OneBot: Leantime 改造版源码（BOM/Univer 表格/AI 接管/品牌替换等）

app/Domain/Users/Controllers/DelUser.php

@@ -0,0 +1,88 @@
+<?php
+
+namespace Leantime\Domain\Users\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Core\Controller\Frontcontroller;
+use Leantime\Domain\Users\Permissions\UsersPermissions;
+use Leantime\Domain\Users\Services\Users;
+use Symfony\Component\HttpFoundation\Response;
+
+class DelUser extends Controller
+{
+    private Users $userService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(Users $userService): void
+    {
+        $this->userService = $userService;
+    }
+
+    /**
+     * Displays the delete user confirmation page.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(UsersPermissions::DELETE, global: true)]
+    public function get(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->display('errors.error403', responseCode: 403);
+        }
+
+        $id = (int) $params['id'];
+        $user = $this->userService->getUser($id);
+
+        $this->generateFormTokens();
+
+        $this->tpl->assign('user', $user);
+
+        return $this->tpl->display('users.delUser');
+    }
+
+    /**
+     * Handles user deletion.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(UsersPermissions::DELETE, global: true)]
+    public function post(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->display('errors.error403', responseCode: 403);
+        }
+
+        $id = (int) $params['id'];
+        $user = $this->userService->getUser($id);
+
+        if (isset($_POST['del'])) {
+            if (isset($_POST[session('formTokenName')]) && $_POST[session('formTokenName')] == session('formTokenValue')) {
+                $this->userService->deleteUser($id);
+                $this->tpl->setNotification($this->language->__('notifications.user_deleted'), 'success', 'user_deleted');
+
+                return Frontcontroller::redirect(BASE_URL.'/users/showAll');
+            }
+
+            $this->tpl->setNotification($this->language->__('notification.form_token_incorrect'), 'error');
+        }
+
+        $this->generateFormTokens();
+
+        $this->tpl->assign('user', $user);
+
+        return $this->tpl->display('users.delUser');
+    }
+
+    /**
+     * Generates CSRF form tokens for the sensitive delete form.
+     */
+    private function generateFormTokens(): void
+    {
+        $permitted_chars = '0123456789abcdefghijklmnopqrstuvwxyz';
+        session(['formTokenName' => substr(str_shuffle($permitted_chars), 0, 32)]);
+        session(['formTokenValue' => substr(str_shuffle($permitted_chars), 0, 32)]);
+    }
+}

