Sign in through the server's single sign-on, with a code

The sign-in screen asks the server how it can be signed in to
(GET /api/auth/config) and offers what it finds: the password form, and
"Sign in with <provider>" when the server can do a device login. The TUI
shows a link and a short code, the person approves it in any browser, and
the next poll hands over the ordinary session, so it works over SSH where
no browser can be opened. The terminal never talks to the identity
provider.

The password form is hidden when the server has turned password login
off. `auth: sso` in config.yaml starts the SSO login straight away, but not
right after signing out, where that would sign the person straight back
in; any other value is refused when the config is read. Polling honours the
server's interval, backs off on slow_down, and gives up after repeated
failures rather than retrying forever.

A server without /api/auth/config answers 404 and is treated as passwords
only, so the sign-in screen is the one it had. Needs terdut-server v0.29.0
for SSO.

.gitea/workflows/ci.yaml

@@ -56,34 +56,8 @@ jobs:
             git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
           fi
 
-      # This exists because `go vet` does not look at import order: the move to
+      # The Makefile is the single definition of the gate -- gofmt with both of its failure
-      # git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
+      # modes handled, go vet, and the tests -- so this is exactly what a developer and the
-      # before github.com/..., and both repos sat unformatted through a green CI run and
+      # release skill run. See the comments on the targets for why each is shaped as it is.
-      # a release before anyone noticed.
+      - name: Format, vet and test
-      #
+        run: make fmt lint test
-      # Both of gofmt's failure modes need handling, and they are not alike. A file that
-      # is merely misformatted is listed on stdout with exit 0 -- so the failure has to
-      # be raised by hand. A file that does not parse is the opposite: nothing on stdout
-      # and exit 2, which a naive `[ -n "$unformatted" ]` reads as success. The first
-      # draft of this step had exactly that hole.
-      - name: Format
-        run: |
-          if ! unformatted=$(gofmt -l .); then
-            echo "::error::gofmt could not parse the tree"
-            gofmt -l .    # re-run unredirected so the parse errors reach the log
-            exit 1
-          fi
-          if [ -n "$unformatted" ]; then
-            echo "::error::not gofmt'd:"
-            echo "$unformatted"
-            gofmt -d .
-            exit 1
-          fi
-
-      - name: Vet
-        run: go vet ./...
-
-      # Covers the API client against a stub server, the Update state machine, and View
-      # rendering -- all three are pure enough to test without a terminal.
-      - name: Test
-        run: go test ./...

.gitea/workflows/release.yaml

@@ -8,9 +8,9 @@ name: Release
 # the job that publishes them. Nothing is handed between jobs.
 #
 # The asset names matter beyond being tidy: internal/updater looks for exactly
-# terdut-tui-<tag>-<goos>-<goarch> in the latest release and reports every available name
+# terdut-tui-<tag>-<goos>-<goarch> in the latest release. The pattern is defined once, by
-# when it cannot find one. Renaming the pattern here breaks self-update for every
+# `make dist` (and `make dist-assets`, which the release skill checks the published release
-# installed binary.
+# against) -- see DIST_TARGETS in the Makefile before touching it.
 on:
   push:
     tags:
@@ -41,35 +41,9 @@ jobs:
           REF_NAME: ${{ github.ref_name }}
         run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
 
-      # This exists because `go vet` does not look at import order: the move to
+      # Same target CI and the release skill run; a tag that fails it publishes nothing.
-      # git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
+      - name: Format, vet and test
-      # before github.com/..., and both repos sat unformatted through a green CI run and
+        run: make fmt lint test
-      # a release before anyone noticed.
-      #
-      # Both of gofmt's failure modes need handling, and they are not alike. A file that
-      # is merely misformatted is listed on stdout with exit 0 -- so the failure has to
-      # be raised by hand. A file that does not parse is the opposite: nothing on stdout
-      # and exit 2, which a naive `[ -n "$unformatted" ]` reads as success. The first
-      # draft of this step had exactly that hole.
-      - name: Format
-        run: |
-          if ! unformatted=$(gofmt -l .); then
-            echo "::error::gofmt could not parse the tree"
-            gofmt -l .    # re-run unredirected so the parse errors reach the log
-            exit 1
-          fi
-          if [ -n "$unformatted" ]; then
-            echo "::error::not gofmt'd:"
-            echo "$unformatted"
-            gofmt -d .
-            exit 1
-          fi
-
-      - name: Vet
-        run: go vet ./...
-
-      - name: Test
-        run: go test ./...
 
   binaries:
     needs: test
@@ -86,21 +60,12 @@ jobs:
           REF_NAME: ${{ github.ref_name }}
         run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
 
+      # The Makefile owns the target list and the asset names -- see DIST_TARGETS there for
+      # why the naming pattern cannot change.
       - name: Build every target
         env:
           REF_NAME: ${{ github.ref_name }}
-        run: |
+        run: make dist VERSION="$REF_NAME"
-          set -eu
-          mkdir -p dist
-          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
-            GOOS="${target%/*}"
-            GOARCH="${target#*/}"
-            out="dist/terdut-tui-${REF_NAME}-${GOOS}-${GOARCH}"
-            echo "building $out"
-            GOOS="$GOOS" GOARCH="$GOARCH" go build \
-              -ldflags "-X main.version=${REF_NAME}" \
-              -o "$out" .
-          done
 
       # Creating the release is made idempotent rather than assumed-new: a re-run of a
       # failed release must not die on the release that already exists. Assets are
@@ -126,6 +91,28 @@ jobs:
           [ -n "$release_id" ] || { echo "::error::could not determine release id"; exit 1; }
           echo "release id $release_id"
 
+          # The release notes are the tag's own message, minus its subject line: the
+          # tag body is the changelog for this project, and without this the release
+          # page stays empty. Only an annotated tag has one, and only a release with
+          # no notes is filled, so a re-run repairs a release created empty without
+          # overwriting notes somebody has since edited by hand.
+          #
+          # There is no jq in this image, so the JSON string is escaped by hand:
+          # backslashes first (or the ones added next would double), then quotes and
+          # tabs, then each line end becomes a literal \n.
+          if [ "$(git cat-file -t "$REF_NAME")" = tag ] \
+             && printf '%s' "$body" | grep -q '"body":""'; then
+            notes=$(git tag -l --format='%(contents)' "$REF_NAME" | sed '1,2d')
+            if [ -n "$notes" ]; then
+              notes_json=$(printf '%s\n' "$notes" \
+                | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t/g' -e 's/\r$//' \
+                | awk 'BEGIN { ORS = "\\n" } { print }')
+              echo "setting release notes from the tag message"
+              curl -sf -X PATCH -H "$auth" -H 'Content-Type: application/json' \
+                -d "{\"body\":\"$notes_json\"}" "$API/releases/$release_id" > /dev/null
+            fi
+          fi
+
           for f in dist/*; do
             name=$(basename "$f")
             # Drop an existing asset of the same name first: Gitea happily stores two

.gitignore

@@ -1,2 +1,3 @@
 terdut-tui
 .graymatter/
+dist/

.release.conf

@@ -0,0 +1,9 @@
+# Read by the `release` skill (~/.claude/skills/release).
+#
+# terdut-tui publishes binaries to a Gitea release and nothing else: no image, no Helm
+# chart, no wrapper in Ryuvia/charts. KIND=binary tells the skill to gate, tag, wait for
+# release.yaml and verify the published assets, and to skip the chart steps.
+KIND=binary
+
+# English, like the rest of the terdut projects.
+PROSE_LANG=en

CLAUDE.md

@@ -1,6 +1,6 @@
 # terdut-tui
 
-TUI client for [terdut-server](https://git.ryuvia.com/niklas/terdut-server), a Prometheus Alertmanager receiver and incident manager. Requires server **v0.4.0+**.
+TUI client for [terdut-server](https://git.ryuvia.com/niklas/terdut-server), a Prometheus Alertmanager receiver and incident manager. Requires server **v0.20.0+** (team-scoped API).
 
 ## Domain model
 
@@ -11,10 +11,37 @@ The server splits alerts from incidents, and this client mirrors it:
   assignee, snooze, notes and an append-only timeline. Many alerts to one incident,
   correlated by Alertmanager's `groupKey`.
 
+The server is multi-team: incidents, alerts and the schedule belong to a team, and
+the caller only sees their own teams. `Model.activeTeamID` (0 = all) narrows the
+incident and alert lists via `team_id`; the schedule is per team and uses
+`Model.scheduleTeam()`. Users have `is_admin`, and the TUI mirrors the server's
+permission rules up front (`canEditSchedule`, `canManageUser`, `isAdmin`) so a 403 is
+explained before the round trip, not after. The server has no version endpoint;
+an old one is recognised by `GET /api/teams` answering 404 (`errServerTooOld`).
+
 All user actions target incidents. Two server behaviours the UI has to respect:
 manual resolve is **terminal** (hence the confirmation prompt), and snooze is the
 non-destructive "not now" alternative.
 
+## Release
+
+Say **"Release"** (or "Release X.Y.Z") and the `release` skill runs it. This repo is
+`KIND=binary` in `.release.conf`: it publishes binaries to a Gitea release and has no image,
+chart or wrapper-chart PR. The run is gate, commit, push, tag, wait for `release.yaml`, then
+`verify-release`. Preconditions and the plan, without side effects:
+
+```sh
+~/.claude/skills/release/scripts/release-preflight          # state + suggested version
+~/.claude/skills/release/scripts/release-preflight vX.Y.Z   # validate that release
+```
+
+- `make fmt lint test` is the gate, and it **is** what `ci.yaml` and `release.yaml` run.
+- `make dist VERSION=vX.Y.Z` builds the four binaries; `make dist-assets` lists their names.
+  The pattern `terdut-tui-<tag>-<goos>-<goarch>` is the self-updater's contract with every
+  installed binary, so changing it breaks self-update.
+- **The annotated tag's message becomes the release notes** (`release.yaml` copies it, minus
+  its subject line). Write it for a reader of the release page. Never move a published tag.
+
 ## Tech stack
 
 - Go 1.25+
@@ -25,7 +52,7 @@ non-destructive "not now" alternative.
 ## Project layout
 
 ```
-main.go                      CLI entry point: flags, config load, health check, start TUI
+main.go                      CLI entry point: flags, config load, start TUI
 internal/api/client.go       REST API client — one method per endpoint
 internal/config/config.go    Config loader (~/.config/terdut-tui/config.yaml)
 internal/theme/              Colour themes: semantic tokens, built-ins, user file loader
@@ -35,7 +62,7 @@ internal/tui/                Bubbletea UI
   view.go                    View() — pure rendering
   keys.go                    keyMap (bubbles/key pattern)
   styles.go                  Styles struct — every lipgloss style, built from a theme
-internal/updater/updater.go  Self-update via GitHub Releases
+internal/updater/updater.go  Self-update via Gitea releases
 ```
 
 ## Architecture rules
@@ -54,16 +81,24 @@ Location: `~/.config/terdut-tui/config.yaml`
 
 ```yaml
 server_url: https://terdut.example.com
-api_key: <64-char hex key>
+username: niklas      # optional, prefills the sign-in form
 refresh_interval: 30  # seconds, optional, default 30
 theme: gruvbox-dark   # optional, default gruvbox-dark
+team: Ops             # optional, team name or id to start on, default all
 ```
 
 Built-in themes are `gruvbox-dark` and `gruvbox-light`; user themes are YAML
 files in `~/.config/terdut-tui/themes/`, optionally `extends:`-ing a built-in.
 See the README for the token list.
 
-The API key is a one-time secret generated by terdut-server (`POST /api/users/{id}/api-keys`).
+There is no API key in the config. The TUI signs in as a user (`POST /api/login`, the
+same session cookie as the web UI) and `internal/session` keeps the token in
+`~/.config/terdut-tui/session.json`, mode 0600, keyed by server URL. The client
+attaches `terdut_session` itself rather than using a cookie jar, because a jar drops the
+server's Secure cookie over plain http. It must never send `Authorization` as well: the
+server judges a request with that header on it alone. A 401 from anything (`msgError`
+in `update.go`) returns to the sign-in form and clears `Model`. A user with no password
+cannot sign in, and the server answers it like a wrong one, so the form says so.
 
 ## Running
 
@@ -95,6 +130,8 @@ go build -ldflags="-X main.version=v0.1.0" -o terdut-tui .
 | 4 | On-call schedule calendar view |
 | 5 | User management and API key lifecycle |
 | 6 | Incidents: queue, timeline, ack/assign/snooze/resolve, MTTA/MTTR |
+| 7 | Teams: `T` switcher, per-team schedule, admin/disabled markers (server v0.20) |
+| 8 | Sign in as a user instead of an API key (server v0.10+ session cookie) |
 
 <!-- graymatter:instructions:begin — managed by `graymatter init`; edits inside this block are overwritten -->
 ## Memory (GrayMatter)

Makefile

@@ -1,6 +1,6 @@
 VERSION := $(shell git describe --tags --always --dirty)
 
-.PHONY: build install test
+.PHONY: build install test lint fmt dist dist-assets release-vars
 
 build:
 	go build -ldflags "-X main.version=$(VERSION)" -o terdut-tui .
@@ -8,5 +8,59 @@ build:
 install:
 	go install -ldflags "-X main.version=$(VERSION)" .
 
-test:
+# ci.yaml and release.yaml run `make fmt lint test`, so a green gate here and a green
+# pipeline are the same code rather than two descriptions of it. It is also what the
+# release skill runs before tagging.
+
+# Covers the API client against a stub server, the sign-in flow, the Update state
+# machine, and View rendering -- all pure enough to test without a terminal.
+test: ## Run the test suite
 	go test ./...
+
+lint: ## go vet
+	go vet ./...
+
+# This exists because `go vet` does not look at import order: the move to
+# git.ryuvia.com rewrote every import path without re-sorting, the new path sorts
+# before github.com/..., and both repos sat unformatted through a green CI run and
+# a release before anyone noticed.
+#
+# Both of gofmt's failure modes need handling, and they are not alike. A file that
+# is merely misformatted is listed on stdout with exit 0 -- so the failure has to
+# be raised by hand. A file that does not parse is the opposite: nothing on stdout
+# and exit 2, which a naive `[ -n "$$unformatted" ]` reads as success. The first
+# draft of this target had exactly that hole.
+fmt: ## Fail on files that are not gofmt'd
+	@if ! unformatted=$$(gofmt -l .); then \
+		echo "gofmt could not parse the tree:"; gofmt -l .; exit 1; \
+	fi; \
+	if [ -n "$$unformatted" ]; then \
+		echo "not gofmt'd:"; echo "$$unformatted"; gofmt -d .; exit 1; \
+	fi
+
+# What a release publishes. The asset names matter beyond being tidy: internal/updater
+# looks for exactly terdut-tui-<tag>-<goos>-<goarch> in the latest release and reports
+# every available name when it cannot find one. Renaming the pattern here breaks
+# self-update for every installed binary.
+DIST_TARGETS := linux/amd64 linux/arm64 darwin/amd64 darwin/arm64
+
+dist: ## Build every release binary into dist/ (VERSION=vX.Y.Z to name them)
+	@set -eu; mkdir -p dist; \
+	for target in $(DIST_TARGETS); do \
+		goos="$${target%/*}"; goarch="$${target#*/}"; \
+		out="dist/terdut-tui-$(VERSION)-$$goos-$$goarch"; \
+		echo "building $$out"; \
+		GOOS="$$goos" GOARCH="$$goarch" go build -ldflags "-X main.version=$(VERSION)" -o "$$out" .; \
+	done
+
+# The names dist produces, one per line, so the release skill can check the published
+# release has every one of them rather than a count.
+dist-assets: ## Print the asset names a release of VERSION carries
+	@for target in $(DIST_TARGETS); do \
+		echo "terdut-tui-$(VERSION)-$${target%/*}-$${target#*/}"; \
+	done
+
+# Read by the release skill for a repo that publishes binaries and no image or chart
+# (KIND=binary in .release.conf). There is nothing to say about images or charts.
+release-vars: ## Print the variables the release process reads
+	@printf 'APP=terdut-tui\n'

README.md

@@ -10,12 +10,33 @@ Written in Go using [Bubbletea](https://github.com/charmbracelet/bubbletea).
 - **Incident actions** — acknowledge, assign, snooze, note, resolve and archive
 - **Timeline** — the full history of an incident, system events, pages and notes together
 - **Alert feed** — the raw read-only alerts underneath, each linked to its incident
-- **On-call schedule** — visual calendar of who is on duty, assign and remove entries
+- **Teams** — switch between your teams, or see all of them at once
+- **On-call schedule** — visual calendar of who is on duty in a team, assign and remove entries
 - **Statistics** — MTTA and MTTR, plus alert frequency by name, hour and day
 - **User management** — add and remove users, manage API keys, set each user's ntfy topic
 
-> Requires terdut-server **v0.4.0 or later**. Earlier servers have no incidents API;
+> Requires terdut-server **v0.20.0 or later**. The server became team-scoped in
-> use terdut-tui v0.3.x with those.
+> v0.12 and this client follows it; earlier servers answer 404 for `/api/teams`
+> and the TUI says so on start. Use terdut-tui v0.9.x with servers before v0.12.
+> Escalation ladders, invites, integrations and the admin settings stay in the
+> server's web UI.
+
+## Teams
+
+Everything the server returns is scoped to the teams your key's user belongs
+to. The header shows which are on screen, and `T` steps through *all* → each of
+your teams in turn. With several teams showing, incident and alert rows carry a
+Team column.
+
+The schedule is one team's rota, so the Schedule section shows the active team,
+or with *all* showing the first team you own. Only a team's owners, and
+administrators, can change its rota; anyone else gets the reason in the status
+bar instead of a picker. The picker offers only that team's members, because the
+server refuses anybody else. Stats always cover all your teams; the server
+cannot narrow them to one.
+
+Administrators are the only users who can create or delete users, or act on
+someone else's password, topic or API keys. Everyone can manage their own.
 
 ## Alerts and incidents
 
@@ -49,9 +70,6 @@ Every delivery lands on the incident's timeline: `Notified <user> (triggered)`
 when ntfy accepted the page, and `Notification to <user> failed` when it ran out
 of retries. That second one is the one to look for when nobody's phone rang.
 
-Editing topics needs terdut-server **v0.6.0 or later**; the timeline entries need
-**v0.7.0 or later**. Against an older server the topic column stays empty and
-editing one reports the server's 404.
 
 ## Installation
 
@@ -67,12 +85,31 @@ Create `~/.config/terdut-tui/config.yaml`:
 
 ```yaml
 server_url: https://terdut.example.com
-api_key: <your-api-key>
+username: niklas      # optional, prefills the sign-in form
 refresh_interval: 30  # seconds, optional
 theme: gruvbox-dark   # optional, this is the default
+team: Ops             # optional, a team name or id to start on; default is all
 ```
 
-The API key is generated in terdut-server. See the server documentation for how to bootstrap a user and issue an API key.
+## Signing in
+
+The TUI signs in the way the web UI does: with a user account's username and
+password, on a form shown at start. It keeps the server's session, not the
+password, in `~/.config/terdut-tui/session.json` (readable by you only), so the
+next start resumes it. The server's sessions last 30 days and slide with use.
+When it has ended, or the account is disabled or the session is ended from the web
+UI, the TUI returns to the form and says so. `L` signs out, which also ends the
+session on the server and deletes the saved one.
+
+The account needs a password, since that is what signing in uses. A user
+created only for API access has none and cannot sign in: the server answers it
+exactly like a wrong password. Set one in the web UI, or have an administrator
+press `p` on that user in Users. Too many failed attempts are rate limited by
+the server for a few minutes.
+
+> **Upgrading from v0.10.0 and earlier:** `api_key` in `config.yaml` is no longer
+> used. Remove it and sign in. API keys still exist on the server, and `k` in
+> Users still manages them, for whatever else uses them.
 
 ## Themes
 
@@ -133,6 +170,8 @@ Global:
 | `esc` | Go back |
 | `r` | Refresh |
 | `f` | Cycle filter |
+| `L` | Sign out |
+| `T` | Switch team: all → each of your teams (when you have more than one) |
 | `q` | Quit |
 
 The sections, in `tab` order: Incidents · Alerts · Stats · Archived · Schedule · Users.
@@ -181,9 +220,8 @@ Schedule section:
 One person holds a given day. Assigning over days somebody else already has
 asks first — naming them and how many days are being taken — and moves the whole
 selection at once when you accept, so reassigning a week is one confirmation
-rather than seven deletions. Taking somebody's shift needs terdut-server
+rather than seven deletions. The header line names the team whose rota this is,
-**v0.8.0 or later**; against an older server the assignment is refused with
+and "On-call today" lists everyone on call across your teams.
-`date already assigned`.
 
