feat: 3-tier role system across all platform apps

Portal:
- Replace is_admin boolean with role column (admin/advanced/standard)
- Settings UI: 3-tier portal role select + per-app role dropdowns
- /portal-return endpoint: re-establishes session from JWT for sub-app back-links
- /api/internal/nv-users: internal endpoint for NetworkView user sync
- portal/migrate_roles.py: one-time DB migration script
- Role badges (admin/advanced/standard) in topbar and settings table

DigiServer:
- Add editor and viewer roles (portal advanced->editor, standard->viewer)
- PlaylistPermission model: grant viewer users edit access to specific playlists
- app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers
- Content routes: editor_required on create/delete, per-playlist permission check on mutations
- Admin: playlist_permissions route + template to manage viewer playlist grants
- Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal
- content_list_new: hide create/delete for viewers; Manage vs View button per permission
- manage_playlist_content: view-only mode when user lacks edit permission

NetworkView:
- backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers
- site_permissions table: one site per advanced user
- All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only)
- Portal SSO auto-upsert: user row synced from X-Auth-Role on every request
- GET /api/users: merges portal users list with local NV data (all 4 portal users visible)
- GET/PUT /api/users/:id/site-permission: assign site to advanced user
- Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator
- Sidebar: ⬡ Portal button between Settings and Logout
- Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh

IT Assets / Server Monitor:
- portal_sso.py updated: map advanced->editor/viewer, standard->readonly
- AdminUser model: add editor role + is_editor property

NetworkView/backend/src/db.js

@@ -120,4 +120,14 @@ db.exec(`
   );
 `);
 
+// ── Site permissions (advanced role: one site per user) ──────────────────────
+db.exec(`
+  CREATE TABLE IF NOT EXISTS site_permissions (
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    site_id TEXT NOT NULL REFERENCES sites(id) ON DELETE CASCADE,
+    granted_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (user_id)
+  );
+`);
+
 module.exports = db;

NetworkView/backend/src/index.js

@@ -11,25 +11,55 @@ app.use(express.json());
 app.use(morgan('dev'));
 
 // ── Actor middleware ──────────────────────────────────────────────────────────
-// The external main app sets x-user-id + x-username after token verification.
+// The external main app sets x-user-id + x-username + x-auth-role after token verification.
 // Direct calls can use x-api-key (validated against users.api_key).
+const VALID_ROLES = new Set(['admin', 'advanced', 'standard']);
 const db = require('./db');
+
 app.use((req, _res, next) => {
   const userId   = req.headers['x-user-id'];
   const username = req.headers['x-username'];
   const apiKey   = req.headers['x-api-key'];
+  const headerRole = (req.headers['x-auth-role'] || '').trim();
+  const portalRole = VALID_ROLES.has(headerRole) ? headerRole : 'standard';
 
   if (userId && username) {
-    req.actor = { id: userId, username: String(username) };
+    req.actor = { id: String(userId), username: String(username), role: portalRole };
+
+    // ── Portal SSO sync ──────────────────────────────────────────────────────
+    // Upsert the user row so the local users table always reflects the portal.
+    // Map portal roles → NV local roles: admin→admin, advanced→advanced, standard→viewer
+    const localRole = portalRole === 'admin' ? 'admin'
+                    : portalRole === 'advanced' ? 'advanced'
+                    : 'viewer';
+    try {
+      const existing = db.prepare('SELECT id, role FROM users WHERE username = ?').get(username);
+      if (!existing) {
+        const { v4: uuidv4 } = require('uuid');
+        db.prepare(
+          'INSERT INTO users (id, username, role, is_active) VALUES (?, ?, ?, 1)'
+        ).run(String(userId), String(username), localRole);
+      } else if (existing.role !== localRole) {
+        db.prepare('UPDATE users SET role = ?, updated_at = CURRENT_TIMESTAMP WHERE username = ?')
+          .run(localRole, String(username));
+      }
+    } catch (_) { /* best-effort; never break the request */ }
+
   } else if (apiKey) {
-    const user = db.prepare('SELECT id, username FROM users WHERE api_key = ? AND is_active = 1').get(apiKey);
-    req.actor = user ? { id: user.id, username: user.username } : { id: null, username: 'api-key-invalid' };
+    const user = db.prepare('SELECT id, username, role FROM users WHERE api_key = ? AND is_active = 1').get(apiKey);
+    req.actor = user
+      ? { id: user.id, username: user.username, role: 'admin' }
+      : { id: null, username: 'api-key-invalid', role: 'standard' };
   } else {
-    req.actor = { id: null, username: 'anonymous' };
+    req.actor = { id: null, username: 'anonymous', role: 'standard' };
   }
   next();
 });
 
