Ensure Pixel gets disabled, PDF ToC support (#3659)

# Description of Changes

Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#6-testing)
for more details.

---------

Co-authored-by: Dario Ghunney Ware <dariogware@gmail.com>
Co-authored-by: Connor Yoh <con.yoh13@gmail.com>
Co-authored-by: a <a>
Co-authored-by: Reece <reecebrowne1995@gmail.com>

proprietary/src/main/java/stirling/software/proprietary/model/Team.java

@@ -0,0 +1,44 @@
+package stirling.software.proprietary.model;
+
+import java.io.Serializable;
+import java.util.HashSet;
+import java.util.Set;
+
+import jakarta.persistence.*;
+
+import lombok.*;
+
+import stirling.software.proprietary.security.model.User;
+
+@Entity
+@Table(name = "teams")
+@NoArgsConstructor
+@Getter
+@Setter
+@EqualsAndHashCode(onlyExplicitlyIncluded = true)
+@ToString(onlyExplicitlyIncluded = true)
+public class Team implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "team_id")
+    private Long id;
+
+    @Column(name = "name", unique = true, nullable = false)
+    private String name;
+
+    @OneToMany(mappedBy = "team", cascade = CascadeType.ALL, orphanRemoval = true)
+    private Set<User> users = new HashSet<>();
+
+    public void addUser(User user) {
+        users.add(user);
+        user.setTeam(this);
+    }
+
+    public void removeUser(User user) {
+        users.remove(user);
+        user.setTeam(null);
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/model/dto/TeamWithUserCountDTO.java

@@ -0,0 +1,20 @@
+package stirling.software.proprietary.model.dto;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+public class TeamWithUserCountDTO {
+    private Long id;
+    private String name;
+    private Long userCount;
+    
+    // Constructor for JPQL projection
+    public TeamWithUserCountDTO(Long id, String name, Long userCount) {
+        this.id = id;
+        this.name = name;
+        this.userCount = userCount;
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/InitialSecuritySetup.java

@@ -1,6 +1,7 @@
 package stirling.software.proprietary.security;
 
 import java.sql.SQLException;
+import java.util.List;
 import java.util.UUID;
 
 import org.springframework.stereotype.Component;
@@ -13,7 +14,10 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.service.DatabaseServiceInterface;
+import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;
 
 @Slf4j
@@ -22,9 +26,8 @@ import stirling.software.proprietary.security.service.UserService;
 public class InitialSecuritySetup {
 
     private final UserService userService;
-
+    private final TeamService teamService;
     private final ApplicationProperties applicationProperties;
-
     private final DatabaseServiceInterface databaseService;
 
     @PostConstruct
@@ -40,6 +43,7 @@ public class InitialSecuritySetup {
             }
 
             userService.migrateOauth2ToSSO();
+            assignUsersToDefaultTeamIfMissing();
             initializeInternalApiUser();
         } catch (IllegalArgumentException | SQLException | UnsupportedProviderException e) {
             log.error("Failed to initialize security setup.", e);
@@ -47,6 +51,19 @@ public class InitialSecuritySetup {
         }
     }
 
+    private void assignUsersToDefaultTeamIfMissing() {
+        Team defaultTeam = teamService.getOrCreateDefaultTeam();
+        List<User> usersWithoutTeam = userService.getUsersWithoutTeam();
+
+        for (User user : usersWithoutTeam) {
+            user.setTeam(defaultTeam);
+        }
+
+        userService.saveAll(usersWithoutTeam); // batch save
+        log.info(
+                "Assigned {} user(s) without a team to the default team.", usersWithoutTeam.size());
+    }
+
     private void initializeAdminUser() throws SQLException, UnsupportedProviderException {
         String initialUsername =
                 applicationProperties.getSecurity().getInitialLogin().getUsername();
@@ -58,7 +75,9 @@ public class InitialSecuritySetup {
                 && !initialPassword.isEmpty()
                 && userService.findByUsernameIgnoreCase(initialUsername).isEmpty()) {
 
-            userService.saveUser(initialUsername, initialPassword, Role.ADMIN.getRoleId());
+            Team team = teamService.getOrCreateDefaultTeam();
+            userService.saveUser(
+                    initialUsername, initialPassword, team, Role.ADMIN.getRoleId(), false);
             log.info("Admin user created: {}", initialUsername);
         } else {
             createDefaultAdminUser();
@@ -70,7 +89,9 @@ public class InitialSecuritySetup {
         String defaultPassword = "stirling";
 
         if (userService.findByUsernameIgnoreCase(defaultUsername).isEmpty()) {
-            userService.saveUser(defaultUsername, defaultPassword, Role.ADMIN.getRoleId(), true);
+            Team team = teamService.getOrCreateDefaultTeam();
+            userService.saveUser(
+                    defaultUsername, defaultPassword, team, Role.ADMIN.getRoleId(), true);
             log.info("Default admin user created: {}", defaultUsername);
         }
     }
@@ -78,10 +99,13 @@ public class InitialSecuritySetup {
     private void initializeInternalApiUser()
             throws IllegalArgumentException, SQLException, UnsupportedProviderException {
         if (!userService.usernameExistsIgnoreCase(Role.INTERNAL_API_USER.getRoleId())) {
+            Team team = teamService.getOrCreateInternalTeam();
             userService.saveUser(
                     Role.INTERNAL_API_USER.getRoleId(),
                     UUID.randomUUID().toString(),
-                    Role.INTERNAL_API_USER.getRoleId());
+                    team,
+                    Role.INTERNAL_API_USER.getRoleId(),
+                    false);
             userService.addApiKeyToUser(Role.INTERNAL_API_USER.getRoleId());
             log.info("Internal API user created: {}", Role.INTERNAL_API_USER.getRoleId());
         }

proprietary/src/main/java/stirling/software/proprietary/security/config/AccountWebController.java

