feat: open the last locked fields for editing, keeping their history intact

Four fields were still frozen because changing them would have bypassed the
record that makes the change traceable, and a user's login data could not be
corrected at all. Locking a field is the wrong trade: a wrong value stays in
the system forever. The fix is to let the edit write the same history entry the
dedicated endpoint writes.

- A colony's apiary is editable through PATCH and writes the same
  ColonyApiaryHistory entry POST /colonies/:id/move writes, so the location
  history never skips a stand the colony was recorded on.
- A honey batch's storage container is editable through PATCH and writes the
  same HoneyBatchRelocation entry POST /honey-batches/:id/relocate writes.
- A stock item's quantity is editable and books the difference as an ADJUSTMENT
  movement, so the stored level stays the sum of its movements.
- A role's key is editable (system roles were already rejected outright by
  RolesService.update, which keeps the seed's ADMIN lookup intact).
- A user's e-mail - the login identity - is editable. A typo there previously
  locked the account out for good.
- New POST /users/:id/reset-password lets an administrator set someone else's
  password: there is no self-service reset flow, so a forgotten password was
  the one thing no edit could repair. It revokes every refresh token and clears
  the permission cache exactly as a self-service change does, refuses to act on
  your own account (that goes through /profile/password, which proves ownership
  by asking for the current one), and never writes the password to the log.

Frontend:
- Users had no edit UI at all, although PATCH /users/:id existed. New
  EditUserDialog covers name, e-mail, role and an optional new password.
- Colony, honey batch and stock item forms gained the newly editable fields,
  each with a note saying the correction is recorded as a move, a relocation
  or a stock adjustment.
- The role dialog gained the key field.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/colonies/colonies.service.spec.ts

@@ -336,4 +336,32 @@ describe('ColoniesService', () => {
       expect.objectContaining({ action: 'UPDATE' }),
     );
   });
+
+  it('writes an apiary-history entry when an edit corrects the apiary', async () => {
+    prisma.colony.findUnique.mockResolvedValue(parentColony);
+    tx.colony.update.mockResolvedValue({
+      ...parentColony,
+      apiaryId: 'apiary-2',
+    });
+
+    await service.update('colony-1', { apiaryId: 'apiary-2' }, 'user-1');
+
+    expect(tx.colonyApiaryHistory.create).toHaveBeenCalledWith({
+      data: {
+        colonyId: 'colony-1',
+        apiaryId: 'apiary-2',
+        movedByUserId: 'user-1',
+        notes: 'Korrektur über Volk bearbeiten',
+      },
+    });
+  });
+
+  it('writes no apiary-history entry when an edit leaves the apiary untouched', async () => {
+    prisma.colony.findUnique.mockResolvedValue(parentColony);
+    tx.colony.update.mockResolvedValue(parentColony);
+
+    await service.update('colony-1', { notes: 'geändert' }, 'user-1');
+
+    expect(tx.colonyApiaryHistory.create).not.toHaveBeenCalled();
+  });
 });

ApiCore-Backend/src/colonies/colonies.service.ts

@@ -90,9 +90,31 @@ export class ColoniesService {
     actingUserId: string,
   ): Promise<Colony> {
     const before = await this.findById(id);
-    const colony = await this.prisma.colony.update({
-      where: { id },
-      data: { ...dto },
+    const movesApiary =
+      dto.apiaryId !== undefined && dto.apiaryId !== before.apiaryId;
+    if (movesApiary) {
+      await this.assertApiaryActive(dto.apiaryId!);
+    }
+
+    const colony = await this.prisma.$transaction(async (tx) => {
+      const updated = await tx.colony.update({
+        where: { id },
+        data: { ...dto },
+      });
+      // Correcting the apiary has to leave the same trace a deliberate move
+      // does - otherwise the colony's location history would silently skip a
+      // stand it was recorded on.
+      if (movesApiary) {
+        await tx.colonyApiaryHistory.create({
+          data: {
+            colonyId: id,
+            apiaryId: updated.apiaryId,
+            movedByUserId: actingUserId,
+            notes: 'Korrektur über Volk bearbeiten',
+          },
+        });
+      }
+      return updated;
     });
     await this.auditLog.record({
       entityType: 'Colony',

