Merge pull request #130 from theta42/release/1.10.0

Release 1.10.0: cross-app super admin, Executive page renamed to Overview

CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to this project are documented here. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions
 correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
+## [1.10.0] - 2026-07-30
+
+### Added
+- **`app_super_admin` cross-app group**: members are full admins here regardless of `app_sso_admin` membership. Bypassed centrally in `utils/permission.js`'s `byGroup`, folded into `GET /api/user/me`'s `isAdmin` flag, and added to nav/`forceLogin` gates. The same group is now also recognized by proxy and jump-host, and by `ldap-client`'s SSSD access filter (SSH login on every host).
+
+### Changed
+- **Renamed the Executive page to Overview** (route, view, `/api/metrics/overview`, nav label, docs). `/executive` kept as a 301 redirect alongside the existing `/admin`, `/notifications`, `/dashboard` legacy redirects.
+
+## [1.9.0] - 2026-07-28
+
+### Added
+- **Directory modal's Associated LDAP Groups tab now supports full membership management**: view, add, and remove members/owners of each associated group directly from the tab, reusing the same `PUT`/`DELETE group/:group/:uid` routes and member-mapping pattern already used on the Groups page.
+- **`app.util.revealItem()`** (in the shared `app-base.js`, byte-identical across the 3 apps): scrolls a just-added/-edited element into view and flashes its background. Wired into the Directory table, the Groups tab's member list, and the Groups page's create-group flow.
+
+### Changed
+- **Groups page's search/sort bar is now sticky**, staying visible while scrolling through a long group list. Introduces `--sw-content-offset` (set in `top.ejs` alongside `#spa-shell`'s margin-top) so an in-page sticky element can offset itself below the fixed navbar/update-banner instead of being hidden behind them.
+- **Directory table**: Kind/Name/Env/Host merged into a single "Resource" column.
+- `@simpleworkjs/frontend` bumped to `^0.2.7`.
+
 ## [1.8.3] - 2026-07-28
 
 ### Changed

docs/concepts-accounts.md

@@ -46,7 +46,7 @@ on, just like anyone else's.
 
 A **group** is just a named list of accounts, used to control access. This
 app has a handful of built-in groups that grant admin powers (e.g. only
-people in the `app_sso_admin` group can see the Users/Groups/Directory/Executive
+people in the `app_sso_admin` group can see the Users/Groups/Directory/Overview
 pages at all), but you can also make your own groups for any app you
 connect — say, a group listing everyone who should be allowed into your
 photo server. Once a group exists, add or remove members from the

docs/index.md

@@ -22,7 +22,7 @@ one command).
 
 ## Screenshots
 
-<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Executive dashboard" width="49%"></a>
+<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Overview dashboard" width="49%"></a>
 <a href="images/users.png" target="_blank"><img src="images/users.png" alt="User list" width="49%"></a>
 <a href="images/groups.png" target="_blank"><img src="images/groups.png" alt="Groups" width="49%"></a>
 <a href="images/directory.png" target="_blank"><img src="images/directory.png" alt="Directory & inventory" width="49%"></a>

nodejs/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.7.0",
+  "version": "1.8.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-sso-manager",
-      "version": "1.7.0",
+      "version": "1.8.3",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
@@ -14,7 +14,7 @@
         "@simpleworkjs/app-stack": "^1.0.0",
         "@simpleworkjs/conf": "^1.2.0",
         "@simpleworkjs/directory-schema": "^1.0.0",
-        "@simpleworkjs/frontend": "^0.2.6",
+        "@simpleworkjs/frontend": "^0.2.7",
         "@simpleworkjs/ldap": "^1.0.0",
         "@simpleworkjs/orm": "^0.2.8",
         "bcrypt": "^6.0.0",
@@ -1280,9 +1280,9 @@
       }
     },
     "node_modules/@simpleworkjs/frontend": {
-      "version": "0.2.6",
-      "resolved": "https://registry.npmjs.org/@simpleworkjs/frontend/-/frontend-0.2.6.tgz",
-      "integrity": "sha512-2uqvEjxyZ2LE+sfhP6rJcEMmqdViazJ3ZkitWJXInPMWF6DiEZuP5MYqBqJvfDko63CCHEt1/ChFQd7Ry85Pzg==",
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/frontend/-/frontend-0.2.7.tgz",
+      "integrity": "sha512-s5oBc9dKLjd1bVhOQWR6+97faqQsbVKi0QYn5sNqOP6pGkUYUg2mY88ruHHg4Fp710owrzO/F3of/7tteFiGCw==",
       "license": "MIT",
       "engines": {
         "node": ">=18.0.0"

