@micha.bigler/ui-core-micha 2.2.0 → 2.2.1

package/dist/auth/authApi.js

@@ -19,15 +19,6 @@ export async function fetchAuthMethods() {
     const res = await apiClient.get('/api/auth-methods/');
     return res.data || {};
 }
-export async function fetchRegistrationOptions() {
-    try {
-        const res = await apiClient.get(`${USERS_BASE}/registration-options/`);
-        return res.data || {};
-    }
-    catch (error) {
-        throw normaliseApiError(error, 'Auth.REGISTRATION_OPTIONS_FAILED');
-    }
-}
 export async function fetchAuthPolicy() {
     try {
         const res = await apiClient.get(`${USERS_BASE}/auth-policy/`);
@@ -372,16 +363,6 @@ export async function createSignupQr(payload = {}) {
         throw normaliseApiError(error, 'Auth.SIGNUP_QR_CREATE_FAILED');
     }
 }
-export async function requestInviteWithCode(email, accessCode) {
-    if (accessCode) {
-        return submitRegistrationRequest({
-            email,
-            mode: 'self_signup_access_code',
-            accessCode,
-        });
-    }
-    return sendAdminInvite(email);
-}
 // -----------------------------
 // Recovery Support (Admin/Support Side)
 // -----------------------------

package/dist/components/AuthFactorRequirementCard.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import React, { useEffect, useState } from 'react';
-import { Alert, Box, Button, FormControl, FormControlLabel, Radio, RadioGroup, Typography, } from '@mui/material';
+import { Alert, Box, FormControl, FormControlLabel, Radio, RadioGroup, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { fetchAuthPolicy, updateAuthPolicy } from '../auth/authApi';
 export function AuthFactorRequirementCard() {
@@ -26,20 +26,24 @@ export function AuthFactorRequirementCard() {
             active = false;
         };
     }, []);
-    const save = async () => {
+    const handleChange = async (event) => {
+        const nextValue = event.target.value;
+        const previous = value;
+        setValue(nextValue);
         setBusy(true);
         setError('');
         setSuccess('');
         try {
-            await updateAuthPolicy({ required_auth_factor_count: Number(value) });
+            await updateAuthPolicy({ required_auth_factor_count: Number(nextValue) });
             setSuccess(t('Auth.AUTH_FACTOR_SAVE_SUCCESS', 'Factor requirement saved.'));
         }
         catch (err) {
+            setValue(previous);
             setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save factor requirement.'));
         }
         finally {
             setBusy(false);
         }
     };
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.AUTH_FACTOR_TITLE', 'Authentication Factors') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.AUTH_FACTOR_HINT', 'Choose whether one factor is enough or two factors are required.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsx(FormControl, { children: _jsxs(RadioGroup, { value: value, onChange: (event) => setValue(event.target.value), children: [_jsx(FormControlLabel, { value: "1", control: _jsx(Radio, {}), label: t('Auth.ONE_FACTOR_LABEL', 'One factor is enough') }), _jsx(FormControlLabel, { value: "2", control: _jsx(Radio, {}), label: t('Auth.TWO_FACTOR_LABEL', 'Two factors are required') })] }) }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: save, disabled: busy, children: t('Common.SAVE', 'Save') })] }));
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.AUTH_FACTOR_TITLE', 'Authentication Factors') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.AUTH_FACTOR_HINT', 'Choose whether one factor is enough or two factors are required.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsx(FormControl, { children: _jsxs(RadioGroup, { value: value, onChange: handleChange, children: [_jsx(FormControlLabel, { value: "1", control: _jsx(Radio, { disabled: busy }), label: t('Auth.ONE_FACTOR_LABEL', 'One factor is enough') }), _jsx(FormControlLabel, { value: "2", control: _jsx(Radio, { disabled: busy }), label: t('Auth.TWO_FACTOR_LABEL', 'Two factors are required') })] }) })] }));
 }

package/dist/components/LoginForm.js

@@ -21,6 +21,6 @@ disabled = false, initialIdentifier = '', }) {
     const supportsPasskey = !!onPasskeyLogin &&
         typeof window !== 'undefined' &&
         !!window.PublicKeyCredential;
-    return (_jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 3 }, children: [error && (_jsx(Typography, { color: "error", gutterBottom: true, children: error })), supportsPasskey && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "contained", fullWidth: true, type: "button", onClick: onPasskeyLogin, disabled: disabled, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON') }), _jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') })] })), onSubmit && (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: identifier, onChange: (e) => setIdentifier(e.target.value), disabled: disabled }), _jsx(TextField, { label: t('Auth.LOGIN_PASSWORD_LABEL'), type: "password", required: true, fullWidth: true, value: password, onChange: (e) => setPassword(e.target.value), disabled: disabled }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: disabled, children: t('Auth.PAGE_LOGIN_TITLE') })] })), onSocialLogin && (_jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsx(SocialLoginButtons, { onProviderClick: onSocialLogin, providers: socialProviders })] })), (onSignUp || onForgotPassword) && (_jsxs(Box, { children: [_jsx(Typography, { variant: "subtitle2", sx: { mb: 1 }, children: t('Auth.LOGIN_ACCOUNT_RECOVERY_TITLE') }), _jsxs(Box, { sx: { display: 'flex', gap: 1, flexWrap: 'wrap' }, children: [onSignUp && (_jsx(Button, { type: "button", variant: "outlined", onClick: onSignUp, disabled: disabled, children: t('Auth.LOGIN_SIGNUP_BUTTON') })), onForgotPassword && (_jsx(Button, { type: "button", variant: "outlined", onClick: onForgotPassword, disabled: disabled, children: t('Auth.LOGIN_FORGOT_PASSWORD_BUTTON') }))] })] }))] }));
+    return (_jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 3 }, children: [error && (_jsx(Typography, { color: "error", gutterBottom: true, children: error })), supportsPasskey && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "contained", fullWidth: true, type: "button", onClick: onPasskeyLogin, disabled: disabled, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON') }), _jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') })] })), onSubmit && (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: identifier, onChange: (e) => setIdentifier(e.target.value), disabled: disabled }), _jsx(TextField, { label: t('Auth.LOGIN_PASSWORD_LABEL'), type: "password", required: true, fullWidth: true, value: password, onChange: (e) => setPassword(e.target.value), disabled: disabled }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: disabled, children: t('Auth.PAGE_LOGIN_TITLE') })] })), onSocialLogin && (_jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsx(SocialLoginButtons, { onProviderClick: onSocialLogin, providers: socialProviders })] })), (onSignUp || onForgotPassword) && (_jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 1.5 }, children: [onSignUp && (_jsx(Button, { type: "button", variant: "outlined", onClick: onSignUp, disabled: disabled, fullWidth: true, children: t('Auth.LOGIN_SIGNUP_BUTTON') })), onForgotPassword && (_jsx(Button, { type: "button", variant: "outlined", onClick: onForgotPassword, disabled: disabled, fullWidth: true, children: t('Auth.LOGIN_FORGOT_PASSWORD_BUTTON') }))] })] }))] }));
 }
 ;

