Add superadmin user edit endpoint and inline UI

Adds POST /admin/api/users/{id}/update for superadmin-only edits of full_name, role, and is_active, with guards against changing your own role or deactivating yourself. Surfaces an Edit button on each row in admin/users.html that swaps the row into an inline editor (name input, role select, active checkbox, Save/Cancel) so deactivated users can be reactivated and promoted without going through delete-and-recreate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/routes/admin_routes.py

@@ -291,6 +291,31 @@ async def toggle_user(user_id: int,
         db.commit()
     return JSONResponse({"success": True, "is_active": user.is_active if user else False})
 
+
+@router.post("/api/users/{user_id}/update")
+async def update_user(user_id: int, request: Request,
+                      current_user: User = Depends(require_superadmin),
+                      db: Session = Depends(get_db)):
+    """Superadmin-only: update name, role, active state of an existing user."""
+    body = await request.json()
+    user = db.query(User).filter(User.id == user_id).first()
+    if not user:
+        return JSONResponse({"error": "User not found"}, status_code=404)
+    if user.id == current_user.id and body.get("role") and body["role"] != current_user.role:
+        return JSONResponse({"error": "Cannot change your own role"}, status_code=400)
+
+    if "full_name" in body and body["full_name"]:
+        user.full_name = body["full_name"].strip()
+    if "role" in body and body["role"] in ("user", "admin", "superadmin"):
+        user.role = body["role"]
+    if "is_active" in body:
+        if user.id == current_user.id and not body["is_active"]:
+            return JSONResponse({"error": "Cannot deactivate yourself"}, status_code=400)
+        user.is_active = bool(body["is_active"])
+    db.commit()
+    return JSONResponse({"success": True, "id": user.id, "role": user.role,
+                         "full_name": user.full_name, "is_active": user.is_active})
+
 @router.post("/api/users/{user_id}/reset-password")
 async def admin_reset_password(user_id: int, request: Request,
                                current_user: User = Depends(require_admin),

