Sign in as a user instead of with an API key

The web UI signs in with a username and password and holds a session
cookie; the TUI was the only client still needing an API key pasted into
a config file. It now asks for the same credentials on a form at start.

What is kept between runs is the session token, not the password, in
session.json under the config directory, mode 0600 and keyed by server
URL so one server's token is never offered to another. It resumes on the
next start; the server's sessions last 30 days and slide with use. L
signs out, which ends the session on the server and deletes the saved
one even if the server cannot be reached.

The client attaches the cookie by hand instead of using a cookie jar:
the server marks it Secure behind https, and a jar drops a Secure cookie
it is given over plain http, which would break a local server for no
reason. It sends no Authorization header at all, since the server judges
a request carrying one on that alone and never falls back to the cookie.
Writes go through the server's cross-origin guard, which lets a client
that sends neither Origin nor Sec-Fetch-Site through; checked against a
real v0.20.1 server for both reads and writes.

A 401 from anything means the session is gone (expired, ended from the
web UI, or the account disabled), so the TUI returns to the form with the
reason, forgets the saved token, and drops what the last session loaded
rather than showing it to whoever signs in next. A 403 is a permission
and leaves the session alone. The refresh timer is started once, so
signing out and in does not leave two running.

An account with no password cannot sign in, and the server answers it
exactly like a wrong password, so the form's message says a password
must be set first. Users created only for API access hit this.

Breaking: api_key in config.yaml is no longer used. It is not an error
to leave it there; the form says it is ignored. API keys still exist on
the server and k in Users still manages them.

.gitea/workflows/release.yaml

@@ -126,6 +126,28 @@ jobs:
           [ -n "$release_id" ] || { echo "::error::could not determine release id"; exit 1; }
           echo "release id $release_id"
 
+          # The release notes are the tag's own message, minus its subject line: the
+          # tag body is the changelog for this project, and without this the release
+          # page stays empty. Only an annotated tag has one, and only a release with
+          # no notes is filled, so a re-run repairs a release created empty without
+          # overwriting notes somebody has since edited by hand.
+          #
+          # There is no jq in this image, so the JSON string is escaped by hand:
+          # backslashes first (or the ones added next would double), then quotes and
+          # tabs, then each line end becomes a literal \n.
+          if [ "$(git cat-file -t "$REF_NAME")" = tag ] \
+             && printf '%s' "$body" | grep -q '"body":""'; then
+            notes=$(git tag -l --format='%(contents)' "$REF_NAME" | sed '1,2d')
+            if [ -n "$notes" ]; then
+              notes_json=$(printf '%s\n' "$notes" \
+                | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t/g' -e 's/\r$//' \
+                | awk 'BEGIN { ORS = "\\n" } { print }')
+              echo "setting release notes from the tag message"
+              curl -sf -X PATCH -H "$auth" -H 'Content-Type: application/json' \
+                -d "{\"body\":\"$notes_json\"}" "$API/releases/$release_id" > /dev/null
+            fi
+          fi
+
           for f in dist/*; do
             name=$(basename "$f")
             # Drop an existing asset of the same name first: Gitea happily stores two

CLAUDE.md

@@ -1,6 +1,6 @@
 # terdut-tui
 
-TUI client for [terdut-server](https://git.ryuvia.com/niklas/terdut-server), a Prometheus Alertmanager receiver and incident manager. Requires server **v0.4.0+**.
+TUI client for [terdut-server](https://git.ryuvia.com/niklas/terdut-server), a Prometheus Alertmanager receiver and incident manager. Requires server **v0.20.0+** (team-scoped API).
 
 ## Domain model
 
@@ -11,6 +11,14 @@ The server splits alerts from incidents, and this client mirrors it:
   assignee, snooze, notes and an append-only timeline. Many alerts to one incident,
   correlated by Alertmanager's `groupKey`.
 
+The server is multi-team: incidents, alerts and the schedule belong to a team, and
+the caller only sees their own teams. `Model.activeTeamID` (0 = all) narrows the
+incident and alert lists via `team_id`; the schedule is per team and uses
+`Model.scheduleTeam()`. Users have `is_admin`, and the TUI mirrors the server's
+permission rules up front (`canEditSchedule`, `canManageUser`, `isAdmin`) so a 403 is
+explained before the round trip, not after. The server has no version endpoint;
+an old one is recognised by `GET /api/teams` answering 404 (`errServerTooOld`).
+
 All user actions target incidents. Two server behaviours the UI has to respect:
 manual resolve is **terminal** (hence the confirmation prompt), and snooze is the
 non-destructive "not now" alternative.
@@ -25,7 +33,7 @@ non-destructive "not now" alternative.
 ## Project layout
 
 ```
-main.go                      CLI entry point: flags, config load, health check, start TUI
+main.go                      CLI entry point: flags, config load, start TUI
 internal/api/client.go       REST API client — one method per endpoint
 internal/config/config.go    Config loader (~/.config/terdut-tui/config.yaml)
 internal/theme/              Colour themes: semantic tokens, built-ins, user file loader
@@ -35,7 +43,7 @@ internal/tui/                Bubbletea UI
   view.go                    View() — pure rendering
   keys.go                    keyMap (bubbles/key pattern)
   styles.go                  Styles struct — every lipgloss style, built from a theme
-internal/updater/updater.go  Self-update via GitHub Releases
+internal/updater/updater.go  Self-update via Gitea releases
 ```
 
 ## Architecture rules
@@ -54,16 +62,24 @@ Location: `~/.config/terdut-tui/config.yaml`
 
 ```yaml
 server_url: https://terdut.example.com
-api_key: <64-char hex key>
+username: niklas      # optional, prefills the sign-in form
 refresh_interval: 30  # seconds, optional, default 30
 theme: gruvbox-dark   # optional, default gruvbox-dark
+team: Ops             # optional, team name or id to start on, default all
 ```
 
 Built-in themes are `gruvbox-dark` and `gruvbox-light`; user themes are YAML
 files in `~/.config/terdut-tui/themes/`, optionally `extends:`-ing a built-in.
 See the README for the token list.
 
-The API key is a one-time secret generated by terdut-server (`POST /api/users/{id}/api-keys`).
+There is no API key in the config. The TUI signs in as a user (`POST /api/login`, the
+same session cookie as the web UI) and `internal/session` keeps the token in
+`~/.config/terdut-tui/session.json`, mode 0600, keyed by server URL. The client
+attaches `terdut_session` itself rather than using a cookie jar, because a jar drops the
+server's Secure cookie over plain http. It must never send `Authorization` as well: the
+server judges a request with that header on it alone. A 401 from anything (`msgError`
+in `update.go`) returns to the sign-in form and clears `Model`. A user with no password
+cannot sign in, and the server answers it like a wrong one, so the form says so.
 
 ## Running
 
@@ -95,6 +111,8 @@ go build -ldflags="-X main.version=v0.1.0" -o terdut-tui .
 | 4 | On-call schedule calendar view |
 | 5 | User management and API key lifecycle |
 | 6 | Incidents: queue, timeline, ack/assign/snooze/resolve, MTTA/MTTR |
+| 7 | Teams: `T` switcher, per-team schedule, admin/disabled markers (server v0.20) |
+| 8 | Sign in as a user instead of an API key (server v0.10+ session cookie) |
 
 <!-- graymatter:instructions:begin — managed by `graymatter init`; edits inside this block are overwritten -->
 ## Memory (GrayMatter)

README.md

@@ -10,12 +10,33 @@ Written in Go using [Bubbletea](https://github.com/charmbracelet/bubbletea).
 - **Incident actions** — acknowledge, assign, snooze, note, resolve and archive
 - **Timeline** — the full history of an incident, system events, pages and notes together
 - **Alert feed** — the raw read-only alerts underneath, each linked to its incident
-- **On-call schedule** — visual calendar of who is on duty, assign and remove entries
+- **Teams** — switch between your teams, or see all of them at once
+- **On-call schedule** — visual calendar of who is on duty in a team, assign and remove entries
 - **Statistics** — MTTA and MTTR, plus alert frequency by name, hour and day
 - **User management** — add and remove users, manage API keys, set each user's ntfy topic
 
-> Requires terdut-server **v0.4.0 or later**. Earlier servers have no incidents API;
-> use terdut-tui v0.3.x with those.
+> Requires terdut-server **v0.20.0 or later**. The server became team-scoped in
+> v0.12 and this client follows it; earlier servers answer 404 for `/api/teams`
+> and the TUI says so on start. Use terdut-tui v0.9.x with servers before v0.12.
+> Escalation ladders, invites, integrations and the admin settings stay in the
+> server's web UI.
+
+## Teams
+
+Everything the server returns is scoped to the teams your key's user belongs
+to. The header shows which are on screen, and `T` steps through *all* → each of
+your teams in turn. With several teams showing, incident and alert rows carry a
+Team column.
+
+The schedule is one team's rota, so the Schedule section shows the active team,
+or with *all* showing the first team you own. Only a team's owners, and
+administrators, can change its rota; anyone else gets the reason in the status
+bar instead of a picker. The picker offers only that team's members, because the
+server refuses anybody else. Stats are not team-scoped by the server and always
+cover all your teams.
+
+Administrators are the only users who can create or delete users, or act on
+someone else's password, topic or API keys. Everyone can manage their own.
 
 ## Alerts and incidents
 
@@ -49,9 +70,6 @@ Every delivery lands on the incident's timeline: `Notified <user> (triggered)`
 when ntfy accepted the page, and `Notification to <user> failed` when it ran out
 of retries. That second one is the one to look for when nobody's phone rang.
 
-Editing topics needs terdut-server **v0.6.0 or later**; the timeline entries need
-**v0.7.0 or later**. Against an older server the topic column stays empty and
-editing one reports the server's 404.
 
 ## Installation
 
@@ -67,12 +85,31 @@ Create `~/.config/terdut-tui/config.yaml`:
 
 ```yaml
 server_url: https://terdut.example.com
-api_key: <your-api-key>
+username: niklas      # optional, prefills the sign-in form
 refresh_interval: 30  # seconds, optional
 theme: gruvbox-dark   # optional, this is the default
+team: Ops             # optional, a team name or id to start on; default is all
 ```
 
-The API key is generated in terdut-server. See the server documentation for how to bootstrap a user and issue an API key.
+## Signing in
+
+The TUI signs in the way the web UI does: with a user account's username and
+password, on a form shown at start. It keeps the server's session, not the
+password, in `~/.config/terdut-tui/session.json` (readable by you only), so the
+next start resumes it. The server's sessions last 30 days and slide with use.
+When it has ended, or the account is disabled or the session is ended from the web
+UI, the TUI returns to the form and says so. `L` signs out, which also ends the
+session on the server and deletes the saved one.
+
+The account needs a password, since that is what signing in uses. A user
+created only for API access has none and cannot sign in: the server answers it
+exactly like a wrong password. Set one in the web UI, or have an administrator
+press `p` on that user in Users. Too many failed attempts are rate limited by
+the server for a few minutes.
+
+> **Upgrading from v0.10.0 and earlier:** `api_key` in `config.yaml` is no longer
+> used. Remove it and sign in. API keys still exist on the server, and `k` in
+> Users still manages them, for whatever else uses them.
 
 ## Themes
 
@@ -133,6 +170,8 @@ Global:
 | `esc` | Go back |
 | `r` | Refresh |
 | `f` | Cycle filter |
+| `L` | Sign out |
+| `T` | Switch team: all → each of your teams (when you have more than one) |
 | `q` | Quit |
 
 The sections, in `tab` order: Incidents · Alerts · Stats · Archived · Schedule · Users.
@@ -181,9 +220,8 @@ Schedule section:
 One person holds a given day. Assigning over days somebody else already has
 asks first — naming them and how many days are being taken — and moves the whole
 selection at once when you accept, so reassigning a week is one confirmation
-rather than seven deletions. Taking somebody's shift needs terdut-server
-**v0.8.0 or later**; against an older server the assignment is refused with
-`date already assigned`.
+rather than seven deletions. The header line names the team whose rota this is,
+and "On-call today" lists everyone on call across your teams.
 
 Users section:
 
@@ -193,3 +231,9 @@ Users section:
 | `t` | Edit the user's ntfy topic — submit empty to clear it |
 | `d` | Delete a user |
 | `k` | API keys for the selected user |
+| `p` | Set the selected user's web UI password — asks for the current one when it is your own |
+
+In Users, `k` and `d` act on the selected row, so move with `↑`/`↓` there rather
+than `k`. The Flags column marks administrators and disabled accounts. `n` and `d`
+are for administrators; `t`, `k` and `p` work on your own row, or on anyone's if you
+are one.

internal/api/client.go

@@ -3,6 +3,7 @@ package api
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -11,32 +12,130 @@ import (
 	"time"
 )
 
+// SessionCookie is the cookie terdut-server's web UI signs in with.
+const SessionCookie = "terdut_session"
+
+// Client talks to terdut-server as the user who signed in. Login trades a
+// username and password for a session, the same one the web UI holds, and every
+// request after it carries that session's cookie.
+//
+// The cookie is attached by hand rather than through a cookie jar: the server
+// marks it Secure behind https, and a jar drops a Secure cookie it is handed
+// over plain http, which would make a local server unusable for no reason. There
+// is nothing else a jar would do here — the token is opaque and does not change
+// while the session lives.
 type Client struct {
 	baseURL    string
 	httpClient *http.Client
-	apiKey     string
+	session    string
 }
 
-func NewClient(baseURL, apiKey string) *Client {
+func NewClient(baseURL string) *Client {
 	return &Client{
 		baseURL: strings.TrimRight(baseURL, "/"),
-		apiKey:  apiKey,
 		httpClient: &http.Client{
 			Timeout: 10 * time.Second,
 		},
 	}
 }
 
+// SetSession resumes a session from a token saved earlier.
+func (c *Client) SetSession(token string) { c.session = token }
+
+// HasSession reports whether there is a session to try. It says nothing about
+// whether the server still honours it.
+func (c *Client) HasSession() bool { return c.session != "" }
+
+// Login signs in and returns the session token, which the client also keeps and
+// sends from then on. The server answers a wrong password, an unknown user and
+// an account with no password all with the same 401, so the caller cannot tell
+// them apart. Too many failures come back as 429.
+func (c *Client) Login(username, password string) (string, error) {
+	body := struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	}{Username: username, Password: password}
+	req, err := c.newRequestWithBody(http.MethodPost, "/api/login", body)
+	if err != nil {
+		return "", err
+	}
+	// A stale session must not ride along on the request that replaces it.
+	req.Header.Del("Cookie")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return "", statusError(resp)
+	}
+	for _, ck := range resp.Cookies() {
+		if ck.Name == SessionCookie && ck.Value != "" {
+			c.session = ck.Value
+			return ck.Value, nil
+		}
+	}
+	return "", fmt.Errorf("server signed us in but sent no %s cookie", SessionCookie)
+}
+
+// Logout ends the session on the server and forgets it here.
+func (c *Client) Logout() error {
+	req, err := c.newRequest(http.MethodPost, "/api/logout")
+	if err != nil {
+		return err
+	}
+	err = c.do(req, nil)
+	c.session = ""
+	return err
+}
+
+// authorize puts the session on a request.
+func (c *Client) authorize(req *http.Request) {
+	req.Header.Set("Accept", "application/json")
+	if c.session != "" {
+		req.AddCookie(&http.Cookie{Name: SessionCookie, Value: c.session})
+	}
+}
+
 func (c *Client) newRequest(method, path string) (*http.Request, error) {
 	req, err := http.NewRequest(method, c.baseURL+path, nil)
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Authorization", "Bearer "+c.apiKey)
-	req.Header.Set("Accept", "application/json")
+	c.authorize(req)
 	return req, nil
 }
 
+// StatusError is a response the server answered with a 4xx or 5xx. Message is
+// the server's own {"error": ...} text, empty when the body carried none.
+type StatusError struct {
+	Code    int
+	Message string
+}
+
+func (e *StatusError) Error() string {
+	if e.Message != "" {
+		return fmt.Sprintf("server returned %d: %s", e.Code, e.Message)
+	}
+	return fmt.Sprintf("server returned %d", e.Code)
+}
+
+// IsUnauthorized reports whether err is the server refusing the session: it
+// expired, was ended elsewhere, or belongs to an account since disabled.
+func IsUnauthorized(err error) bool {
+	var se *StatusError
+	return errors.As(err, &se) && se.Code == http.StatusUnauthorized
+}
+
+func statusError(resp *http.Response) error {
+	var e struct {
+		Error string `json:"error"`
+	}
+	_ = json.NewDecoder(resp.Body).Decode(&e)
+	return &StatusError{Code: resp.StatusCode, Message: e.Error}
+}
+
 func (c *Client) do(req *http.Request, out any) error {
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
@@ -45,14 +144,7 @@ func (c *Client) do(req *http.Request, out any) error {
 	defer resp.Body.Close()
 
 	if resp.StatusCode >= 400 {
-		var e struct {
-			Error string `json:"error"`
-		}
-		_ = json.NewDecoder(resp.Body).Decode(&e)
-		if e.Error != "" {
-			return fmt.Errorf("server returned %d: %s", resp.StatusCode, e.Error)
-		}
-		return fmt.Errorf("server returned %d", resp.StatusCode)
+		return statusError(resp)
 	}
 
 	if out != nil {
@@ -61,14 +153,18 @@ func (c *Client) do(req *http.Request, out any) error {
 	return nil
 }
 
-// ListAlerts fetches alerts. status may be "firing", "resolved", or "" for all.
+// ListAlerts fetches alerts. teamID limits them to one team; 0 means every team
+// the caller belongs to. status may be "firing", "resolved", or "" for all.
 // Set archived=true to fetch only archived alerts; false returns only non-archived.
 //
 // Alerts are read-only on the server — there is nothing to acknowledge or
 // archive here. This is the raw feed, useful for checking what Alertmanager is
 // actually sending; the work queue is ListIncidents.
-func (c *Client) ListAlerts(status string, archived bool, limit int) ([]Alert, error) {
+func (c *Client) ListAlerts(teamID int64, status string, archived bool, limit int) ([]Alert, error) {
 	q := url.Values{}
+	if teamID > 0 {
+		q.Set("team_id", strconv.FormatInt(teamID, 10))
+	}
 	if status != "" {
 		q.Set("status", status)
 	}
@@ -110,8 +206,7 @@ func (c *Client) newRequestWithBody(method, path string, body any) (*http.Reques
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Authorization", "Bearer "+c.apiKey)
-	req.Header.Set("Accept", "application/json")
+	c.authorize(req)
 	req.Header.Set("Content-Type", "application/json")
 	return req, nil
 }
@@ -127,12 +222,16 @@ func (c *Client) GetAlert(id int64) (*Alert, error) {
 
 // ── Incidents ──────────────────────────────────────────────────────────────
 
-// ListIncidents fetches the work queue. status may be "triggered",
+// ListIncidents fetches the work queue. teamID limits it to one team; 0 means
+// every team the caller belongs to. status may be "triggered",
 // "acknowledged", "resolved", or "" for the server default of open incidents
 // only. archived and snoozed each switch the list to that set rather than
 // adding to it, matching the server's filters.
-func (c *Client) ListIncidents(status string, archived, snoozed bool, limit int) ([]Incident, error) {
+func (c *Client) ListIncidents(teamID int64, status string, archived, snoozed bool, limit int) ([]Incident, error) {
 	q := url.Values{}
+	if teamID > 0 {
+		q.Set("team_id", strconv.FormatInt(teamID, 10))
+	}
 	if status != "" {
 		q.Set("status", status)
 	}
@@ -318,8 +417,37 @@ func (c *Client) GetStatsByDay() ([]DayStat, error) {
 	return result, c.do(req, &result)
 }
 
