feat(admin): surface the sign-ups that are stuck outside, and let an admin finish letting them in (E9.5 S5)

Approve an address BEFORE the person registers and their sign-up produces no queue row at all — `_decide` only takes a still-pending invite — so the Access-requests screen sat empty, the tab badge read zero, and the only working move was re-typing the address into the whitelist box. Nobody would guess that, and on 2026-09-03 nobody did. This is roadmap UX-25, where two earlier attempts were reverted after review. Both moved AUTHORITY: auto-activating on registration turns a standing whitelist entry into a bearer grant for whoever registers the address first, and reopening the approved invite to `pending` lets an anonymous sign-up REVOKE a standing approval. What was actually missing was visibility, so this changes nothing about what an unauthenticated caller can cause — the admin could already do exactly this by re-entering the address; they just had no way to know they had to. The section lists every account that cannot sign in yet and says WHICH gate is shut, because the two dead ends look the same from the admin's chair: waiting for activation, or waiting on a confirmation mail. Naming the unconfirmed ones is not decoration — on a no-SMTP instance that is the difference between the owner and whoever registered the address first (SEC-15), and an admin about to let someone in should see it. A person the queue above already covers is deliberately NOT listed here; two buttons for one person is worse than one. Activate is gated on `is_allowed` — the same function the sign-in paths consult, in core, so the button that appears and the badge that counts cannot disagree. Without that gate it would manufacture an inconsistent account: password sign-in only checks `is_active` and would let them in, while their Google sign-in would be turned away and silently reopened as a fresh access request. Letting in someone with no approved invite stays the whitelist box's job, which says so out loud. The badge counts activations SEPARATELY from pending invites rather than widening an existing field's meaning, and only counts what genuinely waits on the admin: an unconfirmed account waits on its owner, so it is listed with a re-send but does not nag. The admin-side resend says plainly what happened, including refusing when the instance has no working SMTP — mail is fail-soft everywhere else, and that silence is exactly what left the 0.78.5 sign-ups with nothing to fall back on. `send_verification_link` is now one function with three callers (registration, the public resend, this one), so the link's shape and TTL cannot drift by who triggered it. UAT on localdev, both languages: the UX-25 shape reproduced end to end (approve the address, then register), the badge counting it, Activate letting them in and dropping the badge, the row losing its Activate but keeping the re-send, a fresh token issued by the re-send, and both actions in the audit log. Test data removed.
2026-09-04 03:27:48 +02:00
parent b1086e05dc
commit 7acdf5d577
17 changed files with 846 additions and 16 deletions
@@ -247,7 +247,10 @@ export default function App() {
    // Keep a single, current nudge: drop any prior one (persisted copies reload as dismissed
    // history, so they'd otherwise pile up one-per-reload) before re-issuing the live notice.
    removeByMetaKind("access-requests");
-    const pending = meQuery.data.pending_invites ?? 0;
+    // Both kinds of "someone is waiting on you": a request needing a decision, and a sign-up whose
+    // address was approved before they registered. The second used to produce NO signal at all —
+    // nothing lands in the queue for it — which is how the 2026-09-03 registrant went unnoticed.
+    const pending = (meQuery.data.pending_invites ?? 0) + (meQuery.data.pending_activations ?? 0);
    if (pending > 0) {
      notify({
        level: "warning",
@@ -266,7 +269,7 @@ export default function App() {
      });
    }
    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [meQuery.data?.role, meQuery.data?.pending_invites]);
+  }, [meQuery.data?.role, meQuery.data?.pending_invites, meQuery.data?.pending_activations]);

  // Language is edited outside the Settings page (sidebar/login), so it stays instant.