+// ── RBAC helpers (used by route files) ───────────────────────────────────────
+// requireRole / requireWriteAccess are defined in middleware/rbac.js
+app.locals.requireRole = require('./middleware/rbac').requireRole;
+
 // API routes
 app.use('/api/sites',      require('./routes/sites'));
 app.use('/api/rooms',      require('./routes/rooms'));

NetworkView/backend/src/middleware/rbac.js

@@ -0,0 +1,95 @@
+/**
+ * RBAC middleware for NetworkView.
+ *
+ * Role tiers (from portal via X-Auth-Role header):
+ *   admin    – full CRUD on everything
+ *   advanced – CRUD scoped to ONE assigned site (site_permissions table)
+ *   standard – read-only (GET only)
+ *
+ * Helpers exported:
+ *   requireRole(minRole)          – rejects if actor tier < minRole
+ *   requireWriteAccess(getSiteId) – admin: always; advanced: only their site;
+ *                                   standard: never
+ */
+
+const db = require('../db');
+
+// Numeric tier so we can do >=  comparisons
+const TIERS = { standard: 0, advanced: 1, admin: 2 };
+
+/** Reject if actor's role tier is below minRole. */
+function requireRole(minRole) {
+  const min = TIERS[minRole] ?? 0;
+  return (req, res, next) => {
+    const tier = TIERS[req.actor?.role] ?? 0;
+    if (tier < min) {
+      return res.status(403).json({
+        error: `Requires ${minRole} role (you have ${req.actor?.role ?? 'none'})`,
+      });
+    }
+    next();
+  };
+}
+
+/**
+ * requireWriteAccess(getSiteIdFn)
+ *
+ * getSiteIdFn(req) → siteId string (or null/undefined)
+ *   – called only when role is 'advanced' to resolve which site is being touched.
+ *   – for 'admin' it is never called.
+ *   – for 'standard' it is never called (rejected immediately).
+ *
+ * Usage:
+ *   router.post('/', requireWriteAccess(req => req.body.site_id), handler)
+ *   router.delete('/:id', requireWriteAccess(req => {
+ *     const room = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(req.params.id);
+ *     return room?.site_id;
+ *   }), handler)
+ */
+function requireWriteAccess(getSiteIdFn) {
+  return (req, res, next) => {
+    const role = req.actor?.role ?? 'standard';
+
+    if (role === 'admin') return next();
+
+    if (role !== 'advanced') {
+      return res.status(403).json({ error: 'Write access requires advanced or admin role.' });
+    }
+
+    // advanced: check site_permissions
+    const userId = req.actor?.id;
+    if (!userId) {
+      return res.status(403).json({ error: 'No user identity for permission check.' });
+    }
+
+    const perm = db.prepare(
+      'SELECT site_id FROM site_permissions WHERE user_id = ?'
+    ).get(userId);
+
+    if (!perm) {
+      return res.status(403).json({
+        error: 'Advanced user has no site assigned. Ask an admin to assign a site.',
+      });
+    }
+
+    // Resolve the target site from the request
+    let targetSiteId;
+    try {
+      targetSiteId = getSiteIdFn(req);
+    } catch (_) {
+      targetSiteId = null;
+    }
+
+    if (!targetSiteId || targetSiteId !== perm.site_id) {
+      return res.status(403).json({
+        error: 'You can only modify your assigned site.',
+      });
+    }
+
+    // Attach for downstream use
+    req.permittedSiteId = perm.site_id;
+    next();
+  };
+}
+
+module.exports = { requireRole, requireWriteAccess, TIERS };

NetworkView/backend/src/routes/components.js

@@ -2,8 +2,25 @@ const express = require('express');
 const { v4: uuidv4 } = require('uuid');
 const db = require('../db');
 const { logAudit } = require('../audit');
+const { requireWriteAccess } = require('../middleware/rbac');
 const router = express.Router();
 
+const siteIdFromComponentBody = req => {
+  if (!req.body.rack_id) return null;
+  const rack = db.prepare('SELECT room_id FROM racks WHERE id=?').get(req.body.rack_id);
+  if (!rack?.room_id) return null;
+  const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(rack.room_id);
+  return r?.site_id;
+};
+const siteIdFromComponentPk = req => {
+  const c = db.prepare('SELECT rack_id FROM components WHERE id=?').get(req.params.id ?? req.params.componentId);
+  if (!c?.rack_id) return null;
+  const rack = db.prepare('SELECT room_id FROM racks WHERE id=?').get(c.rack_id);
+  if (!rack?.room_id) return null;
+  const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(rack.room_id);
+  return r?.site_id;
+};
+
 function checkPositionOverlap(rackId, position, heightUnits, excludeId = null) {
   const end = position + heightUnits - 1;
   const existing = db.prepare(`
@@ -54,7 +71,7 @@ router.get('/:id', (req, res) => {
 });
 