@@ -1,4 +1,4 @@
-package stirling.software.proprietary.security.controller.web;
+package stirling.software.proprietary.security.config;
 
 import static stirling.software.common.util.ProviderUtils.validateProvider;
 
@@ -38,11 +38,14 @@ import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.oauth2.GitHubProvider;
 import stirling.software.common.model.oauth2.GoogleProvider;
 import stirling.software.common.model.oauth2.KeycloakProvider;
+import stirling.software.proprietary.model.Team;
 import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.Authority;
 import stirling.software.proprietary.security.model.SessionEntity;
 import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.TeamRepository;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 
 @Controller
@@ -57,16 +60,19 @@ public class AccountWebController {
     // Assuming you have a repository for user operations
     private final UserRepository userRepository;
     private final boolean runningEE;
+    private final TeamRepository teamRepository;
 
     public AccountWebController(
             ApplicationProperties applicationProperties,
             SessionPersistentRegistry sessionPersistentRegistry,
             UserRepository userRepository,
+            TeamRepository teamRepository,
             @Qualifier("runningEE") boolean runningEE) {
         this.applicationProperties = applicationProperties;
         this.sessionPersistentRegistry = sessionPersistentRegistry;
         this.userRepository = userRepository;
         this.runningEE = runningEE;
+        this.teamRepository = teamRepository;
     }
 
     @GetMapping("/login")
@@ -210,7 +216,7 @@ public class AccountWebController {
     @GetMapping("/adminSettings")
     public String showAddUserForm(
             HttpServletRequest request, Model model, Authentication authentication) {
-        List<User> allUsers = userRepository.findAll();
+        List<User> allUsers = userRepository.findAllWithTeam();
         Iterator<User> iterator = allUsers.iterator();
         Map<String, String> roleDetails = Role.getAllRoleDetails();
         // Map to store session information and user activity status
@@ -221,14 +227,27 @@ public class AccountWebController {
         while (iterator.hasNext()) {
             User user = iterator.next();
             if (user != null) {
+                boolean shouldRemove = false;
+                
+                // Check if user is an INTERNAL_API_USER
                 for (Authority authority : user.getAuthorities()) {
                     if (authority.getAuthority().equals(Role.INTERNAL_API_USER.getRoleId())) {
-                        iterator.remove();
+                        shouldRemove = true;
                         roleDetails.remove(Role.INTERNAL_API_USER.getRoleId());
-                        // Break out of the inner loop once the user is removed
                         break;
                     }
                 }
+                
+                // Also check if user is part of the Internal team
+                if (user.getTeam() != null && user.getTeam().getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+                    shouldRemove = true;
+                }
+                
+                // Remove the user if either condition is true
+                if (shouldRemove) {
+                    iterator.remove();
+                    continue;
+                }
                 // Determine the user's session status and last request time
                 int maxInactiveInterval = sessionPersistentRegistry.getMaxInactiveInterval();
                 boolean hasActiveSession = false;
@@ -331,6 +350,13 @@ public class AccountWebController {
         model.addAttribute("activeUsers", activeUsers);
         model.addAttribute("disabledUsers", disabledUsers);
 
+        // Get all teams but filter out the Internal team
+        List<Team> allTeams = teamRepository.findAll()
+                .stream()
+                .filter(team -> !team.getName().equals(stirling.software.proprietary.security.service.TeamService.INTERNAL_TEAM_NAME))
+                .toList();
+        model.addAttribute("teams", allTeams);
+
         model.addAttribute("maxPaidUsers", applicationProperties.getPremium().getMaxUsers());
         return "adminSettings";
     }

proprietary/src/main/java/stirling/software/proprietary/security/config/PremiumEndpoint.java

@@ -0,0 +1,11 @@
+package stirling.software.proprietary.security.config;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/** Annotation to mark endpoints that require a Pro or higher license. */
+@Target({ElementType.METHOD, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface PremiumEndpoint {}

proprietary/src/main/java/stirling/software/proprietary/security/config/PremiumEndpointAspect.java

