hanna/fabrica

feat(web): hide admin invites when self-registration is on; clear flash

f3bb3d6 · hanna committed on 2026-07-26

- The Invites tab is hidden and /admin/invites (GET and the create POST)
  redirects to the overview when self-registration is enabled — invites
  only matter when open registration is closed.
- The one-time invite-link flash cookie is now removed with its original
  "/admin/invites" path, so the link no longer reappears on reload (a
  path-mismatched deletion left it in the browser).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/web/src/admin.rs +26 −7

 use crate::{AppState, setting_keys};
 /// The admin dashboard shell: a left tab rail and the active tab's content.
+/// `show_invites` hides the Invites tab when self-registration is on (invites
+/// are only useful when registration is otherwise closed).
 #[allow(clippy::needless_pass_by_value)] // `content` is embedded once.
-fn admin_shell(active: &str, content: Markup) -> Markup {
+fn admin_shell(active: &str, content: Markup, show_invites: bool) -> Markup {
     let tab = |href: &str, key: &str, label: &str| {
         html! { a href=(href) aria-current=[(active == key).then_some("page")] { (label) } }
     };
                     (tab("/admin/users", "users", "Users"))
                     (tab("/admin/repos", "repos", "Repositories"))
                     (tab("/admin/groups", "groups", "Groups"))
-                    (tab("/admin/invites", "invites", "Invites"))
+                    @if show_invites { (tab("/admin/invites", "invites", "Invites")) }
                     (tab("/admin/settings", "settings", "Settings"))
+                }
+            }
     active: &str,
     content: Markup,
 ) -> Response {
+    let show_invites = !state.allow_registration();
     let (jar, chrome) = build_chrome(state, jar, Some(user), uri.path().to_string());
-    (jar, page(&chrome, "Admin", admin_shell(active, content))).into_response()
+    (
+        jar,
+        page(&chrome, "Admin", admin_shell(active, content, show_invites)),
+    )
+        .into_response()
+}
 /// Rows shown per page in the admin list views.
     jar: CookieJar,
     uri: Uri,
 ) -> AppResult<Response> {
+    // Invites only matter when self-registration is closed; otherwise the page
+    // is hidden and its route redirects to the overview.
+    if state.allow_registration() {
+        return Ok(Redirect::to("/admin").into_response());
+    }
     let invites = state.store.list_signup_invites().await?;
     let base = state.config.instance.url.trim_end_matches('/').to_string();
     let (_, chrome) = build_chrome(
+            }
+        }
     };
-    // Clear the flash cookie after showing it.
+    // Clear the flash cookie after showing it once. The removal must carry the
-    let jar = jar.remove(axum_extra::extract::cookie::Cookie::from(
+    // same path the cookie was set with ("/admin/invites"), or the browser keeps
-        "fabrica_flash_invite",
+    // it and the link reappears on reload.
-    ));
+    let jar = jar.remove(
+        axum_extra::extract::cookie::Cookie::build("fabrica_flash_invite")
+            .path("/admin/invites")
+            .build(),
+    );
     Ok(render(&state, jar, user, &uri, "invites", content))
+}
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
+    if state.allow_registration() {
+        return Redirect::to("/admin").into_response();
+    }
     let token = auth::new_session_token();
     let note = form.note.trim();
     let created = state