feat(admin): a page for who is on the instance, and how somebody else gets on it

The README has promised "internal users are created by an admin" since the
beginning and there was no such thing. There are exactly two ways an
account has ever come into existence: the first admin at setup, and
somebody accepting an invite to a project. So the only way to add a person
was to share a project with them first.

The store has been ready the whole time. CreateInvite already documents
that "projectID may be empty, which invites somebody to the instance
rather than to a particular project", and AcceptInvite already has the
branch that grants no membership when there is none. requireAdmin has
existed in the middleware and was used nowhere. This wires those three
together and puts a page on them.

An invite rather than an account with a password the administrator picks.
A password typed here would be known to two people before it was ever
used, and would then have to travel to the second one by some channel
nobody has thought about. No name is asked for either — the signup form
asks the person, and a name an administrator guesses is a name somebody
has to correct.

Two refusals keep the instance administrable: the last administrator
cannot be demoted or deleted, and nobody can delete the account they are
signed in as. Both are enforced on the server; the interface simply does
not draw the buttons on your own row, because a button whose only purpose
is to be refused wastes a click to teach a rule. The last-admin refusal
gets its own error code, because "that already exists" is not what
happened and this is the one refusal a person needs explained.

Deleting an account is the only hard delete in this database, and building
the confirmation is what turned up how wide it goes. `projects.owner_id`
cascades, which is expected. But `tasks.created_by` cascades too — so
removing a colleague deletes every task they ever wrote, including in
projects somebody else owns. The count in the list says so, and the
confirmation says it in words. Changing that to ON DELETE SET NULL, so the
work stays and loses its author, means rebuilding the tasks table and its
FTS triggers: worth doing, not worth doing quietly while adding a screen.
It is written down in the store instead.

Pending invites are listed and can be withdrawn. Only the token's hash is
stored, so a link sent to the wrong address cannot be looked up and
resent — withdrawing it is the only way to stop it before it expires.

Six API tests for the guards and the counts, and two smoke tests: the
whole loop from invite to a second browser creating the account and
appearing in the list as somebody who is not an administrator, and the
absence of buttons on your own row.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/httpapi/errors.go

@@ -47,8 +47,16 @@ const (
 	CodeAINotConfigured    = "ai_not_configured"
 	CodeTOTPNotEnabled     = "totp_not_enabled"
 	CodeInboxProtected     = "inbox_protected"
+	// And a fifth, for the same reason: refusing to remove the last administrator
+	// is not "that already exists" either, and it is the one refusal on the user
+	// page that a person needs explained rather than merely reported.
+	CodeLastAdmin = "last_admin"
 )
 
+// errLastAdmin is returned to the caller that already wrote the response, so it
+// stops rather than carrying on. It is never rendered anywhere.
+var errLastAdmin = errors.New("httpapi: refused to remove the last administrator")
+
 func writeError(w http.ResponseWriter, status int, code, message string) {
 	writeJSON(w, status, APIError{Code: code, Message: message})
 }

internal/httpapi/server.go

@@ -297,6 +297,19 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				})
 			})
 
+			// The instance's membership. Administrators only, and behind
+			// requireSession as well as requireAdmin: an API token belongs to a
+			// person, and a leaked one must not be able to mint an account or
+			// delete somebody else's.
+			r.Group(func(r chi.Router) {
+				r.Use(s.requireSession, s.requireAdmin)
+				r.Get("/users", s.handleListUsers)
+				r.Post("/users", s.handleCreateUser)
+				r.Patch("/users/{userID}", s.handleUpdateUser)
+				r.Delete("/users/{userID}", s.handleDeleteUser)
+				r.Delete("/invites/{inviteID}", s.handleDeleteInvite)
+			})
+
 			// Groups are a person's own headings over their projects, so there is
 			// no project permission to check — every query here is scoped to the
 			// caller.

