feat: add URL deep-linking for DataGrids

- Add PageUrlState utility for URL ↔ state serialization
- Add column `id` field for unique column identification in URLs
- Update idSelector to return String for URL compatibility
- All DataGrid pages now support URL params: search, sort, order, id
- Browser URL updates via replaceState (no GoRouter rebuilds)
- Add FilterPanelSemantics for filter panel semantic IDs
- Add TESTING.md documentation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/features/control_room/containers/presentation/pages/containers_list_page.dart

@@ -1,9 +1,13 @@
+import 'dart:async';
+
 import 'package:flutter/material.dart' hide Container;
 import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:go_router/go_router.dart';
 import 'package:tatlock_ui/core/api/api_client.dart';
 import 'package:tatlock_ui/features/control_room/containers/presentation/providers/containers_provider.dart';
 import 'package:tatlock_ui/features/control_room/containers/presentation/widgets/container_logs_viewer.dart';
 import 'package:tatlock_ui/features/control_room/containers/presentation/widgets/container_status_badge.dart';
+import 'package:tatlock_ui/routing/url_state.dart';
 import 'package:tatlock_ui/shared/components/data_grid/adapters/core_api_source.dart';
 import 'package:tatlock_ui/shared/components/data_grid/data_grid_exports.dart';
 
@@ -101,7 +105,10 @@ class ContainerPort {
 
 /// Page displaying the list of containers using DataGrid.
 class ContainersListPage extends ConsumerStatefulWidget {
-  const ContainersListPage({super.key});
+  const ContainersListPage({super.key, this.routerState});
+
+  /// Router state for URL deep-linking.
+  final GoRouterState? routerState;
 
   @override
   ConsumerState<ContainersListPage> createState() => _ContainersListPageState();
@@ -110,10 +117,18 @@ class ContainersListPage extends ConsumerStatefulWidget {
 class _ContainersListPageState extends ConsumerState<ContainersListPage> {
   late final StateNotifierProvider<DataGridController<ContainerData>,
       DataGridState<ContainerData>> _gridProvider;
+  late PageUrlState _urlState;
+  Timer? _urlSyncTimer;
 
   @override
   void initState() {
     super.initState();
+
+    // Parse URL state
+    _urlState = PageUrlState.fromQueryParams(
+      widget.routerState?.uri.queryParameters ?? {},
+    );
+
     final dio = ref.read(coreApiClientProvider);
     final source = CoreApiDataSource<ContainerData>(
       dio: dio,
@@ -121,17 +136,68 @@ class _ContainersListPageState extends ConsumerState<ContainersListPage> {
       fromJson: ContainerData.fromJson,
     );
 
+    // Initialize grid with URL state
     _gridProvider = dataGridProvider<ContainerData>(
       source: source,
       config: _buildConfig(),
       idSelector: (c) => c.id,
+      initialSearch: _urlState.search,
+      initialSortColumnIndex: _columnIndexForId(_urlState.sortColumn),
+      initialSortDescending: _urlState.sortDescending,
     );
   }
 
+  @override
+  void dispose() {
+    _urlSyncTimer?.cancel();
+    super.dispose();
+  }
+
+  /// Find column index by column ID.
+  int? _columnIndexForId(String? columnId) {
+    if (columnId == null) return null;
+    final columns = _buildConfig().columns;
+    for (var i = 0; i < columns.length; i++) {
+      if (columns[i].id == columnId) return i;
+    }
+    return null;
+  }
+
+  /// Get column ID by index.
+  String? _columnIdForIndex(int index) {
+    final columns = _buildConfig().columns;
+    if (index >= 0 && index < columns.length) {
+      return columns[index].id;
+    }
+    return null;
+  }
+
+  /// Schedule URL sync with debounce.
+  void _scheduleUrlSync() {
+    _urlSyncTimer?.cancel();
+    _urlSyncTimer = Timer(const Duration(milliseconds: 500), _syncUrlParams);
+  }
+
+  /// Sync current state to URL.
+  void _syncUrlParams() {
+    final state = ref.read(_gridProvider);
+
+    final params = PageUrlState(
+      search: state.searchQuery.isEmpty ? null : state.searchQuery,
+      sortColumn: state.sortColumnIndex != null
+          ? _columnIdForIndex(state.sortColumnIndex!)
+          : null,
+      sortDescending: state.sortDescending,
+    ).toQueryParams();
+
+    updateBrowserUrlParams(params);
+  }
+
   DataGridConfig<ContainerData> _buildConfig() {
     return DataGridConfig<ContainerData>(
       columns: [
         DataGridColumn<ContainerData>(
+          id: 'container',
           header: 'Container',
           valueBuilder: (c) => '${c.name} ${c.image}',
           sortable: true,
@@ -140,12 +206,14 @@ class _ContainersListPageState extends ConsumerState<ContainersListPage> {
           cellBuilder: (context, c) => _ContainerCell(container: c),
         ),
         DataGridColumn<ContainerData>(
+          id: 'ports',
           header: 'Ports',
           valueBuilder: (c) => c.ports.map((p) => p.formatted).join(', '),
           width: const DataGridColumnWidth.flex(1),
           cellBuilder: (context, c) => _PortsCell(ports: c.ports),
         ),
         DataGridColumn<ContainerData>(
+          id: 'status',
           header: 'Status',
           valueBuilder: (c) => c.displayStatus,
           width: const DataGridColumnWidth.fixed(160),
@@ -211,6 +279,15 @@ class _ContainersListPageState extends ConsumerState<ContainersListPage> {
   Widget build(BuildContext context) {
     final colorScheme = Theme.of(context).colorScheme;
 
