Merge pull request #79 from theta42/docs-help-search

Add header help icon and in-app docs search
2026-07-17 19:24:33 -04:00 · 2026-07-17 19:22:27 -04:00 · 2026-07-17 11:31:11 -04:00 · 2026-07-17 11:28:41 -04:00 · 2026-07-17 11:03:05 -04:00 · 2026-07-17 11:00:50 -04:00
26 changed files with 1039 additions and 415 deletions
@@ -6,6 +6,40 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.

 ## [Unreleased]

+## [1.1.10] - 2026-07-17
+
+### Added
+- A help icon (❓) in the top-right header now deep-links to the doc most relevant to the current page (falls back to the docs index elsewhere).
+- The in-app docs viewer (`/docs`) is now searchable — a simple line-substring search over the same local doc set, no new dependency, still works with no internet access.
+
+## [1.1.9] - 2026-07-17
+
+### Added
+- Every account's personal Unix group (its primary GID holder) can now have supplementary members managed from the account's profile page ("Members of `<uid>`'s group", admin-only) — e.g. to share write access to files owned by that group. Uses the standard `memberUid` attribute (RFC 2307 `posixGroup`).
+
+## [1.1.8] - 2026-07-17
+
+### Added
+- Group membership is now editable directly from a user's profile page ("My groups" -- add via a group-name picker, remove with a button per row), instead of only from each group's own card on the Groups page. Admin-only, using the existing per-group member add/remove endpoints.
+
+### Fixed
+- The Edit Profile form's Mobile Phone field had a stray `validate=":9"` making it effectively required (submission was blocked with "Please fix the form errors" if left blank) -- it was always meant to be optional, matching the "Add user" form. Removed.
+- A service account's profile always showed `Name: Service Account` -- every service account has the same literal filler given/last name (a schema-satisfying placeholder, not meant to be shown), making them indistinguishable by name. The Name line is now hidden for service accounts.
+- The Users page's Service Accounts tab, and a freshly-created service account's own profile, could appear empty/not-a-service-account for up to 5 minutes right after creation. Creating a user caches it via `User.get()` *before* the route handler marks it as a service account (group membership), so the cached copy had `isServiceAccount` stuck wrong until the cache TTL expired. Now cleared and re-fetched immediately after marking.
+- A user belonging to exactly one LDAP group had their `memberOf` attribute returned as a bare string instead of a one-element array (ldapts's normal behavior for single-valued attributes) -- client-side permission checks (`for(let group of user.memberOf)`) would then iterate the DN character-by-character instead of once, causing pages gated on that group (e.g. Groups) to incorrectly show "You do not have permission to be here." Normalized `memberOf` to always be an array, same fix already applied to `manager`.
+
+## [1.1.7] - 2026-07-17
+
+### Changed
+- **Service accounts unified to one kind.** Removed the LDAP bind-only service account type (the Integrations → LDAP "Service Accounts" card, and its `/api/service-account` routes) -- every service account is now a real Unix/POSIX account with a UID, created from the new **Users → Service Accounts** tab. Email and password are both optional for service accounts; a blank password means no `userPassword` is set at all (the account simply can't bind).
+- **Added a `manager` field to every account.** Multi-valued (a list of usernames), defaults to whoever created the account (the admin who added it, or whoever sent the invite), and reassignable from the account's Edit form. Anyone listed as a manager can edit that account -- same fields an admin can (mobile, description, SSH key, date of birth, home directory, login shell, manager list) -- without needing `app_sso_admin`.
+- `homeDirectory` and `loginShell` are now editable from the Edit Profile form (previously view-only).
+
+## [1.1.6] - 2026-07-16
+
+### Changed
+- Redesigned the GitHub Pages docs site to match the app's own look (dark navbar/footer, Bootstrap 5, Font Awesome) instead of the generic `jekyll-theme-cayman` theme, added a real cross-page nav, SEO (`jekyll-seo-tag` + `jekyll-sitemap`, per-page descriptions, OG/Twitter tags, sitemap.xml, robots.txt), and mobile-responsive layout.
+
 ## [1.1.5] - 2026-07-16

 ### Fixed
@@ -49,7 +83,12 @@ First tagged release. Establishes the `vX.Y.Z` tag convention that the in-app up
 - Unix/POSIX and LDAP bind-only service account support, distinct from real-person accounts.
 - Merged OAuth Apps + LDAP Info into a single Integrations page.

-[Unreleased]: https://github.com/theta42/sso-manager-node/compare/v1.1.5...HEAD
+[Unreleased]: https://github.com/theta42/sso-manager-node/compare/v1.1.10...HEAD
+[1.1.10]: https://github.com/theta42/sso-manager-node/compare/v1.1.9...v1.1.10
+[1.1.9]: https://github.com/theta42/sso-manager-node/compare/v1.1.8...v1.1.9
+[1.1.8]: https://github.com/theta42/sso-manager-node/compare/v1.1.7...v1.1.8
+[1.1.7]: https://github.com/theta42/sso-manager-node/compare/v1.1.6...v1.1.7
+[1.1.6]: https://github.com/theta42/sso-manager-node/compare/v1.1.5...v1.1.6
 [1.1.5]: https://github.com/theta42/sso-manager-node/compare/v1.1.4...v1.1.5
 [1.1.4]: https://github.com/theta42/sso-manager-node/compare/v1.1.3...v1.1.4
 [1.1.3]: https://github.com/theta42/sso-manager-node/compare/v1.1.2...v1.1.3
@@ -1,9 +1,44 @@
 title: SSO Manager
-description: A self-hosted OpenID Connect provider with an OpenLDAP directory and a web management UI
-theme: jekyll-theme-cayman
-show_downloads: false
+description: A self-hosted OpenID Connect provider with a bundled OpenLDAP directory and a web management UI, for home labs and small businesses that want their own identity provider.
+url: "https://theta42.github.io"
+baseurl: "/sso-manager-node"
+logo: /assets/img/theta42.svg
+lang: en_US
+
+plugins:
+  - jekyll-seo-tag
+  - jekyll-sitemap
+
 github:
  repository_url: https://github.com/theta42/sso-manager-node
  zip_url: https://github.com/theta42/sso-manager-node/archive/refs/heads/master.zip
  tar_url: https://github.com/theta42/sso-manager-node/archive/refs/heads/master.tar.gz
-  repository_name: theta42/sso-manager-node
+  repository_name: theta42/sso-manager-node
+
+nav:
+  - title: Home
+    page: /
+    icon: fa-house
+  - title: Deployment
+    page: /deployment.html
+    icon: fa-server
+  - title: Configuration
+    page: /configuration.html
+    icon: fa-gears
+  - title: OAuth
+    page: /oauth.html
+    icon: fa-key
+  - title: LDAP
+    page: /ldap.html
+    icon: fa-address-book
+  - title: Changelog
+    url: https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md
+    icon: fa-list
+
+defaults:
+  - scope:
+      path: ""
+      type: "pages"
+    values:
+      layout: default
+      image: /assets/img/theta42.svg
@@ -0,0 +1,82 @@
+<!doctype html>
+<html lang="en">
+<head>
+	<meta charset="utf-8">
+	<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+	<link rel="icon" type="image/svg+xml" href="{{ '/assets/img/theta42.svg' | relative_url }}">
+
+	{% seo title=false %}
+	<title>{% if page.title %}{{ page.title }} &middot; {% endif %}{{ site.title }}</title>
+
+	<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css">
+	<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css">
+	<link rel="stylesheet" href="{{ '/assets/css/style.css' | relative_url }}">
+</head>
+<body class="d-flex flex-column min-vh-100">
+
+	<nav class="navbar navbar-expand-md navbar-dark bg-dark fixed-top">
+		<div class="container-fluid px-3">
+			<a class="navbar-brand d-flex align-items-center" href="{{ '/' | relative_url }}">
+				<img src="{{ '/assets/img/theta42.svg' | relative_url }}" height="28" class="me-2" alt="">
+				{{ site.title }}
+			</a>
+			<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navMain" aria-controls="navMain" aria-expanded="false" aria-label="Toggle navigation">
+				<span class="navbar-toggler-icon"></span>
+			</button>
+			<div class="collapse navbar-collapse justify-content-end" id="navMain">
+				<ul class="navbar-nav">
+					{% for item in site.nav %}
+					<li class="nav-item">
+						{% if item.page %}
+						<a class="nav-link{% if page.url == item.page %} active{% endif %}" href="{{ item.page | relative_url }}">
+							{% if item.icon %}<i class="fa-solid {{ item.icon }}"></i>{% endif %} {{ item.title }}
+						</a>
+						{% else %}
+						<a class="nav-link" href="{{ item.url }}" target="_blank" rel="noopener">
+							{% if item.icon %}<i class="fa-solid {{ item.icon }}"></i>{% endif %} {{ item.title }}
+						</a>
+						{% endif %}
+					</li>
+					{% endfor %}
+				</ul>
+			</div>
+		</div>
+	</nav>
+
+	<main class="flex-grow-1" style="margin-top: 4.5rem;">
+		<div class="container-fluid py-4 py-md-5">
+			<div class="row justify-content-center">
+				<div class="col-12 col-lg-10 col-xl-8">
+					<div class="card shadow-lg">
+						<div class="card-body p-4 p-md-5 site-content">
+							{{ content }}
+						</div>
+					</div>
+				</div>
+			</div>
+		</div>
+	</main>
+
+	<footer class="py-3 bg-dark text-light mt-auto">
+		<div class="container-fluid d-flex flex-wrap justify-content-between align-items-center small gap-2 px-3">
+			<span class="d-flex align-items-center gap-2">
+				<a href="https://theta42.com" target="_blank" rel="noopener">
+					<img width="40" src="{{ '/assets/img/theta42.svg' | relative_url }}" alt="theta42">
+				</a>
+				&copy; {{ 'now' | date: '%Y' }} theta42 &middot;
+				<a href="{{ site.github.repository_url }}/blob/master/LICENSE" target="_blank" rel="noopener" class="text-light">MIT License</a>
+			</span>
+			<span class="d-flex align-items-center gap-3">
+				<a href="{{ site.github.repository_url }}" target="_blank" rel="noopener" class="text-light text-decoration-none">
+					<i class="fa-brands fa-github"></i> GitHub
+				</a>
+				<a href="{{ site.github.repository_url }}/blob/master/CHANGELOG.md" target="_blank" rel="noopener" class="text-light text-decoration-none">
+					<i class="fa-solid fa-list"></i> Changelog
+				</a>
+			</span>
+		</div>
+	</footer>
+
+	<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"></script>
+</body>
+</html>
@@ -0,0 +1,116 @@
+/* theta42 docs site — shares the in-app dark navbar/footer + card look
+   (Bootstrap 5 + Font Awesome, same as the running apps) rather than a
+   generic Jekyll theme. */
+
+body {
+	background-color: #f4f5f6;
+}
+
+.navbar-brand img {
+	filter: drop-shadow(0 0 2px rgba(0, 0, 0, .4));
+}
+
+.navbar-nav .nav-link.active {
+	color: #fff;
+	font-weight: 600;
+}
+
+/* Markdown content typography, scoped to the card body so it doesn't leak
+   into the nav/footer. */
+.site-content h1:first-child {
+	margin-top: 0;
+}
+
+.site-content h1,
+.site-content h2,
+.site-content h3 {
+	font-weight: 700;
+}
+
+.site-content h2 {
+	margin-top: 2.5rem;
+	padding-bottom: .4rem;
+	border-bottom: 1px solid #e9ecef;
+}
+
+.site-content h3 {
+	margin-top: 1.75rem;
+}
+
+.site-content a {
+	color: #a3671f;
+	text-decoration-color: rgba(163, 103, 31, .35);
+}
+
+.site-content a:hover {
+	color: #8a5a16;
+}
+
+.site-content pre {
+	background-color: #212529;
+	color: #f8f9fa;
+	padding: 1rem 1.25rem;
+	border-radius: .375rem;
+	overflow-x: auto;
+}
+
+.site-content code {
+	color: #a3671f;
+	background-color: #f4f0e8;
+	padding: .15em .4em;
+	border-radius: .25rem;
+	font-size: .875em;
+}
+
+.site-content pre code {
+	color: inherit;
+	background: none;
+	padding: 0;
+}
+
+.site-content table {
+	display: block;
+	overflow-x: auto;
+	width: 100%;
+	border-collapse: collapse;
+	margin: 1.25rem 0;
+}
+
+.site-content table th,
+.site-content table td {
+	border: 1px solid #dee2e6;
+	padding: .5rem .75rem;
+	text-align: left;
+}
+
+.site-content table th {
+	background-color: #f8f9fa;
+}
+
+.site-content blockquote {
+	border-left: 4px solid #C59341;
+	padding: .5rem 1rem;
+	margin: 1.25rem 0;
+	background-color: #f8f6f1;
+	color: #495057;
+}
+
+.site-content img {
+	max-width: 100%;
+	height: auto;
+}
+
+/* Screenshot grids in the markdown use width="49%" inline attrs for a
+   two-up desktop layout -- stack them on narrow screens instead of
+   squeezing to illegibility. */
+@media (max-width: 576px) {
+	.site-content img[width] {
+		width: 100% !important;
+		margin-bottom: .75rem;
+	}
+}
+
+.site-content hr {
+	margin: 2rem 0;
+	border-top: 1px solid #e9ecef;
+}
@@ -0,0 +1,51 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 400 400" width="100%" height="100%">
+  <defs>
+    <linearGradient id="gold-grad" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#C59341" />
+      <stop offset="20%" stop-color="#E4B869" />
+      <stop offset="40%" stop-color="#FBF0B9" />
+      <stop offset="60%" stop-color="#DFB260" />
+      <stop offset="80%" stop-color="#BC8837" />
+      <stop offset="100%" stop-color="#A36F28" />
+    </linearGradient>
+
+    <linearGradient id="text-grad" x1="0%" y1="100%" x2="100%" y2="0%">
+      <stop offset="0%" stop-color="#FFFFFF" />
+      <stop offset="40%" stop-color="#F5E3B5" />
+      <stop offset="70%" stop-color="#D4A343" />
+      <stop offset="100%" stop-color="#8A5A16" />
+    </linearGradient>
+
+    <filter id="drop-shadow" x="-20%" y="-20%" width="140%" height="140%">
+      <feDropShadow dx="0" dy="8" stdDeviation="6" flood-color="#000000" flood-opacity="0.4"/>
+    </filter>
+  </defs>
+
+  <g filter="url(#drop-shadow)">
+    <g fill="url(#gold-grad)">
+      <path d="M 200,40 
+               C 290,40 350,110 350,200 
+               C 350,290 290,360 200,360 
+               C 110,360 50,290 50,200 
+               C 50,110 110,40 200,40 Z 
+               M 200,75 
+               C 130,75 88,130 88,200 
+               C 88,270 130,325 200,325 
+               C 270,325 312,270 312,200 
+               C 312,130 270,75 200,75 Z" 
+            fill-rule="evenodd" />
+      
+      <path d="M 88,190 L 140,190 C 140,190 142,210 140,210 L 88,210 Z" />
+      
+      <path d="M 260,190 L 312,190 C 312,190 310,210 260,210 Z" />
+    </g>
+
+    <text x="200" y="222" 
+          font-family="system-ui, -apple-system, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif" 
+          font-size="78" 
+          font-weight="900" 
+          fill="url(#text-grad)" 
+          text-anchor="middle"
+          letter-spacing="-2">42</text>
+  </g>
+</svg>
@@ -1,6 +1,7 @@
 ---
 layout: default
 title: Configuration
+description: SSO Manager's config layers — conf/base.js defaults, secrets.js overrides, and app_* environment variables.
 ---

