Ensure Pixel gets disabled, PDF ToC support (#3659)

# Description of Changes Please provide a summary of the changes, including: - What was changed - Why the change was made - Any challenges encountered Closes #(issue_number) --- ## Checklist ### General - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/HowToAddNewLanguage.md) (if applicable) - [ ] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#6-testing) for more details. --------- Co-authored-by: Dario Ghunney Ware <[email protected]> Co-authored-by: Connor Yoh <[email protected]> Co-authored-by: a <a> Co-authored-by: Reece <[email protected]>
2026-07-16 19:33:11 +02:00 · 2025-06-11 17:21:37 +01:00
parent bdc35519da
commit 1f2365f03c
126 changed files with 39003 additions and 26979 deletions
@@ -0,0 +1,44 @@
+package stirling.software.proprietary.model;
+
+import java.io.Serializable;
+import java.util.HashSet;
+import java.util.Set;
+
+import jakarta.persistence.*;
+
+import lombok.*;
+
+import stirling.software.proprietary.security.model.User;
+
+@Entity
+@Table(name = "teams")
+@NoArgsConstructor
+@Getter
+@Setter
+@EqualsAndHashCode(onlyExplicitlyIncluded = true)
+@ToString(onlyExplicitlyIncluded = true)
+public class Team implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "team_id")
+    private Long id;
+
+    @Column(name = "name", unique = true, nullable = false)
+    private String name;
+
+    @OneToMany(mappedBy = "team", cascade = CascadeType.ALL, orphanRemoval = true)
+    private Set<User> users = new HashSet<>();
+
+    public void addUser(User user) {
+        users.add(user);
+        user.setTeam(this);
+    }
+
+    public void removeUser(User user) {
+        users.remove(user);
+        user.setTeam(null);
+    }
+}
@@ -0,0 +1,20 @@
+package stirling.software.proprietary.model.dto;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+public class TeamWithUserCountDTO {
+    private Long id;
+    private String name;
+    private Long userCount;
+    
+    // Constructor for JPQL projection
+    public TeamWithUserCountDTO(Long id, String name, Long userCount) {
+        this.id = id;
+        this.name = name;
+        this.userCount = userCount;
+    }
+}
@@ -1,6 +1,7 @@
 package stirling.software.proprietary.security;

 import java.sql.SQLException;
+import java.util.List;
 import java.util.UUID;

 import org.springframework.stereotype.Component;
@@ -13,7 +14,10 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.service.DatabaseServiceInterface;
+import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;

@Slf4j
@@ -22,9 +26,8 @@ import stirling.software.proprietary.security.service.UserService;
 public class InitialSecuritySetup {

    private final UserService userService;
-
+    private final TeamService teamService;
    private final ApplicationProperties applicationProperties;
-
    private final DatabaseServiceInterface databaseService;

    @PostConstruct
@@ -40,6 +43,7 @@ public class InitialSecuritySetup {
            }

            userService.migrateOauth2ToSSO();
+            assignUsersToDefaultTeamIfMissing();
            initializeInternalApiUser();
        } catch (IllegalArgumentException | SQLException | UnsupportedProviderException e) {
            log.error("Failed to initialize security setup.", e);
@@ -47,6 +51,19 @@ public class InitialSecuritySetup {
        }
    }

+    private void assignUsersToDefaultTeamIfMissing() {
+        Team defaultTeam = teamService.getOrCreateDefaultTeam();
+        List<User> usersWithoutTeam = userService.getUsersWithoutTeam();
+
+        for (User user : usersWithoutTeam) {
+            user.setTeam(defaultTeam);
+        }
+
+        userService.saveAll(usersWithoutTeam); // batch save
+        log.info(
+                "Assigned {} user(s) without a team to the default team.", usersWithoutTeam.size());
+    }
+
    private void initializeAdminUser() throws SQLException, UnsupportedProviderException {
        String initialUsername =
                applicationProperties.getSecurity().getInitialLogin().getUsername();
@@ -58,7 +75,9 @@ public class InitialSecuritySetup {
                && !initialPassword.isEmpty()
                && userService.findByUsernameIgnoreCase(initialUsername).isEmpty()) {

-            userService.saveUser(initialUsername, initialPassword, Role.ADMIN.getRoleId());
+            Team team = teamService.getOrCreateDefaultTeam();
+            userService.saveUser(
+                    initialUsername, initialPassword, team, Role.ADMIN.getRoleId(), false);
            log.info("Admin user created: {}", initialUsername);
        } else {
            createDefaultAdminUser();
@@ -70,7 +89,9 @@ public class InitialSecuritySetup {
        String defaultPassword = "stirling";

        if (userService.findByUsernameIgnoreCase(defaultUsername).isEmpty()) {
-            userService.saveUser(defaultUsername, defaultPassword, Role.ADMIN.getRoleId(), true);
+            Team team = teamService.getOrCreateDefaultTeam();
+            userService.saveUser(
+                    defaultUsername, defaultPassword, team, Role.ADMIN.getRoleId(), true);
            log.info("Default admin user created: {}", defaultUsername);
        }
    }
@@ -78,10 +99,13 @@ public class InitialSecuritySetup {
    private void initializeInternalApiUser()
            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
        if (!userService.usernameExistsIgnoreCase(Role.INTERNAL_API_USER.getRoleId())) {
+            Team team = teamService.getOrCreateInternalTeam();
            userService.saveUser(
                    Role.INTERNAL_API_USER.getRoleId(),
                    UUID.randomUUID().toString(),
-                    Role.INTERNAL_API_USER.getRoleId());
+                    team,
+                    Role.INTERNAL_API_USER.getRoleId(),
+                    false);
            userService.addApiKeyToUser(Role.INTERNAL_API_USER.getRoleId());
            log.info("Internal API user created: {}", Role.INTERNAL_API_USER.getRoleId());
        }
@@ -1,4 +1,4 @@
-package stirling.software.proprietary.security.controller.web;
+package stirling.software.proprietary.security.config;

 import static stirling.software.common.util.ProviderUtils.validateProvider;

@@ -38,11 +38,14 @@ import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.oauth2.GitHubProvider;
 import stirling.software.common.model.oauth2.GoogleProvider;
 import stirling.software.common.model.oauth2.KeycloakProvider;
+import stirling.software.proprietary.model.Team;
 import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.Authority;
 import stirling.software.proprietary.security.model.SessionEntity;
 import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.TeamRepository;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;

@Controller
@@ -57,16 +60,19 @@ public class AccountWebController {
    // Assuming you have a repository for user operations
    private final UserRepository userRepository;
    private final boolean runningEE;
+    private final TeamRepository teamRepository;

    public AccountWebController(
            ApplicationProperties applicationProperties,
            SessionPersistentRegistry sessionPersistentRegistry,
            UserRepository userRepository,
+            TeamRepository teamRepository,
            @Qualifier("runningEE") boolean runningEE) {
        this.applicationProperties = applicationProperties;
        this.sessionPersistentRegistry = sessionPersistentRegistry;
        this.userRepository = userRepository;
        this.runningEE = runningEE;
+        this.teamRepository = teamRepository;
    }

    @GetMapping("/login")
@@ -210,7 +216,7 @@ public class AccountWebController {
    @GetMapping("/adminSettings")
    public String showAddUserForm(
            HttpServletRequest request, Model model, Authentication authentication) {
-        List<User> allUsers = userRepository.findAll();
+        List<User> allUsers = userRepository.findAllWithTeam();
        Iterator<User> iterator = allUsers.iterator();
        Map<String, String> roleDetails = Role.getAllRoleDetails();
        // Map to store session information and user activity status
@@ -221,14 +227,27 @@ public class AccountWebController {
        while (iterator.hasNext()) {
            User user = iterator.next();
            if (user != null) {
+                boolean shouldRemove = false;
+                
+                // Check if user is an INTERNAL_API_USER
                for (Authority authority : user.getAuthorities()) {
                    if (authority.getAuthority().equals(Role.INTERNAL_API_USER.getRoleId())) {
-                        iterator.remove();
+                        shouldRemove = true;
                        roleDetails.remove(Role.INTERNAL_API_USER.getRoleId());
-                        // Break out of the inner loop once the user is removed
                        break;
                    }
                }
+                
+                // Also check if user is part of the Internal team
+                if (user.getTeam() != null && user.getTeam().getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+                    shouldRemove = true;
+                }
+                
+                // Remove the user if either condition is true
+                if (shouldRemove) {
+                    iterator.remove();
+                    continue;
+                }
                // Determine the user's session status and last request time
                int maxInactiveInterval = sessionPersistentRegistry.getMaxInactiveInterval();
                boolean hasActiveSession = false;
@@ -331,6 +350,13 @@ public class AccountWebController {
        model.addAttribute("activeUsers", activeUsers);
        model.addAttribute("disabledUsers", disabledUsers);

