Sign-in page redesign and Portal roles Super Admin / Admin / Viewer

Sign-in: brand panel, show / hide password, Caps Lock warning, moving
background, tab icon. Roles: Super Admin manages Admins and Viewers,
Admin manages Viewers only (and can Start / Stop, see Sign-ins), Viewer
sees claims and Runs only. create_tables.sql moves an old table.
71 test files, 1220 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_portal_signin.py

@@ -12,8 +12,10 @@ user store and the fake repository / runner (no SQL Server).
   * Wrong password / lock / disabled read as such; 30 minutes idle signs
     out (and is recorded).
   * A user an Admin made must change the password before anything else.
-  * Roles: a Viewer sees no Start / Stop and is refused them; only an
-    Admin reaches Portal Users and the Sign-in history.
+  * Roles (2026-10-27): a Viewer sees no Start / Stop and is refused them;
+    only a Super Admin or an Admin reaches Portal Users and the Sign-in
+    history; an Admin adds and changes Viewers only, a Super Admin Admins
+    and Viewers, and nobody changes a Super Admin from the Portal.
   * Started By / Stopped By reach the runner as the signed-in username.
   * Admin changes take effect on the user's open session at once.
 """
@@ -47,11 +49,11 @@ def case(fn):
 
 
 def _portal(runner=None, clock=None):
-    """(app, store, runner) with users asha (Admin), olu (Operator) and
+    """(app, store, runner) with users sam (Super Admin), asha (Admin) and
     vee (Viewer), all able to sign in straight away."""
     store = FakeUserStore()
     acc = portal_users.Accounts(store)
-    for name, role in (("asha", "Admin"), ("olu", "Operator"),
+    for name, role in (("sam", "Super Admin"), ("asha", "Admin"),
                        ("vee", "Viewer")):
         acc.create_user(name, name.title(), role, PW)
     runner = runner or FakeRunner()
@@ -136,7 +138,7 @@ def a_wrong_password_says_so_and_five_lock():
 @case
 def sign_out_ends_the_session():
     app, store, _ = _portal()
-    c, _ = _sign_in(app, "olu")
+    c, _ = _sign_in(app, "asha")
     assert c.post("/signout", headers=ORIGIN,
                   data={"token": "wrong"}).status_code == 403
     r = c.post("/signout", headers=ORIGIN, data=_form(app),
@@ -144,7 +146,7 @@ def sign_out_ends_the_session():
     assert r.status_code == 303 and r.headers["location"] == "/signin"
     c.cookies.clear()
     assert c.get("/days", follow_redirects=False).status_code == 303
-    assert ("olu", "sign_out", "") in store.events
+    assert ("asha", "sign_out", "") in store.events
 
 
 @case
@@ -203,24 +205,27 @@ def a_viewer_sees_no_start_and_is_refused_it():
 @case
 def started_by_and_stopped_by_are_the_signed_in_user():
     app, _, runner = _portal()
-    c, _ = _sign_in(app, "olu")
+    c, _ = _sign_in(app, "asha")
     assert "const CAN_RUN = true;" in c.get("/").text
     h = {**ORIGIN, "X-Run-Token": app.state.run_token}
     assert c.post("/api/bot/start", headers=h).status_code == 200
-    assert runner.started_by == "olu"
+    assert runner.started_by == "asha"
     assert c.post("/api/bot/stop", headers=h).status_code == 200
-    assert runner.stopped_by == "olu"
-    assert c.get("/admin/users").status_code == 403, "Operator is no Admin"
+    assert runner.stopped_by == "asha"
 
 
 @case
 def the_header_names_the_user_and_admin_links_are_admin_only():
     app, _, _ = _portal()
-    a, _ = _sign_in(app, "asha")
-    page = a.get("/runs").text
-    assert "<b>Asha</b> · Admin" in page and 'href="/admin/users"' in page
-    o, _ = _sign_in(app, "olu")
-    assert 'href="/admin/users"' not in o.get("/runs").text
+    for name, role in (("sam", "Super Admin"), ("asha", "Admin")):
+        a, _ = _sign_in(app, name)
+        page = a.get("/runs").text
+        assert f"<b>{name.title()}</b> · {role}" in page, name
+        assert 'href="/admin/users"' in page and 'href="/admin/signins"' in page
+    v, _ = _sign_in(app, "vee")
+    page = v.get("/runs").text
+    assert 'href="/admin/users"' not in page
+    assert 'href="/admin/signins"' not in page
 
