Release 0.2.0

2026-10-21 17:25:28 +02:00
1 parent 7a49e66c37
commit 08e8875cb5
@@ -1,3 +1,19 @@
 # Relative paths are resolved from the project directory.
 SENDEWERK_DB_PATH=.data/sendewerk.sqlite
 SENDEWERK_UPLOAD_DIR=.data/uploads
+SENDEWERK_MAIL_OUTBOX_DIR=.data/mail-outbox
+
+# Generate this locally and insert it here as described in README.md. Never commit .env.
+SENDEWERK_SETUP_TOKEN=
+SENDEWERK_APP_ORIGIN=http://localhost:5173
+
+# "local" writes messages to the outbox and never contacts a mail server.
+SENDEWERK_MAIL_TRANSPORT=local
+SENDEWERK_MAIL_FROM=Sendewerk <sendewerk@localhost>
+
+# Required only when SENDEWERK_MAIL_TRANSPORT=smtp is explicitly selected.
+SENDEWERK_SMTP_HOST=
+SENDEWERK_SMTP_PORT=587
+SENDEWERK_SMTP_SECURE=false
+SENDEWERK_SMTP_USER=
+SENDEWERK_SMTP_PASSWORD=
@@ -3,7 +3,7 @@
 	"title": "Sendewerk",
 	"description": "Redaktionelle Planung und Durchführung von heinzlive-Sendungen.",
 	"tagline": "Vom Fundstück bis zur Livesendung",
-	"version": "0.1.1",
+	"version": "0.2.0",
 	"healthCheckPath": "/healthz",
 	"httpPort": 3000,
 	"addons": {
@@ -2,9 +2,9 @@

 Sendewerk ist die redaktionelle Webanwendung für den Weg vom vorbereiteten
 Inhalt bis zur moderierten und archivierten Sendung. Der aktuelle Stand umfasst
-ausschließlich Etappe 1: technisches Grundgerüst, persistente Beispieldaten
-und gekennzeichnete Gestaltungsvorschauen. Anmeldung, Bearbeitung und echte
-Live-Steuerung folgen in späteren Etappen.
+Etappe 1 und 2: technisches Grundgerüst, persistente Beispieldaten,
+Gestaltungsvorschauen sowie echte Anmeldung mit Barkeeper-/Thekencrew-Rollen.
+Inhaltsbearbeitung und Live-Steuerung folgen in späteren Etappen.

 ## Voraussetzungen

@@ -20,6 +20,9 @@ nicht erforderlich.
 ```sh
 npm ci
 cp .env.example .env
+SETUP_TOKEN="$(openssl rand -hex 32)"
+sed -i "s/^SENDEWERK_SETUP_TOKEN=.*/SENDEWERK_SETUP_TOKEN=$SETUP_TOKEN/" .env
+printf 'Betreiber-Setup-Token: %s\n' "$SETUP_TOKEN"
 npm run setup
 npm run dev
 ```
@@ -29,18 +32,41 @@ erstellt die konfigurierten Verzeichnisse, führt ausstehende Migrationen aus
 und lädt den reproduzierbaren Beispieldatensatz. Der Seed darf beliebig oft
 ausgeführt werden und ersetzt nur die von ihm verwalteten Beispieldaten.

+Beim ersten Aufruf verlangt `/setup` den ausgegebenen Wert aus
+`SENDEWERK_SETUP_TOKEN` und legt genau einen Barkeeper an. Der Befehl schreibt
+den Wert in die nicht versionierte `.env`, damit auch spätere lokale Starts
+dieselbe Konfiguration verwenden. Nach erfolgreicher Einrichtung ist `/setup`
+dauerhaft geschlossen und der Token kann aus `.env` entfernt werden. Der Seed
+enthält bewusst kein Konto und kein Standardpasswort.