 // POST /api/components
-router.post('/', (req, res) => {
+router.post('/', requireWriteAccess(siteIdFromComponentBody), (req, res) => {
   const {
     rack_id, name, type, position, height_units,
     manufacturer, model, serial_number, asset_tag,
@@ -103,7 +120,7 @@ router.post('/', (req, res) => {
 });
 
 // PUT /api/components/:id
-router.put('/:id', (req, res) => {
+router.put('/:id', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
   const component = db.prepare('SELECT * FROM components WHERE id = ?').get(req.params.id);
   if (!component) return res.status(404).json({ error: 'Component not found' });
 
@@ -162,7 +179,7 @@ router.put('/:id', (req, res) => {
 });
 
 // DELETE /api/components/:id
-router.delete('/:id', (req, res) => {
+router.delete('/:id', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
   const component = db.prepare('SELECT * FROM components WHERE id = ?').get(req.params.id);
   if (!component) return res.status(404).json({ error: 'Component not found' });
 
@@ -180,7 +197,7 @@ router.get('/:id/ports', (req, res) => {
 });
 
 // POST /api/components/:id/ports
-router.post('/:id/ports', (req, res) => {
+router.post('/:id/ports', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
   const component = db.prepare('SELECT id, type, port_count FROM components WHERE id = ?').get(req.params.id);
   if (!component) return res.status(404).json({ error: 'Component not found' });
 
@@ -216,7 +233,7 @@ router.post('/:id/ports', (req, res) => {
 });
 
 // PUT /api/components/:componentId/ports/:portId
-router.put('/:componentId/ports/:portId', (req, res) => {
+router.put('/:componentId/ports/:portId', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
   const port = db.prepare('SELECT * FROM ports WHERE id = ? AND component_id = ?').get(req.params.portId, req.params.componentId);
   if (!port) return res.status(404).json({ error: 'Port not found' });
 
@@ -249,7 +266,7 @@ router.put('/:componentId/ports/:portId', (req, res) => {
 });
 
 // DELETE /api/components/:componentId/ports/:portId
-router.delete('/:componentId/ports/:portId', (req, res) => {
+router.delete('/:componentId/ports/:portId', requireWriteAccess(siteIdFromComponentPk), (req, res) => {
   db.prepare('DELETE FROM ports WHERE id = ? AND component_id = ?').run(req.params.portId, req.params.componentId);
   res.json({ ok: true });
 });

NetworkView/backend/src/routes/racks.js

@@ -2,8 +2,21 @@ const express = require('express');
 const { v4: uuidv4 } = require('uuid');
 const db = require('../db');
 const { logAudit } = require('../audit');
+const { requireWriteAccess } = require('../middleware/rbac');
 const router = express.Router();
 
+const siteIdFromRackBody = req => {
+  if (!req.body.room_id) return null;
+  const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(req.body.room_id);
+  return r?.site_id;
+};
+const siteIdFromRackPk = req => {
+  const rack = db.prepare('SELECT room_id FROM racks WHERE id=?').get(req.params.id);
+  if (!rack?.room_id) return null;
+  const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(rack.room_id);
+  return r?.site_id;
+};
+
 // GET /api/racks?roomId=
 router.get('/', (req, res) => {
   const { roomId } = req.query;
@@ -45,7 +58,7 @@ router.get('/:id', (req, res) => {
 });
 
 // POST /api/racks
-router.post('/', (req, res) => {
+router.post('/', requireWriteAccess(siteIdFromRackBody), (req, res) => {
   const { room_id, name, total_units, manufacturer, model, notes } = req.body;
   if (!name) return res.status(400).json({ error: 'name is required' });
 
@@ -66,7 +79,7 @@ router.post('/', (req, res) => {
 });
 
 // PUT /api/racks/:id
-router.put('/:id', (req, res) => {
+router.put('/:id', requireWriteAccess(siteIdFromRackPk), (req, res) => {
   const rack = db.prepare('SELECT * FROM racks WHERE id = ?').get(req.params.id);
   if (!rack) return res.status(404).json({ error: 'Rack not found' });
 
@@ -98,7 +111,7 @@ router.put('/:id', (req, res) => {
 });
 