+    // Listen for grid state changes to sync URL
+    ref.listen(_gridProvider, (previous, next) {
+      if (previous?.searchQuery != next.searchQuery ||
+          previous?.sortColumnIndex != next.sortColumnIndex ||
+          previous?.sortDescending != next.sortDescending) {
+        _scheduleUrlSync();
+      }
+    });
+
     // Listen for container action results to show snackbars
     ref.listen<AsyncValue<void>>(containerActionsProvider, (previous, next) {
       if (previous?.isLoading == true && !next.isLoading) {

lib/features/control_room/npm/presentation/pages/proxy_hosts_page.dart

@@ -1,8 +1,12 @@
+import 'dart:async';
+
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:go_router/go_router.dart';
 import 'package:tatlock_ui/core/api/api_client.dart';
 import 'package:tatlock_ui/features/control_room/npm/presentation/pages/proxy_host_page.dart';
 import 'package:tatlock_ui/features/control_room/npm/presentation/providers/proxy_hosts_provider.dart';
+import 'package:tatlock_ui/routing/url_state.dart';
 import 'package:tatlock_ui/shared/components/data_grid/adapters/core_api_source.dart';
 import 'package:tatlock_ui/shared/components/data_grid/data_grid_exports.dart';
 
@@ -33,7 +37,10 @@ class DomainData {
 
 /// Page displaying the list of proxy hosts (domains) from NPM.
 class ProxyHostsPage extends ConsumerStatefulWidget {
-  const ProxyHostsPage({super.key});
+  const ProxyHostsPage({super.key, this.routerState});
+
+  /// Router state for URL deep-linking.
+  final GoRouterState? routerState;
 
   @override
   ConsumerState<ProxyHostsPage> createState() => _ProxyHostsPageState();
@@ -42,10 +49,18 @@ class ProxyHostsPage extends ConsumerStatefulWidget {
 class _ProxyHostsPageState extends ConsumerState<ProxyHostsPage> {
   late final StateNotifierProvider<DataGridController<DomainData>,
       DataGridState<DomainData>> _gridProvider;
+  late PageUrlState _urlState;
+  Timer? _urlSyncTimer;
 
   @override
   void initState() {
     super.initState();
+
+    // Parse URL state
+    _urlState = PageUrlState.fromQueryParams(
+      widget.routerState?.uri.queryParameters ?? {},
+    );
+
     final dio = ref.read(coreApiClientProvider);
     final source = CoreApiDataSource<DomainData>(
       dio: dio,
@@ -53,17 +68,80 @@ class _ProxyHostsPageState extends ConsumerState<ProxyHostsPage> {
       fromJson: DomainData.fromJson,
     );
 
