Poweradmin\Application\Service\User

Resolves a user's avatar URL from an OAuth profile picture or Gravatar, per the interface.avatar_* settings.

Adds and removes users from groups and lists a group's members.

Creates, updates, deletes and lists user groups, with the view checks the group pages need.

Changes the logged-in user's own password after verifying the current one; LDAP users are refused.

Generates random passwords that satisfy the configured password policy.

Checks a password against the security.password_policy rules and reports the ones it fails.

Password reset by email: issues and rate-limits tokens, validates them and stores the new password.

Words a permission template delete outcome for the web flash messages.

The single guarded entry point for permission template writes.

Turns a user create or update request, keyed by the API field names, into the typed command UserManagementService takes. A value of the wrong shape is refused here with the same wording and refusal the service used to give.

Words a refused UserManagementService write for the user forms. The service's own message is the API wording; password policy, field length and external-auth password messages are the same on both sides and pass through.

Username recovery by email: rate-limits requests and mails the usernames registered to an address.