-func (c *Client) GetSchedule(from, to string) ([]ScheduleEntry, error) {
-	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/schedule?from=%s&to=%s", from, to))
+// ── Teams ──────────────────────────────────────────────────────────────────
+
+// ListTeams returns the teams the caller belongs to, with the caller's role in
+// each. Everything else the server returns is scoped to these. A server that
+// predates teams (v0.12) answers 404, which is how the TUI spots one.
+func (c *Client) ListTeams() ([]Team, error) {
+	req, err := c.newRequest(http.MethodGet, "/api/teams")
+	if err != nil {
+		return nil, err
+	}
+	var teams []Team
+	return teams, c.do(req, &teams)
+}
+
+// ListTeamMembers returns who belongs to a team. A schedule can only be given to
+// its own members, so this is the assignee list for one.
+func (c *Client) ListTeamMembers(teamID int64) ([]TeamMember, error) {
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/teams/%d/members", teamID))
+	if err != nil {
+		return nil, err
+	}
+	var members []TeamMember
+	return members, c.do(req, &members)
+}
+
+// ── Schedule ───────────────────────────────────────────────────────────────
+
+// GetSchedule returns a team's on-call entries between two YYYY-MM-DD dates.
+func (c *Client) GetSchedule(teamID int64, from, to string) ([]ScheduleEntry, error) {
+	q := url.Values{"from": {from}, "to": {to}}
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/teams/%d/schedule?%s", teamID, q.Encode()))
 	if err != nil {
 		return nil, err
 	}
@@ -327,49 +455,30 @@ func (c *Client) GetSchedule(from, to string) ([]ScheduleEntry, error) {
 	return entries, c.do(req, &entries)
 }
 
-// GetCurrentOnCall returns today's on-call entry, or nil if nobody is scheduled.
-func (c *Client) GetCurrentOnCall() (*ScheduleEntry, error) {
+// GetCurrentOnCall returns today's on-call entries, one per team that has
+// somebody scheduled. It is empty, not an error, when nobody is.
+func (c *Client) GetCurrentOnCall() ([]ScheduleEntry, error) {
 	req, err := c.newRequest(http.MethodGet, "/api/schedule/current")
 	if err != nil {
 		return nil, err
 	}
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode == http.StatusNotFound {
-		return nil, nil
-	}
-	if resp.StatusCode >= 400 {
-		var e struct {
-			Error string `json:"error"`
-		}
-		_ = json.NewDecoder(resp.Body).Decode(&e)
-		if e.Error != "" {
-			return nil, fmt.Errorf("server returned %d: %s", resp.StatusCode, e.Error)
-		}
-		return nil, fmt.Errorf("server returned %d", resp.StatusCode)
-	}
-	var entry ScheduleEntry
-	if err := json.NewDecoder(resp.Body).Decode(&entry); err != nil {
-		return nil, err
-	}
-	return &entry, nil
+	var entries []ScheduleEntry
+	return entries, c.do(req, &entries)
 }
 
-// AssignSchedule puts one user on call for the given dates.
+// AssignSchedule puts one team member on call for the given dates. Only a team
+// owner or an administrator may.
 //
 // The server holds one person per day and refuses a date somebody already has,
 // so replace is what takes a shift off its current holder. It is all-or-nothing
 // either way: a week of free and taken days moves as a unit, or not at all.
-func (c *Client) AssignSchedule(userID int64, dates []string, replace bool) ([]ScheduleEntry, error) {
+func (c *Client) AssignSchedule(teamID, userID int64, dates []string, replace bool) ([]ScheduleEntry, error) {
 	body := struct {
 		UserID  int64    `json:"user_id"`
 		Dates   []string `json:"dates"`
 		Replace bool     `json:"replace,omitempty"`
 	}{UserID: userID, Dates: dates, Replace: replace}
-	req, err := c.newRequestWithBody(http.MethodPost, "/api/schedule", body)
+	req, err := c.newRequestWithBody(http.MethodPost, fmt.Sprintf("/api/teams/%d/schedule", teamID), body)
 	if err != nil {
 		return nil, err
 	}
@@ -377,14 +486,16 @@ func (c *Client) AssignSchedule(userID int64, dates []string, replace bool) ([]S
 	return entries, c.do(req, &entries)
 }
 
-func (c *Client) DeleteScheduleEntry(id int64) error {
-	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/schedule/%d", id))
+func (c *Client) DeleteScheduleEntry(teamID, id int64) error {
+	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/teams/%d/schedule/%d", teamID, id))
 	if err != nil {
 		return err
 	}
 	return c.do(req, nil)
 }
 
+// ── Users ──────────────────────────────────────────────────────────────────
+
 func (c *Client) ListUsers() ([]User, error) {
 	req, err := c.newRequest(http.MethodGet, "/api/users")
 	if err != nil {
@@ -452,7 +563,33 @@ func (c *Client) DeleteAPIKey(userID, keyID int64) error {
 	return c.do(req, nil)
 }
 
-// HealthCheck calls GET /healthz (unauthenticated path, no auth needed but we send it anyway).
+// Me returns the user the API key belongs to, and whether they have a web UI
+// password.
+func (c *Client) Me() (*Me, error) {
+	req, err := c.newRequest(http.MethodGet, "/api/me")
+	if err != nil {
+		return nil, err
+	}
+	var me Me
+	return &me, c.do(req, &me)
+}
+
+// SetPassword sets a user's web UI password. current is only checked by the
+// server when a user changes their own existing password; pass "" otherwise.
+func (c *Client) SetPassword(userID int64, password, current string) error {
+	body := struct {
+		Password        string `json:"password"`
+		CurrentPassword string `json:"current_password,omitempty"`
+	}{Password: password, CurrentPassword: current}
+	req, err := c.newRequestWithBody(http.MethodPut, fmt.Sprintf("/api/users/%d/password", userID), body)
+	if err != nil {
+		return err
+	}
+	return c.do(req, nil)
+}
+
+// HealthCheck calls GET /healthz, which is unauthenticated and does no database
+// check, so it says the process is up, not that the API key works.
 func (c *Client) HealthCheck() error {
 	req, err := http.NewRequest(http.MethodGet, c.baseURL+"/healthz", nil)
 	if err != nil {

internal/api/client_test.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"encoding/json"
+	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -18,7 +19,9 @@ type call struct {
 	path   string
 	query  string
 	body   string
-	auth   string
+	cookie string
+	// authz is the Authorization header, which the client no longer sends at all.
+	authz string
 }
 
 // stub serves one canned response and records the request that fetched it.
@@ -28,22 +31,107 @@ func stub(t *testing.T, status int, response string) (*Client, *call) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		body, _ := io.ReadAll(r.Body)
 		got.method, got.path, got.query = r.Method, r.URL.Path, r.URL.RawQuery
-		got.body, got.auth = string(body), r.Header.Get("Authorization")
+		got.body, got.authz = string(body), r.Header.Get("Authorization")
+		if ck, err := r.Cookie(SessionCookie); err == nil {
+			got.cookie = ck.Value
+		}
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(status)
 		io.WriteString(w, response)
 	}))
 	t.Cleanup(srv.Close)
-	return NewClient(srv.URL, "test-key"), got
+	c := NewClient(srv.URL)
+	c.SetSession("test-session")
+	return c, got
 }
 
-func TestClient_SendsBearerToken(t *testing.T) {
+func TestClient_SendsTheSessionCookie(t *testing.T) {
 	c, got := stub(t, http.StatusOK, `[]`)
-	if _, err := c.ListIncidents("", false, false, 0); err != nil {
+	if _, err := c.ListIncidents(0, "", false, false, 0); err != nil {
 		t.Fatalf("list: %v", err)
 	}
-	if got.auth != "Bearer test-key" {
-		t.Errorf("expected bearer token, got %q", got.auth)
+	if got.cookie != "test-session" {
+		t.Errorf("expected the session cookie, got %q", got.cookie)
+	}
+	// The server judges a request with an Authorization header on that alone and
+	// never falls back to the cookie, so sending one would defeat the session.
+	if got.authz != "" {
+		t.Errorf("expected no Authorization header, got %q", got.authz)
+	}
+}
+
+// Login has to work over plain http, where a cookie jar would discard the
+// Secure cookie a server behind https sets.
+func TestLogin_KeepsTheSessionFromTheCookie(t *testing.T) {
+	var body string
+	var sentCookie bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, _ := io.ReadAll(r.Body)
+		body = string(b)
+		_, err := r.Cookie(SessionCookie)
+		sentCookie = err == nil
+		http.SetCookie(w, &http.Cookie{Name: SessionCookie, Value: "fresh", Path: "/", HttpOnly: true, Secure: true})
+		w.WriteHeader(http.StatusOK)
+		io.WriteString(w, `{"user":{"id":1},"has_password":true}`)
+	}))
+	t.Cleanup(srv.Close)
+
+	c := NewClient(srv.URL)
+	c.SetSession("stale")
+	token, err := c.Login("niklas", "correct horse")
+	if err != nil {
+		t.Fatalf("login: %v", err)
+	}
+	if token != "fresh" || !c.HasSession() {
+		t.Errorf("expected the new token to be kept, got %q", token)
+	}
+	if body != `{"username":"niklas","password":"correct horse"}` {
+		t.Errorf("unexpected body %q", body)
+	}
+	if sentCookie {
+		t.Error("a stale session must not ride along on the login that replaces it")
+	}
+}
+
+func TestLogin_RefusalCarriesTheServersWords(t *testing.T) {
+	c, _ := stub(t, http.StatusUnauthorized, `{"error":"invalid username or password"}`)
+	_, err := c.Login("niklas", "wrong")
+	if !IsUnauthorized(err) || !strings.Contains(err.Error(), "invalid username or password") {
+		t.Errorf("expected the server's 401 message, got %v", err)
+	}
+
+	c, _ = stub(t, http.StatusTooManyRequests, `{"error":"too many attempts"}`)
+	if _, err := c.Login("niklas", "wrong"); err == nil || IsUnauthorized(err) {
+		t.Errorf("a rate limit is not an authentication failure, got %v", err)
+	}
+}
+
+func TestLogin_NoCookieIsAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{}`)
+	if _, err := c.Login("niklas", "pw"); err == nil {
+		t.Error("a 200 without a session cookie is not a sign-in")
+	}
+}
+
+func TestLogout_ForgetsTheSession(t *testing.T) {
+	c, got := stub(t, http.StatusNoContent, ``)
+	if err := c.Logout(); err != nil {
+		t.Fatalf("logout: %v", err)
+	}
+	if got.method != "POST" || got.path != "/api/logout" || got.cookie != "test-session" {
+		t.Errorf("unexpected request %s %s cookie=%q", got.method, got.path, got.cookie)
+	}
+	if c.HasSession() {
+		t.Error("the session should be gone locally")
+	}
+}
+
+func TestIsUnauthorized(t *testing.T) {
+	if !IsUnauthorized(&StatusError{Code: 401}) {
+		t.Error("a 401 is unauthorized")
+	}
+	if IsUnauthorized(&StatusError{Code: 403}) || IsUnauthorized(errors.New("x")) || IsUnauthorized(nil) {
+		t.Error("only a 401 means the session is refused; a 403 is a permission")
 	}
 }
 
@@ -107,23 +195,26 @@ func TestClient_IncidentEndpoints(t *testing.T) {
 func TestListIncidents_Filters(t *testing.T) {
 	tests := []struct {
 		name     string
+		teamID   int64
 		status   string
 		archived bool
 		snoozed  bool
 		limit    int
 		want     string
 	}{
-		{"default is the open queue", "", false, false, 0, ""},
-		{"status", "triggered", false, false, 0, "status=triggered"},
-		{"archived", "resolved", true, false, 0, "archived=true&status=resolved"},
-		{"snoozed", "", false, true, 0, "snoozed=true"},
-		{"limit", "", false, false, 500, "limit=500"},
+		{"default is the open queue", 0, "", false, false, 0, ""},
+		{"status", 0, "triggered", false, false, 0, "status=triggered"},
+		{"archived", 0, "resolved", true, false, 0, "archived=true&status=resolved"},
+		{"snoozed", 0, "", false, true, 0, "snoozed=true"},
+		{"limit", 0, "", false, false, 500, "limit=500"},
+		{"one team", 4, "", false, false, 0, "team_id=4"},
+		{"no team means all of them", 0, "triggered", false, false, 0, "status=triggered"},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			c, got := stub(t, http.StatusOK, `[]`)
-			if _, err := c.ListIncidents(tt.status, tt.archived, tt.snoozed, tt.limit); err != nil {
+			if _, err := c.ListIncidents(tt.teamID, tt.status, tt.archived, tt.snoozed, tt.limit); err != nil {
 				t.Fatalf("list: %v", err)
 			}
 			if got.query != tt.want {
@@ -170,9 +261,12 @@ func TestClient_RequestBodies(t *testing.T) {
 	// wire when asked for — and stay off it when not.
 	t.Run("assign schedule", func(t *testing.T) {
 		c, got := stub(t, http.StatusCreated, `[]`)
-		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, false); err != nil {
+		if _, err := c.AssignSchedule(9, 3, []string{"2026-07-27"}, false); err != nil {
 			t.Fatalf("assign: %v", err)
 		}
+		if got.method != "POST" || got.path != "/api/teams/9/schedule" {
+			t.Errorf("expected POST /api/teams/9/schedule, got %s %s", got.method, got.path)
+		}
 		if got.body != `{"user_id":3,"dates":["2026-07-27"]}` {
 			t.Errorf("unexpected body %q", got.body)
 		}
@@ -180,7 +274,7 @@ func TestClient_RequestBodies(t *testing.T) {
 
 	t.Run("assign schedule with replace", func(t *testing.T) {
 		c, got := stub(t, http.StatusCreated, `[]`)
-		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, true); err != nil {
+		if _, err := c.AssignSchedule(9, 3, []string{"2026-07-27"}, true); err != nil {
 			t.Fatalf("assign: %v", err)
 		}
 		if got.body != `{"user_id":3,"dates":["2026-07-27"],"replace":true}` {
@@ -246,15 +340,91 @@ func TestClient_ErrorWithoutBody(t *testing.T) {
 	}
 }
 
-// Nobody on call is a normal state, not a failure.
-func TestGetCurrentOnCall_404IsNotAnError(t *testing.T) {
-	c, _ := stub(t, http.StatusNotFound, `{"error":"no one is on call today"}`)
-	entry, err := c.GetCurrentOnCall()
+// Nobody on call is a normal state, not a failure: the server answers with an
+// empty list, one entry per team that has somebody scheduled.
+func TestGetCurrentOnCall_ListsOnePerTeam(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[
+		{"id":1,"team_id":1,"team_name":"Ops","user_id":5,"username":"alice","date":"2026-09-23"},
+		{"id":2,"team_id":2,"team_name":"Dev","user_id":6,"username":"bob","date":"2026-09-23"}]`)
+	entries, err := c.GetCurrentOnCall()
 	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
+		t.Fatalf("on call: %v", err)
 	}
-	if entry != nil {
-		t.Errorf("expected nil entry, got %+v", entry)
+	if got.path != "/api/schedule/current" {
+		t.Errorf("unexpected path %q", got.path)
+	}
+	if len(entries) != 2 || entries[0].TeamName != "Ops" || entries[1].Username != "bob" {
+		t.Errorf("unexpected entries %+v", entries)
+	}
+
+	c, _ = stub(t, http.StatusOK, `[]`)
+	if entries, err := c.GetCurrentOnCall(); err != nil || len(entries) != 0 {
+		t.Errorf("expected no entries and no error, got %v, %v", entries, err)
+	}
+}
+
+// Schedules belong to a team, so every call for one has to say which.
+func TestSchedule_IsPerTeam(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[]`)
+	if _, err := c.GetSchedule(7, "2026-09-21", "2026-09-27"); err != nil {
+		t.Fatalf("get schedule: %v", err)
+	}
+	if got.path != "/api/teams/7/schedule" || got.query != "from=2026-09-21&to=2026-09-27" {
+		t.Errorf("unexpected request %s?%s", got.path, got.query)
+	}
+
+	c, got = stub(t, http.StatusNoContent, ``)
+	if err := c.DeleteScheduleEntry(7, 12); err != nil {
+		t.Fatalf("delete: %v", err)
+	}
+	if got.method != "DELETE" || got.path != "/api/teams/7/schedule/12" {
+		t.Errorf("unexpected request %s %s", got.method, got.path)
+	}
+}
+
+func TestTeams(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[{"id":3,"name":"Ops","created_at":"2026-09-20T10:00:00Z","role":"owner"}]`)
+	teams, err := c.ListTeams()
+	if err != nil {
+		t.Fatalf("list teams: %v", err)
+	}
+	if got.path != "/api/teams" || len(teams) != 1 || teams[0].Role != RoleOwner || teams[0].Name != "Ops" {
+		t.Errorf("unexpected %s %+v", got.path, teams)
+	}
+
+	c, got = stub(t, http.StatusOK, `[{"team_id":3,"user_id":5,"username":"alice","role":"member"}]`)
+	members, err := c.ListTeamMembers(3)
+	if err != nil {
+		t.Fatalf("list members: %v", err)
+	}
+	if got.path != "/api/teams/3/members" || len(members) != 1 || members[0].UserID != 5 {
+		t.Errorf("unexpected %s %+v", got.path, members)
+	}
+}
+
+// A server that predates teams has no /api/teams, and the TUI recognises one by
+// that 404, so it must come back as a StatusError carrying the code.
+func TestListTeams_OldServerIs404(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `{"error":"not found"}`)
+	_, err := c.ListTeams()
+	var se *StatusError
+	if !errors.As(err, &se) || se.Code != http.StatusNotFound {
+		t.Errorf("expected a 404 StatusError, got %v", err)
+	}
+}
+
+func TestUser_DecodesAdminAndDisabled(t *testing.T) {
+	var u User
+	if err := json.Unmarshal([]byte(
+		`{"id":1,"username":"a","is_admin":true,"disabled_at":"2026-09-22T08:00:00Z"}`), &u); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !u.IsAdmin || !u.IsDisabled() {
+		t.Errorf("expected an admin who is disabled, got %+v", u)
+	}
+	var other User
+	if err := json.Unmarshal([]byte(`{"id":2,"username":"b","is_admin":false}`), &other); err != nil || other.IsDisabled() {
+		t.Errorf("a user with no disabled_at must not be disabled")
 	}
 }
 
@@ -339,7 +509,7 @@ func TestAlert_DecodesIncidentLink(t *testing.T) {
 
 func TestListAlerts_ArchivedFilter(t *testing.T) {
 	c, got := stub(t, http.StatusOK, `[]`)
-	if _, err := c.ListAlerts("", true, 50); err != nil {
+	if _, err := c.ListAlerts(0, "", true, 50); err != nil {
 		t.Fatalf("list alerts: %v", err)
 	}
 	if got.path != "/api/alerts" || got.query != "archived=true&limit=50" {
@@ -363,3 +533,52 @@ func TestIncidentStats_NullAveragesStayNil(t *testing.T) {
 		t.Errorf("expected nil averages, got %v / %v", stats.MTTASeconds, stats.MTTRSeconds)
 	}
 }
+
+func TestClient_Me(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `{"user":{"id":3,"username":"erik"},"has_password":true}`)
+	me, err := c.Me()
+	if err != nil {
+		t.Fatalf("me: %v", err)
+	}
+	if got.method != http.MethodGet || got.path != "/api/me" {
+		t.Errorf("expected GET /api/me, got %s %s", got.method, got.path)
+	}
+	if me.User.ID != 3 || !me.HasPassword {
+		t.Errorf("unexpected decode %+v", me)
+	}
+}
+
+func TestClient_SetPassword(t *testing.T) {
+	c, got := stub(t, http.StatusNoContent, ``)
+	if err := c.SetPassword(2, "a brand new secret", ""); err != nil {
+		t.Fatalf("set password: %v", err)
+	}
+	if got.method != http.MethodPut || got.path != "/api/users/2/password" {
+		t.Errorf("expected PUT /api/users/2/password, got %s %s", got.method, got.path)
+	}
+	// Setting someone else's password carries no current_password at all,
+	// rather than an empty one.
+	if got.body != `{"password":"a brand new secret"}` {
+		t.Errorf("unexpected body %s", got.body)
+	}
+
+	c, got = stub(t, http.StatusNoContent, ``)
+	c.SetPassword(1, "a brand new secret", "the old one")
+	if !strings.Contains(got.body, `"current_password":"the old one"`) {
+		t.Errorf("current password missing from %s", got.body)
+	}
+}
+
+// Older servers have no /api/me; the caller tells that apart by the status
+// code, so the typed error has to carry it.
+func TestClient_StatusErrorKeepsCodeAndMessage(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `404 page not found`)
+	_, err := c.Me()
+	var se *StatusError
+	if !errors.As(err, &se) || se.Code != http.StatusNotFound {
+		t.Fatalf("expected a 404 StatusError, got %v", err)
+	}
+	if err.Error() != "server returned 404" {
+		t.Errorf("message changed: %q", err.Error())
+	}
+}

internal/api/types.go

@@ -7,6 +7,8 @@ import "time"
 // alert belongs to.
 type Alert struct {
 	ID           int64             `json:"id"`
+	TeamID       int64             `json:"team_id"`
+	TeamName     string            `json:"team_name,omitempty"`
 	Fingerprint  string            `json:"fingerprint"`
 	Name         string            `json:"name"`
 	Status       string            `json:"status"`
@@ -25,7 +27,8 @@ type Alert struct {
 