 
 @case
@@ -228,9 +233,13 @@ def an_admin_adds_a_user_who_then_must_change():
     app, store, _ = _portal()
     c, _ = _sign_in(app, "asha")
     r = c.post("/admin/users", headers=ORIGIN, data=_form(
-        app, username="Ravi", display_name="Ravi K", role="Operator",
+        app, username="Ravi", display_name="Ravi K", role="Viewer",
         password="temp-password-1"))
     assert r.status_code == 200 and "ravi added" in r.text, r.text[:300]
+    r = c.post("/admin/users", headers=ORIGIN, data=_form(
+        app, username="kim", display_name="", role="Admin",
+        password="temp-password-1"))
+    assert r.status_code == 400 and "An Admin can add or change Viewer only"         in r.text and "kim" not in store.users
     assert store.users["ravi"]["must_change"] is True
     assert ("ravi", "user_created", "asha") in store.events
     r = c.post("/admin/users", headers=ORIGIN, data=_form(
@@ -242,20 +251,42 @@ def an_admin_adds_a_user_who_then_must_change():
 @case
 def admin_changes_reach_an_open_session_at_once():
     app, store, _ = _portal()
-    admin, _ = _sign_in(app, "asha")
-    olu, _ = _sign_in(app, "olu")
+    admin, _ = _sign_in(app, "sam")
+    olu, _ = _sign_in(app, "asha")
     vee, _ = _sign_in(app, "vee")
-    admin.post("/admin/users/olu/role", headers=ORIGIN,
+    admin.post("/admin/users/asha/role", headers=ORIGIN,
                data=_form(app, role="Viewer"))
     assert "const CAN_RUN = false;" in olu.get("/").text, "role now Viewer"
     admin.post("/admin/users/vee/disable", headers=ORIGIN, data=_form(app))
     assert vee.get("/days", follow_redirects=False).status_code == 303
     _, r = _sign_in(app, "vee")
     assert r.status_code == 401 and "disabled" in r.text
-    admin.post("/admin/users/olu/reset", headers=ORIGIN,
+    admin.post("/admin/users/asha/reset", headers=ORIGIN,
                data=_form(app, password="temp-password-2"))
     assert olu.get("/days", follow_redirects=False).status_code == 303
-    assert store.users["olu"]["must_change"] is True
+    assert store.users["asha"]["must_change"] is True
+
+
+@case
+def the_users_page_offers_only_what_each_role_may_change():
+    """An Admin's page: add a Viewer, change Viewer rows only. A Super
+    Admin's: Admin or Viewer, never Super Admin; no row changes a Super
+    Admin."""
+    app, store, _ = _portal()
+    a, _ = _sign_in(app, "asha")
+    page = a.get("/admin/users").text
+    assert "<option selected>Viewer</option>" in page
+    assert "<option>Admin</option>" not in page, "an Admin adds Viewers only"
+    assert 'action="/admin/users/vee/reset"' in page
+    for name in ("sam", "asha"):
+        assert f'action="/admin/users/{name}/' not in page, name
+    s, _ = _sign_in(app, "sam")
+    page = s.get("/admin/users").text
+    assert "<option>Admin</option>" in page and "Super Admin</option>"         not in page
+    assert 'action="/admin/users/asha/role"' in page
+    assert 'action="/admin/users/sam/' not in page, "nobody changes sam here"
+    r = a.post("/admin/users/sam/disable", headers=ORIGIN, data=_form(app))
+    assert r.status_code == 400 and not store.users["sam"]["disabled"]
 
 
 @case
@@ -271,9 +302,10 @@ def admin_forms_need_the_token():
 def the_sign_in_history_lists_events_for_an_admin():
     app, _, _ = _portal()
     _sign_in(app, "vee", "wrong-password-x")
-    c, _ = _sign_in(app, "asha")
-    page = c.get("/admin/signins").text
-    assert "wrong password" in page and "vee" in page
+    for name in ("sam", "asha"):
+        c, _ = _sign_in(app, name)
+        page = c.get("/admin/signins").text
+        assert "wrong password" in page and "vee" in page, name
 
 
 @case
@@ -285,6 +317,21 @@ def with_no_users_the_sign_in_page_says_how_to_add_one():
     assert "add_portal_user.py" in page
 
 
+@case
+def the_sign_in_page_says_what_the_portal_is_and_helps_with_the_password():
+    """Operator, 2026-10-26: the Sign-in page was plain. It now introduces
+    the Portal, can show the typed password, warns about Caps Lock, and
+    says the idle and lockout rules."""
+    app, _, _ = _portal()
+    page = TestClient(app, base_url=BASE).get("/signin").text
+    assert 'class="auth-brand"' in page and "Charge Validation" in page
+    assert 'id="pw-toggle"' in page and 'aria-controls="pw"' in page
+    assert 'id="caps"' in page, "a Caps Lock warning"
+    assert "30 minutes" in page and "15 minutes" in page
+    assert 'name="username"' in page and 'id="pw" name="password"' in page
+    assert '<link rel="icon"' in page, "a tab icon, no /favicon.ico 404"
+
+
 @case
 def no_signed_in_page_carries_an_inline_style():
     app, _, _ = _portal()