Release 0.2.0

src/app.css

@@ -78,7 +78,8 @@ body {
 }
 
 button,
-input {
+input,
+select {
 	font: inherit;
 }
 
@@ -1179,6 +1180,290 @@ a {
 	font-size: 0.72rem;
 }
 
+.auth-shell {
+	min-height: 100vh;
+	background:
+		radial-gradient(
+			circle at 12% 8%,
+			color-mix(in srgb, var(--accent) 12%, transparent),
+			transparent 28rem
+		),
+		var(--bg);
+}
+
+.auth-header {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	min-height: 4.25rem;
+	padding: 0.65rem clamp(1rem, 4vw, 3rem);
+	border-bottom: 1px solid var(--line);
+	background: color-mix(in srgb, var(--bg-elevated) 86%, transparent);
+	backdrop-filter: blur(20px);
+}
+
+.auth-header .theme-toggle {
+	width: auto;
+}
+
+.auth-main {
+	display: grid;
+	min-height: calc(100vh - 4.25rem);
+	padding: clamp(1.25rem, 6vw, 4rem) 1rem;
+	place-items: start center;
+}
+
+.auth-card {
+	width: min(100%, 30rem);
+	padding: clamp(1.25rem, 4vw, 2rem);
+	border: 1px solid var(--line);
+	border-radius: var(--radius-large);
+	background: var(--panel);
+	box-shadow: var(--shadow);
+}
+
+.auth-card h1 {
+	margin: 0.3rem 0 0.5rem;
+	font-size: clamp(1.6rem, 5vw, 2.1rem);
+	letter-spacing: -0.04em;
+	line-height: 1.1;
+}
+
+.auth-card > p:not(.eyebrow),
+.quiet-copy {
+	margin: 0 0 1rem;
+	color: var(--text-muted);
+	font-size: 0.85rem;
+}
+
+.auth-form,
+.compact-form {
+	display: grid;
+	gap: 0.85rem;
+}
+
+.auth-form label,
+.compact-form label {
+	display: grid;
+	gap: 0.32rem;
+	color: var(--text-muted);
+	font-size: 0.75rem;
+	font-weight: 700;
+}
+
+.auth-form input,
+.compact-form input,
+.compact-form select,
+.inline-account-form select {
+	width: 100%;
+	min-height: 2.65rem;
+	padding: 0.55rem 0.7rem;
+	border: 1px solid var(--line-strong);
+	border-radius: var(--radius-small);
+	background: var(--panel-strong);
+	color: var(--text);
+}
+
+.primary-button,
+.secondary-button,
+.logout-button,
+.mobile-logout,
+.text-button {
+	border: 0;
+	cursor: pointer;
+	font-weight: 700;
+}
+
+.primary-button {
+	min-height: 2.7rem;
+	padding: 0.6rem 0.9rem;
+	border-radius: var(--radius-small);
+	background: var(--accent);
+	color: var(--panel-strong);
+}
+
+.secondary-button,
+.logout-button {
+	min-height: 2.35rem;
+	padding: 0.48rem 0.7rem;
+	border: 1px solid var(--line);
+	border-radius: var(--radius-small);
+	background: transparent;
+}
+
+.secondary-button:disabled {
+	cursor: not-allowed;
+	opacity: 0.55;
+}
+
+.logout-button {
+	width: 100%;
+	color: var(--text-muted);
+	text-align: left;
+}
+
+.mobile-logout {
+	width: 2.4rem;
+	height: 2.4rem;
+	border-radius: 50%;
+	background: transparent;
+	color: var(--text-muted);
+}
+
+.text-button {
+	padding: 0.25rem;
+	background: transparent;
+	color: var(--accent);
+	font-size: 0.7rem;
+}
+
+.auth-link {
+	display: inline-block;
+	margin-top: 1rem;
+	color: var(--accent);
+	font-size: 0.78rem;
+	font-weight: 700;
+}
+
+.field-hint {
+	margin: -0.35rem 0 0;
+	color: var(--text-faint);
+	font-size: 0.68rem;
+}
+
+.form-message {
+	margin: 0 0 1rem;
+	padding: 0.7rem 0.8rem;
+	border: 1px solid var(--line);
+	border-radius: var(--radius-small);
+	font-size: 0.76rem;
+}
+
+.form-message.error {
+	border-color: color-mix(in srgb, var(--danger) 45%, var(--line));
+	background: color-mix(in srgb, var(--danger) 8%, var(--panel));
+}
+
+.form-message.success {
+	border-color: color-mix(in srgb, var(--accent) 38%, var(--line));
+	background: color-mix(in srgb, var(--accent-soft) 55%, var(--panel));
+}
+
+.account-summary {
+	display: grid;
+	padding: 0 0.7rem;
+}
+
+.account-summary span {
+	font-size: 0.75rem;
+	font-weight: 700;
+}
+
+.account-summary small {
+	color: var(--text-faint);
+	font-size: 0.65rem;
+}
+
+.account-panel,
+.invite-panel {
+	padding: 1rem;
+}
+
+.account-panel {
+	margin-bottom: 0.75rem;
+}
+
+.panel-heading {
+	display: flex;
+	align-items: flex-start;
+	justify-content: space-between;
+	gap: 1rem;
+}
+
+.panel-heading h2,
+.invite-panel h2,
+.section-heading {
+	margin: 0.18rem 0 0.7rem;
+	font-size: 1rem;
+}
+
+.mail-mode,
+.account-status {
+	padding: 0.22rem 0.45rem;
+	border-radius: 2rem;
+	background: var(--accent-soft);
+	color: var(--accent-text);
+	font-size: 0.65rem;
+	font-weight: 700;
+}
+
+.account-status.locked {
+	background: color-mix(in srgb, var(--danger) 12%, var(--panel));
+	color: var(--danger);
+}
+
+.account-list {
+	display: grid;
+	border-top: 1px solid var(--line);
+}
+
+.account-row {
+	display: grid;
+	grid-template-columns: minmax(10rem, 1fr) auto minmax(11rem, auto) auto;
+	align-items: center;
+	gap: 0.7rem;
+	padding: 0.7rem 0;
+	border-bottom: 1px solid var(--line);
+}
+
+.account-row > div,
+.invitation-list span {
+	display: grid;
+	min-width: 0;
+}
+
+.account-row small,
+.invitation-list small {
+	color: var(--text-muted);
+	font-size: 0.68rem;
+	overflow-wrap: anywhere;
+}
+
+.inline-account-form {
+	display: flex;
+	align-items: center;
+	gap: 0.35rem;
+}
+
+.inline-account-form select {
+	min-height: 2.2rem;
+	padding-block: 0.35rem;
+}
+
+.management-grid {
+	display: grid;
+	grid-template-columns: repeat(2, minmax(0, 1fr));
+	gap: 0.75rem;
+	margin-bottom: 1rem;
+}
+
+.invitation-list {
+	display: grid;
+}
+
+.invitation-list > div {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	gap: 0.7rem;
+	padding: 0.55rem 0;
+	border-bottom: 1px solid var(--line);
+}
+
+.section-heading {
+	margin-top: 1rem;
+}
+
 @media (max-width: 72rem) {
 	.page-wrap {
 		padding-inline: 2rem;
@@ -1250,12 +1535,15 @@ a {
 		z-index: 30;
 		display: grid;
 		height: calc(var(--mobile-nav) + env(safe-area-inset-bottom));
-		grid-template-columns: repeat(5, 1fr);
+		grid-template-columns: repeat(4, 1fr);
 		padding: 0.45rem 0.35rem env(safe-area-inset-bottom);
 		border-top: 1px solid var(--line);
 		background: color-mix(in srgb, var(--bg-elevated) 92%, transparent);
 		backdrop-filter: blur(22px) saturate(1.3);
 	}
+	.mobile-navigation:has(a:nth-child(5)) {
+		grid-template-columns: repeat(5, 1fr);
+	}
 	.mobile-navigation a {
 		display: flex;
 		min-width: 0;
@@ -1399,6 +1687,19 @@ a {
 	.settings-grid {
 		grid-template-columns: 1fr;
 	}
+	.management-grid {
+		grid-template-columns: 1fr;
+	}
+	.account-row {
+		grid-template-columns: minmax(0, 1fr) auto;
+	}
+	.inline-account-form,
+	.account-row > form:last-child {
+		grid-column: 1 / -1;
+	}
+	.inline-account-form select {
+		flex: 1;
+	}
 }
 
