simple-module-users 0.0.41__tar.gz → 0.0.42__tar.gz

{simple_module_users-0.0.41 → simple_module_users-0.0.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.41
+Version: 0.0.42
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -23,12 +23,12 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: cachetools<8,>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.41
-Requires-Dist: simple-module-core==0.0.41
-Requires-Dist: simple-module-db==0.0.41
-Requires-Dist: simple-module-hosting==0.0.41
-Requires-Dist: simple-module-mail==0.0.41
-Requires-Dist: simple-module-settings==0.0.41
+Requires-Dist: simple-module-auth==0.0.42
+Requires-Dist: simple-module-core==0.0.42
+Requires-Dist: simple-module-db==0.0.42
+Requires-Dist: simple-module-hosting==0.0.42
+Requires-Dist: simple-module-mail==0.0.42
+Requires-Dist: simple-module-settings==0.0.42
 Requires-Dist: typer<0.28,>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.41 → simple_module_users-0.0.42}/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@simple-module-py/users",
-  "version": "0.0.41",
+  "version": "0.0.42",
   "private": true,
   "description": "Frontend assets for the Users module",
   "peerDependencies": {
+    "@inertiajs/react": "^3.9.1",
+    "@simple-module-py/ui": "*",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "@inertiajs/react": "^3.7.0",
-    "@simple-module-py/ui": "*"
+    "react-dom": "^19.3.1"
   },
   "devDependencies": {
     "@simple-module-py/tsconfig": "*"

{simple_module_users-0.0.41 → simple_module_users-0.0.42}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.41"
+version = "0.0.42"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,14 +21,14 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.41",
-    "simple_module_db==0.0.41",
-    "simple_module_hosting==0.0.41",
-    "simple_module_settings==0.0.41",
-    "simple_module_auth==0.0.41",
+    "simple_module_core==0.0.42",
+    "simple_module_db==0.0.42",
+    "simple_module_hosting==0.0.42",
+    "simple_module_settings==0.0.42",
+    "simple_module_auth==0.0.42",
     # Sends through the framework mail sender; `mail` owns the SMTP transport
     # (GH #496), so an upgrade keeps delivering mail.
-    "simple_module_mail==0.0.41",
+    "simple_module_mail==0.0.42",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

simple_module_users-0.0.42/tests/invites/test_users_bulk_invite_error_privacy.py

@@ -0,0 +1,24 @@
+"""Invite responses never expose database statements or exception details (#698)."""
+
+import pytest
+from fastapi_users.exceptions import UserAlreadyExists
+from sqlalchemy.exc import IntegrityError
+from users.invites.bulk import _failure_detail
+
+
+@pytest.mark.parametrize(
+    "error",
+    [
+        IntegrityError(
+            "INSERT INTO users VALUES (:password)", {"password": "secret"}, Exception("db")
+        ),
+        RuntimeError("private backend details"),
+        Exception(),
+    ],
+)
+def test_users_bulk_invite_unknown_error_is_generic(error):
+    assert _failure_detail(error) == "The invitation could not be created. Please try again."
+
+
+def test_users_bulk_invite_already_exists_has_safe_message():
+    assert _failure_detail(UserAlreadyExists()) == "Already a member of this workspace"

{simple_module_users-0.0.41 → simple_module_users-0.0.42}/tests/test_revocation_broadcast.py

@@ -133,18 +133,20 @@ class TestRollbackDoesNotBroadcast:
     ):
         """Fail the endpoint *after* it has registered the on-commit callback.
 
-        ``delete`` is called for the access-token rows, which happens after the
-        bump and after ``db.on_commit(...)``. Making it raise reproduces "the
-        transaction did not commit" without needing to break the database.
+        Let the shared helper finish, then fail before the response commits.
+        This exercises rollback with an invalidation callback already queued.
         """
         import users.auth_local.self_account as self_account
 
         await _sign_in(anon_client)
 
-        def _explode(*args, **kwargs):
+        revoke = self_account.revoke_all_credentials
+
+        async def _explode(*args, **kwargs):
+            await revoke(*args, **kwargs)
             raise RuntimeError("simulated failure after the session_version bump")
 