@@ -0,0 +1,30 @@
+package stirling.software.proprietary.security.config;
+
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ResponseStatusException;
+
+@Aspect
+@Component
+public class PremiumEndpointAspect {
+
+    private final boolean runningProOrHigher;
+
+    public PremiumEndpointAspect(@Qualifier("runningProOrHigher") boolean runningProOrHigher) {
+        this.runningProOrHigher = runningProOrHigher;
+    }
+
+    @Around(
+            "@annotation(stirling.software.proprietary.security.config.PremiumEndpoint) || @within(stirling.software.proprietary.security.config.PremiumEndpoint)")
+    public Object checkPremiumAccess(ProceedingJoinPoint joinPoint) throws Throwable {
+        if (!runningProOrHigher) {
+            throw new ResponseStatusException(
+                    HttpStatus.FORBIDDEN, "This endpoint requires a Pro or higher license");
+        }
+        return joinPoint.proceed();
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java

@@ -9,6 +9,7 @@ import org.springframework.boot.jdbc.DataSourceBuilder;
 import org.springframework.boot.jdbc.DatabaseDriver;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
 import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
 
 import lombok.Getter;
@@ -21,8 +22,12 @@ import stirling.software.common.model.exception.UnsupportedProviderException;
 @Slf4j
 @Getter
 @Configuration
-@EnableJpaRepositories(basePackages = "stirling.software.proprietary.security.database.repository")
-@EntityScan({"stirling.software.proprietary.security.model"})
+@EnableJpaRepositories(
+        basePackages = {
+            "stirling.software.proprietary.security.database.repository",
+            "stirling.software.proprietary.security.repository"
+        })
+@EntityScan({"stirling.software.proprietary.security.model", "stirling.software.proprietary.model"})
 public class DatabaseConfig {
 
     public final String DATASOURCE_DEFAULT_URL;
@@ -55,6 +60,7 @@ public class DatabaseConfig {
      */
     @Bean
     @Qualifier("dataSource")
+    @Primary
     public DataSource dataSource() throws UnsupportedProviderException {
         DataSourceBuilder<?> dataSourceBuilder = DataSourceBuilder.create();
 

proprietary/src/main/java/stirling/software/proprietary/security/configuration/ee/EEAppConfig.java

@@ -2,9 +2,10 @@ package stirling.software.proprietary.security.configuration.ee;
 
 import static stirling.software.proprietary.security.configuration.ee.KeygenLicenseVerifier.License;
 
-import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
+import org.springframework.context.annotation.Profile;
 import org.springframework.core.Ordered;
 import org.springframework.core.annotation.Order;
 
@@ -28,18 +29,23 @@ public class EEAppConfig {
         migrateEnterpriseSettingsToPremium(this.applicationProperties);
     }
 
+    @Profile("security")
     @Bean(name = "runningProOrHigher")
-    @Qualifier("runningProOrHigher")
+    @Primary
     public boolean runningProOrHigher() {
         return licenseKeyChecker.getPremiumLicenseEnabledResult() != License.NORMAL;
     }
 
+    @Profile("security")
     @Bean(name = "license")
+    @Primary
     public String licenseType() {
         return licenseKeyChecker.getPremiumLicenseEnabledResult().name();
     }
 
+    @Profile("security")
     @Bean(name = "runningEE")
+    @Primary
     public boolean runningEnterprise() {
         return licenseKeyChecker.getPremiumLicenseEnabledResult() == License.ENTERPRISE;
     }
@@ -49,7 +55,9 @@ public class EEAppConfig {
         return applicationProperties.getPremium().getProFeatures().isSsoAutoLogin();
     }
 
+    @Profile("security")
     @Bean(name = "GoogleDriveEnabled")
+    @Primary
     public boolean googleDriveEnabled() {
         return runningProOrHigher()
                 && applicationProperties.getPremium().getProFeatures().getGoogleDrive().isEnabled();

proprietary/src/main/java/stirling/software/proprietary/security/controller/api/TeamController.java