+
 ## Konfiguration

 | Variable                    | Vorgabe                  | Bedeutung                                            |
-| ---------------------- | ------------------------ | ----------------------------------- |
+| --------------------------- | ------------------------ | ---------------------------------------------------- |
 | `SENDEWERK_DB_PATH`         | `.data/sendewerk.sqlite` | Pfad zur persistenten SQLite-Datei                   |
 | `SENDEWERK_UPLOAD_DIR`      | `.data/uploads`          | Persistentes Upload-Verzeichnis                      |
+| `SENDEWERK_MAIL_OUTBOX_DIR` | `.data/mail-outbox`      | Lokale, nicht öffentlich ausgelieferte Testmail      |
+| `SENDEWERK_SETUP_TOKEN`     | keine                    | einmaliges Betreibergeheimnis, mindestens 32 Zeichen |
+| `SENDEWERK_APP_ORIGIN`      | `http://localhost:5173`  | feste Origin für Links und Cookie-Sicherheit         |
+| `SENDEWERK_MAIL_TRANSPORT`  | `local`                  | `local` oder ausdrücklich `smtp`                     |
+| `SENDEWERK_MAIL_FROM`       | lokaler Absender         | Absender; bei SMTP verpflichtend                     |
+| `SENDEWERK_SMTP_HOST`       | keine                    | SMTP-Server, nur im SMTP-Modus                       |
+| `SENDEWERK_SMTP_PORT`       | `587`                    | SMTP-Port                                            |
+| `SENDEWERK_SMTP_SECURE`     | `false`                  | `true` für implizites TLS, üblicherweise Port 465    |
+| `SENDEWERK_SMTP_USER`       | keine                    | optionaler SMTP-Benutzer                             |
+| `SENDEWERK_SMTP_PASSWORD`   | keine                    | optionales SMTP-Passwort                             |
 | `HOST`                      | adapterabhängig          | Bind-Adresse des Produktionsservers                  |
 | `PORT`                      | `3000`                   | Port des Produktionsservers                          |

 Relative Sendewerk-Pfade werden vom Projektverzeichnis aus aufgelöst. In
 Cloudron liegen Datenbank und Uploads unter `/app/data`.

+Der Vorgabemodus `local` baut keine Netzwerkverbindung auf. Einladungen und
+Passwort-Resets landen als JSON-Dateien in `.data/mail-outbox`; die enthaltenen
+Links sind Geheimnisse und dürfen nicht veröffentlicht werden. Echter Versand
+findet nur statt, wenn `SENDEWERK_MAIL_TRANSPORT=smtp` und die SMTP-Werte
+explizit gesetzt sind.
+
 ## Befehle

 | Befehl               | Zweck                                                      |
@@ -48,7 +74,7 @@ Cloudron liegen Datenbank und Uploads unter `/app/data`.
 | `npm run setup`      | Verzeichnisse, Migrationen und Seed für lokale Entwicklung |
 | `npm run db:migrate` | Ausstehende Migrationen atomar ausführen                   |
 | `npm run db:seed`    | Reproduzierbare Beispieldaten laden                        |
-| `npm run dev`        | Entwicklungsserver starten                                 |
+| `npm run dev`        | Migrationen ausführen und Entwicklungsserver starten       |
 | `npm run check`      | Svelte- und TypeScript-Prüfung                             |
 | `npm run lint`       | Formatierung und ESLint prüfen                             |
 | `npm test`           | Verhaltenstests mit temporärer, getrennter Datenbank       |
@@ -61,6 +87,7 @@ Cloudron liegen Datenbank und Uploads unter `/app/data`.
 ```sh
 npm ci
 npm run setup
+export SENDEWERK_APP_ORIGIN=http://localhost:3000
 npm run build
 HOST=127.0.0.1 PORT=3000 npm start
 ```
@@ -68,6 +95,12 @@ HOST=127.0.0.1 PORT=3000 npm start
 Der Healthcheck liegt unter <http://localhost:3000/healthz> und prüft auch den
 Datenbankzugriff.