-        monkeypatch.setattr(self_account, "delete", _explode)
+        monkeypatch.setattr(self_account, "revoke_all_credentials", _explode)
 
         with pytest.raises(RuntimeError, match="simulated failure"):
             await anon_client.post(_REVOKE)

simple_module_users-0.0.42/tests/test_users_admin_create_commit.py

@@ -0,0 +1,77 @@
+"""Single admin creation/invitation side effects follow the commit (#692, #627)."""
+
+import pytest
+from background_tasks.models import OutboxMessage
+from simple_module_db import transaction
+from sqlalchemy import event
+from sqlmodel import select
+from test_users_deletion_events import PausedUserTransport, record_user_event
+from users.contracts.events import UserCreated, UserInvited
+from users.models import User
+
+
+@pytest.mark.parametrize("operation,event_type", [("invite", UserInvited), ("create", UserCreated)])
+@pytest.mark.parametrize("durable", [False, True])
+@pytest.mark.parametrize("fail_commit", [True, False])
+async def test_admin_creation_side_effects_wait_for_commit(
+    admin_client, users_app, captured_mail, monkeypatch, operation, event_type, fail_commit, durable
+):
+    observed = []
+    before_commit = []
+
+    async def observe(message):
+        observed.append(message)
+
+    bus = users_app.state.sm.event_bus
+    bus.subscribe(event_type, observe)
+    if durable:
+        bus.durable_transport = PausedUserTransport()
+        bus.subscribe_durable(event_type, record_user_event)
+    email = "commit-boundary@example.com"
+
+    def fail(session):
+        raise RuntimeError("forced commit failure")
+
+    finalize = transaction.finalize_session
+
+    async def check_commit(session):
+        before_commit.append((list(captured_mail.messages), list(observed)))
+        if fail_commit:
+            event.listen(session.sync_session, "before_commit", fail, once=True)
+        await finalize(session)
+
+    monkeypatch.setattr(transaction, "finalize_session", check_commit)
+    db = users_app.state.sm.db
+    body = {"email": email, "role_names": []}
+    if operation == "create":
+        body["password"] = "CompliantPass1!"
+    response = await admin_client.post(
+        "/api/users/admin/invite" if operation == "invite" else "/api/users/admin", json=body
+    )
+
+    assert response.status_code == (500 if fail_commit else 201), response.text
+    assert before_commit == [([], [])]
+    async with db.session_factory() as session:
+        user = (await session.execute(select(User).where(User.email == email))).scalar_one_or_none()
+        outbox = (await session.execute(select(OutboxMessage))).scalars().all()
+    assert len(outbox) == (1 if durable and not fail_commit else 0)
+    if fail_commit:
+        assert captured_mail.messages == []
+        assert observed == []
+    else:
+        assert user is not None
+        assert len(observed) == 1
+        assert observed[0].user_id == user.id
+        assert observed[0].email == email
+        if operation == "invite":
+            assert any("/users/invite/accept?token=" in m.text for m in captured_mail.to(email))
+
+
+async def test_admin_invite_existing_email_is_a_conflict(admin_client, captured_mail):
+    body = {"email": "dup-invite@example.com", "role_names": []}
+    first = await admin_client.post("/api/users/admin/invite", json=body)
+    assert first.status_code == 201, first.text
+    sent = len(captured_mail.messages)
+    again = await admin_client.post("/api/users/admin/invite", json=body)
+    assert again.status_code == 409, again.text
+    assert len(captured_mail.messages) == sent