ApiCore-Backend/src/colonies/dto/update-colony.dto.ts

@@ -4,13 +4,14 @@ import { ColonyStatus } from '../../../generated/prisma';
 import { CreateColonyDto } from './create-colony.dto';
 
 /**
- * `apiaryId` is deliberately absent: moving a colony to another apiary runs
- * through POST /colonies/:id/move, which also writes the ColonyApiaryHistory
- * entry the traceability chain depends on. A plain PATCH would move the
- * colony without that record.
+ * `apiaryId` is editable here too, not only through POST /colonies/:id/move:
+ * a colony recorded on the wrong apiary is a data-entry error and must be
+ * correctable. The service writes the same ColonyApiaryHistory entry the move
+ * endpoint writes, so the traceability chain stays intact either way.
  */
 class UpdatableColonyFieldsDto extends PartialType(
   PickType(CreateColonyDto, [
+    'apiaryId',
     'code',
     'hiveType',
     'originText',

ApiCore-Backend/src/honey-batches/dto/update-honey-batch.dto.ts

@@ -4,10 +4,10 @@ import { HoneyBatchStatus } from '../../../generated/prisma';
 import { CreateHoneyBatchDto } from './create-honey-batch.dto';
 
 /**
- * `storageContainerId` is deliberately absent: moving a batch to another
- * container runs through POST /honey-batches/:id/relocate, which also writes
- * the HoneyBatchRelocation entry. A plain PATCH would move the honey without
- * that record.
+ * `storageContainerId` is editable here too, not only through
+ * POST /honey-batches/:id/relocate: a batch recorded in the wrong container is
+ * a data-entry error and must be correctable. The service writes the same
+ * HoneyBatchRelocation entry the relocate endpoint writes.
  */
 class UpdatableHoneyBatchFieldsDto extends PartialType(
   PickType(CreateHoneyBatchDto, [
@@ -16,6 +16,7 @@ class UpdatableHoneyBatchFieldsDto extends PartialType(
     'honeyType',
     'amount',
     'waterContent',
+    'storageContainerId',
   ] as const),
 ) {}
 

ApiCore-Backend/src/honey-batches/honey-batches.service.spec.ts

@@ -354,4 +354,48 @@ describe('HoneyBatchesService', () => {
       );
     });
   });
+
+  describe('update', () => {
+    beforeEach(() => {
+      prisma.$transaction.mockImplementation(
+        async (
+          callback: (tx: typeof prisma) => Promise<unknown>,
+        ): Promise<unknown> => callback(prisma),
+      );
+    });
+
+    it('records a relocation when an edit corrects the storage container', async () => {
+      prisma.honeyBatch.findUnique.mockResolvedValue({
+        ...honeyBatch,
+        storageContainerId: 'container-1',
+      });
+
+      await service.update(
+        'batch-1',
+        { storageContainerId: 'container-2' },
+        'user-1',
+      );
+
+      expect(prisma.honeyBatchRelocation.create).toHaveBeenCalledWith({
+        data: {
+          honeyBatchId: 'batch-1',
+          fromStorageContainerId: 'container-1',
+          toStorageContainerId: 'container-2',
+          userId: 'user-1',
+          notes: 'Korrektur über Honigcharge bearbeiten',
+        },
+      });
+    });
+
+    it('records no relocation when an edit leaves the container untouched', async () => {
+      prisma.honeyBatch.findUnique.mockResolvedValue({
+        ...honeyBatch,
+        storageContainerId: 'container-1',
+      });
+
+      await service.update('batch-1', { honeyType: 'Waldhonig' }, 'user-1');
+
+      expect(prisma.honeyBatchRelocation.create).not.toHaveBeenCalled();
+    });
+  });
 });