 	// ResolutionSource records why a resolved alert left the firing state:
 	// "alertmanager" for a real resolved webhook, "expiry" when the server
-	// inferred it after the alert stopped being refreshed.
+	// inferred it after the alert stopped being refreshed, "deadman" for a
+	// dead man's switch that came back. Treat the value set as open.
 	ResolutionSource *string `json:"resolution_source,omitempty"`
 }
 
@@ -41,6 +44,8 @@ const (
 // groupKey Alertmanager computed from the operator's group_by configuration.
 type Incident struct {
 	ID          int64             `json:"id"`
+	TeamID      int64             `json:"team_id"`
+	TeamName    string            `json:"team_name,omitempty"`
 	GroupKey    string            `json:"group_key"`
 	Title       string            `json:"title"`
 	GroupLabels map[string]string `json:"group_labels"`
@@ -63,10 +68,17 @@ type Incident struct {
 
 	ResolvedAt *time.Time `json:"resolved_at,omitempty"`
 
-	// ResolutionSource is "alerts" when every alert stopped firing, or "manual"
-	// when a person closed it. Treat the value set as open.
+	// ResolutionSource is "alerts" when every alert stopped firing, "manual"
+	// when a person closed it, or "recovered" when a dead man's switch came back.
+	// Treat the value set as open.
 	ResolutionSource *string `json:"resolution_source,omitempty"`
 
+	// EscalationLevel is how far up the team's escalation ladder the incident has
+	// climbed (0 = not escalated). EscalationDueAt is when the next step fires,
+	// and is nil once the ladder is exhausted or the incident is acknowledged.
+	EscalationLevel int        `json:"escalation_level"`
+	EscalationDueAt *time.Time `json:"escalation_due_at,omitempty"`
+
 	ArchivedAt *time.Time `json:"archived_at,omitempty"`
 
 	// Alerts is populated by GET /api/incidents/{id} only.
@@ -96,6 +108,9 @@ const (
 	EventResolved       = "resolved"
 	EventNote           = "note"
 
+	// Written when a team's dead man's switch stops reporting.
+	EventDeadmanSilent = "deadman_silent"
+
 	// Written by the server's notifier from the delivery result, not at enqueue.
 	// Detail carries the notification kind ("triggered", "reminder", "resolved"),
 	// and on a failure the reason after it. An absent user means the page went to
@@ -154,6 +169,8 @@ type DayStat struct {
 
 type ScheduleEntry struct {
 	ID        int64     `json:"id"`
+	TeamID    int64     `json:"team_id"`
+	TeamName  string    `json:"team_name,omitempty"`
 	UserID    int64     `json:"user_id"`
 	Username  string    `json:"username"`
 	Date      string    `json:"date"` // YYYY-MM-DD
@@ -166,6 +183,14 @@ type User struct {
 	Email     string    `json:"email"`
 	CreatedAt time.Time `json:"created_at"`
 
+	// IsAdmin marks a system administrator: the only kind of user who can create
+	// or delete users and act on other people's passwords and keys.
+	IsAdmin bool `json:"is_admin"`
+
+	// DisabledAt is set when an administrator has disabled the account. A
+	// disabled user cannot sign in or use their keys.
+	DisabledAt *time.Time `json:"disabled_at,omitempty"`
+
 	// NtfyTopic is where this user's push notifications go. Nil and empty mean
 	// the same thing — no topic of their own — because the server stores a blank
 	// string as NULL. Their incidents fall back to the server's shared fallback
@@ -182,6 +207,40 @@ func (u User) Topic() string {
 	return *u.NtfyTopic
 }
 
+// IsDisabled reports whether the account has been disabled.
+func (u User) IsDisabled() bool { return u.DisabledAt != nil }
+
+// Me is GET /api/me: the caller, and whether they can sign in to the web UI.
+type Me struct {
+	User        User `json:"user"`
+	HasPassword bool `json:"has_password"`
+}
+
+// Team roles.
+const (
+	RoleOwner  = "owner"
+	RoleMember = "member"
+)
+
+// Team is a group that owns integrations, incidents, a schedule and an
+// escalation ladder. Role is the caller's role in it, and is only present on
+// the caller's own team lists (GET /api/teams).
+type Team struct {
+	ID        int64     `json:"id"`
+	Name      string    `json:"name"`
+	CreatedAt time.Time `json:"created_at"`
+	Role      string    `json:"role,omitempty"`
+}
+
+// TeamMember is one person's membership of a team.
+type TeamMember struct {
+	TeamID   int64     `json:"team_id"`
+	UserID   int64     `json:"user_id"`
+	Username string    `json:"username"`
+	Role     string    `json:"role"`
+	JoinedAt time.Time `json:"joined_at"`
+}
+
 type APIKey struct {
 	ID         int64      `json:"id"`
 	UserID     int64      `json:"user_id"`

internal/config/config.go

@@ -13,16 +13,26 @@ const defaultRefreshInterval = 30 * time.Second
 
 type Config struct {
 	ServerURL       string
-	APIKey          string
+	Username        string // optional, prefills the sign-in form
 	RefreshInterval time.Duration
 	Theme           string
+
+	// LegacyAPIKey is set when the file still has an `api_key`. The TUI signs in
+	// with a user account now and ignores it; this is only so it can say so.
+	LegacyAPIKey bool
+
+	// Team is the team to start on, by name or id. Empty shows every team the
+	// key's user belongs to.
+	Team string
 }
 
 type rawConfig struct {
 	ServerURL       string `yaml:"server_url"`
-	APIKey          string `yaml:"api_key"`
+	Username        string `yaml:"username,omitempty"`
+	APIKey          string `yaml:"api_key,omitempty"`          // no longer used; see Config.LegacyAPIKey
 	RefreshInterval int    `yaml:"refresh_interval,omitempty"` // seconds
 	Theme           string `yaml:"theme,omitempty"`
+	Team            string `yaml:"team,omitempty"`
 }
 
 func Load() (*Config, error) {
@@ -35,7 +45,7 @@ func Load() (*Config, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  api_key: <your-api-key>\n  theme: gruvbox-dark  # optional", path)
+			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  username: <your-username>  # optional, prefills the sign-in form\n  theme: gruvbox-dark  # optional\n  team: Ops            # optional, team to start on", path)
 		}
 		return nil, fmt.Errorf("cannot read config file: %w", err)
 	}
@@ -48,9 +58,6 @@ func Load() (*Config, error) {
 	if raw.ServerURL == "" {
 		return nil, fmt.Errorf("config: 'server_url' is required")
 	}
-	if raw.APIKey == "" {
-		return nil, fmt.Errorf("config: 'api_key' is required")
-	}
 
 	interval := defaultRefreshInterval
 	if raw.RefreshInterval > 0 {
@@ -59,8 +66,10 @@ func Load() (*Config, error) {
 
 	return &Config{
 		ServerURL:       raw.ServerURL,
-		APIKey:          raw.APIKey,
+		Username:        raw.Username,
+		LegacyAPIKey:    raw.APIKey != "",
 		RefreshInterval: interval,
 		Theme:           raw.Theme,
+		Team:            raw.Team,
 	}, nil
 }

internal/config/config_test.go

@@ -0,0 +1,61 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeConfig(t *testing.T, body string) {
+	t.Helper()
+	dir := t.TempDir()
+	t.Setenv("XDG_CONFIG_HOME", dir)
+	if err := os.MkdirAll(filepath.Join(dir, "terdut-tui"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "terdut-tui", "config.yaml"), []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestLoad_TeamIsOptional(t *testing.T) {
+	writeConfig(t, "server_url: https://terdut.example.com\n")
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Team != "" {
+		t.Errorf("expected no default team, got %q", cfg.Team)
+	}
+
+	writeConfig(t, "server_url: https://terdut.example.com\nteam: Ops\n")
+	cfg, err = Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Team != "Ops" {
+		t.Errorf("expected team Ops, got %q", cfg.Team)
+	}
+}
+
+// Signing in replaced the API key, so a config that has only a server URL is
+// complete, and one that still carries an api_key is noted rather than refused.
+func TestLoad_NoAPIKeyNeeded(t *testing.T) {
+	writeConfig(t, "server_url: https://terdut.example.com\nusername: niklas\n")
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Username != "niklas" || cfg.LegacyAPIKey {
+		t.Errorf("unexpected config %+v", cfg)
+	}
+
+	writeConfig(t, "server_url: https://terdut.example.com\napi_key: old\n")
+	cfg, err = Load()
+	if err != nil {
+		t.Fatalf("a leftover api_key must not stop the TUI starting: %v", err)
+	}
+	if !cfg.LegacyAPIKey {
+		t.Error("expected the leftover api_key to be noted")
+	}
+}

internal/session/session.go

@@ -0,0 +1,98 @@
+// Package session keeps the signed-in session between runs, so the TUI does not
+// ask for a password every time it starts.
+//
+// What is stored is the server's session token, not the password: it is what the
+// web UI keeps in a cookie, it expires on the server's schedule (30 days, sliding
+// with use) and signing out or a password change ends it. It is still a
+// credential, so the file is readable by its owner only.
+package session
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+type file struct {
+	ServerURL string `json:"server_url"`
+	Token     string `json:"token"`
+}
+
+func path() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "terdut-tui", "session.json"), nil
+}
+
+// normalise makes two spellings of one server compare equal.
+func normalise(serverURL string) string {
+	return strings.TrimRight(serverURL, "/")
+}
+
+// Load returns the saved token for serverURL, or "" when there is none. A session
+// saved for a different server is not offered to this one, and an unreadable file
+// is the same as no file: the worst outcome is being asked to sign in.
+func Load(serverURL string) string {
+	p, err := path()
+	if err != nil {
+		return ""
+	}
+	data, err := os.ReadFile(p)
+	if err != nil {
+		return ""
+	}
+	var f file
+	if json.Unmarshal(data, &f) != nil || normalise(f.ServerURL) != normalise(serverURL) {
+		return ""
+	}
+	return f.Token
+}
+
+// Save stores the token for serverURL, replacing whatever was there.
+func Save(serverURL, token string) error {
+	p, err := path()
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
+		return err
+	}
+	data, err := json.Marshal(file{ServerURL: normalise(serverURL), Token: token})
+	if err != nil {
+		return err
+	}
+	// Written beside the target and renamed over it, so a crash cannot leave a
+	// half-written token, and created 0600 so it is never briefly world-readable.
+	tmp, err := os.CreateTemp(filepath.Dir(p), ".session-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	if err := os.Chmod(tmp.Name(), 0o600); err != nil {
+		tmp.Close()
+		return err
+	}
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), p)
+}
+
+// Clear forgets the saved session. Having none to forget is not an error.
+func Clear() error {
+	p, err := path()
+	if err != nil {
+		return err
+	}
+	if err := os.Remove(p); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}

internal/session/session_test.go

@@ -0,0 +1,92 @@
+package session
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func isolate(t *testing.T) {
+	t.Helper()
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+}
+
+func TestSaveThenLoad(t *testing.T) {
+	isolate(t)
+	if got := Load("https://terdut.example.com"); got != "" {
+		t.Fatalf("expected no session yet, got %q", got)
+	}
+	if err := Save("https://terdut.example.com", "tok"); err != nil {
+		t.Fatalf("save: %v", err)
+	}
+	if got := Load("https://terdut.example.com"); got != "tok" {
+		t.Errorf("expected tok, got %q", got)
+	}
+	// A trailing slash is the same server.
+	if got := Load("https://terdut.example.com/"); got != "tok" {
+		t.Errorf("a trailing slash should not lose the session, got %q", got)
+	}
+}
+
+// A token is only ever valid for the server that issued it; offering it to a
+// different one would send a credential to somebody it was never meant for.
+func TestLoadIgnoresAnotherServersSession(t *testing.T) {
+	isolate(t)
+	if err := Save("https://a.example.com", "tok"); err != nil {
+		t.Fatal(err)
+	}
+	if got := Load("https://b.example.com"); got != "" {
+		t.Errorf("a session for another server must not be reused, got %q", got)
+	}
+}
+
+func TestSaveIsOwnerOnly(t *testing.T) {
+	isolate(t)
+	if err := Save("https://a.example.com", "tok"); err != nil {
+		t.Fatal(err)
+	}
+	p, _ := path()
+	info, err := os.Stat(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if perm := info.Mode().Perm(); perm != 0o600 {
+		t.Errorf("the session file holds a credential and must be 0600, got %o", perm)
+	}
+	entries, _ := os.ReadDir(filepath.Dir(p))
+	for _, e := range entries {
+		if e.Name() != "session.json" {
+			t.Errorf("a temporary file was left behind: %s", e.Name())
+		}
+	}
+}
+
+func TestClear(t *testing.T) {
+	isolate(t)
+	if err := Clear(); err != nil {
+		t.Errorf("clearing nothing is not an error, got %v", err)
+	}
+	if err := Save("https://a.example.com", "tok"); err != nil {
+		t.Fatal(err)
+	}
+	if err := Clear(); err != nil {
+		t.Fatalf("clear: %v", err)
+	}
+	if got := Load("https://a.example.com"); got != "" {
+		t.Errorf("expected the session gone, got %q", got)
+	}
+}
+
+func TestLoadToleratesGarbage(t *testing.T) {
+	isolate(t)
+	p, _ := path()
+	if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(p, []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got := Load("https://a.example.com"); got != "" {
+		t.Errorf("an unreadable file means no session, got %q", got)
+	}
+}

internal/tui/login_test.go

@@ -0,0 +1,242 @@
+package tui
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// signedOut is a model with no session, so it starts on the sign-in form.
+func signedOut(serverURL string) Model {
+	m := NewModel(api.NewClient(serverURL), serverURL, time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	return m
+}
+
+func TestStartsOnTheFormWithoutASession(t *testing.T) {
+	m := signedOut("http://test")
+	if m.mode != modeLogin {
+		t.Fatalf("expected the sign-in form, got mode %v", m.mode)
+	}
+	if m.Init() != nil {
+		t.Error("with no session there is nothing to connect with yet")
+	}
+}
+
+func TestStartsConnectedWithASavedSession(t *testing.T) {
+	c := api.NewClient("http://test")
+	c.SetSession("saved")
+	m := NewModel(c, "http://test", time.Minute, theme.GruvboxDark)
+	if m.mode == modeLogin {
+		t.Fatal("a saved session should be tried before asking for a password")
+	}
+	if m.Init() == nil {
+		t.Error("expected the saved session to be tried on start")
+	}
+}
+
+func TestLoginForm_ChecksBothFieldsBeforeSending(t *testing.T) {
+	m := signedOut("http://test")
+	m, cmd := press(t, m, "enter")
+	if cmd != nil || m.loggingIn || !strings.Contains(m.loginErr, "username") {
+		t.Errorf("an empty form must not be sent, got err %q", m.loginErr)
+	}
+
+	m = typeInto(t, m, "niklas")
+	m, cmd = press(t, m, "enter")
+	if cmd != nil || m.loggingIn || !strings.Contains(m.loginErr, "password") {
+		t.Errorf("a missing password must not be sent, got err %q", m.loginErr)
+	}
+}
+
+func TestLoginForm_QIsTypedNotQuit(t *testing.T) {
+	m := signedOut("http://test")
+	m = typeInto(t, m, "quentin")
+	if got := m.loginInputs[loginUsername].Value(); got != "quentin" {
+		t.Errorf("q is a letter in a username, got %q", got)
+	}
+}
+
+// The whole flow against a server: type both fields, submit, and the session is
+// kept for the next run.
+func TestLogin_SignsInAndSavesTheSession(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, _ := io.ReadAll(r.Body)
+		if r.URL.Path != "/api/login" || string(b) != `{"username":"niklas","password":"secret-pass"}` {
+			t.Errorf("unexpected request %s %s", r.URL.Path, b)
+		}
+		http.SetCookie(w, &http.Cookie{Name: api.SessionCookie, Value: "tok-1", Path: "/"})
+		io.WriteString(w, `{}`)
+	}))
+	t.Cleanup(srv.Close)
+
+	m := signedOut(srv.URL)
+	m = typeInto(t, m, "niklas")
+	m, _ = press(t, m, "tab")
+	m = typeInto(t, m, "secret-pass")
+	m, cmd := press(t, m, "enter")
+	if !m.loggingIn || cmd == nil {
+		t.Fatal("expected the sign-in to be under way")
+	}
+
+	msg := cmd()
+	if _, ok := msg.(loginDoneMsg); !ok {
+		t.Fatalf("expected loginDoneMsg, got %#v", msg)
+	}
+	if got := session.Load(srv.URL); got != "tok-1" {
+		t.Errorf("expected the session saved for next time, got %q", got)
+	}
+
+	next, connect := m.Update(msg)
+	m = next.(Model)
+	if m.mode != modeDashboard || m.loggingIn || connect == nil {
+		t.Errorf("expected to move on and connect, got mode %v", m.mode)
+	}
+	if m.loginInputs[loginPassword].Value() != "" {
+		t.Error("the password must not be kept once it has been used")
+	}
+}
+
+func TestLogin_WrongPasswordStaysOnTheForm(t *testing.T) {
+	m := signedOut("http://test")
+	m.loggingIn = true
+	next, _ := m.Update(loginErrMsg{&api.StatusError{Code: 401, Message: "invalid username or password"}})
+	m = next.(Model)
+	if m.mode != modeLogin || m.loggingIn {
+		t.Fatalf("expected to be back on the form, got mode %v", m.mode)
+	}
+	// The server gives the same 401 for an account with no password, so the
+	// message has to say so or it reads as a typo.
+	if !strings.Contains(m.loginErr, "no password") {
+		t.Errorf("expected the no-password hint, got %q", m.loginErr)
+	}
+	if m.loginFocus != loginPassword {
+		t.Error("focus should return to the password to retry")
+	}
+
+	next, _ = m.Update(loginErrMsg{&api.StatusError{Code: 429, Message: "slow down"}})
+	if got := next.(Model).loginErr; !strings.Contains(got, "too many") {
+		t.Errorf("expected the rate limit explained, got %q", got)
+	}
+	next, _ = m.Update(loginErrMsg{errors.New("dial tcp: refused")})
+	if got := next.(Model).loginErr; !strings.Contains(got, "refused") {
+		t.Errorf("other errors should show as they are, got %q", got)
+	}
+}
+
+// A 401 anywhere means the session is gone. Every action would fail the same
+// way, so it goes back to the form instead, without keeping the old data.
+func TestUnauthorized_ReturnsToTheFormAndDropsTheData(t *testing.T) {
+	for name, msg := range map[string]tea.Msg{
+		"refresh":  fetchDataErrMsg{&api.StatusError{Code: 401}},
+		"action":   actionErrMsg{&api.StatusError{Code: 401}},
+		"schedule": scheduleActionErrMsg{&api.StatusError{Code: 401}},
+		"connect":  connectErrMsg{&api.StatusError{Code: 401}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			m := sized()
+			m.incidents = []api.Incident{{ID: 1, Title: "secret incident"}}
+			m.teams = twoTeams()
+			m.isAdmin = true
+			m.loginInputs[loginUsername].SetValue("niklas")
+
+			next, cmd := m.Update(msg)
+			m = next.(Model)
+			if m.mode != modeLogin || m.connected {
+				t.Fatalf("expected the sign-in form, got mode %v connected=%v", m.mode, m.connected)
+			}
+			if len(m.incidents) != 0 || len(m.teams) != 0 || m.isAdmin {
+				t.Error("the previous session's data must not survive into the next sign-in")
+			}
+			if cmd == nil {
+				t.Error("the dead session should be forgotten on disk")
+			}
+			if !strings.Contains(m.loginNote, "session") {
+				t.Errorf("expected the reason, got %q", m.loginNote)
+			}
+			if m.loginInputs[loginUsername].Value() != "niklas" || m.loginFocus != loginPassword {
+				t.Error("the username should be kept so only the password is retyped")
+			}
+			if strings.Contains(m.View(), "secret incident") {
+				t.Error("nothing from the old session may still be on screen")
+			}
+		})
+	}
+}
+
+// A 403 is a permission, not a lost session: it must not sign anybody out.
+func TestForbidden_DoesNotSignOut(t *testing.T) {
+	m := sized()
+	next, _ := m.Update(actionErrMsg{&api.StatusError{Code: 403, Message: "administrator access required"}})
+	if got := next.(Model); got.mode == modeLogin || !got.connected {
+		t.Error("a 403 must leave the session alone")
+	}
+}
+
+func TestLogout(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	m := sized()
+	m.teams = twoTeams()
+	m.incidents = []api.Incident{{ID: 1}}
+	m, cmd := press(t, m, "L")
+	if cmd == nil {
+		t.Fatal("L should sign out")
+	}
+	next, _ := m.Update(logoutDoneMsg{})
+	m = next.(Model)
+	if m.mode != modeLogin || m.connected || len(m.incidents) != 0 {
+		t.Errorf("expected the form with nothing loaded, got mode %v", m.mode)
+	}
+	if !strings.Contains(m.loginNote, "signed out") {
+		t.Errorf("expected it to say so, got %q", m.loginNote)
+	}
+}
+
+// Signing out and in again must not leave two refresh timers running, each
+// re-arming itself for ever.
+func TestSigningInAgainStartsNoSecondTimer(t *testing.T) {
+	m := sized()
+	next, _ := m.Update(connectedMsg{})
+	m = next.(Model)
+	if !m.ticking {
+		t.Fatal("the first connect starts the refresh timer")
+	}
+	m = m.requireLogin("x")
+	if !m.ticking {
+		t.Fatal("the timer is still running while signed out")
+	}
+	// Ticks while signed out must do nothing rather than fetch.
+	if _, cmd := m.Update(tickMsg(time.Now())); cmd == nil {
+		t.Error("the timer keeps ticking")
+	}
+	if cmd := m.refreshActiveSection(); cmd != nil {
+		t.Error("no refresh should be attempted while signed out")
+	}
+}
+
+func TestLoginView_HidesThePasswordAndShowsTheNote(t *testing.T) {
+	m := signedOut("https://terdut.example.com").WithLogin("niklas", "api_key in config.yaml is no longer used")
+	if m.loginFocus != loginPassword {
+		t.Error("with the username known the cursor should start on the password")
+	}
+	m = typeInto(t, m, "hunter2-hunter2")
+	view := m.View()
+	for _, want := range []string{"Sign in to https://terdut.example.com", "niklas", "api_key in config.yaml is no longer used"} {
+		if !strings.Contains(view, want) {
+			t.Errorf("expected %q on the form:\n%s", want, view)
+		}
+	}
+	if strings.Contains(view, "hunter2") {
+		t.Error("the password must be masked")
+	}
+}

