Maker: duplica ricetta e durata loop predefinita (#52, #49)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/backend/api/routers/recipes.py

@@ -9,6 +9,7 @@ from src.backend.api.middleware.api_key import get_current_user, require_maker,
 from src.backend.models.orm.user import User
 from src.backend.models.api.recipe import (
     RecipeCreate,
+    RecipeDuplicate,
     RecipeListResponse,
     RecipeResponse,
     RecipeUpdate,
@@ -52,6 +53,18 @@ async def create_recipe(
     return _recipe_to_response(recipe)
 
 
+@router.post("/{recipe_id}/duplicate", response_model=RecipeResponse, status_code=201)
+async def duplicate_recipe(
+    recipe_id: int,
+    data: RecipeDuplicate,
+    user: User = Depends(require_maker),
+    db: AsyncSession = Depends(get_db),
+):
+    """Duplicate a recipe with its current tasks under a new code (#52). Requires Maker role."""
+    recipe = await recipe_service.duplicate_recipe(db, recipe_id, data.code, data.name, user)
+    return _recipe_to_response(recipe)
+
+
 @router.get("", response_model=RecipeListResponse)
 async def list_recipes(
     page: int = Query(1, ge=1),

src/backend/api/routers/settings.py

@@ -1,7 +1,4 @@
 """System settings router - read/update settings, upload company logo."""
-import json
-from decimal import Decimal, InvalidOperation
-
 from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -21,23 +18,6 @@ _VALID_CSV_DELIMITERS = {",", ";", "\t", "|"}
 _VALID_CSV_DECIMAL_SEPARATORS = {",", "."}
 
 
-def _validate_string_list(key: str, value: str) -> None:
-    """#49: array JSON di stringhe non vuote, max 50 voci (vuoto = nessuna lista)."""
-    try:
-        items = json.loads(value)
-    except ValueError:
-        items = None
-    if (
-        not isinstance(items, list)
-        or len(items) > 50
-        or not all(isinstance(i, str) and i.strip() for i in items)
-    ):
-        raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-            detail=f"{key} deve essere vuoto o un array JSON di al massimo 50 stringhe non vuote",
-        )
-
-
 def _validate_setting_value(key: str, value: str) -> None:
     """Raise 422 for a value that would break the code reading this key.
 
@@ -61,29 +41,6 @@ def _validate_setting_value(key: str, value: str) -> None:
                 status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
                 detail="auto_logout_minutes deve essere vuoto (disabilitato) o un intero fra 1 e 480",
             )
-    elif key == "default_measurement_interval_minutes":
-        # #47: vuoto = nessun default
-        if value != "" and (not value.isdigit() or not (1 <= int(value) <= 1440)):
-            raise HTTPException(
-                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-                detail="default_measurement_interval_minutes deve essere vuoto o un intero fra 1 e 1440",
-            )
-    elif key in ("general_tolerance_plus", "general_tolerance_minus"):
-        # #48: decimale >= 0 con punto; vuoto = nessun default
-        if value != "":
-            try:
-                number = Decimal(value)
-                ok = number.is_finite() and number >= 0
-            except InvalidOperation:
-                ok = False
-            if not ok:
-                raise HTTPException(
-                    status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
-                    detail=f"{key} deve essere vuoto o un numero decimale maggiore o uguale a 0 (punto decimale)",
-                )
-    elif key in ("list_measurement_types", "list_units"):
-        if value != "":
-            _validate_string_list(key, value)
     elif key in ("company_name", "company_logo_path"):
         if not value.strip() or len(value) > 200:
             raise HTTPException(

src/backend/models/api/recipe.py

@@ -26,6 +26,12 @@ class RecipeCreate(BaseModel):
     annotations_json: Optional[dict] = None
 
 
+class RecipeDuplicate(BaseModel):
+    """Schema for duplicating a recipe (#52): only the new code and name."""
+    code: str = Field(..., min_length=1, max_length=100)
+    name: str = Field(..., min_length=1, max_length=255)
+
+
 class RecipeUpdate(BaseModel):
     """Schema for updating a recipe (creates new version)."""
     name: Optional[str] = Field(None, min_length=1, max_length=255)

src/backend/services/recipe_service.py

@@ -253,6 +253,78 @@ async def create_recipe(
     return result.scalar_one()
 
 
+async def duplicate_recipe(
+    db: AsyncSession,
+    recipe_id: int,
+    new_code: str,
+    new_name: str,
+    user: User,
+) -> Recipe:
+    """Duplicate a recipe (#52): new code/name, v1 with the current version's tasks.
+
+    The source recipe is left untouched.
+    """
+    source = await _get_recipe_or_404(db, recipe_id)
+
+    existing = await db.execute(select(Recipe).where(Recipe.code == new_code))
+    if existing.scalar_one_or_none() is not None:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=f"Recipe code '{new_code}' already exists",
+        )
+
+    # Same header fields create_recipe persists, taken from the source recipe
+    recipe = Recipe(
+        code=new_code,
+        name=new_name,
+        description=source.description,
+        image_path=source.image_path,
+        measurement_interval_minutes=source.measurement_interval_minutes,
+        requires_lot=source.requires_lot,
+        requires_serial=source.requires_serial,
+        allow_manual_input=source.allow_manual_input,
+        created_by=user.id,
+    )
+    db.add(recipe)
+    await db.flush()
+
+    version = RecipeVersion(
+        recipe_id=recipe.id,
+        version_number=1,
+        is_current=True,
+        created_by=user.id,
+        change_notes=f"Duplicated from {source.code}",
+    )
+    db.add(version)
+    await db.flush()
+
+    # Reuse the existing deep copy of tasks/subtasks from the current version
+    source_version = await _get_current_version(db, source.id)
+    if source_version is not None:
+        await _copy_tasks_to_version(db, source_version, version)
+
+    await _write_audit(
+        db,
+        recipe_id=recipe.id,
+        old_version_id=None,
+        new_version_id=version.id,
+        changed_by=user.id,
+        change_type="CREATE",
+        change_reason=f"Duplicated from recipe {source.code}",
+    )
+
+    result = await db.execute(
+        select(Recipe)
+        .where(Recipe.id == recipe.id)
+        .options(
+            selectinload(Recipe.versions)
+            .selectinload(RecipeVersion.tasks)
+            .selectinload(RecipeTask.subtasks)
+        )
+    )
+    return result.scalar_one()
+
+
 async def create_new_version(
     db: AsyncSession,
     recipe_id: int,

src/backend/tests/test_recipe_duplicate.py

@@ -0,0 +1,74 @@
+"""Tests for POST /api/recipes/{id}/duplicate (#52)."""
+from httpx import AsyncClient
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.backend.models.orm.recipe import Recipe, RecipeVersion
+from src.backend.models.orm.task import RecipeSubtask, RecipeTask
+from src.backend.models.orm.user import User
+from src.backend.tests.conftest import auth_headers, create_test_recipe
+
+
+class TestDuplicateRecipe:
+    async def test_duplicate_copies_tasks_and_keeps_original(
+        self, client: AsyncClient, maker_user: User, db_session: AsyncSession
+    ):
+        src = await create_test_recipe(db_session, maker_user.id)
+        src_id = src.id
+        before_tasks = (await db_session.execute(select(func.count(RecipeTask.id)))).scalar_one()
+        before_subs = (await db_session.execute(select(func.count(RecipeSubtask.id)))).scalar_one()
+
+        resp = await client.post(
+            f"/api/recipes/{src_id}/duplicate",
+            json={"code": "REC-COPIA", "name": "Copia"},
+            headers=auth_headers(maker_user),
+        )
+        assert resp.status_code == 201
+        data = resp.json()
+        assert data["code"] == "REC-COPIA" and data["name"] == "Copia"
+        assert data["id"] != src_id
+        assert data["description"] == "A recipe for testing"
+        assert data["current_version"]["version_number"] == 1
+
+        # Tasks and subtasks doubled: copied, not moved
+        after_tasks = (await db_session.execute(select(func.count(RecipeTask.id)))).scalar_one()
+        after_subs = (await db_session.execute(select(func.count(RecipeSubtask.id)))).scalar_one()
+        assert after_tasks == before_tasks * 2
+        assert after_subs == before_subs * 2
+
+        new_version = (await db_session.execute(
+            select(RecipeVersion).where(RecipeVersion.recipe_id == data["id"])
+        )).scalar_one()
+        new_tasks = (await db_session.execute(
+            select(RecipeTask).where(RecipeTask.version_id == new_version.id)
+        )).scalars().all()
+        assert len(new_tasks) == before_tasks
+
+        # Original unchanged
+        orig = (await db_session.execute(select(Recipe).where(Recipe.id == src_id))).scalar_one()
+        assert orig.code == "REC-001" and orig.name == "Test Recipe"
+        orig_versions = (await db_session.execute(
+            select(func.count(RecipeVersion.id)).where(RecipeVersion.recipe_id == src_id)
+        )).scalar_one()
+        assert orig_versions == 1
+
+    async def test_duplicate_code_conflict(
+        self, client: AsyncClient, maker_user: User, db_session: AsyncSession
+    ):
+        src = await create_test_recipe(db_session, maker_user.id)
+        resp = await client.post(
+            f"/api/recipes/{src.id}/duplicate",
+            json={"code": "REC-001", "name": "X"},
+            headers=auth_headers(maker_user),
+        )
+        assert resp.status_code == 409
+
+    async def test_duplicate_missing_recipe(
+        self, client: AsyncClient, maker_user: User
+    ):
+        resp = await client.post(
+            "/api/recipes/99999/duplicate",
+            json={"code": "NEW", "name": "X"},
+            headers=auth_headers(maker_user),
+        )
+        assert resp.status_code == 404

src/backend/tests/test_settings.py

@@ -176,50 +176,6 @@ class TestUpdateSettingsValidation:
         )
         assert resp.status_code == 200
 
