hanna/fabrica

fix(web): reflect email-verified state in the admin user list

9167701 · hanna committed on 2026-07-26

The admin user list showed the "Verify" button unconditionally, so a fully
verified account looked unverified. Badge the primary-email-verified state and
only offer "Verify" when it is not verified. Also mark the primary email verified
when a user activates via an emailed invite — completing the invite proves they
control that address.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/store/src/users.rs +19 −0

crates/web/src/admin.rs +18 −2

crates/web/src/pages.rs +3 −0

         Ok(updated > 0)
+    }
+    /// Whether a user's primary email address is verified.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn primary_email_verified(&self, user_id: &str) -> Result<bool, StoreError> {
+        let row = sqlx::query(
+            "SELECT verified_at FROM user_emails WHERE user_id = $1 AND is_primary = $2",
+        )
+        .bind(user_id)
+        .bind(true)
+        .fetch_optional(&self.pool)
+        .await?;
+        let verified = row
+            .and_then(|r| r.try_get::<Option<i64>, _>("verified_at").ok().flatten())
+            .is_some();
+        Ok(verified)
+    }
     /// Set (or clear) a user's password hash.
     ///
     /// Passing `Some(hash)` sets the credential and clears the

     let (page, offset) = pager.resolve();
     let total = state.store.admin_counts().await?.users;
     let all = state.store.list_users_paged(PAGE_SIZE, offset).await?;
+    // Verified state of each shown user's primary email, so the row can badge it
+    // and only offer "Verify" when it is not yet verified.
+    let mut verified: std::collections::HashSet<String> = std::collections::HashSet::new();
+    for u in &all {
+        if state
+            .store
+            .primary_email_verified(&u.id)
+            .await
+            .unwrap_or(false)
+        {
+            verified.insert(u.id.clone());
+        }
+    }
     // The password picker offers every account, not just the current page.
     let everyone = state.store.list_users().await?;
     let (_, chrome) = build_chrome(
                                 span class="entry-row-title" {
                                     a href={ "/" (u.username) } { (u.username) }
                                     @if u.is_admin { " " span class="badge" { "admin" } }
+                                    @if verified.contains(&u.id) { " " span class="badge badge-verified" { "verified" } }
                                     @if u.disabled_at.is_some() { " " span class="badge badge-private" { "disabled" } }
+                                }
                                 div class="entry-row-meta muted" { (u.email) }
+                            }
                             div class="entry-row-actions admin-actions" {
-                                (post_button(&format!("/admin/users/{}/verify", u.id), &csrf, "Verify", "btn"))
+                                @if !verified.contains(&u.id) {
+                                    (post_button(&format!("/admin/users/{}/verify", u.id), &csrf, "Verify", "btn"))
+                                }
                                 (toggle_button(&format!("/admin/users/{}/admin", u.id), &csrf, "admin", !u.is_admin,
                                     if u.is_admin { "Revoke admin" } else { "Make admin" }))
                                 (toggle_button(&format!("/admin/users/{}/disable", u.id), &csrf, "disabled", u.disabled_at.is_none(),
+                    }
                     p class="muted field-hint" { "Leaving the password blank creates an account that must be activated by the user (they'll need an invite/reset)." }
                     div class="admin-form-actions" {
-                        label class="checkbox" { input type="checkbox" name="admin" value="1"; " Administrator" }
                         button class="btn btn-primary inline-btn" type="submit" { "Create user" }
+                        label class="checkbox" { input type="checkbox" name="admin" value="1"; " Administrator" }
+                    }
+                }
+            }

             .set_password(&invite.user_id, Some(&hash))
             .await?;
         state.store.mark_invite_used(&invite.id).await?;
+        // The invite was delivered to this account's email, so completing it
+        // proves control of that address — mark it verified.
+        let _ = state.store.verify_primary_email(&invite.user_id).await;
         let user = state
             .store
             .user_by_id(&invite.user_id)