+Für lokales HTTP wird das Sitzungscookie gezielt ohne `Secure` gesetzt, bleibt
+aber `HttpOnly` und `SameSite=Lax`. Bei einer `https:`-Origin ist `Secure`
+automatisch aktiv. Die Build-Origin muss beim lokalen Produktionsbuild mit der
+später verwendeten Browser-Origin übereinstimmen; SvelteKits Origin-Prüfung
+bleibt aktiv.
+
 Vor der ersten Browserprüfung wird der Testbrowser einmalig installiert:

 ```sh
@@ -82,9 +115,17 @@ Das frühe Cloudron-Paket besteht aus `Dockerfile`, `CloudronManifest.json` und

 ```sh
 docker build -t sendewerk:local .
-docker run --rm -p 3000:3000 -v sendewerk-data:/app/data sendewerk:local
+docker run --rm -p 3000:3000 \
+  -e SENDEWERK_APP_ORIGIN=http://localhost:3000 \
+  -e SENDEWERK_SETUP_TOKEN="$(openssl rand -hex 32)" \
+  -v sendewerk-data:/app/data sendewerk:local
 ```

+Auf Cloudron muss das Betreiber-Setup-Token vor dem ersten Browseraufruf als
+Umgebungsvariable gesetzt werden. `CLOUDRON_APP_ORIGIN` liefert dort die feste
+HTTPS-Origin. SMTP-Zugangsdaten werden ebenfalls ausschließlich als
+Laufzeitvariablen gesetzt, nicht in Manifest oder Image geschrieben.
+
 Das ersetzt keinen Test auf einem echten Cloudron. Insbesondere Addon-Backup,
 Restore, Proxy-Origin und das read-only Laufzeitdateisystem können erst dort
 abschließend geprüft werden.
@@ -101,5 +142,6 @@ Medien und redaktionellen Inhalten werden dadurch nicht verändert.

 Die direkten Laufzeit- und Werkzeugabhängigkeiten verwenden MIT- oder
 Apache-2.0-Lizenzen: Svelte/SvelteKit, Vite, Vitest, ESLint und
-`better-sqlite3` sind MIT-lizenziert; TypeScript und Playwright stehen unter
-Apache-2.0. Die Lockdatei fixiert den tatsächlich installierten Baum.
+`better-sqlite3` und `@node-rs/argon2` sind MIT-lizenziert; Nodemailer verwendet
+MIT-0, TypeScript und Playwright stehen unter Apache-2.0. Die Lockdatei fixiert
+den tatsächlich installierten Baum.
@@ -39,3 +39,30 @@
 - Ein zusätzlicher Python-Playwright-Lauf: nicht gestartet, weil das optionale
  Python-Modul `playwright` nicht installiert war. Die projektgebundene
  TypeScript-Playwright-Suite lief stattdessen vollständig erfolgreich.
+
+## Etappe 2
+
+| Kriterium                       | Nachweis                                                                            | Stand                 |
+| ------------------------------- | ----------------------------------------------------------------------------------- | --------------------- |
+| Erstadmin danach geschlossen    | Browser-Setup sowie wiederholter Service-Aufruf geprüft; Seed enthält kein Konto    | erfüllt am 21.10.2026 |
+| Login, Logout und lokales HTTP  | Browserablauf; `HttpOnly`, `SameSite=Lax`, ohne `Secure` bei expliziter HTTP-Origin | erfüllt am 21.10.2026 |
+| Einladung und Reset             | lokale Outbox bis Kontoaktivierung und neuem Login im Browser durchlaufen           | erfüllt am 21.10.2026 |
+| Einmalige und abgelaufene Links | Verhaltenstests für Wiederverwendung und Ablauf von Einladung und Reset             | erfüllt am 21.10.2026 |
+| Direkte Admin-Aktion verweigert | Thekencrew-POST auf Einladungsaction liefert 403                                    | erfüllt am 21.10.2026 |
+| Sperrung entzieht Zugriff       | aktive Thekencrew-Sitzung wird gelöscht und beim nächsten Request abgewiesen        | erfüllt am 21.10.2026 |