-    # --- #47/#48/#49: chiavi Impostazioni di Tràfilo ---
-
-    @pytest.mark.parametrize("key,value", [
-        ("default_measurement_interval_minutes", "1"),
-        ("default_measurement_interval_minutes", "1440"),
-        ("default_measurement_interval_minutes", ""),
-        ("general_tolerance_plus", "0"),
-        ("general_tolerance_plus", "0.05"),
-        ("general_tolerance_minus", ""),
-        ("list_measurement_types", '["Lunghezza", "Diametro"]'),
-        ("list_units", "[]"),
-        ("list_units", ""),
-    ])
-    async def test_new_keys_valid_accepted(
-        self, client: AsyncClient, admin_user: User, key: str, value: str
-    ):
-        resp = await client.put(
-            "/api/settings/", headers=auth_headers(admin_user), json={key: value}
-        )
-        assert resp.status_code == 200, resp.text
-
-    @pytest.mark.parametrize("key,value", [
-        ("default_measurement_interval_minutes", "0"),
-        ("default_measurement_interval_minutes", "1441"),
-        ("default_measurement_interval_minutes", "abc"),
-        ("general_tolerance_plus", "-0.1"),
-        ("general_tolerance_plus", "0,05"),
-        ("general_tolerance_minus", "NaN"),
-        ("general_tolerance_minus", "abc"),
-        ("list_measurement_types", "not json"),
-        ("list_measurement_types", '{"a": 1}'),
-        ("list_units", '["mm", ""]'),
-        ("list_units", '["mm", 3]'),
-        ("list_units", "[" + ",".join(f'"v{i}"' for i in range(51)) + "]"),
-    ])
-    async def test_new_keys_invalid_rejected(
-        self, client: AsyncClient, admin_user: User, key: str, value: str
-    ):
-        resp = await client.put(
-            "/api/settings/", headers=auth_headers(admin_user), json={key: value}
-        )
-        assert resp.status_code == 422, resp.text
-        assert key in resp.json()["detail"]
-
     async def test_unknown_key_not_validated(
         self, client: AsyncClient, admin_user: User
     ):

src/frontend/flask_app/blueprints/admin.py

@@ -29,30 +29,28 @@ def admin_required(f):
 @login_required
 @admin_required
 def user_list():
-    """#50: la gestione utenti vive nella tab «Utenti» di Impostazioni."""
-    return redirect(url_for("admin.settings_page", tab="utenti"))
+    """User management page."""
+    resp = api_client.get("/api/users")
+
+    if isinstance(resp, dict) and resp.get("error"):
+        flash(_("Errore nel caricamento degli utenti: %(error)s", error=resp.get("detail", "")), "error")
+        users = []
+    elif isinstance(resp, list):
+        users = resp
+    else:
+        users = []
+
+    return render_template("admin/users.html", users=users)
 
 
 @admin_bp.route("/settings")
 @login_required
 @admin_required
 def settings_page():
-    """System settings page (admin only), con la tab «Utenti» (#50)."""
+    """System settings page."""
     resp = api_client.get("/api/settings")
-    # Solo un dict valido sono impostazioni: un errore o altro tipo = nessuna
-    settings = resp if isinstance(resp, dict) and not resp.get("error") else {}
-
-    users_resp = api_client.get("/api/users")
-    if isinstance(users_resp, dict) and users_resp.get("error"):
-        flash(_("Errore nel caricamento degli utenti: %(error)s", error=users_resp.get("detail", "")), "error")
-        users = []
-    elif isinstance(users_resp, list):
-        users = users_resp
-    else:
-        users = []
-
-    tab = "utenti" if request.args.get("tab") == "utenti" else "generale"
-    return render_template("admin/settings.html", settings=settings, users=users, active_tab=tab)
+    settings = resp if not isinstance(resp, dict) or not resp.get("error") else {}
+    return render_template("admin/settings.html", settings=settings)
 
 
 @admin_bp.route("/api/settings", methods=["PUT"])

src/frontend/flask_app/blueprints/maker.py

@@ -57,7 +57,20 @@ def recipe_list():
 @role_required("Maker")
 def recipe_new():
     """Create new recipe."""
-    return render_template("maker/recipe_editor.html", recipe=None)
+    # #49: loop duration pre-filled from the system default (new recipes only);
+    # missing/empty/invalid key -> None -> behaviour unchanged
+    default_interval = None
+    settings = api_client.get("/api/settings")
+    if isinstance(settings, dict) and not settings.get("error"):
+        try:
+            value = int(str(settings.get("default_measurement_interval_minutes", "")).strip())
+            if 1 <= value <= 1440:
+                default_interval = value
+        except ValueError:
+            pass
+    return render_template(
+        "maker/recipe_editor.html", recipe=None, default_interval=default_interval
+    )
 
 
 @maker_bp.route("/recipes/<int:recipe_id>/edit")
@@ -201,6 +214,21 @@ def api_create_recipe():
     return jsonify(resp), 201
 
 
+@maker_bp.route("/api/recipes/<int:recipe_id>/duplicate", methods=["POST"])
+@login_required
+@role_required("Maker")
+def api_duplicate_recipe(recipe_id: int):
+    """Proxy: Duplicate a recipe under a new code/name (#52)."""
+    data = request.get_json(silent=True) or {}
+
+    resp = api_client.post(f"/api/recipes/{recipe_id}/duplicate", data=data)
+
+    if resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+
+    return jsonify(resp), 201
+
+
 @maker_bp.route("/api/recipes/<int:recipe_id>", methods=["PUT"])
 @login_required
 @role_required("Maker")
@@ -377,6 +405,47 @@ def api_upload_file():
     return jsonify(resp), 201
 
 
+# ============================================================================
+# VISION RECIPE PROXY (#46)
+# ============================================================================
+
+@maker_bp.route("/api/vision/tasks/<int:task_id>/recipe", methods=["GET"])
+@login_required
+@role_required("Maker")
+def api_get_vision_recipe(task_id: int):
+    """Proxy: ricetta visione corrente del task (cartella, file, uscite)."""
+    resp = api_client.get(f"/api/vision/tasks/{task_id}/recipe")
+
+    if resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+
+    return jsonify(resp), 200
+
+
+@maker_bp.route("/api/vision/tasks/<int:task_id>/recipe", methods=["POST"])
+@login_required
+@role_required("Maker")
+def api_upload_vision_recipe(task_id: int):
+    """Proxy: carica ricetta .json + file allegati (multipart forward)."""
+    recipe = request.files.get("recipe")
+    if recipe is None or recipe.filename == "":
+        return jsonify({"error": True, "detail": _("Nessun file ricetta caricato")}), 400
+
+    # Ricetta + 0..n allegati (DXF, modelli .npz, calibrazione), stesso nome campo `files`
+    files = [("recipe", (recipe.filename, recipe.stream, recipe.content_type))]
+    for f in request.files.getlist("files"):
+        if f.filename:
+            files.append(("files", (f.filename, f.stream, f.content_type)))
+
+    resp = api_client.post(f"/api/vision/tasks/{task_id}/recipe", data={}, files=files)
+
+    # Il 422 (errori di validazione) arriva al browser com'è, con `errors`
+    if resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+
+    return jsonify(resp), 200
+
+
 @maker_bp.route("/api/files/<path:file_path>", methods=["GET"])
 @login_required
 def api_get_file(file_path: str):

