Surface

Piece	Role
+page.server.ts	Admin-only load; roles from locals; permission catalog
+page.svelte	Tabs: Permissions, Roles, Admin, Website Tokens; save/reset
permissions.svelte	Permission matrix vs roles
roles.svelte	Create/edit/delete/reorder roles
admin-role.svelte	Admin role chrome
website-tokens.svelte	Website API tokens
access.remote.ts	Token remote helpers

---

Control → test matrix

Control	Unit	E2E	Spec
Admin-only gate	✅ page.server	RBAC elsewhere	unit
Four tabs	—	✅	access-tab-*
Save disabled when clean	—	✅	access-mgmt-save
Permissions matrix content	—	✅	permissions tab
Roles list + admin visible	—	✅	roles tab
Create role → save enabled → reset	—	✅	create + discard
Role search	—	✅	access-role-search
Admin tab	—	✅	opens
Website Tokens tab	—	✅	website-tokens-panel / title / generate
CSRF on save POST	code	—	+page.svelte

Product notes (2026-07-19)

• Create-role modal: modalState.trigger(Component, props, response) — response is 3rd arg, not buried in props.
• Sticky page-actions duplicate Save/Reset — E2E always uses .first().
• Website tokens: $effect density/column sync is change-gated to avoid effect_update_depth_exceeded on tab open.

---

Associated tests

• access-management.spec.ts
• access-management-page-server.test.ts

Run

bun run test:unit -- tests/unit/routes/access-management-page-server.test.ts
bun x playwright test tests/e2e/routes/config/access-management.spec.ts