 @media (max-width: 24rem) {

src/app.d.ts

@@ -1,5 +1,14 @@
+import type { AuthUser } from '#lib/server/auth.js';
+
 declare global {
-	namespace App {}
+	namespace App {
+		interface Locals {
+			user: AuthUser | null;
+		}
+		interface PageData {
+			user?: AuthUser | null;
+		}
+	}
 }
 
 export {};

src/hooks.server.ts

@@ -0,0 +1,32 @@
+import { redirect } from '@sveltejs/kit';
+import type { Handle } from '@sveltejs/kit/hooks';
+import { deleteSession, getSessionUser, hasUsers, SESSION_COOKIE } from '#lib/server/auth.js';
+
+const publicPaths = new Set([
+	'/',
+	'/healthz',
+	'/login',
+	'/setup',
+	'/einladung',
+	'/passwort-vergessen',
+	'/passwort-zuruecksetzen'
+]);
+
+export const handle: Handle = async ({ event, resolve }) => {
+	const token = event.cookies.get(SESSION_COOKIE);
+	event.locals.user = getSessionUser(token);
+	if (token && !event.locals.user) deleteSession(event.cookies);
+
+	if (!publicPaths.has(event.url.pathname) && !event.locals.user) {
+		redirect(303, hasUsers() ? '/login' : '/setup');
+	}
+
+	const response = await resolve(event);
+	response.headers.set('Referrer-Policy', 'same-origin');
+	response.headers.set('X-Content-Type-Options', 'nosniff');
+	response.headers.set('X-Frame-Options', 'DENY');
+	if (event.url.pathname === '/einladung' || event.url.pathname === '/passwort-zuruecksetzen') {
+		response.headers.set('Cache-Control', 'no-store');
+	}
+	return response;
+};

src/lib/server/auth.spec.ts

@@ -0,0 +1,255 @@
+import Database from 'better-sqlite3';
+import { execFileSync } from 'node:child_process';
+import { readFileSync, readdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import type { Cookies } from '@sveltejs/kit';
+
+const temporaryDirectories: string[] = [];
+let directory: string;
+let databasePath: string;
+
+function testCookies(): Cookies {
+	const values = new Map<string, string>();
+	return {
+		get: (name: string) => values.get(name),
+		getAll: () => Array.from(values, ([name, value]) => ({ name, value })),
+		set: (name: string, value: string) => {
+			values.set(name, value);
+		},
+		delete: (name: string) => {
+			values.delete(name);
+		},
+		serialize: () => ''
+	} as unknown as Cookies;
+}
+
+function tokenFromLatestMail(): string {
+	const outbox = path.join(directory, 'outbox');
+	const files = readdirSync(outbox).sort();
+	const message = JSON.parse(readFileSync(path.join(outbox, files.at(-1)!), 'utf8')) as {
+		text: string;
+	};
+	const match = message.text.match(/[?&]token=([^\s]+)/);
+	if (!match) throw new Error('Testmail enthält keinen Token.');
+	return decodeURIComponent(match[1]);
+}
+
+beforeEach(() => {
+	directory = mkdtempSync(path.join(tmpdir(), 'sendewerk-auth-test-'));
+	temporaryDirectories.push(directory);
+	databasePath = path.join(directory, 'test.sqlite');
+	process.env.SENDEWERK_DB_PATH = databasePath;
+	process.env.SENDEWERK_UPLOAD_DIR = path.join(directory, 'uploads');
+	process.env.SENDEWERK_MAIL_OUTBOX_DIR = path.join(directory, 'outbox');
+	process.env.SENDEWERK_MAIL_TRANSPORT = 'local';
+	process.env.SENDEWERK_APP_ORIGIN = 'http://localhost:5173';
+	process.env.SENDEWERK_SETUP_TOKEN = 'a'.repeat(32);
+	execFileSync(process.execPath, ['scripts/migrate.mjs'], { cwd: process.cwd(), env: process.env });
+});
+
+afterEach(async () => {
+	const { closeDatabase } = await import('./database.js');
+	closeDatabase();
+	for (const name of [
+		'SENDEWERK_DB_PATH',
+		'SENDEWERK_UPLOAD_DIR',
+		'SENDEWERK_MAIL_OUTBOX_DIR',
+		'SENDEWERK_MAIL_TRANSPORT',
+		'SENDEWERK_MAIL_FROM',
+		'SENDEWERK_SMTP_HOST',
+		'SENDEWERK_APP_ORIGIN',
+		'SENDEWERK_SETUP_TOKEN'
+	]) {
+		delete process.env[name];
+	}
+	for (const temporaryDirectory of temporaryDirectories.splice(0)) {
+		rmSync(temporaryDirectory, { recursive: true, force: true });
+	}
+});
+
+describe('authentication', () => {
+	it('creates the first Barkeeper once and stores no plaintext secret', async () => {
+		const { createFirstAdmin } = await import('./auth.js');
+		const password = 'Ein-sehr-langes-Testpasswort';
+		const user = await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'Bar@example.org',
+			displayName: 'Erster Barkeeper',
+			password
+		});
+		const database = new Database(databasePath, { readonly: true });
+		const row = database.prepare('SELECT * FROM users').get() as {
+			role: string;
+			email_normalized: string;
+			password_hash: string;
+		};
+		database.close();
+
+		expect(user.role).toBe('barkeeper');
+		expect(row.email_normalized).toBe('bar@example.org');
+		expect(row.password_hash).not.toContain(password);
+		await expect(
+			createFirstAdmin({
+				setupToken: 'a'.repeat(32),
+				email: 'second@example.org',
+				displayName: 'Zweiter Admin',
+				password
+			})
+		).rejects.toThrow('SETUP_CLOSED');
+	});
+
+	it('accepts an invitation only once and rejects an expired invitation', async () => {
+		const { acceptInvitation, createFirstAdmin, inviteUser } = await import('./auth.js');
+		const admin = await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'admin@example.org',
+			displayName: 'Admin',
+			password: 'Admin-Passwort-1234'
+		});
+		await inviteUser(admin, 'crew@example.org', 'thekencrew');
+		const firstToken = tokenFromLatestMail();
+		const crew = await acceptInvitation({
+			token: firstToken,
+			displayName: 'Crew',
+			password: 'Crew-Passwort-1234'
+		});
+		expect(crew.role).toBe('thekencrew');
+		await expect(
+			acceptInvitation({
+				token: firstToken,
+				displayName: 'Crew',
+				password: 'Crew-Passwort-1234'
+			})
+		).rejects.toThrow('TOKEN_INVALID');
+
+		await inviteUser(admin, 'late@example.org', 'thekencrew');
+		const expiredToken = tokenFromLatestMail();
+		const database = new Database(databasePath);
+		database.prepare("UPDATE invitations SET expires_at_utc = '2000-01-01T00:00:00.000Z'").run();
+		database.close();
+		await expect(
+			acceptInvitation({
+				token: expiredToken,
+				displayName: 'Zu spät',
+				password: 'Crew-Passwort-1234'
+			})
+		).rejects.toThrow('TOKEN_INVALID');
+	});
+
+	it('revokes active sessions immediately when a user is locked', async () => {
+		const { createFirstAdmin, createSession, getSessionUser, setUserLocked, SESSION_COOKIE } =
+			await import('./auth.js');
+		const admin = await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'admin@example.org',
+			displayName: 'Admin',
+			password: 'Admin-Passwort-1234'
+		});
+		const database = new Database(databasePath);
+		const crewId = crypto.randomUUID();
+		database
+			.prepare(
+				`INSERT INTO users (id, email, email_normalized, display_name, password_hash, role,
+				 password_changed_at_utc, created_at_utc, updated_at_utc)
+				 SELECT ?, 'crew@example.org', 'crew@example.org', 'Crew', password_hash, 'thekencrew',
+				 password_changed_at_utc, created_at_utc, updated_at_utc FROM users WHERE id = ?`
+			)
+			.run(crewId, admin.id);
+		database.close();
+		const cookies = testCookies();
+		createSession(crewId, cookies);
+		const token = cookies.get(SESSION_COOKIE);
+		expect(getSessionUser(token)?.id).toBe(crewId);
+
+		setUserLocked(admin, crewId, true);
+		expect(getSessionUser(token)).toBeNull();
+	});
+
+	it('uses password reset links once and invalidates prior sessions', async () => {
+		const {
+			authenticate,
+			createFirstAdmin,
+			createSession,
+			getSessionUser,
+			requestPasswordReset,
+			resetPassword,
+			SESSION_COOKIE
+		} = await import('./auth.js');
+		const admin = await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'admin@example.org',
+			displayName: 'Admin',
+			password: 'Altes-Passwort-1234'
+		});
+		const cookies = testCookies();
+		createSession(admin.id, cookies);
+		const sessionToken = cookies.get(SESSION_COOKIE);
+		await requestPasswordReset(admin.email);
+		const expiredToken = tokenFromLatestMail();
+		const database = new Database(databasePath);
+		database
+			.prepare("UPDATE password_reset_tokens SET expires_at_utc = '2000-01-01T00:00:00.000Z'")
+			.run();
+		database.close();
+		await expect(resetPassword(expiredToken, 'Neues-Passwort-1234')).rejects.toThrow(
+			'TOKEN_INVALID'
+		);
+		await requestPasswordReset(admin.email);
+		const resetToken = tokenFromLatestMail();
+		await resetPassword(resetToken, 'Neues-Passwort-1234');
+
+		expect(getSessionUser(sessionToken)).toBeNull();
+		expect(await authenticate(admin.email, 'Altes-Passwort-1234')).toBeNull();
+		expect(await authenticate(admin.email, 'Neues-Passwort-1234')).not.toBeNull();
+		await expect(resetPassword(resetToken, 'Noch-ein-Passwort-1234')).rejects.toThrow(
+			'TOKEN_INVALID'
+		);
+	});
+
+	it('rate limits repeated failed login attempts without locking the account', async () => {
+		const { authenticate, createFirstAdmin, loginIsRateLimited, reserveLoginAttempt } =
+			await import('./auth.js');
+		await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'admin@example.org',
+			displayName: 'Admin',
+			password: 'Admin-Passwort-1234'
+		});
+		for (let attempt = 0; attempt < 5; attempt += 1) {
+			expect(reserveLoginAttempt('admin@example.org', '127.0.0.1')).toBe(true);
+			expect(await authenticate('admin@example.org', 'falsch')).toBeNull();
+		}
+		expect(loginIsRateLimited('admin@example.org', '127.0.0.1')).toBe(true);
+		const database = new Database(databasePath, { readonly: true });
+		const user = database.prepare('SELECT locked_at_utc FROM users').get() as {
+			locked_at_utc: string | null;
+		};
+		database.close();
+		expect(user.locked_at_utc).toBeNull();
+	});
+
+	it('denies administrative operations to Thekencrew', async () => {
+		const { requireBarkeeper } = await import('./auth.js');
+		expect(() =>
+			requireBarkeeper({
+				id: 'crew',
+				email: 'crew@example.org',
+				displayName: 'Crew',
+				role: 'thekencrew',
+				lockedAtUtc: null
+			})
+		).toThrow();
+	});
+
+	it('never falls back to local delivery when SMTP was selected', async () => {
+		process.env.SENDEWERK_MAIL_TRANSPORT = 'smtp';
+		process.env.SENDEWERK_MAIL_FROM = '';
+		process.env.SENDEWERK_SMTP_HOST = '';
+		const { sendMail } = await import('./mail.js');
+		await expect(
+			sendMail({ to: 'test@example.org', subject: 'Test', text: 'Keine echte Nachricht' })
+		).rejects.toThrow('SMTP-Konfiguration');
+	});
+});

