiring
 role reassignment for access restoration.

---
 enferno/admin/views.py | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index b3fa3b6a6..2f55a257d 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5516,7 +5516,8 @@ def api_user_disable(id: int) -> Response:
 @roles_required("Admin")
 def api_user_enable(id: int) -> Response:
     """
-    Re-enable a disabled account.
+    Re-enable a disabled account. Sets status to SUSPENDED (not ACTIVE)
+    since roles were cleared on disable. Admin must assign roles then reactivate.
 
     Args:
         - id: id of the user to enable.
@@ -5528,11 +5529,12 @@ def api_user_enable(id: int) -> Response:
     if not user:
         return HTTPResponse.not_found("User not found")
 
-    if not user.deleted:
+    if user.status != UserStatus.DISABLED:
         return HTTPResponse.success(message="User is already enabled")
 
-    user.active = True
-    user.deleted = False
+    # Set to SUSPENDED, not ACTIVE - user has no roles after disable
+    user.status = UserStatus.SUSPENDED
+    user.active = False
     user.save()
 
     Activity.create(
@@ -5551,7 +5553,7 @@ def api_user_enable(id: int) -> Response:
     )
 
     return HTTPResponse.success(
-        message=f"User {user.username} enabled successfully. Admin must assign roles."
+        message=f"User {user.username} enabled. Assign roles and reactivate to restore access."
     )
 
 

From 6d7530dc51fa7529bc5a607d89ae0720c8b5237c Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 12:41:03 +0200
Subject: [PATCH 119/180] Add unified endpoint for setting user status;
 includes validation and error handling for status changes, ensuring proper
 transitions between states.

---
 enferno/admin/views.py | 59 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 2f55a257d..a6b91da49 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5557,6 +5557,65 @@ def api_user_enable(id: int) -> Response:
     )
 
 
+@admin.post("/api/user/<int:id>/status")
+@roles_required("Admin")
+def api_user_set_status(id: int) -> Response:
+    """
+    Set user status. Unified endpoint for status changes.
+
+    Args:
+        - id: id of the user.
+
+    Returns:
+        - success/error response.
+    """
+    user = db.session.get(User, id)
+    if not user:
+        return HTTPResponse.not_found("User not found")
+
+    new_status = request.json.get("status") if request.json else None
+    if not new_status:
+        return HTTPResponse.error("Missing status field")
+    try:
+        status_enum = UserStatus(new_status)
+    except ValueError:
+        return HTTPResponse.error(
+            f"Invalid status: {new_status}. Must be: active, suspended, disabled"
+        )
+
+    if user.status == status_enum:
+        return HTTPResponse.success(message=f"User is already {new_status}")
+
+    # Disabled users must go through suspended first (to assign roles)
+    if user.status == UserStatus.DISABLED and status_enum == UserStatus.ACTIVE:
+        return HTTPResponse.error(
+            "Cannot activate disabled user directly. Set to 'suspended' first, assign roles, then activate."
+        )
+
+    old_status = user.status.value
+    try:
+        if user.status == UserStatus.DISABLED and status_enum == UserStatus.SUSPENDED:
+            # Enable: just set status directly (no roles to check)
+            user.status = UserStatus.SUSPENDED
+            user.active = False
+        else:
+            user.set_status(status_enum)
+        user.save()
+    except ValueError as e:
+        return HTTPResponse.error(str(e))
+
+    Activity.create(
+        current_user,
+        Activity.ACTION_UPDATE,
+        Activity.STATUS_SUCCESS,
+        user.to_mini(),
+        "user",
+        details=f"status: {old_status} → {new_status}",
+    )
+
+    return HTTPResponse.success(message=f"User {user.username} is now {new_status}")
+
+
 @admin.delete("/api/user/<int:id>")
 @roles_required("Admin")
 def api_user_delete(

From fdc100bbde4dd2b6af723204082842bc2ef34ba8 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 12:47:59 +0200
Subject: [PATCH 120/180] Add migration to introduce user status field,
 replacing active boolean with a status enum. Includes data migration, NOT
 NULL constraint, default value, and index creation for improved query
 performance.

---
 .../20251127_000000_add_user_status.sql       | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 enferno/migrations/20251127_000000_add_user_status.sql

diff --git a/enferno/migrations/20251127_000000_add_user_status.sql b/enferno/migrations/20251127_000000_add_user_status.sql
new file mode 100644
index 000000000..52c3ffb24
--- /dev/null
+++ b/enferno/migrations/20251127_000000_add_user_status.sql
@@ -0,0 +1,29 @@
+-- Migration: Add User Status Field
+-- Add status enum to replace the active boolean
+
+-- 1. Add status column
+ALTER TABLE "user" ADD COLUMN IF NOT EXISTS status VARCHAR(20);
+
+-- 2. Migrate data from active boolean to status
+-- On main branch: active=true means active, active=false means suspended
+UPDATE "user" SET status = CASE
+    WHEN active = true THEN 'active'
+    ELSE 'suspended'
+END
+WHERE status IS NULL;
+
+-- 3. Set NOT NULL constraint and default
+ALTER TABLE "user" ALTER COLUMN status SET NOT NULL;
+ALTER TABLE "user" ALTER COLUMN status SET DEFAULT 'active';
+
+-- 4. Create index for faster queries
+CREATE INDEX IF NOT EXISTS idx_user_status ON "user"(status);
+
+-- Verify migration
+SELECT status, COUNT(*) as count FROM "user" GROUP BY status;
+
+-- Rollback script:
+/*
+DROP INDEX IF EXISTS idx_user_status;
+ALTER TABLE "user" DROP COLUMN IF EXISTS status;
+*/

From 57fb9c04f3a100ea6834c3f5c40d51ca0d58484f Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 27 Nov 2025 12:50:13 +0200
Subject: [PATCH 121/180] Update api_users endpoint to replace 'active' filter
 with 'status' filter using UserStatus enum for improved clarity and
 validation of account status.

---
 enferno/admin/views.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index a6b91da49..23bbdb748 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -4896,7 +4896,7 @@ def api_users() -> Response:
         - page: Page number (default: 1)
         - per_page: Items per page (default: PER_PAGE)
         - q: Search term (searches username, email, name)
-        - active: Filter by account status (true/false)
+        - status: Filter by account status (active/suspended/disabled)
         - twoFactor: Filter by 2FA status (true/false)
         - roles: Comma-separated role IDs for filtering (use 0 for users without roles)
 
@@ -4906,7 +4906,7 @@ def api_users() -> Response:
     page = request.args.get("page", 1, int)
     per_page = request.args.get("per_page", PER_PAGE, int)
     q = request.args.get("q")
-    active = request.args.get("active")
+    status = request.args.get("status")
     two_factor = request.args.get("twoFactor")
     roles = request.args.get("roles")
 
@@ -4924,9 +4924,12 @@ def api_users() -> Response:
         )
 
     # Account status filter
-    if active is not None:
-        is_active = active.lower() == "true"
-        query.append(User.active == is_active)
+    if status is not None:
+        try:
+            status_enum = UserStatus(status)
+            query.append(User.status == status_enum)
+        except ValueError:
+            pass  # Invalid status value, skip filter
 
     # 2FA status filter
     if two_factor is not None:

From 75269f6f8b40ac3b9082f617925f3998789c3f4b Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 28 Nov 2025 15:14:09 -0600
Subject: [PATCH 122/180] update users page to use status key instead of the
 old active / deleted

---
 enferno/admin/templates/admin/users.html | 26 ++++++++++++++----------
 enferno/static/js/components/UserCard.js | 13 +++++++-----
 2 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index d03c10d8d..178a60589 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -75,7 +75,7 @@
                                                 v-bind="props"
                                             >
                                             <v-badge
-                                                v-if="activeCount('active')"
+                                                v-if="activeCount('status')"
                                                 location="top right"
                                                 :offset-x="-14"
                                                 :offset-y="4"
@@ -93,11 +93,11 @@
                                             <v-list-item
                                                 v-for="option in accountStatusOptions"
                                                 :key="option.value"
-                                                @click="options.active = option.value; refresh()"
-                                                :active="options.active === option.value"
+                                                @click="options.status = option.value; refresh()"
+                                                :active="options.status === option.value"
                                                 color="primary"
                                             >
-                                                <v-list-item-title><v-icon v-if="options.active === option.value" start>mdi-check</v-icon>${option.name}</v-list-item-title>
+                                                <v-list-item-title><v-icon v-if="options.status === option.value" start>mdi-check</v-icon>${option.name}</v-list-item-title>
                                             </v-list-item>
                                         </v-list>
                                     </v-menu>
@@ -523,8 +523,9 @@
                     { name: "{{ _('Administrator') }}", value: 'admin', description: "{{ _('Full access to all items and actions, including Activity Monitor and user management across the system.') }}" },
                 ],
                 accountStatusOptions: [
-                    { name: 'Active', value: 'true' },
-                    { name: 'Inactive', value: 'false' },
+                    { name: "{{ _('Active') }}", value: 'active' },
+                    { name: "{{ _('Suspended') }}", value: 'suspended' },
+                    { name: "{{ _('Disabled') }}", value: 'disabled' },
                 ],
                 twoFactorOptions: [
                     { name: 'Active', value: 'true' },
@@ -614,9 +615,12 @@
                     return { color: 'warning', text: "{{ _('2FA Inactive') }}", icon: 'mdi-lock-open-alert' }
                 },
                 getUserStatusMeta(user) {
-                    if (user.active && !user?.deleted) return { color: 'success', text: "{{ _('Active') }}", icon: 'mdi-account-check' }
-                    if (!user.active && !user?.deleted) return { color: 'warning', text: "{{ _('Suspended') }}", icon: 'mdi-account-clock' }
-                    if (!user.active && user?.deleted) return { text: "{{ _('Disabled') }}", icon: 'mdi-account-cancel' }
+                    const statusMap = {
+                        'active': { color: 'success', text: "{{ _('Active') }}", icon: 'mdi-account-check' },
+                        'suspended': { color: 'warning', text: "{{ _('Suspended') }}", icon: 'mdi-account-clock' },
+                        'disabled': { color: 'default', text: "{{ _('Disabled') }}", icon: 'mdi-account-cancel' },
+                    };
+                    return statusMap[user.status] || statusMap['disabled'];
                 },
                 activeCount(key) {
                     const val = this.options?.[key]
@@ -812,7 +816,7 @@
                     });
 
                     if (this.options?.q) params.append('q', this.options.q);
-                    if (this.options?.active) params.append('active', this.options.active);
+                    if (this.options?.status) params.append('status', this.options.status);
                     if (this.options?.roles?.length) params.append('roles', this.options.roles);
                     if (this.options?.twoFactor) params.append('twoFactor', this.options.twoFactor);
 
@@ -923,7 +927,7 @@
 
                     this.saving = true;
                     const payload = { ...this.editedItem };
-                    delete payload.deleted; // Remove deleted field from payload
+                    delete payload.status; // Remove status field from payload
 
                     // edit mode
                     if (payload.id) {
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 0c6c852c4..0163c0347 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -59,14 +59,17 @@ const UserCard = Vue.defineComponent({
     };
   },
   computed: {
+    isUserActive() {
+      return this.user?.status === 'active';
+    },
     isUserSuspended() {
-      return !this.user.active && !this.user?.deleted;
+      return this.user?.status === 'suspended';
     },
     isUserDisabled() {
-      return this.user?.deleted;
+      return this.user?.status === 'disabled';
     },
     isUserEnabled() {
-      return !this.user?.deleted;
+      return !this.isUserDisabled;
     },
     permissions() {
       // [permissionKey, translationIfAllowed, translationIfDenied]
@@ -449,10 +452,10 @@ const UserCard = Vue.defineComponent({
             <div class="d-flex flex-wrap ga-3">
               <template v-if="isUserEnabled">
                 <v-btn v-if="isUserSuspended" @click="reactivateAccount()" variant="outlined" color="success" prepend-icon="mdi-play-circle">{{ translations.reactivateAccount_ }}</v-btn>
-                <v-btn v-if="!isUserSuspended" @click="suspendAccount()" variant="outlined" color="warning" prepend-icon="mdi-pause-circle">{{ translations.suspendAccount_ }}</v-btn>
+                <v-btn v-if="isUserActive" @click="suspendAccount()" variant="outlined" color="warning" prepend-icon="mdi-pause-circle">{{ translations.suspendAccount_ }}</v-btn>
               </template>
               <v-btn v-if="isUserDisabled" @click="enableAccount()" variant="outlined" color="success" prepend-icon="mdi-arrow-down-thin-circle-outline">{{ translations.enableAccount_ }}</v-btn>
-              <v-btn v-if="!isUserDisabled" @click="disableAccount()" variant="outlined" color="error" prepend-icon="mdi-minus-circle">{{ translations.disableAccount_ }}</v-btn>
+              <v-btn v-if="isUserEnabled" @click="disableAccount()" variant="outlined" color="error" prepend-icon="mdi-minus-circle">{{ translations.disableAccount_ }}</v-btn>
             </div>
           </v-card-text>
         </v-card>

From c28939404551ae9f8ee08bd7ba23c08ebe98f407 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 28 Nov 2025 15:20:57 -0600
Subject: [PATCH 123/180] fix username not being cleared on reject

---
 enferno/static/js/components/UserCard.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 0163c0347..b3036726d 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -180,7 +180,7 @@ const UserCard = Vue.defineComponent({
           this.username = '';
           this.displayAccountStatusUpdatedMessage(mode);
         },
-        onReject() {
+        onReject: () => {
           this.username = '';
         }
       })

From ce651bdfe7a9fa117808f6e6be99cfa0939d60d0 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 28 Nov 2025 15:22:52 -0600
Subject: [PATCH 124/180] update key to be active

---
 enferno/admin/templates/admin/users.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 178a60589..fd16a453d 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -57,7 +57,7 @@
                                 </div>
                                 <div class="d-flex align-center ga-5 w-100">
                                     <div>{{ _('Filter') }}
-                                        <v-tooltip v-if="activeCount('twoFactor') || activeCount('roles') || activeCount('active')" location="top" text="{{ _('Clear filters') }}">
+                                        <v-tooltip v-if="activeCount('twoFactor') || activeCount('roles') || activeCount('status')" location="top" text="{{ _('Clear filters') }}">
                                             <template #activator="{props}">
                                                 <v-btn v-bind="props" icon="mdi-filter-off-outline" size="small"
                                                     @click="options = {}; refresh()"

From 3937814a1be0b3120b756d58ecac1af8f13776d2 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 28 Nov 2025 15:26:08 -0600
Subject: [PATCH 125/180] update last remains of the old deleted flag

---
 enferno/admin/templates/admin/users.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index fd16a453d..2238b2be5 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -184,7 +184,7 @@
 
 
                         <template v-slot:item.action="{ item }">
-                            <div v-if="!item?.deleted" class="d-flex">
+                            <div v-if="item?.status !== 'disabled'" class="d-flex">
                                 <v-tooltip location="top" text="{{ _('Edit User') }}">
                                     <template #activator="{props}">
                                         <div v-bind="props" class="d-inline-block">
@@ -248,7 +248,7 @@
                         </template>
 
                         <template v-slot:item.2fa="{ item }">
-                            <v-chip v-if="!item?.deleted" variant="text" :color="getUser2FaMeta(item)?.color" class="ma-1 font-weight-medium">
+                            <v-chip v-if="item?.status !== 'disabled'" variant="text" :color="getUser2FaMeta(item)?.color" class="ma-1 font-weight-medium">
                                 <v-icon start size="large">${getUser2FaMeta(item)?.icon}</v-icon>
                                 ${getUser2FaMeta(item)?.text}
                             </v-chip>
@@ -962,7 +962,7 @@
                     try {
                         this.saving = true;
                         const payload = { ...this.editedItem };
-                        delete payload.deleted; // Remove deleted field from payload
+                        delete payload.status; // Remove status field from payload
                         const response = await api.put(`/admin/api/user/`, { item: payload }, { suppressGlobalErrorHandler: true });
                         this.showSnack(response.data);
 

From be00a37d6315044693fa11cf62a35d6d0b6dcba3 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 1 Dec 2025 10:10:02 -0600
Subject: [PATCH 126/180] add missing semi colons reported by gh ai

---
 enferno/admin/templates/admin/users.html | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 2238b2be5..e8c90e54d 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -911,8 +911,8 @@
 
                 save(options) {
                     const handleError = (err) => {
-                        const usernameAlreadyTaken = err?.response?.status === 409
-                        const errors = err?.response?.data?.errors
+                        const usernameAlreadyTaken = err?.response?.status === 409;
+                        const errors = err?.response?.data?.errors;
                         if (errors || usernameAlreadyTaken) {
                             this.serverErrors = errors
                             // Override email message for something simpler
@@ -920,8 +920,8 @@
                             if (this.serverErrors?.['item.username']) this.serverErrors['item.username'] = [translations.usernameInvalid_];
                             if (usernameAlreadyTaken) this.serverErrors = { ...this.serverErrors, ['item.username']: [translations.usernameAlreadyTaken_]};
 
-                            this.$nextTick(() => scrollToFirstError())
-                            this.showSnack(handleRequestError(err))
+                            this.$nextTick(() => scrollToFirstError());
+                            this.showSnack(handleRequestError(err));
                         }
                     }
 
@@ -973,7 +973,7 @@
                         await this.refresh();
                         this.closeChangePasswordDialog();
                     } catch (err) {
-                        this.showSnack(handleRequestError(err))
+                        this.showSnack(handleRequestError(err));
                     } finally {
                         this.saving = false;
                     }

From 1a707721a4243a79b0c378da423eb8cee550d828 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 1 Dec 2025 13:07:43 -0600
Subject: [PATCH 127/180] add dialog missing translations

