feat: redo user page to match account linking

app/server/web/auth.ts

@@ -7,7 +7,7 @@ import { ulid } from "ulidx";
 
 import type { Machine } from "~/types";
 
-import { authSessions, users } from "../db/schema";
+import { type HeadplaneUser, authSessions, users } from "../db/schema";
 import { Capabilities, type Role, Roles, capsForRole } from "./roles";
 
 // ── Principal ────────────────────────────────────────────────────────
@@ -378,6 +378,14 @@ export class AuthService {
     return this.linkHeadscaleUser(user.id, headscaleUserId);
   }
 
+  /**
+   * List all Headplane user records. Used by the users overview page
+   * to display the primary user list independently of the Headscale API.
+   */
+  async listUsers(): Promise<HeadplaneUser[]> {
+    return this.opts.db.select().from(users);
+  }
+
   /**
    * Returns the set of Headscale user IDs that are already claimed
    * by a Headplane user. Used to filter the link picker.
@@ -408,6 +416,24 @@ export class AuthService {
     return (user.role in Roles ? user.role : "member") as Role;
   }
 
+  /**
+   * Get the role for a Headplane user linked to a given Headscale user ID.
+   * Returns undefined if no Headplane user is linked to this Headscale user.
+   */
+  async roleForHeadscaleUser(headscaleUserId: string): Promise<Role | undefined> {
+    const [user] = await this.opts.db
+      .select()
+      .from(users)
+      .where(eq(users.headscale_user_id, headscaleUserId))
+      .limit(1);
+
+    if (!user) {
+      return;
+    }
+
+    return (user.role in Roles ? user.role : "member") as Role;
+  }
+
   /**
    * Reassign the role of a user identified by their OIDC subject.
    * Cannot reassign the owner role.