@micha.bigler/ui-core-micha 2.2.4 → 2.2.6

package/dist/components/AuthFactorRequirementCard.js

@@ -45,5 +45,5 @@ export function AuthFactorRequirementCard() {
             setBusy(false);
         }
     };
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.AUTH_FACTOR_TITLE', 'Authentication Factors') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.AUTH_FACTOR_HINT', 'Choose whether one factor is enough or two factors are required.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsx(FormControl, { children: _jsxs(RadioGroup, { value: value, onChange: handleChange, children: [_jsx(FormControlLabel, { value: "1", control: _jsx(Radio, { disabled: busy }), label: t('Auth.ONE_FACTOR_LABEL', 'One factor is enough') }), _jsx(FormControlLabel, { value: "2", control: _jsx(Radio, { disabled: busy }), label: t('Auth.TWO_FACTOR_LABEL', 'Two factors are required') })] }) })] }));
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.AUTH_FACTOR_TITLE', 'Authentication Requirements') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.AUTH_FACTOR_HINT', 'Define the minimum number of authentication factors required for sign-in.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsx(FormControl, { children: _jsxs(RadioGroup, { value: value, onChange: handleChange, children: [_jsx(FormControlLabel, { value: "1", control: _jsx(Radio, { disabled: busy }), label: t('Auth.ONE_FACTOR_LABEL', 'Allow single-factor authentication') }), _jsx(FormControlLabel, { value: "2", control: _jsx(Radio, { disabled: busy }), label: t('Auth.TWO_FACTOR_LABEL', 'Require two-factor authentication') })] }) })] }));
 }

package/dist/components/QrSignupManager.js

@@ -1,9 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import React, { useEffect, useMemo, useRef, useState } from 'react';
-import { Alert, Box, Button, Stack, TextField, Typography, } from '@mui/material';
+import { Alert, Box, Button, Stack, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { QRCodeSVG } from 'qrcode.react';
-import { createSignupQr, updateAuthPolicy } from '../auth/authApi';
+import { createSignupQr } from '../auth/authApi';
 const DEFAULT_EXPIRY_DAYS = 90;
 function clampExpiryDays(value) {
     const parsed = parseInt(value, 10);
@@ -20,20 +20,15 @@ function escapeHtml(value) {
         .replace(/"/g, '"')
         .replace(/'/g, ''');
 }
-export function QrSignupManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_DAYS, onPolicyChange, }) {
+export function QrSignupManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_DAYS, }) {
     const { t } = useTranslation();
     const qrWrapperRef = useRef(null);
-    const [currentExpiryDays, setCurrentExpiryDays] = useState(String(expiryDays || DEFAULT_EXPIRY_DAYS));
     const [busy, setBusy] = useState(false);
-    const [savingPolicy, setSavingPolicy] = useState(false);
     const [error, setError] = useState('');
     const [success, setSuccess] = useState('');
     const [result, setResult] = useState(null);
     const [copyState, setCopyState] = useState('idle');
     const hasGeneratedRef = useRef(false);
-    useEffect(() => {
-        setCurrentExpiryDays(String(expiryDays || DEFAULT_EXPIRY_DAYS));
-    }, [expiryDays]);
     const formattedExpiry = useMemo(() => {
         if (!(result === null || result === void 0 ? void 0 : result.expires_at)) {
             return '';
@@ -55,7 +50,7 @@ export function QrSignupManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_D
             setResult(null);
             return;
         }
-        const nextDays = clampExpiryDays(daysOverride !== null && daysOverride !== void 0 ? daysOverride : currentExpiryDays);
+        const nextDays = clampExpiryDays(daysOverride !== null && daysOverride !== void 0 ? daysOverride : expiryDays);
         setBusy(true);
         setError('');
         setSuccess('');
@@ -120,27 +115,6 @@ export function QrSignupManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_D
             active = false;
         };
     }, [enabled, expiryDays, t]);
-    const handleSavePolicy = async () => {
-        const nextDays = clampExpiryDays(currentExpiryDays);
-        setSavingPolicy(true);
-        setError('');
-        setSuccess('');
-        try {
-            const next = await updateAuthPolicy({
-                signup_qr_expiry_days: nextDays,
-            });
-            setCurrentExpiryDays(String((next === null || next === void 0 ? void 0 : next.signup_qr_expiry_days) || nextDays));
-            setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
-            if (onPolicyChange)
-                onPolicyChange(next);
-        }
-        catch (err) {
-            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
-        }
-        finally {
-            setSavingPolicy(false);
-        }
-    };
     const handleCopyLink = async () => {
         var _a;
         const signupUrl = result === null || result === void 0 ? void 0 : result.signup_url;
@@ -270,7 +244,7 @@ export function QrSignupManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_D
     if (!enabled) {
         return null;
     }
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.SIGNUP_QR_MANAGER_TITLE', 'QR Signup') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.SIGNUP_QR_MANAGER_HINT', 'Save the default validity, then generate and share QR signup links below.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), copyState === 'copied' && (_jsx(Alert, { severity: "success", sx: { mb: 2 }, children: t('Auth.SIGNUP_QR_LINK_COPIED', 'Signup link copied.') })), copyState === 'error' && (_jsx(Alert, { severity: "warning", sx: { mb: 2 }, children: t('Auth.SIGNUP_QR_COPY_UNAVAILABLE', 'Copying the link is not available in this browser.') })), _jsxs(Stack, { direction: { xs: 'column', sm: 'row' }, spacing: 1.5, alignItems: { sm: 'flex-start' }, children: [_jsx(TextField, { label: t('Auth.SIGNUP_QR_EXPIRY_DAYS_LABEL', 'QR signup validity (days)'), helperText: t('Auth.SIGNUP_QR_EXPIRY_DAYS_HINT', 'Default validity for newly generated QR signup links.'), type: "number", value: currentExpiryDays, onChange: (event) => setCurrentExpiryDays(event.target.value), disabled: savingPolicy || busy, sx: { flex: 1 } }), _jsx(Button, { variant: "contained", onClick: handleSavePolicy, disabled: savingPolicy || busy, sx: { minWidth: 120, mt: { sm: '8px' } }, children: t('Common.SAVE', 'Save') })] }), (result === null || result === void 0 ? void 0 : result.signup_url) && (_jsxs(Box, { sx: { mt: 3 }, children: [_jsx(Box, { sx: {
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.SIGNUP_QR_MANAGER_TITLE', 'QR Signup') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.SIGNUP_QR_MANAGER_HINT', 'Generate and share QR signup links below.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), copyState === 'copied' && (_jsx(Alert, { severity: "success", sx: { mb: 2 }, children: t('Auth.SIGNUP_QR_LINK_COPIED', 'Signup link copied.') })), copyState === 'error' && (_jsx(Alert, { severity: "warning", sx: { mb: 2 }, children: t('Auth.SIGNUP_QR_COPY_UNAVAILABLE', 'Copying the link is not available in this browser.') })), (result === null || result === void 0 ? void 0 : result.signup_url) && (_jsxs(Box, { sx: { mt: 1 }, children: [_jsx(Box, { sx: {
                             display: 'flex',
                             justifyContent: 'center',
                             alignItems: 'center',
@@ -287,5 +261,5 @@ export function QrSignupManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_D
                             bgcolor: 'grey.50',
                             border: '1px solid',
                             borderColor: 'divider',
-                        }, children: [_jsx(Typography, { variant: "subtitle2", gutterBottom: true, children: t('Auth.SIGNUP_QR_ACCESS_TITLE', 'Signup Access') }), _jsxs(Typography, { variant: "body2", color: "text.secondary", children: [t('Auth.SIGNUP_QR_VALID_UNTIL', 'Valid until'), ": ", formattedExpiry || result.expires_at] })] }), _jsxs(Stack, { direction: { xs: 'column', sm: 'row' }, spacing: 1, sx: { mt: 2 }, children: [_jsx(Button, { variant: "outlined", onClick: () => generate(), disabled: busy || savingPolicy, children: t('Auth.SIGNUP_QR_NEW_BUTTON', 'New QR-Code') }), _jsx(Button, { variant: "outlined", onClick: handleCopyLink, disabled: !(result === null || result === void 0 ? void 0 : result.signup_url) || busy, children: t('Auth.SIGNUP_QR_COPY_BUTTON', 'Copy Link') }), _jsx(Button, { variant: "outlined", onClick: handleSavePdf, disabled: !(result === null || result === void 0 ? void 0 : result.signup_url) || busy, children: t('Auth.SIGNUP_QR_PDF_BUTTON', 'Save as PDF') })] })] }))] }));
+                        }, children: [_jsx(Typography, { variant: "subtitle2", gutterBottom: true, children: t('Auth.SIGNUP_QR_ACCESS_TITLE', 'Signup Access') }), _jsxs(Typography, { variant: "body2", color: "text.secondary", children: [t('Auth.SIGNUP_QR_VALID_UNTIL', 'Valid until'), ": ", formattedExpiry || result.expires_at] })] }), _jsxs(Stack, { direction: { xs: 'column', sm: 'row' }, spacing: 1, sx: { mt: 2 }, children: [_jsx(Button, { variant: "outlined", onClick: () => generate(), disabled: busy, children: t('Auth.SIGNUP_QR_NEW_BUTTON', 'New QR-Code') }), _jsx(Button, { variant: "outlined", onClick: handleCopyLink, disabled: !(result === null || result === void 0 ? void 0 : result.signup_url) || busy, children: t('Auth.SIGNUP_QR_COPY_BUTTON', 'Copy Link') }), _jsx(Button, { variant: "outlined", onClick: handleSavePdf, disabled: !(result === null || result === void 0 ? void 0 : result.signup_url) || busy, children: t('Auth.SIGNUP_QR_PDF_BUTTON', 'Save as PDF') })] })] }))] }));
 }