src/lib/server/auth.ts

@@ -0,0 +1,610 @@
+import { hash, verify } from '@node-rs/argon2';
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { error } from '@sveltejs/kit';
+import type { Cookies } from '@sveltejs/kit';
+import { getAuthConfig } from './config.js';
+import { getDatabase } from './database.js';
+import { sendMail } from './mail.js';
+
+export const SESSION_COOKIE = 'sendewerk_session';
+export const INVITATION_COOKIE = 'sendewerk_invitation';
+export const RESET_COOKIE = 'sendewerk_password_reset';
+const SESSION_DURATION_MS = 30 * 24 * 60 * 60 * 1000;
+const LINK_DURATION_MS = 24 * 60 * 60 * 1000;
+const LOGIN_WINDOW_MS = 15 * 60 * 1000;
+const EMAIL_ATTEMPT_LIMIT = 5;
+const ADDRESS_ATTEMPT_LIMIT = 20;
+const RESET_WINDOW_MS = 60 * 60 * 1000;
+const RESET_EMAIL_LIMIT = 3;
+const RESET_ADDRESS_LIMIT = 10;
+const PASSWORD_OPTIONS = {
+	algorithm: 2,
+	memoryCost: 19_456,
+	timeCost: 2,
+	parallelism: 1,
+	outputLen: 32
+} as const;
+
+export type Role = 'barkeeper' | 'thekencrew';
+export type AuthUser = {
+	id: string;
+	email: string;
+	displayName: string;
+	role: Role;
+	lockedAtUtc: string | null;
+};
+
+type UserRow = {
+	id: string;
+	email: string;
+	display_name: string;
+	password_hash: string;
+	role: Role;
+	locked_at_utc: string | null;
+};
+
+type InvitationRow = {
+	id: string;
+	email: string;
+	role: Role;
+	expires_at_utc: string;
+	accepted_at_utc: string | null;
+	revoked_at_utc: string | null;
+};
+
+function toUser(row: UserRow): AuthUser {
+	return {
+		id: row.id,
+		email: row.email,
+		displayName: row.display_name,
+		role: row.role,
+		lockedAtUtc: row.locked_at_utc
+	};
+}
+
+export function normalizeEmail(email: string): string {
+	return email.trim().toLowerCase();
+}
+
+export function validEmail(email: string): boolean {
+	return email.length <= 254 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+
+export function validDisplayName(name: string): boolean {
+	return name.trim().length >= 2 && name.trim().length <= 80;
+}
+
+export function validPassword(password: string): boolean {
+	return password.length >= 12 && Buffer.byteLength(password, 'utf8') <= 256;
+}
+
+export function isRole(value: string): value is Role {
+	return value === 'barkeeper' || value === 'thekencrew';
+}
+
+export async function hashPassword(password: string): Promise<string> {
+	return hash(password, PASSWORD_OPTIONS);
+}
+
+export async function verifyPassword(passwordHash: string, password: string): Promise<boolean> {
+	return verify(passwordHash, password, PASSWORD_OPTIONS);
+}
+
+const dummyPasswordHash = hashPassword(randomBytes(32).toString('hex'));
+
+function createToken(): string {
+	return randomBytes(32).toString('base64url');
+}
+
+function hashToken(token: string): string {
+	return createHash('sha256').update(token).digest('hex');
+}
+
+function nowUtc(): string {
+	return new Date().toISOString();
+}
+
+function futureUtc(durationMs: number): string {
+	return new Date(Date.now() + durationMs).toISOString();
+}
+
+export function hasUsers(): boolean {
+	const row = getDatabase().prepare('SELECT count(*) AS count FROM users').get() as {
+		count: number;
+	};
+	return row.count > 0;
+}
+
+export function setupIsConfigured(): boolean {
+	return getAuthConfig().setupToken.length >= 32;
+}
+
+function setupTokenMatches(candidate: string): boolean {
+	const configured = getAuthConfig().setupToken;
+	if (configured.length < 32 || candidate.length !== configured.length) return false;
+	return timingSafeEqual(Buffer.from(candidate), Buffer.from(configured));
+}
+
+export async function createFirstAdmin(input: {
+	setupToken: string;
+	email: string;
+	displayName: string;
+	password: string;
+}): Promise<AuthUser> {
+	if (!setupTokenMatches(input.setupToken)) throw new Error('SETUP_TOKEN_INVALID');
+	const email = input.email.trim();
+	const emailNormalized = normalizeEmail(email);
+	const displayName = input.displayName.trim();
+	if (!validEmail(email) || !validDisplayName(displayName) || !validPassword(input.password)) {
+		throw new Error('VALIDATION');
+	}
+	const passwordHash = await hashPassword(input.password);
+	const database = getDatabase();
+	const create = database.transaction(() => {
+		const count = database.prepare('SELECT count(*) AS count FROM users').get() as {
+			count: number;
+		};
+		if (count.count !== 0) throw new Error('SETUP_CLOSED');
+		const id = randomUUID();
+		const timestamp = nowUtc();
+		database
+			.prepare(
+				`INSERT INTO users (
+					id, email, email_normalized, display_name, password_hash, role,
+					password_changed_at_utc, created_at_utc, updated_at_utc
+				) VALUES (?, ?, ?, ?, ?, 'barkeeper', ?, ?, ?)`
+			)
+			.run(id, email, emailNormalized, displayName, passwordHash, timestamp, timestamp, timestamp);
+		return { id, email, displayName, role: 'barkeeper', lockedAtUtc: null } satisfies AuthUser;
+	});
+	return create();
+}
+
+function sessionCookieOptions(expires?: Date) {
+	return {
+		path: '/',
+		httpOnly: true,
+		sameSite: 'lax' as const,
+		secure: getAuthConfig().secureCookies,
+		expires
+	};
+}
+
+function linkCookieOptions() {
+	return {
+		path: '/',
+		httpOnly: true,
+		sameSite: 'strict' as const,
+		secure: getAuthConfig().secureCookies,
+		maxAge: 10 * 60
+	};
+}
+
+export function storeLinkToken(cookies: Cookies, name: string, token: string): void {
+	cookies.set(name, token, linkCookieOptions());
+}
+
+export function readLinkToken(cookies: Cookies, name: string): string {
+	return cookies.get(name) || '';
+}
+
+export function deleteLinkToken(cookies: Cookies, name: string): void {
+	cookies.delete(name, { ...linkCookieOptions(), maxAge: 0 });
+}
+
+export function createSession(userId: string, cookies: Cookies): void {
+	const token = createToken();
+	const expires = new Date(Date.now() + SESSION_DURATION_MS);
+	getDatabase()
+		.prepare(
+			'INSERT INTO sessions (token_hash, user_id, created_at_utc, expires_at_utc) VALUES (?, ?, ?, ?)'
+		)
+		.run(hashToken(token), userId, nowUtc(), expires.toISOString());
+	cookies.set(SESSION_COOKIE, token, sessionCookieOptions(expires));
+}
+
+export function deleteSession(cookies: Cookies): void {
+	const token = cookies.get(SESSION_COOKIE);
+	if (token)
+		getDatabase().prepare('DELETE FROM sessions WHERE token_hash = ?').run(hashToken(token));
+	cookies.delete(SESSION_COOKIE, sessionCookieOptions());
+}
+
+export function getSessionUser(token: string | undefined): AuthUser | null {
+	if (!token) return null;
+	const database = getDatabase();
+	const row = database
+		.prepare(
+			`SELECT u.id, u.email, u.display_name, u.password_hash, u.role, u.locked_at_utc
+			 FROM sessions s
+			 JOIN users u ON u.id = s.user_id
+			 WHERE s.token_hash = ? AND s.expires_at_utc > ? AND u.locked_at_utc IS NULL`
+		)
+		.get(hashToken(token), nowUtc()) as UserRow | undefined;
+	if (!row) return null;
+	return toUser(row);
+}
+
+function rateKey(value: string): string {
+	return hashToken(value || 'unknown');
+}
+
+export function loginIsRateLimited(email: string, address: string): boolean {
+	const database = getDatabase();
+	const since = new Date(Date.now() - LOGIN_WINDOW_MS).toISOString();
+	database.prepare('DELETE FROM login_attempts WHERE attempted_at_utc < ?').run(since);
+	const emailCount = database
+		.prepare(
+			'SELECT count(*) AS count FROM login_attempts WHERE email_key = ? AND attempted_at_utc >= ?'
+		)
+		.get(rateKey(normalizeEmail(email)), since) as { count: number };
+	const addressCount = database
+		.prepare(
+			'SELECT count(*) AS count FROM login_attempts WHERE address_key = ? AND attempted_at_utc >= ?'
+		)
+		.get(rateKey(address), since) as { count: number };
+	return emailCount.count >= EMAIL_ATTEMPT_LIMIT || addressCount.count >= ADDRESS_ATTEMPT_LIMIT;
+}
+
+export function reserveLoginAttempt(email: string, address: string): boolean {
+	const database = getDatabase();
+	const reserve = database.transaction(() => {
+		if (loginIsRateLimited(email, address)) return false;
+		database
+			.prepare(
+				'INSERT INTO login_attempts (id, email_key, address_key, attempted_at_utc) VALUES (?, ?, ?, ?)'
+			)
+			.run(randomUUID(), rateKey(normalizeEmail(email)), rateKey(address), nowUtc());
+		return true;
+	});
+	return reserve();
+}
+
+export async function authenticate(email: string, password: string): Promise<AuthUser | null> {
+	const database = getDatabase();
+	const normalized = normalizeEmail(email);
+	const row = database
+		.prepare(
+			`SELECT id, email, display_name, password_hash, role, locked_at_utc
+			 FROM users WHERE email_normalized = ?`
+		)
+		.get(normalized) as UserRow | undefined;
+	const matches = row
+		? await verifyPassword(row.password_hash, password)
+		: await verifyPassword(await dummyPasswordHash, password);
+	if (!row || !matches || row.locked_at_utc) {
+		return null;
+	}
+	database.prepare('DELETE FROM login_attempts WHERE email_key = ?').run(rateKey(normalized));
+	return toUser(row);
+}
+
+export function requireUser(user: AuthUser | null): AuthUser {
+	if (!user) error(401, 'Anmeldung erforderlich');
+	return user;
+}
+
+export function requireBarkeeper(user: AuthUser | null): AuthUser {
+	const authenticated = requireUser(user);
+	if (authenticated.role !== 'barkeeper') error(403, 'Diese Aktion erfordert Barkeeper-Rechte.');
+	return authenticated;
+}
+
+function requireCurrentBarkeeper(actor: AuthUser): AuthUser {
+	const row = getDatabase()
+		.prepare(
+			`SELECT id, email, display_name, password_hash, role, locked_at_utc
+			 FROM users WHERE id = ? AND role = 'barkeeper' AND locked_at_utc IS NULL`
+		)
+		.get(actor.id) as UserRow | undefined;
+	if (!row) error(403, 'Diese Aktion erfordert aktive Barkeeper-Rechte.');
+	return toUser(row);
+}
+
+export function listUsers(): AuthUser[] {
+	const rows = getDatabase()
+		.prepare(
+			`SELECT id, email, display_name, password_hash, role, locked_at_utc
+			 FROM users ORDER BY display_name COLLATE NOCASE`
+		)
+		.all() as UserRow[];
+	return rows.map(toUser);
+}
+
+export function listOpenInvitations() {
+	return getDatabase()