app/Domain/Users/Controllers/EditOwn.php

@@ -0,0 +1,129 @@
+<?php
+
+namespace Leantime\Domain\Users\Controllers;
+
+use Leantime\Core\Controller\Controller;
+use Leantime\Core\Controller\Frontcontroller as FrontcontrollerCore;
+use Leantime\Domain\Users\Services\Users as UserService;
+use Symfony\Component\HttpFoundation\Response;
+
+class EditOwn extends Controller
+{
+    private UserService $userService;
+
+    private int $userId;
+
+    /**
+     * init - initialize private variables
+     */
+    public function init(UserService $userService): void
+    {
+        $this->userService = $userService;
+
+        $this->userId = session('userdata.id');
+    }
+
+    /**
+     * @throws \Exception
+     */
+    public function get(): Response
+    {
+        $permitted_chars = '123456789abcdefghijklmnopqrstuvwxyz';
+        session(['formTokenName' => substr(str_shuffle($permitted_chars), 0, 32)]);
+        session(['formTokenValue' => substr(str_shuffle($permitted_chars), 0, 32)]);
+
+        $profileSettings = $this->userService->getOwnProfileSettings($this->userId);
+        array_map([$this->tpl, 'assign'], array_keys($profileSettings), array_values($profileSettings));
+
+        $notificationPreferences = $this->userService->getNotificationPreferences($this->userId);
+        array_map([$this->tpl, 'assign'], array_keys($notificationPreferences), array_values($notificationPreferences));
+
+        return $this->tpl->display('users.editOwn');
+    }
+
+    /**
+     * @throws \Exception
+     */
+    public function post(): Response
+    {
+        // Save Profile Info
+        $tab = '';
+
+        if (isset($_POST[session('formTokenName')]) && session()->exists('formTokenName') && $_POST[session('formTokenName')] === session('formTokenValue')) {
+            // profile Info
+            if (isset($_POST['profileInfo'])) {
+                $tab = '#myProfile';
+
+                $result = $this->userService->saveOwnProfile($this->userId, $_POST);
+
+                if ($result === 'success') {
+                    $this->tpl->setNotification($this->language->__('notifications.profile_edited'), 'success', 'profile_edited');
+                } elseif ($result === 'user_exists') {
+                    $this->tpl->setNotification($this->language->__('notification.user_exists'), 'error');
+                } elseif ($result === 'no_valid_email') {
+                    $this->tpl->setNotification($this->language->__('notification.no_valid_email'), 'error');
+                } else {
+                    $this->tpl->setNotification($this->language->__('notification.enter_email'), 'error');
+                }
+            }
+
+            // Save Password
+            if (isset($_POST['savepw'])) {
+                $tab = '#security';
+
+                $result = $this->userService->changeOwnPassword(
+                    $this->userId,
+                    $_POST['currentPassword'],
+                    $_POST['newPassword'],
+                    $_POST['confirmPassword']
+                );
+
+                if ($result === 'success') {
+                    $this->tpl->setNotification($this->language->__('notifications.password_changed'), 'success', 'password_edited');
+                } elseif ($result === 'password_not_strong_enough') {
+                    $this->tpl->setNotification($this->language->__('notification.password_not_strong_enough'), 'error');
+                } elseif ($result === 'passwords_dont_match') {
+                    $this->tpl->setNotification($this->language->__('notification.passwords_dont_match'), 'error');
+                } else {
+                    $this->tpl->setNotification($this->language->__('notification.previous_password_incorrect'), 'error');
+                }
+            }
+
+            if (isset($_POST['saveTheme'])) {
+                $tab = '#theme';
+
+                $this->userService->saveOwnAppearanceSettings($this->userId, $_POST);
+
+                $this->tpl->setNotification($this->language->__('notifications.changed_profile_settings_successfully'), 'success', 'themsettings_updated');
+            }
+
+            // Save Look & Feel
+            if (isset($_POST['saveSettings'])) {
+                $tab = '#settings';
+
+                $this->userService->saveOwnLocaleSettings($this->userId, $_POST);
+
+                $this->tpl->setNotification($this->language->__('notifications.changed_profile_settings_successfully'), 'success', 'profilesettings_updated');
+            }
+
+            // Save Profile Image
+            if (isset($_POST['profileImage'])) {
+                $tab = '#myProfile';
+            }
+
+            // Save Notifications
+            if (isset($_POST['savenotifications'])) {
+                $tab = '#notifications';
+
+                $this->userService->saveOwnNotificationPreferences($this->userId, $_POST);
+
+                $this->tpl->setNotification($this->language->__('notifications.changed_profile_settings_successfully'), 'success', 'profilesettings_updated');
+            }
+        } else {
+            $this->tpl->setNotification($this->language->__('notification.form_token_incorrect'), 'error');
+        }
+
+        // Redirect
+        return FrontcontrollerCore::redirect(BASE_URL.'/users/editOwn'.$tab);
+    }
+}