package/dist/components/QrSignupValidityManager.js

@@ -0,0 +1,48 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React, { useEffect, useState } from 'react';
+import { Alert, Box, Button, Stack, TextField, Typography, } from '@mui/material';
+import { useTranslation } from 'react-i18next';
+import { updateAuthPolicy } from '../auth/authApi';
+const DEFAULT_EXPIRY_DAYS = 90;
+function clampExpiryDays(value) {
+    const parsed = parseInt(value, 10);
+    if (!Number.isFinite(parsed) || parsed < 1) {
+        return DEFAULT_EXPIRY_DAYS;
+    }
+    return parsed;
+}
+export function QrSignupValidityManager({ enabled = false, expiryDays = DEFAULT_EXPIRY_DAYS, onPolicyChange, }) {
+    const { t } = useTranslation();
+    const [currentExpiryDays, setCurrentExpiryDays] = useState(String(expiryDays || DEFAULT_EXPIRY_DAYS));
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState('');
+    const [success, setSuccess] = useState('');
+    useEffect(() => {
+        setCurrentExpiryDays(String(expiryDays || DEFAULT_EXPIRY_DAYS));
+    }, [expiryDays]);
+    const handleSave = async () => {
+        const nextDays = clampExpiryDays(currentExpiryDays);
+        setBusy(true);
+        setError('');
+        setSuccess('');
+        try {
+            const next = await updateAuthPolicy({
+                signup_qr_expiry_days: nextDays,
+            });
+            setCurrentExpiryDays(String((next === null || next === void 0 ? void 0 : next.signup_qr_expiry_days) || nextDays));
+            setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
+            if (onPolicyChange)
+                onPolicyChange(next);
+        }
+        catch (err) {
+            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    if (!enabled) {
+        return null;
+    }
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.SIGNUP_QR_VALIDITY_TITLE', 'QR Signup Validity') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.SIGNUP_QR_VALIDITY_HINT', 'Set the default validity for newly generated QR signup links.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsxs(Stack, { direction: { xs: 'column', sm: 'row' }, spacing: 1.5, alignItems: { sm: 'flex-start' }, children: [_jsx(TextField, { label: t('Auth.SIGNUP_QR_EXPIRY_DAYS_LABEL', 'QR signup validity (days)'), helperText: t('Auth.SIGNUP_QR_EXPIRY_DAYS_HINT', 'Default validity for newly generated QR signup links.'), type: "number", value: currentExpiryDays, onChange: (event) => setCurrentExpiryDays(event.target.value), disabled: busy, sx: { flex: 1 } }), _jsx(Button, { variant: "contained", onClick: handleSave, disabled: busy, sx: { minWidth: 120, mt: { sm: '8px' } }, children: t('Common.SAVE', 'Save') })] })] }));
+}

