feat(admin): streamline group management

apps/web/src/app/admin/(console)/users/actions.ts

@@ -14,6 +14,7 @@ import { redirect } from "next/navigation";
 import { recordAdminEvent } from "@/lib/audit";
 import { requireAdminSession } from "@/lib/auth/require-admin";
 import { db } from "@/lib/database";
+import { adminGroupReturnPath } from "@/lib/group-management";
 
 const USERNAME_PATTERN = /^[A-Za-z0-9_]{3,16}$/;
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -22,12 +23,6 @@ function userPath(userId: string, query?: string) {
   return `/admin/users/${encodeURIComponent(userId)}${query ? `?${query}` : ""}`;
 }
 
-function userRegistryPath(search: string, result: "saved=group" | "error=invalid-group-assignment") {
-  const query = new URLSearchParams(result);
-  if (search) query.set("q", search);
-  return `/admin/users?${query.toString()}`;
-}
-
 async function targetUser(userId: string) {
   if (!UUID_PATTERN.test(userId)) return null;
   const [user] = await db.select().from(users).where(eq(users.id, userId)).limit(1);
@@ -85,20 +80,26 @@ export async function assignUserGroupFromRegistry(formData: FormData) {
   const admin = await requireAdminSession();
   const userId = String(formData.get("userId") ?? "");
   const groupId = String(formData.get("groupId") ?? "");
-  const search = String(formData.get("search") ?? "").trim().slice(0, 100);
-  if (!UUID_PATTERN.test(userId) || !UUID_PATTERN.test(groupId)) redirect(userRegistryPath(search, "error=invalid-group-assignment"));
-
-  const [[user], [targetGroup]] = await Promise.all([
-    db.select({ id: users.id }).from(users).where(eq(users.id, userId)).limit(1),
-    db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault }).from(groups).where(eq(groups.id, groupId)).limit(1),
-  ]);
-  if (!user || !targetGroup) redirect(userRegistryPath(search, "error=invalid-group-assignment"));
+  const returnTo = formData.get("returnTo");
+  if (!UUID_PATTERN.test(userId) || !UUID_PATTERN.test(groupId)) redirect(adminGroupReturnPath(returnTo, "error=invalid-group-assignment"));
 
   const requestHeaders = await headers();
   const ipAddress = getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
   try {
     await db.transaction(async (tx) => {
-      await tx.execute(sql`select ${users.id} from ${users} where ${users.id} = ${user.id} for update`);
+      await tx.execute(sql`select pg_advisory_xact_lock(hashtext('minecraft-account-manager-group-membership'))`);
+      await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${groupId} for update`);
+      await tx.execute(sql`select ${users.id} from ${users} where ${users.id} = ${userId} for update`);
+      const [[user], [targetGroup]] = await Promise.all([
+        tx.select({ id: users.id }).from(users).where(eq(users.id, userId)).limit(1),
+        tx.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault }).from(groups).where(eq(groups.id, groupId)).limit(1),
+      ]);
+      if (!user || !targetGroup) throw new Error("User or destination group no longer exists");
+      const [membership] = await tx.select({ groupId: userGroupMemberships.groupId })
+        .from(userGroupMemberships).where(eq(userGroupMemberships.userId, user.id)).limit(1);
+      if (membership && membership.groupId !== targetGroup.id) {
+        await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${membership.groupId} for update`);
+      }
       const [previous] = await tx.select({ id: groups.id, name: groups.name })
         .from(userGroupMemberships)
         .innerJoin(groups, eq(groups.id, userGroupMemberships.groupId))
@@ -131,9 +132,9 @@ export async function assignUserGroupFromRegistry(formData: FormData) {
       });
     });
   } catch {
-    redirect(userRegistryPath(search, "error=invalid-group-assignment"));
+    redirect(adminGroupReturnPath(returnTo, "error=invalid-group-assignment"));
   }
-  redirect(userRegistryPath(search, "saved=group"));
+  redirect(adminGroupReturnPath(returnTo, "saved=group"));
 }
 
 export async function updateUserName(formData: FormData) {

apps/web/src/app/admin/(console)/users/page.tsx

@@ -1,7 +1,6 @@
 import { groups, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
 import { and, asc, desc, eq, ilike, isNull, or, sql } from "drizzle-orm";
-import Link from "next/link";
-import { UserGroupSelect } from "@/components/user-group-select";
+import { AdminUserTable } from "@/components/admin-user-table";
 import { db } from "@/lib/database";
 import { assignUserGroupFromRegistry } from "./actions";
 