+| Keine echte Mail ungefragt      | Browser- und Verhaltenstests nutzen ausschließlich temporäre lokale Outbox          | erfüllt am 21.10.2026 |
+| Echter SMTP-Versand             | nicht ausgeführt, keine Zugangsdaten bereitgestellt                                 | offen                 |
+
+## Ausgeführte Prüfungen Etappe 2
+
+- `npm run lint`: erfolgreich
+- `npm run check`: 0 Fehler und 0 Warnungen
+- `npm test`: 9 Auth-, Migrations-, Mail- und Dauer-Verhaltenstests erfolgreich
+- `npm run build`: erfolgreich mit `@sveltejs/adapter-node`
+- `npm run test:e2e`: 9 von 9 Browsertests erfolgreich; Erstadmin,
+  Login/Logout, fremder Origin, Einladung, direkte Rollenprüfung, Sperrung,
+  Reset sowie bestehende responsive Arbeitsansichten geprüft
+- Lokale Outbox in isolierten temporären Verzeichnissen geprüft
+- Lokaler Produktionsserver der Browsertests über HTTP gestartet; Healthcheck
+  und Migration vor Start erfolgreich
+- `bash -n start.sh`: erfolgreich
@@ -38,7 +38,7 @@ Kern. Folgende Grenzen sind für spätere Migrationen bereits festgelegt.

 | Bereich     | Geplante Entitäten und Beziehungen                                                                                           |
 | ----------- | ---------------------------------------------------------------------------------------------------------------------------- |
-| Identität   | `users`, Rollen, Sessions, Einladungen, Reset-Tokens, Sperren und technische Zugänge; Tokens nur gehasht                     |
+| Identität   | `users`, Rollen, Sessions, Einladungen, Reset-Tokens und Sperren sind umgesetzt; technische Zugänge folgen später            |
 | Taxonomie   | getrennte `section_categories`, `formats`, `topics`; Pieces und Vorschläge über Zuordnungstabellen mehrfach verknüpft        |
 | Inhalt      | `pieces` mit Status und Dauer; Quellen, Medien, private Recherche, Moderation, Präsentation und Vorlagen als getrennte Daten |
 | Sendungsbau | `shows`, geordnete `show_sections`, kopierte `piece_usages`, Reservebank und Sendungsvorlagen; Original-ID bleibt Referenz   |
@@ -63,6 +63,32 @@ oder eine explizite Abschnittsdauer. Beides wird nie addiert. Reserveelemente
 zählen erst nach dem Einplanen. Geplante und tatsächliche Dauer bleiben
 getrennt.

+## Anmeldung und Rechte
+
+Etappe 2 ergänzt lokale Konten mit den festen Rollen `barkeeper` und
+`thekencrew`. Passwörter werden mit Argon2id gespeichert. Sitzungs-, Einladungs-
+und Reset-Tokens entstehen aus kryptografischem Zufall; in SQLite liegt jeweils
+nur ihr SHA-256-Hash. Der Browser erhält ausschließlich das rohe Sitzungstoken
+in einem `HttpOnly`-, `SameSite=Lax`-Cookie.
+
+`hooks.server.ts` löst die Sitzung für jeden Request auf. Die Datenbankabfrage
+verbindet die Session immer mit dem aktuellen Nutzerzustand, sodass Sperren und
+Rollenwechsel ohne verzögerte Token-Erneuerung wirken. Geschützte Routen
+erfordern eine Anmeldung; Verwaltungs-Loads und jede Verwaltungs-Action prüfen
+zusätzlich die Barkeeper-Rolle. Sperrung und Passwortwechsel löschen bestehende
+Sessions transaktional.
+
+Der Erstadmin benötigt sowohl eine leere Nutzertabelle als auch ein extern
+konfiguriertes Setup-Token. Einladungs- und Reset-Links sind 24 Stunden gültig,
+werden erst beim bestätigenden POST verbraucht und sind genau einmal nutzbar.
