chore: remove coverage and test artifacts from repository

- Remove backend coverage text files (detailed_coverage.txt, dns_handler_coverage.txt, etc.) - Remove frontend test artifacts (coverage-summary.json, test_output.txt) - Remove backend test-results metadata - Total space saved: ~460MB from working directory All these files are properly gitignored and will be regenerated by CI/CD
2026-01-23 06:29:49 +00:00
parent d089fec86b
commit 394a0480d0
11 changed files with 414 additions and 6810 deletions
--- a/backend/detailed_coverage.txt
+++ b/backend/detailed_coverage.txt
@@ -1 +0,0 @@
-mode: set
--- a/backend/dns_handler_coverage.txt
+++ b/backend/dns_handler_coverage.txt
@@ -1,54 +0,0 @@
-mode: set
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:17.85,21.2 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:25.51,27.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:27.16,30.3 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:33.2,34.30 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:34.30,39.3 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:41.2,44.4 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:49.50,51.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:51.16,54.3 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:56.2,57.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:57.16,58.45 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:58.45,61.4 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:62.3,63.9 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:66.2,71.33 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:76.53,78.47 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:78.47,81.3 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:83.2,84.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:84.16,88.14 3 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:89.40,90.50 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:91.39,92.65 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:93.37,95.50 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:98.3,99.9 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:102.2,107.38 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:112.53,114.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:114.16,117.3 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:119.2,120.47 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:120.47,123.3 2 0
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:125.2,126.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:126.16,130.14 3 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:131.40,133.43 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:134.39,135.65 1 0
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:136.37,138.50 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:141.3,142.9 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:145.2,150.33 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:155.53,157.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:157.16,160.3 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:162.2,163.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:163.16,164.45 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:164.45,167.4 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:168.3,169.9 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:172.2,172.78 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:177.51,179.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:179.16,182.3 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:184.2,185.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:185.16,186.45 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:186.45,189.4 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:190.3,191.9 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:194.2,194.31 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:199.62,201.47 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:201.47,204.3 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:206.2,207.16 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:207.16,210.3 2 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:212.2,212.31 1 1
-/projects/Charon/backend/internal/api/handlers/dns_provider_handler.go:217.55,425.2 2 1
--- a/backend/dns_service_coverage.txt
+++ b/backend/dns_service_coverage.txt
@@ -1,91 +0,0 @@
-mode: set
-/projects/Charon/backend/internal/services/dns_provider_service.go:111.97,116.2 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:119.86,123.2 3 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:126.93,129.16 3 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:129.16,130.45 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:130.45,132.4 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:133.3,133.18 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:135.2,135.23 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:139.117,141.44 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:141.44,143.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:146.2,146.79 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:146.79,148.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:151.2,152.16 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:152.16,154.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:156.2,157.16 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:157.16,159.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:162.2,163.29 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:163.29,165.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:167.2,168.26 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:168.26,170.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:173.2,173.19 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:173.19,175.140 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:175.140,177.4 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:181.2,192.69 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:192.69,194.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:196.2,196.22 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:200.126,203.16 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:203.16,205.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:208.2,208.21 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:208.21,210.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:212.2,212.35 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:212.35,214.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:216.2,216.32 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:216.32,218.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:220.2,220.24 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:220.24,222.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:225.2,225.56 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:225.56,227.85 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:227.85,229.4 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:232.3,233.17 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:233.17,235.4 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:237.3,238.17 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:238.17,240.4 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:242.3,242.49 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:246.2,246.44 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:246.44,248.156 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:248.156,250.4 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:251.3,251.28 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:252.8,252.52 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:252.52,254.