feat: 审计 CSV 导出 — 用户/API Key/集群操作日志一键下载

新增端点 (read 级, 审计 viewer 角色即可导出): - GET /audit/users.csv: 账号清单 + 最后登录时间 - GET /audit/apikeys.csv: 密钥清单 (前缀+scope+最后使用+过期) - GET /audit/cluster-log.csv: 令牌环操作日志时间线 (seq/time_utc/node/kind/detail/data_json 六列, detail 为人读摘要, data_json 保留无损原始载荷) 安全设计: - RFC4180 转义 (引号/逗号/换行) - 公式注入防御: =/+/@/tab/- 开头单元格加 ' 前缀 - ISO8601 UTC 时间戳, Excel 直接排序 - 明文密钥不可逆, 仅导出展示前缀前端: - UsersView: 账号表/API 密钥表各加「⤓ 导出 CSV」按钮 - ClusterView: 日志导出下拉新增 CSV 选项 (走服务端生成) - api.ts: downloadAuditCsv() 统一下载管道测试: csvEscape 全用例 / users+apikeys CSV 内容断言 / 未认证 401
2026-09-20 08:57:55 +00:00 · 2026-08-24 22:52:32 +08:00
parent 4a41608d94
commit ef98d9dca1
10 changed files with 645 additions and 231 deletions
--- a/internal/cluster/ring_log.go
+++ b/internal/cluster/ring_log.go
@ -117,3 +117,45 @@ func (l *ClusterLog) Snapshot() []LogEntry {
 	copy(out, l.Log)
 	return out
 }
+
+// DetailOf produces a human-readable one-line summary of a log entry's
+// payload, matching the frontend's detailOf formatting. Used by the audit CSV
+// export and anywhere a flat text rendering of an entry is needed.
+func DetailOf(e LogEntry) string {
+	if len(e.Data) == 0 {
+		return ""
+	}
+	var d map[string]any
+	if err := json.Unmarshal(e.Data, &d); err != nil {
+		return string(e.Data)
+	}
+	str := func(key string) string { s, _ := d[key].(string); return s }
+	switch e.Kind {
+	case LogForwardAdd, LogForwardRemove:
+		s := str("local") + " → " + str("remote")
+		if id := str("taskId"); id != "" {
+			if len(id) > 8 {
+				id = id[len(id)-8:]
+			}
+			s += " · " + id
+		}
+		return s
+	case LogNodeJoin:
+		if addr := str("addr"); addr != "" {
+			return str("node") + " @ " + addr
+		}
+		return str("node")
+	case LogNodeLeave:
+		return str("node")
+	case LogLeaderChange:
+		return "→ " + str("leader")
+	case LogTaskClaimed:
+		return fmt.Sprintf("%s→%s:%v", str("local"), str("remote"), d["port"])
+	default:
+		if len(d) > 0 {
+			b, _ := json.Marshal(d)
+			return string(b)
+		}
+		return ""
+	}
+}
--- a/internal/httpapi/dist/assets/index-B4L3dftx.css
+++ b/internal/httpapi/dist/assets/index-B4L3dftx.css
--- a/internal/httpapi/dist/assets/index-CepJKoxg.js
+++ b/internal/httpapi/dist/assets/index-CepJKoxg.js
--- a/internal/httpapi/dist/index.html
+++ b/internal/httpapi/dist/index.html
@ -5,8 +5,8 @@
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
    <title>webui4frpc</title>
-    <script type="module" crossorigin src="/assets/index-BUbn_fgs.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DQV0nqgE.css">
+    <script type="module" crossorigin src="/assets/index-CepJKoxg.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-B4L3dftx.css">
  </head>
  <body>
    <div id="app"></div>
--- a/internal/httpapi/handlers_audit.go
+++ b/internal/httpapi/handlers_audit.go
@ -0,0 +1,186 @@
+// Audit exports: CSV downloads of the evidence tables an auditor needs —
+// user accounts (with last-login), API keys (with last-use), and the ring
+// operation log. All read-level: exporting is exactly what a viewer/auditor
+// role exists for. CSV cells are RFC4180-escaped; timestamps are ISO8601 UTC
+// so spreadsheets sort them correctly.