+    // Initialize grid with URL state
     _gridProvider = dataGridProvider<DomainData>(
       source: source,
       config: _buildConfig(),
       idSelector: (d) => d.proxyHostId.toString(),
+      initialSearch: _urlState.search,
+      initialSortColumnIndex: _columnIndexForId(_urlState.sortColumn),
+      initialSortDescending: _urlState.sortDescending,
     );
+
+    // Open document from URL if id present
+    if (_urlState.id != null) {
+      final id = int.tryParse(_urlState.id!);
+      if (id != null) {
+        WidgetsBinding.instance.addPostFrameCallback((_) {
+          ref.read(selectedProxyHostProvider.notifier).select(id);
+        });
+      }
+    }
+  }
+
+  @override
+  void dispose() {
+    _urlSyncTimer?.cancel();
+    super.dispose();
+  }
+
+  /// Find column index by column ID.
+  int? _columnIndexForId(String? columnId) {
+    if (columnId == null) return null;
+    final columns = _buildConfig().columns;
+    for (var i = 0; i < columns.length; i++) {
+      if (columns[i].id == columnId) return i;
+    }
+    return null;
+  }
+
+  /// Get column ID by index.
+  String? _columnIdForIndex(int index) {
+    final columns = _buildConfig().columns;
+    if (index >= 0 && index < columns.length) {
+      return columns[index].id;
+    }
+    return null;
+  }
+
+  /// Schedule URL sync with debounce.
+  void _scheduleUrlSync() {
+    _urlSyncTimer?.cancel();
+    _urlSyncTimer = Timer(const Duration(milliseconds: 500), _syncUrlParams);
+  }
+
+  /// Sync current state to URL.
+  void _syncUrlParams() {
+    final state = ref.read(_gridProvider);
+    final selectedId = ref.read(selectedProxyHostProvider);
+
+    final params = PageUrlState(
+      id: selectedId?.toString(),
+      search: state.searchQuery.isEmpty ? null : state.searchQuery,
+      sortColumn: state.sortColumnIndex != null
+          ? _columnIdForIndex(state.sortColumnIndex!)
+          : null,
+      sortDescending: state.sortDescending,
+    ).toQueryParams();
+
+    updateBrowserUrlParams(params);
   }
 
   DataGridConfig<DomainData> _buildConfig() {
     return DataGridConfig<DomainData>(
       columns: [
         DataGridColumn<DomainData>(
+          id: 'domain',
           header: 'Domain',
           valueBuilder: (d) => d.domain,
           sortable: true,
@@ -72,12 +150,14 @@ class _ProxyHostsPageState extends ConsumerState<ProxyHostsPage> {
           cellBuilder: (context, d) => _DomainCell(domain: d),
         ),
         DataGridColumn<DomainData>(
+          id: 'service',
           header: 'Service',
           valueBuilder: (d) => d.service,
           width: const DataGridColumnWidth.flex(1),
           cellBuilder: (context, d) => _ServiceCell(service: d.service),
         ),
         DataGridColumn<DomainData>(
+          id: 'ssl',
           header: 'SSL',
           valueBuilder: (d) => d.sslEnabled ? 'Enabled' : 'Disabled',
           width: const DataGridColumnWidth.fixed(100),
@@ -101,6 +181,8 @@ class _ProxyHostsPageState extends ConsumerState<ProxyHostsPage> {
 
   void _viewDomain(DomainData domain) {
     ref.read(selectedProxyHostProvider.notifier).select(domain.proxyHostId);
+    // Navigate with id to enable back button
+    context.go('/control-room/proxy-hosts?id=${domain.proxyHostId}');
   }
 
   void _createNew() {
@@ -112,6 +194,15 @@ class _ProxyHostsPageState extends ConsumerState<ProxyHostsPage> {
     final selectedId = ref.watch(selectedProxyHostProvider);
     final isCreating = ref.watch(creatingProxyHostProvider);
 
+    // Listen for grid state changes to sync URL
+    ref.listen(_gridProvider, (previous, next) {
+      if (previous?.searchQuery != next.searchQuery ||
+          previous?.sortColumnIndex != next.sortColumnIndex ||
+          previous?.sortDescending != next.sortDescending) {
+        _scheduleUrlSync();
+      }
+    });
+
     // Show create page if creating new
     if (isCreating) {
       return ProxyHostPage.create(
@@ -128,6 +219,8 @@ class _ProxyHostsPageState extends ConsumerState<ProxyHostsPage> {
         proxyHostId: selectedId,
         onClose: () {
           ref.read(selectedProxyHostProvider.notifier).clear();
+          // Clear id from URL
+          context.go('/control-room/proxy-hosts');
           ref.read(_gridProvider.notifier).refresh();
         },
       );

lib/features/control_room/presentation/pages/control_room_page.dart

@@ -17,11 +17,15 @@ class ControlRoomPage extends ConsumerWidget {
   const ControlRoomPage({
     super.key,
     this.nav = ControlRoomNav.containers,
+    this.routerState,
   });
 
