Add Administration user management: list, password reset, email change, group assignments

Wires the previously-unused fis_admin_* user/group stored procs into the Admin
module (fds_sys-gated), adds a users grid with a per-row ribbon (reset
password, change email, manage group membership), and always emails a
password reset result to the user rather than showing it to the admin.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Fuchs/wwwroot/web/fis.admin.de.js

@@ -81,6 +81,31 @@ let $adt = {
     , tm_default_subject: 'Fuchs Intranet – Test-E-Mail'
     , tm_default_body: 'Dies ist eine Test-E-Mail aus dem Administrationsbereich des Fuchs Intranet.'
     , loadfail: 'Der Systemstatus konnte nicht geladen werden.'
+    // user management
+    , sub_users: 'Benutzerverwaltung'
+    , u_title: 'Benutzerkonten'
+    , u_col_name: 'Name'
+    , u_col_email: 'E-Mail'
+    , u_col_status: 'Status'
+    , u_active: 'Aktiv'
+    , u_disabled: 'Deaktiviert'
+    , u_pwdreset: 'Passwort zurücksetzen'
+    , u_pwdreset_btn: 'Zurücksetzen'
+    , u_pwd_field: 'Neues Passwort'
+    , u_pwd_hint: 'Leer lassen, um automatisch ein Passwort zu generieren. In jedem Fall wird das neue Passwort per E-Mail an den Benutzer gesendet.'
+    , u_pwdreset_sent: 'Das neue Passwort wurde per E-Mail an den Benutzer gesendet.'
+    , u_pwdreset_noemail: 'Das Passwort wurde zurückgesetzt, konnte aber nicht per E-Mail zugestellt werden.'
+    , u_email: 'E-Mail-Adresse ändern'
+    , u_email_field: 'E-Mail-Adresse'
+    , u_groups: 'Gruppenzugehörigkeit'
+    , u_groups_title: 'Gruppen – {0}'
+    , u_err: {
+        requirements: 'Das Passwort erfüllt nicht die Mindestanforderungen (mind. 6 Zeichen).',
+        duplicate_email: 'Diese E-Mail-Adresse ist bereits einem anderen Benutzerkonto zugeordnet.',
+        reset_failed: 'Das Passwort konnte nicht zurückgesetzt werden.',
+        change_failed: 'Die Änderung konnte nicht gespeichert werden.'
+    }
+    , u_err_generic: 'Die Änderung konnte nicht gespeichert werden.'
 };
 