 Users section:
 
@@ -193,3 +231,9 @@ Users section:
 | `t` | Edit the user's ntfy topic — submit empty to clear it |
 | `d` | Delete a user |
 | `k` | API keys for the selected user |
+| `p` | Set the selected user's web UI password — asks for the current one when it is your own |
+
+In Users, `k` and `d` act on the selected row, so move with `↑`/`↓` there rather
+than `k`. The Flags column marks administrators and disabled accounts. `n` and `d`
+are for administrators; `t`, `k` and `p` work on your own row, or on anyone's if you
+are one.

internal/api/client.go

@@ -3,6 +3,7 @@ package api
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -11,32 +12,222 @@ import (
 	"time"
 )
 
+// SessionCookie is the cookie terdut-server's web UI signs in with.
+const SessionCookie = "terdut_session"
+
+// Client talks to terdut-server as the user who signed in. Login trades a
+// username and password for a session, the same one the web UI holds, and every
+// request after it carries that session's cookie.
+//
+// The cookie is attached by hand rather than through a cookie jar: the server
+// marks it Secure behind https, and a jar drops a Secure cookie it is handed
+// over plain http, which would make a local server unusable for no reason. There
+// is nothing else a jar would do here — the token is opaque and does not change
+// while the session lives.
 type Client struct {
 	baseURL    string
 	httpClient *http.Client
-	apiKey     string
+	session    string
 }
 
-func NewClient(baseURL, apiKey string) *Client {
+func NewClient(baseURL string) *Client {
 	return &Client{
 		baseURL: strings.TrimRight(baseURL, "/"),
-		apiKey:  apiKey,
 		httpClient: &http.Client{
 			Timeout: 10 * time.Second,
 		},
 	}
 }
 
+// SetSession resumes a session from a token saved earlier.
+func (c *Client) SetSession(token string) { c.session = token }
+
+// HasSession reports whether there is a session to try. It says nothing about
+// whether the server still honours it.
+func (c *Client) HasSession() bool { return c.session != "" }
+
+// Login signs in and returns the session token, which the client also keeps and
+// sends from then on. The server answers a wrong password, an unknown user and
+// an account with no password all with the same 401, so the caller cannot tell
+// them apart. Too many failures come back as 429.
+func (c *Client) Login(username, password string) (string, error) {
+	body := struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	}{Username: username, Password: password}
+	req, err := c.newRequestWithBody(http.MethodPost, "/api/login", body)
+	if err != nil {
+		return "", err
+	}
+	// A stale session must not ride along on the request that replaces it.
+	req.Header.Del("Cookie")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return "", statusError(resp)
+	}
+	for _, ck := range resp.Cookies() {
+		if ck.Name == SessionCookie && ck.Value != "" {
+			c.session = ck.Value
+			return ck.Value, nil
+		}
+	}
+	return "", fmt.Errorf("server signed us in but sent no %s cookie", SessionCookie)
+}
+
+// AuthConfig asks how the server can be signed in to. It is unauthenticated, so
+// it works before anybody has signed in.
+func (c *Client) AuthConfig() (AuthConfig, error) {
+	var cfg AuthConfig
+	req, err := http.NewRequest(http.MethodGet, c.baseURL+"/api/auth/config", nil)
+	if err != nil {
+		return cfg, err
+	}
+	req.Header.Set("Accept", "application/json")
+	err = c.do(req, &cfg)
+	return cfg, err
+}
+
+// The ways a device login poll can end other than with a session.
+var (
+	// ErrDevicePending means nobody has approved yet: poll again after the
+	// interval.
+	ErrDevicePending = errors.New("waiting for approval")
+
+	// ErrDeviceSlowDown means the server was polled faster than it asked. It is
+	// not a failure; poll again, a little slower.
+	ErrDeviceSlowDown = errors.New("polling too fast")
+
+	// ErrDeviceExpired means the person took too long, or the server forgot the
+	// login. ErrDeviceDenied means they refused it.
+	ErrDeviceExpired = errors.New("the sign-in expired")
+	ErrDeviceDenied  = errors.New("the sign-in was refused")
+)
+
+// StartDeviceLogin asks the server to begin a device login.
+func (c *Client) StartDeviceLogin() (*DeviceLogin, error) {
+	req, err := c.newRequestWithBody(http.MethodPost, "/api/oidc/device", struct{}{})
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Del("Cookie")
+	var d DeviceLogin
+	if err := c.do(req, &d); err != nil {
+		return nil, err
+	}
+	if d.DeviceCode == "" || d.UserCode == "" || d.VerificationURL == "" {
+		return nil, errors.New("server started a sign-in but sent no code")
+	}
+	return &d, nil
+}
+
+// PollDeviceLogin asks whether the person has approved. On approval it returns
+// the session token, which the client also keeps; until then it returns one of
+// the ErrDevice* errors.
+func (c *Client) PollDeviceLogin(deviceCode string) (string, error) {
+	req, err := c.newRequestWithBody(http.MethodPost, "/api/oidc/device/token",
+		struct {
+			DeviceCode string `json:"device_code"`
+		}{deviceCode})
+	if err != nil {
+		return "", err
+	}
+	req.Header.Del("Cookie")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	switch resp.StatusCode {
+	case http.StatusAccepted:
+		return "", ErrDevicePending
+	case http.StatusTooManyRequests:
+		return "", ErrDeviceSlowDown
+	case http.StatusGone:
+		var e struct {
+			Error string `json:"error"`
+		}
+		_ = json.NewDecoder(resp.Body).Decode(&e)
+		if e.Error == "denied" {
+			return "", ErrDeviceDenied
+		}
+		return "", ErrDeviceExpired
+	}
+	if resp.StatusCode >= 400 {
+		return "", statusError(resp)
+	}
+	for _, ck := range resp.Cookies() {
+		if ck.Name == SessionCookie && ck.Value != "" {
+			c.session = ck.Value
+			return ck.Value, nil
+		}
+	}
+	return "", fmt.Errorf("server signed us in but sent no %s cookie", SessionCookie)
+}
+
+// Logout ends the session on the server and forgets it here.
+func (c *Client) Logout() error {
+	req, err := c.newRequest(http.MethodPost, "/api/logout")
+	if err != nil {
+		return err
+	}
+	err = c.do(req, nil)
+	c.session = ""
+	return err
+}
+
+// authorize puts the session on a request.
+func (c *Client) authorize(req *http.Request) {
+	req.Header.Set("Accept", "application/json")
+	if c.session != "" {
+		req.AddCookie(&http.Cookie{Name: SessionCookie, Value: c.session})
+	}
+}
+
 func (c *Client) newRequest(method, path string) (*http.Request, error) {
 	req, err := http.NewRequest(method, c.baseURL+path, nil)
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Authorization", "Bearer "+c.apiKey)
+	c.authorize(req)
-	req.Header.Set("Accept", "application/json")
 	return req, nil
 }
 
+// StatusError is a response the server answered with a 4xx or 5xx. Message is
+// the server's own {"error": ...} text, empty when the body carried none.
+type StatusError struct {
+	Code    int
+	Message string
+}
+
+func (e *StatusError) Error() string {
+	if e.Message != "" {
+		return fmt.Sprintf("server returned %d: %s", e.Code, e.Message)
+	}
+	return fmt.Sprintf("server returned %d", e.Code)
+}
+
+// IsUnauthorized reports whether err is the server refusing the session: it
+// expired, was ended elsewhere, or belongs to an account since disabled.
+func IsUnauthorized(err error) bool {
+	var se *StatusError
+	return errors.As(err, &se) && se.Code == http.StatusUnauthorized
+}
+
+func statusError(resp *http.Response) error {
+	var e struct {
+		Error string `json:"error"`
+	}
+	_ = json.NewDecoder(resp.Body).Decode(&e)
+	return &StatusError{Code: resp.StatusCode, Message: e.Error}
+}
+
 func (c *Client) do(req *http.Request, out any) error {
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
@@ -45,14 +236,7 @@ func (c *Client) do(req *http.Request, out any) error {
 	defer resp.Body.Close()
 
 	if resp.StatusCode >= 400 {
-		var e struct {
+		return statusError(resp)
-			Error string `json:"error"`
-		}
-		_ = json.NewDecoder(resp.Body).Decode(&e)
-		if e.Error != "" {
-			return fmt.Errorf("server returned %d: %s", resp.StatusCode, e.Error)
-		}
-		return fmt.Errorf("server returned %d", resp.StatusCode)
 	}
 
 	if out != nil {
@@ -61,14 +245,18 @@ func (c *Client) do(req *http.Request, out any) error {
 	return nil
 }
 
-// ListAlerts fetches alerts. status may be "firing", "resolved", or "" for all.
+// ListAlerts fetches alerts. teamID limits them to one team; 0 means every team
+// the caller belongs to. status may be "firing", "resolved", or "" for all.
 // Set archived=true to fetch only archived alerts; false returns only non-archived.
 //
 // Alerts are read-only on the server — there is nothing to acknowledge or
 // archive here. This is the raw feed, useful for checking what Alertmanager is
 // actually sending; the work queue is ListIncidents.
-func (c *Client) ListAlerts(status string, archived bool, limit int) ([]Alert, error) {
+func (c *Client) ListAlerts(teamID int64, status string, archived bool, limit int) ([]Alert, error) {
 	q := url.Values{}
+	if teamID > 0 {
+		q.Set("team_id", strconv.FormatInt(teamID, 10))
+	}
 	if status != "" {
 		q.Set("status", status)
 	}
@@ -110,8 +298,7 @@ func (c *Client) newRequestWithBody(method, path string, body any) (*http.Reques
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Authorization", "Bearer "+c.apiKey)
+	c.authorize(req)
-	req.Header.Set("Accept", "application/json")
 	req.Header.Set("Content-Type", "application/json")
 	return req, nil
 }
@@ -127,12 +314,16 @@ func (c *Client) GetAlert(id int64) (*Alert, error) {
 
 // ── Incidents ──────────────────────────────────────────────────────────────
 
-// ListIncidents fetches the work queue. status may be "triggered",
+// ListIncidents fetches the work queue. teamID limits it to one team; 0 means
+// every team the caller belongs to. status may be "triggered",
 // "acknowledged", "resolved", or "" for the server default of open incidents
 // only. archived and snoozed each switch the list to that set rather than
 // adding to it, matching the server's filters.
-func (c *Client) ListIncidents(status string, archived, snoozed bool, limit int) ([]Incident, error) {
+func (c *Client) ListIncidents(teamID int64, status string, archived, snoozed bool, limit int) ([]Incident, error) {
 	q := url.Values{}
+	if teamID > 0 {
+		q.Set("team_id", strconv.FormatInt(teamID, 10))
+	}
 	if status != "" {
 		q.Set("status", status)
 	}
@@ -177,6 +368,18 @@ func (c *Client) GetIncidentTimeline(id int64) ([]IncidentEvent, error) {
 	return events, c.do(req, &events)
 }
 
+// GetSimilarIncidents lists earlier resolved incidents that look like this one
+// and have notes. Servers before the similar-incidents endpoint answer 404; the
+// caller treats any error as "nothing to show".
+func (c *Client) GetSimilarIncidents(id int64) ([]SimilarIncident, error) {
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/incidents/%d/similar", id))
+	if err != nil {
+		return nil, err
+	}
+	var similar []SimilarIncident
+	return similar, c.do(req, &similar)
+}
+
 func (c *Client) AcknowledgeIncident(id int64) (*Incident, error) {
 	req, err := c.newRequest(http.MethodPost, fmt.Sprintf("/api/incidents/%d/acknowledge", id))
 	if err != nil {
@@ -258,10 +461,11 @@ func (c *Client) UnarchiveIncident(id int64) error {
 	return c.do(req, nil)
 }
 
-// AddNote appends a note to the incident's timeline.
+// AddNote appends a note to the incident's timeline. pinned files it as the
-func (c *Client) AddNote(incidentID int64, content string) (*IncidentEvent, error) {
+// resolution note: what fixed the incident, shown on similar ones later.
+func (c *Client) AddNote(incidentID int64, content string, pinned bool) (*IncidentEvent, error) {
 	req, err := c.newRequestWithBody(http.MethodPost,
-		fmt.Sprintf("/api/incidents/%d/notes", incidentID), map[string]string{"content": content})
+		fmt.Sprintf("/api/incidents/%d/notes", incidentID), map[string]any{"content": content, "pinned": pinned})
 	if err != nil {
 		return nil, err
 	}
@@ -318,8 +522,37 @@ func (c *Client) GetStatsByDay() ([]DayStat, error) {
 	return result, c.do(req, &result)
 }
 
-func (c *Client) GetSchedule(from, to string) ([]ScheduleEntry, error) {
+// ── Teams ──────────────────────────────────────────────────────────────────
-	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/schedule?from=%s&to=%s", from, to))
+
+// ListTeams returns the teams the caller belongs to, with the caller's role in
+// each. Everything else the server returns is scoped to these. A server that
+// predates teams (v0.12) answers 404, which is how the TUI spots one.
+func (c *Client) ListTeams() ([]Team, error) {
+	req, err := c.newRequest(http.MethodGet, "/api/teams")
+	if err != nil {
+		return nil, err
+	}
+	var teams []Team
+	return teams, c.do(req, &teams)
+}
+
+// ListTeamMembers returns who belongs to a team. A schedule can only be given to
+// its own members, so this is the assignee list for one.
+func (c *Client) ListTeamMembers(teamID int64) ([]TeamMember, error) {
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/teams/%d/members", teamID))
+	if err != nil {
+		return nil, err
+	}
+	var members []TeamMember
+	return members, c.do(req, &members)
+}
+
+// ── Schedule ───────────────────────────────────────────────────────────────
+
+// GetSchedule returns a team's on-call entries between two YYYY-MM-DD dates.
+func (c *Client) GetSchedule(teamID int64, from, to string) ([]ScheduleEntry, error) {
+	q := url.Values{"from": {from}, "to": {to}}
+	req, err := c.newRequest(http.MethodGet, fmt.Sprintf("/api/teams/%d/schedule?%s", teamID, q.Encode()))
 	if err != nil {
 		return nil, err
 	}
@@ -327,49 +560,30 @@ func (c *Client) GetSchedule(from, to string) ([]ScheduleEntry, error) {
 	return entries, c.do(req, &entries)
 }
 
-// GetCurrentOnCall returns today's on-call entry, or nil if nobody is scheduled.
+// GetCurrentOnCall returns today's on-call entries, one per team that has
-func (c *Client) GetCurrentOnCall() (*ScheduleEntry, error) {
+// somebody scheduled. It is empty, not an error, when nobody is.
+func (c *Client) GetCurrentOnCall() ([]ScheduleEntry, error) {
 	req, err := c.newRequest(http.MethodGet, "/api/schedule/current")
 	if err != nil {
 		return nil, err
 	}
-	resp, err := c.httpClient.Do(req)
+	var entries []ScheduleEntry
-	if err != nil {
+	return entries, c.do(req, &entries)
-		return nil, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode == http.StatusNotFound {
-		return nil, nil
-	}
-	if resp.StatusCode >= 400 {
-		var e struct {
-			Error string `json:"error"`
-		}
-		_ = json.NewDecoder(resp.Body).Decode(&e)
-		if e.Error != "" {
-			return nil, fmt.Errorf("server returned %d: %s", resp.StatusCode, e.Error)
-		}
-		return nil, fmt.Errorf("server returned %d", resp.StatusCode)
-	}
-	var entry ScheduleEntry
-	if err := json.NewDecoder(resp.Body).Decode(&entry); err != nil {
-		return nil, err
-	}
-	return &entry, nil
 }
 
-// AssignSchedule puts one user on call for the given dates.
+// AssignSchedule puts one team member on call for the given dates. Only a team
+// owner or an administrator may.
 //
 // The server holds one person per day and refuses a date somebody already has,
 // so replace is what takes a shift off its current holder. It is all-or-nothing
 // either way: a week of free and taken days moves as a unit, or not at all.
-func (c *Client) AssignSchedule(userID int64, dates []string, replace bool) ([]ScheduleEntry, error) {
+func (c *Client) AssignSchedule(teamID, userID int64, dates []string, replace bool) ([]ScheduleEntry, error) {
 	body := struct {
 		UserID  int64    `json:"user_id"`
 		Dates   []string `json:"dates"`
 		Replace bool     `json:"replace,omitempty"`
 	}{UserID: userID, Dates: dates, Replace: replace}
-	req, err := c.newRequestWithBody(http.MethodPost, "/api/schedule", body)
+	req, err := c.newRequestWithBody(http.MethodPost, fmt.Sprintf("/api/teams/%d/schedule", teamID), body)
 	if err != nil {
 		return nil, err
 	}
@@ -377,14 +591,16 @@ func (c *Client) AssignSchedule(userID int64, dates []string, replace bool) ([]S
 	return entries, c.do(req, &entries)
 }
 
-func (c *Client) DeleteScheduleEntry(id int64) error {
+func (c *Client) DeleteScheduleEntry(teamID, id int64) error {
-	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/schedule/%d", id))
+	req, err := c.newRequest(http.MethodDelete, fmt.Sprintf("/api/teams/%d/schedule/%d", teamID, id))
 	if err != nil {
 		return err
 	}
 	return c.do(req, nil)
 }
 
+// ── Users ──────────────────────────────────────────────────────────────────
+
 func (c *Client) ListUsers() ([]User, error) {
 	req, err := c.newRequest(http.MethodGet, "/api/users")
 	if err != nil {
@@ -452,7 +668,33 @@ func (c *Client) DeleteAPIKey(userID, keyID int64) error {
 	return c.do(req, nil)
 }
 
-// HealthCheck calls GET /healthz (unauthenticated path, no auth needed but we send it anyway).
+// Me returns the user the API key belongs to, and whether they have a web UI
+// password.
+func (c *Client) Me() (*Me, error) {
+	req, err := c.newRequest(http.MethodGet, "/api/me")
+	if err != nil {
+		return nil, err
+	}
+	var me Me
+	return &me, c.do(req, &me)
+}
+
+// SetPassword sets a user's web UI password. current is only checked by the
+// server when a user changes their own existing password; pass "" otherwise.
+func (c *Client) SetPassword(userID int64, password, current string) error {
+	body := struct {
+		Password        string `json:"password"`
+		CurrentPassword string `json:"current_password,omitempty"`
+	}{Password: password, CurrentPassword: current}
+	req, err := c.newRequestWithBody(http.MethodPut, fmt.Sprintf("/api/users/%d/password", userID), body)
+	if err != nil {
+		return err
+	}
+	return c.do(req, nil)
+}
+
+// HealthCheck calls GET /healthz, which is unauthenticated and does no database
+// check, so it says the process is up, not that the API key works.
 func (c *Client) HealthCheck() error {
 	req, err := http.NewRequest(http.MethodGet, c.baseURL+"/healthz", nil)
 	if err != nil {

internal/api/client_test.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"encoding/json"
+	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -18,7 +19,9 @@ type call struct {
 	path   string
 	query  string
 	body   string
-	auth   string
+	cookie string
+	// authz is the Authorization header, which the client no longer sends at all.
+	authz string
 }
 
 // stub serves one canned response and records the request that fetched it.
@@ -28,22 +31,107 @@ func stub(t *testing.T, status int, response string) (*Client, *call) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		body, _ := io.ReadAll(r.Body)
 		got.method, got.path, got.query = r.Method, r.URL.Path, r.URL.RawQuery
-		got.body, got.auth = string(body), r.Header.Get("Authorization")
+		got.body, got.authz = string(body), r.Header.Get("Authorization")
+		if ck, err := r.Cookie(SessionCookie); err == nil {
+			got.cookie = ck.Value
+		}
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(status)
 		io.WriteString(w, response)
 	}))
 	t.Cleanup(srv.Close)
-	return NewClient(srv.URL, "test-key"), got
+	c := NewClient(srv.URL)
+	c.SetSession("test-session")
+	return c, got
 }
 
-func TestClient_SendsBearerToken(t *testing.T) {
+func TestClient_SendsTheSessionCookie(t *testing.T) {
 	c, got := stub(t, http.StatusOK, `[]`)
-	if _, err := c.ListIncidents("", false, false, 0); err != nil {
+	if _, err := c.ListIncidents(0, "", false, false, 0); err != nil {
 		t.Fatalf("list: %v", err)
 	}
-	if got.auth != "Bearer test-key" {
+	if got.cookie != "test-session" {
-		t.Errorf("expected bearer token, got %q", got.auth)
+		t.Errorf("expected the session cookie, got %q", got.cookie)
+	}
+	// The server judges a request with an Authorization header on that alone and
+	// never falls back to the cookie, so sending one would defeat the session.
+	if got.authz != "" {
+		t.Errorf("expected no Authorization header, got %q", got.authz)
+	}
+}
+
+// Login has to work over plain http, where a cookie jar would discard the
+// Secure cookie a server behind https sets.
+func TestLogin_KeepsTheSessionFromTheCookie(t *testing.T) {
+	var body string
+	var sentCookie bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, _ := io.ReadAll(r.Body)
+		body = string(b)
+		_, err := r.Cookie(SessionCookie)
+		sentCookie = err == nil
+		http.SetCookie(w, &http.Cookie{Name: SessionCookie, Value: "fresh", Path: "/", HttpOnly: true, Secure: true})
+		w.WriteHeader(http.StatusOK)
+		io.WriteString(w, `{"user":{"id":1},"has_password":true}`)
+	}))
+	t.Cleanup(srv.Close)
+
+	c := NewClient(srv.URL)
+	c.SetSession("stale")
+	token, err := c.Login("niklas", "correct horse")
+	if err != nil {
+		t.Fatalf("login: %v", err)
+	}
+	if token != "fresh" || !c.HasSession() {
+		t.Errorf("expected the new token to be kept, got %q", token)
+	}
+	if body != `{"username":"niklas","password":"correct horse"}` {
+		t.Errorf("unexpected body %q", body)
+	}
+	if sentCookie {
+		t.Error("a stale session must not ride along on the login that replaces it")
+	}
+}
+
+func TestLogin_RefusalCarriesTheServersWords(t *testing.T) {
+	c, _ := stub(t, http.StatusUnauthorized, `{"error":"invalid username or password"}`)
+	_, err := c.Login("niklas", "wrong")
+	if !IsUnauthorized(err) || !strings.Contains(err.Error(), "invalid username or password") {
+		t.Errorf("expected the server's 401 message, got %v", err)
+	}
+
+	c, _ = stub(t, http.StatusTooManyRequests, `{"error":"too many attempts"}`)
+	if _, err := c.Login("niklas", "wrong"); err == nil || IsUnauthorized(err) {
+		t.Errorf("a rate limit is not an authentication failure, got %v", err)
+	}
+}
+
+func TestLogin_NoCookieIsAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{}`)
+	if _, err := c.Login("niklas", "pw"); err == nil {
+		t.Error("a 200 without a session cookie is not a sign-in")
+	}
+}
+
+func TestLogout_ForgetsTheSession(t *testing.T) {
+	c, got := stub(t, http.StatusNoContent, ``)
+	if err := c.Logout(); err != nil {
+		t.Fatalf("logout: %v", err)
+	}
+	if got.method != "POST" || got.path != "/api/logout" || got.cookie != "test-session" {
+		t.Errorf("unexpected request %s %s cookie=%q", got.method, got.path, got.cookie)
+	}
+	if c.HasSession() {
+		t.Error("the session should be gone locally")
+	}
+}
+
+func TestIsUnauthorized(t *testing.T) {
+	if !IsUnauthorized(&StatusError{Code: 401}) {
+		t.Error("a 401 is unauthorized")
+	}
+	if IsUnauthorized(&StatusError{Code: 403}) || IsUnauthorized(errors.New("x")) || IsUnauthorized(nil) {
+		t.Error("only a 401 means the session is refused; a 403 is a permission")
 	}
 }
 