---
 enferno/admin/templates/admin/jsapi.jinja2 | 27 ++++++
 enferno/static/js/components/UserCard.js   | 98 ++++++++++++++++------
 2 files changed, 100 insertions(+), 25 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 3333efb1c..5d24e3fed 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -306,6 +306,33 @@ actorType_ : "{{ _('Actor Type') }}",
 relationshipWithBulletin_: (id) => "{{ _('Relationship with Bulletin {id}') }}".replace("{id}", id),
 relationshipBetweenActorAndBulletinWillBeCreated_ : "{{ _('The relationship between the new Actor and the Bulletin will be created when the Actor is saved') }}",
 
+youAreAboutToSuspendTheAccountForUser_: (name) => "{{ _('You\'re about to suspend the account for user \'{name}\'') }}".replace('{name}', name),
+byEnteringUsernameYouConfirmSuspendForUser_: (name) => "{{ _('By entering the user\'s username, you will confirm the suspend action for user \'{name}\'') }}".replace('{name}', name),
+youAreAboutToReactivateUser_: (name) => "{{ _('You\'re about to reactivate user \'{name}\'') }}".replace('{name}', name),
+byEnteringUsernameYouConfirmReactivationForUser_: (name) => "{{ _('By entering the user\'s username, you will confirm the reactivation for user \'{name}\'') }}".replace('{name}', name),
+youAreAboutToDisableTheAccountForUser_: (name) => "{{ _('You\'re about to disable the account for user \'{name}\'') }}".replace('{name}', name),
+byEnteringUsernameYouConfirmDisableForUser_: (name) => "{{ _('By entering the user\'s username, you will confirm the disable action for user \'{name}\'') }}".replace('{name}', name),
+youAreAboutToEnableTheAccountForUser_: (name) => "{{ _('You\'re about to enable the account for user \'{name}\'') }}".replace('{name}', name),
+byEnteringUsernameYouConfirmEnableForUser_: (name) => "{{ _('By entering the user\'s username, you will confirm enabling the account for user \'{name}\'') }}".replace('{name}', name),
+intendedFor_: "{{ _('Intended for') }}",
+rolesAndAccessRemoval_: "{{ _('Roles and Access Removal') }}",
+rolesAndAccessRestoration_: "{{ _('Roles and Access Restoration') }}",
+accessRemoval_: "{{ _('Access Removal') }}",
+accessRestoration_: "{{ _('Access Restoration') }}",
+profileAndContributions_: "{{ _('Profile and Contributions') }}",
+temporarySuspensionsInternalInvestigationsOrOnLeave_: "{{ _('Temporary suspensions, such as during internal investigations or when the user is on leave.') }}",
+userCanNoLongerLoginToBayanat_: "{{ _('The user will no longer be able to log in to Bayanat.') }}",
+rolesAccessAndAssignmentsRemainUnchanged_: "{{ _('Their system roles, access permissions, and assigned items will remain unchanged.') }}",
+permanentlyEndingUserAccessToBayanat_: "{{ _('Permanently ending a user\'s access to Bayanat, such as when they leave the organization.') }}",
+userProfileRetainedForArchivalPurposes_: "{{ _('The user\'s profile will be retained for archival purposes.') }}",
+itemsCreatedOrUpdatedByUserWillRemainInBayanat_: "{{ _('Items created or updated by the user will remain in Bayanat.') }}",
+activityHistoryWillContinueToReflectUserContributions_: "{{ _('Activity history will continue to reflect the user\'s contributions.') }}",
+previousRolesAndAccessPermissionsWillBeRestored_: "{{ _('Previous system roles and access permissions will be restored.') }}",
+userCanLoginAndPerformRoleActions_: "{{ _('User can log in to Bayanat and perform actions allowed by their roles.') }}",
+userCanUseExistingPasswordToAccessBayanat_: "{{ _('User can use their existing password to access Bayanat.') }}",
+previousProfileAndContributionsRemainIntact_: "{{ _('The user\'s previous profile and contributions remain intact.') }}",
+theUserWillBeAbleToViewAndEditItemsTheyPreviouslyHadAccessTo_: "{{ _('The user will be able to view and edit items they previously had access to.') }}",
+
 originPlace_ : "{{ _('Place of Origin') }}",
 
 idNumber_ : "{{ _('ID Number') }}",
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index b3036726d..420ef2eaf 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -1,46 +1,94 @@
-const actionSections = {
+const actionSections = () => ({
   suspend: {
-    title: (name) => `You're about to suspend the account for user \"${name}\"`,
-    confirmationText: (name) => `By entering the user\'s username, you will confirm the suspend action for user \"${name}\"`,
-    acceptButtonText: "Suspend Account",
+    title: (name) => window.translations.youAreAboutToSuspendTheAccountForUser_(name),
+    confirmationText: (name) => window.translations.byEnteringUsernameYouConfirmSuspendForUser_(name),
+    acceptButtonText: window.translations.suspendAccount_,
     acceptButtonColor: "warning",
     blocks: [
-      { icon: "mdi-account-circle", title: "Intended for", description: "Temporary suspensions, such as during internal investigations or when the user is on leave." },
-      { icon: "mdi-account-key", title: "Roles and Access Removal", bullets: ["The user will no longer be able to log in to Bayanat.", "Their system roles, access permissions, and assigned items will remain unchanged."] },
+      {
+        icon: "mdi-account-circle",
+        title: window.translations.intendedFor_,
+        description: window.translations.temporarySuspensionsInternalInvestigationsOrOnLeave_,
+      },
+      {
+        icon: "mdi-account-key",
+        title: window.translations.rolesAndAccessRemoval_,
+        bullets: [
+          window.translations.userCanNoLongerLoginToBayanat_,
+          window.translations.rolesAccessAndAssignmentsRemainUnchanged_,
+        ],
+      },
     ],
   },
   reactivate: {
-    title: (name) => `You're about to reactivate user \"${name}\"`,
-    confirmationText: (name) => `By entering the user\'s username, you will confirm the reactivation for user \"${name}\"`,
-    acceptButtonText: "Reactivate Account",
+    title: (name) => window.translations.youAreAboutToReactivateUser_(name),
+    confirmationText: (name) => window.translations.byEnteringUsernameYouConfirmReactivationForUser_(name),
+    acceptButtonText: window.translations.reactivateAccount_,
     acceptButtonColor: "success",
     blocks: [
-      { icon: "mdi-account", title: "Roles and Access Restoration", bullets: ["Previous system roles and access permissions will be restored.", "User can log in to Bayanat and perform actions allowed by their roles."] },
-      { icon: "mdi-key", title: "Profile and Contributions", bullets: ["The user will be able to view and edit items they previously had access to."] },
+      {
+        icon: "mdi-account",
+        title: window.translations.rolesAndAccessRestoration_,
+        bullets: [
+          window.translations.previousRolesAndAccessPermissionsWillBeRestored_,
+          window.translations.userCanLoginAndPerformRoleActions_,
+        ],
+      },
+      {
+        icon: "mdi-key",
+        title: window.translations.profileAndContributions_,
+        bullets: [
+          window.translations.theUserWillBeAbleToViewAndEditItemsTheyPreviouslyHadAccessTo_,
+        ],
+      },
     ],
   },
   disable: {
-    title: (name) => `You're about to disable the account for user \"${name}\"`,
-    confirmationText: (name) => `By entering the user\'s username, you will confirm the disable action for user \"${name}\"`,
-    acceptButtonText: "Disable Account",
+    title: (name) => window.translations.youAreAboutToDisableTheAccountForUser_(name),
+    confirmationText: (name) => window.translations.byEnteringUsernameYouConfirmDisableForUser_(name),
+    acceptButtonText: window.translations.disableAccount_,
     acceptButtonColor: "error",
     blocks: [
-      { icon: "mdi-account-circle", title: "Intended for", description: "Permanently ending a user's access to Bayanat, such as when they leave the organization." },
-      { icon: "mdi-account-key", title: "Roles and Access Removal", bullets: ["The user will no longer be able to log in to Bayanat.", "All system roles and access permissions will be removed.", "Items assigned to the user will be unassigned and available for reassignment."] },
-      { icon: "mdi-briefcase-clock-outline", title: "Profile and Contributions", bullets: ["The user's profile will be retained for archival purposes.", "Items created or updated by the user will remain in Bayanat.", "Activity history will continue to reflect the user's contributions."] },
+      {
+        icon: "mdi-account-circle",
+        title: window.translations.intendedFor_,
+        description: window.translations.permanentlyEndingUserAccessToBayanat_,
+      },
+      {
+        icon: "mdi-account-key",
+        title: window.translations.accessRemoval_,
+        bullets: [window.translations.userCanNoLongerLoginToBayanat_],
+      },
+      {
+        icon: "mdi-briefcase-clock-outline",
+        title: window.translations.profileAndContributions_,
+        bullets: [
+          window.translations.userProfileRetainedForArchivalPurposes_,
+          window.translations.itemsCreatedOrUpdatedByUserWillRemainInBayanat_,
+          window.translations.activityHistoryWillContinueToReflectUserContributions_,
+        ],
+      },
     ],
   },
   enable: {
-    title: (name) => `You're about to enable the account for user \"${name}\"`,
-    confirmationText: (name) => `By entering the user\'s username, you will confirm enabling the account for user \"${name}\"`,
-    acceptButtonText: "Enable Account",
+    title: (name) => window.translations.youAreAboutToEnableTheAccountForUser_(name),
+    confirmationText: (name) => window.translations.byEnteringUsernameYouConfirmEnableForUser_(name),
+    acceptButtonText: window.translations.enableAccount_,
     acceptButtonColor: "success",
     blocks: [
-      { icon: "mdi-account", title: "Roles and Access Restoration", bullets: ["The user will be able to log in once a system role is assigned.", "User can use their existing password to access Bayanat."] },
-      { icon: "mdi-key", title: "Profile and Contributions", bullets: ["The user's previous profile and contributions remain intact."] },
+      {
+        icon: "mdi-account",
+        title: window.translations.accessRestoration_,
+        bullets: [window.translations.userCanUseExistingPasswordToAccessBayanat_],
+      },
+      {
+        icon: "mdi-key",
+        title: window.translations.profileAndContributions_,
+        bullets: [window.translations.previousProfileAndContributionsRemainIntact_],
+      },
     ],
   },
-}
+});
 
 const UserCard = Vue.defineComponent({
   props: ['user', 'closable'],
@@ -54,7 +102,7 @@ const UserCard = Vue.defineComponent({
       page: 1,
       perPage: 5,
       more: true,
-      actionSections,
+      actionSections: actionSections(),
       username: '',
     };
   },
@@ -173,7 +221,7 @@ const UserCard = Vue.defineComponent({
       this.$refs.accountActionDialog.show({
         dialogProps: { width: 691 },
         data: { mode },
-        acceptProps: { text: actionSections[mode].acceptButtonText, color: actionSections[mode].acceptButtonColor },
+        acceptProps: { text: this.actionSections[mode].acceptButtonText, color: this.actionSections[mode].acceptButtonColor },
         onAccept: async () => {
           await api.post(`/admin/api/user/${this.user.id}/${mode}`);
           await this.$root.refreshUser(this.user.id);

From 285fd0ecb4c950fb82029594dc403bc2dcdc14bc Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Mon, 1 Dec 2025 13:12:32 -0600
Subject: [PATCH 128/180] add more translations

---
 enferno/admin/templates/admin/jsapi.jinja2 | 2 ++
 enferno/admin/templates/admin/users.html   | 4 ++--
 enferno/static/js/components/UserCard.js   | 4 ++--
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 5d24e3fed..c2f9efdfa 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -332,6 +332,8 @@ userCanLoginAndPerformRoleActions_: "{{ _('User can log in to Bayanat and perfor
 userCanUseExistingPasswordToAccessBayanat_: "{{ _('User can use their existing password to access Bayanat.') }}",
 previousProfileAndContributionsRemainIntact_: "{{ _('The user\'s previous profile and contributions remain intact.') }}",
 theUserWillBeAbleToViewAndEditItemsTheyPreviouslyHadAccessTo_: "{{ _('The user will be able to view and edit items they previously had access to.') }}",
+whatYouShouldKnow_: "{{ _('What you should know') }}",
+enterUsernameToConfirm_: "{{ _('Enter username to confirm') }}",
 
 originPlace_ : "{{ _('Place of Origin') }}",
 
diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index e8c90e54d..174409039 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -528,8 +528,8 @@
                     { name: "{{ _('Disabled') }}", value: 'disabled' },
                 ],
                 twoFactorOptions: [
-                    { name: 'Active', value: 'true' },
-                    { name: 'Inactive', value: 'false' },
+                    { name: "{{ _('Active') }}", value: 'true' },
+                    { name: "{{ _('Inactive') }}", value: 'false' },
                 ],
             }),
             computed: {
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 420ef2eaf..bb796b8f2 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -259,7 +259,7 @@ const UserCard = Vue.defineComponent({
           {{ actionSections[data.mode].title(user.name) }}
         </template>
         <template #default="{ data }">
-          <div class="text-body-2 mb-6 mt-3">What you should know</div>
+          <div class="text-body-2 mb-6 mt-3">{{ translations.whatYouShouldKnow_ }}</div>
           <div class="d-flex flex-column ga-6">
             <div v-for="(block, index) in actionSections[data.mode].blocks" :key="index" class="d-flex">
               <v-avatar color="white">
@@ -279,7 +279,7 @@ const UserCard = Vue.defineComponent({
             {{ actionSections[data.mode].confirmationText(user.username) }}
             <v-text-field
               v-model="username"
-              label="Enter username to confirm"
+              :label="translations.enterUsernameToConfirm_"
               variant="filled"
               class="mt-3"
             ></v-text-field>

From d6ba67f271989fcef6ea48d80eb8694cd9c7b886 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Mon, 1 Dec 2025 22:51:49 +0100
Subject: [PATCH 129/180] Remove role-stripping on user disable

---
 enferno/user/models.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index 14b2d8363..6d53aaffe 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -280,7 +280,7 @@ def set_status(self, new_status: UserStatus) -> None:
 
         # Side effects based on new status
         if new_status == UserStatus.DISABLED:
-            self.roles = []
+            # Note: roles are preserved for audit trail - disabled users can't login anyway
             self.view_usernames = False
             self.view_simple_history = False
             self.view_full_history = False

From 12bf6afa999ad491f1981750c4d741654b046071 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Mon, 1 Dec 2025 22:57:43 +0100
Subject: [PATCH 130/180] Update user status logic to default to SUSPENDED for
 users without roles

---
 enferno/user/models.py | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/enferno/user/models.py b/enferno/user/models.py
index 6d53aaffe..674289e61 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -445,13 +445,18 @@ def from_json(self, item: dict) -> "User":
         # Status can only be set during creation (user has no id yet)
         # For existing users, use set_status() or dedicated endpoints
         if not self.id:
-            status_str = item.get("status", "active")
-            try:
-                self.status = UserStatus(status_str)
-            except ValueError:
-                self.status = UserStatus.ACTIVE
-            # Sync deprecated active field
-            self.active = self.status == UserStatus.ACTIVE
+            # Users without roles default to SUSPENDED - must assign role to activate
+            if not self.roles:
+                self.status = UserStatus.SUSPENDED
+                self.active = False
+            else:
+                status_str = item.get("status", "active")
+                try:
+                    self.status = UserStatus(status_str)
+                except ValueError:
+                    self.status = UserStatus.ACTIVE
+                # Sync deprecated active field
+                self.active = self.status == UserStatus.ACTIVE
 
         return self
 

From cc1c4a7e85e63ba0c2e3075c1aa4d4afed8d54eb Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Mon, 1 Dec 2025 23:05:32 +0100
Subject: [PATCH 131/180] Update enable endpoint to activate users with roles
 directly

Users with roles are now set to ACTIVE when enabled, removing the  unnecessary SUSPENDED intermediate step. Users without roles still go to SUSPENDED and require role assignment before activation
---
 enferno/admin/views.py | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index d6e6f574f..12064c5de 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5519,8 +5519,8 @@ def api_user_disable(id: int) -> Response:
 @roles_required("Admin")
 def api_user_enable(id: int) -> Response:
     """
-    Re-enable a disabled account. Sets status to SUSPENDED (not ACTIVE)
-    since roles were cleared on disable. Admin must assign roles then reactivate.
+    Re-enable a disabled account. Sets status to ACTIVE if user has roles,
+    otherwise SUSPENDED (admin must assign roles then reactivate).
 