package/dist/components/QrSignupManager.js

@@ -1,36 +1,32 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import React, { useState } from 'react';
-import { Alert, Box, Button, Stack, TextField, Typography, } from '@mui/material';
+import React, { useEffect, useRef, useState } from 'react';
+import { Alert, Box, Button, TextField, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { QRCodeSVG } from 'qrcode.react';
 import { createSignupQr } from '../auth/authApi';
-export function QrSignupManager() {
+export function QrSignupManager({ enabled = false }) {
     const { t } = useTranslation();
     const [label, setLabel] = useState('');
-    const [eventRef, setEventRef] = useState('');
-    const [courseRef, setCourseRef] = useState('');
-    const [groupRef, setGroupRef] = useState('');
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState('');
+    const [success, setSuccess] = useState('');
     const [result, setResult] = useState(null);
+    const hasGeneratedRef = useRef(false);
     const generate = async () => {
+        if (!enabled) {
+            setResult(null);
+            return;
+        }
         setBusy(true);
         setError('');
+        setSuccess('');
         try {
-            const registrationContext = {
-                schema_version: '1',
-            };
-            if (eventRef.trim())
-                registrationContext.event_ref = eventRef.trim();
-            if (courseRef.trim())
-                registrationContext.course_ref = courseRef.trim();
-            if (groupRef.trim())
-                registrationContext.group_ref = groupRef.trim();
             const data = await createSignupQr({
                 label,
-                registration_context: registrationContext,
             });
             setResult(data);
+            hasGeneratedRef.current = true;
+            setSuccess(t('Auth.SIGNUP_QR_SAVE_SUCCESS', 'QR signup link updated.'));
         }
         catch (err) {
             setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
@@ -39,5 +35,47 @@ export function QrSignupManager() {
             setBusy(false);
         }
     };
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.SIGNUP_QR_MANAGER_TITLE', 'QR Signup') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.SIGNUP_QR_MANAGER_HINT', 'Generate a QR code for self-signup and optionally prefill registration context references.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), _jsxs(Stack, { spacing: 2, children: [_jsx(TextField, { label: t('Common.LABEL', 'Label'), value: label, onChange: (event) => setLabel(event.target.value) }), _jsx(TextField, { label: t('Auth.EVENT_REF_LABEL', 'Event reference'), value: eventRef, onChange: (event) => setEventRef(event.target.value) }), _jsx(TextField, { label: t('Auth.COURSE_REF_LABEL', 'Course reference'), value: courseRef, onChange: (event) => setCourseRef(event.target.value) }), _jsx(TextField, { label: t('Auth.GROUP_REF_LABEL', 'Group reference'), value: groupRef, onChange: (event) => setGroupRef(event.target.value) })] }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: generate, disabled: busy, children: t('Auth.SIGNUP_QR_CREATE_BUTTON', 'Generate QR') }), (result === null || result === void 0 ? void 0 : result.signup_url) && (_jsxs(Box, { sx: { mt: 3 }, children: [_jsx(QRCodeSVG, { value: result.signup_url, size: 180, includeMargin: true }), _jsx(TextField, { label: t('Auth.SIGNUP_QR_LINK_LABEL', 'Signup link'), value: result.signup_url, fullWidth: true, multiline: true, minRows: 2, sx: { mt: 2 }, InputProps: { readOnly: true } })] }))] }));
+    useEffect(() => {
+        if (!enabled) {
+            setResult(null);
+            setError('');
+            setSuccess('');
+            hasGeneratedRef.current = false;
+            return;
+        }
+        if (hasGeneratedRef.current) {
+            return;
+        }
+        let active = true;
+        const ensureInitialQr = async () => {
+            setBusy(true);
+            setError('');
+            setSuccess('');
+            try {
+                const data = await createSignupQr({
+                    label,
+                });
+                if (!active)
+                    return;
+                setResult(data);
+                hasGeneratedRef.current = true;
+                setSuccess(t('Auth.SIGNUP_QR_SAVE_SUCCESS', 'QR signup link updated.'));
+            }
+            catch (err) {
+                if (!active)
+                    return;
+                setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
+            }
+            finally {
+                if (active) {
+                    setBusy(false);
+                }
+            }
+        };
+        ensureInitialQr();
+        return () => {
+            active = false;
+        };
+    }, [enabled, label, t]);
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.SIGNUP_QR_MANAGER_TITLE', 'QR Signup') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.SIGNUP_QR_MANAGER_HINT', 'When QR signup is enabled, a signup QR code is shown here immediately.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), !enabled && (_jsx(Alert, { severity: "info", sx: { mb: 2 }, children: t('Auth.SIGNUP_QR_DISABLED_HINT', 'Enable self-signup by QR above to show a QR code here.') })), _jsx(TextField, { label: t('Common.LABEL', 'Label'), value: label, onChange: (event) => setLabel(event.target.value), fullWidth: true, disabled: !enabled || busy }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: generate, disabled: !enabled || busy, children: t('Common.SAVE', 'Save') }), (result === null || result === void 0 ? void 0 : result.signup_url) && (_jsxs(Box, { sx: { mt: 3 }, children: [_jsx(QRCodeSVG, { value: result.signup_url, size: 180, includeMargin: true }), _jsx(TextField, { label: t('Auth.SIGNUP_QR_LINK_LABEL', 'Signup link'), value: result.signup_url, fullWidth: true, multiline: true, minRows: 2, sx: { mt: 2 }, InputProps: { readOnly: true } })] }))] }));
 }