@@ -77,8 +165,10 @@ func TestClient_IncidentEndpoints(t *testing.T) {
 			http.MethodPost, "/api/incidents/7/archive", ""},
 		{"unarchive", func(c *Client) error { return c.UnarchiveIncident(7) },
 			http.MethodDelete, "/api/incidents/7/archive", ""},
-		{"add note", func(c *Client) error { _, err := c.AddNote(7, "hi"); return err },
+		{"add note", func(c *Client) error { _, err := c.AddNote(7, "hi", false); return err },
 			http.MethodPost, "/api/incidents/7/notes", ""},
+		{"similar", func(c *Client) error { _, err := c.GetSimilarIncidents(7); return err },
+			http.MethodGet, "/api/incidents/7/similar", `[]`},
 		{"delete note", func(c *Client) error { return c.DeleteNote(7, 12) },
 			http.MethodDelete, "/api/incidents/7/notes/12", ""},
 		{"stats", func(c *Client) error { _, err := c.GetIncidentStats(); return err },
@@ -107,23 +197,26 @@ func TestClient_IncidentEndpoints(t *testing.T) {
 func TestListIncidents_Filters(t *testing.T) {
 	tests := []struct {
 		name     string
+		teamID   int64
 		status   string
 		archived bool
 		snoozed  bool
 		limit    int
 		want     string
 	}{
-		{"default is the open queue", "", false, false, 0, ""},
+		{"default is the open queue", 0, "", false, false, 0, ""},
-		{"status", "triggered", false, false, 0, "status=triggered"},
+		{"status", 0, "triggered", false, false, 0, "status=triggered"},
-		{"archived", "resolved", true, false, 0, "archived=true&status=resolved"},
+		{"archived", 0, "resolved", true, false, 0, "archived=true&status=resolved"},
-		{"snoozed", "", false, true, 0, "snoozed=true"},
+		{"snoozed", 0, "", false, true, 0, "snoozed=true"},
-		{"limit", "", false, false, 500, "limit=500"},
+		{"limit", 0, "", false, false, 500, "limit=500"},
+		{"one team", 4, "", false, false, 0, "team_id=4"},
+		{"no team means all of them", 0, "triggered", false, false, 0, "status=triggered"},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			c, got := stub(t, http.StatusOK, `[]`)
-			if _, err := c.ListIncidents(tt.status, tt.archived, tt.snoozed, tt.limit); err != nil {
+			if _, err := c.ListIncidents(tt.teamID, tt.status, tt.archived, tt.snoozed, tt.limit); err != nil {
 				t.Fatalf("list: %v", err)
 			}
 			if got.query != tt.want {
@@ -170,9 +263,12 @@ func TestClient_RequestBodies(t *testing.T) {
 	// wire when asked for — and stay off it when not.
 	t.Run("assign schedule", func(t *testing.T) {
 		c, got := stub(t, http.StatusCreated, `[]`)
-		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, false); err != nil {
+		if _, err := c.AssignSchedule(9, 3, []string{"2026-07-27"}, false); err != nil {
 			t.Fatalf("assign: %v", err)
 		}
+		if got.method != "POST" || got.path != "/api/teams/9/schedule" {
+			t.Errorf("expected POST /api/teams/9/schedule, got %s %s", got.method, got.path)
+		}
 		if got.body != `{"user_id":3,"dates":["2026-07-27"]}` {
 			t.Errorf("unexpected body %q", got.body)
 		}
@@ -180,7 +276,7 @@ func TestClient_RequestBodies(t *testing.T) {
 
 	t.Run("assign schedule with replace", func(t *testing.T) {
 		c, got := stub(t, http.StatusCreated, `[]`)
-		if _, err := c.AssignSchedule(3, []string{"2026-07-27"}, true); err != nil {
+		if _, err := c.AssignSchedule(9, 3, []string{"2026-07-27"}, true); err != nil {
 			t.Fatalf("assign: %v", err)
 		}
 		if got.body != `{"user_id":3,"dates":["2026-07-27"],"replace":true}` {
@@ -246,15 +342,91 @@ func TestClient_ErrorWithoutBody(t *testing.T) {
 	}
 }
 
-// Nobody on call is a normal state, not a failure.
+// Nobody on call is a normal state, not a failure: the server answers with an
-func TestGetCurrentOnCall_404IsNotAnError(t *testing.T) {
+// empty list, one entry per team that has somebody scheduled.
-	c, _ := stub(t, http.StatusNotFound, `{"error":"no one is on call today"}`)
+func TestGetCurrentOnCall_ListsOnePerTeam(t *testing.T) {
-	entry, err := c.GetCurrentOnCall()
+	c, got := stub(t, http.StatusOK, `[
+		{"id":1,"team_id":1,"team_name":"Ops","user_id":5,"username":"alice","date":"2026-09-23"},
+		{"id":2,"team_id":2,"team_name":"Dev","user_id":6,"username":"bob","date":"2026-09-23"}]`)
+	entries, err := c.GetCurrentOnCall()
 	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
+		t.Fatalf("on call: %v", err)
 	}
-	if entry != nil {
+	if got.path != "/api/schedule/current" {
-		t.Errorf("expected nil entry, got %+v", entry)
+		t.Errorf("unexpected path %q", got.path)
+	}
+	if len(entries) != 2 || entries[0].TeamName != "Ops" || entries[1].Username != "bob" {
+		t.Errorf("unexpected entries %+v", entries)
+	}
+
+	c, _ = stub(t, http.StatusOK, `[]`)
+	if entries, err := c.GetCurrentOnCall(); err != nil || len(entries) != 0 {
+		t.Errorf("expected no entries and no error, got %v, %v", entries, err)
+	}
+}
+
+// Schedules belong to a team, so every call for one has to say which.
+func TestSchedule_IsPerTeam(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[]`)
+	if _, err := c.GetSchedule(7, "2026-09-21", "2026-09-27"); err != nil {
+		t.Fatalf("get schedule: %v", err)
+	}
+	if got.path != "/api/teams/7/schedule" || got.query != "from=2026-09-21&to=2026-09-27" {
+		t.Errorf("unexpected request %s?%s", got.path, got.query)
+	}
+
+	c, got = stub(t, http.StatusNoContent, ``)
+	if err := c.DeleteScheduleEntry(7, 12); err != nil {
+		t.Fatalf("delete: %v", err)
+	}
+	if got.method != "DELETE" || got.path != "/api/teams/7/schedule/12" {
+		t.Errorf("unexpected request %s %s", got.method, got.path)
+	}
+}
+
+func TestTeams(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `[{"id":3,"name":"Ops","created_at":"2026-09-20T10:00:00Z","role":"owner"}]`)
+	teams, err := c.ListTeams()
+	if err != nil {
+		t.Fatalf("list teams: %v", err)
+	}
+	if got.path != "/api/teams" || len(teams) != 1 || teams[0].Role != RoleOwner || teams[0].Name != "Ops" {
+		t.Errorf("unexpected %s %+v", got.path, teams)
+	}
+
+	c, got = stub(t, http.StatusOK, `[{"team_id":3,"user_id":5,"username":"alice","role":"member"}]`)
+	members, err := c.ListTeamMembers(3)
+	if err != nil {
+		t.Fatalf("list members: %v", err)
+	}
+	if got.path != "/api/teams/3/members" || len(members) != 1 || members[0].UserID != 5 {
+		t.Errorf("unexpected %s %+v", got.path, members)
+	}
+}
+
+// A server that predates teams has no /api/teams, and the TUI recognises one by
+// that 404, so it must come back as a StatusError carrying the code.
+func TestListTeams_OldServerIs404(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `{"error":"not found"}`)
+	_, err := c.ListTeams()
+	var se *StatusError
+	if !errors.As(err, &se) || se.Code != http.StatusNotFound {
+		t.Errorf("expected a 404 StatusError, got %v", err)
+	}
+}
+
+func TestUser_DecodesAdminAndDisabled(t *testing.T) {
+	var u User
+	if err := json.Unmarshal([]byte(
+		`{"id":1,"username":"a","is_admin":true,"disabled_at":"2026-09-22T08:00:00Z"}`), &u); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !u.IsAdmin || !u.IsDisabled() {
+		t.Errorf("expected an admin who is disabled, got %+v", u)
+	}
+	var other User
+	if err := json.Unmarshal([]byte(`{"id":2,"username":"b","is_admin":false}`), &other); err != nil || other.IsDisabled() {
+		t.Errorf("a user with no disabled_at must not be disabled")
 	}
 }
 
@@ -339,7 +511,7 @@ func TestAlert_DecodesIncidentLink(t *testing.T) {
 
 func TestListAlerts_ArchivedFilter(t *testing.T) {
 	c, got := stub(t, http.StatusOK, `[]`)
-	if _, err := c.ListAlerts("", true, 50); err != nil {
+	if _, err := c.ListAlerts(0, "", true, 50); err != nil {
 		t.Fatalf("list alerts: %v", err)
 	}
 	if got.path != "/api/alerts" || got.query != "archived=true&limit=50" {
@@ -363,3 +535,155 @@ func TestIncidentStats_NullAveragesStayNil(t *testing.T) {
 		t.Errorf("expected nil averages, got %v / %v", stats.MTTASeconds, stats.MTTRSeconds)
 	}
 }
+
+func TestClient_Me(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `{"user":{"id":3,"username":"erik"},"has_password":true}`)
+	me, err := c.Me()
+	if err != nil {
+		t.Fatalf("me: %v", err)
+	}
+	if got.method != http.MethodGet || got.path != "/api/me" {
+		t.Errorf("expected GET /api/me, got %s %s", got.method, got.path)
+	}
+	if me.User.ID != 3 || !me.HasPassword {
+		t.Errorf("unexpected decode %+v", me)
+	}
+}
+
+func TestClient_SetPassword(t *testing.T) {
+	c, got := stub(t, http.StatusNoContent, ``)
+	if err := c.SetPassword(2, "a brand new secret", ""); err != nil {
+		t.Fatalf("set password: %v", err)
+	}
+	if got.method != http.MethodPut || got.path != "/api/users/2/password" {
+		t.Errorf("expected PUT /api/users/2/password, got %s %s", got.method, got.path)
+	}
+	// Setting someone else's password carries no current_password at all,
+	// rather than an empty one.
+	if got.body != `{"password":"a brand new secret"}` {
+		t.Errorf("unexpected body %s", got.body)
+	}
+
+	c, got = stub(t, http.StatusNoContent, ``)
+	c.SetPassword(1, "a brand new secret", "the old one")
+	if !strings.Contains(got.body, `"current_password":"the old one"`) {
+		t.Errorf("current password missing from %s", got.body)
+	}
+}
+
+// Older servers have no /api/me; the caller tells that apart by the status
+// code, so the typed error has to carry it.
+func TestClient_StatusErrorKeepsCodeAndMessage(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `404 page not found`)
+	_, err := c.Me()
+	var se *StatusError
+	if !errors.As(err, &se) || se.Code != http.StatusNotFound {
+		t.Fatalf("expected a 404 StatusError, got %v", err)
+	}
+	if err.Error() != "server returned 404" {
+		t.Errorf("message changed: %q", err.Error())
+	}
+}
+
+func TestAuthConfig_ReadsWhatTheServerOffers(t *testing.T) {
+	c, got := stub(t, http.StatusOK,
+		`{"password_login":false,"oidc":{"enabled":true,"name":"Authentik"},"device_login":true}`)
+	cfg, err := c.AuthConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.method != http.MethodGet || got.path != "/api/auth/config" {
+		t.Errorf("wrong request: %s %s", got.method, got.path)
+	}
+	if cfg.PasswordLogin || !cfg.OIDC.Enabled || cfg.OIDC.Name != "Authentik" || !cfg.DeviceLogin {
+		t.Errorf("config: %+v", cfg)
+	}
+}
+
+func TestAuthConfig_OldServerAnswers404(t *testing.T) {
+	c, _ := stub(t, http.StatusNotFound, `{"error":"not found"}`)
+	_, err := c.AuthConfig()
+	var se *StatusError
+	if !errors.As(err, &se) || se.Code != http.StatusNotFound {
+		t.Errorf("want a 404 StatusError, got %v", err)
+	}
+}
+
+func TestStartDeviceLogin_SendsNoSessionAndReturnsTheCodes(t *testing.T) {
+	c, got := stub(t, http.StatusOK, `{"device_code":"dev","user_code":"BCDF-GHJK",
+		"verification_url":"https://terdut.example.com/device?code=BCDF-GHJK","interval":5,"expires_in":600}`)
+	d, err := c.StartDeviceLogin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.method != http.MethodPost || got.path != "/api/oidc/device" {
+		t.Errorf("wrong request: %s %s", got.method, got.path)
+	}
+	// A stale session must not ride along on a request that replaces it.
+	if got.cookie != "" {
+		t.Errorf("sent the old session %q", got.cookie)
+	}
+	if d.DeviceCode != "dev" || d.UserCode != "BCDF-GHJK" || d.Interval != 5 || d.ExpiresIn != 600 ||
+		d.VerificationURL != "https://terdut.example.com/device?code=BCDF-GHJK" {
+		t.Errorf("login: %+v", d)
+	}
+}
+
+func TestStartDeviceLogin_AReplyWithoutCodesIsAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{}`)
+	if _, err := c.StartDeviceLogin(); err == nil {
+		t.Error("an empty reply must not be taken for a started login")
+	}
+}
+
+func TestPollDeviceLogin_Outcomes(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		status int
+		body   string
+		want   error
+	}{
+		{"pending", http.StatusAccepted, `{"status":"pending"}`, ErrDevicePending},
+		{"slow down", http.StatusTooManyRequests, `{"error":"slow_down"}`, ErrDeviceSlowDown},
+		{"expired", http.StatusGone, `{"error":"expired"}`, ErrDeviceExpired},
+		{"denied", http.StatusGone, `{"error":"denied"}`, ErrDeviceDenied},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			c, got := stub(t, tc.status, tc.body)
+			tok, err := c.PollDeviceLogin("dev")
+			if !errors.Is(err, tc.want) || tok != "" {
+				t.Errorf("got %q, %v; want %v", tok, err, tc.want)
+			}
+			if got.path != "/api/oidc/device/token" || !strings.Contains(got.body, `"device_code":"dev"`) {
+				t.Errorf("wrong request: %s %s", got.path, got.body)
+			}
+			if c.HasSession() && c.session == "" {
+				t.Error("session state corrupted")
+			}
+		})
+	}
+}
+
+func TestPollDeviceLogin_ApprovalKeepsTheSessionFromTheCookie(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.SetCookie(w, &http.Cookie{Name: SessionCookie, Value: "granted"})
+		io.WriteString(w, `{"user":{}}`)
+	}))
+	t.Cleanup(srv.Close)
+	c := NewClient(srv.URL)
+	tok, err := c.PollDeviceLogin("dev")
+	if err != nil || tok != "granted" {
+		t.Fatalf("got %q, %v", tok, err)
+	}
+	if !c.HasSession() {
+		t.Error("the client must keep the session it was given")
+	}
+}
+
+func TestPollDeviceLogin_ApprovalWithoutACookieIsAnError(t *testing.T) {
+	c, _ := stub(t, http.StatusOK, `{"user":{}}`)
+	c.SetSession("")
+	if _, err := c.PollDeviceLogin("dev"); err == nil {
+		t.Error("a 200 with no session cookie is not a sign-in")
+	}
+}

internal/api/types.go

@@ -7,6 +7,8 @@ import "time"
 // alert belongs to.
 type Alert struct {
 	ID           int64             `json:"id"`
+	TeamID       int64             `json:"team_id"`
+	TeamName     string            `json:"team_name,omitempty"`
 	Fingerprint  string            `json:"fingerprint"`
 	Name         string            `json:"name"`
 	Status       string            `json:"status"`
@@ -25,10 +27,40 @@ type Alert struct {
 
 	// ResolutionSource records why a resolved alert left the firing state:
 	// "alertmanager" for a real resolved webhook, "expiry" when the server
-	// inferred it after the alert stopped being refreshed.
+	// inferred it after the alert stopped being refreshed, "deadman" for a
+	// dead man's switch that came back. Treat the value set as open.
 	ResolutionSource *string `json:"resolution_source,omitempty"`
 }
 
+// AuthConfig is how the server can be signed in to, from the unauthenticated
+// GET /api/auth/config. A server too old to have the endpoint answers 404, which
+// callers treat as "passwords only".
+type AuthConfig struct {
+	PasswordLogin bool `json:"password_login"`
+	OIDC          struct {
+		Enabled bool   `json:"enabled"`
+		Name    string `json:"name"`
+	} `json:"oidc"`
+
+	// DeviceLogin is whether the server can sign in a client that has no browser,
+	// by showing a code (see StartDeviceLogin).
+	DeviceLogin bool `json:"device_login"`
+}
+
+// DeviceLogin is a sign-in the server has started for this client: the person
+// opens VerificationURL, checks UserCode, and approves; the client polls with
+// DeviceCode until the server hands over a session.
+type DeviceLogin struct {
+	DeviceCode      string `json:"device_code"`
+	UserCode        string `json:"user_code"`
+	VerificationURL string `json:"verification_url"`
+
+	// Interval is how many seconds to wait between polls, and ExpiresIn how many
+	// the person has to approve.
+	Interval  int `json:"interval"`
+	ExpiresIn int `json:"expires_in"`
+}
+
 // Incident statuses.
 const (
 	StatusTriggered    = "triggered"
@@ -41,6 +73,8 @@ const (
 // groupKey Alertmanager computed from the operator's group_by configuration.
 type Incident struct {
 	ID          int64             `json:"id"`
+	TeamID      int64             `json:"team_id"`
+	TeamName    string            `json:"team_name,omitempty"`
 	GroupKey    string            `json:"group_key"`
 	Title       string            `json:"title"`
 	GroupLabels map[string]string `json:"group_labels"`
@@ -63,10 +97,17 @@ type Incident struct {
 
 	ResolvedAt *time.Time `json:"resolved_at,omitempty"`
 
-	// ResolutionSource is "alerts" when every alert stopped firing, or "manual"
+	// ResolutionSource is "alerts" when every alert stopped firing, "manual"
-	// when a person closed it. Treat the value set as open.
+	// when a person closed it, or "recovered" when a dead man's switch came back.
+	// Treat the value set as open.
 	ResolutionSource *string `json:"resolution_source,omitempty"`
 
+	// EscalationLevel is how far up the team's escalation ladder the incident has
+	// climbed (0 = not escalated). EscalationDueAt is when the next step fires,
+	// and is nil once the ladder is exhausted or the incident is acknowledged.
+	EscalationLevel int        `json:"escalation_level"`
+	EscalationDueAt *time.Time `json:"escalation_due_at,omitempty"`
+
 	ArchivedAt *time.Time `json:"archived_at,omitempty"`
 
 	// Alerts is populated by GET /api/incidents/{id} only.
@@ -96,6 +137,13 @@ const (
 	EventResolved       = "resolved"
 	EventNote           = "note"
 
+	// A note marked as what fixed the incident. The server leads similar
+	// incidents with these.
+	EventResolutionNote = "resolution_note"
+
+	// Written when a team's dead man's switch stops reporting.
+	EventDeadmanSilent = "deadman_silent"
+
 	// Written by the server's notifier from the delivery result, not at enqueue.
 	// Detail carries the notification kind ("triggered", "reminder", "resolved"),
 	// and on a failure the reason after it. An absent user means the page went to
@@ -154,6 +202,8 @@ type DayStat struct {
 
 type ScheduleEntry struct {
 	ID        int64     `json:"id"`
+	TeamID    int64     `json:"team_id"`
+	TeamName  string    `json:"team_name,omitempty"`
 	UserID    int64     `json:"user_id"`
 	Username  string    `json:"username"`
 	Date      string    `json:"date"` // YYYY-MM-DD
@@ -166,6 +216,14 @@ type User struct {
 	Email     string    `json:"email"`
 	CreatedAt time.Time `json:"created_at"`
 
+	// IsAdmin marks a system administrator: the only kind of user who can create
+	// or delete users and act on other people's passwords and keys.
+	IsAdmin bool `json:"is_admin"`
+
+	// DisabledAt is set when an administrator has disabled the account. A
+	// disabled user cannot sign in or use their keys.
+	DisabledAt *time.Time `json:"disabled_at,omitempty"`
+
 	// NtfyTopic is where this user's push notifications go. Nil and empty mean
 	// the same thing — no topic of their own — because the server stores a blank
 	// string as NULL. Their incidents fall back to the server's shared fallback
@@ -182,6 +240,40 @@ func (u User) Topic() string {
 	return *u.NtfyTopic
 }
 
