Impostazioni: durata loop, tolleranze, anagrafiche; tab Utenti con reset password (#47 #48 #49 #50 #51)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/backend/api/routers/settings.py

@@ -1,4 +1,7 @@
 """System settings router - read/update settings, upload company logo."""
+import json
+from decimal import Decimal, InvalidOperation
+
 from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -18,6 +21,23 @@ _VALID_CSV_DELIMITERS = {",", ";", "\t", "|"}
 _VALID_CSV_DECIMAL_SEPARATORS = {",", "."}
 
 
+def _validate_string_list(key: str, value: str) -> None:
+    """#49: array JSON di stringhe non vuote, max 50 voci (vuoto = nessuna lista)."""
+    try:
+        items = json.loads(value)
+    except ValueError:
+        items = None
+    if (
+        not isinstance(items, list)
+        or len(items) > 50
+        or not all(isinstance(i, str) and i.strip() for i in items)
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=f"{key} deve essere vuoto o un array JSON di al massimo 50 stringhe non vuote",
+        )
+
+
 def _validate_setting_value(key: str, value: str) -> None:
     """Raise 422 for a value that would break the code reading this key.
 
@@ -41,6 +61,29 @@ def _validate_setting_value(key: str, value: str) -> None:
                 status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
                 detail="auto_logout_minutes deve essere vuoto (disabilitato) o un intero fra 1 e 480",
             )
+    elif key == "default_measurement_interval_minutes":
+        # #47: vuoto = nessun default
+        if value != "" and (not value.isdigit() or not (1 <= int(value) <= 1440)):
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                detail="default_measurement_interval_minutes deve essere vuoto o un intero fra 1 e 1440",
+            )
+    elif key in ("general_tolerance_plus", "general_tolerance_minus"):
+        # #48: decimale >= 0 con punto; vuoto = nessun default
+        if value != "":
+            try:
+                number = Decimal(value)
+                ok = number.is_finite() and number >= 0
+            except InvalidOperation:
+                ok = False
+            if not ok:
+                raise HTTPException(
+                    status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                    detail=f"{key} deve essere vuoto o un numero decimale maggiore o uguale a 0 (punto decimale)",
+                )
+    elif key in ("list_measurement_types", "list_units"):
+        if value != "":
+            _validate_string_list(key, value)
     elif key in ("company_name", "company_logo_path"):
         if not value.strip() or len(value) > 200:
             raise HTTPException(

src/backend/api/routers/vision.py

@@ -5,25 +5,19 @@ the numbers: that is what lets a station's configuration change without touching
 the frontend or the recipes.
 """
 import io
-import json
 
-from fastapi.responses import FileResponse
 from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, status
 from PIL import Image
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from src.backend.api.middleware.api_key import require_maker, require_measurement_tec
-from src.backend.api.routers.files import (
-    ALLOWED_IMAGE_TYPES, resolve_upload_path, validate_file_size,
-)
+from src.backend.api.routers.files import ALLOWED_IMAGE_TYPES, validate_file_size
 from src.backend.config import settings
 from src.backend.database import get_db
 from src.backend.models.api.vision import (
-    VisionExecuteResponse, VisionMeasurementResult, VisionRecipeResponse,
-    VisionRecipeUploadResponse, VisionReferenceImageResponse,
+    VisionExecuteResponse, VisionMeasurementResult, VisionReferenceImageResponse,
 )
-from src.backend.models.orm.vision import VisionResult
 from src.backend.models.orm.task import RecipeTask
 from src.backend.models.orm.user import User
 from src.backend.services import vision_service
@@ -132,7 +126,7 @@ async def execute(
 ) -> VisionExecuteResponse:
     task = await _task_or_404(db, task_id)
 
-    result, saved, report = await vision_service.execute_task(
+    result, saved = await vision_service.execute_task(
         db,
         task,
         await _read_image(image),
@@ -141,7 +135,6 @@ async def execute(
         lot_number=lot_number,
         serial_number=serial_number,
         production_run_id=production_run_id,
-        image_ext=_IMAGE_EXTENSIONS.get(image.content_type, "png"),
     )
     await db.commit()
 
@@ -154,111 +147,6 @@ async def execute(
             )
             for m in saved
         ],
-        outcome=report.get("outcome"),
-        overlay=report.get("overlay") or [],
-        image_url=f"/api/vision/results/{result.id}/image",
-        failures=report.get("failures") or [],
-    )
-
-
-@router.get("/results/{result_id}/image")
-async def get_result_image(
-    result_id: int,
-    db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(require_measurement_tec),
-) -> FileResponse:
-    """The image a vision run measured, as saved by `execute` (#46)."""
-    result = (await db.execute(
-        select(VisionResult).where(VisionResult.id == result_id)
-    )).scalar_one_or_none()
-    if result is None or not result.image_path:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND, detail="Result image not found",
-        )
-    return FileResponse(resolve_upload_path(result.image_path))
-
-
-def _422(errors: list[str]) -> HTTPException:
-    # detail e' una lista di stringhe: il frontend legge i 422 solo da `detail`.
-    return HTTPException(
-        status_code=status.HTTP_422_UNPROCESSABLE_CONTENT, detail=errors,
-    )
-
-
-@router.post("/tasks/{task_id}/recipe", response_model=VisionRecipeUploadResponse)
-async def upload_recipe(
-    task_id: int,
-    recipe: UploadFile = File(...),
-    files: list[UploadFile] = File(default=[]),
-    db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(require_maker),
-) -> VisionRecipeUploadResponse:
-    """Load a VisionSuite v2 recipe plus its meta files onto a task (#46)."""
-    task = await _task_or_404(db, task_id)
-    if task.task_type not in vision_service.VISION_TASK_TYPES:
-        raise _422([f"task type {task.task_type!r} does not run a vision recipe"])
-
-    raw = await recipe.read()
-    if not validate_file_size(len(raw)):
-        raise _422([f"recipe exceeds {settings.max_upload_size_mb}MB"])
-    try:
-        graph = json.loads(raw)
-    except ValueError:
-        raise _422(["the recipe is not valid JSON"])
-    if not isinstance(graph, dict):
-        raise _422(["the recipe must be a JSON object"])
-
-    uploads: list[tuple[str, bytes]] = []
-    for f in files:
-        content = await f.read()
-        if not validate_file_size(len(content)):
-            raise _422([f"file {f.filename!r} exceeds {settings.max_upload_size_mb}MB"])
-        uploads.append((f.filename or "", content))
-    placed, errors = vision_service.match_recipe_files(graph, uploads)
-    if errors:
-        raise _422(errors)
-
-    # The folder is content-addressed and immutable; writing it before the
-    # validation is harmless (an orphan folder is never referenced) and the
-    # worker needs it on disk to validate meta files.
-    try:
-        recipe_dir = vision_service.store_recipe_folder(task.id, graph, placed)
-    except ValueError as exc:
-        raise _422([str(exc)])
-    check = await vision_service.validate_recipe(graph, recipe_dir)
-    if not check["ok"]:
-        raise _422([str(e) for e in check["errors"]] or ["the recipe is not valid"])
-
-    task.vision_json = graph
-    task.vision_recipe_dir = recipe_dir
-    await db.commit()
-    return VisionRecipeUploadResponse(
-        task_id=task.id,
-        recipe_dir=recipe_dir,
-        files=vision_service.list_recipe_files(recipe_dir),
-        outputs=check["outputs"],
-    )
-
-
-@router.get("/tasks/{task_id}/recipe", response_model=VisionRecipeResponse)
-async def get_recipe(
-    task_id: int,
-    db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(require_maker),
-) -> VisionRecipeResponse:
-    task = await _task_or_404(db, task_id)
-    outputs: list[dict] = []
-    if task.vision_json:
-        check = await vision_service.validate_recipe(
-            task.vision_json, task.vision_recipe_dir,
-        )
-        outputs = check.get("outputs", [])
-    return VisionRecipeResponse(
-        task_id=task.id,
-        recipe_dir=task.vision_recipe_dir,
-        recipe=task.vision_json,
-        files=vision_service.list_recipe_files(task.vision_recipe_dir),
-        outputs=outputs,
     )
 
 

src/backend/migrations/versions/016_vision_recipe_dir.py

@@ -1,30 +0,0 @@
-"""recipe_tasks.vision_recipe_dir: cartella della ricetta VisionSuite v2 (#46)
-
-Percorso relativo sotto upload_path della cartella immutabile che contiene
-recipe.json e i file di meta (DXF, modelli .npz, ...).
-
-Revision ID: 016_vision_recipe_dir
-Revises: 015_api_key_hash
-Create Date: 2026-10-07
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-
-revision: str = '016_vision_recipe_dir'
-down_revision: Union[str, None] = '015_api_key_hash'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    # batch: SQLite non sa fare DROP COLUMN nativo su tutte le versioni
-    with op.batch_alter_table('recipe_tasks') as batch:
-        batch.add_column(sa.Column('vision_recipe_dir', sa.String(500), nullable=True))
-
-
-def downgrade() -> None:
-    with op.batch_alter_table('recipe_tasks') as batch:
-        batch.drop_column('vision_recipe_dir')

src/backend/models/api/vision.py

@@ -16,34 +16,6 @@ class VisionExecuteResponse(BaseModel):
     vision_result_id: int
     engine_version: str
     measurements: list[VisionMeasurementResult]
-    # Esito VisionSuite (informativo: il verdetto lo danno utl/ltl), overlay
-    # in px immagine, URL dell'immagine salvata e strumenti falliti (#46).
-    outcome: str | None = None
-    overlay: list[dict] = []
-    image_url: str | None = None
-    failures: list[dict] = []
-
-
-class VisionRecipeOutput(BaseModel):
-    """One numeric output a recipe offers to the quotes."""
-    key: str
-    quantity: str | None = None
-    unit: str | None = None
-
-
-class VisionRecipeUploadResponse(BaseModel):
-    task_id: int
-    recipe_dir: str
-    files: list[str]
-    outputs: list[VisionRecipeOutput]
-
-
-class VisionRecipeResponse(BaseModel):
-    task_id: int
-    recipe_dir: str | None = None
-    recipe: dict | None = None
-    files: list[str]
-    outputs: list[VisionRecipeOutput]
 
 
 class VisionReferenceImageResponse(BaseModel):

src/backend/models/orm/task.py

@@ -18,8 +18,7 @@ if TYPE_CHECKING:
 TASK_TYPES = ("note", "measure", "drawing", "dxf_compare", "camera_measure")
 