@@ -0,0 +1,127 @@
+package stirling.software.proprietary.security.controller.api;
+
+import java.util.Optional;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.servlet.view.RedirectView;
+
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import jakarta.transaction.Transactional;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.config.PremiumEndpoint;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.TeamService;
+
+@Controller
+@RequestMapping("/api/v1/team")
+@Tag(name = "Team", description = "Team Management APIs")
+@Slf4j
+@RequiredArgsConstructor
+@PremiumEndpoint
+public class TeamController {
+
+    private final TeamRepository teamRepository;
+    private final UserRepository userRepository;
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/create")
+    public RedirectView createTeam(@RequestParam("name") String name) {
+        if (teamRepository.existsByNameIgnoreCase(name)) {
+            return new RedirectView("/adminSettings?messageType=teamExists");
+        }
+        Team team = new Team();
+        team.setName(name);
+        teamRepository.save(team);
+        return new RedirectView("/adminSettings?messageType=teamCreated");
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/rename")
+    public RedirectView renameTeam(
+            @RequestParam("teamId") Long teamId, @RequestParam("newName") String newName) {
+        Optional<Team> existing = teamRepository.findById(teamId);
+        if (existing.isEmpty()) {
+            return new RedirectView("/adminSettings?messageType=teamNotFound");
+        }
+        if (teamRepository.existsByNameIgnoreCase(newName)) {
+            return new RedirectView("/adminSettings?messageType=teamNameExists");
+        }
+        Team team = existing.get();
+        
+        // Prevent renaming the Internal team
+        if (team.getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return new RedirectView("/adminSettings?messageType=internalTeamNotAccessible");
+        }
+        
+        team.setName(newName);
+        teamRepository.save(team);
+        return new RedirectView("/adminSettings?messageType=teamRenamed");
+    }
+
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/delete")
+    @Transactional
+    public RedirectView deleteTeam(@RequestParam("teamId") Long teamId) {
+        Optional<Team> teamOpt = teamRepository.findById(teamId);
+        if (teamOpt.isEmpty()) {
+            return new RedirectView("/adminSettings?messageType=teamNotFound");
+        }
+
+        Team team = teamOpt.get();
+        
+        // Prevent deleting the Internal team
+        if (team.getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return new RedirectView("/adminSettings?messageType=internalTeamNotAccessible");
+        }
+        
+        long memberCount = userRepository.countByTeam(team);
+        if (memberCount > 0) {
+            return new RedirectView("/adminSettings?messageType=teamHasUsers");
+        }
+
+        teamRepository.delete(team);
+        return new RedirectView("/adminSettings?messageType=teamDeleted");
+    }
+    
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    @PostMapping("/addUser")
+    @Transactional
+    public RedirectView addUserToTeam(
+            @RequestParam("teamId") Long teamId,
+            @RequestParam("userId") Long userId) {
+        
+        // Find the team
+        Team team = teamRepository.findById(teamId)
+                .orElseThrow(() -> new RuntimeException("Team not found"));
+        
+        // Prevent adding users to the Internal team
+        if (team.getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return new RedirectView("/teams?error=internalTeamNotAccessible");
+        }
+        
+        // Find the user
+        User user = userRepository.findById(userId)
+                .orElseThrow(() -> new RuntimeException("User not found"));
+        
+        // Check if user is in the Internal team - prevent moving them
+        if (user.getTeam() != null && user.getTeam().getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return new RedirectView("/teams/" + teamId + "?error=cannotMoveInternalUsers");
+        }
+        
+        // Assign user to team
+        user.setTeam(team);
+        userRepository.save(user);
+        
+        // Redirect back to team details page
+        return new RedirectView("/teams/" + teamId + "?messageType=userAdded");
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/controller/api/UserController.java

@@ -25,6 +25,7 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import jakarta.transaction.Transactional;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -32,10 +33,14 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.exception.UnsupportedProviderException;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.AuthenticationType;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.model.api.user.UsernameAndPass;
+import stirling.software.proprietary.security.repository.TeamRepository;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 
@@ -50,7 +55,8 @@ public class UserController {
     private final UserService userService;
     private final SessionPersistentRegistry sessionRegistry;
     private final ApplicationProperties applicationProperties;
-
+    private final TeamRepository teamRepository;
+    private final UserRepository userRepository;
     @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
     @PostMapping("/register")
     public String register(@ModelAttribute UsernameAndPass requestModel, Model model)
@@ -60,7 +66,13 @@ public class UserController {
             return "register";
         }
         try {
-            userService.saveUser(requestModel.getUsername(), requestModel.getPassword());
+            Team team = teamRepository.findByName(TeamService.DEFAULT_TEAM_NAME).orElse(null);
+            userService.saveUser(
+                    requestModel.getUsername(),
+                    requestModel.getPassword(),
+                    team,
+                    Role.USER.getRoleId(),
+                    false);
         } catch (IllegalArgumentException e) {
             return "redirect:/login?messageType=invalidUsername";
         }
@@ -200,6 +212,7 @@ public class UserController {
             @RequestParam(name = "username", required = true) String username,
             @RequestParam(name = "password", required = false) String password,
             @RequestParam(name = "role") String role,
+            @RequestParam(name = "teamId", required = false) Long teamId,
             @RequestParam(name = "authType") String authType,
             @RequestParam(name = "forceChange", required = false, defaultValue = "false")
                     boolean forceChange)
@@ -233,13 +246,29 @@ public class UserController {
             // If the role ID is not valid, redirect with an error message
             return new RedirectView("/adminSettings?messageType=invalidRole", true);
         }
+        
+        // Use teamId if provided, otherwise use default team
+        Long effectiveTeamId = teamId;
+        if (effectiveTeamId == null) {
+            Team defaultTeam = teamRepository.findByName(TeamService.DEFAULT_TEAM_NAME).orElse(null);
+            if (defaultTeam != null) {
+                effectiveTeamId = defaultTeam.getId();
+            }
+        } else {
+            // Check if the selected team is Internal - prevent assigning to it
+            Team selectedTeam = teamRepository.findById(effectiveTeamId).orElse(null);
+            if (selectedTeam != null && TeamService.INTERNAL_TEAM_NAME.equals(selectedTeam.getName())) {
+                return new RedirectView("/adminSettings?messageType=internalTeamNotAccessible", true);
+            }
+        }
+        
         if (authType.equalsIgnoreCase(AuthenticationType.SSO.toString())) {
-            userService.saveUser(username, AuthenticationType.SSO, role);
+            userService.saveUser(username, AuthenticationType.SSO, effectiveTeamId, role);
         } else {
             if (password.isBlank()) {
                 return new RedirectView("/adminSettings?messageType=invalidPassword", true);
             }
-            userService.saveUser(username, password, role, forceChange);
+            userService.saveUser(username, password, effectiveTeamId, role, forceChange);
         }
         return new RedirectView(
                 "/adminSettings", // Redirect to account page after adding the user
@@ -248,9 +277,11 @@ public class UserController {
 