internal/tui/model.go

@@ -1,12 +1,19 @@
 package tui
 
 import (
+	"errors"
 	"fmt"
+	"net/http"
+	"slices"
+	"strconv"
+	"strings"
 	"time"
 
 	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
 	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
 	"github.com/charmbracelet/bubbles/help"
+	"github.com/charmbracelet/bubbles/key"
 	"github.com/charmbracelet/bubbles/table"
 	"github.com/charmbracelet/bubbles/textinput"
 	"github.com/charmbracelet/bubbles/viewport"
@@ -45,8 +52,29 @@ const (
 	modeAPIKeyCreate
 	modeAPIKeyReveal
 	modeAPIKeyRevokeByID
+	modePasswordSet
+	modeLogin
 )
 
+// Fields of the sign-in form, in tab order.
+const (
+	loginUsername = iota
+	loginPassword
+	loginFieldCount
+)
+
+// Fields of the set-password form, in tab order.
+const (
+	pwCurrent = iota
+	pwNew
+	pwRepeat
+	pwFieldCount
+)
+
+// minPasswordLen mirrors the server's rule, so a short password is refused
+// here rather than after a round trip.
+const minPasswordLen = 10
+
 type confirmTarget int
 
 const (
@@ -91,8 +119,14 @@ func filterLabel(filter string) string {
 // ── Messages ───────────────────────────────────────────────────────────────
 
 // dashboard
-type connectedMsg struct{}
+type connectedMsg struct {
+	teams []api.Team
+	me    api.Me
+}
 type connectErrMsg struct{ err error }
+type loginDoneMsg struct{}
+type loginErrMsg struct{ err error }
+type logoutDoneMsg struct{}
 type incidentsFetchedMsg struct{ incidents []api.Incident }
 type archivedIncidentsFetchedMsg struct{ incidents []api.Incident }
 type incidentActionDoneMsg struct {
@@ -126,7 +160,11 @@ type detailStatsErrMsg struct{ err error }
 // schedule
 type scheduleFetchedMsg struct {
 	entries []api.ScheduleEntry
-	current *api.ScheduleEntry
+	current []api.ScheduleEntry
+}
+type pickerReadyMsg struct {
+	users   []api.User
+	members map[int64]bool
 }
 type scheduleFetchErrMsg struct{ err error }
 type scheduleActionErrMsg struct{ err error }
@@ -136,6 +174,8 @@ type usersFetchedMsg struct{ users []api.User }
 type apiKeyCreatedMsg struct{ key api.APIKey }
 type apiKeyRevokedMsg struct{}
 type userActionErrMsg struct{ err error }
+type meFetchedMsg struct{ me api.Me }
+type passwordSetMsg struct{ username string }
 
 // ── Model ──────────────────────────────────────────────────────────────────
 
@@ -160,12 +200,33 @@ type Model struct {
 	client          *api.Client
 	serverURL       string
 	refreshInterval time.Duration
+	theme           theme.Theme // kept to build a fresh model when signing out
 
 	activeSection section
 	mode          mode
 	width         int
 	height        int
 
+	// Teams. The server scopes everything to the caller's teams; activeTeamID
+	// narrows the incident and alert lists to one of them, 0 meaning all. The
+	// schedule is per team and always needs a concrete one, see scheduleTeam.
+	teams        []api.Team
+	activeTeamID int64
+	defaultTeam  string // config's `team`, resolved on connect
+	meID         int64
+	isAdmin      bool
+
+	// Sign-in. Until the server accepts a session the TUI is in modeLogin;
+	// loginNote is a line the form shows above the fields (why we are here), and
+	// ticking says the refresh timer is already running, so signing in again
+	// after signing out does not start a second one.
+	loginInputs [loginFieldCount]textinput.Model
+	loginFocus  int
+	loggingIn   bool
+	loginErr    string
+	loginNote   string
+	ticking     bool
+
 	// Connection & dashboard
 	connected     bool
 	loading       bool
@@ -223,7 +284,7 @@ type Model struct {
 	scheduleWindow  time.Time
 	scheduleEntries []api.ScheduleEntry
 	scheduleDays    []scheduleDay
-	currentOnCall   *api.ScheduleEntry
+	currentOnCall   []api.ScheduleEntry
 	scheduleLoading bool
 	scheduleTable   table.Model
 
@@ -233,6 +294,9 @@ type Model struct {
 	userPickerTable  table.Model
 	pickerTarget     pickerTarget
 	pickerAssignWeek bool
+	// pickerMembers is who belongs to the schedule's team, so the schedule picker
+	// offers only people the server will accept. Nil until fetched.
+	pickerMembers map[int64]bool
 
 	// User management section
 	userManageTable   table.Model
@@ -244,6 +308,15 @@ type Model struct {
 	apiKeyRevokeInput textinput.Model
 	revealedAPIKey    api.APIKey
 
+	// Set-password form. The current-password field is shown only when the
+	// target is the key's own user and already has a password, which is the
+	// one case the server asks for it; pwLoading covers the /api/me lookup
+	// that decides it.
+	pwInputs      [pwFieldCount]textinput.Model
+	pwFocus       int
+	pwNeedCurrent bool
+	pwLoading     bool
+
 	help   help.Model
 	keys   keyMap
 	styles Styles
@@ -253,22 +326,26 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	st := newStyles(th)
 	ts := st.Table()
 
-	incidentT := table.New(table.WithFocused(true))
+	// Each table sees a key before the section's own handler does, so any
+	// key a section uses as an action must be taken out of that table's
+	// navigation bindings, or the cursor moves first and the action lands on
+	// a different row. See tableKeyMap.
+	incidentT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap("f")))
 	incidentT.SetStyles(ts)
 
-	alertT := table.New(table.WithFocused(true))
+	alertT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap("f")))
 	alertT.SetStyles(ts)
 
-	archivedT := table.New(table.WithFocused(true))
+	archivedT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap()))
 	archivedT.SetStyles(ts)
 
-	schedT := table.New(table.WithFocused(true))
+	schedT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap("d")))
 	schedT.SetStyles(ts)
 
-	pickerT := table.New(table.WithFocused(true))
+	pickerT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap()))
 	pickerT.SetStyles(ts)
 
-	manageT := table.New(table.WithFocused(true))
+	manageT := table.New(table.WithFocused(true), table.WithKeyMap(tableKeyMap("d", "k", "p")))
 	manageT.SetStyles(ts)
 
 	// Sized by the first tea.WindowSizeMsg; built here so it carries the default
@@ -303,11 +380,35 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	revokeIn.Placeholder = "integer key ID"
 	revokeIn.CharLimit = 20
 
+	var pwIn [pwFieldCount]textinput.Model
+	for i, placeholder := range [pwFieldCount]string{"current password", "new password (min. 10 characters)", "repeat new password"} {
+		pwIn[i] = textinput.New()
+		pwIn[i].Placeholder = placeholder
+		pwIn[i].EchoMode = textinput.EchoPassword
+		pwIn[i].EchoCharacter = '•'
+		pwIn[i].CharLimit = 72 // bcrypt's limit; the server refuses longer
+	}
+
+	var loginIn [loginFieldCount]textinput.Model
+	for i, placeholder := range [loginFieldCount]string{"username", "password"} {
+		loginIn[i] = textinput.New()
+		loginIn[i].Placeholder = placeholder
+		loginIn[i].CharLimit = 72 // bcrypt's limit, and the server refuses longer passwords
+	}
+	loginIn[loginPassword].EchoMode = textinput.EchoPassword
+	loginIn[loginPassword].EchoCharacter = '•'
+	for i := range loginIn {
+		loginIn[i] = st.Input(loginIn[i])
+	}
+
 	for _, in := range []*textinput.Model{
 		&noteIn, &snoozeIn, &usernameIn, &emailIn, &topicIn, &keyNameIn, &revokeIn,
 	} {
 		*in = st.Input(*in)
 	}
+	for i := range pwIn {
+		pwIn[i] = st.Input(pwIn[i])
+	}
 
 	helpModel := help.New()
 	helpModel.Styles = st.Help()
@@ -320,12 +421,20 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 	}
 	window := today.AddDate(0, 0, -(weekday - 1))
 
+	startMode := modeDashboard
+	if client != nil && !client.HasSession() {
+		startMode = modeLogin
+		loginIn[loginUsername].Focus()
+	}
+
 	return Model{
 		client:            client,
 		serverURL:         serverURL,
 		refreshInterval:   refreshInterval,
+		theme:             th,
 		activeSection:     sectionIncidents,
-		mode:              modeDashboard,
+		mode:              startMode,
+		loginInputs:       loginIn,
 		loading:           true,
 		incidentFilter:    "",
 		alertFilter:       "firing",
@@ -344,18 +453,70 @@ func NewModel(client *api.Client, serverURL string, refreshInterval time.Duratio
 		ntfyTopicInput:    topicIn,
 		apiKeyNameInput:   keyNameIn,
 		apiKeyRevokeInput: revokeIn,
+		pwInputs:          pwIn,
 		help:              helpModel,
 		keys:              keys,
 		styles:            st,
 	}
 }
 
+// WithDefaultTeam names the team to start on, by name or id. It is resolved
+// against the caller's teams once connected; an unknown one is reported and the
+// TUI starts on all teams.
+func (m Model) WithDefaultTeam(team string) Model {
+	m.defaultTeam = strings.TrimSpace(team)
+	return m
+}
+
+// WithLogin prefills the sign-in form's username and sets a note shown above it.
+func (m Model) WithLogin(username, note string) Model {
+	m.loginInputs[loginUsername].SetValue(username)
+	m.loginNote = note
+	if username != "" && m.mode == modeLogin {
+		// The name is known, so the only thing left to type is the password.
+		m.loginInputs[loginUsername].Blur()
+		m.loginFocus = loginPassword
+		m.loginInputs[loginPassword].Focus()
+	}
+	return m
+}
+
+// Init tries the saved session, if there is one; otherwise the sign-in form is
+// already showing and there is nothing to do until it is submitted.
 func (m Model) Init() tea.Cmd {
+	if m.mode == modeLogin {
+		return nil
+	}
 	return connectCmd(m.client)
 }
 
 // ── Table rebuilders ───────────────────────────────────────────────────────
 
+// tableKeyMap is the bubbles table keymap without the given keys.
+//
+// The table's defaults claim several letters -- k up, d half a page down, f a
+// page down -- and the dashboard hands every key to the table before the
+// section's own handler reads the cursor. A letter that is both, like k for
+// API keys in Users, therefore moved the cursor and then acted on the row it
+// had moved to. Each table gives up the letters its section acts on; the
+// arrow keys and the rest of the defaults are untouched.
+func tableKeyMap(reserved ...string) table.KeyMap {
+	km := table.DefaultKeyMap()
+	for _, b := range []*key.Binding{
+		&km.LineUp, &km.LineDown, &km.PageUp, &km.PageDown,
+		&km.HalfPageUp, &km.HalfPageDown, &km.GotoTop, &km.GotoBottom,
+	} {
+		var keep []string
+		for _, k := range b.Keys() {
+			if !slices.Contains(reserved, k) {
+				keep = append(keep, k)
+			}
+		}
+		b.SetKeys(keep...)
+	}
+	return km
+}
+
 // setRows replaces a table's rows and keeps its cursor in a state the rest of
 // this package can rely on: valid whenever the table has any rows at all.
 //
@@ -374,21 +535,34 @@ func setRows(t *table.Model, rows []table.Row) {
 	}
 }
 
+// setTable replaces a table's columns and rows together, for tables whose column
+// count can change (the Team column comes and goes). bubbles re-renders the
+// existing rows as soon as SetColumns is called, and a row with a different
+// number of cells than the new columns indexes past the end and panics, so the
+// old rows have to go first. The cursor is put back afterwards, since a refresh
+// must not send it to the top.
+func setTable(t *table.Model, cols []table.Column, rows []table.Row) {
+	cursor := t.Cursor()
+	t.SetRows(nil)
+	t.SetColumns(cols)
+	setRows(t, rows)
+	if cursor > 0 && cursor < len(rows) {
+		t.SetCursor(cursor)
+	}
+}
+
 func (m *Model) rebuildIncidentTable() {
-	m.incidentTable.SetColumns(incidentColumns(m.width))
-	setRows(&m.incidentTable, incidentRows(m.incidents))
+	setTable(&m.incidentTable, incidentColumns(m.width, m.showTeamColumn()), incidentRows(m.incidents, m.showTeamColumn()))
 	m.incidentTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildTable() {
-	m.alertTable.SetColumns(alertColumns(m.width))
-	setRows(&m.alertTable, alertRows(m.alerts))
+	setTable(&m.alertTable, alertColumns(m.width, m.showTeamColumn()), alertRows(m.alerts, m.showTeamColumn()))
 	m.alertTable.SetHeight(tableHeight(m.height, 8))
 }
 
 func (m *Model) rebuildArchivedTable() {
-	m.archivedTable.SetColumns(incidentColumns(m.width))
-	setRows(&m.archivedTable, incidentRows(m.archivedIncidents))
+	setTable(&m.archivedTable, incidentColumns(m.width, m.showTeamColumn()), incidentRows(m.archivedIncidents, m.showTeamColumn()))
 	m.archivedTable.SetHeight(tableHeight(m.height, 8))
 }
 
@@ -400,8 +574,9 @@ func (m *Model) rebuildScheduleTable() {
 
 func (m *Model) rebuildUserPickerTable() {
 	m.userPickerTable.SetColumns(userPickerColumns(m.width))
-	rows := make([]table.Row, len(m.users))
-	for i, u := range m.users {
+	pickable := m.pickerUsers()
+	rows := make([]table.Row, len(pickable))
+	for i, u := range pickable {
 		rows[i] = table.Row{u.Username, u.Email}
 	}
 	setRows(&m.userPickerTable, rows)
@@ -416,7 +591,7 @@ func (m *Model) rebuildUserManageTable() {
 		if topic == "" {
 			topic = "—"
 		}
-		rows[i] = table.Row{u.Username, u.Email, topic, u.CreatedAt.UTC().Format("2006-01-02")}
+		rows[i] = table.Row{u.Username, u.Email, topic, userFlags(u), u.CreatedAt.UTC().Format("2006-01-02")}
 	}
 	setRows(&m.userManageTable, rows)
 	m.userManageTable.SetHeight(tableHeight(m.height, 10))
@@ -466,6 +641,106 @@ func (m Model) detailViewportHeight() int {
 	return h
 }
 