simple_module_users-0.0.42/tests/test_users_data_compatibility.py

@@ -0,0 +1,66 @@
+"""Semantic token checks accept current baselines and equivalent ports (#711)."""
+
+import pytest
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from users.module import UsersModule
+
+
+@pytest.mark.parametrize(
+    ("access_type", "refresh_type", "token", "incompatible"),
+    [
+        ("VARCHAR(64)", "VARCHAR(64)", None, False),
+        ("VARCHAR(64)", "VARCHAR(64)", "a" * 64, False),
+        ("VARCHAR(43)", "CHAR(32)", None, True),
+        ("VARCHAR(64)", "VARCHAR(64)", "plaintext", True),
+        ("VARCHAR(64)", "VARCHAR(64)", "z" * 64, True),
+    ],
+)
+async def test_users_semantic_token_compatibility(access_type, refresh_type, token, incompatible):
+    engine = create_async_engine("sqlite+aiosqlite:///:memory:")
+    try:
+        async with engine.begin() as conn:
+            for name, kind in [("access", access_type), ("refresh", refresh_type)]:
+                await conn.execute(text(f"CREATE TABLE users_{name}_token (token {kind})"))
+                if token:
+                    await conn.execute(
+                        text(f"INSERT INTO users_{name}_token VALUES (:token)"), {"token": token}
+                    )
+        async with async_sessionmaker(engine)() as db:
+            issues = await UsersModule().check_data_compatibility(db)
+            assert bool(issues) is incompatible
+            if incompatible:
+                assert issues[0].upgrade_id == "users.hashed_bearer_tokens_v1"
+                assert issues[0].severity == "error"
+            if token:
+                assert await db.scalar(text("SELECT token FROM users_access_token")) == token
+    finally:
+        await engine.dispose()
+
+
+async def test_missing_token_tables_are_not_a_finding():
+    # An unmigrated database is the migration check's problem; this must not
+    # refuse a production boot on its own.
+    engine = create_async_engine("sqlite+aiosqlite:///:memory:")
+    try:
+        async with async_sessionmaker(engine)() as db:
+            assert await UsersModule().check_data_compatibility(db) == []
+    finally:
+        await engine.dispose()
+
+
+async def test_plaintext_rows_behind_hashed_ones_are_found():
+    engine = create_async_engine("sqlite+aiosqlite:///:memory:")
+    try:
+        async with engine.begin() as conn:
+            for name in ("access", "refresh"):
+                await conn.execute(text(f"CREATE TABLE users_{name}_token (token VARCHAR(64))"))
+                for i in range(150):
+                    await conn.execute(
+                        text(f"INSERT INTO users_{name}_token VALUES (:t)"), {"t": f"{i:064x}"}
+                    )
+            await conn.execute(text("INSERT INTO users_access_token VALUES ('plaintext')"))
+        async with async_sessionmaker(engine)() as db:
+            assert await UsersModule().check_data_compatibility(db)
+    finally:
+        await engine.dispose()