package/dist/components/RegistrationMethodsManager.js

@@ -1,63 +1,53 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import React, { useEffect, useState } from 'react';
-import { Alert, Box, FormControlLabel, Stack, Switch, Typography, } from '@mui/material';
+import { Alert, Box, CircularProgress, FormControlLabel, Stack, Switch, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
-import { fetchAuthPolicy, updateAuthPolicy } from '../auth/authApi';
+import { updateAuthPolicy } from '../auth/authApi';
 const EMPTY_POLICY = {
     allow_admin_invite: true,
     allow_self_signup_access_code: false,
     allow_self_signup_open: false,
     allow_self_signup_email_domain: false,
     allow_self_signup_qr: false,
+    allowed_email_domains: [],
+    signup_qr_expiry_days: 90,
     required_auth_factor_count: 1,
 };
-export function RegistrationMethodsManager({ onPolicyChange }) {
+export function RegistrationMethodsManager({ policy: authPolicy, error = '', onPolicyChange, }) {
     const { t } = useTranslation();
-    const [policy, setPolicy] = useState(EMPTY_POLICY);
+    const [policyState, setPolicyState] = useState(EMPTY_POLICY);
     const [busyField, setBusyField] = useState('');
-    const [error, setError] = useState('');
+    const [saveError, setSaveError] = useState('');
     const [success, setSuccess] = useState('');
     useEffect(() => {
-        let active = true;
-        (async () => {
-            try {
-                const data = await fetchAuthPolicy();
-                if (!active)
-                    return;
-                setPolicy((prev) => (Object.assign(Object.assign({}, prev), data)));
-                if (onPolicyChange)
-                    onPolicyChange(data);
-            }
-            catch (err) {
-                if (active) {
-                    setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_FETCH_FAILED', 'Could not load authentication policy.'));
-                }
-            }
-        })();
-        return () => {
-            active = false;
-        };
-    }, [onPolicyChange, t]);
+        if (!authPolicy) {
+            return;
+        }
+        setPolicyState(Object.assign(Object.assign({}, EMPTY_POLICY), authPolicy));
+    }, [authPolicy]);
     const toggle = (field) => async (_event, checked) => {
-        const previous = policy[field];
-        setPolicy((prev) => (Object.assign(Object.assign({}, prev), { [field]: checked })));
+        const previous = policyState[field];
+        setPolicyState((prev) => (Object.assign(Object.assign({}, prev), { [field]: checked })));
         setBusyField(field);
-        setError('');
+        setSaveError('');
         setSuccess('');
         try {
             const next = await updateAuthPolicy({ [field]: checked });
-            setPolicy((prev) => (Object.assign(Object.assign({}, prev), next)));
+            setPolicyState((prev) => (Object.assign(Object.assign({}, prev), next)));
             setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
             if (onPolicyChange)
                 onPolicyChange(next);
         }
         catch (err) {
-            setPolicy((prev) => (Object.assign(Object.assign({}, prev), { [field]: previous })));
-            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+            setPolicyState((prev) => (Object.assign(Object.assign({}, prev), { [field]: previous })));
+            setSaveError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
         }
         finally {
             setBusyField('');
         }
     };
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.REGISTRATION_METHODS_TITLE', 'Registration Methods') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.REGISTRATION_METHODS_HINT', 'Choose which signup and invite flows are active for this app.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsxs(Stack, { spacing: 1, children: [_jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_admin_invite), onChange: toggle('allow_admin_invite'), disabled: Boolean(busyField) })), label: t('Auth.ADMIN_INVITE_LABEL', 'Admin invite') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_access_code), onChange: toggle('allow_self_signup_access_code'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_ACCESS_CODE_LABEL', 'Self-signup with access code') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_open), onChange: toggle('allow_self_signup_open'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_OPEN_LABEL', 'Open self-signup') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_email_domain), onChange: toggle('allow_self_signup_email_domain'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_EMAIL_DOMAIN_LABEL', 'Self-signup by email domain') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_qr), onChange: toggle('allow_self_signup_qr'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_QR_LABEL', 'Self-signup by QR') })] }), policy.allow_self_signup_email_domain && !(policy.allowed_email_domains || []).length && (_jsx(Alert, { severity: "info", sx: { mt: 2 }, children: t('Auth.EMAIL_DOMAIN_CURRENTLY_BLOCKED_HINT', 'Email-domain signup is enabled, but it stays blocked until at least one allowed domain is saved.') }))] }));
+    if (!authPolicy && !error) {
+        return (_jsx(Box, { sx: { py: 3, display: 'flex', justifyContent: 'center' }, children: _jsx(CircularProgress, { size: 28 }) }));
+    }
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.REGISTRATION_METHODS_TITLE', 'Registration Methods') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.REGISTRATION_METHODS_HINT', 'Choose which signup and invite flows are active for this app.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), saveError && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: saveError }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsxs(Stack, { spacing: 1, children: [_jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policyState.allow_admin_invite), onChange: toggle('allow_admin_invite'), disabled: Boolean(busyField) })), label: t('Auth.ADMIN_INVITE_LABEL', 'Admin invite') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policyState.allow_self_signup_access_code), onChange: toggle('allow_self_signup_access_code'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_ACCESS_CODE_LABEL', 'Self-signup with access code') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policyState.allow_self_signup_open), onChange: toggle('allow_self_signup_open'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_OPEN_LABEL', 'Open self-signup') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policyState.allow_self_signup_email_domain), onChange: toggle('allow_self_signup_email_domain'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_EMAIL_DOMAIN_LABEL', 'Self-signup by email domain') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policyState.allow_self_signup_qr), onChange: toggle('allow_self_signup_qr'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_QR_LABEL', 'Self-signup by QR') })] }), policyState.allow_self_signup_email_domain && !(policyState.allowed_email_domains || []).length && (_jsx(Alert, { severity: "info", sx: { mt: 2 }, children: t('Auth.EMAIL_DOMAIN_CURRENTLY_BLOCKED_HINT', 'Email-domain signup is enabled, but it stays blocked until at least one allowed domain is saved.') }))] }));
 }

package/dist/i18n/authTranslations.js

@@ -456,6 +456,12 @@ export const authTranslations = {
         "en": "Add code manually",
         "sw": "Ongeza msimbo mwenyewe"
     },
+    "Auth.ACCESS_CODE_MANAGER_TITLE": {
+        "de": "Zugangscodes",
+        "fr": "Codes d'accès",
+        "en": "Access Codes",
+        "sw": "Misimbo ya ufikiaji"
+    },
     "Auth.ACCESS_CODE_LABEL": {
         "de": "Zugangscode",
         "fr": "Code d'accès",
@@ -468,6 +474,24 @@ export const authTranslations = {
         "en": "Add",
         "sw": "Ongeza"
     },
+    "Auth.ACCESS_CODE_COPY_BUTTON": {
+        "de": "Kopieren",
+        "fr": "Copier",
+        "en": "Copy",
+        "sw": "Nakili"
+    },
+    "Auth.ACCESS_CODE_COPY_SUCCESS": {
+        "de": "Code kopiert.",
+        "fr": "Code copié.",
+        "en": "Code copied.",
+        "sw": "Msimbo umenakiliwa."
+    },
+    "Auth.ACCESS_CODE_COPY_FALLBACK": {
+        "de": "Code markieren und mit Strg+C kopieren.",
+        "fr": "Sélectionnez le code et copiez-le avec Ctrl+C.",
+        "en": "Select the code and copy it with Ctrl+C.",
+        "sw": "Chagua msimbo na unakili kwa Ctrl+C."
+    },
     "Auth.ACCESS_CODE_LIST_FAILED": {
         "de": "Zugangscodes konnten nicht geladen werden.",
         "fr": "Impossible de charger les codes d'accès.",
@@ -1266,6 +1290,36 @@ export const authTranslations = {
         "en": "Authentication settings saved.",
         "sw": "Mipangilio ya uthibitishaji imehifadhiwa."
     },
+    "Auth.AUTH_FACTOR_TITLE": {
+        "de": "Authentifizierungsanforderungen",
+        "fr": "Exigences d'authentification",
+        "en": "Authentication Requirements",
+        "sw": "Mahitaji ya uthibitishaji"
+    },
+    "Auth.AUTH_FACTOR_HINT": {
+        "de": "Legen Sie fest, wie viele Authentifizierungsfaktoren mindestens für die Anmeldung erforderlich sind.",
+        "fr": "Définissez le nombre minimal de facteurs d'authentification requis pour la connexion.",
+        "en": "Define the minimum number of authentication factors required for sign-in.",
+        "sw": "Weka idadi ya chini ya vipengele vya uthibitishaji vinavyohitajika ili kuingia."
+    },
+    "Auth.ONE_FACTOR_LABEL": {
+        "de": "Single-Factor-Authentifizierung erlauben",
+        "fr": "Autoriser l'authentification à un facteur",
+        "en": "Allow single-factor authentication",
+        "sw": "Ruhusu uthibitishaji wa kipengele kimoja"
+    },
+    "Auth.TWO_FACTOR_LABEL": {
+        "de": "Zwei-Faktor-Authentifizierung erzwingen",
+        "fr": "Exiger l'authentification à deux facteurs",
+        "en": "Require two-factor authentication",
+        "sw": "Hitaji uthibitishaji wa vipengele viwili"
+    },
+    "Auth.AUTH_FACTOR_SAVE_SUCCESS": {
+        "de": "Die Anforderung für Authentifizierungsfaktoren wurde gespeichert.",
+        "fr": "L'exigence relative aux facteurs d'authentification a été enregistrée.",
+        "en": "Factor requirement saved.",
+        "sw": "Hitaji la vipengele vya uthibitishaji limehifadhiwa."
+    },
     "Auth.REGISTRATION_METHODS_TITLE": {
         "de": "Registrierungsmethoden",
         "fr": "Méthodes d'inscription",
@@ -1345,10 +1399,22 @@ export const authTranslations = {
         "sw": "Usajili wa QR"
     },
     "Auth.SIGNUP_QR_MANAGER_HINT": {
-        "de": "Speichern Sie zuerst die Standard-Gültigkeit und erzeugen Sie darunter neue QR-Registrierungslinks.",
-        "fr": "Enregistrez d'abord la validité par défaut, puis générez ci-dessous de nouveaux liens d'inscription QR.",
-        "en": "Save the default validity, then generate and share QR signup links below.",
-        "sw": "Hifadhi muda wa kawaida wa uhalali kwanza, kisha tengeneza na ushiriki viungo vya usajili wa QR hapa chini."
+        "de": "Erzeugen und teilen Sie hier QR-Registrierungslinks.",
+        "fr": "Générez et partagez ici des liens d'inscription QR.",
+        "en": "Generate and share QR signup links below.",
+        "sw": "Tengeneza na ushiriki viungo vya usajili wa QR hapa chini."
+    },
+    "Auth.SIGNUP_QR_VALIDITY_TITLE": {
+        "de": "QR-Registrierung Gültigkeit",
+        "fr": "Validité de l'inscription QR",
+        "en": "QR Signup Validity",
+        "sw": "Uhalali wa usajili wa QR"
+    },
+    "Auth.SIGNUP_QR_VALIDITY_HINT": {
+        "de": "Legen Sie die Standard-Gültigkeit für neu erzeugte QR-Registrierungslinks fest.",
+        "fr": "Définissez la validité par défaut des nouveaux liens d'inscription QR générés.",
+        "en": "Set the default validity for newly generated QR signup links.",
+        "sw": "Weka muda wa kawaida wa uhalali wa viungo vipya vya usajili wa QR."
     },
     "Auth.SIGNUP_QR_EXPIRY_DAYS_LABEL": {
         "de": "QR-Registrierung gültig (Tage)",
@@ -1440,6 +1506,12 @@ export const authTranslations = {
         "en": "Sign-Up Access",
         "sw": "Ufikiaji wa kujisajili"
     },
+    "Auth.SAVE_BUTTON_LOADING": {
+        "de": "Speichern…",
+        "fr": "Enregistrement…",
+        "en": "Saving…",
+        "sw": "Inahifadhi..."
+    },
     "Common.YES": {
         "de": "Ja",
         "fr": "Oui",