+// showTeamColumn is whether list rows need saying which team they belong to:
+// only when they can come from more than one.
+func (m Model) showTeamColumn() bool {
+	return m.activeTeamID == 0 && len(m.teams) > 1
+}
+
+// activeTeam returns the team the lists are narrowed to.
+func (m Model) activeTeam() (api.Team, bool) {
+	return m.teamByID(m.activeTeamID)
+}
+
+func (m Model) teamByID(id int64) (api.Team, bool) {
+	for _, t := range m.teams {
+		if t.ID == id {
+			return t, true
+		}
+	}
+	return api.Team{}, false
+}
+
+// scheduleTeam is the team whose schedule the Schedule section shows. That is
+// the active team; with all teams showing it is the first one the caller owns,
+// else their first, because a rota belongs to one team and there is no
+// meaningful union to display.
+func (m Model) scheduleTeam() (api.Team, bool) {
+	if t, ok := m.activeTeam(); ok {
+		return t, true
+	}
+	for _, t := range m.teams {
+		if t.Role == api.RoleOwner {
+			return t, true
+		}
+	}
+	if len(m.teams) > 0 {
+		return m.teams[0], true
+	}
+	return api.Team{}, false
+}
+
+// canEditSchedule mirrors the server: writes need a team owner or an
+// administrator. Saying so up front beats a 403 after picking a user.
+func (m Model) canEditSchedule(t api.Team) bool {
+	return m.isAdmin || t.Role == api.RoleOwner
+}
+
+// canManageUser mirrors the server's self-or-admin rule for a user's password,
+// ntfy topic and API keys.
+func (m Model) canManageUser(u api.User) bool {
+	return m.isAdmin || u.ID == m.meID
+}
+
+// resolveTeam finds a team by id or, failing that, by name.
+func resolveTeam(teams []api.Team, want string) (api.Team, bool) {
+	if id, err := strconv.ParseInt(want, 10, 64); err == nil {
+		for _, t := range teams {
+			if t.ID == id {
+				return t, true
+			}
+		}
+	}
+	for _, t := range teams {
+		if strings.EqualFold(t.Name, want) {
+			return t, true
+		}
+	}
+	return api.Team{}, false
+}
+
+// pickerUsers is who the user picker offers. Disabled accounts are never worth
+// assigning to. For the schedule it is also limited to the team's members: the
+// server answers 404 for anyone else, and shows nothing until they are known.
+func (m Model) pickerUsers() []api.User {
+	out := make([]api.User, 0, len(m.users))
+	for _, u := range m.users {
+		if u.IsDisabled() {
+			continue
+		}
+		if m.pickerTarget == pickerSchedule && !m.pickerMembers[u.ID] {
+			continue
+		}
+		out = append(out, u)
+	}
+	return out
+}
+
+// userFlags is the Users table's marker column.
+func userFlags(u api.User) string {
+	var flags []string
+	if u.IsAdmin {
+		flags = append(flags, "admin")
+	}
+	if u.IsDisabled() {
+		flags = append(flags, "disabled")
+	}
+	if len(flags) == 0 {
+		return "—"
+	}
+	return strings.Join(flags, ",")
+}
+
 // noteEvents filters a timeline down to the deletable entries, which is what
 // the [ and ] cursor walks.
 func noteEvents(timeline []api.IncidentEvent) []api.IncidentEvent {
@@ -480,44 +755,67 @@ func noteEvents(timeline []api.IncidentEvent) []api.IncidentEvent {
 
 // ── Column definitions ─────────────────────────────────────────────────────
 
-func incidentColumns(width int) []table.Column {
+// teamW is the width of the Team column shown when rows can span teams.
+const teamW = 14
+
+func incidentColumns(width int, showTeam bool) []table.Column {
 	const sevW, statusW, timeW = 9, 15, 12
 	titleW := width/2 - 10
+	if showTeam {
+		titleW -= teamW + 2
+	}
 	if titleW < 20 {
 		titleW = 20
 	}
 	// 10 = bubbles' Padding(0, 1) on each of the five cells.
 	assigneeW := width - sevW - titleW - statusW - timeW - 10
+	if showTeam {
+		assigneeW -= teamW + 2
+	}
 	if assigneeW < 8 {
 		assigneeW = 8
 	}
-	return []table.Column{
+	cols := []table.Column{
 		{Title: "Sev", Width: sevW},
 		{Title: "Incident", Width: titleW},
-		{Title: "Status", Width: statusW},
-		{Title: "Assignee", Width: assigneeW},
-		{Title: "Triggered", Width: timeW},
 	}
+	if showTeam {
+		cols = append(cols, table.Column{Title: "Team", Width: teamW})
+	}
+	return append(cols,
+		table.Column{Title: "Status", Width: statusW},
+		table.Column{Title: "Assignee", Width: assigneeW},
+		table.Column{Title: "Triggered", Width: timeW},
+	)
 }
 
-func alertColumns(width int) []table.Column {
+func alertColumns(width int, showTeam bool) []table.Column {
 	const statusW, timeW = 10, 12
 	nameW := width/2 - 14
+	if showTeam {
+		nameW -= teamW + 2
+	}
 	if nameW < 20 {
 		nameW = 20
 	}
 	// 10 = bubbles' Padding(0, 1) on each of the five cells.
 	incW := width - nameW - statusW - 2*timeW - 10
+	if showTeam {
+		incW -= teamW + 2
+	}
 	if incW < 8 {
 		incW = 8
 	}
-	return []table.Column{
-		{Title: "Name", Width: nameW},
-		{Title: "Status", Width: statusW},
-		{Title: "Started", Width: timeW},
-		{Title: "Last Seen", Width: timeW},
-		{Title: "Incident", Width: incW},
+	cols := []table.Column{{Title: "Name", Width: nameW}}
+	if showTeam {
+		cols = append(cols, table.Column{Title: "Team", Width: teamW})
 	}
+	return append(cols,
+		table.Column{Title: "Status", Width: statusW},
+		table.Column{Title: "Started", Width: timeW},
+		table.Column{Title: "Last Seen", Width: timeW},
+		table.Column{Title: "Incident", Width: incW},
+	)
 }
 
 func scheduleColumns(width int) []table.Column {
@@ -548,8 +846,9 @@ func userManageColumns(width int) []table.Column {
 	createdW := 12
 	usernameW := 25
 	topicW := 22
-	// 8 = bubbles' Padding(0, 1) on each of the four cells.
-	emailW := width - usernameW - topicW - createdW - 8
+	flagsW := 14
+	// 10 = bubbles' Padding(0, 1) on each of the five cells.
+	emailW := width - usernameW - topicW - flagsW - createdW - 10
 	if emailW < 15 {
 		emailW = 15
 	}
@@ -557,13 +856,14 @@ func userManageColumns(width int) []table.Column {
 		{Title: "Username", Width: usernameW},
 		{Title: "Email", Width: emailW},
 		{Title: "Ntfy Topic", Width: topicW},
+		{Title: "Flags", Width: flagsW},
 		{Title: "Created", Width: createdW},
 	}
 }
 
 // ── Row builders ───────────────────────────────────────────────────────────
 
-func incidentRows(incidents []api.Incident) []table.Row {
+func incidentRows(incidents []api.Incident, showTeam bool) []table.Row {
 	now := time.Now()
 	rows := make([]table.Row, len(incidents))
 	for i, inc := range incidents {
@@ -581,12 +881,16 @@ func incidentRows(incidents []api.Incident) []table.Row {
 		if assignee == "" {
 			assignee = "—"
 		}
+		if showTeam {
+			rows[i] = table.Row{severity, inc.Title, teamLabel(inc.TeamName), status, assignee, humanAgo(now, inc.TriggeredAt)}
+			continue
+		}
 		rows[i] = table.Row{severity, inc.Title, status, assignee, humanAgo(now, inc.TriggeredAt)}
 	}
 	return rows
 }
 
-func alertRows(alerts []api.Alert) []table.Row {
+func alertRows(alerts []api.Alert, showTeam bool) []table.Row {
 	now := time.Now()
 	rows := make([]table.Row, len(alerts))
 	for i, a := range alerts {
@@ -594,11 +898,23 @@ func alertRows(alerts []api.Alert) []table.Row {
 		if a.IncidentID != nil {
 			incident = fmt.Sprintf("#%d", *a.IncidentID)
 		}
+		if showTeam {
+			rows[i] = table.Row{a.Name, teamLabel(a.TeamName), a.Status, humanAgo(now, a.StartsAt), humanAgo(now, a.ReceivedAt), incident}
+			continue
+		}
 		rows[i] = table.Row{a.Name, a.Status, humanAgo(now, a.StartsAt), humanAgo(now, a.ReceivedAt), incident}
 	}
 	return rows
 }
 
+// teamLabel is a team name for a table cell, with a dash when the server sent none.
+func teamLabel(name string) string {
+	if name == "" {
+		return "—"
+	}
+	return name
+}
+
 func scheduleRows(days []scheduleDay) []table.Row {
 	today := time.Now().UTC().Format("2006-01-02")
 	rows := make([]table.Row, len(days))
@@ -693,19 +1009,70 @@ func humanSeconds(secs *float64) string {
 
 // ── Commands ───────────────────────────────────────────────────────────────
 
+// errServerTooOld is what connecting to a server without teams looks like: the
+// server has no version endpoint, so its missing /api/teams is the tell.
+var errServerTooOld = errors.New("this server predates teams -- terdut-tui needs terdut-server v0.20 or later")
+
+// connectCmd checks the server is up, then loads the caller's teams and identity
+// with their key. /healthz is unauthenticated, so this is also the first thing
+// to notice a wrong key.
 func connectCmd(client *api.Client) tea.Cmd {
 	return func() tea.Msg {
 		if err := client.HealthCheck(); err != nil {
 			return connectErrMsg{err}
 		}
-		return connectedMsg{}
+		teams, err := client.ListTeams()
+		var se *api.StatusError
+		if errors.As(err, &se) && se.Code == http.StatusNotFound {
+			return connectErrMsg{errServerTooOld}
+		}
+		if err != nil {
+			return connectErrMsg{err}
+		}
+		me, err := client.Me()
+		if err != nil {
+			return connectErrMsg{err}
+		}
+		return connectedMsg{teams: teams, me: *me}
 	}
 }
 
-func fetchIncidentsCmd(client *api.Client, filter string) tea.Cmd {
+// loginCmd signs in and saves the session, so the next run can resume it. Failing
+// to save is not failing to sign in: the session works for this run either way.
+func loginCmd(client *api.Client, serverURL, username, password string) tea.Cmd {
+	return func() tea.Msg {
+		token, err := client.Login(username, password)
+		if err != nil {
+			return loginErrMsg{err}
+		}
+		_ = session.Save(serverURL, token)
+		return loginDoneMsg{}
+	}
+}
+
+// logoutCmd ends the session on the server and deletes the saved one. The saved
+// copy goes even when the server cannot be reached, because the person asked to
+// be signed out and a token left on disk would say otherwise.
+func logoutCmd(client *api.Client) tea.Cmd {
+	return func() tea.Msg {
+		_ = client.Logout()
+		_ = session.Clear()
+		return logoutDoneMsg{}
+	}
+}
+
+// forgetSessionCmd drops a saved session the server no longer honours.
+func forgetSessionCmd() tea.Cmd {
+	return func() tea.Msg {
+		_ = session.Clear()
+		return nil
+	}
+}
+
+func fetchIncidentsCmd(client *api.Client, teamID int64, filter string) tea.Cmd {
 	return func() tea.Msg {
 		status, snoozed := incidentQuery(filter)
-		incidents, err := client.ListIncidents(status, false, snoozed, 500)
+		incidents, err := client.ListIncidents(teamID, status, false, snoozed, 500)
 		if err != nil {
 			return fetchDataErrMsg{err}
 		}
@@ -713,11 +1080,11 @@ func fetchIncidentsCmd(client *api.Client, filter string) tea.Cmd {
 	}
 }
 
-func fetchArchivedIncidentsCmd(client *api.Client) tea.Cmd {
+func fetchArchivedIncidentsCmd(client *api.Client, teamID int64) tea.Cmd {
 	return func() tea.Msg {
 		// Archived incidents are all resolved, so the status filter has to be
 		// widened past the server's open-only default or nothing comes back.
-		incidents, err := client.ListIncidents(api.StatusResolved, true, false, 500)
+		incidents, err := client.ListIncidents(teamID, api.StatusResolved, true, false, 500)
 		if err != nil {
 			return fetchDataErrMsg{err}
 		}
@@ -725,13 +1092,13 @@ func fetchArchivedIncidentsCmd(client *api.Client) tea.Cmd {
 	}
 }
 
-func fetchAlertsCmd(client *api.Client, filter string) tea.Cmd {
+func fetchAlertsCmd(client *api.Client, teamID int64, filter string) tea.Cmd {
 	return func() tea.Msg {
 		status, archived := filter, false
 		if filter == "archived" {
 			status, archived = "", true
 		}
-		alerts, err := client.ListAlerts(status, archived, 500)
+		alerts, err := client.ListAlerts(teamID, status, archived, 500)
 		if err != nil {
 			return fetchDataErrMsg{err}
 		}
@@ -831,13 +1198,13 @@ func deleteNoteCmd(client *api.Client, id, eventID int64) tea.Cmd {
 
 // archiveIncidentCmd archives from the list view, so it reloads the list rather
 // than a detail pane.
-func archiveIncidentCmd(client *api.Client, id int64, filter string) tea.Cmd {
+func archiveIncidentCmd(client *api.Client, id, teamID int64, filter string) tea.Cmd {
 	return func() tea.Msg {
 		if _, err := client.ArchiveIncident(id); err != nil {
 			return actionErrMsg{err}
 		}
 		status, snoozed := incidentQuery(filter)
-		incidents, err := client.ListIncidents(status, false, snoozed, 500)
+		incidents, err := client.ListIncidents(teamID, status, false, snoozed, 500)
 		if err != nil {
 			return actionErrMsg{err}
 		}
@@ -845,12 +1212,12 @@ func archiveIncidentCmd(client *api.Client, id int64, filter string) tea.Cmd {
 	}
 }
 
-func unarchiveIncidentCmd(client *api.Client, id int64) tea.Cmd {
+func unarchiveIncidentCmd(client *api.Client, id, teamID int64) tea.Cmd {
 	return func() tea.Msg {
 		if err := client.UnarchiveIncident(id); err != nil {
 			return actionErrMsg{err}
 		}
-		incidents, err := client.ListIncidents(api.StatusResolved, true, false, 500)
+		incidents, err := client.ListIncidents(teamID, api.StatusResolved, true, false, 500)
 		if err != nil {
 			return actionErrMsg{err}
 		}
@@ -886,51 +1253,73 @@ func fetchDetailStatsCmd(client *api.Client) tea.Cmd {
 	}
 }
 
-func fetchScheduleCmd(client *api.Client, from, to time.Time) tea.Cmd {
+// loadSchedule reads one team's window and everyone's on-call today, the way
+// every schedule command ends so the view reflects what the server now holds.
+func loadSchedule(client *api.Client, teamID int64, from, to time.Time) (scheduleFetchedMsg, error) {
+	entries, err := client.GetSchedule(teamID, from.Format("2006-01-02"), to.Format("2006-01-02"))
+	if err != nil {
+		return scheduleFetchedMsg{}, err
+	}
+	current, err := client.GetCurrentOnCall()
+	if err != nil {
+		return scheduleFetchedMsg{}, err
+	}
+	return scheduleFetchedMsg{entries: entries, current: current}, nil
+}
+
+func fetchScheduleCmd(client *api.Client, teamID int64, from, to time.Time) tea.Cmd {
 	return func() tea.Msg {
-		entries, err := client.GetSchedule(from.Format("2006-01-02"), to.Format("2006-01-02"))
+		msg, err := loadSchedule(client, teamID, from, to)
 		if err != nil {
 			return scheduleFetchErrMsg{err}
 		}
-		current, err := client.GetCurrentOnCall()
-		if err != nil {
-			return scheduleFetchErrMsg{err}
-		}
-		return scheduleFetchedMsg{entries: entries, current: current}
+		return msg
 	}
 }
 
-func assignScheduleCmd(client *api.Client, userID int64, dates []string, replace bool, from, to time.Time) tea.Cmd {
+func assignScheduleCmd(client *api.Client, teamID, userID int64, dates []string, replace bool, from, to time.Time) tea.Cmd {
 	return func() tea.Msg {
-		if _, err := client.AssignSchedule(userID, dates, replace); err != nil {
+		if _, err := client.AssignSchedule(teamID, userID, dates, replace); err != nil {
 			return scheduleActionErrMsg{err}
 		}
-		entries, err := client.GetSchedule(from.Format("2006-01-02"), to.Format("2006-01-02"))
+		msg, err := loadSchedule(client, teamID, from, to)
 		if err != nil {
 			return scheduleActionErrMsg{err}
 		}
-		current, err := client.GetCurrentOnCall()
-		if err != nil {
-			return scheduleActionErrMsg{err}
-		}
-		return scheduleFetchedMsg{entries: entries, current: current}
+		return msg
 	}
 }
 
-func deleteScheduleEntryCmd(client *api.Client, entryID int64, from, to time.Time) tea.Cmd {
+func deleteScheduleEntryCmd(client *api.Client, teamID, entryID int64, from, to time.Time) tea.Cmd {
 	return func() tea.Msg {
-		if err := client.DeleteScheduleEntry(entryID); err != nil {
+		if err := client.DeleteScheduleEntry(teamID, entryID); err != nil {
 			return scheduleActionErrMsg{err}
 		}
-		entries, err := client.GetSchedule(from.Format("2006-01-02"), to.Format("2006-01-02"))
+		msg, err := loadSchedule(client, teamID, from, to)
 		if err != nil {
 			return scheduleActionErrMsg{err}
 		}
-		current, err := client.GetCurrentOnCall()
+		return msg
+	}
+}
+
+// fetchPickerCmd loads what the schedule's user picker offers: everyone, and who
+// belongs to the team, since only members can be put on its rota.
+func fetchPickerCmd(client *api.Client, teamID int64) tea.Cmd {
+	return func() tea.Msg {
+		users, err := client.ListUsers()
 		if err != nil {
-			return scheduleActionErrMsg{err}
+			return userActionErrMsg{err}
 		}
-		return scheduleFetchedMsg{entries: entries, current: current}
+		members, err := client.ListTeamMembers(teamID)
+		if err != nil {
+			return userActionErrMsg{err}
+		}
+		ids := make(map[int64]bool, len(members))
+		for _, mem := range members {
+			ids[mem.UserID] = true
+		}
+		return pickerReadyMsg{users: users, members: ids}
 	}
 }
 
@@ -996,6 +1385,29 @@ func createAPIKeyCmd(client *api.Client, userID int64, name string) tea.Cmd {
 	}
 }
 
+func fetchMeCmd(client *api.Client) tea.Cmd {
+	return func() tea.Msg {
+		me, err := client.Me()
+		var se *api.StatusError
+		if errors.As(err, &se) && se.Code == http.StatusNotFound {
+			return userActionErrMsg{errors.New("this server has no passwords -- needs terdut-server v0.10.2 or later")}
+		}
+		if err != nil {
+			return userActionErrMsg{err}
+		}
+		return meFetchedMsg{me: *me}
+	}
+}
+
+func setPasswordCmd(client *api.Client, user api.User, password, current string) tea.Cmd {
+	return func() tea.Msg {
+		if err := client.SetPassword(user.ID, password, current); err != nil {
+			return userActionErrMsg{err}
+		}
+		return passwordSetMsg{username: user.Username}
+	}
+}
+
 func deleteAPIKeyCmd(client *api.Client, userID, keyID int64) tea.Cmd {
 	return func() tea.Msg {
 		if err := client.DeleteAPIKey(userID, keyID); err != nil {

internal/tui/model_test.go

@@ -143,7 +143,7 @@ func TestIncidentRows(t *testing.T) {
 		{Title: "Unowned", Status: api.StatusTriggered, TriggeredAt: time.Now()},
 		{Title: "Quiet", Status: api.StatusTriggered, Severity: "info",
 			AssignedTo: "alice", SnoozedUntil: &future, TriggeredAt: time.Now()},
-	})
+	}, false)
 	if len(rows) != 3 {
 		t.Fatalf("expected 3 rows, got %d", len(rows))
 	}
@@ -159,12 +159,35 @@ func TestIncidentRows(t *testing.T) {
 	}
 }
 