 # Configuration
@@ -1,6 +1,7 @@
 ---
 layout: default
 title: Deployment
+description: Deploying SSO Manager — the all-in-one Docker image, bare-metal install, config layers, and backups.
 ---

 # Deployment Guide
@@ -1,6 +1,7 @@
 ---
 layout: default
 title: Home
+description: A self-hosted OpenID Connect provider with a bundled OpenLDAP directory and a web management UI. One login for your modern apps, one LDAP directory for the rest, no phone-home.
 ---

 # SSO Manager
@@ -1,6 +1,7 @@
 ---
 layout: default
 title: LDAP
+description: SSO Manager's bundled OpenLDAP directory — schema, service accounts, TLS, and connecting third-party apps directly.
 ---

 # LDAP Directory
@@ -34,6 +35,15 @@ User entries are `cn=<uid>,ou=people,<base>` and carry the objectClasses:
 - `sudoRole` — per-user sudo rules (`sudoCommand`, `sudoHost`, `sudoUser`).
 - `theta42Person` (custom auxiliary; `dateOfBirth`).

+Every user (person or service account) also carries a `manager` attribute
+(the standard COSINE `manager`, `SUP distinguishedName`) — one or more DNs of
+the people who created/administer that account. Set automatically to the
+creator's DN on signup (whoever an admin was logged in as, or whoever sent
+the invite), and reassignable later from the account's Edit form. Anyone
+listed as a `manager` can edit that account (same fields an admin can:
+mobile, description, SSH key, date of birth, home directory, login shell,
+and the manager list itself) without needing `app_sso_admin`.
+
 Passwords are stored as `{SSHA512}` (8-byte salt, sha512(pass+salt), base64),
 verified by the `pw-sha2` module. The app's `hashPasswordSSHA512` is the
 canonical hasher; if you provision users out-of-band, hash passwords the same
@@ -47,6 +57,19 @@ membership (`memberOf` on the user); `refint` keeps it consistent on
 add/remove. **Admin permission checks read the group's `member` list**, not
 `memberOf` on the user.

+### Personal groups
+
+Every user (person or service account) also gets a **personal Unix group**
+at creation — `cn=<uid>,ou=groups,<base>`, `objectClass: posixGroup` (RFC
+2307), holding just `cn` and `gidNumber` (the user's primary GID). This is a
+different schema than the `groupOfNames` groups above — its membership
+attribute is `memberUid` (a bare username, not a DN), and unlike
+`groupOfNames` it's valid with zero members. It's excluded from the
+`/groups` page (which filters on `objectClass=groupOfNames`) and managed
+instead from the owning user's own profile page ("Members of `<uid>`'s
+group", admin-only) — add other accounts as supplementary members, e.g. to
+share write access to files owned by this group.
+
 The SSO requires three groups (seeded automatically by the entrypoint /
 `install.sh`):

@@ -93,33 +116,39 @@ The entrypoint leaves existing certs untouched (idempotent).

 ## Service accounts

-There are two different kinds of "not a real person" account, and which one
-you want depends on what's consuming it:
+A service account is a normal `posixAccount` for something that isn't a
+person: a media manager, a torrent client, a service like Emby, or a
+read-only bind account an app uses to look users up — anything that needs a
+real `uidNumber`/`gidNumber` to own files, or that other accounts join via a
+group for write access (e.g. a `stuff_manager` group granting write rights
+to a media library). There's only one kind — every account, person or
+service, is a real `posixAccount` with a UID.

-**LDAP bind-only** — for an app that just needs to bind LDAP to look users up
-(its own "LDAP authentication" settings page, or the read-only account
-`theta42/ldap-client` binds as). Not a `posixAccount` — no `uidNumber`, no
-home directory, can't log into this UI. Create one from the
-**Integrations → LDAP** tab's *Service Accounts* section (create, rotate
-password, delete). theta-env's bootstrap creates `cn=ldapclient` this same
-way automatically, and the proxy binds as it — don't reuse the admin DN for
-this.
+Create one from the **Users → Service Accounts** tab's "Add new user" form
+with **This is a service account** checked — it skips the birthday/
+Terms-of-Service fields a real person's account needs and asks for just an
+account name. It's flagged (via membership in the `app_sso_service_account`
+group) so it's listed separately from real people and excluded from "all
+users" notification broadcasts.

-**Unix/POSIX** — for an account something actually *runs as* on a Linux
-host: a media manager, a torrent client, a service like Emby — anything that
-needs a real `uidNumber`/`gidNumber` to own files or that other accounts join
-via a group for write access (e.g. a `stuff_manager` group granting write
-rights to a media library). Create one from the **Users** page's "Add new
-user" form with **This is a service account** checked — it skips the
-birthday/Terms-of-Service fields a real person's account needs and asks for
-just an account name. It's a normal `posixAccount`, just flagged (via
-membership in the `app_sso_service_account` group) so it's visibly marked in
-the Users list and excluded from "all users" notification broadcasts.
+Email and password are both optional for a service account:

-Either way: don't reuse the admin DN, and give it only the group memberships
-it actually needs.
+- No `mail` is set unless you give it one (it never needs a mailbox).
+- Leaving the password blank is fine — no `userPassword` attribute is set at
+  all, and an entry with no `userPassword` simply can't bind with any
+  password (standard LDAP simple-bind behavior). Only set a password if the
+  account actually needs to authenticate as itself (e.g. a bind-only account
+  an app uses to look users up).