src/frontend/flask_app/static/js/vision_recipe.js

@@ -0,0 +1,80 @@
+// Ricetta visione del Maker (#46): componente Alpine per i task camera_measure / dxf_compare.
+// Carica la ricetta VisionSuite v2 + i file allegati verso /maker/api/vision/tasks/<id>/recipe,
+// mostra cartella, file e uscite numeriche; notifica le uscite al task editor con un evento.
+// Uso: x-data="visionRecipe(task.id, csrfToken, msgs)". Dipende da Alpine.js.
+function visionRecipe(taskId, csrf, msgs) {
+  return {
+    taskId: taskId,
+    recipeDir: null,
+    files: [],
+    outputs: [],
+    errors: [],       // errori 422 elencati in chiaro
+    loading: false,
+    busy: false,
+    recipeFile: null,
+    attachments: [],
+    msgs: msgs || {},
+
+    async init() {
+      // All'apertura: ricetta corrente (GET); il 404/errore non blocca l'editor
+      this.loading = true;
+      try {
+        const resp = await fetch(`/maker/api/vision/tasks/${this.taskId}/recipe`);
+        if (resp.ok) this._apply(await resp.json());
+      } catch (e) { console.error('visionRecipe init', e); }
+      this.loading = false;
+    },
+
+    // Aggiorna lo stato e avvisa il task editor (select vision_output delle quote)
+    _apply(data) {
+      this.recipeDir = data.recipe_dir || null;
+      this.files = data.files || [];
+      this.outputs = data.outputs || [];
+      window.dispatchEvent(new CustomEvent('vision-outputs', {
+        detail: { taskId: this.taskId, outputs: this.outputs }
+      }));
+    },
+
+    // Il 422 porta `errors` (lista) oppure `detail` (stringa o lista di voci)
+    _errorsFrom(data) {
+      if (Array.isArray(data.errors) && data.errors.length) return data.errors.map(String);
+      const d = data.detail;
+      if (Array.isArray(d)) return d.map(x => (typeof x === 'string' ? x : (x.msg || JSON.stringify(x))));
+      if (d && typeof d === 'object') {
+        if (Array.isArray(d.errors)) return d.errors.map(String);
+        return [JSON.stringify(d)];
+      }
+      return [d || this.msgs.genericError || 'Error'];
+    },
+
+    async upload() {
+      if (!this.recipeFile) return;
+      this.busy = true;
+      this.errors = [];
+      try {
+        const fd = new FormData();
+        fd.append('recipe', this.recipeFile);
+        for (const f of this.attachments) fd.append('files', f);
+        const resp = await fetch(`/maker/api/vision/tasks/${this.taskId}/recipe`, {
+          method: 'POST',
+          headers: { 'X-CSRFToken': typeof csrf === 'function' ? csrf() : csrf },
+          body: fd
+        });
+        const data = await resp.json();
+        if (!resp.ok || data.error) {
+          this.errors = this._errorsFrom(data);
+        } else {
+          this._apply(data);
+          this.recipeFile = null;
+          this.attachments = [];
+        }
+      } catch (e) {
+        this.errors = [this.msgs.genericError || String(e)];
+      }
+      this.busy = false;
+    },
+
+    onRecipe(ev) { this.recipeFile = ev.target.files[0] || null; },
+    onAttachments(ev) { this.attachments = Array.from(ev.target.files || []); }
+  };
+}

src/frontend/flask_app/templates/admin/_users_script.html

@@ -1,258 +0,0 @@
-<script>
-function userManagement(initialUsers) {
-  return {
-    users: initialUsers || [],
-    search: '',
-    showModal: false,
-    showToggleConfirm: false,
-    // #51: stato del reset password
-    showReset: false,
-    resetUser: null,
-    resetPw: '',
-    resetDone: false,
-    resetError: '',
-    isEditing: false,
-    editingUserId: null,
-    toggleUser: null,
-    saving: false,
-    errorMsg: '',
-    form: {
-      username: '',
-      display_name: '',
-      email: '',
-      password: '',
-      roles: [],
-      is_admin: false,
-      language_pref: 'it',
-      theme_pref: 'light'
-    },
-
-    get csrfToken() {
-      const meta = document.querySelector('meta[name=csrf-token]');
-      return meta ? meta.content : '';
-    },
-
-    get filteredUsers() {
-      if (!this.search.trim()) return this.users;
-      const q = this.search.toLowerCase();
-      return this.users.filter(u =>
-        u.username.toLowerCase().includes(q) ||
-        (u.display_name && u.display_name.toLowerCase().includes(q)) ||
-        (u.email && u.email.toLowerCase().includes(q)) ||
-        (u.roles && u.roles.some(r => r.toLowerCase().includes(q)))
-      );
-    },
-
-    openCreateModal() {
-      this.isEditing = false;
-      this.editingUserId = null;
-      this.errorMsg = '';
-      this.form = {
-        username: '',
-        display_name: '',
-        email: '',
-        password: '',
-        roles: [],
-        is_admin: false,
-        language_pref: 'it',
-        theme_pref: 'light'
-      };
-      this.showModal = true;
-    },
-
-    openEditModal(user) {
-      this.isEditing = true;
-      this.editingUserId = user.id;
-      this.errorMsg = '';
-      this.form = {
-        username: user.username,
-        display_name: user.display_name || '',
-        email: user.email || '',
-        password: '',
-        roles: [...(user.roles || [])],
-        is_admin: user.is_admin || false,
-        language_pref: user.language_pref || 'it',
-        theme_pref: user.theme_pref || 'light'
-      };
-      this.showModal = true;
-    },
-
-    closeModal() {
-      this.showModal = false;
-      this.errorMsg = '';
-    },
-
-    async saveUser() {
-      this.saving = true;
-      this.errorMsg = '';
-
-      try {
-        if (this.isEditing) {
-          // Update user
-          const data = {
-            display_name: this.form.display_name,
-            email: this.form.email || null,
-            roles: this.form.roles,
-            is_admin: this.form.is_admin,
-            language_pref: this.form.language_pref,
-            theme_pref: this.form.theme_pref
-          };
-
-          const resp = await fetch(`/admin/api/users/${this.editingUserId}`, {
-            method: 'PUT',
-            headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
-            body: JSON.stringify(data)
-          });
-
-          const result = await resp.json();
-          if (!resp.ok) {
-            this.errorMsg = result.detail || 'Errore nel salvataggio';
-            return;
-          }
-
-          // Update local array
-          const idx = this.users.findIndex(u => u.id === this.editingUserId);
-          if (idx >= 0) this.users[idx] = result;
-
-          // Change password if provided
-          if (this.form.password) {
-            const pwResp = await fetch(`/admin/api/users/${this.editingUserId}/password`, {
-              method: 'PUT',
-              headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
-              body: JSON.stringify({ password: this.form.password })
-            });
-            if (!pwResp.ok) {
-              const pwResult = await pwResp.json();
-              this.errorMsg = pwResult.detail || 'Errore nel cambio password';
-              return;
-            }
-          }
-        } else {
-          // Create user
-          if (!this.form.username || !this.form.display_name || !this.form.password) {
-            this.errorMsg = '{{ _("Username, nome visualizzato e password sono obbligatori") }}';
-            return;
-          }
-
-          const data = {
-            username: this.form.username,
-            password: this.form.password,
-            display_name: this.form.display_name,
-            email: this.form.email || null,
-            roles: this.form.roles,
-            is_admin: this.form.is_admin,
-            language_pref: this.form.language_pref,
-            theme_pref: this.form.theme_pref
-          };
-
-          const resp = await fetch('/admin/api/users', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
-            body: JSON.stringify(data)
-          });
-
-          const result = await resp.json();
-          if (!resp.ok) {
-            this.errorMsg = result.detail || 'Errore nella creazione';
-            return;
-          }
-
-          this.users.push(result);
-        }
-
-        this.closeModal();
-      } catch (e) {
-        this.errorMsg = '{{ _("Errore di connessione al server") }}';
-      } finally {
-        this.saving = false;
-      }
-    },
-
-    // #51: reset password dall'admin, usa PUT /admin/api/users/<id>/password
-    openReset(user) {
-      this.resetUser = user;
-      this.resetPw = '';
-      this.resetDone = false;
-      this.resetError = '';
-      this.showReset = true;
-    },
-
-    closeReset() {
-      this.showReset = false;
-      this.resetPw = '';  // la password generata non resta in memoria
-      this.resetDone = false;
-    },
-
-    generateResetPw() {
-      // 12 caratteri senza simboli ambigui (0/O, 1/l/I), da crypto random
-      const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789';
-      const buf = new Uint32Array(12);
-      crypto.getRandomValues(buf);
-      this.resetPw = Array.from(buf, n => chars[n % chars.length]).join('');
-      this.resetError = '';
-    },
-
-    async confirmReset() {
-      if (!this.resetPw || this.resetPw.length < 8) {
-        this.resetError = {{ _('La password deve avere almeno 8 caratteri')|tojson }};
-        return;
-      }
-      this.saving = true;
-      this.resetError = '';
-      try {
-        const resp = await fetch(`/admin/api/users/${this.resetUser.id}/password`, {
-          method: 'PUT',
-          headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
-          body: JSON.stringify({ password: this.resetPw })
-        });
-        const result = await resp.json();
-        if (!resp.ok) {
-          this.resetError = result.detail || {{ _('Errore nel cambio password')|tojson }};
-          return;
-        }
-        this.resetDone = true;
-      } catch (e) {
-        this.resetError = {{ _('Errore di connessione al server')|tojson }};
-      } finally {
-        this.saving = false;
-      }
-    },
-
-    toggleActive(user) {
-      this.toggleUser = user;
-      this.showToggleConfirm = true;
-    },
-
-    async confirmToggle() {
-      if (!this.toggleUser) return;
-      this.saving = true;
-
-      try {
-        const newActive = !this.toggleUser.active;
-        const resp = await fetch(`/admin/api/users/${this.toggleUser.id}/toggle-active`, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
-          body: JSON.stringify({ active: newActive })
-        });
-
-        const result = await resp.json();
-        if (!resp.ok) {
-          alert(result.detail || 'Errore');
-          return;
-        }
-
-        // Update local array
-        const idx = this.users.findIndex(u => u.id === this.toggleUser.id);
-        if (idx >= 0) this.users[idx] = result;
-
-        this.showToggleConfirm = false;
-        this.toggleUser = null;
-      } catch (e) {
-        alert('{{ _("Errore di connessione al server") }}');
-      } finally {
-        this.saving = false;
-      }
-    }
-  };
-}
-</script>

src/frontend/flask_app/templates/admin/settings.html

@@ -3,31 +3,17 @@
 {% block title %}{{ _('Impostazioni') }} - TieMeasureFlow{% endblock %}
 
