fix(xo6/role): count users inherited from groups in the users column

The column read `role.userIds`, which the server fills from the direct
user-role assignments only. A role assigned to one user and to a group
of eight was listed as having a single user, and the side panel, which
counts the effective users, contradicted it on the same screen.

The count now unions the direct users with the members of the role's
groups, deduplicated since a user can hold the role both ways. The page
waits for the groups collection so the column does not first show the
direct count then jump to the effective one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01USXniSefu5YSpDDAbo4nf1

Author: ByScripts

@xen-orchestra/web/src/modules/role/components/list/RolesTable.vue

@@ -22,7 +22,9 @@
 </template>
 
 <script setup lang="ts">
+import { useXoGroupCollection } from '@/modules/group/remote-resources/use-xo-group-collection.ts'
 import type { FrontXoRole } from '@/modules/role/remote-resources/use-xo-role-collection.ts'
+import { getRoleUserIds } from '@/modules/role/utils/xo-role.util.ts'
 import VtsQueryBuilder from '@core/components/query-builder/VtsQueryBuilder.vue'
 import VtsRow from '@core/components/table/VtsRow.vue'
 import VtsTable from '@core/components/table/VtsTable.vue'
@@ -56,11 +58,13 @@ const {
 
 const { t } = useI18n()
 
+const { getGroupsByIds } = useXoGroupCollection()
+
 const filterableRoles = computed<FilterableRole[]>(() =>
   rawRoles.map(role => ({
     ...role,
     description: role.description ?? '',
-    usersCount: role.userIds.length,
+    usersCount: getRoleUserIds(role, getGroupsByIds(role.groupIds)).length,
     groupsCount: role.groupIds.length,
     privilegesCount: role.privilegeIds.length,
   }))

@xen-orchestra/web/src/modules/role/utils/xo-role.util.ts

@@ -0,0 +1,8 @@
+import type { FrontXoGroup } from '@/modules/group/remote-resources/use-xo-group-collection.ts'
+import type { FrontXoRole } from '@/modules/role/remote-resources/use-xo-role-collection.ts'
+
+// A user holds a role either directly or through one of its groups, and can hold it both ways at
+// once, so the same user is only counted once.
+export function getRoleUserIds(role: FrontXoRole, roleGroups: FrontXoGroup[]) {
+  return Array.from(new Set([...roleGroups.flatMap(group => group.users), ...role.userIds]))
+}

@xen-orchestra/web/src/pages/admin/user-management/roles.vue

@@ -7,12 +7,13 @@
       </template>
     </UiAlert>
     <UiCard class="container">
-      <RolesTable :roles :busy="!areRolesReady" :error="hasRoleFetchError" />
+      <RolesTable :roles :busy="!areRolesReady || !areGroupsReady" :error="hasRoleFetchError || hasGroupFetchError" />
     </UiCard>
   </div>
 </template>
 
 <script setup lang="ts">
+import { useXoGroupCollection } from '@/modules/group/remote-resources/use-xo-group-collection.ts'
 import RolesTable from '@/modules/role/components/list/RolesTable.vue'
 import { useXoRoleCollection } from '@/modules/role/remote-resources/use-xo-role-collection.ts'
 import UiAlert from '@core/components/ui/alert/UiAlert.vue'
@@ -24,6 +25,10 @@ const { t } = useI18n()
 
 const { roles, areRolesReady, hasRoleFetchError } = useXoRoleCollection()
 
+// The users column counts the users inherited from the role's groups, so the table is only
+// meaningful once the groups are loaded.
+const { areGroupsReady, hasGroupFetchError } = useXoGroupCollection()
+
 const [isInfoVisible, hideInfo] = useHidePermanently('what-is-a-role')
 </script>