package/dist/components/RegistrationMethodsManager.js

@@ -17,6 +17,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
     const [policy, setPolicy] = useState(EMPTY_POLICY);
     const [domainsText, setDomainsText] = useState('');
     const [busy, setBusy] = useState(false);
+    const [busyField, setBusyField] = useState('');
     const [error, setError] = useState('');
     const [success, setSuccess] = useState('');
     useEffect(() => {
@@ -28,6 +29,8 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
                     return;
                 setPolicy((prev) => (Object.assign(Object.assign({}, prev), data)));
                 setDomainsText(((data === null || data === void 0 ? void 0 : data.allowed_email_domains) || []).join('\n'));
+                if (onPolicyChange)
+                    onPolicyChange(data);
             }
             catch (err) {
                 if (active) {
@@ -38,9 +41,28 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         return () => {
             active = false;
         };
-    }, [t]);
-    const toggle = (field) => (_event, checked) => {
+    }, [onPolicyChange, t]);
+    const toggle = (field) => async (_event, checked) => {
+        const previous = policy[field];
         setPolicy((prev) => (Object.assign(Object.assign({}, prev), { [field]: checked })));
+        setBusyField(field);
+        setError('');
+        setSuccess('');
+        try {
+            const next = await updateAuthPolicy({ [field]: checked });
+            setPolicy((prev) => (Object.assign(Object.assign({}, prev), next)));
+            setDomainsText(((next === null || next === void 0 ? void 0 : next.allowed_email_domains) || []).join('\n'));
+            setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
+            if (onPolicyChange)
+                onPolicyChange(next);
+        }
+        catch (err) {
+            setPolicy((prev) => (Object.assign(Object.assign({}, prev), { [field]: previous })));
+            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+        }
+        finally {
+            setBusyField('');
+        }
     };
     const save = async () => {
         setBusy(true);
@@ -51,7 +73,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
                 .split(/\r?\n/)
                 .map((value) => value.trim())
                 .filter(Boolean);
-            const next = await updateAuthPolicy(Object.assign(Object.assign({}, policy), { allowed_email_domains }));
+            const next = await updateAuthPolicy({ allowed_email_domains });
             setPolicy((prev) => (Object.assign(Object.assign({}, prev), next)));
             setDomainsText(((next === null || next === void 0 ? void 0 : next.allowed_email_domains) || allowed_email_domains).join('\n'));
             setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
@@ -65,5 +87,5 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
             setBusy(false);
         }
     };
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.REGISTRATION_METHODS_TITLE', 'Registration Methods') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.REGISTRATION_METHODS_HINT', 'Choose which signup and invite flows are active for this app.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsxs(Stack, { spacing: 1, children: [_jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_admin_invite), onChange: toggle('allow_admin_invite') }), label: t('Auth.ADMIN_INVITE_LABEL', 'Admin invite') }), _jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_self_signup_access_code), onChange: toggle('allow_self_signup_access_code') }), label: t('Auth.SIGNUP_ACCESS_CODE_LABEL', 'Self-signup with access code') }), _jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_self_signup_open), onChange: toggle('allow_self_signup_open') }), label: t('Auth.SIGNUP_OPEN_LABEL', 'Open self-signup') }), _jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_self_signup_email_domain), onChange: toggle('allow_self_signup_email_domain') }), label: t('Auth.SIGNUP_EMAIL_DOMAIN_LABEL', 'Self-signup by email domain') }), _jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_self_signup_qr), onChange: toggle('allow_self_signup_qr') }), label: t('Auth.SIGNUP_QR_LABEL', 'Self-signup by QR') })] }), _jsx(TextField, { label: t('Auth.ALLOWED_EMAIL_DOMAINS_LABEL', 'Allowed email domains'), helperText: t('Auth.ALLOWED_EMAIL_DOMAINS_HINT', 'One domain per line, e.g. example.org'), multiline: true, minRows: 3, fullWidth: true, sx: { mt: 2 }, value: domainsText, onChange: (event) => setDomainsText(event.target.value) }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: save, disabled: busy, children: t('Common.SAVE', 'Save') })] }));
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.REGISTRATION_METHODS_TITLE', 'Registration Methods') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.REGISTRATION_METHODS_HINT', 'Choose which signup and invite flows are active for this app.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsxs(Stack, { spacing: 1, children: [_jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_admin_invite), onChange: toggle('allow_admin_invite'), disabled: Boolean(busyField) })), label: t('Auth.ADMIN_INVITE_LABEL', 'Admin invite') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_access_code), onChange: toggle('allow_self_signup_access_code'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_ACCESS_CODE_LABEL', 'Self-signup with access code') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_open), onChange: toggle('allow_self_signup_open'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_OPEN_LABEL', 'Open self-signup') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_email_domain), onChange: toggle('allow_self_signup_email_domain'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_EMAIL_DOMAIN_LABEL', 'Self-signup by email domain') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_qr), onChange: toggle('allow_self_signup_qr'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_QR_LABEL', 'Self-signup by QR') })] }), policy.allow_self_signup_email_domain && !(policy.allowed_email_domains || []).length && (_jsx(Alert, { severity: "info", sx: { mt: 2 }, children: t('Auth.EMAIL_DOMAIN_CURRENTLY_BLOCKED_HINT', 'Email-domain signup is enabled, but it stays blocked until at least one allowed domain is saved.') })), _jsx(TextField, { label: t('Auth.ALLOWED_EMAIL_DOMAINS_LABEL', 'Allowed email domains'), helperText: t('Auth.ALLOWED_EMAIL_DOMAINS_HINT', 'One domain per line, e.g. example.org. You can leave this empty temporarily.'), multiline: true, minRows: 3, fullWidth: true, sx: { mt: 2 }, value: domainsText, onChange: (event) => setDomainsText(event.target.value) }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: save, disabled: busy, children: t('Common.SAVE', 'Save') })] }));
 }

package/dist/pages/AccountPage.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import React, { useContext, useMemo } from 'react';
+import React, { useContext, useMemo, useState } from 'react';
 import { Helmet } from 'react-helmet';
 import { useSearchParams } from 'react-router-dom';
 import { Tabs, Tab, Box, Typography, Alert, CircularProgress, Paper, Stack, } from '@mui/material';
@@ -24,6 +24,7 @@ export function AccountPage({ userListExtraColumns = [], userListExtraRowActions
     const { t } = useTranslation();
     const { user, login, loading } = useContext(AuthContext);
     const [searchParams, setSearchParams] = useSearchParams();
+    const [authPolicy, setAuthPolicy] = useState(null);
     // 1. URL State Management
     const currentTabRaw = searchParams.get('tab') || 'profile';
     const currentTab = ['invite', 'bulk-invite-csv', 'access'].includes(currentTabRaw)
@@ -90,5 +91,5 @@ export function AccountPage({ userListExtraColumns = [], userListExtraRowActions
     const activeExtraTab = builtInTabValues.has(safeTab)
         ? null
         : extraTabs.find((tab) => tab.value === safeTab);
-    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsx(Tabs, { value: safeTab, onChange: handleTabChange, variant: "scrollable", scrollButtons: "auto", sx: { mb: 3, borderBottom: 1, borderColor: 'divider' }, children: tabs.map((tab) => (_jsx(Tab, { label: tab.label, value: tab.value }, tab.value))) }), safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [(isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(RegistrationMethodsManager, {}) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(AuthFactorRequirementCard, {}) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(UserInviteComponent, {}) })), (isSuperUser || perms.can_manage_access_codes) && (_jsxs(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: [_jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), (isSuperUser || perms.can_invite) && showBulkInviteCsvTab && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(QrSignupManager, {}) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] }));
+    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsx(Tabs, { value: safeTab, onChange: handleTabChange, variant: "scrollable", scrollButtons: "auto", sx: { mb: 3, borderBottom: 1, borderColor: 'divider' }, children: tabs.map((tab) => (_jsx(Tab, { label: tab.label, value: tab.value }, tab.value))) }), safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [(isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(RegistrationMethodsManager, { onPolicyChange: setAuthPolicy }) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(AuthFactorRequirementCard, {}) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(UserInviteComponent, {}) })), (isSuperUser || perms.can_manage_access_codes) && (_jsxs(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: [_jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), (isSuperUser || perms.can_invite) && showBulkInviteCsvTab && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(QrSignupManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) }) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] }));
 }

