From 5985977f211c7b4efb495b328b726124b9874dc3 Mon Sep 17 00:00:00 2001
From: Mikhail Yenuchenko <public@mixeme.ru>
Date: Tue, 11 Aug 2026 22:37:04 +0300
Subject: [PATCH] panel: hide domain pick for global administrators on user
 form

Global administrators manage every domain; the assignment checkboxes are
now hidden when that role is selected.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 CHANGELOG.md                               |  2 ++
 internal/web/handlers/handlers_users.go    |  1 +
 internal/web/view/static/panel.js          | 23 ++++++++++++++++++++++
 internal/web/view/templates/user_form.html |  4 ++--
 4 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 94ddaef..8f765e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ### Changed
 
+- panel: the user create/edit form hides **Assigned domains** when the role is
+  global administrator, since that role manages every domain anyway.
 - panel: **Settings** shows panel credentials and DMARC aggregate reports side
   by side for global administrators (the same `.split` layout as a delivery's
   message and history). Domain-scoped users keep the single narrow card.
diff --git a/internal/web/handlers/handlers_users.go b/internal/web/handlers/handlers_users.go
index 11af923..c1a2338 100644
--- a/internal/web/handlers/handlers_users.go
+++ b/internal/web/handlers/handlers_users.go
@@ -128,6 +128,7 @@ func (h *Handlers) renderUserForm(w http.ResponseWriter, r *http.Request, status
 	data["Error"] = view.FormErr
 	data["FormUsername"] = view.FormUsername
 	data["FormRole"] = view.FormRole
+	data["GlobalRole"] = store.RoleGlobal
 	data["FormDomains"] = view.FormDomains
 	data["FormPassword"] = view.FormPassword
 	data["IsEdit"] = userID != 0
diff --git a/internal/web/view/static/panel.js b/internal/web/view/static/panel.js
index 4b9fe12..146c688 100644
--- a/internal/web/view/static/panel.js
+++ b/internal/web/view/static/panel.js
@@ -72,6 +72,28 @@
     });
   }
 
+  // --- Domain pick shown only for domain administrators ------------------
+  // Global administrators manage every domain, so the assignment checkboxes
+  // are irrelevant for that role. The toggle runs on load too, because the
+  // edit form of an existing global user should not flash the fieldset.
+  function syncDomainPickField(select) {
+    var form = select.closest("form");
+    var field = form && form.querySelector("[data-domain-pick]");
+    if (!field) {
+      return;
+    }
+    field.hidden = select.value === select.dataset.globalRole;
+  }
+
+  function initDomainPickFields(root) {
+    root.querySelectorAll("select[data-global-role]").forEach(function (select) {
+      syncDomainPickField(select);
+      select.addEventListener("change", function () {
+        syncDomainPickField(select);
+      });
+    });
+  }
+
   // --- Encryption password fields shown only when asked for --------------
   // The backup, export and import forms carry an optional password block. It
   // is hidden until the checkbox next to it is ticked, and cleared when it is
@@ -199,6 +221,7 @@
 
   document.addEventListener("DOMContentLoaded", function () {
     initAddressFields(document);
+    initDomainPickFields(document);
     initEncryptFields(document);
     initImportPasswordField(document);
     initSectionIndex();
diff --git a/internal/web/view/templates/user_form.html b/internal/web/view/templates/user_form.html
index 864a859..1918ca9 100644
--- a/internal/web/view/templates/user_form.html
+++ b/internal/web/view/templates/user_form.html
@@ -14,12 +14,12 @@
     <input id="password" name="password" type="password" autocomplete="new-password" {{if not .IsEdit}}required{{end}}>
 
     <label for="role">Role</label>
-    <select id="role" name="role">
+    <select id="role" name="role" data-global-role="{{.GlobalRole}}">
       <option value="domain_admin" {{if eq .FormRole "domain_admin"}}selected{{end}}>Domain administrator</option>
       <option value="global" {{if eq .FormRole "global"}}selected{{end}}>Global administrator</option>
     </select>
 
-    <fieldset id="domain-pick">
+    <fieldset id="domain-pick" data-domain-pick>
       <legend>Assigned domains</legend>
       <p class="muted">Required for domain administrators.</p>
       {{range .Domains}}