+Fehlgeschlagene Loginversuche werden pro E-Mail-Schlüssel und Clientadresse in
+einem Zeitfenster begrenzt, ohne das Konto dauerhaft zu sperren.
+
+Mail verwendet einen Adapter: `local` schreibt geschützte Dateien in den
+konfigurierten Outbox-Pfad, `smtp` nutzt Nodemailer nur nach expliziter Auswahl.
+Die feste Anwendungs-Origin erzeugt Links und bestimmt den `Secure`-Status der
+Cookies; sie wird nicht aus ungeprüften Request-Headern übernommen.
+
 ## Oberflächenstruktur

 Die Hauptnavigation umfasst Eingang, Fundus, Sendungen, Archiv und Verwaltung.
@@ -81,8 +107,8 @@ Fachabläufe werden jedoch nicht vorgetäuscht.

 ## Sicherheitsgrenzen ab den Folgeetappen

-Authentifizierung und Autorisierung werden serverseitig an jeder Route und
-Action geprüft. Markdown und fremdes HTML werden vor Ausgabe bereinigt.
+Authentifizierung und Autorisierung werden seit Etappe 2 serverseitig an jeder
+betroffenen Route und Action geprüft. Markdown und fremdes HTML werden vor Ausgabe bereinigt.
 Uploadzugriff folgt denselben Rechten. Netzwerkabrufe erhalten Schutz gegen
 interne Ziele, Größen-/Zeitlimits und kontrollierte Redirects. Diese Regeln
 sind geplant, aber nicht Bestandteil der Etappe-1-Vorschauen.
@@ -94,3 +94,44 @@ Der Fundus erscheint auf dem Desktop als kompakte Liste und auf kleinen
 Bildschirmen als Kartenfolge. Vorschau- und Schreibschutzinformationen sind in
 einem nativen, tastaturbedienbaren `details`-Element gebündelt. Diese
 Darstellungsentscheidung ändert weder Datenmodell noch Funktionsumfang.
+
+## D-008: Widerrufbare Datenbanksitzungen und Argon2id
+
+Sendewerk verwendet Datenbanksitzungen statt JWT. SvelteKit empfiehlt diesen
+Ansatz, wenn sofortiger Widerruf wichtiger als eine zusätzliche Datenbankabfrage
+ist. Ein zufälliges Sitzungstoken liegt nur als SHA-256-Hash in SQLite; der
+Browser erhält es als `HttpOnly`-, `SameSite=Lax`-Cookie. Nutzerstatus und Rolle
+werden bei jedem Request erneut verbunden. Lokal erlaubt eine explizite
+`http:`-Origin Cookies ohne `Secure`, bei `https:` wird `Secure` gesetzt.
+
+Passwörter hasht `@node-rs/argon2` 2.2.2 mit Argon2id und den dokumentierten
+Paketparametern. Zufallstokens und SHA-256 stammen aus `node:crypto`; eigene
+Kryptoprimitive werden nicht implementiert.
+
+Quellen:
+
+- <https://svelte.dev/docs/kit/auth>
+- <https://svelte.dev/docs/kit/hooks>
+- <https://github.com/napi-rs/node-rs/tree/main/packages/argon2>
+
+## D-009: Form-Actions, geschlossenes Setup und Rollenprüfung
+
+Alle Auth-Schreibvorgänge verwenden POST-Form-Actions beziehungsweise einen
+POST-Endpunkt. SvelteKits gleichursprüngliche Formularprüfung bleibt aktiv. Der
+Erstadmin erfordert ein mindestens 32 Zeichen langes Betreiber-Setup-Token und
+eine transaktional geprüfte leere Nutzertabelle. Danach bleibt `/setup`
+geschlossen. Barkeeper-Rechte werden in jeder Verwaltungsaktion erneut geprüft;
+UI-Sichtbarkeit ist keine Sicherheitsgrenze.