-Example bind test (LDAP bind-only account):
+theta-env's bootstrap creates its own `cn=ldapclient` bind account directly
+against LDAP (independent of this app), and the proxy binds as it — that
+account won't show up in the Service Accounts tab since it isn't managed
+through this app, but it keeps working unchanged.
+
+Either way: don't reuse the admin DN, and give a service account only the
+group memberships and `manager`s it actually needs.
+
+Example bind test (a service account with a password set):

 ```bash
 ldapsearch -x -H ldaps://sso.example.com:636 \
@@ -1,6 +1,7 @@
 ---
 layout: default
 title: OAuth / OIDC
+description: SSO Manager's OpenID Connect / OAuth 2.0 provider — discovery document, client registration, and token endpoints.
 ---

 # OAuth 2.0 / OpenID Connect
@@ -0,0 +1,4 @@
+User-agent: *
+Allow: /
+
+Sitemap: https://theta42.github.io/sso-manager-node/sitemap.xml
@@ -82,7 +82,6 @@ app.use('/api/user', middleware.auth, require('./routes/user'));
 app.use('/api/token', middleware.auth, require('./routes/token'));

 app.use('/api/group', middleware.auth, require('./routes/group'));
-app.use('/api/service-account', middleware.auth, require('./routes/service_account'));
 app.use('/api/notification', middleware.auth, require('./routes/notification'));
 app.use('/api/update-check', middleware.auth, require('./routes/update_check'));
 app.use('/api/tos', middleware.auth, require('./routes/tos'));
@@ -1,114 +0,0 @@
-'use strict';
-
-// Non-person "service" accounts under ou=people -- bind-only LDAP identities
-// for things like theta-env's bootstrap-created cn=ldapclient (the proxy's
-// direct-LDAP bind account) or any other app/host that needs its own
-// dedicated read-only credential, as opposed to a real user who logs into
-// the web UI.
-//
-// Deliberately NOT posixAccount/inetOrgPerson (the User model's shape) --
-// these can't log into the SSO Manager UI or get a home directory/uidNumber.
-// objectClass matches exactly what theta-env's bootstrap.js already creates
-// for cn=ldapclient, so this model recognizes and manages that account too,
-// not just ones created through this UI.
-
-const { Client, Attribute, Change } = require('ldapts');
-const crypto = require('crypto');
-const conf = require('@simpleworkjs/conf').ldap;
-
-function hashPasswordSSHA512(password) {
-	const salt = crypto.randomBytes(8);
-	const hash = crypto.createHash('sha512').update(password).update(salt).digest();
-	return '{SSHA512}' + Buffer.concat([hash, salt]).toString('base64');
-}
-
-function makeClient() {
-	return new Client({ url: conf.url });
-}
-
-async function withClient(fn) {
-	const client = makeClient();
-	try {
-		await client.bind(conf.bindDN, conf.bindPassword);
-		return await fn(client);
-	} finally {
-		await client.unbind().catch(() => {});
-	}
-}
-
-const FILTER = '(&(objectClass=organizationalRole)(objectClass=simpleSecurityObject))';
-const CN_RE = /^[A-Za-z][A-Za-z0-9._-]{1,63}$/;
-
-var ServiceAccount = {};
-
-ServiceAccount.list = async function(){
-	return withClient(async (client) => {
-		const res = await client.search(conf.userBase, {
-			scope: 'sub',
-			filter: FILTER,
-			attributes: ['cn', 'description', 'createTimestamp', 'modifyTimestamp'],
-		});
-		return res.searchEntries.map((entry) => ({
-			cn: entry.cn,
-			dn: `cn=${entry.cn},${conf.userBase}`,
-			description: entry.description || '',
-			created_on: entry.createTimestamp || null,
-			modified_on: entry.modifyTimestamp || null,
-		})).sort((a, b) => a.cn.localeCompare(b.cn));
-	});
-};
-
-ServiceAccount.create = async function({cn, description}){
-	if(!cn || !CN_RE.test(cn)){
-		throw Object.assign(new Error('InvalidName'), {status: 400, message: 'Name must start with a letter and contain only letters, numbers, dot, dash, underscore.'});
-	}
-
-	const dn = `cn=${cn},${conf.userBase}`;
-	const password = crypto.randomBytes(24).toString('base64url');
-
-	await withClient(async (client) => {
-		let existing = true;
-		try{
-			const res = await client.search(dn, {scope: 'base', filter: '(objectClass=*)', attributes: ['dn']});
-			existing = res.searchEntries.length > 0;
-		}catch(error){ existing = false; }
-		if(existing){
-			throw Object.assign(new Error('NameInUse'), {status: 409, message: `"${cn}" already exists under ${conf.userBase}.`});
-		}
-
-		await client.add(dn, {
-			objectClass: ['organizationalRole', 'simpleSecurityObject', 'top'],
-			cn,
-			description: description || '',
-			userPassword: hashPasswordSSHA512(password),
-		});
-	});
-
-	return {cn, dn, description: description || '', password};
-};
-
-ServiceAccount.setPassword = async function(cn, password){
-	const dn = `cn=${cn},${conf.userBase}`;
-	const newPassword = password || crypto.randomBytes(24).toString('base64url');
-
-	await withClient(async (client) => {
-		await client.modify(dn, [
-			new Change({
-				operation: 'replace',
-				modification: new Attribute({type: 'userPassword', values: [hashPasswordSSHA512(newPassword)]}),
-			}),
-		]);
-	});
-
-	return {cn, dn, password: newPassword};
-};
-
-ServiceAccount.remove = async function(cn){
-	const dn = `cn=${cn},${conf.userBase}`;
-	await withClient(async (client) => {
-		await client.del(dn);
-	});
-	return true;
-};
-
-module.exports = {ServiceAccount};
@@ -103,7 +103,6 @@ async function addPosixAccount(client, data){
 		givenName: data.givenName,
 		loginShell: data.loginShell,
 		homeDirectory: data.homeDirectory,
-		userPassword: data.userPassword,
 		description: data.description || ' ',
 		sudoHost: 'ALL',
 		sudoCommand: 'ALL',
@@ -131,6 +130,19 @@ async function addPosixAccount(client, data){
 		entry.dateOfBirth = data.dob;
 	}

+	// userPassword is optional -- a service account with no password set
+	// simply can't bind (no special enforcement needed, that's the default
+	// LDAP simple-bind behavior for an entry lacking the attribute).
+	if (data.userPassword) {
+		entry.userPassword = data.userPassword;
+	}
+
+	// manager (COSINE, SUP distinguishedName) is naturally multi-valued --
+	// every account gets at least the DN of whoever created it.
+	if (data.manager && [].concat(data.manager).length) {
+		entry.manager = [].concat(data.manager);
+	}
+
 	await client.add(`cn=${data.cn},${conf.userBase}`, entry);

 	return data
@@ -151,9 +163,13 @@ async function addLdapUser(client, data){
 			data.uid = `${data.givenName[0]}${data.sn}`.toLowerCase();
 		}
 		data.cn = data.uid;
-		data.loginShell = '/bin/bash';
-		data.homeDirectory= `/home/${data.uid}`;
-		data.userPassword = hashPasswordSSHA512(data.userPassword);
+		data.loginShell = data.loginShell || '/bin/bash';
+		data.homeDirectory = data.homeDirectory || `/home/${data.uid}`;
+		if (data.userPassword) {
+			data.userPassword = hashPasswordSSHA512(data.userPassword);
+		} else {
+			delete data.userPassword;
+		}

 		console.log('addLdapUser', data)
 		group = await addPosixGroup(client, data);
@@ -194,6 +210,14 @@ const user_parse = function(data){
 	data.isActive   = data.pwdAccountLockedTime ? '' : 'active';
 	data.isInactive = data.pwdAccountLockedTime ? 'inactive' : '';

+	// manager (COSINE, SUP distinguishedName) and memberOf (from the memberof
+	// overlay) are both multi-valued; ldapts returns a bare string for a
+	// single value and an array for multiple -- normalize both to always be
+	// an array, or app-base.js's `for(let group of user.memberOf)` silently
+	// iterates a single DN string character-by-character instead of once.
+	data.manager   = [].concat(data.manager || []).filter(Boolean);
+	data.memberOf  = [].concat(data.memberOf || []).filter(Boolean);
+
 	return data;
 }

@@ -242,6 +266,8 @@ User.listDetail = async function(){
 			serviceAccountDNs = new Set((svcGroup.member || []).map(dn => dn.toLowerCase()));
 		}catch(error){ /* group not seeded yet on an old deployment -- treat as none */ }

+		const dnToUid = new Map(searchEntries.map(e => [String(e.dn).toLowerCase(), e.uid]));
+
 		const users = await Promise.all(searchEntries.map(async (entry) => {
 			const rawPassword = entry.userPassword ? entry.userPassword.toString() : '';
 			const isLegacyMD5 = rawPassword.toUpperCase().startsWith('{MD5}');
@@ -269,6 +295,7 @@ User.listDetail = async function(){
 			].filter(Boolean);
 			obj.onboardingRequired = obj.onboardingNeeds.length > 0 ? 'yes' : '';
 			obj.isServiceAccount   = serviceAccountDNs.has(String(obj.dn).toLowerCase()) ? 'yes' : '';
+			obj.managerUids        = obj.manager.map(dn => dnToUid.get(String(dn).toLowerCase()) || dn);

 			return obj;
 		}));
@@ -324,6 +351,13 @@ User.get = async function(data, key) {

        const verif = await UserVerification.getOrCreate(obj.uid);

+        // Same membership check as User.listDetail() -- see the comment there.
+        try{
+            const svcGroup = await Group.get('app_sso_service_account');
+            const serviceAccountDNs = new Set((svcGroup.member || []).map(dn => dn.toLowerCase()));
+            obj.isServiceAccount = serviceAccountDNs.has(String(obj.dn).toLowerCase()) ? 'yes' : '';
+        }catch(error){ obj.isServiceAccount = ''; }
+
        // Auto-flag legacy MD5 password users — persist so subsequent cache hits see it
        if (isLegacyMD5 && !verif.password_must_change) {
            await verif.update({ password_must_change: true });
@@ -421,7 +455,7 @@ User.update = async function(data){
 			}
 		}

-		let editableFeilds = ['mobile', 'description'];
+		let editableFeilds = ['mobile', 'description', 'homeDirectory', 'loginShell'];

 		await withClient(async (client) => {
 			for(let field of editableFeilds){
@@ -469,6 +503,21 @@ User.update = async function(data){
 				]);
 				this.dateOfBirth = data.dateOfBirth;
 			}
+
+			if(data.manager !== undefined){
+				// Client sends uids; resolve each to a DN before writing --
+				// manager (COSINE, SUP distinguishedName) stores DNs, not uids.
+				const uids = [].concat(data.manager || []).filter(Boolean);