 {% block content %}
-<div class="tmf-page" x-data="{ tab: {{ active_tab|tojson_attr }} }">
+<div class="tmf-page tmf-page-narrow"
+     x-data="systemSettings()">
 
   <!-- Header -->
-  <div class="mb-4">
+  <div class="mb-6">
     <h1 class="text-2xl font-bold text-[var(--text-primary)]">{{ _('Impostazioni di Sistema') }}</h1>
     <p class="mt-1 text-sm text-[var(--text-secondary)]">{{ _('Configura i parametri generali del sistema') }}</p>
   </div>
 
-  <!-- #50: tab. L'intera pagina e' gia' solo per admin (admin_required) -->
-  <div class="flex gap-1 mb-6 border-b border-[var(--border-color)]">
-    <button type="button" @click="tab = 'generale'"
-            :class="tab === 'generale' ? 'border-primary text-primary' : 'border-transparent text-[var(--text-secondary)] hover:text-[var(--text-primary)]'"
-            class="px-4 py-2 -mb-px text-sm font-medium border-b-2 transition-colors">{{ _('Generale') }}</button>
-    <button type="button" @click="tab = 'utenti'"
-            :class="tab === 'utenti' ? 'border-primary text-primary' : 'border-transparent text-[var(--text-secondary)] hover:text-[var(--text-primary)]'"
-            class="px-4 py-2 -mb-px text-sm font-medium border-b-2 transition-colors">{{ _('Utenti') }}</button>
-  </div>
-
-  <div x-show="tab === 'utenti'" x-cloak>
-    {% include "admin/_users_panel.html" %}
-  </div>
-
-  <div x-show="tab === 'generale'" class="max-w-4xl mx-auto" x-data="systemSettings()">
   <!-- Settings Card -->
-  <div class="tmf-card mb-6">
+  <div class="tmf-card">
     <div class="tmf-card-header flex items-center gap-2">
       <svg class="w-4 h-4 text-[var(--text-muted)]" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
         <path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z"/>
@@ -57,57 +43,6 @@
           {{ _('L\'operatore verrà disconnesso automaticamente dopo il periodo di inattività indicato. Lasciare vuoto per disabilitare.') }}
         </p>
       </div>
-
-      <!-- #47: durata loop predefinita delle ricette -->
-      <div class="pt-5 border-t border-[var(--border-color)]">
-        <h3 class="text-sm font-semibold text-[var(--text-primary)] mb-3">{{ _('Ricette') }}</h3>
-        <label class="tmf-label" for="default-interval">{{ _('Durata loop predefinita (minuti)') }}</label>
-        <input id="default-interval" type="number" x-model="defaultInterval" class="tmf-input w-32" min="1" max="1440" placeholder="—">
-        <p class="text-xs text-[var(--text-muted)] mt-1">{{ _('Proposta come intervallo di misura nelle nuove ricette (1-1440). Vuoto = nessun predefinito.') }}</p>
-      </div>
-
-      <!-- #48: tolleranze generali -->
-      <div class="pt-5 border-t border-[var(--border-color)]">
-        <h3 class="text-sm font-semibold text-[var(--text-primary)] mb-3">{{ _('Tolleranze generali') }}</h3>
-        <div class="flex items-center gap-6">
-          <div>
-            <label class="tmf-label" for="tol-plus">{{ _('Tolleranza +') }}</label>
-            <input id="tol-plus" type="text" inputmode="decimal" x-model="tolPlus" class="tmf-input w-32" placeholder="—">
-          </div>
-          <div>
-            <label class="tmf-label" for="tol-minus">{{ _('Tolleranza −') }}</label>
-            <input id="tol-minus" type="text" inputmode="decimal" x-model="tolMinus" class="tmf-input w-32" placeholder="—">
-          </div>
-        </div>
-        <p class="text-xs text-[var(--text-muted)] mt-1">{{ _('Valori positivi (zero o più) proposti come tolleranza nelle nuove misure. Vuoto = nessun predefinito.') }}</p>
-      </div>
-
-      <!-- #49: anagrafiche (liste di scelta) -->
-      <div class="pt-5 border-t border-[var(--border-color)]">
-        <h3 class="text-sm font-semibold text-[var(--text-primary)] mb-3">{{ _('Anagrafiche') }}</h3>
-        <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
-          <template x-for="lst in ['types', 'units']" :key="lst">
-            <div>
-              <label class="tmf-label" x-text="lst === 'types' ? {{ _('Tipi di misura')|tojson_attr }} : {{ _('Unità di misura')|tojson_attr }}"></label>
-              <ul class="space-y-1 mb-2">
-                <template x-for="(item, i) in lists[lst]" :key="lst + i">
-                  <li class="flex items-center gap-1 text-sm">
-                    <span class="flex-1 px-2 py-1 rounded bg-[var(--bg-secondary)] text-[var(--text-primary)]" x-text="item"></span>
-                    <button type="button" @click="moveItem(lst, i, -1)" :disabled="i === 0" class="px-1.5 text-[var(--text-muted)] hover:text-primary disabled:opacity-30" title="{{ _('Su') }}">▲</button>
-                    <button type="button" @click="moveItem(lst, i, 1)" :disabled="i === lists[lst].length - 1" class="px-1.5 text-[var(--text-muted)] hover:text-primary disabled:opacity-30" title="{{ _('Giù') }}">▼</button>
-                    <button type="button" @click="removeItem(lst, i)" class="px-1.5 text-[var(--text-muted)] hover:text-red-500" title="{{ _('Rimuovi') }}">✕</button>
-                  </li>
-                </template>
-              </ul>
-              <div class="flex gap-2">
-                <input type="text" x-model="newItem[lst]" @keydown.enter.prevent="addItem(lst)" class="tmf-input flex-1" placeholder="{{ _('Nuova voce') }}">
-                <button type="button" @click="addItem(lst)" class="btn btn-secondary">{{ _('Aggiungi') }}</button>
-              </div>
-            </div>
-          </template>
-        </div>
-        <p class="text-xs text-[var(--text-muted)] mt-2">{{ _('Massimo 50 voci per lista. Un elenco vuoto = nessuna scelta predefinita.') }}</p>
-      </div>
     </div>
 
     <div class="tmf-card-footer flex items-center justify-between">
@@ -133,48 +68,18 @@
       </button>
     </div>
   </div>
-  </div><!-- /tab generale -->
 </div>
 {% endblock %}
 
 {% block extra_js %}
 <script>
-// #49: legge un array JSON di stringhe salvato come impostazione; vuoto/malformato = lista vuota
-function tmfParseList(raw) {
-  try { var a = JSON.parse(raw || '[]'); return Array.isArray(a) ? a.map(String) : []; }
-  catch (e) { return []; }
-}
 function systemSettings() {
   return {
     autoLogoutMinutes: {{ (settings.auto_logout_minutes or '')|tojson }},
-    // #47-#49: nuove chiavi (valori stringa, vuoto = nessun default)
-    defaultInterval: {{ (settings.default_measurement_interval_minutes or '')|tojson }},
-    tolPlus: {{ (settings.general_tolerance_plus or '')|tojson }},
-    tolMinus: {{ (settings.general_tolerance_minus or '')|tojson }},
-    lists: {
-      types: tmfParseList({{ (settings.list_measurement_types or '')|tojson }}),
-      units: tmfParseList({{ (settings.list_units or '')|tojson }})
-    },
-    newItem: { types: '', units: '' },
     saving: false,
     saved: false,
     errorMessage: '',
 
-    addItem(lst) {
-      var v = (this.newItem[lst] || '').trim();
-      if (!v) return;
-      if (this.lists[lst].length >= 50) { this.errorMessage = {{ _('Massimo 50 voci per lista')|tojson }}; return; }
-      if (this.lists[lst].indexOf(v) === -1) this.lists[lst].push(v);
-      this.newItem[lst] = '';
-    },
-    removeItem(lst, i) { this.lists[lst].splice(i, 1); },
-    moveItem(lst, i, d) {
-      var a = this.lists[lst].slice(), j = i + d;
-      if (j < 0 || j >= a.length) return;
-      var t = a[i]; a[i] = a[j]; a[j] = t;
-      this.lists[lst] = a;
-    },
-
     async save() {
       this.saving = true;
       this.saved = false;
@@ -182,13 +87,7 @@ function systemSettings() {
 
       var csrfToken = document.querySelector('meta[name=csrf-token]')?.content;
       var payload = {
-        auto_logout_minutes: this.autoLogoutMinutes ? String(this.autoLogoutMinutes) : '',
-        default_measurement_interval_minutes: String(this.defaultInterval || '').trim(),
-        // virgola decimale accettata in input, il backend vuole il punto
-        general_tolerance_plus: String(this.tolPlus || '').trim().replace(',', '.'),
-        general_tolerance_minus: String(this.tolMinus || '').trim().replace(',', '.'),
-        list_measurement_types: this.lists.types.length ? JSON.stringify(this.lists.types) : '',
-        list_units: this.lists.units.length ? JSON.stringify(this.lists.units) : ''
+        auto_logout_minutes: this.autoLogoutMinutes ? String(this.autoLogoutMinutes) : ''
       };
 
       try {
@@ -212,5 +111,4 @@ function systemSettings() {
   };
 }
 </script>
-{% include "admin/_users_script.html" %}
 {% endblock %}

src/frontend/flask_app/templates/admin/users.html

@@ -1,7 +1,18 @@
-{# Pannello utenti: incluso nella tab «Utenti» di Impostazioni (#50) #}
+{% extends "base.html" %}
+
+{% block title %}{{ _('Gestione Utenti') }} - TieMeasureFlow{% endblock %}
+
+{% block content %}
 <script>window.__users = {{ users|tojson }};</script>
 