package/dist/pages/LoginPage.js

@@ -32,6 +32,21 @@ export function LoginPage() {
         : recoveryTokenRaw;
     // Backward-compatible fallback for legacy links using query parameters.
     const recoveryEmail = hashParams.get('email') || params.get('email') || '';
+    const requestedNext = params.get('next');
+    const getRedirectTarget = (currentUser, options = {}) => {
+        var _a;
+        if (options.forceSecurityRedirect) {
+            return options.forceSecurityRedirect;
+        }
+        const requiresExtra = ((_a = currentUser === null || currentUser === void 0 ? void 0 : currentUser.security_state) === null || _a === void 0 ? void 0 : _a.requires_additional_security) === true;
+        if (requiresExtra) {
+            return '/account?tab=security&from=weak_login';
+        }
+        if (requestedNext && requestedNext.startsWith('/')) {
+            return requestedNext;
+        }
+        return '/';
+    };
     useEffect(() => {
         const socialError = params.get('error') || params.get('social');
         if (socialError) {
@@ -39,30 +54,14 @@ export function LoginPage() {
         }
     }, [location.search]);
     useEffect(() => {
-        var _a;
         if (loading || !user)
             return;
-        const requiresExtra = ((_a = user.security_state) === null || _a === void 0 ? void 0 : _a.requires_additional_security) === true;
-        if (requiresExtra) {
-            navigate('/account?tab=security&from=weak_login', { replace: true });
-        }
-        else {
-            navigate('/', { replace: true });
-        }
-    }, [loading, user, navigate]);
+        navigate(getRedirectTarget(user), { replace: true });
+    }, [loading, user, navigate, requestedNext]);
     // --- Helper: Central Success Logic ---
     const handleLoginSuccess = (user) => {
-        var _a;
         login(user); // Update Context
-        // Check if "Strong Security" is enforced/required but not met
-        const requiresExtra = ((_a = user.security_state) === null || _a === void 0 ? void 0 : _a.requires_additional_security) === true;
-        if (requiresExtra) {
-            navigate('/account?tab=security&from=weak_login');
-        }
-        else {
-            // Standard Redirect (könnte man noch mit ?next=... erweitern)
-            navigate('/');
-        }
+        navigate(getRedirectTarget(user));
     };
     // --- Handlers ---
     const handleSubmitCredentials = async ({ identifier, password }) => {
@@ -72,9 +71,10 @@ export function LoginPage() {
             // A) Recovery Flow
             if (recoveryToken) {
                 const result = await loginWithRecoveryPassword(identifier, password, recoveryToken);
-                // Recovery login implies a specific redirect usually, usually straight to security settings
                 login(result.user);
-                navigate('/account?tab=security&from=recovery');
+                navigate(getRedirectTarget(result.user, {
+                    forceSecurityRedirect: '/account?tab=security&from=recovery',
+                }));
                 return;
             }
             // B) Standard Password Login
@@ -118,9 +118,10 @@ export function LoginPage() {
     const handleMfaSuccess = ({ user, method }) => {
         // MFA component should return the user object after verifying code
         if (method === 'recovery_code') {
-            // Recovery codes often trigger a security check prompt
             login(user);
-            navigate('/account?tab=security&from=recovery');
+            navigate(getRedirectTarget(user, {
+                forceSecurityRedirect: '/account?tab=security&from=recovery',
+            }));
         }
         else {
             handleLoginSuccess(user);

package/dist/pages/PasswordInvitePage.js

@@ -13,6 +13,8 @@ export function PasswordInvitePage() {
     const location = useLocation();
     const navigate = useNavigate();
     const { t } = useTranslation();
+    const searchParams = new URLSearchParams(location.search);
+    const nextPath = searchParams.get('next');
     const [submitting, setSubmitting] = useState(false);
     const [errorKey, setErrorKey] = useState(null);
     const [successKey, setSuccessKey] = useState(null);
@@ -57,7 +59,10 @@ export function PasswordInvitePage() {
             setSuccessKey(isInvite
                 ? 'Auth.RESET_PASSWORD_SUCCESS_INVITE'
                 : 'Auth.RESET_PASSWORD_SUCCESS_RESET');
-            navigate('/login');
+            const target = nextPath
+                ? `/login?next=${encodeURIComponent(nextPath)}`
+                : '/login';
+            navigate(target);
         }
         catch (err) {
             setErrorKey(err.code || 'Auth.RESET_PASSWORD_FAILED');