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.8.3",
+  "version": "1.10.0",
   "description": "A very simple LDAP management and SSO system",
   "author": [
     {
@@ -26,7 +26,7 @@
     "@simpleworkjs/app-stack": "^1.0.0",
     "@simpleworkjs/conf": "^1.2.0",
     "@simpleworkjs/directory-schema": "^1.0.0",
-    "@simpleworkjs/frontend": "^0.2.6",
+    "@simpleworkjs/frontend": "^0.2.7",
     "@simpleworkjs/ldap": "^1.0.0",
     "@simpleworkjs/orm": "^0.2.8",
     "bcrypt": "^6.0.0",

nodejs/public/css/styles.css

@@ -7,6 +7,12 @@ body {
 	display: flex;
 	flex-direction: column;
 	min-height: 100vh;
+	/* Height of the fixed navbar (plus the update banner, while shown --
+	   see top.ejs's showUpdateBanner/dismissUpdateBanner). Lets an in-page
+	   sticky element offset itself below both fixed elements via
+	   `top: var(--sw-content-offset)` instead of colliding with them at the
+	   viewport's true top:0. */
+	--sw-content-offset: 4.5rem;
 }
 
 #spa-shell {

nodejs/public/lib/js/app-base.js

@@ -584,10 +584,31 @@ app.util = (function(app){
 		document.body.removeChild(element);
 	}
 
+	// Scroll a just-added/-edited element into view and flash its
+	// background, so the user's eye lands on the row that changed instead of
+	// it silently appearing/updating somewhere off-screen. Takes a jQuery
+	// object or a raw DOM node (e.g. jq-repeat's `item.__jq_$el`).
+	function revealItem(el){
+		var node = el && el.jquery ? el[0] : el;
+		if (!node) return;
+		if (typeof node.scrollIntoView === 'function') {
+			node.scrollIntoView({behavior: 'smooth', block: 'center'});
+		}
+		var prevTransition = node.style.transition;
+		var prevBg = node.style.backgroundColor;
+		node.style.transition = 'background-color 1.5s ease';
+		node.style.backgroundColor = 'var(--bs-success-bg-subtle, #d1e7dd)';
+		setTimeout(function(){
+			node.style.backgroundColor = prevBg;
+			setTimeout(function(){ node.style.transition = prevTransition; }, 1500);
+		}, 300);
+	}
+
 	return {
 		downloadFile: downloadFile,
 		getUrlParameter: getUrlParameter,
 		escapeHtml: escapeHtml,
+		revealItem: revealItem,
 	}
 })(app);
 

nodejs/routes/api_metrics.js

@@ -3,8 +3,8 @@ const router = require('express').Router();
 const permission = require('../utils/permission');
 const metrics = require('../utils/metrics');
 
-// /api/metrics/executive
-router.get('/executive', async (req, res, next) => {
+// /api/metrics/overview
+router.get('/overview', async (req, res, next) => {
     try {
         await permission.byGroup(req.user, ['app_sso_admin']);
         

nodejs/routes/index.js

@@ -48,13 +48,14 @@ router.get('/tos', async function(req, res, next) {
 
 // Admin dashboard (stats + recent/inactive users) and Notifications
 // (broadcast + history) merged into one page.
-router.get('/executive', function(req, res) {
-  res.render('executive', {...values});
+router.get('/overview', function(req, res) {
+  res.render('overview', {...values});
 });
 
-router.get('/admin', (req, res) => res.redirect(301, '/executive'));
-router.get('/notifications', (req, res) => res.redirect(301, '/executive'));
-router.get('/dashboard', (req, res) => res.redirect(301, '/executive'));
+router.get('/admin', (req, res) => res.redirect(301, '/overview'));
+router.get('/notifications', (req, res) => res.redirect(301, '/overview'));
+router.get('/dashboard', (req, res) => res.redirect(301, '/overview'));
+router.get('/executive', (req, res) => res.redirect(301, '/overview'));
 
 router.get('/directory', function(req, res) {
   res.render('directory', {...values});

nodejs/routes/user.js

@@ -78,11 +78,12 @@ router.get('/me', async function(req, res, next){
 
 		// The shared client framework gates the UI on a single effective-rights
 		// flag (the OIDC-client apps send the same key). Here "admin" means
-		// membership in app_sso_admin; group-level gating still reads memberOf.
+		// membership in app_sso_admin or the cross-app app_super_admin group;
+		// group-level gating still reads memberOf.
 		const groups = (user.memberOf || []).map(function(dn){
 			return String(dn).split(',')[0].replace(/^cn=/i, '');
 		});
-		user.isAdmin = groups.includes('app_sso_admin');
+		user.isAdmin = groups.includes('app_sso_admin') || groups.includes(permission.SUPER_ADMIN_GROUP);
 
 		return res.json(user);
 	}catch(error){

nodejs/utils/permission.js

@@ -2,7 +2,16 @@
 
 const {Group} = require('../models/group_ldap');
 
