move per-user plugin grants to the user's page

Granting was a checklist of every user on each plugin's page, so "what may
this person use?" meant opening every plugin in turn — and the answer lived
on N pages while the connector half of it already lived on one. Both grant
sections now sit together on #users/{id}: same row list, same disabled chip,
same replace-the-whole-set save. The plugin's own page keeps a read-only
roster of who holds it, linking back to each person.

- db: plugin_access::set_for_user, the per-user twin of set_for_user on
  mcp_catalog_access; set_access stays as the inverse read model
- PluginManager: list_grants_for_user / set_grants_for_user, which omit and
  reject manages_own_access plugins (a box that controls nothing is worse
  than no box)
- GET/PUT /api/users/{id}/plugins, mounted next to /users/{id}/connectors;
  PUT /api/plugins/{id}/access is gone, GET remains as the roster

No push after the write, unlike a connector grant: that one gates a runtime
snapshotted at login, while a plugin grant is re-read from plugin_access on
every request that depends on it (sidebar pages, /plugins/mine, and each
inbound channel message), so a revoke lands with no bus event.

Docs updated with where access is granted, and why mobile-connector is
absent from that list.

web/components/plugin-detail.js

@@ -9,9 +9,15 @@ import { jf, schemaFields, pluginHealth } from './shared/plugin-common.js';
 //
 // Hosts what was squeezed into the old combined page: the instance-wide
 // config form (`config_schema`, saved via `PUT /api/plugins/{id}`) and the
-// per-user access checklist (`GET/PUT /api/plugins/{id}/access`). The enable
-// toggle is repeated in the summary card so a full setup round-trip happens
-// on one page.
+// enable toggle, repeated in the summary card so a full setup round-trip
+// happens on one page.
+//
+// Access used to be an editable checklist of every user here. It is now a
+// read-only roster (`GET /api/plugins/{id}/access`) linking to each person's
+// page: granting is done on the *user*, next to their connector grants, because
+// "what may this person use" is the question an admin actually asks — and
+// answering it plugin-by-plugin meant opening every plugin in turn. One write
+// path, so the two surfaces cannot disagree about who has what.
 
 const PAGE_ID = 'plugin-detail';
 
@@ -32,10 +38,8 @@ export class PluginDetailPage extends LightElement {
       _error:       { state: true },
       _draft:       { state: true },   // config form draft
       _status:      { state: true },   // { ok?: string, err?: string }
-      _access:      { state: true },   // AccessEntry[]
-      _accessSel:   { state: true },   // Set of granted user ids
+      _access:      { state: true },   // AccessEntry[] — read-only roster
       _accessErr:   { state: true },
-      _accessSaved: { state: true },
     };
   }
 
@@ -53,9 +57,7 @@ export class PluginDetailPage extends LightElement {
     this._draft = null;
     this._status = {};
     this._access = null;
-    this._accessSel = new Set();
     this._accessErr = null;
-    this._accessSaved = false;
   }
 
   connectedCallback() {
@@ -109,7 +111,7 @@ export class PluginDetailPage extends LightElement {
       // Keep whatever the admin has already typed across a reload triggered by a save.
       this._draft = { ...(p.config || {}), ...(this._draft || {}) };
       // Binding-managed plugins (e.g. mobile-connector) gate access through
-      // their own pairing lifecycle — the generic checklist controls nothing.
+      // their own pairing lifecycle — there is no grant roster to show.
       if (!p.manages_own_access) await this._loadAccess();
     } catch (e) {
       this._error = e.message;
@@ -118,9 +120,7 @@ export class PluginDetailPage extends LightElement {
 
   async _loadAccess() {
     try {
-      const entries = await jf(`/api/plugins/${encodeURIComponent(this._id)}/access`);
-      this._access = entries;
-      this._accessSel = new Set(entries.filter(e => e.granted).map(e => e.user_id));
+      this._access = await jf(`/api/plugins/${encodeURIComponent(this._id)}/access`);
     } catch (e) {
       this._accessErr = e.message;
     }
@@ -161,25 +161,13 @@ export class PluginDetailPage extends LightElement {
     }
   }
 