+        // Get all teams but filter out the Internal team
+        List<Team> allTeams = teamRepository.findAll()
+                .stream()
+                .filter(team -> !team.getName().equals(stirling.software.proprietary.security.service.TeamService.INTERNAL_TEAM_NAME))
+                .toList();
+        model.addAttribute("teams", allTeams);
+
        model.addAttribute("maxPaidUsers", applicationProperties.getPremium().getMaxUsers());
        return "adminSettings";
    }
@@ -0,0 +1,11 @@
+package stirling.software.proprietary.security.config;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/** Annotation to mark endpoints that require a Pro or higher license. */
+@Target({ElementType.METHOD, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface PremiumEndpoint {}
@@ -0,0 +1,30 @@
+package stirling.software.proprietary.security.config;
+
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ResponseStatusException;
+
+@Aspect
+@Component
+public class PremiumEndpointAspect {
+
+    private final boolean runningProOrHigher;
+
+    public PremiumEndpointAspect(@Qualifier("runningProOrHigher") boolean runningProOrHigher) {
+        this.runningProOrHigher = runningProOrHigher;
+    }
+
+    @Around(
+            "@annotation(stirling.software.proprietary.security.config.PremiumEndpoint) || @within(stirling.software.proprietary.security.config.PremiumEndpoint)")
+    public Object checkPremiumAccess(ProceedingJoinPoint joinPoint) throws Throwable {
+        if (!runningProOrHigher) {
+            throw new ResponseStatusException(
+                    HttpStatus.FORBIDDEN, "This endpoint requires a Pro or higher license");
+        }
+        return joinPoint.proceed();
+    }
+}
@@ -9,6 +9,7 @@ import org.springframework.boot.jdbc.DataSourceBuilder;
 import org.springframework.boot.jdbc.DatabaseDriver;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
 import org.springframework.data.jpa.repository.config.EnableJpaRepositories;

 import lombok.Getter;
@@ -21,8 +22,12 @@ import stirling.software.common.model.exception.UnsupportedProviderException;
@Slf4j
@Getter
@Configuration
-@EnableJpaRepositories(basePackages = "stirling.software.proprietary.security.database.repository")
-@EntityScan({"stirling.software.proprietary.security.model"})
+@EnableJpaRepositories(
+        basePackages = {
+            "stirling.software.proprietary.security.database.repository",
+            "stirling.software.proprietary.security.repository"
+        })
+@EntityScan({"stirling.software.proprietary.security.model", "stirling.software.proprietary.model"})
 public class DatabaseConfig {

    public final String DATASOURCE_DEFAULT_URL;
@@ -55,6 +60,7 @@ public class DatabaseConfig {
     */
    @Bean
    @Qualifier("dataSource")
+    @Primary
    public DataSource dataSource() throws UnsupportedProviderException {
        DataSourceBuilder<?> dataSourceBuilder = DataSourceBuilder.create();

@@ -2,9 +2,10 @@ package stirling.software.proprietary.security.configuration.ee;

 import static stirling.software.proprietary.security.configuration.ee.KeygenLicenseVerifier.License;

-import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
+import org.springframework.context.annotation.Profile;
 import org.springframework.core.Ordered;
 import org.springframework.core.annotation.Order;

@@ -28,18 +29,23 @@ public class EEAppConfig {
        migrateEnterpriseSettingsToPremium(this.applicationProperties);
    }

+    @Profile("security")
    @Bean(name = "runningProOrHigher")
-    @Qualifier("runningProOrHigher")
+    @Primary
    public boolean runningProOrHigher() {
        return licenseKeyChecker.getPremiumLicenseEnabledResult() != License.NORMAL;
    }

+    @Profile("security")
    @Bean(name = "license")
+    @Primary
    public String licenseType() {
        return licenseKeyChecker.getPremiumLicenseEnabledResult().name();
    }

+    @Profile("security")
    @Bean(name = "runningEE")
+    @Primary
    public boolean runningEnterprise() {
        return licenseKeyChecker.getPremiumLicenseEnabledResult() == License.ENTERPRISE;
    }
@@ -49,7 +55,9 @@ public class EEAppConfig {
        return applicationProperties.getPremium().getProFeatures().isSsoAutoLogin();
    }

+    @Profile("security")
    @Bean(name = "GoogleDriveEnabled")
+    @Primary
    public boolean googleDriveEnabled() {
        return runningProOrHigher()
                && applicationProperties.getPremium().getProFeatures().getGoogleDrive().isEnabled();
@@ -0,0 +1,127 @@
+package stirling.software.proprietary.security.controller.api;
+
+import java.util.Optional;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.servlet.view.RedirectView;
+
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import jakarta.transaction.Transactional;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.config.PremiumEndpoint;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.TeamService;
+
+@Controller
+@RequestMapping("/api/v1/team")
+@Tag(name = "Team", description = "Team Management APIs")
+@Slf4j
+@RequiredArgsConstructor
+@PremiumEndpoint
+public class TeamController {
+
+    private final TeamRepository teamRepository;
+    private final UserRepository userRepository;
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/create")
+    public RedirectView createTeam(@RequestParam("name") String name) {
+        if (teamRepository.existsByNameIgnoreCase(name)) {
+            return new RedirectView("/adminSettings?messageType=teamExists");
+        }
+        Team team = new Team();
+        team.setName(name);
+        teamRepository.save(team);
+        return new RedirectView("/adminSettings?messageType=teamCreated");
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/rename")
+    public RedirectView renameTeam(
+            @RequestParam("teamId") Long teamId, @RequestParam("newName") String newName) {
+        Optional<Team> existing = teamRepository.findById(teamId);
+        if (existing.isEmpty()) {
+            return new RedirectView("/adminSettings?messageType=teamNotFound");
+        }
+        if (teamRepository.existsByNameIgnoreCase(newName)) {
+            return new RedirectView("/adminSettings?messageType=teamNameExists");
+        }
+        Team team = existing.get();
+        
+        // Prevent renaming the Internal team
+        if (team.getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return new RedirectView("/adminSettings?messageType=internalTeamNotAccessible");
+        }
+        
+        team.setName(newName);
+        teamRepository.save(team);
+        return new RedirectView("/adminSettings?messageType=teamRenamed");
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/delete")
+    @Transactional
+    public RedirectView deleteTeam(@RequestParam("teamId") Long teamId) {
+        Optional<Team> teamOpt = teamRepository.findById(teamId);
+        if (teamOpt.isEmpty()) {
+            return new RedirectView("/adminSettings?messageType=teamNotFound");
+        }
+
+        Team team = teamOpt.get();
+        
+        // Prevent deleting the Internal team
+        if (team.getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return new RedirectView("/adminSettings?messageType=internalTeamNotAccessible");
+        }
+        
+        long memberCount = userRepository.countByTeam(team);
+        if (memberCount > 0) {
+            return new RedirectView("/adminSettings?messageType=teamHasUsers");
+        }
+
+        teamRepository.delete(team);
+        return new RedirectView("/adminSettings?messageType=teamDeleted");
+    }
+    
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/addUser")
+    @Transactional
+    public RedirectView addUserToTeam(
+            @RequestParam("teamId") Long teamId,
+            @RequestParam("userId") Long userId) {
+        
+        // Find the team
+        Team team = teamRepository.findById(teamId)
+                .orElseThrow(() -> new RuntimeException("Team not found"));
+        
+        // Prevent adding users to the Internal team
+        if (team.getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return new RedirectView("/teams?error=internalTeamNotAccessible");
+        }
+        
+        // Find the user
+        User user = userRepository.findById(userId)
+                .orElseThrow(() -> new RuntimeException("User not found"));
+        
+        // Check if user is in the Internal team - prevent moving them
+        if (user.getTeam() != null && user.getTeam().getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return new RedirectView("/teams/" + teamId + "?error=cannotMoveInternalUsers");
+        }
+        
+        // Assign user to team
+        user.setTeam(team);
+        userRepository.save(user);
+        
+        // Redirect back to team details page
+        return new RedirectView("/teams/" + teamId + "?messageType=userAdded");
+    }
+}
@@ -25,6 +25,7 @@ import io.swagger.v3.oas.annotations.tags.Tag;