+const SUPER_ADMIN_GROUP = 'app_super_admin';
+
 let byGroup = async function(user, groups, ownerOf){
+	try{
+		let superAdmin = await Group.get(SUPER_ADMIN_GROUP);
+		if(superAdmin.member.includes(user.dn)) return true
+	}catch(error){
+		// group not found, continue checking
+	}
+
 	for(let group of groups){
 		try{
 			group = await Group.get(group);
@@ -28,4 +37,4 @@ let byGroup = async function(user, groups, ownerOf){
 	throw error;
 }
 
-module.exports = {byGroup};
+module.exports = {byGroup, SUPER_ADMIN_GROUP};

nodejs/utils/ui.js

@@ -38,9 +38,9 @@ module.exports = {
 	// app-base.js, which reveals .group-required-<cn> for each group the user is
 	// in (plus the synthetic `admin` group when user/me reports isAdmin).
 	nav: [
-		{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['app_sso_admin']},
-		{href: '/groups', icon: 'fa-solid fa-users-viewfinder', label: 'Groups', groups: ['app_sso_admin']},
-		{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin']},
-		{href: '/executive', icon: 'fa-solid fa-gauge-high', label: 'Executive', groups: ['app_sso_admin']},
+		{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['app_sso_admin', 'admin']},
+		{href: '/groups', icon: 'fa-solid fa-users-viewfinder', label: 'Groups', groups: ['app_sso_admin', 'admin']},
+		{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin', 'admin']},
+		{href: '/overview', icon: 'fa-solid fa-gauge-high', label: 'Overview', groups: ['app_sso_admin', 'admin']},
 	],
 };

nodejs/views/directory.ejs

@@ -29,31 +29,25 @@
 				<table class="card-body table table-striped mb-0">
             <thead>
               <tr>
-                <th class="ps-3">Kind</th>
-                <th>Name</th>
-                <th>Env</th>
-                <th>Host</th>
+                <th class="ps-3">Resource</th>
                 <th>IP / Address</th>
                 <th>Actions</th>
               </tr>
             </thead>
             <tbody id="resources-list" jq-repeat="resources">
-              <tr>
-                <td class="ps-3 text-nowrap">
+              <tr id="resource-row-{{id}}">
+                <td class="ps-3">
                   {{{indentHtml}}}
                   <span class="badge bg-secondary">{{kind}}{{#metadata.subType}} ({{metadata.subType}}){{/metadata.subType}}</span>
-                </td>
-                <td>
+                  {{#metadata.isProduction}}<span class="badge bg-danger">Prod</span>{{/metadata.isProduction}}
+                  {{^metadata.isProduction}}<span class="badge bg-info">Dev</span>{{/metadata.isProduction}}
+                  <span class="badge bg-light text-dark border">{{hostName}}</span>
+                  <br>
                   <a href="#" class="text-reset text-decoration-none" onclick="openEditModal('{{id}}'); return false;" title="View details">
                     <strong>{{name}}</strong>
                   </a>
-                  <br><small class="text-muted">{{slug}}</small>
+                  <small class="text-muted">{{slug}}</small>
                 </td>
-                <td>
-                  {{#metadata.isProduction}}<span class="badge bg-danger">Prod</span>{{/metadata.isProduction}}
-                  {{^metadata.isProduction}}<span class="badge bg-info">Dev</span>{{/metadata.isProduction}}
-                </td>
-                <td><span class="badge bg-light text-dark border">{{hostName}}</span></td>
                 <td>
                   {{#metadata.ip}}<div><small>IP:</small> {{metadata.ip}}</div>{{/metadata.ip}}
                   {{#metadata.address}}<div><small>URL:</small> {{metadata.address}}</div>{{/metadata.address}}
@@ -79,7 +73,7 @@
 </div>
 