+				const managers = await Promise.all(uids.map(uid => User.get(uid)));
+				const dns = managers.map(u => u.dn);
+				await client.modify(this.dn, [
+					new Change({
+						operation: 'replace',
+						modification: new Attribute({ type: 'manager', values: dns }),
+					}),
+				]);
+				this.manager = dns;
+			}
 		});
 		cache.clear();

@@ -537,6 +586,12 @@ User.addByInvite = async function(data){

 		data.mail = token.mail;

+		// Default manager: whoever sent the invite.
+		try {
+			const inviter = await this.get(token.created_by);
+			data.manager = [inviter.dn];
+		} catch(e) { /* inviter no longer exists -- leave manager unset */ }
+
 		const suggestions = await this.usernameSuggestions(data.givenName, data.sn, data.dob);
 		if (!data.uid || !suggestions.includes(data.uid)) {
 			const err = new Error('Invalid username selection');
@@ -739,6 +794,53 @@ User.addSSHkey = async function(data) {
 	return result;
 };

+// Every user gets a personal Unix group of the same name at creation (see
+// addPosixGroup) -- just a GID holder, cn always equal to the user's uid.
+// memberUid (RFC 2307, posixGroup) is a bare username, not a DN, unlike
+// groupOfNames' `member` used by app_sso_* groups in group_ldap.js.
+function personalGroupDN(uid){
+	return `cn=${uid},${conf.groupBase}`;
+}
+
+User.getPersonalGroupMembers = async function(uid) {
+	try {
+		return await withClient(async (client) => {
+			const res = await client.search(personalGroupDN(uid), {
+				scope: 'base',
+				filter: '(objectClass=posixGroup)',
+				attributes: ['memberUid'],
+			});
+			const entry = res.searchEntries[0];
+			return [].concat((entry && entry.memberUid) || []).filter(Boolean);
+		});
+	} catch(error) {
+		throw error;
+	}
+};
+
+User.addPersonalGroupMember = async function(uid, memberUid) {
+	await this.get(memberUid); // throws UserNotFound if the target uid doesn't exist
+	await withClient(async (client) => {
+		await client.modify(personalGroupDN(uid), [
+			new Change({
+				operation: 'add',
+				modification: new Attribute({ type: 'memberUid', values: [memberUid] }),
+			}),
+		]);
+	});
+};
+
+User.removePersonalGroupMember = async function(uid, memberUid) {
+	await withClient(async (client) => {
+		await client.modify(personalGroupDN(uid), [
+			new Change({
+				operation: 'delete',
+				modification: new Attribute({ type: 'memberUid', values: [memberUid] }),
+			}),
+		]);
+	});
+};
+
 User.invite = async function(data = {}){
 	try{
 		let token = await InviteToken.create({
@@ -1,12 +1,12 @@
 {
  "name": "t42-sso-manager",
-  "version": "1.1.5",
+  "version": "1.1.10",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "t42-sso-manager",
-      "version": "1.1.5",
+      "version": "1.1.10",
      "license": "MIT",
      "dependencies": {
        "@fortawesome/fontawesome-free": "^7.3.0",
@@ -1,6 +1,6 @@
 {
  "name": "t42-sso-manager",
-  "version": "1.1.5",
+  "version": "1.1.10",
  "private": true,
  "author": [
    {
@@ -102,7 +102,15 @@ app.user = (function(app){
 		});
 	}

-	return {list, remove, createInvite, setActive};
+	// A user DN's cn is always their uid (see models/user_ldap.js addLdapUser,
+	// `data.cn = data.uid`) -- pulling it straight out of the DN avoids an
+	// extra lookup just to display a manager list.
+	function dnToUid(dn){
+		var m = /^cn=([^,]+)/i.exec(dn || '');
+		return m ? m[1] : dn;
+	}
+
+	return {list, remove, createInvite, setActive, dnToUid};

 })(app);

@@ -149,6 +157,21 @@ app.ui = (function(app){
 	// Drop the cache (e.g. after a group is created) so the next selector refetches.
 	function refreshGroups(){ _groupsPromise = null; return loadGroups(); }

+	// All usernames, fetched once and shared across every user selector (e.g. manager pickers).
+	var _usersPromise = null;
+	function loadUsers(){
+		if(!_usersPromise){
+			_usersPromise = new Promise(function(resolve){
+				app.user.list(function(error, data){
+					if(error || !data || !data.results){ resolve([]); return; }
+					resolve(data.results.map(function(u){ return u.uid; }).filter(Boolean).sort());
+				});
+			});
+		}
+		return _usersPromise;
+	}
+	function refreshUsers(){ _usersPromise = null; return loadUsers(); }
+
 	// opts: { values, options, freeSolo, placeholder, name, separator }
 	// Returns a handle: { get, set, add, clear, setOptions, element }.
 	function tagInput(mount, opts){
@@ -249,7 +272,25 @@ app.ui = (function(app){
 		return handle;
 	}

-	return { tagInput: tagInput, groupSelect: groupSelect, loadGroups: loadGroups, refreshGroups: refreshGroups };
+	// Universal user selector (e.g. picking managers). Preloads all usernames.
+	function userSelect(mount, opts){
+		opts = opts || {};
+		var handle = tagInput(mount, {
+			name: opts.name || 'manager',
+			values: opts.values || [],
+			options: [],
+			freeSolo: opts.freeSolo !== false,
+			separator: opts.separator != null ? opts.separator : '\n',
+			placeholder: opts.placeholder || 'Type a username…',
+		});
+		loadUsers().then(function(users){ handle.setOptions(users); });
+		return handle;
+	}
+
+	return {
+		tagInput: tagInput, groupSelect: groupSelect, loadGroups: loadGroups, refreshGroups: refreshGroups,
+		userSelect: userSelect, loadUsers: loadUsers, refreshUsers: refreshUsers,
+	};
 })(app);

 app.oauthClient = (function(app){
@@ -52,6 +52,30 @@ router.get('/', function(req, res) {
 	res.render('docs_index', {...values, docs: docList});
 });

+// Plain, dependency-free line-substring search over the same allowlisted
+// doc set -- no separate index to build/maintain, no new dependency, and it
+// keeps working with no internet access (same reasoning as the rest of this
+// route). Must be registered before the /:slug catch-all below, or "search"
+// would be treated as a (nonexistent) doc slug and 404.
+router.get('/search', function(req, res) {
+	const q = (req.query.q || '').trim();
+	if (!q) return res.json({results: []});
+	const qLower = q.toLowerCase();
+
+	const results = [];
+	for (const [slug, doc] of Object.entries(DOCS)) {
+		try {
+			const content = fs.readFileSync(doc.file, 'utf8');
+			const matchLine = content.split('\n').find(line => line.toLowerCase().includes(qLower));
+			if (matchLine) {
+				results.push({slug, title: doc.title, snippet: matchLine.trim().slice(0, 200)});
+			}
+		} catch (error) { /* unreadable doc file -- skip it */ }
+	}
+
+	res.json({results});
+});
+
 router.get('/:slug', function(req, res, next) {
 	const doc = DOCS[req.params.slug];
 	if (!doc) return next({status: 404, message: 'Doc not found'});
@@ -1,54 +0,0 @@
-'use strict';
-
-const router = require('express').Router();
-const {ServiceAccount} = require('../models/service_account');
-const permission = require('../utils/permission');
-
-const ADMIN_GROUP = 'app_sso_admin';
-
-router.get('/', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-		return res.json({results: await ServiceAccount.list()});
-	} catch(error) {
-		next(error);
-	}
-});
-
-router.post('/', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-		const result = await ServiceAccount.create({cn: req.body.cn, description: req.body.description});
-		return res.json({
-			results: result,
-			message: `Service account "${result.cn}" created. Save the password now — it will not be shown again.`,
-		});
-	} catch(error) {
-		next(error);
-	}
-});
-
-router.put('/:cn/password', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-		const result = await ServiceAccount.setPassword(req.params.cn, req.body.password);
-		return res.json({
-			results: result,
-			message: `Password rotated for "${req.params.cn}". Save it now — it will not be shown again.`,
-		});
-	} catch(error) {
-		next(error);
-	}
-});
-
-router.delete('/:cn', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-		await ServiceAccount.remove(req.params.cn);
-		return res.json({message: `Service account "${req.params.cn}" deleted.`});
-	} catch(error) {
-		next(error);
-	}
-});
-
-module.exports = router;
@@ -23,8 +23,9 @@ router.post('/', async function(req, res, next){
 		await permission.byGroup(req.user, ['app_sso_admin'])

 		req.body.created_by = req.user.uid
+		req.body.manager = [req.user.dn];

-		const user = await User.add(req.body);
+		let user = await User.add(req.body);
 		const verif = await UserVerification.getOrCreate(user.uid);
 		const updates = { password_must_change: true };
 		if (req.body.tosAgree) updates.tos_accepted = true, updates.tos_accepted_at = Date.now();
@@ -37,6 +38,12 @@ router.post('/', async function(req, res, next){
 			try {
 				const group = await Group.get('app_sso_service_account');
 				await group.addMember(user);
+				// User.add() already cached `user` (via its own internal
+				// User.get()) before this group membership existed, so the
+				// cached isServiceAccount would be stuck wrong for 5 minutes
+				// (the cache TTL) without this -- re-fetch after clearing.
+				User.clearCache();
+				user = await User.get(user.uid);
 			} catch (error) {
 				console.error(`user.add: failed to mark ${user.uid} as a service account:`, error.message);
 			}
@@ -137,6 +144,41 @@ router.put('/:uid/active', async function(req, res, next){
 	}
 });

+router.get('/:uid/group-members', async function(req, res, next){
+	try{
+		await permission.byGroup(req.user, ['app_sso_admin']);
+		return res.json({results: await User.getPersonalGroupMembers(req.params.uid)});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.put('/:uid/group-member/:memberUid', async function(req, res, next){
+	try{
+		await permission.byGroup(req.user, ['app_sso_admin']);
+		await User.addPersonalGroupMember(req.params.uid, req.params.memberUid);
+		return res.json({
+			results: true,
+			message: `Added ${req.params.memberUid} to ${req.params.uid}'s group`
+		});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.delete('/:uid/group-member/:memberUid', async function(req, res, next){
+	try{
