release: 0.78.6 (feat/admin-invite-delete-email-health)

VERSION

@@ -1 +1 @@
-0.78.4
+0.78.6

backend/app/audit.py

@@ -30,6 +30,7 @@ class AuditAction:
     INVITE_APPROVE = "invite_approve"
     INVITE_DENY = "invite_deny"
     INVITE_ADD = "invite_add"
+    INVITE_DELETE = "invite_delete"
     DEMO_ADD = "demo_add"
     DEMO_REMOVE = "demo_remove"
     DEMO_RESET = "demo_reset"

backend/app/email.py

@@ -3,6 +3,11 @@
 Gmail SMTP + App Password by default. Deliberately fail-soft: if SMTP isn't configured
 or a send errors, we log and return False so the caller can fall back to in-app
 notifications — email is never load-bearing for the app's core flow.
+
+Fail-soft must not mean invisible, though: every drop also leaves an in-app notice in the admins'
+inbox (see `_alert_admins`). An instance whose SMTP was never filled in silently swallows
+verification links, password resets and access-request notices, and the operator's first clue used
+to be a person telling them nothing arrived.
 """
 
 import logging
@@ -11,28 +16,88 @@ import ssl
 from email.message import EmailMessage
 from email.utils import formatdate
 
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
 from app import sysconfig
 from app.config import settings
 from app.db import SessionLocal
+from app.models import User
+from app.notifications import create_notification
+from app.ratelimit import RateLimiter
 
 log = logging.getLogger("siftlode.email")
 
-
-def _smtp() -> dict:
-    """Effective SMTP config (admin DB override over env defaults). Opens its own short
-    session because email is often sent from a BackgroundTask, outside a request's db."""
-    with SessionLocal() as db:
-        return {
-            "host": sysconfig.get_str(db, "smtp_host"),
-            "port": sysconfig.get_int(db, "smtp_port"),
-            "user": sysconfig.get_str(db, "smtp_user"),
-            "password": sysconfig.get_str(db, "smtp_password"),
-            "from": sysconfig.get_str(db, "smtp_from"),
-        }
+# One admin notice an hour per reason. A relay that is down fails every send, and the inbox must
+# stay readable; the log keeps the full record either way.
+_alert_throttle = RateLimiter(max_events=1, window_seconds=3600)
 
 
-def email_enabled() -> bool:
-    c = _smtp()
+def _alert_admins(reason: str, subject: str, recipients: list[str]) -> None:
+    """Record an in-app notice that a message did NOT go out. Best effort in every direction: it
+    opens its own session (callers are often background tasks), swallows its own errors, and never
+    reports failure to the caller — this is the fallback path, it must not become a new way to
+    break a send."""
+    if not _alert_throttle.allow(reason):
+        return
+    try:
+        with SessionLocal() as db:
+            admins = (
+                db.execute(
+                    select(User.id).where(
+                        User.role == "admin",
+                        User.is_active.is_(True),
+                        User.is_suspended.is_(False),
+                    )
+                )
+                .scalars()
+                .all()
+            )
+            if not admins:
+                # Nothing was recorded, so don't let this cost the next hour of alerts on the very
+                # path whose job is to stop drops going unseen. Same on the failure branch below.
+                _alert_throttle.reset()
+                return
+            for uid in admins:
+                create_notification(
+                    db,
+                    user_id=uid,
+                    type="email_undelivered",
+                    # English fallback; the inbox renders a translated version from `data`.
+                    title="Email could not be sent",
+                    body=subject,
+                    data={"reason": reason, "subject": subject, "recipients": recipients},
+                    commit=False,
+                )
+            db.commit()
+    except Exception:
+        _alert_throttle.reset()
+        log.exception("Could not record the undelivered-email notice (%r)", subject)
+
+
+def _read_smtp(db: Session) -> dict:
+    return {
+        "host": sysconfig.get_str(db, "smtp_host"),
+        "port": sysconfig.get_int(db, "smtp_port"),
+        "user": sysconfig.get_str(db, "smtp_user"),
+        "password": sysconfig.get_str(db, "smtp_password"),
+        "from": sysconfig.get_str(db, "smtp_from"),
+    }
+
+
+def _smtp(db: Session | None = None) -> dict:
+    """Effective SMTP config (admin DB override over env defaults). Opens its own short session when
+    the caller has none, because email is usually sent from a BackgroundTask outside a request's db.
+    A caller that IS inside a request should pass its session: reading the password decrypts a Fernet
+    value, and /api/me polls this for every admin tab."""
+    if db is not None:
+        return _read_smtp(db)
+    with SessionLocal() as own:
+        return _read_smtp(own)
+
+
+def email_enabled(db: Session | None = None) -> bool:
+    c = _smtp(db)
     return bool(c["host"] and c["user"] and c["password"])
 
 
@@ -47,6 +112,7 @@ def _send(to: list[str], subject: str, body: str, reply_to: str | None = None) -
     c = _smtp()
     if not (c["host"] and c["user"] and c["password"]):
         log.info("SMTP not configured; skipping email %r to %s", subject, recipients)
+        _alert_admins("not_configured", subject, recipients)
         return False
     msg = EmailMessage()
     msg["Subject"] = subject
@@ -67,6 +133,7 @@ def _send(to: list[str], subject: str, body: str, reply_to: str | None = None) -
         return True
     except Exception:
         log.exception("SMTP send failed (%r to %s)", subject, recipients)
+        _alert_admins("send_failed", subject, recipients)
         return False
 
 

backend/app/ratelimit.py

@@ -18,6 +18,13 @@ class RateLimiter:
         self._hits: dict[str, list[float]] = {}
         self._lock = threading.Lock()
 
+    def reset(self) -> None:
+        """Forget every recorded attempt. Each limiter is a module-level singleton, so a test suite
+        sharing one process would otherwise pool all of its attempts into a single window and
+        eventually trip an unrelated test with a 429."""
+        with self._lock:
+            self._hits.clear()
+
     def allow(self, key: str) -> bool:
         """Record an attempt for ``key`` and return whether it is within the limit.
 

backend/app/routes/admin.py

@@ -1,6 +1,7 @@
 """Admin-only onboarding: review access requests (Invites), approve/deny, manual add.
 Also the demo-account admin surface: the demo email whitelist + a manual state reset."""
 
+from collections.abc import Iterable
 from datetime import datetime, timezone
 
 from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
@@ -18,6 +19,7 @@ from app.auth import (
     operator_contact,
     purge_user,
 )
+from app.config import settings
 from app.db import get_db
 from app.demo import reset_demo_state
 from app.models import (
@@ -31,7 +33,26 @@ from app.utils import iso, valid_email
 router = APIRouter(prefix="/api/admin", tags=["admin"])
 
 
-def _serialize(inv: Invite) -> dict:
+def _accounts_for(db: Session, emails: Iterable[str]) -> set[str]:
+    """Which of these addresses already have an account. Batched, so listing the invites costs one
+    extra query. An invite whose address has an account must not be deletable: `is_allowed` reads
+    this row, so removing it would silently revoke a live user's access."""
+    wanted = {e.lower() for e in emails if e}
+    if not wanted:
+        return set()
+    rows = db.execute(select(User.email).where(User.email.in_(wanted))).scalars()
+    return {e.lower() for e in rows if e}
+
+
+def _env_allowed(email: str) -> bool:
+    """Whether the env bootstrap lists still let this address in. `is_allowed` consults them only
+    when no Invite row exists, so this is exactly what deleting the row would fall back to — and the
+    admin has to know that BEFORE they confirm, not from a toast afterwards."""
+    email = (email or "").lower()
+    return email in settings.allowed_email_set or email in settings.admin_email_set
+
+
+def _serialize(inv: Invite, *, has_account: bool = False) -> dict:
     return {
         "id": inv.id,
         "email": inv.email,
@@ -40,6 +61,11 @@ def _serialize(inv: Invite) -> dict:
         "requested_at": iso(inv.requested_at),
         "decided_at": iso(inv.decided_at),
         "decided_by": inv.decided_by,
+        # Drives the delete affordance: an entry backed by an account is not removable here.
+        "has_account": has_account,
+        # …and whether removing it would actually take access away, or leave the env allow-list
+        # granting it anyway (for an ADMIN_EMAILS address, as an admin).
+        "still_allowed_by_env": _env_allowed(inv.email),
     }
 
 
@@ -56,7 +82,8 @@ def list_invites(
     rows = db.execute(stmt.order_by(Invite.requested_at.desc())).scalars().all()
     order = {"pending": 0, "approved": 1, "denied": 2}
     rows.sort(key=lambda i: order.get(i.status, 9))
-    return [_serialize(i) for i in rows]
+    accounts = _accounts_for(db, (i.email for i in rows))
+    return [_serialize(i, has_account=(i.email or "").lower() in accounts) for i in rows]
 
 
 def _activate_user_by_email(db: Session, email: str) -> None:
@@ -107,7 +134,7 @@ def approve_invite(
     inv = _decide(db, invite_id, admin, approved=True)
     _activate_user_by_email(db, inv.email)
     background.add_task(email_mod.send_access_approved, inv.email)
-    return _serialize(inv)
+    return _serialize(inv, has_account=bool(_accounts_for(db, [inv.email])))
 
 
 @router.post("/invites/{invite_id}/deny")
@@ -121,7 +148,7 @@ def deny_invite(
     # account is activated, so this is an email only (the requester has no in-app inbox yet).
     inv = _decide(db, invite_id, admin, approved=False)
     background.add_task(email_mod.send_access_denied, inv.email)
-    return _serialize(inv)
+    return _serialize(inv, has_account=bool(_accounts_for(db, [inv.email])))
 
 
 class AddInviteIn(BaseModel):
@@ -150,7 +177,49 @@ def add_invite(
     )
     db.commit()
     _activate_user_by_email(db, email)
-    return _serialize(inv)
+    return _serialize(inv, has_account=bool(_accounts_for(db, [email])))
+
+
+@router.delete("/invites/{invite_id}")
+def delete_invite(
+    invite_id: int,
+    admin: User = Depends(admin_user),
+    db: Session = Depends(get_db),
+) -> dict:
+    """Remove a whitelist/request entry outright — the counterpart to add_invite, for an address that
+    never became an account (an approval added by mistake, or one that is no longer wanted). Deny
+    records a decision and keeps the row for the audit trail; delete forgets the address. Neither
+    stops the person asking again: `upsert_pending_invite` reopens a denied row, and a deleted one
+    simply comes back as a fresh pending request.
+
+    Refused once an account exists for the address, whatever its state: this row is the account's
+    approval gate, and orphaning the account from it would leave a person who can neither sign in nor
+    be approved. Delete the USER instead — purge_user removes the invite along with it.
+
+    Reports `still_allowed_by_env`, because deleting the row is NOT always a revoke: `is_allowed`
+    falls back to the env ALLOWED_EMAILS / ADMIN_EMAILS bootstrap lists once no invite exists, so for
+    an address on those the deletion leaves access intact (and an ADMIN_EMAILS address is still
+    promoted to admin on its next Google sign-in). The admin has to hear that, not guess it."""
+    inv = db.get(Invite, invite_id)
+    if inv is None:
+        raise HTTPException(status_code=404, detail="No such invite")
+    if _accounts_for(db, [inv.email]):
+        raise HTTPException(
+            status_code=409,
+            detail="That address already has an account — delete the account instead.",
+        )
+    still_allowed_by_env = _env_allowed(inv.email)
+    audit.record(
+        db,
+        admin.id,
+        AuditAction.INVITE_DELETE,
+        target_type="invite",
+        target_id=inv.id,
+        summary=inv.email,
+    )
+    db.delete(inv)
+    db.commit()
+    return {"deleted": invite_id, "still_allowed_by_env": still_allowed_by_env}
 