simple_module_users-0.0.42/tests/test_users_mailer_templates.py

@@ -0,0 +1,148 @@
+"""Host template precedence, optional HTML, and startup configuration (#712)."""
+
+import json
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+from fastapi import FastAPI
+from jinja2 import TemplateNotFound, TemplateSyntaxError
+from jinja2.exceptions import SecurityError
+from simple_module_core.settings_hydrate import build_settings
+from users.mailer import build_mailer
+from users.mailer.templated import TemplatedMailer
+from users.settings import UsersSettings
+from users.startup import _build_mailer
+
+
+@pytest.mark.parametrize(
+    ("stem", "method", "args", "route"),
+    [
+        ("verify_email", "send_verification", (), "verify"),
+        ("reset_password", "send_password_reset", (), "reset-password"),
+        ("invite", "send_invite", ("<Alice>", " <note> "), "invite/accept"),
+    ],
+)
+async def test_html_only_override_keeps_bundled_text(
+    tmp_path, captured_mail, stem, method, args, route
+):
+    (tmp_path / f"{stem}.html").write_text(
+        "<p>{{ app_name }}|{{ link }}|{{ invited_by_name }}|{{ message }}</p>"
+    )
+    mailer = TemplatedMailer("https://example.com/", lambda: "<Acme>", template_dirs=[tmp_path])
+    await getattr(mailer, method)("a@example.com", "tok&x", *args)
+
+    (msg,) = captured_mail.messages
+    assert f"https://example.com/users/{route}?token=tok&x" in msg.text
+    assert "<Acme>" in msg.text
+    assert f"https://example.com/users/{route}?token=tok&amp;x" in msg.html
+    assert "&lt;Acme&gt;" in msg.html
+    if stem == "invite":
+        assert "&lt;Alice&gt;|&lt;note&gt;" in msg.html
+        assert "<Alice>" in msg.text and "<note>" in msg.text
+
+
+async def test_directory_order_and_independent_file_fallback(tmp_path, captured_mail):
+    first, second = tmp_path / "first", tmp_path / "second"
+    first.mkdir()
+    second.mkdir()
+    (first / "verify_email.txt").write_text("first {{ app_name }}")
+    (second / "verify_email.txt").write_text("second")
+    (second / "verify_email.html").write_text("<b>second {{ app_name }}</b>")
+    mailer = build_mailer(UsersSettings(), lambda: "<Acme>", template_dirs=[str(first), second])
+    await mailer.send_verification("a@example.com", "tok")
+    await mailer.send_password_reset("a@example.com", "reset")
+    verify, reset = captured_mail.messages
+    assert verify.text == "first <Acme>"
+    assert verify.html == "<b>second &lt;Acme&gt;</b>"
+    assert "/users/reset-password?token=reset" in reset.text
+    assert reset.html is None
+
+
+async def test_mailer_environments_are_isolated(tmp_path, captured_mail):
+    (tmp_path / "verify_email.txt").write_text("custom")
+    custom = TemplatedMailer("https://example.com", template_dirs=[tmp_path])
+    default = TemplatedMailer("https://example.com")
+    await custom.send_verification("a@example.com", "tok")
+    await default.send_verification("a@example.com", "tok")
+    await custom.send_verification("a@example.com", "tok")
+    assert [m.text for m in captured_mail.messages][::2] == ["custom", "custom"]
+    assert "Welcome to SimpleModule!" in captured_mail.messages[1].text
+    assert all(m.html is None for m in captured_mail.messages)
+
+
+@pytest.mark.parametrize(
+    ("source", "error"),
+    [
+        ("{% if %}", TemplateSyntaxError),
+        ('{% include "missing.html" %}', TemplateNotFound),
+        ('{% extends "missing.html" %}', TemplateNotFound),
+        ("{{ 1 / 0 }}", ZeroDivisionError),
+    ],
+)
+async def test_broken_html_prevents_delivery(tmp_path, captured_mail, source, error):
+    (tmp_path / "verify_email.html").write_text(source)
+    mailer = TemplatedMailer("https://example.com", template_dirs=[tmp_path])
+    with pytest.raises(error):
+        await mailer.send_verification("a@example.com", "tok")
+    assert not captured_mail.messages
+
+
+async def test_broken_text_is_not_hidden_by_bundled_fallback(tmp_path, captured_mail):
+    (tmp_path / "verify_email.txt").write_text("{% if %}")
+    mailer = TemplatedMailer("https://example.com", template_dirs=[tmp_path])
+    with pytest.raises(TemplateSyntaxError):
+        await mailer.send_verification("a@example.com", "tok")
+    assert not captured_mail.messages
+
+
+@pytest.mark.parametrize("kind", ["relative", "missing", "file"])
+def test_invalid_template_directory_is_skipped_with_warning(tmp_path, kind, caplog):
+    path = tmp_path / kind
+    if kind == "file":
+        path.write_text("not a directory")
+    if kind == "relative":
+        path = Path("relative")
+    settings = UsersSettings(mail_template_dirs=[str(path)])
+    state = SimpleNamespace()
+    _build_mailer(FastAPI(), state, settings)
+    assert state.mailer is not None
+    assert "Ignoring mail template path" in caplog.text
+
+
+async def test_startup_forwards_db_setting_and_keeps_branding_live(tmp_path, captured_mail):
+    (tmp_path / "verify_email.html").write_text("<p>{{ app_name }}</p>")
+    settings = build_settings(
+        UsersSettings, {"mail_template_dirs": (json.dumps([str(tmp_path)]), "json")}
+    )
+    app = FastAPI()
+    app.state.branding = SimpleNamespace(settings=SimpleNamespace(app_name="First"))
+    state = SimpleNamespace()
+    _build_mailer(app, state, settings)
+    app.state.branding.settings.app_name = "<Second>"
+    await state.mailer.send_verification("a@example.com", "tok")
+    (msg,) = captured_mail.messages
+    assert msg.html == "<p>&lt;Second&gt;</p>"
+    assert msg.subject == "Verify your email for <Second>"
+    assert "<Second>" in msg.text
+
+
+def test_template_setting_is_restart_required_and_defaults_are_independent(monkeypatch):
+    monkeypatch.setenv("SM_USERS_MAIL_TEMPLATE_DIRS", '["/ignored"]')
+    first, second = UsersSettings(), UsersSettings()
+    assert first.mail_template_dirs == []
+    first.mail_template_dirs.append("/trusted/templates")
+    assert second.mail_template_dirs == []
+    assert UsersSettings.model_fields["mail_template_dirs"].json_schema_extra == {
+        "requires_restart": True
+    }
+
+
+async def test_host_templates_render_sandboxed(tmp_path, captured_mail):
+    # The directory list is admin-editable, so a template must not reach Python
+    # internals (the classic ``__class__.__mro__`` escape).
+    (tmp_path / "verify_email.txt").write_text("{{ ''.__class__.__mro__[1].__subclasses__() }}")
+    mailer = TemplatedMailer("https://example.com", template_dirs=[tmp_path])
+    with pytest.raises(SecurityError):
+        await mailer.send_verification("a@example.com", "tok")
+    assert captured_mail.messages == []