     Args:
         - id: id of the user to enable.
@@ -5535,9 +5535,16 @@ def api_user_enable(id: int) -> Response:
     if user.status != UserStatus.DISABLED:
         return HTTPResponse.success(message="User is already enabled")
 
-    # Set to SUSPENDED, not ACTIVE - user has no roles after disable
-    user.status = UserStatus.SUSPENDED
-    user.active = False
+    # Set to ACTIVE if user has roles, otherwise SUSPENDED
+    if user.roles:
+        user.status = UserStatus.ACTIVE
+        user.active = True
+        message = f"User {user.username} enabled and activated."
+    else:
+        user.status = UserStatus.SUSPENDED
+        user.active = False
+        message = f"User {user.username} enabled. Assign roles and reactivate to restore access."
+
     user.save()
 
     Activity.create(
@@ -5555,9 +5562,7 @@ def api_user_enable(id: int) -> Response:
         f"User {user.username} has been enabled by {current_user.username}.",
     )
 
-    return HTTPResponse.success(
-        message=f"User {user.username} enabled. Assign roles and reactivate to restore access."
-    )
+    return HTTPResponse.success(message=message)
 
 
 @admin.post("/api/user/<int:id>/status")

From 7aea65872c5d139d465e2a3df3a057128364ea61 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Mon, 1 Dec 2025 23:07:48 +0100
Subject: [PATCH 132/180] =?UTF-8?q?Simplified=20the=20unified=20/status=20?=
 =?UTF-8?q?endpoint,=20removed=20the=20forced=20DISABLED=20=E2=86=92=20SUS?=
 =?UTF-8?q?PENDED=20=E2=86=92=20ACTIVE=20flow.=20Now=20it=20just=20uses=20?=
 =?UTF-8?q?set=5Fstatus()=20which=20already=20has=20=20role=20validation?=
 =?UTF-8?q?=20built=20in?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 enferno/admin/views.py | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 12064c5de..4914b423e 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5594,20 +5594,9 @@ def api_user_set_status(id: int) -> Response:
     if user.status == status_enum:
         return HTTPResponse.success(message=f"User is already {new_status}")
 
-    # Disabled users must go through suspended first (to assign roles)
-    if user.status == UserStatus.DISABLED and status_enum == UserStatus.ACTIVE:
-        return HTTPResponse.error(
-            "Cannot activate disabled user directly. Set to 'suspended' first, assign roles, then activate."
-        )
-
     old_status = user.status.value
     try:
-        if user.status == UserStatus.DISABLED and status_enum == UserStatus.SUSPENDED:
-            # Enable: just set status directly (no roles to check)
-            user.status = UserStatus.SUSPENDED
-            user.active = False
-        else:
-            user.set_status(status_enum)
+        user.set_status(status_enum)
         user.save()
     except ValueError as e:
         return HTTPResponse.error(str(e))

From c9c4b1aa2cdbf3532f16bd3c74a16acf840a802d Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 2 Dec 2025 08:38:44 -0600
Subject: [PATCH 133/180] if user has no roles and is suspended disable button
 and add tooltip saying that a user needs to get assigned a system role to
 allow it being reactivated

---
 enferno/admin/templates/admin/jsapi.jinja2 | 1 +
 enferno/static/js/components/UserCard.js   | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index c2f9efdfa..eed791f1a 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -334,6 +334,7 @@ previousProfileAndContributionsRemainIntact_: "{{ _('The user\'s previous profil
 theUserWillBeAbleToViewAndEditItemsTheyPreviouslyHadAccessTo_: "{{ _('The user will be able to view and edit items they previously had access to.') }}",
 whatYouShouldKnow_: "{{ _('What you should know') }}",
 enterUsernameToConfirm_: "{{ _('Enter username to confirm') }}",
+pleaseAssignASystemRoleToReactivateUser_: "{{ _('Please assign a system role to reactivate user') }}",
 
 originPlace_ : "{{ _('Place of Origin') }}",
 
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index bb796b8f2..79c45eaac 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -499,7 +499,13 @@ const UserCard = Vue.defineComponent({
             <div class="mb-3 text-body-1">{{ translations.manageAccount_ }}</div>
             <div class="d-flex flex-wrap ga-3">
               <template v-if="isUserEnabled">
-                <v-btn v-if="isUserSuspended" @click="reactivateAccount()" variant="outlined" color="success" prepend-icon="mdi-play-circle">{{ translations.reactivateAccount_ }}</v-btn>
+                <v-tooltip v-if="isUserSuspended" location="bottom" :disabled="user.roles.length" :text="translations.pleaseAssignASystemRoleToReactivateUser_">
+                    <template #activator="{ props }">
+                      <div v-bind="props">
+                        <v-btn :disabled="!user.roles.length" @click="reactivateAccount()" variant="outlined" color="success" prepend-icon="mdi-play-circle">{{ translations.reactivateAccount_ }}</v-btn>
+                      </div>
+                    </template>
+                  </v-tooltip>
                 <v-btn v-if="isUserActive" @click="suspendAccount()" variant="outlined" color="warning" prepend-icon="mdi-pause-circle">{{ translations.suspendAccount_ }}</v-btn>
               </template>
               <v-btn v-if="isUserDisabled" @click="enableAccount()" variant="outlined" color="success" prepend-icon="mdi-arrow-down-thin-circle-outline">{{ translations.enableAccount_ }}</v-btn>

From 556b5febb92102c95fb588872c8cb6c7c158ccde Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 2 Dec 2025 08:58:51 -0600
Subject: [PATCH 134/180] if password reset was requested still allow to change
 password just hide the reset checkbox

---
 enferno/admin/templates/admin/users.html | 11 ++++++-----
 enferno/static/js/components/UserCard.js |  1 -
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 174409039..6a8c8de20 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -442,10 +442,10 @@
                                             validationRules.checkPassword({ onResponse: onPasswordCheckResponse })
                                         ]"
                                         @input="isStrongPassword = false"
-                                >
-                                    <template #label>{{ _('Temporary Password') }}<span class="text-red">*</span></template>
-                                </v-text-field>
-                                    <v-checkbox v-model="askUserToChangePassword" color="blue" class="text-medium-emphasis text-body-2" label="{{ _('Ask user to change password when they sign in') }}"></v-checkbox>
+                                    >
+                                        <template #label>{{ _('Temporary Password') }}<span class="text-red">*</span></template>
+                                    </v-text-field>
+                                    <v-checkbox v-if="!editedItem?.force_reset" v-model="askUserToChangePassword" color="blue" class="text-medium-emphasis text-body-2" label="{{ _('Ask user to change password when they sign in') }}"></v-checkbox>
                                 </v-card-text>
                             </v-form>
                             <v-card-actions class="px-7 pb-7 pt-0">
@@ -962,11 +962,12 @@
                     try {
                         this.saving = true;
                         const payload = { ...this.editedItem };
+                        const passwordResetRequested = this.editedItem?.force_reset != null;
                         delete payload.status; // Remove status field from payload
                         const response = await api.put(`/admin/api/user/`, { item: payload }, { suppressGlobalErrorHandler: true });
                         this.showSnack(response.data);
 
-                        if (this.askUserToChangePassword && this.editedItem?.force_reset === null) {
+                        if (!passwordResetRequested && this.askUserToChangePassword && this.editedItem?.force_reset === null) {
                             await this.forcePasswordReset(payload);
                         }
 
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 79c45eaac..c07468975 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -356,7 +356,6 @@ const UserCard = Vue.defineComponent({
                       <template #activator="{props}">
                         <div v-bind="props">
                           <v-btn
-                            :disabled="user.force_reset != null"
                             color="warning"
                             density="comfortable"
                             icon="mdi-form-textbox-password"

From 78f3dcdbe951788d0a25af2d702ae5cb40f8e966 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 2 Dec 2025 09:48:13 -0600
Subject: [PATCH 135/180] Parse number to boolean on disabled prop

---
 enferno/static/js/components/UserCard.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index c07468975..bc96ad06d 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -498,10 +498,10 @@ const UserCard = Vue.defineComponent({
             <div class="mb-3 text-body-1">{{ translations.manageAccount_ }}</div>
             <div class="d-flex flex-wrap ga-3">
               <template v-if="isUserEnabled">
-                <v-tooltip v-if="isUserSuspended" location="bottom" :disabled="user.roles.length" :text="translations.pleaseAssignASystemRoleToReactivateUser_">
+                <v-tooltip v-if="isUserSuspended" location="bottom" :disabled="Boolean(user.roles.length)" :text="translations.pleaseAssignASystemRoleToReactivateUser_">
                     <template #activator="{ props }">
                       <div v-bind="props">
-                        <v-btn :disabled="!user.roles.length" @click="reactivateAccount()" variant="outlined" color="success" prepend-icon="mdi-play-circle">{{ translations.reactivateAccount_ }}</v-btn>
+                        <v-btn :disabled="!Boolean(user.roles.length)" @click="reactivateAccount()" variant="outlined" color="success" prepend-icon="mdi-play-circle">{{ translations.reactivateAccount_ }}</v-btn>
                       </div>
                     </template>
                   </v-tooltip>

From 453cb5d7f5fad4bbc4a285e95bb7a16de141b86f Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 2 Dec 2025 10:31:32 -0600
Subject: [PATCH 136/180] tweak index selection

---
 enferno/admin/templates/admin/users.html | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 6a8c8de20..7a4a87f36 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -555,11 +555,10 @@
                     return this.isNewUser ? "{{_('Add New User')}}" : "{{_('Edit User')}}";
                 },
                 selectedRoleIndex() {
-                    if (!this.editedItem?.roles?.length) return null;
-
-                    return this.systemRoles.findIndex(role =>
-                        this.editedItem.roles.some(r => r?.name?.toLowerCase() === role?.value?.toLowerCase())
-                    ) || 0;
+                    const idx = this.systemRoles.findIndex(role =>
+                        this.editedItem.roles?.some(r => r?.name?.toLowerCase() === role.value)
+                    );
+                    return idx >= 0 ? idx : null;
                 },
                 selectedRole() {
                     return this.selectedRoleIndex != null

From 873ef27e50d504a5d6654b41cfc01b5a3e8754ba Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 2 Dec 2025 11:18:51 -0600
Subject: [PATCH 137/180] move actionSections from data to computed

---
 enferno/static/js/components/UserCard.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index bc96ad06d..e9876535c 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -102,11 +102,13 @@ const UserCard = Vue.defineComponent({
       page: 1,
       perPage: 5,
       more: true,
-      actionSections: actionSections(),
       username: '',
     };
   },
   computed: {
+    actionSections() {
+      return actionSections();
+    },
     isUserActive() {
       return this.user?.status === 'active';
     },

From 9c91eaf96a4a83bd0e078ac3b6be7410351d494f Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 2 Dec 2025 11:29:54 -0600
Subject: [PATCH 138/180] make toggle button more readable

---
 enferno/static/js/components/ToggleButton.js | 68 +++++++++++++++++---
 1 file changed, 58 insertions(+), 10 deletions(-)

diff --git a/enferno/static/js/components/ToggleButton.js b/enferno/static/js/components/ToggleButton.js
index fdcf80dc7..c9d032441 100644
--- a/enferno/static/js/components/ToggleButton.js
+++ b/enferno/static/js/components/ToggleButton.js
@@ -1,6 +1,6 @@
 const ToggleButton = Vue.defineComponent({
   props: {
-    modelValue: { type: Boolean, required: true, default: false },
+    modelValue: { type: Boolean, default: false },
     readOnly: { type: Boolean, default: false },
     activeColor: { type: String, default: 'primary' },
     hideLeftIcon: { type: Boolean, default: false },
@@ -8,21 +8,69 @@ const ToggleButton = Vue.defineComponent({
     disabled: { type: Boolean, default: false },
   },
   emits: ['update:modelValue', 'close'],
+
+  computed: {
+    variant() {
+      if (this.modelValue) return 'tonal';
+      if (this.readOnly) return 'tonal';
+      return 'outlined';
+    },
+
+    buttonColor() {
+      return this.modelValue ? this.activeColor : undefined;
+    },
+
+    buttonClasses() {
+      return [
+        'font-weight-medium',
+        { 'text-medium-emphasis cursor-default': this.readOnly }
+      ];
+    },
+
+    showLeftCheck() {
+      return this.modelValue && !this.hideLeftIcon;
+    },
+
+    showLeftCross() {
+      return !this.modelValue && this.readOnly && !this.hideLeftIcon;
+    },
+  },
+
+  methods: {
+    onClick() {
+      if (!this.readOnly) {
+        this.$emit('update:modelValue', !this.modelValue);
+      }
+    },
+  },
+
   template: `
     <v-btn
-      :variant="modelValue || (!modelValue && readOnly) ? 'tonal' : 'outlined'"
-      :color="modelValue ? activeColor : undefined"
-      @click="$emit('update:modelValue', !modelValue)"
-      :class="['font-weight-medium', { 'text-medium-emphasis cursor-default': readOnly }]"
+      :variant="variant"
+      :color="buttonColor"
+      :class="buttonClasses"
       :readonly="readOnly"
       :disabled="disabled"
+      @click="onClick"
     >
-      <template v-if="!hideLeftIcon">
-        <v-icon v-if="modelValue" start size="small">mdi-check</v-icon>
-        <v-icon v-if="!modelValue && readOnly" start size="small">mdi-close</v-icon>
+      <template v-if="showLeftCheck">
+        <v-icon start size="small">mdi-check</v-icon>
+      </template>
+
+      <template v-if="showLeftCross">
+        <v-icon start size="small">mdi-close</v-icon>
       </template>
+
       <slot></slot>
-      <v-icon v-if="closable" @click.stop="$emit('close', modelValue)" end size="small">mdi-close-circle</v-icon>
+
+      <v-icon
+        v-if="closable"
+        end
+        size="small"
+        @click.stop="$emit('close', modelValue)"
+      >
+        mdi-close-circle
+      </v-icon>
     </v-btn>
   `,
-});
\ No newline at end of file
+});

From a8f22428b28e27ad545c24026aca1c8ecc43b593 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 2 Dec 2025 11:33:52 -0600
Subject: [PATCH 139/180] get rid of timeout on cleanup and use v-dialog
 afterLeave event

---
 enferno/static/js/components/ConfirmDialog.js | 26 +++++++++----------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/enferno/static/js/components/ConfirmDialog.js b/enferno/static/js/components/ConfirmDialog.js
index c5ed90e17..c651c6d72 100644
--- a/enferno/static/js/components/ConfirmDialog.js
+++ b/enferno/static/js/components/ConfirmDialog.js
@@ -49,9 +49,9 @@ const ConfirmDialog = Vue.defineComponent({
         data,
       });
 
-      return new Promise((resolve, rejectPromise) => {
+      return new Promise((resolve, reject) => {
         this.resolvePromise = resolve;
-        this.rejectPromise = rejectPromise;
+        this.rejectPromise = reject;
       });
     },
 
@@ -78,21 +78,19 @@ const ConfirmDialog = Vue.defineComponent({
     },
 
     cleanup() {
-      setTimeout(() => {
-        this.loading = false;
-        this.onAccept = null;
-        this.onReject = null;
-        this.resolvePromise = null;
-        this.rejectPromise = null;
-        this.cancelProps = { text: translations.cancel_, variant: 'outlined' };
-        this.acceptProps = { text: translations.confirm_, color: 'primary', variant: 'flat' };
-        this.dialogProps = {};
-        this.data = null;
-      }, 300)
+      this.loading = false;
+      this.onAccept = null;
+      this.onReject = null;
+      this.resolvePromise = null;
+      this.rejectPromise = null;
+      this.cancelProps = { text: translations.cancel_, variant: 'outlined' };
+      this.acceptProps = { text: translations.confirm_, color: 'primary', variant: 'flat' };
+      this.dialogProps = {};
+      this.data = null;
     },
   },
   template: `
-    <v-dialog v-model="open" v-bind="{ persistent: loading, ...dialogProps}">
+    <v-dialog v-model="open" v-bind="{ persistent: loading, ...dialogProps}" @after-leave="cleanup()">
       <v-card rounded="12">
         <v-card-title class="px-7 pt-6 pb-0">
           <slot name="title" :data="data">{{ title }}</slot>

From af4e6b1ac25a30baca41710f4f8d01c8486ab179 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 2 Dec 2025 11:43:09 -0600
Subject: [PATCH 140/180] remove cleanup function since now it's automatically
 run on afterLeave

---
 enferno/static/js/components/ConfirmDialog.js | 2 --
 1 file changed, 2 deletions(-)

diff --git a/enferno/static/js/components/ConfirmDialog.js b/enferno/static/js/components/ConfirmDialog.js
index c651c6d72..374d454a4 100644
--- a/enferno/static/js/components/ConfirmDialog.js
+++ b/enferno/static/js/components/ConfirmDialog.js
@@ -59,7 +59,6 @@ const ConfirmDialog = Vue.defineComponent({
       await this.onReject?.();
       this.open = false;
       this.resolvePromise?.(false);
-      this.cleanup();
     },
 
     async ok() {
@@ -69,7 +68,6 @@ const ConfirmDialog = Vue.defineComponent({
         await this.onAccept?.(); // if this throws, code below won't run
         this.open = false;
         this.resolvePromise?.(true);
-        this.cleanup();
       } catch (error) {
         console.log('Something failed when confirming dialog', error)
       } finally {

From 22dd4520b1c316054af3bdb363272319f5361c56 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 2 Dec 2025 11:43:50 -0600
Subject: [PATCH 141/180] add null safe operators when confirm dialog is
 cleaned up

---
 enferno/static/js/components/UserCard.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index e9876535c..af870f52b 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -258,12 +258,12 @@ const UserCard = Vue.defineComponent({
   template: `
       <confirm-dialog ref="accountActionDialog" :disabled-accept="username !== user.username">
         <template #title="{ data }">
-          {{ actionSections[data.mode].title(user.name) }}
+          {{ actionSections[data?.mode]?.title(user.name) }}
         </template>
         <template #default="{ data }">
           <div class="text-body-2 mb-6 mt-3">{{ translations.whatYouShouldKnow_ }}</div>
           <div class="d-flex flex-column ga-6">
-            <div v-for="(block, index) in actionSections[data.mode].blocks" :key="index" class="d-flex">
+            <div v-for="(block, index) in actionSections[data?.mode]?.blocks" :key="index" class="d-flex">
               <v-avatar color="white">
                 <v-icon color="primary" size="x-large">{{ block.icon }}</v-icon>
               </v-avatar>
@@ -278,7 +278,7 @@ const UserCard = Vue.defineComponent({
             </div>
           </div>
           <div class="text-body-2 mt-6">
-            {{ actionSections[data.mode].confirmationText(user.username) }}
+            {{ actionSections[data?.mode]?.confirmationText(user.username) }}
             <v-text-field
               v-model="username"
               :label="translations.enterUsernameToConfirm_"

From aff1dea84315983847e542bdc07f23a250e8a004 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 3 Dec 2025 11:43:53 -0600
Subject: [PATCH 142/180] remove redundant check and rename variable

---
 enferno/admin/templates/admin/users.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 7a4a87f36..31a390ac2 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -961,12 +961,12 @@
                     try {
                         this.saving = true;
                         const payload = { ...this.editedItem };
-                        const passwordResetRequested = this.editedItem?.force_reset != null;
+                        const resetFlagIsSet = this.editedItem?.force_reset != null;
                         delete payload.status; // Remove status field from payload
                         const response = await api.put(`/admin/api/user/`, { item: payload }, { suppressGlobalErrorHandler: true });
                         this.showSnack(response.data);
 
-                        if (!passwordResetRequested && this.askUserToChangePassword && this.editedItem?.force_reset === null) {
+                        if (!resetFlagIsSet && this.askUserToChangePassword) {
                             await this.forcePasswordReset(payload);
                         }
 

From 89de59fbaacd5ac03a3123d9f401b117efe07b38 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 4 Dec 2025 13:15:52 +0100
Subject: [PATCH 143/180] Updated user history API endpoint to require "Admin"
 role

---
 enferno/admin/views.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 4914b423e..4ed12dd86 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -4858,7 +4858,7 @@ def api_locationhistory(locationid: t.id) -> Response:
 
 
 @admin.route("/api/userhistory/<int:userid>")
-@require_view_history
+@roles_required("Admin")
 def api_userhistory(userid: t.id) -> Response:
     """
     Endpoint to get revision history of a user.