 # Types the operator screen treats as "there are quotes to take here".
-# dxf_compare produce quote come camera_measure (#46)
-MEASURING_TASK_TYPES = ("measure", "camera_measure", "dxf_compare")
+MEASURING_TASK_TYPES = ("measure", "camera_measure")
 
 
 class RecipeTask(Base):
@@ -52,9 +51,6 @@ class RecipeTask(Base):
     # server routes it and never interprets it, which is what keeps VisionSuite
     # out of this container.
     vision_json: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
-    # Cartella immutabile (relativa a upload_path) con recipe.json e i file di
-    # meta della ricetta VisionSuite v2 (#46).
-    vision_recipe_dir: Mapped[Optional[str]] = mapped_column(String(500), nullable=True)
 
     # Relationships
     version: Mapped["RecipeVersion"] = relationship(back_populates="tasks")

src/backend/services/recipe_service.py

@@ -115,8 +115,6 @@ async def _copy_tasks_to_version(
             # a camera_measure task unable to execute from the moment a
             # recipe with measurements is next edited.
             vision_json=task.vision_json,
-            # Cartella immutabile: basta il riferimento (#46).
-            vision_recipe_dir=task.vision_recipe_dir,
         )
         db.add(new_task)
         await db.flush()  # get new_task.id

src/backend/services/vision_service.py

@@ -5,7 +5,6 @@ to the worker over HTTP and stays ignorant of how a number was produced.
 """
 from __future__ import annotations
 
-import hashlib
 import json
 import math
 from pathlib import Path
@@ -47,13 +46,7 @@ def _is_measurable(value: object) -> bool:
     )
 
 
-async def _call_worker(
-    image_bytes: bytes,
-    graph: dict,
-    *,
-    recipe_dir: str | None = None,
-    calibration: dict | None = None,
-) -> dict:
+async def _call_worker(image_bytes: bytes, graph: dict) -> dict:
     """The one place that talks to the worker; the tests replace it.
 
     The worker's fault must not become the API's fault (spec's edge-case
@@ -67,19 +60,12 @@ async def _call_worker(
     is not the worker's JSON contract must not turn into a bare KeyError
     further down.
     """
-    # recipe_dir (relativo, #46) e calibration sono opzionali: se assenti non
-    # si mandano, il worker usa i suoi default.
-    data = {"graph": json.dumps(graph)}
-    if recipe_dir:
-        data["recipe_dir"] = recipe_dir
-    if calibration:
-        data["calibration"] = json.dumps(calibration)
     try:
         async with httpx.AsyncClient(timeout=120.0) as client:
             response = await client.post(
                 f"{settings.vision_worker_url}/run",
                 files={"image": ("frame.png", image_bytes, "image/png")},
-                data=data,
+                data={"graph": json.dumps(graph)},
             )
     except httpx.TimeoutException as exc:
         raise HTTPException(
@@ -136,188 +122,6 @@ async def _call_worker(
     return report
 
 
-async def validate_recipe(graph: dict, recipe_dir: str | None) -> dict:
-    """Ask the worker's /validate whether a v2 recipe is loadable (#46).
-
-    Returns {"ok", "errors", "outputs"}. A worker 422 (e.g. recipe_dir
-    refused) is folded into ok=False; transport faults become 502/504 as in
-    `_call_worker`. Replaced by the tests.
-    """
-    data = {"graph": json.dumps(graph)}
-    if recipe_dir:
-        data["recipe_dir"] = recipe_dir
-    try:
-        async with httpx.AsyncClient(timeout=60.0) as client:
-            response = await client.post(
-                f"{settings.vision_worker_url}/validate", data=data,
-            )
-    except httpx.TimeoutException as exc:
-        raise HTTPException(
-            status_code=status.HTTP_504_GATEWAY_TIMEOUT,
-            detail=f"the vision worker did not answer in time: {exc}",
-        ) from exc
-    except httpx.HTTPError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_502_BAD_GATEWAY,
-            detail=f"the vision worker is unreachable: {exc}",
-        ) from exc
-    if response.status_code == status.HTTP_422_UNPROCESSABLE_CONTENT:
-        try:
-            detail = response.json().get("detail", response.text)
-        except ValueError:
-            detail = response.text
-        errors = detail if isinstance(detail, list) else [str(detail)]
-        return {"ok": False, "errors": [str(e) for e in errors], "outputs": []}
-    if response.status_code != 200:
-        raise HTTPException(
-            status_code=status.HTTP_502_BAD_GATEWAY,
-            detail=f"the vision worker refused the job: {response.text}",
-        )
-    try:
-        body = response.json()
-    except ValueError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_502_BAD_GATEWAY,
-            detail="the vision worker's answer was malformed: not valid JSON",
-        ) from exc
-    if not isinstance(body, dict) or "ok" not in body:
-        raise HTTPException(
-            status_code=status.HTTP_502_BAD_GATEWAY,
-            detail="the vision worker's answer was malformed: missing ok",
-        )
-    body.setdefault("errors", [])
-    body.setdefault("outputs", [])
-    return body
-
-
-# Task types that run a vision graph (#46).
-VISION_TASK_TYPES = ("camera_measure", "dxf_compare")
-
-
-def _safe_join(root: Path, relative: str) -> Path:
-    """root/relative, refusing absolute paths, '..' and anything leaving root."""
-    candidate = Path(relative)
-    if candidate.is_absolute() or ".." in candidate.parts or not candidate.parts:
-        raise ValueError(f"unsafe path: {relative}")
-    full = (root / candidate).resolve()
-    if not full.is_relative_to(root.resolve()):
-        raise ValueError(f"unsafe path: {relative}")
-    return full
-
-
-def collect_meta_paths(node: object) -> list[str]:
-    """Every `path` string found in any dict under the recipe's `meta`."""
-    found: list[str] = []
-    if isinstance(node, dict):
-        for key, value in node.items():
-            if key == "path" and isinstance(value, str):
-                found.append(value)
-            else:
-                found.extend(collect_meta_paths(value))
-    elif isinstance(node, list):
-        for item in node:
-            found.extend(collect_meta_paths(item))
-    return found
-
-
-def match_recipe_files(
-    recipe: dict, uploads: list[tuple[str, bytes]],
-) -> tuple[dict[str, bytes], list[str]]:
-    """Pair each uploaded file with a meta path by base name (#46).
-
-    Returns ({relative path: bytes}, errors). Errors list every upload that
-    has no name or matches no meta path, and every unsafe meta path. A meta
-    path left without a file is not an error here: /validate decides.
-    """
-    paths = collect_meta_paths(recipe.get("meta", {}))
-    by_name: dict[str, str] = {}
-    for p in paths:
-        by_name.setdefault(Path(p.replace("\\", "/")).name, p)
-    placed: dict[str, bytes] = {}
-    errors: list[str] = []
-    for name, content in uploads:
-        if not name:
-            errors.append("a file has no name")
-            continue
-        target = by_name.get(Path(name.replace("\\", "/")).name)
-        if target is None:
-            errors.append(f"file {name!r} matches no path in the recipe's meta")
-            continue
-        try:
-            _safe_join(Path("."), target)
-        except ValueError:
-            errors.append(f"meta path {target!r} is not allowed")
-            continue
-        placed[target] = content
-    return placed, errors
-
-
-def store_recipe_folder(
-    task_id: int, recipe: dict, files: dict[str, bytes],
-) -> str:
-    """Write the immutable recipe folder; return its path relative to uploads.
-
-    Folder name = first 16 hex of the recipe's sha256. If it already exists it
-    is left untouched (immutable: other task versions may reference it).
-    """
-    canonical = json.dumps(recipe, sort_keys=True, separators=(",", ":"))
-    # Il digest copre anche i file (path ordinato + sha256 del contenuto): la
-    # stessa ricetta con file diversi (es. primo upload senza il DXF) deve dare
-    # una cartella diversa, altrimenti quella incompleta resterebbe per sempre
-    # perche' immutabile (#46).
-    h = hashlib.sha256(canonical.encode("utf-8"))
-    for rel in sorted(files):
-        h.update(b"\0" + rel.encode("utf-8") + b"\0")
-        h.update(hashlib.sha256(files[rel]).digest())
-    digest = h.hexdigest()[:16]
-    relative = f"vision/recipes/{task_id}/{digest}"
-    folder = settings.upload_path / relative
-    if folder.exists():
-        return relative
-    folder.mkdir(parents=True, exist_ok=True)
-    (folder / "recipe.json").write_text(
-        json.dumps(recipe, indent=2, ensure_ascii=False), encoding="utf-8",
-    )
-    for rel, content in files.items():
-        target = _safe_join(folder, rel)
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_bytes(content)
-    return relative
-
-
-def list_recipe_files(recipe_dir: str | None) -> list[str]:
-    """Files of a recipe folder, relative to it (recipe.json excluded)."""
-    if not recipe_dir:
-        return []
-    try:
-        folder = _safe_join(settings.upload_path, recipe_dir)
-    except ValueError:
-        return []
-    if not folder.is_dir():
-        return []
-    return sorted(
-        p.relative_to(folder).as_posix()
-        for p in folder.rglob("*") if p.is_file() and p.name != "recipe.json"
-    )
-
-
-def save_result_files(
-    task_id: int, image_bytes: bytes, overlay: list, image_ext: str = "png",
-) -> tuple[str, str]:
-    """Save the executed image and its overlay JSON side by side (#46).
-
-    Returns (image_path, overlay_path), both relative to uploads.
-    """
-    stem = uuid4().hex
-    base = Path("vision") / "results" / str(task_id)
-    (settings.upload_path / base).mkdir(parents=True, exist_ok=True)
-    image_rel = (base / f"{stem}.{image_ext}").as_posix()
-    overlay_rel = (base / f"{stem}.overlay.json").as_posix()
-    (settings.upload_path / image_rel).write_bytes(image_bytes)
-    (settings.upload_path / overlay_rel).write_text(json.dumps(overlay), encoding="utf-8")
-    return image_rel, overlay_rel
-
-
 async def execute_task(
     db: AsyncSession,
     task: RecipeTask,
@@ -328,9 +132,8 @@ async def execute_task(
     lot_number: str | None = None,
     serial_number: str | None = None,
     production_run_id: int | None = None,
-    image_ext: str = "png",
-) -> tuple[VisionResult, list[Measurement], dict]:
-    if task.task_type not in VISION_TASK_TYPES:
+) -> tuple[VisionResult, list[Measurement]]:
+    if task.task_type != "camera_measure":
         raise HTTPException(
             status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
             detail=f"task type {task.task_type!r} is not a camera measurement",
@@ -407,11 +210,7 @@ async def execute_task(
             ),
         )
 