+		.prepare(
+			`SELECT id, email, role, expires_at_utc
+			 FROM invitations
+			 WHERE accepted_at_utc IS NULL AND revoked_at_utc IS NULL AND expires_at_utc > ?
+			 ORDER BY created_at_utc DESC`
+		)
+		.all(nowUtc()) as Array<{ id: string; email: string; role: Role; expires_at_utc: string }>;
+}
+
+export async function inviteUser(
+	actor: AuthUser,
+	emailValue: string,
+	role: Role
+): Promise<'local' | 'smtp'> {
+	actor = requireCurrentBarkeeper(actor);
+	const email = emailValue.trim();
+	const normalized = normalizeEmail(email);
+	if (!validEmail(email) || !isRole(role)) throw new Error('VALIDATION');
+	const database = getDatabase();
+	if (database.prepare('SELECT 1 FROM users WHERE email_normalized = ?').get(normalized)) {
+		throw new Error('USER_EXISTS');
+	}
+	const token = createToken();
+	const id = randomUUID();
+	const timestamp = nowUtc();
+	const expiresAt = futureUtc(LINK_DURATION_MS);
+	const store = database.transaction(() => {
+		database
+			.prepare(
+				`UPDATE invitations SET revoked_at_utc = ?
+				 WHERE email_normalized = ? AND accepted_at_utc IS NULL AND revoked_at_utc IS NULL`
+			)
+			.run(timestamp, normalized);
+		database
+			.prepare(
+				`INSERT INTO invitations (
+					id, email, email_normalized, role, token_hash, created_by_user_id,
+					created_at_utc, expires_at_utc
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+			)
+			.run(id, email, normalized, role, hashToken(token), actor.id, timestamp, expiresAt);
+	});
+	store();
+	const link = new URL(
+		`/einladung?token=${encodeURIComponent(token)}`,
+		getAuthConfig().origin
+	).toString();
+	try {
+		return await sendMail({
+			to: email,
+			subject: 'Einladung zu Sendewerk',
+			text: `Du wurdest zu Sendewerk eingeladen. Der Link ist 24 Stunden gültig und einmalig nutzbar:\n\n${link}`
+		});
+	} catch (mailError) {
+		database.prepare('UPDATE invitations SET revoked_at_utc = ? WHERE id = ?').run(nowUtc(), id);
+		throw mailError;
+	}
+}
+
+export function getInvitation(token: string): InvitationRow | null {
+	if (!token || token.length > 100) return null;
+	return (
+		(getDatabase()
+			.prepare(
+				`SELECT id, email, role, expires_at_utc, accepted_at_utc, revoked_at_utc
+				 FROM invitations WHERE token_hash = ?`
+			)
+			.get(hashToken(token)) as InvitationRow | undefined) ?? null
+	);
+}
+
+export async function acceptInvitation(input: {
+	token: string;
+	displayName: string;
+	password: string;
+}): Promise<AuthUser> {
+	const invitation = getInvitation(input.token);
+	const displayName = input.displayName.trim();
+	if (
+		!invitation ||
+		invitation.accepted_at_utc ||
+		invitation.revoked_at_utc ||
+		invitation.expires_at_utc <= nowUtc()
+	) {
+		throw new Error('TOKEN_INVALID');
+	}
+	if (!validDisplayName(displayName) || !validPassword(input.password))
+		throw new Error('VALIDATION');
+	const passwordHash = await hashPassword(input.password);
+	const database = getDatabase();
+	const accept = database.transaction(() => {
+		const current = database
+			.prepare(
+				`SELECT id, email, role, expires_at_utc, accepted_at_utc, revoked_at_utc
+				 FROM invitations WHERE id = ?`
+			)
+			.get(invitation.id) as InvitationRow;
+		if (current.accepted_at_utc || current.revoked_at_utc || current.expires_at_utc <= nowUtc()) {
+			throw new Error('TOKEN_INVALID');
+		}
+		const id = randomUUID();
+		const timestamp = nowUtc();
+		database
+			.prepare(
+				`INSERT INTO users (
+					id, email, email_normalized, display_name, password_hash, role,
+					password_changed_at_utc, created_at_utc, updated_at_utc
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			)
+			.run(
+				id,
+				current.email,
+				normalizeEmail(current.email),
+				displayName,
+				passwordHash,
+				current.role,
+				timestamp,
+				timestamp,
+				timestamp
+			);
+		database
+			.prepare('UPDATE invitations SET accepted_at_utc = ? WHERE id = ?')
+			.run(timestamp, current.id);
+		return {
+			id,
+			email: current.email,
+			displayName,
+			role: current.role,
+			lockedAtUtc: null
+		} satisfies AuthUser;
+	});
+	return accept();
+}
+
+export function reservePasswordResetRequest(email: string, address: string): boolean {
+	const database = getDatabase();
+	const since = new Date(Date.now() - RESET_WINDOW_MS).toISOString();
+	const emailKey = rateKey(`reset-email:${normalizeEmail(email)}`);
+	const addressKey = rateKey(`reset-address:${address}`);
+	const reserve = database.transaction(() => {
+		database.prepare('DELETE FROM login_attempts WHERE attempted_at_utc < ?').run(since);
+		const emailCount = database
+			.prepare(
+				'SELECT count(*) AS count FROM login_attempts WHERE email_key = ? AND attempted_at_utc >= ?'
+			)
+			.get(emailKey, since) as { count: number };
+		const addressCount = database
+			.prepare(
+				'SELECT count(*) AS count FROM login_attempts WHERE address_key = ? AND attempted_at_utc >= ?'
+			)
+			.get(addressKey, since) as { count: number };
+		if (emailCount.count >= RESET_EMAIL_LIMIT || addressCount.count >= RESET_ADDRESS_LIMIT)
+			return false;
+		database
+			.prepare(
+				'INSERT INTO login_attempts (id, email_key, address_key, attempted_at_utc) VALUES (?, ?, ?, ?)'
+			)
+			.run(randomUUID(), emailKey, addressKey, nowUtc());
+		return true;
+	});
+	return reserve();
+}
+
+export async function requestPasswordReset(emailValue: string): Promise<void> {
+	const normalized = normalizeEmail(emailValue);
+	const database = getDatabase();
+	const row = database
+		.prepare('SELECT id, email FROM users WHERE email_normalized = ?')
+		.get(normalized) as { id: string; email: string } | undefined;
+	if (!row) return;
+	const token = createToken();
+	const id = randomUUID();
+	const timestamp = nowUtc();
+	database
+		.prepare(
+			`INSERT INTO password_reset_tokens
+			 (id, user_id, token_hash, created_at_utc, expires_at_utc)
+			 VALUES (?, ?, ?, ?, ?)`
+		)
+		.run(id, row.id, hashToken(token), timestamp, futureUtc(LINK_DURATION_MS));
+	const link = new URL(
+		`/passwort-zuruecksetzen?token=${encodeURIComponent(token)}`,
+		getAuthConfig().origin
+	).toString();
+	try {
+		await sendMail({
+			to: row.email,
+			subject: 'Sendewerk-Passwort zurücksetzen',
+			text: `Mit diesem 24 Stunden gültigen, einmaligen Link kannst du dein Passwort zurücksetzen:\n\n${link}`
+		});
+	} catch (mailError) {
+		database.prepare('DELETE FROM password_reset_tokens WHERE id = ?').run(id);
+		throw mailError;
+	}
+}
+
+export function passwordResetIsValid(token: string): boolean {
+	if (!token || token.length > 100) return false;
+	return Boolean(
+		getDatabase()
+			.prepare(
+				`SELECT 1 FROM password_reset_tokens
+				 WHERE token_hash = ? AND consumed_at_utc IS NULL AND expires_at_utc > ?`
+			)
+			.get(hashToken(token), nowUtc())
+	);
+}
+
+export async function resetPassword(token: string, password: string): Promise<void> {
+	if (!passwordResetIsValid(token)) throw new Error('TOKEN_INVALID');
+	if (!validPassword(password)) throw new Error('VALIDATION');
+	const passwordHash = await hashPassword(password);
+	const database = getDatabase();
+	const reset = database.transaction(() => {
+		const row = database
+			.prepare(
+				`SELECT id, user_id FROM password_reset_tokens
+				 WHERE token_hash = ? AND consumed_at_utc IS NULL AND expires_at_utc > ?`
+			)
+			.get(hashToken(token), nowUtc()) as { id: string; user_id: string } | undefined;
+		if (!row) throw new Error('TOKEN_INVALID');
+		const timestamp = nowUtc();
+		database
+			.prepare(
+				`UPDATE users SET password_hash = ?, password_changed_at_utc = ?, updated_at_utc = ?
+				 WHERE id = ?`
+			)
+			.run(passwordHash, timestamp, timestamp, row.user_id);
+		database
+			.prepare(
+				'UPDATE password_reset_tokens SET consumed_at_utc = ? WHERE user_id = ? AND consumed_at_utc IS NULL'
+			)
+			.run(timestamp, row.user_id);
+		database.prepare('DELETE FROM sessions WHERE user_id = ?').run(row.user_id);
+	});
+	reset();
+}
+
+function activeBarkeeperCount(): number {
+	const row = getDatabase()
+		.prepare(
+			"SELECT count(*) AS count FROM users WHERE role = 'barkeeper' AND locked_at_utc IS NULL"
+		)
+		.get() as { count: number };
+	return row.count;
+}
+
+export function setUserLocked(actor: AuthUser, userId: string, locked: boolean): void {
+	actor = requireCurrentBarkeeper(actor);
+	const database = getDatabase();
+	const row = database.prepare('SELECT role, locked_at_utc FROM users WHERE id = ?').get(userId) as
+		{ role: Role; locked_at_utc: string | null } | undefined;
+	if (!row) throw new Error('NOT_FOUND');
+	if (locked && actor.id === userId) throw new Error('SELF_LOCK');
+	if (locked && row.role === 'barkeeper' && !row.locked_at_utc && activeBarkeeperCount() <= 1) {
+		throw new Error('LAST_BARKEEPER');
+	}
+	const update = database.transaction(() => {
+		database
+			.prepare('UPDATE users SET locked_at_utc = ?, updated_at_utc = ? WHERE id = ?')
+			.run(locked ? nowUtc() : null, nowUtc(), userId);
+		if (locked) database.prepare('DELETE FROM sessions WHERE user_id = ?').run(userId);
+	});
+	update();
+}
+
+export function setUserRole(actor: AuthUser, userId: string, role: Role): void {
+	requireCurrentBarkeeper(actor);
+	if (!isRole(role)) throw new Error('VALIDATION');
+	const database = getDatabase();
+	const row = database.prepare('SELECT role, locked_at_utc FROM users WHERE id = ?').get(userId) as
+		{ role: Role; locked_at_utc: string | null } | undefined;
+	if (!row) throw new Error('NOT_FOUND');
+	if (
+		row.role === 'barkeeper' &&
+		role === 'thekencrew' &&
+		!row.locked_at_utc &&
+		activeBarkeeperCount() <= 1
+	) {
+		throw new Error('LAST_BARKEEPER');
+	}
+	database
+		.prepare('UPDATE users SET role = ?, updated_at_utc = ? WHERE id = ?')
+		.run(role, nowUtc(), userId);
+}
+
+export function revokeInvitation(actor: AuthUser, invitationId: string): void {
+	requireCurrentBarkeeper(actor);
+	getDatabase()
+		.prepare(
+			`UPDATE invitations SET revoked_at_utc = ?
+			 WHERE id = ? AND accepted_at_utc IS NULL AND revoked_at_utc IS NULL`
+		)
+		.run(nowUtc(), invitationId);
+}