 <script>
-  app.auth.forceLogin(['app_sso_admin', 'app_sso_directory_admin']);
+  app.auth.forceLogin(['app_sso_admin', 'app_sso_directory_admin', 'admin']);
 
   // --- Resource modal tab content, built once. Populated via .val() in
   //     openAddModal/openEditModal AFTER app.modal.open() has (re)built the
@@ -259,7 +253,8 @@
   `;
 
   var groupsTabHtml = `
-    <div class="mb-3">
+    <div class="mb-3" id="groups-tab-container">
+      <div class="actionMessage" style="display:none"></div>
       <ul class="list-group mb-2 shadow-sm" id="groups-list"></ul>
       <div class="input-group shadow-sm mt-2">
         <input type="text" class="form-control" id="new-group-cn" placeholder="Group CN (e.g. app_emby_users)" list="ldap-groups-datalist">
@@ -606,7 +601,94 @@
   // destroyed and recreated runs asynchronously -- populating it
   // synchronously right after open() (as this function is called) would race
   // that and silently lose the pushed data on the second and later opens.
-  function refreshGroupsUI(resourceId) {
+  // uid from a member/owner DN, e.g. "cn=jdoe,ou=people,..." -> "jdoe".
+  function uidFromDn(dn) {
+    const m = dn.match(/cn=[a-zA-Z0-9_\-@.]+/);
+    return m ? m[0].replace('cn=', '') : dn;
+  }
+
+  var directoryUserCache = null;
+  async function loadDirectoryUsers() {
+    if (!directoryUserCache) {
+      const data = await app.user.list();
+      directoryUserCache = data.results;
+    }
+    return directoryUserCache;
+  }
+
+  // Renders one associated group's member/owner management block: a
+  // collapsible member list (remove button per member) plus an "add member"
+  // dropdown of users not already in the group. Fetches the live LDAP group
+  // detail (member/owner DN arrays) rather than relying on `allGroups`, which
+  // only holds the resource<->group association record, not membership.
+  async function renderGroupMembership(g, resourceId) {
+    const $li = $('<li class="list-group-item"></li>');
+    const $head = $('<div class="d-flex justify-content-between align-items-center"></div>');
+    const $span = $('<span></span>');
+    $span.append('<i class="fa-solid fa-users text-muted me-2"></i>');
+    $('<strong></strong>').text(g.groupCn).appendTo($span);
+    $('<span class="badge bg-primary ms-2"></span>').text(g.accessLevel).appendTo($span);
+    $head.append($span);
+
+    const collapseId = 'group-members-' + g.id;
+    const $actions = $('<span></span>');
+    $('<button type="button" class="btn btn-sm btn-outline-secondary me-1" data-bs-toggle="collapse"><i class="fa-solid fa-user-group"></i> Members</button>')
+      .attr('data-bs-target', '#' + collapseId)
+      .appendTo($actions);
+    $('<button type="button" class="btn btn-sm btn-outline-danger"><i class="fa-solid fa-xmark"></i></button>')
+      .on('click', function(){ removeGroup(g.id); })
+      .appendTo($actions);
+    $head.append($actions);
+    $li.append($head);
+
+    const $collapse = $('<div class="collapse mt-2"></div>').attr('id', collapseId);
+    $li.append($collapse);
+
+    let detail, userlist;
+    try {
+      [detail, userlist] = await Promise.all([
+        app.group.get(g.groupCn).then(d => d.results),
+        loadDirectoryUsers(),
+      ]);
+    } catch (err) {
+      console.error(err);
+      $collapse.append('<p class="text-danger small mb-0">Failed to load group membership.</p>');
+      return $li;
+    }
+
+    const memberDns = Array.isArray(detail.member) ? detail.member : (detail.member ? [detail.member] : []);
+    const $memberList = $('<ul class="list-group list-group-flush mb-2"></ul>');
