fix(review-2): high — read-only ban model, failed-compression cleanup, live SSE eviction

H1: corrected a round-1 over-reach. Bans are read-only per USER_JOURNEYS §10:
    the base AuthUser extractor no longer rejects banned users (they keep read
    access); Require{Host,Admin} and write handlers enforce the ban via
    auth.is_banned → 403 (incl. self-unban). Demoted hosts still lose powers
    immediately (live DB role) and are bounced off the dashboard. Also fixed the
    login/recover redirect regression on unauthenticated 401.

H2: failed compression now self-heals instead of leaving a permanent broken
    card — refund the quota, delete the orphaned original, soft-delete the row;
    the frontend toasts the uploader and evicts the card on upload-error.

H3: self-delete, ban-with-hide (user-hidden), and comment-deletes now broadcast
    SSE; feed, diashow, and lightbox evict the affected content live instead of
    waiting for a reload. sse-eviction.spec.ts covers it.

Riders: feed/+page.svelte also carries the medium truncated-delta pill; host.rs
also carries the low atomic release_gallery claim; admin/+page.svelte also drops
the dead compression_concurrency control (medium).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/auth/middleware.rs

@@ -13,6 +13,10 @@ pub struct AuthUser {
     pub user_id: Uuid,
     pub event_id: Uuid,
     pub role: UserRole,
+    /// Live ban flag. Banned users keep *read* access (per USER_JOURNEYS §10), so
+    /// the base extractor does NOT reject them — write handlers and the
+    /// Require{Host,Admin} extractors enforce the ban instead.
+    pub is_banned: bool,
     pub token_hash: String,
 }
 
@@ -45,15 +49,13 @@ impl FromRequestParts<AppState> for AuthUser {
 
         // Trust *live* DB state, not the JWT: a role/ban stored in the token would
         // survive a demote/ban for the full session lifetime (up to 30d). Re-read
-        // the user row so a demoted host loses host powers and a banned user is
-        // locked out immediately on their next request.
+        // the user row so a demoted host loses host powers immediately. We do NOT
+        // reject banned users here — they retain read access by design; writes and
+        // host/admin actions enforce the ban downstream.
         let user = crate::models::user::User::find_by_id(&state.pool, claims.sub)
             .await
             .map_err(|e| AppError::Internal(e.into()))?
             .ok_or_else(|| AppError::Unauthorized("Benutzer nicht gefunden.".into()))?;
-        if user.is_banned {
-            return Err(AppError::Forbidden("Dein Zugang wurde gesperrt.".into()));
-        }
 
         // Update last_seen_at in the background (fire-and-forget). Failures are
         // non-fatal but worth surfacing — silent swallowing hides DB connection
@@ -70,6 +72,7 @@ impl FromRequestParts<AppState> for AuthUser {
             user_id: user.id,
             event_id: user.event_id,
             role: user.role,
+            is_banned: user.is_banned,
             token_hash,
         })
     }
@@ -86,6 +89,9 @@ impl FromRequestParts<AppState> for RequireHost {
         state: &AppState,
     ) -> Result<Self, Self::Rejection> {
         let auth = AuthUser::from_request_parts(parts, state).await?;
+        if auth.is_banned {
+            return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+        }
         match auth.role {
             UserRole::Host | UserRole::Admin => Ok(Self(auth)),
             _ => Err(AppError::Forbidden("Nur für Hosts und Admins.".into())),
@@ -104,6 +110,9 @@ impl FromRequestParts<AppState> for RequireAdmin {
         state: &AppState,
     ) -> Result<Self, Self::Rejection> {
         let auth = AuthUser::from_request_parts(parts, state).await?;
+        if auth.is_banned {
+            return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+        }
         match auth.role {
             UserRole::Admin => Ok(Self(auth)),
             _ => Err(AppError::Forbidden("Nur für Admins.".into())),

backend/src/handlers/host.rs

@@ -121,6 +121,15 @@ pub async fn ban_user(
     .execute(&state.pool)
     .await?;
 