internal/httpapi/users_handlers.go

@@ -0,0 +1,237 @@
+package httpapi
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/kristianwind/verdande/internal/store"
+)
+
+// Who is on the instance, and how somebody else gets on it.
+//
+// There is no open registration and there never was: an account comes into
+// existence in exactly two ways — the first admin at setup, and somebody accepting
+// an invite. This surface is the second one made reachable without first sharing a
+// project, which is what "create a user" turns out to mean here.
+//
+// The whole file is administrators only.
+
+type adminUserJSON struct {
+	ID          string `json:"id"`
+	Email       string `json:"email"`
+	Name        string `json:"name"`
+	AvatarColor string `json:"avatar_color"`
+	IsAdmin     bool   `json:"is_admin"`
+	// Self marks the caller, so the interface can grey out the two things nobody
+	// should do to their own account from here.
+	Self       bool   `json:"self"`
+	CreatedAt  string `json:"created_at"`
+	LastSeenAt string `json:"last_seen_at,omitempty"`
+	// ProjectCount and TaskCount are what a delete would destroy. Sent with the
+	// list rather than fetched when the button is pressed, so the confirmation can
+	// name real numbers without a round trip in the middle of a decision.
+	ProjectCount int `json:"project_count"`
+	TaskCount    int `json:"task_count"`
+}
+
+type pendingInviteJSON struct {
+	ID    string `json:"id"`
+	Email string `json:"email"`
+	// ProjectName is empty for an invite to the instance itself, which is what
+	// this page issues. The two read very differently to whoever is looking.
+	ProjectName string `json:"project_name,omitempty"`
+	Role        string `json:"role"`
+	InvitedBy   string `json:"invited_by,omitempty"`
+	CreatedAt   string `json:"created_at"`
+	ExpiresAt   string `json:"expires_at"`
+}
+
+func (s *Server) handleListUsers(w http.ResponseWriter, r *http.Request) {
+	me := userFrom(r.Context())
+
+	users, err := s.db.ListUsers(r.Context())
+	if err != nil {
+		s.internal(w, "list users", err)
+		return
+	}
+	invites, err := s.db.ListPendingInvites(r.Context())
+	if err != nil {
+		s.internal(w, "list pending invites", err)
+		return
+	}
+
+	out := make([]adminUserJSON, 0, len(users))
+	for _, u := range users {
+		j := adminUserJSON{
+			ID: u.ID, Email: u.Email, Name: u.Name, AvatarColor: u.AvatarColor,
+			IsAdmin: u.IsAdmin, Self: u.ID == me.ID,
+			CreatedAt:    u.CreatedAt.Format(time.RFC3339),
+			ProjectCount: u.ProjectCount, TaskCount: u.TaskCount,
+		}
+		// Zero means never signed in, which is not a time and must not be sent as
+		// one — 1970 in an interface reads as a bug rather than as "never".
+		if !u.LastSeenAt.IsZero() {
+			j.LastSeenAt = u.LastSeenAt.Format(time.RFC3339)
+		}
+		out = append(out, j)
+	}
+
+	pending := make([]pendingInviteJSON, 0, len(invites))
+	for _, i := range invites {
+		pending = append(pending, pendingInviteJSON{
+			ID: i.ID, Email: i.Email, ProjectName: i.ProjectName, Role: string(i.Role),
+			InvitedBy: i.InvitedBy,
+			CreatedAt: i.CreatedAt.Format(time.RFC3339),
+			ExpiresAt: i.ExpiresAt.Format(time.RFC3339),
+		})
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{"users": out, "invites": pending})
+}
+
+type createUserRequest struct {
+	Email string `json:"email"`
+}
+
+// handleCreateUser invites somebody to the instance.
+//
+// An invite rather than an account with a password the administrator chooses. A
+// password typed here would be known to two people before it was ever used, and
+// would have to travel to the second one by some channel nobody has thought about.
+// The link does the same job and ends with a password only its owner has seen.
+//
+// No name is asked for, because the signup form asks the person themselves — a
+// name an administrator guesses is a name somebody has to correct.
+func (s *Server) handleCreateUser(w http.ResponseWriter, r *http.Request) {
+	var req createUserRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	inviter := userFrom(r.Context())
+
+	email := store.NormalizeEmail(req.Email)