From af4519899fdea41de1aaa865ae6013907e9af5ed Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 4 Dec 2025 13:33:03 +0100
Subject: [PATCH 144/180] Add password confirmation to reactivate and enable
 endpoints

---
 enferno/admin/views.py | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 4ed12dd86..af8f24809 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -14,6 +14,7 @@
 from flask_babel import gettext
 from flask_security import logout_user
 from flask_security.decorators import auth_required, current_user, roles_accepted, roles_required
+from flask_security.utils import verify_password
 from sqlalchemy import desc, or_, asc, select, func, and_
 from werkzeug.utils import safe_join, secure_filename
 from flask_security.twofactor import tf_disable
@@ -5437,10 +5438,18 @@ def api_user_reactivate(id: int) -> Response:
 
     Args:
         - id: id of the user to reactivate.
+        - password: admin's password for confirmation (in request body).
 
     Returns:
         - success/error response.
     """
+    password = request.json.get("password") if request.json else None
+    if not password:
+        return HTTPResponse.error("Password confirmation required")
+
+    if not verify_password(password, current_user.password):
+        return HTTPResponse.forbidden("Invalid password")
+
     user = db.session.get(User, id)
     if not user:
         return HTTPResponse.not_found("User not found")
@@ -5524,10 +5533,18 @@ def api_user_enable(id: int) -> Response:
 
     Args:
         - id: id of the user to enable.
+        - password: admin's password for confirmation (in request body).
 
     Returns:
         - success/error response.
     """
+    password = request.json.get("password") if request.json else None
+    if not password:
+        return HTTPResponse.error("Password confirmation required")
+
+    if not verify_password(password, current_user.password):
+        return HTTPResponse.forbidden("Invalid password")
+
     user = db.session.get(User, id)
     if not user:
         return HTTPResponse.not_found("User not found")

From 3819f77e88291b8160659e1a4bb36f0353d5ac2d Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 4 Dec 2025 13:40:42 +0100
Subject: [PATCH 145/180] Simplify UserHistory model for admin-only access

---
 enferno/admin/models/UserHistory.py | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/enferno/admin/models/UserHistory.py b/enferno/admin/models/UserHistory.py
index b40bfe253..bccd54c39 100644
--- a/enferno/admin/models/UserHistory.py
+++ b/enferno/admin/models/UserHistory.py
@@ -3,7 +3,6 @@
 
 from sqlalchemy import JSON
 
-from enferno.admin.models.utils import check_history_access
 from enferno.extensions import db
 from enferno.utils.base import BaseMixin
 from enferno.utils.date_helper import DateHelper
@@ -14,7 +13,8 @@
 
 class UserHistory(db.Model, BaseMixin):
     """
-    SQL Alchemy model for user revisions
+    SQL Alchemy model for user revisions.
+    Access is restricted to Admin role at the endpoint level.
     """
 
     id = db.Column(db.Integer, primary_key=True)
@@ -29,23 +29,11 @@ class UserHistory(db.Model, BaseMixin):
     user_id = db.Column(db.Integer, db.ForeignKey("user.id"))
     user = db.relationship("User", foreign_keys=[user_id])
 
-    @property
-    def restricted_data(self):
-        return {
-            "name": self.data.get("name"),
-            "username": self.data.get("username"),
-            "email": self.data.get("email"),
-            "active": self.data.get("active"),
-            "roles": self.data.get("roles"),
-        }
-
-    # serialize
-    @check_history_access
-    def to_dict(self, full=False) -> dict[str, Any]:
+    def to_dict(self) -> dict[str, Any]:
         """Return a dictionary representation of the user revision."""
         return {
             "id": self.id,
-            "data": self.data if full else self.restricted_data,
+            "data": self.data,
             "created_at": DateHelper.serialize_datetime(self.created_at),
             "user": self.user.to_compact() if self.user else None,
         }

From 72c560b535d45563c85cb797d829c05d38d8be02 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 4 Dec 2025 13:43:49 +0100
Subject: [PATCH 146/180] Remove auto-assignment of View role in migration

---
 .../20251105_225708_refactor_system_roles.sql | 25 +------------------
 1 file changed, 1 insertion(+), 24 deletions(-)

diff --git a/enferno/migrations/20251105_225708_refactor_system_roles.sql b/enferno/migrations/20251105_225708_refactor_system_roles.sql
index bbe6a27f6..820f747b2 100644
--- a/enferno/migrations/20251105_225708_refactor_system_roles.sql
+++ b/enferno/migrations/20251105_225708_refactor_system_roles.sql
@@ -1,5 +1,5 @@
 -- Migration: Refactor System Roles
--- Add new 'View' role, rename existing system roles, and assign View role to users without roles
+-- Add new 'View' role and rename existing system roles
 
 -- 1. Rename existing roles
 UPDATE role SET name = 'Moderator' WHERE name = 'Mod';
@@ -10,35 +10,12 @@ INSERT INTO role (name, description, view_simple_history, view_bulletin, edit_bu
 VALUES ('View', 'System Role', true, true, false, false)
 ON CONFLICT DO NOTHING;
 
--- 3. Assign View role to active users without any roles
-INSERT INTO roles_users (user_id, role_id)
-SELECT u.id, r.id
-FROM "user" u
-CROSS JOIN role r
-WHERE r.name = 'View'
-  AND u.active = true
-  AND NOT EXISTS (
-    SELECT 1 FROM roles_users ru WHERE ru.user_id = u.id
-  );
-
 -- Verify changes
 SELECT id, name, description FROM role ORDER BY id;
-SELECT u.id, u.username, u.active, COUNT(ru.role_id) as role_count
-FROM "user" u
-LEFT JOIN roles_users ru ON u.id = ru.user_id
-GROUP BY u.id, u.username, u.active
-ORDER BY role_count, u.id;
 
 -- Rollback script:
 /*
 UPDATE role SET name = 'Mod' WHERE name = 'Moderator';
 UPDATE role SET name = 'DA' WHERE name = 'Analyst';
-DELETE FROM roles_users
-WHERE role_id = (SELECT id FROM role WHERE name = 'View')
-  AND user_id IN (
-    SELECT u.id FROM "user" u
-    WHERE u.active = true
-    AND (SELECT COUNT(*) FROM roles_users WHERE user_id = u.id) = 1
-  );
 DELETE FROM role WHERE name = 'View';
 */

From b4a04f320e202bf71c46e38b40fee22686e7e545 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 4 Dec 2025 10:06:01 -0600
Subject: [PATCH 147/180] on reactivate or enable send password to confirm

---
 enferno/admin/templates/admin/jsapi.jinja2 |  5 ++--
 enferno/static/js/components/UserCard.js   | 33 +++++++++++++++++++---
 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index eed791f1a..246642878 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -309,11 +309,11 @@ relationshipBetweenActorAndBulletinWillBeCreated_ : "{{ _('The relationship betw
 youAreAboutToSuspendTheAccountForUser_: (name) => "{{ _('You\'re about to suspend the account for user \'{name}\'') }}".replace('{name}', name),
 byEnteringUsernameYouConfirmSuspendForUser_: (name) => "{{ _('By entering the user\'s username, you will confirm the suspend action for user \'{name}\'') }}".replace('{name}', name),
 youAreAboutToReactivateUser_: (name) => "{{ _('You\'re about to reactivate user \'{name}\'') }}".replace('{name}', name),
-byEnteringUsernameYouConfirmReactivationForUser_: (name) => "{{ _('By entering the user\'s username, you will confirm the reactivation for user \'{name}\'') }}".replace('{name}', name),
+byEnteringYourPasswordYouConfirmReactivationForUser_: (name) => "{{ _('By entering your password, you will confirm the reactivation for user \'{name}\'') }}".replace('{name}', name),
 youAreAboutToDisableTheAccountForUser_: (name) => "{{ _('You\'re about to disable the account for user \'{name}\'') }}".replace('{name}', name),
 byEnteringUsernameYouConfirmDisableForUser_: (name) => "{{ _('By entering the user\'s username, you will confirm the disable action for user \'{name}\'') }}".replace('{name}', name),
 youAreAboutToEnableTheAccountForUser_: (name) => "{{ _('You\'re about to enable the account for user \'{name}\'') }}".replace('{name}', name),
-byEnteringUsernameYouConfirmEnableForUser_: (name) => "{{ _('By entering the user\'s username, you will confirm enabling the account for user \'{name}\'') }}".replace('{name}', name),
+byEnteringYourPasswordYouConfirmEnablingTheAccountForUser_: (name) => "{{ _('By entering your password, you will confirm enabling the account for user \'{name}\'') }}".replace('{name}', name),
 intendedFor_: "{{ _('Intended for') }}",
 rolesAndAccessRemoval_: "{{ _('Roles and Access Removal') }}",
 rolesAndAccessRestoration_: "{{ _('Roles and Access Restoration') }}",
@@ -334,6 +334,7 @@ previousProfileAndContributionsRemainIntact_: "{{ _('The user\'s previous profil
 theUserWillBeAbleToViewAndEditItemsTheyPreviouslyHadAccessTo_: "{{ _('The user will be able to view and edit items they previously had access to.') }}",
 whatYouShouldKnow_: "{{ _('What you should know') }}",
 enterUsernameToConfirm_: "{{ _('Enter username to confirm') }}",
+confirmWithYourPassword_: "{{ _('Confirm with your password') }}",
 pleaseAssignASystemRoleToReactivateUser_: "{{ _('Please assign a system role to reactivate user') }}",
 
 originPlace_ : "{{ _('Place of Origin') }}",
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index af870f52b..bfed792a9 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -4,6 +4,7 @@ const actionSections = () => ({
     confirmationText: (name) => window.translations.byEnteringUsernameYouConfirmSuspendForUser_(name),
     acceptButtonText: window.translations.suspendAccount_,
     acceptButtonColor: "warning",
+    confirmationType: 'username',
     blocks: [
       {
         icon: "mdi-account-circle",
@@ -22,9 +23,10 @@ const actionSections = () => ({
   },
   reactivate: {
     title: (name) => window.translations.youAreAboutToReactivateUser_(name),
-    confirmationText: (name) => window.translations.byEnteringUsernameYouConfirmReactivationForUser_(name),
+    confirmationText: (name) => window.translations.byEnteringYourPasswordYouConfirmReactivationForUser_(name),
     acceptButtonText: window.translations.reactivateAccount_,
     acceptButtonColor: "success",
+    confirmationType: 'password',
     blocks: [
       {
         icon: "mdi-account",
@@ -48,6 +50,7 @@ const actionSections = () => ({
     confirmationText: (name) => window.translations.byEnteringUsernameYouConfirmDisableForUser_(name),
     acceptButtonText: window.translations.disableAccount_,
     acceptButtonColor: "error",
+    confirmationType: 'username',
     blocks: [
       {
         icon: "mdi-account-circle",
@@ -72,9 +75,10 @@ const actionSections = () => ({
   },
   enable: {
     title: (name) => window.translations.youAreAboutToEnableTheAccountForUser_(name),
-    confirmationText: (name) => window.translations.byEnteringUsernameYouConfirmEnableForUser_(name),
+    confirmationText: (name) => window.translations.byEnteringYourPasswordYouConfirmEnablingTheAccountForUser_(name),
     acceptButtonText: window.translations.enableAccount_,
     acceptButtonColor: "success",
+    confirmationType: 'password',
     blocks: [
       {
         icon: "mdi-account",
@@ -103,6 +107,8 @@ const UserCard = Vue.defineComponent({
       perPage: 5,
       more: true,
       username: '',
+      password: '',
+      showPassword: false,
     };
   },
   computed: {
@@ -225,13 +231,21 @@ const UserCard = Vue.defineComponent({
         data: { mode },
         acceptProps: { text: this.actionSections[mode].acceptButtonText, color: this.actionSections[mode].acceptButtonColor },
         onAccept: async () => {
-          await api.post(`/admin/api/user/${this.user.id}/${mode}`);
+          const payload = {};
+          if (this.actionSections[mode].confirmationType === 'password') {
+            payload.password = this.password;
+          }
+          await api.post(`/admin/api/user/${this.user.id}/${mode}`, payload);
           await this.$root.refreshUser(this.user.id);
           this.username = '';
+          this.password = '';
+          this.showPassword = false;
           this.displayAccountStatusUpdatedMessage(mode);
         },
         onReject: () => {
           this.username = '';
+          this.password = '';
+          this.showPassword = false;
         }
       })
     },
@@ -256,7 +270,7 @@ const UserCard = Vue.defineComponent({
     },
   },
   template: `
-      <confirm-dialog ref="accountActionDialog" :disabled-accept="username !== user.username">
+      <confirm-dialog ref="accountActionDialog" :disabled-accept="username !== user.username && !password">
         <template #title="{ data }">
           {{ actionSections[data?.mode]?.title(user.name) }}
         </template>
@@ -280,11 +294,22 @@ const UserCard = Vue.defineComponent({
           <div class="text-body-2 mt-6">
             {{ actionSections[data?.mode]?.confirmationText(user.username) }}
             <v-text-field
+              v-if="actionSections[data?.mode]?.confirmationType === 'username'"
               v-model="username"
               :label="translations.enterUsernameToConfirm_"
               variant="filled"
               class="mt-3"
             ></v-text-field>
+            <v-text-field
+              v-else
+              v-model="password"
+              :label="translations.confirmWithYourPassword_"
+              variant="filled"
+              class="mt-3"
+              :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
+              :type="showPassword ? 'text' : 'password'"
+              @click:append-inner="showPassword = !showPassword"
+            ></v-text-field>
           </div>
         </template>
       </confirm-dialog>

From b9041e0f9859427a66cd95164af90f3f1b231337 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Fri, 5 Dec 2025 13:07:21 +0100
Subject: [PATCH 148/180] Add Moderator role to all Analyst endpoints

---
 enferno/admin/views.py | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index af8f24809..866cb4268 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -3281,7 +3281,7 @@ def api_bulletins(validated_data: dict) -> Response:
 
 
 @admin.post("/api/bulletin/")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @can_assign_roles
 @validate_with(BulletinRequestModel)
 def api_bulletin_create(
@@ -3328,7 +3328,7 @@ def api_bulletin_create(
 
 
 @admin.put("/api/bulletin/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(BulletinRequestModel)
 def api_bulletin_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -3398,7 +3398,7 @@ def api_bulletin_update(id: t.id, validated_data: dict) -> Response:
 
 # Add/Update review bulletin endpoint
 @admin.put("/api/bulletin/review/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(BulletinReviewRequestModel)
 def api_bulletin_review_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -3625,7 +3625,7 @@ def api_bulletin_import() -> Response:
 
 
 @admin.put("/api/bulletin/assign/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(BulletinSelfAssignRequestModel)
 def api_bulletin_self_assign(id: t.id, validated_data: dict) -> Response:
     """
@@ -3691,7 +3691,7 @@ def api_bulletin_self_assign(id: t.id, validated_data: dict) -> Response:
 
 
 @admin.put("/api/actor/assign/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(ActorSelfAssignRequestModel)
 def api_actor_self_assign(id: t.id, validated_data: dict) -> Response:
     """
@@ -3748,7 +3748,7 @@ def api_actor_self_assign(id: t.id, validated_data: dict) -> Response:
 
 
 @admin.put("/api/incident/assign/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(IncidentSelfAssignRequestModel)
 def api_incident_self_assign(id: t.id, validated_data: dict) -> Response:
     """
@@ -3812,7 +3812,7 @@ def api_incident_self_assign(id: t.id, validated_data: dict) -> Response:
 
 
 @admin.post("/api/media/chunk")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 def api_medias_chunk() -> Response:
     """
     Endpoint for uploading media files based on file system settings.
@@ -3932,7 +3932,7 @@ def api_medias_chunk() -> Response:
 
 
 @admin.post("/api/media/upload/")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 def api_medias_upload() -> Response:
     """
     Endpoint to upload screenshots based on file system settings.
@@ -4127,7 +4127,7 @@ def api_local_serve_media(
 
 
 @admin.post("/api/inline/upload")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 def api_inline_medias_upload() -> Response:
     """
     Endpoint to upload inline media files.
@@ -4168,7 +4168,7 @@ def api_local_serve_inline_media(filename: str) -> Response:
 
 
 @admin.put("/api/media/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(MediaRequestModel)
 def api_media_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -4373,7 +4373,7 @@ def api_actors(validated_data: dict) -> Response:
 
 # create actor endpoint
 @admin.post("/api/actor/")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(ActorRequestModel)
 @can_assign_roles
 def api_actor_create(
@@ -4419,7 +4419,7 @@ def api_actor_create(
 
 # update actor endpoint
 @admin.put("/api/actor/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(ActorRequestModel)
 def api_actor_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -4493,7 +4493,7 @@ def api_actor_update(id: t.id, validated_data: dict) -> Response:
 
 # Add/Update review actor endpoint
 @admin.put("/api/actor/review/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(ActorReviewRequestModel)
 def api_actor_review_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -6000,7 +6000,7 @@ def api_incidents(validated_data: dict) -> Response:
 