package/dist/pages/AccountPage.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import React, { useContext, useMemo, useState } from 'react';
+import React, { useContext, useEffect, useMemo, useState } from 'react';
 import { Helmet } from 'react-helmet';
 import { useSearchParams } from 'react-router-dom';
 import { Tabs, Tab, Box, Typography, Alert, CircularProgress, Paper, Stack, } from '@mui/material';
@@ -17,15 +17,17 @@ import { AllowedEmailDomainsManager } from '../components/AllowedEmailDomainsMan
 import { RegistrationMethodsManager } from '../components/RegistrationMethodsManager';
 import { AuthFactorRequirementCard } from '../components/AuthFactorRequirementCard';
 import { QrSignupManager } from '../components/QrSignupManager';
+import { QrSignupValidityManager } from '../components/QrSignupValidityManager';
 import { SupportRecoveryRequestsTab } from '../components/SupportRecoveryRequestsTab';
 import { BulkInviteCsvTab } from '../components/BulkInviteCsvTab';
-import { updateUserProfile } from '../auth/authApi'; // Ggf. Pfad anpassen
+import { fetchAuthPolicy, updateUserProfile } from '../auth/authApi'; // Ggf. Pfad anpassen
 export function AccountPage({ userListExtraColumns = [], userListExtraRowActions = [], userListExtraContext = null, userListRefreshTrigger = 0, userListCanEditUser = null, showBulkInviteCsvTab = false, bulkInviteCsvProps = {}, extraTabs = [], }) {
     var _a;
     const { t } = useTranslation();
     const { user, login, loading } = useContext(AuthContext);
     const [searchParams, setSearchParams] = useSearchParams();
     const [authPolicy, setAuthPolicy] = useState(null);
+    const [authPolicyError, setAuthPolicyError] = useState('');
     // 1. URL State Management
     const currentTabRaw = searchParams.get('tab') || 'profile';
     const currentTab = ['invite', 'bulk-invite-csv', 'access'].includes(currentTabRaw)
@@ -45,6 +47,34 @@ export function AccountPage({ userListExtraColumns = [], userListExtraRowActions
         const updatedUser = await updateUserProfile(payload);
         login(updatedUser);
     };
+    useEffect(() => {
+        let active = true;
+        const canLoadPolicy = Boolean(user) && (isSuperUser || perms.can_invite || perms.can_manage_access_codes);
+        if (!canLoadPolicy) {
+            setAuthPolicy(null);
+            setAuthPolicyError('');
+            return undefined;
+        }
+        const loadPolicy = async () => {
+            try {
+                const data = await fetchAuthPolicy();
+                if (!active)
+                    return;
+                setAuthPolicy(data);
+                setAuthPolicyError('');
+            }
+            catch (err) {
+                if (!active)
+                    return;
+                setAuthPolicy(null);
+                setAuthPolicyError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_FETCH_FAILED', 'Could not load authentication policy.'));
+            }
+        };
+        loadPolicy();
+        return () => {
+            active = false;
+        };
+    }, [user, isSuperUser, perms.can_invite, perms.can_manage_access_codes, t]);
     // 3. Dynamic Tabs (angepasst für Superuser)
     const tabs = useMemo(() => {
         if (!user)
@@ -92,5 +122,5 @@ export function AccountPage({ userListExtraColumns = [], userListExtraRowActions
     const activeExtraTab = builtInTabValues.has(safeTab)
         ? null
         : extraTabs.find((tab) => tab.value === safeTab);
-    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsx(Tabs, { value: safeTab, onChange: handleTabChange, variant: "scrollable", scrollButtons: "auto", sx: { mb: 3, borderBottom: 1, borderColor: 'divider' }, children: tabs.map((tab) => (_jsx(Tab, { label: tab.label, value: tab.value }, tab.value))) }), safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [(isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(RegistrationMethodsManager, { onPolicyChange: setAuthPolicy }) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(AuthFactorRequirementCard, {}) })), (isSuperUser || perms.can_invite) && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(UserInviteComponent, {}) })), (isSuperUser || perms.can_manage_access_codes) && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsxs(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: [_jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), (isSuperUser || perms.can_invite) && showBulkInviteCsvTab && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), (isSuperUser || perms.can_invite) && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(AllowedEmailDomainsManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain), domains: (authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allowed_email_domains) || [], onPolicyChange: setAuthPolicy }) })), (isSuperUser || perms.can_invite) && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(QrSignupManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days, onPolicyChange: setAuthPolicy }) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] }));
+    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsx(Tabs, { value: safeTab, onChange: handleTabChange, variant: "scrollable", scrollButtons: "auto", sx: { mb: 3, borderBottom: 1, borderColor: 'divider' }, children: tabs.map((tab) => (_jsx(Tab, { label: tab.label, value: tab.value }, tab.value))) }), safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [(isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(AuthFactorRequirementCard, {}) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(RegistrationMethodsManager, { policy: authPolicy, error: authPolicyError, onPolicyChange: setAuthPolicy }) })), (isSuperUser || perms.can_invite) && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(UserInviteComponent, {}) })), (isSuperUser || perms.can_manage_access_codes) && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsxs(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.ACCESS_CODE_MANAGER_TITLE', 'Access Codes') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), (isSuperUser || perms.can_invite) && showBulkInviteCsvTab && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), (isSuperUser || perms.can_invite) && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(AllowedEmailDomainsManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain), domains: (authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allowed_email_domains) || [], onPolicyChange: setAuthPolicy }) })), (isSuperUser || perms.can_invite) && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(QrSignupValidityManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days, onPolicyChange: setAuthPolicy }) })), (isSuperUser || perms.can_invite) && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(QrSignupManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days }) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "2.2.4",
+  "version": "2.2.6",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "private": false,
@@ -20,6 +20,7 @@
     "build": "tsc -p tsconfig.build.json"
   },
   "devDependencies": {
+    "typescript": "^5.9.3"
   },
   "dependencies": {
     "react-i18next": "^16.3.5"