+// Rows only carry a team cell when the columns have a Team header for it, or
+// every cell after it would sit under the wrong heading.
+func TestRows_TeamCellMatchesTeamColumn(t *testing.T) {
+	now := time.Now()
+	incRows := incidentRows([]api.Incident{{Title: "DiskFull", TeamName: "Ops", Status: api.StatusTriggered, TriggeredAt: now}}, true)
+	if got, want := len(incRows[0]), len(incidentColumns(120, true)); got != want {
+		t.Errorf("incident row has %d cells for %d columns", got, want)
+	}
+	if incRows[0][2] != "Ops" {
+		t.Errorf("expected the team after the title, got %v", incRows[0])
+	}
+	alRows := alertRows([]api.Alert{{Name: "DiskFull", StartsAt: now, ReceivedAt: now}}, true)
+	if got, want := len(alRows[0]), len(alertColumns(120, true)); got != want {
+		t.Errorf("alert row has %d cells for %d columns", got, want)
+	}
+	if alRows[0][1] != "—" {
+		t.Errorf("a missing team name should show an em dash, got %v", alRows[0])
+	}
+	if got, want := len(incidentRows([]api.Incident{{}}, false)[0]), len(incidentColumns(120, false)); got != want {
+		t.Errorf("incident row has %d cells for %d columns without teams", got, want)
+	}
+}
+
 func TestAlertRows_ShowIncidentLink(t *testing.T) {
 	id := int64(7)
 	rows := alertRows([]api.Alert{
 		{Name: "DiskFull", Status: "firing", IncidentID: &id},
 		{Name: "Orphan", Status: "resolved"},
-	})
+	}, false)
 	if rows[0][4] != "#7" {
 		t.Errorf("expected #7, got %q", rows[0][4])
 	}
@@ -204,31 +227,31 @@ func TestUserManageRows_ShowMissingTopic(t *testing.T) {
 // the window width.
 func TestColumnWidthsFitTheTerminal(t *testing.T) {
 	for _, width := range []int{100, 110, 140, 200} {
-		for name, cols := range map[string][]int{
-			"incident": widths(incidentColumns(width)),
-			"alert":    widths(alertColumns(width)),
+		// Five cells each, or six once a Team column is added. userManageColumns
+		// is five cells as well: username, email, topic, flags, created.
+		for name, tc := range map[string]struct {
+			cols  []table.Column
+			cells int
+		}{
+			"incident":           {incidentColumns(width, false), 5},
+			"incident with team": {incidentColumns(width, true), 6},
+			"alert":              {alertColumns(width, false), 5},
+			"alert with team":    {alertColumns(width, true), 6},
+			"user":               {userManageColumns(width), 5},
 		} {
 			sum := 0
-			for _, w := range cols {
+			for _, w := range widths(tc.cols) {
 				sum += w
 			}
-			const padding = 10 // bubbles applies Padding(0, 1) to each of five cells
+			padding := 2 * tc.cells // bubbles applies Padding(0, 1) to each cell
+			if len(tc.cols) != tc.cells {
+				t.Errorf("%s has %d columns, expected %d", name, len(tc.cols), tc.cells)
+			}
 			if sum+padding != width {
 				t.Errorf("%s columns at width %d sum to %d+%d = %d",
 					name, width, sum, padding, sum+padding)
 			}
 		}
-
-		// The users table is four cells, so its padding budget differs.
-		sum := 0
-		for _, w := range widths(userManageColumns(width)) {
-			sum += w
-		}
-		const userPadding = 8
-		if sum+userPadding != width {
-			t.Errorf("user columns at width %d sum to %d+%d = %d",
-				width, sum, userPadding, sum+userPadding)
-		}
 	}
 }
 
@@ -236,7 +259,7 @@ func TestColumnWidthsFitTheTerminal(t *testing.T) {
 // what must not happen is a negative or zero column.
 func TestColumnWidthsStayPositiveWhenNarrow(t *testing.T) {
 	for _, width := range []int{20, 40, 60} {
-		cols := append(widths(incidentColumns(width)), widths(alertColumns(width))...)
+		cols := append(widths(incidentColumns(width, true)), widths(alertColumns(width, true))...)
 		cols = append(cols, widths(userManageColumns(width))...)
 		for _, w := range cols {
 			if w < 1 {
@@ -287,6 +310,7 @@ func scheduledWeek(entries []api.ScheduleEntry) Model {
 	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
 	m.width, m.height = 120, 40
 	m.connected = true
+	m.teams = []api.Team{{ID: 1, Name: "Ops", Role: api.RoleOwner}}
 	m.activeSection = sectionSchedule
 	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
 	m.scheduleEntries = entries

internal/tui/update.go

@@ -1,6 +1,10 @@
 package tui
 
 import (
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -11,6 +15,14 @@ import (
 )
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	// A 401 from anything means the server no longer honours the session: it
+	// expired, was ended from the web UI, or the account was disabled. Whatever
+	// was being done cannot succeed, so go back to the sign-in form and say why,
+	// rather than leaving every action to fail with "server returned 401".
+	if err := msgError(msg); api.IsUnauthorized(err) && m.mode != modeLogin {
+		return m.requireLogin("your session has ended — sign in again"), forgetSessionCmd()
+	}
+
 	switch msg := msg.(type) {
 	case tea.WindowSizeMsg:
 		m.width = msg.Width
@@ -31,13 +43,55 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	// ── Dashboard messages ────────────────────────────────────────────────
 
+	case loginDoneMsg:
+		m.loggingIn = false
+		m.loginErr = ""
+		m.loginNote = ""
+		m.loginInputs[loginPassword].Reset()
+		m.blurLoginForm()
+		m.mode = modeDashboard
+		m.err = nil
+		return m, connectCmd(m.client)
+
+	case loginErrMsg:
+		m.loggingIn = false
+		m.loginErr = loginErrorText(msg.err)
+		m.loginInputs[loginPassword].Reset()
+		m.focusLogin(loginPassword)
+		return m, nil
+
+	case logoutDoneMsg:
+		return m.requireLogin("you have signed out"), nil
+
 	case connectedMsg:
+		firstConnect := len(m.teams) == 0
 		m.connected = true
 		m.err = nil
+		m.teams = msg.teams
+		m.meID = msg.me.User.ID
+		m.isAdmin = msg.me.User.IsAdmin
+		var statusCmd tea.Cmd
+		if firstConnect && m.activeTeamID == 0 && m.defaultTeam != "" {
+			if t, ok := resolveTeam(m.teams, m.defaultTeam); ok {
+				m.activeTeamID = t.ID
+			} else {
+				m.statusMsg = fmt.Sprintf("team %q not found -- showing all teams", m.defaultTeam)
+				statusCmd = clearStatusCmd()
+			}
+		}
+		m.rebuildIncidentTable()
+		m.rebuildTable()
+		m.rebuildArchivedTable()
+		var tick tea.Cmd
+		if !m.ticking {
+			m.ticking = true
+			tick = tickCmd(m.refreshInterval)
+		}
 		return m, tea.Batch(
-			tickCmd(m.refreshInterval),
-			fetchIncidentsCmd(m.client, m.incidentFilter),
+			tick,
+			fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter),
 			fetchStatsCmd(m.client),
+			statusCmd,
 		)
 
 	case connectErrMsg:
@@ -157,6 +211,17 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.rebuildUserManageTable()
 		return m, nil
 
+	case pickerReadyMsg:
+		if m.mode != modeUserPicker {
+			return m, nil // the picker was closed before the lookup came back
+		}
+		m.users = msg.users
+		m.pickerMembers = msg.members
+		m.usersLoading = false
+		m.rebuildUserPickerTable()
+		m.rebuildUserManageTable()
+		return m, nil
+
 	case apiKeyCreatedMsg:
 		m.revealedAPIKey = msg.key
 		m.mode = modeAPIKeyReveal
@@ -167,8 +232,27 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.mode = modeDashboard
 		return m, clearStatusCmd()
 
+	case meFetchedMsg:
+		if m.mode != modePasswordSet {
+			return m, nil // the form was closed before the lookup came back
+		}
+		m.pwLoading = false
+		m.pwNeedCurrent = msg.me.User.ID == m.selectedUser.ID && msg.me.HasPassword
+		m.pwFocus = pwNew
+		if m.pwNeedCurrent {
+			m.pwFocus = pwCurrent
+		}
+		m.pwInputs[m.pwFocus].Focus()
+		return m, nil
+
+	case passwordSetMsg:
+		m.statusMsg = "password set for " + msg.username + " -- their other web sessions were signed out"
+		return m, clearStatusCmd()
+
 	case userActionErrMsg:
 		m.usersLoading = false
+		m.pwLoading = false
+		m.blurPasswordForm()
 		m.statusMsg = "error: " + msg.err.Error()
 		m.mode = modeDashboard
 		return m, clearStatusCmd()
@@ -205,22 +289,32 @@ func (m Model) refreshActiveSection() tea.Cmd {
 
 	switch m.activeSection {
 	case sectionIncidents:
-		return tea.Batch(fetchIncidentsCmd(m.client, m.incidentFilter), fetchStatsCmd(m.client))
+		return tea.Batch(fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter), fetchStatsCmd(m.client))
 	case sectionAlerts:
-		return tea.Batch(fetchAlertsCmd(m.client, m.alertFilter), fetchStatsCmd(m.client))
+		return tea.Batch(fetchAlertsCmd(m.client, m.activeTeamID, m.alertFilter), fetchStatsCmd(m.client))
 	case sectionStats:
 		// Both: fetchStatsCmd feeds the Incident Response block, the other the charts.
 		return tea.Batch(fetchStatsCmd(m.client), fetchDetailStatsCmd(m.client))
 	case sectionArchived:
-		return fetchArchivedIncidentsCmd(m.client)
+		return fetchArchivedIncidentsCmd(m.client, m.activeTeamID)
 	case sectionSchedule:
-		return fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+		return m.fetchScheduleWindowCmd()
 	case sectionUsers:
 		return fetchUsersCmd(m.client)
 	}
 	return nil
 }
 
+// fetchScheduleWindowCmd reloads the schedule window for the schedule's team, or
+// does nothing when the caller belongs to none.
+func (m Model) fetchScheduleWindowCmd() tea.Cmd {
+	team, ok := m.scheduleTeam()
+	if !ok {
+		return nil
+	}
+	return fetchScheduleCmd(m.client, team.ID, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+}
+
 // routeKey passes the key to the active component then to our handler.
 func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	switch m.mode {
@@ -279,6 +373,22 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	case modeAPIKeyMenu, modeAPIKeyReveal:
 		return m.handleKey(msg)
 
+	case modeLogin:
+		var inputCmd tea.Cmd
+		if !m.loggingIn {
+			m.loginInputs[m.loginFocus], inputCmd = m.loginInputs[m.loginFocus].Update(msg)
+		}
+		m2, ourCmd := m.handleKey(msg)
+		return m2, tea.Batch(inputCmd, ourCmd)
+
+	case modePasswordSet:
+		var inputCmd tea.Cmd
+		if !m.pwLoading {
+			m.pwInputs[m.pwFocus], inputCmd = m.pwInputs[m.pwFocus].Update(msg)
+		}
+		m2, ourCmd := m.handleKey(msg)
+		return m2, tea.Batch(inputCmd, ourCmd)
+
 	default: // modeDashboard
 		if m.connected {
 			switch m.activeSection {
@@ -338,6 +448,10 @@ func (m Model) handleKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		return m.handleUserNotifyEditKey(msg)
 	case modeAPIKeyMenu:
 		return m.handleAPIKeyMenuKey(msg)
+	case modePasswordSet:
+		return m.handlePasswordKey(msg)
+	case modeLogin:
+		return m.handleLoginKey(msg)
 	case modeAPIKeyCreate:
 		return m.handleAPIKeyCreateKey(msg)
 	case modeAPIKeyReveal:
@@ -379,14 +493,27 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		case sectionIncidents:
 			m.incidentFilter = nextFilter(incidentFilters, m.incidentFilter)
 			m.loading = true
-			return m, fetchIncidentsCmd(m.client, m.incidentFilter)
+			return m, fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter)
 		case sectionAlerts:
 			m.alertFilter = nextFilter(alertFilters, m.alertFilter)
 			m.loading = true
-			return m, fetchAlertsCmd(m.client, m.alertFilter)
+			return m, fetchAlertsCmd(m.client, m.activeTeamID, m.alertFilter)
 		}
 		return m, nil
 
+	case "L":
+		if !m.connected {
+			return m, nil
+		}
+		m.statusMsg = "Signing out…"
+		return m, logoutCmd(m.client)
+
+	case "T":
+		if !m.connected || len(m.teams) == 0 {
+			return m, nil
+		}
+		return m.switchTeam()
+
 	case "enter":
 		switch m.activeSection {
 		case sectionIncidents:
@@ -419,14 +546,14 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 				m.statusMsg = "resolve the incident before archiving it"
 				return m, clearStatusCmd()
 			}
-			return m, archiveIncidentCmd(m.client, inc.ID, m.incidentFilter)
+			return m, archiveIncidentCmd(m.client, inc.ID, m.activeTeamID, m.incidentFilter)
 		case sectionArchived:
 			i := m.archivedTable.Cursor()
 			if i < 0 || i >= len(m.archivedIncidents) {
 				return m, nil
 			}
 			m.archivedLoading = true
-			return m, unarchiveIncidentCmd(m.client, m.archivedIncidents[i].ID)
+			return m, unarchiveIncidentCmd(m.client, m.archivedIncidents[i].ID, m.activeTeamID)
 		}
 		return m, nil
 
@@ -434,16 +561,18 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	case "left", "h":
 		if m.activeSection == sectionSchedule {
 			m.scheduleWindow = m.scheduleWindow.AddDate(0, 0, -7)
-			m.scheduleLoading = true
-			return m, fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+			cmd := m.fetchScheduleWindowCmd()
+			m.scheduleLoading = cmd != nil
+			return m, cmd
 		}
 		return m, nil
 
 	case "right", "l":
 		if m.activeSection == sectionSchedule {
 			m.scheduleWindow = m.scheduleWindow.AddDate(0, 0, 7)
-			m.scheduleLoading = true
-			return m, fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+			cmd := m.fetchScheduleWindowCmd()
+			m.scheduleLoading = cmd != nil
+			return m, cmd
 		}
 		return m, nil
 
@@ -451,6 +580,9 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if m.activeSection != sectionSchedule || !m.connected {
 			return m, nil
 		}
+		if !m.checkScheduleEditable() {
+			return m, clearStatusCmd()
+		}
 		m.pickerAssignWeek = false
 		return m.openUserPicker(pickerSchedule)
 
@@ -458,6 +590,9 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if m.activeSection != sectionSchedule || !m.connected {
 			return m, nil
 		}
+		if !m.checkScheduleEditable() {
+			return m, clearStatusCmd()
+		}
 		m.pickerAssignWeek = true
 		return m.openUserPicker(pickerSchedule)
 
@@ -487,6 +622,10 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			if cursor < 0 || cursor >= len(m.users) {
 				return m, nil
 			}
+			if !m.isAdmin {
+				m.statusMsg = "only administrators can delete users"
+				return m, clearStatusCmd()
+			}
 			m.selectedUser = m.users[cursor]
 			m.confirmTarget = confirmDeleteUser
 			m.mode = modeConfirm
@@ -497,6 +636,10 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if m.activeSection != sectionUsers || !m.connected {
 			return m, nil
 		}
+		if !m.isAdmin {
+			m.statusMsg = "only administrators can create users"
+			return m, clearStatusCmd()
+		}
 		m.userFormInputs[0].Reset()
 		m.userFormInputs[1].Reset()
 		m.userFormFocus = 0
@@ -514,6 +657,10 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, nil
 		}
 		m.selectedUser = m.users[cursor]
+		if !m.canManageUser(m.selectedUser) {
+			cmd := m.refuseUserAction("notification topic")
+			return m, cmd
+		}
 		// Prefilled with what they have, so editing a topic does not mean
 		// retyping it, and clearing one is a deliberate wipe.
 		m.ntfyTopicInput.SetValue(m.selectedUser.Topic())
@@ -531,20 +678,55 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, nil
 		}
 		m.selectedUser = m.users[cursor]
+		if !m.canManageUser(m.selectedUser) {
+			cmd := m.refuseUserAction("API keys")
+			return m, cmd
+		}
 		m.mode = modeAPIKeyMenu
 		return m, nil
+
+	case "p":
+		if m.activeSection != sectionUsers || !m.connected || len(m.users) == 0 {
+			return m, nil
+		}
+		cursor := m.userManageTable.Cursor()
+		if cursor >= len(m.users) {
+			return m, nil
+		}
+		m.selectedUser = m.users[cursor]
+		if !m.canManageUser(m.selectedUser) {
+			cmd := m.refuseUserAction("password")
+			return m, cmd
+		}
+		for i := range m.pwInputs {
+			m.pwInputs[i].Reset()
+			m.pwInputs[i].Blur()
+		}
+		m.pwNeedCurrent = false
+		m.pwLoading = true
+		m.mode = modePasswordSet
+		// Whether the form needs the current password depends on who the key
+		// belongs to, which the client does not otherwise know.
+		return m, fetchMeCmd(m.client)
 	}
 
 	return m, nil
 }
 
+// refuseUserAction explains a self-or-admin action declined up front, and is what
+// the status bar clears afterwards. The server refuses these with a 403 anyway.
+func (m *Model) refuseUserAction(what string) tea.Cmd {
+	m.statusMsg = "only administrators can change another user's " + what
+	return clearStatusCmd()
+}
+
 // loadSectionIfEmpty fetches a section's data the first time it is opened.
 func (m *Model) loadSectionIfEmpty() tea.Cmd {
 	switch m.activeSection {
 	case sectionAlerts:
 		if len(m.alerts) == 0 {
 			m.loading = true
-			return fetchAlertsCmd(m.client, m.alertFilter)
+			return fetchAlertsCmd(m.client, m.activeTeamID, m.alertFilter)
 		}
 	case sectionStats:
 		if !m.statsLoaded {
@@ -554,12 +736,13 @@ func (m *Model) loadSectionIfEmpty() tea.Cmd {
 	case sectionArchived:
 		if len(m.archivedIncidents) == 0 {
 			m.archivedLoading = true
-			return fetchArchivedIncidentsCmd(m.client)
+			return fetchArchivedIncidentsCmd(m.client, m.activeTeamID)
 		}
 	case sectionSchedule:
 		if len(m.scheduleDays) == 0 {
-			m.scheduleLoading = true
-			return fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+			cmd := m.fetchScheduleWindowCmd()
+			m.scheduleLoading = cmd != nil
+			return cmd
 		}
 	case sectionUsers:
 		if len(m.users) == 0 {
@@ -590,6 +773,18 @@ func (m Model) openIncident(inc api.Incident) (Model, tea.Cmd) {
 func (m Model) openUserPicker(target pickerTarget) (Model, tea.Cmd) {
 	m.pickerTarget = target
 	m.mode = modeUserPicker
+	if target == pickerSchedule {
+		// Only the team's own members can go on its rota, so who they are has to
+		// be known before anybody is offered.
+		team, ok := m.scheduleTeam()
+		if !ok {
+			m.mode = modeDashboard
+			return m, nil
+		}
+		m.pickerMembers = nil
+		m.usersLoading = true
+		return m, fetchPickerCmd(m.client, team.ID)
+	}
 	if len(m.users) == 0 {
 		m.usersLoading = true
 		return m, fetchUsersCmd(m.client)
@@ -598,6 +793,63 @@ func (m Model) openUserPicker(target pickerTarget) (Model, tea.Cmd) {
 	return m, nil
 }
 