 // DELETE /api/racks/:id
-router.delete('/:id', (req, res) => {
+router.delete('/:id', requireWriteAccess(siteIdFromRackPk), (req, res) => {
   const rack = db.prepare('SELECT * FROM racks WHERE id = ?').get(req.params.id);
   if (!rack) return res.status(404).json({ error: 'Rack not found' });
 

NetworkView/backend/src/routes/rooms.js

@@ -2,8 +2,16 @@ const express = require('express');
 const { v4: uuidv4 } = require('uuid');
 const db = require('../db');
 const { logAudit } = require('../audit');
+const { requireWriteAccess } = require('../middleware/rbac');
 const router = express.Router();
 
+// Resolvers for site_id from a room id or room body
+const siteIdFromRoomId  = req => req.body.site_id;
+const siteIdFromRoomPk  = req => {
+  const r = db.prepare('SELECT site_id FROM rooms WHERE id=?').get(req.params.id);
+  return r?.site_id;
+};
+
 // GET /api/rooms?siteId=
 router.get('/', (req, res) => {
   const { siteId } = req.query;
@@ -39,7 +47,7 @@ router.get('/:id', (req, res) => {
 });
 
 // POST /api/rooms
-router.post('/', (req, res) => {
+router.post('/', requireWriteAccess(siteIdFromRoomId), (req, res) => {
   const { site_id, name, notes } = req.body;
   if (!site_id || !name) return res.status(400).json({ error: 'site_id and name are required' });
 
@@ -56,7 +64,7 @@ router.post('/', (req, res) => {
 });
 
 // PUT /api/rooms/:id
-router.put('/:id', (req, res) => {
+router.put('/:id', requireWriteAccess(siteIdFromRoomPk), (req, res) => {
   const room = db.prepare('SELECT * FROM rooms WHERE id = ?').get(req.params.id);
   if (!room) return res.status(404).json({ error: 'Room not found' });
 
@@ -78,7 +86,7 @@ router.put('/:id', (req, res) => {
 });
 
 // DELETE /api/rooms/:id
-router.delete('/:id', (req, res) => {
+router.delete('/:id', requireWriteAccess(siteIdFromRoomPk), (req, res) => {
   const room = db.prepare('SELECT * FROM rooms WHERE id = ?').get(req.params.id);
   if (!room) return res.status(404).json({ error: 'Room not found' });
 

NetworkView/backend/src/routes/sites.js

@@ -2,8 +2,12 @@ const express = require('express');
 const { v4: uuidv4 } = require('uuid');
 const db = require('../db');
 const { logAudit } = require('../audit');
+const { requireRole, requireWriteAccess } = require('../middleware/rbac');
 const router = express.Router();
 
+// For advanced users: the site itself IS the permission boundary
+// PUT is allowed if they own that site; POST (create) and DELETE are admin-only.
+
 // GET /api/sites
 router.get('/', (req, res) => {
   const sites = db.prepare(`
@@ -33,8 +37,8 @@ router.get('/:id', (req, res) => {
   res.json({ ...site, rooms });
 });
 
-// POST /api/sites
-router.post('/', (req, res) => {
+// POST /api/sites — admin only (creating a new site is a structural change)
+router.post('/', requireRole('admin'), (req, res) => {
   const { name, location, notes } = req.body;
   if (!name) return res.status(400).json({ error: 'Name is required' });
 
@@ -47,8 +51,8 @@ router.post('/', (req, res) => {
   res.status(201).json(created);
 });
 
-// PUT /api/sites/:id
-router.put('/:id', (req, res) => {
+// PUT /api/sites/:id — admin always; advanced only if this is their assigned site
+router.put('/:id', requireWriteAccess(req => req.params.id), (req, res) => {
   const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(req.params.id);
   if (!site) return res.status(404).json({ error: 'Site not found' });
 
@@ -71,8 +75,8 @@ router.put('/:id', (req, res) => {
   res.json(db.prepare('SELECT * FROM sites WHERE id = ?').get(req.params.id));
 });
 
-// DELETE /api/sites/:id
-router.delete('/:id', (req, res) => {
+// DELETE /api/sites/:id — admin only
+router.delete('/:id', requireRole('admin'), (req, res) => {
   const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(req.params.id);
   if (!site) return res.status(404).json({ error: 'Site not found' });
 