-    # Nessuna fonte di calibrazione esiste oggi (ne' task ne' stazione): non si
-    # passa `calibration`, la ricetta porta la sua (#46).
-    report = await _call_worker(
-        image_bytes, task.vision_json, recipe_dir=task.vision_recipe_dir,
-    )
+    report = await _call_worker(image_bytes, task.vision_json)
     outputs = report["outputs"]
 
     # Every quote or none. A half-measured piece read as a whole one is worse
@@ -432,12 +231,8 @@ async def execute_task(
             ),
         )
 
-    overlay = report.get("overlay") or []
-    image_path, overlay_path = save_result_files(task.id, image_bytes, overlay, image_ext)
     result = VisionResult(
         task_id=task.id,
-        image_path=image_path,
-        overlay_path=overlay_path,
         engine_version=report["engine_version"],
         executed_on="server",
         graph_snapshot=task.vision_json,
@@ -462,7 +257,7 @@ async def execute_task(
             enforce_tolerance_gate=False,
         ))
 
-    return result, saved, report
+    return result, saved
 
 
 def _reference_file_path(reference: VisionReferenceImage) -> Path:
@@ -582,6 +377,4 @@ async def preview(db: AsyncSession, task: RecipeTask, image_bytes: bytes) -> dic
             status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
             detail="this task carries no vision graph",
         )
-    return await _call_worker(
-        image_bytes, task.vision_json, recipe_dir=task.vision_recipe_dir,
-    )
+    return await _call_worker(image_bytes, task.vision_json)

src/backend/tests/test_migrations.py

@@ -131,21 +131,3 @@ class TestApiKeyHashMigration:
 
         command.upgrade(cfg, "head")  # and up again
         assert "api_keys" in _inspect(db_path).get_table_names()
-
-
-class TestVisionRecipeDirMigration:
-    """016_vision_recipe_dir: recipe_tasks.vision_recipe_dir, su e giu (#46)."""
-
-    def test_016_upgrade_and_downgrade(self, sqlite_database_url):
-        db_path, _ = sqlite_database_url
-        cfg = _alembic_config()
-
-        def cols():
-            return {c["name"] for c in _inspect(db_path).get_columns("recipe_tasks")}
-
-        command.upgrade(cfg, "head")
-        assert "vision_recipe_dir" in cols()
-        command.downgrade(cfg, "015_api_key_hash")
-        assert "vision_recipe_dir" not in cols()
-        command.upgrade(cfg, "head")  # e di nuovo su
-        assert "vision_recipe_dir" in cols()

src/backend/tests/test_settings.py

@@ -176,6 +176,50 @@ class TestUpdateSettingsValidation:
         )
         assert resp.status_code == 200
 
+    # --- #47/#48/#49: chiavi Impostazioni di Tràfilo ---
+
+    @pytest.mark.parametrize("key,value", [
+        ("default_measurement_interval_minutes", "1"),
+        ("default_measurement_interval_minutes", "1440"),
+        ("default_measurement_interval_minutes", ""),
+        ("general_tolerance_plus", "0"),
+        ("general_tolerance_plus", "0.05"),
+        ("general_tolerance_minus", ""),
+        ("list_measurement_types", '["Lunghezza", "Diametro"]'),
+        ("list_units", "[]"),
+        ("list_units", ""),
+    ])
+    async def test_new_keys_valid_accepted(
+        self, client: AsyncClient, admin_user: User, key: str, value: str
+    ):
+        resp = await client.put(
+            "/api/settings/", headers=auth_headers(admin_user), json={key: value}
+        )
+        assert resp.status_code == 200, resp.text
+
+    @pytest.mark.parametrize("key,value", [
+        ("default_measurement_interval_minutes", "0"),
+        ("default_measurement_interval_minutes", "1441"),
+        ("default_measurement_interval_minutes", "abc"),
+        ("general_tolerance_plus", "-0.1"),
+        ("general_tolerance_plus", "0,05"),
+        ("general_tolerance_minus", "NaN"),
+        ("general_tolerance_minus", "abc"),
+        ("list_measurement_types", "not json"),
+        ("list_measurement_types", '{"a": 1}'),
+        ("list_units", '["mm", ""]'),
+        ("list_units", '["mm", 3]'),
+        ("list_units", "[" + ",".join(f'"v{i}"' for i in range(51)) + "]"),
+    ])
+    async def test_new_keys_invalid_rejected(
+        self, client: AsyncClient, admin_user: User, key: str, value: str
+    ):
+        resp = await client.put(
+            "/api/settings/", headers=auth_headers(admin_user), json={key: value}
+        )
+        assert resp.status_code == 422, resp.text
+        assert key in resp.json()["detail"]
+
     async def test_unknown_key_not_validated(
         self, client: AsyncClient, admin_user: User
     ):

src/backend/tests/test_vision_execute.py

@@ -66,7 +66,7 @@ async def two_vision_quotes(db_session, recipe_id: int):
 def worker_says(monkeypatch):
     """The worker does not run in tests: its response is faked here."""
     def _install(outputs: dict, failures: list | None = None):
-        async def fake_call(image_bytes: bytes, graph: dict, **kwargs) -> dict:
+        async def fake_call(image_bytes: bytes, graph: dict) -> dict:
             return {
                 "outputs": outputs,
                 "failures": failures or [],
@@ -316,7 +316,7 @@ async def test_a_pending_fail_blocks_before_the_worker_is_called(
     )
     await db_session.commit()
 
-    async def worker_must_not_be_called(image_bytes: bytes, graph: dict, **kwargs) -> dict:
+    async def worker_must_not_be_called(image_bytes: bytes, graph: dict) -> dict:
         raise AssertionError("the worker must not run while the operator is blocked")
     monkeypatch.setattr(
         "src.backend.services.vision_service._call_worker", worker_must_not_be_called,

src/backend/tests/test_vision_execute_gates.py

@@ -53,7 +53,7 @@ async def a_camera_task(db_session, recipe_id: int):
 @pytest.fixture
 def worker_says(monkeypatch):
     def _install(outputs: dict):
-        async def fake_call(image_bytes: bytes, graph: dict, **kwargs) -> dict:
+        async def fake_call(image_bytes: bytes, graph: dict) -> dict:
             return {"outputs": outputs, "failures": [],
                     "engine_version": "e" * 40, "duration_ms": 3}
         monkeypatch.setattr(