app/Domain/Users/Controllers/EditUser.php

@@ -0,0 +1,250 @@
+<?php
+
+namespace Leantime\Domain\Users\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Core\Controller\Frontcontroller;
+use Leantime\Domain\Auth\Models\Roles;
+use Leantime\Domain\Clients\Services\Clients as ClientService;
+use Leantime\Domain\Projects\Services\Projects as ProjectService;
+use Leantime\Domain\Users\Permissions\UsersPermissions;
+use Leantime\Domain\Users\Repositories\Users as UserRepository;
+use Leantime\Domain\Users\Services\Users;
+use Symfony\Component\HttpFoundation\Response;
+
+class EditUser extends Controller
+{
+    private ProjectService $projectService;
+
+    private ClientService $clientService;
+
+    private Users $userService;
+
+    private UserRepository $userRepo;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(
+        ProjectService $projectService,
+        ClientService $clientService,
+        Users $userService,
+        UserRepository $userRepo
+    ): void {
+        $this->projectService = $projectService;
+        $this->clientService = $clientService;
+        $this->userService = $userService;
+        $this->userRepo = $userRepo;
+    }
+
+    /**
+     * Displays the edit user form.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(UsersPermissions::EDIT, global: true)]
+    public function get(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->display('errors.error403', responseCode: 403);
+        }
+
+        $id = (int) $params['id'];
+        // Admin edit form needs the full row (e.g. pwReset for the invite
+        // link), so read from the repository — the service getUser strips
+        // secrets for API safety (#3556).
+        $row = $this->userRepo->getUser($id);
+
+        if ($row === false) {
+            return $this->tpl->display('errors.error404', responseCode: 404);
+        }
+
+        if (array_key_exists('resendInvite', $_GET)) {
+            return $this->handleResendInvite($id, $row);
+        }
+
+        $values = $this->buildValuesFromUser($row);
+        $projectrelation = $this->userService->getUserProjectIds($id);
+
+        $this->generateFormTokens();
+
+        $this->tpl->assign('values', $values);
+        $this->tpl->assign('relations', $projectrelation);
+        $this->tpl->assign('id', $id);
+        $this->assignTemplateVars();
+
+        return $this->tpl->display('users.editUser');
+    }
+
+    /**
+     * Handles user profile updates.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(UsersPermissions::EDIT, global: true)]
+    public function post(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->display('errors.error403', responseCode: 403);
+        }
+
+        $id = (int) $params['id'];
+        // Admin edit form needs the full row (e.g. pwReset for the invite
+        // link), so read from the repository — the service getUser strips
+        // secrets for API safety (#3556).
+        $row = $this->userRepo->getUser($id);
+
+        if ($row === false) {
+            return $this->tpl->display('errors.error404', responseCode: 404);
+        }
+
+        $values = $this->buildValuesFromUser($row);
+        $edit = false;
+
+        if (isset($_POST['save'])) {
+            if (! isset($_POST[session('formTokenName')]) || $_POST[session('formTokenName')] != session('formTokenValue')) {
+                $this->tpl->setNotification($this->language->__('notification.form_token_incorrect'), 'error');
+            } else {
+                $values = $this->buildValuesFromPost($row);
+                $edit = $this->handleValidation($values, $row, $id);
+            }
+        }
+
+        if ($edit) {
+            $this->userService->updateUser($values, $id, $_POST['projects'] ?? null);
+            $this->tpl->setNotification($this->language->__('notifications.user_edited'), 'success');
+        }
+
+        $projectrelation = $this->userService->getUserProjectIds($id);
+
+        $this->generateFormTokens();
+
+        $this->tpl->assign('values', $values);
+        $this->tpl->assign('relations', $projectrelation);
+        $this->tpl->assign('id', $id);
+        $this->assignTemplateVars();
+
+        return $this->tpl->display('users.editUser');
+    }
+
+    /**
+     * Handles the resend invite action.
+     */
+    private function handleResendInvite(int $id, array $row): Response
+    {
+        $result = $this->userService->resendUserInvite($id, $row);
+
+        if ($result === 'too_soon') {
+            $this->tpl->setNotification($this->language->__('notification.invite_too_soon'), 'error');