NetworkView/backend/src/routes/users.js

@@ -1,40 +1,121 @@
 /**
  * /api/users
  *
- * Manages NetworkView users. Authentication is expected to be handled by
- * the external main app; this API accepts an `x-user-id` / `x-username`
- * header (set by the gateway after verifying the bearer token) and an
- * `x-api-key` header for direct service-to-service calls.
+ * Manages NetworkView users. The GET / endpoint merges data from:
+ *   1. The local NV users table (api_key status, site_permissions)
+ *   2. The portal's /api/internal/nv-users endpoint (all portal users with NV access)
  *
- * Roles: admin | editor | viewer
+ * This ensures portal users appear in Settings even before their first NV login.
  */
 
 const express = require('express');
 const { v4: uuidv4 } = require('uuid');
 const crypto = require('crypto');
+const http = require('http');
 const db = require('../db');
 const { logAudit } = require('../audit');
+const { requireRole } = require('../middleware/rbac');
 const router = express.Router();
 
+// ── Config ────────────────────────────────────────────────────────────────────
+const PORTAL_URL     = process.env.PORTAL_INTERNAL_URL || 'http://localhost:5001';
+const INTERNAL_TOKEN = process.env.INTERNAL_SYNC_SECRET || 'change-this-internal-secret';
+
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
-const safeUser = u => ({
-  id: u.id,
-  username: u.username,
-  email: u.email,
-  role: u.role,
-  is_active: u.is_active,
-  has_api_key: !!u.api_key,
-  created_at: u.created_at,
-  updated_at: u.updated_at,
-});
+const safeUser = u => {
+  const perm = db.prepare(
+    'SELECT sp.site_id, s.name AS site_name FROM site_permissions sp LEFT JOIN sites s ON s.id = sp.site_id WHERE sp.user_id = ?'
+  ).get(u.id);
+  return {
+    id: u.id,
+    username: u.username,
+    email: u.email,
+    role: u.role,
+    is_active: Boolean(u.is_active),
+    has_api_key: !!u.api_key,
+    site_permission: perm ? { site_id: perm.site_id, site_name: perm.site_name } : null,
+    created_at: u.created_at,
+    updated_at: u.updated_at,
+  };
+};
+
+/** Fetch portal NV-users list. Returns [] on any error (best-effort). */
+function fetchPortalUsers() {
+  return new Promise(resolve => {
+    const url = new URL('/api/internal/nv-users', PORTAL_URL);
+    const req = http.request(
+      { hostname: url.hostname, port: url.port || 80, path: url.pathname,
+        method: 'GET', headers: { 'X-Internal-Token': INTERNAL_TOKEN } },
+      res => {
+        let body = '';
+        res.on('data', c => { body += c; });
+        res.on('end', () => {
+          try { resolve(res.statusCode === 200 ? JSON.parse(body) : []); }
+          catch (_) { resolve([]); }
+        });
+      }
+    );
+    req.on('error', () => resolve([]));
+    req.setTimeout(3000, () => { req.destroy(); resolve([]); });
+    req.end();
+  });
+}
 
 // ── GET /api/users ────────────────────────────────────────────────────────────
-router.get('/', (req, res) => {
-  const users = db.prepare('SELECT * FROM users ORDER BY username').all();
-  res.json(users.map(safeUser));
+// Merges portal users (with NV access) and local NV user rows.
+router.get('/', async (req, res) => {
+  // Local NV users keyed by username
+  const localUsers = db.prepare('SELECT * FROM users ORDER BY username').all();
+  const localByUsername = Object.fromEntries(localUsers.map(u => [u.username, u]));
+
+  // Portal users (all who have NV access)
+  const portalUsers = await fetchPortalUsers();
+
+  const seen = new Set();
+  const result = [];
+
+  for (const pu of portalUsers) {
+    seen.add(pu.username);
+    const local = localByUsername[pu.username];
+
+    if (local) {
+      // Merge: use portal role (source of truth) but keep NV-local extras
+      result.push(safeUser({ ...local, role: _mapPortalRole(pu.nv_role) }));
+    } else {
+      // Portal user not yet in NV — show with no local extras
+      const perm = null;
+      result.push({
+        id:             pu.portal_id,
+        username:       pu.username,
+        email:          pu.email,
+        role:           _mapPortalRole(pu.nv_role),
+        is_active:      true,
+        has_api_key:    false,
+        site_permission: null,
+        created_at:     null,
+        updated_at:     null,
+        not_yet_synced: true,  // hint for UI
+      });
+    }
+  }
+
+  // Include any local-only users not in portal (e.g. API-key-only accounts)
+  for (const u of localUsers) {
+    if (!seen.has(u.username)) result.push(safeUser(u));
+  }
+
+  result.sort((a, b) => a.username.localeCompare(b.username));
+  res.json(result);
 });
 