src/backend/tests/test_vision_recipe_upload.py

@@ -1,282 +0,0 @@
-"""Ricetta VisionSuite v2 su un task, execute dxf_compare, copy-on-write (#46)."""
-import io
-import json
-
-import pytest
-from PIL import Image
-from sqlalchemy import select
-
-from src.backend.config import settings
-from src.backend.models.orm.recipe import RecipeVersion
-from src.backend.models.orm.task import RecipeSubtask, RecipeTask
-from src.backend.models.orm.vision import VisionResult
-from src.backend.tests.conftest import auth_headers, create_test_recipe
-
-RECIPE = {
-    "schema_version": 2, "name": "dxf", "tools": [],
-    "meta": {"dxf": {"d1": {"path": "dxf/part.dxf"}}, "models": {"m": {"path": "models/m.npz"}}},
-}
-OUTPUTS = [{"key": "cmp.points_in_pct", "quantity": "ratio", "unit": "%"}]
-GOOD_FILES = (("part.dxf", b"0 EOF"), ("m.npz", b"npz"))
-
-
-@pytest.fixture(autouse=True)
-def redirect_uploads(monkeypatch, tmp_path):
-    # upload_path = parents[2] / upload_dir: un assoluto sostituisce la base
-    monkeypatch.setattr(settings, "upload_dir", str(tmp_path))
-
-
-@pytest.fixture
-def validate_says(monkeypatch):
-    """Il worker /validate non gira nei test: risposta finta."""
-    def _install(ok=True, errors=None, outputs=None):
-        async def fake(graph, recipe_dir):
-            return {
-                "ok": ok, "errors": errors or [],
-                "outputs": outputs if outputs is not None else OUTPUTS,
-            }
-        monkeypatch.setattr("src.backend.services.vision_service.validate_recipe", fake)
-    return _install
-
-
-def an_image() -> bytes:
-    buf = io.BytesIO()
-    Image.new("L", (32, 32)).save(buf, format="PNG")
-    return buf.getvalue()
-
-
-async def make_task(db_session, user, task_type="dxf_compare"):
-    recipe = await create_test_recipe(db_session, user.id)
-    version = (await db_session.execute(
-        select(RecipeVersion).where(RecipeVersion.recipe_id == recipe.id)
-    )).scalars().first()
-    task = (await db_session.execute(
-        select(RecipeTask).where(RecipeTask.version_id == version.id)
-    )).scalars().first()
-    subtask = (await db_session.execute(
-        select(RecipeSubtask).where(RecipeSubtask.task_id == task.id)
-    )).scalars().first()
-    task.task_type = task_type
-    await db_session.commit()
-    return task, subtask
-
-
-def upload(client, user, task, recipe=RECIPE, files=()):
-    return client.post(
-        f"/api/vision/tasks/{task.id}/recipe",
-        headers=auth_headers(user),
-        files=[("recipe", ("r.json", json.dumps(recipe).encode(), "application/json"))]
-        + [("files", (n, c, "application/octet-stream")) for n, c in files],
-    )
-
-
-@pytest.mark.asyncio
-async def test_upload_ok_stores_folder_and_task(client, db_session, maker_user, validate_says):
-    validate_says()
-    task, _ = await make_task(db_session, maker_user)
-    resp = await upload(client, maker_user, task, files=GOOD_FILES)
-    assert resp.status_code == 200, resp.text
-    body = resp.json()
-    assert body["outputs"] == OUTPUTS
-    assert sorted(body["files"]) == ["dxf/part.dxf", "models/m.npz"]
-    assert body["recipe_dir"].startswith(f"vision/recipes/{task.id}/")
-    folder = settings.upload_path / body["recipe_dir"]
-    assert (folder / "recipe.json").is_file() and (folder / "dxf" / "part.dxf").is_file()
-    await db_session.refresh(task)
-    assert task.vision_json == RECIPE and task.vision_recipe_dir == body["recipe_dir"]
-
-    got = await client.get(f"/api/vision/tasks/{task.id}/recipe", headers=auth_headers(maker_user))
-    assert got.status_code == 200
-    assert got.json()["recipe"] == RECIPE and got.json()["outputs"] == OUTPUTS
-
-
-@pytest.mark.asyncio
-async def test_get_without_recipe_is_empty(client, db_session, maker_user, validate_says):
-    validate_says()
-    task, _ = await make_task(db_session, maker_user)
-    got = await client.get(f"/api/vision/tasks/{task.id}/recipe", headers=auth_headers(maker_user))
-    assert got.json() == {
-        "task_id": task.id, "recipe_dir": None, "recipe": None, "files": [], "outputs": [],
-    }
-
-
-@pytest.mark.asyncio
-async def test_unmatched_file_name_is_422_list(client, db_session, maker_user, validate_says):
-    validate_says()
-    task, _ = await make_task(db_session, maker_user)
-    resp = await upload(client, maker_user, task, files=[("other.dxf", b"x")])
-    assert resp.status_code == 422
-    assert isinstance(resp.json()["detail"], list) and "other.dxf" in resp.json()["detail"][0]
-    await db_session.refresh(task)
-    assert task.vision_json is None and task.vision_recipe_dir is None
-
-
-@pytest.mark.asyncio
-async def test_traversal_in_meta_path_is_422(client, db_session, maker_user, validate_says):
-    validate_says()
-    task, _ = await make_task(db_session, maker_user)
-    evil = {"schema_version": 2, "tools": [], "meta": {"dxf": {"d": {"path": "../../evil.dxf"}}}}
-    resp = await upload(client, maker_user, task, recipe=evil, files=[("evil.dxf", b"x")])
-    assert resp.status_code == 422
-    assert not (settings.upload_path.parent / "evil.dxf").exists()
-
-
-@pytest.mark.asyncio
-async def test_wrong_task_type_is_422(client, db_session, maker_user, validate_says):
-    validate_says()
-    task, _ = await make_task(db_session, maker_user, task_type="measure")
-    resp = await upload(client, maker_user, task, files=GOOD_FILES)
-    assert resp.status_code == 422
-
-
-@pytest.mark.asyncio
-async def test_invalid_json_is_422(client, db_session, maker_user, validate_says):
-    validate_says()
-    task, _ = await make_task(db_session, maker_user)
-    resp = await client.post(
-        f"/api/vision/tasks/{task.id}/recipe", headers=auth_headers(maker_user),
-        files=[("recipe", ("r.json", b"{nope", "application/json"))],
-    )
-    assert resp.status_code == 422
-
-
-@pytest.mark.asyncio
-async def test_worker_not_ok_is_422_and_task_unchanged(client, db_session, maker_user, validate_says):
-    validate_says(ok=False, errors=["meta file missing"])
-    task, _ = await make_task(db_session, maker_user)
-    task.vision_json = {"old": 1}
-    task.vision_recipe_dir = "vision/recipes/old"
-    await db_session.commit()
-    resp = await upload(client, maker_user, task, files=GOOD_FILES)
-    assert resp.status_code == 422
-    assert resp.json()["detail"] == ["meta file missing"]
-    await db_session.refresh(task)
-    assert task.vision_json == {"old": 1} and task.vision_recipe_dir == "vision/recipes/old"
-
-
-@pytest.mark.asyncio
-async def test_existing_folder_is_not_rewritten(client, db_session, maker_user, validate_says):
-    validate_says()
-    task, _ = await make_task(db_session, maker_user)
-    first = (await upload(client, maker_user, task, files=GOOD_FILES)).json()
-    marker = settings.upload_path / first["recipe_dir"] / "dxf" / "part.dxf"
-    marker.write_bytes(b"CHANGED")
-    second = (await upload(client, maker_user, task, files=GOOD_FILES)).json()
-    assert second["recipe_dir"] == first["recipe_dir"]
-    assert marker.read_bytes() == b"CHANGED"
-
-
-@pytest.mark.asyncio
-async def test_upload_requires_maker(
-    client, db_session, maker_user, measurement_tec_user, validate_says,
-):
-    validate_says()
-    task, _ = await make_task(db_session, maker_user)
-    resp = await upload(client, measurement_tec_user, task, files=GOOD_FILES)
-    assert resp.status_code in (401, 403)
-
-
-@pytest.mark.asyncio
-async def test_execute_dxf_compare_saves_files_and_extended_response(
-    client, db_session, measurement_tec_user, monkeypatch,
-):
-    task, subtask = await make_task(db_session, measurement_tec_user)
-    task.vision_json = RECIPE
-    task.vision_recipe_dir = "vision/recipes/1/abc"
-    subtask.vision_output = "cmp.points_in_pct"
-    await db_session.commit()
-    seen = {}
-    overlay = [{"type": "contour", "role": "found", "rows": [1], "cols": [2], "tool_id": "cmp"}]
-
-    async def fake_call(image_bytes, graph, **kwargs):
-        seen.update(kwargs)
-        return {
-            "outputs": {"cmp.points_in_pct": float(subtask.nominal)},
-            "failures": [], "engine_version": "e" * 40, "duration_ms": 5,
-            "overlay": overlay, "outcome": "OK",
-        }
-    monkeypatch.setattr("src.backend.services.vision_service._call_worker", fake_call)
-
-    resp = await client.post(
-        "/api/vision/execute", headers=auth_headers(measurement_tec_user),
-        files={"image": ("p.png", an_image(), "image/png")},
-        data={"task_id": str(task.id)},
-    )
-    assert resp.status_code == 200, resp.text
-    body = resp.json()
-    assert seen["recipe_dir"] == "vision/recipes/1/abc" and "calibration" not in seen
-    assert body["outcome"] == "OK" and body["overlay"] == overlay and body["failures"] == []
-    assert body["image_url"] == f"/api/vision/results/{body['vision_result_id']}/image"
-    assert body["measurements"][0]["pass_fail"] == "pass"
-
-    result = (await db_session.execute(select(VisionResult))).scalars().one()
-    assert (settings.upload_path / result.image_path).read_bytes() == an_image()
-    assert json.loads((settings.upload_path / result.overlay_path).read_text()) == overlay
-
-    img = await client.get(body["image_url"], headers=auth_headers(measurement_tec_user))
-    assert img.status_code == 200 and img.content == an_image()
-
-
-@pytest.mark.asyncio
-async def test_execute_dxf_compare_out_of_tolerance_fails(
-    client, db_session, measurement_tec_user, monkeypatch,
-):
-    task, subtask = await make_task(db_session, measurement_tec_user)
-    task.vision_json = RECIPE
-    subtask.vision_output = "cmp.points_in_pct"
-    await db_session.commit()
-
-    async def fake_call(image_bytes, graph, **kwargs):
-        return {"outputs": {"cmp.points_in_pct": 99.0}, "failures": [],
-                "engine_version": "e" * 40, "outcome": "OK"}
-    monkeypatch.setattr("src.backend.services.vision_service._call_worker", fake_call)
-    resp = await client.post(
-        "/api/vision/execute", headers=auth_headers(measurement_tec_user),
-        files={"image": ("p.png", an_image(), "image/png")},
-        data={"task_id": str(task.id)},
-    )
-    assert resp.status_code == 200
-    # il verdetto e' delle tolleranze del subtask, non di outcome di VisionSuite
-    assert resp.json()["measurements"][0]["pass_fail"] == "fail"
-    assert resp.json()["overlay"] == []
-
-
-@pytest.mark.asyncio
-async def test_copy_on_write_carries_recipe_dir(client, db_session, maker_user):
-    from src.backend.tests.test_vision_copy_on_write import (
-        _current_task_and_subtask, _seed_measurement,
-    )
-    recipe = await create_test_recipe(db_session, maker_user.id)
-    _, task, _ = await _current_task_and_subtask(db_session, recipe.id)
-    task.task_type = "dxf_compare"
-    task.vision_json = RECIPE
-    task.vision_recipe_dir = "vision/recipes/1/abc"
-    await db_session.flush()
-    await _seed_measurement(db_session, recipe.id, maker_user.id)
-    db_session.expunge_all()
-    resp = await client.put(
-        f"/api/recipes/{recipe.id}", headers=auth_headers(maker_user),
-        json={"change_notes": "cow"},
-    )
-    assert resp.status_code == 200
-    db_session.expunge_all()
-    version, new_task, _ = await _current_task_and_subtask(db_session, recipe.id)
-    assert version.version_number == 2
-    assert new_task.vision_recipe_dir == "vision/recipes/1/abc" and new_task.vision_json == RECIPE
-
-
-@pytest.mark.asyncio
-async def test_retry_with_missing_file_then_complete_succeeds(
-    client, db_session, maker_user, monkeypatch,
-):
-    # worker finto: ok solo se il DXF esiste nella cartella della ricetta
-    async def fake(graph, recipe_dir):
-        present = (settings.upload_path / recipe_dir / "dxf" / "part.dxf").is_file()
-        return {"ok": present, "errors": [] if present else ["dxf missing"], "outputs": OUTPUTS}
-    monkeypatch.setattr("src.backend.services.vision_service.validate_recipe", fake)
-    task, _ = await make_task(db_session, maker_user)
-
-    first = await upload(client, maker_user, task, files=[])
-    assert first.status_code == 422
-    second = await upload(client, maker_user, task, files=GOOD_FILES)
-    assert second.status_code == 200, second.text