+package httpapi
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"webui4frpc/internal/cluster"
+)
+
+// csvEscape quotes a cell per RFC4180: wrap in double quotes when the value
+// contains quote/comma/newline, doubling embedded quotes. Prefixing a leading
+// '=' '+' '@' '\t' with an apostrophe defuses spreadsheet formula injection
+// (CSV cells are data, not formulas — auditors open these in Excel).
+func csvEscape(v string) string {
+	if v == "" {
+		return ""
+	}
+	if strings.ContainsAny(v, ",\"\n\r") {
+		v = `"` + strings.ReplaceAll(v, `"`, `""`) + `"`
+	}
+	if len(v) > 0 && (v[0] == '=' || v[0] == '+' || v[0] == '@' || v[0] == '\t' || v[0] == '-') {
+		return "'" + v
+	}
+	return v
+}
+
+// isoTime renders unix seconds as ISO8601 UTC ("2026-08-24T12:00:00Z"); 0 →
+// empty (never logged / never used).
+func isoTime(unix int64) string {
+	if unix <= 0 {
+		return ""
+	}
+	return time.Unix(unix, 0).UTC().Format(time.RFC3339)
+}
+
+// writeCSV sets attachment headers and streams the header row + rows.
+func writeCSV(w http.ResponseWriter, filename string, header []string, rows [][]string) {
+	var b strings.Builder
+	writeRow := func(cells []string) {
+		for i, c := range cells {
+			if i > 0 {
+				b.WriteByte(',')
+			}
+			b.WriteString(csvEscape(c))
+		}
+		b.WriteString("\r\n")
+	}
+	writeRow(header)
+	for _, r := range rows {
+		writeRow(r)
+	}
+	w.Header().Set("Content-Type", "text/csv; charset=utf-8")
+	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename=%q`, filename))
+	_, _ = w.Write([]byte(b.String()))
+}
+
+// handleAuditUsersCsv serves GET /audit/users.csv: the account inventory with
+// last-login timestamps. Admin-only? No — read-level: auditors (viewer role)
+// are precisely the people who need this; password hashes were never part of
+// the User JSON shape and are not included here either.
+func (h *Handler) handleAuditUsersCsv(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		methodNotAllowed(w)
+		return
+	}
+	users, err := h.Store.ListUsers()
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	rows := make([][]string, 0, len(users))
+	for _, u := range users {
+		rows = append(rows, []string{
+			strconv.FormatInt(u.ID, 10),
+			u.Username,
+			u.Role,
+			strconv.FormatBool(u.Enabled),
+			strconv.FormatBool(u.System),
+			isoTime(u.CreatedAt),
+			isoTime(u.LastLoginAt),
+		})
+	}
+	writeCSV(w,
+		fmt.Sprintf("audit-users-%s.csv", time.Now().UTC().Format("20060102-150405")),
+		[]string{"id", "username", "role", "enabled", "system", "created_at", "last_login_at"},
+		rows)
+}
+
+// handleAuditApiKeysCsv serves GET /audit/apikeys.csv: key inventory with
+// scope, last-use and expiry. The plaintext key is unrecoverable by design;
+// only the display prefix is exported.
+func (h *Handler) handleAuditApiKeysCsv(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		methodNotAllowed(w)
+		return
+	}
+	keys, err := h.Store.ListApiKeys()
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	// Resolve owning username for readability.