app/templates/admin/users.html

@@ -58,27 +58,54 @@
             {% for u in users %}
             <tr class="{{ 'bg-gray-50' if loop.index % 2 == 0 }} {{ 'opacity-50' if not u.is_active }} user-row" data-active="{{ 'true' if u.is_active else 'false' }}"
                 {% if not u.is_active %}style="display: none;"{% endif %}>
-                <td class="px-4 py-3 font-medium">{{ u.full_name }}</td>
+                <td class="px-4 py-3 font-medium">
+                    <span class="view-mode" id="name_view_{{ u.id }}">{{ u.full_name }}</span>
+                    <input type="text" class="edit-mode hidden w-full border rounded px-2 py-1 text-sm"
+                           id="name_edit_{{ u.id }}" value="{{ u.full_name }}">
+                </td>
                 <td class="px-4 py-3 text-gray-600">{{ u.email }}</td>
                 <td class="px-4 py-3 text-center">
-                    <span class="px-2 py-0.5 rounded text-xs font-semibold
-                        {{ 'bg-purple-100 text-purple-700' if u.role == 'superadmin' else 'bg-blue-100 text-blue-700' if u.role == 'admin' else 'bg-gray-100 text-gray-600' }}">
+                    <span class="view-mode px-2 py-0.5 rounded text-xs font-semibold
+                        {{ 'bg-purple-100 text-purple-700' if u.role == 'superadmin' else 'bg-blue-100 text-blue-700' if u.role == 'admin' else 'bg-gray-100 text-gray-600' }}"
+                        id="role_view_{{ u.id }}">
                         {{ u.role }}
                     </span>
+                    {% if user.role == 'superadmin' and u.id != user.id %}
+                    <select class="edit-mode hidden border rounded px-1 py-0.5 text-xs" id="role_edit_{{ u.id }}">
+                        <option value="user" {% if u.role == 'user' %}selected{% endif %}>user</option>
+                        <option value="admin" {% if u.role == 'admin' %}selected{% endif %}>admin</option>
+                        <option value="superadmin" {% if u.role == 'superadmin' %}selected{% endif %}>superadmin</option>
+                    </select>
+                    {% endif %}
                 </td>
                 <td class="px-4 py-3 text-center">
-                    <span class="text-xs {{ 'text-green-600' if u.is_active else 'text-red-500' }}">
+                    <span class="view-mode text-xs {{ 'text-green-600' if u.is_active else 'text-red-500' }}" id="active_view_{{ u.id }}">
                         {{ 'Active' if u.is_active else 'Inactive' }}
                     </span>
+                    {% if user.role == 'superadmin' and u.id != user.id %}
+                    <label class="edit-mode hidden text-xs inline-flex items-center space-x-1">
+                        <input type="checkbox" id="active_edit_{{ u.id }}" {% if u.is_active %}checked{% endif %}>
+                        <span>Active</span>
+                    </label>
+                    {% endif %}
                 </td>
                 <td class="px-4 py-3 text-center space-x-2">
                     {% if u.id != user.id %}
-                    <button onclick="toggleUser({{ u.id }})" class="text-blue-600 hover:underline text-xs">
-                        {{ 'Deactivate' if u.is_active else 'Activate' }}
-                    </button>
-                    <button onclick="resetPassword({{ u.id }}, '{{ u.email }}')" class="text-amber-600 hover:underline text-xs">
-                        Reset PW
-                    </button>
+                    <span class="view-mode space-x-2">
+                        {% if user.role == 'superadmin' %}
+                        <button onclick="startEdit({{ u.id }})" class="text-green-700 hover:underline text-xs">Edit</button>
+                        {% endif %}
+                        <button onclick="toggleUser({{ u.id }})" class="text-blue-600 hover:underline text-xs">
+                            {{ 'Deactivate' if u.is_active else 'Activate' }}
+                        </button>
+                        <button onclick="resetPassword({{ u.id }}, '{{ u.email }}')" class="text-amber-600 hover:underline text-xs">
+                            Reset PW
+                        </button>
+                    </span>
+                    <span class="edit-mode hidden space-x-2">
+                        <button onclick="saveEdit({{ u.id }})" class="text-green-700 hover:underline text-xs font-semibold">Save</button>
+                        <button onclick="cancelEdit({{ u.id }})" class="text-gray-500 hover:underline text-xs">Cancel</button>
+                    </span>
                     {% else %}
                     <span class="text-gray-300 text-xs">You</span>
                     {% endif %}
@@ -127,6 +154,32 @@ async function toggleUser(id) {
     await fetch('/admin/api/users/' + id + '/toggle', { method: 'POST', headers: {'Authorization': 'Bearer ' + authToken} });
     location.reload();
 }
+function rowEls(id) {
+    return document.querySelector(`tr.user-row [id="name_view_${id}"]`).closest('tr');
+}
+function startEdit(id) {
+    const row = rowEls(id);
+    row.querySelectorAll('.view-mode').forEach(el => el.classList.add('hidden'));
+    row.querySelectorAll('.edit-mode').forEach(el => el.classList.remove('hidden'));
+}
+function cancelEdit(id) {
+    const row = rowEls(id);
+    row.querySelectorAll('.edit-mode').forEach(el => el.classList.add('hidden'));
+    row.querySelectorAll('.view-mode').forEach(el => el.classList.remove('hidden'));
+}
+async function saveEdit(id) {
+    const payload = {
+        full_name: document.getElementById('name_edit_' + id).value,
+        role: document.getElementById('role_edit_' + id).value,
+        is_active: document.getElementById('active_edit_' + id).checked,
+    };
+    const resp = await fetch('/admin/api/users/' + id + '/update', {
+        method: 'POST', headers: authHeaders, body: JSON.stringify(payload),
+    });
+    const data = await resp.json();
+    if (data.success) location.reload();
+    else alert(data.error || 'Failed to save');
+}
 async function resetPassword(id, email) {
     if (!confirm('Send password reset email to ' + email + '?')) return;
     const resp = await fetch('/admin/api/users/' + id + '/reset-password', {