feat: open the last locked fields for editing, keeping their history intact

Four fields were still frozen because changing them would have bypassed the
record that makes the change traceable, and a user's login data could not be
corrected at all. Locking a field is the wrong trade: a wrong value stays in
the system forever. The fix is to let the edit write the same history entry the
dedicated endpoint writes.

- A colony's apiary is editable through PATCH and writes the same
  ColonyApiaryHistory entry POST /colonies/:id/move writes, so the location
  history never skips a stand the colony was recorded on.
- A honey batch's storage container is editable through PATCH and writes the
  same HoneyBatchRelocation entry POST /honey-batches/:id/relocate writes.
- A stock item's quantity is editable and books the difference as an ADJUSTMENT
  movement, so the stored level stays the sum of its movements.
- A role's key is editable (system roles were already rejected outright by
  RolesService.update, which keeps the seed's ADMIN lookup intact).
- A user's e-mail - the login identity - is editable. A typo there previously
  locked the account out for good.
- New POST /users/:id/reset-password lets an administrator set someone else's
  password: there is no self-service reset flow, so a forgotten password was
  the one thing no edit could repair. It revokes every refresh token and clears
  the permission cache exactly as a self-service change does, refuses to act on
  your own account (that goes through /profile/password, which proves ownership
  by asking for the current one), and never writes the password to the log.

Frontend:
- Users had no edit UI at all, although PATCH /users/:id existed. New
  EditUserDialog covers name, e-mail, role and an optional new password.
- Colony, honey batch and stock item forms gained the newly editable fields,
  each with a note saying the correction is recorded as a move, a relocation
  or a stock adjustment.
- The role dialog gained the key field.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/users/dto/reset-user-password.dto.ts

@@ -0,0 +1,15 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsString, MinLength } from 'class-validator';
+
+/**
+ * An administrator setting a new password for someone else. There is no
+ * self-service password-reset flow, so without this a user who forgets their
+ * password is locked out of the account for good - the one correction the
+ * generic user update cannot make, since the password is never readable.
+ */
+export class ResetUserPasswordDto {
+  @ApiProperty({ minLength: 8 })
+  @IsString()
+  @MinLength(8)
+  password!: string;
+}

ApiCore-Backend/src/users/dto/update-user.dto.ts

@@ -1,5 +1,5 @@
 import { ApiPropertyOptional } from '@nestjs/swagger';
-import { IsOptional, IsString, MinLength } from 'class-validator';
+import { IsEmail, IsOptional, IsString, MinLength } from 'class-validator';
 
 export class UpdateUserDto {
   @ApiPropertyOptional()
@@ -7,6 +7,18 @@ export class UpdateUserDto {
   @IsString()
   name?: string;
 
+  /**
+   * The e-mail is the login identity, so changing it changes which address
+   * signs in as this account. It is still correctable: a typo would otherwise
+   * lock the account out for good, and there is no password-reset flow that a
+   * changed address could be abused to trigger. A duplicate is rejected by the
+   * unique constraint and surfaces as a 409.
+   */
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsEmail()
+  email?: string;
+
   @ApiPropertyOptional({ description: 'Id of an active Role' })
   @IsOptional()
   @IsString()

ApiCore-Backend/src/users/users.controller.ts

@@ -5,6 +5,7 @@ import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateUserDto } from './dto/create-user.dto';
 import { UpdateUserDto } from './dto/update-user.dto';
+import { ResetUserPasswordDto } from './dto/reset-user-password.dto';
 import { UsersService } from './users.service';
 
 @ApiTags('users')
@@ -53,6 +54,16 @@ export class UsersController {
     return this.usersService.activate(id, actor.id);
   }
 
+  @RequirePermission('users:update')
+  @Post(':id/reset-password')
+  resetPassword(
+    @Param('id') id: string,
+    @Body() dto: ResetUserPasswordDto,
+    @CurrentUser() actor: AuthenticatedUser,
+  ) {
+    return this.usersService.resetPassword(id, dto, actor.id);
+  }
+
   @RequirePermission('users:update')
   @Post(':id/mfa/reset')
   resetMfa(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {

ApiCore-Backend/src/users/users.service.spec.ts

@@ -21,6 +21,7 @@ describe('UsersService', () => {
     role: {
       findUnique: jest.Mock;
     };
+    refreshToken: { updateMany: jest.Mock };
   };
   let auditLog: { record: jest.Mock };
   let permissionResolver: {
@@ -77,6 +78,7 @@ describe('UsersService', () => {
       role: {
         findUnique: jest.fn().mockResolvedValue(staffRole),
       },
+      refreshToken: { updateMany: jest.fn() },
     };
     auditLog = { record: jest.fn().mockResolvedValue(undefined) };
     permissionResolver = {
@@ -379,4 +381,53 @@ describe('UsersService', () => {
     ).rejects.toBeInstanceOf(ForbiddenException);
     expect(prisma.user.update).not.toHaveBeenCalled();
   });
+
+  describe('resetPassword', () => {
+    it('revokes every refresh token and clears the permission cache', async () => {
+      prisma.user.findUnique.mockResolvedValue(existingUser);
+      prisma.user.update.mockResolvedValue(existingUser);
+
+      await usersService.resetPassword(
+        'user-1',
+        { password: 'neuesPasswort1' },
+        'user-admin',
+      );
+
+      expect(prisma.refreshToken.updateMany).toHaveBeenCalledWith({
+        where: { userId: 'user-1', revokedAt: null },
+        data: { revokedAt: expect.any(Date) as Date },
+      });
+      expect(permissionResolver.invalidateUser).toHaveBeenCalledWith('user-1');
+    });
+
+    it('stores a hash, never the password itself', async () => {
+      prisma.user.findUnique.mockResolvedValue(existingUser);
+      prisma.user.update.mockResolvedValue(existingUser);
+
+      await usersService.resetPassword(
+        'user-1',
+        { password: 'neuesPasswort1' },
+        'user-admin',
+      );
+
+      const [[updateArgs]] = prisma.user.update.mock.calls as [
+        [{ data: { passwordHash: string } }],
+      ];
+      expect(updateArgs.data.passwordHash).not.toBe('neuesPasswort1');
+      expect(updateArgs.data.passwordHash).toMatch(/^\$2[aby]\$/);
+    });
+
+    it('refuses to reset your own password, which belongs to /profile/password', async () => {
+      prisma.user.findUnique.mockResolvedValue(existingUser);
+
+      await expect(
+        usersService.resetPassword(
+          'user-1',
+          { password: 'neuesPasswort1' },
+          'user-1',
+        ),
+      ).rejects.toBeInstanceOf(ForbiddenException);
+      expect(prisma.user.update).not.toHaveBeenCalled();
+    });
+  });
 });

ApiCore-Backend/src/users/users.service.ts

@@ -11,6 +11,7 @@ import { PermissionResolverService } from '../auth/permissions/permission-resolv
 import { Prisma } from '../../generated/prisma';
 import { CreateUserDto } from './dto/create-user.dto';
 import { UpdateUserDto } from './dto/update-user.dto';
+import { ResetUserPasswordDto } from './dto/reset-user-password.dto';
 
 const BCRYPT_SALT_ROUNDS = 12;
 
@@ -194,6 +195,7 @@ export class UsersService {
       where: { id },
       data: {
         name: dto.name,
+        email: dto.email,
         roleId: dto.roleId,
       },
       ...USER_WITH_ROLE,
@@ -240,6 +242,49 @@ export class UsersService {
    * a stolen access token alone (no password) would be enough to strip the
    * victim's own MFA protection via this admin route.
    */
+  /**
+   * Sets a new password for another user. Mirrors ProfileService.changePassword
+   * in what it invalidates: every refresh token is revoked and the permission
+   * cache is cleared, so sessions opened with the old password stop working at
+   * once rather than living on until their access token expires.
+   *
+   * Your own password goes through /profile/password, which requires the
+   * current one - otherwise anyone holding users:update could silently take
+   * over their own account's credentials without proving they own it.
+   */
+  async resetPassword(
+    id: string,
+    dto: ResetUserPasswordDto,
+    actingUserId?: string,
+  ): Promise<UserSummary> {
+    if (actingUserId && id === actingUserId) {
+      throw new ForbiddenException(
+        'Use /profile/password to change your own password',
+      );
+    }
+    await this.findById(id);
+    const passwordHash = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
+    const user = await this.prisma.user.update({
+      where: { id },
+      data: { passwordHash, passwordChangedAt: new Date() },
+      ...USER_WITH_ROLE,
+    });
+    await this.prisma.refreshToken.updateMany({
+      where: { userId: id, revokedAt: null },
+      data: { revokedAt: new Date() },
+    });
+    this.permissionResolver.invalidateUser(id);
+    // The new password never reaches the audit log - only the fact that it
+    // was replaced, and by whom.
+    await this.auditLog.record({
+      entityType: 'User',
+      entityId: id,
+      action: 'UPDATE',
+      userId: actingUserId,
+    });
+    return this.toSummary(user);
+  }
+
   async resetMfa(id: string, actingUserId?: string): Promise<UserSummary> {
     if (actingUserId && id === actingUserId) {
       throw new ForbiddenException(