+	if email == "" || !strings.Contains(email, "@") {
+		writeFieldErrors(w, map[string]string{"email": "must be an email address"})
+		return
+	}
+	if _, err := s.db.UserByEmail(r.Context(), email); err == nil {
+		writeError(w, http.StatusConflict, CodeConflict, "that email address already has an account")
+		return
+	}
+
+	// RoleEditor is carried on the row because the column requires a role, and it
+	// is never read: AcceptInvite returns early when there is no project to grant
+	// anything on.
+	token, _, err := s.db.CreateInvite(r.Context(), email, "", store.RoleEditor,
+		inviter.ID, s.cfg.InviteTTL)
+	if err != nil {
+		s.internal(w, "create instance invite", err)
+		return
+	}
+	link := s.cfg.BaseURL + "/invite?token=" + token
+
+	emailed := false
+	if s.mail.Configured() {
+		if err := s.mail.SendInvite(r.Context(), email, inviter.Name, "", link, s.cfg.InviteTTL); err != nil {
+			s.log.Error("send instance invite", "err", err, "to", email)
+		} else {
+			emailed = true
+		}
+	}
+	writeJSON(w, http.StatusCreated, inviteResponse{Link: link, Emailed: emailed})
+}
+
+type updateUserRequest struct {
+	IsAdmin *bool `json:"is_admin"`
+}
+
+// handleUpdateUser promotes or demotes an administrator.
+func (s *Server) handleUpdateUser(w http.ResponseWriter, r *http.Request) {
+	var req updateUserRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	userID := chi.URLParam(r, "userID")
+	me := userFrom(r.Context())
+
+	if req.IsAdmin == nil {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+	// Standing down as the last administrator locks everybody out of this page,
+	// and there is no console and no second setup run to undo it with.
+	if !*req.IsAdmin {
+		if err := s.refuseIfLastAdmin(w, r, userID, "the last administrator cannot be demoted"); err != nil {
+			return
+		}
+	}
+
+	if err := s.db.SetUserAdmin(r.Context(), userID, *req.IsAdmin); err != nil {
+		s.storeError(w, "set user admin", err)
+		return
+	}
+	s.log.Info("admin changed", "by", me.ID, "user", userID, "is_admin", *req.IsAdmin)
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleDeleteUser removes an account and everything the foreign keys take with
+// it. See store.DeleteUser for what that is; it is more than it looks.
+func (s *Server) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
+	userID := chi.URLParam(r, "userID")
+	me := userFrom(r.Context())
+
+	// Not yourself. Deleting the account you are signed in as would take your own
+	// projects while you were looking at them, and end the session mid-request.
+	// Somebody who really means it can be demoted first and removed by another
+	// administrator.
+	if userID == me.ID {
+		writeError(w, http.StatusConflict, CodeConflict,
+			"you cannot delete the account you are signed in as")
+		return
+	}
+	if err := s.refuseIfLastAdmin(w, r, userID, "the last administrator cannot be deleted"); err != nil {
+		return
+	}
+
+	if err := s.db.DeleteUser(r.Context(), userID); err != nil {
+		s.storeError(w, "delete user", err)
+		return
+	}
+	s.log.Info("user deleted", "by", me.ID, "user", userID)
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (s *Server) handleDeleteInvite(w http.ResponseWriter, r *http.Request) {
+	if err := s.db.DeleteInvite(r.Context(), chi.URLParam(r, "inviteID")); err != nil {
+		s.storeError(w, "delete invite", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// refuseIfLastAdmin writes a 409 and returns an error when the named user is the
+// only administrator left. The two callers both need it, and getting it wrong in
+// one of them is an instance nobody can administer again.
+func (s *Server) refuseIfLastAdmin(w http.ResponseWriter, r *http.Request, userID, message string) error {
+	target, err := s.db.UserByID(r.Context(), userID)
+	if err != nil {
+		s.storeError(w, "get user", err)
+		return err
+	}
+	if !target.IsAdmin {
+		return nil
+	}
+	admins, err := s.db.CountAdmins(r.Context())
+	if err != nil {
+		s.internal(w, "count admins", err)
+		return err
+	}
+	if admins <= 1 {
+		writeError(w, http.StatusConflict, CodeLastAdmin, message)
+		return errLastAdmin
+	}
+	return nil
+}