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:257.2,257.67 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:257.67,259.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:261.2,261.22 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:265.73,267.25 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:267.25,269.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:270.2,270.30 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:270.30,272.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:273.2,273.12 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:277.86,279.16 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:279.16,281.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:284.2,285.16 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:285.16,291.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:294.2,300.20 4 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:300.20,303.3 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:303.8,306.3 2 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:309.2,311.20 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:315.118,317.44 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:317.44,323.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:326.2,326.79 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:326.79,332.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:335.2,335.75 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:339.111,341.16 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:341.16,343.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:346.2,347.16 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:347.16,349.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:352.2,353.68 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:353.68,355.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:358.2,362.25 4 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:366.52,367.51 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:367.51,368.32 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:368.32,370.4 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:372.2,372.14 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:376.84,378.9 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:378.9,380.3 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:383.2,383.39 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:383.39,384.66 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:384.66,386.4 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:389.2,389.12 1 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:395.97,402.71 2 1
-/projects/Charon/backend/internal/services/dns_provider_service.go:402.71,408.3 1 0
-/projects/Charon/backend/internal/services/dns_provider_service.go:411.2,419.3 2 1
--- a/backend/final_coverage.txt
+++ b/backend/final_coverage.txt
--- a/backend/handlers_coverage.txt
+++ b/backend/handlers_coverage.txt
--- a/backend/handlers_final_coverage.txt
+++ b/backend/handlers_final_coverage.txt
@@ -1 +0,0 @@
-mode: set
--- a/backend/handlers_new_coverage.txt
+++ b/backend/handlers_new_coverage.txt
@@ -1 +0,0 @@
-mode: set
--- a/backend/test-results/.last-run.json
+++ b/backend/test-results/.last-run.json
@@ -1,4 +0,0 @@
-{
-  "status": "failed",
-  "failedTests": []
-}
--- a/docs/plans/skipped-tests-remediation.md
+++ b/docs/plans/skipped-tests-remediation.md
@@ -472,6 +472,420 @@ These tests are intentionally skipped with documented reasons:

 ---

+## Remaining Work: Phased Implementation Plan
+
+This section outlines the tactical plan for addressing the remaining 63 skipped tests across three major work streams.
+
+### Overview
+
+**Total Remaining Skipped Tests**: 63
+**Work Streams**: 3 major categories requiring implementation
+**Estimated Total Effort**: 65-85 hours (8-11 dev days)
+**Recommended Approach**: Sequential phases with validation gates
+
+---
+
+### Phase 4: Security Module Toggle Actions (High Priority)
+
+**Target**: Enable security module toggles (ACL, WAF, Rate Limiting)
+**Tests Enabled**: 8 tests
+**Effort**: M (Medium) - 12-16 hours
+**Priority**: P1 - Core security functionality
+**Dependencies**: None (can start immediately)
+
+#### Scope
+
+Implement backend enable/disable functionality for security modules that currently only show status:
+
+1. **ACL (Access Control Lists)** - 2 tests
+   - Enable/disable toggle action
+   - State persistence in DB
+   - Middleware honor of enabled/disabled state
+
+2. **WAF (Web Application Firewall)** - 2 tests
+   - Enable/disable toggle action
+   - State persistence in DB
+   - Coraza WAF activation/deactivation
+
+3. **Rate Limiting** - 2 tests
+   - Enable/disable toggle action
+   - State persistence in DB
+   - Middleware application of rate limits
+
+4. **Navigation Tests** - 2 tests
+   - WAF configuration page navigation
+   - Rate Limiting configuration page navigation
+
+#### Implementation Tasks
+
+**Backend (8-10 hours):**
+- [ ] Add `POST /api/v1/security/acl/toggle` endpoint
+- [ ] Add `POST /api/v1/security/waf/toggle` endpoint
+- [ ] Add `POST /api/v1/security/ratelimit/toggle` endpoint
+- [ ] Update `SecurityConfig` model with proper enable flags
+- [ ] Implement toggle logic in `security_service.go`
+- [ ] Update middleware to check enabled state from DB
+- [ ] Add unit tests for toggle endpoints (85% coverage minimum)
+
+**Frontend (4-6 hours):**
+- [ ] Update `SecurityDashboard.tsx` toggle handlers
+- [ ] Add React Query mutations for toggle actions
+- [ ] Add optimistic updates for toggle UI
+- [ ] Add error handling and rollback on failure
+- [ ] Update type definitions in `types/security.ts`
+
+**Validation:**
+- [ ] Run `tests/security/security-dashboard.spec.ts` - expect 7 additional tests passing
+- [ ] Run `tests/security/rate-limiting.spec.ts` - expect 1 additional test passing
+- [ ] Backend coverage: verify ≥85%
+- [ ] E2E: verify toggle state persists across page reloads
+
+**Success Criteria:**
+- ✅ All 8 toggle-related tests passing
+- ✅ State persists in DB across restarts
+- ✅ Middleware honors enabled/disabled state
+- ✅ No regression in existing security tests
+
+**Estimated Completion**: 2 days
+
+---
+
+### Phase 5: TestDataManager Authentication Fix (High Priority)
+
+**Target**: Fix authenticated API context in test fixtures
+**Tests Enabled**: 8 tests (user management CRUD operations)
+**Effort**: M (Medium) - 8-12 hours
+**Priority**: P1 - Blocks user management test coverage
+**Dependencies**: None (can run parallel to Phase 4)
+
+#### Problem Statement
+
+`TestDataManager` uses raw `APIRequestContext` that doesn't inherit browser authentication cookies, causing "Admin access required" (401/403) errors when creating test data via API.