+
+Quelle: <https://svelte.dev/docs/kit/form-actions>
+
+## D-010: Lokale Mail-Outbox als sichere Vorgabe
+
+Der Mailmodus ist standardmäßig `local` und schreibt Einladungs-/Resetnachrichten
+in einen konfigurierten persistenten Pfad. Dadurch wird lokal keine echte Mail
+ungefragt versandt. Nur die explizite Auswahl `smtp` initialisiert Nodemailer;
+bei SMTP sind Host und Absender verpflichtend. Outbox-Dateien sind private
+Geheimnisträger und werden weder versioniert noch über eine Route ausgeliefert.
+
+Nodemailer 10.1.7 unterstützt Node 20 oder neuer und ist MIT-0-lizenziert.
+Quelle: <https://github.com/nodemailer/nodemailer>
@@ -2,8 +2,9 @@

 ## Aktueller Umfang

-Etappe 1 ist abgeschlossen. Architektur, Gesamtdatenmodell, Entscheidungen und
-lokaler Betriebsweg sind dokumentiert. Etappe 2 wurde nicht begonnen.
+Etappe 1 und Etappe 2 sind abgeschlossen. Architektur, Gesamtdatenmodell,
+Anmeldung, Rollen und lokaler Betriebsweg sind dokumentiert. Etappe 3 wurde
+nicht begonnen.

 ## Umgesetzter Stand Etappe 1

@@ -36,11 +37,22 @@ umgebrochen.

 ## Nicht Bestandteil dieser Etappe

-Anmeldung, Rollen, echte Inhaltsbearbeitung, Autospeichern, Sendungsplanung,
-Live-Steuerung, Präsentationsfenster, Archivabschluss, Freigaben, RSS und API.
+Echte Inhaltsbearbeitung, Autospeichern, Sendungsplanung, Live-Steuerung,
+Präsentationsfenster, Archivabschluss, Freigaben, RSS und API.
 Die Vorschauen dürfen nicht als Implementierung dieser Funktionen verstanden
 werden.

+## Umgesetzter Stand Etappe 2
+
+- einmalige Erstadmin-Einrichtung mit externem Betreiber-Token
+- Login und POST-Logout mit widerrufbaren Datenbanksitzungen
+- Rollen Barkeeper und Thekencrew mit serverseitiger Prüfung
+- Einladungen und Passwortreset über befristete, einmalige Links
+- Kontensperrung mit sofortigem Entzug bestehender Sitzungen
+- zeitfensterbasiertes Login-Rate-Limit ohne dauerhafte Kontensperre
+- lokale Mail-Outbox als Vorgabe und explizit konfigurierbarer SMTP-Versand
+- responsive Authentifizierungs- und Kontenverwaltungsoberflächen
+
 ## Bekannte offene Betriebsprüfung

 Eine echte Cloudron-Installation samt Backup/Restore, Reverse-Proxy-Verhalten
@@ -0,0 +1,58 @@
+CREATE TABLE users (
+  id TEXT PRIMARY KEY,
+  email TEXT NOT NULL,
+  email_normalized TEXT NOT NULL UNIQUE,
+  display_name TEXT NOT NULL,
+  password_hash TEXT NOT NULL,
+  role TEXT NOT NULL CHECK (role IN ('barkeeper', 'thekencrew')),
+  locked_at_utc TEXT,
+  password_changed_at_utc TEXT NOT NULL,
+  created_at_utc TEXT NOT NULL,
+  updated_at_utc TEXT NOT NULL
+);
+
+CREATE TABLE sessions (
+  token_hash TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  created_at_utc TEXT NOT NULL,
+  expires_at_utc TEXT NOT NULL
+);
+
+CREATE INDEX sessions_user_idx ON sessions(user_id);
+CREATE INDEX sessions_expiry_idx ON sessions(expires_at_utc);
+
+CREATE TABLE invitations (
+  id TEXT PRIMARY KEY,
+  email TEXT NOT NULL,
+  email_normalized TEXT NOT NULL,