+/** Map portal role string → NV local role string */
+function _mapPortalRole(role) {
+  if (role === 'admin')    return 'admin';
+  if (role === 'advanced') return 'advanced';
+  return 'viewer';
+}
+
 // ── GET /api/users/:id ────────────────────────────────────────────────────────
 router.get('/:id', (req, res) => {
   const user = db.prepare('SELECT * FROM users WHERE id = ?').get(req.params.id);
@@ -113,6 +194,41 @@ router.delete('/:id', (req, res) => {
   res.json({ ok: true });
 });
 
+// ── GET /api/users/:id/site-permission ───────────────────────────────────────
+router.get('/:id/site-permission', requireRole('admin'), (req, res) => {
+  const user = db.prepare('SELECT id FROM users WHERE id = ?').get(req.params.id);
+  if (!user) return res.status(404).json({ error: 'User not found' });
+  const perm = db.prepare(
+    'SELECT sp.site_id, s.name AS site_name FROM site_permissions sp LEFT JOIN sites s ON s.id = sp.site_id WHERE sp.user_id = ?'
+  ).get(req.params.id);
+  res.json(perm ?? { site_id: null, site_name: null });
+});
+
+// ── PUT /api/users/:id/site-permission ───────────────────────────────────────
+// Body: { site_id: "<uuid>" }  or  { site_id: null } to clear
+router.put('/:id/site-permission', requireRole('admin'), (req, res) => {
+  const user = db.prepare('SELECT id, username FROM users WHERE id = ?').get(req.params.id);
+  if (!user) return res.status(404).json({ error: 'User not found' });
+
+  const { site_id } = req.body;
+
+  if (!site_id) {
+    db.prepare('DELETE FROM site_permissions WHERE user_id = ?').run(req.params.id);
+    logAudit(req, { action: 'update', entityType: 'user', entityId: user.id, entityName: user.username, changes: 'site_permission cleared' });
+    return res.json({ ok: true, site_id: null });
+  }
+
+  const site = db.prepare('SELECT id, name FROM sites WHERE id = ?').get(site_id);
+  if (!site) return res.status(404).json({ error: 'Site not found' });
+
+  db.prepare(
+    'INSERT INTO site_permissions (user_id, site_id) VALUES (?, ?) ON CONFLICT(user_id) DO UPDATE SET site_id=excluded.site_id, granted_at=CURRENT_TIMESTAMP'
+  ).run(req.params.id, site_id);
+
+  logAudit(req, { action: 'update', entityType: 'user', entityId: user.id, entityName: user.username, changes: `site_permission set to ${site.name}` });
+  res.json({ ok: true, site_id, site_name: site.name });
+});
+
 // ── POST /api/users/:id/api-key  (generate / rotate) ─────────────────────────
 router.post('/:id/api-key', (req, res) => {
   const user = db.prepare('SELECT * FROM users WHERE id = ?').get(req.params.id);

NetworkView/frontend/src/api.ts

@@ -84,6 +84,10 @@ export const rotateApiKey = (id: string) =>
   request<{ api_key: string }>(`/users/${id}/api-key`, { method: 'POST' });
 export const revokeApiKey = (id: string) =>
   request(`/users/${id}/api-key`, { method: 'DELETE' });
+export const setSitePermission = (userId: string, siteId: string | null) =>
+  request<{ ok: boolean; site_id: string | null }>(`/users/${userId}/site-permission`, {
+    method: 'PUT', body: JSON.stringify({ site_id: siteId }),
+  });
 
 // --- Audit ---
 export const getAuditLog = (params: {

NetworkView/frontend/src/components/Sidebar.tsx

@@ -19,6 +19,7 @@ export default function Sidebar() {
   const [loading, setLoading] = useState(true);
   const [addSiteName, setAddSiteName] = useState('');
   const [showAddSite, setShowAddSite] = useState(false);
+  const [addSiteErr, setAddSiteErr] = useState<string | null>(null);
   const navigate = useNavigate();
   const location = useLocation();
 
@@ -74,11 +75,16 @@ export default function Sidebar() {
   const handleAddSite = async (e: React.FormEvent) => {
     e.preventDefault();
     if (!addSiteName.trim()) return;
-    const site = await api.createSite({ name: addSiteName.trim() });
-    setAddSiteName('');
-    setShowAddSite(false);
-    await loadTree();
-    navigate(`/sites/${site.id}`);
+    setAddSiteErr(null);
+    try {
+      const site = await api.createSite({ name: addSiteName.trim() });
+      setAddSiteName('');
+      setShowAddSite(false);
+      await loadTree();
+      navigate(`/sites/${site.id}`);
+    } catch (ex: unknown) {
+      setAddSiteErr(ex instanceof Error ? ex.message : String(ex));
+    }
   };
 
   useEffect(() => {
@@ -147,18 +153,21 @@ export default function Sidebar() {
         </div>
 