+	nameOf := map[int64]string{}
+	if users, err := h.Store.ListUsers(); err == nil {
+		for _, u := range users {
+			nameOf[u.ID] = u.Username
+		}
+	}
+	rows := make([][]string, 0, len(keys))
+	for _, k := range keys {
+		expires := ""
+		if k.ExpiresAt != 0 {
+			expires = isoTime(k.ExpiresAt)
+		}
+		rows = append(rows, []string{
+			strconv.FormatInt(k.ID, 10),
+			k.Prefix + "…",
+			nameOf[k.UserID],
+			k.Label,
+			k.Scope,
+			isoTime(k.CreatedAt),
+			isoTime(k.LastUsedAt),
+			expires,
+		})
+	}
+	writeCSV(w,
+		fmt.Sprintf("audit-apikeys-%s.csv", time.Now().UTC().Format("20060102-150405")),
+		[]string{"id", "key_prefix", "owner", "label", "scope", "created_at", "last_used_at", "expires_at"},
+		rows)
+}
+
+// handleAuditClusterLogCsv serves GET /audit/cluster-log.csv: this node's ring
+// operation log (forward add/remove, join/leave, leader changes, claims) as
+// one flat CSV sorted by seq — the "who did what to the cluster" timeline.
+// Data payloads are flattened into a human-readable detail column plus raw
+// JSON for lossless reprocessing.
+func (h *Handler) handleAuditClusterLogCsv(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		methodNotAllowed(w)
+		return
+	}
+	if h.Ring == nil {
+		http.Error(w, "ring engine not enabled", http.StatusNotFound)
+		return
+	}
+	snap := h.Ring.Snapshot()
+	entries := snap.Log
+	rows := make([][]string, 0, len(entries))
+	for _, e := range entries {
+		rows = append(rows, []string{
+			strconv.FormatInt(e.Seq, 10),
+			isoTime(e.At),
+			e.Node,
+			e.Kind,
+			cluster.DetailOf(e),
+			rawJSON(e.Data),
+		})
+	}
+	writeCSV(w,
+		fmt.Sprintf("audit-cluster-log-%s.csv", time.Now().UTC().Format("20060102-150405")),
+		[]string{"seq", "time_utc", "node", "kind", "detail", "data_json"},
+		rows)
+}
+
+// rawJSON renders the log entry's payload as compact JSON (empty when absent)
+// for the lossless audit column.
+func rawJSON(data json.RawMessage) string {
+	if len(data) == 0 {
+		return ""
+	}
+	var buf bytes.Buffer
+	if err := json.Compact(&buf, data); err != nil {
+		return string(data)
+	}
+	return buf.String()
+}
--- a/internal/httpapi/handlers_audit_test.go
+++ b/internal/httpapi/handlers_audit_test.go
@ -0,0 +1,110 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"webui4frpc/internal/store"
+)
+
+// newAuditHarness builds a Handler + mux with a temp store, mirroring
+// TestSaveCanvasPublishesRevokeTask's setup minus the ring.
