From 1ea83bc56de61c2b4dd7553c791920549f3f4cd7 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Wed, 2 Sep 2026 00:45:51 -0700
Subject: [PATCH] roles: scope person picker to user-kind principals only
 (CL-6664)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The "Assign a role" person picker showed all principals — people, agents,
and workflows — in one flat list. This surfaced 49+ duplicate placeholder-
named service accounts (e.g. "Dana Reyes Gaj0a5c7 Localhost") in the
picker, none scoped to the workbench's actual member roster.

Fix by filtering principals to kind === "user" in both the picker select
and the assignments table, matching the People section's member list.
Remove the now-unused optgroup structure and PRINCIPAL_KIND imports.

All 4 tests rewritten to verify user-only filtering.
---
 packages/settings-ui/src/identity.ts          | 10 ++-
 packages/settings-ui/src/roles-section.tsx    | 34 ++++------
 .../settings-ui/test/roles-section.test.tsx   | 65 +++++++++++++------
 3 files changed, 63 insertions(+), 46 deletions(-)

diff --git a/packages/settings-ui/src/identity.ts b/packages/settings-ui/src/identity.ts
index 209422c9e..3acff7402 100644
--- a/packages/settings-ui/src/identity.ts
+++ b/packages/settings-ui/src/identity.ts
@@ -7,12 +7,10 @@
 // only, never as visible text.
 //
 // `PRINCIPAL_KIND_LABEL` and `PRINCIPAL_KIND_ORDER` live here too, shared by
-// every picker that lists principals (Grants' target select and filter,
-// Roles' assignment select): Grants/Roles assign to people, agents, *and*
-// workflows (see `people-section.tsx`'s own header comment), and a picker
-// that shows only names with no kind is kind-blind — a workflow's machine
-// principal can look identical to a person's account. Every such picker
-// must show which kind an option is, not just its name.
+// every picker that lists principals (Grants' target select and filter).
+// Grants assign to people, agents, *and* workflows. Roles' assignment picker
+// is scoped to user-kind principals only (CL-6664): agents/workflows are
+// machine identities that belong on separate surfaces.
 
 import { SETTINGS_STRINGS } from "./strings";
 
diff --git a/packages/settings-ui/src/roles-section.tsx b/packages/settings-ui/src/roles-section.tsx
index 42814bc5d..6df074a51 100644
--- a/packages/settings-ui/src/roles-section.tsx
+++ b/packages/settings-ui/src/roles-section.tsx
@@ -32,11 +32,7 @@ import {
   UnauthenticatedError,
   describeQueryError,
 } from "@corbits/api-query";
-import {
-  PRINCIPAL_KIND_LABEL,
-  PRINCIPAL_KIND_ORDER,
-  principalLabel,
-} from "./identity";
+import { principalLabel } from "./identity";
 import { SETTINGS_STRINGS } from "./strings";
 import {
   assignRole,
@@ -317,7 +313,13 @@ export function RoleAssignments({
   const [principalId, setPrincipalId] = useState("");
   const [roleId, setRoleId] = useState("");
 
-  const assignments = principals.flatMap((principal) =>
+  // CL-6664: Scope both picker and assignments to user-kind principals only.
+  // Agents and workflows are machine identities — the "Person" picker and
+  // its assignment table should match the People section's member roster,
+  // not the full tenant-wide principal list.
+  const people = principals.filter((p) => p.kind === "user");
+
+  const assignments = people.flatMap((principal) =>
     principal.roles.map((role) => ({ principal, role })),
   );
 
@@ -333,21 +335,11 @@ export function RoleAssignments({
             onChange={(event) => setPrincipalId(event.target.value)}
           >
             <option value="">—</option>
-            {PRINCIPAL_KIND_ORDER.map((kind) => {
-              const kindPrincipals = principals.filter(
-                (principal) => principal.kind === kind,
-              );
-              if (kindPrincipals.length === 0) return null;
-              return (
-                <optgroup key={kind} label={PRINCIPAL_KIND_LABEL[kind]}>
-                  {kindPrincipals.map((principal) => (
-                    <option key={principal.id} value={principal.id}>
-                      {principalLabel(principal.displayName).label}
-                    </option>
-                  ))}
-                </optgroup>
-              );
-            })}
+            {people.map((principal) => (
+              <option key={principal.id} value={principal.id}>
+                {principalLabel(principal.displayName).label}
+              </option>
+            ))}
           </select>
         </label>
         <label className="settings-form-field">
diff --git a/packages/settings-ui/test/roles-section.test.tsx b/packages/settings-ui/test/roles-section.test.tsx
index 9366dcb82..ec94723a9 100644
--- a/packages/settings-ui/test/roles-section.test.tsx
+++ b/packages/settings-ui/test/roles-section.test.tsx
@@ -1,12 +1,11 @@
-// CL-6077: the "Assign a role" person picker previously listed every
-// principal — people, agents, and workflows — as flat, indistinguishable
-// options. Grouping by kind (optgroup) means a workflow's machine
-// principal can never be mistaken for a person's account in the picker.
+// CL-6664: the "Assign a role" person picker must show only user-kind
+// principals — the same roster as the People section. Agent/workflow
+// machine identities are excluded to prevent placeholder-named garbage
+// accounts from polluting the picker.
 