+// IsDisabled reports whether the account has been disabled.
+func (u User) IsDisabled() bool { return u.DisabledAt != nil }
+
+// Me is GET /api/me: the caller, and whether they can sign in to the web UI.
+type Me struct {
+	User        User `json:"user"`
+	HasPassword bool `json:"has_password"`
+}
+
+// Team roles.
+const (
+	RoleOwner  = "owner"
+	RoleMember = "member"
+)
+
+// Team is a group that owns integrations, incidents, a schedule and an
+// escalation ladder. Role is the caller's role in it, and is only present on
+// the caller's own team lists (GET /api/teams).
+type Team struct {
+	ID        int64     `json:"id"`
+	Name      string    `json:"name"`
+	CreatedAt time.Time `json:"created_at"`
+	Role      string    `json:"role,omitempty"`
+}
+
+// TeamMember is one person's membership of a team.
+type TeamMember struct {
+	TeamID   int64     `json:"team_id"`
+	UserID   int64     `json:"user_id"`
+	Username string    `json:"username"`
+	Role     string    `json:"role"`
+	JoinedAt time.Time `json:"joined_at"`
+}
+
 type APIKey struct {
 	ID         int64      `json:"id"`
 	UserID     int64      `json:"user_id"`
@@ -190,3 +282,15 @@ type APIKey struct {
 	CreatedAt  time.Time  `json:"created_at"`
 	LastUsedAt *time.Time `json:"last_used_at"`
 }
+
+// SimilarIncident is an earlier, resolved incident with the same signature
+// (alert name plus stable group labels) as the one being viewed. ResolutionNotes
+// are its "what fixed it" notes; NoteCount counts its plain notes.
+type SimilarIncident struct {
+	ID              int64           `json:"id"`
+	Title           string          `json:"title"`
+	TriggeredAt     time.Time       `json:"triggered_at"`
+	ResolvedAt      time.Time       `json:"resolved_at"`
+	NoteCount       int             `json:"note_count"`
+	ResolutionNotes []IncidentEvent `json:"resolution_notes"`
+}

internal/config/config.go

@@ -13,16 +13,33 @@ const defaultRefreshInterval = 30 * time.Second
 
 type Config struct {
 	ServerURL       string
-	APIKey          string
+	Username        string // optional, prefills the sign-in form
 	RefreshInterval time.Duration
 	Theme           string
+
+	// LegacyAPIKey is set when the file still has an `api_key`. The TUI signs in
+	// with a user account now and ignores it; this is only so it can say so.
+	LegacyAPIKey bool
+
+	// Team is the team to start on, by name or id. Empty shows every team the
+	// key's user belongs to.
+	Team string
+
+	// Auth is how to sign in when the server offers a choice: "sso" starts a
+	// single sign-on login straight away, "password" (or empty) shows the
+	// password form. The server decides what is on offer; this only picks the
+	// default among it.
+	Auth string
 }
 
 type rawConfig struct {
 	ServerURL       string `yaml:"server_url"`
-	APIKey          string `yaml:"api_key"`
+	Username        string `yaml:"username,omitempty"`
+	APIKey          string `yaml:"api_key,omitempty"`          // no longer used; see Config.LegacyAPIKey
 	RefreshInterval int    `yaml:"refresh_interval,omitempty"` // seconds
 	Theme           string `yaml:"theme,omitempty"`
+	Team            string `yaml:"team,omitempty"`
+	Auth            string `yaml:"auth,omitempty"`
 }
 
 func Load() (*Config, error) {
@@ -35,7 +52,7 @@ func Load() (*Config, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  api_key: <your-api-key>\n  theme: gruvbox-dark  # optional", path)
+			return nil, fmt.Errorf("config file not found at %s\n\nCreate it with:\n  server_url: https://terdut.example.com\n  username: <your-username>  # optional, prefills the sign-in form\n  theme: gruvbox-dark  # optional\n  team: Ops            # optional, team to start on\n  auth: sso            # optional, sso or password: how to sign in by default", path)
 		}
 		return nil, fmt.Errorf("cannot read config file: %w", err)
 	}
@@ -48,8 +65,11 @@ func Load() (*Config, error) {
 	if raw.ServerURL == "" {
 		return nil, fmt.Errorf("config: 'server_url' is required")
 	}
-	if raw.APIKey == "" {
+
-		return nil, fmt.Errorf("config: 'api_key' is required")
+	switch raw.Auth {
+	case "", "password", "sso":
+	default:
+		return nil, fmt.Errorf("config: 'auth' must be sso or password, not %q", raw.Auth)
 	}
 
 	interval := defaultRefreshInterval
@@ -59,8 +79,11 @@ func Load() (*Config, error) {
 
 	return &Config{
 		ServerURL:       raw.ServerURL,
-		APIKey:          raw.APIKey,
+		Username:        raw.Username,
+		LegacyAPIKey:    raw.APIKey != "",
 		RefreshInterval: interval,
 		Theme:           raw.Theme,
+		Team:            raw.Team,
+		Auth:            raw.Auth,
 	}, nil
 }

internal/config/config_test.go

@@ -0,0 +1,84 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeConfig(t *testing.T, body string) {
+	t.Helper()
+	dir := t.TempDir()
+	t.Setenv("XDG_CONFIG_HOME", dir)
+	if err := os.MkdirAll(filepath.Join(dir, "terdut-tui"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "terdut-tui", "config.yaml"), []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestLoad_TeamIsOptional(t *testing.T) {
+	writeConfig(t, "server_url: https://terdut.example.com\n")
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Team != "" {
+		t.Errorf("expected no default team, got %q", cfg.Team)
+	}
+
+	writeConfig(t, "server_url: https://terdut.example.com\nteam: Ops\n")
+	cfg, err = Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Team != "Ops" {
+		t.Errorf("expected team Ops, got %q", cfg.Team)
+	}
+}
+
+// Signing in replaced the API key, so a config that has only a server URL is
+// complete, and one that still carries an api_key is noted rather than refused.
+func TestLoad_NoAPIKeyNeeded(t *testing.T) {
+	writeConfig(t, "server_url: https://terdut.example.com\nusername: niklas\n")
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Username != "niklas" || cfg.LegacyAPIKey {
+		t.Errorf("unexpected config %+v", cfg)
+	}
+
+	writeConfig(t, "server_url: https://terdut.example.com\napi_key: old\n")
+	cfg, err = Load()
+	if err != nil {
+		t.Fatalf("a leftover api_key must not stop the TUI starting: %v", err)
+	}
+	if !cfg.LegacyAPIKey {
+		t.Error("expected the leftover api_key to be noted")
+	}
+}
+
+func TestLoad_AuthIsOptionalAndChecked(t *testing.T) {
+	for _, tc := range []struct {
+		yaml, want string
+		bad        bool
+	}{
+		{"", "", false},
+		{"auth: password\n", "password", false},
+		{"auth: sso\n", "sso", false},
+		{"auth: oidc\n", "", true},
+	} {
+		writeConfig(t, "server_url: https://terdut.example.com\n"+tc.yaml)
+		cfg, err := Load()
+		switch {
+		case tc.bad && err == nil:
+			t.Errorf("%q: expected an error", tc.yaml)
+		case !tc.bad && err != nil:
+			t.Errorf("%q: %v", tc.yaml, err)
+		case !tc.bad && cfg.Auth != tc.want:
+			t.Errorf("%q: auth %q, want %q", tc.yaml, cfg.Auth, tc.want)
+		}
+	}
+}

internal/session/session.go

@@ -0,0 +1,98 @@
+// Package session keeps the signed-in session between runs, so the TUI does not
+// ask for a password every time it starts.
+//
+// What is stored is the server's session token, not the password: it is what the
+// web UI keeps in a cookie, it expires on the server's schedule (30 days, sliding
+// with use) and signing out or a password change ends it. It is still a
+// credential, so the file is readable by its owner only.
+package session
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+type file struct {
+	ServerURL string `json:"server_url"`
+	Token     string `json:"token"`
+}
+
+func path() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "terdut-tui", "session.json"), nil
+}
+
+// normalise makes two spellings of one server compare equal.
+func normalise(serverURL string) string {
+	return strings.TrimRight(serverURL, "/")
+}
+
+// Load returns the saved token for serverURL, or "" when there is none. A session
+// saved for a different server is not offered to this one, and an unreadable file
+// is the same as no file: the worst outcome is being asked to sign in.
+func Load(serverURL string) string {
+	p, err := path()
+	if err != nil {
+		return ""
+	}
+	data, err := os.ReadFile(p)
+	if err != nil {
+		return ""
+	}
+	var f file
+	if json.Unmarshal(data, &f) != nil || normalise(f.ServerURL) != normalise(serverURL) {
+		return ""
+	}
+	return f.Token
+}
+
+// Save stores the token for serverURL, replacing whatever was there.
+func Save(serverURL, token string) error {
+	p, err := path()
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
+		return err
+	}
+	data, err := json.Marshal(file{ServerURL: normalise(serverURL), Token: token})
+	if err != nil {
+		return err
+	}
+	// Written beside the target and renamed over it, so a crash cannot leave a
+	// half-written token, and created 0600 so it is never briefly world-readable.
+	tmp, err := os.CreateTemp(filepath.Dir(p), ".session-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	if err := os.Chmod(tmp.Name(), 0o600); err != nil {
+		tmp.Close()
+		return err
+	}
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), p)
+}
+
+// Clear forgets the saved session. Having none to forget is not an error.
+func Clear() error {
+	p, err := path()
+	if err != nil {
+		return err
+	}
+	if err := os.Remove(p); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}

internal/session/session_test.go

@@ -0,0 +1,92 @@
+package session
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func isolate(t *testing.T) {
+	t.Helper()
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+}
+
+func TestSaveThenLoad(t *testing.T) {
+	isolate(t)
+	if got := Load("https://terdut.example.com"); got != "" {
+		t.Fatalf("expected no session yet, got %q", got)
+	}
+	if err := Save("https://terdut.example.com", "tok"); err != nil {
+		t.Fatalf("save: %v", err)
+	}
+	if got := Load("https://terdut.example.com"); got != "tok" {
+		t.Errorf("expected tok, got %q", got)
+	}
+	// A trailing slash is the same server.
+	if got := Load("https://terdut.example.com/"); got != "tok" {
+		t.Errorf("a trailing slash should not lose the session, got %q", got)
+	}
+}
+
+// A token is only ever valid for the server that issued it; offering it to a
+// different one would send a credential to somebody it was never meant for.
+func TestLoadIgnoresAnotherServersSession(t *testing.T) {
+	isolate(t)
+	if err := Save("https://a.example.com", "tok"); err != nil {
+		t.Fatal(err)
+	}
+	if got := Load("https://b.example.com"); got != "" {
+		t.Errorf("a session for another server must not be reused, got %q", got)
+	}
+}
+
+func TestSaveIsOwnerOnly(t *testing.T) {
+	isolate(t)
+	if err := Save("https://a.example.com", "tok"); err != nil {
+		t.Fatal(err)
+	}
+	p, _ := path()
+	info, err := os.Stat(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if perm := info.Mode().Perm(); perm != 0o600 {
+		t.Errorf("the session file holds a credential and must be 0600, got %o", perm)
+	}
+	entries, _ := os.ReadDir(filepath.Dir(p))
+	for _, e := range entries {
+		if e.Name() != "session.json" {
+			t.Errorf("a temporary file was left behind: %s", e.Name())
+		}
+	}
+}
+
+func TestClear(t *testing.T) {
+	isolate(t)
+	if err := Clear(); err != nil {
+		t.Errorf("clearing nothing is not an error, got %v", err)
+	}
+	if err := Save("https://a.example.com", "tok"); err != nil {
+		t.Fatal(err)
+	}
+	if err := Clear(); err != nil {
+		t.Fatalf("clear: %v", err)
+	}
+	if got := Load("https://a.example.com"); got != "" {
+		t.Errorf("expected the session gone, got %q", got)
+	}
+}
+
+func TestLoadToleratesGarbage(t *testing.T) {
+	isolate(t)
+	p, _ := path()
+	if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(p, []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got := Load("https://a.example.com"); got != "" {
+		t.Errorf("an unreadable file means no session, got %q", got)
+	}
+}

internal/tui/login_test.go

@@ -0,0 +1,255 @@
+package tui
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
+	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// signedOut is a model with no session, so it starts on the sign-in form.
+func signedOut(serverURL string) Model {
+	m := NewModel(api.NewClient(serverURL), serverURL, time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	return m
+}
+
+func TestStartsOnTheFormWithoutASession(t *testing.T) {
+	m := signedOut("http://test")
+	if m.mode != modeLogin {
+		t.Fatalf("expected the sign-in form, got mode %v", m.mode)
+	}
+	// Nothing is connected without a session. The one thing started is asking
+	// how the server can be signed in to, and a server too old to be asked (404)
+	// must leave the password form as it was.
+	srv := httptest.NewServer(http.NotFoundHandler())
+	t.Cleanup(srv.Close)
+	cmd := signedOut(srv.URL).Init()
+	if cmd == nil {
+		t.Fatal("expected the form to ask the server how it can be signed in to")
+	}
+	msg, ok := cmd().(authConfigMsg)
+	if !ok {
+		t.Fatalf("expected authConfigMsg, got %#v", cmd())
+	}
+	if !msg.cfg.PasswordLogin || msg.cfg.DeviceLogin {
+		t.Errorf("an old server offers passwords only, got %+v", msg.cfg)
+	}
+}
+
+func TestStartsConnectedWithASavedSession(t *testing.T) {
+	c := api.NewClient("http://test")
+	c.SetSession("saved")
+	m := NewModel(c, "http://test", time.Minute, theme.GruvboxDark)
+	if m.mode == modeLogin {
+		t.Fatal("a saved session should be tried before asking for a password")
+	}
+	if m.Init() == nil {
+		t.Error("expected the saved session to be tried on start")
+	}
+}
+
+func TestLoginForm_ChecksBothFieldsBeforeSending(t *testing.T) {
+	m := signedOut("http://test")
+	m, cmd := press(t, m, "enter")
+	if cmd != nil || m.loggingIn || !strings.Contains(m.loginErr, "username") {
+		t.Errorf("an empty form must not be sent, got err %q", m.loginErr)
+	}
+
+	m = typeInto(t, m, "niklas")
+	m, cmd = press(t, m, "enter")
+	if cmd != nil || m.loggingIn || !strings.Contains(m.loginErr, "password") {
+		t.Errorf("a missing password must not be sent, got err %q", m.loginErr)
+	}
+}
+
+func TestLoginForm_QIsTypedNotQuit(t *testing.T) {
+	m := signedOut("http://test")
+	m = typeInto(t, m, "quentin")
+	if got := m.loginInputs[loginUsername].Value(); got != "quentin" {
+		t.Errorf("q is a letter in a username, got %q", got)
+	}
+}
+
+// The whole flow against a server: type both fields, submit, and the session is
+// kept for the next run.
+func TestLogin_SignsInAndSavesTheSession(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, _ := io.ReadAll(r.Body)
+		if r.URL.Path != "/api/login" || string(b) != `{"username":"niklas","password":"secret-pass"}` {
+			t.Errorf("unexpected request %s %s", r.URL.Path, b)
+		}
+		http.SetCookie(w, &http.Cookie{Name: api.SessionCookie, Value: "tok-1", Path: "/"})
+		io.WriteString(w, `{}`)
+	}))
+	t.Cleanup(srv.Close)
+
+	m := signedOut(srv.URL)
+	m = typeInto(t, m, "niklas")
+	m, _ = press(t, m, "tab")
+	m = typeInto(t, m, "secret-pass")
+	m, cmd := press(t, m, "enter")
+	if !m.loggingIn || cmd == nil {
+		t.Fatal("expected the sign-in to be under way")
+	}
+
+	msg := cmd()
+	if _, ok := msg.(loginDoneMsg); !ok {
+		t.Fatalf("expected loginDoneMsg, got %#v", msg)
+	}
+	if got := session.Load(srv.URL); got != "tok-1" {
+		t.Errorf("expected the session saved for next time, got %q", got)
+	}
+
+	next, connect := m.Update(msg)
+	m = next.(Model)
+	if m.mode != modeDashboard || m.loggingIn || connect == nil {
+		t.Errorf("expected to move on and connect, got mode %v", m.mode)
+	}
+	if m.loginInputs[loginPassword].Value() != "" {
+		t.Error("the password must not be kept once it has been used")
+	}
+}
+
+func TestLogin_WrongPasswordStaysOnTheForm(t *testing.T) {
+	m := signedOut("http://test")
+	m.loggingIn = true
+	next, _ := m.Update(loginErrMsg{&api.StatusError{Code: 401, Message: "invalid username or password"}})
+	m = next.(Model)
+	if m.mode != modeLogin || m.loggingIn {
+		t.Fatalf("expected to be back on the form, got mode %v", m.mode)
+	}
+	// The server gives the same 401 for an account with no password, so the
+	// message has to say so or it reads as a typo.
+	if !strings.Contains(m.loginErr, "no password") {
+		t.Errorf("expected the no-password hint, got %q", m.loginErr)
+	}
+	if m.loginFocus != loginPassword {
+		t.Error("focus should return to the password to retry")
+	}
+
+	next, _ = m.Update(loginErrMsg{&api.StatusError{Code: 429, Message: "slow down"}})
+	if got := next.(Model).loginErr; !strings.Contains(got, "too many") {
+		t.Errorf("expected the rate limit explained, got %q", got)
+	}
+	next, _ = m.Update(loginErrMsg{errors.New("dial tcp: refused")})
+	if got := next.(Model).loginErr; !strings.Contains(got, "refused") {
+		t.Errorf("other errors should show as they are, got %q", got)
+	}
+}
+
+// A 401 anywhere means the session is gone. Every action would fail the same
+// way, so it goes back to the form instead, without keeping the old data.
+func TestUnauthorized_ReturnsToTheFormAndDropsTheData(t *testing.T) {
+	for name, msg := range map[string]tea.Msg{
+		"refresh":  fetchDataErrMsg{&api.StatusError{Code: 401}},
+		"action":   actionErrMsg{&api.StatusError{Code: 401}},
+		"schedule": scheduleActionErrMsg{&api.StatusError{Code: 401}},
+		"connect":  connectErrMsg{&api.StatusError{Code: 401}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			m := sized()
+			m.incidents = []api.Incident{{ID: 1, Title: "secret incident"}}
+			m.teams = twoTeams()
+			m.isAdmin = true
+			m.loginInputs[loginUsername].SetValue("niklas")
+
+			next, cmd := m.Update(msg)
+			m = next.(Model)
+			if m.mode != modeLogin || m.connected {
+				t.Fatalf("expected the sign-in form, got mode %v connected=%v", m.mode, m.connected)
+			}
+			if len(m.incidents) != 0 || len(m.teams) != 0 || m.isAdmin {
+				t.Error("the previous session's data must not survive into the next sign-in")
+			}
+			if cmd == nil {
+				t.Error("the dead session should be forgotten on disk")
+			}
+			if !strings.Contains(m.loginNote, "session") {
+				t.Errorf("expected the reason, got %q", m.loginNote)
+			}
+			if m.loginInputs[loginUsername].Value() != "niklas" || m.loginFocus != loginPassword {
+				t.Error("the username should be kept so only the password is retyped")
+			}
+			if strings.Contains(m.View(), "secret incident") {
+				t.Error("nothing from the old session may still be on screen")
+			}
+		})
+	}
+}
+
+// A 403 is a permission, not a lost session: it must not sign anybody out.
+func TestForbidden_DoesNotSignOut(t *testing.T) {
+	m := sized()
+	next, _ := m.Update(actionErrMsg{&api.StatusError{Code: 403, Message: "administrator access required"}})
+	if got := next.(Model); got.mode == modeLogin || !got.connected {
+		t.Error("a 403 must leave the session alone")
+	}
+}
+
+func TestLogout(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	m := sized()
+	m.teams = twoTeams()
+	m.incidents = []api.Incident{{ID: 1}}
+	m, cmd := press(t, m, "L")
+	if cmd == nil {
+		t.Fatal("L should sign out")
+	}
+	next, _ := m.Update(logoutDoneMsg{})
+	m = next.(Model)
+	if m.mode != modeLogin || m.connected || len(m.incidents) != 0 {
+		t.Errorf("expected the form with nothing loaded, got mode %v", m.mode)
+	}
+	if !strings.Contains(m.loginNote, "signed out") {
+		t.Errorf("expected it to say so, got %q", m.loginNote)
+	}
+}
+
+// Signing out and in again must not leave two refresh timers running, each
+// re-arming itself for ever.
+func TestSigningInAgainStartsNoSecondTimer(t *testing.T) {
+	m := sized()
+	next, _ := m.Update(connectedMsg{})
+	m = next.(Model)
+	if !m.ticking {
+		t.Fatal("the first connect starts the refresh timer")
+	}
+	m = m.requireLogin("x")
+	if !m.ticking {
+		t.Fatal("the timer is still running while signed out")
+	}
+	// Ticks while signed out must do nothing rather than fetch.
+	if _, cmd := m.Update(tickMsg(time.Now())); cmd == nil {
+		t.Error("the timer keeps ticking")
+	}
+	if cmd := m.refreshActiveSection(); cmd != nil {
+		t.Error("no refresh should be attempted while signed out")
+	}
+}
+
+func TestLoginView_HidesThePasswordAndShowsTheNote(t *testing.T) {
+	m := signedOut("https://terdut.example.com").WithLogin("niklas", "api_key in config.yaml is no longer used")
+	if m.loginFocus != loginPassword {
+		t.Error("with the username known the cursor should start on the password")
+	}
+	m = typeInto(t, m, "hunter2-hunter2")
+	view := m.View()
+	for _, want := range []string{"Sign in to https://terdut.example.com", "niklas", "api_key in config.yaml is no longer used"} {
+		if !strings.Contains(view, want) {
+			t.Errorf("expected %q on the form:\n%s", want, view)
+		}
+	}
+	if strings.Contains(view, "hunter2") {
+		t.Error("the password must be masked")
+	}
+}

internal/tui/model_test.go

@@ -143,7 +143,7 @@ func TestIncidentRows(t *testing.T) {
 		{Title: "Unowned", Status: api.StatusTriggered, TriggeredAt: time.Now()},
 		{Title: "Quiet", Status: api.StatusTriggered, Severity: "info",
 			AssignedTo: "alice", SnoozedUntil: &future, TriggeredAt: time.Now()},
-	})
+	}, false)
 	if len(rows) != 3 {
 		t.Fatalf("expected 3 rows, got %d", len(rows))
 	}
@@ -159,12 +159,35 @@ func TestIncidentRows(t *testing.T) {
 	}
 }
 
+// Rows only carry a team cell when the columns have a Team header for it, or
+// every cell after it would sit under the wrong heading.
+func TestRows_TeamCellMatchesTeamColumn(t *testing.T) {
+	now := time.Now()
+	incRows := incidentRows([]api.Incident{{Title: "DiskFull", TeamName: "Ops", Status: api.StatusTriggered, TriggeredAt: now}}, true)
+	if got, want := len(incRows[0]), len(incidentColumns(120, true)); got != want {
+		t.Errorf("incident row has %d cells for %d columns", got, want)
+	}
+	if incRows[0][2] != "Ops" {
+		t.Errorf("expected the team after the title, got %v", incRows[0])
+	}
+	alRows := alertRows([]api.Alert{{Name: "DiskFull", StartsAt: now, ReceivedAt: now}}, true)
+	if got, want := len(alRows[0]), len(alertColumns(120, true)); got != want {
+		t.Errorf("alert row has %d cells for %d columns", got, want)
+	}
+	if alRows[0][1] != "—" {
+		t.Errorf("a missing team name should show an em dash, got %v", alRows[0])
+	}
+	if got, want := len(incidentRows([]api.Incident{{}}, false)[0]), len(incidentColumns(120, false)); got != want {
+		t.Errorf("incident row has %d cells for %d columns without teams", got, want)
+	}
+}
+
 func TestAlertRows_ShowIncidentLink(t *testing.T) {
 	id := int64(7)
 	rows := alertRows([]api.Alert{
 		{Name: "DiskFull", Status: "firing", IncidentID: &id},
 		{Name: "Orphan", Status: "resolved"},
-	})
+	}, false)
 	if rows[0][4] != "#7" {
 		t.Errorf("expected #7, got %q", rows[0][4])
 	}
@@ -204,31 +227,31 @@ func TestUserManageRows_ShowMissingTopic(t *testing.T) {
 // the window width.
 func TestColumnWidthsFitTheTerminal(t *testing.T) {
 	for _, width := range []int{100, 110, 140, 200} {
-		for name, cols := range map[string][]int{
+		// Five cells each, or six once a Team column is added. userManageColumns
-			"incident": widths(incidentColumns(width)),
+		// is five cells as well: username, email, topic, flags, created.
-			"alert":    widths(alertColumns(width)),
+		for name, tc := range map[string]struct {
+			cols  []table.Column
+			cells int
+		}{
+			"incident":           {incidentColumns(width, false), 5},
+			"incident with team": {incidentColumns(width, true), 6},
+			"alert":              {alertColumns(width, false), 5},
+			"alert with team":    {alertColumns(width, true), 6},
+			"user":               {userManageColumns(width), 5},
 		} {
 			sum := 0
-			for _, w := range cols {
+			for _, w := range widths(tc.cols) {
 				sum += w
 			}
-			const padding = 10 // bubbles applies Padding(0, 1) to each of five cells
+			padding := 2 * tc.cells // bubbles applies Padding(0, 1) to each cell
+			if len(tc.cols) != tc.cells {
+				t.Errorf("%s has %d columns, expected %d", name, len(tc.cols), tc.cells)
+			}
 			if sum+padding != width {
 				t.Errorf("%s columns at width %d sum to %d+%d = %d",
 					name, width, sum, padding, sum+padding)
 			}
 		}
-
-		// The users table is four cells, so its padding budget differs.
-		sum := 0
-		for _, w := range widths(userManageColumns(width)) {
-			sum += w
-		}
-		const userPadding = 8
-		if sum+userPadding != width {
-			t.Errorf("user columns at width %d sum to %d+%d = %d",
-				width, sum, userPadding, sum+userPadding)
-		}
 	}
 }
 