src/lib/server/config.ts

@@ -7,6 +7,38 @@ function configuredPath(value: string | undefined, fallback: string): string {
 export function getServerPaths() {
 	return {
 		database: configuredPath(process.env.SENDEWERK_DB_PATH, '.data/sendewerk.sqlite'),
-		uploads: configuredPath(process.env.SENDEWERK_UPLOAD_DIR, '.data/uploads')
+		uploads: configuredPath(process.env.SENDEWERK_UPLOAD_DIR, '.data/uploads'),
+		mailOutbox: configuredPath(process.env.SENDEWERK_MAIL_OUTBOX_DIR, '.data/mail-outbox')
+	};
+}
+
+export function getAuthConfig() {
+	const configuredOrigin = process.env.SENDEWERK_APP_ORIGIN || process.env.CLOUDRON_APP_ORIGIN;
+	if (process.env.NODE_ENV === 'production' && !configuredOrigin) {
+		throw new Error('SENDEWERK_APP_ORIGIN muss im Produktionsbetrieb gesetzt sein.');
+	}
+	const origin = new URL(configuredOrigin || 'http://localhost:5173');
+	return {
+		origin,
+		setupToken: process.env.SENDEWERK_SETUP_TOKEN || '',
+		secureCookies: origin.protocol === 'https:'
+	};
+}
+
+export function getMailConfig() {
+	const transport = process.env.SENDEWERK_MAIL_TRANSPORT || 'local';
+	if (transport !== 'local' && transport !== 'smtp') {
+		throw new Error('SENDEWERK_MAIL_TRANSPORT muss local oder smtp sein.');
+	}
+	return {
+		transport,
+		from:
+			process.env.SENDEWERK_MAIL_FROM ||
+			(transport === 'local' ? 'Sendewerk <sendewerk@localhost>' : ''),
+		host: process.env.SENDEWERK_SMTP_HOST || '',
+		port: Number(process.env.SENDEWERK_SMTP_PORT || '587'),
+		secure: process.env.SENDEWERK_SMTP_SECURE === 'true',
+		user: process.env.SENDEWERK_SMTP_USER || '',
+		password: process.env.SENDEWERK_SMTP_PASSWORD || ''
 	};
 }

src/lib/server/database.spec.ts

@@ -52,7 +52,7 @@ describe('database setup', () => {
 			.get() as { migrations: number; pieces: number; shows: number; usages: number };
 		database.close();
 
-		expect(counts).toEqual({ migrations: 1, pieces: 4, shows: 1, usages: 3 });
+		expect(counts).toEqual({ migrations: 2, pieces: 4, shows: 1, usages: 3 });
 		expect(databasePath).not.toBe(path.resolve('.data/sendewerk.sqlite'));
 	});
 

src/lib/server/mail.ts

@@ -0,0 +1,49 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import nodemailer from 'nodemailer';
+import { getMailConfig, getServerPaths } from './config.js';
+
+export type MailMessage = {
+	to: string;
+	subject: string;
+	text: string;
+};
+
+export async function sendMail(message: MailMessage): Promise<'local' | 'smtp'> {
+	const config = getMailConfig();
+	if (config.transport === 'local') {
+		const outbox = getServerPaths().mailOutbox;
+		await mkdir(outbox, { recursive: true, mode: 0o700 });
+		const filename = `${new Date().toISOString().replaceAll(':', '-')}-${randomUUID()}.json`;
+		await writeFile(
+			path.join(outbox, filename),
+			JSON.stringify({ from: config.from, ...message }, null, 2),
+			{ encoding: 'utf8', mode: 0o600 }
+		);
+		return 'local';
+	}
+
+	if (
+		!config.host ||
+		!config.from ||
+		!Number.isInteger(config.port) ||
+		config.port < 1 ||
+		config.port > 65_535 ||
+		Boolean(config.user) !== Boolean(config.password)
+	) {
+		throw new Error('Die SMTP-Konfiguration ist unvollständig.');
+	}
+	const transporter = nodemailer.createTransport({
+		host: config.host,
+		port: config.port,
+		secure: config.secure,
+		requireTLS: !config.secure,
+		connectionTimeout: 10_000,
+		greetingTimeout: 10_000,
+		socketTimeout: 20_000,
+		auth: config.user ? { user: config.user, pass: config.password } : undefined
+	});
+	await transporter.sendMail({ from: config.from, ...message });
+	return 'smtp';
+}

src/routes/+layout.server.ts

@@ -0,0 +1,3 @@
+import type { LayoutServerLoad } from './$types';
+
+export const load: LayoutServerLoad = ({ locals }) => ({ user: locals.user });

src/routes/+layout.svelte

@@ -5,7 +5,7 @@
 	import NavIcon from '#lib/components/NavIcon.svelte';
 	import ThemeToggle from '#lib/components/ThemeToggle.svelte';
 