     @PreAuthorize("hasRole('ROLE_ADMIN')")
     @PostMapping("/admin/changeRole")
+    @Transactional
     public RedirectView changeRole(
             @RequestParam(name = "username") String username,
             @RequestParam(name = "role") String role,
+            @RequestParam(name = "teamId", required = false) Long teamId,
             Authentication authentication)
             throws SQLException, UnsupportedProviderException {
         Optional<User> userOpt = userService.findByUsernameIgnoreCase(username);
@@ -278,6 +309,26 @@ public class UserController {
             return new RedirectView("/adminSettings?messageType=invalidRole", true);
         }
         User user = userOpt.get();
+        
+        // Update the team if a teamId is provided
+        if (teamId != null) {
+            Team team = teamRepository.findById(teamId).orElse(null);
+            if (team != null) {
+                // Prevent assigning to Internal team
+                if (TeamService.INTERNAL_TEAM_NAME.equals(team.getName())) {
+                    return new RedirectView("/adminSettings?messageType=internalTeamNotAccessible", true);
+                }
+                
+                // Prevent moving users from Internal team
+                if (user.getTeam() != null && TeamService.INTERNAL_TEAM_NAME.equals(user.getTeam().getName())) {
+                    return new RedirectView("/adminSettings?messageType=cannotMoveInternalUsers", true);
+                }
+                
+                user.setTeam(team);
+                userRepository.save(user);
+            }
+        }
+        
         userService.changeRole(user, role);
         return new RedirectView(
                 "/adminSettings", // Redirect to account page after adding the user

proprietary/src/main/java/stirling/software/proprietary/security/controller/web/TeamWebController.java

@@ -0,0 +1,105 @@
+package stirling.software.proprietary.security.controller.web;
+
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.model.dto.TeamWithUserCountDTO;
+import stirling.software.proprietary.security.database.repository.SessionRepository;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.TeamService;
+
+@Controller
+@RequestMapping("/teams")
+@RequiredArgsConstructor
+@Slf4j
+public class TeamWebController {
+
+    private final TeamRepository teamRepository;
+    private final SessionRepository sessionRepository;
+    private final UserRepository userRepository;
+
+    @GetMapping
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    public String listTeams(Model model) {
+        // Get teams with user counts using a DTO projection
+        List<TeamWithUserCountDTO> allTeamsWithCounts = teamRepository.findAllTeamsWithUserCount();
+        
+        // Filter out the Internal team
+        List<TeamWithUserCountDTO> teamsWithCounts = allTeamsWithCounts.stream()
+                .filter(team -> !team.getName().equals(TeamService.INTERNAL_TEAM_NAME))
+                .toList();
+
+        // Get the latest activity for each team
+        List<Object[]> teamActivities = sessionRepository.findLatestActivityByTeam();
+
+        // Convert the query results to a map for easy access in the view
+        Map<Long, Date> teamLastRequest = new HashMap<>();
+        for (Object[] result : teamActivities) {
+            Long teamId = (Long) result[0]; // teamId alias
+            Date lastActivity = (Date) result[1]; // lastActivity alias
+            teamLastRequest.put(teamId, lastActivity);
+        }
+
+        // Add data to the model
+        model.addAttribute("teamsWithCounts", teamsWithCounts);
+        model.addAttribute("teamLastRequest", teamLastRequest);
+        
+        return "accounts/teams";
+    }
+
+    @GetMapping("/{id}")
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
+    public String viewTeamDetails(@PathVariable("id") Long id, Model model) {
+        // Get the team
+        Team team = teamRepository.findById(id)
+                .orElseThrow(() -> new RuntimeException("Team not found"));
+        
+        // Prevent access to Internal team
+        if (team.getName().equals(TeamService.INTERNAL_TEAM_NAME)) {
+            return "redirect:/teams?error=internalTeamNotAccessible";
+        }
+        
+        // Get users for this team directly using the direct query
+        List<User> teamUsers = userRepository.findAllByTeamId(id);
+        
+        // Get all users not in this team for the Add User to Team dropdown
+        // Exclude users that are in the Internal team
+        List<User> allUsers = userRepository.findAllWithTeam();
+        List<User> availableUsers = allUsers.stream()
+                .filter(user -> (user.getTeam() == null || !user.getTeam().getId().equals(id)) && 
+                               (user.getTeam() == null || !user.getTeam().getName().equals(TeamService.INTERNAL_TEAM_NAME)))
+                .toList();
+        
+        // Get the latest session for each user in the team
+        List<Object[]> userSessions = sessionRepository.findLatestSessionByTeamId(id);
+
+        // Create a map of username to last request date
+        Map<String, Date> userLastRequest = new HashMap<>();
+        for (Object[] result : userSessions) {
+            String username = (String) result[0]; // username alias
+            Date lastRequest = (Date) result[1]; // lastRequest alias
+            userLastRequest.put(username, lastRequest);
+        }
+
+        model.addAttribute("team", team);
+        model.addAttribute("teamUsers", teamUsers);
+        model.addAttribute("availableUsers", availableUsers);
+        model.addAttribute("userLastRequest", userLastRequest);
+        return "accounts/team-details";
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/database/repository/SessionRepository.java