 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import jakarta.transaction.Transactional;

 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -32,10 +33,14 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.AuthenticationType;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.model.api.user.UsernameAndPass;
+import stirling.software.proprietary.security.repository.TeamRepository;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;

@@ -50,7 +55,8 @@ public class UserController {
    private final UserService userService;
    private final SessionPersistentRegistry sessionRegistry;
    private final ApplicationProperties applicationProperties;
-
+    private final TeamRepository teamRepository;
+    private final UserRepository userRepository;
    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
    @PostMapping("/register")
    public String register(@ModelAttribute UsernameAndPass requestModel, Model model)
@@ -60,7 +66,13 @@ public class UserController {
            return "register";
        }
        try {
-            userService.saveUser(requestModel.getUsername(), requestModel.getPassword());
+            Team team = teamRepository.findByName(TeamService.DEFAULT_TEAM_NAME).orElse(null);
+            userService.saveUser(
+                    requestModel.getUsername(),
+                    requestModel.getPassword(),
+                    team,
+                    Role.USER.getRoleId(),
+                    false);
        } catch (IllegalArgumentException e) {
            return "redirect:/login?messageType=invalidUsername";
        }
@@ -200,6 +212,7 @@ public class UserController {
            @RequestParam(name = "username", required = true) String username,
            @RequestParam(name = "password", required = false) String password,
            @RequestParam(name = "role") String role,
+            @RequestParam(name = "teamId", required = false) Long teamId,
            @RequestParam(name = "authType") String authType,
            @RequestParam(name = "forceChange", required = false, defaultValue = "false")
                    boolean forceChange)
@@ -233,13 +246,29 @@ public class UserController {
            // If the role ID is not valid, redirect with an error message
            return new RedirectView("/adminSettings?messageType=invalidRole", true);
        }
+        
+        // Use teamId if provided, otherwise use default team
+        Long effectiveTeamId = teamId;
+        if (effectiveTeamId == null) {
+            Team defaultTeam = teamRepository.findByName(TeamService.DEFAULT_TEAM_NAME).orElse(null);
+            if (defaultTeam != null) {
+                effectiveTeamId = defaultTeam.getId();
+            }
+        } else {
+            // Check if the selected team is Internal - prevent assigning to it
+            Team selectedTeam = teamRepository.findById(effectiveTeamId).orElse(null);
+            if (selectedTeam != null && TeamService.INTERNAL_TEAM_NAME.equals(selectedTeam.getName())) {
+                return new RedirectView("/adminSettings?messageType=internalTeamNotAccessible", true);
+            }
+        }
+        
        if (authType.equalsIgnoreCase(AuthenticationType.SSO.toString())) {
-            userService.saveUser(username, AuthenticationType.SSO, role);
+            userService.saveUser(username, AuthenticationType.SSO, effectiveTeamId, role);
        } else {
            if (password.isBlank()) {
                return new RedirectView("/adminSettings?messageType=invalidPassword", true);
            }
-            userService.saveUser(username, password, role, forceChange);
+            userService.saveUser(username, password, effectiveTeamId, role, forceChange);
        }
        return new RedirectView(
                "/adminSettings", // Redirect to account page after adding the user
@@ -248,9 +277,11 @@ public class UserController {

    @PreAuthorize("hasRole('ROLE_ADMIN')")
    @PostMapping("/admin/changeRole")
+    @Transactional
    public RedirectView changeRole(
            @RequestParam(name = "username") String username,
            @RequestParam(name = "role") String role,
+            @RequestParam(name = "teamId", required = false) Long teamId,
            Authentication authentication)
            throws SQLException, UnsupportedProviderException {
        Optional<User> userOpt = userService.findByUsernameIgnoreCase(username);
@@ -278,6 +309,26 @@ public class UserController {
            return new RedirectView("/adminSettings?messageType=invalidRole", true);
        }
        User user = userOpt.get();
+        
+        // Update the team if a teamId is provided
+        if (teamId != null) {
+            Team team = teamRepository.findById(teamId).orElse(null);
+            if (team != null) {
+                // Prevent assigning to Internal team
+                if (TeamService.INTERNAL_TEAM_NAME.equals(team.getName())) {
+                    return new RedirectView("/adminSettings?messageType=internalTeamNotAccessible", true);
+                }
+                
+                // Prevent moving users from Internal team
+                if (user.getTeam() != null && TeamService.INTERNAL_TEAM_NAME.equals(user.getTeam().getName())) {
+                    return new RedirectView("/adminSettings?messageType=cannotMoveInternalUsers", true);
+                }
+                
+                user.setTeam(team);
+                userRepository.save(user);
+            }
+        }
+        
        userService.changeRole(user, role);
        return new RedirectView(
                "/adminSettings", // Redirect to account page after adding the user
@@ -0,0 +1,105 @@
+package stirling.software.proprietary.security.controller.web;
+
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.model.dto.TeamWithUserCountDTO;
+import stirling.software.proprietary.security.database.repository.SessionRepository;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.TeamService;
+
+@Controller
+@RequestMapping("/teams")
+@RequiredArgsConstructor
+@Slf4j
+public class TeamWebController {
+
+    private final TeamRepository teamRepository;
+    private final SessionRepository sessionRepository;
+    private final UserRepository userRepository;
+
+    @GetMapping
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    public String listTeams(Model model) {
+        // Get teams with user counts using a DTO projection
+        List<TeamWithUserCountDTO> allTeamsWithCounts = teamRepository.findAllTeamsWithUserCount();
+        
+        // Filter out the Internal team
+        List<TeamWithUserCountDTO> teamsWithCounts = allTeamsWithCounts.stream()
+                .filter(team -> !team.getName().equals(TeamService.INTERNAL_TEAM_NAME))
+                .toList();
+
+        // Get the latest activity for each team
+        List<Object[]> teamActivities = sessionRepository.findLatestActivityByTeam();
+
+        // Convert the query results to a map for easy access in the view
+        Map<Long, Date> teamLastRequest = new HashMap<>();
+        for (Object[] result : teamActivities) {
+            Long teamId = (Long) result[0]; // teamId alias
+            Date lastActivity = (Date) result[1]; // lastActivity alias
+            teamLastRequest.put(teamId, lastActivity);
+        }
+
+        // Add data to the model
+        model.addAttribute("teamsWithCounts", teamsWithCounts);
+        model.addAttribute("teamLastRequest", teamLastRequest);
+        
+        return "accounts/teams";
+    }
+
+    @GetMapping("/{id}")
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    public String viewTeamDetails(@PathVariable("id") Long id, Model model) {
+        // Get the team
+        Team team = teamRepository.findById(id)
+                .orElseThrow(() -> new RuntimeException("Team not found"));
+        
+        // Prevent access to Internal team
+        if (team.getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return "redirect:/teams?error=internalTeamNotAccessible";
+        }
+        
+        // Get users for this team directly using the direct query
+        List<User> teamUsers = userRepository.findAllByTeamId(id);
+        
+        // Get all users not in this team for the Add User to Team dropdown
+        // Exclude users that are in the Internal team
+        List<User> allUsers = userRepository.findAllWithTeam();
+        List<User> availableUsers = allUsers.stream()
+                .filter(user -> (user.getTeam() == null || !user.getTeam().getId().equals(id)) && 
+                               (user.getTeam() == null || !user.getTeam().getName().equals(TeamService.INTERNAL_TEAM_NAME)))
+                .toList();
+        
+        // Get the latest session for each user in the team
+        List<Object[]> userSessions = sessionRepository.findLatestSessionByTeamId(id);
+
+        // Create a map of username to last request date
+        Map<String, Date> userLastRequest = new HashMap<>();
+        for (Object[] result : userSessions) {
+            String username = (String) result[0]; // username alias
+            Date lastRequest = (Date) result[1]; // lastRequest alias
+            userLastRequest.put(username, lastRequest);
+        }
+
+        model.addAttribute("team", team);
+        model.addAttribute("teamUsers", teamUsers);
+        model.addAttribute("availableUsers", availableUsers);
+        model.addAttribute("userLastRequest", userLastRequest);
+        return "accounts/team-details";
+    }
+}
@@ -29,4 +29,20 @@ public interface SessionRepository extends JpaRepository<SessionEntity, String>
            @Param("expired") boolean expired,
            @Param("lastRequest") Date lastRequest,
            @Param("principalName") String principalName);
+
+    @Query(
+            "SELECT t.id as teamId, MAX(s.lastRequest) as lastActivity "
+                    + "FROM stirling.software.proprietary.model.Team t "
+                    + "LEFT JOIN t.users u "
+                    + "LEFT JOIN SessionEntity s ON u.username = s.principalName "
+                    + "GROUP BY t.id")
+    List<Object[]> findLatestActivityByTeam();
+
+    @Query(
+            "SELECT u.username as username, MAX(s.lastRequest) as lastRequest "
+                    + "FROM stirling.software.proprietary.security.model.User u "
+                    + "LEFT JOIN SessionEntity s ON u.username = s.principalName "
+                    + "WHERE u.team.id = :teamId "
+                    + "GROUP BY u.username")
+    List<Object[]> findLatestSessionByTeamId(@Param("teamId") Long teamId);
 }
@@ -8,6 +8,7 @@ import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.query.Param;
 import org.springframework.stereotype.Repository;