         {showAddSite && (
-          <form onSubmit={handleAddSite} className="inline-add-form">
-            <input
-              autoFocus
-              type="text"
-              placeholder="Site name..."
-              value={addSiteName}
-              onChange={e => setAddSiteName(e.target.value)}
-              className="inline-input"
-            />
-            <button type="submit" className="inline-btn">Add</button>
-            <button type="button" className="inline-btn secondary" onClick={() => setShowAddSite(false)}>✕</button>
-          </form>
+          <>
+            <form onSubmit={handleAddSite} className="inline-add-form">
+              <input
+                autoFocus
+                type="text"
+                placeholder="Site name..."
+                value={addSiteName}
+                onChange={e => setAddSiteName(e.target.value)}
+                className="inline-input"
+              />
+              <button type="submit" className="inline-btn">Add</button>
+              <button type="button" className="inline-btn secondary" onClick={() => { setShowAddSite(false); setAddSiteErr(null); }}>✕</button>
+            </form>
+            {addSiteErr && <div className="inline-error">{addSiteErr}</div>}
+          </>
         )}
 
         {loading && <div className="sidebar-loading">Loading...</div>}
@@ -229,6 +238,13 @@ export default function Sidebar() {
         <Link to="/settings" className={`sidebar-footer-link ${isActive('/settings') ? 'active' : ''}`}>
           ⚙ Settings
         </Link>
+        <a
+          href="/portal-return"
+          className="sidebar-footer-link"
+          title="Back to Enterprise Portal"
+        >
+          ⬡ Portal
+        </a>
         <button
           className="sidebar-footer-link sidebar-logout-btn"
           onClick={() => { window.location.href = (import.meta.env.VITE_PORTAL_LOGOUT_URL as string | undefined) ?? '/logout'; }}

NetworkView/frontend/src/index.css

@@ -172,6 +172,7 @@ a:hover { text-decoration: underline; }
 }
 .inline-input {
   flex: 1;
+  min-width: 0;
   background: var(--surface2);
   border: 1px solid var(--accent);
   border-radius: var(--radius);
@@ -181,6 +182,7 @@ a:hover { text-decoration: underline; }
   outline: none;
 }
 .inline-btn {
+  flex-shrink: 0;
   background: var(--accent-dim);
   border: none;
   border-radius: var(--radius);
@@ -190,6 +192,7 @@ a:hover { text-decoration: underline; }
   padding: 4px 8px;
 }
 .inline-btn.secondary { background: var(--surface3); }
+.inline-error { padding: 2px 8px 4px; color: var(--danger); font-size: 11px; }
 
 /* Tree nodes */
 .tree-node { display: flex; flex-direction: column; }

NetworkView/frontend/src/pages/SettingsPage.tsx

@@ -14,9 +14,10 @@ const ACTION_COLORS: Record<string, string> = {
 };
 
 const ROLE_COLORS: Record<string, string> = {
-  admin:  '#f87171',
-  editor: '#f59e0b',
-  viewer: '#8b949e',
+  admin:    '#f87171',
+  advanced: '#f59e0b',
+  editor:   '#f59e0b',
+  viewer:   '#8b949e',
 };
 
 function formatTs(ts: string) {
@@ -40,6 +41,7 @@ function StatsPanel({ stats }: { stats: DbStats }) {
 // ── Sub-section: Users ────────────────────────────────────────────────────────
 function UsersPanel() {
   const [users, setUsers]     = useState<User[]>([]);
+  const [sites, setSites]     = useState<{ id: string; name: string }[]>([]);
   const [loading, setLoading] = useState(true);
   const [showAdd, setShowAdd] = useState(false);
   const [form, setForm]       = useState({ username: '', email: '', role: 'viewer' });
@@ -48,7 +50,9 @@ function UsersPanel() {
 
   const load = useCallback(async () => {
     setLoading(true);
-    setUsers(await api.getUsers());
+    const [us, ss] = await Promise.all([api.getUsers(), api.getSites()]);
+    setUsers(us);
+    setSites(ss);
     setLoading(false);
   }, []);
 
@@ -90,6 +94,21 @@ function UsersPanel() {
     await load();
   };
 