-  _toggleAccessUser(userId, on) {
-    const next = new Set(this._accessSel);
-    if (on) next.add(userId); else next.delete(userId);
-    this._accessSel = next;
-    this._accessSaved = false;
-  }
-
-  async _saveAccess() {
-    this._accessErr = null;
-    this._accessSaved = false;
-    try {
-      await jf(`/api/plugins/${encodeURIComponent(this._id)}/access`, {
-        method: 'PUT', headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ user_ids: [...this._accessSel] }),
-      });
-      this._accessSaved = true;
-    } catch (e) {
-      this._accessErr = e.message;
-    }
+  // Opens a user's page — the surface that owns the grant. `#users/{id}` is the
+  // same route the Users list pushes, so Back behaves identically.
+  _openUser(e, userId) {
+    e.preventDefault();
+    const hash = userId ? `#users/${encodeURIComponent(userId)}` : '#users';
+    history.pushState({ page: 'users', user: userId ?? undefined }, '', hash);
+    window.dispatchEvent(new CustomEvent('llm-page-change', { detail: { page: 'users' } }));
   }
 
   // ── Render ─────────────────────────────────────────────────────────────────
@@ -318,6 +306,7 @@ export class PluginDetailPage extends LightElement {
   }
 
   _renderAccess() {
+    const granted = (this._access ?? []).filter(u => u.granted);
     return html`
       <div style="margin-top:1.75rem">
         <div class="um-header" style="padding:0 0 .5rem">
@@ -326,27 +315,25 @@ export class PluginDetailPage extends LightElement {
         <div class="text-muted mb-2" style="font-size:.78rem">${t('plugins.access.desc')}</div>
         ${this._accessErr ? html`
           <div class="alert alert-danger py-2 mb-3" style="font-size:.82rem">${this._accessErr}</div>` : nothing}
-        ${this._accessSaved ? html`
-          <div class="alert alert-success py-2 mb-3" style="font-size:.82rem">${t('plugins.saved')}</div>` : nothing}
         ${this._access === null
           ? html`<div style="font-size:.8rem"><i class="bi bi-hourglass-split"></i></div>`
-          : this._access.length === 0
-            ? html`<div class="um-empty" style="padding:1rem"><i class="bi bi-people"></i><p>${t('plugins.access.empty')}</p></div>`
-            : html`
-              <div class="connector-card" style="cursor:default">
-                ${this._access.map(u => html`
-                  <div class="form-check">
-                    <input class="form-check-input" type="checkbox" id="plugin-access-${u.user_id}"
-                      .checked=${this._accessSel.has(u.user_id)}
-                      @change=${(e) => this._toggleAccessUser(u.user_id, e.target.checked)} />
-                    <label class="form-check-label" for="plugin-access-${u.user_id}">
-                      ${u.username} <code class="text-muted" style="font-size:.7rem">${u.role_id}</code>
-                    </label>
-                  </div>`)}
-              </div>
-              <button class="btn btn-sm btn-primary mt-2" @click=${() => this._saveAccess()}>
-                <i class="bi bi-check-lg me-1"></i>${t('plugins.access.save')}
-              </button>`}
+          : html`
+            ${granted.length === 0
+              ? html`<div class="um-empty" style="padding:1rem"><i class="bi bi-people"></i>
+                  <p>${t('plugins.access.nobody')}</p></div>`
+              : html`
+                <div class="connector-card" style="cursor:default">
+                  ${granted.map(u => html`
+                    <div class="d-flex align-items-center gap-2" style="font-size:.85rem;padding:.15rem 0">
+                      <i class="bi bi-person text-muted"></i>
+                      <a href="#users/${encodeURIComponent(u.user_id)}"
+                         @click=${(e) => this._openUser(e, u.user_id)}>${u.username}</a>
+                      <code class="text-muted" style="font-size:.7rem">${u.role_id}</code>
+                    </div>`)}
+                </div>`}
+            <a class="btn btn-sm btn-outline-secondary mt-2" href="#users" @click=${(e) => this._openUser(e, null)}>
+              <i class="bi bi-box-arrow-up-right me-1"></i>${t('plugins.access.manage')}
+            </a>`}
       </div>`;
   }
 }

web/components/users-page.js

@@ -11,12 +11,15 @@ import { connectorIconUrl }       from './shared/connector-common.js';
 // viewport with no scroll. Same failure the connector activation and manual-add
 // dialogs had, same fix — a page scrolls, and leaving it is a deliberate
 // navigation. Edit and password followed, so everything about one user lives in
-// one place: Profile, Connectors, Security. Only **create** stays a modal — it is
-// three fields and a role, it fits.
+// one place: Profile, Connectors, Plugins, Security. Only **create** stays a modal
+// — it is three fields and a role, it fits.
 //
-// The connectors section mirrors the Connectors page's row list (icon, name,
-// description) so the admin reads one vocabulary everywhere; saving replaces the
-// whole grant set, like the plugin-detail access checklist.
+// Both grant sections answer the same question — *what may this person use* — so
+// they read the same way: the Connectors page's row list (icon, name, description),
+// a chip for anything not enabled instance-wide, and a save that replaces the whole
+// grant set. Plugins moved here from the plugin's own page for that reason: granted
+// plugin-by-plugin, "what does this person have?" meant opening every plugin in
+// turn, and the answer lived on N pages instead of one.
 
