hanna/fabrica

feat(web): hide admin invites when self-registration is on; clear flash

f3bb3d6 · hanna committed on 2026-07-26

- The Invites tab is hidden and /admin/invites (GET and the create POST)
  redirects to the overview when self-registration is enabled — invites
  only matter when open registration is closed.
- The one-time invite-link flash cookie is now removed with its original
  "/admin/invites" path, so the link no longer reappears on reload (a
  path-mismatched deletion left it in the browser).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/web/src/admin.rs +26 −7

@@ @@ -24,8 +24,10 @@ use crate::session::{RequireAdmin, verify_csrf}; @@
 use crate::{AppState, setting_keys};
 /// The admin dashboard shell: a left tab rail and the active tab's content.
 /// `show_invites` hides the Invites tab when self-registration is on (invites
 /// are only useful when registration is otherwise closed).
 #[allow(clippy::needless_pass_by_value)] // `content` is embedded once.
 fn admin_shell(active: &str, content: Markup) -> Markup {
 fn admin_shell(active: &str, content: Markup, show_invites: bool) -> Markup {
     let tab = |href: &str, key: &str, label: &str| {
         html! { a href=(href) aria-current=[(active == key).then_some("page")] { (label) } }
     };
@@ @@ -38,7 +40,7 @@ fn admin_shell(active: &str, content: Markup) -> Markup { @@
                     (tab("/admin/users", "users", "Users"))
                     (tab("/admin/repos", "repos", "Repositories"))
                     (tab("/admin/groups", "groups", "Groups"))
                     (tab("/admin/invites", "invites", "Invites"))
                     @if show_invites { (tab("/admin/invites", "invites", "Invites")) }
                     (tab("/admin/settings", "settings", "Settings"))
+                }
+            }
@@ @@ -56,8 +58,13 @@ fn render( @@
     active: &str,
     content: Markup,
 ) -> Response {
     let show_invites = !state.allow_registration();
     let (jar, chrome) = build_chrome(state, jar, Some(user), uri.path().to_string());
     (jar, page(&chrome, "Admin", admin_shell(active, content))).into_response()
+    (
         jar,
         page(&chrome, "Admin", admin_shell(active, content, show_invites)),
+    )
         .into_response()
+}
 /// Rows shown per page in the admin list views.
@@ @@ -557,6 +564,11 @@ pub async fn invites( @@
     jar: CookieJar,
     uri: Uri,
 ) -> AppResult<Response> {
     // Invites only matter when self-registration is closed; otherwise the page
     // is hidden and its route redirects to the overview.
     if state.allow_registration() {
         return Ok(Redirect::to("/admin").into_response());
+    }
     let invites = state.store.list_signup_invites().await?;
     let base = state.config.instance.url.trim_end_matches('/').to_string();
     let (_, chrome) = build_chrome(
@@ @@ -606,10 +618,14 @@ pub async fn invites( @@
+            }
+        }
     };
     // Clear the flash cookie after showing it.
     let jar = jar.remove(axum_extra::extract::cookie::Cookie::from(
         "fabrica_flash_invite",
     ));
     // Clear the flash cookie after showing it once. The removal must carry the
     // same path the cookie was set with ("/admin/invites"), or the browser keeps
     // it and the link reappears on reload.
     let jar = jar.remove(
         axum_extra::extract::cookie::Cookie::build("fabrica_flash_invite")
             .path("/admin/invites")
             .build(),
     );
     Ok(render(&state, jar, user, &uri, "invites", content))
+}
@@ @@ -633,6 +649,9 @@ pub async fn invite_create( @@
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     if state.allow_registration() {
         return Redirect::to("/admin").into_response();
+    }
     let token = auth::new_session_token();
     let note = form.note.trim();
     let created = state