src/backend/tests/test_vision_reference.py

@@ -39,7 +39,7 @@ async def recipe_parts(db_session, recipe_id: int):
 @pytest.fixture
 def worker_says(monkeypatch):
     def _install(outputs: dict):
-        async def fake_call(image_bytes: bytes, graph: dict, **kwargs) -> dict:
+        async def fake_call(image_bytes: bytes, graph: dict) -> dict:
             return {"outputs": outputs, "failures": [],
                     "engine_version": "b" * 40, "duration_ms": 7}
         monkeypatch.setattr(

src/backend/tests/test_vision_upload_limits.py

@@ -69,7 +69,7 @@ async def recipe_parts(db_session, recipe_id: int):
 @pytest.fixture
 def worker_says(monkeypatch):
     def _install(outputs: dict):
-        async def fake_call(image_bytes: bytes, graph: dict, **kwargs) -> dict:
+        async def fake_call(image_bytes: bytes, graph: dict) -> dict:
             return {"outputs": outputs, "failures": [],
                     "engine_version": "c" * 40, "duration_ms": 5}
         monkeypatch.setattr(

src/frontend/flask_app/blueprints/admin.py

@@ -29,28 +29,30 @@ def admin_required(f):
 @login_required
 @admin_required
 def user_list():
-    """User management page."""
-    resp = api_client.get("/api/users")
-
-    if isinstance(resp, dict) and resp.get("error"):
-        flash(_("Errore nel caricamento degli utenti: %(error)s", error=resp.get("detail", "")), "error")
-        users = []
-    elif isinstance(resp, list):
-        users = resp
-    else:
-        users = []
-
-    return render_template("admin/users.html", users=users)
+    """#50: la gestione utenti vive nella tab «Utenti» di Impostazioni."""
+    return redirect(url_for("admin.settings_page", tab="utenti"))
 
 
 @admin_bp.route("/settings")
 @login_required
 @admin_required
 def settings_page():
-    """System settings page."""
+    """System settings page (admin only), con la tab «Utenti» (#50)."""
     resp = api_client.get("/api/settings")
-    settings = resp if not isinstance(resp, dict) or not resp.get("error") else {}
-    return render_template("admin/settings.html", settings=settings)
+    # Solo un dict valido sono impostazioni: un errore o altro tipo = nessuna
+    settings = resp if isinstance(resp, dict) and not resp.get("error") else {}
+
+    users_resp = api_client.get("/api/users")
+    if isinstance(users_resp, dict) and users_resp.get("error"):
+        flash(_("Errore nel caricamento degli utenti: %(error)s", error=users_resp.get("detail", "")), "error")
+        users = []
+    elif isinstance(users_resp, list):
+        users = users_resp
+    else:
+        users = []
+
+    tab = "utenti" if request.args.get("tab") == "utenti" else "generale"
+    return render_template("admin/settings.html", settings=settings, users=users, active_tab=tab)
 
 
 @admin_bp.route("/api/settings", methods=["PUT"])

src/frontend/flask_app/templates/admin/_users_panel.html

@@ -1,18 +1,7 @@
-{% extends "base.html" %}
-
-{% block title %}{{ _('Gestione Utenti') }} - TieMeasureFlow{% endblock %}
-
-{% block content %}
+{# Pannello utenti: incluso nella tab «Utenti» di Impostazioni (#50) #}
 <script>window.__users = {{ users|tojson }};</script>
 
-<div class="tmf-page"
-     x-data="userManagement(window.__users)">
-
-  <!-- Header -->
-  <div class="mb-6">
-    <h1 class="text-2xl font-bold text-[var(--text-primary)]">{{ _('Gestione Utenti') }}</h1>
-    <p class="mt-1 text-sm text-[var(--text-secondary)]">{{ _('Crea, modifica e gestisci gli utenti del sistema') }}</p>
-  </div>
+<div x-data="userManagement(window.__users)">
 
   <!-- Toolbar -->
   <div class="flex flex-col sm:flex-row items-start sm:items-center justify-between gap-3 mb-6">
@@ -102,6 +91,12 @@
                       <path stroke-linecap="round" stroke-linejoin="round" d="M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"/>
                     </svg>
                   </button>
+                  <!-- #51: reset password dall'admin -->
+                  <button @click="openReset(user)" class="p-1.5 rounded-lg text-[var(--text-secondary)] hover:text-primary hover:bg-primary-50 dark:hover:bg-primary-900/20 transition-colors" :title="{{ _('Reset password')|tojson_attr }}">
+                    <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
+                      <path stroke-linecap="round" stroke-linejoin="round" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"/>
+                    </svg>
+                  </button>
                   <button @click="toggleActive(user)" class="p-1.5 rounded-lg transition-colors"
                           :class="user.active
                             ? 'text-[var(--text-secondary)] hover:text-red-600 hover:bg-red-50 dark:hover:bg-red-900/20'
@@ -332,210 +327,51 @@
     </div>
   </div>
 