package/dist/pages/SignUpPage.js

@@ -1,7 +1,7 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import React, { useContext, useEffect, useMemo, useState } from 'react';
 import { useNavigate, useLocation } from 'react-router-dom';
-import { Alert, Box, Button, Stack, Tab, Tabs, TextField, Typography, } from '@mui/material';
+import { Alert, Box, Button, Stack, TextField, Typography, } from '@mui/material';
 import { Helmet } from 'react-helmet';
 import { useTranslation } from 'react-i18next';
 import { NarrowPage } from '../layout/PageLayout';
@@ -13,6 +13,12 @@ const MODE_LABELS = {
     self_signup_email_domain: 'Auth.SIGNUP_EMAIL_DOMAIN_TAB',
     self_signup_qr: 'Auth.SIGNUP_QR_TAB',
 };
+const MODE_HINTS = {
+    self_signup_access_code: 'Auth.SIGNUP_ACCESS_CODE_HINT',
+    self_signup_open: 'Auth.SIGNUP_OPEN_HINT',
+    self_signup_email_domain: 'Auth.SIGNUP_EMAIL_DOMAIN_HINT',
+    self_signup_qr: 'Auth.SIGNUP_QR_HINT',
+};
 export function SignUpPage() {
     const navigate = useNavigate();
     const location = useLocation();
@@ -42,6 +48,21 @@ export function SignUpPage() {
     const [successKey, setSuccessKey] = useState(null);
     const [errorKey, setErrorKey] = useState(null);
     const [qrHint, setQrHint] = useState('');
+    const modeHint = useMemo(() => {
+        if (mode === 'self_signup_access_code') {
+            return t(MODE_HINTS[mode], 'Use this option only if you were given an access code for signup.');
+        }
+        if (mode === 'self_signup_open') {
+            return t(MODE_HINTS[mode], 'Use this option for direct signup without an access code.');
+        }
+        if (mode === 'self_signup_email_domain') {
+            return t(MODE_HINTS[mode], 'Use an email address from an allowed domain for this signup flow.');
+        }
+        if (mode === 'self_signup_qr') {
+            return qrHint || t(MODE_HINTS[mode], 'Use a valid QR signup link to continue.');
+        }
+        return '';
+    }, [mode, qrHint, t]);
     useEffect(() => {
         setMode(initialMode);
     }, [initialMode]);
@@ -89,7 +110,7 @@ export function SignUpPage() {
     const handleGoToLogin = () => {
         navigate('/login');
     };
-    return (_jsxs(NarrowPage, { title: t('Auth.LOGIN_SIGNUP_BUTTON'), subtitle: t('Auth.PAGE_SIGNUP_SUBTITLE'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('App.NAME'), " \u2013 ", t('Auth.LOGIN_SIGNUP_BUTTON')] }) }), successKey && (_jsx(Alert, { severity: "success", sx: { mb: 2 }, children: t(successKey, { email }) })), errorKey && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: t(errorKey, t('Auth.INVITE_FAILED', 'Could not complete signup.')) })), signupModes.length > 1 && (_jsx(Tabs, { value: mode, onChange: (_event, next) => setMode(next), variant: "scrollable", scrollButtons: "auto", sx: { mb: 2 }, children: signupModes.map((entry) => (_jsx(Tab, { value: entry, label: t(MODE_LABELS[entry] || entry, entry) }, entry))) })), _jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: email, onChange: (e) => setEmail(e.target.value), disabled: submitting }), mode === 'self_signup_access_code' && (_jsx(TextField, { label: t('Auth.ACCESS_CODE_LABEL'), type: "text", required: true, fullWidth: true, value: accessCode, onChange: (e) => setAccessCode(e.target.value), disabled: submitting })), mode === 'self_signup_email_domain' && (_jsx(Alert, { severity: "info", children: t('Auth.SIGNUP_EMAIL_DOMAIN_HINT', 'Only addresses from configured email domains are allowed for this signup flow.') })), mode === 'self_signup_qr' && (_jsxs(Stack, { spacing: 1, children: [_jsx(Alert, { severity: "info", children: qrHint || t('Auth.SIGNUP_QR_HINT', 'Use a valid QR signup link to continue.') }), _jsx(TextField, { label: t('Auth.SIGNUP_QR_TOKEN_LABEL', 'QR token'), value: tokenFromUrl, fullWidth: true, InputProps: { readOnly: true } })] })), _jsx(Button, { type: "submit", variant: "contained", disabled: submitting || signupModes.length === 0, children: submitting
+    return (_jsxs(NarrowPage, { title: t('Auth.LOGIN_SIGNUP_BUTTON'), subtitle: t('Auth.PAGE_SIGNUP_SUBTITLE'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('App.NAME'), " \u2013 ", t('Auth.LOGIN_SIGNUP_BUTTON')] }) }), successKey && (_jsx(Alert, { severity: "success", sx: { mb: 2 }, children: t(successKey, { email }) })), errorKey && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: t(errorKey, t('Auth.INVITE_FAILED', 'Could not complete signup.')) })), signupModes.length > 1 && (_jsxs(Stack, { spacing: 1, sx: { mb: 2 }, children: [_jsx(Alert, { severity: "info", children: t('Auth.SIGNUP_MODE_SELECTOR_HINT', 'Choose the signup option that matches how you want to register.') }), _jsx(Stack, { direction: { xs: 'column', sm: 'row' }, spacing: 1, flexWrap: "wrap", children: signupModes.map((entry) => (_jsx(Button, { variant: mode === entry ? 'contained' : 'outlined', onClick: () => setMode(entry), disabled: submitting, children: t(MODE_LABELS[entry] || entry, entry) }, entry))) })] })), _jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [modeHint && _jsx(Alert, { severity: "info", children: modeHint }), _jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: email, onChange: (e) => setEmail(e.target.value), disabled: submitting }), mode === 'self_signup_access_code' && (_jsx(TextField, { label: t('Auth.ACCESS_CODE_LABEL'), type: "text", required: true, fullWidth: true, value: accessCode, onChange: (e) => setAccessCode(e.target.value), disabled: submitting })), mode === 'self_signup_qr' && (_jsx(Stack, { spacing: 1, children: _jsx(TextField, { label: t('Auth.SIGNUP_QR_TOKEN_LABEL', 'QR token'), value: tokenFromUrl, fullWidth: true, InputProps: { readOnly: true } }) })), _jsx(Button, { type: "submit", variant: "contained", disabled: submitting || signupModes.length === 0, children: submitting
                             ? t('Auth.SIGNUP_SUBMITTING')
                             : t('Auth.SIGNUP_SUBMIT') })] }), _jsx(Box, { sx: { mt: 3 }, children: _jsxs(Typography, { variant: "body2", children: [t('Auth.SIGNUP_ALREADY_HAVE_ACCOUNT'), ' ', _jsx(Button, { onClick: handleGoToLogin, variant: "text", size: "small", children: t('Auth.SIGNUP_GO_TO_LOGIN') })] }) })] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "private": false,

package/src/auth/authApi.jsx

@@ -23,15 +23,6 @@ export async function fetchAuthMethods() {
   return res.data || {};
 }
 
-export async function fetchRegistrationOptions() {
-  try {
-    const res = await apiClient.get(`${USERS_BASE}/registration-options/`);
-    return res.data || {};
-  } catch (error) {
-    throw normaliseApiError(error, 'Auth.REGISTRATION_OPTIONS_FAILED');
-  }
-}
-
 export async function fetchAuthPolicy() {
   try {
     const res = await apiClient.get(`${USERS_BASE}/auth-policy/`);
@@ -390,17 +381,6 @@ export async function createSignupQr(payload = {}) {
   }
 }
 
-export async function requestInviteWithCode(email, accessCode) {
-  if (accessCode) {
-    return submitRegistrationRequest({
-      email,
-      mode: 'self_signup_access_code',
-      accessCode,
-    });
-  }
-  return sendAdminInvite(email);
-}
-
 // -----------------------------
 // Recovery Support (Admin/Support Side)
 // -----------------------------

package/src/components/AuthFactorRequirementCard.jsx

@@ -2,7 +2,6 @@ import React, { useEffect, useState } from 'react';
 import {
   Alert,
   Box,
-  Button,
   FormControl,
   FormControlLabel,
   Radio,
@@ -36,14 +35,18 @@ export function AuthFactorRequirementCard() {
     };
   }, []);
 
-  const save = async () => {
+  const handleChange = async (event) => {
+    const nextValue = event.target.value;
+    const previous = value;
+    setValue(nextValue);
     setBusy(true);
     setError('');
     setSuccess('');
     try {
-      await updateAuthPolicy({ required_auth_factor_count: Number(value) });
+      await updateAuthPolicy({ required_auth_factor_count: Number(nextValue) });
       setSuccess(t('Auth.AUTH_FACTOR_SAVE_SUCCESS', 'Factor requirement saved.'));
     } catch (err) {
+      setValue(previous);
       setError(t(err?.code || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save factor requirement.'));
     } finally {
       setBusy(false);
@@ -61,14 +64,11 @@ export function AuthFactorRequirementCard() {
       {error && <Alert severity="error" sx={{ mb: 2 }}>{error}</Alert>}
       {success && <Alert severity="success" sx={{ mb: 2 }}>{success}</Alert>}
       <FormControl>
-        <RadioGroup value={value} onChange={(event) => setValue(event.target.value)}>
-          <FormControlLabel value="1" control={<Radio />} label={t('Auth.ONE_FACTOR_LABEL', 'One factor is enough')} />
-          <FormControlLabel value="2" control={<Radio />} label={t('Auth.TWO_FACTOR_LABEL', 'Two factors are required')} />
+        <RadioGroup value={value} onChange={handleChange}>
+          <FormControlLabel value="1" control={<Radio disabled={busy} />} label={t('Auth.ONE_FACTOR_LABEL', 'One factor is enough')} />
+          <FormControlLabel value="2" control={<Radio disabled={busy} />} label={t('Auth.TWO_FACTOR_LABEL', 'Two factors are required')} />
         </RadioGroup>
       </FormControl>
-      <Button variant="contained" sx={{ mt: 2 }} onClick={save} disabled={busy}>
-        {t('Common.SAVE', 'Save')}
-      </Button>
     </Box>
   );
 }

package/src/components/LoginForm.jsx

@@ -118,21 +118,21 @@ export function LoginForm({
           />
         </Box>
       )}
-      {/* Account & Recovery */}
-      
+      {/* Account actions */}
       {(onSignUp || onForgotPassword) && (
       <Box>
-        <Typography variant="subtitle2" sx={{ mb: 1 }}>
-          {t('Auth.LOGIN_ACCOUNT_RECOVERY_TITLE')}
-        </Typography>
+        <Divider sx={{ my: 2 }}>
+          {t('Auth.LOGIN_OR')}
+        </Divider>
 