  function changeLanguage(code: LangCode) {
@@ -2,8 +2,26 @@ import { useState } from "react";
 import { qk } from "../lib/queryKeys";
 import { useTranslation } from "react-i18next";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { Ban, Check, RotateCcw, Shield, Trash2, UserPlus, X } from "lucide-react";
-import { api, HttpError, type AdminUserRow, type Invite, type Me } from "../lib/api";
+import {
+  Ban,
+  Check,
+  Clock,
+  MailWarning,
+  RotateCcw,
+  Send,
+  Shield,
+  Trash2,
+  UserPlus,
+  X,
+} from "lucide-react";
+import {
+  api,
+  HttpError,
+  type AdminUserRow,
+  type Invite,
+  type Me,
+  type PendingAccessRow,
+} from "../lib/api";
 import { notify } from "../lib/notifications";
 import { ADMIN_USERS_TAB_KEY } from "../lib/adminUsersTab";
 import Tooltip from "./Tooltip";
@@ -27,7 +45,14 @@ export default function AdminUsers() {
  const [tab, setTab] = usePersistedTab(ADMIN_USERS_TAB_KEY, "roles");
  const tabs = [
    { id: "roles", label: t("users.tabs.roles") },
-    { id: "access", label: t("users.tabs.access"), badge: me.pending_invites },
+    // Both kinds of "waiting on the admin": a request needing a decision, and a sign-up whose
+    // address was approved BEFORE they registered — the second never reaches the invite queue,
+    // so the badge used to read zero while somebody sat locked out (roadmap UX-25).
+    {
+      id: "access",
+      label: t("users.tabs.access"),
+      badge: me.pending_invites + me.pending_activations,
+    },
    { id: "demo", label: t("users.tabs.demo") },
  ];
  const active = tabs.some((x) => x.id === tab) ? tab : "roles";
@@ -41,7 +66,12 @@ export default function AdminUsers() {
      </PageToolbar>
      <div className="px-4 pb-4 pt-3 max-w-3xl w-full mx-auto">
        {active === "roles" && <UsersRoles me={me} />}
-        {active === "access" && <AdminInvites />}
+        {active === "access" && (
+          <>
+            <AdminInvites />
+            <PendingAccess />
+          </>
+        )}
        {active === "demo" && <AdminDemo />}
      </div>
    </>
@@ -261,6 +291,166 @@ function UsersRoles({ me }: { me: Me }) {
  );
 }

+// --- Sign-ups that are still outside (roadmap UX-25) --------------------------------------------
+//
+// The gap this closes: approve an address BEFORE the person registers and their sign-up produces no
+// queue row at all — `_decide` only takes a pending invite — so the Access-requests screen above was
+// empty while they sat locked out. The only working move was re-typing the address into the
+// whitelist box, which nobody would guess. This section makes the state visible and the fix one
+// click, WITHOUT changing who may cause what: the button is admin-authenticated and explicit. Two
+// earlier attempts moved authority instead (auto-activating on registration, reopening the approved
+// invite) and were reverted after review.
+function PendingAccess() {
+  const { t } = useTranslation();
+  const qc = useQueryClient();
+  const rows = useQuery({
+    queryKey: qk.adminPendingAccess(),
+    queryFn: () => api.adminPendingAccess(),
+  });
+  // Activating changes /api/me's badge count too, so refresh both or the number lies until reload.
+  const refresh = () => {
+    qc.invalidateQueries({ queryKey: qk.adminPendingAccess() });
+    qc.invalidateQueries({ queryKey: qk.me() });
+    qc.invalidateQueries({ queryKey: qk.adminUsers() });
+  };
+
+  const activate = useMutation({
+    mutationFn: (u: PendingAccessRow) => api.activateUser(u.id),
+    onSuccess: (_r, u) => {
+      refresh();
+      notify({ level: "success", message: t("users.pendingAccess.activated", { email: u.email }) });
+    },
+    onError: () => notify({ level: "error", message: t("users.pendingAccess.activateFailed") }),
+  });
+
+  const resend = useMutation({
+    mutationFn: (u: PendingAccessRow) => api.resendUserVerification(u.id),
+    onSuccess: (_r, u) => {
+      refresh();
+      notify({ level: "success", message: t("users.pendingAccess.resent", { email: u.email }) });
+    },
+    // The public resend is deliberately silent; this one is not, so say WHY it failed — an instance
+    // with no working SMTP would otherwise show a success toast for a mail that was never sent.