+  <!-- #51: Modal reset password (la password attuale non si mostra mai) -->
+  <div x-show="showReset" x-cloak
+       class="fixed inset-0 z-50 flex items-center justify-center p-4"
+       @keydown.escape.window="closeReset()">
+    <div class="absolute inset-0 bg-black/50" @click="closeReset()"></div>
+    <div class="relative bg-[var(--bg-card)] rounded-xl border border-[var(--border-color)] shadow-xl w-full max-w-md p-6">
+      <h3 class="text-lg font-semibold text-[var(--text-primary)] mb-2">
+        {{ _('Reset password') }}: <span x-text="resetUser?.username"></span>
+      </h3>
+      <p class="text-sm text-[var(--text-secondary)] mb-4">
+        {{ _('Le sessioni aperte dell\'utente verranno chiuse e dovrà accedere con la nuova password.') }}
+      </p>
+      <template x-if="!resetDone">
+        <div>
+          <label class="block text-sm font-medium text-[var(--text-primary)] mb-1">{{ _('Nuova password (minimo 8 caratteri)') }}</label>
+          <div class="flex gap-2">
+            <input type="text" x-model="resetPw" autocomplete="off"
+                   class="flex-1 px-3 py-2 rounded-lg border border-[var(--border-color)] bg-[var(--bg-card)] text-sm font-mono text-[var(--text-primary)] focus:outline-none focus:ring-2 focus:ring-primary/30 focus:border-primary">
+            <button @click="generateResetPw()" type="button"
+                    class="px-3 py-2 text-sm font-medium rounded-lg border border-[var(--border-color)] text-[var(--text-primary)] hover:bg-[var(--bg-secondary)]">
+              {{ _('Genera') }}
+            </button>
+          </div>
+          <template x-if="resetError">
+            <p class="mt-2 text-sm text-red-600" x-text="resetError"></p>
+          </template>
+        </div>
+      </template>
+      <template x-if="resetDone">
+        <div class="px-3 py-2 rounded-lg bg-emerald-50 dark:bg-emerald-900/20 border border-emerald-200 dark:border-emerald-800">
+          <p class="text-sm text-emerald-700 dark:text-emerald-300">{{ _('Password cambiata. Annotala ora: non verrà mostrata di nuovo.') }}</p>
+          <p class="mt-1 text-base font-mono font-semibold text-[var(--text-primary)] select-all" x-text="resetPw"></p>
+        </div>
+      </template>
+      <div class="flex justify-end gap-3 mt-5">
+        <button @click="closeReset()"
+                class="px-4 py-2 text-sm font-medium text-[var(--text-secondary)] rounded-lg hover:bg-[var(--bg-secondary)]">
+          <span x-text="resetDone ? {{ _('Chiudi')|tojson_attr }} : {{ _('Annulla')|tojson_attr }}"></span>
+        </button>
+        <button x-show="!resetDone" @click="confirmReset()" :disabled="saving"
+                class="px-4 py-2 bg-primary text-white text-sm font-medium rounded-lg hover:bg-primary-700 shadow-sm disabled:opacity-50">
+          {{ _('Imposta password') }}
+        </button>
+      </div>
+    </div>
+  </div>
+
 </div>
-{% endblock %}
-
-{% block extra_js %}
-<script>
-function userManagement(initialUsers) {
-  return {
-    users: initialUsers || [],
-    search: '',
-    showModal: false,
-    showToggleConfirm: false,
-    isEditing: false,
-    editingUserId: null,
-    toggleUser: null,
-    saving: false,
-    errorMsg: '',
-    form: {
-      username: '',
-      display_name: '',
-      email: '',
-      password: '',
-      roles: [],
-      is_admin: false,
-      language_pref: 'it',
-      theme_pref: 'light'
-    },
-
-    get csrfToken() {
-      const meta = document.querySelector('meta[name=csrf-token]');
-      return meta ? meta.content : '';
-    },
-
-    get filteredUsers() {
-      if (!this.search.trim()) return this.users;
-      const q = this.search.toLowerCase();
-      return this.users.filter(u =>
-        u.username.toLowerCase().includes(q) ||
-        (u.display_name && u.display_name.toLowerCase().includes(q)) ||
-        (u.email && u.email.toLowerCase().includes(q)) ||
-        (u.roles && u.roles.some(r => r.toLowerCase().includes(q)))
-      );
-    },
-
-    openCreateModal() {
-      this.isEditing = false;
-      this.editingUserId = null;
-      this.errorMsg = '';
-      this.form = {
-        username: '',
-        display_name: '',
-        email: '',
-        password: '',
-        roles: [],
-        is_admin: false,
-        language_pref: 'it',
-        theme_pref: 'light'
-      };
-      this.showModal = true;
-    },
-
-    openEditModal(user) {
-      this.isEditing = true;
-      this.editingUserId = user.id;
-      this.errorMsg = '';
-      this.form = {
-        username: user.username,
-        display_name: user.display_name || '',
-        email: user.email || '',
-        password: '',
-        roles: [...(user.roles || [])],
-        is_admin: user.is_admin || false,
-        language_pref: user.language_pref || 'it',
-        theme_pref: user.theme_pref || 'light'
-      };
-      this.showModal = true;
-    },
-
-    closeModal() {
-      this.showModal = false;
-      this.errorMsg = '';
-    },
-
-    async saveUser() {
-      this.saving = true;
-      this.errorMsg = '';
-
-      try {
-        if (this.isEditing) {
-          // Update user
-          const data = {
-            display_name: this.form.display_name,
-            email: this.form.email || null,
-            roles: this.form.roles,
-            is_admin: this.form.is_admin,
-            language_pref: this.form.language_pref,
-            theme_pref: this.form.theme_pref
-          };
-
-          const resp = await fetch(`/admin/api/users/${this.editingUserId}`, {
-            method: 'PUT',
-            headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
-            body: JSON.stringify(data)
-          });
-
-          const result = await resp.json();
-          if (!resp.ok) {
-            this.errorMsg = result.detail || 'Errore nel salvataggio';
-            return;
-          }
-
-          // Update local array
-          const idx = this.users.findIndex(u => u.id === this.editingUserId);
-          if (idx >= 0) this.users[idx] = result;
-
-          // Change password if provided
-          if (this.form.password) {
-            const pwResp = await fetch(`/admin/api/users/${this.editingUserId}/password`, {
-              method: 'PUT',
-              headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
-              body: JSON.stringify({ password: this.form.password })
-            });
-            if (!pwResp.ok) {
-              const pwResult = await pwResp.json();
-              this.errorMsg = pwResult.detail || 'Errore nel cambio password';
-              return;
-            }
-          }
-        } else {
-          // Create user
-          if (!this.form.username || !this.form.display_name || !this.form.password) {
-            this.errorMsg = '{{ _("Username, nome visualizzato e password sono obbligatori") }}';
-            return;
-          }
-
-          const data = {
-            username: this.form.username,
-            password: this.form.password,
-            display_name: this.form.display_name,
-            email: this.form.email || null,
-            roles: this.form.roles,
-            is_admin: this.form.is_admin,
-            language_pref: this.form.language_pref,
-            theme_pref: this.form.theme_pref
-          };
-
-          const resp = await fetch('/admin/api/users', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
-            body: JSON.stringify(data)
-          });
-
-          const result = await resp.json();
-          if (!resp.ok) {
-            this.errorMsg = result.detail || 'Errore nella creazione';
-            return;
-          }
-
-          this.users.push(result);
-        }
-
-        this.closeModal();
-      } catch (e) {
-        this.errorMsg = '{{ _("Errore di connessione al server") }}';
-      } finally {
-        this.saving = false;
-      }
-    },
-
-    toggleActive(user) {
-      this.toggleUser = user;
-      this.showToggleConfirm = true;
-    },
-
-    async confirmToggle() {
-      if (!this.toggleUser) return;
-      this.saving = true;
-
-      try {
-        const newActive = !this.toggleUser.active;
-        const resp = await fetch(`/admin/api/users/${this.toggleUser.id}/toggle-active`, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
-          body: JSON.stringify({ active: newActive })
-        });
-
-        const result = await resp.json();
-        if (!resp.ok) {
-          alert(result.detail || 'Errore');
-          return;
-        }
-
-        // Update local array
-        const idx = this.users.findIndex(u => u.id === this.toggleUser.id);
-        if (idx >= 0) this.users[idx] = result;
-
-        this.showToggleConfirm = false;
-        this.toggleUser = null;
-      } catch (e) {
-        alert('{{ _("Errore di connessione al server") }}');
-      } finally {
-        this.saving = false;
-      }
-    }
-  };
-}
-</script>
-{% endblock %}