@@ -29,4 +29,20 @@ public interface SessionRepository extends JpaRepository<SessionEntity, String>
             @Param("expired") boolean expired,
             @Param("lastRequest") Date lastRequest,
             @Param("principalName") String principalName);
+
+    @Query(
+            "SELECT t.id as teamId, MAX(s.lastRequest) as lastActivity "
+                    + "FROM stirling.software.proprietary.model.Team t "
+                    + "LEFT JOIN t.users u "
+                    + "LEFT JOIN SessionEntity s ON u.username = s.principalName "
+                    + "GROUP BY t.id")
+    List<Object[]> findLatestActivityByTeam();
+
+    @Query(
+            "SELECT u.username as username, MAX(s.lastRequest) as lastRequest "
+                    + "FROM stirling.software.proprietary.security.model.User u "
+                    + "LEFT JOIN SessionEntity s ON u.username = s.principalName "
+                    + "WHERE u.team.id = :teamId "
+                    + "GROUP BY u.username")
+    List<Object[]> findLatestSessionByTeamId(@Param("teamId") Long teamId);
 }

proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java

@@ -8,6 +8,7 @@ import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.query.Param;
 import org.springframework.stereotype.Repository;
 
+import stirling.software.proprietary.model.Team;
 import stirling.software.proprietary.security.model.User;
 
 @Repository
@@ -22,4 +23,17 @@ public interface UserRepository extends JpaRepository<User, Long> {
     Optional<User> findByApiKey(String apiKey);
 
     List<User> findByAuthenticationTypeIgnoreCase(String authenticationType);
+
+    @Query("SELECT u FROM User u WHERE u.team IS NULL")
+    List<User> findAllWithoutTeam();
+
+    @Query(value = "SELECT u FROM User u LEFT JOIN FETCH u.team")
+    List<User> findAllWithTeam();
+    
+    @Query("SELECT u FROM User u JOIN FETCH u.authorities JOIN FETCH u.team WHERE u.team.id = :teamId")
+    List<User> findAllByTeamId(@Param("teamId") Long teamId);
+
+    long countByTeam(Team team);
+
+    List<User> findAllByTeam(Team team);
 }

proprietary/src/main/java/stirling/software/proprietary/security/model/User.java

@@ -16,6 +16,7 @@ import lombok.Setter;
 import lombok.ToString;
 
 import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.model.Team;
 
 @Entity
 @Table(name = "users")
@@ -57,6 +58,10 @@ public class User implements Serializable {
     @OneToMany(fetch = FetchType.EAGER, cascade = CascadeType.ALL, mappedBy = "user")
     private Set<Authority> authorities = new HashSet<>();
 
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "team_id")
+    private Team team;
+
     @ElementCollection
     @MapKeyColumn(name = "setting_key")
     @Lob

proprietary/src/main/java/stirling/software/proprietary/security/repository/TeamRepository.java

@@ -0,0 +1,23 @@
+package stirling.software.proprietary.security.repository;
+
+import java.util.List;
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.model.dto.TeamWithUserCountDTO;
+
+@Repository
+public interface TeamRepository extends JpaRepository<Team, Long> {
+    Optional<Team> findByName(String name);
+
+    @Query("SELECT new stirling.software.proprietary.model.dto.TeamWithUserCountDTO(t.id, t.name, COUNT(u)) " +
+           "FROM Team t LEFT JOIN t.users u GROUP BY t.id, t.name")
+    List<TeamWithUserCountDTO> findAllTeamsWithUserCount();
+
+    boolean existsByNameIgnoreCase(String name);
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/TeamService.java

@@ -0,0 +1,40 @@
+package stirling.software.proprietary.security.service;
+
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.repository.TeamRepository;
+
+@Service
+@RequiredArgsConstructor
+public class TeamService {
+
+    private final TeamRepository teamRepository;
+
+    public static final String DEFAULT_TEAM_NAME = "Default";
+    public static final String INTERNAL_TEAM_NAME = "Internal";
+
+    public Team getOrCreateDefaultTeam() {
+        return teamRepository
+                .findByName(DEFAULT_TEAM_NAME)
+                .orElseGet(
+                        () -> {
+                            Team defaultTeam = new Team();
+                            defaultTeam.setName(DEFAULT_TEAM_NAME);
+                            return teamRepository.save(defaultTeam);
+                        });
+    }
+
+    public Team getOrCreateInternalTeam() {
+        return teamRepository
+                .findByName(INTERNAL_TEAM_NAME)
+                .orElseGet(
+                        () -> {
+                            Team internalTeam = new Team();
+                            internalTeam.setName(INTERNAL_TEAM_NAME);
+                            return teamRepository.save(internalTeam);
+                        });
+    }
+}

proprietary/src/main/java/stirling/software/proprietary/security/service/UserService.java