+    if (!memberDns.length) {
+      $memberList.append('<li class="list-group-item text-muted px-0">No members.</li>');
+    }
+    for (const dn of memberDns) {
+      const uid = uidFromDn(dn);
+      const $mLi = $('<li class="list-group-item d-flex justify-content-between align-items-center px-0"></li>');
+      $('<span></span>').append('<i class="fa-solid fa-user me-1"></i>').append(document.createTextNode(uid)).appendTo($mLi);
+      $('<button type="button" class="btn btn-sm btn-outline-danger"><i class="fa-solid fa-user-slash"></i></button>')
+        .on('click', function(){ removeResourceGroupMember(g.groupCn, uid, resourceId); })
+        .appendTo($mLi);
+      $memberList.append($mLi);
+    }
+    $collapse.append($memberList);
+
+    const toAdd = userlist.filter(function(u){ return !memberDns.includes(u.dn); });
+    const $dropdown = $('<div class="dropdown"></div>');
+    $('<button type="button" class="btn btn-sm btn-secondary dropdown-toggle" data-bs-toggle="dropdown"><i class="fa-solid fa-user-plus"></i> Add member</button>')
+      .appendTo($dropdown);
+    const $menu = $('<div class="dropdown-menu shadow-lg" style="max-height: 240px; overflow-y: auto;"></div>');
+    for (const u of toAdd) {
+      $('<a class="dropdown-item" href="#"></a>').text(u.uid)
+        .on('click', function(e){ e.preventDefault(); addResourceGroupMember(g.groupCn, u.uid, resourceId); })
+        .appendTo($menu);
+    }
+    $dropdown.append($menu);
+    $collapse.append($dropdown);
+
+    return $li;
+  }
+
+  async function refreshGroupsUI(resourceId) {
     const myGroups = allGroups.filter(g => g.resourceId === resourceId);
     const $list = $('#groups-list').empty();
     if (!myGroups.length) {
@@ -614,16 +696,30 @@
       return;
     }
     for (const g of myGroups) {
-      const $li = $('<li class="list-group-item d-flex justify-content-between align-items-center"></li>');
-      const $span = $('<span></span>');
-      $span.append('<i class="fa-solid fa-users text-muted me-2"></i>');
-      $('<strong></strong>').text(g.groupCn).appendTo($span);
-      $('<span class="badge bg-primary ms-2"></span>').text(g.accessLevel).appendTo($span);
-      $li.append($span);
-      $('<button class="btn btn-sm btn-outline-danger"><i class="fa-solid fa-xmark"></i></button>')
-        .on('click', function(){ removeGroup(g.id); })
-        .appendTo($li);
-      $list.append($li);
+      $list.append(await renderGroupMembership(g, resourceId));
+    }
+  }
+
+  async function addResourceGroupMember(groupCn, uid, resourceId) {
+    try {
+      const data = await app.api.put('group/' + groupCn + '/' + uid, {});
+      await refreshGroupsUI(resourceId);
+      app.messages.action(data.message, $('#groups-tab-container'), 'success');
+      app.util.revealItem($('#groups-list'));
+    } catch (err) {
+      app.messages.action((err && err.message) || 'Failed to add member', $('#groups-tab-container'), 'danger');
+    }
+  }
+
+  async function removeResourceGroupMember(groupCn, uid, resourceId) {
+    const confirmed = await app.messages.confirm('Remove "' + uid + '" from "' + groupCn + '"?', $('#groups-tab-container'), 'warning');
+    if (!confirmed) return;
+    try {
+      const data = await app.api.delete('group/' + groupCn + '/' + uid);
+      await refreshGroupsUI(resourceId);
+      app.messages.action(data.message, $('#groups-tab-container'), 'success');
+    } catch (err) {
+      app.messages.action((err && err.message) || 'Failed to remove member', $('#groups-tab-container'), 'danger');
     }
   }
 