simple_module_users-0.0.42/tests/test_users_reset_credentials.py

@@ -0,0 +1,118 @@
+"""A mailbox password reset strands every previously issued credential (#686)."""
+
+from urllib.parse import parse_qs, urlsplit
+
+import httpx
+import pytest
+from sqlmodel import select
+from users.models import RefreshToken, UserAccessToken
+from users.session_revocation import CHANNEL
+
+
+@pytest.mark.parametrize("credential", ["refresh", "session", "access"])
+async def test_reset_revokes_old_credentials(admin_client, anon_client, users_app, credential):
+    login = await anon_client.post(
+        "/api/users/auth/login",
+        data={"username": "admin@example.com", "password": "AdminPass1!"},
+    )
+    assert login.status_code == 204, login.text
+    pair = await anon_client.post(
+        "/api/users/auth/token",
+        json={"email": "admin@example.com", "password": "AdminPass1!"},
+    )
+    assert pair.status_code == 200, pair.text
+    tokens = pair.json()
+    me = await anon_client.get("/api/users/me")
+    assert me.status_code == 200, me.text
+    # Warm the session-version cache before resetting in a separate client.
+    assert (await anon_client.get("/admin/users/")).status_code == 200
+    link = await admin_client.post(f"/api/users/admin/{me.json()['id']}/reset-password-link")
+    assert link.status_code == 200, link.text
+    token = parse_qs(urlsplit(link.json()["link"]).query)["token"][0]
+    invalidations = []
+    users_app.state.sm.invalidation.subscribe(CHANNEL, invalidations.append)
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=users_app), base_url="http://testserver"
+    ) as fresh:
+        reset = await fresh.post(
+            "/api/users/auth/reset-password",
+            json={"token": token, "password": "NewCompliantPass1!"},
+        )
+        assert reset.status_code == 200, reset.text
+        assert [message.key for message in invalidations] == [me.json()["id"]]
+        async with users_app.state.sm.db.session_factory() as session:
+            assert (await session.execute(select(UserAccessToken))).scalars().all() == []
+            refresh_rows = (await session.execute(select(RefreshToken))).scalars().all()
+            assert refresh_rows and all(row.revoked_at is not None for row in refresh_rows)
+        if credential == "refresh":
+            response = await fresh.post(
+                "/api/users/auth/token/refresh", json={"refresh_token": tokens["refresh_token"]}
+            )
+            assert response.status_code == 401, response.text
+        elif credential == "access":
+            response = await fresh.get(
+                "/api/users/me", headers={"Authorization": f"Bearer {tokens['access_token']}"}
+            )
+            assert response.status_code == 401, response.text
+        else:
+            response = await anon_client.get("/admin/users/", follow_redirects=False)
+            assert response.status_code == 302, response.text
+            assert "/users/login" in response.headers["location"]
+
+
+async def test_reset_revokes_in_the_password_commit(
+    admin_client, anon_client, users_app, monkeypatch
+):
+    """A failure after the password is stored must not leave old credentials valid."""
+    from users.manager import UserManager
+
+    pair = await anon_client.post(
+        "/api/users/auth/token",
+        json={"email": "admin@example.com", "password": "AdminPass1!"},
+    )
+    assert pair.status_code == 200, pair.text
+    me = await anon_client.get(
+        "/api/users/me", headers={"Authorization": f"Bearer {pair.json()['access_token']}"}
+    )
+    link = await admin_client.post(f"/api/users/admin/{me.json()['id']}/reset-password-link")
+    token = parse_qs(urlsplit(link.json()["link"]).query)["token"][0]
+
+    async def explode(self, user, request=None):
+        raise RuntimeError("after-reset hook failed")
+
+    monkeypatch.setattr(UserManager, "on_after_reset_password", explode)
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=users_app, raise_app_exceptions=False),
+        base_url="http://testserver",
+    ) as fresh:
+        reset = await fresh.post(
+            "/api/users/auth/reset-password",
+            json={"token": token, "password": "NewCompliantPass1!"},
+        )
+        assert reset.status_code == 500
+        refreshed = await fresh.post(
+            "/api/users/auth/token/refresh",
+            json={"refresh_token": pair.json()["refresh_token"]},
+        )
+        assert refreshed.status_code == 401, refreshed.text
+    async with users_app.state.sm.db.session_factory() as session:
+        assert (await session.execute(select(UserAccessToken))).scalars().all() == []
+
+
+async def test_rejected_reset_password_revokes_nothing(admin_client, anon_client, users_app):
+    login = await anon_client.post(
+        "/api/users/auth/login",
+        data={"username": "admin@example.com", "password": "AdminPass1!"},
+    )
+    assert login.status_code == 204, login.text
+    me = await anon_client.get("/api/users/me")
+    link = await admin_client.post(f"/api/users/admin/{me.json()['id']}/reset-password-link")
+    token = parse_qs(urlsplit(link.json()["link"]).query)["token"][0]
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=users_app), base_url="http://testserver"
+    ) as fresh:
+        reset = await fresh.post(
+            "/api/users/auth/reset-password", json={"token": token, "password": "12345678"}
+        )
+        assert reset.status_code == 400, reset.text
+    assert (await anon_client.get("/admin/users/", follow_redirects=False)).status_code == 200

