ui pack redo

src/Authority/StellaOps.Authority/StellaOps.Authority.Tests/Console/ConsoleAdminEndpointsTests.cs

@@ -116,6 +116,48 @@ public sealed class ConsoleAdminEndpointsTests
         Assert.Contains(listed!.Users, static user => user.Username == "alice");
     }
 
+    [Fact]
+    public async Task LegacyApiAlias_UsersListAndCreate_WorkForApiAdminPath()
+    {
+        var now = new DateTimeOffset(2026, 2, 20, 14, 0, 0, TimeSpan.Zero);
+        var timeProvider = new FakeTimeProvider(now);
+        var sink = new RecordingAuthEventSink();
+        var users = new InMemoryUserRepository();
+
+        await using var app = await CreateApplicationAsync(timeProvider, sink, users);
+
+        var principalAccessor = app.Services.GetRequiredService<AdminTestPrincipalAccessor>();
+        principalAccessor.Principal = CreatePrincipal(
+            tenant: "default",
+            scopes: new[] { StellaOpsScopes.UiAdmin, StellaOpsScopes.AuthorityUsersRead, StellaOpsScopes.AuthorityUsersWrite },
+            expiresAt: now.AddMinutes(10));
+
+        using var client = CreateTestClient(app);
+        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(AdminAuthenticationDefaults.AuthenticationScheme);
+        client.DefaultRequestHeaders.Add(AuthorityHttpHeaders.Tenant, "default");
+
+        var createResponse = await client.PostAsJsonAsync(
+            "/api/admin/users",
+            new
+            {
+                username = "legacy-api-user",
+                email = "legacy@example.com",
+                displayName = "Legacy API User",
+                roles = new[] { "operator" }
+            });
+
+        Assert.Equal(HttpStatusCode.Created, createResponse.StatusCode);
+        Assert.NotNull(createResponse.Headers.Location);
+        Assert.StartsWith("/api/admin/users/", createResponse.Headers.Location!.ToString(), StringComparison.OrdinalIgnoreCase);
+
+        var listResponse = await client.GetAsync("/api/admin/users");
+        Assert.Equal(HttpStatusCode.OK, listResponse.StatusCode);
+
+        var payload = await listResponse.Content.ReadFromJsonAsync<UserListPayload>();
+        Assert.NotNull(payload);
+        Assert.Contains(payload!.Users, static user => user.Username == "legacy-api-user");
+    }
+
     private static async Task<WebApplication> CreateApplicationAsync(
         FakeTimeProvider timeProvider,
         RecordingAuthEventSink sink,

src/Authority/StellaOps.Authority/StellaOps.Authority/Console/Admin/ConsoleAdminEndpointExtensions.cs

@@ -33,6 +33,13 @@ internal static class ConsoleAdminEndpointExtensions
         adminGroup.AddEndpointFilter(new TenantHeaderFilter());
         adminGroup.AddEndpointFilter(new FreshAuthFilter());
 
+        var legacyApiGroup = app.MapGroup("/api/admin")
+            .RequireAuthorization(policy => policy.RequireStellaOpsScopes(StellaOpsScopes.UiAdmin))
+            .WithTags("Console Admin");
+
+        legacyApiGroup.AddEndpointFilter(new TenantHeaderFilter());
+        legacyApiGroup.AddEndpointFilter(new FreshAuthFilter());
+
         // Tenants
         var tenantGroup = adminGroup.MapGroup("/tenants");
 
@@ -79,6 +86,17 @@ internal static class ConsoleAdminEndpointExtensions
             .WithName("AdminCreateUser")
             .WithSummary("Create a local user (does not apply to external IdP users).");
 
+        var legacyUserGroup = legacyApiGroup.MapGroup("/users");
+
+        legacyUserGroup.MapGet("", ListUsers)
+            .RequireAuthorization(policy => policy.RequireStellaOpsScopes(StellaOpsScopes.AuthorityUsersRead))
+            .WithSummary("Legacy alias: list users for the specified tenant.");
+
+        legacyUserGroup.MapPost("", CreateUser)
+            .RequireAuthorization(policy => policy.RequireStellaOpsScopes(StellaOpsScopes.AuthorityUsersWrite))
+            .RequireFreshAuth()
+            .WithSummary("Legacy alias: create a local user.");
+
         userGroup.MapPatch("/{userId}", UpdateUser)
             .RequireAuthorization(policy => policy.RequireStellaOpsScopes(StellaOpsScopes.AuthorityUsersWrite))
             .RequireFreshAuth()
@@ -388,7 +406,12 @@ internal static class ConsoleAdminEndpointExtensions
                 ("user.id", createdSummary.Id)),
             cancellationToken).ConfigureAwait(false);
 
-        return Results.Created($"/console/admin/users/{createdSummary.Id}", createdSummary);
+        var requestPath = httpContext.Request.Path.Value ?? string.Empty;
+        var locationPrefix = requestPath.StartsWith("/api/admin", StringComparison.OrdinalIgnoreCase)
+            ? "/api/admin/users"
+            : "/console/admin/users";
+
+        return Results.Created($"{locationPrefix}/{createdSummary.Id}", createdSummary);
     }
 
     private static async Task<IResult> UpdateUser(