+    // If we hid their uploads, evict them live from every feed + the diashow so a
+    // banned guest's content disappears without each viewer having to reload.
+    if body.hide_uploads {
+        let _ = state.sse_tx.send(SseEvent::new(
+            "user-hidden",
+            serde_json::json!({ "user_id": user_id }).to_string(),
+        ));
+    }
+
     tracing::info!(
         actor_user_id = %auth.user_id,
         target_user_id = %user_id,
@@ -329,6 +338,10 @@ pub async fn host_delete_comment(
     if !deleted {
         return Err(AppError::NotFound("Kommentar nicht gefunden.".into()));
     }
+    let _ = state.sse_tx.send(SseEvent::new(
+        "comment-deleted",
+        serde_json::json!({ "comment_id": comment_id }).to_string(),
+    ));
     tracing::info!(
         actor_user_id = %auth.user_id,
         event_id = %auth.event_id,
@@ -380,19 +393,33 @@ pub async fn release_gallery(
     State(state): State<AppState>,
     RequireHost(_auth): RequireHost,
 ) -> Result<StatusCode, AppError> {
+    // Atomic claim: the conditional UPDATE is the sole gate, so two concurrent
+    // release calls can't both pass a check-then-set and double-enqueue exports.
+    // rows_affected == 0 means someone already released.
+    let result = sqlx::query(
+        "UPDATE event SET export_released_at = NOW()
+         WHERE slug = $1 AND export_released_at IS NULL",
+    )
+    .bind(&state.config.event_slug)
+    .execute(&state.pool)
+    .await?;
+    if result.rows_affected() == 0 {
+        // Distinguish "no such event" from "already released" for a clean error.
+        let exists = Event::find_by_slug(&state.pool, &state.config.event_slug)
+            .await?
+            .is_some();
+        return Err(if exists {
+            AppError::BadRequest("Galerie wurde bereits freigegeben.".into())
+        } else {
+            AppError::NotFound("Event nicht gefunden.".into())
+        });
+    }
+
+    // We won the claim — load the event for its id/name to enqueue export jobs.
     let event = Event::find_by_slug(&state.pool, &state.config.event_slug)
         .await?
         .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
 
-    if event.export_released_at.is_some() {
-        return Err(AppError::BadRequest("Galerie wurde bereits freigegeben.".into()));
-    }
-
-    sqlx::query("UPDATE event SET export_released_at = NOW() WHERE slug = $1")
-        .bind(&state.config.event_slug)
-        .execute(&state.pool)
-        .await?;
-
     // Enqueue export jobs
     for export_type in ["zip", "html"] {
         sqlx::query(
@@ -411,6 +438,7 @@ pub async fn release_gallery(
         event.name,
         state.pool.clone(),
         state.config.media_path.clone(),
+        state.config.export_path.clone(),
         state.sse_tx.clone(),
     );
 

backend/src/handlers/social.rs

@@ -213,5 +213,9 @@ pub async fn delete_comment(
     if !deleted {
         return Err(AppError::NotFound("Kommentar nicht gefunden.".into()));
     }
+    let _ = state.sse_tx.send(crate::state::SseEvent::new(
+        "comment-deleted",
+        serde_json::json!({ "comment_id": comment_id, "upload_id": comment.upload_id }).to_string(),
+    ));
     Ok(StatusCode::NO_CONTENT)
 }

backend/src/handlers/upload.rs

@@ -313,6 +313,14 @@ pub async fn delete_upload(
 
     Upload::soft_delete_in_event(&state.pool, upload_id, auth.event_id).await?;
 
+    // Evict the card live on every other feed + the projector diashow — otherwise
+    // a self-deleted post lingers until each viewer manually reloads. Same event
+    // the host-delete path already emits and the frontend already handles.
+    let _ = state.sse_tx.send(crate::state::SseEvent::new(
+        "upload-deleted",
+        serde_json::json!({ "upload_id": upload_id }).to_string(),
+    ));
+
     Ok(StatusCode::NO_CONTENT)
 }
 

backend/src/services/compression.rs

@@ -42,11 +42,28 @@ impl CompressionWorker {
                 }
                 Err(e) => {
                     tracing::error!("compression failed for upload {upload_id}: {e:#}");
+                    // Auto-cleanup: a failed transcode would otherwise leave a
+                    // permanently broken feed card, silently charge the uploader's
+                    // quota, and orphan the original on disk. Refund + soft-delete
+                    // (one tx, so v_feed excludes it), remove the orphan file, then
+                    // tell the uploader (upload-error toast) and evict the card
+                    // everywhere (upload-deleted, already handled by the feed).
+                    let _ = Upload::set_compression_status(&worker.pool, upload_id, "failed").await;
+                    if let Err(del) = Upload::soft_delete(&worker.pool, upload_id).await {
+                        tracing::warn!(error = ?del, %upload_id, "failed to soft-delete after compression failure");
+                    }
+                    let orphan = worker.media_path.join(&original_path);
+                    if let Err(rm) = tokio::fs::remove_file(&orphan).await {
+                        tracing::warn!(error = ?rm, path = %orphan.display(), "failed to remove orphaned original");
+                    }
                     let _ = worker.sse_tx.send(SseEvent {
                         event_type: "upload-error".to_string(),
                         data: serde_json::json!({ "upload_id": upload_id, "error": e.to_string() }).to_string(),
                     });
-                    let _ = Upload::set_compression_status(&worker.pool, upload_id, "failed").await;
+                    let _ = worker.sse_tx.send(SseEvent {
+                        event_type: "upload-deleted".to_string(),
+                        data: serde_json::json!({ "upload_id": upload_id }).to_string(),
+                    });
                 }
             }
         });