 
 # --- Users & roles --------------------------------------------------------------------

backend/app/routes/auth.py

@@ -636,12 +636,25 @@ def _register_account(email: str, password: str) -> None:
             # no-op as the pre-check hit — roll back and stop.
             db.rollback()
             return
-        upsert_pending_invite(db, email)  # admin-approval gate (commits)
+        upsert_pending_invite(db, email)  # admin-approval gate
+        # Persist the account ourselves. upsert_pending_invite commits only when it actually writes an
+        # invite row — not when this address already has a pending or approved one — and _issue_token
+        # below only runs with SMTP on. So for an address the admin had already approved (or one whose
+        # request was still pending), on an instance with no working SMTP, NOTHING along this path
+        # committed and the flushed user was silently rolled back when the session closed: the
+        # would-be user got the uniform "ok" and no account, and re-registering did the same again.
+        # Commit unconditionally; it is a no-op when upsert already committed the same transaction.
+        db.commit()
         if email_ok:
             raw = _issue_token(db, user, "verify", VERIFY_TTL)
             # Fragment (#), not a query token: keeps the token out of proxy/access logs + Referer (SB3).
             email_mod.send_verify_email(email, f"{_app_base()}/#verify={raw}")
         admins = admin_notify_emails(db)
+        # Fired unconditionally, unlike the other two callers which gate on a fresh invite row: for
+        # an address the admin already approved, nothing lands in the Access-requests queue, so this
+        # is the only place the account's existence is announced at all. Delivery is a separate
+        # matter — with no working SMTP `_send` drops it, which is why the pre-approved registrant
+        # still needs the admin to notice them (roadmap UX-25).
         if admins:
             email_mod.send_admin_new_request(admins, email)
 

backend/app/routes/me.py

@@ -13,6 +13,7 @@ from app.auth import (
     optional_current_user,
     purge_user,
 )
+from app import email as email_mod
 from app import sysconfig
 from app.db import get_db
 from app.models import Invite, User
@@ -98,11 +99,16 @@ def get_me(
     if user is None:
         return {"authenticated": False}
     pending_invites = 0
+    # Admin-only, because it drives an operator warning: email is fail-soft, so a half-filled SMTP
+    # config costs verification links, password resets and access-request notices with nothing
+    # visible anywhere. Surfacing it here puts the warning on the screens where onboarding happens.
+    email_configured = True
     if user.role == "admin":
         pending_invites = (
             db.scalar(select(func.count()).select_from(Invite).where(Invite.status == "pending"))
             or 0
         )
+        email_configured = email_mod.email_enabled(db)  # this request's session; no second connect
     return {
         "authenticated": True,
         "id": user.id,
@@ -121,6 +127,7 @@ def get_me(
         "can_read": has_read_scope(user),
         "can_write": has_write_scope(user),
         "pending_invites": pending_invites,
+        "email_configured": email_configured,
         "preferences": user.preferences or {},
     }
 

backend/tests/conftest.py

@@ -189,3 +189,24 @@ def as_user(db, override_dep, _configured):
         return TestClient(app, headers={"x-test-user": str(user.id)})
 
     return _as
+
+
+@pytest.fixture(autouse=True)
+def _reset_rate_limiters():
+    """Every RateLimiter is a module-level singleton keyed by client IP, and TestClient always
+    presents the same host — so without this the whole suite's login/register attempts pool into one
+    300s window and, past the cap, some unrelated test starts failing with a 429 depending on order.
+    Cleared before each test; a test that wants to exercise throttling can still exhaust one itself.
+
+    Sweeps every loaded `app.*` module rather than a hand-kept list, so a limiter added in a new
+    module is covered the day it lands instead of silently pooling until something fails."""
+    import sys
+
+    from app.ratelimit import RateLimiter
+
+    for name, mod in list(sys.modules.items()):
+        if name != "app" and not name.startswith("app."):
+            continue
+        for obj in vars(mod).values():
+            if isinstance(obj, RateLimiter):
+                obj.reset()

backend/tests/test_admin_invites.py

@@ -0,0 +1,170 @@
+"""Deleting a whitelist / access-request entry (admin).
+
+Deny records an auditable decision and keeps the row; delete forgets the address outright, for an
+approval added by mistake or one that is no longer wanted. Neither stops the person asking again —
+`upsert_pending_invite` reopens a denied row as pending, and a deleted one comes back as a fresh
+request. The one hard rule is that an entry backed by an account is NOT deletable here: this row is
+that account's approval gate, and orphaning it would strand someone who could then neither sign in
+nor be approved.
+"""
+
+from sqlalchemy import select
+
+from app.models import Invite, User
+
+
+def _invites(client):
+    r = client.get("/api/admin/invites")
+    assert r.status_code == 200
+    return {i["email"]: i for i in r.json()}
+
+
+def test_admin_deletes_a_whitelist_entry_that_never_became_an_account(db, make_user, as_user):
+    admin = make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="mistake@example.com", status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+    listed = _invites(client)["mistake@example.com"]
+    assert listed["has_account"] is False  # drives the delete affordance in the UI
+
+    r = client.delete(f"/api/admin/invites/{listed['id']}")
+
+    assert r.status_code == 200 and r.json()["deleted"] == listed["id"]
+    db.expire_all()
+    assert (
+        db.execute(select(Invite).where(Invite.email == "mistake@example.com")).scalar_one_or_none()
+        is None
+    )
+
+
+def test_deleting_an_entry_that_has_an_account_is_refused(db, make_user, as_user):
+    # The guard that matters: this row is what is_allowed() reads, so deleting it would revoke the
+    # user's access without touching the account or saying so.
+    admin = make_user(email="admin@example.com", role="admin")
+    member = make_user(email="member@example.com")
+    db.add(Invite(email=member.email, status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+    listed = _invites(client)[member.email]
+    assert listed["has_account"] is True
+
+    r = client.delete(f"/api/admin/invites/{listed['id']}")
+
+    assert r.status_code == 409
+    db.expire_all()
+    assert (
+        db.execute(select(Invite).where(Invite.email == member.email)).scalar_one_or_none()
+        is not None
+    )
+
+
+def test_a_pending_request_from_a_registration_is_not_deletable(db, make_user, as_user):
+    # The shape the ordinary sign-up produces: _register_account writes the User (inactive) AND the
+    # pending Invite together. The invite is that account's approval gate, so deleting it would
+    # strand the person — they could neither sign in nor be approved, and re-registering is a silent
+    # no-op. Managed from Users & roles instead, which is what the UI and the 409 both say.
+    admin = make_user(email="admin@example.com", role="admin")
+    make_user(email="signup@example.com", is_active=False, email_verified=False)
+    db.add(Invite(email="signup@example.com", status="pending"))
+    db.commit()
+    client = as_user(admin)
+    listed = _invites(client)["signup@example.com"]
+    assert listed["has_account"] is True  # the UI shows a disabled control, not a missing one
+
+    r = client.delete(f"/api/admin/invites/{listed['id']}")
+
+    assert r.status_code == 409
+    db.expire_all()
+    assert (
+        db.execute(select(Invite).where(Invite.email == "signup@example.com")).scalar_one_or_none()
+        is not None
+    )
+
+
+def test_deleting_an_env_allow_listed_address_reports_that_it_kept_access(
+    db, make_user, as_user, monkeypatch
+):
+    # Removing the row is NOT always a revoke: is_allowed falls back to the env bootstrap lists once
+    # no invite exists. The admin has to be told, or they think they removed access and did not.
+    from app.config import settings
+
+    # Patch the raw env field, not the derived property: that keeps the split/strip/lower parsing
+    # under test, and matches how the rest of the suite stubs settings.
+    monkeypatch.setattr(settings, "allowed_emails", " OPS@Example.com , someone@else.test ")
+    admin = make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="ops@example.com", status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+    listed = _invites(client)["ops@example.com"]
+    # The LIST carries it too, so the confirm dialog can warn before the delete happens.
+    assert listed["still_allowed_by_env"] is True
+
+    r = client.delete(f"/api/admin/invites/{listed['id']}")
+
+    assert r.status_code == 200
+    assert r.json()["still_allowed_by_env"] is True
+
+
+def test_an_admin_emails_address_is_also_reported(db, make_user, as_user, monkeypatch):
+    # ADMIN_EMAILS is the sharper case: deleting the row not only keeps access, the next Google
+    # sign-in re-promotes the address to admin.
+    from app.config import settings
+
+    monkeypatch.setattr(settings, "admin_emails", "boss@example.com")
+    admin = make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="boss@example.com", status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+
+    assert _invites(client)["boss@example.com"]["still_allowed_by_env"] is True
+
+
+def test_deleting_a_pending_request_forgets_it(db, make_user, as_user):
+    # A pending row is deletable too — "drop this without recording a decision" is a different
+    # choice from Deny, which stores a decision (status, decided_by) and mails the requester.
+    admin = make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="asker@example.com", status="pending"))
+    db.commit()
+    client = as_user(admin)
+
+    r = client.delete(f"/api/admin/invites/{_invites(client)['asker@example.com']['id']}")
+
+    assert r.status_code == 200
+    assert r.json()["still_allowed_by_env"] is False  # nothing in the env allow-lists
+    assert "asker@example.com" not in _invites(client)
+
+
+def test_deleting_a_missing_invite_is_404(db, make_user, as_user):
+    admin = make_user(email="admin@example.com", role="admin")
+    assert as_user(admin).delete("/api/admin/invites/9999").status_code == 404
+
+
+def test_a_regular_user_cannot_delete_an_invite(db, make_user, as_user):
+    make_user(email="admin@example.com", role="admin")
+    plain = make_user(email="plain@example.com")
+    db.add(Invite(email="mistake@example.com", status="approved"))
+    db.commit()
+    inv_id = db.execute(select(Invite.id).where(Invite.email == "mistake@example.com")).scalar_one()
+
+    assert as_user(plain).delete(f"/api/admin/invites/{inv_id}").status_code == 403
+
+    db.expire_all()
+    assert db.get(Invite, inv_id) is not None
+
+
+def test_deleting_the_user_also_clears_the_way_to_re_invite(db, make_user, as_user):
+    # The refusal above tells the admin to delete the account instead; purge_user takes the invite
+    # with it, so the address really is forgotten and a fresh request starts over as pending.
+    admin = make_user(email="admin@example.com", role="admin")
+    member = make_user(email="member@example.com")
+    db.add(Invite(email=member.email, status="approved", decided_by=admin.email))
+    db.commit()
+    client = as_user(admin)
+
+    assert client.delete(f"/api/admin/users/{member.id}").status_code == 200
+
+    db.expire_all()
+    assert db.execute(select(User).where(User.email == member.email)).scalar_one_or_none() is None
+    assert (
+        db.execute(select(Invite).where(Invite.email == member.email)).scalar_one_or_none() is None
+    )