+		await permission.byGroup(req.user, ['app_sso_admin']);
+		await User.removePersonalGroupMember(req.params.uid, req.params.memberUid);
+		return res.json({
+			results: true,
+			message: `Removed ${req.params.memberUid} from ${req.params.uid}'s group`
+		});
+	}catch(error){
+		next(error);
+	}
+});
+
 router.put('/:uid', async function(req, res, next){
 	try{
 		let user;
@@ -145,7 +187,15 @@ router.put('/:uid', async function(req, res, next){
 			user = req.user;
 		}else{
 			user = await User.get(req.params.uid);
-			await permission.byGroup(req.user, ['app_sso_admin'])
+			const isManager = (user.manager || []).includes(req.user.dn);
+			if(!isManager) await permission.byGroup(req.user, ['app_sso_admin'])
+		}
+
+		// The manager picker is a tag widget backed by a single newline-separated
+		// hidden input (see public/js/app.js app.ui.userSelect), same convention
+		// as oauth_client.js's allowed_groups.
+		if (typeof req.body.manager === 'string') {
+			req.body.manager = req.body.manager.split('\n').map(s => s.trim()).filter(Boolean);
 		}

 		return res.json({
@@ -10,7 +10,12 @@
 					A local copy of this project's documentation, readable from the
 					running app -- no internet access required.
 				</p>
-				<ul class="list-group">
+				<div class="input-group mb-3">
+					<span class="input-group-text"><i class="fa-solid fa-magnifying-glass"></i></span>
+					<input type="search" id="docs-search-input" class="form-control" placeholder="Search the docs…" oninput="docsSearch(this.value)">
+				</div>
+				<div id="docs-search-results" style="display:none"></div>
+				<ul id="docs-list" class="list-group">
 					<% docs.forEach(function(doc){ %>
 						<li class="list-group-item">
 							<a href="/docs/<%= doc.slug %>"><%= doc.title %></a>
@@ -21,4 +26,40 @@
 		</div>
 	</div>
 </div>
+<script type="text/javascript">
+	var docsSearchTimer;
+	function docsSearch(q){
+		clearTimeout(docsSearchTimer);
+		docsSearchTimer = setTimeout(function(){ docsSearchRun(q); }, 200);
+	}
+	function docsSearchRun(q){
+		q = (q || '').trim();
+		var $results = $('#docs-search-results');
+		var $list = $('#docs-list');
+		if(!q){
+			$results.hide().empty();
+			$list.show();
+			return;
+		}
+		// Not app.api.get() -- routes/docs.js is mounted at /docs directly,
+		// not under /api, unlike the rest of this app's endpoints.
+		$.getJSON('/docs/search', {q: q}, function(data){
+			$list.hide();
+			$results.empty().show();
+			var hits = (data && data.results) || [];
+			if(!hits.length){
+				$results.append($('<p class="text-muted"></p>').text('No results for "' + q + '".'));
+				return;
+			}
+			var $ul = $('<ul class="list-group"></ul>');
+			hits.forEach(function(hit){
+				var $li = $('<li class="list-group-item"></li>');
+				$('<a></a>').attr('href', '/docs/' + hit.slug).text(hit.title).appendTo($li);
+				$('<div class="text-muted small"></div>').text(hit.snippet).appendTo($li);
+				$ul.append($li);
+			});
+			$results.append($ul);
+		});
+	}
+</script>
 <%- include('bottom') %>
@@ -208,40 +208,8 @@
 		});
 	}

-	// ── Service accounts ──────────────────────────────────────────────────
-	async function svcTableAJAX(){
-		let data = await app.api.get('service-account');
-		$.scope.serviceAccountCard.empty();
-		$.each(data.results, function(_, acct){
-			$.scope.serviceAccountCard.push(acct);
-		});
-	}
-
-	async function rotateServiceAccountPassword(cn, btn){
-		const $card = $(btn).closest('.card');
-		const confirmed = await app.util.actionConfirm('Rotate the password for "' + cn + '"? Anything still using the old password will stop working immediately.', $card, 'warning');
-		if (!confirmed) return;
-		app.api.put('service-account/' + encodeURIComponent(cn) + '/password', {}, function(error, data){
-			if(error){ app.util.actionMessage('Error: ' + (data && data.message), $card, 'danger'); return; }
-			showSecret(data.results.password, 'Password for ' + cn);
-		});
-	}
-
-	async function deleteServiceAccount(cn, btn){
-		const $card = $(btn).closest('.card');
-		$card.addClass('table-warning');
-		const confirmed = await app.util.actionConfirm('Delete service account "' + cn + '"? Anything binding as it will stop working immediately.', $card, 'warning');
-		$card.removeClass('table-warning');
-		if (!confirmed) return;
-		app.api.delete('service-account/' + encodeURIComponent(cn), function(error, data){
-			if(error){ app.util.actionMessage('Error: ' + (data && data.message), $card, 'danger'); return; }
-			$.scope.serviceAccountCard.remove('cn', cn);
-		});
-	}
-
 	$(document).ready(function(){
 		tableAJAX();
-		svcTableAJAX();

 		// Initialise the create-form tag widgets.
 		createScopes = app.ui.tagInput('#create-scopes', {
@@ -256,9 +224,6 @@
 		$('form[action="oauth/client/"]').attr('evalAJAX',
 			'showSecret(data.client_secret, "Client Secret"); tableAJAX(); $form.trigger("reset"); createScopes.set(DEFAULT_SCOPES); createGroups.clear();'
 		);
-		$('form[action="service-account/"]').attr('evalAJAX',
-			'showSecret(data.password, "Password for " + data.cn); svcTableAJAX(); $form.trigger("reset");'
-		);
 	});
 </script>

@@ -509,8 +474,9 @@
 								<button class="btn btn-outline-secondary" type="button" onclick="copyField('f-bindDn', this)" title="Copy"><i class="fa-solid fa-copy"></i></button>
 							</div>
 							<small class="field-help text-muted d-block">
-								A read-only bind account — create one below under
-								<b>Service Accounts</b> (don't reuse a real person's login or the admin DN).
+								A read-only bind account — create one from
+								<a href="/users">Users &gt; Service Accounts</a> (don't reuse a real
+								person's login or the admin DN).
 							</small>
 						</dd>
 					</dl>
@@ -527,9 +493,10 @@
 					<p class="text-muted small">
 						For full host login, SSH keys, and sudo via LDAP (not just one app) —
 						clone <a href="https://github.com/theta42/ldap-client" target="_blank">theta42/ldap-client</a>
-						and run this on the host. Fill in a service account's password (create
-						one below) and, if you want this host's access/sudo groups
-						auto-registered, an <a href="/">API token</a> from your Profile.
+						and run this on the host. Fill in a service account's password
+						(create one from <a href="/users">Users &gt; Service Accounts</a>) and,
+						if you want this host's access/sudo groups auto-registered, an
+						<a href="/">API token</a> from your Profile.
 					</p>
 					<div class="input-group">
 						<textarea id="f-bashSnippet" class="form-control font-monospace" rows="16" readonly style="font-size:.8rem"></textarea>
@@ -541,65 +508,6 @@
 			</div>
 		</div>

-		<div class="col-12">
-			<div class="card shadow-sm border-info">
-				<div class="card-header bg-info bg-opacity-10">
-					<i class="fa-solid fa-user-gear"></i> Service Accounts
-				</div>
-				<div class="card-body">
-					<p class="text-muted small mb-3">
-						Bind-only LDAP identities for apps and hosts — not real people, can't log
-						into this UI, no home directory. theta-env's <code>cn=ldapclient</code>
-						bootstrap account (used by theta42/proxy) shows up here too, since it's
-						the same kind of account.
-						<br>
-						Need an account something actually <i>runs as</i> on a Linux host instead
-						(a media manager, a torrent client, ...) — with a real <code>uidNumber</code>
-						and a group other accounts join for write access? That's a Unix account, not
-						a bind-only one — create it from <a href="/users">Users</a> with
-						<b>This is a service account</b> checked.
-					</p>
-					<div class="row g-3">
-						<div class="col-md-4">
-							<form action="service-account/" method="post" onsubmit="formAJAX(this)">
-								<div class="mb-2">
-									<label class="form-label">Name</label>
-									<input type="text" class="form-control shadow" name="cn" placeholder="ldapclient" validate=":1">
-								</div>
-								<div class="mb-2">
-									<label class="form-label">Description <small class="text-muted">(optional)</small></label>
-									<input type="text" class="form-control shadow" name="description" placeholder="Bind account for gitea.example.com">
-								</div>
-								<button type="submit" class="btn btn-outline-dark btn-sm">
-									<i class="fa-solid fa-plus"></i> Create
-								</button>
-							</form>
-						</div>
-						<div class="col-md-8">
-							<div class="table-responsive">
-								<table class="table table-sm mb-0">
-									<thead><tr><th>Name</th><th>Description</th><th></th></tr></thead>
-									<tbody jq-repeat="serviceAccountCard">
-										<tr>
-											<td><code>cn={{cn}},<%= userBase %></code></td>
-											<td>{{description}}</td>
-											<td class="text-end">
-												<button type="button" class="btn btn-sm btn-outline-warning" title="Rotate password" onclick="rotateServiceAccountPassword('{{cn}}', this)">
-													<i class="fa-solid fa-key"></i>
-												</button>
-												<button type="button" class="btn btn-sm btn-outline-danger" title="Delete" onclick="deleteServiceAccount('{{cn}}', this)">
-													<i class="fa-solid fa-trash"></i>
-												</button>
-											</td>
-										</tr>
-									</tbody>
-								</table>
-							</div>
-						</div>
-					</div>
-				</div>
-			</div>
-		</div>
 	</div>
 </div>
 </div>
@@ -613,8 +521,8 @@
 			'export ldap_host="<%= ldapHost %>"',
 			'export ldap_base_dn="<%= baseDn %>"',
 			'',
-			'# A read-only service account -- create one under Service Accounts',
-			'# above, then fill in its password below.',
+			'# A read-only service account -- create one under Users > Service',
+			'# Accounts, then fill in its password below.',
 			'export ldap_bind_dn="<%= exampleBindDn %>"',
 			'export ldap_bind_password="CHANGE-ME"',
 			'',
@@ -9,6 +9,7 @@
 		// data.photo = unescape(encodeURIComponent(data.jpegPhoto));