 
 @admin.post("/api/incident/")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @can_assign_roles
 @validate_with(IncidentRequestModel)
 def api_incident_create(
@@ -6050,7 +6050,7 @@ def api_incident_create(
 
 # update incident endpoint
 @admin.put("/api/incident/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(IncidentRequestModel)
 def api_incident_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -6126,7 +6126,7 @@ def api_incident_update(id: t.id, validated_data: dict) -> Response:
 
 # Add/Update review incident endpoint
 @admin.put("/api/incident/review/<int:id>")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(IncidentReviewRequestModel)
 def api_incident_review_update(id: t.id, validated_data: dict) -> Response:
     """
@@ -6919,7 +6919,7 @@ def api_mark_all_notifications_read():
 
 
 @admin.post("/api/bulletin/web")
-@roles_accepted("Admin", "Analyst")
+@roles_accepted("Admin", "Moderator", "Analyst")
 @validate_with(WebImportValidationModel)
 def api_bulletin_web_import(validated_data: dict) -> Response:
     """Import bulletin from web URL"""

From bf03d70e2211d75740e3cbb6c1361008ef2d9274 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Fri, 5 Dec 2025 13:07:56 +0100
Subject: [PATCH 149/180] Update tests for Moderator access to Analyst
 endpoints

---
 tests/admin/test_actors.py    | 8 ++++----
 tests/admin/test_bulletins.py | 9 +++++----
 tests/admin/test_incidents.py | 8 ++++----
 tests/admin/test_medias.py    | 4 ++--
 4 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/tests/admin/test_actors.py b/tests/admin/test_actors.py
index a4cac3939..640644c58 100644
--- a/tests/admin/test_actors.py
+++ b/tests/admin/test_actors.py
@@ -254,7 +254,7 @@ def test_actor_endpoint_roled_restricted(
 post_actor_endpoint_roles = [
     ("admin_client", 201),
     ("da_client", 201),
-    ("mod_client", 403),
+    ("mod_client", 201),
     ("anonymous_client", 401),
 ]
 
@@ -338,7 +338,7 @@ def test_put_actor_endpoint(
 put_actor_endpoint_roles2 = [
     ("admin_client", 200),
     ("da_client", 200),
-    ("mod_client", 403),
+    ("mod_client", 200),
     ("anonymous_client", 401),
 ]
 
@@ -393,7 +393,7 @@ def test_put_actor_assigned_endpoint(
     ("anonymous_client", 401),
     ("admin_sa_client", 200),
     ("da_sa_client", 200),
-    ("mod_sa_client", 403),
+    ("mod_sa_client", 200),
 ]
 
 
@@ -425,7 +425,7 @@ def test_put_actor_assign_endpoint(
 put_actor_review_endpoint_roles = [
     ("admin_client", 200),
     ("da_client", 200),
-    ("mod_client", 403),
+    ("mod_client", 200),
     ("anonymous_client", 401),
 ]
 
diff --git a/tests/admin/test_bulletins.py b/tests/admin/test_bulletins.py
index 27cf05fb7..dee0448ac 100644
--- a/tests/admin/test_bulletins.py
+++ b/tests/admin/test_bulletins.py
@@ -236,7 +236,7 @@ def test_bulletin_endpoint_roled_restricted(
 post_bulletin_endpoint_roles = [
     ("admin_client", 201),
     ("da_client", 201),
-    ("mod_client", 403),
+    ("mod_client", 201),
     ("anonymous_client", 401),
 ]
 
@@ -275,6 +275,7 @@ def test_post_bulletin_endpoint(clean_slate_bulletins, request, client_fixture,
     ("mod_client", 403),
     ("anonymous_client", 401),
 ]
+# Note: This tests unassigned bulletins - DA/Mod can only edit assigned bulletins
 
 
 @pytest.mark.parametrize("client_fixture, expected_status", put_bulletin_endpoint_roles)
@@ -307,7 +308,7 @@ def test_put_bulletin_endpoint(
 put_bulletin_endpoint_roles2 = [
     ("admin_client", 200),
     ("da_client", 200),
-    ("mod_client", 403),
+    ("mod_client", 200),
     ("anonymous_client", 401),
 ]
 
@@ -353,7 +354,7 @@ def test_put_bulletin_assigned_endpoint(
 put_bulletin_review_endpoint_roles = [
     ("admin_client", 200),
     ("da_client", 200),
-    ("mod_client", 403),
+    ("mod_client", 200),
     ("anonymous_client", 401),
 ]
 
@@ -457,7 +458,7 @@ def test_get_bulletin_relations_endpoint(
     ("anonymous_client", 401),
     ("admin_sa_client", 200),
     ("da_sa_client", 200),
-    ("mod_sa_client", 403),
+    ("mod_sa_client", 200),
 ]
 
 
diff --git a/tests/admin/test_incidents.py b/tests/admin/test_incidents.py
index c4d80f82c..cf6621cb6 100644
--- a/tests/admin/test_incidents.py
+++ b/tests/admin/test_incidents.py
@@ -221,7 +221,7 @@ def test_incident_endpoint_roled_restricted(
 post_incident_endpoint_roles = [
     ("admin_client", 201),
     ("da_client", 201),
-    ("mod_client", 403),
+    ("mod_client", 201),
     ("anonymous_client", 401),
 ]
 
@@ -289,7 +289,7 @@ def test_put_incident_endpoint(
 put_incident_endpoint_roles2 = [
     ("admin_client", 200),
     ("da_client", 200),
-    ("mod_client", 403),
+    ("mod_client", 200),
     ("anonymous_client", 401),
 ]
 
@@ -334,7 +334,7 @@ def test_put_incident_assigned_endpoint(
     ("anonymous_client", 401),
     ("admin_sa_client", 200),
     ("da_sa_client", 200),
-    ("mod_sa_client", 403),
+    ("mod_sa_client", 200),
 ]
 
 
@@ -366,7 +366,7 @@ def test_put_incident_assign_endpoint(
 put_incident_review_endpoint_roles = [
     ("admin_client", 200),
     ("da_client", 200),
-    ("mod_client", 403),
+    ("mod_client", 200),
     ("anonymous_client", 401),
 ]
 
diff --git a/tests/admin/test_medias.py b/tests/admin/test_medias.py
index a78c7c2bc..08f9d441c 100644
--- a/tests/admin/test_medias.py
+++ b/tests/admin/test_medias.py
@@ -29,7 +29,7 @@ def create_media_file(request, app):
 post_media_chunk_endpoint_roles = [
     ("admin_client", 200),
     ("da_client", 200),
-    ("mod_client", 403),
+    ("mod_client", 200),
     ("anonymous_client", 401),
 ]
 
@@ -141,7 +141,7 @@ def test_post_media_chunk_endpoint_chunked_upload(
 post_media_upload_endpoint_roles = [
     ("admin_client", 200),
     ("da_client", 200),
-    ("mod_client", 403),
+    ("mod_client", 200),
     ("anonymous_client", 401),
 ]
 

From 67b9faadb78ce58157110a33dc3de730a8d51215 Mon Sep 17 00:00:00 2001
From: tarekio <7659394+tarekio@users.noreply.github.com>
Date: Fri, 5 Dec 2025 16:10:25 +0000
Subject: [PATCH 150/180] Improve roles descriptions

---
 enferno/admin/templates/admin/users.html | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 31a390ac2..46751f75d 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -517,10 +517,10 @@
                 askUserToChangePassword: true,
 
                 systemRoles: [
-                    { name: "{{ _('View') }}", value: 'view', description: "{{ _('Users can view items in Actors, Bulletins, and Incidents but cannot edit or add new items.') }}" },
-                    { name: "{{ _('Data Analyst') }}", value: 'analyst', description: "{{ _('User can view all items and edit only those assigned to them. User can review assigned items for peer review.') }}" },
-                    { name: "{{ _('Moderator') }}", value: 'moderator', description: "{{ _('User can manage system data, edit assigned items, and perform bulk updates.') }}" },
-                    { name: "{{ _('Administrator') }}", value: 'admin', description: "{{ _('Full access to all items and actions, including Activity Monitor and user management across the system.') }}" },
+                    { name: "{{ _('View') }}", value: 'view', description: "{{ _('View-only users can view and search Actors, Bulletins, and Incidents strictly defined by the system\'s access policies and assigned access roles. They cannot create new items or edit existing ones.') }}" },
+                    { name: "{{ _('Data Analyst') }}", value: 'analyst', description: "{{ _('Analysts can view and search Actors, Bulletins, and Incidents permitted by the system\'s access policies and assigned access roles. They can create new items, as well as edit and review items specifically assigned to them.') }}" },
+                    { name: "{{ _('Moderator') }}", value: 'moderator', description: "{{ _('Moderators assist Administrators in managing the system. They can add or edit secondary items (Labels, Locations, Component Data) and perform bulk assignments. This role includes the same creation and access privileges as Analysts, subject to access policies and assigned access roles.') }}" },
+                    { name: "{{ _('Administrator') }}", value: 'admin', description: "{{ _('Administrators have unrestricted access to all system items, settings, logs, and actions. They manage users, access controls, approve export requests and import data in bulk via Bayanat tools. Only trusted, trained and competent users should be assigned this role.') }}" },
                 ],
                 accountStatusOptions: [
                     { name: "{{ _('Active') }}", value: 'active' },

From b7f30f0ecf929a73200b8a24c77de4516a614544 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 5 Dec 2025 11:13:55 -0600
Subject: [PATCH 151/180] make system role required by default

---
 enferno/admin/templates/admin/users.html | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 46751f75d..d182e2ede 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -355,18 +355,19 @@
 
                                         <v-row>
                                             <v-col cols="12" lg="6">
-                                                <div class="mb-3 text-body-1">{{ _('System Role') }}</div>
+                                                <div class="mb-3 text-body-1">{{ _('System Role') }}<span class="text-red">*</span></div>
                                                 <div class="d-flex flex-wrap ga-3 mb-7">
-                                                    <v-btn-toggle
-                                                        :model-value="selectedRoleIndex"
-                                                        @update:model-value="updateSystemRole($event)"
-                                                        variant="outlined"
-                                                        divided
-                                                        color="primary"
-                                                    >
-                                                        <v-btn v-for="(role) in systemRoles" :key="role?.value">${role.name}</v-btn>
-                                                    </v-btn-toggle>
-                                                    <div class="text-caption text-medium-emphasis">${selectedRole?.description}</div>
+                                                    <v-input :model-value="selectedRoleIndex" :messages="selectedRole?.description" :rules="[validationRules.atLeastOneRequired(selectedRoleIndex)]">
+                                                        <v-btn-toggle
+                                                            :model-value="selectedRoleIndex"
+                                                            @update:model-value="updateSystemRole($event)"
+                                                            variant="outlined"
+                                                            divided
+                                                            color="primary"
+                                                        >
+                                                            <v-btn v-for="(role) in systemRoles" :key="role?.value">${role.name}</v-btn>
+                                                        </v-btn-toggle>
+                                                    </v-input>
                                                 </div>
                                             </v-col>
                                             <v-col cols="12" lg="6">

From 30b039c61b21c68561c8856072ea9ddf5c726ed9 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 5 Dec 2025 11:14:18 -0600
Subject: [PATCH 152/180] tweak validation to allow selecting 0 values

---
 enferno/static/js/common/config.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/enferno/static/js/common/config.js b/enferno/static/js/common/config.js
index 55fd354f2..dbb2fcb21 100644
--- a/enferno/static/js/common/config.js
+++ b/enferno/static/js/common/config.js
@@ -105,7 +105,8 @@ const validationRules = {
 
 // Helper functions
 function hasValue(value) {
-    return Array.isArray(value) ? value.length > 0 : !!value;
+    if (Array.isArray(value)) return value.length > 0;
+    return value === 0 || Boolean(value);
 }
 
 function isValidLength(value, limit, type) {

From 60f903a9aa79c3d902631a54c8e403860593cbcb Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 5 Dec 2025 11:15:55 -0600
Subject: [PATCH 153/180] rename data analyst to analyst

---
 enferno/admin/templates/admin/users.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index d182e2ede..7f92fdb09 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -519,7 +519,7 @@
 
                 systemRoles: [
                     { name: "{{ _('View') }}", value: 'view', description: "{{ _('View-only users can view and search Actors, Bulletins, and Incidents strictly defined by the system\'s access policies and assigned access roles. They cannot create new items or edit existing ones.') }}" },
-                    { name: "{{ _('Data Analyst') }}", value: 'analyst', description: "{{ _('Analysts can view and search Actors, Bulletins, and Incidents permitted by the system\'s access policies and assigned access roles. They can create new items, as well as edit and review items specifically assigned to them.') }}" },
+                    { name: "{{ _('Analyst') }}", value: 'analyst', description: "{{ _('Analysts can view and search Actors, Bulletins, and Incidents permitted by the system\'s access policies and assigned access roles. They can create new items, as well as edit and review items specifically assigned to them.') }}" },
                     { name: "{{ _('Moderator') }}", value: 'moderator', description: "{{ _('Moderators assist Administrators in managing the system. They can add or edit secondary items (Labels, Locations, Component Data) and perform bulk assignments. This role includes the same creation and access privileges as Analysts, subject to access policies and assigned access roles.') }}" },
                     { name: "{{ _('Administrator') }}", value: 'admin', description: "{{ _('Administrators have unrestricted access to all system items, settings, logs, and actions. They manage users, access controls, approve export requests and import data in bulk via Bayanat tools. Only trusted, trained and competent users should be assigned this role.') }}" },
                 ],

From 93f5dc08cb33d3486e5d810a6f77e9e2adba8aa5 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 5 Dec 2025 11:53:39 -0600
Subject: [PATCH 154/180] improve logic of system role selection, becoming an
 admin selects all roles, when leaving the admin role we reset selection

---
 enferno/admin/templates/admin/users.html | 93 ++++++++++++++++--------
 1 file changed, 64 insertions(+), 29 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 7f92fdb09..ed6ac289b 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -516,6 +516,7 @@
                 adminRoleId: 1,
                 changePasswordDialog: false,
                 askUserToChangePassword: true,
+                hadAdminRoleBefore: false,
 
                 systemRoles: [
                     { name: "{{ _('View') }}", value: 'view', description: "{{ _('View-only users can view and search Actors, Bulletins, and Incidents strictly defined by the system\'s access policies and assigned access roles. They cannot create new items or edit existing ones.') }}" },
@@ -790,20 +791,27 @@
 
                 },
 
-                checkRoles() {
-                    this.isAdmin = this.editedUserHasAdminRole;
-                    if (this.isAdmin) {
-                        this.editedItem.view_usernames = true;
-                        this.editedItem.view_simple_history = true;
-                        this.editedItem.view_full_history = true;
-                        this.editedItem.can_self_assign = true;
-                        this.editedItem.can_edit_locations = true;
-                        this.editedItem.can_export = true;
-                        this.editedItem.can_import_web = true;
-                        this.editedItem.roles = [this.roles[0], ...this.accessRoles];
-                        return true;
-                    }
-                    return false;
+                applyAdministratorPrivileges() {
+                    this.editedItem.view_usernames = true;
+                    this.editedItem.view_simple_history = true;
+                    this.editedItem.view_full_history = true;
+                    this.editedItem.can_self_assign = true;
+                    this.editedItem.can_edit_locations = true;
+                    this.editedItem.can_export = true;
+                    this.editedItem.can_import_web = true;
+                    this.editedItem.roles = [this.roles[0], ...this.accessRoles];
+                },
+                clearNonAdminAccess(roles = []) {
+                    this.editedItem.roles = roles ?? [];
+
+                    // Limpia permisos
+                    this.editedItem.view_usernames = false;
+                    this.editedItem.view_simple_history = false;
+                    this.editedItem.view_full_history = false;
+                    this.editedItem.can_self_assign = false;
+                    this.editedItem.can_edit_locations = false;
+                    this.editedItem.can_export = false;
+                    this.editedItem.can_import_web = false;
                 },
 
                 refresh(options) {
@@ -873,6 +881,7 @@
                 createItem() {
                     this.editedItem = {};
                     this.dialog = true;
+                    this.hadAdminRoleBefore = false;
                 },
 
                 editItem(item) {
@@ -882,6 +891,7 @@
                     this.isUsernameAvailable = false;
                     this.initialUsername = item.username;
                     this.dialog = true;
+                    this.hadAdminRoleBefore = this.editedUserHasAdminRole;
                 },
 
 
@@ -979,26 +989,51 @@
                         this.saving = false;
                     }
                 },
-               updateSystemRole(index) {
-                    if (index === null || index === undefined) return;
-
-                    const systemRole = this.systemRoles?.[index];
-
-                    if (!Array.isArray(this.editedItem?.roles)) this.editedItem.roles = [];
+                updateSystemRole(index) {
+                    if (index == null) return;
 
-                    const selectedRole = this.roles?.find(
-                        r => r?.name?.toLowerCase() === systemRole?.value?.toLowerCase()
-                    );
+                    const systemRole = this.systemRoles[index];
 
-                    const preservedRoles = this.editedItem.roles.filter(r => this.accessRoles.some(ar => ar.name.toLowerCase() === r.name.toLowerCase()));
+                    if (this.isSystemAdmin(systemRole)) {
+                        return this.becomeAdmin();
+                    }
 
-                    if (!selectedRole) {
-                        this.editedItem.roles = [...preservedRoles];
-                    } else {
-                        this.editedItem.roles = [selectedRole, ...preservedRoles];
+                    if (this.hadAdminRoleBefore) {
+                        return this.leaveAdmin(systemRole);
                     }
 