backend/tests/test_auth_session.py

@@ -127,3 +127,217 @@ def test_activating_a_verified_account_keeps_its_password(db, make_user):
     _activate_user_by_email(db, "legit@example.com")
     assert user.is_active is True
     assert user.password_hash is not None
+
+
+def _register_and_fetch(db, email: str):
+    """Run the /register background worker, then read the users/invites rows back through a FRESH
+    query. The worker owns its own session, so anything it failed to commit is simply not there."""
+    from sqlalchemy import select as _select
+
+    from app.models import Invite, User
+    from app.routes.auth import _register_account
+
+    _register_account(email, _PW)
+    db.expire_all()
+    user = db.execute(_select(User).where(User.email == email)).scalar_one_or_none()
+    invite = db.execute(_select(Invite).where(Invite.email == email)).scalar_one_or_none()
+    return user, invite
+
+
+def _no_smtp(monkeypatch):
+    """Put the worker on the no-SMTP path and capture the admin notice instead of sending it."""
+    from app.routes import auth as auth_mod
+
+    notified: list[str] = []
+    monkeypatch.setattr(auth_mod.email_mod, "email_enabled", lambda: False)
+    monkeypatch.setattr(
+        auth_mod.email_mod, "send_admin_new_request", lambda admins, to: notified.append(to) or True
+    )
+    return notified
+
+
+def test_registration_of_a_pre_approved_email_persists_the_account_without_smtp(
+    db, make_user, monkeypatch
+):
+    # THE regression. An admin whitelists an address, the person registers, and the account silently
+    # never existed: upsert_pending_invite leaves an already-approved row alone and returns WITHOUT
+    # committing, and the only other commit on this path (_issue_token) is gated on SMTP — so with no
+    # working mail the flushed user was rolled back at session close. The sign-up answered "ok",
+    # created nothing, and re-registering did the same again.
+    from app.models import Invite
+
+    notified = _no_smtp(monkeypatch)
+    make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="roland@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+
+    user, invite = _register_and_fetch(db, "roland@example.com")
+
+    assert user is not None, "pre-approved registration was rolled back — the account is gone"
+    assert user.password_hash is not None
+    assert user.email_verified is True  # no SMTP => ownership can't be proven by link
+    assert (
+        user.is_active is False
+    )  # approval is bound to the account by an admin, not by signing up
+    # The admin's standing decision is left exactly as it was — is_allowed() still reads "approved",
+    # so their Google sign-in keeps working and an anonymous sign-up cannot revoke access.
+    assert invite.status == "approved"
+    assert invite.decided_by == "admin@example.com"
+    # The notify path still fires for an already-approved address — nothing lands in the queue, so
+    # it is the only announcement there is. (Whether it is DELIVERED is separate: on a real no-SMTP
+    # instance `_send` drops it, which is the open half of the problem, roadmap UX-25.)
+    assert notified == ["roland@example.com"]
+
+
+def test_registration_with_an_already_pending_request_persists_the_account(
+    db, make_user, monkeypatch
+):
+    # The same rollback, reached the other way: someone uses Request access, then registers before
+    # the admin has decided. upsert_pending_invite leaves the pending row alone and does not commit.
+    from app.models import Invite
+
+    notified = _no_smtp(monkeypatch)
+    make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="pia@example.com", status="pending"))
+    db.commit()
+
+    user, invite = _register_and_fetch(db, "pia@example.com")
+
+    assert user is not None, "registration was rolled back — the account is gone"
+    assert user.is_active is False
+    assert invite.status == "pending"
+    assert notified == ["pia@example.com"]
+
+
+def test_an_admin_can_activate_a_pre_approved_registrant(db, monkeypatch):
+    # The recovery path for the account above, pinned so it cannot quietly break: re-entering the
+    # address in the Access-requests whitelist box (POST /api/admin/invites) runs
+    # _activate_user_by_email, which is also what keeps the SEC-10 preset-password guard in play.
+    from app.models import Invite
+    from app.routes.admin import _activate_user_by_email
+
+    _no_smtp(monkeypatch)
+    db.add(Invite(email="roland@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+    user, _ = _register_and_fetch(db, "roland@example.com")
+
+    _activate_user_by_email(db, "roland@example.com")
+
+    db.expire_all()
+    assert user.is_active is True
+    assert user.password_hash is not None  # a verified account keeps its own password
+
+
+def test_registration_of_an_unknown_email_still_persists_account_and_pending_invite(
+    db, make_user, monkeypatch
+):
+    # Guard, not a regression test: this branch always worked (upsert INSERTs the invite and commits
+    # the same transaction). It must keep working — and it is the case that DOES notify the admin.
+    notified = _no_smtp(monkeypatch)
+    make_user(email="admin@example.com", role="admin")
+
+    user, invite = _register_and_fetch(db, "stranger@example.com")
+
+    assert user is not None
+    assert user.is_active is False
+    assert invite is not None and invite.status == "pending"
+    assert notified == ["stranger@example.com"]
+
+
+def test_registration_of_a_previously_denied_email_revives_the_request(db, make_user, monkeypatch):
+    # Guard: a denied person may ask again — the invite flips back to pending (and commits) so the
+    # admin sees a fresh request. The stale decision must not leak into the new account's state.
+    from app.models import Invite
+
+    notified = _no_smtp(monkeypatch)
+    make_user(email="admin@example.com", role="admin")
+    db.add(Invite(email="denis@example.com", status="denied", decided_by="admin@example.com"))
+    db.commit()
+
+    user, invite = _register_and_fetch(db, "denis@example.com")
+
+    assert user is not None
+    assert user.is_active is False
+    assert invite.status == "pending"
+    assert invite.decided_at is None and invite.decided_by is None
+    assert notified == ["denis@example.com"]
+
+
+def test_registration_of_a_pre_approved_email_persists_the_account_with_smtp(db, monkeypatch):
+    # Guard, not a regression test: with SMTP on, _issue_token's own commit already persisted the
+    # user, so this branch was never broken and must stay unbroken.
+    from app.models import Invite
+    from app.routes import auth as auth_mod
+
+    sent: list[str] = []
+    monkeypatch.setattr(auth_mod.email_mod, "email_enabled", lambda: True)
+    monkeypatch.setattr(auth_mod.email_mod, "send_verify_email", lambda to, link: sent.append(to))
+    monkeypatch.setattr(auth_mod.email_mod, "send_admin_new_request", lambda admins, to: True)
+    db.add(Invite(email="rita@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+
+    user, invite = _register_and_fetch(db, "rita@example.com")
+
+    assert user is not None
+    assert user.email_verified is False  # must confirm the address
+    assert user.is_active is False
+    assert invite.status == "approved"
+    assert sent == ["rita@example.com"]
+
+
+def test_verifying_an_email_never_grants_access_on_its_own(client, db, make_user):
+    # Verification attests the address; it does not decide access. The two gates stay separate.
+    from app.models import Invite
+    from app.routes.auth import _issue_token
+
+    user = make_user(email="rita@example.com", password=_PW, email_verified=False, is_active=False)
+    db.add(Invite(email="rita@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+    raw = _issue_token(db, user, "verify", timedelta(hours=1))
+
+    assert client.post("/auth/verify", json={"token": raw}).status_code == 200
+
+    db.expire_all()
+    assert user.email_verified is True
+    assert user.is_active is False
+    assert _login(client, "rita@example.com", _PW).status_code == 403
+
+
+def test_register_route_creates_the_account_end_to_end(client, db, monkeypatch):
+    # The tests above call _register_account directly, so nothing covered the ROUTE: its
+    # allow_registration gate, its rate limiter and the background.add_task wiring that makes the
+    # whole flow reachable at all. TestClient runs BackgroundTasks after the response, so a single
+    # POST exercises the real path end to end.
+    from sqlalchemy import select as _select
+
+    from app.models import User
+
+    _no_smtp(monkeypatch)
+
+    r = client.post("/auth/register", json={"email": "newbie@example.com", "password": _PW})
+
+    assert r.status_code == 200 and r.json() == {"status": "ok"}
+    db.expire_all()
+    user = db.execute(_select(User).where(User.email == "newbie@example.com")).scalar_one_or_none()
+    assert user is not None, "POST /auth/register answered ok but created nothing"
+    assert user.password_hash is not None
+
+
+def test_register_route_is_refused_when_registration_is_closed(client, db, monkeypatch):
+    # The gate is an explicit 403 with nothing created — not a uniform "ok" that silently drops it.
+    from sqlalchemy import select as _select
+
+    from app import sysconfig
+    from app.models import User
+
+    _no_smtp(monkeypatch)
+    sysconfig.set_value(db, "allow_registration", False)
+
+    r = client.post("/auth/register", json={"email": "closed@example.com", "password": _PW})
+
+    assert r.status_code == 403
+    db.expire_all()
+    assert (
+        db.execute(_select(User).where(User.email == "closed@example.com")).scalar_one_or_none()
+        is None
+    )