 		user.createTimestamp = moment(user.createTimestamp, "YYYYMMDDHHmmssZ").fromNow();
 		user.modifyTimestamp = moment(user.modifyTimestamp, "YYYYMMDDHHmmssZ").fromNow();
+		user.managerUids = (user.manager || []).map(app.user.dnToUid);

 		$.scope.user.update(user);
 		$.scope.passwordReset.update(user);
@@ -17,12 +18,77 @@
 	async function renderUserGroups(user){
 		try{
 			let res = await app.api.get('group/?detail=true&member='+user.uid);
+			$.scope.mygroups.empty();
 			$.scope.mygroups.push(...res.results);
 		}catch(error){
 			console.error('renderUserGroups error:', error)
 		}
 	}

+	async function removeFromGroup(cn, btn){
+		const $row = $(btn).closest('tr');
+		const confirmed = await app.util.actionConfirm(`Remove ${currentUser.uid} from "${cn}"?`, $row, 'warning');
+		if (!confirmed) return;
+		app.api.delete('group/' + encodeURIComponent(cn) + '/' + encodeURIComponent(currentUser.uid), function(error, data){
+			if(error){ app.util.actionMessage((data && data.message) || 'Failed to remove from group', $row, 'danger'); return; }
+			$.scope.mygroups.remove('cn', cn);
+		});
+	}
+
+	var addGroupSelect;
+	async function addToGroups(btn){
+		const cns = addGroupSelect.get();
+		if(!cns.length) return;
+		const $card = $(btn).closest('.card-body');
+		for(const cn of cns){
+			await new Promise(function(resolve){
+				app.api.put('group/' + encodeURIComponent(cn) + '/' + encodeURIComponent(currentUser.uid), {}, function(error, data){
+					if(error) app.util.actionMessage((data && data.message) || `Failed to add to "${cn}"`, $card, 'danger');
+					resolve();
+				});
+			});
+		}
+		addGroupSelect.clear();
+		renderUserGroups(currentUser);
+	}
+
+	async function renderPersonalGroupMembers(user){
+		try{
+			let res = await app.api.get('user/' + user.uid + '/group-members');
+			$.scope.personalGroupMembers.empty();
+			$.scope.personalGroupMembers.push(...(res.results || []).map(uid => ({uid})));
+		}catch(error){
+			console.error('renderPersonalGroupMembers error:', error)
+		}
+	}
+
+	async function removePersonalGroupMember(memberUid, btn){
+		const $row = $(btn).closest('tr');
+		const confirmed = await app.util.actionConfirm(`Remove ${memberUid} from ${currentUser.uid}'s group?`, $row, 'warning');
+		if (!confirmed) return;
+		app.api.delete('user/' + encodeURIComponent(currentUser.uid) + '/group-member/' + encodeURIComponent(memberUid), function(error, data){
+			if(error){ app.util.actionMessage((data && data.message) || 'Failed to remove from group', $row, 'danger'); return; }
+			$.scope.personalGroupMembers.remove('uid', memberUid);
+		});
+	}
+
+	var addPersonalGroupMemberSelect;
+	async function addPersonalGroupMembers(btn){
+		const uids = addPersonalGroupMemberSelect.get();
+		if(!uids.length) return;
+		const $card = $(btn).closest('.card-body');
+		for(const uid of uids){
+			await new Promise(function(resolve){
+				app.api.put('user/' + encodeURIComponent(currentUser.uid) + '/group-member/' + encodeURIComponent(uid), {}, function(error, data){
+					if(error) app.util.actionMessage((data && data.message) || `Failed to add "${uid}"`, $card, 'danger');
+					resolve();
+				});
+			});
+		}
+		addPersonalGroupMemberSelect.clear();
+		renderPersonalGroupMembers(currentUser);
+	}
+
 	async function determinUser(){
 		if(location.pathname.includes('/users/')){
 			let uid = location.pathname.replace('/users/', '');
@@ -42,8 +108,15 @@
 		$.scope.editProfile.update(user);
 		// jq-repeat's update() is trailing-edge throttled (~50ms) as of 2.1.0 --
 		// wait for the throttle tick to land before sliding the updated card
-		// into view, or it can briefly show stale/empty data.
+		// into view, or it can briefly show stale/empty data. The manager
+		// picker is a JS widget, not a mustache-bound input, so it also has to
+		// wait for update() to (re-)render its empty mount div before attaching.
 		setTimeout(function(){
+			app.ui.userSelect('#edit-manager', {
+				name: 'manager',
+				values: user.managerUids || [],
+				placeholder: 'Type a username…',
+			});
 			$profileCard.slideUp();
 			$editCard.slideDown();
 		}, 60);
@@ -86,6 +159,15 @@

 		renderProfile(currentUser);
 		renderUserGroups(currentUser);
+		renderPersonalGroupMembers(currentUser);
+		$('#personal-group-uid-label').text(currentUser.uid);
+
+		addGroupSelect = app.ui.groupSelect('#add-group-select', {
+			name: 'groups', values: [], placeholder: 'Type a group name…',
+		});
+		addPersonalGroupMemberSelect = app.ui.userSelect('#add-personal-group-member-select', {
+			name: 'members', values: [], placeholder: 'Type a username…',
+		});

 		// API Tokens are self-service only — never shown when an admin is
 		// viewing someone else's profile via /users/:uid.
@@ -151,7 +233,7 @@
 			<div class="profile-body" jq-repeat="user">
 				<div class="card-body profile-body-{{uid}}">
 					<h2><i>User Name:</i> <b>{{uid}}</b></h2>
-					<i>Name:</i> <b>{{givenName}} {{sn}}</b><br />
+					{{^isServiceAccount}}<i>Name:</i> <b>{{givenName}} {{sn}}</b><br />{{/isServiceAccount}}
 					<i>Email:</i> <b>{{mail}}</b>
 					{{#emailVerified}}<span class="badge bg-success ms-1"><i class="fa-solid fa-circle-check"></i> Verified</span>{{/emailVerified}}
 					<br />
@@ -161,6 +243,9 @@
 					<i>LDAP DN:</i> <b>{{dn}} </b><br />
 					<i>Home Directory:</i> <b>{{homeDirectory}} </b><br />
 					<i>Login Shell:</i> <b>{{loginShell}} </b><br />
+					<i>Manager(s):</i>
+					{{#managerUids}}<span class="badge bg-secondary me-1">{{.}}</span>{{/managerUids}}
+					<br />
 					<i>Status:</i>
 					{{#isActive}}<span class="badge bg-success">Active</span>{{/isActive}}
 					{{#isInactive}}<span class="badge bg-danger">Inactive</span>{{/isInactive}}
@@ -236,7 +321,19 @@

 						<div class="mb-3">
 							<label class="form-label">Mobile Phone</label>
-							<input type="text" class="form-control" name="mobile" placeholder="9175551234" validate=":9" value="{{mobile}}" />
+							<input type="text" class="form-control" name="mobile" placeholder="9175551234" value="{{mobile}}" />
+						</div>
+						<div class="mb-3">
+							<label class="form-label">Home Directory</label>
+							<input type="text" class="form-control" name="homeDirectory" placeholder="/home/jsmith" value="{{homeDirectory}}" />
+						</div>
+						<div class="mb-3">
+							<label class="form-label">Login Shell</label>
+							<input type="text" class="form-control" name="loginShell" placeholder="/bin/bash" value="{{loginShell}}" />
+						</div>
+						<div class="mb-3">
+							<label class="form-label">Manager(s)</label>
+							<div id="edit-manager"></div>
 						</div>
 						<div class="mb-3">
 							<label class="form-label">User Description (Optional)</label>
@@ -259,7 +356,7 @@
 			</div>
 			<div class="card-header shadow actionMessage" style="display:none">
 			</div>
-			<div class="card-body" style="padding-bottom:0">
+			<div class="card-body">
 				<div class="table-responsive">
 					<table class="table">
 						<thead>
@@ -269,19 +366,77 @@
 							<th>
 								Description
 							</th>
+							<th class="group-required group-required-app_sso_admin"></th>
 						</thead>
 						<tbody jq-repeat="mygroups">
 							<tr>
 								<td>{{cn}}</td>
 								<td>{{description}}</td>
+								<td class="text-end group-required group-required-app_sso_admin">
+									<button type="button" class="btn btn-sm btn-outline-danger" title="Remove from group" onclick="removeFromGroup('{{cn}}', this)">
+										<i class="fa-solid fa-xmark"></i>
+									</button>
+								</td>
 							</tr>
 						</tbody>
 					</table>
 				</div>
+				<div class="group-required group-required-app_sso_admin">
+					<label class="form-label small">Add to group</label>
+					<div class="d-flex gap-2 align-items-start">
+						<div id="add-group-select" class="flex-grow-1"></div>
+						<button type="button" class="btn btn-outline-dark" onclick="addToGroups(this)">Add</button>
+					</div>
+				</div>
+			</div>
+		</div>
+
+		<div class="shadow-lg card card-default mb-8 group-required group-required-app_sso_admin">
+			<div class="card-header shadow">
+				<i class="fa-solid fa-people-group"></i>
+				Members of <span id="personal-group-uid-label"></span>'s group
+				<div class="float-end">
+					<i class="fa-solid fa-arrows-up-down"></i>
+				</div>
+			</div>
+			<div class="card-header shadow actionMessage" style="display:none">
+			</div>
+			<div class="card-body">
+				<p class="text-muted small">
+					Every account gets a personal Unix group (its primary GID) — add
+					other accounts here as supplementary members (e.g. to share write
+					access to files owned by this group).
+				</p>
+				<div class="table-responsive">
+					<table class="table">
+						<thead>
+							<th>
+								Username
+							</th>
+							<th class="text-end"></th>
+						</thead>
+						<tbody jq-repeat="personalGroupMembers">
+							<tr>
+								<td>{{uid}}</td>
+								<td class="text-end">
+									<button type="button" class="btn btn-sm btn-outline-danger" title="Remove from group" onclick="removePersonalGroupMember('{{uid}}', this)">
+										<i class="fa-solid fa-xmark"></i>
+									</button>
+								</td>
+							</tr>
+						</tbody>
+					</table>
+				</div>
+				<label class="form-label small">Add member</label>
+				<div class="d-flex gap-2 align-items-start">
+					<div id="add-personal-group-member-select" class="flex-grow-1"></div>
+					<button type="button" class="btn btn-outline-dark" onclick="addPersonalGroupMembers(this)">Add</button>
+				</div>
 			</div>
 		</div>
 	</div>
 </div>
+</div>

 <!-- Token modal (shown once on create/rotate) -->
 <div class="modal fade" id="secretModal" tabindex="-1">
@@ -64,6 +64,9 @@
  	      </li>
  	    </ul>
  	    <div class="form-inline mt-2 mt-md-0">
+  	      <a id="cl-help" class="nav-link text-light me-3" href="/docs" title="Help">
+  	        <i class="fa-solid fa-circle-question"></i>
