fix(user-flow): close offline-queue, export, session, ban & realtime gaps

Comprehensive user-flow review across guest/host/admin roles, then fixes with
e2e regression guards. Highlights:

- Offline upload queue auto-resumes on reconnect: network errors keep items
  pending (not error), 4xx are terminal (no infinite retry), quota exhaustion
  returns a distinct 413; queue cap + dedup.
- Export lifecycle: release atomically locks uploads; reopen invalidates and
  re-release regenerates the keepsake; workers claim their job atomically so a
  reopen->re-release can't corrupt the ZIP; startup re-spawns interrupted
  exports.
- Sessions slide on activity (no 30-day cliff); JWT expiry deferred to the
  revocable session row; sign-out-everywhere + revoke-on-PIN-reset.
- Ban always hides content (v_feed / find_visible_media / export filter
  is_banned) but stays a read-only ban per USER_JOURNEYS §10 — sessions are
  not revoked, read access + keepsake download preserved.
- Realtime: server-clock SSE delta cursor; event-closed/opened drive the UI
  live; feed_delta rate-limited; like returns {liked, like_count} to fix
  multi-device drift; lightbox live comments; diashow delta backfill.
- Forgotten-PIN in-app request flow; simultaneous same-name join returns 409;
  quota increment is transactional; operator floor.

Adds e2e/specs/10-flow-review/ (offline resume, export integrity, deterministic
anti-race guard) and updates existing specs for the new contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/src/handlers/host.rs

@@ -9,6 +9,7 @@ use crate::auth::middleware::RequireHost;
 use crate::error::AppError;
 use crate::models::comment::Comment;
 use crate::models::event::Event;
+use crate::models::session::Session;
 use crate::models::upload::Upload;
 use crate::models::user::UserRole;
 use crate::state::{AppState, SseEvent};
@@ -35,11 +36,27 @@ pub struct EventStatus {
     pub export_released: bool,
 }
 
-#[derive(Deserialize)]
-pub struct BanRequest {
-    pub hide_uploads: bool,
+/// Count non-banned hosts/admins in the event OTHER than `excluding` — the operators
+/// who would remain if `excluding` were demoted or banned. Used to enforce the "an event
+/// always keeps at least one operator" floor.
+async fn remaining_operators(
+    state: &AppState,
+    event_id: Uuid,
+    excluding: Uuid,
+) -> Result<i64, AppError> {
+    let count = sqlx::query_scalar::<_, i64>(
+        "SELECT COUNT(*) FROM \"user\"
+         WHERE event_id = $1 AND id != $2
+           AND role IN ('host', 'admin') AND is_banned = FALSE",
+    )
+    .bind(event_id)
+    .bind(excluding)
+    .fetch_one(&state.pool)
+    .await?;
+    Ok(count)
 }
 
+
 #[derive(Deserialize)]
 pub struct SetRoleRequest {
     pub role: String,
@@ -93,8 +110,8 @@ pub async fn ban_user(
     State(state): State<AppState>,
     RequireHost(auth): RequireHost,
     Path(user_id): Path<Uuid>,
-    Json(body): Json<BanRequest>,
 ) -> Result<StatusCode, AppError> {
+    // The ban request carries no body — ban always hides (no per-request options).
     // Cannot ban yourself or another host/admin
     if user_id == auth.user_id {
         return Err(AppError::BadRequest("Du kannst dich nicht selbst sperren.".into()));
@@ -112,29 +129,46 @@ pub async fn ban_user(
         return Err(AppError::Forbidden("Du kannst diesen Benutzer nicht sperren.".into()));
     }
 
+    // Floor: never leave the event with zero operators. Banning removes the target from
+    // the active-operator pool, so refuse if they're the last non-banned host/admin.
+    if target.0 == "host" && remaining_operators(&state, auth.event_id, user_id).await? == 0 {
+        return Err(AppError::BadRequest(
+            "Der letzte Host kann nicht gesperrt werden.".into(),
+        ));
+    }
+
+    // Ban ALWAYS hides: a banned user's content is "gone" everywhere. The visibility
+    // views/queries now also filter on `is_banned` (defense in depth), and we set
+    // `uploads_hidden` so the existing `user-hidden` live-eviction path fires too. The old
+    // opt-out checkbox is gone — `hide_uploads` in the request is ignored.
+    //
+    // We deliberately do NOT revoke the banned user's sessions. This is a *read-only ban*
+    // by design (USER_JOURNEYS §10.3): the user keeps read access to the feed and can still
+    // download the released export — writes and host/admin actions are what the ban blocks
+    // (enforced live on the write handlers + Require{Host,Admin}). Revoking sessions would
+    // contradict that model, break the documented "banned guest can still download the
+    // keepsake" flow, and be ineffective anyway (the user could just /recover a new session).
     sqlx::query(
-        "UPDATE \"user\" SET is_banned = TRUE, uploads_hidden = $2 WHERE id = $1 AND event_id = $3",
+        "UPDATE \"user\" SET is_banned = TRUE, uploads_hidden = TRUE WHERE id = $1 AND event_id = $2",
     )
     .bind(user_id)
-    .bind(body.hide_uploads)
     .bind(auth.event_id)
     .execute(&state.pool)
     .await?;
 