+  const handleSitePermission = async (u: User, siteId: string | null) => {
+    try {
+      await api.setSitePermission(u.id, siteId);
+      await load();
+    } catch (ex: unknown) {
+      alert(ex instanceof Error ? ex.message : String(ex));
+    }
+  };
+
+  const ROLE_LABEL: Record<string, string> = {
+    admin:    '★ admin',
+    advanced: '✏ advanced',
+    viewer:   '👁 viewer',
+  };
+
   return (
     <div className="settings-section">
       <div className="settings-section-header">
@@ -97,8 +116,8 @@ function UsersPanel() {
         <button className="btn-primary btn-sm" onClick={() => setShowAdd(v => !v)}>+ Add User</button>
       </div>
       <p className="settings-desc">
-        User accounts for this NetworkView instance. Authentication is delegated to your central app — 
-        set <code>X-User-Id</code> + <code>X-Username</code> headers on API requests, or use per-user API keys.
+        Users are automatically synced from the Enterprise Portal on each login.
+        Roles: <strong>admin</strong> — full access · <strong>advanced</strong> — CRUD on one assigned site · <strong>viewer</strong> — read-only.
       </p>
 
       {showAdd && (
@@ -115,9 +134,9 @@ function UsersPanel() {
             className="modal-select"
             value={form.role} onChange={e => setForm(f => ({ ...f, role: e.target.value }))}
           >
-            <option value="viewer">Viewer</option>
-            <option value="editor">Editor</option>
-            <option value="admin">Admin</option>
+            <option value="viewer">👁 Viewer — read-only</option>
+            <option value="advanced">✏ Advanced — one site</option>
+            <option value="admin">★ Admin — full access</option>
           </select>
           {err && <div className="settings-error">{err}</div>}
           <div className="form-actions">
@@ -142,19 +161,43 @@ function UsersPanel() {
         <table className="settings-user-table">
           <thead>
             <tr>
-              <th>Username</th><th>Email</th><th>Role</th><th>Status</th><th>API Key</th><th>Actions</th>
+              <th>Username</th><th>Email</th><th>Role</th><th>Assigned Site</th><th>Status</th><th>API Key</th><th>Actions</th>
             </tr>
           </thead>
           <tbody>
             {users.map(u => (
               <tr key={u.id} style={{ opacity: u.is_active ? 1 : 0.5 }}>
-                <td><strong>{u.username}</strong></td>
+                <td><strong>{u.username}</strong>{u.not_yet_synced && (
+                    <span title="User exists in portal but hasn't logged into NetworkView yet"
+                          style={{ marginLeft: 6, fontSize: 10, color: 'var(--text3)', verticalAlign: 'middle' }}>
+                      (portal only)
+                    </span>
+                  )}</td>
                 <td style={{ color: 'var(--text3)', fontSize: 12 }}>{u.email ?? '—'}</td>
                 <td>
                   <span className="status-badge" style={{ color: ROLE_COLORS[u.role] ?? '#8b949e', borderColor: ROLE_COLORS[u.role] ?? '#8b949e' }}>
-                    {u.role}
+                    {ROLE_LABEL[u.role] ?? u.role}
                   </span>
                 </td>
+                <td style={{ minWidth: 160 }}>
+                  {u.role === 'advanced' ? (
+                    <select
+                      className="modal-select"
+                      style={{ fontSize: 12, padding: '2px 6px' }}
+                      value={u.site_permission?.site_id ?? ''}
+                      onChange={e => handleSitePermission(u, e.target.value || null)}
+                    >
+                      <option value="">— no site assigned —</option>
+                      {sites.map(s => (
+                        <option key={s.id} value={s.id}>{s.name}</option>
+                      ))}
+                    </select>
+                  ) : (
+                    <span style={{ color: 'var(--text3)', fontSize: 12 }}>
+                      {u.role === 'admin' ? 'all sites' : '—'}
+                    </span>
+                  )}
+                </td>
                 <td>
                   <span className={`status-badge status-${u.is_active ? 'active' : 'decommissioned'}`}>
                     {u.is_active ? 'active' : 'inactive'}
@@ -177,7 +220,7 @@ function UsersPanel() {
               </tr>
             ))}
             {users.length === 0 && (
-              <tr><td colSpan={6} style={{ textAlign: 'center', color: 'var(--text3)', padding: 20 }}>No users yet</td></tr>
+              <tr><td colSpan={7} style={{ textAlign: 'center', color: 'var(--text3)', padding: 20 }}>No users yet</td></tr>
             )}
           </tbody>
         </table>

NetworkView/frontend/src/types.ts

@@ -143,11 +143,13 @@ export interface User {
   id: string;
   username: string;
   email?: string;
-  role: 'admin' | 'editor' | 'viewer';
+  role: 'admin' | 'advanced' | 'viewer';
   is_active: boolean;
   has_api_key: boolean;
-  created_at: string;
-  updated_at: string;
+  site_permission: { site_id: string; site_name: string } | null;
+  not_yet_synced?: boolean;
+  created_at: string | null;
+  updated_at: string | null;
 }
 
 export interface AuditEntry {