package/src/components/AuthFactorRequirementCard.jsx

@@ -56,17 +56,28 @@ export function AuthFactorRequirementCard() {
   return (
     <Box>
       <Typography variant="h6" gutterBottom>
-        {t('Auth.AUTH_FACTOR_TITLE', 'Authentication Factors')}
+        {t('Auth.AUTH_FACTOR_TITLE', 'Authentication Requirements')}
       </Typography>
       <Typography variant="body2" sx={{ mb: 2, color: 'text.secondary' }}>
-        {t('Auth.AUTH_FACTOR_HINT', 'Choose whether one factor is enough or two factors are required.')}
+        {t(
+          'Auth.AUTH_FACTOR_HINT',
+          'Define the minimum number of authentication factors required for sign-in.',
+        )}
       </Typography>
       {error && <Alert severity="error" sx={{ mb: 2 }}>{error}</Alert>}
       {success && <Alert severity="success" sx={{ mb: 2 }}>{success}</Alert>}
       <FormControl>
         <RadioGroup value={value} onChange={handleChange}>
-          <FormControlLabel value="1" control={<Radio disabled={busy} />} label={t('Auth.ONE_FACTOR_LABEL', 'One factor is enough')} />
-          <FormControlLabel value="2" control={<Radio disabled={busy} />} label={t('Auth.TWO_FACTOR_LABEL', 'Two factors are required')} />
+          <FormControlLabel
+            value="1"
+            control={<Radio disabled={busy} />}
+            label={t('Auth.ONE_FACTOR_LABEL', 'Allow single-factor authentication')}
+          />
+          <FormControlLabel
+            value="2"
+            control={<Radio disabled={busy} />}
+            label={t('Auth.TWO_FACTOR_LABEL', 'Require two-factor authentication')}
+          />
         </RadioGroup>
       </FormControl>
     </Box>

package/src/components/QrSignupManager.jsx

@@ -4,12 +4,11 @@ import {
   Box,
   Button,
   Stack,
-  TextField,
   Typography,
 } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { QRCodeSVG } from 'qrcode.react';
-import { createSignupQr, updateAuthPolicy } from '../auth/authApi';
+import { createSignupQr } from '../auth/authApi';
 
 const DEFAULT_EXPIRY_DAYS = 90;
 
@@ -33,23 +32,16 @@ function escapeHtml(value) {
 export function QrSignupManager({
   enabled = false,
   expiryDays = DEFAULT_EXPIRY_DAYS,
-  onPolicyChange,
 }) {
   const { t } = useTranslation();
   const qrWrapperRef = useRef(null);
-  const [currentExpiryDays, setCurrentExpiryDays] = useState(String(expiryDays || DEFAULT_EXPIRY_DAYS));
   const [busy, setBusy] = useState(false);
-  const [savingPolicy, setSavingPolicy] = useState(false);
   const [error, setError] = useState('');
   const [success, setSuccess] = useState('');
   const [result, setResult] = useState(null);
   const [copyState, setCopyState] = useState('idle');
   const hasGeneratedRef = useRef(false);
 
-  useEffect(() => {
-    setCurrentExpiryDays(String(expiryDays || DEFAULT_EXPIRY_DAYS));
-  }, [expiryDays]);
-
   const formattedExpiry = useMemo(() => {
     if (!result?.expires_at) {
       return '';
@@ -72,7 +64,7 @@ export function QrSignupManager({
       setResult(null);
       return;
     }
-    const nextDays = clampExpiryDays(daysOverride ?? currentExpiryDays);
+    const nextDays = clampExpiryDays(daysOverride ?? expiryDays);
     setBusy(true);
     setError('');
     setSuccess('');
@@ -133,25 +125,6 @@ export function QrSignupManager({
     };
   }, [enabled, expiryDays, t]);
 
-  const handleSavePolicy = async () => {
-    const nextDays = clampExpiryDays(currentExpiryDays);
-    setSavingPolicy(true);
-    setError('');
-    setSuccess('');
-    try {
-      const next = await updateAuthPolicy({
-        signup_qr_expiry_days: nextDays,
-      });
-      setCurrentExpiryDays(String(next?.signup_qr_expiry_days || nextDays));
-      setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
-      if (onPolicyChange) onPolicyChange(next);
-    } catch (err) {
-      setError(t(err?.code || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
-    } finally {
-      setSavingPolicy(false);
-    }
-  };
-
   const handleCopyLink = async () => {
     const signupUrl = result?.signup_url;
     if (!signupUrl || !navigator?.clipboard?.writeText) {
@@ -290,7 +263,7 @@ export function QrSignupManager({
         {t('Auth.SIGNUP_QR_MANAGER_TITLE', 'QR Signup')}
       </Typography>
       <Typography variant="body2" sx={{ mb: 2, color: 'text.secondary' }}>
-        {t('Auth.SIGNUP_QR_MANAGER_HINT', 'Save the default validity, then generate and share QR signup links below.')}
+        {t('Auth.SIGNUP_QR_MANAGER_HINT', 'Generate and share QR signup links below.')}
       </Typography>
 
       {error && <Alert severity="error" sx={{ mb: 2 }}>{error}</Alert>}
@@ -306,31 +279,8 @@ export function QrSignupManager({
         </Alert>
       )}
 