+        } elseif ($result === 'too_many_invites') {
+            $this->tpl->setNotification($this->language->__('notification.too_many_invites'), 'error');
+        } else {
+            $this->tpl->setNotification($this->language->__('notification.invitation_sent'), 'success', 'userinvitation_sent');
+        }
+
+        return Frontcontroller::redirect(BASE_URL.'/users/editUser/'.$id);
+    }
+
+    /**
+     * Validates a user update and sets the matching notification on failure.
+     *
+     * @return bool True if the update should proceed.
+     */
+    private function handleValidation(array $values, array $row, int $id): bool
+    {
+        $result = $this->userService->validateUserUpdate($values, $row, $id, $_POST);
+
+        if ($result === 'valid') {
+            return true;
+        }
+
+        $messages = [
+            'passwords_dont_match' => 'notification.passwords_dont_match',
+            'enter_email' => 'notification.enter_email',
+            'no_valid_email' => 'notification.no_valid_email',
+            'user_exists' => 'notification.user_exists',
+        ];
+
+        $this->tpl->setNotification($this->language->__($messages[$result]), 'error');
+
+        return false;
+    }
+
+    /**
+     * Builds a values array from the user database row.
+     */
+    private function buildValuesFromUser(array $row): array
+    {
+        return [
+            'id' => $row['id'],
+            'firstname' => $row['firstname'],
+            'lastname' => $row['lastname'],
+            'user' => $row['username'],
+            'phone' => $row['phone'],
+            'status' => $row['status'],
+            'role' => $row['role'],
+            'hours' => $row['hours'],
+            'wage' => $row['wage'],
+            'clientId' => $row['clientId'],
+            'source' => $row['source'],
+            'pwReset' => $row['pwReset'],
+            'jobTitle' => $row['jobTitle'],
+            'jobLevel' => $row['jobLevel'],
+            'department' => $row['department'],
+            'weekly_hours' => $row['weekly_hours'] ?? null,
+            'employment_type' => $row['employment_type'] ?? null,
+        ];
+    }
+
+    /**
+     * Builds a values array from POST data, falling back to the original user row.
+     */
+    private function buildValuesFromPost(array $row): array
+    {
+        return [
+            'id' => $row['id'],
+            'firstname' => $_POST['firstname'] ?? $row['firstname'],
+            'lastname' => $_POST['lastname'] ?? $row['lastname'],
+            'user' => $_POST['user'] ?? $row['username'],
+            'phone' => $_POST['phone'] ?? $row['phone'],
+            'status' => $_POST['status'] ?? $row['status'],
+            'role' => $_POST['role'] ?? $row['role'],
+            'hours' => $_POST['hours'] ?? $row['hours'],
+            'wage' => $_POST['wage'] ?? $row['wage'],
+            'clientId' => $_POST['client'] ?? $row['clientId'],
+            'source' => $row['source'],
+            'pwReset' => $row['pwReset'],
+            'jobTitle' => $_POST['jobTitle'] ?? $row['jobTitle'],
+            'jobLevel' => $_POST['jobLevel'] ?? $row['jobLevel'],
+            'department' => $_POST['department'] ?? $row['department'],
+            // Capacity fields — only pass when actually posted so the
+            // repo's array_key_exists guard preserves existing values on
+            // a form submit that omits them (non-admin path today, but
+            // also future partial-update callers).
+            ...(array_key_exists('weekly_hours', $_POST) ? ['weekly_hours' => $_POST['weekly_hours']] : []),
+            ...(array_key_exists('employment_type', $_POST) ? ['employment_type' => $_POST['employment_type']] : []),
+        ];
+    }
+
+    /**
+     * Generates CSRF form tokens.
+     */
+    private function generateFormTokens(): void
+    {
+        $permitted_chars = '0123456789abcdefghijklmnopqrstuvwxyz';
+        session(['formTokenName' => substr(str_shuffle($permitted_chars), 0, 32)]);
+        session(['formTokenValue' => substr(str_shuffle($permitted_chars), 0, 32)]);
+    }
+
+    /**
+     * Assigns common template variables.
+     */
+    private function assignTemplateVars(): void
+    {
+        $this->tpl->assign('allProjects', $this->projectService->getAll(true));
+        $this->tpl->assign('roles', Roles::getRoles());
+        $this->tpl->assign('clients', $this->clientService->getAll());
+        $this->tpl->assign('status', $this->userService->getUserStatuses());
+    }
+}