+import stirling.software.proprietary.model.Team;
 import stirling.software.proprietary.security.model.User;

@Repository
@@ -22,4 +23,17 @@ public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByApiKey(String apiKey);

    List<User> findByAuthenticationTypeIgnoreCase(String authenticationType);
+
+    @Query("SELECT u FROM User u WHERE u.team IS NULL")
+    List<User> findAllWithoutTeam();
+
+    @Query(value = "SELECT u FROM User u LEFT JOIN FETCH u.team")
+    List<User> findAllWithTeam();
+    
+    @Query("SELECT u FROM User u JOIN FETCH u.authorities JOIN FETCH u.team WHERE u.team.id = :teamId")
+    List<User> findAllByTeamId(@Param("teamId") Long teamId);
+
+    long countByTeam(Team team);
+
+    List<User> findAllByTeam(Team team);
 }
@@ -16,6 +16,7 @@ import lombok.Setter;
 import lombok.ToString;

 import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.model.Team;

@Entity
@Table(name = "users")
@@ -57,6 +58,10 @@ public class User implements Serializable {
    @OneToMany(fetch = FetchType.EAGER, cascade = CascadeType.ALL, mappedBy = "user")
    private Set<Authority> authorities = new HashSet<>();

+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "team_id")
+    private Team team;
+
    @ElementCollection
    @MapKeyColumn(name = "setting_key")
    @Lob
@@ -0,0 +1,23 @@
+package stirling.software.proprietary.security.repository;
+
+import java.util.List;
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.model.dto.TeamWithUserCountDTO;
+
+@Repository
+public interface TeamRepository extends JpaRepository<Team, Long> {
+    Optional<Team> findByName(String name);
+
+    @Query("SELECT new stirling.software.proprietary.model.dto.TeamWithUserCountDTO(t.id, t.name, COUNT(u)) " +
+           "FROM Team t LEFT JOIN t.users u GROUP BY t.id, t.name")
+    List<TeamWithUserCountDTO> findAllTeamsWithUserCount();
+
+    boolean existsByNameIgnoreCase(String name);
+}
@@ -0,0 +1,40 @@
+package stirling.software.proprietary.security.service;
+
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.repository.TeamRepository;
+
+@Service
+@RequiredArgsConstructor
+public class TeamService {
+
+    private final TeamRepository teamRepository;
+
+    public static final String DEFAULT_TEAM_NAME = "Default";
+    public static final String INTERNAL_TEAM_NAME = "Internal";
+
+    public Team getOrCreateDefaultTeam() {
+        return teamRepository
+                .findByName(DEFAULT_TEAM_NAME)
+                .orElseGet(
+                        () -> {
+                            Team defaultTeam = new Team();
+                            defaultTeam.setName(DEFAULT_TEAM_NAME);
+                            return teamRepository.save(defaultTeam);
+                        });
+    }
+
+    public Team getOrCreateInternalTeam() {
+        return teamRepository
+                .findByName(INTERNAL_TEAM_NAME)
+                .orElseGet(
+                        () -> {
+                            Team internalTeam = new Team();
+                            internalTeam.setName(INTERNAL_TEAM_NAME);
+                            return teamRepository.save(internalTeam);
+                        });
+    }
+}
@@ -8,6 +8,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.UUID;
+import java.util.function.Supplier;

 import org.springframework.context.MessageSource;
 import org.springframework.context.i18n.LocaleContextHolder;
@@ -31,11 +32,13 @@ import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.common.service.UserServiceInterface;
+import stirling.software.proprietary.model.Team;
 import stirling.software.proprietary.security.database.repository.AuthorityRepository;
 import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.AuthenticationType;
 import stirling.software.proprietary.security.model.Authority;
 import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.TeamRepository;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;

@@ -45,7 +48,7 @@ import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 public class UserService implements UserServiceInterface {

    private final UserRepository userRepository;
-
+    private final TeamRepository teamRepository;
    private final AuthorityRepository authorityRepository;

    private final PasswordEncoder passwordEncoder;
@@ -162,7 +165,7 @@ public class UserService implements UserServiceInterface {

    public void saveUser(String username, AuthenticationType authenticationType)
            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        saveUser(username, authenticationType, Role.USER.getRoleId());
+        saveUser(username, authenticationType, (Long) null, Role.USER.getRoleId());
    }

    private User saveUser(Optional<User> user, String apiKey) {
@@ -173,71 +176,98 @@ public class UserService implements UserServiceInterface {
        throw new UsernameNotFoundException("User not found");
    }

-    public void saveUser(String username, AuthenticationType authenticationType, String role)
+    public User saveUser(
+            String username, AuthenticationType authenticationType, Long teamId, String role)
            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        if (!isUsernameValid(username)) {
-            throw new IllegalArgumentException(getInvalidUsernameMessage());
-        }
-        User user = new User();
-        user.setUsername(username);
-        user.setEnabled(true);
-        user.setFirstLogin(false);
-        user.addAuthority(new Authority(role, user));
-        user.setAuthenticationType(authenticationType);
-        userRepository.save(user);
-        databaseService.exportDatabase();
+        return saveUserCore(
+                username, // username
+                null, // password
+                authenticationType, // authenticationType
+                teamId, // teamId
+                null, // team
+                role, // role
+                false, // firstLogin
+                true // enabled
+                );
    }

-    public void saveUser(String username, String password)
+    public User saveUser(
+            String username, AuthenticationType authenticationType, Team team, String role)
            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        if (!isUsernameValid(username)) {
-            throw new IllegalArgumentException(getInvalidUsernameMessage());
-        }
-        User user = new User();
-        user.setUsername(username);
-        user.setPassword(passwordEncoder.encode(password));
-        user.setEnabled(true);
-        user.setAuthenticationType(AuthenticationType.WEB);
-        user.addAuthority(new Authority(Role.USER.getRoleId(), user));
-        userRepository.save(user);
-        databaseService.exportDatabase();
+        return saveUserCore(
+                username, // username
+                null, // password
+                authenticationType, // authenticationType
+                null, // teamId
+                team, // team
+                role, // role
+                false, // firstLogin
+                true // enabled
+                );
    }

