User management and roles

@users-access @admin
Feature: User management and roles
  As an admin
  I want to add, edit, deactivate and reassign users with roles
  So that access always matches who is actually on the team

  Admins manage the whole user list from a searchable register, and deactivation takes effect at once.

  Background:
    Given an admin is signed in
    And the user register is searchable and paged

  Rule: Only an admin may manage users

    Scenario: A non-admin cannot reach the admin actions
      Given a staff member without the admin role
      When they call an add, edit, deactivate or reassign action
      Then the action is refused on the server, not only hidden in the screen

  Rule: An admin manages users from the register

    Scenario: Add a user
      Given an admin opens the add-user form
      When they enter a valid user with a role
      Then the user is added to the register

    Scenario: Edit a user
      Given a user exists in the register
      When an admin edits the user's details or role
      Then the changes are saved

  Rule: The data guards refuse invalid users

    Scenario Outline: A bad user entry is refused with the real reason
      Given an admin is adding or editing a user
      When the entry has "<fault>"
      Then it is refused and the message names the real reason

      Examples:
        | fault                              |
        | an email in the wrong format       |
        | an email on a domain not allowed   |
        | an email already used by a user    |

  Rule: The admin set cannot be emptied and an admin cannot lock themselves out

    Scenario: An admin cannot deactivate themselves
      Given an admin is signed in
      When they try to deactivate their own account
      Then the action is refused

    Scenario: The active-admin count cannot drop below two
      Given there are exactly two active administrators
      When an admin tries to deactivate or downgrade one of them
      Then the action is refused, because at least two active administrators must remain

  Rule: Deactivation takes effect immediately

    Scenario: Deactivating a user revokes access and notifies them
      Given a user is active and signed in
      When an admin deactivates the user
      Then the user's sessions are revoked at once
      And the user is sent a notice at their work email

    Scenario: A role change on a signed-in user ends their session
      Given a user is signed in
      When an admin changes that user's role
      Then the user's session ends and the new role applies on their next sign-in

    Scenario: Reactivating a user restores access
      Given a user is deactivated
      When an admin reactivates the user
      Then the user can sign in again

  Rule: A deactivated user's work is reassigned, not lost

    Scenario: Reassign a whole account's work
      Given a user owns work in the system
      When an admin reassigns that user's account to an active user
      Then all of the user's work moves to the new owner

    Scenario Outline: An invalid reassignment target is refused
      Given a user owns work in the system
      When an admin reassigns the account to "<target>"
      Then the reassignment is refused

      Examples:
        | target                        |
        | an inactive user              |
        | the reviewer of that user's own item |

  Rule: The register can be exported

    Scenario: Exporting the register records who exported it
      Given an admin is viewing the user register
      When they export it
      Then the export matches the current list
      And the register export is administrator-only and writes an audit row, and a build check flags any new export column