+func newAuditHarness(t *testing.T) (*Handler, http.Handler) {
+	t.Helper()
+	dir := t.TempDir()
+	st, err := store.New(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { st.Close() })
+	if _, err := st.CreateUser("auditor", "pw-auditor", "viewer"); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := st.CreateApiKey(1, "ci-key", "read"); err != nil {
+		t.Fatal(err)
+	}
+	h := &Handler{Store: st, WorkDir: dir, User: "admin", Password: "pw"}
+	mux, err := NewServeMux(h)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return h, mux
+}
+
+func TestCsvEscape(t *testing.T) {
+	cases := []struct{ in, want string }{
+		{"plain", "plain"},
+		{"", ""},
+		{"a,b", `"a,b"`},
+		{`say "hi"`, `"say ""hi"""`},
+		{"line\nbreak", "\"line\nbreak\""},
+		{"=cmd()", "'=cmd()"},     // formula injection defused
+		{"+1+1", "'+1+1"},         // formula injection defused
+		{"@SUM(A1)", "'@SUM(A1)"}, // formula injection defused
+		{"-2+3", "'-2+3"},         // formula injection defused
+	}
+	for _, c := range cases {
+		if got := csvEscape(c.in); got != c.want {
+			t.Errorf("csvEscape(%q)=%q want %q", c.in, got, c.want)
+		}
+	}
+}
+
+func TestIsoTimeEmpty(t *testing.T) {
+	if got := isoTime(0); got != "" {
+		t.Errorf("isoTime(0)=%q want empty", got)
+	}
+}
+
+func TestAuditUsersCsv(t *testing.T) {
+	_, mux := newAuditHarness(t)
+	req := httptest.NewRequest(http.MethodGet, "/api/manager/audit/users.csv", nil)
+	req.SetBasicAuth("admin", "pw")
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	for _, want := range []string{"id,username,role,enabled,system,created_at,last_login_at", "auditor,viewer"} {
+		if !strings.Contains(body, want) {
+			t.Errorf("CSV missing %q:\n%s", want, body)
+		}
+	}
+	if ct := rec.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/csv") {
+		t.Errorf("content-type=%q", ct)
+	}
+}
+
+func TestAuditApiKeysCsv(t *testing.T) {
+	_, mux := newAuditHarness(t)
+	req := httptest.NewRequest(http.MethodGet, "/api/manager/audit/apikeys.csv", nil)
+	req.SetBasicAuth("admin", "pw")
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	if !strings.Contains(body, "key_prefix,owner,label,scope") {
+		t.Errorf("CSV header missing:\n%s", body)
+	}
+	if !strings.Contains(body, "w4f_") || !strings.Contains(body, "ci-key") {
+		t.Errorf("key row missing:\n%s", body)
+	}
+}
+
+func TestAuditEndpointsNeedAuth(t *testing.T) {
+	_, mux := newAuditHarness(t)
+	for _, path := range []string{"/api/manager/audit/users.csv", "/api/manager/audit/apikeys.csv"} {
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		rec := httptest.NewRecorder()
+		mux.ServeHTTP(rec, req)
+		if rec.Code != http.StatusUnauthorized {
+			t.Errorf("%s without auth: status=%d want 401", path, rec.Code)
+		}
+	}
+}
--- a/internal/httpapi/server.go
+++ b/internal/httpapi/server.go
@ -111,6 +111,12 @@ func NewServeMux(h *Handler) (http.Handler, error) {
 	mux.HandleFunc(apiPrefix+"/cluster/ring", h.auth("read")(h.handleClusterRing))
 	mux.HandleFunc(apiPrefix+"/node/logs", h.auth("read")(h.handleNodeLogs))
 	mux.HandleFunc(apiPrefix+"/cluster/logs/export", h.auth("read")(h.handleClusterLogsExport))
+
+	// Audit exports (CSV): read-level — exporting evidence is exactly what a
+	// viewer/auditor role exists for. RFC4180 CSV, ISO8601 UTC timestamps.
+	mux.HandleFunc(apiPrefix+"/audit/users.csv", h.auth("read")(h.handleAuditUsersCsv))
+	mux.HandleFunc(apiPrefix+"/audit/apikeys.csv", h.auth("read")(h.handleAuditApiKeysCsv))
+	mux.HandleFunc(apiPrefix+"/audit/cluster-log.csv", h.auth("read")(h.handleAuditClusterLogCsv))
 	mux.HandleFunc(apiPrefix+"/cluster/token", h.auth("write")(h.handleClusterToken))
 	mux.HandleFunc(apiPrefix+"/cluster/join", h.auth("write")(h.handleClusterJoin))
 	mux.HandleFunc(apiPrefix+"/cluster/task", h.auth("write")(h.handleClusterTask))
--- a/web/src/api.ts
+++ b/web/src/api.ts
@ -124,7 +124,12 @@ export const api = {
 		}),
 	// assignGroup changes a single forward's group label (status page chip).
 	// Empty group clears the assignment (移出分组). Pure DB update, no worker.