   /// The current nav item to display.
   final ControlRoomNav nav;
 
+  /// Router state for URL deep-linking (query params).
+  final GoRouterState? routerState;
+
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final colorScheme = Theme.of(context).colorScheme;
@@ -53,7 +57,7 @@ class ControlRoomPage extends ConsumerWidget {
           ),
           // Section content
           Expanded(
-            child: _SectionContent(nav: nav),
+            child: _SectionContent(nav: nav, routerState: routerState),
           ),
         ],
       ),
@@ -63,15 +67,16 @@ class ControlRoomPage extends ConsumerWidget {
 
 /// Renders content for the selected nav item.
 class _SectionContent extends ConsumerWidget {
-  const _SectionContent({required this.nav});
+  const _SectionContent({required this.nav, this.routerState});
 
   final ControlRoomNav nav;
+  final GoRouterState? routerState;
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     return switch (nav) {
-      ControlRoomNav.containers => const _ContainersSection(),
-      ControlRoomNav.proxyHosts => const ProxyHostsPage(),
+      ControlRoomNav.containers => _ContainersSection(routerState: routerState),
+      ControlRoomNav.proxyHosts => ProxyHostsPage(routerState: routerState),
       _ => _PlaceholderSection(nav: nav),
     };
   }
@@ -119,7 +124,9 @@ class _PlaceholderSection extends StatelessWidget {
 
 /// Containers section with optional stack filter.
 class _ContainersSection extends ConsumerWidget {
-  const _ContainersSection();
+  const _ContainersSection({this.routerState});
+
+  final GoRouterState? routerState;
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
@@ -129,7 +136,7 @@ class _ContainersSection extends ConsumerWidget {
     return Row(
       children: [
         // Stacks filter panel
-        const _StacksFilterPanel(),
+        _StacksFilterPanel(routerState: routerState),
         // Divider
         VerticalDivider(
           width: 1,
@@ -139,7 +146,7 @@ class _ContainersSection extends ConsumerWidget {
         // Main content - containers list or stack detail
         Expanded(
           child: selectedStack == null
-              ? const ContainersListPage()
+              ? ContainersListPage(routerState: routerState)
               : StackDetailPage(stackId: selectedStack),
         ),
       ],
@@ -149,7 +156,9 @@ class _ContainersSection extends ConsumerWidget {
 
 /// Stacks filter panel for Containers section (includes "All Containers" option).
 class _StacksFilterPanel extends ConsumerWidget {
-  const _StacksFilterPanel();
+  const _StacksFilterPanel({this.routerState});
+
+  final GoRouterState? routerState;
 
   @override
   Widget build(BuildContext context, WidgetRef ref) {
@@ -207,6 +216,7 @@ class _StacksFilterPanel extends ConsumerWidget {
               data: (stacks) => _StacksList(
                 stacks: stacks,
                 selectedStackId: selectedStack,
+                routerState: routerState,
                 onStackSelected: (id) =>
                     ref.read(selectedStackProvider.notifier).select(id),
                 onStackAction: (id, action) =>
@@ -281,12 +291,14 @@ class _StacksList extends StatefulWidget {
     required this.selectedStackId,
     required this.onStackSelected,
     required this.onStackAction,
+    this.routerState,
   });
 
   final List<Stack> stacks;
   final String? selectedStackId;
   final void Function(String) onStackSelected;
   final void Function(String, String) onStackAction;
+  final GoRouterState? routerState;
 
   @override
   State<_StacksList> createState() => _StacksListState();

lib/features/control_room/router.dart

@@ -63,8 +63,11 @@ List<RouteBase> controlRoomRoutes() {
       GoRoute(
         path: nav.path,
         name: 'controlRoom${_capitalize(nav.id.replaceAll('-', '_'))}',
-        pageBuilder: (context, state) =>
-            noTransitionPage(context, state, ControlRoomPage(nav: nav)),
+        pageBuilder: (context, state) => noTransitionPage(
+          context,
+          state,
+          ControlRoomPage(nav: nav, routerState: state),
+        ),
       ),
   ];
 }

lib/features/security/groups/groups_list_page.dart

@@ -1,6 +1,10 @@
+import 'dart:async';
+
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:go_router/go_router.dart';
 import 'package:tatlock_ui/core/api/api_client.dart';
+import 'package:tatlock_ui/routing/url_state.dart';
 import 'package:tatlock_ui/shared/components/data_grid/adapters/core_api_source.dart';
 import 'package:tatlock_ui/shared/components/data_grid/data_grid_exports.dart';
 