internal/httpapi/users_test.go

@@ -0,0 +1,279 @@
+package httpapi
+
+import (
+	"net/http"
+	"testing"
+)
+
+// The instance's membership is an administrator's list, and creating an account
+// means issuing an invite — there is no other door, and no password chosen by
+// somebody other than its owner.
+func TestAnAdminCanInviteSomebodyToTheInstance(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "POST", "/api/v1/users", map[string]any{"email": "ny@example.dk"})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("invite: %d %v", resp.StatusCode, body)
+	}
+	link, _ := body["link"].(string)
+	if link == "" {
+		t.Fatal("no link came back — with no mail server it is the only way the invite reaches anybody")
+	}
+	if body["emailed"] != false {
+		t.Errorf("emailed = %v, want false with no mail server configured", body["emailed"])
+	}
+
+	// It shows as pending, with no project attached: this is an invite to the
+	// instance, not to somewhere in it.
+	_, listed := ts.do(t, "GET", "/api/v1/users", nil)
+	invites, _ := listed["invites"].([]any)
+	if len(invites) != 1 {
+		t.Fatalf("want one pending invite, got %v", invites)
+	}
+	invite := invites[0].(map[string]any)
+	if invite["email"] != "ny@example.dk" {
+		t.Errorf("email = %v", invite["email"])
+	}
+	if name, ok := invite["project_name"]; ok && name != "" {
+		t.Errorf("project_name = %v, want none for an instance invite", name)
+	}
+
+	// And the token in the link creates the account, through the same signup the
+	// project invites use.
+	token := link[len(link)-len(link)+indexAfter(link, "token="):]
+	fresh := newSignedOut(t, ts)
+	resp, _ = fresh.do(t, "POST", "/api/v1/auth/signup", map[string]any{
+		"token": token, "name": "Ny Bruger", "password": "et langt kodeord",
+	})
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		t.Fatalf("signup with the instance invite: status %d", resp.StatusCode)
+	}
+
+	// They are on the instance, and they are not an administrator.
+	_, after := ts.do(t, "GET", "/api/v1/users", nil)
+	users, _ := after["users"].([]any)
+	if len(users) != 2 {
+		t.Fatalf("want two accounts, got %v", users)
+	}
+	for _, raw := range users {
+		u := raw.(map[string]any)
+		if u["email"] == "ny@example.dk" && u["is_admin"] != false {
+			t.Errorf("a newly invited account is an administrator: %v", u)
+		}
+	}
+	// The invite is used up rather than left live.
+	if pending, _ := after["invites"].([]any); len(pending) != 0 {
+		t.Errorf("the invite is still pending after being accepted: %v", pending)
+	}
+}
+
+// The two refusals that make this page safe to have at all.
+func TestTheLastAdministratorCannotBeRemoved(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	me, err := ts.db.UserByEmail(t.Context(), "kristian@example.dk")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Demoting yourself as the only administrator locks everybody out: there is no
+	// console, and setup refuses to run once an account exists.
+	resp, body := ts.do(t, "PATCH", "/api/v1/users/"+me.ID, map[string]any{"is_admin": false})
+	if resp.StatusCode != http.StatusConflict {
+		t.Fatalf("demote the last admin: status %d, want 409", resp.StatusCode)
+	}
+	if body["code"] != "last_admin" {
+		t.Errorf("code = %v, want last_admin — the interface has to explain this one", body["code"])
+	}
+
+	// And deleting the account you are signed in as is refused before that check
+	// is even reached.
+	resp, _ = ts.do(t, "DELETE", "/api/v1/users/"+me.ID, nil)
+	if resp.StatusCode != http.StatusConflict {
+		t.Errorf("delete your own account: status %d, want 409", resp.StatusCode)
+	}
+
+	// Still an administrator, and still there.
+	_, listed := ts.do(t, "GET", "/api/v1/users", nil)
+	first := listed["users"].([]any)[0].(map[string]any)
+	if first["is_admin"] != true || first["self"] != true {
+		t.Errorf("the only administrator is no longer one: %v", first)
+	}
+}
+
+// With a second administrator the refusal lifts — it is about the last one, not
+// about administrators.
+func TestASecondAdministratorCanBeDemoted(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	ts.newUser(t, "anden@example.dk", "Anden")
+
+	other, err := ts.db.UserByEmail(t.Context(), "anden@example.dk")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if resp, _ := ts.do(t, "PATCH", "/api/v1/users/"+other.ID,
+		map[string]any{"is_admin": true}); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("promote: status %d", resp.StatusCode)
+	}
+	if resp, _ := ts.do(t, "PATCH", "/api/v1/users/"+other.ID,
+		map[string]any{"is_admin": false}); resp.StatusCode != http.StatusNoContent {
+		t.Errorf("demote a second administrator: status %d, want 204", resp.StatusCode)
+	}
+}
+
+// Deleting an account takes more than its own projects, and the list says so
+// before anybody presses the button.
+func TestTheDeleteCountsSayWhatWouldGo(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "anden@example.dk", "Anden")
+
+	otherUser, err := ts.db.UserByEmail(t.Context(), "anden@example.dk")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// One project of their own, with a task in it.
+	_, theirs := other.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Deres"})
