Make the system users list searchable

[level09]

Salvaged from the closed #217 and rebuilt on current main.

The System Users page has no way to find a user. It turns out this is not a missing feature so much as a broken one on both ends:

• The page passes {search: this.search} as the second argument to api.get(), which axios reads as the request config, not as params. An unknown search key there is silently dropped, and this.search was never defined on the component in the first place. Nothing was ever sent.
• The backend has read a q param all along, so q was dead code that nothing could reach.
• There is no search field in the toolbar.

Changes

• Search field in the users toolbar, matching the existing pattern on the Sources page (clearable, @click:clear="resetSearch", submit on Enter) so it behaves the way the other admin lists already do.
• refresh() now sends real query params via the axios params object.
• q matches name, username, or email instead of name alone. Case-insensitive partial match.

Permission note

username and email are masked by the secure_* properties for users without view_usernames, so letting them search those fields would be an enumeration oracle: no email is visible, but a hit or miss reveals whether one exists. The broadened search is therefore gated on the same condition the masking uses (Admin or view_usernames); everyone else keeps matching on name only, exactly as before. test_hidden_identifiers_are_not_searchable covers this, and fails if the gate is removed (verified).

Verification

• 893 passed, 4 skipped (full suite), including 7 new tests.
• Template parses; the guard test was confirmed to fail when the permission branch is bypassed.

Not included

Status and role filters. #217 had them, but they are a filter-row design decision on a page Daniel owns, and there is no ticket or mockup driving them yet. The search field is the unambiguous part and stands on its own. Worth raising with him against BYNT-1549.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9e155911-7d71-4338-bbc8-c53e901632eb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}