@@ -31,7 +35,10 @@ class GroupData {
 
 /// Groups list page using the shared DataGrid component.
 class GroupsListPage extends ConsumerStatefulWidget {
-  const GroupsListPage({super.key});
+  const GroupsListPage({super.key, this.routerState});
+
+  /// Router state for URL deep-linking.
+  final GoRouterState? routerState;
 
   @override
   ConsumerState<GroupsListPage> createState() => _GroupsListPageState();
@@ -40,11 +47,19 @@ class GroupsListPage extends ConsumerStatefulWidget {
 class _GroupsListPageState extends ConsumerState<GroupsListPage> {
   late final StateNotifierProvider<DataGridController<GroupData>,
       DataGridState<GroupData>> _gridProvider;
+  late PageUrlState _urlState;
+  Timer? _urlSyncTimer;
   bool _isSyncing = false;
 
   @override
   void initState() {
     super.initState();
+
+    // Parse URL state
+    _urlState = PageUrlState.fromQueryParams(
+      widget.routerState?.uri.queryParameters ?? {},
+    );
+
     // Create provider in initState to ensure stable reference
     final dio = ref.read(coreApiClientProvider);
     final source = CoreApiDataSource<GroupData>(
@@ -53,13 +68,63 @@ class _GroupsListPageState extends ConsumerState<GroupsListPage> {
       fromJson: GroupData.fromJson,
     );
 
+    // Initialize grid with URL state
     _gridProvider = dataGridProvider<GroupData>(
       source: source,
       config: _buildConfig(),
       idSelector: (g) => g.id,
+      initialSearch: _urlState.search,
+      initialSortColumnIndex: _columnIndexForId(_urlState.sortColumn),
+      initialSortDescending: _urlState.sortDescending,
     );
   }
 
+  @override
+  void dispose() {
+    _urlSyncTimer?.cancel();
+    super.dispose();
+  }
+
+  /// Find column index by column ID.
+  int? _columnIndexForId(String? columnId) {
+    if (columnId == null) return null;
+    final columns = _buildConfig().columns;
+    for (var i = 0; i < columns.length; i++) {
+      if (columns[i].id == columnId) return i;
+    }
+    return null;
+  }
+
+  /// Get column ID by index.
+  String? _columnIdForIndex(int index) {
+    final columns = _buildConfig().columns;
+    if (index >= 0 && index < columns.length) {
+      return columns[index].id;
+    }
+    return null;
+  }
+
+  /// Schedule URL sync with debounce.
+  void _scheduleUrlSync() {
+    _urlSyncTimer?.cancel();
+    _urlSyncTimer = Timer(const Duration(milliseconds: 500), _syncUrlParams);
+  }
+
+  /// Sync current state to URL.
+  void _syncUrlParams() {
+    final state = ref.read(_gridProvider);
+
+    final params = PageUrlState(
+      search: state.searchQuery.isEmpty ? null : state.searchQuery,
+      sortColumn: state.sortColumnIndex != null
+          ? _columnIdForIndex(state.sortColumnIndex!)
+          : null,
+      sortDescending: state.sortDescending,
+    ).toQueryParams();
+
+    updateBrowserUrlParams(params);
+  }
+
   Future<void> _syncFromAuthentik() async {
     if (_isSyncing) return;
     setState(() => _isSyncing = true);
@@ -96,6 +161,7 @@ class _GroupsListPageState extends ConsumerState<GroupsListPage> {
     return DataGridConfig<GroupData>(
       columns: [
         DataGridColumn<GroupData>(
+          id: 'name',
           header: 'Name',
           valueBuilder: (g) => g.name,
           sortable: true,
@@ -103,18 +169,21 @@ class _GroupsListPageState extends ConsumerState<GroupsListPage> {
           width: const DataGridColumnWidth.flex(2),
         ),
         DataGridColumn<GroupData>(
+          id: 'members',
           header: 'Members',
           valueBuilder: (g) => g.memberCount.toString(),
           width: const DataGridColumnWidth.fixed(100),
           alignment: DataGridColumnAlignment.end,
         ),
         DataGridColumn<GroupData>(
+          id: 'type',
           header: 'Type',
           valueBuilder: (g) => g.isSuperuser ? 'Superuser' : 'Standard',
           cellBuilder: (context, g) => _GroupTypeBadge(isSuperuser: g.isSuperuser),
           width: const DataGridColumnWidth.fixed(120),
         ),
         DataGridColumn<GroupData>(
+          id: 'parent',
           header: 'Parent',
           valueBuilder: (g) => g.parentName ?? '-',
           width: const DataGridColumnWidth.flex(1),
@@ -129,6 +198,15 @@ class _GroupsListPageState extends ConsumerState<GroupsListPage> {
 
