feat(users): Angular Beta portlet with list view and Filter by

[hmoreras]

Summary

• Scaffold the Angular Users portlet as an opt-in Beta (users-beta portletId, "Users (Beta)" label) with a <portlet-url>/users</portlet-url> override so the URL bar shows /users while the Dojo portlet stays untouched at #/c/users.
• Deliver the list view: debounced search, single-select Filter by chip (All access / Back-end / Front-end), sortable columns, pagination, bulk delete, Inactive chip, Back-end / Front-end access chips.
• Wire the search box and Filter by chip to /api/v1/users/filter using the actual backend param names (query, roleKey, per_page, orderby).

Screenshare.-.2026-08-03.11_44_56.AM.mp4

What ships

• Nx library at core-web/libs/portlets/dot-users/:
  • DotUsersShellComponent, DotUsersListComponent + DotUsersListStore, DotUsersFilterByComponent, and a stub DotUsersCreateComponent.
  • DotUsersService covering the paginated list query and single-user delete.
• Beta portlet registration:
  • portlet.xml gains a users-beta entry with <portlet-url>/users</portlet-url>.
  • Language.properties gets the portlet title and the portlet-scoped i18n keys (search placeholder, table headers, Filter by, chips, empty state, etc.).
  • app.routes.ts maps /users to the lazy-loaded module.
  • SerializationHelperTest.java bumps the expected portlet count and adds assertions for both users and users-beta.
• 28 unit tests (Spectator + Jest) covering service, store, list view, and the Filter by component.

What defers to sibling work

• The full Create / Edit User dialog with its four tabs (Profile, Roles, Permissions, API Tokens) — this PR ships the entry-point stub only; the tabs are delivered by their own tickets under Epic Dojo to Angular: Users Management Portlet #34736.
• The Roles column renders — for every row. /api/v1/users/filter does not include a user's granted roles in the response payload; populating this column requires either a batch endpoint or an inline addition to the user shape, which is captured in the spike and out of scope for the list-view ticket.
• Add to Bundle bulk action is not wired — pending confirmation on the Bundle REST contract for user assets.

Notes

• The Beta pattern is preserved: the Dojo portlet keeps its original users portletId, the Angular build is opt-in via "Add Portlet" in Tools, and the disruptive rename-and-swap is deferred to a separate follow-up.
• The Filter by chip and the userId-aware search rely on the endpoint changes merged in #36794: feat(users): extend /api/v1/users/filter with userId search and role filter #36846 (fixes Users REST: extend /api/v1/users/filter to support userId search and role filter #36794). Without those the filter param is silently ignored; with them the FE works end-to-end.
• Bulk delete calls DELETE /api/v1/users/{userId} in parallel per selected row. replacementUserId defaults to the acting admin on the backend, matching the current single-user delete behavior.

Test plan

• pnpm nx test portlets-dot-users-portlet — 28/28 pass locally
• pnpm nx lint portlets-dot-users-portlet — clean
• Manual: open a dotCMS build from this branch, add the "Users (Beta)" portlet from Tools → Add Portlet, verify the URL bar shows /users
• Manual: verify search filters as you type (against name, email, and user ID)
• Manual: verify Filter by → Back-end shows only backend users; Front-end shows only front-end users; All access clears the filter
• Manual: sort by User, Email, and Last login (asc + desc)
• Manual: paginate through 20 / 40 / 100 page sizes
• Manual: multi-select rows → Delete → confirmation → users are removed; N selected counter updates as rows toggle
• Manual: verify inactive users show the Inactive chip inline with the name
• Manual: verify the existing Dojo Users portlet is still reachable at #/c/users and unchanged

Closes #36716

[claude]

Claude finished @hmoreras's task in 10m 3s —— View job

---

Code Review — PR #36862 (Users Beta portlet)

I reviewed the frontend library (service, store, list, filter-by, shell, create stub) and the backend touchpoints (portlet.xml, Language.properties, SerializationHelperTest.java, routes). I cross-checked the FE param names and pagination math against UserResource#filter, PaginationUtil, and UserPaginator.

New Issues

• 🟡 Medium: core-web/libs/portlets/dot-users/src/lib/dot-users-list/store/dot-users-list.store.ts:104-112 — setFilter/setRoleFilter reset page to 1 and call loadUsers() directly. When the user is on a page > 1, the <p-table> [first] binding (dot-users-list.component.html:49) also changes to 0, which makes PrimeNG emit a second onLazyLoad → applyLazyLoad → a second loadUsers(). switchMap cancels the first request so there's no stale-data corruption, but it's a redundant HTTP round-trip on every filter/search change made from a non-first page. Non-blocking. Fix this →

• 🟡 Medium: core-web/libs/portlets/dot-users/src/lib/dot-users-list/dot-users-list.component.html:82-91 — the loading skeleton is rendered inside the body template, which only iterates over store.users(). On the initial load users is empty, so no skeleton renders and the emptymessage template shows the "No users yet" empty state instead — a brief but misleading flash before the first page arrives. Subsequent loads (search/sort/paginate over an already-populated list) show skeletons correctly. Consider gating the empty state on status() === 'loaded'. Non-blocking.

Verified correct

• Query params match the backend contract: query, page, per_page, orderby, direction, roleKey, includeanonymous, includedefault all line up with UserPaginator/PaginationUtil constants.
• Pagination is consistently 1-based: FE page: 1 → PaginationUtil (page-1)*perPage = 0 offset. No off-by-one.
• Sort fields (firstName, emailAddress, lastLoginDate) survive SQLUtil.sanitizeSortBy and resolve to real user_ columns under Postgres' identifier lowercasing.
• deleteSelectedUsers guards against double-submit (status() === 'loading' early return) and against a success toast when every delete fails; partial failures surface via DotHttpErrorManagerService + WARNING toast. Error paths are handled.
• rxMethod + switchMap with no take(1) inside — matches the portlet guidance; cancellation is preserved.
• userId is encodeURIComponent-escaped in the delete URL.
• SerializationHelperTest count bump (55→56) and the users / users-beta assertions are correct; both portlet ids exist in portlet.xml.
• Beta pattern intact: legacy users portlet keeps #/c/users, new users-beta adds <portlet-url>/users</portlet-url>; no route collision.
• All user-facing strings use i18n keys; data-testid present on interactive elements. Conventions followed.

The two mediums are non-blocking. Nice, well-tested PR.

• branch issue-36716-users-portlet

[alwaysmeticulous]

🤖 No test run has been triggered as your Meticulous project has been deactivated (since you haven't viewed any test results in a while). Click here to reactivate.

_{Last updated for commit d2080c8. This comment will update as new commits are pushed.}