* owners can remove and change roles of other namespace members.

* editors can invite log emitting agents without mailboxes using JWT tokens.
* guests can read logs from public namespaces.

	modified:   app.py
	modified:   openapi.yaml
	modified:   templates/base.html.j2
	modified:   templates/home.html.j2
	modified:   templates/manage_namespace.html.j2

openapi.yaml

@@ -111,6 +111,15 @@ paths:
       description: Logs out the current user.
       security:
         - sessionAuth: []
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                csrf_token:
+                  type: string
       responses:
         '302':
           description: Redirects to the home page
@@ -154,6 +163,13 @@ paths:
                   enum: ['on']
                 new_username:
                   type: string
+              required:
+                - new_username
+            encoding:
+              enable_gravatar:
+                contentType: text/plain
+              new_username:
+                contentType: text/plain
       responses:
         '302':
           description: Redirects to the profile page
@@ -199,8 +215,11 @@ paths:
                 is_public:
                   type: string
                   enum: ['on']
-              required:
-                - name
+            encoding:
+              name:
+                contentType: text/plain
+              is_public:
+                contentType: text/plain
       responses:
         '302':
           description: Redirects to the namespace management page
@@ -262,6 +281,10 @@ paths:
                 is_public:
                   type: string
                   enum: ['on']
+                  description: 'Checkbox value. Present if checked.'
+            encoding:
+              is_public:
+                contentType: text/plain
       responses:
         '302':
           description: Redirects to the namespace management page
@@ -304,6 +327,11 @@ paths:
               required:
                 - email
                 - role
+            encoding:
+              email:
+                contentType: text/plain
+              role:
+                contentType: text/plain
       responses:
         '302':
           description: Redirects to the namespace management page
@@ -319,6 +347,96 @@ paths:
         '404':
           description: Namespace not found
 
+  /namespace/{namespace_short_id}/remove_user:
+    post:
+      summary: Remove User from Namespace
+      description: Removes a user from the namespace (owners only, cannot remove self).
+      security:
+        - sessionAuth: []
+      parameters:
+        - in: path
+          name: namespace_short_id
+          required: true
+          schema:
+            type: string
+          description: The short ID of the namespace
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                user_id:
+                  type: string
+              required:
+                - user_id
+            encoding:
+              user_id:
+                contentType: text/plain
+      responses:
+        '302':
+          description: Redirects to the namespace management page
+          headers:
+            Location:
+              description: URL of the namespace management page
+              schema:
+                type: string
+        '400':
+          description: Bad Request (e.g., cannot remove self)
+        '403':
+          description: Forbidden (not owner or not logged in)
+        '404':
+          description: Namespace or user not found
+
+  /namespace/{namespace_short_id}/change_member_role:
+    post:
+      summary: Change Member Role in Namespace
+      description: Changes a member's role in the namespace (owners only, cannot change own role).
+      security:
+        - sessionAuth: []
+      parameters:
+        - in: path
+          name: namespace_short_id
+          required: true
+          schema:
+            type: string
+          description: The short ID of the namespace
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                user_id:
+                  type: string
+                role:
+                  type: string
+                  enum: ['owner', 'editor', 'reader']
+              required:
+                - user_id
+                - role
+            encoding:
+              user_id:
+                contentType: text/plain
+              role:
+                contentType: text/plain
+      responses:
+        '302':
+          description: Redirects to the namespace management page
+          headers:
+            Location:
+              description: URL of the namespace management page
+              schema:
+                type: string
+        '400':
+          description: Bad Request (e.g., cannot change own role)
+        '403':
+          description: Forbidden (not owner or not logged in)
+        '404':
+          description: Namespace or user not found
+
   /namespace/{namespace_short_id}/generate_agent_jwt:
     post:
       summary: Generate Agent JWT
@@ -343,6 +461,9 @@ paths:
                   type: string
               required:
                 - agent_name
+            encoding:
+              agent_name:
+                contentType: text/plain
       responses:
         '200':
           description: Agent JWT generated and displayed
@@ -381,6 +502,9 @@ paths:
                   type: string
               required:
                 - agent_id
+            encoding:
+              agent_id:
+                contentType: text/plain
       responses:
         '302':
           description: Redirects to the namespace management page
@@ -399,8 +523,12 @@ paths:
   /namespace/{namespace_short_id}/logs:
     get:
       summary: View Namespace Logs
-      description: Displays logs for the namespace (readers and above).
+      description: |
+        Displays logs for the specified namespace.
+        - **Public Namespaces:** Accessible to all users, including guests.
+        - **Private Namespaces:** Requires authentication and at least 'reader' role.
       security:
+        - {}          # Allows public access to this endpoint
         - sessionAuth: []
       parameters:
         - in: path
@@ -422,7 +550,7 @@ paths:
               schema:
                 type: string
         '403':
-          description: Forbidden (user does not have access)
+          description: Forbidden (user does not have access to private namespace)
         '404':
           description: Namespace not found