-        <Box sx={{ display: 'flex', gap: 1, flexWrap: 'wrap' }}>
+        <Box sx={{ display: 'flex', flexDirection: 'column', gap: 1.5 }}>
           {onSignUp && (
             <Button
               type="button"
               variant="outlined"
               onClick={onSignUp}
               disabled={disabled}
+              fullWidth
             >
               {t('Auth.LOGIN_SIGNUP_BUTTON')}
             </Button>
@@ -144,6 +144,7 @@ export function LoginForm({
               variant="outlined"
               onClick={onForgotPassword}
               disabled={disabled}
+              fullWidth
             >
               {t('Auth.LOGIN_FORGOT_PASSWORD_BUTTON')}
             </Button>

package/src/components/QrSignupManager.jsx

@@ -1,9 +1,8 @@
-import React, { useState } from 'react';
+import React, { useEffect, useRef, useState } from 'react';
 import {
   Alert,
   Box,
   Button,
-  Stack,
   TextField,
   Typography,
 } from '@mui/material';
@@ -11,32 +10,30 @@ import { useTranslation } from 'react-i18next';
 import { QRCodeSVG } from 'qrcode.react';
 import { createSignupQr } from '../auth/authApi';
 
-export function QrSignupManager() {
+export function QrSignupManager({ enabled = false }) {
   const { t } = useTranslation();
   const [label, setLabel] = useState('');
-  const [eventRef, setEventRef] = useState('');
-  const [courseRef, setCourseRef] = useState('');
-  const [groupRef, setGroupRef] = useState('');
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState('');
+  const [success, setSuccess] = useState('');
   const [result, setResult] = useState(null);
+  const hasGeneratedRef = useRef(false);
 
   const generate = async () => {
+    if (!enabled) {
+      setResult(null);
+      return;
+    }
     setBusy(true);
     setError('');
+    setSuccess('');
     try {
-      const registrationContext = {
-        schema_version: '1',
-      };
-      if (eventRef.trim()) registrationContext.event_ref = eventRef.trim();
-      if (courseRef.trim()) registrationContext.course_ref = courseRef.trim();
-      if (groupRef.trim()) registrationContext.group_ref = groupRef.trim();
-
       const data = await createSignupQr({
         label,
-        registration_context: registrationContext,
       });
       setResult(data);
+      hasGeneratedRef.current = true;
+      setSuccess(t('Auth.SIGNUP_QR_SAVE_SUCCESS', 'QR signup link updated.'));
     } catch (err) {
       setError(t(err?.code || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
     } finally {
@@ -44,25 +41,72 @@ export function QrSignupManager() {
     }
   };
 
+  useEffect(() => {
+    if (!enabled) {
+      setResult(null);
+      setError('');
+      setSuccess('');
+      hasGeneratedRef.current = false;
+      return;
+    }
+    if (hasGeneratedRef.current) {
+      return;
+    }
+    let active = true;
+    const ensureInitialQr = async () => {
+      setBusy(true);
+      setError('');
+      setSuccess('');
+      try {
+        const data = await createSignupQr({
+          label,
+        });
+        if (!active) return;
+        setResult(data);
+        hasGeneratedRef.current = true;
+        setSuccess(t('Auth.SIGNUP_QR_SAVE_SUCCESS', 'QR signup link updated.'));
+      } catch (err) {
+        if (!active) return;
+        setError(t(err?.code || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
+      } finally {
+        if (active) {
+          setBusy(false);
+        }
+      }
+    };
+    ensureInitialQr();
+    return () => {
+      active = false;
+    };
+  }, [enabled, label, t]);
+
   return (
     <Box>
       <Typography variant="h6" gutterBottom>
         {t('Auth.SIGNUP_QR_MANAGER_TITLE', 'QR Signup')}
       </Typography>
       <Typography variant="body2" sx={{ mb: 2, color: 'text.secondary' }}>
-        {t('Auth.SIGNUP_QR_MANAGER_HINT', 'Generate a QR code for self-signup and optionally prefill registration context references.')}
+        {t('Auth.SIGNUP_QR_MANAGER_HINT', 'When QR signup is enabled, a signup QR code is shown here immediately.')}
       </Typography>
       {error && <Alert severity="error" sx={{ mb: 2 }}>{error}</Alert>}
+      {success && <Alert severity="success" sx={{ mb: 2 }}>{success}</Alert>}
+
+      {!enabled && (
+        <Alert severity="info" sx={{ mb: 2 }}>
+          {t('Auth.SIGNUP_QR_DISABLED_HINT', 'Enable self-signup by QR above to show a QR code here.')}
+        </Alert>
+      )}
 
-      <Stack spacing={2}>
-        <TextField label={t('Common.LABEL', 'Label')} value={label} onChange={(event) => setLabel(event.target.value)} />
-        <TextField label={t('Auth.EVENT_REF_LABEL', 'Event reference')} value={eventRef} onChange={(event) => setEventRef(event.target.value)} />
-        <TextField label={t('Auth.COURSE_REF_LABEL', 'Course reference')} value={courseRef} onChange={(event) => setCourseRef(event.target.value)} />
-        <TextField label={t('Auth.GROUP_REF_LABEL', 'Group reference')} value={groupRef} onChange={(event) => setGroupRef(event.target.value)} />
-      </Stack>
+      <TextField
+        label={t('Common.LABEL', 'Label')}
+        value={label}
+        onChange={(event) => setLabel(event.target.value)}
+        fullWidth
+        disabled={!enabled || busy}
+      />
 
-      <Button variant="contained" sx={{ mt: 2 }} onClick={generate} disabled={busy}>
-        {t('Auth.SIGNUP_QR_CREATE_BUTTON', 'Generate QR')}
+      <Button variant="contained" sx={{ mt: 2 }} onClick={generate} disabled={!enabled || busy}>
+        {t('Common.SAVE', 'Save')}
       </Button>
 
       {result?.signup_url && (

package/src/components/RegistrationMethodsManager.jsx

@@ -27,6 +27,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
   const [policy, setPolicy] = useState(EMPTY_POLICY);
   const [domainsText, setDomainsText] = useState('');
   const [busy, setBusy] = useState(false);
+  const [busyField, setBusyField] = useState('');
   const [error, setError] = useState('');
   const [success, setSuccess] = useState('');
 
@@ -38,6 +39,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         if (!active) return;
         setPolicy((prev) => ({ ...prev, ...data }));
         setDomainsText((data?.allowed_email_domains || []).join('\n'));
+        if (onPolicyChange) onPolicyChange(data);
       } catch (err) {
         if (active) {
           setError(t(err?.code || 'Auth.AUTH_POLICY_FETCH_FAILED', 'Could not load authentication policy.'));
@@ -47,10 +49,26 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
     return () => {
       active = false;
     };
-  }, [t]);
+  }, [onPolicyChange, t]);
 