+// switchTeam steps the active team through all teams, then each of the caller's
+// teams in turn, and reloads what depends on it. Sections that are not on screen
+// are emptied rather than fetched, so they load when next opened; the incident
+// queue is the exception because it is what the caller returns to.
+func (m Model) switchTeam() (Model, tea.Cmd) {
+	next := int64(0)
+	if m.activeTeamID == 0 {
+		next = m.teams[0].ID
+	} else {
+		for i, t := range m.teams {
+			if t.ID == m.activeTeamID && i+1 < len(m.teams) {
+				next = m.teams[i+1].ID
+			}
+		}
+	}
+	m.activeTeamID = next
+
+	m.incidents, m.alerts, m.archivedIncidents = nil, nil, nil
+	m.scheduleEntries, m.scheduleDays, m.currentOnCall = nil, nil, nil
+	m.loading = true
+	m.rebuildIncidentTable()
+	m.rebuildTable()
+	m.rebuildArchivedTable()
+	m.rebuildScheduleTable()
+
+	label := "all teams"
+	if t, ok := m.activeTeam(); ok {
+		label = t.Name
+	}
+	m.statusMsg = "Team: " + label
+
+	cmds := []tea.Cmd{clearStatusCmd()}
+	if m.activeSection != sectionIncidents {
+		cmds = append(cmds, fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter))
+	}
+	cmds = append(cmds, m.refreshActiveSection())
+	if m.activeSection == sectionSchedule {
+		m.scheduleLoading = true
+	}
+	return m, tea.Batch(cmds...)
+}
+
+// checkScheduleEditable says why a schedule change is refused, in the status
+// bar, and reports whether it may go ahead. The server enforces the same rule.
+func (m *Model) checkScheduleEditable() bool {
+	team, ok := m.scheduleTeam()
+	switch {
+	case !ok:
+		m.statusMsg = "you are not in any team"
+	case !m.canEditSchedule(team):
+		m.statusMsg = "only owners of " + team.Name + " can change its schedule"
+	default:
+		return true
+	}
+	return false
+}
+
 // nextFilter advances a filter cycle, wrapping at the end.
 func nextFilter(cycle []string, current string) string {
 	for i, f := range cycle {
@@ -681,10 +933,10 @@ func (m Model) handleIncidentDetailKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if inc.ArchivedAt != nil {
 			m.archivedLoading = true
 			m.mode = modeDashboard
-			return m, unarchiveIncidentCmd(m.client, inc.ID)
+			return m, unarchiveIncidentCmd(m.client, inc.ID, m.activeTeamID)
 		}
 		m.mode = modeDashboard
-		return m, archiveIncidentCmd(m.client, inc.ID, m.incidentFilter)
+		return m, archiveIncidentCmd(m.client, inc.ID, m.activeTeamID, m.incidentFilter)
 
 	case "c":
 		m.mode = modeNote
@@ -844,7 +1096,8 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeDashboard
 		m.pendingDeleteEntry = nil
 		m.scheduleLoading = true
-		return m, deleteScheduleEntryCmd(m.client, entry.ID,
+		team, _ := m.scheduleTeam()
+		return m, deleteScheduleEntryCmd(m.client, team.ID, entry.ID,
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 
 	case confirmDeleteUser:
@@ -861,7 +1114,8 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, nil
 		}
 		m.scheduleLoading = true
-		return m, assignScheduleCmd(m.client, p.userID, p.dates, true,
+		team, _ := m.scheduleTeam()
+		return m, assignScheduleCmd(m.client, team.ID, p.userID, p.dates, true,
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
@@ -882,10 +1136,11 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 
 	case "enter":
 		cursor := m.userPickerTable.Cursor()
-		if cursor < 0 || cursor >= len(m.users) {
+		pickable := m.pickerUsers()
+		if cursor < 0 || cursor >= len(pickable) {
 			return m, nil
 		}
-		user := m.users[cursor]
+		user := pickable[cursor]
 
 		if m.pickerTarget == pickerIncidentAssignee {
 			m.mode = modeIncidentDetail
@@ -935,7 +1190,8 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		// Nobody else loses anything, but the server rejects any date that
 		// already exists — including days this same person already holds, which
 		// is a no-op worth letting through silently.
-		return m, assignScheduleCmd(m.client, user.ID, dates, m.scheduleOccupied(dates),
+		team, _ := m.scheduleTeam()
+		return m, assignScheduleCmd(m.client, team.ID, user.ID, dates, m.scheduleOccupied(dates),
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
@@ -1127,3 +1383,185 @@ func (m Model) handleAPIKeyRevokeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 
 	return m, nil
 }
+
+// ── Set password ──────────────────────────────────────────────────────────────
+
+// pwFields is the set-password form's fields in tab order.
+func (m Model) pwFields() []int {
+	if m.pwNeedCurrent {
+		return []int{pwCurrent, pwNew, pwRepeat}
+	}
+	return []int{pwNew, pwRepeat}
+}
+
+func (m *Model) blurPasswordForm() {
+	for i := range m.pwInputs {
+		m.pwInputs[i].Blur()
+	}
+}
+
+func (m Model) handlePasswordKey(msg tea.KeyMsg) (Model, tea.Cmd) {
+	switch msg.String() {
+	case "esc":
+		m.blurPasswordForm()
+		m.pwLoading = false
+		m.mode = modeDashboard
+		return m, nil
+	}
+	if m.pwLoading {
+		return m, nil
+	}
+
+	switch msg.String() {
+	case "tab", "shift+tab":
+		fields := m.pwFields()
+		i := slices.Index(fields, m.pwFocus)
+		step := 1
+		if msg.String() == "shift+tab" {
+			step = len(fields) - 1
+		}
+		m.pwInputs[m.pwFocus].Blur()
+		m.pwFocus = fields[(i+step)%len(fields)]
+		m.pwInputs[m.pwFocus].Focus()
+		return m, nil
+
+	case "enter":
+		password := m.pwInputs[pwNew].Value()
+		switch {
+		case m.pwNeedCurrent && m.pwInputs[pwCurrent].Value() == "":
+			m.statusMsg = "enter your current password"
+			return m, clearStatusCmd()
+		case len(password) < minPasswordLen:
+			m.statusMsg = fmt.Sprintf("the password must be at least %d characters", minPasswordLen)
+			return m, clearStatusCmd()
+		case password != m.pwInputs[pwRepeat].Value():
+			m.statusMsg = "the two new passwords do not match"
+			return m, clearStatusCmd()
+		}
+		current := ""
+		if m.pwNeedCurrent {
+			current = m.pwInputs[pwCurrent].Value()
+		}
+		m.blurPasswordForm()
+		m.mode = modeDashboard
+		m.statusMsg = "Setting password…"
+		return m, setPasswordCmd(m.client, m.selectedUser, password, current)
+	}
+	return m, nil
+}
+
+// ── Sign in ───────────────────────────────────────────────────────────────────
+
+// msgError digs the error out of the messages that carry one, so the 401 check
+// in Update covers them all in one place.
+func msgError(msg tea.Msg) error {
+	switch msg := msg.(type) {
+	case connectErrMsg:
+		return msg.err
+	case fetchDataErrMsg:
+		return msg.err
+	case detailErrMsg:
+		return msg.err
+	case actionErrMsg:
+		return msg.err
+	case detailStatsErrMsg:
+		return msg.err
+	case scheduleFetchErrMsg:
+		return msg.err
+	case scheduleActionErrMsg:
+		return msg.err
+	case userActionErrMsg:
+		return msg.err
+	}
+	return nil
+}
+
+// requireLogin returns to the sign-in form with everything the previous session
+// loaded dropped, so a different account never sees the last one's incidents.
+func (m Model) requireLogin(note string) Model {
+	name := m.loginInputs[loginUsername].Value()
+	fresh := NewModel(m.client, m.serverURL, m.refreshInterval, m.theme)
+	fresh.width, fresh.height = m.width, m.height
+	fresh.defaultTeam = m.defaultTeam
+	fresh.ticking = m.ticking
+	fresh.mode = modeLogin
+	fresh.loginInputs[loginUsername].SetValue(name)
+	fresh.loginNote = note
+	fresh.focusLogin(loginUsername)
+	if name != "" {
+		fresh.focusLogin(loginPassword)
+	}
+	fresh.rebuildIncidentTable()
+	fresh.rebuildTable()
+	fresh.rebuildArchivedTable()
+	fresh.rebuildScheduleTable()
+	fresh.rebuildUserPickerTable()
+	fresh.rebuildUserManageTable()
+	return fresh
+}
+
+func (m *Model) blurLoginForm() {
+	for i := range m.loginInputs {
+		m.loginInputs[i].Blur()
+	}
+}
+
+func (m *Model) focusLogin(field int) {
+	m.blurLoginForm()
+	m.loginFocus = field
+	m.loginInputs[field].Focus()
+}
+
+// loginErrorText turns a failed sign-in into something to act on. The server
+// answers a wrong password, an unknown user and an account with no password with
+// the same 401, so the last one has to be named here or it reads as a typo.
+func loginErrorText(err error) string {
+	var se *api.StatusError
+	if errors.As(err, &se) {
+		switch se.Code {
+		case http.StatusUnauthorized:
+			return "invalid username or password — an account with no password cannot sign in; set one in the web UI first"
+		case http.StatusTooManyRequests:
+			return "too many attempts — wait a few minutes and try again"
+		}
+	}
+	return err.Error()
+}
+
+func (m Model) handleLoginKey(msg tea.KeyMsg) (Model, tea.Cmd) {
+	switch msg.String() {
+	case "ctrl+c", "esc":
+		return m, tea.Quit
+	}
+	if m.loggingIn {
+		return m, nil
+	}
+
+	switch msg.String() {
+	case "tab", "shift+tab", "down", "up":
+		next := loginPassword
+		if m.loginFocus == loginPassword {
+			next = loginUsername
+		}
+		m.focusLogin(next)
+		return m, nil
+
+	case "enter":
+		username := strings.TrimSpace(m.loginInputs[loginUsername].Value())
+		password := m.loginInputs[loginPassword].Value()
+		switch {
+		case username == "":
+			m.loginErr = "enter your username"
+			m.focusLogin(loginUsername)
+			return m, nil
+		case password == "":
+			m.loginErr = "enter your password"
+			m.focusLogin(loginPassword)
+			return m, nil
+		}
+		m.loggingIn = true
+		m.loginErr = ""
+		return m, loginCmd(m.client, m.serverURL, username, password)
+	}
+	return m, nil
+}

internal/tui/update_test.go

@@ -35,6 +35,7 @@ func sized() Model {
 	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
 	m.width, m.height = 120, 40
 	m.connected = true
+	m.isAdmin = true // most handlers are being tested for what they do, not who may
 	return m
 }
 
@@ -320,6 +321,8 @@ func pickingOnCall(entries []api.ScheduleEntry, dayIndex int, week bool) Model {
 		{ID: 1, Username: "niklas", Email: "n@example.com"},
 		{ID: 2, Username: "alex", Email: "a@example.com"},
 	}
+	m.pickerTarget = pickerSchedule
+	m.pickerMembers = map[int64]bool{1: true, 2: true}
 	m.rebuildUserPickerTable()
 	m.scheduleTable.SetCursor(dayIndex)
 	m.pickerAssignWeek = week
@@ -693,6 +696,8 @@ func containsAll(s string, subs ...string) bool {
 func TestSchedule_AssignWeekAfterStartupSizingDoesNotPanic(t *testing.T) {
 	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
 	m.connected = true
+	m.isAdmin = true
+	m.teams = []api.Team{{ID: 1, Name: "Ops", Role: api.RoleOwner}}
 	m.activeSection = sectionSchedule
 	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
 
@@ -718,9 +723,253 @@ func TestSchedule_AssignWeekAfterStartupSizingDoesNotPanic(t *testing.T) {
 	if m.mode != modeUserPicker {
 		t.Fatalf("W did not open the user picker, got mode %v", m.mode)
 	}
+	// The picker waits for the team's members before offering anybody.
+	next, _ = m.Update(pickerReadyMsg{
+		users:   []api.User{{ID: 1, Username: "niklas", Email: "n@example.com"}},
+		members: map[int64]bool{1: true},
+	})
+	m = next.(Model)
 	m, _ = press(t, m, "enter") // panicked here
 
 	if m.mode == modeUserPicker {
 		t.Fatal("enter left the picker open; the assignment never went anywhere")
 	}
 }
+
+// ── Teams ─────────────────────────────────────────────────────────────────
+
+func twoTeams() []api.Team {
+	return []api.Team{
+		{ID: 1, Name: "Ops", Role: api.RoleOwner},
+		{ID: 2, Name: "Dev", Role: api.RoleMember},
+	}
+}
+
+func TestConnected_LoadsTeamsAndWhoIAm(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	next, _ := m.Update(connectedMsg{
+		teams: twoTeams(),
+		me:    api.Me{User: api.User{ID: 7, IsAdmin: true}},
+	})
+	m = next.(Model)
+	if len(m.teams) != 2 || m.meID != 7 || !m.isAdmin {
+		t.Errorf("expected teams, id and admin flag to be kept, got %+v %d %v", m.teams, m.meID, m.isAdmin)
+	}
+	if m.activeTeamID != 0 {
+		t.Errorf("with no default team every team shows, got active %d", m.activeTeamID)
+	}
+}
+
+func TestConnected_DefaultTeamFromConfig(t *testing.T) {
+	for _, want := range []string{"dev", "2"} { // by name, any case, or by id
+		m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark).WithDefaultTeam(want)
+		next, _ := m.Update(connectedMsg{teams: twoTeams()})
+		if got := next.(Model).activeTeamID; got != 2 {
+			t.Errorf("default team %q: expected team 2, got %d", want, got)
+		}
+	}
+
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark).WithDefaultTeam("nope")
+	next, cmd := m.Update(connectedMsg{teams: twoTeams()})
+	m = next.(Model)
+	if m.activeTeamID != 0 || !strings.Contains(m.statusMsg, "nope") {
+		t.Errorf("an unknown default should fall back to all teams and say so, got %d %q",
+			m.activeTeamID, m.statusMsg)
+	}
+	if cmd == nil {
+		t.Error("expected the initial fetches to still be issued")
+	}
+}
+
+func TestSwitchTeam_CyclesAllThenEachTeam(t *testing.T) {
+	m := sized()
+	m.teams = twoTeams()
+	var seen []int64
+	for i := 0; i < 4; i++ {
+		var cmd tea.Cmd
+		m, cmd = press(t, m, "T")
+		if cmd == nil {
+			t.Fatal("switching team should reload")
+		}
+		seen = append(seen, m.activeTeamID)
+	}
+	want := []int64{1, 2, 0, 1}
+	for i := range want {
+		if seen[i] != want[i] {
+			t.Fatalf("expected the cycle %v, got %v", want, seen)
+		}
+	}
+}
+
+func TestSwitchTeam_ClearsRowsFromTheOtherTeam(t *testing.T) {
+	m := sized()
+	m.teams = twoTeams()
+	m.incidents = []api.Incident{{ID: 1, Title: "old", TeamName: "Ops"}}
+	m.rebuildIncidentTable()
+	m, _ = press(t, m, "T")
+	if len(m.incidents) != 0 {
+		t.Errorf("the previous team's incidents must not linger, got %d", len(m.incidents))
+	}
+	if !strings.Contains(m.statusMsg, "Ops") {
+		t.Errorf("expected the status bar to name the team, got %q", m.statusMsg)
+	}
+}
+
+func TestSwitchTeam_NoTeamsDoesNothing(t *testing.T) {
+	m, cmd := press(t, sized(), "T")
+	if cmd != nil || m.activeTeamID != 0 {
+		t.Errorf("without teams T has nothing to switch to")
+	}
+}
+
+func TestScheduleTeam(t *testing.T) {
+	m := sized()
+	if _, ok := m.scheduleTeam(); ok {
+		t.Error("no teams means no schedule")
+	}
+	m.teams = []api.Team{{ID: 2, Name: "Dev", Role: api.RoleMember}, {ID: 1, Name: "Ops", Role: api.RoleOwner}}
+	if tm, _ := m.scheduleTeam(); tm.ID != 1 {
+		t.Errorf("with all teams showing the one the caller owns is used, got %d", tm.ID)
+	}
+	m.activeTeamID = 2
+	if tm, _ := m.scheduleTeam(); tm.ID != 2 {
+		t.Errorf("the active team wins, got %d", tm.ID)
+	}
+}
+
+func TestSchedule_OnlyOwnersAndAdminsEdit(t *testing.T) {
+	m := scheduledWeek(nil)
+	m.isAdmin = false
+	m.teams = []api.Team{{ID: 1, Name: "Ops", Role: api.RoleMember}}
+	m, cmd := press(t, m, "+")
+	if m.mode == modeUserPicker {
+		t.Fatal("a plain member must not get as far as the picker")
+	}
+	if !strings.Contains(m.statusMsg, "owners of Ops") {
+		t.Errorf("expected the reason in the status bar, got %q", m.statusMsg)
+	}
+	if cmd == nil {
+		t.Error("the message should clear itself")
+	}
+
+	m.isAdmin = true // administrators may edit any team's rota
+	m.statusMsg = ""
+	m, _ = press(t, m, "+")
+	if m.mode != modeUserPicker {
+		t.Errorf("an administrator should reach the picker, got mode %v", m.mode)
+	}
+}
+
+// The picker fetches the team's members, and offers nobody until they arrive:
+// the server answers 404 for anyone else.
+func TestSchedulePicker_OffersOnlyTeamMembers(t *testing.T) {
+	m := scheduledWeek(nil)
+	m, cmd := press(t, m, "+")
+	if cmd == nil || !m.usersLoading {
+		t.Fatal("opening the picker should start loading the members")
+	}
+	if got := len(m.pickerUsers()); got != 0 {
+		t.Errorf("nobody should be offered before the members are known, got %d", got)
+	}
+
+	disabled := time.Now()
+	next, _ := m.Update(pickerReadyMsg{
+		users: []api.User{
+			{ID: 1, Username: "niklas"},
+			{ID: 2, Username: "outsider"},
+			{ID: 3, Username: "gone", DisabledAt: &disabled},
+		},
+		members: map[int64]bool{1: true, 3: true},
+	})
+	m = next.(Model)
+	got := m.pickerUsers()
+	if len(got) != 1 || got[0].Username != "niklas" {
+		t.Errorf("expected only the enabled member, got %+v", got)
+	}
+	if rows := m.userPickerTable.Rows(); len(rows) != 1 {
+		t.Errorf("the table should match, got %d rows", len(rows))
+	}
+}
+
+func TestUsers_NonAdminsCannotCreateOrDelete(t *testing.T) {
+	m := threeUsers()
+	m.isAdmin = false
+	m.meID = 1
+	m, _ = press(t, m, "n")
+	if m.mode != modeDashboard || !strings.Contains(m.statusMsg, "administrators") {
+		t.Errorf("n should be refused with a reason, got mode %v %q", m.mode, m.statusMsg)
+	}
+	m, _ = press(t, m, "d")
+	if m.mode != modeDashboard {
+		t.Errorf("d should not ask to delete for a non-admin, got mode %v", m.mode)
+	}
+}
+
+func TestUsers_NonAdminManagesOnlyThemselves(t *testing.T) {
+	m := threeUsers() // cursor on erik, id 3
+	m.isAdmin = false
+	m.meID = 1
+	for _, key := range []string{"t", "k", "p"} {
+		next, _ := press(t, m, key)
+		if next.mode != modeDashboard {
+			t.Errorf("%s on somebody else's row should be refused, got mode %v", key, next.mode)
+		}
+		if !strings.Contains(next.statusMsg, "another user's") {
+			t.Errorf("%s: expected the reason, got %q", key, next.statusMsg)
+		}
+	}
+
+	m.userManageTable.SetCursor(0) // niklas, id 1: themselves
+	if next, _ := press(t, m, "k"); next.mode != modeAPIKeyMenu {
+		t.Errorf("a user may manage their own keys, got mode %v", next.mode)
+	}
+}
+
+func TestUserFlags(t *testing.T) {
+	now := time.Now()
+	cases := []struct {
+		u    api.User
+		want string
+	}{
+		{api.User{}, "—"},
+		{api.User{IsAdmin: true}, "admin"},
+		{api.User{DisabledAt: &now}, "disabled"},
+		{api.User{IsAdmin: true, DisabledAt: &now}, "admin,disabled"},
+	}
+	for _, c := range cases {
+		if got := userFlags(c.u); got != c.want {
+			t.Errorf("userFlags(%+v) = %q, want %q", c.u, got, c.want)
+		}
+	}
+}
+
+// Rebuilding a list on every refresh must not send the cursor back to the top.
+func TestRefresh_KeepsTheCursor(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{{ID: 1}, {ID: 2}, {ID: 3}}
+	m.rebuildIncidentTable()
+	m.incidentTable.SetCursor(2)
+	next, _ := m.Update(incidentsFetchedMsg{incidents: m.incidents})
+	if got := next.(Model).incidentTable.Cursor(); got != 2 {
+		t.Errorf("expected the cursor to stay on row 2, got %d", got)
+	}
+}
+
+// The Team column comes and goes as the team switches, and the table must
+// survive its column count changing under rows that are already loaded.
+func TestTeamColumn_AppearsWithoutPanicking(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{{ID: 1, Title: "a", TeamName: "Ops"}}
+	m.rebuildIncidentTable()
+	m.teams = twoTeams()
+	m.rebuildIncidentTable() // five columns become six over a five-cell row
+	if got := len(m.incidentTable.Columns()); got != 6 {
+		t.Errorf("expected a Team column across two teams, got %d columns", got)
+	}
+	m.activeTeamID = 1
+	m.rebuildIncidentTable()
+	if got := len(m.incidentTable.Columns()); got != 5 {
+		t.Errorf("expected the Team column to go when one team is chosen, got %d", got)
+	}
+}