-    public void saveUser(String username, String password, String role, boolean firstLogin)
+    public User saveUser(String username, String password, Long teamId)
            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        if (!isUsernameValid(username)) {
-            throw new IllegalArgumentException(getInvalidUsernameMessage());
-        }
-        User user = new User();
-        user.setUsername(username);
-        user.setPassword(passwordEncoder.encode(password));
-        user.addAuthority(new Authority(role, user));
-        user.setEnabled(true);
-        user.setAuthenticationType(AuthenticationType.WEB);
-        user.setFirstLogin(firstLogin);
-        userRepository.save(user);
-        databaseService.exportDatabase();
+        return saveUserCore(
+                username, // username
+                password, // password
+                AuthenticationType.WEB, // authenticationType
+                teamId, // teamId
+                null, // team
+                Role.USER.getRoleId(), // role
+                false, // firstLogin
+                true // enabled
+                );
    }

-    public void saveUser(String username, String password, String role)
+    public User saveUser(
+            String username, String password, Team team, String role, boolean firstLogin)
            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        saveUser(username, password, role, false);
+        return saveUserCore(
+                username, // username
+                password, // password
+                AuthenticationType.WEB, // authenticationType
+                null, // teamId
+                team, // team
+                role, // role
+                firstLogin, // firstLogin
+                true // enabled
+                );
    }

-    public void saveUser(String username, String password, boolean firstLogin, boolean enabled)
+    public User saveUser(
+            String username, String password, Long teamId, String role, boolean firstLogin)
            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        if (!isUsernameValid(username)) {
-            throw new IllegalArgumentException(getInvalidUsernameMessage());
-        }
-        User user = new User();
-        user.setUsername(username);
-        user.setPassword(passwordEncoder.encode(password));
-        user.addAuthority(new Authority(Role.USER.getRoleId(), user));
-        user.setEnabled(enabled);
-        user.setAuthenticationType(AuthenticationType.WEB);
-        user.setFirstLogin(firstLogin);
-        userRepository.save(user);
-        databaseService.exportDatabase();
+        return saveUserCore(
+                username, // username
+                password, // password
+                AuthenticationType.WEB, // authenticationType
+                teamId, // teamId
+                null, // team
+                role, // role
+                firstLogin, // firstLogin
+                true // enabled
+                );
+    }
+
+    public void saveUser(String username, String password, Long teamId, String role)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        saveUser(username, password, teamId, role, false);
+    }
+
+    public void saveUser(
+            String username, String password, Long teamId, boolean firstLogin, boolean enabled)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        saveUserCore(
+                username, // username
+                password, // password
+                AuthenticationType.WEB, // authenticationType
+                teamId, // teamId
+                null, // team
+                Role.USER.getRoleId(), // role
+                firstLogin, // firstLogin
+                enabled // enabled
+                );
    }

    public void deleteUser(String username) {
@@ -345,6 +375,111 @@ public class UserService implements UserServiceInterface {
        return passwordEncoder.matches(currentPassword, user.getPassword());
    }

+    /**
+     * Resolves a team based on the provided information, with consistent error handling.
+     *
+     * @param teamId The ID of the team to find, may be null
+     * @param defaultTeamSupplier A supplier that provides a default team when teamId is null
+     * @return The resolved Team object
+     * @throws IllegalArgumentException If the teamId is invalid
+     */
+    private Team resolveTeam(Long teamId, Supplier<Team> defaultTeamSupplier) {
+        if (teamId == null) {
+            return defaultTeamSupplier.get();
+        }
+
+        return teamRepository
+                .findById(teamId)
+                .orElseThrow(() -> new IllegalArgumentException("Invalid team ID: " + teamId));
+    }
+
+    /**
+     * Gets the default team, creating it if it doesn't exist.
+     *
+     * @return The default team
+     */
+    private Team getDefaultTeam() {
+        return teamRepository
+                .findByName("Default")
+                .orElseGet(
+                        () -> {
+                            Team team = new Team();
+                            team.setName("Default");
+                            return teamRepository.save(team);
+                        });
+    }
+
+    /**
+     * Core implementation for saving a user with all possible parameters. This method centralizes
+     * the common logic for all saveUser variants.
+     *
+     * @param username Username for the new user
+     * @param password Password for the user (may be null for SSO/OAuth users)
+     * @param authenticationType Type of authentication (WEB, SSO, etc.)
+     * @param teamId ID of the team to assign (may be null to use default)
+     * @param team Team object to assign (takes precedence over teamId if both provided)
+     * @param role Role to assign to the user
+     * @param firstLogin Whether this is the user's first login
+     * @param enabled Whether the user account is enabled
+     * @return The saved User object
+     * @throws IllegalArgumentException If username is invalid or team is invalid
+     * @throws SQLException If database operation fails
+     * @throws UnsupportedProviderException If provider is not supported
+     */
+    private User saveUserCore(
+            String username,
+            String password,
+            AuthenticationType authenticationType,
+            Long teamId,
+            Team team,
+            String role,
+            boolean firstLogin,
+            boolean enabled)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+
+        if (!isUsernameValid(username)) {
+            throw new IllegalArgumentException(getInvalidUsernameMessage());
+        }
+
+        User user = new User();
+        user.setUsername(username);
+
+        // Set password if provided
+        if (password != null && !password.isEmpty()) {
+            user.setPassword(passwordEncoder.encode(password));
+        }
+
+        // Set authentication type
+        user.setAuthenticationType(authenticationType);
+
+        // Set enabled status
+        user.setEnabled(enabled);
+
+        // Set first login flag
+        user.setFirstLogin(firstLogin);
+
+        // Set role (authority)
+        if (role == null) {
+            role = Role.USER.getRoleId();
+        }
+        user.addAuthority(new Authority(role, user));
+
+        // Resolve and set team
+        if (team != null) {
+            user.setTeam(team);
+        } else {
+            user.setTeam(resolveTeam(teamId, this::getDefaultTeam));
+        }
+
+        // Save user
+        userRepository.save(user);
+
+        // Export database
+        databaseService.exportDatabase();
+
+        return user;
+    }
+
    public boolean isUsernameValid(String username) {
        // Checks whether the simple username is formatted correctly
        // Regular expression for user name: Min. 3 characters, max. 50 characters
@@ -464,7 +599,6 @@ public class UserService implements UserServiceInterface {
        }
    }