-<div x-data="userManagement(window.__users)">
+<div class="tmf-page"
+     x-data="userManagement(window.__users)">
+
+  <!-- Header -->
+  <div class="mb-6">
+    <h1 class="text-2xl font-bold text-[var(--text-primary)]">{{ _('Gestione Utenti') }}</h1>
+    <p class="mt-1 text-sm text-[var(--text-secondary)]">{{ _('Crea, modifica e gestisci gli utenti del sistema') }}</p>
+  </div>
 
   <!-- Toolbar -->
   <div class="flex flex-col sm:flex-row items-start sm:items-center justify-between gap-3 mb-6">
@@ -91,12 +102,6 @@
                       <path stroke-linecap="round" stroke-linejoin="round" d="M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"/>
                     </svg>
                   </button>
-                  <!-- #51: reset password dall'admin -->
-                  <button @click="openReset(user)" class="p-1.5 rounded-lg text-[var(--text-secondary)] hover:text-primary hover:bg-primary-50 dark:hover:bg-primary-900/20 transition-colors" :title="{{ _('Reset password')|tojson_attr }}">
-                    <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
-                      <path stroke-linecap="round" stroke-linejoin="round" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"/>
-                    </svg>
-                  </button>
                   <button @click="toggleActive(user)" class="p-1.5 rounded-lg transition-colors"
                           :class="user.active
                             ? 'text-[var(--text-secondary)] hover:text-red-600 hover:bg-red-50 dark:hover:bg-red-900/20'
@@ -327,51 +332,210 @@
     </div>
   </div>
 
-  <!-- #51: Modal reset password (la password attuale non si mostra mai) -->
-  <div x-show="showReset" x-cloak
-       class="fixed inset-0 z-50 flex items-center justify-center p-4"
-       @keydown.escape.window="closeReset()">
-    <div class="absolute inset-0 bg-black/50" @click="closeReset()"></div>
-    <div class="relative bg-[var(--bg-card)] rounded-xl border border-[var(--border-color)] shadow-xl w-full max-w-md p-6">
-      <h3 class="text-lg font-semibold text-[var(--text-primary)] mb-2">
-        {{ _('Reset password') }}: <span x-text="resetUser?.username"></span>
-      </h3>
-      <p class="text-sm text-[var(--text-secondary)] mb-4">
-        {{ _('Le sessioni aperte dell\'utente verranno chiuse e dovrà accedere con la nuova password.') }}
-      </p>
-      <template x-if="!resetDone">
-        <div>
-          <label class="block text-sm font-medium text-[var(--text-primary)] mb-1">{{ _('Nuova password (minimo 8 caratteri)') }}</label>
-          <div class="flex gap-2">
-            <input type="text" x-model="resetPw" autocomplete="off"
-                   class="flex-1 px-3 py-2 rounded-lg border border-[var(--border-color)] bg-[var(--bg-card)] text-sm font-mono text-[var(--text-primary)] focus:outline-none focus:ring-2 focus:ring-primary/30 focus:border-primary">
-            <button @click="generateResetPw()" type="button"
-                    class="px-3 py-2 text-sm font-medium rounded-lg border border-[var(--border-color)] text-[var(--text-primary)] hover:bg-[var(--bg-secondary)]">
-              {{ _('Genera') }}
-            </button>
-          </div>
-          <template x-if="resetError">
-            <p class="mt-2 text-sm text-red-600" x-text="resetError"></p>
-          </template>
-        </div>
-      </template>
-      <template x-if="resetDone">
-        <div class="px-3 py-2 rounded-lg bg-emerald-50 dark:bg-emerald-900/20 border border-emerald-200 dark:border-emerald-800">
-          <p class="text-sm text-emerald-700 dark:text-emerald-300">{{ _('Password cambiata. Annotala ora: non verrà mostrata di nuovo.') }}</p>
-          <p class="mt-1 text-base font-mono font-semibold text-[var(--text-primary)] select-all" x-text="resetPw"></p>
-        </div>
-      </template>
-      <div class="flex justify-end gap-3 mt-5">
-        <button @click="closeReset()"
-                class="px-4 py-2 text-sm font-medium text-[var(--text-secondary)] rounded-lg hover:bg-[var(--bg-secondary)]">
-          <span x-text="resetDone ? {{ _('Chiudi')|tojson_attr }} : {{ _('Annulla')|tojson_attr }}"></span>
-        </button>
-        <button x-show="!resetDone" @click="confirmReset()" :disabled="saving"
-                class="px-4 py-2 bg-primary text-white text-sm font-medium rounded-lg hover:bg-primary-700 shadow-sm disabled:opacity-50">
-          {{ _('Imposta password') }}
-        </button>
-      </div>
-    </div>
-  </div>
-
 </div>
+{% endblock %}
+
+{% block extra_js %}
+<script>
+function userManagement(initialUsers) {
+  return {
+    users: initialUsers || [],
+    search: '',
+    showModal: false,
+    showToggleConfirm: false,
+    isEditing: false,
+    editingUserId: null,
+    toggleUser: null,
+    saving: false,
+    errorMsg: '',
+    form: {
+      username: '',
+      display_name: '',
+      email: '',
+      password: '',
+      roles: [],
+      is_admin: false,
+      language_pref: 'it',
+      theme_pref: 'light'
+    },
+
+    get csrfToken() {
+      const meta = document.querySelector('meta[name=csrf-token]');
+      return meta ? meta.content : '';
+    },
+
+    get filteredUsers() {
+      if (!this.search.trim()) return this.users;
+      const q = this.search.toLowerCase();
+      return this.users.filter(u =>
+        u.username.toLowerCase().includes(q) ||
+        (u.display_name && u.display_name.toLowerCase().includes(q)) ||
+        (u.email && u.email.toLowerCase().includes(q)) ||
+        (u.roles && u.roles.some(r => r.toLowerCase().includes(q)))
+      );
+    },
+
+    openCreateModal() {
+      this.isEditing = false;
+      this.editingUserId = null;
+      this.errorMsg = '';
+      this.form = {
+        username: '',
+        display_name: '',
+        email: '',
+        password: '',
+        roles: [],
+        is_admin: false,
+        language_pref: 'it',
+        theme_pref: 'light'
+      };
+      this.showModal = true;
+    },
+
+    openEditModal(user) {
+      this.isEditing = true;
+      this.editingUserId = user.id;
+      this.errorMsg = '';
+      this.form = {
+        username: user.username,
+        display_name: user.display_name || '',
+        email: user.email || '',
+        password: '',
+        roles: [...(user.roles || [])],
+        is_admin: user.is_admin || false,
+        language_pref: user.language_pref || 'it',
+        theme_pref: user.theme_pref || 'light'
+      };
+      this.showModal = true;
+    },
+
+    closeModal() {
+      this.showModal = false;
+      this.errorMsg = '';
+    },
+
+    async saveUser() {
+      this.saving = true;
+      this.errorMsg = '';
+
+      try {
+        if (this.isEditing) {
+          // Update user
+          const data = {
+            display_name: this.form.display_name,
+            email: this.form.email || null,
+            roles: this.form.roles,
+            is_admin: this.form.is_admin,
+            language_pref: this.form.language_pref,
+            theme_pref: this.form.theme_pref
+          };
+
+          const resp = await fetch(`/admin/api/users/${this.editingUserId}`, {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
+            body: JSON.stringify(data)
+          });
+
+          const result = await resp.json();
+          if (!resp.ok) {
+            this.errorMsg = result.detail || 'Errore nel salvataggio';
+            return;
+          }
+
+          // Update local array
+          const idx = this.users.findIndex(u => u.id === this.editingUserId);
+          if (idx >= 0) this.users[idx] = result;
+
+          // Change password if provided
+          if (this.form.password) {
+            const pwResp = await fetch(`/admin/api/users/${this.editingUserId}/password`, {
+              method: 'PUT',
+              headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
+              body: JSON.stringify({ password: this.form.password })
+            });
+            if (!pwResp.ok) {
+              const pwResult = await pwResp.json();
+              this.errorMsg = pwResult.detail || 'Errore nel cambio password';
+              return;
+            }
+          }
+        } else {
+          // Create user
+          if (!this.form.username || !this.form.display_name || !this.form.password) {
+            this.errorMsg = '{{ _("Username, nome visualizzato e password sono obbligatori") }}';
+            return;
+          }
+
+          const data = {
+            username: this.form.username,
+            password: this.form.password,
+            display_name: this.form.display_name,
+            email: this.form.email || null,
+            roles: this.form.roles,
+            is_admin: this.form.is_admin,
+            language_pref: this.form.language_pref,
+            theme_pref: this.form.theme_pref
+          };
+
+          const resp = await fetch('/admin/api/users', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
+            body: JSON.stringify(data)
+          });
+
+          const result = await resp.json();
+          if (!resp.ok) {
+            this.errorMsg = result.detail || 'Errore nella creazione';
+            return;
+          }
+
+          this.users.push(result);
+        }
+
+        this.closeModal();
+      } catch (e) {
+        this.errorMsg = '{{ _("Errore di connessione al server") }}';
+      } finally {
+        this.saving = false;
+      }
+    },
+
+    toggleActive(user) {
+      this.toggleUser = user;
+      this.showToggleConfirm = true;
+    },
+
+    async confirmToggle() {
+      if (!this.toggleUser) return;
+      this.saving = true;
+
+      try {
+        const newActive = !this.toggleUser.active;
+        const resp = await fetch(`/admin/api/users/${this.toggleUser.id}/toggle-active`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', 'X-CSRFToken': this.csrfToken },
+          body: JSON.stringify({ active: newActive })
+        });
+
+        const result = await resp.json();
+        if (!resp.ok) {
+          alert(result.detail || 'Errore');
+          return;
+        }
+
+        // Update local array
+        const idx = this.users.findIndex(u => u.id === this.toggleUser.id);
+        if (idx >= 0) this.users[idx] = result;
+
+        this.showToggleConfirm = false;
+        this.toggleUser = null;
+      } catch (e) {
+        alert('{{ _("Errore di connessione al server") }}');
+      } finally {
+        this.saving = false;
+      }
+    }
+  };
+}
+</script>
+{% endblock %}