{simple_module_users-0.0.41 → simple_module_users-0.0.42}/users/admin/api.py

@@ -8,6 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from fastapi import status as http_status
 from fastapi_users import exceptions as fa_exceptions
 from simple_module_core.events import EventBus
+from simple_module_db import RequestSession
 from simple_module_db.deps import get_db
 from simple_module_db.pagination import PageParams
 from simple_module_hosting.pagination import page_params
@@ -42,6 +43,8 @@ from users.exceptions import (
 from users.invites.bulk import bulk_router
 from users.invites.resend import resend_router
 
+_DUPLICATE_EMAIL = "A user with this email already exists."
+
 admin_router = APIRouter(
     prefix="/admin",
     dependencies=[Depends(RequiresPermission(PERM_USERS_MANAGE))],
@@ -91,20 +94,26 @@ async def admin_invite_user(
     bus: EventBus = Depends(get_event_bus),
     service: UserService = Depends(get_user_service),
     mailer=Depends(get_mailer),
+    db: RequestSession = Depends(get_db),
 ):
     """Invite a new user by email, optionally assigning roles."""
     invited_by = getattr(request.state, "user", None)
     invited_by_name = invited_by.name if invited_by else "Administrator"
-    user, token = await service.invite(
-        data.email, data.full_name, data.role_names, invited_by=invited_by
-    )
-    await mailer.send_invite(user.email, token, invited_by_name)
-    await bus.publish(
+    try:
+        user, token = await service.invite(
+            data.email, data.full_name, data.role_names, invited_by=invited_by
+        )
+    except fa_exceptions.UserAlreadyExists:
+        raise HTTPException(status_code=409, detail=_DUPLICATE_EMAIL) from None
+    db.on_commit(lambda: mailer.send_invite(user.email, token, invited_by_name))
+    await publish_admin_event(
+        bus,
         UserInvited(
             user_id=user.id,
             email=user.email,
             invited_by=(str(invited_by.id) if invited_by else None),
-        )
+        ),
+        db,
     )
     return service.to_list_item(user)
 
@@ -119,6 +128,7 @@ async def admin_create_user(
     request: Request,
     bus: EventBus = Depends(get_event_bus),
     service: UserService = Depends(get_user_service),
+    db: AsyncSession = Depends(get_db),
 ):
     """Create an active+verified user with an admin-set password."""
     creator = getattr(request.state, "user", None)
@@ -132,13 +142,12 @@ async def admin_create_user(
             created_by=created_by,
         )
     except fa_exceptions.UserAlreadyExists:
-        raise HTTPException(
-            status_code=409,
-            detail="A user with this email already exists.",
-        ) from None
+        raise HTTPException(status_code=409, detail=_DUPLICATE_EMAIL) from None
     except fa_exceptions.InvalidPasswordException as exc:
         raise HTTPException(status_code=400, detail=exc.reason) from None
-    await bus.publish(UserCreated(user_id=user.id, email=user.email, created_by=created_by))
+    await publish_admin_event(
+        bus, UserCreated(user_id=user.id, email=user.email, created_by=created_by), db
+    )
     return service.to_list_item(user)
 
 
@@ -154,10 +163,7 @@ async def admin_update_user(
     except UserNotFoundError:
         raise HTTPException(status_code=404, detail="User not found") from None
     except EmailAlreadyExistsError:
-        raise HTTPException(
-            status_code=409,
-            detail="A user with this email already exists.",
-        ) from None
+        raise HTTPException(status_code=409, detail=_DUPLICATE_EMAIL) from None
     return service.to_list_item(user)