+
+**Root Cause**: Cookie domain mismatch
+- Auth setup creates cookies for `localhost` domain
+- Tests may run against `100.98.12.109:8080` (Tailscale IP)
+- Cookies aren't sent cross-domain → API calls unauthenticated
+
+#### Solution Approach
+
+**Option A: Consistent Base URL (Recommended - 4 hours)**
+
+Ensure all E2E tests use `http://localhost:8080` consistently:
+
+1. Update `playwright.config.js` to force localhost
+2. Update `docker-compose.e2e.yml` port mappings if needed
+3. Update auth fixtures to always use localhost for cookie domain
+4. Verify TestDataManager inherits authenticated context
+
+**Option B: Cookie Domain Override (8 hours)**
+
+Modify auth setup to create cookies for both domains:
+
+1. Update `auth.setup.ts` to set cookies for multiple domains
+2. Modify TestDataManager to accept authenticated context
+3. Pass `storageState` to TestDataManager API context
+4. Add domain validation and fallback logic
+
+#### Implementation Tasks
+
+**Auth Fixtures (3-4 hours):**
+- [ ] Audit `playwright.config.js` baseURL configuration
+- [ ] Ensure `PLAYWRIGHT_BASE_URL` consistently uses localhost
+- [ ] Update `tests/auth.setup.ts` cookie domain logic
+- [ ] Verify `playwright/.auth/user.json` contains correct domain
+
+**TestDataManager (2-3 hours):**
+- [ ] Update `TestDataManager` constructor to accept `APIRequestContext`
+- [ ] Pass authenticated context from fixtures
+- [ ] Add defensive checks for storage state
+- [ ] Update all test files using TestDataManager
+
+**Environment Config (1-2 hours):**
+- [ ] Update `.env.example` with `PLAYWRIGHT_BASE_URL=http://localhost:8080`
+- [ ] Update Docker compose port bindings if needed
+- [ ] Document base URL requirements in README
+
+**Testing (2-3 hours):**
+- [ ] Re-enable 8 skipped user management tests
+- [ ] Verify CRUD operations work (create, read, update, delete users)
+- [ ] Test with clean DB to ensure no cookie leakage
+- [ ] Verify tests pass on both localhost and Tailscale IP (if needed)
+
+**Validation:**
+- [ ] Run `tests/settings/user-management.spec.ts` - expect 8 additional tests passing
+- [ ] Verify no 401/403 errors in test output
+- [ ] Confirm TestDataManager creates/deletes users successfully
+- [ ] Backend logs show authenticated requests
+
+**Success Criteria:**
+- ✅ All 8 TestDataManager-dependent tests passing
+- ✅ No authentication errors during test data creation
+- ✅ Cookie domain consistent across auth and tests
+- ✅ Tests remain stable across multiple runs
+
+**Estimated Completion**: 1-2 days
+
+---
+
+### Phase 6: User Management UI Implementation (Large Epic)
+
+**Target**: Complete user management frontend
+**Tests Enabled**: 22 tests
+**Effort**: L (Large) - 40-60 hours (1-2 weeks)
+**Priority**: P2 - Feature completeness
+**Dependencies**: Phase 5 (TestDataManager) should be complete first
+
+#### Scope
+
+Implement missing UI components for comprehensive user management:
+
+**Component Breakdown:**
+1. User Status Badge (2 tests) - 2 hours
+2. Role Badge (2 tests) - 2 hours
+3. Action Buttons (4 tests) - 4 hours
+4. User Invite Modal (5 tests) - 12 hours
+5. User Edit Modal (4 tests) - 10 hours
+6. Permissions Modal (5 tests) - 14 hours
+7. User List Enhancements (4 tests) - 8 hours
+
+#### Epic Breakdown: Sub-Phases
+
+##### Phase 6.1: Basic UI Components (8 hours)
+
+**Goal**: Add status/role indicators and action buttons
+
+**Tasks:**
+- [ ] Design and implement `UserStatusBadge.tsx` component
+  - Active/Inactive/Pending states
+  - Color coding (green/gray/yellow)
+  - Accessible ARIA labels
+- [ ] Design and implement `UserRoleBadge.tsx` component
+  - Admin/User role indicators
+  - Icon + text format
