Toby Feel free to send a PR!
As I mentioned over here, there seems to be some vagueness about the purpose of the Guardian extension. One would suppose from the name that it is intended as a security add-on, but much of its stated functionality seems to fit better in the user management category.
I'm guessing that it's been focussing so much on the user management functionality because it needed someplace to display the security-related information. But wouldn't some of that infrastructure be better in the core? I think this would be a good time to assess what needs to go where, so that this functionality makes sense from the perspective of overall usability.
For example: the user list provided by Guardian is probably the best place to add in the "create new user" admin functionality being discussed in the thread I've linked above. But ... we've also had repeated feature requests for a user list that's visible to other users. That's a common feature for forums to have, and one that Flarum still lacks. Should such a user list be provided by a separate extension other than Guardian? If so, how do we rationalize the duplication of functionality this would represent?
If I were designing this, I'd probably take the user list functionality out of Guardian and put it in the core, accessible at a URL such as example.com/u/ (which currently returns a 404). Whether this user list is accessible by non-admin non-mod members would be controlled by a permission setting.
I would also add the user controls that are currently displayed on the user profile page to the user list page as well (with appropriate permissions, of course). And I'd add a "create new user" button at the top of that page (again, with appropriate permissions). That would be a reasonable thing to have in the core, I think; the ability to create users is akin to the ability to edit users, which is already in the core.