-                    this.checkRoles();
+                    this.applyNormalSystemRole(systemRole);
+                },
+                becomeAdmin() {
+                    this.applyAdministratorPrivileges();
+                    this.hadAdminRoleBefore = true;
+                },
+
+                leaveAdmin(systemRole) {
+                    const nextRoles = this.buildNextRoles(systemRole);
+                    this.clearNonAdminAccess(nextRoles);
+                    this.hadAdminRoleBefore = false;
+                },
+                applyNormalSystemRole(systemRole) {
+                    const selectedRole = this.getRoleFromName(systemRole.value);
+                    const accessRoles = this.getPreservedAccessRoles();
+                    this.editedItem.roles = selectedRole
+                        ? [selectedRole, ...accessRoles]
+                        : accessRoles;
+                    this.hadAdminRoleBefore = false;
+                },
+                getRoleFromName(name) {
+                    return this.roles.find(r => r.name.toLowerCase() === name.toLowerCase());
+                },
+                getPreservedAccessRoles() {
+                    return this.editedItem.roles.filter(r =>
+                        this.accessRoles.some(a => a.name.toLowerCase() === r.name.toLowerCase())
+                    );
+                },
+                buildNextRoles(systemRole) {
+                    const selected = this.getRoleFromName(systemRole.value);
+                    const access = this.getPreservedAccessRoles();
+                    return selected ? [selected, ...access] : access;
                 },
                 isAccessRoleSelected(role) {
                     return this.editedItemAccessRoles?.some(r => r.name === role.name)

From 255f960e39fe1b0ecf721358c07c913e24c92670 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 5 Dec 2025 12:04:02 -0600
Subject: [PATCH 155/180] fix errors when selecting admin

---
 enferno/admin/templates/admin/users.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index ed6ac289b..a99da9d23 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -994,7 +994,7 @@
 
                     const systemRole = this.systemRoles[index];
 
-                    if (this.isSystemAdmin(systemRole)) {
+                    if (systemRole.value === 'admin') {
                         return this.becomeAdmin();
                     }
 
@@ -1010,8 +1010,8 @@
                 },
 
                 leaveAdmin(systemRole) {
-                    const nextRoles = this.buildNextRoles(systemRole);
-                    this.clearNonAdminAccess(nextRoles);
+                    const selected = this.getRoleFromName(systemRole.value);
+                    this.clearNonAdminAccess([selected]);
                     this.hadAdminRoleBefore = false;
                 },
                 applyNormalSystemRole(systemRole) {

From 6dbc8835b75f978c8e2b2d3d9dab54f03781d5a3 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 5 Dec 2025 12:07:44 -0600
Subject: [PATCH 156/180] fix empty roles array

---
 enferno/admin/templates/admin/users.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index a99da9d23..9ae921e59 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -1026,6 +1026,7 @@
                     return this.roles.find(r => r.name.toLowerCase() === name.toLowerCase());
                 },
                 getPreservedAccessRoles() {
+                    if (!Array.isArray(this.editedItem.roles)) this.editedItem.roles = [];
                     return this.editedItem.roles.filter(r =>
                         this.accessRoles.some(a => a.name.toLowerCase() === r.name.toLowerCase())
                     );

From dc9b37de1646e22585d7bddd3f614c69880ab314 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Fri, 5 Dec 2025 14:23:11 -0600
Subject: [PATCH 157/180] add label to access role on admin selection, bring
 back previous selection, and do not select access roles on admin selection

---
 enferno/admin/templates/admin/users.html | 57 +++++++++++++++++-------
 1 file changed, 41 insertions(+), 16 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 9ae921e59..88ae57dca 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -356,7 +356,7 @@
                                         <v-row>
                                             <v-col cols="12" lg="6">
                                                 <div class="mb-3 text-body-1">{{ _('System Role') }}<span class="text-red">*</span></div>
-                                                <div class="d-flex flex-wrap ga-3 mb-7">
+                                                <div class="d-flex flex-wrap ga-3">
                                                     <v-input :model-value="selectedRoleIndex" :messages="selectedRole?.description" :rules="[validationRules.atLeastOneRequired(selectedRoleIndex)]">
                                                         <v-btn-toggle
                                                             :model-value="selectedRoleIndex"
@@ -371,15 +371,19 @@
                                                 </div>
                                             </v-col>
                                             <v-col cols="12" lg="6">
-                                                <div class="mb-3 text-body-1">{{ _('Access Role') }}</div>
+                                                <div class="mb-3 text-body-1">
+                                                    {{ _('Access Role') }}
+                                                    <span v-if="editedUserHasAdminRole" class="text-caption text-medium-emphasis font-italic ml-2">
+                                                        {{ _('(Admins have unrestricted access regardless of access roles)') }}
+                                                    </span>
+                                                </div>
+
                                                 <div class="d-flex flex-wrap ga-3 mb-7">
                                                     <toggle-button
                                                         v-for="role in accessRoles"
                                                         :key="role.id"
                                                         :model-value="isAccessRoleSelected(role)"
                                                         @update:model-value="toggleAccessRole(role)"
-                                                        :read-only="editedUserHasAdminRole"
-                                                        :hide-left-icon="editedUserHasAdminRole"
                                                     >
                                                         ${role.name}
                                                     </toggle-button>
@@ -791,7 +795,7 @@
 
                 },
 
-                applyAdministratorPrivileges() {
+                applyAllPermissions() {
                     this.editedItem.view_usernames = true;
                     this.editedItem.view_simple_history = true;
                     this.editedItem.view_full_history = true;
@@ -799,12 +803,8 @@
                     this.editedItem.can_edit_locations = true;
                     this.editedItem.can_export = true;
                     this.editedItem.can_import_web = true;
-                    this.editedItem.roles = [this.roles[0], ...this.accessRoles];
                 },
-                clearNonAdminAccess(roles = []) {
-                    this.editedItem.roles = roles ?? [];
-
-                    // Limpia permisos
+                clearAllPermissions() {
                     this.editedItem.view_usernames = false;
                     this.editedItem.view_simple_history = false;
                     this.editedItem.view_full_history = false;
@@ -906,6 +906,8 @@
                         this.isStrongPassword = false;
                         this.editedItem = {};
                         this.editedIndex = -1;
+                        this.beforeAdminPermissions = null;
+                        this.hadAdminRoleBefore = false;
                     }, 300);
                 },
 
@@ -995,7 +997,7 @@
                     const systemRole = this.systemRoles[index];
 
                     if (systemRole.value === 'admin') {
-                        return this.becomeAdmin();
+                        return this.becomeAdmin(systemRole);
                     }
 
                     if (this.hadAdminRoleBefore) {
@@ -1004,14 +1006,37 @@
 
                     this.applyNormalSystemRole(systemRole);
                 },
-                becomeAdmin() {
-                    this.applyAdministratorPrivileges();
+                becomeAdmin(systemRole) {
+                    this.beforeAdminPermissions = {
+                        view_usernames: this.editedItem.view_usernames,
+                        view_simple_history: this.editedItem.view_simple_history,
+                        view_full_history: this.editedItem.view_full_history,
+                        can_self_assign: this.editedItem.can_self_assign,
+                        can_edit_locations: this.editedItem.can_edit_locations,
+                        can_export: this.editedItem.can_export,
+                        can_import_web: this.editedItem.can_import_web,
+                    };
+
+                    const nextRoles = this.buildNextRoles(systemRole);
+                    this.editedItem.roles = nextRoles;
+
+                    this.applyAllPermissions();
                     this.hadAdminRoleBefore = true;
                 },
 
                 leaveAdmin(systemRole) {
-                    const selected = this.getRoleFromName(systemRole.value);
-                    this.clearNonAdminAccess([selected]);
+                    const nextRoles = this.buildNextRoles(systemRole);
+                    this.editedItem.roles = nextRoles;
+
+                    if (this.beforeAdminPermissions) {
+                        // User became admin during this session → restore their previous permissions
+                        Object.assign(this.editedItem, this.beforeAdminPermissions);
+                    } else {
+                        // User was already admin before opening the dialog → default restricted permissions
+                        this.clearAllPermissions();
+                    }
+
+                    this.beforeAdminPermissions = null;
                     this.hadAdminRoleBefore = false;
                 },
                 applyNormalSystemRole(systemRole) {
@@ -1023,7 +1048,7 @@
                     this.hadAdminRoleBefore = false;
                 },
                 getRoleFromName(name) {
-                    return this.roles.find(r => r.name.toLowerCase() === name.toLowerCase());
+                    return this.roles.find(r => r.name.toLowerCase() === name?.toLowerCase());
                 },
                 getPreservedAccessRoles() {
                     if (!Array.isArray(this.editedItem.roles)) this.editedItem.roles = [];

From 7d8dcbbb3b0198ba36b435cdd37d095aa8b9de22 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 11 Dec 2025 13:00:52 -0600
Subject: [PATCH 158/180] add new translation

---
 enferno/admin/templates/admin/jsapi.jinja2 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index 246642878..cc67a4a2b 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -105,6 +105,7 @@ userHasBeenSuspended_: (name) => "{{ _('User \'{name}\' has been suspended.') }}
 userHasBeenDisabled_: (name) => "{{ _('User \'{name}\' has been disabled.') }}".replace("{name}", name),
 userHasBeenReactivated_: (name) => "{{ _('User \'{name}\' has been reactivated.') }}".replace("{name}", name),
 userHasBeenEnabled_: (name) => "{{ _('User \'{name}\' has been enabled.') }}".replace("{name}", name),
+revisionHistory_: "{{ _('Revision History') }}",
 
 cancel_ : "{{ _('Cancel') }}",
 titleOrTitleArRequired_ : "{{ _('Title or Title (Ar) is required') }}",

From 82e5d4a63e20198d3e8376f24d189f1e3c33a7d3 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 11 Dec 2025 13:01:29 -0600
Subject: [PATCH 159/180] add history button with tooltip on toolbar and emit
 showHistory evt

---
 enferno/static/js/components/UserCard.js | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index bfed792a9..ded6246b0 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -96,7 +96,7 @@ const actionSections = () => ({
 
 const UserCard = Vue.defineComponent({
   props: ['user', 'closable'],
-  emits: ['close', 'edit', 'resetPassword', 'revoke2fa', 'logoutAll', 'changePassword'],
+  emits: ['close', 'edit', 'resetPassword', 'revoke2fa', 'logoutAll', 'changePassword', 'showHistory'],
   components: { ConfirmDialog },
   data() {
     return {
@@ -112,6 +112,9 @@ const UserCard = Vue.defineComponent({
     };
   },
   computed: {
+    logAllowed() {
+      return this.$root.currentUser.view_simple_history;
+    },
     actionSections() {
       return actionSections();
     },
@@ -357,6 +360,22 @@ const UserCard = Vue.defineComponent({
               </template>
   
               <div class="d-flex justify-space-between ga-2 align-center">
+                <v-tooltip
+                  v-if="logAllowed"
+                  location="bottom"
+                  :text="translations.revisionHistory_"
+                >
+                  <template #activator="{props}">
+                    <div v-bind="props">
+                      <v-btn
+                        density="comfortable"
+                        icon="mdi-history"
+                        @click="$emit('showHistory', user)"
+                      ></v-btn>
+                    </div>
+                  </template>
+                </v-tooltip>
+
                 <template v-if="isUserEnabled">
                   <template v-if="$root.userId !== user.id">
                     <v-tooltip

From 9a384afdfaf31b01b37bb7ad0c4c1a1ed46a3928 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 11 Dec 2025 13:01:54 -0600
Subject: [PATCH 160/180] call open history function to display drawer

---
 enferno/admin/templates/admin/partials/user_drawer.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/partials/user_drawer.html b/enferno/admin/templates/admin/partials/user_drawer.html
index 0e23cf7f8..fa1e256ff 100644
--- a/enferno/admin/templates/admin/partials/user_drawer.html
+++ b/enferno/admin/templates/admin/partials/user_drawer.html
@@ -15,8 +15,8 @@
             @revoke2fa="openRevoke2FADialog($event)"
             @logout-all="openLogoutAllUserSessionsDialog($event)"
             @change-password="openChangePasswordDialog($event)"
+            @show-history="openHistoryDrawer($event)"
             :user="user"
         ></user-card>
     </v-card>
-
 </v-navigation-drawer>
\ No newline at end of file

From 2c83a502e5dcb723fc16ddcb3857696b726dff9e Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 11 Dec 2025 13:16:30 -0600
Subject: [PATCH 161/180] revision history drawer on users page

---
 enferno/admin/templates/admin/users.html | 104 ++++++++++++++++++++++-
 1 file changed, 103 insertions(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 88ae57dca..5c605e27b 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -467,12 +467,82 @@
     </v-main>
     {% include 'admin/partials/user_drawer.html' %}
 
+    <!-- Revision history sidebar -->
+    <v-navigation-drawer v-model="historyDrawer" location="right" temporary width="630" disable-route-watcher>
+        <v-card flat>
+            <v-card-title class="pa-6">
+                {{ _('Revision history') }} - (${this.revisionState.user?.username})
+            </v-card-title>
+    
+            <!-- Loading -->
+            <div v-if="hloading" class="text-center py-6">
+                <v-progress-circular indeterminate size="32"></v-progress-circular>
+            </div>
+    
+            <!-- Empty -->
+            <div v-else-if="revisionState.history.length === 0" class="text-center py-6 text-medium-emphasis">
+                <v-icon size="40" class="mb-2">mdi-history</v-icon>
+                {{ _('No revision history available.') }}
+            </div>
+    
+            <!-- Timeline -->
+            <v-card-text v-else class="px-6">
+                <v-timeline density="compact" side="end" align="start">
+                    <v-timeline-item v-for="(revision, index) in revisionState.history" :key="revision.id || index" dot-color="primary"
+                        size="10">
+                        <div class="mt-n1">
+                            <!-- Header -->
+                            <div>
+                                <v-chip size="x-small" label class="mr-2">${revision.data.status}</v-chip>
+                                <b>${revision.user.username}</b>
+                                {{ _('updated user') }}
+    
+                                <!-- Current version label -->
+                                <b v-if="index === 0">
+                                    ({{ _('Current settings') }})
+                                </b>
+    
+                                <!-- Created at -->
+                                <span class="text-muted">
+                                    – ${formatDate(revision.created_at, dateFormats.standardDatetime, dateOptions.local)}
+                                </span>
+                            </div>
+    
+                            <!-- No diff between this revision and previous -->
+                            <div v-if="index > 0 && !DiffTool.hasDiff(revisionState.history[index + 1]?.data, revision.data)"
+                                class="font-italic text-medium-emphasis mt-1"
+                            >
+                                {{ _('No changes in this configuration') }}
+                            </div>
+    
+                            <!-- Diff details -->
+                            <show-details v-else-if="index !== revisionState.history.length - 1 && diffAllowed"
+                                show-more-text="{{ _('Show detailed changes') }}" show-less-text="{{ _('Collapse') }}"
+                                class="mt-2"
+                            >
+                                <diff-renderer :diff="DiffTool.getAndRenderDiff(revisionState.history[index + 1]?.data, revision.data)" />
+                            </show-details>
+                        </div>
+                    </v-timeline-item>
+                </v-timeline>
+    
+            </v-card-text>
+        </v-card>
+    </v-navigation-drawer>
+
+
 
 {% endblock %} {% block js %}
     <script src="/static/js/components/UserCard.js"></script>
     <script src="/static/js/components/ToggleButton.js"></script>
+    <script src="/static/js/components/ShowDetails.js"></script>
+    <script src="/static/js/diff-tool.js"></script>
+    <script src="/static/js/components/DiffRenderer.js"></script>
 
-    <script>
+   <script type="module">
+        import * as jsondiffpatch from '/static/js/jsondiffpatch/jsondiffpatch.esm.min.js'
+        import * as htmlFormatter from '/static/js/jsondiffpatch/formatters/html.js'
+        import '/static/js/jsondiffpatch/formatters/base.js'
 
         const {createApp} = Vue;
         const {createVuetify} = Vuetify;
@@ -492,6 +562,13 @@
                 validationRules: validationRules,
                 options: {},
                 search: '',
+                revisionState: {
+                    user: null,
+                    history: [],
+                },
+                hloading: false,
+                historyDrawer: false,
+                DiffTool: DiffTool,
 
                 headers: [
                     {title: "{{_('ID')}}", value: "id"},
@@ -521,6 +598,7 @@
                 changePasswordDialog: false,
                 askUserToChangePassword: true,
                 hadAdminRoleBefore: false,
+                currentUser: JSON.parse(`{{ current_user.to_dict()|tojson }}`),
 
                 systemRoles: [
                     { name: "{{ _('View') }}", value: 'view', description: "{{ _('View-only users can view and search Actors, Bulletins, and Incidents strictly defined by the system\'s access policies and assigned access roles. They cannot create new items or edit existing ones.') }}" },
@@ -539,6 +617,9 @@
                 ],
             }),
             computed: {
+                diffAllowed() {
+                    return this.currentUser.view_full_history;
+                },
                 accessRoles() {
                     return this.roles?.filter(role => !this.systemRoles.some(systemRole => systemRole.value === role.name.toLowerCase()));
                 },
@@ -612,6 +693,22 @@
 
 
             methods: {
+                openHistoryDrawer(user) {
+                    this.userDrawer = false;
+                    this.historyDrawer = true;
+                    this.loadRevisions(user);
+                },
+                loadRevisions(user) {
+                    this.hloading = true;
+                    axios
+                        .get(`/admin/api/userhistory/${user.id}`)
+                        .then((response) => {
+                            this.revisionState.history = response.data.items;
+                            this.revisionState.user = user;
+                        }).finally(() => {
+                            this.hloading = false;
+                        });
+                },
                 getUserSystemRoles(user) {
                     return user.roles?.filter(role => this.systemRoles?.some(systemRole => systemRole.value.toLowerCase() === role.name.toLowerCase())) ?? [];
                 },
@@ -1079,8 +1176,13 @@
             }
         });
 
+        app.config.globalProperties.$jsondiffpatch = jsondiffpatch;
+        app.config.globalProperties.$htmlFormatter = htmlFormatter;
+
         app.component('UserCard', UserCard);
         app.component('ToggleButton', ToggleButton);
+        app.component('ShowDetails', ShowDetails);
+        app.component('DiffRenderer', DiffRenderer);
         app.use(router).use(vuetify).mount('#app')
     </script>
 {% endblock %}