backend/tests/test_email_alerts.py

@@ -0,0 +1,149 @@
+"""An undelivered email leaves a trace in the admins' inbox.
+
+Sending is deliberately fail-soft — a missing SMTP setting or a rejecting relay logs and returns
+False so nothing user-facing breaks. The cost of that used to be total silence: an instance whose
+SMTP was never filled in swallowed verification links, password resets and access-request notices,
+and the operator's first clue was somebody saying nothing arrived.
+"""
+
+import smtplib
+
+import pytest
+from sqlalchemy import select
+
+from app import email as email_mod
+from app.models import Notification
+
+
+@pytest.fixture(autouse=True)
+def _no_smtp_config(monkeypatch):
+    """Every test here drives the real `_send`, so make sure it never reaches a socket."""
+    monkeypatch.setattr(
+        email_mod,
+        "_smtp",
+        lambda: {"host": "", "port": 587, "user": "", "password": "", "from": ""},
+    )
+
+
+def _notifications(db, user_id: int) -> list[Notification]:
+    return list(
+        db.execute(
+            select(Notification)
+            .where(Notification.user_id == user_id, Notification.type == "email_undelivered")
+            .order_by(Notification.id)
+        )
+        .scalars()
+        .all()
+    )
+
+
+def test_a_skipped_email_notifies_every_admin(db, make_user):
+    admin_a = make_user(email="admin-a@example.com", role="admin")
+    admin_b = make_user(email="admin-b@example.com", role="admin")
+    plain = make_user(email="plain@example.com")
+
+    assert email_mod.send_test("someone@example.com") is False  # fail-soft, as before
+
+    db.expire_all()
+    for admin in (admin_a, admin_b):
+        (n,) = _notifications(db, admin.id)
+        assert n.data["reason"] == "not_configured"
+        assert n.data["subject"] == "Siftlode SMTP test"
+        assert n.data["recipients"] == ["someone@example.com"]
+    assert _notifications(db, plain.id) == []  # not an operator's problem to see
+
+
+def test_the_notice_is_throttled_so_a_dead_relay_cannot_flood_the_inbox(db, make_user):
+    admin = make_user(email="admin@example.com", role="admin")
+
+    for _ in range(5):
+        email_mod.send_test("someone@example.com")
+
+    db.expire_all()
+    assert len(_notifications(db, admin.id)) == 1
+
+
+def test_a_send_failure_is_reported_separately_from_a_missing_config(db, make_user, monkeypatch):
+    # A configured-but-rejecting relay is a different operator problem from an empty config, and the
+    # inbox copy differs — so the reason has to survive to the notification.
+    admin = make_user(email="admin@example.com", role="admin")
+    monkeypatch.setattr(
+        email_mod,
+        "_smtp",
+        lambda: {
+            "host": "smtp.example.com",
+            "port": 587,
+            "user": "u",
+            "password": "p",
+            "from": "Siftlode <u@example.com>",
+        },
+    )
+
+    def _boom(*a, **kw):
+        raise smtplib.SMTPException("nope")
+
+    monkeypatch.setattr(email_mod.smtplib, "SMTP", _boom)
+
+    assert email_mod.send_test("someone@example.com") is False
+
+    db.expire_all()
+    (n,) = _notifications(db, admin.id)
+    assert n.data["reason"] == "send_failed"
+
+
+def test_no_admins_means_no_notification_and_no_error(db, make_user):
+    # A fresh instance can have no admin yet (the wizard has not run). The alert must stay silent
+    # rather than blowing up inside the fail-soft path it is supposed to make visible.
+    plain = make_user(email="plain@example.com")
+
+    assert email_mod.send_test("someone@example.com") is False
+
+    db.expire_all()
+    assert _notifications(db, plain.id) == []
+
+
+def test_a_drop_with_nobody_to_tell_does_not_burn_the_hour(db, make_user):
+    # The throttle window must only be spent on a notice that was actually written. Otherwise a drop
+    # during setup — before any admin exists — silences the next hour for the admin created a minute
+    # later, which is exactly the blind spot this alert exists to remove.
+    email_mod.send_test("someone@example.com")  # no admins yet
+    admin = make_user(email="admin@example.com", role="admin")
+
+    assert email_mod.send_test("someone@example.com") is False
+
+    db.expire_all()
+    assert len(_notifications(db, admin.id)) == 1
+
+
+def test_a_failed_alert_does_not_burn_the_hour_either(db, make_user, monkeypatch):
+    admin = make_user(email="admin@example.com", role="admin")
+    boom = {"on": True}
+
+    def _maybe_boom(*a, **kw):
+        if boom["on"]:
+            raise RuntimeError("notification store is down")
+        from app.notifications import create_notification as real
+
+        return real(*a, **kw)
+
+    monkeypatch.setattr(email_mod, "create_notification", _maybe_boom)
+    email_mod.send_test("someone@example.com")  # the write blows up; nothing recorded
+    boom["on"] = False
+
+    assert email_mod.send_test("someone@example.com") is False
+
+    db.expire_all()
+    assert len(_notifications(db, admin.id)) == 1
+
+
+def test_a_broken_alert_never_breaks_the_send(db, make_user, monkeypatch):
+    # The alert is the fallback path; if IT fails, the caller must still get the ordinary fail-soft
+    # False rather than an exception surfacing from a background task.
+    make_user(email="admin@example.com", role="admin")
+
+    def _boom(*a, **kw):
+        raise RuntimeError("notification store is down")
+
+    monkeypatch.setattr(email_mod, "create_notification", _boom)
+
+    assert email_mod.send_test("someone@example.com") is False

backend/tests/test_me_email_flag.py

@@ -0,0 +1,58 @@
+"""/api/me carries whether this instance can actually send email.
+
+It drives the operator warnings on the Configuration and Access-requests screens. Admin-only,
+because it is an operator concern and a regular user has nothing to do with it.
+"""
+
+from app import email as email_mod
+
+_PW = "correct horse battery"
+
+
+def _signed_in(client, make_user, **kw):
+    """/api/me resolves its user through optional_current_user, which the as_user override does not
+    cover — so sign in for real and read the bootstrap payload the SPA actually gets."""
+    user = make_user(password=_PW, **kw)
+    assert (
+        client.post("/auth/password-login", json={"email": user.email, "password": _PW}).status_code
+        == 200
+    )
+    r = client.get("/api/me")
+    assert r.status_code == 200 and r.json()["authenticated"] is True
+    return r.json()
+
+
+def test_an_admin_is_told_when_email_is_not_configured(client, make_user, monkeypatch):
+    monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: False)
+
+    me = _signed_in(client, make_user, email="admin@example.com", role="admin")
+
+    assert me["email_configured"] is False
+
+
+def test_an_admin_sees_nothing_wrong_when_email_works(client, make_user, monkeypatch):
+    monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: True)
+
+    me = _signed_in(client, make_user, email="admin@example.com", role="admin")
+
+    assert me["email_configured"] is True
+
+
+def test_a_regular_user_is_never_warned_about_the_mail_setup(client, make_user, monkeypatch):
+    # Not their problem, and the flag must not become a way to probe the instance's configuration.
+    monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: False)
+
+    me = _signed_in(client, make_user, email="plain@example.com")
+
+    assert me["email_configured"] is True
+
+
+def test_the_flag_reuses_the_request_session(client, make_user, monkeypatch):
+    # /api/me is polled once a minute per open tab; reading the SMTP settings decrypts a Fernet
+    # value, so it must not also check out a second pooled connection each time.
+    seen: list[object] = []
+    monkeypatch.setattr(email_mod, "email_enabled", lambda db=None: seen.append(db) or True)
+
+    _signed_in(client, make_user, email="admin@example.com", role="admin")
+
+    assert seen and seen[0] is not None

backend/tests/test_ratelimit.py

@@ -0,0 +1,65 @@
+"""The sliding-window limiter behind /auth/register, password-login, password-reset and demo.
+
+Pure logic, no DB. `reset()` in particular is only ever called by a test fixture (conftest clears
+the module-level limiters between tests), so without a test here a refactor could turn it into a
+no-op and nothing would notice until an unrelated test started failing with a 429.
+"""
+
+from app import ratelimit
+from app.ratelimit import RateLimiter
+
+
+def test_allow_trips_at_the_cap_and_stays_tripped():
+    lim = RateLimiter(max_events=2, window_seconds=300)
+
+    assert lim.allow("ip") is True
+    assert lim.allow("ip") is True
+    assert lim.allow("ip") is False
+    assert lim.allow("ip") is False
+
+
+def test_hammering_while_blocked_does_not_push_the_window_forward(monkeypatch):
+    # A blocked attempt must not be recorded, otherwise someone who keeps retrying holds their own
+    # window open forever — an indefinite lockout for anyone sharing that IP. Only observable across
+    # the window boundary, so drive the clock: two attempts fill the cap, ten blocked retries land
+    # just before it expires, and the caller must still be let back in on the far side.
+    clock = {"t": 1000.0}
+    monkeypatch.setattr(ratelimit.time, "monotonic", lambda: clock["t"])
+    lim = RateLimiter(max_events=2, window_seconds=60)
+
+    assert lim.allow("ip") is True
+    assert lim.allow("ip") is True
+    for _ in range(10):
+        clock["t"] += 5  # still inside the window; every one of these is refused
+        assert lim.allow("ip") is False
+
+    clock["t"] = 1000.0 + 61  # past the window of the two attempts that actually counted
+    assert lim.allow("ip") is True
+
+
+def test_keys_are_independent():
+    lim = RateLimiter(max_events=1, window_seconds=300)
+
+    assert lim.allow("a") is True
+    assert lim.allow("a") is False
+    assert lim.allow("b") is True
+
+
+def test_reset_clears_every_key():
+    lim = RateLimiter(max_events=1, window_seconds=300)
+    lim.allow("a")
+    lim.allow("b")
+    assert lim.allow("a") is False
+
+    lim.reset()
+
+    assert lim.allow("a") is True
+    assert lim.allow("b") is True
+
+
+def test_expired_attempts_fall_out_of_the_window():
+    # A zero-length window means every previous attempt is already outside it.
+    lim = RateLimiter(max_events=1, window_seconds=0)
+
+    assert lim.allow("ip") is True
+    assert lim.allow("ip") is True