+    onError: (err) =>
+      notify({
+        level: "error",
+        message:
+          err instanceof HttpError && isEmailOff(err)
+            ? t("users.pendingAccess.resendEmailOff")
+            : t("users.pendingAccess.resendFailed"),
+      }),
+  });
+
+  const list = rows.data ?? [];
+  const busy = activate.isPending || resend.isPending;
+  if (rows.isSuccess && list.length === 0) return null; // nothing stuck: no empty box to explain
+
+  return (
+    <Section card title={t("users.pendingAccess.title")}>
+      <p className="text-xs text-muted leading-relaxed mb-3">{t("users.pendingAccess.body")}</p>
+      {rows.isError && !rows.data ? (
+        <StateMessage tone="error" onRetry={() => rows.refetch()}>
+          {t("common.loadError")}
+        </StateMessage>
+      ) : rows.isLoading && !rows.data ? (
+        <LoadingState />
+      ) : (
+        <div className="space-y-1.5">
+          {list.map((u) => (
+            <PendingAccessRowView
+              key={u.id}
+              row={u}
+              busy={busy}
+              onActivate={() => activate.mutate(u)}
+              onResend={() => resend.mutate(u)}
+            />
+          ))}
+        </div>
+      )}
+    </Section>
+  );
+}
+
+/** Did the resend fail because this instance has no working SMTP? */
+function isEmailOff(err: HttpError): boolean {
+  const d = err.detailData as { code?: string; reason?: string } | null | undefined;
+  return d?.code === "resend" && d.reason === "email_off";
+}
+
+// One stuck sign-up. The row names WHICH gate is shut rather than just offering buttons — the same
+// reasoning as the sign-in card's blocked panel, from the admin's side: an admin about to let someone
+// in should see that the address has not been confirmed yet, because on a no-SMTP instance that is
+// the difference between the owner and whoever registered the address first (roadmap SEC-15).
+function PendingAccessRowView({
+  row,
+  busy,
+  onActivate,
+  onResend,
+}: {
+  row: PendingAccessRow;
+  busy: boolean;
+  onActivate: () => void;
+  onResend: () => void;
+}) {
+  const { t } = useTranslation();
+  return (
+    <div className="glass-card flex items-center gap-2 p-2.5 rounded-xl">
+      <div className="min-w-0 flex-1">
+        <div className="text-sm truncate">{row.email}</div>
+        <div className="text-2xs text-muted flex items-center gap-2 mt-0.5 flex-wrap">
+          {row.created_at && (
+            <span>
+              {t("users.pendingAccess.signedUp", {
+                time: new Date(row.created_at).toLocaleString(),
+              })}
+            </span>
+          )}
+          {row.email_verified ? (
+            <span className="inline-flex items-center gap-1 text-success">
+              <Check className="w-3 h-3" />
+              {t("users.pendingAccess.emailConfirmed")}
+            </span>
+          ) : (
+            <span className="inline-flex items-center gap-1 text-warn">
+              <MailWarning className="w-3 h-3" />
+              {t("users.pendingAccess.emailUnconfirmed")}
+            </span>
+          )}
+          {!row.is_active && (
+            <span className="inline-flex items-center gap-1">
+              <Clock className="w-3 h-3" />
+              {t("users.pendingAccess.inactive")}
+            </span>
+          )}
+        </div>
+      </div>
+      {!row.email_verified && (
+        <Tooltip hint={t("users.pendingAccess.resendHint")}>
+          <button
+            onClick={onResend}
+            disabled={busy}