+	other.do(t, "POST", "/api/v1/tasks", map[string]any{
+		"content": "deres egen", "project_id": theirs["id"].(string),
+	})
+
+	// And a task they wrote in a project somebody else owns. tasks.created_by
+	// cascades, so this one goes too — and a count that missed it would understate
+	// the damage in exactly the case that matters.
+	_, mine := ts.do(t, "POST", "/api/v1/projects", map[string]any{"name": "Fælles"})
+	sharedID := mine["id"].(string)
+	ts.do(t, "POST", "/api/v1/projects/"+sharedID+"/invites", map[string]any{
+		"email": "anden@example.dk", "role": "editor",
+	})
+	other.do(t, "POST", "/api/v1/tasks", map[string]any{
+		"content": "skrevet i et delt projekt", "project_id": sharedID,
+	})
+
+	_, listed := ts.do(t, "GET", "/api/v1/users", nil)
+	var found map[string]any
+	for _, raw := range listed["users"].([]any) {
+		if u := raw.(map[string]any); u["id"] == otherUser.ID {
+			found = u
+		}
+	}
+	if found == nil {
+		t.Fatal("the second account is not in the list")
+	}
+	if found["project_count"] != float64(1) {
+		t.Errorf("project_count = %v, want 1 — the Inbox must not be counted", found["project_count"])
+	}
+	if found["task_count"] != float64(2) {
+		t.Errorf("task_count = %v, want 2 — the task in the shared project cascades too",
+			found["task_count"])
+	}
+
+	// And the delete really does take it.
+	if resp, _ := ts.do(t, "DELETE", "/api/v1/users/"+otherUser.ID, nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete: status %d", resp.StatusCode)
+	}
+	_, tasks := ts.do(t, "GET", "/api/v1/tasks?project_id="+sharedID, nil)
+	if got, _ := tasks["tasks"].([]any); len(got) != 0 {
+		t.Errorf("a task written by the deleted account survived in a shared project: %v", got)
+	}
+}
+
+// Everything here is administrators only, and not reachable with an API token
+// even by an administrator: a leaked token must not be able to mint an account.
+func TestTheUserPageIsAdminsOnlyAndSessionsOnly(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+	other := ts.newUser(t, "anden@example.dk", "Anden")
+
+	for _, c := range []struct {
+		what, method, path string
+		body               any
+	}{
+		{"list", "GET", "/api/v1/users", nil},
+		{"invite", "POST", "/api/v1/users", map[string]any{"email": "x@y.dk"}},
+		{"promote", "PATCH", "/api/v1/users/whoever", map[string]any{"is_admin": true}},
+		{"delete", "DELETE", "/api/v1/users/whoever", nil},
+		{"revoke", "DELETE", "/api/v1/invites/whichever", nil},
+	} {
+		if resp, _ := other.do(t, c.method, c.path, c.body); resp.StatusCode != http.StatusForbidden {
+			t.Errorf("%s as an ordinary user: status %d, want 403", c.what, resp.StatusCode)
+		}
+	}
+
+	admin, err := ts.db.UserByEmail(t.Context(), "kristian@example.dk")
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := ts.apiToken(t, admin.ID)
+	req, _ := http.NewRequest("GET", ts.URL+"/api/v1/users", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := (&http.Client{}).Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Errorf("an administrator's API token reached the user list: status %d", resp.StatusCode)
+	}
+}
+
+// A pending invite can be withdrawn, which is the only way to stop a link that
+// went to the wrong address: the token is stored as a hash and cannot be looked up.
+func TestAPendingInviteCanBeWithdrawn(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	_, created := ts.do(t, "POST", "/api/v1/users", map[string]any{"email": "forkert@example.dk"})
+	link := created["link"].(string)
+
+	_, listed := ts.do(t, "GET", "/api/v1/users", nil)
+	inviteID := listed["invites"].([]any)[0].(map[string]any)["id"].(string)
+
+	if resp, _ := ts.do(t, "DELETE", "/api/v1/invites/"+inviteID, nil); resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("withdraw: status %d", resp.StatusCode)
+	}
+
+	// The link no longer works.
+	token := link[indexAfter(link, "token="):]
+	fresh := newSignedOut(t, ts)
+	resp, _ := fresh.do(t, "POST", "/api/v1/auth/signup", map[string]any{
+		"token": token, "name": "Forkert", "password": "et langt kodeord",
+	})
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("a withdrawn invite still signs somebody up: status %d", resp.StatusCode)
+	}
+}
+
+// An address that already has an account is a conflict rather than a second
+// invite: the signup would fail at the end, after somebody had chosen a password.
+func TestInvitingAnAddressThatAlreadyHasAnAccount(t *testing.T) {
+	ts := newTestServer(t)
+	ts.bootstrap(t)
+
+	resp, body := ts.do(t, "POST", "/api/v1/users",
+		map[string]any{"email": "kristian@example.dk"})
+	if resp.StatusCode != http.StatusConflict {
+		t.Fatalf("status %d, want 409 — body %v", resp.StatusCode, body)
+	}
+}
+
+// newSignedOut is a client against the same server with an empty cookie jar.
+func newSignedOut(t *testing.T, ts *testServer) *testServer {
+	t.Helper()
+	return &testServer{Server: ts.Server, db: ts.db, client: newJarClient(t)}
+}
+
+// indexAfter returns the offset just past `needle` in `s`.
+func indexAfter(s, needle string) int {
+	for i := 0; i+len(needle) <= len(s); i++ {
+		if s[i:i+len(needle)] == needle {
+			return i + len(needle)
+		}
+	}
+	return 0
+}

