Add filter-based topology bulk writes and refine API key scopes UX.

Filter add/layout/remove keeps MCP payloads small; tokens default MCP scopes and edit them in a modal with a compact help tip.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/i18n/en.ts

@@ -11,6 +11,7 @@ const en = {
     pagerMeta: "{{total}} items · page {{page}}/{{pages}}",
     opFailed: "Operation failed",
     empty: "-",
+    cancel: "Cancel",
   },
   workbench: {
     title: "Workbench",
@@ -476,8 +477,8 @@ const en = {
     colStatus: "Status",
     colIp: "IP",
     apiKeysTitle: "API Key management",
-    apiKeysHint:
-      "Create long-lived tokens for MCP/scripts. The secret is shown only once. Admins can issue keys for other users. Pick scopes; topology drawing needs ne:write.",
+    apiKeysHelp:
+      "The web UI uses login sessions, not API keys — keys are for MCP/scripts. Defaults on create: alarms:read + ne:read + ne:write + ne:exec; refine later with Edit scopes (takes effect immediately, no need to regenerate). Secret is shown once. Admins may issue for other users; scopes cannot exceed the owner's. Unused scopes are reserved for future MCP tools.",
     tokenName: "Name",
     expiresIn: "Expiry",
     expire7d: "7 days",
@@ -489,6 +490,7 @@ const en = {
     tokenOwnerSelf: "Myself ({{user}})",
     createToken: "Create key",
     tokenCreated: "API key created",
+    tokenUpdated: "Scopes updated",
     tokenRevoked: "Revoked",
     tokenOnceHint: "Copy and store this secret now; it will not be shown again:",
     copyToken: "Copy",
@@ -501,24 +503,21 @@ const en = {
     tokenStatusRevoked: "Revoked",
     revokeToken: "Revoke",
     revokeConfirm: "Revoke this API key?",
-    scopesTitle: "Scopes",
-    scopesHint:
-      "Scopes are stored on the token. Without Inherit, pick at least one. MCP default omits ne:write so write tools stay hidden from the agent.",
-    scopesInherit: "Inherit all owner scopes",
-    scopesInheritShort: "Inherit owner",
+    editScopes: "Edit scopes",
+    saveScopes: "Save scopes",
+    scopesUnsetLegacy: "Unrestricted (same as owner)",
     scopesCol: "Scopes",
-    scopesRequired: "Select at least one scope, or inherit all owner scopes",
+    scopesRequired: "Select at least one scope",
     scopesNoneAvailable: "This owner has no grantable scopes",
-    scopePresetMcp: "MCP default (read + CLI)",
-    scopePresetTopoWrite: "MCP + topology write",
-    scopeAlarmsRead: "alarms:read Alarms read",
-    scopeNeRead: "ne:read NE / topology read",
-    scopeNeWrite: "ne:write NE / topology write (draw)",
-    scopeNeExec: "ne:exec Managed NE exec",
-    scopeWebcrt: "webcrt:session WebCRT",
-    scopeSql: "sql:query SQL",
-    scopeAdminUsers: "admin:users User admin",
-    scopeOpsWrite: "ops:write Ops write",
+    scopeAlarmsRead: "alarms:read — Alarms read (netx MCP)",
+    scopeNeRead: "ne:read — NE / topology read (MCP)",
+    scopeNeWrite: "ne:write — NE / topology write / draw (MCP)",
+    scopeNeExec: "ne:exec — Managed NE CLI (netx MCP)",
+    scopeSql: "sql:query — UME SQL (netx MCP)",
+    scopeWebcrt: "webcrt:session — WebCRT (reserved MCP)",
+    scopeAdminUsers: "admin:users — User admin (reserved MCP)",
+    scopeOpsWrite: "ops:write — Ops write / subscriptions (reserved MCP)",
+
     forceChangeTitle: "Change initial password",
     forceChangeHint: "Account {{user}} is still using the default password. You must change it before continuing.",
     oldPassword: "Current password",