+            className="shrink-0 p-1.5 rounded-lg border border-border text-muted hover:text-fg disabled:opacity-50 transition"
+            aria-label={t("users.pendingAccess.resend")}
+          >
+            <Send className="w-4 h-4" />
+          </button>
+        </Tooltip>
+      )}
+      {row.can_activate && (
+        <Tooltip hint={t("users.pendingAccess.activateHint")}>
+          <button
+            onClick={onActivate}
+            disabled={busy}
+            className="shrink-0 px-2.5 py-1.5 rounded-lg border border-accent/40 text-accent text-xs font-medium hover:bg-accent/10 disabled:opacity-50 transition"
+          >
+            {t("users.pendingAccess.activate")}
+          </button>
+        </Tooltip>
+      )}
+    </div>
+  );
+}
+
 // --- Access requests (the Invite whitelist) — moved verbatim from Settings → Account -------

 function AdminInvites() {
@@ -37,7 +37,13 @@ vi.mock("../lib/notifications", async (importOriginal) => {
  return { ...actual, notify: (...a: unknown[]) => notifyMock(...a) };
 });

-const meMock = { pending_invites: 0, email_configured: true, id: 1, role: "admin" };
+const meMock = {
+  pending_invites: 0,
+  pending_activations: 0,
+  email_configured: true,
+  id: 1,
+  role: "admin",
+};
 vi.mock("../lib/useMe", () => ({ useMe: () => meMock }));

 // The tab strip is rendered into an app-level toolbar slot that does not exist here, so pin the
@@ -57,6 +63,9 @@ vi.mock("../lib/api", async (importOriginal) => {
      ...actual.api,
      adminInvites: () => listMock(),
      deleteInvite: (id: number) => deleteMock(id),
+      // The access tab also renders the stuck-sign-ups section (E9.5 S5); nothing stuck here, so it
+      // renders nothing and this file stays about the delete affordance.
+      adminPendingAccess: () => Promise.resolve([]),
    },
  };
 });
@@ -0,0 +1,186 @@
+// @vitest-environment jsdom
+//
+// The admin lifeline for a sign-up that is stuck outside (E9.5 S5, roadmap UX-25). Approve an address
+// BEFORE the person registers and their sign-up produces no queue row at all, so the Access-requests
+// screen was empty while they sat locked out and the only working move — re-typing the address into
+// the whitelist box — was undiscoverable. These pin what the section shows and, just as importantly,
+// what it does NOT show: the section is a discovery surface, and a person the queue above already
+// covers must not appear twice.
+//
+// i18n is a key-passthrough so assertions read stable keys; the API and the notify singleton are
+// stubbed so the panel can be driven without a server.
+import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
+import { render, screen, cleanup, waitFor, fireEvent } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({
+      t: (key: string, vars?: Record<string, unknown>) =>
+        vars?.email ? `${key}:${String(vars.email)}` : key,
+      i18n: { language: "en" },
+    }),
+  };
+});
+
+vi.mock("./ConfirmProvider", () => ({
+  useConfirm: () => vi.fn(async () => true),
+  ConfirmProvider: ({ children }: { children: React.ReactNode }) => children,
+}));
+
+const notifyMock = vi.fn();
+vi.mock("../lib/notifications", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/notifications")>();
+  return { ...actual, notify: (...a: unknown[]) => notifyMock(...a) };
+});
+
+const meMock = {
+  pending_invites: 0,
+  pending_activations: 0,
+  email_configured: true,
+  id: 1,
+  role: "admin",
+};
+vi.mock("../lib/useMe", () => ({ useMe: () => meMock }));
+
+// The tab strip renders into an app-level toolbar slot that does not exist here; pin the tab.