-  const toggle = (field) => (_event, checked) => {
+  const toggle = (field) => async (_event, checked) => {
+    const previous = policy[field];
     setPolicy((prev) => ({ ...prev, [field]: checked }));
+    setBusyField(field);
+    setError('');
+    setSuccess('');
+    try {
+      const next = await updateAuthPolicy({ [field]: checked });
+      setPolicy((prev) => ({ ...prev, ...next }));
+      setDomainsText((next?.allowed_email_domains || []).join('\n'));
+      setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
+      if (onPolicyChange) onPolicyChange(next);
+    } catch (err) {
+      setPolicy((prev) => ({ ...prev, [field]: previous }));
+      setError(t(err?.code || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+    } finally {
+      setBusyField('');
+    }
   };
 
   const save = async () => {
@@ -62,7 +80,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         .split(/\r?\n/)
         .map((value) => value.trim())
         .filter(Boolean);
-      const next = await updateAuthPolicy({ ...policy, allowed_email_domains });
+      const next = await updateAuthPolicy({ allowed_email_domains });
       setPolicy((prev) => ({ ...prev, ...next }));
       setDomainsText((next?.allowed_email_domains || allowed_email_domains).join('\n'));
       setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
@@ -87,30 +105,69 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
 
       <Stack spacing={1}>
         <FormControlLabel
-          control={<Switch checked={Boolean(policy.allow_admin_invite)} onChange={toggle('allow_admin_invite')} />}
+          control={(
+            <Switch
+              checked={Boolean(policy.allow_admin_invite)}
+              onChange={toggle('allow_admin_invite')}
+              disabled={Boolean(busyField)}
+            />
+          )}
           label={t('Auth.ADMIN_INVITE_LABEL', 'Admin invite')}
         />
         <FormControlLabel
-          control={<Switch checked={Boolean(policy.allow_self_signup_access_code)} onChange={toggle('allow_self_signup_access_code')} />}
+          control={(
+            <Switch
+              checked={Boolean(policy.allow_self_signup_access_code)}
+              onChange={toggle('allow_self_signup_access_code')}
+              disabled={Boolean(busyField)}
+            />
+          )}
           label={t('Auth.SIGNUP_ACCESS_CODE_LABEL', 'Self-signup with access code')}
         />
         <FormControlLabel
-          control={<Switch checked={Boolean(policy.allow_self_signup_open)} onChange={toggle('allow_self_signup_open')} />}
+          control={(
+            <Switch
+              checked={Boolean(policy.allow_self_signup_open)}
+              onChange={toggle('allow_self_signup_open')}
+              disabled={Boolean(busyField)}
+            />
+          )}
           label={t('Auth.SIGNUP_OPEN_LABEL', 'Open self-signup')}
         />
         <FormControlLabel
-          control={<Switch checked={Boolean(policy.allow_self_signup_email_domain)} onChange={toggle('allow_self_signup_email_domain')} />}
+          control={(
+            <Switch
+              checked={Boolean(policy.allow_self_signup_email_domain)}
+              onChange={toggle('allow_self_signup_email_domain')}
+              disabled={Boolean(busyField)}
+            />
+          )}
           label={t('Auth.SIGNUP_EMAIL_DOMAIN_LABEL', 'Self-signup by email domain')}
         />
         <FormControlLabel
-          control={<Switch checked={Boolean(policy.allow_self_signup_qr)} onChange={toggle('allow_self_signup_qr')} />}
+          control={(
+            <Switch
+              checked={Boolean(policy.allow_self_signup_qr)}
+              onChange={toggle('allow_self_signup_qr')}
+              disabled={Boolean(busyField)}
+            />
+          )}
           label={t('Auth.SIGNUP_QR_LABEL', 'Self-signup by QR')}
         />
       </Stack>
 
+      {policy.allow_self_signup_email_domain && !(policy.allowed_email_domains || []).length && (
+        <Alert severity="info" sx={{ mt: 2 }}>
+          {t(
+            'Auth.EMAIL_DOMAIN_CURRENTLY_BLOCKED_HINT',
+            'Email-domain signup is enabled, but it stays blocked until at least one allowed domain is saved.',
+          )}
+        </Alert>
+      )}
+
       <TextField
         label={t('Auth.ALLOWED_EMAIL_DOMAINS_LABEL', 'Allowed email domains')}
-        helperText={t('Auth.ALLOWED_EMAIL_DOMAINS_HINT', 'One domain per line, e.g. example.org')}
+        helperText={t('Auth.ALLOWED_EMAIL_DOMAINS_HINT', 'One domain per line, e.g. example.org. You can leave this empty temporarily.')}
         multiline
         minRows={3}
         fullWidth

package/src/pages/AccountPage.jsx

@@ -1,4 +1,4 @@
-import React, { useContext, useMemo } from 'react';
+import React, { useContext, useMemo, useState } from 'react';
 import { Helmet } from 'react-helmet';
 import { useSearchParams } from 'react-router-dom';
 import { 
@@ -43,6 +43,7 @@ export function AccountPage({
   const { t } = useTranslation();
   const { user, login, loading } = useContext(AuthContext);
   const [searchParams, setSearchParams] = useSearchParams();
+  const [authPolicy, setAuthPolicy] = useState(null);
 
   // 1. URL State Management
   const currentTabRaw = searchParams.get('tab') || 'profile';
@@ -193,7 +194,7 @@ export function AccountPage({
           <Stack spacing={2.5}>
             {(isSuperUser || perms.can_invite) && (
               <Paper variant="outlined" sx={{ p: 2.5, borderRadius: 2 }}>
-                <RegistrationMethodsManager />
+                <RegistrationMethodsManager onPolicyChange={setAuthPolicy} />
               </Paper>
             )}
 
@@ -226,7 +227,7 @@ export function AccountPage({
 
             {(isSuperUser || perms.can_invite) && (
               <Paper variant="outlined" sx={{ p: 2.5, borderRadius: 2 }}>
-                <QrSignupManager />
+                <QrSignupManager enabled={Boolean(authPolicy?.allow_self_signup_qr)} />
               </Paper>
             )}
           </Stack>

package/src/pages/LoginPage.jsx

@@ -39,6 +39,24 @@ export function LoginPage() {
     : recoveryTokenRaw;
   // Backward-compatible fallback for legacy links using query parameters.
   const recoveryEmail = hashParams.get('email') || params.get('email') || '';
+  const requestedNext = params.get('next');
+
+  const getRedirectTarget = (currentUser, options = {}) => {
+    if (options.forceSecurityRedirect) {
+      return options.forceSecurityRedirect;
+    }
+
+    const requiresExtra = currentUser?.security_state?.requires_additional_security === true;
+    if (requiresExtra) {
+      return '/account?tab=security&from=weak_login';
+    }
+
+    if (requestedNext && requestedNext.startsWith('/')) {
+      return requestedNext;
+    }
+
+    return '/';
+  };
 
   useEffect(() => {
     const socialError = params.get('error') || params.get('social');
@@ -49,28 +67,13 @@ export function LoginPage() {
 
   useEffect(() => {
     if (loading || !user) return;
-
-    const requiresExtra = user.security_state?.requires_additional_security === true;
-    if (requiresExtra) {
-      navigate('/account?tab=security&from=weak_login', { replace: true });
-    } else {
-      navigate('/', { replace: true });
-    }
-  }, [loading, user, navigate]);
+    navigate(getRedirectTarget(user), { replace: true });
+  }, [loading, user, navigate, requestedNext]);
 