 // Stable per-user avatar color: same user, same hue, everywhere (same hash as the
 // topbar avatar — duplicated, it is three lines and the topbar does not export it).
@@ -42,10 +45,12 @@ export class UsersPage extends LightElement {
       _conns:     { state: true },  // working copy of the user's connector grants
       _connQ:     { state: true },
       _noIcon:    { state: true },  // connector names whose icon failed to load
+      _plugs:     { state: true },  // working copy of the user's plugin grants
       _busy:      { state: true },
       _dSaved:    { state: true },  // "saved" ticks, one per section
       _pwSaved:   { state: true },
       _connSaved: { state: true },
+      _plugSaved: { state: true },
     };
   }
 
@@ -67,10 +72,12 @@ export class UsersPage extends LightElement {
     this._dPw    = '';
     this._conns  = null;
     this._connQ  = '';
+    this._plugs  = null;
     this._busy      = false;
     this._dSaved    = false;
     this._pwSaved   = false;
     this._connSaved = false;
+    this._plugSaved = false;
   }
 
   connectedCallback() {
@@ -137,9 +144,14 @@ export class UsersPage extends LightElement {
     };
     this._dPw = '';
     try {
-      const res = await fetch(`/api/users/${encodeURIComponent(u.id)}/connectors`);
-      if (!res.ok) throw new Error(await res.text());
-      this._conns = await res.json();
+      const [cRes, pRes] = await Promise.all([
+        fetch(`/api/users/${encodeURIComponent(u.id)}/connectors`),
+        fetch(`/api/users/${encodeURIComponent(u.id)}/plugins`),
+      ]);
+      if (!cRes.ok) throw new Error(await cRes.text());
+      if (!pRes.ok) throw new Error(await pRes.text());
+      this._conns = await cRes.json();
+      this._plugs = await pRes.json();
     } catch (e) { this._error = e.message; }
   }
 
@@ -259,6 +271,29 @@ export class UsersPage extends LightElement {
     finally { this._busy = false; }
   }
 
+  // ── Detail: plugins ──────────────────────────────────────────────────────────
+
+  _togglePlug(idx) {
+    this._plugs = this._plugs.map((p, i) => i === idx ? { ...p, granted: !p.granted } : p);
+    this._plugSaved = false;
+  }
+
+  async _savePlugins() {
+    const u = this._user;
+    const plugin_ids = this._plugs.filter(p => p.granted).map(p => p.id);
+    this._busy = true; this._error = null;
+    try {
+      const res = await fetch(`/api/users/${encodeURIComponent(u.id)}/plugins`, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ plugin_ids }),
+      });
+      if (!res.ok) throw new Error(await res.text());
+      this._plugSaved = true;
+    } catch (e) { this._error = e.message; }
+    finally { this._busy = false; }
+  }
+
   // ── Detail: security ──────────────────────────────────────────────────────────
 
   async _resetPassword() {
@@ -390,6 +425,7 @@ export class UsersPage extends LightElement {
             <div class="alert alert-danger py-2 mb-3" style="font-size:.85rem">${this._error}</div>` : nothing}
           ${this._renderProfile(u)}
           ${this._renderConnectors(u)}
+          ${this._renderPlugins(u)}
           ${this._renderSecurity(u)}
         </div>
       </div>`;
@@ -546,6 +582,56 @@ export class UsersPage extends LightElement {
       </div>`;
   }
 