+vi.mock("./Tabs", () => ({
+  default: () => null,
+  usePersistedTab: () => ["access", () => {}],
+}));
+
+const pendingMock = vi.fn();
+const activateMock = vi.fn();
+const resendMock = vi.fn();
+vi.mock("../lib/api", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/api")>();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      adminInvites: () => Promise.resolve([]),
+      adminPendingAccess: () => pendingMock(),
+      activateUser: (id: number) => activateMock(id),
+      resendUserVerification: (id: number) => resendMock(id),
+    },
+  };
+});
+
+import AdminUsers from "./AdminUsers";
+
+/** A row as /api/admin/pending-access serves it. */
+const row = (over: Record<string, unknown> = {}) => ({
+  id: 7,
+  email: "later@example.com",
+  display_name: null,
+  role: "user",
+  is_active: false,
+  is_suspended: false,
+  email_verified: true,
+  is_demo: false,
+  has_password: true,
+  has_google: false,
+  created_at: "2026-09-01T10:00:00Z",
+  can_activate: true,
+  ...over,
+});
+
+function mount() {
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  render(
+    <QueryClientProvider client={qc}>
+      <AdminUsers />
+    </QueryClientProvider>,
+  );
+}
+
+beforeEach(() => {
+  pendingMock.mockReset();
+  activateMock.mockReset().mockResolvedValue({});
+  resendMock.mockReset().mockResolvedValue({ ok: true, email: "later@example.com" });
+  notifyMock.mockReset();
+});
+afterEach(cleanup);
+
+describe("the stuck sign-ups section", () => {
+  it("offers Activate for a registrant whose address was already approved", async () => {
+    pendingMock.mockResolvedValue([row()]);
+    mount();
+
+    const button = await screen.findByText("users.pendingAccess.activate");
+    fireEvent.click(button);
+
+    await waitFor(() => expect(activateMock).toHaveBeenCalledWith(7));
+    expect(notifyMock).toHaveBeenCalledWith(
+      expect.objectContaining({ message: "users.pendingAccess.activated:later@example.com" }),
+    );
+  });
+
+  it("shows no Activate when the address is not allowed, since that would be a different decision", async () => {
+    // Activating an address with no approved invite makes an account that signs in with a password
+    // but is turned away by Google — the whitelist box is the honest move for that.
+    pendingMock.mockResolvedValue([row({ can_activate: false, email_verified: false })]);
+    mount();
+
+    await screen.findByText("users.pendingAccess.emailUnconfirmed");
+    expect(screen.queryByText("users.pendingAccess.activate")).toBeNull();
+  });
+
+  it("names which gate is shut, so an admin sees an unconfirmed address before letting it in", async () => {
+    pendingMock.mockResolvedValue([row({ email_verified: false })]);
+    mount();
+
+    // On a no-SMTP instance this is the difference between the owner and whoever registered the
+    // address first (roadmap SEC-15), so it belongs on the row, not in a tooltip.
+    expect(await screen.findByText("users.pendingAccess.emailUnconfirmed")).toBeTruthy();
+    expect(screen.getByText("users.pendingAccess.inactive")).toBeTruthy();
+  });
+
+  it("re-sends the confirmation link for an unconfirmed account", async () => {
+    pendingMock.mockResolvedValue([row({ email_verified: false })]);
+    mount();
+
+    fireEvent.click(await screen.findByLabelText("users.pendingAccess.resend"));
+
+    await waitFor(() => expect(resendMock).toHaveBeenCalledWith(7));
+  });
+
+  it("offers no resend once the address is confirmed", async () => {
+    pendingMock.mockResolvedValue([row()]);
+    mount();
+
+    await screen.findByText("users.pendingAccess.activate");
+    expect(screen.queryByLabelText("users.pendingAccess.resend")).toBeNull();
+  });
+
+  it("says the mail was never sent when the instance has no SMTP", async () => {
+    const { HttpError } = await import("../lib/api");
+    pendingMock.mockResolvedValue([row({ email_verified: false })]);
+    resendMock.mockRejectedValue(
+      new HttpError(409, "ignored", { code: "resend", reason: "email_off" }),
+    );
+    mount();
+
+    fireEvent.click(await screen.findByLabelText("users.pendingAccess.resend"));
+
+    // Mail is fail-soft everywhere else, which is what left the 0.78.5 sign-ups with nothing to fall
+    // back on. A button the admin pressed must not answer with a success toast.