@@ -236,7 +259,7 @@ func TestColumnWidthsFitTheTerminal(t *testing.T) {
 // what must not happen is a negative or zero column.
 func TestColumnWidthsStayPositiveWhenNarrow(t *testing.T) {
 	for _, width := range []int{20, 40, 60} {
-		cols := append(widths(incidentColumns(width)), widths(alertColumns(width))...)
+		cols := append(widths(incidentColumns(width, true)), widths(alertColumns(width, true))...)
 		cols = append(cols, widths(userManageColumns(width))...)
 		for _, w := range cols {
 			if w < 1 {
@@ -287,6 +310,7 @@ func scheduledWeek(entries []api.ScheduleEntry) Model {
 	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
 	m.width, m.height = 120, 40
 	m.connected = true
+	m.teams = []api.Team{{ID: 1, Name: "Ops", Role: api.RoleOwner}}
 	m.activeSection = sectionSchedule
 	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
 	m.scheduleEntries = entries

internal/tui/sso_test.go

@@ -0,0 +1,378 @@
+package tui
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// fakeServer is the device-login half of terdut-server: it starts a login,
+// answers polls with whatever poll says, and records what it was asked.
+type fakeServer struct {
+	*httptest.Server
+	mu    sync.Mutex
+	polls int
+	// poll is called for each poll and writes the response.
+	poll func(w http.ResponseWriter, n int)
+}
+
+func newFakeServer(t *testing.T) *fakeServer {
+	t.Helper()
+	f := &fakeServer{}
+	f.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/api/oidc/device":
+			io.WriteString(w, `{"device_code":"dev-1","user_code":"BCDF-GHJK",
+				"verification_url":"https://terdut.example.com/device?code=BCDF-GHJK","interval":5,"expires_in":600}`)
+		case "/api/oidc/device/token":
+			f.mu.Lock()
+			f.polls++
+			n := f.polls
+			f.mu.Unlock()
+			var body struct {
+				DeviceCode string `json:"device_code"`
+			}
+			json.NewDecoder(r.Body).Decode(&body)
+			if body.DeviceCode != "dev-1" {
+				t.Errorf("polled with %q", body.DeviceCode)
+			}
+			f.poll(w, n)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(f.Close)
+	return f
+}
+
+func pending(w http.ResponseWriter, _ int) {
+	w.WriteHeader(http.StatusAccepted)
+	io.WriteString(w, `{"status":"pending"}`)
+}
+
+// offering is a signed-out model that has been told what the server offers.
+func offering(t *testing.T, url string, cfg api.AuthConfig, pref string) (Model, tea.Cmd) {
+	t.Helper()
+	m := signedOut(url).WithAuth(pref)
+	next, cmd := m.Update(authConfigMsg{cfg})
+	return next.(Model), cmd
+}
+
+func both() api.AuthConfig {
+	c := api.AuthConfig{PasswordLogin: true, DeviceLogin: true}
+	c.OIDC.Enabled, c.OIDC.Name = true, "Authentik"
+	return c
+}
+
+func ssoOnly() api.AuthConfig {
+	c := both()
+	c.PasswordLogin = false
+	return c
+}
+
+func update(t *testing.T, m Model, msg tea.Msg) (Model, tea.Cmd) {
+	t.Helper()
+	next, cmd := m.Update(msg)
+	return next.(Model), cmd
+}
+
+func ctrlO() tea.KeyMsg { return tea.KeyMsg{Type: tea.KeyCtrlO} }
+
+func TestSSO_OfferedAlongsidePasswordsIsNotStartedByItself(t *testing.T) {
+	m, cmd := offering(t, "http://test", both(), "")
+	if cmd != nil || m.sso.active {
+		t.Fatal("with passwords on offer nothing should start until asked")
+	}
+	view := m.View()
+	for _, want := range []string{"Username:", "Password:", "ctrl+o to sign in with Authentik"} {
+		if !strings.Contains(view, want) {
+			t.Errorf("expected %q on the form:\n%s", want, view)
+		}
+	}
+}
+
+func TestSSO_NotOfferedShowsNoSuchHint(t *testing.T) {
+	m, _ := offering(t, "http://test", api.AuthConfig{PasswordLogin: true}, "")
+	if strings.Contains(m.View(), "ctrl+o") {
+		t.Error("a server with no SSO must not advertise it")
+	}
+	if m, cmd := update(t, m, ctrlO()); cmd != nil || m.sso.active {
+		t.Error("ctrl+o must do nothing when the server has no SSO")
+	}
+}
+
+func TestSSO_FullFlow(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	f := newFakeServer(t)
+	f.poll = func(w http.ResponseWriter, n int) {
+		if n < 3 {
+			pending(w, n)
+			return
+		}
+		http.SetCookie(w, &http.Cookie{Name: api.SessionCookie, Value: "tok-sso", Path: "/"})
+		io.WriteString(w, `{"user":{}}`)
+	}
+	m, _ := offering(t, f.URL, both(), "")
+
+	// ctrl+o asks the server for a login.
+	m, cmd := update(t, m, ctrlO())
+	if !m.sso.active || cmd == nil {
+		t.Fatal("ctrl+o should start a single sign-on login")
+	}
+	if !strings.Contains(m.View(), "Contacting the server") {
+		t.Errorf("before the server answers:\n%s", m.View())
+	}
+	started, ok := cmd().(deviceStartedMsg)
+	if !ok {
+		t.Fatalf("expected deviceStartedMsg, got %#v", cmd())
+	}
+
+	// The link and the code are shown, and a poll is scheduled.
+	m, cmd = update(t, m, started)
+	if cmd == nil || m.sso.interval != 5*time.Second {
+		t.Fatalf("expected a poll to be scheduled every 5s, got cmd %v interval %v", cmd != nil, m.sso.interval)
+	}
+	view := m.View()
+	for _, want := range []string{"Sign in with Authentik", "https://terdut.example.com/device?code=BCDF-GHJK",
+		"BCDF-GHJK", "Waiting for approval", "10 minutes", "esc·cancel"} {
+		if !strings.Contains(view, want) {
+			t.Errorf("expected %q while waiting:\n%s", want, view)
+		}
+	}
+	if strings.Contains(view, "Username:") {
+		t.Error("the password form must be out of the way while waiting")
+	}
+
+	// Two polls that find nothing, each scheduling the next.
+	for i := 1; i <= 2; i++ {
+		m, cmd = update(t, m, devicePollMsg{m.sso.attempt})
+		if cmd == nil {
+			t.Fatalf("poll %d: expected a request", i)
+		}
+		pend, ok := cmd().(devicePendingMsg)
+		if !ok {
+			t.Fatalf("poll %d: expected devicePendingMsg", i)
+		}
+		if m, cmd = update(t, m, pend); cmd == nil || !m.sso.active {
+			t.Fatalf("poll %d: expected to keep waiting", i)
+		}
+	}
+
+	// The third is approved: the session is saved and it moves on and connects.
+	m, cmd = update(t, m, devicePollMsg{m.sso.attempt})
+	done := cmd()
+	if _, ok := done.(loginDoneMsg); !ok {
+		t.Fatalf("expected loginDoneMsg, got %#v", done)
+	}
+	if got := session.Load(f.URL); got != "tok-sso" {
+		t.Errorf("session saved for next time: %q", got)
+	}
+	m, connect := update(t, m, done)
+	if m.mode != modeDashboard || m.sso.active || connect == nil {
+		t.Errorf("expected to move on and connect: mode %v active %v", m.mode, m.sso.active)
+	}
+	if f.polls != 3 {
+		t.Errorf("%d polls, want 3", f.polls)
+	}
+}
+
+func TestSSO_EscCancelsBeforeItQuits(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	m, _ = update(t, m, deviceStartedMsg{m.sso.attempt, api.DeviceLogin{DeviceCode: "d", UserCode: "AAAA-BBBB", VerificationURL: "u", Interval: 5, ExpiresIn: 600}})
+
+	m, cmd := update(t, m, tea.KeyMsg{Type: tea.KeyEsc})
+	if cmd != nil {
+		t.Fatal("the first esc backs out of the wait; it must not quit")
+	}
+	if m.sso.active || m.mode != modeLogin || !strings.Contains(m.View(), "Username:") {
+		t.Errorf("expected the password form back, active %v", m.sso.active)
+	}
+	if _, cmd := update(t, m, tea.KeyMsg{Type: tea.KeyEsc}); cmd == nil {
+		t.Error("esc on the form quits, as it always did")
+	} else if _, ok := cmd().(tea.QuitMsg); !ok {
+		t.Errorf("expected a quit, got %#v", cmd())
+	}
+}
+
+// The answers of an attempt that was cancelled arrive late and must change nothing.
+func TestSSO_StaleMessagesAreIgnored(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	old := m.sso.attempt
+	m = m.cancelSSO()
+
+	for name, msg := range map[string]tea.Msg{
+		"started": deviceStartedMsg{old, api.DeviceLogin{DeviceCode: "d", UserCode: "X", Interval: 5}},
+		"poll":    devicePollMsg{old},
+		"pending": devicePendingMsg{attempt: old},
+		"failed":  deviceFailedMsg{old, api.ErrDeviceExpired},
+	} {
+		next, cmd := update(t, m, msg)
+		if cmd != nil || next.sso.active || next.sso.login != nil || next.loginErr != "" {
+			t.Errorf("%s from a cancelled attempt was acted on: %+v err %q", name, next.sso, next.loginErr)
+		}
+	}
+
+	// A new attempt is not confused by the old one's messages either.
+	m, _ = update(t, m, ctrlO())
+	if m.sso.attempt == old {
+		t.Fatal("a new attempt must have a new number")
+	}
+	if _, cmd := update(t, m, devicePollMsg{old}); cmd != nil {
+		t.Error("the old attempt's poll must not run in the new one")
+	}
+}
+
+func TestSSO_NoPasswordsStartsByItselfAndEnterRestarts(t *testing.T) {
+	m, cmd := offering(t, "http://test", ssoOnly(), "")
+	if !m.sso.active || cmd == nil {
+		t.Fatal("a server with no passwords should start signing in with SSO straight away")
+	}
+	m = m.cancelSSO()
+	view := m.View()
+	if strings.Contains(view, "Username:") || !strings.Contains(view, "This server signs in with Authentik") {
+		t.Errorf("no password form on an SSO-only server:\n%s", view)
+	}
+	if !strings.Contains(view, "enter·sign in with Authentik") {
+		t.Errorf("the footer should say what enter does:\n%s", view)
+	}
+	if m, cmd = update(t, m, tea.KeyMsg{Type: tea.KeyEnter}); !m.sso.active || cmd == nil {
+		t.Error("enter should start it again")
+	}
+}
+
+func TestSSO_ConfigPrefersItWhenOffered(t *testing.T) {
+	if m, cmd := offering(t, "http://test", both(), "sso"); !m.sso.active || cmd == nil {
+		t.Error("auth: sso should start by itself when the server offers it")
+	}
+	// ...and shows the password form when it does not, rather than a dead end.
+	m, cmd := offering(t, "http://test", api.AuthConfig{PasswordLogin: true}, "sso")
+	if m.sso.active || cmd != nil || !strings.Contains(m.View(), "Username:") {
+		t.Error("auth: sso against a server without SSO must fall back to the form")
+	}
+	if m, cmd := offering(t, "http://test", both(), "password"); m.sso.active || cmd != nil {
+		t.Error("auth: password must not start SSO")
+	}
+}
+
+func TestSSO_ExpiredAndRefusedReturnToTheFormWithAReason(t *testing.T) {
+	for name, tc := range map[string]struct {
+		err  error
+		want string
+	}{
+		"expired": {api.ErrDeviceExpired, "expired"},
+		"refused": {api.ErrDeviceDenied, "refused"},
+		"no sso":  {&api.StatusError{Code: 404}, "does not offer"},
+		"limited": {&api.StatusError{Code: 429}, "too many"},
+		"other":   {errors.New("dial tcp: refused"), "Authentik failed"},
+	} {
+		m, _ := offering(t, "http://test", both(), "")
+		m, _ = update(t, m, ctrlO())
+		m, cmd := update(t, m, deviceFailedMsg{m.sso.attempt, tc.err})
+		if cmd != nil || m.sso.active || !strings.Contains(m.loginErr, tc.want) {
+			t.Errorf("%s: active %v err %q, want it to contain %q", name, m.sso.active, m.loginErr, tc.want)
+		}
+		if !strings.Contains(m.View(), tc.want) {
+			t.Errorf("%s: the reason is not shown:\n%s", name, m.View())
+		}
+	}
+}
+
+func TestSSO_SlowDownLengthensTheInterval(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	m, _ = update(t, m, deviceStartedMsg{m.sso.attempt, api.DeviceLogin{DeviceCode: "d", UserCode: "A", VerificationURL: "u", Interval: 5, ExpiresIn: 60}})
+	m, cmd := update(t, m, devicePendingMsg{attempt: m.sso.attempt, slower: true})
+	if m.sso.interval != 10*time.Second || cmd == nil {
+		t.Errorf("interval %v, cmd %v; want 10s and another poll", m.sso.interval, cmd != nil)
+	}
+}
+
+func TestSSO_ADeadConnectionEndsTheWaitButABlipDoesNot(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	m, _ = update(t, m, deviceStartedMsg{m.sso.attempt, api.DeviceLogin{DeviceCode: "d", UserCode: "A", VerificationURL: "u", Interval: 5, ExpiresIn: 60}})
+	blip := errors.New("connection reset")
+
+	// Two failures, then a good answer: the count starts over.
+	for range 2 {
+		m, _ = update(t, m, devicePendingMsg{attempt: m.sso.attempt, err: blip})
+	}
+	m, _ = update(t, m, devicePendingMsg{attempt: m.sso.attempt})
+	if !m.sso.active || m.sso.failures != 0 {
+		t.Fatalf("a good answer should reset the failures: %+v", m.sso)
+	}
+
+	// Three in a row is a dead connection.
+	var cmd tea.Cmd
+	for range maxPollFailures {
+		m, cmd = update(t, m, devicePendingMsg{attempt: m.sso.attempt, err: blip})
+	}
+	if m.sso.active || cmd != nil || !strings.Contains(m.loginErr, "connection reset") {
+		t.Errorf("expected to give up with the reason: active %v err %q", m.sso.active, m.loginErr)
+	}
+}
+
+func TestSSO_TypingGoesNowhereWhileWaiting(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "")
+	m, _ = update(t, m, ctrlO())
+	m = typeInto(t, m, "hunter2")
+	if got := m.loginInputs[m.loginFocus].Value(); got != "" {
+		t.Errorf("keys typed during the wait ended up in a field: %q", got)
+	}
+	if _, cmd := update(t, m, tea.KeyMsg{Type: tea.KeyEnter}); cmd != nil {
+		t.Error("enter during the wait must not start anything")
+	}
+}
+
+// After the session ends the form comes back; it must still know what the
+// server offers, and follow the config's preference without a second question.
+func TestSSO_SessionEndingReturnsToSSOWhenPreferred(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "sso")
+	m = m.cancelSSO()
+	m.mode = modeDashboard // signed in, as loginDoneMsg leaves it
+	m, _ = update(t, m, connectedMsg{})
+	m, cmd := update(t, m, fetchDataErrMsg{&api.StatusError{Code: 401}})
+	if m.mode != modeLogin || m.authInfo == nil {
+		t.Fatalf("expected the form with what the server offers kept: mode %v info %v", m.mode, m.authInfo)
+	}
+	if !m.sso.active || cmd == nil {
+		t.Error("with auth: sso an ended session should go straight to SSO")
+	}
+}
+
+func TestSSO_SigningOutDoesNotSignStraightBackIn(t *testing.T) {
+	m, _ := offering(t, "http://test", both(), "sso")
+	m = m.cancelSSO()
+	m.mode = modeDashboard
+	m, _ = update(t, m, connectedMsg{})
+	m, cmd := update(t, m, logoutDoneMsg{})
+	if m.mode != modeLogin || m.sso.active || cmd != nil {
+		t.Errorf("a deliberate sign-out must wait: mode %v active %v", m.mode, m.sso.active)
+	}
+}
+
+// A session that ends before the server was ever asked (the TUI started on a
+// saved session) still has to learn what to offer.
+func TestSSO_LearnsWhatIsOfferedWhenTheSessionEndsFirst(t *testing.T) {
+	c := api.NewClient("http://test")
+	c.SetSession("saved")
+	m := NewModel(c, "http://test", time.Minute, signedOut("x").theme)
+	m.width, m.height = 120, 40
+	m, cmd := update(t, m, fetchDataErrMsg{&api.StatusError{Code: 401}})
+	if m.mode != modeLogin || m.authInfo != nil || cmd == nil {
+		t.Errorf("expected the form and a question to the server: mode %v info %v cmd %v", m.mode, m.authInfo, cmd != nil)
+	}
+}

internal/tui/update.go

@@ -1,8 +1,13 @@
 package tui
 
 import (
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
 	"strconv"
 	"strings"
+	"time"
 
 	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"github.com/atotto/clipboard"
@@ -11,6 +16,15 @@ import (
 )
 
 func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	// A 401 from anything means the server no longer honours the session: it
+	// expired, was ended from the web UI, or the account was disabled. Whatever
+	// was being done cannot succeed, so go back to the sign-in form and say why,
+	// rather than leaving every action to fail with "server returned 401".
+	if err := msgError(msg); api.IsUnauthorized(err) && m.mode != modeLogin {
+		m, entry := m.requireLogin("your session has ended — sign in again").enterLogin(true)
+		return m, tea.Batch(forgetSessionCmd(), entry)
+	}
+
 	switch msg := msg.(type) {
 	case tea.WindowSizeMsg:
 		m.width = msg.Width
@@ -31,13 +45,106 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	// ── Dashboard messages ────────────────────────────────────────────────
 
+	case loginDoneMsg:
+		m.loggingIn = false
+		m.sso = ssoLogin{attempt: m.sso.attempt + 1}
+		m.loginErr = ""
+		m.loginNote = ""
+		m.loginInputs[loginPassword].Reset()
+		m.blurLoginForm()
+		m.mode = modeDashboard
+		m.err = nil
+		return m, connectCmd(m.client)
+
+	case loginErrMsg:
+		m.loggingIn = false
+		m.loginErr = loginErrorText(msg.err)
+		m.loginInputs[loginPassword].Reset()
+		m.focusLogin(loginPassword)
+		return m, nil
+
+	case logoutDoneMsg:
+		// Not auto-started even with auth: sso: somebody who has just signed out
+		// did not ask to be signed straight back in.
+		return m.requireLogin("you have signed out").enterLogin(false)
+
+	case authConfigMsg:
+		cfg := msg.cfg
+		m.authInfo = &cfg
+		if m.mode == modeLogin && m.autoStartsSSO() {
+			return m.startSSO()
+		}
+		return m, nil
+
+	case deviceStartedMsg:
+		if !m.sso.current(msg.attempt) {
+			return m, nil
+		}
+		login := msg.login
+		m.sso.login = &login
+		m.sso.interval = time.Duration(login.Interval) * time.Second
+		if m.sso.interval <= 0 {
+			m.sso.interval = defaultDevicePoll
+		}
+		return m, devicePollAfter(m.sso.attempt, m.sso.interval)
+
+	case devicePollMsg:
+		if !m.sso.current(msg.attempt) || m.sso.login == nil {
+			return m, nil
+		}
+		return m, pollDeviceCmd(m.client, m.serverURL, m.sso.attempt, m.sso.login.DeviceCode)
+
+	case devicePendingMsg:
+		if !m.sso.current(msg.attempt) {
+			return m, nil
+		}
+		if msg.err != nil {
+			if m.sso.failures++; m.sso.failures >= maxPollFailures {
+				return m.failSSO(msg.err), nil
+			}
+		} else {
+			m.sso.failures = 0
+		}
+		if msg.slower {
+			m.sso.interval += defaultDevicePoll
+		}
+		return m, devicePollAfter(m.sso.attempt, m.sso.interval)
+
+	case deviceFailedMsg:
+		if !m.sso.current(msg.attempt) {
+			return m, nil
+		}
+		return m.failSSO(msg.err), nil
+
 	case connectedMsg:
+		firstConnect := len(m.teams) == 0
 		m.connected = true
 		m.err = nil
+		m.teams = msg.teams
+		m.meID = msg.me.User.ID
+		m.isAdmin = msg.me.User.IsAdmin
+		var statusCmd tea.Cmd
+		if firstConnect && m.activeTeamID == 0 && m.defaultTeam != "" {
+			if t, ok := resolveTeam(m.teams, m.defaultTeam); ok {
+				m.activeTeamID = t.ID
+			} else {
+				m.statusMsg = fmt.Sprintf("team %q not found -- showing all teams", m.defaultTeam)
+				statusCmd = clearStatusCmd()
+			}
+		}
+		m.rebuildIncidentTable()
+		m.rebuildTable()
+		m.rebuildArchivedTable()
+		var tick tea.Cmd
+		if !m.ticking {
+			m.ticking = true
+			tick = tickCmd(m.refreshInterval)
+		}
 		return m, tea.Batch(
-			tickCmd(m.refreshInterval),
+			tick,
-			fetchIncidentsCmd(m.client, m.incidentFilter),
+			fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter),
 			fetchStatsCmd(m.client),
+			statusCmd,
 		)
 
 	case connectErrMsg:
@@ -91,6 +198,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case incidentDetailFetchedMsg:
 		m.selectedIncident = msg.incident
 		m.timeline = msg.timeline
+		m.similar = msg.similar
 		m.detailLoading = false
 		if m.noteCursor >= len(noteEvents(m.timeline)) {
 			m.noteCursor = -1
@@ -157,6 +265,17 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.rebuildUserManageTable()
 		return m, nil
 
+	case pickerReadyMsg:
+		if m.mode != modeUserPicker {
+			return m, nil // the picker was closed before the lookup came back
+		}
+		m.users = msg.users
+		m.pickerMembers = msg.members
+		m.usersLoading = false
+		m.rebuildUserPickerTable()
+		m.rebuildUserManageTable()
+		return m, nil
+
 	case apiKeyCreatedMsg:
 		m.revealedAPIKey = msg.key
 		m.mode = modeAPIKeyReveal
@@ -167,8 +286,27 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.mode = modeDashboard
 		return m, clearStatusCmd()
 