-	let { children } = $props();
+	let { children, data } = $props();
 	const primaryNavigation = [
 		{ href: '/eingang', label: 'Eingang', icon: 'inbox' },
 		{ href: '/fundus', label: 'Fundus', icon: 'library' },
@@ -13,7 +13,9 @@
 		{ href: '/archiv', label: 'Archiv', icon: 'archive' }
 	] as const;
 	const administration = { href: '/verwaltung', label: 'Verwaltung', icon: 'settings' } as const;
-	const mobileNavigation = [...primaryNavigation, administration];
+	const mobileNavigation = $derived(
+		data.user?.role === 'barkeeper' ? [...primaryNavigation, administration] : primaryNavigation
+	);
 
 	function isActive(href: string) {
 		return (
@@ -29,15 +31,66 @@
 	/>
 </svelte:head>
 
-<div class="app-shell">
-	<aside class="sidebar">
-		<a class="brand" href={resolve('/fundus')} aria-label="Sendewerk Startseite">
-			<span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>
-			<span>Sendewerk</span>
-		</a>
+{#if data.user}
+	<div class="app-shell">
+		<aside class="sidebar">
+			<a class="brand" href={resolve('/fundus')} aria-label="Sendewerk Startseite">
+				<span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>
+				<span>Sendewerk</span>
+			</a>
 
-		<nav class="main-navigation" aria-label="Hauptnavigation">
-			{#each primaryNavigation as item (item.href)}
+			<nav class="main-navigation" aria-label="Hauptnavigation">
+				{#each primaryNavigation as item (item.href)}
+					<a
+						href={resolve(item.href)}
+						class:active={isActive(item.href)}
+						aria-current={isActive(item.href) ? 'page' : undefined}
+					>
+						<NavIcon name={item.icon} />
+						<span>{item.label}</span>
+					</a>
+				{/each}
+			</nav>
+
+			<div class="sidebar-footer">
+				{#if data.user.role === 'barkeeper'}
+					<nav class="utility-navigation" aria-label="Verwaltung">
+						<a
+							href={resolve(administration.href)}
+							class:active={isActive(administration.href)}
+							aria-current={isActive(administration.href) ? 'page' : undefined}
+						>
+							<NavIcon name={administration.icon} />
+							<span>{administration.label}</span>
+						</a>
+					</nav>
+				{/if}
+				<div class="account-summary">
+					<span>{data.user.displayName}</span>
+					<small>{data.user.role === 'barkeeper' ? 'Barkeeper' : 'Thekencrew'}</small>
+				</div>
+				<form method="POST" action="/logout">
+					<button class="logout-button" type="submit">Abmelden</button>
+				</form>
+				<ThemeToggle />
+			</div>
+		</aside>
+
+		<header class="mobile-header">
+			<a class="brand" href={resolve('/fundus')} aria-label="Sendewerk Startseite">
+				<span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>
+				<span>Sendewerk</span>
+			</a>
+			<form method="POST" action="/logout">
+				<button class="mobile-logout" type="submit" aria-label="Abmelden">↗</button>
+			</form>
+			<ThemeToggle />
+		</header>
+
+		<main id="main-content">{@render children()}</main>
+
+		<nav class="mobile-navigation" aria-label="Hauptnavigation">
+			{#each mobileNavigation as item (item.href)}
 				<a
 					href={resolve(item.href)}
 					class:active={isActive(item.href)}
@@ -48,42 +101,16 @@
 				</a>
 			{/each}
 		</nav>
-
-		<div class="sidebar-footer">
-			<nav class="utility-navigation" aria-label="Verwaltung">
-				<a
-					href={resolve(administration.href)}
-					class:active={isActive(administration.href)}
-					aria-current={isActive(administration.href) ? 'page' : undefined}
-				>
-					<NavIcon name={administration.icon} />
-					<span>{administration.label}</span>
-				</a>
-			</nav>
-			<ThemeToggle />
-		</div>
-	</aside>
-
-	<header class="mobile-header">
-		<a class="brand" href={resolve('/fundus')} aria-label="Sendewerk Startseite">
-			<span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>
-			<span>Sendewerk</span>
-		</a>
-		<ThemeToggle />
-	</header>
-
-	<main id="main-content">{@render children()}</main>
-
-	<nav class="mobile-navigation" aria-label="Hauptnavigation">
-		{#each mobileNavigation as item (item.href)}
-			<a
-				href={resolve(item.href)}
-				class:active={isActive(item.href)}
-				aria-current={isActive(item.href) ? 'page' : undefined}
-			>
-				<NavIcon name={item.icon} />
-				<span>{item.label}</span>
+	</div>
+{:else}
+	<div class="auth-shell">
+		<header class="auth-header">
+			<a class="brand" href={resolve('/login')} aria-label="Sendewerk Anmeldung">
+				<span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>
+				<span>Sendewerk</span>
 			</a>
-		{/each}
-	</nav>
-</div>
+			<ThemeToggle />
+		</header>
+		<main class="auth-main">{@render children()}</main>
+	</div>
+{/if}

src/routes/+page.server.ts

@@ -1,5 +1,7 @@
 import { redirect } from '@sveltejs/kit';
+import { hasUsers } from '#lib/server/auth.js';
 
-export function load() {
-	redirect(307, '/fundus');
+export function load({ locals }) {
+	if (!hasUsers()) redirect(307, '/setup');
+	redirect(307, locals.user ? '/fundus' : '/login');
 }

src/routes/einladung/+page.server.ts

@@ -0,0 +1,57 @@
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	acceptInvitation,
+	createSession,
+	deleteLinkToken,
+	getInvitation,
+	INVITATION_COOKIE,
+	readLinkToken,
+	storeLinkToken,
+	validDisplayName,
+	validPassword
+} from '#lib/server/auth.js';
+
+export const load: PageServerLoad = ({ url, cookies }) => {
+	const queryToken = url.searchParams.get('token');
+	if (queryToken) {
+		if (queryToken.length <= 100) storeLinkToken(cookies, INVITATION_COOKIE, queryToken);
+		else deleteLinkToken(cookies, INVITATION_COOKIE);
+		redirect(303, '/einladung');
+	}
+	const token = readLinkToken(cookies, INVITATION_COOKIE);
+	const invitation = getInvitation(token);
+	const valid = Boolean(
+		invitation &&
+		!invitation.accepted_at_utc &&
+		!invitation.revoked_at_utc &&
+		invitation.expires_at_utc > new Date().toISOString()
+	);
+	return { valid, email: valid ? invitation?.email : null };
+};
+
+export const actions = {
+	default: async ({ request, cookies }) => {
+		const data = await request.formData();
+		const token = readLinkToken(cookies, INVITATION_COOKIE);
+		const displayName = String(data.get('displayName') || '').trim();
+		const password = String(data.get('password') || '');
+		if (!validDisplayName(displayName) || !validPassword(password)) {
+			return fail(400, {
+				displayName,
+				error: 'Bitte Namen und ein Passwort mit mindestens 12 Zeichen prüfen.'
+			});
+		}
+		try {
+			const user = await acceptInvitation({ token, displayName, password });
+			deleteLinkToken(cookies, INVITATION_COOKIE);
+			createSession(user.id, cookies);
+		} catch {
+			return fail(400, {
+				displayName,
+				error: 'Die Einladung ist ungültig, abgelaufen oder bereits verwendet.'
+			});
+		}
+		redirect(303, '/fundus');
+	}
+} satisfies Actions;

src/routes/einladung/+page.svelte

@@ -0,0 +1,41 @@
+<script lang="ts">
+	import type { PageProps } from './$types';
+	let { data, form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Einladung annehmen | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Einladung</p>
+	<h1>Sendewerk-Konto aktivieren</h1>
+	{#if !data.valid && !form?.error}
+		<div class="form-message error" role="alert">
+			Die Einladung ist ungültig, abgelaufen oder bereits verwendet.
+		</div>
+	{:else}
+		<p>Die Einladung gilt für <strong>{data.email}</strong>.</p>
+		{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+		<form class="auth-form" method="POST">
+			<label
+				>Name<input
+					name="displayName"
+					required
+					maxlength="80"
+					value={form?.displayName ?? ''}
+					autocomplete="name"
+				/></label
+			>
+			<label
+				>Passwort<input
+					name="password"
+					type="password"
+					required
+					minlength="12"
+					maxlength="256"
+					autocomplete="new-password"
+				/></label
+			>
+			<button class="primary-button" type="submit">Konto aktivieren</button>
+		</form>
+	{/if}
+</section>