src/frontend/flask_app/templates/admin/_users_script.html

@@ -0,0 +1,258 @@
+<script>
+function userManagement(initialUsers) {
+  return {
+    users: initialUsers || [],
+    search: '',
+    showModal: false,
+    showToggleConfirm: false,
+    // #51: stato del reset password
+    showReset: false,
+    resetUser: null,
+    resetPw: '',
+    resetDone: false,
+    resetError: '',
+    isEditing: false,
+    editingUserId: null,
+    toggleUser: null,
+    saving: false,
+    errorMsg: '',
+    form: {
+      username: '',
+      display_name: '',
+      email: '',
+      password: '',
+      roles: [],
+      is_admin: false,
+      language_pref: 'it',
+      theme_pref: 'light'
+    },
+
+    get csrfToken() {
+      const meta = document.querySelector('meta[name=csrf-token]');
+      return meta ? meta.content : '';
+    },
+
+    get filteredUsers() {
+      if (!this.search.trim()) return this.users;
+      const q = this.search.toLowerCase();
+      return this.users.filter(u =>
+        u.username.toLowerCase().includes(q) ||
+        (u.display_name && u.display_name.toLowerCase().includes(q)) ||
+        (u.email && u.email.toLowerCase().includes(q)) ||
+        (u.roles && u.roles.some(r => r.toLowerCase().includes(q)))
+      );
+    },
+
+    openCreateModal() {
+      this.isEditing = false;
+      this.editingUserId = null;
+      this.errorMsg = '';
+      this.form = {
+        username: '',
+        display_name: '',
+        email: '',
+        password: '',
+        roles: [],
+        is_admin: false,
+        language_pref: 'it',
+        theme_pref: 'light'
+      };
+      this.showModal = true;
+    },
+
+    openEditModal(user) {
+      this.isEditing = true;
+      this.editingUserId = user.id;
+      this.errorMsg = '';
+      this.form = {
+        username: user.username,
+        display_name: user.display_name || '',
+        email: user.email || '',
+        password: '',
+        roles: [...(user.roles || [])],
+        is_admin: user.is_admin || false,
+        language_pref: user.language_pref || 'it',
+        theme_pref: user.theme_pref || 'light'
+      };
+      this.showModal = true;
+    },
+
+    closeModal() {
+      this.showModal = false;
+      this.errorMsg = '';
+    },
+
+    async saveUser() {
+      this.saving = true;
+      this.errorMsg = '';
+
+      try {
+        if (this.isEditing) {
+          // Update user
+          const data = {
+            display_name: this.form.display_name,
+            email: this.form.email || null,
+            roles: this.form.roles,
+            is_admin: this.form.is_admin,
+            language_pref: this.form.language_pref,
+            theme_pref: this.form.theme_pref
+          };
+
+          const resp = await fetch(`/admin/api/users/${this.editingUserId}`, {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
+            body: JSON.stringify(data)
+          });
+
+          const result = await resp.json();
+          if (!resp.ok) {
+            this.errorMsg = result.detail || 'Errore nel salvataggio';
+            return;
+          }
+
+          // Update local array
+          const idx = this.users.findIndex(u => u.id === this.editingUserId);
+          if (idx >= 0) this.users[idx] = result;
+
+          // Change password if provided
+          if (this.form.password) {
+            const pwResp = await fetch(`/admin/api/users/${this.editingUserId}/password`, {
+              method: 'PUT',
+              headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
+              body: JSON.stringify({ password: this.form.password })
+            });
+            if (!pwResp.ok) {
+              const pwResult = await pwResp.json();
+              this.errorMsg = pwResult.detail || 'Errore nel cambio password';
+              return;
+            }
+          }
+        } else {
+          // Create user
+          if (!this.form.username || !this.form.display_name || !this.form.password) {
+            this.errorMsg = '{{ _("Username, nome visualizzato e password sono obbligatori") }}';
+            return;
+          }
+
+          const data = {
+            username: this.form.username,
+            password: this.form.password,
+            display_name: this.form.display_name,
+            email: this.form.email || null,
+            roles: this.form.roles,
+            is_admin: this.form.is_admin,
+            language_pref: this.form.language_pref,
+            theme_pref: this.form.theme_pref
+          };
+
+          const resp = await fetch('/admin/api/users', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
+            body: JSON.stringify(data)
+          });
+
+          const result = await resp.json();
+          if (!resp.ok) {
+            this.errorMsg = result.detail || 'Errore nella creazione';
+            return;
+          }
+
+          this.users.push(result);
+        }
+
+        this.closeModal();
+      } catch (e) {
+        this.errorMsg = '{{ _("Errore di connessione al server") }}';
+      } finally {
+        this.saving = false;
+      }
+    },
+
+    // #51: reset password dall'admin, usa PUT /admin/api/users/<id>/password
+    openReset(user) {
+      this.resetUser = user;
+      this.resetPw = '';
+      this.resetDone = false;
+      this.resetError = '';
+      this.showReset = true;
+    },
+
+    closeReset() {
+      this.showReset = false;
+      this.resetPw = '';  // la password generata non resta in memoria
+      this.resetDone = false;
+    },
+
+    generateResetPw() {
+      // 12 caratteri senza simboli ambigui (0/O, 1/l/I), da crypto random
+      const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789';
+      const buf = new Uint32Array(12);
+      crypto.getRandomValues(buf);
+      this.resetPw = Array.from(buf, n => chars[n % chars.length]).join('');
+      this.resetError = '';
+    },
+
+    async confirmReset() {
+      if (!this.resetPw || this.resetPw.length < 8) {
+        this.resetError = {{ _('La password deve avere almeno 8 caratteri')|tojson }};
+        return;
+      }
+      this.saving = true;
+      this.resetError = '';
+      try {
+        const resp = await fetch(`/admin/api/users/${this.resetUser.id}/password`, {
+          method: 'PUT',
+          headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
+          body: JSON.stringify({ password: this.resetPw })
+        });
+        const result = await resp.json();
+        if (!resp.ok) {
+          this.resetError = result.detail || {{ _('Errore nel cambio password')|tojson }};
+          return;
+        }
+        this.resetDone = true;
+      } catch (e) {
+        this.resetError = {{ _('Errore di connessione al server')|tojson }};
+      } finally {
+        this.saving = false;
+      }
+    },
+
+    toggleActive(user) {
+      this.toggleUser = user;
+      this.showToggleConfirm = true;
+    },
+
+    async confirmToggle() {
+      if (!this.toggleUser) return;
+      this.saving = true;
+
+      try {
+        const newActive = !this.toggleUser.active;
+        const resp = await fetch(`/admin/api/users/${this.toggleUser.id}/toggle-active`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
+          body: JSON.stringify({ active: newActive })
+        });
+
+        const result = await resp.json();
+        if (!resp.ok) {
+          alert(result.detail || 'Errore');
+          return;
+        }
+
+        // Update local array
+        const idx = this.users.findIndex(u => u.id === this.toggleUser.id);
+        if (idx >= 0) this.users[idx] = result;
+
+        this.showToggleConfirm = false;
+        this.toggleUser = null;
+      } catch (e) {
+        alert('{{ _("Errore di connessione al server") }}');
+      } finally {
+        this.saving = false;
+      }
+    }
+  };
+}
+</script>

src/frontend/flask_app/templates/admin/settings.html

@@ -3,17 +3,31 @@
 {% block title %}{{ _('Impostazioni') }} - TieMeasureFlow{% endblock %}
 
 {% block content %}
-<div class="tmf-page tmf-page-narrow"
-     x-data="systemSettings()">
+<div class="tmf-page" x-data="{ tab: {{ active_tab|tojson_attr }} }">
 
   <!-- Header -->
-  <div class="mb-6">
+  <div class="mb-4">
     <h1 class="text-2xl font-bold text-[var(--text-primary)]">{{ _('Impostazioni di Sistema') }}</h1>
     <p class="mt-1 text-sm text-[var(--text-secondary)]">{{ _('Configura i parametri generali del sistema') }}</p>
   </div>
 
+  <!-- #50: tab. L'intera pagina e' gia' solo per admin (admin_required) -->
+  <div class="flex gap-1 mb-6 border-b border-[var(--border-color)]">
+    <button type="button" @click="tab = 'generale'"
+            :class="tab === 'generale' ? 'border-primary text-primary' : 'border-transparent text-[var(--text-secondary)] hover:text-[var(--text-primary)]'"
+            class="px-4 py-2 -mb-px text-sm font-medium border-b-2 transition-colors">{{ _('Generale') }}</button>
+    <button type="button" @click="tab = 'utenti'"
+            :class="tab === 'utenti' ? 'border-primary text-primary' : 'border-transparent text-[var(--text-secondary)] hover:text-[var(--text-primary)]'"
+            class="px-4 py-2 -mb-px text-sm font-medium border-b-2 transition-colors">{{ _('Utenti') }}</button>
+  </div>
+
+  <div x-show="tab === 'utenti'" x-cloak>
+    {% include "admin/_users_panel.html" %}
+  </div>
+
+  <div x-show="tab === 'generale'" class="max-w-4xl mx-auto" x-data="systemSettings()">
   <!-- Settings Card -->
-  <div class="tmf-card">
+  <div class="tmf-card mb-6">
     <div class="tmf-card-header flex items-center gap-2">
       <svg class="w-4 h-4 text-[var(--text-muted)]" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
         <path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z"/>
@@ -43,6 +57,57 @@
           {{ _('L\'operatore verrà disconnesso automaticamente dopo il periodo di inattività indicato. Lasciare vuoto per disabilitare.') }}
         </p>
       </div>
+
+      <!-- #47: durata loop predefinita delle ricette -->
+      <div class="pt-5 border-t border-[var(--border-color)]">
+        <h3 class="text-sm font-semibold text-[var(--text-primary)] mb-3">{{ _('Ricette') }}</h3>
+        <label class="tmf-label" for="default-interval">{{ _('Durata loop predefinita (minuti)') }}</label>
+        <input id="default-interval" type="number" x-model="defaultInterval" class="tmf-input w-32" min="1" max="1440" placeholder="—">
+        <p class="text-xs text-[var(--text-muted)] mt-1">{{ _('Proposta come intervallo di misura nelle nuove ricette (1-1440). Vuoto = nessun predefinito.') }}</p>
+      </div>
+
+      <!-- #48: tolleranze generali -->
+      <div class="pt-5 border-t border-[var(--border-color)]">
+        <h3 class="text-sm font-semibold text-[var(--text-primary)] mb-3">{{ _('Tolleranze generali') }}</h3>
+        <div class="flex items-center gap-6">
+          <div>
+            <label class="tmf-label" for="tol-plus">{{ _('Tolleranza +') }}</label>
+            <input id="tol-plus" type="text" inputmode="decimal" x-model="tolPlus" class="tmf-input w-32" placeholder="—">
+          </div>
+          <div>
+            <label class="tmf-label" for="tol-minus">{{ _('Tolleranza −') }}</label>
+            <input id="tol-minus" type="text" inputmode="decimal" x-model="tolMinus" class="tmf-input w-32" placeholder="—">
+          </div>
+        </div>
+        <p class="text-xs text-[var(--text-muted)] mt-1">{{ _('Valori positivi (zero o più) proposti come tolleranza nelle nuove misure. Vuoto = nessun predefinito.') }}</p>
+      </div>
+
+      <!-- #49: anagrafiche (liste di scelta) -->
+      <div class="pt-5 border-t border-[var(--border-color)]">
+        <h3 class="text-sm font-semibold text-[var(--text-primary)] mb-3">{{ _('Anagrafiche') }}</h3>
+        <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
+          <template x-for="lst in ['types', 'units']" :key="lst">
+            <div>
+              <label class="tmf-label" x-text="lst === 'types' ? {{ _('Tipi di misura')|tojson_attr }} : {{ _('Unità di misura')|tojson_attr }}"></label>
+              <ul class="space-y-1 mb-2">
+                <template x-for="(item, i) in lists[lst]" :key="lst + i">
+                  <li class="flex items-center gap-1 text-sm">
+                    <span class="flex-1 px-2 py-1 rounded bg-[var(--bg-secondary)] text-[var(--text-primary)]" x-text="item"></span>
+                    <button type="button" @click="moveItem(lst, i, -1)" :disabled="i === 0" class="px-1.5 text-[var(--text-muted)] hover:text-primary disabled:opacity-30" title="{{ _('Su') }}">▲</button>
+                    <button type="button" @click="moveItem(lst, i, 1)" :disabled="i === lists[lst].length - 1" class="px-1.5 text-[var(--text-muted)] hover:text-primary disabled:opacity-30" title="{{ _('Giù') }}">▼</button>
+                    <button type="button" @click="removeItem(lst, i)" class="px-1.5 text-[var(--text-muted)] hover:text-red-500" title="{{ _('Rimuovi') }}">✕</button>
+                  </li>
+                </template>
+              </ul>
+              <div class="flex gap-2">
+                <input type="text" x-model="newItem[lst]" @keydown.enter.prevent="addItem(lst)" class="tmf-input flex-1" placeholder="{{ _('Nuova voce') }}">
+                <button type="button" @click="addItem(lst)" class="btn btn-secondary">{{ _('Aggiungi') }}</button>
+              </div>
+            </div>
+          </template>
+        </div>
+        <p class="text-xs text-[var(--text-muted)] mt-2">{{ _('Massimo 50 voci per lista. Un elenco vuoto = nessuna scelta predefinita.') }}</p>
+      </div>
     </div>
 