+	case meFetchedMsg:
+		if m.mode != modePasswordSet {
+			return m, nil // the form was closed before the lookup came back
+		}
+		m.pwLoading = false
+		m.pwNeedCurrent = msg.me.User.ID == m.selectedUser.ID && msg.me.HasPassword
+		m.pwFocus = pwNew
+		if m.pwNeedCurrent {
+			m.pwFocus = pwCurrent
+		}
+		m.pwInputs[m.pwFocus].Focus()
+		return m, nil
+
+	case passwordSetMsg:
+		m.statusMsg = "password set for " + msg.username + " -- their other web sessions were signed out"
+		return m, clearStatusCmd()
+
 	case userActionErrMsg:
 		m.usersLoading = false
+		m.pwLoading = false
+		m.blurPasswordForm()
 		m.statusMsg = "error: " + msg.err.Error()
 		m.mode = modeDashboard
 		return m, clearStatusCmd()
@@ -205,22 +343,32 @@ func (m Model) refreshActiveSection() tea.Cmd {
 
 	switch m.activeSection {
 	case sectionIncidents:
-		return tea.Batch(fetchIncidentsCmd(m.client, m.incidentFilter), fetchStatsCmd(m.client))
+		return tea.Batch(fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter), fetchStatsCmd(m.client))
 	case sectionAlerts:
-		return tea.Batch(fetchAlertsCmd(m.client, m.alertFilter), fetchStatsCmd(m.client))
+		return tea.Batch(fetchAlertsCmd(m.client, m.activeTeamID, m.alertFilter), fetchStatsCmd(m.client))
 	case sectionStats:
 		// Both: fetchStatsCmd feeds the Incident Response block, the other the charts.
 		return tea.Batch(fetchStatsCmd(m.client), fetchDetailStatsCmd(m.client))
 	case sectionArchived:
-		return fetchArchivedIncidentsCmd(m.client)
+		return fetchArchivedIncidentsCmd(m.client, m.activeTeamID)
 	case sectionSchedule:
-		return fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+		return m.fetchScheduleWindowCmd()
 	case sectionUsers:
 		return fetchUsersCmd(m.client)
 	}
 	return nil
 }
 
+// fetchScheduleWindowCmd reloads the schedule window for the schedule's team, or
+// does nothing when the caller belongs to none.
+func (m Model) fetchScheduleWindowCmd() tea.Cmd {
+	team, ok := m.scheduleTeam()
+	if !ok {
+		return nil
+	}
+	return fetchScheduleCmd(m.client, team.ID, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+}
+
 // routeKey passes the key to the active component then to our handler.
 func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	switch m.mode {
@@ -279,6 +427,22 @@ func (m Model) routeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	case modeAPIKeyMenu, modeAPIKeyReveal:
 		return m.handleKey(msg)
 
+	case modeLogin:
+		var inputCmd tea.Cmd
+		if !m.loggingIn && !m.sso.active && m.offersPasswords() {
+			m.loginInputs[m.loginFocus], inputCmd = m.loginInputs[m.loginFocus].Update(msg)
+		}
+		m2, ourCmd := m.handleKey(msg)
+		return m2, tea.Batch(inputCmd, ourCmd)
+
+	case modePasswordSet:
+		var inputCmd tea.Cmd
+		if !m.pwLoading {
+			m.pwInputs[m.pwFocus], inputCmd = m.pwInputs[m.pwFocus].Update(msg)
+		}
+		m2, ourCmd := m.handleKey(msg)
+		return m2, tea.Batch(inputCmd, ourCmd)
+
 	default: // modeDashboard
 		if m.connected {
 			switch m.activeSection {
@@ -338,6 +502,10 @@ func (m Model) handleKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		return m.handleUserNotifyEditKey(msg)
 	case modeAPIKeyMenu:
 		return m.handleAPIKeyMenuKey(msg)
+	case modePasswordSet:
+		return m.handlePasswordKey(msg)
+	case modeLogin:
+		return m.handleLoginKey(msg)
 	case modeAPIKeyCreate:
 		return m.handleAPIKeyCreateKey(msg)
 	case modeAPIKeyReveal:
@@ -379,14 +547,27 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		case sectionIncidents:
 			m.incidentFilter = nextFilter(incidentFilters, m.incidentFilter)
 			m.loading = true
-			return m, fetchIncidentsCmd(m.client, m.incidentFilter)
+			return m, fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter)
 		case sectionAlerts:
 			m.alertFilter = nextFilter(alertFilters, m.alertFilter)
 			m.loading = true
-			return m, fetchAlertsCmd(m.client, m.alertFilter)
+			return m, fetchAlertsCmd(m.client, m.activeTeamID, m.alertFilter)
 		}
 		return m, nil
 
+	case "L":
+		if !m.connected {
+			return m, nil
+		}
+		m.statusMsg = "Signing out…"
+		return m, logoutCmd(m.client)
+
+	case "T":
+		if !m.connected || len(m.teams) == 0 {
+			return m, nil
+		}
+		return m.switchTeam()
+
 	case "enter":
 		switch m.activeSection {
 		case sectionIncidents:
@@ -419,14 +600,14 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 				m.statusMsg = "resolve the incident before archiving it"
 				return m, clearStatusCmd()
 			}
-			return m, archiveIncidentCmd(m.client, inc.ID, m.incidentFilter)
+			return m, archiveIncidentCmd(m.client, inc.ID, m.activeTeamID, m.incidentFilter)
 		case sectionArchived:
 			i := m.archivedTable.Cursor()
 			if i < 0 || i >= len(m.archivedIncidents) {
 				return m, nil
 			}
 			m.archivedLoading = true
-			return m, unarchiveIncidentCmd(m.client, m.archivedIncidents[i].ID)
+			return m, unarchiveIncidentCmd(m.client, m.archivedIncidents[i].ID, m.activeTeamID)
 		}
 		return m, nil
 
@@ -434,16 +615,18 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 	case "left", "h":
 		if m.activeSection == sectionSchedule {
 			m.scheduleWindow = m.scheduleWindow.AddDate(0, 0, -7)
-			m.scheduleLoading = true
+			cmd := m.fetchScheduleWindowCmd()
-			return m, fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+			m.scheduleLoading = cmd != nil
+			return m, cmd
 		}
 		return m, nil
 
 	case "right", "l":
 		if m.activeSection == sectionSchedule {
 			m.scheduleWindow = m.scheduleWindow.AddDate(0, 0, 7)
-			m.scheduleLoading = true
+			cmd := m.fetchScheduleWindowCmd()
-			return m, fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+			m.scheduleLoading = cmd != nil
+			return m, cmd
 		}
 		return m, nil
 
@@ -451,6 +634,9 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if m.activeSection != sectionSchedule || !m.connected {
 			return m, nil
 		}
+		if !m.checkScheduleEditable() {
+			return m, clearStatusCmd()
+		}
 		m.pickerAssignWeek = false
 		return m.openUserPicker(pickerSchedule)
 
@@ -458,6 +644,9 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if m.activeSection != sectionSchedule || !m.connected {
 			return m, nil
 		}
+		if !m.checkScheduleEditable() {
+			return m, clearStatusCmd()
+		}
 		m.pickerAssignWeek = true
 		return m.openUserPicker(pickerSchedule)
 
@@ -487,6 +676,10 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			if cursor < 0 || cursor >= len(m.users) {
 				return m, nil
 			}
+			if !m.isAdmin {
+				m.statusMsg = "only administrators can delete users"
+				return m, clearStatusCmd()
+			}
 			m.selectedUser = m.users[cursor]
 			m.confirmTarget = confirmDeleteUser
 			m.mode = modeConfirm
@@ -497,6 +690,10 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if m.activeSection != sectionUsers || !m.connected {
 			return m, nil
 		}
+		if !m.isAdmin {
+			m.statusMsg = "only administrators can create users"
+			return m, clearStatusCmd()
+		}
 		m.userFormInputs[0].Reset()
 		m.userFormInputs[1].Reset()
 		m.userFormFocus = 0
@@ -514,6 +711,10 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, nil
 		}
 		m.selectedUser = m.users[cursor]
+		if !m.canManageUser(m.selectedUser) {
+			cmd := m.refuseUserAction("notification topic")
+			return m, cmd
+		}
 		// Prefilled with what they have, so editing a topic does not mean
 		// retyping it, and clearing one is a deliberate wipe.
 		m.ntfyTopicInput.SetValue(m.selectedUser.Topic())
@@ -531,20 +732,55 @@ func (m Model) handleDashboardKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, nil
 		}
 		m.selectedUser = m.users[cursor]
+		if !m.canManageUser(m.selectedUser) {
+			cmd := m.refuseUserAction("API keys")
+			return m, cmd
+		}
 		m.mode = modeAPIKeyMenu
 		return m, nil
+
+	case "p":
+		if m.activeSection != sectionUsers || !m.connected || len(m.users) == 0 {
+			return m, nil
+		}
+		cursor := m.userManageTable.Cursor()
+		if cursor >= len(m.users) {
+			return m, nil
+		}
+		m.selectedUser = m.users[cursor]
+		if !m.canManageUser(m.selectedUser) {
+			cmd := m.refuseUserAction("password")
+			return m, cmd
+		}
+		for i := range m.pwInputs {
+			m.pwInputs[i].Reset()
+			m.pwInputs[i].Blur()
+		}
+		m.pwNeedCurrent = false
+		m.pwLoading = true
+		m.mode = modePasswordSet
+		// Whether the form needs the current password depends on who the key
+		// belongs to, which the client does not otherwise know.
+		return m, fetchMeCmd(m.client)
 	}
 
 	return m, nil
 }
 
+// refuseUserAction explains a self-or-admin action declined up front, and is what
+// the status bar clears afterwards. The server refuses these with a 403 anyway.
+func (m *Model) refuseUserAction(what string) tea.Cmd {
+	m.statusMsg = "only administrators can change another user's " + what
+	return clearStatusCmd()
+}
+
 // loadSectionIfEmpty fetches a section's data the first time it is opened.
 func (m *Model) loadSectionIfEmpty() tea.Cmd {
 	switch m.activeSection {
 	case sectionAlerts:
 		if len(m.alerts) == 0 {
 			m.loading = true
-			return fetchAlertsCmd(m.client, m.alertFilter)
+			return fetchAlertsCmd(m.client, m.activeTeamID, m.alertFilter)
 		}
 	case sectionStats:
 		if !m.statsLoaded {
@@ -554,12 +790,13 @@ func (m *Model) loadSectionIfEmpty() tea.Cmd {
 	case sectionArchived:
 		if len(m.archivedIncidents) == 0 {
 			m.archivedLoading = true
-			return fetchArchivedIncidentsCmd(m.client)
+			return fetchArchivedIncidentsCmd(m.client, m.activeTeamID)
 		}
 	case sectionSchedule:
 		if len(m.scheduleDays) == 0 {
-			m.scheduleLoading = true
+			cmd := m.fetchScheduleWindowCmd()
-			return fetchScheduleCmd(m.client, m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
+			m.scheduleLoading = cmd != nil
+			return cmd
 		}
 	case sectionUsers:
 		if len(m.users) == 0 {
@@ -590,6 +827,18 @@ func (m Model) openIncident(inc api.Incident) (Model, tea.Cmd) {
 func (m Model) openUserPicker(target pickerTarget) (Model, tea.Cmd) {
 	m.pickerTarget = target
 	m.mode = modeUserPicker
+	if target == pickerSchedule {
+		// Only the team's own members can go on its rota, so who they are has to
+		// be known before anybody is offered.
+		team, ok := m.scheduleTeam()
+		if !ok {
+			m.mode = modeDashboard
+			return m, nil
+		}
+		m.pickerMembers = nil
+		m.usersLoading = true
+		return m, fetchPickerCmd(m.client, team.ID)
+	}
 	if len(m.users) == 0 {
 		m.usersLoading = true
 		return m, fetchUsersCmd(m.client)
@@ -598,6 +847,63 @@ func (m Model) openUserPicker(target pickerTarget) (Model, tea.Cmd) {
 	return m, nil
 }
 
+// switchTeam steps the active team through all teams, then each of the caller's
+// teams in turn, and reloads what depends on it. Sections that are not on screen
+// are emptied rather than fetched, so they load when next opened; the incident
+// queue is the exception because it is what the caller returns to.
+func (m Model) switchTeam() (Model, tea.Cmd) {
+	next := int64(0)
+	if m.activeTeamID == 0 {
+		next = m.teams[0].ID
+	} else {
+		for i, t := range m.teams {
+			if t.ID == m.activeTeamID && i+1 < len(m.teams) {
+				next = m.teams[i+1].ID
+			}
+		}
+	}
+	m.activeTeamID = next
+
+	m.incidents, m.alerts, m.archivedIncidents = nil, nil, nil
+	m.scheduleEntries, m.scheduleDays, m.currentOnCall = nil, nil, nil
+	m.loading = true
+	m.rebuildIncidentTable()
+	m.rebuildTable()
+	m.rebuildArchivedTable()
+	m.rebuildScheduleTable()
+
+	label := "all teams"
+	if t, ok := m.activeTeam(); ok {
+		label = t.Name
+	}
+	m.statusMsg = "Team: " + label
+
+	cmds := []tea.Cmd{clearStatusCmd()}
+	if m.activeSection != sectionIncidents {
+		cmds = append(cmds, fetchIncidentsCmd(m.client, m.activeTeamID, m.incidentFilter))
+	}
+	cmds = append(cmds, m.refreshActiveSection())
+	if m.activeSection == sectionSchedule {
+		m.scheduleLoading = true
+	}
+	return m, tea.Batch(cmds...)
+}
+
+// checkScheduleEditable says why a schedule change is refused, in the status
+// bar, and reports whether it may go ahead. The server enforces the same rule.
+func (m *Model) checkScheduleEditable() bool {
+	team, ok := m.scheduleTeam()
+	switch {
+	case !ok:
+		m.statusMsg = "you are not in any team"
+	case !m.canEditSchedule(team):
+		m.statusMsg = "only owners of " + team.Name + " can change its schedule"
+	default:
+		return true
+	}
+	return false
+}
+
 // nextFilter advances a filter cycle, wrapping at the end.
 func nextFilter(cycle []string, current string) string {
 	for i, f := range cycle {
@@ -681,13 +987,14 @@ func (m Model) handleIncidentDetailKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		if inc.ArchivedAt != nil {
 			m.archivedLoading = true
 			m.mode = modeDashboard
-			return m, unarchiveIncidentCmd(m.client, inc.ID)
+			return m, unarchiveIncidentCmd(m.client, inc.ID, m.activeTeamID)
 		}
 		m.mode = modeDashboard
-		return m, archiveIncidentCmd(m.client, inc.ID, m.incidentFilter)
+		return m, archiveIncidentCmd(m.client, inc.ID, m.activeTeamID, m.incidentFilter)
 
-	case "c":
+	case "c", "C":
 		m.mode = modeNote
+		m.notePinned = msg.String() == "C"
 		m.noteInput.Reset()
 		m.noteInput.Focus()
 		m.detailViewport.Height = m.detailViewportHeight()
@@ -780,7 +1087,7 @@ func (m Model) handleNoteKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeIncidentDetail
 		m.noteInput.Blur()
 		m.detailViewport.Height = m.detailViewportHeight()
-		return m, addNoteCmd(m.client, m.selectedIncident.ID, content)
+		return m, addNoteCmd(m.client, m.selectedIncident.ID, content, m.notePinned)
 	}
 
 	return m, nil
@@ -844,7 +1151,8 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		m.mode = modeDashboard
 		m.pendingDeleteEntry = nil
 		m.scheduleLoading = true
-		return m, deleteScheduleEntryCmd(m.client, entry.ID,
+		team, _ := m.scheduleTeam()
+		return m, deleteScheduleEntryCmd(m.client, team.ID, entry.ID,
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 
 	case confirmDeleteUser:
@@ -861,7 +1169,8 @@ func (m Model) handleConfirmKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 			return m, nil
 		}
 		m.scheduleLoading = true
-		return m, assignScheduleCmd(m.client, p.userID, p.dates, true,
+		team, _ := m.scheduleTeam()
+		return m, assignScheduleCmd(m.client, team.ID, p.userID, p.dates, true,
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
@@ -882,10 +1191,11 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 
 	case "enter":
 		cursor := m.userPickerTable.Cursor()
-		if cursor < 0 || cursor >= len(m.users) {
+		pickable := m.pickerUsers()
+		if cursor < 0 || cursor >= len(pickable) {
 			return m, nil
 		}
-		user := m.users[cursor]
+		user := pickable[cursor]
 
 		if m.pickerTarget == pickerIncidentAssignee {
 			m.mode = modeIncidentDetail
@@ -935,7 +1245,8 @@ func (m Model) handleUserPickerKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 		// Nobody else loses anything, but the server rejects any date that
 		// already exists — including days this same person already holds, which
 		// is a no-op worth letting through silently.
-		return m, assignScheduleCmd(m.client, user.ID, dates, m.scheduleOccupied(dates),
+		team, _ := m.scheduleTeam()
+		return m, assignScheduleCmd(m.client, team.ID, user.ID, dates, m.scheduleOccupied(dates),
 			m.scheduleWindow, m.scheduleWindow.AddDate(0, 0, 6))
 	}
 
@@ -1127,3 +1438,282 @@ func (m Model) handleAPIKeyRevokeKey(msg tea.KeyMsg) (Model, tea.Cmd) {
 
 	return m, nil
 }
+
+// ── Set password ──────────────────────────────────────────────────────────────
+
+// pwFields is the set-password form's fields in tab order.
+func (m Model) pwFields() []int {
+	if m.pwNeedCurrent {
+		return []int{pwCurrent, pwNew, pwRepeat}
+	}
+	return []int{pwNew, pwRepeat}
+}
+
+func (m *Model) blurPasswordForm() {
+	for i := range m.pwInputs {
+		m.pwInputs[i].Blur()
+	}
+}
+
+func (m Model) handlePasswordKey(msg tea.KeyMsg) (Model, tea.Cmd) {
+	switch msg.String() {
+	case "esc":
+		m.blurPasswordForm()
+		m.pwLoading = false
+		m.mode = modeDashboard
+		return m, nil
+	}
+	if m.pwLoading {
+		return m, nil
+	}
+
+	switch msg.String() {
+	case "tab", "shift+tab":
+		fields := m.pwFields()
+		i := slices.Index(fields, m.pwFocus)
+		step := 1
+		if msg.String() == "shift+tab" {
+			step = len(fields) - 1
+		}
+		m.pwInputs[m.pwFocus].Blur()
+		m.pwFocus = fields[(i+step)%len(fields)]
+		m.pwInputs[m.pwFocus].Focus()
+		return m, nil
+
+	case "enter":
+		password := m.pwInputs[pwNew].Value()
+		switch {
+		case m.pwNeedCurrent && m.pwInputs[pwCurrent].Value() == "":
+			m.statusMsg = "enter your current password"
+			return m, clearStatusCmd()
+		case len(password) < minPasswordLen:
+			m.statusMsg = fmt.Sprintf("the password must be at least %d characters", minPasswordLen)
+			return m, clearStatusCmd()
+		case password != m.pwInputs[pwRepeat].Value():
+			m.statusMsg = "the two new passwords do not match"
+			return m, clearStatusCmd()
+		}
+		current := ""
+		if m.pwNeedCurrent {
+			current = m.pwInputs[pwCurrent].Value()
+		}
+		m.blurPasswordForm()
+		m.mode = modeDashboard
+		m.statusMsg = "Setting password…"
+		return m, setPasswordCmd(m.client, m.selectedUser, password, current)
+	}
+	return m, nil
+}
+
+// ── Sign in ───────────────────────────────────────────────────────────────────
+
+// msgError digs the error out of the messages that carry one, so the 401 check
+// in Update covers them all in one place.
+func msgError(msg tea.Msg) error {
+	switch msg := msg.(type) {
+	case connectErrMsg:
+		return msg.err
+	case fetchDataErrMsg:
+		return msg.err
+	case detailErrMsg:
+		return msg.err
+	case actionErrMsg:
+		return msg.err
+	case detailStatsErrMsg:
+		return msg.err
+	case scheduleFetchErrMsg:
+		return msg.err
+	case scheduleActionErrMsg:
+		return msg.err
+	case userActionErrMsg:
+		return msg.err
+	}
+	return nil
+}
+
+// requireLogin returns to the sign-in form with everything the previous session
+// loaded dropped, so a different account never sees the last one's incidents.
+func (m Model) requireLogin(note string) Model {
+	name := m.loginInputs[loginUsername].Value()
+	fresh := NewModel(m.client, m.serverURL, m.refreshInterval, m.theme)
+	fresh.width, fresh.height = m.width, m.height
+	fresh.defaultTeam = m.defaultTeam
+	fresh.authInfo, fresh.authPref = m.authInfo, m.authPref
+	fresh.ticking = m.ticking
+	fresh.mode = modeLogin
+	fresh.loginInputs[loginUsername].SetValue(name)
+	fresh.loginNote = note
+	fresh.focusLogin(loginUsername)
+	if name != "" {
+		fresh.focusLogin(loginPassword)
+	}
+	fresh.rebuildIncidentTable()
+	fresh.rebuildTable()
+	fresh.rebuildArchivedTable()
+	fresh.rebuildScheduleTable()
+	fresh.rebuildUserPickerTable()
+	fresh.rebuildUserManageTable()
+	return fresh
+}
+
+func (m *Model) blurLoginForm() {
+	for i := range m.loginInputs {
+		m.loginInputs[i].Blur()
+	}
+}
+
+func (m *Model) focusLogin(field int) {
+	m.blurLoginForm()
+	m.loginFocus = field
+	m.loginInputs[field].Focus()
+}
+
+// loginErrorText turns a failed sign-in into something to act on. The server
+// answers a wrong password, an unknown user and an account with no password with
+// the same 401, so the last one has to be named here or it reads as a typo.
+func loginErrorText(err error) string {
+	var se *api.StatusError
+	if errors.As(err, &se) {
+		switch se.Code {
+		case http.StatusUnauthorized:
+			return "invalid username or password — an account with no password cannot sign in; set one in the web UI first"
+		case http.StatusTooManyRequests:
+			return "too many attempts — wait a few minutes and try again"
+		}
+	}
+	return err.Error()
+}
+
+// ── Single sign-on ────────────────────────────────────────────────────────────
+
+// current reports whether a message belongs to the attempt in progress. Anything
+// else is the late answer of one that was cancelled, replaced or finished.
+func (s ssoLogin) current(attempt int) bool { return s.active && attempt == s.attempt }
+
+// canSSO is whether the server can sign in a client with no browser.
+func (m Model) canSSO() bool { return m.authInfo != nil && m.authInfo.DeviceLogin }
+
+// offersPasswords is whether the password form is worth showing. Until the
+// server has answered it is: the form is what a server too old to be asked has.
+func (m Model) offersPasswords() bool { return m.authInfo == nil || m.authInfo.PasswordLogin }
+
+// autoStartsSSO is whether the form should start a single sign-on login by
+// itself: when the config asks for it, and when the server has no passwords, so
+// that there is nothing else to show.
+func (m Model) autoStartsSSO() bool {
+	return m.canSSO() && !m.sso.active && (m.authPref == "sso" || !m.offersPasswords())
+}
+
+// ssoName is what the provider is called on screen.
+func (m Model) ssoName() string {
+	if m.authInfo != nil && m.authInfo.OIDC.Name != "" {
+		return m.authInfo.OIDC.Name
+	}
+	return "single sign-on"
+}
+
+// enterLogin is what to do on arriving at the sign-in form other than by
+// starting up: learn how the server can be signed in to if that is not known,
+// and, when auto is set, start a single sign-on login if the config or the
+// server's lack of passwords calls for one.
+func (m Model) enterLogin(auto bool) (Model, tea.Cmd) {
+	if m.authInfo == nil {
+		return m, authConfigCmd(m.client)
+	}
+	if auto && m.autoStartsSSO() {
+		return m.startSSO()
+	}
+	return m, nil
+}
+
+// startSSO begins a device login, replacing any earlier attempt.
+func (m Model) startSSO() (Model, tea.Cmd) {
+	m.sso = ssoLogin{attempt: m.sso.attempt + 1, active: true}
+	m.loginErr = ""
+	return m, startDeviceCmd(m.client, m.sso.attempt)
+}
+
+// cancelSSO abandons the attempt in progress. The server forgets the login when
+// it expires; there is nothing to tell it.
+func (m Model) cancelSSO() Model {
+	m.sso = ssoLogin{attempt: m.sso.attempt + 1}
+	return m
+}
+
+// failSSO ends the attempt and says why on the form.
+func (m Model) failSSO(err error) Model {
+	m = m.cancelSSO()
+	m.loginErr = ssoErrorText(err, m.ssoName())
+	return m
+}
+
+// ssoErrorText turns a failed single sign-on into something to act on.
+func ssoErrorText(err error, name string) string {
+	var se *api.StatusError
+	switch {
+	case errors.Is(err, api.ErrDeviceExpired):
+		return "the sign-in expired before it was approved — start it again"
+	case errors.Is(err, api.ErrDeviceDenied):
+		return "the sign-in was refused in the browser"
+	case errors.As(err, &se) && se.Code == http.StatusNotFound:
+		return "this server does not offer sign-in with " + name
+	case errors.As(err, &se) && se.Code == http.StatusTooManyRequests:
+		return "too many attempts — wait a few minutes and try again"
+	}
+	return "sign-in with " + name + " failed: " + err.Error()
+}
+
+func (m Model) handleLoginKey(msg tea.KeyMsg) (Model, tea.Cmd) {
+	switch msg.String() {
+	case "ctrl+c":
+		return m, tea.Quit
+	case "esc":
+		// Backs out of a single sign-on wait before it quits the program, so a
+		// wrong turn does not cost the session.
+		if m.sso.active {
+			return m.cancelSSO(), nil
+		}
+		return m, tea.Quit
+	}
+	if m.loggingIn || m.sso.active {
+		return m, nil
+	}
+	if msg.String() == "ctrl+o" && m.canSSO() {
+		return m.startSSO()
+	}
+	// With no password form there is one thing to do, and enter does it.
+	if msg.String() == "enter" && !m.offersPasswords() {
+		if m.canSSO() {
+			return m.startSSO()
+		}
+		return m, nil
+	}
+
+	switch msg.String() {
+	case "tab", "shift+tab", "down", "up":
+		next := loginPassword
+		if m.loginFocus == loginPassword {
+			next = loginUsername
+		}
+		m.focusLogin(next)
+		return m, nil
+
+	case "enter":
+		username := strings.TrimSpace(m.loginInputs[loginUsername].Value())
+		password := m.loginInputs[loginPassword].Value()
+		switch {
+		case username == "":
+			m.loginErr = "enter your username"
+			m.focusLogin(loginUsername)
+			return m, nil
+		case password == "":
+			m.loginErr = "enter your password"
+			m.focusLogin(loginPassword)
+			return m, nil
+		}
+		m.loggingIn = true
+		m.loginErr = ""
+		return m, loginCmd(m.client, m.serverURL, username, password)
+	}
+	return m, nil
+}