-    @Override
    public long getTotalUsersCount() {
        // Count all users in the database
        long userCount = userRepository.count();
@@ -474,4 +608,12 @@ public class UserService implements UserServiceInterface {
        }
        return userCount;
    }
+
+    public List<User> getUsersWithoutTeam() {
+        return userRepository.findAllWithoutTeam();
+    }
+
+    public void saveAll(List<User> users) {
+        userRepository.saveAll(users);
+    }
 }
@@ -0,0 +1,387 @@
+/* modern-tables.css - Professional styling for data tables and related elements */
+
+/* Main container - Reduced max-width from 1100px to 900px */
+.data-container {
+  max-width: 900px;
+  margin: 2rem auto;
+  background-color: var(--md-sys-color-surface-container-lowest);
+  border-radius: 1rem;
+  padding: 0.5rem;
+  box-shadow: 0 2px 12px rgba(var(--md-sys-color-shadow, 0, 0, 0), 0.05);
+}
+
+/* Panel / Card */
+.data-panel {
+  background-color: var(--md-sys-color-surface);
+  border-radius: 0.75rem;
+  box-shadow: 0 2px 8px rgba(var(--md-sys-color-shadow, 0, 0, 0), 0.08);
+  overflow: hidden;
+}
+
+/* Header */
+.data-header {
+  display: flex;
+  align-items: center;
+  padding: 1.25rem 1.5rem;
+  background-color: var(--md-sys-color-surface-variant);
+  border-bottom: 1px solid var(--md-sys-color-outline-variant);
+}
+
+.data-title {
+  margin: 0;
+  font-size: 1.5rem;
+  font-weight: 600;
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+}
+
+.data-icon {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 2.5rem;
+  height: 2.5rem;
+  background-color: var(--md-sys-color-primary);
+  color: var(--md-sys-color-on-primary);
+  border-radius: 0.5rem;
+  transition: all 0.2s ease;
+}
+
+/* Content area */
+.data-body {
+  padding: 1.5rem;
+  background-color: var(--md-sys-color-surface-container-low);
+  border-radius: 0.5rem;
+}
+
+/* Action buttons container */
+.data-actions {
+  display: flex;
+  justify-content: center;
+  margin: 1rem 0 1.5rem;
+  gap: 0.75rem;
+}
+
+/* Can add these classes for different alignments */
+.data-actions-start {
+  justify-content: flex-start;
+}
+
+.data-actions-end {
+  justify-content: flex-end;
+}
+
+/* Button styling */
+.data-btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0.625rem 1.25rem;
+  border-radius: 0.5rem;
+  font-weight: 500;
+  transition: all 0.2s ease;
+  border: none;
+  cursor: pointer;
+  text-decoration: none;
+}
+
+/* Fixed button colors - normal state has more contrast now */
+.data-btn-primary {
+  background-color: var(--md-sys-color-primary);
+  color: var(--md-sys-color-on-primary);
+}
+
+.data-btn-primary:hover {
+  background-color: var(--md-sys-color-primary-container);
+  color: var(--md-sys-color-primary);
+  box-shadow: 0 2px 4px rgba(var(--md-sys-color-shadow, 0, 0, 0), 0.1);
+}
+
+.data-btn-secondary {
+  background-color: var(--md-sys-color-secondary);
+  color: var(--md-sys-color-on-secondary);
+}
+
+.data-btn-secondary:hover {
+  background-color: var(--md-sys-color-secondary-container);
+  color: var(--md-sys-color-secondary);
+  box-shadow: 0 2px 4px rgba(var(--md-sys-color-shadow, 0, 0, 0), 0.1);
+}
+
+.data-btn-danger {
+  background-color: var(--md-sys-color-error);
+  color: var(--md-sys-color-on-error);
+}
+
+.data-btn-danger:hover {
+  background-color: var(--md-sys-color-error-container);
+  color: var(--md-sys-color-error);
+  box-shadow: 0 2px 4px rgba(var(--md-sys-color-shadow, 0, 0, 0), 0.1);
+}
+
+.data-btn-sm {
+  padding: 0.375rem 0.75rem;
+  font-size: 0.875rem;
+}
+
+/* Icon button */
+.data-icon-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2.25rem;
+  height: 2.25rem;
+  border-radius: 0.5rem;
+  border: none;
+  cursor: pointer;
+  transition: all 0.2s ease;
+  background-color: transparent;
+}
+
+/* Fixed icon button colors */
+.data-icon-btn-primary {
+  background-color: var(--md-sys-color-primary);
+  color: var(--md-sys-color-on-primary);
+}
+
+.data-icon-btn-primary:hover {
+  background-color: var(--md-sys-color-primary-container);
+  color: var(--md-sys-color-primary);
+  box-shadow: 0 2px 4px rgba(var(--md-sys-color-shadow, 0, 0, 0), 0.1);
+}
+
+.data-icon-btn-danger {
+  background-color: var(--md-sys-color-error);
+  color: var(--md-sys-color-on-error);
+}
+
+.data-icon-btn-danger:hover {
+  background-color: var(--md-sys-color-error-container);
+  color: var(--md-sys-color-error);
+  box-shadow: 0 2px 4px rgba(var(--md-sys-color-shadow, 0, 0, 0), 0.1);
+}
+
+/* Table styling */
+.data-table {
+  width: 100%;
+  border-collapse: separate;
+  border-spacing: 0;
+}
+
+.data-table th {
+  text-align: left;
+  padding: 1rem;
+  background-color: var(--md-sys-color-surface-variant);
+  color: var(--md-sys-color-on-surface-variant);
+  font-weight: 600;
+  position: sticky;
+  top: 0;
+}
+
+.data-table th:first-child {
+  border-top-left-radius: 0.5rem;
+}
+
+.data-table th:last-child {
+  border-top-right-radius: 0.5rem;
+}
+
+.data-table td {
+  padding: 1rem;
+  border-bottom: 1px solid var(--md-sys-color-outline-variant);
+}
+
+.data-table tr:last-child td {
+  border-bottom: none;
+}
+
+.data-table tr:hover {
+  background-color: rgba(var(--md-sys-color-surface-variant-rgb), 0.5);
+}
+
+/* Table action cells */
+.data-action-cell {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  justify-content: flex-start;
+}
+
+.data-action-cell-center {
+  justify-content: center;
+}
+
+.data-action-cell-end {
+  justify-content: flex-end;
+}
+
+/* Status indicators */
+.data-status {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.375rem;
+  padding: 0.375rem 0.75rem;
+  border-radius: 1rem;
+  font-size: 0.875rem;
+  font-weight: 500;
+}
+
+.data-status-success {
+  background-color: var(--md-sys-color-tertiary-container);
+  color: var(--md-sys-color-tertiary);
+}
+
+.data-status-danger {
+  background-color: var(--md-sys-color-error-container);
+  color: var(--md-sys-color-error);
+}
+
+.data-status-warning {
+  background-color: var(--md-sys-color-secondary-container);
+  color: var(--md-sys-color-secondary);
+}
+
+.data-status-info {
+  background-color: var(--md-sys-color-primary-container);
+  color: var(--md-sys-color-primary);
+}
+
+/* Stats/Info container */
+.data-stats {
+  display: flex;
+  gap: 1.5rem;
+  margin-bottom: 1.5rem;
+  flex-wrap: wrap;
+}
+
+.data-stat-card {
+  background-color: var(--md-sys-color-surface-variant);
+  border-radius: 0.5rem;
+  padding: 1.25rem;
+  flex: 1;
+  min-width: 180px;
+  box-shadow: 0 2px 8px rgba(var(--md-sys-color-shadow, 0, 0, 0), 0.05);
+}
+
+.data-stat-label {
+  font-size: 0.875rem;
+  color: var(--md-sys-color-on-surface-variant);
+  margin-bottom: 0.5rem;
+}
+
+.data-stat-value {
+  font-size: 1.75rem;
+  font-weight: 700;
+  color: var(--md-sys-color-on-surface);
+}
+
+/* Section title */
+.data-section-title {
+  font-size: 1.25rem;
+  font-weight: 600;
+  margin: 1.5rem 0 1rem;
+  padding-bottom: 0.5rem;
+  border-bottom: 1px solid var(--md-sys-color-outline-variant);
+}
+
+/* Empty state styling */
+.data-empty {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  padding: 3rem;
+  color: var(--md-sys-color-on-surface-variant);
+}
+
+.data-empty-icon {
+  font-size: 4rem;
+  margin-bottom: 1rem;
+  opacity: 0.7;
+}
+
+.data-empty-text {
+  font-size: 1.125rem;
+  margin-bottom: 1.5rem;
+}
+
+/* Modal styling */
+.data-modal {
+  border-radius: 0.75rem;
+  overflow: hidden;
+}
+
+.data-modal-header {
+  background-color: var(--md-sys-color-surface-variant);
+  padding: 1.25rem;
+  border-bottom: 1px solid var(--md-sys-color-outline-variant);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+
+.data-modal-title {
+  margin: 0;
+  font-size: 1.25rem;
+  font-weight: 600;
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+}
+
+/* Modal close button styling */
+.data-btn-close {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 2rem;
+  height: 2rem;
+  border-radius: 50%;
+  background-color: var(--md-sys-color-surface-variant);
+  color: var(--md-sys-color-on-surface-variant);
+  border: none;
+  cursor: pointer;
+  transition: all 0.2s ease;
+  padding: 0;
+  margin: 0;
+}
+
+.data-btn-close:hover {
+  background-color: var(--md-sys-color-surface-container-high);
+  color: var(--md-sys-color-on-surface);
+}
+
+.data-btn-close .material-symbols-rounded {
+  font-size: 1.25rem;
+}
+
+.data-modal-body {
+  padding: 1.5rem;
+}
+
+.data-modal-footer {
+  padding: 1rem 1.5rem;
+  border-top: 1px solid var(--md-sys-color-outline-variant);
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.75rem;
+}
+
+/* Form elements */