-      <Stack direction={{ xs: 'column', sm: 'row' }} spacing={1.5} alignItems={{ sm: 'flex-start' }}>
-        <TextField
-          label={t('Auth.SIGNUP_QR_EXPIRY_DAYS_LABEL', 'QR signup validity (days)')}
-          helperText={t(
-            'Auth.SIGNUP_QR_EXPIRY_DAYS_HINT',
-            'Default validity for newly generated QR signup links.',
-          )}
-          type="number"
-          value={currentExpiryDays}
-          onChange={(event) => setCurrentExpiryDays(event.target.value)}
-          disabled={savingPolicy || busy}
-          sx={{ flex: 1 }}
-        />
-        <Button
-          variant="contained"
-          onClick={handleSavePolicy}
-          disabled={savingPolicy || busy}
-          sx={{ minWidth: 120, mt: { sm: '8px' } }}
-        >
-          {t('Common.SAVE', 'Save')}
-        </Button>
-      </Stack>
-
       {result?.signup_url && (
-        <Box sx={{ mt: 3 }}>
+        <Box sx={{ mt: 1 }}>
           <Box
             sx={{
               display: 'flex',
@@ -368,7 +318,7 @@ export function QrSignupManager({
           </Box>
 
           <Stack direction={{ xs: 'column', sm: 'row' }} spacing={1} sx={{ mt: 2 }}>
-            <Button variant="outlined" onClick={() => generate()} disabled={busy || savingPolicy}>
+            <Button variant="outlined" onClick={() => generate()} disabled={busy}>
               {t('Auth.SIGNUP_QR_NEW_BUTTON', 'New QR-Code')}
             </Button>
             <Button variant="outlined" onClick={handleCopyLink} disabled={!result?.signup_url || busy}>

package/src/components/QrSignupValidityManager.jsx

@@ -0,0 +1,100 @@
+import React, { useEffect, useState } from 'react';
+import {
+  Alert,
+  Box,
+  Button,
+  Stack,
+  TextField,
+  Typography,
+} from '@mui/material';
+import { useTranslation } from 'react-i18next';
+import { updateAuthPolicy } from '../auth/authApi';
+
+const DEFAULT_EXPIRY_DAYS = 90;
+
+function clampExpiryDays(value) {
+  const parsed = parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed < 1) {
+    return DEFAULT_EXPIRY_DAYS;
+  }
+  return parsed;
+}
+
+export function QrSignupValidityManager({
+  enabled = false,
+  expiryDays = DEFAULT_EXPIRY_DAYS,
+  onPolicyChange,
+}) {
+  const { t } = useTranslation();
+  const [currentExpiryDays, setCurrentExpiryDays] = useState(String(expiryDays || DEFAULT_EXPIRY_DAYS));
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState('');
+  const [success, setSuccess] = useState('');
+
+  useEffect(() => {
+    setCurrentExpiryDays(String(expiryDays || DEFAULT_EXPIRY_DAYS));
+  }, [expiryDays]);
+
+  const handleSave = async () => {
+    const nextDays = clampExpiryDays(currentExpiryDays);
+    setBusy(true);
+    setError('');
+    setSuccess('');
+    try {
+      const next = await updateAuthPolicy({
+        signup_qr_expiry_days: nextDays,
+      });
+      setCurrentExpiryDays(String(next?.signup_qr_expiry_days || nextDays));
+      setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
+      if (onPolicyChange) onPolicyChange(next);
+    } catch (err) {
+      setError(t(err?.code || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  if (!enabled) {
+    return null;
+  }
+
+  return (
+    <Box>
+      <Typography variant="h6" gutterBottom>
+        {t('Auth.SIGNUP_QR_VALIDITY_TITLE', 'QR Signup Validity')}
+      </Typography>
+      <Typography variant="body2" sx={{ mb: 2, color: 'text.secondary' }}>
+        {t(
+          'Auth.SIGNUP_QR_VALIDITY_HINT',
+          'Set the default validity for newly generated QR signup links.',
+        )}
+      </Typography>
+
+      {error && <Alert severity="error" sx={{ mb: 2 }}>{error}</Alert>}
+      {success && <Alert severity="success" sx={{ mb: 2 }}>{success}</Alert>}
+
+      <Stack direction={{ xs: 'column', sm: 'row' }} spacing={1.5} alignItems={{ sm: 'flex-start' }}>
+        <TextField
+          label={t('Auth.SIGNUP_QR_EXPIRY_DAYS_LABEL', 'QR signup validity (days)')}
+          helperText={t(
+            'Auth.SIGNUP_QR_EXPIRY_DAYS_HINT',
+            'Default validity for newly generated QR signup links.',
+          )}
+          type="number"
+          value={currentExpiryDays}
+          onChange={(event) => setCurrentExpiryDays(event.target.value)}
+          disabled={busy}
+          sx={{ flex: 1 }}
+        />
+        <Button
+          variant="contained"
+          onClick={handleSave}
+          disabled={busy}
+          sx={{ minWidth: 120, mt: { sm: '8px' } }}
+        >
+          {t('Common.SAVE', 'Save')}
+        </Button>
+      </Stack>
+    </Box>
+  );
+}

package/src/components/RegistrationMethodsManager.jsx

@@ -2,13 +2,14 @@ import React, { useEffect, useState } from 'react';
 import {
   Alert,
   Box,
+  CircularProgress,
   FormControlLabel,
   Stack,
   Switch,
   Typography,
 } from '@mui/material';
 import { useTranslation } from 'react-i18next';
-import { fetchAuthPolicy, updateAuthPolicy } from '../auth/authApi';
+import { updateAuthPolicy } from '../auth/authApi';
 
 const EMPTY_POLICY = {
   allow_admin_invite: true,
@@ -16,54 +17,56 @@ const EMPTY_POLICY = {
   allow_self_signup_open: false,
   allow_self_signup_email_domain: false,
   allow_self_signup_qr: false,
+  allowed_email_domains: [],
+  signup_qr_expiry_days: 90,
   required_auth_factor_count: 1,
 };
 
-export function RegistrationMethodsManager({ onPolicyChange }) {
+export function RegistrationMethodsManager({
+  policy: authPolicy,
+  error = '',
+  onPolicyChange,
+}) {
   const { t } = useTranslation();
-  const [policy, setPolicy] = useState(EMPTY_POLICY);
+  const [policyState, setPolicyState] = useState(EMPTY_POLICY);
   const [busyField, setBusyField] = useState('');
-  const [error, setError] = useState('');
+  const [saveError, setSaveError] = useState('');
   const [success, setSuccess] = useState('');
 
   useEffect(() => {
-    let active = true;
-    (async () => {
-      try {
-        const data = await fetchAuthPolicy();
-        if (!active) return;
-        setPolicy((prev) => ({ ...prev, ...data }));
-        if (onPolicyChange) onPolicyChange(data);
-      } catch (err) {
-        if (active) {
-          setError(t(err?.code || 'Auth.AUTH_POLICY_FETCH_FAILED', 'Could not load authentication policy.'));
-        }
-      }
-    })();
-    return () => {
-      active = false;
-    };
-  }, [onPolicyChange, t]);
+    if (!authPolicy) {
+      return;
+    }
+    setPolicyState({ ...EMPTY_POLICY, ...authPolicy });
+  }, [authPolicy]);
 
   const toggle = (field) => async (_event, checked) => {
-    const previous = policy[field];
-    setPolicy((prev) => ({ ...prev, [field]: checked }));
+    const previous = policyState[field];
+    setPolicyState((prev) => ({ ...prev, [field]: checked }));
     setBusyField(field);
-    setError('');
+    setSaveError('');
     setSuccess('');
     try {
       const next = await updateAuthPolicy({ [field]: checked });
-      setPolicy((prev) => ({ ...prev, ...next }));
+      setPolicyState((prev) => ({ ...prev, ...next }));
       setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
       if (onPolicyChange) onPolicyChange(next);
     } catch (err) {
-      setPolicy((prev) => ({ ...prev, [field]: previous }));
-      setError(t(err?.code || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+      setPolicyState((prev) => ({ ...prev, [field]: previous }));
+      setSaveError(t(err?.code || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
     } finally {
       setBusyField('');
     }
   };
 