src/frontend/flask_app/templates/components/navbar.html

@@ -32,6 +32,7 @@
     {{ nav_link(url_for('statistics.dashboard'), _('Statistiche'), icon_stats, ep.startswith('statistics.'), mobile) }}
   {% endif %}
   {% if current_user.get('is_admin') %}
+    {{ nav_link(url_for('admin.user_list'), _('Utenti'), icon_users, ep == 'admin.user_list', mobile) }}
     {{ nav_link(url_for('admin.station_list'), _('Stazioni'), icon_stations, ep == 'admin.station_list', mobile) }}
     {{ nav_link(url_for('admin.settings_page'), _('Impostazioni'), icon_settings, ep == 'admin.settings_page', mobile) }}
   {% endif %}

src/frontend/flask_app/templates/maker/recipe_editor.html

@@ -526,7 +526,8 @@ function recipeEditor() {
     currentVersion: {{ (recipe.current_version.version_number if recipe and recipe.current_version else 0)|tojson }},
 
     // ---- Measurement interval ----
-    measurementIntervalMinutes: {{ (recipe.measurement_interval_minutes if recipe and recipe.measurement_interval_minutes else 'null')|tojson }},
+    // #49: a new recipe starts from the system default duration (default_interval), an existing one never does
+    measurementIntervalMinutes: {{ (recipe.measurement_interval_minutes if recipe and recipe.measurement_interval_minutes else (default_interval if not recipe and default_interval else 'null'))|tojson }},
 
     // ---- Rules of measurement (points 8 and 9) ----
     // A new recipe forbids typing: the caliper is the instrument, and permission

src/frontend/flask_app/templates/maker/recipe_list.html

@@ -10,6 +10,51 @@
        filter: 'all',
        deleteModal: false,
        deleteTarget: null,
+       // #52: duplicate modal state
+       dupModal: false,
+       dupSource: null,
+       dupCode: '',
+       dupName: '',
+       dupError: '',
+       dupBusy: false,
+
+       openDupModal(recipe) {
+         this.dupSource = recipe;
+         this.dupCode = recipe.code + '-COPIA';
+         this.dupName = recipe.name + ' ' + {{ _('(copia)')|tojson_attr }};
+         this.dupError = '';
+         this.dupModal = true;
+       },
+
+       async duplicateRecipe() {
+         const csrfToken = document.querySelector('meta[name=csrf-token]')?.content;
+         this.dupBusy = true;
+         this.dupError = '';
+         try {
+           const resp = await fetch(`/maker/api/recipes/${this.dupSource.id}/duplicate`, {
+             method: 'POST',
+             headers: { 'Content-Type': 'application/json', 'X-CSRFToken': csrfToken || '' },
+             body: JSON.stringify({ code: this.dupCode.trim(), name: this.dupName.trim() })
+           });
+           const data = await resp.json().catch(() => ({}));
+           if (resp.ok) {
+             // open the new recipe in the editor
+             window.location.href = '/maker/recipes/' + data.id + '/edit';
+             return;
+           }
+           if (resp.status === 409) {
+             this.dupError = {{ _('Esiste già una ricetta con questo codice')|tojson_attr }};
+           } else if (resp.status === 422) {
+             this.dupError = {{ _('Codice o nome non validi')|tojson_attr }};
+           } else {
+             this.dupError = data.detail || data.error || {{ _('Errore durante la duplicazione')|tojson_attr }};
+           }
+         } catch (err) {
+           this.dupError = {{ _('Errore di connessione')|tojson_attr }};
+         } finally {
+           this.dupBusy = false;
+         }
+       },
 
        get filteredRecipes() {
          let filtered = this.recipes;
@@ -265,6 +310,15 @@
               {{ _('Versioni') }}
             </a>
 
+            <!-- Duplica (#52) -->
+            <button @click="openDupModal(recipe)"
+                    class="btn btn-secondary gap-1.5 text-xs">
+              <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z"/>
+              </svg>
+              {{ _('Duplica') }}
+            </button>
+
             <!-- Spacer -->
             <div class="flex-1"></div>
 
@@ -318,6 +372,42 @@
     </a>
   </div>
 
+  <!-- Duplicate Modal (#52) -->
+  <div x-show="dupModal"
+       x-cloak
+       @keydown.escape.window="dupModal = false"
+       class="fixed inset-0 z-50 overflow-y-auto"
+       role="dialog"
+       aria-modal="true">
+    <div @click="dupModal = false" class="fixed inset-0 bg-black/50 backdrop-blur-sm"></div>
+    <div class="flex min-h-full items-center justify-center p-4">
+      <div class="tmf-card max-w-lg w-full relative p-6">
+        <h3 class="text-lg font-semibold text-[var(--text-primary)] mb-4">
+          {{ _('Duplica ricetta') }}
+        </h3>
+        <div class="mb-3">
+          <label class="tmf-label" for="dup-code">{{ _('Codice') }}</label>
+          <input id="dup-code" type="text" x-model="dupCode" maxlength="100" class="tmf-input">
+        </div>
+        <div class="mb-3">
+          <label class="tmf-label" for="dup-name">{{ _('Nome') }}</label>
+          <input id="dup-name" type="text" x-model="dupName" maxlength="255" class="tmf-input">
+        </div>
+        <p x-show="dupError" x-text="dupError" class="text-sm text-red-600 mb-3"></p>
+        <div class="flex flex-col sm:flex-row gap-3">
+          <button @click="dupModal = false" class="btn btn-secondary flex-1 justify-center">
+            {{ _('Annulla') }}
+          </button>
+          <button @click="duplicateRecipe()"
+                  :disabled="dupBusy || !dupCode.trim() || !dupName.trim()"
+                  class="btn btn-primary flex-1 justify-center">
+            {{ _('Duplica') }}
+          </button>
+        </div>
+      </div>
+    </div>
+  </div>
+
   <!-- Delete Confirmation Modal -->
   <div x-show="deleteModal"
        x-cloak

src/frontend/flask_app/templates/maker/task_editor.html

@@ -277,6 +277,8 @@
             <option value="note">{{ _('Nota') }}</option>
             <option value="measure">{{ _('Misura') }}</option>
             <option value="drawing">{{ _('Disegno') }}</option>
+            <option value="camera_measure">{{ _('Misura camera') }}</option>
+            <option value="dxf_compare">{{ _('Confronto profilo') }}</option>
           </select>
           <p class="mt-1 text-xs text-[var(--text-secondary)]">
             {{ _('Un task di misura resta tale anche prima di inserire le quote') }}
@@ -460,6 +462,55 @@
 