app/Domain/Users/Controllers/Import.php

@@ -0,0 +1,79 @@
+<?php
+
+/* Not production ready yet. Prepping for future version */
+
+namespace Leantime\Domain\Users\Controllers;
+
+use Illuminate\Contracts\Container\BindingResolutionException;
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Auth\Models\Roles;
+use Leantime\Domain\Ldap\Services\Ldap as LdapService;
+use Leantime\Domain\Users\Permissions\UsersPermissions;
+use Leantime\Domain\Users\Services\Users as UserService;
+use Symfony\Component\HttpFoundation\Response;
+
+class Import extends Controller
+{
+    private UserService $userService;
+
+    private LdapService $ldapService;
+
+    public function init(UserService $userService, LdapService $ldapService): void
+    {
+        $this->userService = $userService;
+        $this->ldapService = $ldapService;
+
+        if (! session()->exists('tmp')) {
+            session(['tmp' => []]);
+        }
+    }
+
+    /**
+     * @throws \Exception
+     */
+    #[RequiresPermission(UsersPermissions::IMPORT, global: true)]
+    public function get(): Response
+    {
+        $this->tpl->assign('allUsers', $this->userService->getAll());
+        $this->tpl->assign('admin', true);
+        $this->tpl->assign('roles', Roles::getRoles());
+
+        if (session()->exists('tmp.ldapUsers') && count(session('tmp.ldapUsers')) > 0) {
+            $this->tpl->assign('allLdapUsers', session('tmp.ldapUsers'));
+            $this->tpl->assign('confirmUsers', true);
+        }
+
+        return $this->tpl->displayPartial('users.importLdapDialog');
+    }
+
+    /**
+     * @throws BindingResolutionException
+     */
+    #[RequiresPermission(UsersPermissions::IMPORT, global: true)]
+    public function post($params): Response
+    {
+        // Password Submit to connect to ldap and retrieve users. Sets tmp session var
+        if (isset($params['pwSubmit'])) {
+            $bindUsername = $this->ldapService->extractLdapFromUsername(session('userdata.mail'));
+            $members = $this->userService->fetchLdapMembers($bindUsername, $params['password']);
+
+            if ($members !== false) {
+                session(['tmp.ldapUsers' => $members]);
+                $this->tpl->assign('allLdapUsers', session('tmp.ldapUsers'));
+                $this->tpl->assign('confirmUsers', true);
+            } else {
+                $this->tpl->setNotification($this->language->__('notifications.username_or_password_incorrect'), 'error');
+            }
+        }
+
+        // Import/Update User Post
+        if (isset($params['importSubmit'])) {
+            if (is_array($params['users'])) {
+                $this->userService->importSelectedLdapUsers(session('tmp.ldapUsers'), $params['users']);
+            }
+        }
+
+        return $this->tpl->displayPartial('users.importLdapDialog');
+    }
+}