frontend/src/components/AdminUsers.tsx

@@ -3,10 +3,11 @@ import { qk } from "../lib/queryKeys";
 import { useTranslation } from "react-i18next";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { Ban, Check, RotateCcw, Shield, Trash2, UserPlus, X } from "lucide-react";
-import { api, type AdminUserRow, type Invite, type Me } from "../lib/api";
+import { api, HttpError, type AdminUserRow, type Invite, type Me } from "../lib/api";
 import { notify } from "../lib/notifications";
 import { ADMIN_USERS_TAB_KEY } from "../lib/adminUsersTab";
 import Tooltip from "./Tooltip";
+import InlineNotice from "./InlineNotice";
 import { Section } from "./ui/form";
 import { LoadingState, StateMessage } from "./QueryState";
 import { useConfirm } from "./ConfirmProvider";
@@ -266,6 +267,7 @@ function AdminInvites() {
   const { t } = useTranslation();
   const qc = useQueryClient();
   const confirm = useConfirm();
+  const me = useMe();
   const invites = useQuery({ queryKey: qk.adminInvites(), queryFn: () => api.adminInvites() });
   const [newEmail, setNewEmail] = useState("");
   const refresh = () => {
@@ -297,6 +299,45 @@ function AdminInvites() {
     });
     if (ok) deny.mutate(i.id);
   };
+  const remove = useMutation({
+    mutationFn: (id: number) => api.deleteInvite(id),
+    onSuccess: (d) => {
+      refresh();
+      // Removing the row is not always a revoke: is_allowed falls back to the env allow-lists, so
+      // for an address on those the person keeps access. Saying "removed" alone would mislead.
+      if (d.still_allowed_by_env)
+        notify({ level: "warning", message: t("settings.invites.deletedStillAllowed") });
+      else notify({ level: "success", message: t("settings.invites.deleted") });
+    },
+    onError: (e) => {
+      // A 409 means the list was stale — someone registered on that address since it loaded. Say
+      // what to do instead of a generic failure, and refetch so the row re-renders as read-only.
+      const conflict = e instanceof HttpError && e.status === 409;
+      notify({
+        level: "error",
+        message: t(
+          conflict ? "settings.invites.deleteHasAccount" : "settings.invites.deleteFailed",
+        ),
+      });
+      if (conflict) refresh();
+    },
+  });
+  const onDelete = async (i: Invite) => {
+    const ok = await confirm({
+      title: t("settings.invites.deleteTitle"),
+      // Removing the row is not a revoke when the address is also in the server's env allow-lists —
+      // say so while the admin can still change their mind, not in a toast after the fact.
+      message: t(
+        i.still_allowed_by_env
+          ? "settings.invites.deleteConfirmStillAllowed"
+          : "settings.invites.deleteConfirm",
+        { email: i.email },
+      ),
+      confirmLabel: t("settings.invites.delete"),
+      danger: true,
+    });
+    if (ok) remove.mutate(i.id);
+  };
   const add = useMutation({
     mutationFn: (email: string) => api.addInvite(email),
     onSuccess: (_d, email) => {
@@ -313,6 +354,9 @@ function AdminInvites() {
 
   return (
     <Section card title={t("settings.invites.title")}>
+      {!me.email_configured && (
+        <InlineNotice className="mb-3">{t("settings.invites.emailOff")}</InlineNotice>
+      )}
       {invites.isError && !invites.data ? (
         <StateMessage tone="error" onRetry={() => invites.refetch()}>
           {t("common.loadError")}
@@ -329,7 +373,8 @@ function AdminInvites() {
               inv={i}
               onApprove={() => approve.mutate({ id: i.id, email: i.email })}
               onDeny={() => onDeny(i)}
-              busy={approve.isPending || deny.isPending}
+              onDelete={() => onDelete(i)}
+              busy={approve.isPending || deny.isPending || remove.isPending}
             />
           ))}
         </div>
@@ -364,11 +409,38 @@ function AdminInvites() {
           </summary>
           <div className="mt-2 space-y-1 text-xs text-muted">
             {decided.map((i) => (
-              <div key={i.id} className="flex items-center justify-between gap-2">
-                <span className="truncate">{i.email}</span>
+              <div key={i.id} className="flex items-center gap-2">
+                <span className="truncate flex-1">{i.email}</span>
                 <span className={i.status === "approved" ? "text-accent" : "text-danger"}>
                   {i.status}
                 </span>
+                {/* An entry with an account behind it stays read-only: deleting it would revoke that
+                    user's access, since is_allowed reads this row. Delete the user instead. */}
+                {i.has_account ? (
+                  // `disabled` would drop it from the tab order AND suppress the title, so the
+                  // reason reached nobody — same call as the Playlists drag handle.
+                  <button
+                    type="button"
+                    aria-disabled
+                    onClick={(e) => e.preventDefault()}
+                    title={t("settings.invites.deleteHasAccount")}
+                    aria-label={t("settings.invites.deleteHasAccount")}
+                    className="shrink-0 p-1 text-muted/50 cursor-not-allowed"
+                  >
+                    <Trash2 className="w-3.5 h-3.5" />
+                  </button>
+                ) : (
+                  <Tooltip hint={t("settings.invites.deleteHint")}>
+                    <button
+                      onClick={() => onDelete(i)}
+                      disabled={remove.isPending}
+                      className="shrink-0 p-1 rounded-md text-muted hover:text-danger disabled:opacity-50 transition"
+                      aria-label={t("settings.invites.deleteLabel", { email: i.email })}
+                    >
+                      <Trash2 className="w-3.5 h-3.5" />
+                    </button>
+                  </Tooltip>
+                )}
               </div>
             ))}
           </div>
@@ -506,11 +578,13 @@ function InviteRow({
   inv,
   onApprove,
   onDeny,
+  onDelete,
   busy,
 }: {
   inv: Invite;
   onApprove: () => void;
   onDeny: () => void;
+  onDelete: () => void;
   busy: boolean;
 }) {
   const { t } = useTranslation();
@@ -546,6 +620,34 @@ function InviteRow({
           <X className="w-4 h-4" />
         </button>
       </Tooltip>
+      {/* Deny records a decision and keeps the row; delete forgets the address. Once an account
+          exists for it the row is that account's approval gate, so it is managed from Users & roles
+          instead — shown as a disabled control rather than omitted, or the admin sees a row that is
+          silently missing a button their other rows have. */}
+      {inv.has_account ? (
+        // aria-disabled, not `disabled`: the reason has to stay reachable by keyboard.
+        <button
+          type="button"
+          aria-disabled
+          onClick={(e) => e.preventDefault()}
+          title={t("settings.invites.deleteHasAccount")}
+          aria-label={t("settings.invites.deleteHasAccount")}
+          className="shrink-0 p-1.5 rounded-lg border border-border/50 text-muted/50 cursor-not-allowed"
+        >
+          <Trash2 className="w-4 h-4" />
+        </button>
+      ) : (
+        <Tooltip hint={t("settings.invites.deleteHint")}>
+          <button
+            onClick={onDelete}
+            disabled={busy}
+            className="shrink-0 p-1.5 rounded-lg border border-border text-muted hover:text-danger disabled:opacity-50 transition"
+            aria-label={t("settings.invites.deleteLabel", { email: inv.email })}
+          >
+            <Trash2 className="w-4 h-4" />
+          </button>
+        </Tooltip>
+      )}
     </div>
   );
 }

frontend/src/components/ConfigPanel.tsx

@@ -6,6 +6,8 @@ import { Plug, RotateCcw, Send } from "lucide-react";
 import { api, type ConfigItem, type PlexTestResult } from "../lib/api";
 import { notify } from "../lib/notifications";
 import Tooltip from "./Tooltip";
+import InlineNotice from "./InlineNotice";
+import { useMe } from "../lib/useMe";
 import Tabs, { usePersistedTab } from "./Tabs";
 import { LoadingState, StateMessage } from "./QueryState";
 import { PageToolbar } from "./PageShell";
@@ -35,6 +37,7 @@ const GROUP_ORDER = [
 export default function ConfigPanel() {
   const { t } = useTranslation();
   const qc = useQueryClient();
+  const me = useMe();
   const q = useQuery({ queryKey: qk.adminConfig(), queryFn: api.adminConfig });
   const data = q.data;
 
@@ -100,6 +103,10 @@ export default function ConfigPanel() {
         }
       }
       await qc.invalidateQueries({ queryKey: qk.adminConfig() });
+      // The email-not-configured notice reads me.email_configured, which is otherwise only
+      // refetched on its own 60s interval — without this it keeps warning about fields the admin
+      // has just filled in, which reads as the save not having taken.
+      await qc.invalidateQueries({ queryKey: qk.me() });
       setReseedToken((n) => n + 1); // re-seed the draft from the saved server state
       setSaveState("saved");
       setTimeout(() => setSaveState((s) => (s === "saved" ? "idle" : s)), 2500);
@@ -204,7 +211,11 @@ export default function ConfigPanel() {
             </div>
 
             {activeGroup === "email" && (
-              <div className="mt-3 pt-3 border-t border-border/60">
+              <div className="mt-3 pt-3 border-t border-border/60 space-y-3">
+                {/* The one place an operator can see that mail is off. Sending is fail-soft, so a
+                    half-filled config costs verification links, resets and access-request notices
+                    with no error anywhere — say so next to the fields that fix it. */}
+                {!me.email_configured && <InlineNotice>{t("config.emailOff")}</InlineNotice>}
                 <Tooltip hint={t("config.testEmailHint")}>
                   <button
                     onClick={() => testEmail.mutate()}

frontend/src/components/InlineNotice.tsx

@@ -0,0 +1,26 @@
+import type { ReactNode } from "react";
+import type { LucideIcon } from "lucide-react";
+import { AlertTriangle } from "lucide-react";
+
+// An in-flow warning that sits INSIDE a panel, next to the thing it is about — as opposed to
+// Banner, which is the full-bleed top-of-app bar (border-b, app chrome) and looks wrong nested in a
+// card. Same warn tokens as Banner's warning tone so the two read as one system.
+export default function InlineNotice({
+  children,
+  icon: Icon = AlertTriangle,
+  className = "",
+}: {
+  children: ReactNode;
+  icon?: LucideIcon;
+  className?: string;
+}) {
+  return (
+    <div
+      role="status"
+      className={`flex items-start gap-2 rounded-xl border border-warn/30 bg-warn/15 px-3 py-2 text-sm text-fg ${className}`}
+    >
+      <Icon className="w-4 h-4 shrink-0 mt-0.5 text-warn" aria-hidden />
+      <span className="min-w-0">{children}</span>
+    </div>
+  );
+}

frontend/src/components/NotificationsPanel.tsx

@@ -243,6 +243,7 @@ function NotificationRow({
   const isMaintenance = n.type === "maintenance" && typeof n.data?.count === "number";
   const isScheduler = n.type === "scheduler" && typeof n.data?.job_id === "string";
   const isDownloadDone = n.type === "download_done";
+  const isEmailUndelivered = n.type === "email_undelivered" && typeof n.data?.reason === "string";
   let title = n.title;
   let body = n.body;
   if (isMaintenance) {
@@ -258,6 +259,17 @@ function NotificationRow({
       job,
     });
     body = d.summary || n.body;
+  } else if (isEmailUndelivered) {
+    // Email is fail-soft: a drop leaves no error anywhere else, so this notice IS the trace. Name
+    // the message that was lost, since that is what tells the operator what their users didn't get.
+    const d = n.data as { reason: string; subject?: string };
+    title = t("inbox.emailUndelivered.title");
+    body = t(
+      d.reason === "not_configured"
+        ? "inbox.emailUndelivered.notConfigured"
+        : "inbox.emailUndelivered.sendFailed",
+      { subject: d.subject || n.body || "" },
+    );
   } else if (isDownloadDone) {
     // "Download ready" / "Edit ready" per the producer's kind, with the video's title as the body
     // (shipped in data.title). Same notification type; the copy differs so an edit isn't mislabelled.