web/src/i18n/zh.ts

@@ -11,6 +11,7 @@ const zh = {
     pagerMeta: "共 {{total}} 条 · 第 {{page}}/{{pages}} 页",
     opFailed: "操作失败",
     empty: "-",
+    cancel: "取消",
   },
   workbench: {
     title: "工作台",
@@ -473,7 +474,8 @@ const zh = {
     colStatus: "状态码",
     colIp: "IP",
     apiKeysTitle: "API Key 管理",
-    apiKeysHint: "生成长期 Token 供 MCP/脚本调用；明文仅创建时显示一次。管理员可为其他用户签发。可勾选权限；拓扑画图需 ne:write。",
+    apiKeysHelp:
+      "网页登录不用 API Key，Key 给 MCP/脚本用。生成时默认 alarms:read + ne:read + ne:write + ne:exec，之后用「改权限」增减（保存即生效，不必重生明文）。明文仅创建时显示一次。管理员可代其他用户签发，权限不能超过所属用户已有能力；未接 MCP 的项为预留。",
     tokenName: "名称",
     expiresIn: "有效期",
     expire7d: "7 天",
@@ -485,6 +487,7 @@ const zh = {
     tokenOwnerSelf: "自己（{{user}}）",
     createToken: "生成 Key",
     tokenCreated: "API Key 已生成",
+    tokenUpdated: "权限已更新",
     tokenRevoked: "已吊销",
     tokenOnceHint: "请立即复制保存，关闭后无法再次查看明文：",
     copyToken: "复制",
@@ -497,23 +500,20 @@ const zh = {
     tokenStatusRevoked: "已吊销",
     revokeToken: "吊销",
     revokeConfirm: "确定吊销该 API Key？",
-    scopesTitle: "权限范围",
-    scopesHint: "勾选后写入 Token；不勾选「继承」时至少选一项。默认 MCP 不含 ne:write，写工具对 Agent 不可见。",
-    scopesInherit: "继承所属用户全部权限",
-    scopesInheritShort: "继承用户",
+    editScopes: "改权限",
+    saveScopes: "保存权限",
+    scopesUnsetLegacy: "未限定（等同所属用户）",
     scopesCol: "权限",
-    scopesRequired: "请至少勾选一项权限，或选择继承用户全部权限",
+    scopesRequired: "请至少勾选一项权限",
     scopesNoneAvailable: "当前所属用户没有可授予的权限",
-    scopePresetMcp: "MCP 默认（只读+CLI）",
-    scopePresetTopoWrite: "MCP + 拓扑写",
-    scopeAlarmsRead: "alarms:read 告警只读",
-    scopeNeRead: "ne:read 网元/拓扑只读",
-    scopeNeWrite: "ne:write 网元/拓扑写入（含画图）",
-    scopeNeExec: "ne:exec 托管网元执行命令",
-    scopeWebcrt: "webcrt:session WebCRT",
-    scopeSql: "sql:query SQL 查询",
-    scopeAdminUsers: "admin:users 用户管理",
-    scopeOpsWrite: "ops:write 运维写入",
+    scopeAlarmsRead: "alarms:read — 告警只读（netx MCP）",
+    scopeNeRead: "ne:read — 网元/拓扑只读（MCP）",
+    scopeNeWrite: "ne:write — 网元/拓扑写入、画图（MCP）",
+    scopeNeExec: "ne:exec — 托管网元 CLI（netx MCP）",
+    scopeSql: "sql:query — UME SQL（netx MCP）",
+    scopeWebcrt: "webcrt:session — WebCRT（预留 MCP）",
+    scopeAdminUsers: "admin:users — 用户管理（预留 MCP）",
+    scopeOpsWrite: "ops:write — 运维写/订阅（预留 MCP）",
     forceChangeTitle: "请修改初始密码",
     forceChangeHint: "账号 {{user}} 仍在使用默认密码，登录前必须先修改。",
     oldPassword: "当前密码",