+  // Deliberately unfiltered, unlike the connectors above: a plugin ships in the
+  // binary, so the list is short and a search box over it is furniture. Plugins
+  // that gate access through their own pairing (Mobile Connector) never reach
+  // here — the server omits them, since a checkbox would control nothing.
+  _renderPlugins(u) {
+    const plugs = this._plugs;
+    // An admin holds every enabled plugin implicitly (`list_accessible` short-
+    // circuits on the role), so unticked boxes here would read as "no access".
+    const isAdmin = u.role_id === 'admin';
+    return html`
+      <div class="ud-section">
+        <h3 class="ud-section-title"><i class="bi bi-puzzle me-2"></i>${t('users.detail.plugins')}</h3>
+        ${isAdmin ? html`
+          <div class="alert alert-info py-2 mb-2" style="font-size:.8rem">
+            <i class="bi bi-info-circle me-1"></i>${t('users.plug.admin_note')}
+          </div>` : nothing}
+        ${plugs === null
+          ? html`<div class="um-empty" style="padding:1rem"><i class="bi bi-hourglass-split"></i> ${t('users.loading')}</div>`
+          : plugs.length === 0
+            ? html`<div class="um-empty" style="padding:1rem"><i class="bi bi-puzzle"></i><p>${t('users.plug.empty')}</p></div>`
+            : html`
+              <div class="form-text mb-2" style="font-size:.75rem">${t('users.plug.hint')}</div>
+              <div class="connector-list">
+                ${plugs.map((p, i) => html`
+                  <label class="connector-row" style="cursor:pointer">
+                    <input class="form-check-input" type="checkbox"
+                      .checked=${p.granted} @change=${() => this._togglePlug(i)} />
+                    <div class="connector-card-icon connector-card-icon--empty"><i class="bi bi-puzzle"></i></div>
+                    <div class="connector-row-main">
+                      <div class="connector-row-name">
+                        <span>${p.name}</span>
+                        <span class="connector-row-sub">${p.id}</span>
+                      </div>
+                      ${p.description ? html`<div class="connector-row-desc">${p.description}</div>` : nothing}
+                    </div>
+                    <div class="connector-row-chips">
+                      ${p.enabled ? nothing : html`
+                        <span class="connector-chip"><i class="bi bi-pause-circle"></i>${t('users.conn.disabled')}</span>`}
+                    </div>
+                  </label>`)}
+              </div>
+              <div class="d-flex align-items-center gap-2 mt-3">
+                <button class="btn btn-sm btn-primary" ?disabled=${this._busy} @click=${() => this._savePlugins()}>
+                  <i class="bi bi-check-lg me-1"></i>${t('users.modal.save_btn')}
+                </button>
+                ${this._plugSaved ? html`<span class="ud-saved"><i class="bi bi-check2"></i>${t('users.detail.saved')}</span>` : nothing}
+              </div>`}
+      </div>`;
+  }
+
   _renderSecurity(u) {
     return html`
       <div class="ud-section">

web/i18n/en.js

@@ -892,9 +892,9 @@ export default {
   'plugin_page.loading':       'Loading…',
   'plugin_page.unavailable':   'This page is not available (plugin disabled or page not granted).',
   'plugins.badge.user_page':   'user page',
-  'plugins.access.desc':       'Tick a box to let that person see and configure this plugin. Saving replaces the whole list.',
-  'plugins.access.empty':      'No users.',
-  'plugins.access.save':       'Save access',
+  'plugins.access.desc':       'Who can see and use this plugin. Access is granted on each person\'s own page, next to their connectors. Admins always have access.',
+  'plugins.access.nobody':     'Nobody has been granted this plugin yet.',
+  'plugins.access.manage':     'Manage access from Users',
   'plugins.error.required':    '"{field}" is required.',
   'plugins.catalog.configure': 'Configure',
   'plugins.health.ok':           'active',
@@ -1065,6 +1065,7 @@ export default {
   'users.detail.back':                 'Users',
   'users.detail.profile':              'Profile',
   'users.detail.connectors':           'Connectors',
+  'users.detail.plugins':              'Plugins',
   'users.detail.security':             'Security',
   'users.detail.saved':                'Saved',
   'users.detail.delete_hint':          'Deletes this user, their database and all conversation history.',
@@ -1077,6 +1078,10 @@ export default {
   'users.conn.empty':                  'No connectors registered yet.',
   'users.conn.disabled':               'disabled',
 