From 652cd34a546343e8ea2d4e44cdc4288beb4832c2 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 11 Dec 2025 14:37:29 -0600
Subject: [PATCH 162/180] map history so it looks better on diff

---
 enferno/admin/templates/admin/users.html | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 5c605e27b..ca1a5e0f3 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -702,10 +702,18 @@
                     this.hloading = true;
                     axios
                         .get(`/admin/api/userhistory/${user.id}`)
-                        .then((response) => {
-                            this.revisionState.history = response.data.items;
+                        .then(({ data }) => {
+                            this.revisionState.history = data.items.map(item => ({
+                                ...item,
+                                data: {
+                                    ...item.data,
+                                    roles: (item.data?.roles || []).map(r => r.name)
+                                }
+                            }));
+
                             this.revisionState.user = user;
-                        }).finally(() => {
+                        })
+                        .finally(() => {
                             this.hloading = false;
                         });
                 },

From d4ae13602e64cde4fbf006f6206a22f5e337c7dd Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Mon, 15 Dec 2025 20:57:48 +0100
Subject: [PATCH 163/180] Add /api/users/assignable/ endpoint for task
 assignment

Dedicated endpoint returning only active users in compact format.  Designed for Moderators to get user lists for assignment tasks  without access to sensitive filters (2FA, roles, status).
---
 enferno/admin/views.py | 45 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 866cb4268..7c17264e8 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -4887,6 +4887,51 @@ def api_userhistory(userid: t.id) -> Response:
 # user management routes
 
 
+@admin.route("/api/users/assignable/")
+@roles_accepted("Admin", "Moderator")
+def api_users_assignable() -> Response:
+    """
+    API endpoint for listing active users available for assignment tasks.
+    Returns a simplified user list with only active users.
+
+    Query Parameters:
+        - page: Page number (default: 1)
+        - per_page: Items per page (default: PER_PAGE)
+        - q: Search term (searches username, name)
+
+    Returns:
+        - json feed of active users in compact format.
+    """
+    page = request.args.get("page", 1, int)
+    per_page = request.args.get("per_page", PER_PAGE, int)
+    q = request.args.get("q")
+
+    query = [User.status == UserStatus.ACTIVE]
+
+    if q is not None:
+        search_term = f"%{q}%"
+        query.append(
+            or_(
+                User.username.ilike(search_term),
+                User.name.ilike(search_term),
+            )
+        )
+
+    result = (
+        User.query.filter(*query)
+        .order_by(User.username)
+        .paginate(page=page, per_page=per_page, count=True)
+    )
+
+    response = {
+        "items": [item.to_compact() for item in result.items],
+        "perPage": per_page,
+        "total": result.total,
+    }
+
+    return HTTPResponse.success(data=response)
+
+
 @admin.route("/api/users/")
 @roles_accepted("Admin", "Moderator")
 def api_users() -> Response:

From 1d6ed3c2d5e1c3ae05200b80a4419ed10d878074 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Mon, 15 Dec 2025 20:59:01 +0100
Subject: [PATCH 164/180] Update roles decorator for /api/users/ endpoint to
 require "Admin" role only

---
 enferno/admin/views.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 7c17264e8..0de66a415 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -4933,7 +4933,7 @@ def api_users_assignable() -> Response:
 
 
 @admin.route("/api/users/")
-@roles_accepted("Admin", "Moderator")
+@roles_required("Admin")
 def api_users() -> Response:
     """
     API endpoint to feed users data in json format, supports paging, search, and filtering.

From 87e7171a8d5f9660609433b189b92d2f6becf1b6 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Mon, 15 Dec 2025 22:19:42 +0100
Subject: [PATCH 165/180]  Update user endpoint tests for role-based access
 changes

  - Moderator now gets 403 on /api/users/ (admin-only)
  - Add tests for /api/users/assignable/ endpoint (admin + moderator)
---
 tests/admin/test_users.py | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/tests/admin/test_users.py b/tests/admin/test_users.py
index 0760b86b3..16891e066 100644
--- a/tests/admin/test_users.py
+++ b/tests/admin/test_users.py
@@ -152,7 +152,7 @@ def user_to_dict(user):
 get_users_endpoint_roles = [
     ("admin_client", 200),
     ("da_client", 403),
-    ("mod_client", 200),
+    ("mod_client", 403),
     ("anonymous_client", 401),
 ]
 
@@ -166,6 +166,27 @@ def test_get_users_endpoint(request, client_fixture, expected_status):
         conform_to_schema_or_fail(convert_empty_strings_to_none(response.json), UsersResponseModel)
 
 
+##### GET /admin/api/users/assignable #####
+
+get_users_assignable_endpoint_roles = [
+    ("admin_client", 200),
+    ("da_client", 403),
+    ("mod_client", 200),
+    ("anonymous_client", 401),
+]
+
+
+@pytest.mark.parametrize("client_fixture, expected_status", get_users_assignable_endpoint_roles)
+def test_get_users_assignable_endpoint(request, client_fixture, expected_status):
+    client_ = request.getfixturevalue(client_fixture)
+    response = client_.get(
+        "/admin/api/users/assignable/", headers={"Content-Type": "application/json"}
+    )
+    assert response.status_code == expected_status
+    if expected_status == 200:
+        conform_to_schema_or_fail(convert_empty_strings_to_none(response.json), UsersResponseModel)
+
+
 ##### POST /admin/api/user #####
 
 post_user_endpoint_roles = [

From 43954c5b301ab8a53cea2fec8690c323489f3645 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 16 Dec 2025 08:25:29 -0600
Subject: [PATCH 166/180] update /users endpoint for /assignable so moderators
 can keep loading users lists

---
 enferno/admin/templates/admin/actors.html                     | 2 +-
 enferno/admin/templates/admin/incidents.html                  | 2 +-
 enferno/admin/templates/admin/partials/bulk_actor_drawer.html | 4 ++--
 .../admin/templates/admin/partials/bulk_bulletin_drawer.html  | 4 ++--
 .../admin/templates/admin/partials/bulk_incident_drawer.html  | 4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/enferno/admin/templates/admin/actors.html b/enferno/admin/templates/admin/actors.html
index 2cbb0a453..373401f7b 100644
--- a/enferno/admin/templates/admin/actors.html
+++ b/enferno/admin/templates/admin/actors.html
@@ -1292,7 +1292,7 @@
                 searchUsers: debounce(function (evt) {
                     this.searchLoading[evt.target.dataset.loader] = true;
 
-                    api.get(`/admin/api/users/?q=${evt.target.value}`).then(response => {
+                    api.get(`/admin/api/users/assignable?q=${evt.target.value}`).then(response => {
                         this.users = response.data.items;
                         this.searchLoading[evt.target.dataset.loader] = false;
                     });
diff --git a/enferno/admin/templates/admin/incidents.html b/enferno/admin/templates/admin/incidents.html
index bfd8269c3..f2107ae38 100644
--- a/enferno/admin/templates/admin/incidents.html
+++ b/enferno/admin/templates/admin/incidents.html
@@ -1118,7 +1118,7 @@
                 searchUsers: debounce(function (evt) {
                     this.searchLoading[evt.target.dataset.loader] = true;
 
-                    api.get(`/admin/api/users/?q=${evt.target.value}`).then(response => {
+                    api.get(`/admin/api/users/assignable?q=${evt.target.value}`).then(response => {
                         this.users = response.data.items;
                         this.searchLoading[evt.target.dataset.loader] = false;
                     });
diff --git a/enferno/admin/templates/admin/partials/bulk_actor_drawer.html b/enferno/admin/templates/admin/partials/bulk_actor_drawer.html
index 2482cbc67..5880bd274 100644
--- a/enferno/admin/templates/admin/partials/bulk_actor_drawer.html
+++ b/enferno/admin/templates/admin/partials/bulk_actor_drawer.html
@@ -22,7 +22,7 @@
                 <div class="d-flex">
                     <search-field
                         v-model="bulk.assigned_to_id"
-                        api="/admin/api/users/"
+                        api="/admin/api/users/assignable"
                         item-title="name"
                         item-value="id"
                         :return-object="false"
@@ -38,7 +38,7 @@
                 <div class="d-flex">
                     <search-field
                         v-model="bulk.first_peer_reviewer_id"
-                        api="/admin/api/users/"
+                        api="/admin/api/users/assignable"
                         item-title="name"
                         item-value="id"
                         :multiple="false"
diff --git a/enferno/admin/templates/admin/partials/bulk_bulletin_drawer.html b/enferno/admin/templates/admin/partials/bulk_bulletin_drawer.html
index eb142bdfb..3bde499e0 100644
--- a/enferno/admin/templates/admin/partials/bulk_bulletin_drawer.html
+++ b/enferno/admin/templates/admin/partials/bulk_bulletin_drawer.html
@@ -23,7 +23,7 @@
                 <div class="d-flex">
                     <search-field
                         v-model="bulk.assigned_to_id"
-                        api="/admin/api/users/"
+                        api="/admin/api/users/assignable"
                         item-title="name"
                         item-value="id"
                         :return-object="false"
@@ -39,7 +39,7 @@
                 <div class="d-flex">
                     <search-field
                         v-model="bulk.first_peer_reviewer_id"
-                        api="/admin/api/users/"
+                        api="/admin/api/users/assignable"
                         item-title="name"
                         item-value="id"
                         :multiple="false"
diff --git a/enferno/admin/templates/admin/partials/bulk_incident_drawer.html b/enferno/admin/templates/admin/partials/bulk_incident_drawer.html
index d553b6d6f..4b5940ad0 100644
--- a/enferno/admin/templates/admin/partials/bulk_incident_drawer.html
+++ b/enferno/admin/templates/admin/partials/bulk_incident_drawer.html
@@ -21,7 +21,7 @@
                 <div class="d-flex">
                     <search-field
                         v-model="bulk.assigned_to_id"
-                        api="/admin/api/users/"
+                        api="/admin/api/users/assignable"
                         item-title="name"
                         item-value="id"
                         :return-object="false"
@@ -37,7 +37,7 @@
                 <div class="d-flex">
                     <search-field
                         v-model="bulk.first_peer_reviewer_id"
-                        api="/admin/api/users/"
+                        api="/admin/api/users/assignable"
                         item-title="name"
                         item-value="id"
                         :multiple="false"

From a9f2ce4f54c0cc77d5adafddd2f961ec221ee8e3 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 6 Jan 2026 13:43:38 -0600
Subject: [PATCH 167/180] parse user agent to display in sessions table device
 and browser

---
 enferno/admin/templates/admin/jsapi.jinja2 |  5 ++
 enferno/static/js/components/UserCard.js   | 69 +++++++++++++++++++++-
 2 files changed, 71 insertions(+), 3 deletions(-)

diff --git a/enferno/admin/templates/admin/jsapi.jinja2 b/enferno/admin/templates/admin/jsapi.jinja2
index cc67a4a2b..3c6bdfd90 100644
--- a/enferno/admin/templates/admin/jsapi.jinja2
+++ b/enferno/admin/templates/admin/jsapi.jinja2
@@ -106,6 +106,11 @@ userHasBeenDisabled_: (name) => "{{ _('User \'{name}\' has been disabled.') }}".
 userHasBeenReactivated_: (name) => "{{ _('User \'{name}\' has been reactivated.') }}".replace("{name}", name),
 userHasBeenEnabled_: (name) => "{{ _('User \'{name}\' has been enabled.') }}".replace("{name}", name),
 revisionHistory_: "{{ _('Revision History') }}",
+desktop_: "{{ _('Desktop') }}",
+tablet_: "{{ _('Tablet') }}",
+mobile_: "{{ _('Mobile') }}",
+unknownBrowser_: "{{ _('Unknown Browser') }}",
+unknownOS_: "{{ _('Unknown OS') }}",
 
 cancel_ : "{{ _('Cancel') }}",
 titleOrTitleArRequired_ : "{{ _('Title or Title (Ar) is required') }}",
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index ded6246b0..1ce65e09a 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -265,6 +265,69 @@ const UserCard = Vue.defineComponent({
     enableAccount() {
       this.openAccountDialog("enable");
     },
+    parseUserAgent(ua) {
+      const uaLower = ua.toLowerCase();
+
+      // ---- Device ----
+      let device = 'desktop';
+      if (/mobile|iphone|android|ipad/.test(uaLower)) {
+        device = /ipad/.test(uaLower) ? 'tablet' : 'mobile';
+      }
+
+      // ---- OS ----
+      let os = 'unknown';
+      if (/mac os x/.test(uaLower)) os = 'macos';
+      else if (/windows nt/.test(uaLower)) os = 'windows';
+      else if (/android/.test(uaLower)) os = 'android';
+      else if (/iphone|ipad|ipod/.test(uaLower)) os = 'ios';
+      else if (/linux/.test(uaLower)) os = 'linux';
+
+      // ---- Browser (family, not flavor) ----
+      let browser = 'unknown';
+      if (uaLower.includes('firefox')) {
+        browser = 'firefox';
+      } else if (
+        /safari/.test(uaLower) &&
+        !uaLower.includes('chrome') &&
+        !uaLower.includes('crios') &&
+        !uaLower.includes('fxios')
+      ) {
+        browser = 'safari';
+      } else if (uaLower.includes('chrome') || uaLower.includes('chromium')) {
+        browser = 'chrome'; // Chrome, Brave, Edge, Opera
+      }
+
+      // ---- Display label ----
+      const OS_LABEL = {
+        macos: 'Mac',
+        windows: 'Windows',
+        linux: 'Linux',
+        ios: 'iPhone',
+        android: 'Android',
+        unknown: window.translations.unknownOS_
+      };
+
+      const BROWSER_LABEL = {
+        chrome: 'Chrome',
+        firefox: 'Firefox',
+        safari: 'Safari',
+        unknown: window.translations.unknownBrowser_
+      };
+
+      const DEVICE_LABEL = {
+        desktop: window.translations.desktop_,
+        mobile: window.translations.mobile_,
+        tablet: window.translations.tablet_
+      };
+
+      return {
+        deviceLabel: `${OS_LABEL[os]} (${DEVICE_LABEL[device]})`,
+        device,   // desktop | mobile | tablet
+        os,       // macos | windows | linux | ios | android
+        browser,  // chrome | firefox | safari
+        browserLabel: BROWSER_LABEL[browser]
+      };
+    }
   },
   watch: {
     user(val, old) {
@@ -608,11 +671,11 @@ const UserCard = Vue.defineComponent({
 
 
                 </td>
-                <td>
-                  {{ session.meta.os }}
+                <td class="text-caption">
+                  {{ parseUserAgent(session.meta.device)?.deviceLabel }}
                 </td>
                 <td class="text-caption">
-                  {{ session.meta.browser }}
+                  {{ parseUserAgent(session.meta.device)?.browserLabel }}
                 </td>
                 <td class="text-caption">{{ $root.formatDate(session.created_at, $root.dateFormats.standardDatetime, $root.dateOptions.local) }}</td>
                 <td>

From cad17a003c915a9918f968d5e1b5ca8274dd3559 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 6 Jan 2026 14:17:26 -0600
Subject: [PATCH 168/180] add round toggle button to user card

---
 enferno/static/js/components/ToggleButton.js | 2 ++
 enferno/static/js/components/UserCard.js     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/enferno/static/js/components/ToggleButton.js b/enferno/static/js/components/ToggleButton.js
index c9d032441..448759dc6 100644
--- a/enferno/static/js/components/ToggleButton.js
+++ b/enferno/static/js/components/ToggleButton.js
@@ -6,6 +6,7 @@ const ToggleButton = Vue.defineComponent({
     hideLeftIcon: { type: Boolean, default: false },
     closable: { type: Boolean, default: false },
     disabled: { type: Boolean, default: false },
+    rounded: { type: String, default: () => null },
   },
   emits: ['update:modelValue', 'close'],
 
@@ -52,6 +53,7 @@ const ToggleButton = Vue.defineComponent({
       :readonly="readOnly"
       :disabled="disabled"
       @click="onClick"
+      :rounded="rounded"
     >
       <template v-if="showLeftCheck">
         <v-icon start size="small">mdi-check</v-icon>
diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 1ce65e09a..9510b3348 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -530,6 +530,7 @@ const UserCard = Vue.defineComponent({
                     read-only
                     hide-left-icon
                     :model-value="true"
+                    rounded="xl"
                   >
                     {{ $root.systemRoles.find(r => r.value === role.name.toLowerCase())?.name ?? role.name }}
                   </toggle-button>
@@ -547,6 +548,7 @@ const UserCard = Vue.defineComponent({
                     read-only
                     hide-left-icon
                     :model-value="true"
+                    rounded="xl"
                   >
                     {{ role.name }}
                   </toggle-button>

From 3f43ddacc85c9d5ad74549d34cb257037dc47971 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 6 Jan 2026 14:27:43 -0600
Subject: [PATCH 169/180] fix if statement to allow showing no changes text on
 first revision item

---
 enferno/admin/templates/admin/users.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index ca1a5e0f3..e321ed78e 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -509,7 +509,7 @@
                             </div>
     
                             <!-- No diff between this revision and previous -->
-                            <div v-if="index > 0 && !DiffTool.hasDiff(revisionState.history[index + 1]?.data, revision.data)"
+                            <div v-if="!DiffTool.hasDiff(revisionState.history[index + 1]?.data, revision.data)"
                                 class="font-italic text-medium-emphasis mt-1"
                             >
                                 {{ _('No changes in this configuration') }}

From c2c9c486a5f2c98143a3150bcac3643c4cf0f055 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Tue, 6 Jan 2026 23:11:01 +0100
Subject: [PATCH 170/180] Fix Activity.create() call and type signature in
 forms.py

---
 enferno/admin/models/Activity.py | 8 ++++----
 enferno/user/forms.py            | 9 ++++++---
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/enferno/admin/models/Activity.py b/enferno/admin/models/Activity.py
index 1989242e5..4654efecd 100644
--- a/enferno/admin/models/Activity.py
+++ b/enferno/admin/models/Activity.py
@@ -76,10 +76,10 @@ def to_dict(self) -> dict[str, Any]:
     # helper static method to create different type of activities (tags)
     @staticmethod
     def create(
-        user: t.id,
+        user: "User",
         action: str,
         status: str,
-        subject: str,
+        subject: dict,
         model: str,
         details: Optional[str] = None,
     ) -> None:
@@ -87,10 +87,10 @@ def create(
         Create an activity.
 