     <div class="tmf-card-footer flex items-center justify-between">
@@ -68,18 +133,48 @@
       </button>
     </div>
   </div>
+  </div><!-- /tab generale -->
 </div>
 {% endblock %}
 
 {% block extra_js %}
 <script>
+// #49: legge un array JSON di stringhe salvato come impostazione; vuoto/malformato = lista vuota
+function tmfParseList(raw) {
+  try { var a = JSON.parse(raw || '[]'); return Array.isArray(a) ? a.map(String) : []; }
+  catch (e) { return []; }
+}
 function systemSettings() {
   return {
     autoLogoutMinutes: {{ (settings.auto_logout_minutes or '')|tojson }},
+    // #47-#49: nuove chiavi (valori stringa, vuoto = nessun default)
+    defaultInterval: {{ (settings.default_measurement_interval_minutes or '')|tojson }},
+    tolPlus: {{ (settings.general_tolerance_plus or '')|tojson }},
+    tolMinus: {{ (settings.general_tolerance_minus or '')|tojson }},
+    lists: {
+      types: tmfParseList({{ (settings.list_measurement_types or '')|tojson }}),
+      units: tmfParseList({{ (settings.list_units or '')|tojson }})
+    },
+    newItem: { types: '', units: '' },
     saving: false,
     saved: false,
     errorMessage: '',
 
+    addItem(lst) {
+      var v = (this.newItem[lst] || '').trim();
+      if (!v) return;
+      if (this.lists[lst].length >= 50) { this.errorMessage = {{ _('Massimo 50 voci per lista')|tojson }}; return; }
+      if (this.lists[lst].indexOf(v) === -1) this.lists[lst].push(v);
+      this.newItem[lst] = '';
+    },
+    removeItem(lst, i) { this.lists[lst].splice(i, 1); },
+    moveItem(lst, i, d) {
+      var a = this.lists[lst].slice(), j = i + d;
+      if (j < 0 || j >= a.length) return;
+      var t = a[i]; a[i] = a[j]; a[j] = t;
+      this.lists[lst] = a;
+    },
+
     async save() {
       this.saving = true;
       this.saved = false;
@@ -87,7 +182,13 @@ function systemSettings() {
 
       var csrfToken = document.querySelector('meta[name=csrf-token]')?.content;
       var payload = {
-        auto_logout_minutes: this.autoLogoutMinutes ? String(this.autoLogoutMinutes) : ''
+        auto_logout_minutes: this.autoLogoutMinutes ? String(this.autoLogoutMinutes) : '',
+        default_measurement_interval_minutes: String(this.defaultInterval || '').trim(),
+        // virgola decimale accettata in input, il backend vuole il punto
+        general_tolerance_plus: String(this.tolPlus || '').trim().replace(',', '.'),
+        general_tolerance_minus: String(this.tolMinus || '').trim().replace(',', '.'),
+        list_measurement_types: this.lists.types.length ? JSON.stringify(this.lists.types) : '',
+        list_units: this.lists.units.length ? JSON.stringify(this.lists.units) : ''
       };
 
       try {
@@ -111,4 +212,5 @@ function systemSettings() {
   };
 }
 </script>
+{% include "admin/_users_script.html" %}
 {% endblock %}

src/frontend/flask_app/templates/components/navbar.html

@@ -32,7 +32,6 @@
     {{ nav_link(url_for('statistics.dashboard'), _('Statistiche'), icon_stats, ep.startswith('statistics.'), mobile) }}
   {% endif %}
   {% if current_user.get('is_admin') %}
-    {{ nav_link(url_for('admin.user_list'), _('Utenti'), icon_users, ep == 'admin.user_list', mobile) }}
     {{ nav_link(url_for('admin.station_list'), _('Stazioni'), icon_stations, ep == 'admin.station_list', mobile) }}
     {{ nav_link(url_for('admin.settings_page'), _('Impostazioni'), icon_settings, ep == 'admin.settings_page', mobile) }}
   {% endif %}

src/frontend/flask_app/tests/test_admin_users_tab.py

@@ -0,0 +1,64 @@
+"""#50/#51: tab Utenti dentro Impostazioni, redirect da /admin/users, reset password."""
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from tests.conftest import api_get_router
+
+USER = {
+    "id": 2, "username": "mario", "display_name": "Mario", "email": None,
+    "roles": ["MeasurementTec"], "is_admin": False, "language_pref": "it",
+    "theme_pref": "light", "active": True,
+}
+
+
+@pytest.fixture
+def mock_admin_api():
+    mock = MagicMock()
+    mock.get.side_effect = api_get_router({
+        "/api/users": [USER],
+        "/api/settings": {"auto_logout_minutes": "30"},
+    })
+    with patch("blueprints.admin.api_client", mock):
+        yield mock
+
+
+def test_users_url_redirects_to_settings_tab(logged_in_client, mock_admin_api):
+    resp = logged_in_client.get("/admin/users")
+    assert resp.status_code == 302
+    assert resp.headers["Location"].endswith("/admin/settings?tab=utenti")
+
+
+def test_settings_has_users_tab_and_reset_for_admin(logged_in_client, mock_admin_api):
+    resp = logged_in_client.get("/admin/settings?tab=utenti")
+    assert resp.status_code == 200
+    html = resp.data.decode("utf-8")
+    assert "userManagement(" in html          # pannello utenti incluso
+    assert "openReset(user)" in html          # pulsante reset password (#51)
+    assert "mario" in html                    # utente caricato
+    assert "tab: " in html and "utenti" in html  # tab iniziale richiesta
+
+
+def test_navbar_has_no_users_link(logged_in_client, mock_admin_api):
+    html = logged_in_client.get("/admin/settings").data.decode("utf-8")
+    assert 'href="/admin/users"' not in html
+
+
+def test_non_admin_cannot_reach_users_tab(client, mock_admin_api):
+    with client.session_transaction() as sess:
+        sess["api_key"] = "k"
+        sess["user"] = {"id": 3, "username": "op", "roles": ["MeasurementTec"],
+                        "is_admin": False, "language_pref": "it", "theme_pref": "light"}
+    for url in ("/admin/settings?tab=utenti", "/admin/users"):
+        resp = client.get(url)
+        assert resp.status_code == 302
+        assert "/admin/" not in resp.headers["Location"]
+    mock_admin_api.get.assert_not_called()
+
+
+def test_password_reset_proxy(logged_in_client, mock_admin_api):
+    mock_admin_api.put.return_value = {"message": "ok"}
+    resp = logged_in_client.put("/admin/api/users/2/password", json={"password": "Nuova1234"})
+    assert resp.status_code == 200
+    mock_admin_api.put.assert_called_once_with(
+        "/api/users/2/password", data={"password": "Nuova1234"})

src/frontend/flask_app/tests/test_template_js_syntax.py

@@ -256,7 +256,7 @@ def test_admin_stations_inline_js_is_valid_in_english(
 
 
 def test_admin_users_inline_js_is_valid(logged_in_client, mock_admin_api):
-    """Same guard for /admin/users (reuses the userManagement Alpine pattern)."""
+    """Same guard for the Users tab, now inside /admin/settings (#50)."""
     mock_admin_api.get.return_value = [{
         "id": 1, "username": "admin", "display_name": "Admin",
         "email": None, "roles": ["Maker"], "is_admin": True,
@@ -264,7 +264,7 @@ def test_admin_users_inline_js_is_valid(logged_in_client, mock_admin_api):
     }]
 
     _force_italian(logged_in_client)
-    resp = logged_in_client.get("/admin/users")
+    resp = logged_in_client.get("/admin/settings")
     assert resp.status_code == 200
 
     html = resp.data.decode("utf-8")
@@ -272,9 +272,9 @@ def test_admin_users_inline_js_is_valid(logged_in_client, mock_admin_api):
     assert scripts
 
     for i, body in enumerate(scripts):
-        _node_check(body, f"/admin/users script[{i}]")
+        _node_check(body, f"/admin/settings script[{i}]")
 
-    _check_alpine_attributes(html, "/admin/users")
+    _check_alpine_attributes(html, "/admin/settings")
 
 
 @pytest.fixture