internal/tui/users_test.go

@@ -0,0 +1,204 @@
+package tui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// threeUsers is the Users section with the cursor on the last of three users.
+func threeUsers() Model {
+	m := onUsers([]api.User{
+		{ID: 1, Username: "niklas"},
+		{ID: 2, Username: "anna"},
+		{ID: 3, Username: "erik"},
+	})
+	m.userManageTable.SetCursor(2)
+	return m
+}
+
+// The table used to see k before the section did, take it as "up", and the
+// handler then opened API keys for the user above the one selected.
+func TestUsers_APIKeysOpenForTheSelectedUser(t *testing.T) {
+	m, _ := press(t, threeUsers(), "k")
+	if m.mode != modeAPIKeyMenu {
+		t.Fatalf("expected the API key menu, got mode %v", m.mode)
+	}
+	if m.selectedUser.Username != "erik" {
+		t.Errorf("API keys opened for %s, want erik", m.selectedUser.Username)
+	}
+}
+
+// Same collision with d, which the table read as half a page down: the delete
+// confirmation named a different user than the one under the cursor.
+func TestUsers_DeleteTargetsTheSelectedUser(t *testing.T) {
+	m := threeUsers()
+	m.userManageTable.SetCursor(0)
+	m, _ = press(t, m, "d")
+	if m.mode != modeConfirm || m.selectedUser.Username != "niklas" {
+		t.Errorf("delete asked about %q in mode %v, want niklas", m.selectedUser.Username, m.mode)
+	}
+}
+
+func TestSchedule_DeleteTargetsTheSelectedDay(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionSchedule
+	m.scheduleEntries = []api.ScheduleEntry{
+		{ID: 10, UserID: 1, Username: "niklas", Date: m.scheduleWindow.Format("2006-01-02")},
+		{ID: 11, UserID: 2, Username: "anna", Date: m.scheduleWindow.AddDate(0, 0, 1).Format("2006-01-02")},
+	}
+	m.scheduleDays = buildScheduleDays(m.scheduleWindow, m.scheduleEntries)
+	m.rebuildScheduleTable()
+	m.scheduleTable.SetCursor(0)
+	m, _ = press(t, m, "d")
+	if m.pendingDeleteEntry == nil || m.pendingDeleteEntry.ID != 10 {
+		t.Errorf("schedule delete targeted %+v, want entry 10", m.pendingDeleteEntry)
+	}
+}
+
+// f cycles the filter; it must not also page the cursor down.
+func TestFilter_DoesNotMoveTheCursor(t *testing.T) {
+	m := sized()
+	m.incidents = make([]api.Incident, 40)
+	for i := range m.incidents {
+		m.incidents[i] = api.Incident{ID: int64(i + 1), Title: "x", Status: api.StatusTriggered, TriggeredAt: time.Now()}
+	}
+	m.rebuildIncidentTable()
+	m, _ = press(t, m, "f")
+	if c := m.incidentTable.Cursor(); c != 0 {
+		t.Errorf("f moved the cursor to %d", c)
+	}
+}
+
+// The arrow keys still move the users table, now that k is an action there.
+func TestUsers_ArrowKeysStillNavigate(t *testing.T) {
+	m := threeUsers()
+	next, _ := m.Update(keyUp())
+	if c := next.(Model).userManageTable.Cursor(); c != 1 {
+		t.Errorf("up arrow left the cursor on %d, want 1", c)
+	}
+}
+
+func TestPassword_OpensForTheSelectedUserAndLooksUpWhoIAm(t *testing.T) {
+	m, cmd := press(t, threeUsers(), "p")
+	if m.mode != modePasswordSet || m.selectedUser.Username != "erik" {
+		t.Fatalf("expected the password form for erik, got mode %v for %q", m.mode, m.selectedUser.Username)
+	}
+	if !m.pwLoading || cmd == nil {
+		t.Error("the form should look up /api/me before it is usable")
+	}
+	if !strings.Contains(m.View(), "Checking who this key belongs to") {
+		t.Error("the form should say it is waiting")
+	}
+}
+
+func TestPassword_SomeoneElseNeedsNoCurrentPassword(t *testing.T) {
+	m, _ := press(t, threeUsers(), "p")
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}, HasPassword: true}})
+	m = next.(Model)
+	if m.pwNeedCurrent || m.pwFocus != pwNew {
+		t.Errorf("setting erik's password as niklas should not ask for a current one")
+	}
+	if strings.Contains(m.View(), "Current password") {
+		t.Error("the current-password field should be hidden")
+	}
+}
+
+func TestPassword_OwnExistingPasswordNeedsCurrent(t *testing.T) {
+	m := threeUsers()
+	m.userManageTable.SetCursor(0)
+	m, _ = press(t, m, "p")
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}, HasPassword: true}})
+	m = next.(Model)
+	if !m.pwNeedCurrent || m.pwFocus != pwCurrent {
+		t.Fatal("changing your own existing password should ask for the current one first")
+	}
+	m = typeInto(t, m, "correct horse")
+	m, _ = press(t, m, "tab")
+	m = typeInto(t, m, "a brand new secret")
+	m, _ = press(t, m, "tab")
+	m = typeInto(t, m, "a brand new secret")
+	m, cmd := press(t, m, "enter")
+	if cmd == nil || m.mode != modeDashboard {
+		t.Errorf("a complete form should submit (mode %v)", m.mode)
+	}
+}
+
+func TestPassword_OwnFirstPasswordNeedsNoCurrent(t *testing.T) {
+	m := threeUsers()
+	m.userManageTable.SetCursor(0)
+	m, _ = press(t, m, "p")
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}, HasPassword: false}})
+	if next.(Model).pwNeedCurrent {
+		t.Error("there is no current password to ask for yet")
+	}
+}
+
+func TestPassword_RejectsBeforeSending(t *testing.T) {
+	cases := []struct{ name, pw, repeat, want string }{
+		{"too short", "short", "short", "at least 10"},
+		{"mismatch", "a brand new secret", "a different secret", "do not match"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			m, _ := press(t, threeUsers(), "p")
+			next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}}})
+			m = typeInto(t, next.(Model), tc.pw)
+			m, _ = press(t, m, "tab")
+			m = typeInto(t, m, tc.repeat)
+			m, cmd := press(t, m, "enter")
+			if m.mode != modePasswordSet {
+				t.Error("the form should stay open")
+			}
+			if !strings.Contains(m.statusMsg, tc.want) {
+				t.Errorf("status %q should mention %q", m.statusMsg, tc.want)
+			}
+			if cmd == nil {
+				return
+			}
+			// Only the clear-status timer may be scheduled, never a request.
+			if _, ok := cmd().(clearStatusMsg); !ok {
+				t.Error("nothing should be sent to the server")
+			}
+		})
+	}
+}
+
+func TestPassword_EscapeCancels(t *testing.T) {
+	m, _ := press(t, threeUsers(), "p")
+	m, _ = press(t, m, "esc")
+	if m.mode != modeDashboard {
+		t.Errorf("esc should close the form, got mode %v", m.mode)
+	}
+	// A lookup arriving after the form closed must not reopen anything.
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 3}, HasPassword: true}})
+	if next.(Model).mode != modeDashboard {
+		t.Error("a late /api/me answer reopened the form")
+	}
+}
+
+func TestPassword_ErrorClosesTheFormWithAMessage(t *testing.T) {
+	m, _ := press(t, threeUsers(), "p")
+	next, _ := m.Update(userActionErrMsg{errTest("server returned 403: current password is incorrect")})
+	m = next.(Model)
+	if m.mode != modeDashboard || !strings.Contains(m.statusMsg, "current password is incorrect") {
+		t.Errorf("expected the server's message on the dashboard, got %q in mode %v", m.statusMsg, m.mode)
+	}
+}
+
+func typeInto(t *testing.T, m Model, s string) Model {
+	t.Helper()
+	next, _ := m.Update(runes(s))
+	return next.(Model)
+}
+
+func runes(s string) tea.KeyMsg { return tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(s)} }
+
+func keyUp() tea.KeyMsg { return tea.KeyMsg{Type: tea.KeyUp} }
+
+type errTest string
+
+func (e errTest) Error() string { return string(e) }

internal/tui/view.go

@@ -27,10 +27,40 @@ func (m Model) View() string {
 
 func (m Model) renderHeader() string {
 	title := m.styles.Header.Render("terdut-tui")
+	if len(m.teams) > 0 {
+		title += m.styles.Muted.Render("  team: " + m.activeTeamLabel())
+	}
 	right := m.styles.Muted.Render(m.serverURL)
 	return spread(title, right, m.width)
 }
 
+// renderLogin is the sign-in form. It is the whole body: nothing else is shown
+// until the server has accepted a session.
+func (m Model) renderLogin() string {
+	var b strings.Builder
+	b.WriteString("\n  " + m.styles.Bold.Render("Sign in to "+m.serverURL) + "\n\n")
+	if m.loginNote != "" {
+		b.WriteString(m.styles.Status.Render("  "+m.loginNote) + "\n\n")
+	}
+	b.WriteString("  " + m.styles.Header.Render("Username: ") + m.loginInputs[loginUsername].View() + "\n")
+	b.WriteString("  " + m.styles.Header.Render("Password: ") + m.loginInputs[loginPassword].View() + "\n\n")
+	switch {
+	case m.loggingIn:
+		b.WriteString(m.styles.Muted.Render("  Signing in…") + "\n")
+	case m.loginErr != "":
+		b.WriteString(m.styles.Error.Render("  "+m.loginErr) + "\n")
+	}
+	return b.String()
+}
+
+// activeTeamLabel names what the lists are narrowed to.
+func (m Model) activeTeamLabel() string {
+	if t, ok := m.activeTeam(); ok {
+		return t.Name
+	}
+	return "all"
+}
+
 func (m Model) renderTabs() string {
 	var tabs []string
 	for i, name := range sectionNames {
@@ -45,6 +75,9 @@ func (m Model) renderTabs() string {
 }
 
 func (m Model) renderBody() string {
+	if m.mode == modeLogin {
+		return m.renderLogin()
+	}
 	if m.err != nil {
 		return "\n" + m.styles.Error.Render(fmt.Sprintf("  Error: %v", m.err)) +
 			"\n" + m.styles.Muted.Render("  Press r to retry.")
@@ -83,6 +116,8 @@ func (m Model) renderBody() string {
 		return m.renderAPIKeyReveal()
 	case modeAPIKeyRevokeByID:
 		return m.renderAPIKeyRevokeByID()
+	case modePasswordSet:
+		return m.renderPasswordSet()
 	default:
 		return m.renderDashboard()
 	}
@@ -144,25 +179,39 @@ func (m Model) renderFooter() string {
 	case modeAPIKeyRevokeByID:
 		return withStatus("  enter·revoke  esc·back")
 
+	case modePasswordSet:
+		return withStatus("  tab·next field  enter·set password  esc·cancel")
+
+	case modeLogin:
+		return "\n" + m.styles.Footer.Render("  tab·next field  enter·sign in  esc·quit")
+
 	default:
 		switch m.activeSection {
 		case sectionIncidents:
-			return withStatus("  enter·detail  x·archive  f·filter  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  x·archive  f·filter  " + m.teamHint() + "r·refresh  tab·section  L·sign out  q·quit")
 		case sectionAlerts:
-			return withStatus("  enter·detail  f·filter  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  f·filter  " + m.teamHint() + "r·refresh  tab·section  q·quit")
 		case sectionStats:
 			return withStatus("  ↑/↓·scroll  r·refresh  tab·section  q·quit")
 		case sectionArchived:
-			return withStatus("  enter·detail  x·unarchive  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  x·unarchive  " + m.teamHint() + "r·refresh  tab·section  q·quit")
 		case sectionSchedule:
-			return withStatus("  +·assign day  W·assign week  d·del  ←/→·shift week  tab·section  r·refresh  q·quit")
+			return withStatus("  +·assign day  W·assign week  d·del  ←/→·shift week  " + m.teamHint() + "tab·section  r·refresh  q·quit")
 		case sectionUsers:
-			return withStatus("  n·new user  t·topic  d·delete  k·API keys  r·refresh  tab·section  q·quit")
+			return withStatus("  n·new user  t·topic  d·delete  k·API keys  p·password  r·refresh  L·sign out  q·quit")
 		}
 		return "\n" + m.styles.Footer.Render(m.help.ShortHelpView(m.keys.ShortHelp()))
 	}
 }
 
+// teamHint is the footer's team-switch key, shown only when there is a choice.
+func (m Model) teamHint() string {
+	if len(m.teams) > 1 {
+		return "T·team  "
+	}
+	return ""
+}
+
 func (m Model) confirmPrompt() string {
 	switch m.confirmTarget {
 	case confirmDeleteNote:
@@ -327,23 +376,41 @@ func (m Model) renderSchedule() string {
 		return "\n" + m.styles.Muted.Render("  Loading schedule…")
 	}
 
+	team, ok := m.scheduleTeam()
+	if !ok {
+		return "\n" + m.styles.Muted.Render("  You are not in any team, so there is no schedule to show.")
+	}
+
 	var onCallLine string
-	if m.currentOnCall != nil {
-		onCallLine = fmt.Sprintf("  On-call today: %s",
-			m.styles.AlertName.Render(m.currentOnCall.Username))
+	if len(m.currentOnCall) > 0 {
+		onCallLine = "  On-call today: " + m.styles.AlertName.Render(m.onCallNames())
 	} else {
 		onCallLine = m.styles.Muted.Render("  On-call today: nobody scheduled")
 	}
 
 	from := m.scheduleWindow
 	to := m.scheduleWindow.AddDate(0, 0, 6)
-	windowLabel := m.styles.Muted.Render(fmt.Sprintf("  %s — %s",
-		from.Format("Jan 02"), to.Format("Jan 02, 2006")))
+	windowLabel := m.styles.Muted.Render(fmt.Sprintf("  %s: %s — %s",
+		team.Name, from.Format("Jan 02"), to.Format("Jan 02, 2006")))
 
 	header := "\n" + spread(onCallLine, windowLabel, m.width) + "\n"
 	return header + m.scheduleTable.View()
 }
 
+// onCallNames lists who is on call today. With several teams each name carries
+// its team, since one person per team is on call and "alice, bob" alone would
+// not say whose.
+func (m Model) onCallNames() string {
+	parts := make([]string, len(m.currentOnCall))
+	for i, e := range m.currentOnCall {
+		parts[i] = e.Username
+		if len(m.teams) > 1 && e.TeamName != "" {
+			parts[i] += " (" + e.TeamName + ")"
+		}
+	}
+	return strings.Join(parts, ", ")
+}
+
 func (m Model) renderUserPicker() string {
 	if m.usersLoading {
 		return "\n" + m.styles.Muted.Render("  Loading users…")
@@ -436,6 +503,9 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 	b.WriteString("\n  " + title + strings.Repeat(" ", gap) + status + "\n\n")
 
 	// Timing and ownership
+	if inc.TeamName != "" {
+		b.WriteString(fmt.Sprintf("  Team:       %s\n", inc.TeamName))
+	}
 	b.WriteString(fmt.Sprintf("  Triggered:  %s  (%s)\n",
 		inc.TriggeredAt.UTC().Format("2006-01-02 15:04 UTC"), humanAgo(now, inc.TriggeredAt)))
 
@@ -456,6 +526,10 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 		b.WriteString(line(s.Muted, "  Acked:      not acknowledged"))
 	}
 
+	if inc.EscalationLevel > 0 {
+		b.WriteString(line(s.Snoozed, fmt.Sprintf("  Escalation: level %d", inc.EscalationLevel)))
+	}
+
 	if inc.IsSnoozed() {
 		b.WriteString(line(s.Snoozed, fmt.Sprintf("  Snoozed:    until %s  (%s)",
 			inc.SnoozedUntil.UTC().Format("2006-01-02 15:04 UTC"), humanUntil(now, *inc.SnoozedUntil))))
@@ -598,6 +672,8 @@ func eventLabel(e api.IncidentEvent) string {
 		// the only thing that says why nobody's phone rang.
 		return truncate(fmt.Sprintf("  Notification to %s failed · %s",
 			notifiedTarget(who), e.Detail), 52)
+	case api.EventDeadmanSilent:
+		return "  Dead man's switch went silent"
 	default:
 		label := "  " + e.Type
 		if e.Detail != "" {
@@ -810,6 +886,28 @@ func (m Model) renderUserNotifyEdit() string {
 	return header + "\n" + hint + "\n" + label + m.ntfyTopicInput.View() + "\n"
 }
 
+func (m Model) renderPasswordSet() string {
+	header := fmt.Sprintf("\n  Web UI password for %s\n\n", m.styles.Bold.Render(m.selectedUser.Username))
+	if m.pwLoading {
+		return header + line(m.styles.Muted, "  Checking who this key belongs to…")
+	}
+	labels := [pwFieldCount]string{
+		pwCurrent: "  Current password:  ",
+		pwNew:     "  New password:      ",
+		pwRepeat:  "  Repeat:            ",
+	}
+	var form string
+	for _, f := range m.pwFields() {
+		label := labels[f]
+		if f == m.pwFocus {
+			label = m.styles.Selected.Render(label)
+		}
+		form += label + m.pwInputs[f].View() + "\n"
+	}
+	hint := fmt.Sprintf("  At least %d characters. Setting it signs %s out of every other\n  web UI session. API keys are not affected.", minPasswordLen, m.selectedUser.Username)
+	return header + form + "\n" + line(m.styles.Muted, hint)
+}
+
 func (m Model) renderAPIKeyMenu() string {
 	header := fmt.Sprintf("\n  API keys for %s\n", m.styles.Bold.Render(m.selectedUser.Username))
 	warning := line(m.styles.Muted, "  Keys cannot be listed — only new keys can be created,\n  or existing ones revoked by their integer ID.")

main.go

@@ -7,6 +7,7 @@ import (
 
 	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"git.ryuvia.com/niklas/terdut-tui/internal/config"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
 	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
 	"git.ryuvia.com/niklas/terdut-tui/internal/tui"
 	"git.ryuvia.com/niklas/terdut-tui/internal/updater"
@@ -45,8 +46,17 @@ func main() {
 		os.Exit(1)
 	}
 
-	client := api.NewClient(cfg.ServerURL, cfg.APIKey)
-	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval, th)
+	client := api.NewClient(cfg.ServerURL)
+	if token := session.Load(cfg.ServerURL); token != "" {
+		client.SetSession(token)
+	}
+	note := ""
+	if cfg.LegacyAPIKey {
+		note = "api_key in config.yaml is no longer used: sign in with your username and password"
+	}
+	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval, th).
+		WithDefaultTeam(cfg.Team).
+		WithLogin(cfg.Username, note)
 
 	p := tea.NewProgram(model, tea.WithAltScreen())
 	if _, err := p.Run(); err != nil {