-  assignGroup: (local: string, remote: string, remotePort: number, group: string) =>
+	assignGroup: (
+		local: string,
+		remote: string,
+		remotePort: number,
+		group: string,
+	) =>
 		request<{ ok: boolean }>("/api/manager/forwards/assign", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
@ -192,13 +197,16 @@ export const api = {
 	// M7 auth/accounts/API keys/canvas export-import/worker logs.
 	me: () => request<MeResp>("/api/manager/me"),
 	listUsers: () => request<{ users: User[] }>("/api/manager/users"),
-  createUser: (username: string, password: string, role: 'admin' | 'viewer') =>
+	createUser: (username: string, password: string, role: "admin" | "viewer") =>
 		request<User>("/api/manager/users", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({ username, password, role }),
 		}),
-  updateUser: (name: string, patch: { password?: string; role?: 'admin' | 'viewer'; enabled?: boolean }) =>
+	updateUser: (
+		name: string,
+		patch: { password?: string; role?: "admin" | "viewer"; enabled?: boolean },
+	) =>
 		request<User>(`/api/manager/users/${encodeURIComponent(name)}`, {
 			method: "PUT",
 			headers: { "Content-Type": "application/json" },
@ -209,7 +217,11 @@ export const api = {
 			method: "DELETE",
 		}),
 	listApiKeys: () => request<{ apiKeys: ApiKey[] }>("/api/manager/apikeys"),
-  createApiKey: (userId: number, label: string, scope: 'read' | 'write' | 'admin') =>
+	createApiKey: (
+		userId: number,
+		label: string,
+		scope: "read" | "write" | "admin",
+	) =>
 		request<ApiKeyCreated>("/api/manager/apikeys", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
@ -219,7 +231,8 @@ export const api = {
 		request<void>(`/api/manager/apikeys/${id}`, { method: "DELETE" }),

 	// Canvas export/import (转发表 备份/还原).
-  exportCanvas: () => request<CanvasExportEnvelope>("/api/manager/canvas/export"),
+	exportCanvas: () =>
+		request<CanvasExportEnvelope>("/api/manager/canvas/export"),
 	importCanvas: (data: CanvasData | CanvasExportEnvelope) =>
 		request<CanvasData>("/api/manager/canvas/import", {
 			method: "POST",
@ -228,5 +241,34 @@ export const api = {
 		}),

 	// Worker-log bundle (HTTP fan-out across ring nodes; read-level/auditor).
-  exportWorkerLogs: () => request<WorkerLogBundle>("/api/manager/cluster/logs/export"),
+	exportWorkerLogs: () =>
+		request<WorkerLogBundle>("/api/manager/cluster/logs/export"),
+
+	// ---- Audit CSV exports (read-level) ----
+	// downloadCsv fetches a CSV endpoint with credentials and triggers a file
+	// download. Kept here so views don't repeat the blob plumbing.
 };
+
+// downloadAuditCsv streams one of the /audit/*.csv endpoints to a file.