-    // If we hid their uploads, evict them live from every feed + the diashow so a
-    // banned guest's content disappears without each viewer having to reload.
-    if body.hide_uploads {
-        let _ = state.sse_tx.send(SseEvent::new(
-            "user-hidden",
-            serde_json::json!({ "user_id": user_id }).to_string(),
-        ));
-    }
+    // Evict their content live from every feed + the diashow so it disappears without
+    // each viewer having to reload. (Their own SSE stream is separately dropped by the
+    // is_banned revalidation in `sse::stream`, so they stop receiving live pushes while
+    // retaining plain read access.)
+    let _ = state.sse_tx.send(SseEvent::new(
+        "user-hidden",
+        serde_json::json!({ "user_id": user_id }).to_string(),
+    ));
 
     tracing::info!(
         actor_user_id = %auth.user_id,
         target_user_id = %user_id,
         event_id = %auth.event_id,
-        hide_uploads = body.hide_uploads,
         "host: ban_user"
     );
 
@@ -166,8 +200,10 @@ pub async fn unban_user(
         ));
     }
 
+    // Unban restores visibility too: ban set `uploads_hidden = TRUE`, so clearing only
+    // `is_banned` would leave their content invisible. Clear both.
     let result = sqlx::query(
-        "UPDATE \"user\" SET is_banned = FALSE WHERE id = $1 AND event_id = $2",
+        "UPDATE \"user\" SET is_banned = FALSE, uploads_hidden = FALSE WHERE id = $1 AND event_id = $2",
     )
     .bind(user_id)
     .bind(auth.event_id)
@@ -230,6 +266,17 @@ pub async fn set_role(
         ));
     }
 
+    // Floor: demoting the last non-banned host/admin to guest would leave the event with
+    // no operator. Refuse.
+    if new_role == "guest"
+        && target.0 == "host"
+        && remaining_operators(&state, auth.event_id, user_id).await? == 0
+    {
+        return Err(AppError::BadRequest(
+            "Der letzte Host kann nicht zum Gast gemacht werden.".into(),
+        ));
+    }
+
     sqlx::query("UPDATE \"user\" SET role = $2::user_role WHERE id = $1 AND event_id = $3")
         .bind(user_id)
         .bind(new_role)
@@ -308,6 +355,16 @@ pub async fn reset_user_pin(
     .execute(&state.pool)
     .await?;
 
+    // A PIN reset means the old credential is compromised/forgotten — revoke every
+    // existing session so old devices must re-authenticate with the new PIN.
+    let _ = Session::delete_all_for_user(&state.pool, user_id).await;
+
+    // Resolve any pending in-app "I forgot my PIN" request for this user.
+    let _ = sqlx::query("DELETE FROM pin_reset_request WHERE user_id = $1")
+        .bind(user_id)
+        .execute(&state.pool)
+        .await;
+
     // Notify the *recipient* device(s) if they happen to be online so they can clear
     // their cached local PIN. They'll save the new one on the next /recover.
     let _ = state.sse_tx.send(SseEvent::new(
@@ -325,6 +382,48 @@ pub async fn reset_user_pin(
     Ok(Json(PinResetResponse { pin }))
 }
 