 let $adm = {
@@ -101,6 +126,14 @@ let $adm = {
             { lbl: $adt.refreshAll, id: 'adm_refresh_all', ico: 'glyphicon glyphicon-refresh', fnc: function () { $adm.init3(); } }
         ]);
     },
+    /* Per-row ribbon shown while a user row is selected (mirrors the Banking module's iMn/eM swap). */
+    uMn: function (rw) {
+        return $('#topbar').ocmsmenu([
+            { lbl: $adt.u_pwdreset, fnc: function () { $adm.pwdResetDlg(rw); } },
+            { lbl: $adt.u_email, fnc: function () { $adm.emailDlg(rw); } },
+            { lbl: $adt.u_groups, fnc: function () { $adm.groupsDlg(rw); } }
+        ]);
+    },
     load: function (frm) {
         $ocms.postXT({
             url: $ocms.url('admin/status'), success: function (r) {
@@ -127,6 +160,109 @@ let $adm = {
         $adm.blobCard(grid, info.blob || {}, pmap.blob);
         $adm.mfrCard(grid, info.mfr || {}, pmap.mfr);
         $adm.kvCard(grid, info.keyVault || {}, pmap.keyvault);
+
+        $$.dc('adm_sec', frm).text($adt.sub_users);
+        $adm.usersCard(frm);
+    },
+
+    /* ── user management ─────────────────────────────────────────────────── */
+    usersCard: function (frm) {
+        let card = $$.dc('adm_card adm_card_wide', frm);
+        let hd = $$.dc('adm_card_hd', card);
+        $$.s($adt.u_title).appendTo(hd);
+        let bd = $$.dc('adm_card_bd adm_users_bd', card);
+        $adm.renderUsers(bd);
+    },
+    renderUsers: function (bd) {
+        bd.empty();
+        let ts = $$.tblset({}, bd);
+        let thr = $$.tr(ts.hd);
+        $.each([$adt.u_col_name, $adt.u_col_email, $adt.u_col_status], function (i, lbl) {
+            $$.th(thr).text(lbl);
+        });
+        $ocms.postXT({
+            url: $ocms.url('admin/users'), success: function (r) {
+                $.each(r.users || [], function (ri, rw) {
+                    let tr = $$.tr(ts.bdy, { id: 'adu' + rw.useraccount_id });
+                    $$.td(tr).text(`${rw.firstname || ''} ${rw.name || ''}`.trim());
+                    $$.td(tr).text(rw.email || '');
+                    $$.td(tr).text(bool(rw.disabled, false) === true ? $adt.u_disabled : $adt.u_active);
+                    tr.click(function () {
+                        tr.toggleClass('selected').siblings().rC('selected');
+                        if (tr.is('.selected') === true) { $adm.uMn(rw); } else { $adm.topbar(); }
+                    });
+                });
+            }, error: function () {
+                $$.dc('adm_err', bd).text($adt.loadfail);
+            }
+        });
+    },
+    pwdResetDlg: function (rw) {
+        $ocms.dlgform([
+            { name: 'useraccount_id', type: 'hidden', value: rw.useraccount_id },
+            { name: 'newpassword', label: $adt.u_pwd_field, type: 'string', note: $adt.u_pwd_hint }
+        ], {
+            title: $adt.u_pwdreset,
+            button: $adt.u_pwdreset_btn,
+            submit: function (e) {
+                let c = $(this).ldng(1);
+                let qs = c.serializeObject(true, { typedvalues: true });
+                $ocms.postXT({
+                    url: $ocms.url('admin/userpwdreset'), data: qs, success: function (response) {
+                        alert(response.emailed === true ? $adt.u_pwdreset_sent : $adt.u_pwdreset_noemail);
+                        c.trigger('modal_close');
+                    }, error: function (jqXHR) {
+                        let code = ((jqXHR || {}).responseJSON || {}).error;
+                        alert($adt.u_err[code] || $adt.u_err_generic);
+                    }, complete: function () { c.ldng(0); $adm.renderUsers($('.adm_users_bd')); $adm.topbar(); }
+                });
+            }
+        });
+    },
+    emailDlg: function (rw) {
+        $ocms.dlgform([
+            { name: 'useraccount_id', type: 'hidden', value: rw.useraccount_id },
+            { name: 'email', label: $adt.u_email_field, type: 'email', required: true, value: rw.email }
+        ], {
+            title: $adt.u_email,
+            submit: function (e) {
+                let c = $(this).ldng(1);
+                let qs = c.serializeObject(true, { typedvalues: true });
+                $ocms.postXT({
+                    url: $ocms.url('admin/useremail'), data: qs, success: function () {
+                        c.trigger('modal_close');
+                    }, error: function (jqXHR) {
+                        let code = ((jqXHR || {}).responseJSON || {}).error;
+                        alert($adt.u_err[code] || $adt.u_err_generic);
+                    }, complete: function () { c.ldng(0); $adm.renderUsers($('.adm_users_bd')); $adm.topbar(); }
+                });
+            }
+        });
+    },
+    groupsDlg: function (rw) {
+        let f = $$.dc('adm_groups_dlg');
+        $ocms.postXT({
+            url: $ocms.url('admin/usergroups'), data: { useraccount_id: rw.useraccount_id }, success: function (r) {
+                $.each(r.groups || [], function (gi, g) {
+                    let row = $$.dc('adm_group_row', f);
+                    let cid = 'adg' + g.usergroup_id;
+                    let cb = $$.i({ type: 'checkbox', id: cid }).prop('checked', bool(g.member, false)).appendTo(row);
+                    $$.lbl(g.name, { for: cid }).appendTo(row);
+                    cb.change(function () {
+                        let checked = cb.prop('checked');
+                        $ocms.postXT({
+                            url: $ocms.url('admin/usergroupset'),
+                            data: { useraccount_id: rw.useraccount_id, usergroup_id: g.usergroup_id, member: checked },
+                            error: function () {
+                                cb.prop('checked', !checked);
+                                alert($adt.u_err_generic);
+                            }
+                        });
+                    });
+                });
+            }
+        });
+        $ocms.dlg(f, { title: string($adt.u_groups_title, [`${rw.firstname || ''} ${rw.name || ''}`.trim()]), size: [420, 380] });
     },
 
     /* ── generic building blocks ─────────────────────────────────────────── */