frontend/src/components/Welcome.tsx

@@ -1,4 +1,5 @@
 import { useEffect, useRef, useState } from "react";
+import { useHistorySubview, type SubviewUrl } from "../lib/history";
 import { useTranslation } from "react-i18next";
 import {
   ArrowRight,
@@ -27,7 +28,19 @@ import { inputCls } from "./ui/form";
 const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
 const PASSWORD_MIN = 10;
 
-type Mode = "signin" | "register" | "forgot" | "reset" | "resend";
+export type Mode = "signin" | "register" | "forgot" | "reset" | "resend";
+
+// The card's sub-views are real history entries, so browser/mouse Back leaves one the way it leaves
+// any other page — they used to be plain state, and Back silently changed only the address bar.
+// "signin" is the root (no param) and "reset" is deliberately NOT mirrored: that view is only
+// reachable with the one-time token from the #reset fragment, so a bookmarked ?m=reset would open a
+// form that cannot submit.
+export const MODE_URL: SubviewUrl<Mode> = {
+  key: "m",
+  encode: (m: Mode) => (m === "signin" || m === "reset" ? null : m),
+  decode: (raw: string) =>
+    raw === "register" || raw === "forgot" || raw === "resend" ? (raw as Mode) : null,
+};
 
 // Per-mode i18n keys for the card title and the submit button. A flat map (vs nested ternaries)
 // keeps adding a new mode a one-line change and makes a missing key a compile error.
@@ -296,7 +309,9 @@ function AuthCard() {
   // stay in the query string.
   const [params] = useState(() => new URLSearchParams(window.location.search));
   const [hashParams] = useState(() => new URLSearchParams(window.location.hash.replace(/^#/, "")));
-  const resetToken = hashParams.get("reset");
+  // State, not a const: once the token has been spent the reset view must stop being the card's
+  // root, or a Back from the "password changed" screen lands on a form whose token is already used.
+  const [resetToken, setResetToken] = useState<string | null>(() => hashParams.get("reset"));
   const verifyToken = hashParams.get("verify"); // raw token → POST to confirm (new flow)
   const bounced = params.get("access"); // Google denied → "requested" | "denied"
   const deleted = params.get("deleted"); // self-service account deletion just completed
@@ -328,7 +343,10 @@ function AuthCard() {
       .catch(() => setVerify("invalid"));
   }, [verifyToken]);
 
-  const [mode, setMode] = useState<Mode>(resetToken ? "reset" : "signin");
+  const { view: mode, open: setMode } = useHistorySubview<Mode>(
+    resetToken ? "reset" : "signin",
+    MODE_URL,
+  );
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
   const [busy, setBusy] = useState(false);
@@ -344,6 +362,13 @@ function AuthCard() {
       .catch(() => {});
   }, []);
   const [done, setDone] = useState<string>(""); // success/info message replacing the form
+  // `done` and `error` belong to the view that produced them, and the render is `done ? msg : form`
+  // — without this, Back out of a submitted form would show the old success message under the
+  // previous view's title. Clearing on view change covers both Back/Forward and the mode links.
+  useEffect(() => {
+    setDone("");
+    setError("");
+  }, [mode]);
 
   // Explicit demo entry (replaces the old hidden probe): a labelled email field, still gated
   // by the demo whitelist server-side.
@@ -400,6 +425,7 @@ function AuthCard() {
         setDone(t("welcome.auth.resendDone"));
       } else if (mode === "reset") {
         await api.confirmPasswordReset(resetToken ?? "", password);
+        setResetToken(null); // single-use: the reset view is no longer a place to come back to
         setDone(t("welcome.auth.resetDone"));
       }
     } catch (err) {

frontend/src/components/adminInvites.dom.test.tsx

@@ -0,0 +1,216 @@
+// @vitest-environment jsdom
+//
+// The Access-requests panel's delete affordance and its three outcomes. The control's whole point is
+// that it explains itself: an entry backed by an account keeps a focusable, labelled control instead
+// of quietly missing one, and an address the server's env still allow-lists gets a warning BEFORE the
+// irreversible click, not a correction after it.
+//
+// i18n is a key-passthrough so assertions read stable keys; the API and the confirm/notify
+// singletons are stubbed so the panel can be driven without a server.
+import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
+import { render, screen, cleanup, waitFor, fireEvent } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({
+      // Echo the interpolation too, so a message that forgets its {{email}} is visible in the test.
+      t: (key: string, vars?: Record<string, unknown>) =>
+        vars?.email ? `${key}:${String(vars.email)}` : key,
+      i18n: { language: "en" },
+    }),
+  };
+});
+
+type ConfirmOpts = { title?: string; message?: string; confirmLabel?: string; danger?: boolean };
+const confirmMock = vi.fn(async (_opts: ConfirmOpts) => true);
+vi.mock("./ConfirmProvider", () => ({
+  useConfirm: () => confirmMock,
+  ConfirmProvider: ({ children }: { children: React.ReactNode }) => children,
+}));
+
+const notifyMock = vi.fn();
+vi.mock("../lib/notifications", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/notifications")>();
+  return { ...actual, notify: (...a: unknown[]) => notifyMock(...a) };
+});
+
+const meMock = { pending_invites: 0, email_configured: true, id: 1, role: "admin" };
+vi.mock("../lib/useMe", () => ({ useMe: () => meMock }));
+
+// The tab strip is rendered into an app-level toolbar slot that does not exist here, so pin the
+// active tab directly — this file is about the Access-requests panel, not the tab chrome.
+vi.mock("./Tabs", () => ({
+  default: () => null,
+  usePersistedTab: () => ["access", () => {}],
+}));
+
+const listMock = vi.fn();
+const deleteMock = vi.fn();
+vi.mock("../lib/api", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/api")>();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      adminInvites: () => listMock(),
+      deleteInvite: (id: number) => deleteMock(id),
+    },
+  };
+});
+
+import { HttpError } from "../lib/api";
+import AdminUsers from "./AdminUsers";
+
+const invite = (over: Partial<Record<string, unknown>> = {}) => ({
+  id: 1,
+  email: "asker@example.com",
+  status: "pending",
+  note: null,
+  requested_at: null,
+  decided_at: null,
+  decided_by: null,
+  has_account: false,
+  still_allowed_by_env: false,
+  ...over,
+});
+
+const renderPanel = () => {
+  const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  return render(
+    <QueryClientProvider client={qc}>
+      <AdminUsers />
+    </QueryClientProvider>,
+  );
+};
+
+beforeEach(() => {
+  confirmMock.mockClear().mockResolvedValue(true);
+  notifyMock.mockClear();
+  deleteMock.mockReset().mockResolvedValue({ deleted: 1, still_allowed_by_env: false });
+  listMock.mockReset().mockResolvedValue([invite()]);
+  meMock.email_configured = true;
+});
+afterEach(cleanup);
+
+const openAccessTab = async () => {
+  await screen.findByText("settings.invites.title");
+};
+
+describe("Access requests — the delete affordance", () => {
+  it("offers a labelled delete on an entry with no account behind it", async () => {
+    renderPanel();
+    await openAccessTab();
+
+    const btn = await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com");
+    expect(btn.getAttribute("aria-disabled")).toBeNull();
+  });
+
+  it("keeps the control present and focusable — not missing — when the address has an account", async () => {
+    listMock.mockResolvedValue([invite({ has_account: true })]);
+    renderPanel();
+    await openAccessTab();
+
+    const btn = await screen.findByLabelText("settings.invites.deleteHasAccount");
+    // aria-disabled, not `disabled`: a disabled button leaves the tab order and takes its
+    // explanation with it, which is the whole reason the control is shown at all.
+    expect(btn.getAttribute("aria-disabled")).toBe("true");
+    expect((btn as HTMLButtonElement).disabled).toBe(false);
+    expect(btn.getAttribute("title")).toBe("settings.invites.deleteHasAccount");
+    expect(screen.queryByLabelText(/deleteLabel/)).toBeNull();
+  });
+
+  it("keeps the same control on the previously-decided list, where the case is commonest", async () => {
+    // The affordance exists twice — the pending rows and the collapsed "decided" list — and an
+    // approved address that has since registered lands in the second one. Both must behave alike.
+    listMock.mockResolvedValue([invite({ status: "approved", has_account: true })]);
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByText(/settings\.invites\.decided/));
+    const btn = await screen.findByLabelText("settings.invites.deleteHasAccount");
+    expect(btn.getAttribute("aria-disabled")).toBe("true");
+    expect((btn as HTMLButtonElement).disabled).toBe(false);
+  });
+
+  it("offers a working delete on a decided entry with no account", async () => {
+    listMock.mockResolvedValue([invite({ status: "denied" })]);
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByText(/settings\.invites\.decided/));
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    await waitFor(() => expect(deleteMock).toHaveBeenCalledWith(1));
+  });
+
+  it("warns in the confirmation — before the click is irreversible — when the env still allows it", async () => {
+    listMock.mockResolvedValue([invite({ still_allowed_by_env: true })]);
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    expect(confirmMock).toHaveBeenCalledTimes(1);
+    expect(confirmMock.mock.calls[0]![0]).toMatchObject({
+      message: "settings.invites.deleteConfirmStillAllowed:asker@example.com",
+      danger: true,
+    });
+  });
+
+  it("uses the plain confirmation otherwise", async () => {
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    expect(confirmMock.mock.calls[0]![0]).toMatchObject({
+      message: "settings.invites.deleteConfirm:asker@example.com",
+    });
+  });
+
+  it("says the entry kept its access when the server reports the env allow-list", async () => {
+    deleteMock.mockResolvedValue({ deleted: 1, still_allowed_by_env: true });
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    await waitFor(() =>
+      expect(notifyMock).toHaveBeenCalledWith({
+        level: "warning",
+        message: "settings.invites.deletedStillAllowed",
+      }),
+    );
+  });
+
+  it("turns a 409 into the actionable reason rather than a generic failure", async () => {
+    // The stale-list case: someone registered on the address after the page loaded.
+    deleteMock.mockRejectedValue(new HttpError(409, "That address already has an account"));
+    renderPanel();
+    await openAccessTab();
+
+    fireEvent.click(await screen.findByLabelText("settings.invites.deleteLabel:asker@example.com"));
+
+    await waitFor(() =>
+      expect(notifyMock).toHaveBeenCalledWith({
+        level: "error",
+        message: "settings.invites.deleteHasAccount",
+      }),
+    );
+  });
+
+  it("shows the mail-is-off warning only while email is unconfigured", async () => {
+    renderPanel();
+    await openAccessTab();
+    expect(screen.queryByText("settings.invites.emailOff")).toBeNull();
+    cleanup();
+
+    meMock.email_configured = false;
+    renderPanel();
+    await openAccessTab();
+    expect(await screen.findByText("settings.invites.emailOff")).toBeTruthy();
+  });
+});