@@ -8,6 +8,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.UUID;
+import java.util.function.Supplier;
 
 import org.springframework.context.MessageSource;
 import org.springframework.context.i18n.LocaleContextHolder;
@@ -31,11 +32,13 @@ import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.common.service.UserServiceInterface;
+import stirling.software.proprietary.model.Team;
 import stirling.software.proprietary.security.database.repository.AuthorityRepository;
 import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.AuthenticationType;
 import stirling.software.proprietary.security.model.Authority;
 import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.TeamRepository;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 
@@ -45,7 +48,7 @@ import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 public class UserService implements UserServiceInterface {
 
     private final UserRepository userRepository;
-
+    private final TeamRepository teamRepository;
     private final AuthorityRepository authorityRepository;
 
     private final PasswordEncoder passwordEncoder;
@@ -162,7 +165,7 @@ public class UserService implements UserServiceInterface {
 
     public void saveUser(String username, AuthenticationType authenticationType)
             throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        saveUser(username, authenticationType, Role.USER.getRoleId());
+        saveUser(username, authenticationType, (Long) null, Role.USER.getRoleId());
     }
 
     private User saveUser(Optional<User> user, String apiKey) {
@@ -173,71 +176,98 @@ public class UserService implements UserServiceInterface {
         throw new UsernameNotFoundException("User not found");
     }
 
-    public void saveUser(String username, AuthenticationType authenticationType, String role)
+    public User saveUser(
+            String username, AuthenticationType authenticationType, Long teamId, String role)
             throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        if (!isUsernameValid(username)) {
-            throw new IllegalArgumentException(getInvalidUsernameMessage());
-        }
-        User user = new User();
-        user.setUsername(username);
-        user.setEnabled(true);
-        user.setFirstLogin(false);
-        user.addAuthority(new Authority(role, user));
-        user.setAuthenticationType(authenticationType);
-        userRepository.save(user);
-        databaseService.exportDatabase();
+        return saveUserCore(
+                username, // username
+                null, // password
+                authenticationType, // authenticationType
+                teamId, // teamId
+                null, // team
+                role, // role
+                false, // firstLogin
+                true // enabled
+                );
     }
 
-    public void saveUser(String username, String password)
+    public User saveUser(
+            String username, AuthenticationType authenticationType, Team team, String role)
             throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        if (!isUsernameValid(username)) {
-            throw new IllegalArgumentException(getInvalidUsernameMessage());
-        }
-        User user = new User();
-        user.setUsername(username);
-        user.setPassword(passwordEncoder.encode(password));
-        user.setEnabled(true);
-        user.setAuthenticationType(AuthenticationType.WEB);
-        user.addAuthority(new Authority(Role.USER.getRoleId(), user));
-        userRepository.save(user);
-        databaseService.exportDatabase();
+        return saveUserCore(
+                username, // username
+                null, // password
+                authenticationType, // authenticationType
+                null, // teamId
+                team, // team
+                role, // role
+                false, // firstLogin
+                true // enabled
+                );
     }
 
-    public void saveUser(String username, String password, String role, boolean firstLogin)
+    public User saveUser(String username, String password, Long teamId)
             throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        if (!isUsernameValid(username)) {
-            throw new IllegalArgumentException(getInvalidUsernameMessage());
-        }
-        User user = new User();
-        user.setUsername(username);
-        user.setPassword(passwordEncoder.encode(password));
-        user.addAuthority(new Authority(role, user));
-        user.setEnabled(true);
-        user.setAuthenticationType(AuthenticationType.WEB);
-        user.setFirstLogin(firstLogin);
-        userRepository.save(user);
-        databaseService.exportDatabase();
+        return saveUserCore(
+                username, // username
+                password, // password
+                AuthenticationType.WEB, // authenticationType
+                teamId, // teamId
+                null, // team
+                Role.USER.getRoleId(), // role
+                false, // firstLogin
+                true // enabled
+                );
     }
 
-    public void saveUser(String username, String password, String role)
+    public User saveUser(
+            String username, String password, Team team, String role, boolean firstLogin)
             throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        saveUser(username, password, role, false);
+        return saveUserCore(
+                username, // username
+                password, // password
+                AuthenticationType.WEB, // authenticationType
+                null, // teamId
+                team, // team
+                role, // role
+                firstLogin, // firstLogin
+                true // enabled
+                );
     }
 