+#[derive(Serialize, sqlx::FromRow)]
+pub struct PinResetRequestSummary {
+    pub id: Uuid,
+    pub user_id: Uuid,
+    pub display_name: String,
+    pub created_at: DateTime<Utc>,
+}
+
+/// List pending in-app PIN-reset requests so a host can action them (via the existing
+/// `reset_user_pin`, which also clears the request).
+pub async fn list_pin_reset_requests(
+    State(state): State<AppState>,
+    RequireHost(auth): RequireHost,
+) -> Result<Json<Vec<PinResetRequestSummary>>, AppError> {
+    let rows = sqlx::query_as::<_, PinResetRequestSummary>(
+        "SELECT r.id, r.user_id, u.display_name, r.created_at
+         FROM pin_reset_request r
+         JOIN \"user\" u ON u.id = r.user_id
+         WHERE r.event_id = $1
+         ORDER BY r.created_at ASC",
+    )
+    .bind(auth.event_id)
+    .fetch_all(&state.pool)
+    .await?;
+    Ok(Json(rows))
+}
+
+/// Dismiss a PIN-reset request without resetting (e.g. the host couldn't verify the
+/// requester's identity).
+pub async fn dismiss_pin_reset_request(
+    State(state): State<AppState>,
+    RequireHost(auth): RequireHost,
+    Path(id): Path<Uuid>,
+) -> Result<StatusCode, AppError> {
+    sqlx::query("DELETE FROM pin_reset_request WHERE id = $1 AND event_id = $2")
+        .bind(id)
+        .bind(auth.event_id)
+        .execute(&state.pool)
+        .await?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
 pub async fn host_delete_upload(
     State(state): State<AppState>,
     RequireHost(auth): RequireHost,
@@ -401,8 +500,17 @@ pub async fn open_event(
     State(state): State<AppState>,
     RequireHost(_auth): RequireHost,
 ) -> Result<StatusCode, AppError> {
+    // Reopening also invalidates any prior release: the keepsake was snapshotted at
+    // release time, so allowing new uploads afterwards would silently diverge the live
+    // feed from the frozen export. Clearing `export_released_at` (and the readiness
+    // flags) lets the host re-release later to regenerate a correct, complete keepsake.
     let result = sqlx::query(
-        "UPDATE event SET uploads_locked_at = NULL WHERE slug = $1 AND uploads_locked_at IS NOT NULL",
+        "UPDATE event
+         SET uploads_locked_at = NULL,
+             export_released_at = NULL,
+             export_zip_ready = FALSE,
+             export_html_ready = FALSE
+         WHERE slug = $1 AND (uploads_locked_at IS NOT NULL OR export_released_at IS NOT NULL)",
     )
     .bind(&state.config.event_slug)
     .execute(&state.pool)
@@ -422,8 +530,15 @@ pub async fn release_gallery(
     // Atomic claim: the conditional UPDATE is the sole gate, so two concurrent
     // release calls can't both pass a check-then-set and double-enqueue exports.
     // rows_affected == 0 means someone already released.
+    //
+    // Releasing also locks uploads in the same statement (release ⇒ lock). Otherwise a
+    // guest whose offline upload reconnects *after* the export snapshot would land in the
+    // live feed but not in the downloaded keepsake — a silent, non-regenerable data loss.
+    // `COALESCE` preserves an earlier explicit lock time rather than overwriting it.
     let result = sqlx::query(
-        "UPDATE event SET export_released_at = NOW()
+        "UPDATE event
+         SET export_released_at = NOW(),
+             uploads_locked_at = COALESCE(uploads_locked_at, NOW())
          WHERE slug = $1 AND export_released_at IS NULL",
     )
     .bind(&state.config.event_slug)
@@ -441,32 +556,26 @@ pub async fn release_gallery(
         });
     }
 
+    // Release locked uploads too — tell any open composer to flip to the locked UI live
+    // rather than discovering it via a rejected upload.
+    let _ = state.sse_tx.send(SseEvent::new("event-closed", "{}"));
+
     // We won the claim — load the event for its id/name to enqueue export jobs.
     let event = Event::find_by_slug(&state.pool, &state.config.event_slug)
         .await?
         .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
 
-    // Enqueue export jobs
-    for export_type in ["zip", "html"] {
-        sqlx::query(
-            "INSERT INTO export_job (event_id, type) VALUES ($1, $2::export_type)
-             ON CONFLICT (event_id, type) DO NOTHING",
-        )
-        .bind(event.id)
-        .bind(export_type)
-        .execute(&state.pool)
-        .await?;
-    }
-
-    // Spawn export workers
-    crate::services::export::spawn_export_jobs(
+    // Enqueue + spawn via the shared path so a re-release (after reopen) regenerates
+    // cleanly and startup recovery uses identical logic.
+    crate::services::export::enqueue_and_spawn_exports(
         event.id,
         event.name,
         state.pool.clone(),
         state.config.media_path.clone(),
         state.config.export_path.clone(),
         state.sse_tx.clone(),
-    );
+    )
+    .await?;
 
     Ok(StatusCode::NO_CONTENT)
 }