frontend/src/components/welcomeMode.dom.test.ts

@@ -0,0 +1,93 @@
+// @vitest-environment jsdom
+//
+// The login card's sub-views (Create an account / Forgot password / Didn't get the email) used to be
+// plain React state: clicking one changed nothing in history, so Back popped to whatever entry came
+// before the card and the address bar moved while the form on screen did not. They now ride
+// useHistorySubview, and this pins the wiring decisions that are specific to THIS card — which modes
+// are mirrored, and that Back walks the views. The hook's own mechanics live in
+// history.subview.dom.test.ts.
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { renderHook, act } from "@testing-library/react";
+
+import { useHistorySubview } from "../lib/history";
+import { MODE_URL, type Mode } from "./Welcome";
+
+const render = (root: Mode = "signin") => renderHook(() => useHistorySubview<Mode>(root, MODE_URL));
+
+// jsdom's history.back() is asynchronous and does not rewind location, so — as in
+// history.subview.dom.test.ts — a Back is simulated by landing on the target entry and firing
+// popstate. `open()` pushing a REAL entry is asserted separately via history.length.
+const popTo = (search: string, state: unknown = null) =>
+  act(() => {
+    window.history.replaceState(state, "", search || "/");
+    window.dispatchEvent(new PopStateEvent("popstate", { state }));
+  });
+
+// jsdom keeps one history across a file; land on a clean root entry before each test.
+beforeEach(() => window.history.replaceState(null, "", "/"));
+afterEach(() => window.history.replaceState(null, "", "/"));
+
+describe("login card mode ↔ URL", () => {
+  it("mirrors the three link-reachable views and leaves sign-in as the bare root", () => {
+    expect(MODE_URL.encode("signin")).toBeNull();
+    expect(MODE_URL.encode("register")).toBe("register");
+    expect(MODE_URL.encode("forgot")).toBe("forgot");
+    expect(MODE_URL.encode("resend")).toBe("resend");
+  });
+
+  it("never mirrors the reset view", () => {
+    // Reset is only reachable with the one-time token from the #reset fragment. Mirroring it would
+    // hand out a bookmark that opens a password form with no token behind it.
+    expect(MODE_URL.encode("reset")).toBeNull();
+    expect(MODE_URL.decode("reset")).toBeNull();
+  });
+
+  it("decodes only real views, so a hand-typed ?m= falls back to sign-in", () => {
+    expect(MODE_URL.decode("register")).toBe("register");
+    expect(MODE_URL.decode("")).toBeNull();
+    expect(MODE_URL.decode("nonsense")).toBeNull();
+  });
+
+  it("opening a view pushes a real history entry, and landing back on the root restores sign-in", () => {
+    const { result } = render();
+    const entries = window.history.length;
+    expect(result.current.view).toBe("signin");
+
+    act(() => result.current.open("forgot"));
+
+    // The whole point: a Back has somewhere to go. Before this the click changed state only.
+    expect(window.history.length).toBe(entries + 1);
+    expect(result.current.view).toBe("forgot");
+    expect(new URLSearchParams(window.location.search).get("m")).toBe("forgot");
+
+    popTo("/");
+
+    expect(result.current.view).toBe("signin");
+  });
+
+  it("walks back one view at a time when the user hops between them", () => {
+    const { result } = render();
+    const entries = window.history.length;
+    act(() => result.current.open("register"));
+    act(() => result.current.open("forgot"));
+    expect(window.history.length).toBe(entries + 2); // one entry per view, not one for the lot
+
+    popTo("/?m=register", { _sub: "register" });
+    expect(result.current.view).toBe("register");
+
+    popTo("/");
+    expect(result.current.view).toBe("signin");
+  });
+
+  it("opens on the reset view when a reset token seeded it, without putting it in the URL", () => {
+    const { result } = render("reset");
+    expect(result.current.view).toBe("reset");
+    expect(window.location.search).toBe("");
+  });
+
+  it("restores a bookmarked view from the URL alone", () => {
+    window.history.replaceState(null, "", "/?m=resend");
+    const { result } = render();
+    expect(result.current.view).toBe("resend");
+  });
+});

frontend/src/components/welcomeMode.render.dom.test.tsx

@@ -0,0 +1,78 @@
+// @vitest-environment jsdom
+//
+// The sign-in card's sub-views as the user meets them: clicking a link must leave a history entry,
+// so Back — including the mouse's back button — returns to the previous view. They used to be plain
+// React state, and Back moved only the address bar while the form on screen stayed put. The
+// encode/decode table lives in welcomeMode.dom.test.ts; this file renders the real card, so a revert
+// to useState fails here.
+//
+// i18n is mocked to a key-passthrough so queries read stable keys, and the API module is stubbed —
+// the card probes /auth/config on mount and must not reach the network.
+import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
+import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({ t: (key: string) => key, i18n: { language: "en" } }),
+  };
+});
+
+vi.mock("../lib/api", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/api")>();
+  return {
+    ...actual,
+    api: { ...actual.api, authConfig: () => Promise.resolve({ google_enabled: false }) },
+  };
+});
+
+import Welcome from "./Welcome";
+
+const back = () =>
+  act(() => {
+    // jsdom's history.back() is async and does not rewind location, so land on the previous entry
+    // the way the browser would and fire popstate. The push itself is asserted via history.length.
+    window.history.replaceState(null, "", "/");
+    window.dispatchEvent(new PopStateEvent("popstate", { state: null }));
+  });
+
+beforeEach(() => window.history.replaceState(null, "", "/"));
+afterEach(() => {
+  cleanup();
+  window.history.replaceState(null, "", "/");
+});
+
+describe("sign-in card sub-views and the Back button", () => {
+  it("opens Forgot password as a history entry and comes back to sign in", async () => {
+    render(<Welcome />);
+    expect(await screen.findByText("welcome.auth.signinTitle")).toBeTruthy();
+    const entries = window.history.length;
+
+    fireEvent.click(screen.getByText("welcome.auth.forgotLink"));
+
+    expect(screen.getByText("welcome.auth.forgotTitle")).toBeTruthy();
+    expect(window.history.length).toBe(entries + 1); // a Back now has somewhere to go
+    expect(new URLSearchParams(window.location.search).get("m")).toBe("forgot");
+
+    back();
+
+    expect(screen.getByText("welcome.auth.signinTitle")).toBeTruthy();
+    expect(screen.queryByText("welcome.auth.forgotTitle")).toBeNull();
+  });
+
+  it("does the same for Create an account and the verification-email link", async () => {
+    render(<Welcome />);
+    await screen.findByText("welcome.auth.signinTitle");
+
+    fireEvent.click(screen.getByText("welcome.auth.createLink"));
+    expect(screen.getByText("welcome.auth.createTitle")).toBeTruthy();
+    back();
+    expect(screen.getByText("welcome.auth.signinTitle")).toBeTruthy();
+
+    fireEvent.click(screen.getByText("welcome.auth.resendLink"));
+    expect(screen.getByText("welcome.auth.resendTitle")).toBeTruthy();
+    back();
+    expect(screen.getByText("welcome.auth.signinTitle")).toBeTruthy();
+  });
+});

frontend/src/i18n/locales/en/auditActions.json

@@ -19,5 +19,6 @@
   "job_run": "Scheduler job run",
   "audit_clear": "Audit log cleared",
   "download_credential_set": "Download cookies set",
-  "download_credential_delete": "Download cookies removed"
+  "download_credential_delete": "Download cookies removed",
+  "invite_delete": "Whitelist entry deleted"
 }

frontend/src/i18n/locales/en/config.json

@@ -216,5 +216,6 @@
   "plexPickLibraries": "Libraries to expose:",
   "plexPickHint": "Unchecking all is the same as exposing every library. Remember to Save.",
   "plexMovies": "Movies",
-  "plexShows": "TV Shows"
+  "plexShows": "TV Shows",
+  "emailOff": "Email sending is not configured — Siftlode silently skips every message: verification links, password resets and access-request notices. Fill in the fields above, then send a test."
 }

frontend/src/i18n/locales/en/inbox.json

@@ -28,5 +28,10 @@
   "jobDone": {
     "titleOk": "{{job}} finished",
     "titleError": "{{job}} failed"
+  },
+  "emailUndelivered": {
+    "title": "Email is not going out",
+    "notConfigured": "SMTP is not configured, so nothing this instance sends is being delivered — verification links, password resets and access requests alike. One of them was “{{subject}}”. Set it up under Configuration → Email / SMTP.",
+    "sendFailed": "Sending failed, so messages are not being delivered. One of them was “{{subject}}”. Check Configuration → Email / SMTP and send a test; the server log has the reason."
   }
 }

frontend/src/i18n/locales/en/settings.json

@@ -164,6 +164,17 @@
     "deny": "Deny",
     "denied": "Request denied",
     "denyTitle": "Deny access request?",
-    "denyConfirm": "Deny the access request from {{email}}?"
+    "denyConfirm": "Deny the access request from {{email}}?",
+    "delete": "Delete",
+    "deleteLabel": "Delete {{email}} from the whitelist",
+    "deleteHint": "Forget this address. A later request from it comes back as a new one.",
+    "deleteTitle": "Delete whitelist entry?",
+    "deleteConfirm": "Forget {{email}}? Siftlode drops the record, so anyone at that address would have to ask again.",
+    "deleteHasAccount": "Someone has registered on this address — manage it under Users & roles, where deleting the account removes this entry too.",
+    "deleted": "Whitelist entry removed.",
+    "deleteFailed": "Could not remove the entry.",
+    "emailOff": "Email sending is not configured, so nobody gets a verification link and no request reaches you by email. Watch this list and your inbox instead, and fix it under Configuration → Email / SMTP.",
+    "deletedStillAllowed": "Entry removed, but this address is still allow-listed by the server's configuration, so it keeps access. Remove it from ALLOWED_EMAILS / ADMIN_EMAILS to change that.",
+    "deleteConfirmStillAllowed": "Forget {{email}}? Careful: this address is also allow-listed in the server's configuration (ALLOWED_EMAILS / ADMIN_EMAILS), so removing this row will NOT take its access away — and an ADMIN_EMAILS address is made an admin again on its next Google sign-in."
   }
 }