internal/store/invites.go

@@ -136,6 +136,70 @@ func (db *DB) InviteByToken(ctx context.Context, token string) (*Invite, error)
 	return &inv, nil
 }
 
+// PendingInvite is an invite that has been sent and not yet used, as the
+// administrator's list shows it. The token is not here and cannot be: only its
+// hash is stored, so a link that has gone astray is revoked rather than resent.
+type PendingInvite struct {
+	ID          string
+	Email       string
+	ProjectID   string
+	ProjectName string
+	Role        Role
+	InvitedBy   string
+	CreatedAt   time.Time
+	ExpiresAt   time.Time
+}
+
+// ListPendingInvites returns invites that are neither accepted nor expired.
+//
+// Expired ones are left out rather than shown greyed: an invite past its date is
+// not a thing anybody can act on, and a list of them would grow forever. The
+// project name is joined in because an invite with no project means something
+// different — an invitation to the instance itself — and the interface has to be
+// able to say which it is.
+func (db *DB) ListPendingInvites(ctx context.Context) ([]PendingInvite, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT i.id, i.email, COALESCE(i.project_id, ''), COALESCE(p.name, ''), i.role,
+		       COALESCE(u.name, ''), i.created_at, i.expires_at
+		FROM invites i
+		LEFT JOIN projects p ON p.id = i.project_id
+		LEFT JOIN users u ON u.id = i.created_by
+		WHERE i.accepted_at IS NULL AND i.expires_at > ?
+		ORDER BY i.created_at DESC`, time.Now().Unix())
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := []PendingInvite{}
+	for rows.Next() {
+		var p PendingInvite
+		var created, expires int64
+		if err := rows.Scan(&p.ID, &p.Email, &p.ProjectID, &p.ProjectName, &p.Role,
+			&p.InvitedBy, &created, &expires); err != nil {
+			return nil, err
+		}
+		p.CreatedAt = time.Unix(created, 0).UTC()
+		p.ExpiresAt = time.Unix(expires, 0).UTC()
+		out = append(out, p)
+	}
+	return out, rows.Err()
+}
+
+// DeleteInvite revokes an invite, which is what makes a link sent to the wrong
+// address recoverable: the token cannot be looked up, so withdrawing it is the
+// only way to stop it working before it expires.
+func (db *DB) DeleteInvite(ctx context.Context, inviteID string) error {
+	res, err := db.ExecContext(ctx, `DELETE FROM invites WHERE id = ?`, inviteID)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
 // AcceptInvite marks the invite used and grants the membership it promised, in one
 // transaction. Splitting the two would allow a signup to fail partway and leave a
 // live invite behind, which is a link that still works after it has been used.

internal/store/users.go

@@ -163,6 +163,117 @@ func (db *DB) PeopleByIDs(ctx context.Context, ids []string) (map[string]Person,
 	return people, rows.Err()
 }
 
