feat: scope Editor user administration by group (#990 slice 2)

crates/ruscker-admin/assets/i18n/en/landing.ftl

@@ -165,6 +165,7 @@ admin-users-import-done-prefix = Imported:
 admin-users-import-skipped-prefix = skipped:
 admin-users-groups-placeholder = analysts, managers
 admin-users-groups-hint = Comma-separated groups control which restricted apps the user sees.
+admin-users-groups-readonly = Groups managed by other teams (read-only):
 admin-users-col-groups = Groups
 admin-users-save-groups = Save groups
 admin-users-new-password = new password
@@ -181,6 +182,10 @@ admin-users-password-rule = At least 8 characters, with at least 1 uppercase, 1
 admin-users-flash-weak-password = Weak password — the policy requires at least 8 characters, with 1 uppercase, 1 lowercase, 1 digit and 1 special character.
 admin-users-generate-password = Generate random password
 admin-users-flash-exists = A user with that name already exists.
+admin-users-flash-scope-role = Editors may only assign the Viewer or Editor role.
+admin-users-flash-scope-groups = Editors may only assign groups they already belong to.
+admin-users-flash-group-required = Add at least one of your groups so the new user remains within your scope.
+admin-users-flash-self-edit = You cannot change your own role, groups or password here. Use your account page to change your password.
 
 # Admin dashboard
 admin-dashboard-title = Container Management

crates/ruscker-admin/assets/i18n/es/landing.ftl

@@ -165,6 +165,7 @@ admin-users-import-done-prefix = Importados:
 admin-users-import-skipped-prefix = omitidos:
 admin-users-groups-placeholder = analistas, gestores
 admin-users-groups-hint = Los grupos separados por comas controlan qué apps restringidas ve el usuario.
+admin-users-groups-readonly = Grupos administrados por otros equipos (solo lectura):
 admin-users-col-groups = Grupos
 admin-users-save-groups = Guardar grupos
 admin-users-new-password = nueva contraseña
@@ -181,6 +182,10 @@ admin-users-password-rule = Mínimo 8 caracteres, con al menos 1 mayúscula, 1 m
 admin-users-flash-weak-password = Contraseña débil — la política exige mínimo 8 caracteres, con 1 mayúscula, 1 minúscula, 1 número y 1 carácter especial.
 admin-users-generate-password = Generar contraseña aleatoria
 admin-users-flash-exists = Ya existe un usuario con ese nombre.
+admin-users-flash-scope-role = Los Editores solo pueden asignar los roles Visualizador o Editor.
+admin-users-flash-scope-groups = Los Editores solo pueden asignar grupos a los que ya pertenecen.
+admin-users-flash-group-required = Añada al menos uno de sus grupos para que el nuevo usuario permanezca dentro de su ámbito.
+admin-users-flash-self-edit = No puede cambiar su propio rol, grupos ni contraseña aquí. Use la página de su cuenta para cambiar la contraseña.
 
 # Admin dashboard
 admin-dashboard-title = Gestión de Contenedores

crates/ruscker-admin/assets/i18n/fr/landing.ftl

@@ -165,6 +165,7 @@ admin-users-import-done-prefix = Importés :
 admin-users-import-skipped-prefix = ignorés :
 admin-users-groups-placeholder = analystes, gestionnaires
 admin-users-groups-hint = Les groupes séparés par des virgules déterminent les applis restreintes visibles par l'utilisateur.
+admin-users-groups-readonly = Groupes gérés par d'autres équipes (lecture seule) :
 admin-users-col-groups = Groupes
 admin-users-save-groups = Enregistrer les groupes
 admin-users-new-password = nouveau mot de passe
@@ -181,6 +182,10 @@ admin-users-password-rule = Au moins 8 caractères, dont 1 majuscule, 1 minuscul
 admin-users-flash-weak-password = Mot de passe faible — la politique exige au moins 8 caractères, dont 1 majuscule, 1 minuscule, 1 chiffre et 1 caractère spécial.
 admin-users-generate-password = Générer un mot de passe aléatoire
 admin-users-flash-exists = Un utilisateur portant ce nom existe déjà.
+admin-users-flash-scope-role = Les Éditeurs ne peuvent attribuer que les rôles Lecteur ou Éditeur.
+admin-users-flash-scope-groups = Les Éditeurs ne peuvent attribuer que les groupes auxquels ils appartiennent déjà.
+admin-users-flash-group-required = Ajoutez au moins un de vos groupes afin que le nouvel utilisateur reste dans votre périmètre.
+admin-users-flash-self-edit = Vous ne pouvez pas modifier ici votre propre rôle, vos groupes ou votre mot de passe. Utilisez la page de votre compte pour changer votre mot de passe.
 