frontend/src/i18n/locales/hu/auditActions.json

@@ -19,5 +19,6 @@
   "job_run": "Ütemező job lefutott",
   "audit_clear": "Napló ürítve",
   "download_credential_set": "Letöltési cookie-k beállítva",
-  "download_credential_delete": "Letöltési cookie-k eltávolítva"
+  "download_credential_delete": "Letöltési cookie-k eltávolítva",
+  "invite_delete": "Whitelista-bejegyzés törölve"
 }

frontend/src/i18n/locales/hu/config.json

@@ -216,5 +216,6 @@
   "plexPickLibraries": "Megjelenítendő könyvtárak:",
   "plexPickHint": "Ha egyiket sem jelölöd be, az az összes könyvtár megjelenítésével egyenértékű. Ne feledj menteni.",
   "plexMovies": "Filmek",
-  "plexShows": "Sorozatok"
+  "plexShows": "Sorozatok",
+  "emailOff": "Az e-mail-küldés nincs beállítva — a Siftlode némán kihagy minden üzenetet: megerősítő linkeket, jelszó-visszaállításokat és hozzáférés-kérés értesítőket. Töltsd ki a fenti mezőket, majd küldj tesztet."
 }

frontend/src/i18n/locales/hu/inbox.json

@@ -28,5 +28,10 @@
   "jobDone": {
     "titleOk": "{{job}} kész",
     "titleError": "{{job}} hibázott"
+  },
+  "emailUndelivered": {
+    "title": "Nem megy ki e-mail",
+    "notConfigured": "Az SMTP nincs beállítva, így semmi nem kézbesíthető, amit ez a példány küldene — megerősítő linkek, jelszó-visszaállítások és hozzáférés-kérelmek egyaránt. Az egyik ilyen: „{{subject}}”. Állítsd be a Konfiguráció → E-mail / SMTP fülön.",
+    "sendFailed": "A küldés nem sikerült, így az üzenetek nem kézbesíthetők. Az egyik ilyen: „{{subject}}”. Nézd meg a Konfiguráció → E-mail / SMTP fület, és küldj tesztet; az okot a szerver naplója tartalmazza."
   }
 }

frontend/src/i18n/locales/hu/settings.json

@@ -164,6 +164,17 @@
     "deny": "Elutasítás",
     "denied": "Kérelem elutasítva",
     "denyTitle": "Elutasítod a hozzáférési kérelmet?",
-    "denyConfirm": "Elutasítod {{email}} hozzáférési kérelmét?"
+    "denyConfirm": "Elutasítod {{email}} hozzáférési kérelmét?",
+    "delete": "Törlés",
+    "deleteLabel": "{{email}} törlése a whitelistáról",
+    "deleteHint": "A cím elfelejtése. Egy későbbi kérelme új kérelemként jelenik meg.",
+    "deleteTitle": "Törlöd a whitelista-bejegyzést?",
+    "deleteConfirm": "Elfelejted {{email}} címet? A Siftlode eldobja a bejegyzést, így az adott címről újra kérelmezni kell.",
+    "deleteHasAccount": "Erre a címre már regisztrált valaki — a Felhasználók és szerepek fülön kezelhető, ahol a fiók törlése ezt a bejegyzést is eltávolítja.",
+    "deleted": "Whitelista-bejegyzés eltávolítva.",
+    "deleteFailed": "A bejegyzést nem sikerült eltávolítani.",
+    "emailOff": "Az e-mail-küldés nincs beállítva, így senki nem kap megerősítő linket, és e-mailben egy kérelem sem jut el hozzád. Ezt a listát és az értesítéseidet figyeld helyette, a javítás pedig a Konfiguráció → E-mail / SMTP fülön van.",
+    "deletedStillAllowed": "A bejegyzés törölve, de ezt a címet a szerver konfigurációja továbbra is engedélyezi, tehát megmarad a hozzáférése. Vedd ki az ALLOWED_EMAILS / ADMIN_EMAILS listából, ha ezen változtatnál.",
+    "deleteConfirmStillAllowed": "Elfelejted {{email}} címet? Figyelem: ezt a címet a szerver konfigurációja is engedélyezi (ALLOWED_EMAILS / ADMIN_EMAILS), így a bejegyzés törlése NEM veszi el a hozzáférését — sőt egy ADMIN_EMAILS cím a következő Google-belépéskor újra adminná válik."
   }
 }

frontend/src/lib/api/account.ts

@@ -16,6 +16,8 @@ export interface Me {
   can_read: boolean;
   can_write: boolean;
   pending_invites: number;
+  /** Admin-only: false when SMTP is incomplete, so every outbound message is silently skipped. */
+  email_configured: boolean;
   preferences: Record<string, unknown>;
 }
 

frontend/src/lib/api/admin.ts

@@ -19,6 +19,12 @@ export interface Invite {
   requested_at: string | null;
   decided_at: string | null;
   decided_by: string | null;
+  /** An account already exists for this address, so the entry can't be deleted from here — deleting
+   *  it would revoke that user's access (is_allowed reads this row). Delete the user instead. */
+  has_account: boolean;
+  /** The address stays allow-listed by the server's env ALLOWED_EMAILS / ADMIN_EMAILS, so removing
+   *  this row would NOT take access away. The delete confirmation says so. */
+  still_allowed_by_env: boolean;
 }
 
 // Admin Configuration page: one DB-overridable setting (registry entry on the backend).
@@ -169,4 +175,10 @@ export const adminApi = {
   denyInvite: (id: number) => req(`/api/admin/invites/${id}/deny`, { method: "POST" }),
   addInvite: (email: string) =>
     req("/api/admin/invites", { method: "POST", body: JSON.stringify({ email }) }),
+  /** `still_allowed_by_env` is true when the address stays allow-listed by the server's env
+   *  ALLOWED_EMAILS / ADMIN_EMAILS, i.e. removing the row did not actually revoke access. */
+  // quiet: a 409 here ("that address has an account") is a case the UI handles with a translated
+  // toast; without this the shared handler ALSO raises the server's English detail as a modal.
+  deleteInvite: (id: number): Promise<{ deleted: number; still_allowed_by_env: boolean }> =>
+    req(`/api/admin/invites/${id}`, { method: "DELETE" }, { quiet: true }),
 };

frontend/src/lib/releaseNotes.ts

@@ -14,6 +14,39 @@ export interface ReleaseEntry {
 }
 
 export const RELEASE_NOTES: ReleaseEntry[] = [
+  {
+    version: "0.78.6",
+    date: "2026-09-01",
+    summary:
+      "Admins can delete a whitelist entry, and an instance that cannot send email finally says so — in the inbox when a message is dropped, and on the screens where it matters.",
+    features: [
+      "Delete an entry under Users → Access requests: an address you whitelisted earlier, or a request nobody has acted on. Deny records your decision and keeps the record; delete forgets the address, and a later request from it arrives as a new one. Entries that already have an account behind them show the control disabled — that row is the account's approval gate, so it is managed from Users & roles, where deleting the account removes the entry too. If the address is also allow-listed in the server's configuration, the confirmation warns you before you commit, because then removing the entry does not actually take access away.",
+      "When a message cannot go out, every admin gets it in their inbox, naming one of the messages that were lost — an access request, a verification link, a password reset — so you know what your users did not get. Sending is deliberately fail-soft so a mail problem never breaks sign-up, but that used to mean it left no trace anywhere. Throttled to one notice an hour, so a dead relay cannot bury the inbox; the log keeps the full list.",
+      "A standing warning where it can be acted on: on Configuration → Email / SMTP while the settings are incomplete, and above the access-request list, where it explains that nobody is getting a verification link and no request will reach you by email.",
+    ],
+    fixes: [
+      "On the sign-in card, Create an account / Forgot password / Didn't get the verification email are proper history steps now, so Back — including the mouse's back button — returns to the previous view. It used to move the address bar and leave the form on screen unchanged.",
+    ],
+    chores: [
+      "DELETE /api/admin/invites/{id}, refused with 409 while a User row exists for the address, whatever its state — orphaning an account from its invite would leave someone who can neither sign in nor be approved. The list carries has_account so the UI disables rather than hides the control, and the response reports still_allowed_by_env, since is_allowed falls back to ALLOWED_EMAILS / ADMIN_EMAILS once no row exists. Audited as invite_delete.",
+      "email._send() records an email_undelivered notification for every active admin on both the not-configured and the send-failed path, opening its own session and swallowing its own errors so the alert can never become a new way to break a send; a failed or unnecessary write releases the throttle rather than costing the next hour. /api/me carries email_configured for admins, read through the request's own session. The login card's mode moved to useHistorySubview, covered by a render test that fails if it goes back to useState, and the per-test rate-limiter reset now sweeps every loaded app.* module instead of a hand-kept list.",
+    ],
+  },
+  {
+    version: "0.78.5",
+    date: "2026-09-01",
+    summary:
+      "On an instance that cannot send email, signing up with an address that had already been whitelisted or had already requested access created no account at all. The sign-up said it worked, nothing existed, and trying again did the same.",
+    fixes: [
+      "Such a sign-up now creates the account. Before, there was nothing behind the request for an admin to approve, and every retry silently repeated the same nothing. Other sign-ups were unaffected — a brand-new address, one that had been denied and was asking again, and every sign-up on an instance with working email all created their account as expected.",
+      "Admins: a new account still starts inactive. If the person had merely requested access, approve their request as usual. If you had already whitelisted their address, there is no pending request to approve — re-enter the address in the whitelist box under Users → Access requests and that activates their account.",
+      "Operator note: an incomplete SMTP setting makes Siftlode skip every message silently by design — that is what left the sign-ups above with nothing to fall back on. If your instance has never delivered mail, check Configuration → Email / SMTP and use “Send test email”.",
+    ],
+    chores: [
+      "Registration commits the new account explicitly. upsert_pending_invite() commits only when it actually writes an invite row — not when the address already has a pending or approved one — and the only other commit on that path is gated on working SMTP, so with mail unavailable the flushed user row was rolled back when the background task's session closed. That one line is the whole behavioural change in production; the only other shipped edit is a test-only RateLimiter.reset() helper. Two attempts to also fix the pre-approved account's activation UX were reverted after review — roadmap UX-25 records both dead ends and the safe shape.",
+      "Tests: three that fail without the fix (pre-approved and already-pending sign-ups on a no-SMTP instance, and the admin-activation recovery that depends on the account existing), guards for the unknown-email, previously-denied and SMTP-on branches and for verification not granting access on its own, the first end-to-end tests of the /auth/register route and its allow_registration gate, unit tests for the rate limiter, and an autouse fixture resetting the module-level limiters between tests so their windows stop pooling across the suite.",
+    ],
+  },
   {
     version: "0.78.4",
     date: "2026-08-30",