+    await waitFor(() =>
+      expect(notifyMock).toHaveBeenCalledWith(
+        expect.objectContaining({ message: "users.pendingAccess.resendEmailOff" }),
+      ),
+    );
+  });
+
+  it("renders nothing at all when nobody is stuck", async () => {
+    pendingMock.mockResolvedValue([]);
+    mount();
+
+    // The section withdraws itself rather than leaving an empty box to explain — so wait for it to
+    // GO, not merely for the request to have been made.
+    await waitFor(() => expect(screen.queryByText("users.pendingAccess.title")).toBeNull());
+    expect(pendingMock).toHaveBeenCalled();
+  });
+});
@@ -3,6 +3,8 @@
  "user_suspend": "User suspended",
  "user_unsuspend": "User reinstated",
  "user_delete": "User deleted",
+  "user_activate": "Account activated",
+  "user_verify_resend": "Confirmation link re-sent",
  "invite_approve": "Access request approved",
  "invite_deny": "Access request denied",
  "invite_add": "Email whitelisted",
@@ -4,6 +4,23 @@
    "access": "Access requests",
    "demo": "Demo"
  },
+  "pendingAccess": {
+    "title": "Signed up, but still outside",
+    "body": "These people created an account that can't sign in yet. If you approved their address before they registered, no request reached the queue above — let them in here.",
+    "signedUp": "Signed up {{time}}",
+    "emailConfirmed": "email confirmed",
+    "emailUnconfirmed": "email not confirmed",
+    "inactive": "waiting for activation",
+    "activate": "Activate",
+    "activateHint": "Let this account in. Their address is already approved — this only finishes it.",
+    "activated": "{{email}} can sign in now.",
+    "activateFailed": "Couldn't activate that account.",
+    "resend": "Send the confirmation link again",
+    "resendHint": "Send the confirmation link again, to the address on the account.",
+    "resent": "Confirmation link sent to {{email}}.",
+    "resendFailed": "Couldn't send the confirmation link.",
+    "resendEmailOff": "No mail was sent: this instance has no working SMTP setup. Check Configuration → Email."
+  },
  "roles": {
    "title": "Users & roles",
    "intro": "Everyone who can sign in. Promote a user to admin, or back to a regular user.",
@@ -3,6 +3,8 @@
  "user_suspend": "Felhasználó felfüggesztve",
  "user_unsuspend": "Felhasználó visszaállítva",
  "user_delete": "Felhasználó törölve",
+  "user_activate": "Fiók aktiválva",
+  "user_verify_resend": "Megerősítő link újraküldve",
  "invite_approve": "Hozzáférési kérelem jóváhagyva",
  "invite_deny": "Hozzáférési kérelem elutasítva",
  "invite_add": "Email fehérlistázva",
@@ -4,6 +4,23 @@
    "access": "Hozzáférési kérések",
    "demo": "Demo"
  },
+  "pendingAccess": {
+    "title": "Regisztrált, de még kívül van",
+    "body": "Ezek a fiókok léteznek, de még nem tudnak belépni. Ha a címüket a regisztrációjuk előtt hagytad jóvá, a fenti sorba semmi nem került — itt engedheted be őket.",
+    "signedUp": "Regisztrált: {{time}}",
+    "emailConfirmed": "cím megerősítve",
+    "emailUnconfirmed": "cím nincs megerősítve",
+    "inactive": "aktiválásra vár",
+    "activate": "Aktiválás",
+    "activateHint": "Beengedi ezt a fiókot. A címe már jóvá van hagyva — ez csak befejezi.",
+    "activated": "{{email}} mostantól be tud lépni.",
+    "activateFailed": "Nem sikerült aktiválni a fiókot.",
+    "resend": "Megerősítő link újraküldése",
+    "resendHint": "Újraküldi a megerősítő linket, a fiókon szereplő címre.",
+    "resent": "Megerősítő link elküldve ide: {{email}}.",
+    "resendFailed": "Nem sikerült elküldeni a megerősítő linket.",
+    "resendEmailOff": "Nem ment ki levél: ezen a példányon nincs működő SMTP. Nézd meg a Beállítások → E-mail részt."