app/Domain/Users/Controllers/NewUser.php

@@ -0,0 +1,146 @@
+<?php
+
+namespace Leantime\Domain\Users\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Auth\Models\Roles;
+use Leantime\Domain\Auth\Services\Auth;
+use Leantime\Domain\Clients\Services\Clients as ClientService;
+use Leantime\Domain\Projects\Services\Projects as ProjectService;
+use Leantime\Domain\Users\Permissions\UsersPermissions;
+use Leantime\Domain\Users\Services\Users as UserService;
+use Symfony\Component\HttpFoundation\Response;
+
+class NewUser extends Controller
+{
+    private UserService $userService;
+
+    private ProjectService $projectService;
+
+    private ClientService $clientService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(
+        UserService $userService,
+        ProjectService $projectService,
+        ClientService $clientService
+    ): void {
+        $this->userService = $userService;
+        $this->projectService = $projectService;
+        $this->clientService = $clientService;
+    }
+
+    /**
+     * Displays the new user invitation form.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(UsersPermissions::CREATE, global: true)]
+    public function get(array $params): Response
+    {
+        $projectrelation = [];
+        if (isset($params['preSelectProjectId'])) {
+            $preSelected = explode(',', $params['preSelectProjectId']);
+            foreach ($preSelected as $item) {
+                $projectrelation[] = (int) $item;
+            }
+        }
+
+        $this->tpl->assign('values', $this->getDefaultValues());
+        $this->tpl->assign('preSelectedClient', isset($params['preSelectedClient']) ? (int) $params['preSelectedClient'] : '');
+        $this->tpl->assign('relations', $projectrelation);
+        $this->assignTemplateVars();
+
+        return $this->tpl->displayPartial('users.newUser');
+    }
+
+    /**
+     * Handles new user creation / invitation.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(UsersPermissions::CREATE, global: true)]
+    public function post(array $params): Response
+    {
+        $values = $this->getDefaultValues();
+        $projectrelation = [];
+
+        if (isset($_POST['save'])) {
+            $isManager = Auth::userHasRole(Roles::$manager);
+
+            $values = [
+                'firstname' => $_POST['firstname'],
+                'lastname' => $_POST['lastname'],
+                'user' => $_POST['user'],
+                'phone' => $_POST['phone'],
+                'role' => $_POST['role'],
+                'password' => '',
+                'pwReset' => '',
+                'status' => '',
+                'jobTitle' => $_POST['jobTitle'],
+                'jobLevel' => $_POST['jobLevel'],
+                'department' => $_POST['department'],
+                'clientId' => $isManager ? session('userdata.clientId') : $_POST['client'],
+            ];
+
+            if (isset($_POST['projects']) && is_array($_POST['projects'])) {
+                foreach ($_POST['projects'] as $project) {
+                    $projectrelation[] = $project;
+                }
+            }
+
+            $result = $this->userService->inviteNewUser($_POST, session('userdata.clientId'), $isManager);
+
+            if ($result === 'enter_email') {
+                $this->tpl->setNotification($this->language->__('notification.enter_email'), 'error');
+            } elseif ($result === 'no_valid_email') {
+                $this->tpl->setNotification($this->language->__('notification.no_valid_email'), 'error');
+            } elseif ($result === 'user_exists') {
+                $this->tpl->setNotification($this->language->__('notification.user_exists'), 'error');
+            } elseif ($result === 'invite_failed') {
+                $this->tpl->setNotification($this->language->__('notification.invite_failed'), 'error');
+            } else {
+                $this->tpl->setNotification('notification.user_invited_successfully', 'success', 'user_invited');
+            }
+        }
+
+        $this->tpl->assign('values', $values);
+        $this->tpl->assign('preSelectedClient', '');
+        $this->tpl->assign('relations', $projectrelation);
+        $this->assignTemplateVars();
+
+        return $this->tpl->displayPartial('users.newUser');
+    }
+
+    /**
+     * Returns default empty values for the new user form.
+     */
+    private function getDefaultValues(): array
+    {
+        return [
+            'firstname' => '',
+            'lastname' => '',
+            'user' => '',
+            'phone' => '',
+            'role' => '',
+            'password' => '',
+            'clientId' => '',
+            'jobTitle' => '',
+            'jobLevel' => '',
+            'department' => '',
+        ];
+    }
+
+    /**
+     * Assigns common template variables.
+     */
+    private function assignTemplateVars(): void
+    {
+        $this->tpl->assign('clients', $this->clientService->getAll());
+        $this->tpl->assign('allProjects', $this->projectService->getAll());
+        $this->tpl->assign('roles', Roles::getRoles());
+    }
+}