   // --- Helper: Central Success Logic ---
   const handleLoginSuccess = (user) => {
     login(user); // Update Context
-
-    // Check if "Strong Security" is enforced/required but not met
-    const requiresExtra = user.security_state?.requires_additional_security === true;
-
-    if (requiresExtra) {
-      navigate('/account?tab=security&from=weak_login');
-    } else {
-      // Standard Redirect (könnte man noch mit ?next=... erweitern)
-      navigate('/');
-    }
+    navigate(getRedirectTarget(user));
   };
 
   // --- Handlers ---
@@ -86,9 +89,12 @@ export function LoginPage() {
           password,
           recoveryToken
         );
-        // Recovery login implies a specific redirect usually, usually straight to security settings
         login(result.user);
-        navigate('/account?tab=security&from=recovery');
+        navigate(
+          getRedirectTarget(result.user, {
+            forceSecurityRedirect: '/account?tab=security&from=recovery',
+          }),
+        );
         return;
       }
 
@@ -131,9 +137,12 @@ export function LoginPage() {
   const handleMfaSuccess = ({ user, method }) => {
     // MFA component should return the user object after verifying code
     if (method === 'recovery_code') {
-      // Recovery codes often trigger a security check prompt
       login(user);
-      navigate('/account?tab=security&from=recovery');
+      navigate(
+        getRedirectTarget(user, {
+          forceSecurityRedirect: '/account?tab=security&from=recovery',
+        }),
+      );
     } else {
       handleLoginSuccess(user);
     }

package/src/pages/PasswordInvitePage.jsx

@@ -13,6 +13,8 @@ export function PasswordInvitePage() {
   const location = useLocation();
   const navigate = useNavigate();
   const { t } = useTranslation();
+  const searchParams = new URLSearchParams(location.search);
+  const nextPath = searchParams.get('next');
 
   const [submitting, setSubmitting] = useState(false);
   const [errorKey, setErrorKey] = useState(null);
@@ -68,7 +70,10 @@ export function PasswordInvitePage() {
           ? 'Auth.RESET_PASSWORD_SUCCESS_INVITE'
           : 'Auth.RESET_PASSWORD_SUCCESS_RESET',
       );
-      navigate('/login');
+      const target = nextPath
+        ? `/login?next=${encodeURIComponent(nextPath)}`
+        : '/login';
+      navigate(target);
     } catch (err) {
       setErrorKey(err.code || 'Auth.RESET_PASSWORD_FAILED');
     } finally {

package/src/pages/SignUpPage.jsx

@@ -5,8 +5,6 @@ import {
   Box,
   Button,
   Stack,
-  Tab,
-  Tabs,
   TextField,
   Typography,
 } from '@mui/material';
@@ -23,6 +21,13 @@ const MODE_LABELS = {
   self_signup_qr: 'Auth.SIGNUP_QR_TAB',
 };
 
+const MODE_HINTS = {
+  self_signup_access_code: 'Auth.SIGNUP_ACCESS_CODE_HINT',
+  self_signup_open: 'Auth.SIGNUP_OPEN_HINT',
+  self_signup_email_domain: 'Auth.SIGNUP_EMAIL_DOMAIN_HINT',
+  self_signup_qr: 'Auth.SIGNUP_QR_HINT',
+};
+
 export function SignUpPage() {
   const navigate = useNavigate();
   const location = useLocation();
@@ -57,6 +62,31 @@ export function SignUpPage() {
   const [errorKey, setErrorKey] = useState(null);
   const [qrHint, setQrHint] = useState('');
 
+  const modeHint = useMemo(() => {
+    if (mode === 'self_signup_access_code') {
+      return t(
+        MODE_HINTS[mode],
+        'Use this option only if you were given an access code for signup.',
+      );
+    }
+    if (mode === 'self_signup_open') {
+      return t(
+        MODE_HINTS[mode],
+        'Use this option for direct signup without an access code.',
+      );
+    }
+    if (mode === 'self_signup_email_domain') {
+      return t(
+        MODE_HINTS[mode],
+        'Use an email address from an allowed domain for this signup flow.',
+      );
+    }
+    if (mode === 'self_signup_qr') {
+      return qrHint || t(MODE_HINTS[mode], 'Use a valid QR signup link to continue.');
+    }
+    return '';
+  }, [mode, qrHint, t]);
+
   useEffect(() => {
     setMode(initialMode);
   }, [initialMode]);
@@ -134,21 +164,26 @@ export function SignUpPage() {
       )}
 
       {signupModes.length > 1 && (
-        <Tabs
-          value={mode}
-          onChange={(_event, next) => setMode(next)}
-          variant="scrollable"
-          scrollButtons="auto"
-          sx={{ mb: 2 }}
-        >
-          {signupModes.map((entry) => (
-            <Tab
-              key={entry}
-              value={entry}
-              label={t(MODE_LABELS[entry] || entry, entry)}
-            />
-          ))}
-        </Tabs>
+        <Stack spacing={1} sx={{ mb: 2 }}>
+          <Alert severity="info">
+            {t(
+              'Auth.SIGNUP_MODE_SELECTOR_HINT',
+              'Choose the signup option that matches how you want to register.',
+            )}
+          </Alert>
+          <Stack direction={{ xs: 'column', sm: 'row' }} spacing={1} flexWrap="wrap">
+            {signupModes.map((entry) => (
+              <Button
+                key={entry}
+                variant={mode === entry ? 'contained' : 'outlined'}
+                onClick={() => setMode(entry)}
+                disabled={submitting}
+              >
+                {t(MODE_LABELS[entry] || entry, entry)}
+              </Button>
+            ))}
+          </Stack>
+        </Stack>
       )}
 
       <Box
@@ -156,6 +191,8 @@ export function SignUpPage() {
         onSubmit={handleSubmit}
         sx={{ display: 'flex', flexDirection: 'column', gap: 2 }}
       >
+        {modeHint && <Alert severity="info">{modeHint}</Alert>}
+
         <TextField
           label={t('Auth.EMAIL_LABEL')}
           type="email"
@@ -178,20 +215,8 @@ export function SignUpPage() {
           />
         )}
 
-        {mode === 'self_signup_email_domain' && (
-          <Alert severity="info">
-            {t(
-              'Auth.SIGNUP_EMAIL_DOMAIN_HINT',
-              'Only addresses from configured email domains are allowed for this signup flow.',
-            )}
-          </Alert>
-        )}
-
         {mode === 'self_signup_qr' && (
           <Stack spacing={1}>
-            <Alert severity="info">
-              {qrHint || t('Auth.SIGNUP_QR_HINT', 'Use a valid QR signup link to continue.')}
-            </Alert>
             <TextField
               label={t('Auth.SIGNUP_QR_TOKEN_LABEL', 'QR token')}
               value={tokenFromUrl}