+export async function downloadAuditCsv(
+	kind: "users" | "apikeys" | "cluster-log",
+): Promise<void> {
+	const resp = await fetch(`/api/manager/audit/${kind}.csv`, {
+		credentials: "same-origin",
+	});
+	if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
+	const disposition = resp.headers.get("content-disposition") || "";
+	const m = disposition.match(/filename="?([^";]+)"?/);
+	const filename = m?.[1] ?? `audit-${kind}.csv`;
+	const blob = new Blob([await resp.text()], {
+		type: "text/csv;charset=utf-8",
+	});
+	const url = URL.createObjectURL(blob);
+	const a = document.createElement("a");
+	a.href = url;
+	a.download = filename;
+	document.body.appendChild(a);
+	a.click();
+	document.body.removeChild(a);
+	URL.revokeObjectURL(url);
+}
--- a/web/src/views/ClusterView.vue
+++ b/web/src/views/ClusterView.vue
@ -150,6 +150,7 @@
                <el-dropdown-menu>
                  <el-dropdown-item command="json">JSON（完整结构）</el-dropdown-item>
                  <el-dropdown-item command="txt">文本（可读 TSV）</el-dropdown-item>
+                  <el-dropdown-item command="csv">CSV（审计用，Excel 可开）</el-dropdown-item>
                </el-dropdown-menu>
              </template>
            </el-dropdown>
@ -194,7 +195,7 @@
 <script setup lang="ts">
 import { ref, reactive, computed, onMounted, onBeforeUnmount } from 'vue'
 import { ElMessage } from 'element-plus'
-import { api } from '../api'
+import { api, downloadAuditCsv } from '../api'
 import type { RingSnapshot, RingTaskInfo, RingLogEntry } from '../types'

 const ring = ref<RingSnapshot | null>(null)
@ -321,8 +322,18 @@ const detailOf = (e: RingLogEntry): string => {
  }
 }
 // exportLog downloads the FULL cluster log (snapshot carries every entry) as
-// either pretty JSON (lossless) or a readable TSV text file, sorted by seq.
-const exportLog = (fmt: string) => {
+// pretty JSON (lossless), a readable TSV text file, or server-generated RFC4180
+// CSV (audit deliverable, Excel-friendly) — sorted by seq.
+const exportLog = async (fmt: string) => {
+  if (fmt === 'csv') {
+    // Server-side CSV: RFC4180 escaping + formula-injection defence + ISO8601 UTC.
+    try {
+      await downloadAuditCsv('cluster-log')
+    } catch (e: any) {
+      ElMessage.error('导出失败: ' + (e?.message || e))
+    }
+    return
+  }
  const entries = [...(ring.value?.log ?? [])].sort((a, b) => a.seq - b.seq)
  if (!entries.length) return
  let content = ''
--- a/web/src/views/UsersView.vue
+++ b/web/src/views/UsersView.vue
@ -10,7 +10,10 @@
    <section class="card">
      <header class="card-h">
        <h3>账号</h3>
+        <div class="h-actions">
+          <el-button size="small" @click="exportCsv('users')">⤓ 导出 CSV</el-button>
          <el-button type="primary" size="small" @click="openUserCreate">＋ 新建账号</el-button>
+        </div>
      </header>
      <el-table :data="users" size="small" stripe empty-text="暂无账号">
        <el-table-column prop="username" label="用户名" min-width="140" />
@ -55,7 +58,10 @@
    <section class="card">
      <header class="card-h">
        <h3>API 密钥</h3>
+        <div class="h-actions">
+          <el-button size="small" @click="exportCsv('apikeys')">⤓ 导出 CSV</el-button>
          <el-button type="primary" size="small" @click="openKeyCreate">＋ 新建密钥</el-button>
+        </div>
      </header>
      <el-table :data="apiKeys" size="small" stripe empty-text="暂无密钥">
        <el-table-column prop="label" label="标签" min-width="140" />
@ -150,12 +156,23 @@
 <script setup lang="ts">
 import { onMounted, ref } from 'vue'
 import { ElMessage, ElMessageBox } from 'element-plus'
-import { api } from '../api'
+import { api, downloadAuditCsv } from '../api'
 import type { ApiKey, ApiKeyCreated, User } from '../types'

 const users = ref<User[]>([])
 const apiKeys = ref<ApiKey[]>([])

+// exportCsv streams one of the audit CSV endpoints to a file. Read-level:
+// auditors pull these without any write permission.
+const exportCsv = async (kind: 'users' | 'apikeys') => {
+  try {
+    await downloadAuditCsv(kind)
+    ElMessage.success('已导出 CSV')
+  } catch (e: any) {
+    ElMessage.error('导出失败: ' + (e?.message || e))
+  }
+}
+
 const loadUsers = async () => {
  const r = await api.listUsers()
  users.value = r.users