   @override
   Widget build(BuildContext context) {
+    // Listen for grid state changes to sync URL
+    ref.listen(_gridProvider, (previous, next) {
+      if (previous?.searchQuery != next.searchQuery ||
+          previous?.sortColumnIndex != next.sortColumnIndex ||
+          previous?.sortDescending != next.sortDescending) {
+        _scheduleUrlSync();
+      }
+    });
+
     return DataGrid<GroupData>(
       provider: _gridProvider,
       config: _buildConfig(),

lib/features/security/presentation/pages/security_page.dart

@@ -11,11 +11,15 @@ class SecurityPage extends ConsumerWidget {
   const SecurityPage({
     super.key,
     this.nav = SecurityNav.users,
+    this.routerState,
   });
 
   /// The current nav item to display.
   final SecurityNav nav;
 
+  /// Router state for URL deep-linking (query params).
+  final GoRouterState? routerState;
+
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final colorScheme = Theme.of(context).colorScheme;
@@ -45,7 +49,7 @@ class SecurityPage extends ConsumerWidget {
           ),
           // Section content
           Expanded(
-            child: _SectionContent(nav: nav),
+            child: _SectionContent(nav: nav, routerState: routerState),
           ),
         ],
       ),
@@ -55,17 +59,18 @@ class SecurityPage extends ConsumerWidget {
 
 /// Renders content for the selected nav item.
 class _SectionContent extends StatelessWidget {
-  const _SectionContent({required this.nav});
+  const _SectionContent({required this.nav, this.routerState});
 
   final SecurityNav nav;
+  final GoRouterState? routerState;
 
   @override
   Widget build(BuildContext context) {
     switch (nav) {
       case SecurityNav.users:
-        return const UsersListPage();
+        return UsersListPage(routerState: routerState);
       case SecurityNav.groups:
-        return const GroupsListPage();
+        return GroupsListPage(routerState: routerState);
       default:
         return _PlaceholderSection(nav: nav);
     }

lib/features/security/router.dart

@@ -61,8 +61,11 @@ List<RouteBase> securityRoutes() {
       GoRoute(
         path: nav.path,
         name: 'security${_capitalize(nav.id.replaceAll('-', '_'))}',
-        pageBuilder: (context, state) =>
-            noTransitionPage(context, state, SecurityPage(nav: nav)),
+        pageBuilder: (context, state) => noTransitionPage(
+          context,
+          state,
+          SecurityPage(nav: nav, routerState: state),
+        ),
       ),
   ];
 }

lib/features/security/users/users_list_page.dart

@@ -1,6 +1,10 @@
+import 'dart:async';
+
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:go_router/go_router.dart';
 import 'package:tatlock_ui/core/api/api_client.dart';
+import 'package:tatlock_ui/routing/url_state.dart';
 import 'package:tatlock_ui/shared/components/data_grid/adapters/core_api_source.dart';
 import 'package:tatlock_ui/shared/components/data_grid/data_grid_exports.dart';
 
@@ -61,7 +65,10 @@ class UserData {
 
 /// Users list page using the shared DataGrid component.
 class UsersListPage extends ConsumerStatefulWidget {
-  const UsersListPage({super.key});
+  const UsersListPage({super.key, this.routerState});
+
+  /// Router state for URL deep-linking.
+  final GoRouterState? routerState;
 