src/routes/login/+page.server.ts

@@ -0,0 +1,36 @@
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	authenticate,
+	createSession,
+	hasUsers,
+	reserveLoginAttempt,
+	validEmail
+} from '#lib/server/auth.js';
+
+export const load: PageServerLoad = ({ locals }) => {
+	if (!hasUsers()) redirect(303, '/setup');
+	if (locals.user) redirect(303, '/fundus');
+};
+
+export const actions = {
+	default: async ({ request, cookies, getClientAddress }) => {
+		const data = await request.formData();
+		const email = String(data.get('email') || '').trim();
+		const password = String(data.get('password') || '');
+		const address = getClientAddress();
+		if (!validEmail(email) || !password || Buffer.byteLength(password, 'utf8') > 256) {
+			return fail(400, { email, error: 'E-Mail oder Passwort ist nicht korrekt.' });
+		}
+		if (!reserveLoginAttempt(email, address)) {
+			return fail(429, {
+				email,
+				error: 'Zu viele Anmeldeversuche. Bitte in 15 Minuten erneut versuchen.'
+			});
+		}
+		const user = await authenticate(email, password);
+		if (!user) return fail(400, { email, error: 'E-Mail oder Passwort ist nicht korrekt.' });
+		createSession(user.id, cookies);
+		redirect(303, '/fundus');
+	}
+} satisfies Actions;

src/routes/login/+page.svelte

@@ -0,0 +1,37 @@
+<script lang="ts">
+	import { resolve } from '$app/paths';
+	import type { PageProps } from './$types';
+	let { form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Anmelden | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Redaktionszugang</p>
+	<h1>Bei Sendewerk anmelden</h1>
+	<p>Für Barkeeper und Thekencrew. Eine öffentliche Registrierung gibt es nicht.</p>
+	{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+	<form class="auth-form" method="POST">
+		<label
+			>E-Mail<input
+				name="email"
+				type="email"
+				required
+				maxlength="254"
+				value={form?.email ?? ''}
+				autocomplete="email"
+			/></label
+		>
+		<label
+			>Passwort<input
+				name="password"
+				type="password"
+				required
+				maxlength="256"
+				autocomplete="current-password"
+			/></label
+		>
+		<button class="primary-button" type="submit">Anmelden</button>
+	</form>
+	<a class="auth-link" href={resolve('/passwort-vergessen')}>Passwort vergessen?</a>
+</section>

src/routes/logout/+server.ts

@@ -0,0 +1,8 @@
+import { redirect } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { deleteSession } from '#lib/server/auth.js';
+
+export const POST: RequestHandler = ({ cookies }) => {
+	deleteSession(cookies);
+	redirect(303, '/login');
+};

src/routes/passwort-vergessen/+page.server.ts

@@ -0,0 +1,22 @@
+import { fail } from '@sveltejs/kit';
+import type { Actions } from './$types';
+import { requestPasswordReset, reservePasswordResetRequest, validEmail } from '#lib/server/auth.js';
+
+export const actions = {
+	default: async ({ request, getClientAddress }) => {
+		const data = await request.formData();
+		const email = String(data.get('email') || '').trim();
+		if (!validEmail(email))
+			return fail(400, { email, error: 'Bitte eine gültige E-Mail eingeben.' });
+		if (!reservePasswordResetRequest(email, getClientAddress())) {
+			return { sent: true };
+		}
+		try {
+			await requestPasswordReset(email);
+		} catch {
+			// Die sichtbare Antwort bleibt identisch, damit der Mailzustand kein Konto verrät.
+			console.error('Eine Passwortreset-Nachricht konnte nicht bereitgestellt werden.');
+		}
+		return { sent: true };
+	}
+} satisfies Actions;

src/routes/passwort-vergessen/+page.svelte

@@ -0,0 +1,31 @@
+<script lang="ts">
+	import { resolve } from '$app/paths';
+	import type { PageProps } from './$types';
+	let { form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Passwort vergessen | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Kontozugang</p>
+	<h1>Passwort zurücksetzen</h1>
+	<p>Wenn das Konto existiert, wird ein 24 Stunden gültiger, einmaliger Link bereitgestellt.</p>
+	{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+	{#if form?.sent}<div class="form-message success" role="status">
+			Anfrage verarbeitet. Bitte Postfach beziehungsweise lokale Outbox prüfen.
+		</div>{/if}
+	<form class="auth-form" method="POST">
+		<label
+			>E-Mail<input
+				name="email"
+				type="email"
+				required
+				maxlength="254"
+				value={form?.email ?? ''}
+				autocomplete="email"
+			/></label
+		>
+		<button class="primary-button" type="submit">Reset-Link anfordern</button>
+	</form>
+	<a class="auth-link" href={resolve('/login')}>Zurück zur Anmeldung</a>
+</section>

src/routes/passwort-zuruecksetzen/+page.server.ts

@@ -0,0 +1,39 @@
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	deleteLinkToken,
+	passwordResetIsValid,
+	readLinkToken,
+	RESET_COOKIE,
+	resetPassword,
+	storeLinkToken,
+	validPassword
+} from '#lib/server/auth.js';
+
+export const load: PageServerLoad = ({ url, cookies }) => {
+	const queryToken = url.searchParams.get('token');
+	if (queryToken) {
+		if (queryToken.length <= 100) storeLinkToken(cookies, RESET_COOKIE, queryToken);
+		else deleteLinkToken(cookies, RESET_COOKIE);
+		redirect(303, '/passwort-zuruecksetzen');
+	}
+	return { valid: passwordResetIsValid(readLinkToken(cookies, RESET_COOKIE)) };
+};
+
+export const actions = {
+	default: async ({ request, cookies }) => {
+		const data = await request.formData();
+		const token = readLinkToken(cookies, RESET_COOKIE);
+		const password = String(data.get('password') || '');
+		if (!validPassword(password)) {
+			return fail(400, { error: 'Das neue Passwort muss mindestens 12 Zeichen lang sein.' });
+		}
+		try {
+			await resetPassword(token, password);
+			deleteLinkToken(cookies, RESET_COOKIE);
+		} catch {
+			return fail(400, { error: 'Der Link ist ungültig, abgelaufen oder bereits verwendet.' });
+		}
+		redirect(303, '/login?reset=erfolgreich');
+	}
+} satisfies Actions;

src/routes/passwort-zuruecksetzen/+page.svelte

@@ -0,0 +1,33 @@
+<script lang="ts">
+	import { resolve } from '$app/paths';
+	import type { PageProps } from './$types';
+	let { data, form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Neues Passwort | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Kontozugang</p>
+	<h1>Neues Passwort setzen</h1>
+	{#if !data.valid && !form?.error}
+		<div class="form-message error" role="alert">
+			Der Link ist ungültig, abgelaufen oder bereits verwendet.
+		</div>
+		<a class="auth-link" href={resolve('/passwort-vergessen')}>Neuen Link anfordern</a>
+	{:else}
+		{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+		<form class="auth-form" method="POST">
+			<label
+				>Neues Passwort<input
+					name="password"
+					type="password"
+					required
+					minlength="12"
+					maxlength="256"
+					autocomplete="new-password"
+				/></label
+			>
+			<button class="primary-button" type="submit">Passwort speichern</button>
+		</form>
+	{/if}
+</section>

src/routes/setup/+page.server.ts

@@ -0,0 +1,47 @@
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	createFirstAdmin,
+	createSession,
+	hasUsers,
+	setupIsConfigured,
+	validDisplayName,
+	validEmail,
+	validPassword
+} from '#lib/server/auth.js';
+
+export const load: PageServerLoad = () => {
+	if (hasUsers()) redirect(303, '/login');
+	return { configured: setupIsConfigured() };
+};
+
+export const actions = {
+	default: async ({ request, cookies }) => {
+		if (hasUsers()) redirect(303, '/login');
+		const data = await request.formData();
+		const setupToken = String(data.get('setupToken') || '');
+		const displayName = String(data.get('displayName') || '').trim();
+		const email = String(data.get('email') || '').trim();
+		const password = String(data.get('password') || '');
+		if (!validDisplayName(displayName) || !validEmail(email) || !validPassword(password)) {
+			return fail(400, {
+				error: 'Bitte Name, gültige E-Mail und ein Passwort mit mindestens 12 Zeichen prüfen.',
+				displayName,
+				email
+			});
+		}
+		try {
+			const user = await createFirstAdmin({ setupToken, displayName, email, password });
+			createSession(user.id, cookies);
+		} catch (cause) {
+			const code = cause instanceof Error ? cause.message : '';
+			if (code === 'SETUP_CLOSED') redirect(303, '/login');
+			return fail(403, {
+				error: 'Das Betreiber-Setup-Token ist ungültig.',
+				displayName,
+				email
+			});
+		}
+		redirect(303, '/fundus');
+	}
+} satisfies Actions;