internal/tui/update_test.go

@@ -35,6 +35,7 @@ func sized() Model {
 	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
 	m.width, m.height = 120, 40
 	m.connected = true
+	m.isAdmin = true // most handlers are being tested for what they do, not who may
 	return m
 }
 
@@ -320,6 +321,8 @@ func pickingOnCall(entries []api.ScheduleEntry, dayIndex int, week bool) Model {
 		{ID: 1, Username: "niklas", Email: "n@example.com"},
 		{ID: 2, Username: "alex", Email: "a@example.com"},
 	}
+	m.pickerTarget = pickerSchedule
+	m.pickerMembers = map[int64]bool{1: true, 2: true}
 	m.rebuildUserPickerTable()
 	m.scheduleTable.SetCursor(dayIndex)
 	m.pickerAssignWeek = week
@@ -693,6 +696,8 @@ func containsAll(s string, subs ...string) bool {
 func TestSchedule_AssignWeekAfterStartupSizingDoesNotPanic(t *testing.T) {
 	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
 	m.connected = true
+	m.isAdmin = true
+	m.teams = []api.Team{{ID: 1, Name: "Ops", Role: api.RoleOwner}}
 	m.activeSection = sectionSchedule
 	m.scheduleWindow = time.Date(2026, 7, 27, 0, 0, 0, 0, time.UTC)
 
@@ -718,9 +723,253 @@ func TestSchedule_AssignWeekAfterStartupSizingDoesNotPanic(t *testing.T) {
 	if m.mode != modeUserPicker {
 		t.Fatalf("W did not open the user picker, got mode %v", m.mode)
 	}
+	// The picker waits for the team's members before offering anybody.
+	next, _ = m.Update(pickerReadyMsg{
+		users:   []api.User{{ID: 1, Username: "niklas", Email: "n@example.com"}},
+		members: map[int64]bool{1: true},
+	})
+	m = next.(Model)
 	m, _ = press(t, m, "enter") // panicked here
 
 	if m.mode == modeUserPicker {
 		t.Fatal("enter left the picker open; the assignment never went anywhere")
 	}
 }
+
+// ── Teams ─────────────────────────────────────────────────────────────────
+
+func twoTeams() []api.Team {
+	return []api.Team{
+		{ID: 1, Name: "Ops", Role: api.RoleOwner},
+		{ID: 2, Name: "Dev", Role: api.RoleMember},
+	}
+}
+
+func TestConnected_LoadsTeamsAndWhoIAm(t *testing.T) {
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark)
+	m.width, m.height = 120, 40
+	next, _ := m.Update(connectedMsg{
+		teams: twoTeams(),
+		me:    api.Me{User: api.User{ID: 7, IsAdmin: true}},
+	})
+	m = next.(Model)
+	if len(m.teams) != 2 || m.meID != 7 || !m.isAdmin {
+		t.Errorf("expected teams, id and admin flag to be kept, got %+v %d %v", m.teams, m.meID, m.isAdmin)
+	}
+	if m.activeTeamID != 0 {
+		t.Errorf("with no default team every team shows, got active %d", m.activeTeamID)
+	}
+}
+
+func TestConnected_DefaultTeamFromConfig(t *testing.T) {
+	for _, want := range []string{"dev", "2"} { // by name, any case, or by id
+		m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark).WithDefaultTeam(want)
+		next, _ := m.Update(connectedMsg{teams: twoTeams()})
+		if got := next.(Model).activeTeamID; got != 2 {
+			t.Errorf("default team %q: expected team 2, got %d", want, got)
+		}
+	}
+
+	m := NewModel(nil, "http://test", time.Minute, theme.GruvboxDark).WithDefaultTeam("nope")
+	next, cmd := m.Update(connectedMsg{teams: twoTeams()})
+	m = next.(Model)
+	if m.activeTeamID != 0 || !strings.Contains(m.statusMsg, "nope") {
+		t.Errorf("an unknown default should fall back to all teams and say so, got %d %q",
+			m.activeTeamID, m.statusMsg)
+	}
+	if cmd == nil {
+		t.Error("expected the initial fetches to still be issued")
+	}
+}
+
+func TestSwitchTeam_CyclesAllThenEachTeam(t *testing.T) {
+	m := sized()
+	m.teams = twoTeams()
+	var seen []int64
+	for i := 0; i < 4; i++ {
+		var cmd tea.Cmd
+		m, cmd = press(t, m, "T")
+		if cmd == nil {
+			t.Fatal("switching team should reload")
+		}
+		seen = append(seen, m.activeTeamID)
+	}
+	want := []int64{1, 2, 0, 1}
+	for i := range want {
+		if seen[i] != want[i] {
+			t.Fatalf("expected the cycle %v, got %v", want, seen)
+		}
+	}
+}
+
+func TestSwitchTeam_ClearsRowsFromTheOtherTeam(t *testing.T) {
+	m := sized()
+	m.teams = twoTeams()
+	m.incidents = []api.Incident{{ID: 1, Title: "old", TeamName: "Ops"}}
+	m.rebuildIncidentTable()
+	m, _ = press(t, m, "T")
+	if len(m.incidents) != 0 {
+		t.Errorf("the previous team's incidents must not linger, got %d", len(m.incidents))
+	}
+	if !strings.Contains(m.statusMsg, "Ops") {
+		t.Errorf("expected the status bar to name the team, got %q", m.statusMsg)
+	}
+}
+
+func TestSwitchTeam_NoTeamsDoesNothing(t *testing.T) {
+	m, cmd := press(t, sized(), "T")
+	if cmd != nil || m.activeTeamID != 0 {
+		t.Errorf("without teams T has nothing to switch to")
+	}
+}
+
+func TestScheduleTeam(t *testing.T) {
+	m := sized()
+	if _, ok := m.scheduleTeam(); ok {
+		t.Error("no teams means no schedule")
+	}
+	m.teams = []api.Team{{ID: 2, Name: "Dev", Role: api.RoleMember}, {ID: 1, Name: "Ops", Role: api.RoleOwner}}
+	if tm, _ := m.scheduleTeam(); tm.ID != 1 {
+		t.Errorf("with all teams showing the one the caller owns is used, got %d", tm.ID)
+	}
+	m.activeTeamID = 2
+	if tm, _ := m.scheduleTeam(); tm.ID != 2 {
+		t.Errorf("the active team wins, got %d", tm.ID)
+	}
+}
+
+func TestSchedule_OnlyOwnersAndAdminsEdit(t *testing.T) {
+	m := scheduledWeek(nil)
+	m.isAdmin = false
+	m.teams = []api.Team{{ID: 1, Name: "Ops", Role: api.RoleMember}}
+	m, cmd := press(t, m, "+")
+	if m.mode == modeUserPicker {
+		t.Fatal("a plain member must not get as far as the picker")
+	}
+	if !strings.Contains(m.statusMsg, "owners of Ops") {
+		t.Errorf("expected the reason in the status bar, got %q", m.statusMsg)
+	}
+	if cmd == nil {
+		t.Error("the message should clear itself")
+	}
+
+	m.isAdmin = true // administrators may edit any team's rota
+	m.statusMsg = ""
+	m, _ = press(t, m, "+")
+	if m.mode != modeUserPicker {
+		t.Errorf("an administrator should reach the picker, got mode %v", m.mode)
+	}
+}
+
+// The picker fetches the team's members, and offers nobody until they arrive:
+// the server answers 404 for anyone else.
+func TestSchedulePicker_OffersOnlyTeamMembers(t *testing.T) {
+	m := scheduledWeek(nil)
+	m, cmd := press(t, m, "+")
+	if cmd == nil || !m.usersLoading {
+		t.Fatal("opening the picker should start loading the members")
+	}
+	if got := len(m.pickerUsers()); got != 0 {
+		t.Errorf("nobody should be offered before the members are known, got %d", got)
+	}
+
+	disabled := time.Now()
+	next, _ := m.Update(pickerReadyMsg{
+		users: []api.User{
+			{ID: 1, Username: "niklas"},
+			{ID: 2, Username: "outsider"},
+			{ID: 3, Username: "gone", DisabledAt: &disabled},
+		},
+		members: map[int64]bool{1: true, 3: true},
+	})
+	m = next.(Model)
+	got := m.pickerUsers()
+	if len(got) != 1 || got[0].Username != "niklas" {
+		t.Errorf("expected only the enabled member, got %+v", got)
+	}
+	if rows := m.userPickerTable.Rows(); len(rows) != 1 {
+		t.Errorf("the table should match, got %d rows", len(rows))
+	}
+}
+
+func TestUsers_NonAdminsCannotCreateOrDelete(t *testing.T) {
+	m := threeUsers()
+	m.isAdmin = false
+	m.meID = 1
+	m, _ = press(t, m, "n")
+	if m.mode != modeDashboard || !strings.Contains(m.statusMsg, "administrators") {
+		t.Errorf("n should be refused with a reason, got mode %v %q", m.mode, m.statusMsg)
+	}
+	m, _ = press(t, m, "d")
+	if m.mode != modeDashboard {
+		t.Errorf("d should not ask to delete for a non-admin, got mode %v", m.mode)
+	}
+}
+
+func TestUsers_NonAdminManagesOnlyThemselves(t *testing.T) {
+	m := threeUsers() // cursor on erik, id 3
+	m.isAdmin = false
+	m.meID = 1
+	for _, key := range []string{"t", "k", "p"} {
+		next, _ := press(t, m, key)
+		if next.mode != modeDashboard {
+			t.Errorf("%s on somebody else's row should be refused, got mode %v", key, next.mode)
+		}
+		if !strings.Contains(next.statusMsg, "another user's") {
+			t.Errorf("%s: expected the reason, got %q", key, next.statusMsg)
+		}
+	}
+
+	m.userManageTable.SetCursor(0) // niklas, id 1: themselves
+	if next, _ := press(t, m, "k"); next.mode != modeAPIKeyMenu {
+		t.Errorf("a user may manage their own keys, got mode %v", next.mode)
+	}
+}
+
+func TestUserFlags(t *testing.T) {
+	now := time.Now()
+	cases := []struct {
+		u    api.User
+		want string
+	}{
+		{api.User{}, "—"},
+		{api.User{IsAdmin: true}, "admin"},
+		{api.User{DisabledAt: &now}, "disabled"},
+		{api.User{IsAdmin: true, DisabledAt: &now}, "admin,disabled"},
+	}
+	for _, c := range cases {
+		if got := userFlags(c.u); got != c.want {
+			t.Errorf("userFlags(%+v) = %q, want %q", c.u, got, c.want)
+		}
+	}
+}
+
+// Rebuilding a list on every refresh must not send the cursor back to the top.
+func TestRefresh_KeepsTheCursor(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{{ID: 1}, {ID: 2}, {ID: 3}}
+	m.rebuildIncidentTable()
+	m.incidentTable.SetCursor(2)
+	next, _ := m.Update(incidentsFetchedMsg{incidents: m.incidents})
+	if got := next.(Model).incidentTable.Cursor(); got != 2 {
+		t.Errorf("expected the cursor to stay on row 2, got %d", got)
+	}
+}
+
+// The Team column comes and goes as the team switches, and the table must
+// survive its column count changing under rows that are already loaded.
+func TestTeamColumn_AppearsWithoutPanicking(t *testing.T) {
+	m := sized()
+	m.incidents = []api.Incident{{ID: 1, Title: "a", TeamName: "Ops"}}
+	m.rebuildIncidentTable()
+	m.teams = twoTeams()
+	m.rebuildIncidentTable() // five columns become six over a five-cell row
+	if got := len(m.incidentTable.Columns()); got != 6 {
+		t.Errorf("expected a Team column across two teams, got %d columns", got)
+	}
+	m.activeTeamID = 1
+	m.rebuildIncidentTable()
+	if got := len(m.incidentTable.Columns()); got != 5 {
+		t.Errorf("expected the Team column to go when one team is chosen, got %d", got)
+	}
+}

internal/tui/users_test.go

@@ -0,0 +1,204 @@
+package tui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-tui/internal/api"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// threeUsers is the Users section with the cursor on the last of three users.
+func threeUsers() Model {
+	m := onUsers([]api.User{
+		{ID: 1, Username: "niklas"},
+		{ID: 2, Username: "anna"},
+		{ID: 3, Username: "erik"},
+	})
+	m.userManageTable.SetCursor(2)
+	return m
+}
+
+// The table used to see k before the section did, take it as "up", and the
+// handler then opened API keys for the user above the one selected.
+func TestUsers_APIKeysOpenForTheSelectedUser(t *testing.T) {
+	m, _ := press(t, threeUsers(), "k")
+	if m.mode != modeAPIKeyMenu {
+		t.Fatalf("expected the API key menu, got mode %v", m.mode)
+	}
+	if m.selectedUser.Username != "erik" {
+		t.Errorf("API keys opened for %s, want erik", m.selectedUser.Username)
+	}
+}
+
+// Same collision with d, which the table read as half a page down: the delete
+// confirmation named a different user than the one under the cursor.
+func TestUsers_DeleteTargetsTheSelectedUser(t *testing.T) {
+	m := threeUsers()
+	m.userManageTable.SetCursor(0)
+	m, _ = press(t, m, "d")
+	if m.mode != modeConfirm || m.selectedUser.Username != "niklas" {
+		t.Errorf("delete asked about %q in mode %v, want niklas", m.selectedUser.Username, m.mode)
+	}
+}
+
+func TestSchedule_DeleteTargetsTheSelectedDay(t *testing.T) {
+	m := sized()
+	m.activeSection = sectionSchedule
+	m.scheduleEntries = []api.ScheduleEntry{
+		{ID: 10, UserID: 1, Username: "niklas", Date: m.scheduleWindow.Format("2006-01-02")},
+		{ID: 11, UserID: 2, Username: "anna", Date: m.scheduleWindow.AddDate(0, 0, 1).Format("2006-01-02")},
+	}
+	m.scheduleDays = buildScheduleDays(m.scheduleWindow, m.scheduleEntries)
+	m.rebuildScheduleTable()
+	m.scheduleTable.SetCursor(0)
+	m, _ = press(t, m, "d")
+	if m.pendingDeleteEntry == nil || m.pendingDeleteEntry.ID != 10 {
+		t.Errorf("schedule delete targeted %+v, want entry 10", m.pendingDeleteEntry)
+	}
+}
+
+// f cycles the filter; it must not also page the cursor down.
+func TestFilter_DoesNotMoveTheCursor(t *testing.T) {
+	m := sized()
+	m.incidents = make([]api.Incident, 40)
+	for i := range m.incidents {
+		m.incidents[i] = api.Incident{ID: int64(i + 1), Title: "x", Status: api.StatusTriggered, TriggeredAt: time.Now()}
+	}
+	m.rebuildIncidentTable()
+	m, _ = press(t, m, "f")
+	if c := m.incidentTable.Cursor(); c != 0 {
+		t.Errorf("f moved the cursor to %d", c)
+	}
+}
+
+// The arrow keys still move the users table, now that k is an action there.
+func TestUsers_ArrowKeysStillNavigate(t *testing.T) {
+	m := threeUsers()
+	next, _ := m.Update(keyUp())
+	if c := next.(Model).userManageTable.Cursor(); c != 1 {
+		t.Errorf("up arrow left the cursor on %d, want 1", c)
+	}
+}
+
+func TestPassword_OpensForTheSelectedUserAndLooksUpWhoIAm(t *testing.T) {
+	m, cmd := press(t, threeUsers(), "p")
+	if m.mode != modePasswordSet || m.selectedUser.Username != "erik" {
+		t.Fatalf("expected the password form for erik, got mode %v for %q", m.mode, m.selectedUser.Username)
+	}
+	if !m.pwLoading || cmd == nil {
+		t.Error("the form should look up /api/me before it is usable")
+	}
+	if !strings.Contains(m.View(), "Checking who this key belongs to") {
+		t.Error("the form should say it is waiting")
+	}
+}
+
+func TestPassword_SomeoneElseNeedsNoCurrentPassword(t *testing.T) {
+	m, _ := press(t, threeUsers(), "p")
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}, HasPassword: true}})
+	m = next.(Model)
+	if m.pwNeedCurrent || m.pwFocus != pwNew {
+		t.Errorf("setting erik's password as niklas should not ask for a current one")
+	}
+	if strings.Contains(m.View(), "Current password") {
+		t.Error("the current-password field should be hidden")
+	}
+}
+
+func TestPassword_OwnExistingPasswordNeedsCurrent(t *testing.T) {
+	m := threeUsers()
+	m.userManageTable.SetCursor(0)
+	m, _ = press(t, m, "p")
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}, HasPassword: true}})
+	m = next.(Model)
+	if !m.pwNeedCurrent || m.pwFocus != pwCurrent {
+		t.Fatal("changing your own existing password should ask for the current one first")
+	}
+	m = typeInto(t, m, "correct horse")
+	m, _ = press(t, m, "tab")
+	m = typeInto(t, m, "a brand new secret")
+	m, _ = press(t, m, "tab")
+	m = typeInto(t, m, "a brand new secret")
+	m, cmd := press(t, m, "enter")
+	if cmd == nil || m.mode != modeDashboard {
+		t.Errorf("a complete form should submit (mode %v)", m.mode)
+	}
+}
+
+func TestPassword_OwnFirstPasswordNeedsNoCurrent(t *testing.T) {
+	m := threeUsers()
+	m.userManageTable.SetCursor(0)
+	m, _ = press(t, m, "p")
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}, HasPassword: false}})
+	if next.(Model).pwNeedCurrent {
+		t.Error("there is no current password to ask for yet")
+	}
+}
+
+func TestPassword_RejectsBeforeSending(t *testing.T) {
+	cases := []struct{ name, pw, repeat, want string }{
+		{"too short", "short", "short", "at least 10"},
+		{"mismatch", "a brand new secret", "a different secret", "do not match"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			m, _ := press(t, threeUsers(), "p")
+			next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 1}}})
+			m = typeInto(t, next.(Model), tc.pw)
+			m, _ = press(t, m, "tab")
+			m = typeInto(t, m, tc.repeat)
+			m, cmd := press(t, m, "enter")
+			if m.mode != modePasswordSet {
+				t.Error("the form should stay open")
+			}
+			if !strings.Contains(m.statusMsg, tc.want) {
+				t.Errorf("status %q should mention %q", m.statusMsg, tc.want)
+			}
+			if cmd == nil {
+				return
+			}
+			// Only the clear-status timer may be scheduled, never a request.
+			if _, ok := cmd().(clearStatusMsg); !ok {
+				t.Error("nothing should be sent to the server")
+			}
+		})
+	}
+}
+
+func TestPassword_EscapeCancels(t *testing.T) {
+	m, _ := press(t, threeUsers(), "p")
+	m, _ = press(t, m, "esc")
+	if m.mode != modeDashboard {
+		t.Errorf("esc should close the form, got mode %v", m.mode)
+	}
+	// A lookup arriving after the form closed must not reopen anything.
+	next, _ := m.Update(meFetchedMsg{me: api.Me{User: api.User{ID: 3}, HasPassword: true}})
+	if next.(Model).mode != modeDashboard {
+		t.Error("a late /api/me answer reopened the form")
+	}
+}
+
+func TestPassword_ErrorClosesTheFormWithAMessage(t *testing.T) {
+	m, _ := press(t, threeUsers(), "p")
+	next, _ := m.Update(userActionErrMsg{errTest("server returned 403: current password is incorrect")})
+	m = next.(Model)
+	if m.mode != modeDashboard || !strings.Contains(m.statusMsg, "current password is incorrect") {
+		t.Errorf("expected the server's message on the dashboard, got %q in mode %v", m.statusMsg, m.mode)
+	}
+}
+
+func typeInto(t *testing.T, m Model, s string) Model {
+	t.Helper()
+	next, _ := m.Update(runes(s))
+	return next.(Model)
+}
+
+func runes(s string) tea.KeyMsg { return tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(s)} }
+
+func keyUp() tea.KeyMsg { return tea.KeyMsg{Type: tea.KeyUp} }
+
+type errTest string
+
+func (e errTest) Error() string { return string(e) }

internal/tui/view.go

@@ -27,10 +27,85 @@ func (m Model) View() string {
 
 func (m Model) renderHeader() string {
 	title := m.styles.Header.Render("terdut-tui")
+	if len(m.teams) > 0 {
+		title += m.styles.Muted.Render("  team: " + m.activeTeamLabel())
+	}
 	right := m.styles.Muted.Render(m.serverURL)
 	return spread(title, right, m.width)
 }
 
