Surface

Piece	Role
+page.server.ts	Admin-only load; slim roles + permission catalog
+page.svelte	Tabs load on demand; header Save/Reset posts to /api/user/update-roles
permissions.svelte	Permission matrix vs roles; per-row ? help tooltip from Permission.description
roles.svelte	Create/edit/delete/reorder roles
admin-role.svelte	Admin role chrome
website-tokens.svelte	Website API tokens (admin mutations)

---

Control → test matrix

Control	Unit	E2E	Spec
Admin-only gate	✅ page.server + dispatcher update-roles	RBAC elsewhere	unit
Four tabs	—	✅	access-tab-*
Save disabled when clean	—	✅	access-mgmt-save
Permissions matrix content	—	✅	permissions tab
Roles list + admin visible	—	✅	roles tab
Create role → save enabled → reset	—	✅	create + discard
Role search	—	✅	access-role-search
Admin tab	—	✅	opens
Website Tokens tab	—	✅	website-tokens-panel / title / generate
Permission help tooltips	—	—	Permission.description (core-permissions.ts)
CSRF on save POST	code	—	+page.svelte

Product notes (2026-07-19)

• Create-role modal: modalState.trigger(Component, props, response) — response is 3rd arg, not buried in props.
• Save/Reset render in the PageTitle header (not StickyActions) so the fixed toast region can’t overlay them.
• Permission rows show a ? help tooltip when Permission.description is set; descriptions live in src/databases/auth/core-permissions.ts.
• Roles drag-reorder: handleRoleDrop uses insertAt = fromIndex < targetIndex ? targetIndex - 1 : targetIndex (pre-removal→post-removal index shift).
• Website tokens: $effect density/column sync is change-gated to avoid effect_update_depth_exceeded on tab open.

---

Associated tests

• access-management.spec.ts
• permissions.spec.ts — permission-matrix toggle + persistence (reads the page node from __data.json, never the layout node)
• access-management-page-server.test.ts

Run

bun run test:unit -- tests/unit/routes/access-management-page-server.test.ts
bun x playwright test tests/e2e/routes/config/access-management.spec.ts