Team settings in the web UI: escalation, integrations, dead-man switches, members #17

New Issue

2026-09-20T18:19:26Z

niklas commented

2026-09-20 18:19:26 +00:00

Part of #1. Everything a team owner configures is API-only. A team owner has to use curl to set up the features they most need — including escalation, which is the whole point of #6.

This accumulated across #4, #5 and #6: each added server-side configuration and deferred its screen, on the grounds that the screens are one piece of work rather than three. This is that piece.

What exists, and where it can be reached from

Thing	API	UI
Escalation ladder (#6)	`GET`/`PUT /api/teams/{id}/escalation`	✗
Integrations (#4)	`GET`/`POST`/`DELETE /api/teams/{id}/integrations`	✗
Dead-man switches (#4)	`GET`/`PUT /api/teams/{id}/deadman`	✗
Members and roles (#4)	`GET`/`POST`/`DELETE /api/teams/{id}/members`	✗
Team rename/delete (#5)	`PUT`/`DELETE /api/teams/{id}`	admin page only, not per team
Schedule	`POST`/`GET`/`DELETE /api/teams/{id}/schedule`	read-only — the view still says "the TUI edits the schedule", and the TUI is broken against the current API
Incidents, alerts, on-call, account, admin	—	✓

Scope

A team settings screen, reachable from the team badge or a settings link, showing one team at a time and only what the viewer's role allows — an owner edits, a member reads. The server already enforces that: a member editing anything here gets 403, and a non-member gets 404.

Escalation ladder. Ordered levels with a timeout each; targets are "whoever is on call" or a named member, picked from the team's own membership. Add, remove and reorder levels; repeat count; fallback topic. The API replaces the ladder wholesale, so the editor holds a draft and sends the whole thing.
Integrations. List, create, delete. The key is returned exactly once, so the create flow has to show it prominently, offer a copy button, and say plainly that it will not be shown again. Include the ready-to-paste Alertmanager receiver snippet with the URL filled in.
Dead-man switches. Matchers, timeout, severity. The matcher string is fiddly — alertname=Watchdog,cluster=prod; alertname=EdgeHeartbeat — so it needs either a real editor or a very good example next to the field.
Members. List with roles, add from the user list, remove, change role. The last owner cannot be removed (409).
Rename and delete the team, for owners, where the rest of its settings are. Delete is refused while the team has open incidents.
Schedule editing, so the rota can be set without the TUI.

Also missing, from #6

The incident view should show where an incident is in its ladder — current level, and when the next escalation is due. Right now the only way to see it is the timeline after the fact, or the database. This was in #6's scope and was deferred with the rest of the UI.

Notes

Overlaps with #7. Its onboarding checklist wants "create an integration and copy its URL" and in-app Alertmanager instructions, which is the integrations screen above. Whichever is built first should build that screen properly and let the other link to it, rather than each growing its own half.
Only the queue and on-call views know about teams today (badge, filter, one card per team). Everything else in the UI is still team-agnostic because it did not need to be otherwise.
The admin page already lists every team with its size and open-incident count; this is the per-team counterpart an owner can reach without being an administrator.

Done when

A team owner can set up escalation, an integration, dead-man switches and the rota from the browser, without a terminal — and a member can see all of it without being able to change it.

Part of #1. Everything a team owner configures is API-only. A team owner has to use `curl` to set up the features they most need — including escalation, which is the whole point of #6. This accumulated across #4, #5 and #6: each added server-side configuration and deferred its screen, on the grounds that the screens are one piece of work rather than three. This is that piece. ### What exists, and where it can be reached from | Thing | API | UI | |---|---|---| | Escalation ladder (#6) | `GET`/`PUT /api/teams/{id}/escalation` | ✗ | | Integrations (#4) | `GET`/`POST`/`DELETE /api/teams/{id}/integrations` | ✗ | | Dead-man switches (#4) | `GET`/`PUT /api/teams/{id}/deadman` | ✗ | | Members and roles (#4) | `GET`/`POST`/`DELETE /api/teams/{id}/members` | ✗ | | Team rename/delete (#5) | `PUT`/`DELETE /api/teams/{id}` | admin page only, not per team | | Schedule | `POST`/`GET`/`DELETE /api/teams/{id}/schedule` | **read-only** — the view still says "the TUI edits the schedule", and the TUI is broken against the current API | | Incidents, alerts, on-call, account, admin | — | ✓ | ### Scope A **team settings** screen, reachable from the team badge or a settings link, showing one team at a time and only what the viewer's role allows — an owner edits, a member reads. The server already enforces that: a member editing anything here gets `403`, and a non-member gets `404`. - [ ] **Escalation ladder.** Ordered levels with a timeout each; targets are "whoever is on call" or a named member, picked from the team's own membership. Add, remove and reorder levels; repeat count; fallback topic. The API replaces the ladder wholesale, so the editor holds a draft and sends the whole thing. - [ ] **Integrations.** List, create, delete. **The key is returned exactly once**, so the create flow has to show it prominently, offer a copy button, and say plainly that it will not be shown again. Include the ready-to-paste Alertmanager receiver snippet with the URL filled in. - [ ] **Dead-man switches.** Matchers, timeout, severity. The matcher string is fiddly — `alertname=Watchdog,cluster=prod; alertname=EdgeHeartbeat` — so it needs either a real editor or a very good example next to the field. - [ ] **Members.** List with roles, add from the user list, remove, change role. The last owner cannot be removed (`409`). - [ ] **Rename and delete the team**, for owners, where the rest of its settings are. Delete is refused while the team has open incidents. - [ ] **Schedule editing**, so the rota can be set without the TUI. ### Also missing, from #6 - [ ] **The incident view should show where an incident is in its ladder** — current level, and when the next escalation is due. Right now the only way to see it is the timeline after the fact, or the database. This was in #6's scope and was deferred with the rest of the UI. ### Notes - **Overlaps with #7.** Its onboarding checklist wants "create an integration and copy its URL" and in-app Alertmanager instructions, which is the integrations screen above. Whichever is built first should build that screen properly and let the other link to it, rather than each growing its own half. - **Only the queue and on-call views know about teams today** (badge, filter, one card per team). Everything else in the UI is still team-agnostic because it did not need to be otherwise. - The admin page already lists every team with its size and open-incident count; this is the per-team counterpart an owner can reach without being an administrator. ### Done when A team owner can set up escalation, an integration, dead-man switches and the rota from the browser, without a terminal — and a member can see all of it without being able to change it.

niklas added the teams notifications ui labels 2026-09-20 18:19:30 +00:00

niklas referenced this issue

2026-09-20 18:19:49 +00:00

Epic: teams, escalation chains, self-service onboarding and an admin page #1

niklas referenced this issue from a commit

2026-09-20 18:50:33 +00:00

terdut-server: 0.13.0 — escalation, an admin page, and the end of the open webhook

niklas referenced this issue from a commit

2026-09-20 19:22:25 +00:00

Put a team's own settings in the web UI

niklas referenced a pull request that will close this issue

2026-09-20 19:22:42 +00:00