+  	      </a>
  	      <a id="cl-username" class="navbar-text text-light me-3" href="/" style="display: none;">
  	        <i class="fa-solid fa-user me-1"></i><span id="cl-username-text"></span>
  	      </a>
@@ -98,6 +101,19 @@
  	    sessionStorage.setItem('update-banner-dismissed', '1');
  	  }

+  	  // Deep-link the header help icon to whichever doc is most relevant to
+  	  // the current page. No server-side "current section" local exists (every
+  	  // res.render() call shares one values object, see routes/index.js), so
+  	  // this follows the same client-side path-matching convention already
+  	  // used for the top-nav active-link highlighting just below. Unmapped
+  	  // pages fall back to the docs index (already /docs, the anchor's default).
+  	  var HELP_DOCS_BY_PATH = {
+  	    '/users': 'ldap',
+  	    '/groups': 'ldap',
+  	    '/integrations': 'ldap',
+  	    '/oauth/authorize': 'oauth',
+  	  };
+
  	  $(document).ready(async function(){

  	    // Set the correct link to active in the top nav bar
@@ -109,6 +125,12 @@
  	      }
  	    })

+  	    // /users/:uid (profile pages) should still map like /users.
+  	    var path = window.location.pathname.toLocaleLowerCase();
+  	    var helpSlug = HELP_DOCS_BY_PATH[path] ||
+  	      (path.indexOf('/users/') === 0 ? HELP_DOCS_BY_PATH['/users'] : null);
+  	    if(helpSlug) $('#cl-help').attr('href', '/docs/' + helpSlug);
+
  	    // Set the correct login/logout button, and reveal the current user's
  	    // name (linking to their profile) once we know who they are.
  	    var me = await app.auth.isLoggedIn();
@@ -59,6 +59,14 @@ async function fetchUsernameSuggestions() {
 		$form.find('#personNameFields').toggle(!checked);
 		$form.find('#serviceAccountNameField').toggle(checked);

+		// Service accounts aren't a person with a mailbox, and a blank
+		// password is fine (no userPassword attribute set -- the account
+		// simply can't bind). Disabling (not just hiding) keeps disabled
+		// fields out of both form serialization and validation.
+		$form.find('[name=mail]').prop('disabled', checked).closest('.mb-3').toggle(!checked);
+		$form.find('[name=userPassword]').prop('disabled', checked).closest('.mb-3').toggle(!checked);
+		$form.find('[name=passwordMatch]').prop('disabled', checked).closest('.mb-3').toggle(!checked);
+
 		if(checked){
 			// Filler values so the LDAP schema (inetOrgPerson requires sn) is
 			// satisfied; not shown anywhere, the account name is what matters.
@@ -3,15 +3,17 @@

 </script>
 <script type="text/javascript">
-	function renderUsers(actionMessage, type){
-
+	function renderUsers(){
 		app.user.list(function(error, data){
 			if(error){
-				app.util.actionMessage(data.message, $target, 'danger');
+				app.util.actionMessage(data.message, $('#tab-people'), 'danger');
 				return;
 			}
-			$.scope.userRow.push(...data.results);
-
+			$.scope.userRow.empty();
+			$.scope.serviceAccountRow.empty();
+			const results = data.results || [];
+			$.scope.userRow.push(...results.filter(u => !u.isServiceAccount));
+			$.scope.serviceAccountRow.push(...results.filter(u => u.isServiceAccount));
 		});
 	}

@@ -100,110 +102,190 @@
 	})();

 </script>
-<div class="row" style="display:none">
-	<div class="col-md-4">
-		<div class="shadow-lg card mb-3 card-default group-required group-required-app_sso_admin">
-			<div class="card-header shadow">
-				<i class="fas fa-user-plus"></i>
-				Invite User
-				<span class="float-end">
-					<i class="fa-solid fa-arrows-up-down"></i>
-				</span>
+<h4><i class="fa-solid fa-users"></i> Users</h4>
+
+<ul class="nav nav-tabs mb-3" role="tablist">
+	<li class="nav-item" role="presentation">
+		<button class="nav-link active" id="tab-people-btn" data-bs-toggle="tab" data-bs-target="#tab-people" type="button" role="tab">
+			<i class="fa-solid fa-user"></i> People
+		</button>
+	</li>
+	<li class="nav-item" role="presentation">
+		<button class="nav-link" id="tab-service-accounts-btn" data-bs-toggle="tab" data-bs-target="#tab-service-accounts" type="button" role="tab">
+			<i class="fa-solid fa-gears"></i> Service Accounts
+		</button>
+	</li>
+</ul>
+
+<div class="tab-content">
+<div class="tab-pane fade show active" id="tab-people" role="tabpanel">
+	<div class="row" style="display:none">
+		<div class="col-md-4">
+			<div class="shadow-lg card mb-3 card-default group-required group-required-app_sso_admin">
+				<div class="card-header shadow">
+					<i class="fas fa-user-plus"></i>
+					Invite User
+					<span class="float-end">
+						<i class="fa-solid fa-arrows-up-down"></i>
+					</span>
+				</div>
+				<div class="card-header shadow actionMessage" style="display: none;"></div>
+				<div class="card-body">
+					<div class="mb-2">
+						<label class="form-label small">Email <small class="text-muted">(optional — sends invite immediately)</small></label>
+						<input type="email" id="invite-email" class="form-control form-control-sm shadow" placeholder="user@example.com" />
+					</div>
+					<div class="mb-2">
+						<label class="form-label small">Groups <small class="text-muted">(optional — hold Ctrl/⌘ for multiple)</small></label>
+						<input type="text" class="form-control form-control-sm shadow mb-1" placeholder="Filter groups…" oninput="filterGroups(this, 'invite-groups')" />
+						<select id="invite-groups" class="form-select form-select-sm shadow" multiple size="4"></select>
+					</div>
+					<button onclick="sendInvite()" class="btn btn-sm btn-outline-dark shadow">
+						<i class="fa-solid fa-envelope"></i> Send Invite
+					</button>
+					<div id="invite-result" style="display:none" class="mt-2"></div>
+				</div>
 			</div>
-			<div class="card-header shadow actionMessage" style="display: none;"></div>
-			<div class="card-body">
-				<div class="mb-2">
-					<label class="form-label small">Email <small class="text-muted">(optional — sends invite immediately)</small></label>
-					<input type="email" id="invite-email" class="form-control form-control-sm shadow" placeholder="user@example.com" />
+			<div class="card shadow-lg">
+				<div class="card-header">
+					<i class="fas fa-user-plus"></i>
+					Add new user
+					<small class="text-muted">(check <b>This is a service account</b> below to create one — it'll show up under the Service Accounts tab)</small>
 				</div>
-				<div class="mb-2">
-					<label class="form-label small">Groups <small class="text-muted">(optional — hold Ctrl/⌘ for multiple)</small></label>
-					<input type="text" class="form-control form-control-sm shadow mb-1" placeholder="Filter groups…" oninput="filterGroups(this, 'invite-groups')" />
-					<select id="invite-groups" class="form-select form-select-sm shadow" multiple size="4"></select>
+				<div class="card-header actionMessage" style="display:none"></div>
+				<div class="card-body">
+					<%- include('user_form', {adminMode: true}) %>
 				</div>
-				<button onclick="sendInvite()" class="btn btn-sm btn-outline-dark shadow">
-					<i class="fa-solid fa-envelope"></i> Send Invite
-				</button>
-				<div id="invite-result" style="display:none" class="mt-2"></div>
 			</div>
 		</div>
-		<div class="card shadow-lg">
-			<div class="card-header">
-				<i class="fas fa-user-plus"></i>
-				Add new user
-			</div>
-			<div class="card-header actionMessage" style="display:none"></div>
-			<div class="card-body">
-				<%- include('user_form', {adminMode: true}) %>
-			</div>
-		</div>
-	</div>
-	<div class="col-md-8">
-		<div class="card shadow">
-			<div class="card-header">
-				<i class="fa-solid fa-users"></i>
-				User List
-			</div>
-			<div class="card-header actionMessage" style="display:none"></div>
-			<div class="table-responsive">
-			<table class="card-body table table-striped" style="margin-bottom:0">
-				<thead>
-					<th>ID</th>
-					<th>Name</th>
-					<th>eMail</th>
-					<th>Key</th>
-					<th>Active</th>
-					<th>TOS</th>
-					<th></th>
-				</thead>
-				<tbody id="tableAJAX">
-					<tr jq-repeat="userRow">
-						<td>
-							{{ uidNumber }}
-						</td>
-						<td>
-							<a href='/users/{{uid}}'>{{givenName}} {{sn}}</a>
-							{{#isServiceAccount}}<span class="badge bg-secondary" title="Service account — not a person"><i class="fa-solid fa-gears"></i> service</span>{{/isServiceAccount}}
-						</td>
-						<td>
-							{{mail}}
-						</td>
-						<td>
-							{{#sshPublicKey}}<i class="fa-regular fa-circle-check text-success"></i>{{/sshPublicKey}}
-						</td>
-						<td>
-							{{#isActive}}<i class="fa-regular fa-circle-check text-success"></i>{{/isActive}}
-							{{#isInactive}}<i class="fa-solid fa-circle-xmark text-danger"></i>{{/isInactive}}
-						</td>
-						<td>
-							{{#tosAccepted}}<i class="fa-solid fa-circle-check text-success" title="TOS accepted"></i>{{/tosAccepted}}
-							{{#tosNotAccepted}}<i class="fa-solid fa-circle-xmark text-danger" title="TOS not accepted"></i>{{/tosNotAccepted}}
-						</td>
-						<td class="text-nowrap">
-							{{#isActive}}
-							<button class="btn btn-sm btn-outline-warning me-1" title="Deactivate" onclick="toggleActive('{{uid}}', false)">
-								<i class="fa-solid fa-lock"></i>
-							</button>
-							{{/isActive}}
-							{{#isInactive}}
-							<button class="btn btn-sm btn-warning me-1" title="Activate" onclick="toggleActive('{{uid}}', true)">
-								<i class="fa-solid fa-lock-open"></i>
-							</button>
-							{{/isInactive}}
-							<button class="btn btn-sm btn-outline-secondary me-1" title="Impersonate" onclick="startImpersonate('{{uid}}')">
-								<i class="fa-solid fa-user-secret"></i>
-							</button>
-							<button class="btn btn-sm btn-danger" onclick="deleteUser('{{uid}}', this)">
-								<i class="fa-solid fa-user-slash"></i>
-							</button>
-						</td>
-					</tr>
-				</tbody>
-			</table>
+		<div class="col-md-8">
+			<div class="card shadow">
+				<div class="card-header">
+					<i class="fa-solid fa-users"></i>