@@ -66,8 +65,8 @@ export default async function AdminUsersPage({
     db.select({ userId: userGroupMemberships.userId, groupId: userGroupMemberships.groupId })
       .from(userGroupMemberships),
   ]);
-  const defaultGroup = allGroups.find((group) => group.isDefault);
-  const groupByUser = new Map(memberships.map((membership) => [membership.userId, membership.groupId]));
+  const assignmentByUser = Object.fromEntries(memberships.map((membership) => [membership.userId, membership.groupId]));
+  const returnTo = `/admin/users${search ? `?${new URLSearchParams({ q: search }).toString()}` : ""}`;
 
   return (
     <main className="mx-auto max-w-6xl px-6 py-14">
@@ -92,26 +91,8 @@ export default async function AdminUsersPage({
       {query.error && <p className="mt-7 border-l-2 border-accent bg-panel px-5 py-4 text-sm text-accent" role="alert">{query.error === "invalid-group-assignment" ? "The user or group no longer exists. No group change was applied." : "The requested user could not be found."}</p>}
       {query.saved === "group" && <p className="mt-7 border-l-2 border-signal bg-panel px-5 py-4 text-sm" role="status">User group updated.</p>}
 
-      <div className="mt-8 overflow-x-auto border border-line bg-panel shadow-[8px_8px_0_var(--color-shadow)]">
-        <table className="w-full min-w-[900px] border-collapse text-left">
-          <caption className="sr-only">Registered portal users</caption>
-          <thead className="border-b border-line font-mono text-[10px] uppercase tracking-widest text-muted">
-            <tr><th className="p-4" scope="col">User</th><th className="p-4" scope="col">Discord</th><th className="p-4" scope="col">Primary</th><th className="p-4" scope="col">Accounts</th><th className="p-4" scope="col">Group</th><th className="p-4" scope="col">Status</th></tr>
-          </thead>
-          <tbody className="divide-y divide-line">
-            {results.map((user) => (
-              <tr className="transition-colors hover:bg-canvas/60" key={user.id}>
-                <th className="p-4 text-left" scope="row"><Link className="font-display text-lg font-black underline decoration-line underline-offset-4 hover:text-accent" href={`/admin/users/${user.id}`}>{user.firstName ?? "Name needed"}</Link></th>
-                <td className="p-4"><div className="font-mono text-xs font-bold">{user.discordGlobalName ?? user.discordUsername}</div><div className="mt-1 font-mono text-[10px] text-muted">@{user.discordUsername}</div><div className="mt-1 font-mono text-[9px] text-muted">{user.discordUserId}</div></td>
-                <td className="p-4 font-mono text-xs">{user.primaryUsername ?? "—"}</td>
-                <td className="p-4 font-mono text-xs">{user.accountCount}</td>
-                <td className="p-4">{defaultGroup ? <UserGroupSelect action={assignUserGroupFromRegistry} effectiveGroupId={groupByUser.get(user.id) ?? defaultGroup.id} groups={allGroups} search={search} userId={user.id} userLabel={user.firstName ?? user.discordUsername} /> : <span className="text-xs text-accent">Default group missing</span>}</td>
-                <td className="p-4"><span className={`border px-2 py-1 font-mono text-[9px] uppercase tracking-wider ${user.onboardingCompletedAt ? "border-line text-muted" : "border-accent text-accent"}`}>{user.onboardingCompletedAt ? "Ready" : "Onboarding"}</span></td>
-              </tr>
-            ))}
-            {!results.length && <tr><td className="p-8 text-muted" colSpan={6}>No users match that search.</td></tr>}
-          </tbody>
-        </table>
+      <div className="mt-8">
+        <AdminUserTable action={assignUserGroupFromRegistry} assignmentByUser={assignmentByUser} emptyMessage="No users match that search." groups={allGroups} returnTo={returnTo} users={results} />
       </div>
       <p className="mt-4 font-mono text-[9px] uppercase tracking-widest text-muted">Showing up to 100 users</p>
     </main>