app/Domain/Users/Controllers/PatchUserSettings.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace Leantime\Domain\Users\Controllers;
+
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Auth\Services\Auth;
+use Leantime\Domain\Users\Services\Users as UserService;
+use Symfony\Component\HttpFoundation\Response;
+
+class PatchUserSettings extends Controller
+{
+    private Auth $authService;
+
+    private UserService $userService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(
+        Auth $authService,
+        UserService $userService
+    ): void {
+        $this->authService = $authService;
+        $this->userService = $userService;
+    }
+
+    /**
+     * Handles PATCH requests for user UI settings (e.g. dismissing modals).
+     *
+     * @param  array  $params  Request parameters
+     */
+    public function patch(array $params): Response
+    {
+        if (! $this->authService->isLoggedIn()) {
+            return $this->tpl->displayJson(['status' => 'error', 'message' => 'Not authorized'], 401);
+        }
+
+        // Handle modal dismissal updates
+        if (
+            isset($params['patchModalSettings'], $params['settings'])
+            && $params['patchModalSettings'] == 1
+        ) {
+            $permanent = isset($params['permanent']) && $params['permanent'] == 1;
+            $this->userService->saveModalDismissal($params['settings'], $permanent);
+
+            return $this->tpl->displayJson(['status' => 'success']);
+        }
+
+        return $this->tpl->displayJson(['status' => 'error', 'message' => 'Invalid request'], 400);
+    }
+}

app/Domain/Users/Controllers/ProfileImage.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace Leantime\Domain\Users\Controllers;
+
+use Illuminate\Http\Request;
+use Leantime\Core\Http\Responses\ImageResponse;
+use Leantime\Domain\Users\Services\Users as UserService;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Serves and updates user profile images.
+ *
+ * A native Laravel controller (constructor DI, route-bound actions returning a
+ * Response/Responsable) — no Frontcontroller/legacy base-controller machinery.
+ * Relocated from the retired Api\Controllers\Users. Bound in Users/routes.php at the
+ * canonical /users/profileImage/{id} plus the backward-compatible /api/users alias that
+ * core templates and the plugin submodule still reference.
+ */
+class ProfileImage
+{
+    public function __construct(private UserService $userService) {}
+
+    /**
+     * GET — returns the profile image as a binary/SVG response.
+     *
+     * The id comes from the canonical path segment ({id}) or the legacy ?profileImage=
+     * query param. "me" resolves to the session user; "false"/empty yields the placeholder.
+     */
+    public function show(Request $request, ?string $id = null): ImageResponse
+    {
+        $id = $request->query('profileImage', $id) ?? 'false';
+
+        if ($id === 'me') {
+            $id = session('userdata.id');
+        }
+
+        return new ImageResponse($this->userService->getProfilePicture($id));
+    }
+
+    /**
+     * POST — uploads a new profile photo for the current user.
+     *
+     * The target is always the session user; a client-supplied id is never trusted.
+     */
+    public function upload(): Response
+    {
+        if (! isset($_FILES['file'])) {
+            return response()->json(['error' => 'File not included'], 400);
+        }
+
+        $_FILES['file']['name'] = 'userPicture.png';
+
+        $this->userService->setProfilePicture($_FILES, session('userdata.id'));
+
+        session(['msg' => 'PICTURE_CHANGED']);
+        session(['msgT' => 'success']);
+
+        return response()->json(['status' => 'ok']);
+    }
+}

app/Domain/Users/Controllers/ShowAll.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace Leantime\Domain\Users\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\Auth\Models\Roles;
+use Leantime\Domain\Users\Permissions\UsersPermissions;
+use Leantime\Domain\Users\Services\Users as UserService;
+use Symfony\Component\HttpFoundation\Response;
+
+class ShowAll extends Controller
+{
+    private UserService $userService;
+
+    public function init(UserService $userService): void
+    {
+        $this->userService = $userService;
+    }
+
+    /**
+     * @throws \Exception
+     */
+    #[RequiresPermission(UsersPermissions::VIEW, global: true)]
+    public function get(): Response
+    {
+        $this->tpl->assign('allUsers', $this->userService->getAllVisibleToUser());
+        $this->tpl->assign('admin', true);
+        $this->tpl->assign('roles', Roles::getRoles());
+
+        return $this->tpl->display('users.showAll');
+    }
+
+    public function post($params): Response
+    {
+        return $this->tpl->displayJson(['status' => 'Not Implemented']);
+    }
+}