 import { describe, expect, test } from "bun:test";
 import { renderToStaticMarkup } from "react-dom/server";
 
-import { PRINCIPAL_KIND_LABEL, PRINCIPAL_KIND_ORDER } from "../src/identity";
 import { RoleAssignments } from "../src/roles-section";
 
 const timestamps = {
@@ -32,7 +31,7 @@ function principal(
 }
 
 describe("RoleAssignments picker", () => {
-  test("groups the person select by principal kind, in user/agent/workflow order", () => {
+  test("shows only user-kind principals, not agents or workflows", () => {
     const markup = renderToStaticMarkup(
       <RoleAssignments
         roles={[
@@ -45,37 +44,65 @@ describe("RoleAssignments picker", () => {
           },
         ]}
         principals={[
-          principal("workflow", "prn_wf", "Nightly digest"),
           principal("user", "prn_user", "Alice Anderson"),
           principal("agent", "prn_agent", "Research Assistant"),
+          principal("workflow", "prn_wf", "Nightly digest"),
         ]}
         onAssign={() => undefined}
         onUnassign={() => undefined}
       />,
     );
 
-    const groupOrder = [...markup.matchAll(/<optgroup label="([^"]+)"/g)].map(
-      (match) => match[1],
-    );
-    expect(groupOrder).toEqual(
-      PRINCIPAL_KIND_ORDER.map((kind) => PRINCIPAL_KIND_LABEL[kind]),
+    expect(markup).toContain("Alice Anderson");
+    expect(markup).not.toContain("Research Assistant");
+    expect(markup).not.toContain("Nightly digest");
+    expect(markup).not.toContain("<optgroup");
+  });
+
+  test("shows no optgroups (flat list)", () => {
+    const markup = renderToStaticMarkup(
+      <RoleAssignments
+        roles={[]}
+        principals={[
+          principal("user", "prn_1", "Alice Anderson"),
+          principal("user", "prn_2", "Bob Baker"),
+        ]}
+        onAssign={() => undefined}
+        onUnassign={() => undefined}
+      />,
     );
-    expect(groupOrder).not.toEqual([...PRINCIPAL_KIND_ORDER]);
+    expect(markup).not.toContain("<optgroup");
+    expect(markup).toContain("Alice Anderson");
+    expect(markup).toContain("Bob Baker");
   });
 
-  test("omits an empty kind group entirely rather than an empty optgroup", () => {
+  test("excludes agents from the assignments table too", () => {
     const markup = renderToStaticMarkup(
       <RoleAssignments
         roles={[]}
-        principals={[principal("user", "prn_user", "Alice Anderson")]}
+        principals={[
+          principal("user", "prn_user", "Alice Anderson"),
+          principal("agent", "prn_agent", "Research Assistant"),
+        ]}
         onAssign={() => undefined}
         onUnassign={() => undefined}
       />,
     );
-    const groupOrder = [...markup.matchAll(/<optgroup label="([^"]+)"/g)].map(
-      (match) => match[1],
+    // The assignments table header should exist but have no rows
+    expect(markup).toContain("No one has been assigned a role yet.");
+    expect(markup).not.toContain("Research Assistant");
+  });
+
+  test("does not show user kind label for single-kind list", () => {
+    const markup = renderToStaticMarkup(
+      <RoleAssignments
+        roles={[]}
+        principals={[principal("user", "prn_1", "Alice Anderson")]}
+        onAssign={() => undefined}
+        onUnassign={() => undefined}
+      />,
     );
-    expect(groupOrder).toEqual([PRINCIPAL_KIND_LABEL.user]);
-    expect(groupOrder).not.toEqual(["user"]);
+    expect(markup).toContain("Alice Anderson");
+    expect(markup).not.toContain("<optgroup");
   });
 });