panel: hide domain pick for global administrators on user form

Global administrators manage every domain; the assignment checkboxes are
now hidden when that role is selected.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/handlers/handlers_users.go

@@ -128,6 +128,7 @@ func (h *Handlers) renderUserForm(w http.ResponseWriter, r *http.Request, status
 	data["Error"] = view.FormErr
 	data["FormUsername"] = view.FormUsername
 	data["FormRole"] = view.FormRole
+	data["GlobalRole"] = store.RoleGlobal
 	data["FormDomains"] = view.FormDomains
 	data["FormPassword"] = view.FormPassword
 	data["IsEdit"] = userID != 0

internal/web/view/static/panel.js

@@ -72,6 +72,28 @@
     });
   }
 
+  // --- Domain pick shown only for domain administrators ------------------
+  // Global administrators manage every domain, so the assignment checkboxes
+  // are irrelevant for that role. The toggle runs on load too, because the
+  // edit form of an existing global user should not flash the fieldset.
+  function syncDomainPickField(select) {
+    var form = select.closest("form");
+    var field = form && form.querySelector("[data-domain-pick]");
+    if (!field) {
+      return;
+    }
+    field.hidden = select.value === select.dataset.globalRole;
+  }
+
+  function initDomainPickFields(root) {
+    root.querySelectorAll("select[data-global-role]").forEach(function (select) {
+      syncDomainPickField(select);
+      select.addEventListener("change", function () {
+        syncDomainPickField(select);
+      });
+    });
+  }
+
   // --- Encryption password fields shown only when asked for --------------
   // The backup, export and import forms carry an optional password block. It
   // is hidden until the checkbox next to it is ticked, and cleared when it is
@@ -199,6 +221,7 @@
 
   document.addEventListener("DOMContentLoaded", function () {
     initAddressFields(document);
+    initDomainPickFields(document);
     initEncryptFields(document);
     initImportPasswordField(document);
     initSectionIndex();

internal/web/view/templates/user_form.html

@@ -14,12 +14,12 @@
     <input id="password" name="password" type="password" autocomplete="new-password" {{if not .IsEdit}}required{{end}}>
 
     <label for="role">Role</label>
-    <select id="role" name="role">
+    <select id="role" name="role" data-global-role="{{.GlobalRole}}">
       <option value="domain_admin" {{if eq .FormRole "domain_admin"}}selected{{end}}>Domain administrator</option>
       <option value="global" {{if eq .FormRole "global"}}selected{{end}}>Global administrator</option>
     </select>
 
-    <fieldset id="domain-pick">
+    <fieldset id="domain-pick" data-domain-pick>
       <legend>Assigned domains</legend>
       <p class="muted">Required for domain administrators.</p>
       {{range .Domains}}