-    public void saveUser(String username, String password, boolean firstLogin, boolean enabled)
+    public User saveUser(
+            String username, String password, Long teamId, String role, boolean firstLogin)
             throws IllegalArgumentException, SQLException, UnsupportedProviderException {
-        if (!isUsernameValid(username)) {
-            throw new IllegalArgumentException(getInvalidUsernameMessage());
-        }
-        User user = new User();
-        user.setUsername(username);
-        user.setPassword(passwordEncoder.encode(password));
-        user.addAuthority(new Authority(Role.USER.getRoleId(), user));
-        user.setEnabled(enabled);
-        user.setAuthenticationType(AuthenticationType.WEB);
-        user.setFirstLogin(firstLogin);
-        userRepository.save(user);
-        databaseService.exportDatabase();
+        return saveUserCore(
+                username, // username
+                password, // password
+                AuthenticationType.WEB, // authenticationType
+                teamId, // teamId
+                null, // team
+                role, // role
+                firstLogin, // firstLogin
+                true // enabled
+                );
+    }
+
+    public void saveUser(String username, String password, Long teamId, String role)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        saveUser(username, password, teamId, role, false);
+    }
+
+    public void saveUser(
+            String username, String password, Long teamId, boolean firstLogin, boolean enabled)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+        saveUserCore(
+                username, // username
+                password, // password
+                AuthenticationType.WEB, // authenticationType
+                teamId, // teamId
+                null, // team
+                Role.USER.getRoleId(), // role
+                firstLogin, // firstLogin
+                enabled // enabled
+                );
     }
 
     public void deleteUser(String username) {
@@ -345,6 +375,111 @@ public class UserService implements UserServiceInterface {
         return passwordEncoder.matches(currentPassword, user.getPassword());
     }
 
+    /**
+     * Resolves a team based on the provided information, with consistent error handling.
+     *
+     * @param teamId The ID of the team to find, may be null
+     * @param defaultTeamSupplier A supplier that provides a default team when teamId is null
+     * @return The resolved Team object
+     * @throws IllegalArgumentException If the teamId is invalid
+     */
+    private Team resolveTeam(Long teamId, Supplier<Team> defaultTeamSupplier) {
+        if (teamId == null) {
+            return defaultTeamSupplier.get();
+        }
+
+        return teamRepository
+                .findById(teamId)
+                .orElseThrow(() -> new IllegalArgumentException("Invalid team ID: " + teamId));
+    }
+
+    /**
+     * Gets the default team, creating it if it doesn't exist.
+     *
+     * @return The default team
+     */
+    private Team getDefaultTeam() {
+        return teamRepository
+                .findByName("Default")
+                .orElseGet(
+                        () -> {
+                            Team team = new Team();
+                            team.setName("Default");
+                            return teamRepository.save(team);
+                        });
+    }
+
+    /**
+     * Core implementation for saving a user with all possible parameters. This method centralizes
+     * the common logic for all saveUser variants.
+     *
+     * @param username Username for the new user
+     * @param password Password for the user (may be null for SSO/OAuth users)
+     * @param authenticationType Type of authentication (WEB, SSO, etc.)
+     * @param teamId ID of the team to assign (may be null to use default)
+     * @param team Team object to assign (takes precedence over teamId if both provided)
+     * @param role Role to assign to the user
+     * @param firstLogin Whether this is the user's first login
+     * @param enabled Whether the user account is enabled
+     * @return The saved User object
+     * @throws IllegalArgumentException If username is invalid or team is invalid
+     * @throws SQLException If database operation fails
+     * @throws UnsupportedProviderException If provider is not supported
+     */
+    private User saveUserCore(
+            String username,
+            String password,
+            AuthenticationType authenticationType,
+            Long teamId,
+            Team team,
+            String role,
+            boolean firstLogin,
+            boolean enabled)
+            throws IllegalArgumentException, SQLException, UnsupportedProviderException {
+
+        if (!isUsernameValid(username)) {
+            throw new IllegalArgumentException(getInvalidUsernameMessage());
+        }
+
+        User user = new User();
+        user.setUsername(username);
+
+        // Set password if provided
+        if (password != null && !password.isEmpty()) {
+            user.setPassword(passwordEncoder.encode(password));
+        }
+
+        // Set authentication type
+        user.setAuthenticationType(authenticationType);
+
+        // Set enabled status
+        user.setEnabled(enabled);
+
+        // Set first login flag
+        user.setFirstLogin(firstLogin);
+
+        // Set role (authority)
+        if (role == null) {
+            role = Role.USER.getRoleId();
+        }
+        user.addAuthority(new Authority(role, user));
+
+        // Resolve and set team
+        if (team != null) {
+            user.setTeam(team);
+        } else {
+            user.setTeam(resolveTeam(teamId, this::getDefaultTeam));
+        }
+
+        // Save user
+        userRepository.save(user);
+
+        // Export database
+        databaseService.exportDatabase();
+
+        return user;
+    }
+
     public boolean isUsernameValid(String username) {
         // Checks whether the simple username is formatted correctly
         // Regular expression for user name: Min. 3 characters, max. 50 characters
@@ -464,7 +599,6 @@ public class UserService implements UserServiceInterface {
         }
     }
 
-    @Override
     public long getTotalUsersCount() {
         // Count all users in the database
         long userCount = userRepository.count();
@@ -474,4 +608,12 @@ public class UserService implements UserServiceInterface {
         }
         return userCount;
     }
+
+    public List<User> getUsersWithoutTeam() {
+        return userRepository.findAllWithoutTeam();
+    }
+
+    public void saveAll(List<User> users) {
+        userRepository.saveAll(users);
+    }
 }