 # Admin dashboard
 admin-dashboard-title = Gestion des Conteneurs

crates/ruscker-admin/assets/i18n/pt/landing.ftl

@@ -169,6 +169,7 @@ admin-users-import-done-prefix = Importados:
 admin-users-import-skipped-prefix = ignorados:
 admin-users-groups-placeholder = analistas, gestores
 admin-users-groups-hint = Grupos separados por vírgula controlam quais apps restritos o usuário vê.
+admin-users-groups-readonly = Grupos administrados por outras equipes (somente leitura):
 admin-users-col-groups = Grupos
 admin-users-save-groups = Salvar grupos
 admin-users-new-password = nova senha
@@ -185,6 +186,10 @@ admin-users-password-rule = Mínimo de 8 caracteres, com ao menos 1 maiúscula,
 admin-users-flash-weak-password = Senha fraca — a política exige mínimo de 8 caracteres, com 1 maiúscula, 1 minúscula, 1 número e 1 caractere especial.
 admin-users-generate-password = Gerar senha aleatória
 admin-users-flash-exists = Já existe um usuário com esse nome.
+admin-users-flash-scope-role = Editores só podem atribuir os níveis Visualizador ou Editor.
+admin-users-flash-scope-groups = Editores só podem atribuir grupos dos quais já fazem parte.
+admin-users-flash-group-required = Informe pelo menos um dos seus grupos para que o novo usuário permaneça no seu escopo.
+admin-users-flash-self-edit = Você não pode alterar seu próprio nível, grupos ou senha nesta tela. Use a tela da sua conta para trocar sua senha.
 
 # Admin dashboard
 admin-dashboard-title = Gestão dos Containers

crates/ruscker-admin/src/auth.rs

@@ -12,9 +12,9 @@
 //! never be locked out — treat it as a sensitive secret. When it isn't
 //! set, admin routes 503.
 //!
-//! Roles (see [`Role`]): **Viewer** (dashboard only), **Editor**
-//! (apps + media + dashboard), and **Admin** (everything, incl. user
-//! management). External IdPs (OIDC/SAML/LDAP) and per-app ACLs land
+//! Roles (see [`Role`]): **Viewer** (portal only), **Editor**
+//! (apps + media + group-scoped user management), and **Admin**
+//! (everything). External IdPs (OIDC/SAML/LDAP) and per-app ACLs land
 //! in Phase 8.
 //!
 //! Cookie: the value is an opaque server-side session id (never the
@@ -47,10 +47,10 @@ pub const COOKIE_NAME: &str = "ruscker_admin_session";
 /// `nav_section` strings the templates already use.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub enum Role {
-    /// Read-only: the monitoring dashboard, nothing else.
+    /// Portal end user: app visibility comes from group membership.
     Viewer,
-    /// Manages apps and media (create/edit/delete + uploads) and has
-    /// the full dashboard, including the stop/restart actions.
+    /// Manages apps, media and group-scoped users and has the full
+    /// dashboard, including the stop/restart actions.
     Editor,
     /// Everything — credentials, landing editor, custom blocks, audit
     /// log. The historical single-token behaviour.
@@ -64,13 +64,13 @@ impl Role {
     /// `landing`, `blocks`, `audit`).
     pub fn can_access_section(&self, section: &str) -> bool {
         match section {
-            // Dashboard + apps + media: Editor and up. A Viewer is NOT
-            // an admin-panel operator (#857) — it's the portal's
+            // Dashboard + apps + media + scoped users: Editor and up. A
+            // Viewer is NOT an admin-panel operator (#857) — it's the portal's
             // authenticated-end-user role (group-based card visibility,
             // #155), so it reaches NO admin section.
-            "dashboard" | "specs" | "images" => *self >= Role::Editor,
-            // Everything else — credentials, landing, users, groups,
-            // logs, disk, audit, system, schedules — is admin-only.
+            "dashboard" | "specs" | "images" | "users" => *self >= Role::Editor,
+            // Everything else — credentials, landing, groups, logs, disk,
+            // audit, system, schedules — is admin-only.
             _ => *self == Role::Admin,
         }
     }
@@ -741,9 +741,9 @@ mod tests {
         assert!(Role::Admin > Role::Editor);
         assert!(Role::Editor > Role::Viewer);
 
-        // Dashboard + apps + media: Editor and up — a Viewer reaches no
-        // admin section (#857).
-        for sec in ["dashboard", "specs", "images"] {
+        // Dashboard + apps + media + scoped users: Editor and up — a Viewer
+        // reaches no admin section (#857).
+        for sec in ["dashboard", "specs", "images", "users"] {
             assert!(!Role::Viewer.can_access_section(sec));
             assert!(Role::Editor.can_access_section(sec));
             assert!(Role::Admin.can_access_section(sec));