+  if (!authPolicy && !error) {
+    return (
+      <Box sx={{ py: 3, display: 'flex', justifyContent: 'center' }}>
+        <CircularProgress size={28} />
+      </Box>
+    );
+  }
+
   return (
     <Box>
       <Typography variant="h6" gutterBottom>
@@ -73,13 +76,14 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         {t('Auth.REGISTRATION_METHODS_HINT', 'Choose which signup and invite flows are active for this app.')}
       </Typography>
       {error && <Alert severity="error" sx={{ mb: 2 }}>{error}</Alert>}
+      {saveError && <Alert severity="error" sx={{ mb: 2 }}>{saveError}</Alert>}
       {success && <Alert severity="success" sx={{ mb: 2 }}>{success}</Alert>}
 
       <Stack spacing={1}>
         <FormControlLabel
           control={(
             <Switch
-              checked={Boolean(policy.allow_admin_invite)}
+              checked={Boolean(policyState.allow_admin_invite)}
               onChange={toggle('allow_admin_invite')}
               disabled={Boolean(busyField)}
             />
@@ -89,7 +93,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         <FormControlLabel
           control={(
             <Switch
-              checked={Boolean(policy.allow_self_signup_access_code)}
+              checked={Boolean(policyState.allow_self_signup_access_code)}
               onChange={toggle('allow_self_signup_access_code')}
               disabled={Boolean(busyField)}
             />
@@ -99,7 +103,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         <FormControlLabel
           control={(
             <Switch
-              checked={Boolean(policy.allow_self_signup_open)}
+              checked={Boolean(policyState.allow_self_signup_open)}
               onChange={toggle('allow_self_signup_open')}
               disabled={Boolean(busyField)}
             />
@@ -109,7 +113,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         <FormControlLabel
           control={(
             <Switch
-              checked={Boolean(policy.allow_self_signup_email_domain)}
+              checked={Boolean(policyState.allow_self_signup_email_domain)}
               onChange={toggle('allow_self_signup_email_domain')}
               disabled={Boolean(busyField)}
             />
@@ -119,7 +123,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         <FormControlLabel
           control={(
             <Switch
-              checked={Boolean(policy.allow_self_signup_qr)}
+              checked={Boolean(policyState.allow_self_signup_qr)}
               onChange={toggle('allow_self_signup_qr')}
               disabled={Boolean(busyField)}
             />
@@ -128,7 +132,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         />
       </Stack>
 
-      {policy.allow_self_signup_email_domain && !(policy.allowed_email_domains || []).length && (
+      {policyState.allow_self_signup_email_domain && !(policyState.allowed_email_domains || []).length && (
         <Alert severity="info" sx={{ mt: 2 }}>
           {t(
             'Auth.EMAIL_DOMAIN_CURRENTLY_BLOCKED_HINT',

package/src/i18n/authTranslations.ts

@@ -497,6 +497,12 @@ export const authTranslations = {
     "en": "Add code manually",
     "sw": "Ongeza msimbo mwenyewe"
   },
+  "Auth.ACCESS_CODE_MANAGER_TITLE": {
+    "de": "Zugangscodes",
+    "fr": "Codes d'accès",
+    "en": "Access Codes",
+    "sw": "Misimbo ya ufikiaji"
+  },
   "Auth.ACCESS_CODE_LABEL": {
     "de": "Zugangscode",
     "fr": "Code d'accès",
@@ -509,6 +515,24 @@ export const authTranslations = {
     "en": "Add",
     "sw": "Ongeza"
   },
+  "Auth.ACCESS_CODE_COPY_BUTTON": {
+    "de": "Kopieren",
+    "fr": "Copier",
+    "en": "Copy",
+    "sw": "Nakili"
+  },
+  "Auth.ACCESS_CODE_COPY_SUCCESS": {
+    "de": "Code kopiert.",
+    "fr": "Code copié.",
+    "en": "Code copied.",
+    "sw": "Msimbo umenakiliwa."
+  },
+  "Auth.ACCESS_CODE_COPY_FALLBACK": {
+    "de": "Code markieren und mit Strg+C kopieren.",
+    "fr": "Sélectionnez le code et copiez-le avec Ctrl+C.",
+    "en": "Select the code and copy it with Ctrl+C.",
+    "sw": "Chagua msimbo na unakili kwa Ctrl+C."
+  },
   "Auth.ACCESS_CODE_LIST_FAILED": {
     "de": "Zugangscodes konnten nicht geladen werden.",
     "fr": "Impossible de charger les codes d'accès.",
@@ -1313,6 +1337,36 @@ export const authTranslations = {
     "en": "Authentication settings saved.",
     "sw": "Mipangilio ya uthibitishaji imehifadhiwa."
   },
+  "Auth.AUTH_FACTOR_TITLE": {
+    "de": "Authentifizierungsanforderungen",
+    "fr": "Exigences d'authentification",
+    "en": "Authentication Requirements",
+    "sw": "Mahitaji ya uthibitishaji"
+  },
+  "Auth.AUTH_FACTOR_HINT": {
+    "de": "Legen Sie fest, wie viele Authentifizierungsfaktoren mindestens für die Anmeldung erforderlich sind.",
+    "fr": "Définissez le nombre minimal de facteurs d'authentification requis pour la connexion.",
+    "en": "Define the minimum number of authentication factors required for sign-in.",
+    "sw": "Weka idadi ya chini ya vipengele vya uthibitishaji vinavyohitajika ili kuingia."
+  },
+  "Auth.ONE_FACTOR_LABEL": {
+    "de": "Single-Factor-Authentifizierung erlauben",
+    "fr": "Autoriser l'authentification à un facteur",
+    "en": "Allow single-factor authentication",
+    "sw": "Ruhusu uthibitishaji wa kipengele kimoja"
+  },
+  "Auth.TWO_FACTOR_LABEL": {
+    "de": "Zwei-Faktor-Authentifizierung erzwingen",
+    "fr": "Exiger l'authentification à deux facteurs",
+    "en": "Require two-factor authentication",
+    "sw": "Hitaji uthibitishaji wa vipengele viwili"
+  },
+  "Auth.AUTH_FACTOR_SAVE_SUCCESS": {
+    "de": "Die Anforderung für Authentifizierungsfaktoren wurde gespeichert.",
+    "fr": "L'exigence relative aux facteurs d'authentification a été enregistrée.",
+    "en": "Factor requirement saved.",
+    "sw": "Hitaji la vipengele vya uthibitishaji limehifadhiwa."
+  },
   "Auth.REGISTRATION_METHODS_TITLE": {
     "de": "Registrierungsmethoden",
     "fr": "Méthodes d'inscription",
@@ -1392,10 +1446,22 @@ export const authTranslations = {
     "sw": "Usajili wa QR"
   },
   "Auth.SIGNUP_QR_MANAGER_HINT": {
-    "de": "Speichern Sie zuerst die Standard-Gültigkeit und erzeugen Sie darunter neue QR-Registrierungslinks.",
-    "fr": "Enregistrez d'abord la validité par défaut, puis générez ci-dessous de nouveaux liens d'inscription QR.",
-    "en": "Save the default validity, then generate and share QR signup links below.",
-    "sw": "Hifadhi muda wa kawaida wa uhalali kwanza, kisha tengeneza na ushiriki viungo vya usajili wa QR hapa chini."
+    "de": "Erzeugen und teilen Sie hier QR-Registrierungslinks.",
+    "fr": "Générez et partagez ici des liens d'inscription QR.",
+    "en": "Generate and share QR signup links below.",
+    "sw": "Tengeneza na ushiriki viungo vya usajili wa QR hapa chini."
+  },
+  "Auth.SIGNUP_QR_VALIDITY_TITLE": {
+    "de": "QR-Registrierung Gültigkeit",
+    "fr": "Validité de l'inscription QR",
+    "en": "QR Signup Validity",
+    "sw": "Uhalali wa usajili wa QR"
+  },
+  "Auth.SIGNUP_QR_VALIDITY_HINT": {
+    "de": "Legen Sie die Standard-Gültigkeit für neu erzeugte QR-Registrierungslinks fest.",
+    "fr": "Définissez la validité par défaut des nouveaux liens d'inscription QR générés.",
+    "en": "Set the default validity for newly generated QR signup links.",
+    "sw": "Weka muda wa kawaida wa uhalali wa viungo vipya vya usajili wa QR."
   },
   "Auth.SIGNUP_QR_EXPIRY_DAYS_LABEL": {
     "de": "QR-Registrierung gültig (Tage)",
@@ -1487,6 +1553,12 @@ export const authTranslations = {
     "en": "Sign-Up Access",
     "sw": "Ufikiaji wa kujisajili"
   },
+  "Auth.SAVE_BUTTON_LOADING": {
+    "de": "Speichern…",
+    "fr": "Enregistrement…",
+    "en": "Saving…",
+    "sw": "Inahifadhi..."
+  },
   "Common.YES": {
     "de": "Ja",
     "fr": "Oui",