+// renderLogin is the sign-in form. It is the whole body: nothing else is shown
+// until the server has accepted a session.
+func (m Model) renderLogin() string {
+	var b strings.Builder
+	b.WriteString("\n  " + m.styles.Bold.Render("Sign in to "+m.serverURL) + "\n\n")
+	if m.loginNote != "" {
+		b.WriteString(m.styles.Status.Render("  "+m.loginNote) + "\n\n")
+	}
+	if m.sso.active {
+		b.WriteString(m.renderSSOWait())
+		return b.String()
+	}
+	if m.offersPasswords() {
+		b.WriteString("  " + m.styles.Header.Render("Username: ") + m.loginInputs[loginUsername].View() + "\n")
+		b.WriteString("  " + m.styles.Header.Render("Password: ") + m.loginInputs[loginPassword].View() + "\n\n")
+	} else {
+		b.WriteString(m.styles.Muted.Render("  This server signs in with "+m.ssoName()+".") + "\n\n")
+	}
+	switch {
+	case m.loggingIn:
+		b.WriteString(m.styles.Muted.Render("  Signing in…") + "\n")
+	case m.loginErr != "":
+		b.WriteString(m.styles.Error.Render("  "+m.loginErr) + "\n")
+	}
+	if m.canSSO() && m.offersPasswords() {
+		b.WriteString("\n" + m.styles.Muted.Render("  or press ctrl+o to sign in with "+m.ssoName()) + "\n")
+	}
+	return b.String()
+}
+
+// renderSSOWait is the single sign-on screen: the link to open and the code to
+// check against it, while the client waits for the approval.
+func (m Model) renderSSOWait() string {
+	var b strings.Builder
+	l := m.sso.login
+	if l == nil {
+		b.WriteString(m.styles.Muted.Render("  Contacting the server…") + "\n")
+		return b.String()
+	}
+	b.WriteString("  " + m.styles.Header.Render("Sign in with "+m.ssoName()) + "\n\n")
+	b.WriteString("  Open this link in a browser, on any device, and approve the sign-in:\n\n")
+	b.WriteString("    " + m.styles.Accent.Render(l.VerificationURL) + "\n\n")
+	b.WriteString("  " + m.styles.Header.Render("Code: ") + m.styles.Bold.Render(l.UserCode) +
+		m.styles.Muted.Render("   it should match the code on that page") + "\n\n")
+	b.WriteString(m.styles.Muted.Render(fmt.Sprintf("  Waiting for approval… good for %d minutes", (l.ExpiresIn+59)/60)) + "\n")
+	return b.String()
+}
+
+// loginHelp is the sign-in footer, which depends on what the server offers.
+func (m Model) loginHelp() string {
+	switch {
+	case m.sso.active:
+		return "  esc·cancel"
+	case !m.offersPasswords():
+		if m.canSSO() {
+			return "  enter·sign in with " + m.ssoName() + "  esc·quit"
+		}
+		return "  esc·quit"
+	case m.canSSO():
+		return "  tab·next field  enter·sign in  ctrl+o·" + m.ssoName() + "  esc·quit"
+	}
+	return "  tab·next field  enter·sign in  esc·quit"
+}
+
+// activeTeamLabel names what the lists are narrowed to.
+func (m Model) activeTeamLabel() string {
+	if t, ok := m.activeTeam(); ok {
+		return t.Name
+	}
+	return "all"
+}
+
 func (m Model) renderTabs() string {
 	var tabs []string
 	for i, name := range sectionNames {
@@ -45,6 +120,9 @@ func (m Model) renderTabs() string {
 }
 
 func (m Model) renderBody() string {
+	if m.mode == modeLogin {
+		return m.renderLogin()
+	}
 	if m.err != nil {
 		return "\n" + m.styles.Error.Render(fmt.Sprintf("  Error: %v", m.err)) +
 			"\n" + m.styles.Muted.Render("  Press r to retry.")
@@ -57,7 +135,11 @@ func (m Model) renderBody() string {
 	case modeIncidentDetail, modeAlertDetail:
 		return m.renderDetail()
 	case modeNote:
-		return m.renderPrompt(m.styles.Header.Render("Note: ") + m.noteInput.View())
+		label := "Note: "
+		if m.notePinned {
+			label = "What fixed it: "
+		}
+		return m.renderPrompt(m.styles.Header.Render(label) + m.noteInput.View())
 	case modeSnooze:
 		return m.renderPrompt(m.styles.Header.Render("Snooze for: ") + m.snoozeInput.View())
 	case modeConfirm:
@@ -83,6 +165,8 @@ func (m Model) renderBody() string {
 		return m.renderAPIKeyReveal()
 	case modeAPIKeyRevokeByID:
 		return m.renderAPIKeyRevokeByID()
+	case modePasswordSet:
+		return m.renderPasswordSet()
 	default:
 		return m.renderDashboard()
 	}
@@ -100,7 +184,7 @@ func (m Model) renderFooter() string {
 	switch m.mode {
 	case modeIncidentDetail:
 		if !m.selectedIncident.IsOpen() {
-			return withStatus("  x·archive  c·note  [/]·select  d·del  esc·back")
+			return withStatus("  x·archive  c·note  C·fix note  [/]·select  d·del  esc·back")
 		}
 		return withStatus("  a·ack  A·unack  R·resolve  s·assign  z·snooze  Z·unsnooze  c·note  [/]·select  d·del  esc·back")
 
@@ -144,25 +228,39 @@ func (m Model) renderFooter() string {
 	case modeAPIKeyRevokeByID:
 		return withStatus("  enter·revoke  esc·back")
 
+	case modePasswordSet:
+		return withStatus("  tab·next field  enter·set password  esc·cancel")
+
+	case modeLogin:
+		return "\n" + m.styles.Footer.Render(m.loginHelp())
+
 	default:
 		switch m.activeSection {
 		case sectionIncidents:
-			return withStatus("  enter·detail  x·archive  f·filter  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  x·archive  f·filter  " + m.teamHint() + "r·refresh  tab·section  L·sign out  q·quit")
 		case sectionAlerts:
-			return withStatus("  enter·detail  f·filter  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  f·filter  " + m.teamHint() + "r·refresh  tab·section  q·quit")
 		case sectionStats:
 			return withStatus("  ↑/↓·scroll  r·refresh  tab·section  q·quit")
 		case sectionArchived:
-			return withStatus("  enter·detail  x·unarchive  r·refresh  tab·section  q·quit")
+			return withStatus("  enter·detail  x·unarchive  " + m.teamHint() + "r·refresh  tab·section  q·quit")
 		case sectionSchedule:
-			return withStatus("  +·assign day  W·assign week  d·del  ←/→·shift week  tab·section  r·refresh  q·quit")
+			return withStatus("  +·assign day  W·assign week  d·del  ←/→·shift week  " + m.teamHint() + "tab·section  r·refresh  q·quit")
 		case sectionUsers:
-			return withStatus("  n·new user  t·topic  d·delete  k·API keys  r·refresh  tab·section  q·quit")
+			return withStatus("  n·new user  t·topic  d·delete  k·API keys  p·password  r·refresh  L·sign out  q·quit")
 		}
 		return "\n" + m.styles.Footer.Render(m.help.ShortHelpView(m.keys.ShortHelp()))
 	}
 }
 
+// teamHint is the footer's team-switch key, shown only when there is a choice.
+func (m Model) teamHint() string {
+	if len(m.teams) > 1 {
+		return "T·team  "
+	}
+	return ""
+}
+
 func (m Model) confirmPrompt() string {
 	switch m.confirmTarget {
 	case confirmDeleteNote:
@@ -327,23 +425,41 @@ func (m Model) renderSchedule() string {
 		return "\n" + m.styles.Muted.Render("  Loading schedule…")
 	}
 
+	team, ok := m.scheduleTeam()
+	if !ok {
+		return "\n" + m.styles.Muted.Render("  You are not in any team, so there is no schedule to show.")
+	}
+
 	var onCallLine string
-	if m.currentOnCall != nil {
+	if len(m.currentOnCall) > 0 {
-		onCallLine = fmt.Sprintf("  On-call today: %s",
+		onCallLine = "  On-call today: " + m.styles.AlertName.Render(m.onCallNames())
-			m.styles.AlertName.Render(m.currentOnCall.Username))
 	} else {
 		onCallLine = m.styles.Muted.Render("  On-call today: nobody scheduled")
 	}
 
 	from := m.scheduleWindow
 	to := m.scheduleWindow.AddDate(0, 0, 6)
-	windowLabel := m.styles.Muted.Render(fmt.Sprintf("  %s — %s",
+	windowLabel := m.styles.Muted.Render(fmt.Sprintf("  %s: %s — %s",
-		from.Format("Jan 02"), to.Format("Jan 02, 2006")))
+		team.Name, from.Format("Jan 02"), to.Format("Jan 02, 2006")))
 
 	header := "\n" + spread(onCallLine, windowLabel, m.width) + "\n"
 	return header + m.scheduleTable.View()
 }
 
+// onCallNames lists who is on call today. With several teams each name carries
+// its team, since one person per team is on call and "alice, bob" alone would
+// not say whose.
+func (m Model) onCallNames() string {
+	parts := make([]string, len(m.currentOnCall))
+	for i, e := range m.currentOnCall {
+		parts[i] = e.Username
+		if len(m.teams) > 1 && e.TeamName != "" {
+			parts[i] += " (" + e.TeamName + ")"
+		}
+	}
+	return strings.Join(parts, ", ")
+}
+
 func (m Model) renderUserPicker() string {
 	if m.usersLoading {
 		return "\n" + m.styles.Muted.Render("  Loading users…")
@@ -418,7 +534,7 @@ func line(style lipgloss.Style, s string) string {
 
 // ── Content builders ───────────────────────────────────────────────────────
 
-func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.IncidentEvent, cursor, width int) string {
+func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.IncidentEvent, similar []api.SimilarIncident, cursor, width int) string {
 	now := time.Now()
 	var b strings.Builder
 	contentW := width - 4
@@ -436,6 +552,9 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 	b.WriteString("\n  " + title + strings.Repeat(" ", gap) + status + "\n\n")
 
 	// Timing and ownership
+	if inc.TeamName != "" {
+		b.WriteString(fmt.Sprintf("  Team:       %s\n", inc.TeamName))
+	}
 	b.WriteString(fmt.Sprintf("  Triggered:  %s  (%s)\n",
 		inc.TriggeredAt.UTC().Format("2006-01-02 15:04 UTC"), humanAgo(now, inc.TriggeredAt)))
 
@@ -456,6 +575,10 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 		b.WriteString(line(s.Muted, "  Acked:      not acknowledged"))
 	}
 
+	if inc.EscalationLevel > 0 {
+		b.WriteString(line(s.Snoozed, fmt.Sprintf("  Escalation: level %d", inc.EscalationLevel)))
+	}
+
 	if inc.IsSnoozed() {
 		b.WriteString(line(s.Snoozed, fmt.Sprintf("  Snoozed:    until %s  (%s)",
 			inc.SnoozedUntil.UTC().Format("2006-01-02 15:04 UTC"), humanUntil(now, *inc.SnoozedUntil))))
@@ -505,6 +628,22 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 	}
 	b.WriteString("\n")
 
+	// Seen before: earlier incidents of the same kind that someone left notes on.
+	if len(similar) > 0 {
+		b.WriteString(divider(s, "Seen before", width))
+		for _, sim := range similar {
+			b.WriteString(fmt.Sprintf("  #%-6d %-44s %s\n", sim.ID, truncate(sim.Title, 44),
+				s.Muted.Render("resolved "+humanAgo(now, sim.ResolvedAt))))
+			for _, n := range sim.ResolutionNotes {
+				b.WriteString("    " + s.Resolved.Render("fixed: ") + n.Detail + "\n")
+			}
+			if len(sim.ResolutionNotes) == 0 {
+				b.WriteString(line(s.Muted, fmt.Sprintf("    %d note(s), no resolution note", sim.NoteCount)))
+			}
+		}
+		b.WriteString("\n")
+	}
+
 	// Timeline — the only history the server keeps.
 	notes := noteEvents(timeline)
 	b.WriteString(divider(s, fmt.Sprintf("Timeline (%d events, %d notes)", len(timeline), len(notes)), width))
@@ -514,7 +653,7 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 		noteIndex := 0
 		for _, e := range timeline {
 			when := s.Muted.Render(humanAgo(now, e.CreatedAt))
-			if e.Type != api.EventNote {
+			if e.Type != api.EventNote && e.Type != api.EventResolutionNote {
 				b.WriteString(fmt.Sprintf("  %-52s %s\n", eventLabel(e), when))
 				continue
 			}
@@ -524,7 +663,11 @@ func buildIncidentDetailContent(s Styles, inc api.Incident, timeline []api.Incid
 				marker = s.Selected.Render("> ")
 				author = s.Selected.Render(e.Username)
 			}
-			b.WriteString(fmt.Sprintf("%s%-50s %s\n", marker, author+" wrote", when))
+			verb := " wrote"
+			if e.Type == api.EventResolutionNote {
+				verb = " noted the fix"
+			}
+			b.WriteString(fmt.Sprintf("%s%-50s %s\n", marker, author+verb, when))
 			b.WriteString("    " + e.Detail + "\n")
 			noteIndex++
 		}
@@ -598,6 +741,8 @@ func eventLabel(e api.IncidentEvent) string {
 		// the only thing that says why nobody's phone rang.
 		return truncate(fmt.Sprintf("  Notification to %s failed · %s",
 			notifiedTarget(who), e.Detail), 52)
+	case api.EventDeadmanSilent:
+		return "  Dead man's switch went silent"
 	default:
 		label := "  " + e.Type
 		if e.Detail != "" {
@@ -810,6 +955,28 @@ func (m Model) renderUserNotifyEdit() string {
 	return header + "\n" + hint + "\n" + label + m.ntfyTopicInput.View() + "\n"
 }
 
+func (m Model) renderPasswordSet() string {
+	header := fmt.Sprintf("\n  Web UI password for %s\n\n", m.styles.Bold.Render(m.selectedUser.Username))
+	if m.pwLoading {
+		return header + line(m.styles.Muted, "  Checking who this key belongs to…")
+	}
+	labels := [pwFieldCount]string{
+		pwCurrent: "  Current password:  ",
+		pwNew:     "  New password:      ",
+		pwRepeat:  "  Repeat:            ",
+	}
+	var form string
+	for _, f := range m.pwFields() {
+		label := labels[f]
+		if f == m.pwFocus {
+			label = m.styles.Selected.Render(label)
+		}
+		form += label + m.pwInputs[f].View() + "\n"
+	}
+	hint := fmt.Sprintf("  At least %d characters. Setting it signs %s out of every other\n  web UI session. API keys are not affected.", minPasswordLen, m.selectedUser.Username)
+	return header + form + "\n" + line(m.styles.Muted, hint)
+}
+
 func (m Model) renderAPIKeyMenu() string {
 	header := fmt.Sprintf("\n  API keys for %s\n", m.styles.Bold.Render(m.selectedUser.Username))
 	warning := line(m.styles.Muted, "  Keys cannot be listed — only new keys can be created,\n  or existing ones revoked by their integer ID.")

internal/tui/view_test.go

@@ -57,7 +57,7 @@ func TestIncidentDetail_RendersTheWholeStory(t *testing.T) {
 		{Type: api.EventNote, Username: "admin", Detail: "draining node-2", CreatedAt: now},
 	}
 
-	out := buildIncidentDetailContent(testStyles(), inc, timeline, -1, 110)
+	out := buildIncidentDetailContent(testStyles(), inc, timeline, nil, -1, 110)
 	mustContain(t, out,
 		"DiskFull (namespace=prod)", "ACKNOWLEDGED", "CRITICAL",
 		"Assigned:", "admin",
@@ -77,7 +77,7 @@ func TestIncidentDetail_ShowsSnooze(t *testing.T) {
 	}
 	// The exact remaining time is humanUntil's business, not this test's — a few
 	// microseconds of elapsed clock turn "in 2h" into "in 1h 59m".
-	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110),
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110),
 		"TRIGGERED (snoozed)", "Snoozed:", "until", "in 1h")
 }
 
@@ -88,7 +88,7 @@ func TestIncidentDetail_HidesExpiredSnooze(t *testing.T) {
 		Title: "Noisy", Status: api.StatusTriggered,
 		TriggeredAt: time.Now(), SnoozedUntil: &past,
 	}
-	if strings.Contains(plain(buildIncidentDetailContent(testStyles(), inc, nil, -1, 110)), "Snoozed:") {
+	if strings.Contains(plain(buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110)), "Snoozed:") {
 		t.Error("an expired snooze should not be rendered")
 	}
 }
@@ -100,18 +100,18 @@ func TestIncidentDetail_ShowsResolutionSource(t *testing.T) {
 		Title: "Done", Status: api.StatusResolved, TriggeredAt: now.Add(-time.Hour),
 		ResolvedAt: &now, ResolutionSource: &source,
 	}
-	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110),
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110),
 		"RESOLVED", "Resolved:", "manual")
 }
 
 func TestIncidentDetail_UnassignedAndUnacknowledged(t *testing.T) {
 	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
-	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110), "nobody", "not acknowledged")
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110), "nobody", "not acknowledged")
 }
 
 func TestIncidentDetail_EmptyTimeline(t *testing.T) {
 	inc := api.Incident{Title: "Fresh", Status: api.StatusTriggered, TriggeredAt: time.Now()}
-	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, -1, 110), "Nothing recorded yet")
+	mustContain(t, buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110), "Nothing recorded yet")
 }
 
 func TestIncidentDetail_MarksSelectedNote(t *testing.T) {
@@ -122,7 +122,7 @@ func TestIncidentDetail_MarksSelectedNote(t *testing.T) {
 	}
 	inc := api.Incident{Title: "X", Status: api.StatusTriggered, TriggeredAt: now}
 
-	out := plain(buildIncidentDetailContent(testStyles(), inc, timeline, 1, 110))
+	out := plain(buildIncidentDetailContent(testStyles(), inc, timeline, nil, 1, 110))
 	for _, line := range strings.Split(out, "\n") {
 		if strings.Contains(line, "alice") && !strings.HasPrefix(line, "> ") {
 			t.Errorf("expected the selected note marked, got %q", line)
@@ -212,7 +212,7 @@ func TestIncidentDetail_RendersNotifications(t *testing.T) {
 			Detail: "reminder: ntfy returned 502", CreatedAt: now},
 	}
 
-	got := buildIncidentDetailContent(testStyles(), inc, timeline, -1, 120)
+	got := buildIncidentDetailContent(testStyles(), inc, timeline, nil, -1, 120)
 	mustContain(t, got, "Notified niklas (triggered)", "Notification to niklas failed")
 }
 
@@ -349,3 +349,20 @@ func TestView_ZeroWidthRendersNothing(t *testing.T) {
 type errFixture struct{}
 
 func (errFixture) Error() string { return "connection refused" }
+
+func TestIncidentDetail_ShowsSimilarWithResolutionNotes(t *testing.T) {
+	now := time.Now()
+	inc := api.Incident{Title: "DiskFull", Status: api.StatusTriggered, TriggeredAt: now}
+	similar := []api.SimilarIncident{
+		{ID: 4, Title: "DiskFull (job=node)", ResolvedAt: now.Add(-48 * time.Hour),
+			ResolutionNotes: []api.IncidentEvent{{Type: api.EventResolutionNote, Detail: "rotated the logs"}}},
+		{ID: 2, Title: "DiskFull (job=node)", ResolvedAt: now.Add(-96 * time.Hour), NoteCount: 3},
+	}
+	out := plain(buildIncidentDetailContent(testStyles(), inc, nil, similar, -1, 110))
+	mustContain(t, out, "Seen before", "#4", "fixed: rotated the logs", "3 note(s), no resolution note")
+
+	// Nothing similar, no section.
+	if strings.Contains(plain(buildIncidentDetailContent(testStyles(), inc, nil, nil, -1, 110)), "Seen before") {
+		t.Error("expected no Seen before section without similar incidents")
+	}
+}

main.go

@@ -7,6 +7,7 @@ import (
 
 	"git.ryuvia.com/niklas/terdut-tui/internal/api"
 	"git.ryuvia.com/niklas/terdut-tui/internal/config"
+	"git.ryuvia.com/niklas/terdut-tui/internal/session"
 	"git.ryuvia.com/niklas/terdut-tui/internal/theme"
 	"git.ryuvia.com/niklas/terdut-tui/internal/tui"
 	"git.ryuvia.com/niklas/terdut-tui/internal/updater"
@@ -45,8 +46,18 @@ func main() {
 		os.Exit(1)
 	}
 
-	client := api.NewClient(cfg.ServerURL, cfg.APIKey)
+	client := api.NewClient(cfg.ServerURL)
-	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval, th)
+	if token := session.Load(cfg.ServerURL); token != "" {
+		client.SetSession(token)
+	}
+	note := ""
+	if cfg.LegacyAPIKey {
+		note = "api_key in config.yaml is no longer used: sign in with your username and password"
+	}
+	model := tui.NewModel(client, cfg.ServerURL, cfg.RefreshInterval, th).
+		WithDefaultTeam(cfg.Team).
+		WithAuth(cfg.Auth).
+		WithLogin(cfg.Username, note)
 
 	p := tea.NewProgram(model, tea.WithAltScreen())
 	if _, err := p.Run(); err != nil {