           <div class="tmf-card-body space-y-4">
 
+            <!-- ========== Ricetta visione (#46): solo camera_measure / dxf_compare ========== -->
+            <template x-if="task.task_type === 'camera_measure' || task.task_type === 'dxf_compare'">
+              <div class="p-3 rounded-lg bg-[var(--bg-secondary)] border border-[var(--border-color)]"
+                   x-data="visionRecipe(task.id, () => csrfToken(), {{ {'genericError': _('Errore durante il caricamento della ricetta')}|tojson_attr }})">
+                <p class="text-xs font-semibold text-[var(--text-secondary)] uppercase tracking-wide mb-2">
+                  {{ _('Ricetta visione') }}
+                </p>
+                <!-- Stato corrente: cartella, file, uscite -->
+                <template x-if="recipeDir">
+                  <div class="text-xs space-y-1 mb-3">
+                    <p><span class="text-[var(--text-secondary)]">{{ _('Cartella') }}:</span>
+                       <span class="font-mono" x-text="recipeDir"></span></p>
+                    <p x-show="files.length"><span class="text-[var(--text-secondary)]">{{ _('File') }}:</span>
+                       <span class="font-mono" x-text="files.join(', ')"></span></p>
+                    <p x-show="outputs.length"><span class="text-[var(--text-secondary)]">{{ _('Uscite numeriche') }}:</span></p>
+                    <ul class="list-disc pl-5" x-show="outputs.length">
+                      <template x-for="o in outputs" :key="o.key">
+                        <li><span class="font-mono" x-text="o.key"></span>
+                            <span class="text-[var(--text-muted)]" x-text="(o.quantity || o.unit) ? '(' + [o.quantity, o.unit].filter(Boolean).join(', ') + ')' : ''"></span></li>
+                      </template>
+                    </ul>
+                  </div>
+                </template>
+                <p x-show="!recipeDir && !loading" class="text-xs text-[var(--text-muted)] mb-3">
+                  {{ _('Nessuna ricetta caricata') }}
+                </p>
+                <!-- Caricamento: ricetta .json + allegati -->
+                <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+                  <div>
+                    <label class="tmf-label text-xs">{{ _('Ricetta (.json)') }}</label>
+                    <input type="file" accept=".json,application/json" class="tmf-input text-xs"
+                           @change="onRecipe($event)">
+                  </div>
+                  <div>
+                    <label class="tmf-label text-xs">{{ _('File allegati (DXF, modelli, calibrazione)') }}</label>
+                    <input type="file" multiple class="tmf-input text-xs" @change="onAttachments($event)">
+                  </div>
+                </div>
+                <div class="flex justify-end mt-3">
+                  <button type="button" class="btn btn-primary text-xs" @click="upload()"
+                          :disabled="!recipeFile || busy">{{ _('Carica ricetta') }}</button>
+                </div>
+                <!-- Errori 422 in chiaro -->
+                <ul x-show="errors.length" class="mt-3 text-xs text-red-500 list-disc pl-5">
+                  <template x-for="(e, i) in errors" :key="i"><li x-text="e"></li></template>
+                </ul>
+              </div>
+            </template>
+
             <!-- ========== Task File Upload / Preview ========== -->
             <div class="p-3 rounded-lg bg-[var(--bg-secondary)] border border-[var(--border-color)]">
               <p class="text-xs font-semibold text-[var(--text-secondary)] uppercase tracking-wide mb-2">
@@ -543,6 +594,8 @@
                     <option value="note">{{ _('Nota') }}</option>
                     <option value="measure">{{ _('Misura') }}</option>
                     <option value="drawing">{{ _('Disegno') }}</option>
+                    <option value="camera_measure">{{ _('Misura camera') }}</option>
+                    <option value="dxf_compare">{{ _('Confronto profilo') }}</option>
                   </select>
                 </div>
                 <div>
@@ -699,6 +752,18 @@
                          class="tmf-input"
                          placeholder="{{ _('Es. Diametro foro principale') }}">
                 </div>
+                <!-- Uscita visione (#46): solo task camera_measure / dxf_compare -->
+                <div class="col-span-2 sm:col-span-3 lg:col-span-2"
+                     x-show="task.task_type === 'camera_measure' || task.task_type === 'dxf_compare'">
+                  <label class="tmf-label text-xs">{{ _('Uscita visione') }}</label>
+                  <select x-model="newSubtask.vision_output" class="tmf-input">
+                    <option value="">{{ _('Nessuna') }}</option>
+                    <template x-for="o in (visionOutputs[task.id] || [])" :key="o.key">
+                      <option :value="o.key" :selected="o.key === newSubtask.vision_output"
+                              x-text="o.key + ((o.quantity || o.unit) ? ' (' + [o.quantity, o.unit].filter(Boolean).join(', ') + ')' : '')"></option>
+                    </template>
+                  </select>
+                </div>
                 <!-- Measurement Type -->
                 <div>
                   <label class="tmf-label text-xs">{{ _('Tipo') }}</label>
@@ -1093,6 +1158,7 @@
 {% block extra_js %}
 {# Bold and line breaks in descriptions: the same rules the server renders with. #}
 <script src="{{ url_for('static', filename='js/rich-text.js') }}"></script>
+<script src="{{ url_for('static', filename='js/vision_recipe.js') }}"></script>
 <script src="{{ url_for('static', filename='vendor/pdf-3.11.174.min.js') }}"></script>
 <script>if(typeof pdfjsLib!=='undefined')pdfjsLib.GlobalWorkerOptions.workerSrc='{{ url_for('static', filename='vendor/pdf.worker-3.11.174.min.js') }}';</script>
 <script src="{{ url_for('static', filename='js/annotation-viewer.js') }}?v=6"></script>
@@ -1129,8 +1195,11 @@ function taskEditor() {
     addingSubtaskForTask: null,
     newSubtask: {
       marker_number: 1, description: '', measurement_type: '',
-      nominal: null, utl: null, uwl: null, lwl: null, ltl: null, unit: 'mm'
+      nominal: null, utl: null, uwl: null, lwl: null, ltl: null, unit: 'mm',
+      vision_output: ''
     },
+    // Uscite numeriche della ricetta visione per task (#46), riempite da vision_recipe.js
+    visionOutputs: {},
 
     // ---- Delete modals ----
     deleteTaskModal: false,
@@ -1153,6 +1222,10 @@ function taskEditor() {
     // Init
     // ============================================================
     init() {
+      // Uscite della ricetta visione: evento dal componente visionRecipe (#46)
+      window.addEventListener('vision-outputs', (ev) => {
+        this.visionOutputs = { ...this.visionOutputs, [ev.detail.taskId]: ev.detail.outputs || [] };
+      });
       // Sort tasks by order_index on load
       this.tasks.sort((a, b) => (a.order_index || 0) - (b.order_index || 0));
 
@@ -1610,7 +1683,8 @@ function taskEditor() {
         uwl: null,
         lwl: null,
         ltl: null,
-        unit: 'mm'
+        unit: 'mm',
+        vision_output: ''
       };
     },
 
@@ -1634,7 +1708,8 @@ function taskEditor() {
         uwl: this.newSubtask.uwl,
         lwl: this.newSubtask.lwl,
         ltl: this.newSubtask.ltl,
-        unit: this.newSubtask.unit || 'mm'
+        unit: this.newSubtask.unit || 'mm',
+        vision_output: this.newSubtask.vision_output || null  // chiave uscita ricetta visione (#46)
       };
 
       try {
@@ -1687,7 +1762,8 @@ function taskEditor() {
         uwl: subtask.uwl,
         lwl: subtask.lwl,
         ltl: subtask.ltl,
-        unit: subtask.unit || 'mm'
+        unit: subtask.unit || 'mm',
+        vision_output: subtask.vision_output || ''
       };
     },
 
@@ -1711,7 +1787,8 @@ function taskEditor() {
         uwl: this.newSubtask.uwl,
         lwl: this.newSubtask.lwl,
         ltl: this.newSubtask.ltl,
-        unit: this.newSubtask.unit || 'mm'
+        unit: this.newSubtask.unit || 'mm',
+        vision_output: this.newSubtask.vision_output || null  // chiave uscita ricetta visione (#46)
       };
 
       try {

src/frontend/flask_app/tests/test_admin_users_tab.py

@@ -1,64 +0,0 @@
-"""#50/#51: tab Utenti dentro Impostazioni, redirect da /admin/users, reset password."""
-from unittest.mock import MagicMock, patch
-
-import pytest
-
-from tests.conftest import api_get_router
-
-USER = {
-    "id": 2, "username": "mario", "display_name": "Mario", "email": None,
-    "roles": ["MeasurementTec"], "is_admin": False, "language_pref": "it",
-    "theme_pref": "light", "active": True,
-}
-
-
-@pytest.fixture
-def mock_admin_api():
-    mock = MagicMock()
-    mock.get.side_effect = api_get_router({
-        "/api/users": [USER],
-        "/api/settings": {"auto_logout_minutes": "30"},
-    })
-    with patch("blueprints.admin.api_client", mock):
-        yield mock
-
-
-def test_users_url_redirects_to_settings_tab(logged_in_client, mock_admin_api):
-    resp = logged_in_client.get("/admin/users")
-    assert resp.status_code == 302
-    assert resp.headers["Location"].endswith("/admin/settings?tab=utenti")
-
-
-def test_settings_has_users_tab_and_reset_for_admin(logged_in_client, mock_admin_api):
-    resp = logged_in_client.get("/admin/settings?tab=utenti")
-    assert resp.status_code == 200
-    html = resp.data.decode("utf-8")
-    assert "userManagement(" in html          # pannello utenti incluso
-    assert "openReset(user)" in html          # pulsante reset password (#51)
-    assert "mario" in html                    # utente caricato
-    assert "tab: " in html and "utenti" in html  # tab iniziale richiesta
-
-
-def test_navbar_has_no_users_link(logged_in_client, mock_admin_api):
-    html = logged_in_client.get("/admin/settings").data.decode("utf-8")
-    assert 'href="/admin/users"' not in html
-
-
-def test_non_admin_cannot_reach_users_tab(client, mock_admin_api):
-    with client.session_transaction() as sess:
-        sess["api_key"] = "k"
-        sess["user"] = {"id": 3, "username": "op", "roles": ["MeasurementTec"],
-                        "is_admin": False, "language_pref": "it", "theme_pref": "light"}
-    for url in ("/admin/settings?tab=utenti", "/admin/users"):
-        resp = client.get(url)
-        assert resp.status_code == 302
-        assert "/admin/" not in resp.headers["Location"]
-    mock_admin_api.get.assert_not_called()
-
-
-def test_password_reset_proxy(logged_in_client, mock_admin_api):
-    mock_admin_api.put.return_value = {"message": "ok"}
-    resp = logged_in_client.put("/admin/api/users/2/password", json={"password": "Nuova1234"})
-    assert resp.status_code == 200
-    mock_admin_api.put.assert_called_once_with(
-        "/api/users/2/password", data={"password": "Nuova1234"})