+  - Accessible role announcements
+- [ ] Add user action buttons to table rows
+  - Edit user button
+  - Delete user button
+  - Permissions button
+  - Settings button
+- [ ] Add proper `data-testid` attributes for testing
+- [ ] Write Storybook stories for each component
+- [ ] Unit tests for badge logic
+
+**Tests Enabled**: 4 tests (badges + buttons)
+
+##### Phase 6.2: User Invite Flow (12 hours)
+
+**Goal**: Complete user invitation workflow
+
+**Tasks:**
+- [ ] Implement `InviteUserModal.tsx` component
+  - Email input with validation
+  - Role selection dropdown
+  - Permission preset options
+  - Copy invite link button
+- [ ] Add invite form validation
+  - Email format validation
+  - Duplicate email check
+  - Required field validation
+- [ ] Implement invite link copy functionality
+  - Clipboard API integration
+  - Toast notification on copy
+  - Accessible keyboard support
+- [ ] Add React Query mutations
+  - `useInviteUser` hook
+  - Error handling and retry logic
+  - Optimistic UI updates
+- [ ] Wire up "Invite User" button in header
+- [ ] E2E test validation
+
+**Tests Enabled**: 5 tests (invite flow)
+
+##### Phase 6.3: User Edit Modal (10 hours)
+
+**Goal**: Enable editing existing user details
+
+**Tasks:**
+- [ ] Implement `EditUserModal.tsx` component
+  - Pre-filled form with user data
+  - Name/email edit fields
+  - Role change dropdown
+  - Enable/disable toggle
+- [ ] Add form state management
+  - Track changes vs original
+  - Dirty state detection
+  - Unsaved changes warning
+- [ ] Implement update mutation
+  - `useUpdateUser` hook
+  - Conflict resolution
+  - Success/error notifications
+- [ ] Add validation logic
+  - Email uniqueness check
+  - Role change authorization
+  - Unsaved changes prompt
+- [ ] Wire up edit button actions
+
+**Tests Enabled**: 4 tests (edit flow)
+
+##### Phase 6.4: Permissions Management (14 hours)
+
+**Goal**: Granular permission controls per user
+
+**Tasks:**
+- [ ] Implement `UserPermissionsModal.tsx` component
+  - Permission mode selector (All/Restricted)
+  - Host permission list
+  - Add/remove host permissions
+  - Bulk permission actions
+- [ ] Design permission UI/UX
+  - Clear visual hierarchy
+  - Searchable host list
+  - Selected hosts chip display
+  - Permission inheritance rules
+- [ ] Implement permission mutations
+  - `useUpdatePermissions` hook
+  - Batch permission updates
+  - Validation and error handling
+- [ ] Add permission business logic
+  - Admin users bypass restrictions
+  - Owner-specific permissions
+  - Permission inheritance rules
+- [ ] Wire up permissions button
+
+**Tests Enabled**: 5 tests (permissions)
+
+##### Phase 6.5: Delete & Management (8 hours)
+
+**Goal**: Complete CRUD with delete operations
+
+**Tasks:**
+- [ ] Implement `DeleteUserModal.tsx` confirmation
+  - Warning message for admin users
+  - Ownership transfer for proxy hosts
+  - Cascade delete options
+- [ ] Add delete mutation
+  - `useDeleteUser` hook
+  - Optimistic removal from list
+  - Rollback on error
+- [ ] Implement resend invite action
+  - Resend invite link
+  - Update invite timestamp
+  - Notification on success
+- [ ] Add user search/filter
+  - Search by name/email
+  - Filter by role/status
+  - Keyboard navigation
+- [ ] Polish table interactions
+  - Row hover states
+  - Bulk selection (future)
+  - Pagination (if needed)
+
+**Tests Enabled**: 4 tests (delete + mgmt)
+
+#### Technical Considerations
+
+**State Management:**
+- React Query for server state
+- Local state for modal open/close
+- Form state with React Hook Form or similar
+
+**Component Library:**
+- Use existing UI components from `frontend/src/components/ui/`