package/src/pages/AccountPage.jsx

@@ -1,4 +1,4 @@
-import React, { useContext, useMemo, useState } from 'react';
+import React, { useContext, useEffect, useMemo, useState } from 'react';
 import { Helmet } from 'react-helmet';
 import { useSearchParams } from 'react-router-dom';
 import { 
@@ -27,9 +27,10 @@ import { AllowedEmailDomainsManager } from '../components/AllowedEmailDomainsMan
 import { RegistrationMethodsManager } from '../components/RegistrationMethodsManager';
 import { AuthFactorRequirementCard } from '../components/AuthFactorRequirementCard';
 import { QrSignupManager } from '../components/QrSignupManager';
+import { QrSignupValidityManager } from '../components/QrSignupValidityManager';
 import { SupportRecoveryRequestsTab } from '../components/SupportRecoveryRequestsTab';
 import { BulkInviteCsvTab } from '../components/BulkInviteCsvTab';
-import { updateUserProfile } from '../auth/authApi'; // Ggf. Pfad anpassen
+import { fetchAuthPolicy, updateUserProfile } from '../auth/authApi'; // Ggf. Pfad anpassen
 
 export function AccountPage({
   userListExtraColumns = [],
@@ -45,6 +46,7 @@ export function AccountPage({
   const { user, login, loading } = useContext(AuthContext);
   const [searchParams, setSearchParams] = useSearchParams();
   const [authPolicy, setAuthPolicy] = useState(null);
+  const [authPolicyError, setAuthPolicyError] = useState('');
 
   // 1. URL State Management
   const currentTabRaw = searchParams.get('tab') || 'profile';
@@ -70,6 +72,38 @@ export function AccountPage({
     login(updatedUser);
   };
 
+  useEffect(() => {
+    let active = true;
+    const canLoadPolicy = Boolean(user) && (isSuperUser || perms.can_invite || perms.can_manage_access_codes);
+
+    if (!canLoadPolicy) {
+      setAuthPolicy(null);
+      setAuthPolicyError('');
+      return undefined;
+    }
+
+    const loadPolicy = async () => {
+      try {
+        const data = await fetchAuthPolicy();
+        if (!active) return;
+        setAuthPolicy(data);
+        setAuthPolicyError('');
+      } catch (err) {
+        if (!active) return;
+        setAuthPolicy(null);
+        setAuthPolicyError(
+          t(err?.code || 'Auth.AUTH_POLICY_FETCH_FAILED', 'Could not load authentication policy.'),
+        );
+      }
+    };
+
+    loadPolicy();
+
+    return () => {
+      active = false;
+    };
+  }, [user, isSuperUser, perms.can_invite, perms.can_manage_access_codes, t]);
+
   // 3. Dynamic Tabs (angepasst für Superuser)
   const tabs = useMemo(() => {
     if (!user) return [];
@@ -195,13 +229,17 @@ export function AccountPage({
           <Stack spacing={2.5}>
             {(isSuperUser || perms.can_invite) && (
               <Paper variant="outlined" sx={{ p: 2.5, borderRadius: 2 }}>
-                <RegistrationMethodsManager onPolicyChange={setAuthPolicy} />
+                <AuthFactorRequirementCard />
               </Paper>
             )}
 
             {(isSuperUser || perms.can_invite) && (
               <Paper variant="outlined" sx={{ p: 2.5, borderRadius: 2 }}>
-                <AuthFactorRequirementCard />
+                <RegistrationMethodsManager
+                  policy={authPolicy}
+                  error={authPolicyError}
+                  onPolicyChange={setAuthPolicy}
+                />
               </Paper>
             )}
 
@@ -213,6 +251,9 @@ export function AccountPage({
 
             {(isSuperUser || perms.can_manage_access_codes) && Boolean(authPolicy?.allow_self_signup_access_code) && (
               <Paper variant="outlined" sx={{ p: 2.5, borderRadius: 2 }}>
+                <Typography variant="h6" gutterBottom>
+                  {t('Auth.ACCESS_CODE_MANAGER_TITLE', 'Access Codes')}
+                </Typography>
                 <Typography variant="body2" sx={{ mb: 2, color: 'text.secondary' }}>
                   {t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.')}
                 </Typography>
@@ -238,13 +279,22 @@ export function AccountPage({
 
             {(isSuperUser || perms.can_invite) && Boolean(authPolicy?.allow_self_signup_qr) && (
               <Paper variant="outlined" sx={{ p: 2.5, borderRadius: 2 }}>
-                <QrSignupManager
+                <QrSignupValidityManager
                   enabled={Boolean(authPolicy?.allow_self_signup_qr)}
                   expiryDays={authPolicy?.signup_qr_expiry_days}
                   onPolicyChange={setAuthPolicy}
                 />
               </Paper>
             )}
+
+            {(isSuperUser || perms.can_invite) && Boolean(authPolicy?.allow_self_signup_qr) && (
+              <Paper variant="outlined" sx={{ p: 2.5, borderRadius: 2 }}>
+                <QrSignupManager
+                  enabled={Boolean(authPolicy?.allow_self_signup_qr)}
+                  expiryDays={authPolicy?.signup_qr_expiry_days}
+                />
+              </Paper>
+            )}
           </Stack>
         </Box>
       )}