+.data-form-group {
+  margin-bottom: 1.25rem;
+}
+
+.data-form-label {
+  display: block;
+  margin-bottom: 0.5rem;
+  font-weight: 500;
+}
+
+.data-form-control {
+  width: 100%;
+  padding: 0.75rem 1rem;
+  border-radius: 0.5rem;
+  border: 1px solid
+  }
@@ -0,0 +1,196 @@
+<!DOCTYPE html>
+<html th:lang="${#locale.language}" th:dir="#{language.direction}" th:data-language="${#locale.toString()}" xmlns:th="https://www.thymeleaf.org">
+  <head>
+    <th:block th:insert="~{fragments/common :: head(title=#{team.details.title}, header=#{team.details.header})}"></th:block>
+    <link rel="stylesheet" th:href="@{/css/modern-tables.css}">
+  </head>
+
+  <body>
+    <th:block th:insert="~{fragments/common :: game}"></th:block>
+    <div id="page-container">
+      <div id="content-wrap">
+        <th:block th:insert="~{fragments/navbar.html :: navbar}"></th:block>
+        
+        <div class="data-container">
+          <div class="data-panel">
+            <div class="data-header">
+              <h1 class="data-title">
+                <span class="data-icon">
+                  <span class="material-symbols-rounded">group</span>
+                </span>
+                <span th:text="'Team: ' + ${team.name}">Team Name</span>
+              </h1>
+            </div>
+            
+            <div class="data-body">
+              <div class="data-stats">
+                <div class="data-stat-card">
+                  <div class="data-stat-label">Total Members:</div>
+                  <div class="data-stat-value" th:text="${teamUsers.size()}">1</div>
+                </div>
+              </div>
+              
+              <div class="data-actions data-actions-start">
+                <a th:href="@{'/teams'}" class="data-btn data-btn-secondary">
+                  <span class="material-symbols-rounded">arrow_back</span>
+                  <span th:text="#{team.back}">Back to Teams</span>
+                </a>
+              </div>
+              
+              <div class="data-section-title">Members</div>
+              
+              <div class="table-responsive">
+                <table class="data-table">
+                  <thead>
+                    <tr>
+                      <th>ID</th>
+                      <th>Username</th>
+                      <th>Role</th>
+                      <th scope="col" th:title="${@runningProOrHigher} ? #{adminUserSettings.lastRequest} : 'Pro feature'" class="text-overflow" th:text="#{adminUserSettings.lastRequest}">Last Request</th>
+                      <th>Status</th>
+                    </tr>
+                  </thead>
+                  <tbody>
+                    <tr th:each="user : ${teamUsers}">
+                      <td th:text="${user.id}">1</td>
+                      <td th:text="${user.username}">username</td>
+                      <td th:text="#{${user.roleName}}">Role</td>
+                      <td th:text="${@runningProOrHigher} ? (${userLastRequest[user.username] != null ? #dates.format(userLastRequest[user.username], 'yyyy-MM-dd HH:mm:ss') : 'N/A'}) : 'hidden'">2023-01-01 12:00:00</td>
+                      <td>
+                        <span th:if="${user.enabled}" class="data-status data-status-success">
+                          <span class="material-symbols-rounded">person</span>
+                          Enabled
+                        </span>
+                        <span th:unless="${user.enabled}" class="data-status data-status-danger">
+                          <span class="material-symbols-rounded">person_off</span>
+                          Disabled
+                        </span>
+                      </td>
+                    </tr>
+                  </tbody>
+                </table>
+              </div>
+              
+              <!-- Empty state for when there are no team members -->
+              <div th:if="${teamUsers.empty}" class="data-empty">
+                <span class="material-symbols-rounded data-empty-icon">person_off</span>
+                <p class="data-empty-text">This team has no members yet.</p>
+                <button data-bs-toggle="modal" data-bs-target="#addUserToTeamModal" class="data-btn data-btn-primary">
+                  <span class="material-symbols-rounded">person_add</span>
+                  <span th:text="#{team.addUser}">Add User to Team</span>
+                </button>
+              </div>
+              
+              <!-- Add button for non-empty teams too -->
+              <div th:if="${!teamUsers.empty}" class="data-actions data-mt-3">
+                <button data-bs-toggle="modal" data-bs-target="#addUserToTeamModal" class="data-btn data-btn-primary">
+                  <span class="material-symbols-rounded">person_add</span>
+                  <span th:text="#{team.addUser}">Add User to Team</span>
+                </button>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+      
+      <!-- JavaScript for team warning -->
+      <script th:inline="javascript">
+        function checkUserTeam(userId) {
+          // Clear any existing warning
+          const warningDiv = document.getElementById('teamChangeWarning');
+          const warningMessage = document.getElementById('warningMessage');
+          const submitButton = document.getElementById('addUserSubmitBtn');
+          
+          // Reset
+          warningDiv.style.display = 'none';
+          submitButton.onclick = null;
+          
+          // Get the selected option
+          const selectedOption = document.querySelector('#userId option[value="' + userId + '"]');
+          if (!selectedOption) return;
+          
+          // Get team data
+          const currentTeam = selectedOption.getAttribute('data-team');
+          const currentTeamId = selectedOption.getAttribute('data-team-id');
+          const newTeamName = /*[[${team.name}]]*/ 'Current Team';
+          
+          // If user is already in a team, show warning
+          if (currentTeam && currentTeam.length > 0) {
+            // Use internationalized message
+            const warningTemplate = /*[[#{team.warning.moveUser}]]*/ 'Warning: This will move the user from "{0}" team to "{1}" team. Are you sure?';
+            const formattedWarning = warningTemplate.replace('{0}', currentTeam).replace('{1}', newTeamName);
+            warningMessage.textContent = formattedWarning;
+            warningDiv.style.display = 'block';
+            
+            // Add confirmation to submit button
+            submitButton.onclick = function(e) {
+              // Use internationalized message
+              const confirmTemplate = /*[[#{team.confirm.moveUser}]]*/ 'Are you sure you want to move this user from "{0}" team to "{1}" team?';
+              const formattedConfirm = confirmTemplate.replace('{0}', currentTeam).replace('{1}', newTeamName);
+              if (!confirm(formattedConfirm)) {
+                e.preventDefault();
+                return false;
+              }
+              return true;
+            };
+          }
+        }
+      </script>
+      
+      <!-- Add User to Team Modal -->
+      <div class="modal fade" id="addUserToTeamModal" tabindex="-1" aria-hidden="true">
+        <div class="modal-dialog modal-dialog-centered">
+          <form th:action="@{'/api/v1/team/addUser'}" method="post" class="modal-content data-modal">
+            <div class="data-modal-header">
+              <h5 class="data-modal-title">
+                <span class="data-icon">
+                  <span class="material-symbols-rounded">person_add</span>
+                </span>
+                <span th:text="#{team.addUser}">Add User to Team</span>
+              </h5>
+              <button type="button" class="data-btn-close" data-bs-dismiss="modal" aria-label="Close">
+                <span class="material-symbols-rounded">close</span>
+              </button>
+            </div>
+            <div class="data-modal-body">
+              <input type="hidden" name="teamId" th:value="${team.id}" />
+              
+              <div class="data-form-group">
+                <label for="userId" class="data-form-label" th:text="#{team.selectUser}">Select User</label>
+                <select name="userId" id="userId" class="data-form-control" required onchange="checkUserTeam(this.value)">
+                  <option value="" disabled selected th:text="#{selectFillter}">-- Select User --</option>
+                  <option th:each="user : ${availableUsers}" 
+                          th:value="${user.id}" 