+  'users.plug.hint':                   'Tick a plugin to let this user see and use it. A disabled plugin can be granted now and will appear once you enable it.',
+  'users.plug.empty':                  'No plugins available.',
+  'users.plug.admin_note':             'Admins can use every enabled plugin, whatever is ticked here.',
+
   'users.modal.create_title':          'New user',
   'users.modal.username':              'Username',
   'users.modal.display_name':          'Display name',

web/i18n/fr.js

@@ -882,9 +882,9 @@ export default {
   'plugin_page.loading':       'Chargement…',
   'plugin_page.unavailable':   'Page non disponible (plugin désactivé ou page non accordée).',
   'plugins.badge.user_page':   'page utilisateur',
-  'plugins.access.desc':       "Cochez qui peut voir et configurer ce plugin. L'enregistrement remplace toute la liste.",
-  'plugins.access.empty':      'Aucun utilisateur.',
-  'plugins.access.save':       'Enregistrer les accès',
+  'plugins.access.desc':       "Qui peut voir et utiliser ce plugin. L'accès se donne depuis la page de chaque personne, à côté de ses connecteurs. Les administrateurs y ont toujours accès.",
+  'plugins.access.nobody':     "Personne n'a encore accès à ce plugin.",
+  'plugins.access.manage':     'Gérer les accès depuis Utilisateurs',
   'plugins.error.required':    '« {field} » est requis.',
   'plugins.catalog.configure': 'Configurer',
   'plugins.health.ok':           'actif',
@@ -1052,6 +1052,7 @@ export default {
   'users.detail.back':                 'Utilisateurs',
   'users.detail.profile':              'Profil',
   'users.detail.connectors':           'Connecteurs',
+  'users.detail.plugins':              'Plugins',
   'users.detail.security':             'Sécurité',
   'users.detail.saved':                'Enregistré',
   'users.detail.delete_hint':          'Supprime cet utilisateur, sa base de données et tout l\'historique des conversations.',
@@ -1064,6 +1065,10 @@ export default {
   'users.conn.empty':                  'Aucun connecteur enregistré pour le moment.',
   'users.conn.disabled':               'désactivé',
 
+  'users.plug.hint':                   "Cochez les plugins que cet utilisateur peut voir et utiliser. Un plugin désactivé peut être accordé dès maintenant : il apparaîtra quand vous l'activerez.",
+  'users.plug.empty':                  'Aucun plugin disponible.',
+  'users.plug.admin_note':             "Les administrateurs peuvent utiliser tout plugin activé, quelles que soient les cases cochées ici.",
+
   'users.modal.create_title':          'Nouvel utilisateur',
   'users.modal.username':              'Nom d\'utilisateur',
   'users.modal.display_name':          'Nom d\'affichage',

web/i18n/it.js

@@ -882,9 +882,9 @@ export default {
   'plugin_page.loading':       'Caricamento…',
   'plugin_page.unavailable':   'Pagina non disponibile (plugin disabilitato o pagina non concessa).',
   'plugins.badge.user_page':   'pagina utente',
-  'plugins.access.desc':       "Seleziona chi può vedere e configurare questo plugin. Il salvataggio sostituisce l'intera lista.",
-  'plugins.access.empty':      'Nessun utente.',
-  'plugins.access.save':       'Salva accesso',
+  'plugins.access.desc':       "Chi può vedere e usare questo plugin. L'accesso si concede dalla pagina della singola persona, accanto ai suoi connettori. Gli amministratori hanno sempre accesso.",
+  'plugins.access.nobody':     'Nessuno ha ancora accesso a questo plugin.',
+  'plugins.access.manage':     'Gestisci gli accessi da Utenti',
   'plugins.error.required':    '"{field}" è obbligatorio.',
   'plugins.catalog.configure': 'Configura',
   'plugins.health.ok':           'attivo',
@@ -1052,6 +1052,7 @@ export default {
   'users.detail.back':                 'Utenti',
   'users.detail.profile':              'Profilo',
   'users.detail.connectors':           'Connettori',
+  'users.detail.plugins':              'Plugin',
   'users.detail.security':             'Sicurezza',
   'users.detail.saved':                'Salvato',
   'users.detail.delete_hint':          'Elimina questo utente, il suo database e tutta la cronologia delle conversazioni.',
@@ -1064,6 +1065,10 @@ export default {
   'users.conn.empty':                  'Nessun connettore ancora registrato.',
   'users.conn.disabled':               'disabilitato',
 
+  'users.plug.hint':                   "Seleziona i plugin che questo utente può vedere e usare. Un plugin disabilitato può essere concesso ora: comparirà appena lo abiliti.",
+  'users.plug.empty':                  'Nessun plugin disponibile.',
+  'users.plug.admin_note':             'Gli amministratori possono usare qualsiasi plugin abilitato, indipendentemente da ciò che è selezionato qui.',
+
   'users.modal.create_title':          'Nuovo utente',
   'users.modal.username':              'Nome utente',
   'users.modal.display_name':          'Nome visualizzato',