src/routes/setup/+page.svelte

@@ -0,0 +1,65 @@
+<script lang="ts">
+	import type { PageProps } from './$types';
+	let { data, form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Erstadmin einrichten | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Einmalige Einrichtung</p>
+	<h1>Ersten Barkeeper anlegen</h1>
+	<p>
+		Dieses Konto verwaltet Einladungen, Rollen und Sperren. Danach wird die Einrichtung geschlossen.
+	</p>
+	{#if !data.configured}
+		<div class="form-message error" role="alert">
+			Vor dem Start muss ein mindestens 32 Zeichen langes <code>SENDEWERK_SETUP_TOKEN</code>
+			konfiguriert werden.
+		</div>
+	{:else}
+		{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+		<form class="auth-form" method="POST">
+			<label
+				>Betreiber-Setup-Token<input
+					name="setupToken"
+					type="password"
+					required
+					autocomplete="off"
+				/></label
+			>
+			<label
+				>Name<input
+					name="displayName"
+					required
+					maxlength="80"
+					value={form?.displayName ?? ''}
+					autocomplete="name"
+				/></label
+			>
+			<label
+				>E-Mail<input
+					name="email"
+					type="email"
+					required
+					maxlength="254"
+					value={form?.email ?? ''}
+					autocomplete="email"
+				/></label
+			>
+			<label
+				>Passwort<input
+					name="password"
+					type="password"
+					required
+					minlength="12"
+					maxlength="256"
+					autocomplete="new-password"
+				/></label
+			>
+			<p class="field-hint">
+				Mindestens 12 Zeichen. Das Passwort wird ausschließlich als Argon2id-Hash gespeichert.
+			</p>
+			<button class="primary-button" type="submit">Barkeeper anlegen</button>
+		</form>
+	{/if}
+</section>

src/routes/verwaltung/+page.server.ts

@@ -1,5 +1,97 @@
+import { fail } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
 import { getTaxonomy } from '#lib/server/previews.js';
+import { getMailConfig } from '#lib/server/config.js';
+import {
+	inviteUser,
+	isRole,
+	listOpenInvitations,
+	listUsers,
+	requireBarkeeper,
+	revokeInvitation,
+	setUserLocked,
+	setUserRole,
+	validEmail
+} from '#lib/server/auth.js';
 
-export function load() {
-	return { taxonomy: getTaxonomy() };
+export const load: PageServerLoad = ({ locals }) => {
+	requireBarkeeper(locals.user);
+	return {
+		taxonomy: getTaxonomy(),
+		users: listUsers(),
+		invitations: listOpenInvitations(),
+		mailTransport: getMailConfig().transport
+	};
+};
+
+function actionError(cause: unknown): string {
+	const code = cause instanceof Error ? cause.message : '';
+	if (code === 'USER_EXISTS') return 'Für diese E-Mail existiert bereits ein Konto.';
+	if (code === 'SELF_LOCK') return 'Das eigene Konto kann nicht gesperrt werden.';
+	if (code === 'LAST_BARKEEPER') return 'Mindestens ein aktiver Barkeeper muss erhalten bleiben.';
+	if (code === 'NOT_FOUND') return 'Das Konto wurde nicht gefunden.';
+	return 'Die Aktion konnte nicht ausgeführt werden.';
 }
+
+export const actions = {
+	invite: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		const email = String(data.get('email') || '').trim();
+		const role = String(data.get('role') || '');
+		if (!validEmail(email) || !isRole(role)) {
+			return fail(400, { intent: 'invite', email, error: 'E-Mail und Rolle bitte prüfen.' });
+		}
+		try {
+			const transport = await inviteUser(actor, email, role);
+			return {
+				intent: 'invite',
+				success:
+					transport === 'local'
+						? 'Einladung wurde in der lokalen Mail-Outbox abgelegt.'
+						: 'Einladung wurde versandt.'
+			};
+		} catch (cause) {
+			return fail(400, { intent: 'invite', email, error: actionError(cause) });
+		}
+	},
+	role: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		const userId = String(data.get('userId') || '');
+		const role = String(data.get('role') || '');
+		if (!userId || !isRole(role)) return fail(400, { intent: 'role', error: 'Ungültige Rolle.' });
+		try {
+			setUserRole(actor, userId, role);
+			return { intent: 'role', success: 'Rolle aktualisiert.' };
+		} catch (cause) {
+			return fail(400, { intent: 'role', error: actionError(cause) });
+		}
+	},
+	lock: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			setUserLocked(actor, String(data.get('userId') || ''), true);
+			return { intent: 'lock', success: 'Konto gesperrt und bestehende Sitzungen beendet.' };
+		} catch (cause) {
+			return fail(400, { intent: 'lock', error: actionError(cause) });
+		}
+	},
+	unlock: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			setUserLocked(actor, String(data.get('userId') || ''), false);
+			return { intent: 'unlock', success: 'Konto entsperrt.' };
+		} catch (cause) {
+			return fail(400, { intent: 'unlock', error: actionError(cause) });
+		}
+	},
+	revokeInvitation: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		revokeInvitation(actor, String(data.get('invitationId') || ''));
+		return { intent: 'revokeInvitation', success: 'Einladung widerrufen.' };
+	}
+} satisfies Actions;

src/routes/verwaltung/+page.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
-	import type { PageData } from './$types';
-	let { data }: { data: PageData } = $props();
+	import type { PageProps } from './$types';
+	let { data, form }: PageProps = $props();
 </script>
 
 <svelte:head><title>Verwaltung | Sendewerk</title></svelte:head>
@@ -8,8 +8,108 @@
 <div class="page-wrap narrow-page">
 	<header class="page-heading">
 		<h1>Verwaltung</h1>
-		<p class="page-intro">Abschnittskategorien, Formate und Themen im Überblick.</p>
+		<p class="page-intro">Konten, Rollen und bestehende Taxonomie verwalten.</p>
 	</header>
+	{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+	{#if form?.success}<div class="form-message success" role="status">{form.success}</div>{/if}
+
+	<section class="quiet-panel account-panel">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">Konten & Rollen</p>
+				<h2>Redaktionszugänge</h2>
+			</div>
+			<span class="mail-mode"
+				>Mail: {data.mailTransport === 'local' ? 'lokale Outbox' : 'SMTP'}</span
+			>
+		</div>
+		<div class="account-list">
+			{#each data.users as user (user.id)}
+				<article class="account-row">
+					<div><strong>{user.displayName}</strong><small>{user.email}</small></div>
+					<span class:locked={user.lockedAtUtc} class="account-status"
+						>{user.lockedAtUtc ? 'Gesperrt' : 'Aktiv'}</span
+					>
+					<form method="POST" action="?/role" class="inline-account-form">
+						<input type="hidden" name="userId" value={user.id} />
+						<label class="sr-only" for={`role-${user.id}`}>Rolle für {user.displayName}</label>
+						<select id={`role-${user.id}`} name="role">
+							<option value="barkeeper" selected={user.role === 'barkeeper'}>Barkeeper</option>
+							<option value="thekencrew" selected={user.role === 'thekencrew'}>Thekencrew</option>
+						</select>
+						<button class="text-button" type="submit">Rolle speichern</button>
+					</form>
+					<form method="POST" action={user.lockedAtUtc ? '?/unlock' : '?/lock'}>
+						<input type="hidden" name="userId" value={user.id} />
+						<button
+							class="secondary-button"
+							type="submit"
+							disabled={user.id === data.user?.id}
+							title={user.id === data.user?.id
+								? 'Das eigene Konto kann nicht gesperrt werden.'
+								: undefined}
+							>{user.lockedAtUtc
+								? 'Entsperren'
+								: user.id === data.user?.id
+									? 'Eigenes Konto'
+									: 'Sperren'}</button
+						>
+					</form>
+				</article>
+			{/each}
+		</div>
+	</section>
+
+	<div class="management-grid">
+		<section class="quiet-panel invite-panel">
+			<p class="eyebrow">Einladung</p>
+			<h2>Neues Konto einladen</h2>
+			<form class="compact-form" method="POST" action="?/invite">
+				<label
+					>E-Mail<input
+						name="email"
+						type="email"
+						required
+						maxlength="254"
+						value={form?.intent === 'invite' ? (form.email ?? '') : ''}
+					/></label
+				>
+				<label
+					>Rolle<select name="role"
+						><option value="thekencrew">Thekencrew</option><option value="barkeeper"
+							>Barkeeper</option
+						></select
+					></label
+				>
+				<button class="primary-button" type="submit">Einladung erstellen</button>
+			</form>
+		</section>
+		<section class="quiet-panel invite-panel">
+			<p class="eyebrow">Offene Einladungen</p>
+			<h2>Noch nicht angenommen</h2>
+			{#if data.invitations.length}
+				<div class="invitation-list">
+					{#each data.invitations as invitation (invitation.id)}
+						<div>
+							<span
+								><strong>{invitation.email}</strong><small
+									>{invitation.role === 'barkeeper' ? 'Barkeeper' : 'Thekencrew'}</small
+								></span
+							>
+							<form method="POST" action="?/revokeInvitation">
+								<input type="hidden" name="invitationId" value={invitation.id} /><button
+									class="text-button"
+									type="submit">Widerrufen</button
+								>
+							</form>
+						</div>
+					{/each}
+				</div>
+			{:else}<p class="quiet-copy">Keine offenen Einladungen.</p>{/if}
+		</section>
+	</div>
+
+	<h2 class="section-heading">Taxonomie</h2>
 	<div class="settings-grid">
 		<section class="quiet-panel taxonomy-panel">
 			<p class="eyebrow">Abschnittskategorien</p>
@@ -35,5 +135,4 @@
 			</div>
 		</section>
 	</div>
-	<p class="settings-footnote">Konten und Rollen sind noch nicht verfügbar.</p>
 </div>