@@ -757,6 +853,8 @@
       }
       
       await loadResources();
+      const savedId = id || (res.results && res.results.id);
+      if (savedId) setTimeout(function(){ app.util.revealItem($('#resource-row-' + savedId)); }, 400);
 
       if (!id && data.kind === 'oauth' && res.results && res.results._raw_secret) {
         // Deliberately no app.modal.close() before this -- app.modal is a

nodejs/views/groups.ejs

@@ -64,9 +64,7 @@
 		$.scope.groupCard.update('cn', group, processGroup(data.results));
 		app.messages.action(message, $("#group-card-"+group), 'success');
 		$('a[href="#'+$form.closest('.tab-pane').attr('id')+'"]').tab('show');
-		setTimeout(function(group){
-			$("body,html").animate({ scrollTop: $("#group-card-" + group).offset().top }, 0);
-		}, 400, group);
+		setTimeout(function(){ app.util.revealItem($("#group-card-" + group)); }, 400);
 	}
 
 	function applySort() {
@@ -91,10 +89,11 @@
 		$('#groupCount').text(groups.length + ' of ' + allGroups.length + ' group' + (allGroups.length !== 1 ? 's' : ''));
 	}
 
-	async function tableAJAX() {
+	async function tableAJAX(revealCn) {
 		let data = await app.group.list();
 		allGroups = data.results.map(processGroup);
 		applyFilters();
+		if (revealCn) setTimeout(function(){ app.util.revealItem($('#group-card-' + revealCn)); }, 100);
 	}
 
 	async function removeMember(groupCN, uid, btn) {
@@ -141,7 +140,7 @@
 		}
 	}
 
-	app.auth.forceLogin('app_sso_admin');
+	app.auth.forceLogin(['app_sso_admin', 'admin']);
 
 	$(document).ready(async function(){
 		userlist = (await app.user.list()).results;
@@ -150,7 +149,7 @@
 </script>
 <div class="container mt-4">
 	
-	<div class="d-flex flex-wrap gap-2 align-items-center">
+	<div class="d-flex flex-wrap gap-2 align-items-center sticky-top bg-body py-2" style="top: var(--sw-content-offset, 0);">
 		<div class="input-group" style="flex: 1 1 200px;">
 			<span class="input-group-text"><i class="fa-solid fa-magnifying-glass"></i></span>
 			<input type="text" id="groupSearch" class="form-control" placeholder="Search groups…" oninput="applyFilters()">
@@ -173,7 +172,7 @@
 				</div>
 				<div class="card-header actionMessage" style="display:none"></div>
 				<div class="card-body">
-					<form action="group/" method="post" onsubmit="formAJAX(this)" evalAJAX="tableAJAX('')">
+					<form action="group/" method="post" onsubmit="formAJAX(this)" evalAJAX="tableAJAX(data.results.cn)">
 						<div class="mb-3">
 							<label class="form-label">Name</label>
 							<input type="text" class="form-control shadow" name="name" placeholder="app_gitea_admin" validate=":3" />

nodejs/views/overview.ejs

@@ -1,7 +1,7 @@
 <%- include('top') %>
 
 <script type="text/javascript">
-	app.auth.forceLogin('app_sso_admin');
+	app.auth.forceLogin(['app_sso_admin', 'admin']);
 
 	// ── Overview (stats, recent signups, inactive users) ────────────────────
 	async function loadDashboard() {
@@ -46,7 +46,7 @@
 
 	async function loadMetrics() {
 		try {
-			const data = await app.api.get('metrics/executive');
+			const data = await app.api.get('metrics/overview');
 			if (data && data.results) {
 				const renderList = (items, id) => {
 					const el = document.getElementById(id);
@@ -213,7 +213,7 @@
 <div class="container mt-4">
 	<div class="row mb-3">
 		<div class="col-12">
-			<h4 class="mb-0"><i class="fa-solid fa-gauge-high"></i> Executive Dashboard</h4>
+			<h4 class="mb-0"><i class="fa-solid fa-gauge-high"></i> Overview</h4>
 		</div>
 	</div>
 

nodejs/views/top.ejs

@@ -82,16 +82,24 @@
 		</div>
 
 		<script type="text/javascript">
+			// --sw-content-offset tracks the same height as #spa-shell's margin-top
+			// (fixed navbar, plus the update banner while it's shown), so any
+			// in-page sticky element (e.g. a sticky search/sort bar) can offset
+			// itself below both fixed elements via `top: var(--sw-content-offset)`
+			// instead of colliding with them at the viewport's true top:0.
 			function showUpdateBanner(){
 				let $nav = $('nav.fixed-top');
 				let $banner = $('#update-banner');
 				$banner.css('top', $nav.outerHeight() + 'px').show();
-				$('#spa-shell').css('margin-top', ($nav.outerHeight() + $banner.outerHeight()) + 'px');
+				let offset = $nav.outerHeight() + $banner.outerHeight();
+				$('#spa-shell').css('margin-top', offset + 'px');
+				document.documentElement.style.setProperty('--sw-content-offset', offset + 'px');
 			}
 
 			function dismissUpdateBanner(){
 				$('#update-banner').hide();
 				$('#spa-shell').css('margin-top', '');
+				document.documentElement.style.setProperty('--sw-content-offset', $('nav.fixed-top').outerHeight() + 'px');
 				sessionStorage.setItem('update-banner-dismissed', '1');
 			}
 

nodejs/views/users.ejs

@@ -223,7 +223,7 @@
 	}
 
 	(async function(){
-		await app.auth.forceLogin('app_sso_admin');
+		await app.auth.forceLogin(['app_sso_admin', 'admin']);
 
 		$(document).ready(function(){
 			renderUsers();