+// UserSummary is a user as the administrator's list shows them: the account, plus
+// the two numbers that say what deleting it would take with it and the one that
+// says whether it is in use at all.
+type UserSummary struct {
+	User
+	// LastSeenAt is the most recent request from any of their sessions, zero if
+	// they have never signed in — which is what an invite that was accepted and
+	// then forgotten looks like.
+	LastSeenAt time.Time
+	// ProjectCount excludes the Inbox: every account has one, so counting it would
+	// make "1 project" mean "nothing".
+	ProjectCount int
+	// TaskCount is everything a delete would destroy, which is not the same as
+	// "their tasks": it is the tasks in projects they own *plus* every task they
+	// wrote anywhere, because tasks.created_by cascades. A number that counted
+	// only the first would understate the damage in exactly the case that matters
+	// — a colleague leaving a shared project.
+	TaskCount int
+}
+
+// ListUsers returns every account on the instance. Administrators only — this is
+// the whole membership of the server, which is not a list anybody else is owed.
+func (db *DB) ListUsers(ctx context.Context) ([]UserSummary, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT u.id, u.email, u.name, u.avatar_color, u.is_admin, u.created_at,
+		       COALESCE((SELECT max(s.last_seen_at) FROM sessions s WHERE s.user_id = u.id), 0),
+		       (SELECT count(*) FROM projects p
+		         WHERE p.owner_id = u.id AND p.is_inbox = 0 AND p.deleted_at IS NULL),
+		       (SELECT count(*) FROM tasks t JOIN projects p ON p.id = t.project_id
+		         WHERE t.deleted_at IS NULL
+		           AND (p.owner_id = u.id OR t.created_by = u.id))
+		FROM users u
+		ORDER BY u.is_admin DESC, u.name`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := []UserSummary{}
+	for rows.Next() {
+		var s UserSummary
+		var isAdmin int
+		var created, lastSeen int64
+		if err := rows.Scan(&s.ID, &s.Email, &s.Name, &s.AvatarColor, &isAdmin, &created,
+			&lastSeen, &s.ProjectCount, &s.TaskCount); err != nil {
+			return nil, err
+		}
+		s.IsAdmin = isAdmin == 1
+		s.CreatedAt = time.Unix(created, 0).UTC()
+		if lastSeen > 0 {
+			s.LastSeenAt = time.Unix(lastSeen, 0).UTC()
+		}
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
+// CountAdmins is what stops the last administrator from being deleted or demoted.
+// An instance with no administrator has no way back: there is no console, and the
+// setup route refuses to run once an account exists.
+func (db *DB) CountAdmins(ctx context.Context) (int, error) {
+	var n int
+	err := db.QueryRowContext(ctx, `SELECT count(*) FROM users WHERE is_admin = 1`).Scan(&n)
+	return n, err
+}
+
+func (db *DB) SetUserAdmin(ctx context.Context, userID string, admin bool) error {
+	res, err := db.ExecContext(ctx,
+		`UPDATE users SET is_admin = ?, updated_at = ? WHERE id = ?`,
+		boolToInt(admin), time.Now().Unix(), userID)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// DeleteUser removes an account and everything that hangs off it.
+//
+// A hard delete, and the only one in this database. Every other delete here is a
+// `deleted_at` with a trash behind it; this one relies on the foreign keys and
+// there is no way back — which is why the handler sends the counts to the
+// interface first.
+//
+// What goes is wider than it looks. `projects.owner_id` cascades, so their
+// projects go and every task in them goes too. But `tasks.created_by` cascades as
+// well, so **every task they ever wrote goes, including in projects somebody else
+// owns**. Retiring a colleague's account therefore removes their contributions
+// from shared projects rather than leaving them behind unattributed.
+//
+// That is the schema as it stands rather than a decision made here. Changing it —
+// `created_by` as ON DELETE SET NULL, so the work stays and loses its author —
+// means rebuilding the tasks table, which carries the FTS triggers with it. Worth
+// doing; not worth doing quietly as part of adding a screen.
+//
+// What survives: tasks merely *assigned* to them, which are unassigned by
+// `assignee_id ON DELETE SET NULL`, and completions, by the same rule on
+// `completed_by`.
+func (db *DB) DeleteUser(ctx context.Context, userID string) error {
+	res, err := db.ExecContext(ctx, `DELETE FROM users WHERE id = ?`, userID)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
 // UserCount is what decides whether the instance still needs its first admin.
 func (db *DB) UserCount(ctx context.Context) (int, error) {
 	var n int