+- Maintain consistent design language
+- Follow accessibility patterns from a11y instructions
+
+**API Integration:**
+- All endpoints already exist in backend
+- Use existing `client.ts` wrapper
+- Create typed API client in `frontend/src/api/users.ts`
+
+**Testing Strategy:**
+- Unit tests for component logic (Vitest)
+- E2E tests with Playwright (already written, currently skipped)
+- Storybook for component isolation
+
+#### Implementation Order
+
+**Week 1 (5 days, 8 hours/day = 40 hours):**
+- Day 1: Phase 6.1 - Basic UI Components
+- Day 2-3: Phase 6.2 - User Invite Flow
+- Day 4-5: Phase 6.3 - User Edit Modal
+
+**Week 2 (3 days, 20 hours):**
+- Day 1-2: Phase 6.4 - Permissions Management
+- Day 3: Phase 6.5 - Delete & Management
+
+**Buffer**: 8-12 hours for debugging, polish, E2E validation
+
+#### Validation Gates
+
+After each sub-phase:
+- [ ] Component unit tests pass (≥85% coverage)
+- [ ] Storybook story renders correctly
+- [ ] Component is accessible (run Accessibility Insights)
+- [ ] Related E2E tests pass
+- [ ] No TypeScript errors
+- [ ] Pre-commit hooks pass
+
+Final validation:
+- [ ] All 22 user management tests passing
+- [ ] No regression in existing tests
+- [ ] Frontend coverage ≥85%
+- [ ] Manual QA of complete flow
+- [ ] Accessibility audit passes
+
+**Success Criteria:**
+- ✅ All 22 user management tests passing
+- ✅ Complete CRUD operations functional
+- ✅ Permission management working
+- ✅ Accessible UI (WCAG 2.2 Level AA)
+- ✅ Responsive design on mobile/tablet
+- ✅ No console errors or warnings
+
+**Estimated Completion**: 1-2 weeks (depending on resource availability)
+
+---
+
+### Phase Sequencing & Dependencies
+
+**Recommended Execution:**
+1. **Parallel Start**: Kick off Phase 4 and Phase 5 simultaneously (different team members or separate days)
+2. **Phase 4 → Quick Win**: Complete security toggles first for immediate impact (2 days)
+3. **Phase 5 → Unblock**: Complete TestDataManager fix to unblock Phase 6 (1-2 days)
+4. **Phase 6 → Epic**: Dedicate 1-2 week sprint to user management UI
+5. **Phase 7 → Validate**: Run full E2E suite, verify no regressions
+
+**Total Timeline**: 2-3 weeks with dedicated resources
+
+---
+
+### Risk & Mitigation
+
+| Risk | Impact | Likelihood | Mitigation |
+|------|--------|------------|------------|
+| Security toggles affect middleware behavior | High | Medium | Extensive unit tests, feature flags, staged rollout |
+| Cookie domain mismatch complex to fix | Medium | Low | Start with localhost standardization, document workarounds |
+| User Management UI scope creep | Medium | High | Strict adherence to test requirements, defer "nice-to-haves" |
+| E2E tests remain flaky after fixes | Medium | Medium | Add retry logic, improve test stability, debug CI environment |
+| Breaking changes in existing tests | High | Low | Run full suite after each phase, maintain backwards compatibility |
+
+---
+
+### Success Metrics (Final Target)
+
+| Metric | Current (Post-Phase 3) | After Phase 4-6 | Stretch Goal |
+|--------|------------------------|-----------------|--------------|
+| Total Skipped Tests | 63 | **25** | <10 |
+| Security Module Coverage | 60% | **95%** | 100% |
+| User Management Coverage | 0% | **100%** | 100% |
+| Total E2E Test Pass Rate | ~80% | **~90%** | ~95% |
+| Intentional Skips Only | No | **Yes** | Yes |
+
+**Final State**: With Phases 4-6 complete, only intentional skips and environment-dependent tests (DNS providers, encryption rotation) will remain.
+
+---
+
 ## Appendix A: Full Skip Inventory

 ### By File
--- a/frontend/coverage-summary.json
+++ b/frontend/coverage-summary.json
--- a/frontend/test_output.txt
+++ b/frontend/test_output.txt