+  },
  "roles": {
    "title": "Felhasználók és szerepek",
    "intro": "Mindenki, aki be tud lépni. Léptess egy felhasználót adminná, vagy vissza sima felhasználóvá.",
@@ -20,6 +20,11 @@ export interface Me {
  can_read: boolean;
  can_write: boolean;
  pending_invites: number;
+  /** Admin-only: sign-ups an admin still has to let in — approved BEFORE they registered, so nothing
+   *  ever reached the Access-requests queue and its badge read zero (roadmap UX-25). Counted apart
+   *  from pending_invites because they are different facts, and widening one number silently would
+   *  change what an existing field means. */
+  pending_activations: number;
  /** Admin-only: false when SMTP is incomplete, so every outbound message is silently skipped. */
  email_configured: boolean;
  preferences: Record<string, unknown>;
@@ -27,6 +27,16 @@ export interface Invite {
  still_allowed_by_env: boolean;
 }

+/** A sign-up that is still outside, as the admin screen shows it. Same shape as a user row plus the
+ *  one thing the client cannot work out for itself. */
+export interface PendingAccessRow extends AdminUserRow {
+  /** The address is already allowed and the account is merely inactive, so Activate finishes a
+   *  decision the admin has already made. False when there is no approved invite behind it —
+   *  activating then would make an account that signs in with a password but is turned away by
+   *  Google, so the whitelist box is the honest move instead. */
+  can_activate: boolean;
+}
+
 // Admin Configuration page: one DB-overridable setting (registry entry on the backend).
 export interface ConfigItem {
  key: string;
@@ -169,6 +179,16 @@ export const adminApi = {
  resetDemo: (): Promise<{ reset: boolean; playlists_seeded: number }> =>
    req("/api/admin/demo/reset", { method: "POST" }),
  // --- access invites ---
+  // Sign-ups that registered but still cannot get in — the admin lifeline for roadmap UX-25.
+  adminPendingAccess: (): Promise<PendingAccessRow[]> => req("/api/admin/pending-access"),
+  // Let one in. Admin-only and explicit: it changes discoverability, not authority — the same thing
+  // was always possible by re-entering the address in the whitelist box.
+  activateUser: (id: number): Promise<AdminUserRow> =>
+    req(`/api/admin/users/${id}/activate`, { method: "POST" }, { quiet: true }),
+  // Re-send someone's confirmation link. Unlike the public resend this one says what happened,
+  // because the caller is already an authenticated admin.
+  resendUserVerification: (id: number): Promise<{ ok: boolean; email: string }> =>
+    req(`/api/admin/users/${id}/resend-verification`, { method: "POST" }, { quiet: true }),
  adminInvites: (status?: string): Promise<Invite[]> =>
    req(`/api/admin/invites${status ? `?status=${status}` : ""}`),
  approveInvite: (id: number) => req(`/api/admin/invites/${id}/approve`, { method: "POST" }),
@@ -86,6 +86,7 @@ export const qk = {
  // --- admin ---
  adminUsers: () => ["admin-users"] as const,
  adminInvites: () => ["admin-invites"] as const,
+  adminPendingAccess: () => ["admin-pending-access"] as const,
  adminConfig: () => ["admin-config"] as const,
  adminAudit: () => ["admin-audit"] as const,
  adminStorage: () => ["admin-storage"] as const,