Enhance user account management workflows

[nonprofittechy]

Closes #283.

Summary

• Add last login, saved-session count, and latest interview activity to the user-information page.
• Add server-sent password-reset email alongside the existing reset and copy-link options.
• Add a user-filtered saved-interview view with Join, Details/files, and View answers actions. Detail and answer actions reuse the existing list-sessions interview and open in a new tab.
• Add a recent-account-activity report for registered and anonymous temporary users.
• Show recent-session counts and latest session activity in the report, sorted newest first.
• Let support users drill into an anonymous temporary user's sessions with the same reusable session view and actions.
• Use the full account combobox through 200 users and bounded AJAX lookup on larger servers.
• Add a pre-commit gate that mirrors the DA build workflow: Python compilation, source/wheel packaging, DAYamlChecker interview and template validation, DOCX accessibility reporting, and URL validation.

Permissions and performance

Cross-user interview access requires the existing access-sessions and access-user-info permissions. Non-admin support users cannot inspect or modify protected admin, developer, or cron accounts.

Session queries limit recent candidates before joining user and metadata records. Recent registered-session aggregation is restricted to the users displayed in the report, and account lookup does not load the complete user table on servers above the threshold.

Development and review history

This implementation went through several rounds of local testing and revision:

1. Reused the existing account search, password tools, and session-detail actions instead of introducing a parallel implementation.
2. Added adaptive account lookup after considering servers with thousands of users. The more aggressive lookup is used only above 200 accounts.
3. Replaced an invalid confirmation block that combined an event designator with a gathering field with a separate event and confirmation screen.
4. Replaced a saved-interview link that lost its user filter with an account-centered session list, and removed the undefined redirect reference from the main session viewer.
5. Added a recent-activity report centered on accounts. Anonymous activity uses docassemble's temporary-user identifier because the session tables do not preserve reliable historical IP addresses.
6. Fixed an infinite user-task variable-resolution loop. An initial two-page correction proved less usable and caused a Continue-button regression, so user and task selection were restored to the first page while same-screen task conditions were moved to browser-side visibility rules.
7. Removed implementation commentary from the end-user interface.
8. Replaced the initial dead-end anonymous summary with session drill-down and added recent-session totals and latest activity to registered-user rows.

Testing

• Manually tested locally by Quinten.
• 430 tests passed, 2 skipped, and 37 subtests passed.
• Mypy passed with no issues, and Bandit found no high-severity issues.
• The complete docassemble pre-commit build gate passed locally.
• git diff --check passed.

[Copilot]

🟡 Changes recommended

A few new flows lack defensive input handling and robust parameter coercion, which can lead to avoidable 500s or report failures in production.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR expands ALDashboard’s user-account management tooling by adding richer account/session visibility (including recent activity reporting) and a server-sent password reset email flow, while tightening and reusing permission checks for cross-user session access.

Changes:

• Added can_access_user_sessions() (and supporting permission helper) and reused it to gate session visibility across the dashboard.
• Added user-centric session viewing (including anonymous temp-user drill-down) and a “recently active users” report.
• Added “send password reset email” using docassemble’s built-in user manager, plus UI wiring and tests.

File summaries

File	Description
docassemble/ALDashboard/aldashboard.py	Adds permission helper, reset-email sender, recent-activity reporting, and extends session query to support anonymous temp-user filtering.
docassemble/ALDashboard/data/questions/manage_users.yml	Updates the Manage Users interview UI to show last-login/session stats, adds reset-email flow, session viewer, and recent-activity report/drill-down.
docassemble/ALDashboard/data/questions/list_sessions.yml	Switches several “admin/developer” gates to can_access_user_sessions() so authorized support users can access broader session tooling.
docassemble/ALDashboard/test/test_user_account_manager.py	New tests covering permission gating, UI wiring in manage_users.yml, and password reset email behavior.
docassemble/ALDashboard/test/test_session_search.py	Updates tests for the revised session query structure and adds coverage for permission checks and temp-user filtering.
docassemble/ALDashboard/test/test_session_details_and_files.py	Adjusts tests to reflect get_allowed_interview_filenames() now depending on login/session-access logic.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.