   @override
   ConsumerState<UsersListPage> createState() => _UsersListPageState();
@@ -70,11 +77,19 @@ class UsersListPage extends ConsumerStatefulWidget {
 class _UsersListPageState extends ConsumerState<UsersListPage> {
   late final StateNotifierProvider<DataGridController<UserData>,
       DataGridState<UserData>> _gridProvider;
+  late PageUrlState _urlState;
+  Timer? _urlSyncTimer;
   bool _isSyncing = false;
 
   @override
   void initState() {
     super.initState();
+
+    // Parse URL state
+    _urlState = PageUrlState.fromQueryParams(
+      widget.routerState?.uri.queryParameters ?? {},
+    );
+
     final dio = ref.read(coreApiClientProvider);
     final source = CoreApiDataSource<UserData>(
       dio: dio,
@@ -82,13 +97,63 @@ class _UsersListPageState extends ConsumerState<UsersListPage> {
       fromJson: UserData.fromJson,
     );
 
+    // Initialize grid with URL state
     _gridProvider = dataGridProvider<UserData>(
       source: source,
       config: _buildConfig(),
       idSelector: (u) => u.id,
+      initialSearch: _urlState.search,
+      initialSortColumnIndex: _columnIndexForId(_urlState.sortColumn),
+      initialSortDescending: _urlState.sortDescending,
     );
   }
 
+  @override
+  void dispose() {
+    _urlSyncTimer?.cancel();
+    super.dispose();
+  }
+
+  /// Find column index by column ID.
+  int? _columnIndexForId(String? columnId) {
+    if (columnId == null) return null;
+    final columns = _buildConfig().columns;
+    for (var i = 0; i < columns.length; i++) {
+      if (columns[i].id == columnId) return i;
+    }
+    return null;
+  }
+
+  /// Get column ID by index.
+  String? _columnIdForIndex(int index) {
+    final columns = _buildConfig().columns;
+    if (index >= 0 && index < columns.length) {
+      return columns[index].id;
+    }
+    return null;
+  }
+
+  /// Schedule URL sync with debounce.
+  void _scheduleUrlSync() {
+    _urlSyncTimer?.cancel();
+    _urlSyncTimer = Timer(const Duration(milliseconds: 500), _syncUrlParams);
+  }
+
+  /// Sync current state to URL.
+  void _syncUrlParams() {
+    final state = ref.read(_gridProvider);
+
+    final params = PageUrlState(
+      search: state.searchQuery.isEmpty ? null : state.searchQuery,
+      sortColumn: state.sortColumnIndex != null
+          ? _columnIdForIndex(state.sortColumnIndex!)
+          : null,
+      sortDescending: state.sortDescending,
+    ).toQueryParams();
+
+    updateBrowserUrlParams(params);
+  }
+
   Future<void> _syncFromAuthentik() async {
     if (_isSyncing) return;
     setState(() => _isSyncing = true);
@@ -125,6 +190,7 @@ class _UsersListPageState extends ConsumerState<UsersListPage> {
     return DataGridConfig<UserData>(
       columns: [
         DataGridColumn<UserData>(
+          id: 'user',
           header: 'User',
           valueBuilder: (u) => u.name,
           sortable: true,
@@ -133,12 +199,14 @@ class _UsersListPageState extends ConsumerState<UsersListPage> {
           cellBuilder: (context, u) => _UserCell(user: u),
         ),
         DataGridColumn<UserData>(
+          id: 'roles',
           header: 'Roles',
           valueBuilder: (u) => u.roles.join(', '),
           width: const DataGridColumnWidth.flex(1),
           cellBuilder: (context, u) => _RolesCell(roles: u.roles),
         ),
         DataGridColumn<UserData>(
+          id: 'lastLogin',
           header: 'Last Login',
           valueBuilder: (u) => u.lastLoginFormatted,
           width: const DataGridColumnWidth.fixed(120),
@@ -154,6 +222,15 @@ class _UsersListPageState extends ConsumerState<UsersListPage> {
 
   @override
   Widget build(BuildContext context) {
+    // Listen for grid state changes to sync URL
+    ref.listen(_gridProvider, (previous, next) {
+      if (previous?.searchQuery != next.searchQuery ||
+          previous?.sortColumnIndex != next.sortColumnIndex ||
+          previous?.sortDescending != next.sortDescending) {
+        _scheduleUrlSync();
+      }
+    });
+
     return DataGrid<UserData>(
       provider: _gridProvider,
       config: _buildConfig(),