         Args:
-            - user: the user id.
+            - user: the user object.
             - action: the action.
             - status: the status.
-            - subject: the subject.
+            - subject: the subject dict (e.g. from to_mini()).
             - model: the model.
             - details: the details.
         """
diff --git a/enferno/user/forms.py b/enferno/user/forms.py
index 883ed0e0b..96891210c 100644
--- a/enferno/user/forms.py
+++ b/enferno/user/forms.py
@@ -42,9 +42,12 @@ def validate(self, **kwargs):
                 logger.warning(f"User {user.username} blocked - no system role")
 
                 Activity.create(
-                    user_id=user.id,
-                    action="Login blocked - no system role",
-                    details=f"User attempted login without assigned role",
+                    user=user,
+                    action=Activity.ACTION_LOGIN,
+                    status=Activity.STATUS_DENIED,
+                    subject={"class": "user", "id": user.id},
+                    model="User",
+                    details="Login blocked - no system role assigned",
                 )
 
                 Notification.send_admin_notification_for_event(

From 03b9a24e43f1abe0825d5f8e14ae4cf643cb2aad Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Tue, 6 Jan 2026 23:16:39 +0100
Subject: [PATCH 171/180] Add revision history for user status changes

---
 enferno/admin/views.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 0de66a415..cee873231 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5456,6 +5456,7 @@ def api_user_suspend(id: int) -> Response:
 
     user.set_status(UserStatus.SUSPENDED)
     user.save()
+    user.create_revision()
 
     Activity.create(
         current_user,
@@ -5508,6 +5509,7 @@ def api_user_reactivate(id: int) -> Response:
     try:
         user.set_status(UserStatus.ACTIVE)
         user.save()
+        user.create_revision()
     except ValueError as e:
         return HTTPResponse.error(str(e))
 
@@ -5550,6 +5552,7 @@ def api_user_disable(id: int) -> Response:
 
     user.set_status(UserStatus.DISABLED)
     user.save()
+    user.create_revision()
 
     Activity.create(
         current_user,
@@ -5608,6 +5611,7 @@ def api_user_enable(id: int) -> Response:
         message = f"User {user.username} enabled. Assign roles and reactivate to restore access."
 
     user.save()
+    user.create_revision()
 
     Activity.create(
         current_user,

From 9e3081912d64004ed895b894669d5318a0e0887b Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Tue, 6 Jan 2026 23:17:28 +0100
Subject: [PATCH 172/180] Add activity logging for admin force password reset

---
 enferno/admin/views.py | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index cee873231..16bdf158f 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5412,7 +5412,17 @@ def api_user_force_reset(validated_data: dict) -> Response:
         message = f"Forced password reset already requested: {reset_key}"
         return HTTPResponse.error(message)
     user.set_security_reset_key()
-    message = f"User ‘{user.name}’ will reset password at next sign-in."
+
+    Activity.create(
+        current_user,
+        Activity.ACTION_UPDATE,
+        Activity.STATUS_SUCCESS,
+        user.to_mini(),
+        "user",
+        details="force password reset requested",
+    )
+
+    message = f"User '{user.name}' will reset password at next sign-in."
     return HTTPResponse.success(message=message)
 
 

From f9e5453488032d7a2fd9f784d0d98d47ef967d92 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 7 Jan 2026 09:38:47 -0600
Subject: [PATCH 173/180] add show password button to change_password.html

---
 enferno/templates/security/change_password.html | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/enferno/templates/security/change_password.html b/enferno/templates/security/change_password.html
index 49d37e905..9f626ec91 100755
--- a/enferno/templates/security/change_password.html
+++ b/enferno/templates/security/change_password.html
@@ -13,9 +13,11 @@
           {% if active_password %}
           <v-text-field
             v-model="form.password"
-            type="password"
             name="password"
             :rules="[validationRules.required()]"
+            :append-inner-icon="showPassword ? 'mdi-eye' : 'mdi-eye-off'"
+            :type="showPassword ? 'text' : 'password'"
+            @click:append-inner="showPassword = !showPassword"
           ><template #label>{{ _('Current Password') }}<span class="text-red">*</span></template></v-text-field>
           {% else %}
           <v-card-title>
@@ -25,7 +27,6 @@
 
           <v-text-field
             v-model="form.new_password"
-            type="password"
             name="new_password"
             :class="isStrongPassword ? 'text-success' : undefined"
             :hint="isStrongPassword ? '{{ _('Strong password') }}' : undefined"
@@ -35,13 +36,18 @@
                 validationRules.checkPassword({ onResponse: onPasswordCheckResponse })
             ]"
             @input="isStrongPassword = false"
+            :append-inner-icon="showNewPassword ? 'mdi-eye' : 'mdi-eye-off'"
+            :type="showNewPassword ? 'text' : 'password'"
+            @click:append-inner="showNewPassword = !showNewPassword"
           ><template #label>{{ _('New Password') }}<span class="text-red">*</span></template></v-text-field>
 
           <v-text-field
             v-model="form.new_password_confirm"
-            type="password"
             name="new_password_confirm"
             :rules="[validationRules.matchesField(form.new_password)]"
+            :append-inner-icon="showConfirmPassword ? 'mdi-eye' : 'mdi-eye-off'"
+            :type="showConfirmPassword ? 'text' : 'password'"
+            @click:append-inner="showConfirmPassword = !showConfirmPassword"
           ><template #label>{{ _('Retype Password') }}<span class="text-red">*</span></template></v-text-field>
         </v-card-text>
 
@@ -80,6 +86,9 @@
         validationRules: validationRules,
         isStrongPassword: false,
         drawer: null,
+        showPassword: false,
+        showNewPassword: false,
+        showConfirmPassword: false,
         form: {
           password: '',
           new_password: '',

From dc58751d80826482aece634733f2cdb1bfcca544 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 7 Jan 2026 09:39:14 -0600
Subject: [PATCH 174/180] when globally forcing password reload page to show
 the change password prompt

---
 enferno/admin/templates/admin/users.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index e321ed78e..880900df8 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -974,6 +974,7 @@
                             this.loading = true;
                             api.post('/admin/api/user/force-reset-all').then(res => {
                                 this.showSnack(res.data);
+                                window.location.reload();
                             }).catch(err => {
                                 console.error(err?.response?.data);
                             }).finally(() => {

From fc91078b732da515094653da010ce48e6390f444 Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Wed, 7 Jan 2026 09:52:31 -0600
Subject: [PATCH 175/180] refresh users list if account status is changed
 suspend or disable

---
 enferno/static/js/components/UserCard.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/enferno/static/js/components/UserCard.js b/enferno/static/js/components/UserCard.js
index 9510b3348..f667a61c1 100644
--- a/enferno/static/js/components/UserCard.js
+++ b/enferno/static/js/components/UserCard.js
@@ -240,6 +240,7 @@ const UserCard = Vue.defineComponent({
           }
           await api.post(`/admin/api/user/${this.user.id}/${mode}`, payload);
           await this.$root.refreshUser(this.user.id);
+          await this.$root.refresh();
           this.username = '';
           this.password = '';
           this.showPassword = false;

From f7d4530f6b427f2959fe0001372602d4f6dde8ec Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Tue, 27 Jan 2026 09:21:33 -0600
Subject: [PATCH 176/180] remove display name from update user payload

---
 enferno/admin/templates/admin/users.html | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/enferno/admin/templates/admin/users.html b/enferno/admin/templates/admin/users.html
index 880900df8..ec1dca584 100644
--- a/enferno/admin/templates/admin/users.html
+++ b/enferno/admin/templates/admin/users.html
@@ -1046,6 +1046,7 @@
                     this.saving = true;
                     const payload = { ...this.editedItem };
                     delete payload.status; // Remove status field from payload
+                    delete payload.display_name; // Remove display_name field from payload
 
                     // edit mode
                     if (payload.id) {
@@ -1082,6 +1083,7 @@
                         const payload = { ...this.editedItem };
                         const resetFlagIsSet = this.editedItem?.force_reset != null;
                         delete payload.status; // Remove status field from payload
+                        delete payload.display_name; // Remove display_name field from payload
                         const response = await api.put(`/admin/api/user/`, { item: payload }, { suppressGlobalErrorHandler: true });
                         this.showSnack(response.data);
 

From 38a0431aac87547f1ab9e0db9208e14181d4358b Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 29 Jan 2026 17:35:39 +0100
Subject: [PATCH 177/180] Fix user status management and use set_status()
 consistently

---
 enferno/admin/views.py | 17 +++++++++--------
 enferno/user/models.py | 15 ++-------------
 2 files changed, 11 insertions(+), 21 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index d550e045d..1192bdd77 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -5615,16 +5615,17 @@ def api_user_enable(id: int) -> Response:
         return HTTPResponse.success(message="User is already enabled")
 
     # Set to ACTIVE if user has roles, otherwise SUSPENDED
-    if user.roles:
-        user.status = UserStatus.ACTIVE
-        user.active = True
+    try:
+        new_status = UserStatus.ACTIVE if user.roles else UserStatus.SUSPENDED
+        user.set_status(new_status)
+        user.save()
+    except ValueError as e:
+        return HTTPResponse.error(str(e))
+
+    if new_status == UserStatus.ACTIVE:
         message = f"User {user.username} enabled and activated."
     else:
-        user.status = UserStatus.SUSPENDED
-        user.active = False
         message = f"User {user.username} enabled. Assign roles and reactivate to restore access."
-
-    user.save()
     user.create_revision()
 
     Activity.create(
@@ -5711,7 +5712,7 @@ def api_user_delete(
     if user is None:
         return HTTPResponse.not_found("User not found")
 
-    if user.active:
+    if user.status == UserStatus.ACTIVE:
         return HTTPResponse.forbidden("User is active, make inactive before deleting")
 
     if user.delete():
diff --git a/enferno/user/models.py b/enferno/user/models.py
index 46c0670f9..d534bd5d8 100644
--- a/enferno/user/models.py
+++ b/enferno/user/models.py
@@ -278,19 +278,8 @@ def set_status(self, new_status: UserStatus) -> None:
         # Sync deprecated active field
         self.active = new_status == UserStatus.ACTIVE
 
-        # Side effects based on new status
-        if new_status == UserStatus.DISABLED:
-            # Note: roles are preserved for audit trail - disabled users can't login anyway
-            self.view_usernames = False
-            self.view_simple_history = False
-            self.view_full_history = False
-            self.can_self_assign = False
-            self.can_edit_locations = False
-            self.can_export = False
-            self.can_import_web = False
-            self.logout_other_sessions()
-        elif old_status != new_status:
-            # Logout on any status change (suspend or reactivate)
+        # Logout active sessions on any status change
+        if old_status != new_status:
             self.logout_other_sessions()
 
     def roles_in(self, roles: list) -> bool:

From 8626dbef24f18ac748733cfc2e9c0f40d1d1375c Mon Sep 17 00:00:00 2001
From: Daniel Apodaca <apodacaduron@gmail.com>
Date: Thu, 29 Jan 2026 10:43:27 -0600
Subject: [PATCH 178/180] replace assigned_to.active with assigned_to.status
 since active is no longer present on api response

---
 enferno/admin/templates/admin/actors.html    | 2 +-
 enferno/admin/templates/admin/bulletins.html | 2 +-
 enferno/admin/templates/admin/incidents.html | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/enferno/admin/templates/admin/actors.html b/enferno/admin/templates/admin/actors.html
index d9cd2250b..178893fb3 100644
--- a/enferno/admin/templates/admin/actors.html
+++ b/enferno/admin/templates/admin/actors.html
@@ -1400,7 +1400,7 @@
                     }
 
                     if (this.currentUser.can_self_assign) {
-                        if ((!actor.assigned_to) || (actor.assigned_to && !actor.assigned_to.active)) {
+                        if ((!actor.assigned_to) || (actor.assigned_to && actor.assigned_to.status !== 'active')) {
                             return true
                         }
 
diff --git a/enferno/admin/templates/admin/bulletins.html b/enferno/admin/templates/admin/bulletins.html
index d393ae523..230771e3d 100644
--- a/enferno/admin/templates/admin/bulletins.html
+++ b/enferno/admin/templates/admin/bulletins.html
@@ -1440,7 +1440,7 @@
                         }
 
                         if (this.currentUser.can_self_assign) {
-                            if ((!bulletin.assigned_to) || (bulletin.assigned_to && !bulletin.assigned_to.active)) {
+                            if ((!bulletin.assigned_to) || (bulletin.assigned_to && bulletin.assigned_to.status !== 'active')) {
                                 return true
                             }
 
diff --git a/enferno/admin/templates/admin/incidents.html b/enferno/admin/templates/admin/incidents.html
index 4ddaa946f..4019bd078 100644
--- a/enferno/admin/templates/admin/incidents.html
+++ b/enferno/admin/templates/admin/incidents.html
@@ -1232,7 +1232,7 @@
 
 
                     if (this.currentUser.can_self_assign) {
-                        if ((!incident.assigned_to) || (incident.assigned_to && !incident.assigned_to.active)) {
+                        if ((!incident.assigned_to) || (incident.assigned_to && incident.assigned_to.status !== 'active')) {
                             return true
                         }
 

From a05710d621b2edf2d5dac82cc60e52e1e7aa78c2 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 29 Jan 2026 19:19:09 +0100
Subject: [PATCH 179/180] Use to_compact() for assigned_to and
 first_peer_reviewer in list views

---
 enferno/admin/views.py | 30 ++++++------------------------
 1 file changed, 6 insertions(+), 24 deletions(-)

diff --git a/enferno/admin/views.py b/enferno/admin/views.py
index 1192bdd77..6471683e1 100644
--- a/enferno/admin/views.py
+++ b/enferno/admin/views.py
@@ -3243,15 +3243,9 @@ def api_bulletins(validated_data: dict) -> Response:
                     "sjac_title": item.sjac_title,
                     "sjac_title_ar": item.sjac_title_ar,
                     "status": item.status,
-                    "assigned_to": (
-                        {"id": item.assigned_to.id, "name": item.assigned_to.name}
-                        if item.assigned_to
-                        else None
-                    ),
+                    "assigned_to": (item.assigned_to.to_compact() if item.assigned_to else None),
                     "first_peer_reviewer": (
-                        {"id": item.first_peer_reviewer.id, "name": item.first_peer_reviewer.name}
-                        if item.first_peer_reviewer
-                        else None
+                        item.first_peer_reviewer.to_compact() if item.first_peer_reviewer else None
                     ),
                     "roles": (
                         [
@@ -4335,15 +4329,9 @@ def api_actors(validated_data: dict) -> Response:
                     "name": item.name,
                     "name_ar": item.name_ar,
                     "status": item.status,
-                    "assigned_to": (
-                        {"id": item.assigned_to.id, "name": item.assigned_to.name}
-                        if item.assigned_to
-                        else None
-                    ),
+                    "assigned_to": (item.assigned_to.to_compact() if item.assigned_to else None),
                     "first_peer_reviewer": (
-                        {"id": item.first_peer_reviewer.id, "name": item.first_peer_reviewer.name}
-                        if item.first_peer_reviewer
-                        else None
+                        item.first_peer_reviewer.to_compact() if item.first_peer_reviewer else None
                     ),
                     "roles": (
                         [
@@ -6024,15 +6012,9 @@ def api_incidents(validated_data: dict) -> Response:
                     "title": item.title,
                     "title_ar": item.title_ar,
                     "status": item.status,
-                    "assigned_to": (
-                        {"id": item.assigned_to.id, "name": item.assigned_to.name}
-                        if item.assigned_to
-                        else None
-                    ),
+                    "assigned_to": (item.assigned_to.to_compact() if item.assigned_to else None),
                     "first_peer_reviewer": (
-                        {"id": item.first_peer_reviewer.id, "name": item.first_peer_reviewer.name}
-                        if item.first_peer_reviewer
-                        else None
+                        item.first_peer_reviewer.to_compact() if item.first_peer_reviewer else None
                     ),
                     "roles": (
                         [

From 9127275ca947970b7c1533c81b62b9344c48e636 Mon Sep 17 00:00:00 2001
From: level09 <level09@gmail.com>
Date: Thu, 29 Jan 2026 21:35:11 +0100
Subject: [PATCH 180/180] Fix create_inactive_user fixture to set status field

The fixture only set the deprecated active flag but not the status
field, causing test_delete_user_endpoint to fail since the delete
endpoint checks user.status instead of user.active.
---
 tests/admin/test_users.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/admin/test_users.py b/tests/admin/test_users.py
index 16891e066..556ce08a4 100644
--- a/tests/admin/test_users.py
+++ b/tests/admin/test_users.py
@@ -6,7 +6,7 @@
 from enferno.admin.models import Activity
 from enferno.admin.models.Notification import Notification
 from enferno.utils.validation_utils import convert_empty_strings_to_none
-from enferno.user.models import User, Session, WebAuthn
+from enferno.user.models import User, UserStatus, Session, WebAuthn
 
 from tests.factories import UserFactory, create_webauthn_for
 from tests.test_utils import (
@@ -89,6 +89,7 @@ def create_user(session):
 def create_inactive_user(session):
     user = UserFactory()
     user.active = False
+    user.status = UserStatus.DISABLED
     session.add(user)
     session.commit()
     yield user