ApiCore-Backend/src/honey-batches/honey-batches.service.ts

@@ -86,9 +86,29 @@ export class HoneyBatchesService {
 
   async update(id: string, dto: UpdateHoneyBatchDto, actingUserId: string) {
     const before = await this.findById(id);
-    await this.prisma.honeyBatch.update({
-      where: { id },
-      data: { ...dto },
+    const movesContainer =
+      dto.storageContainerId !== undefined &&
+      dto.storageContainerId !== before.storageContainerId;
+
+    await this.prisma.$transaction(async (tx) => {
+      await tx.honeyBatch.update({
+        where: { id },
+        data: { ...dto },
+      });
+      // Correcting the container has to leave the same trace a deliberate
+      // relocation does - otherwise the batch's storage history would skip a
+      // container it was recorded in.
+      if (movesContainer) {
+        await tx.honeyBatchRelocation.create({
+          data: {
+            honeyBatchId: id,
+            fromStorageContainerId: before.storageContainerId,
+            toStorageContainerId: dto.storageContainerId!,
+            userId: actingUserId,
+            notes: 'Korrektur über Honigcharge bearbeiten',
+          },
+        });
+      }
     });
     const updated = await this.findById(id);
     await this.auditLog.record({

ApiCore-Backend/src/roles/dto/update-role.dto.ts

@@ -15,6 +15,18 @@ import {
 const CATALOG_KEYS = PERMISSION_CATALOG.map((entry) => entry.key);
 
 export class UpdateRoleDto {
+  /**
+   * Correctable like every other field. System roles are out of reach anyway:
+   * RolesService.update rejects them outright, which also keeps the seed's
+   * lookup of the ADMIN role by key intact.
+   */
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsString()
+  @MinLength(2)
+  @MaxLength(50)
+  key?: string;
+
   @ApiPropertyOptional()
   @IsOptional()
   @IsString()

ApiCore-Backend/src/roles/roles.service.ts

@@ -158,7 +158,7 @@ export class RolesService {
     const role = await this.prisma.$transaction(async (tx) => {
       await tx.role.update({
         where: { id },
-        data: { name: dto.name, description: dto.description },
+        data: { key: dto.key, name: dto.name, description: dto.description },
       });
       if (dto.permissionKeys) {
         await this.replacePermissions(tx, id, dto.permissionKeys);

ApiCore-Backend/src/storage/dto/update-stock-item.dto.ts

@@ -1,12 +1,10 @@
-import { PartialType, PickType } from '@nestjs/swagger';
+import { PartialType } from '@nestjs/swagger';
 import { CreateStockItemDto } from './create-stock-item.dto';
 
-export class UpdateStockItemDto extends PartialType(
-  PickType(CreateStockItemDto, [
-    'name',
-    'category',
-    'unit',
-    'minThreshold',
-    'notes',
-  ] as const),
-) {}
+/**
+ * `quantity` is editable here, not only through stock movements: a stock level
+ * typed in wrong has to be correctable directly. The service books the
+ * difference as an ADJUSTMENT movement, so the movement history still adds up
+ * to the stored quantity and nothing is corrected behind its back.
+ */
+export class UpdateStockItemDto extends PartialType(CreateStockItemDto) {}

ApiCore-Backend/src/storage/storage.service.spec.ts

@@ -132,4 +132,28 @@ describe('StorageService', () => {
     ];
     expect(updateArg.data.quantity.increment).toBe(-3);
   });
+
+  it('books the difference as an ADJUSTMENT movement when the stock quantity is corrected', async () => {
+    prisma.stockItem.findUnique.mockResolvedValue(stockItem);
+
+    await service.updateStockItem('item-1', { quantity: 7 }, 'user-1');
+
+    expect(tx.stockMovement.create).toHaveBeenCalledWith({
+      data: {
+        stockItemId: 'item-1',
+        type: 'ADJUSTMENT',
+        quantity: -3,
+        userId: 'user-1',
+        notes: 'Korrektur über Artikel bearbeiten',
+      },
+    });
+  });
+
+  it('books no movement when an edit leaves the stock quantity untouched', async () => {
+    prisma.stockItem.findUnique.mockResolvedValue(stockItem);
+
+    await service.updateStockItem('item-1', { name: 'Futtersirup' }, 'user-1');
+
+    expect(tx.stockMovement.create).not.toHaveBeenCalled();
+  });
 });