src/frontend/flask_app/tests/test_maker.py

@@ -71,6 +71,61 @@ class TestRecipeNew:
         assert resp.status_code == 200
 
 
+    def test_recipe_new_default_interval_present(self, logged_in_client, mock_api_client):
+        """#49: default_measurement_interval_minutes pre-fills the loop duration."""
+        mock_api_client.get.return_value = {"default_measurement_interval_minutes": "45"}
+        html = logged_in_client.get("/maker/recipes/new").get_data(as_text=True)
+        assert "measurementIntervalMinutes: 45," in html
+
+    def test_recipe_new_default_interval_absent(self, logged_in_client, mock_api_client):
+        """#49: key missing, empty or invalid -> unchanged behaviour (null)."""
+        for payload in ({}, {"default_measurement_interval_minutes": ""},
+                        {"default_measurement_interval_minutes": "abc"},
+                        {"default_measurement_interval_minutes": "5000"}):
+            mock_api_client.get.return_value = payload
+            html = logged_in_client.get("/maker/recipes/new").get_data(as_text=True)
+            assert 'measurementIntervalMinutes: "null",' in html
+
+    def test_recipe_edit_ignores_default_interval(self, logged_in_client, mock_api_client):
+        """#49: an existing recipe never receives the default."""
+        def fake_get(path, *a, **k):
+            if path == "/api/recipes/7":
+                return {"id": 7, "code": "R", "name": "R"}
+            if path.endswith("/versions"):
+                return []
+            return {"default_measurement_interval_minutes": "45"}
+        mock_api_client.get.side_effect = fake_get
+        html = logged_in_client.get("/maker/recipes/7/edit").get_data(as_text=True)
+        assert 'measurementIntervalMinutes: "null",' in html
+
+
+class TestRecipeDuplicateProxy:
+    """POST /maker/api/recipes/<id>/duplicate (#52)."""
+
+    def test_duplicate_proxy_ok(self, logged_in_client, mock_api_client):
+        mock_api_client.post.return_value = {"id": 9, "code": "A-COPIA"}
+        resp = logged_in_client.post(
+            "/maker/api/recipes/3/duplicate", json={"code": "A-COPIA", "name": "A (copia)"}
+        )
+        assert resp.status_code == 201
+        assert resp.get_json()["id"] == 9
+        mock_api_client.post.assert_called_with(
+            "/api/recipes/3/duplicate", data={"code": "A-COPIA", "name": "A (copia)"}
+        )
+
+    def test_duplicate_proxy_conflict(self, logged_in_client, mock_api_client):
+        mock_api_client.post.return_value = {"error": True, "status_code": 409, "detail": "exists"}
+        resp = logged_in_client.post(
+            "/maker/api/recipes/3/duplicate", json={"code": "A", "name": "A"}
+        )
+        assert resp.status_code == 409
+
+    def test_recipe_list_has_duplicate_button(self, logged_in_client, mock_api_client):
+        mock_api_client.get.return_value = {"items": [], "total": 0, "pages": 1}
+        html = logged_in_client.get("/maker/recipes").get_data(as_text=True)
+        assert "openDupModal" in html
+
+
 class TestRoleRequired:
     """Maker role enforcement tests."""
 
@@ -161,3 +216,82 @@ class TestVersionConflictProxy:
 
         assert resp.status_code == 409
         assert resp.get_json()["detail"] == self._CONFLICT["detail"]
+
+
+class TestVisionRecipeProxy:
+    """Proxy ricetta visione (#46): /maker/api/vision/tasks/<id>/recipe."""
+
+    def test_upload_forwards_recipe_and_files(self, logged_in_client, mock_api_client):
+        import io
+
+        mock_api_client.post.return_value = {
+            "task_id": 7, "recipe_dir": "vision/recipes/7/abc", "files": ["a.dxf"],
+            "outputs": [{"key": "n1.points_in_pct", "quantity": None, "unit": None}],
+        }
+
+        resp = logged_in_client.post(
+            "/maker/api/vision/tasks/7/recipe",
+            data={
+                "recipe": (io.BytesIO(b"{}"), "r.json"),
+                "files": [(io.BytesIO(b"dxf"), "a.dxf"), (io.BytesIO(b"npz"), "m.npz")],
+            },
+            content_type="multipart/form-data",
+        )
+
+        assert resp.status_code == 200
+        assert resp.get_json()["outputs"][0]["key"] == "n1.points_in_pct"
+        endpoint = mock_api_client.post.call_args.args[0]
+        sent = mock_api_client.post.call_args.kwargs["files"]
+        assert endpoint == "/api/vision/tasks/7/recipe"
+        # un campo `recipe` e un campo `files` per ogni allegato
+        assert [name for name, _f in sent] == ["recipe", "files", "files"]
+
+    def test_upload_without_recipe_is_400(self, logged_in_client, mock_api_client):
+        resp = logged_in_client.post(
+            "/maker/api/vision/tasks/7/recipe", data={}, content_type="multipart/form-data"
+        )
+        assert resp.status_code == 400
+        mock_api_client.post.assert_not_called()
+
+    def test_upload_proxies_422(self, logged_in_client, mock_api_client):
+        import io
+
+        mock_api_client.post.return_value = {
+            "error": True, "status_code": 422, "detail": "file mancante: a.dxf",
+        }
+        resp = logged_in_client.post(
+            "/maker/api/vision/tasks/7/recipe",
+            data={"recipe": (io.BytesIO(b"{}"), "r.json")},
+            content_type="multipart/form-data",
+        )
+        assert resp.status_code == 422
+        assert "a.dxf" in resp.get_json()["detail"]
+
+    def test_get_recipe_proxies(self, logged_in_client, mock_api_client):
+        mock_api_client.get.return_value = {
+            "task_id": 7, "recipe_dir": None, "recipe": None, "files": [], "outputs": [],
+        }
+        resp = logged_in_client.get("/maker/api/vision/tasks/7/recipe")
+        assert resp.status_code == 200
+        mock_api_client.get.assert_called_once_with("/api/vision/tasks/7/recipe")
+
+
+class TestTaskEditorVisionUi:
+    """task_editor.html espone i tipi visione e la select vision_output (#46)."""
+
+    def test_editor_has_vision_types_and_section(self, logged_in_client, mock_api_client):
+        from tests.conftest import api_get_router
+
+        mock_api_client.get.side_effect = api_get_router({
+            "/api/recipes/3": {"id": 3, "code": "R", "name": "R"},
+            "/api/recipes/3/tasks": [{
+                "id": 11, "title": "T", "task_type": "dxf_compare", "subtasks": [],
+                "file_path": None, "order_index": 1,
+            }],
+        })
+        html = logged_in_client.get("/maker/recipes/3/tasks").get_data(as_text=True)
+        assert 'value="camera_measure"' in html
+        assert 'value="dxf_compare"' in html
+        assert "visionRecipe(" in html
+        assert "vision_output" in html
+        assert "js/vision_recipe.js" in html

src/frontend/flask_app/tests/test_template_js_syntax.py

@@ -256,7 +256,7 @@ def test_admin_stations_inline_js_is_valid_in_english(
 
 
 def test_admin_users_inline_js_is_valid(logged_in_client, mock_admin_api):
-    """Same guard for the Users tab, now inside /admin/settings (#50)."""
+    """Same guard for /admin/users (reuses the userManagement Alpine pattern)."""
     mock_admin_api.get.return_value = [{
         "id": 1, "username": "admin", "display_name": "Admin",
         "email": None, "roles": ["Maker"], "is_admin": True,
@@ -264,7 +264,7 @@ def test_admin_users_inline_js_is_valid(logged_in_client, mock_admin_api):
     }]
 
     _force_italian(logged_in_client)
-    resp = logged_in_client.get("/admin/settings")
+    resp = logged_in_client.get("/admin/users")
     assert resp.status_code == 200
 
     html = resp.data.decode("utf-8")
@@ -272,9 +272,9 @@ def test_admin_users_inline_js_is_valid(logged_in_client, mock_admin_api):
     assert scripts
 
     for i, body in enumerate(scripts):
-        _node_check(body, f"/admin/settings script[{i}]")
+        _node_check(body, f"/admin/users script[{i}]")
 
-    _check_alpine_attributes(html, "/admin/settings")
+    _check_alpine_attributes(html, "/admin/users")
 
 
 @pytest.fixture