+                          th:text="${user.username}"
+                          th:data-team="${user.team != null ? user.team.name : ''}"
+                          th:data-team-id="${user.team != null ? user.team.id : ''}">
+                    Username
+                  </option>
+                </select>
+              </div>
+              
+              <!-- Warning message for users being moved between teams -->
+              <div id="teamChangeWarning" class="alert alert-warning mt-3" style="display: none;">
+                <span class="material-symbols-rounded">warning</span>
+                <span id="warningMessage">Warning: This will move the user from their current team to this team.</span>
+              </div>
+              
+              <div class="data-form-actions">
+                <button type="button" class="data-btn data-btn-secondary" data-bs-dismiss="modal">
+                  <span class="material-symbols-rounded">close</span>
+                  <span th:text="#{cancel}">Cancel</span>
+                </button>
+                <button type="submit" id="addUserSubmitBtn" class="data-btn data-btn-primary">
+                  <span class="material-symbols-rounded">check</span>
+                  <span th:text="#{team.addUser}">Add User</span>
+                </button>
+              </div>
+            </div>
+          </form>
+        </div>
+      </div>
+      
+      <th:block th:insert="~{fragments/footer.html :: footer}"></th:block>
+    </div>
+  </body>
+</html>
@@ -0,0 +1,133 @@
+<!DOCTYPE html>
+<html th:lang="${#locale.language}" th:dir="#{language.direction}" th:data-language="${#locale.toString()}" xmlns:th="https://www.thymeleaf.org">
+<head>
+  <th:block th:insert="~{fragments/common :: head(title=#{adminUserSettings.manageTeams}, header=#{adminUserSettings.manageTeams})}"></th:block>
+  <link rel="stylesheet" th:href="@{/css/modern-tables.css}">
+</head>
+<body>
+  <th:block th:insert="~{fragments/common :: game}"></th:block>
+  <div id="page-container">
+    <div id="content-wrap">
+      <th:block th:insert="~{fragments/navbar.html :: navbar}"></th:block>
+      
+      <div class="data-container">
+        <div class="data-panel">
+          <div class="data-header">
+            <h1 class="data-title">
+              <span class="data-icon">
+                <span class="material-symbols-rounded">groups</span>
+              </span>
+              <span th:text="#{adminUserSettings.manageTeams}">Team Management</span>
+            </h1>
+          </div>
+          
+          <div class="data-body">
+            <!-- Back Button -->
+            <div class="data-actions data-actions-start">
+              <a href="/adminSettings" class="data-btn data-btn-secondary">
+                <span class="material-symbols-rounded">arrow_back</span>
+                <span th:text="#{back.toSettings}">Back to Settings</span>
+              </a>
+            </div>
+            
+            <!-- Create New Team Button -->
+            <div class="data-actions">
+              <a href="#" 
+                 th:data-bs-toggle="${@runningProOrHigher} ? 'modal' : null" 
+                 th:data-bs-target="${@runningProOrHigher} ? '#addTeamModal' : null"
+                 th:class="${@runningProOrHigher} ? 'data-btn data-btn-primary' : 'data-btn data-btn-danger'"
+                 th:title="${@runningProOrHigher} ? #{adminUserSettings.createTeam} : #{enterpriseEdition.proTeamFeatureDisabled}">
+                <span class="material-symbols-rounded">group_add</span>
+                <span th:text="#{adminUserSettings.createTeam}">Create New Team</span>
+              </a>
+            </div>
+            
+            <!-- Team Table -->
+            <div class="table-responsive">
+              <table class="data-table">
+                <thead>
+                  <tr>
+                    <th scope="col" th:text="#{adminUserSettings.teamName}">Team Name</th>
+                    <th scope="col" th:text="#{adminUserSettings.totalMembers}">Total Members</th>
+                    <th scope="col" th:title="${@runningProOrHigher} ? #{adminUserSettings.lastRequest} : 'Pro feature'" class="text-overflow" th:text="#{adminUserSettings.lastRequest}">Last Request</th>
+                    <th scope="col" th:text="#{adminUserSettings.actions}">Actions</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  <!-- Try approach 1 - DTO projection -->
+                  <tr th:each="teamDto : ${teamsWithCounts}">
+                    <td th:text="${teamDto.name}"></td>
+                    <td th:text="${teamDto.userCount}"></td>
+                    <td th:text="${@runningProOrHigher} ? (${teamLastRequest[teamDto.id] != null ? #dates.format(teamLastRequest[teamDto.id], 'yyyy-MM-dd HH:mm:ss') : 'N/A'}) : 'hidden'"></td>
+                    <td>
+                      <div class="data-action-cell">
+                        <a th:href="@{'/teams/' + ${teamDto.id}}" class="data-btn data-btn-secondary data-btn-sm" th:title="#{adminUserSettings.viewTeam}">
+                          <span class="material-symbols-rounded">search</span> <span th:text="#{view}">View</span>
+                        </a>
+                        <form th:action="@{'/api/v1/team/delete'}" method="post" style="display:inline-block"
+                              onsubmit="return confirmDeleteTeam()">
+                          <input type="hidden" name="teamId" th:value="${teamDto.id}" />
+                          <button type="submit" class="data-btn data-btn-danger data-btn-sm" 
+                            th:disabled="${!@runningProOrHigher}" 
+                            th:classappend="${!@runningProOrHigher} ? 'disabled' : ''"
+                            th:title="${@runningProOrHigher} ? #{adminUserSettings.deleteTeam} : #{enterpriseEdition.proTeamFeatureDisabled}">
+                            <span class="material-symbols-rounded">delete</span> <span th:text="#{delete}">Delete</span>
+                          </button>
+                        </form>
+                      </div>
+                    </td>
+                  </tr>
+                </tbody>
+              </table>
+            </div>
+            
+            <!-- Delete Confirmation Script -->
+            <script th:inline="javascript">
+              const confirmDeleteText = /*[[#{adminUserSettings.confirmDeleteTeam}]]*/ 'Are you sure you want to delete this team?';
+              function confirmDeleteTeam() {
+                return confirm(confirmDeleteText);
+              }
+            </script>
+          </div>
+        </div>
+      </div>
+      
+      <!-- Add Team Modal -->
+      <div class="modal fade" id="addTeamModal" tabindex="-1" aria-hidden="true">
+        <div class="modal-dialog modal-dialog-centered">
+          <form th:action="@{'/api/v1/team/create'}" method="post" class="modal-content data-modal">
+            <div class="data-modal-header">
+              <h5 class="data-modal-title">
+                <span class="data-icon">
+                  <span class="material-symbols-rounded">group_add</span>
+                </span>
+                <span th:text="#{adminUserSettings.createTeam}">Create Team</span>
+              </h5>
+              <button type="button" class="data-btn-close" data-bs-dismiss="modal" aria-label="Close">
+                <span class="material-symbols-rounded">close</span>
+              </button>
+            </div>
+            <div class="data-modal-body">
+              <div class="data-form-group">
+                <label for="teamName" class="data-form-label" th:text="#{adminUserSettings.teamName}">Team Name</label>
+                <input type="text" name="name" id="teamName" class="data-form-control" required />
+              </div>
+              <div class="data-form-actions">
+                <button type="button" class="data-btn data-btn-secondary" data-bs-dismiss="modal">
+                  <span class="material-symbols-rounded">close</span>
+                  <span th:text="#{cancel}">Cancel</span>
+                </button>
+                <button type="submit" class="data-btn data-btn-primary">
+                  <span class="material-symbols-rounded">check</span>
+                  <span th:text="#{adminUserSettings.createTeam}">Create</span>
+                </button>
+              </div>
+            </div>
+          </form>
+        </div>
+      </div>
+    </div>
+    <th:block th:insert="~{fragments/footer.html :: footer}"></th:block>
+  </div>
+</body>
+</html>