ApiCore-Backend/src/storage/storage.service.ts

@@ -106,9 +106,29 @@ export class StorageService {
     actingUserId: string,
   ): Promise<StockItem> {
     const before = await this.findStockItemById(id);
-    const stockItem = await this.prisma.stockItem.update({
-      where: { id },
-      data: { ...dto },
+    const correction =
+      dto.quantity === undefined ? 0 : dto.quantity - before.quantity;
+
+    const stockItem = await this.prisma.$transaction(async (tx) => {
+      const updated = await tx.stockItem.update({
+        where: { id },
+        data: { ...dto },
+      });
+      // Booking the difference keeps the movement history consistent with the
+      // stored quantity - without it, a corrected stock level would no longer
+      // be the sum of its movements.
+      if (correction !== 0) {
+        await tx.stockMovement.create({
+          data: {
+            stockItemId: id,
+            type: 'ADJUSTMENT',
+            quantity: correction,
+            userId: actingUserId,
+            notes: 'Korrektur über Artikel bearbeiten',
+          },
+        });
+      }
+      return updated;
     });
     await this.auditLog.record({
       entityType: 'StockItem',

ApiCore-Backend/src/users/dto/reset-user-password.dto.ts

@@ -0,0 +1,15 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsString, MinLength } from 'class-validator';
+
+/**
+ * An administrator setting a new password for someone else. There is no
+ * self-service password-reset flow, so without this a user who forgets their
+ * password is locked out of the account for good - the one correction the
+ * generic user update cannot make, since the password is never readable.
+ */
+export class ResetUserPasswordDto {
+  @ApiProperty({ minLength: 8 })
+  @IsString()
+  @MinLength(8)
+  password!: string;
+}

ApiCore-Backend/src/users/dto/update-user.dto.ts

@@ -1,5 +1,5 @@
 import { ApiPropertyOptional } from '@nestjs/swagger';
-import { IsOptional, IsString, MinLength } from 'class-validator';
+import { IsEmail, IsOptional, IsString, MinLength } from 'class-validator';
 
 export class UpdateUserDto {
   @ApiPropertyOptional()
@@ -7,6 +7,18 @@ export class UpdateUserDto {
   @IsString()
   name?: string;
 
+  /**
+   * The e-mail is the login identity, so changing it changes which address
+   * signs in as this account. It is still correctable: a typo would otherwise
+   * lock the account out for good, and there is no password-reset flow that a
+   * changed address could be abused to trigger. A duplicate is rejected by the
+   * unique constraint and surfaces as a 409.
+   */
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsEmail()
+  email?: string;
+
   @ApiPropertyOptional({ description: 'Id of an active Role' })
   @IsOptional()
   @IsString()

ApiCore-Backend/src/users/users.controller.ts

@@ -5,6 +5,7 @@ import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateUserDto } from './dto/create-user.dto';
 import { UpdateUserDto } from './dto/update-user.dto';
+import { ResetUserPasswordDto } from './dto/reset-user-password.dto';
 import { UsersService } from './users.service';
 
 @ApiTags('users')
@@ -53,6 +54,16 @@ export class UsersController {
     return this.usersService.activate(id, actor.id);
   }
 
+  @RequirePermission('users:update')
+  @Post(':id/reset-password')
+  resetPassword(
+    @Param('id') id: string,
+    @Body() dto: ResetUserPasswordDto,
+    @CurrentUser() actor: AuthenticatedUser,
+  ) {
+    return this.usersService.resetPassword(id, dto, actor.id);
+  }
+
   @RequirePermission('users:update')
   @Post(':id/mfa/reset')
   resetMfa(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {

ApiCore-Backend/src/users/users.service.spec.ts

@@ -21,6 +21,7 @@ describe('UsersService', () => {
     role: {
       findUnique: jest.Mock;
     };
+    refreshToken: { updateMany: jest.Mock };
   };
   let auditLog: { record: jest.Mock };
   let permissionResolver: {
@@ -77,6 +78,7 @@ describe('UsersService', () => {
       role: {
         findUnique: jest.fn().mockResolvedValue(staffRole),
       },
+      refreshToken: { updateMany: jest.fn() },
     };
     auditLog = { record: jest.fn().mockResolvedValue(undefined) };
     permissionResolver = {
@@ -379,4 +381,53 @@ describe('UsersService', () => {
     ).rejects.toBeInstanceOf(ForbiddenException);
     expect(prisma.user.update).not.toHaveBeenCalled();
   });
+
+  describe('resetPassword', () => {
+    it('revokes every refresh token and clears the permission cache', async () => {
+      prisma.user.findUnique.mockResolvedValue(existingUser);
+      prisma.user.update.mockResolvedValue(existingUser);
+
+      await usersService.resetPassword(
+        'user-1',
+        { password: 'neuesPasswort1' },
+        'user-admin',
+      );
+
+      expect(prisma.refreshToken.updateMany).toHaveBeenCalledWith({
+        where: { userId: 'user-1', revokedAt: null },
+        data: { revokedAt: expect.any(Date) as Date },
+      });
+      expect(permissionResolver.invalidateUser).toHaveBeenCalledWith('user-1');
+    });
+
+    it('stores a hash, never the password itself', async () => {
+      prisma.user.findUnique.mockResolvedValue(existingUser);
+      prisma.user.update.mockResolvedValue(existingUser);
+
+      await usersService.resetPassword(
+        'user-1',
+        { password: 'neuesPasswort1' },
+        'user-admin',
+      );
+
+      const [[updateArgs]] = prisma.user.update.mock.calls as [
+        [{ data: { passwordHash: string } }],
+      ];
+      expect(updateArgs.data.passwordHash).not.toBe('neuesPasswort1');
+      expect(updateArgs.data.passwordHash).toMatch(/^\$2[aby]\$/);
+    });
+
+    it('refuses to reset your own password, which belongs to /profile/password', async () => {
+      prisma.user.findUnique.mockResolvedValue(existingUser);
+
+      await expect(
+        usersService.resetPassword(
+          'user-1',
+          { password: 'neuesPasswort1' },
+          'user-1',
+        ),
+      ).rejects.toBeInstanceOf(ForbiddenException);
+      expect(prisma.user.update).not.toHaveBeenCalled();
+    });
+  });
 });

ApiCore-Backend/src/users/users.service.ts

@@ -11,6 +11,7 @@ import { PermissionResolverService } from '../auth/permissions/permission-resolv
 import { Prisma } from '../../generated/prisma';
 import { CreateUserDto } from './dto/create-user.dto';
 import { UpdateUserDto } from './dto/update-user.dto';
+import { ResetUserPasswordDto } from './dto/reset-user-password.dto';
 
 const BCRYPT_SALT_ROUNDS = 12;
 
@@ -194,6 +195,7 @@ export class UsersService {
       where: { id },
       data: {
         name: dto.name,
+        email: dto.email,
         roleId: dto.roleId,
       },
       ...USER_WITH_ROLE,
@@ -240,6 +242,49 @@ export class UsersService {
    * a stolen access token alone (no password) would be enough to strip the
    * victim's own MFA protection via this admin route.
    */
+  /**
+   * Sets a new password for another user. Mirrors ProfileService.changePassword
+   * in what it invalidates: every refresh token is revoked and the permission
+   * cache is cleared, so sessions opened with the old password stop working at
+   * once rather than living on until their access token expires.
+   *
+   * Your own password goes through /profile/password, which requires the
+   * current one - otherwise anyone holding users:update could silently take
+   * over their own account's credentials without proving they own it.
+   */
+  async resetPassword(
+    id: string,
+    dto: ResetUserPasswordDto,
+    actingUserId?: string,
+  ): Promise<UserSummary> {
+    if (actingUserId && id === actingUserId) {
+      throw new ForbiddenException(
+        'Use /profile/password to change your own password',
+      );
+    }
+    await this.findById(id);
+    const passwordHash = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
+    const user = await this.prisma.user.update({
+      where: { id },
+      data: { passwordHash, passwordChangedAt: new Date() },
+      ...USER_WITH_ROLE,
+    });
+    await this.prisma.refreshToken.updateMany({
+      where: { userId: id, revokedAt: null },
+      data: { revokedAt: new Date() },
+    });
+    this.permissionResolver.invalidateUser(id);
+    // The new password never reaches the audit log - only the fact that it
+    // was replaced, and by whom.
+    await this.auditLog.record({
+      entityType: 'User',
+      entityId: id,
+      action: 'UPDATE',
+      userId: actingUserId,
+    });
+    return this.toSummary(user);
+  }
+
   async resetMfa(id: string, actingUserId?: string): Promise<UserSummary> {
     if (actingUserId && id === actingUserId) {
       throw new ForbiddenException(