+					User List
+				</div>
+				<div class="card-header actionMessage" style="display:none"></div>
+				<div class="table-responsive">
+				<table class="card-body table table-striped" style="margin-bottom:0">
+					<thead>
+						<th>ID</th>
+						<th>Name</th>
+						<th>eMail</th>
+						<th>Key</th>
+						<th>Active</th>
+						<th>TOS</th>
+						<th></th>
+					</thead>
+					<tbody id="tableAJAX">
+						<tr jq-repeat="userRow">
+							<td>
+								{{ uidNumber }}
+							</td>
+							<td>
+								<a href='/users/{{uid}}'>{{givenName}} {{sn}}</a>
+							</td>
+							<td>
+								{{mail}}
+							</td>
+							<td>
+								{{#sshPublicKey}}<i class="fa-regular fa-circle-check text-success"></i>{{/sshPublicKey}}
+							</td>
+							<td>
+								{{#isActive}}<i class="fa-regular fa-circle-check text-success"></i>{{/isActive}}
+								{{#isInactive}}<i class="fa-solid fa-circle-xmark text-danger"></i>{{/isInactive}}
+							</td>
+							<td>
+								{{#tosAccepted}}<i class="fa-solid fa-circle-check text-success" title="TOS accepted"></i>{{/tosAccepted}}
+								{{#tosNotAccepted}}<i class="fa-solid fa-circle-xmark text-danger" title="TOS not accepted"></i>{{/tosNotAccepted}}
+							</td>
+							<td class="text-nowrap">
+								{{#isActive}}
+								<button class="btn btn-sm btn-outline-warning me-1" title="Deactivate" onclick="toggleActive('{{uid}}', false)">
+									<i class="fa-solid fa-lock"></i>
+								</button>
+								{{/isActive}}
+								{{#isInactive}}
+								<button class="btn btn-sm btn-warning me-1" title="Activate" onclick="toggleActive('{{uid}}', true)">
+									<i class="fa-solid fa-lock-open"></i>
+								</button>
+								{{/isInactive}}
+								<button class="btn btn-sm btn-outline-secondary me-1" title="Impersonate" onclick="startImpersonate('{{uid}}')">
+									<i class="fa-solid fa-user-secret"></i>
+								</button>
+								<button class="btn btn-sm btn-danger" onclick="deleteUser('{{uid}}', this)">
+									<i class="fa-solid fa-user-slash"></i>
+								</button>
+							</td>
+						</tr>
+					</tbody>
+				</table>
+				</div>
 			</div>
 		</div>
 	</div>
 </div>
+<div class="tab-pane fade" id="tab-service-accounts" role="tabpanel">
+	<div class="row" style="display:none">
+		<div class="col-12">
+			<div class="card shadow">
+				<div class="card-header">
+					<i class="fa-solid fa-gears"></i>
+					Service Accounts
+					<small class="text-muted">— Unix/POSIX accounts something runs as, not a person. Create one from the People tab's "Add new user" form.</small>
+				</div>
+				<div class="card-header actionMessage" style="display:none"></div>
+				<div class="table-responsive">
+				<table class="card-body table table-striped" style="margin-bottom:0">
+					<thead>
+						<th>Username</th>
+						<th>Description</th>
+						<th>Manager(s)</th>
+						<th>Created</th>
+						<th>Active</th>
+						<th></th>
+					</thead>
+					<tbody>
+						<tr jq-repeat="serviceAccountRow">
+							<td>
+								<a href='/users/{{uid}}'>{{uid}}</a>
+							</td>
+							<td>
+								{{description}}
+							</td>
+							<td>
+								{{#managerUids}}<span class="badge bg-secondary me-1">{{.}}</span>{{/managerUids}}
+							</td>
+							<td>
+								{{createTimestamp}}
+							</td>
+							<td>
+								{{#isActive}}<i class="fa-regular fa-circle-check text-success"></i>{{/isActive}}
+								{{#isInactive}}<i class="fa-solid fa-circle-xmark text-danger"></i>{{/isInactive}}
+							</td>
+							<td class="text-nowrap">
+								{{#isActive}}
+								<button class="btn btn-sm btn-outline-warning me-1" title="Deactivate" onclick="toggleActive('{{uid}}', false)">
+									<i class="fa-solid fa-lock"></i>
+								</button>
+								{{/isActive}}
+								{{#isInactive}}
+								<button class="btn btn-sm btn-warning me-1" title="Activate" onclick="toggleActive('{{uid}}', true)">
+									<i class="fa-solid fa-lock-open"></i>
+								</button>
+								{{/isInactive}}
+								<button class="btn btn-sm btn-danger" onclick="deleteUser('{{uid}}', this)">
+									<i class="fa-solid fa-user-slash"></i>
+								</button>
+							</td>
+						</tr>
+					</tbody>
+				</table>
+				</div>
+			</div>
+		</div>
+	</div>
+</div>
+</div>

 <%- include('impersonate_modal') %>
 <%- include('bottom') %>
Author	SHA1	Message	Date
wmantly	099638057e	Merge pull request #79 from theta42/docs-help-search Add header help icon and in-app docs search	2026-07-17 19:24:33 -04:00
wmantly	077c41844d	Add header help icon and in-app docs search - A ? icon in the top-right header deep-links to the doc most relevant to the current page (client-side path mapping, same pattern already used for top-nav active-link highlighting -- no server-side "current section" local exists to key off of instead). Falls back to the docs index. - GET /docs/search does a plain line-substring search over the existing allowlisted doc set. No new dependency, stays usable with no internet access. Bumps to v1.1.10. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDEx8ghuZR61pqPXc6da9C	2026-07-17 19:22:27 -04:00
wmantly	96adf60cf7	Merge pull request #78 from theta42/personal-group-members Add personal Unix group member management	2026-07-17 11:31:11 -04:00
wmantly	82f703f560	Add personal Unix group member management Every account gets a personal posixGroup at creation (its primary GID holder) but there was no way to manage its memberUid list -- add add/remove endpoints and a profile-page UI (admin-only), reusing the userSelect widget already built for the manager field. Bumps to v1.1.9. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDEx8ghuZR61pqPXc6da9C	2026-07-17 11:28:41 -04:00
wmantly	65b107d8ff	Merge pull request #77 from theta42/fix-account-editing-bugs Fix account-editing bugs; add editable group membership from profile	2026-07-17 11:03:05 -04:00
wmantly	5d7c0bd594	Fix account-editing bugs from real-world feedback, add editable group membership - Edit form's Mobile Phone field was effectively required (stray validate attribute) -- removed. - Service account profiles always showed the literal filler name "Service Account" -- hidden now, since it's not meaningful. Required computing isServiceAccount in User.get(), not just listDetail(). - Fresh service accounts could look uncategorized (missing from the Service Accounts tab, wrong isServiceAccount) for up to 5 minutes after creation, due to a cache-staleness race in the create route -- the user gets cached via User.get() before the route marks it as a service account. Cleared and re-fetched after marking. - memberOf came back as a bare string instead of a one-element array for users in exactly one group, causing client-side permission checks to iterate character-by-character and incorrectly deny access -- normalized alongside the existing manager normalization. - Added editable group membership on the profile page ("My groups"), admin-only, using the existing per-group member endpoints. Bumps to v1.1.8. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDEx8ghuZR61pqPXc6da9C	2026-07-17 11:00:50 -04:00
wmantly	3ad817767a	Merge pull request #76 from theta42/accounts-manager-rework Unify service accounts, add manager field, editable homeDirectory/loginShell	2026-07-17 00:35:52 -04:00
wmantly	cdc5d1528c	Unify service accounts to one kind, add manager field, make homeDirectory/loginShell editable Removes the LDAP bind-only service account type in favor of a single Unix/POSIX account model, surfaced in a new Users > Service Accounts tab. Adds a multi-valued `manager` field to every account (defaults to the creator, editable, and grants edit rights on the accounts a person manages without needing app_sso_admin). homeDirectory and loginShell are now editable from the profile edit form. Bumps to v1.1.7. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KDEx8ghuZR61pqPXc6da9C	2026-07-17 00:32:19 -04:00
wmantly	5fc65d6fb3	Merge pull request #75 from theta42/bump-1.1.6 Bump version to 1.1.6	2026-07-16 20:24:43 -04:00
wmantly	ea65a85aa9	Bump version to 1.1.6; update CHANGELOG	2026-07-16 20:22:42 -04:00
wmantly	f8cf68b85f	Merge pull request #74 from theta42/redesign-docs-site Redesign docs site: match the app's own look, add SEO, mobile-ready	2026-07-16 19:54:43 -04:00
wmantly	cedef0ed09	Redesign docs site: match the app's own look, add SEO, mobile-ready The GitHub Pages site used the generic jekyll-theme-cayman theme -- purple gradient hero, no site nav, no per-page SEO. Replaced with a custom layout that mirrors the actual app UI: dark fixed navbar with the theta42 logo, Bootstrap 5 + Font Awesome (same stack the app uses), content in a card, dark footer matching bottom.ejs (copyright, MIT license, GitHub, Changelog links). - New cross-page nav (Home/Deployment/Configuration/OAuth/LDAP/ Changelog) -- there was previously no way to get from one docs page to another except a single "Back to Home" link per page. - SEO: jekyll-seo-tag + jekyll-sitemap (both GitHub-Pages-supported plugins, no custom build needed) -- real per-page meta description, Open Graph/Twitter card tags, canonical URLs, JSON-LD, sitemap.xml, and a robots.txt referencing it. Added a real description to every page's front matter (none existed before). - Mobile: Bootstrap's responsive grid + collapsible navbar; the screenshot pairs in index.md (inline width="49%" for a two-up desktop layout) now stack to full-width below 576px instead of squeezing illegibly small. Verified with a real Jekyll build (jekyll/jekyll Docker image, no Ruby available locally) + Playwright: desktop and mobile (375px) screenshots of the home and deployment pages, mobile nav toggle open/close, active-link highlighting per page, zero console/page errors, and confirmed real SEO output (meta description, OG/Twitter tags, canonical, JSON-LD, sitemap.xml, robots.txt) via curl against the served site.	2026-07-16 19:52:26 -04:00