+  role TEXT NOT NULL CHECK (role IN ('barkeeper', 'thekencrew')),
+  token_hash TEXT NOT NULL UNIQUE,
+  created_by_user_id TEXT NOT NULL REFERENCES users(id),
+  created_at_utc TEXT NOT NULL,
+  expires_at_utc TEXT NOT NULL,
+  accepted_at_utc TEXT,
+  revoked_at_utc TEXT
+);
+
+CREATE INDEX invitations_email_idx ON invitations(email_normalized, created_at_utc);
+
+CREATE TABLE password_reset_tokens (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  created_at_utc TEXT NOT NULL,
+  expires_at_utc TEXT NOT NULL,
+  consumed_at_utc TEXT
+);
+
+CREATE INDEX password_resets_user_idx ON password_reset_tokens(user_id, created_at_utc);
+
+CREATE TABLE login_attempts (
+  id TEXT PRIMARY KEY,
+  email_key TEXT NOT NULL,
+  address_key TEXT NOT NULL,
+  attempted_at_utc TEXT NOT NULL
+);
+
+CREATE INDEX login_attempts_email_idx ON login_attempts(email_key, attempted_at_utc);
+CREATE INDEX login_attempts_address_idx ON login_attempts(address_key, attempted_at_utc);
@@ -1,14 +1,16 @@
 {
 	"name": "sendewerk",
-	"version": "0.1.1",
+	"version": "0.2.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "sendewerk",
-			"version": "0.1.1",
+			"version": "0.2.0",
 			"dependencies": {
-				"better-sqlite3": "^13.0.3"
+				"@node-rs/argon2": "^2.2.2",
+				"better-sqlite3": "^13.0.3",
+				"nodemailer": "^10.1.7"
 			},
 			"devDependencies": {
 				"@eslint/js": "^10.0.1",
@@ -327,6 +329,238 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/@node-rs/argon2": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2/-/argon2-2.2.2.tgz",
+			"integrity": "sha512-NtdlPPWtR5U4BxX5EGJYza+UklNaoWORmkaKCMqf/nyKeXWKVwNt8KfQoRpNT7OB1DcEwmePafO4wZyW+sbfCQ==",
+			"license": "MIT",
+			"engines": {
+				"node": ">= 10"
+			},
+			"optionalDependencies": {
+				"@node-rs/argon2-android-arm-eabi": "2.2.2",
+				"@node-rs/argon2-android-arm64": "2.2.2",
+				"@node-rs/argon2-darwin-arm64": "2.2.2",
+				"@node-rs/argon2-darwin-x64": "2.2.2",
+				"@node-rs/argon2-freebsd-x64": "2.2.2",
+				"@node-rs/argon2-linux-arm-gnueabihf": "2.2.2",
+				"@node-rs/argon2-linux-arm64-gnu": "2.2.2",
+				"@node-rs/argon2-linux-arm64-musl": "2.2.2",
+				"@node-rs/argon2-linux-x64-gnu": "2.2.2",
+				"@node-rs/argon2-linux-x64-musl": "2.2.2",
+				"@node-rs/argon2-win32-arm64-msvc": "2.2.2",
+				"@node-rs/argon2-win32-ia32-msvc": "2.2.2",
+				"@node-rs/argon2-win32-x64-msvc": "2.2.2"
+			}
+		},
+		"node_modules/@node-rs/argon2-android-arm-eabi": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-android-arm-eabi/-/argon2-android-arm-eabi-2.2.2.tgz",
+			"integrity": "sha512-c11BOrPLBWNC1cDyzGB+Bil+flmxfZbB2hv8EhcobmAsFKMyqkHPNhUY4qhcjv1U+4+Vmw4G8H+l224iO2g/Dw==",
+			"cpu": [
+				"arm"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"android"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-android-arm64": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-android-arm64/-/argon2-android-arm64-2.2.2.tgz",
+			"integrity": "sha512-dpMYIoxhN/wY6hFH+3MM5kQErcH3luMekkszbkDF3NKqhB1kFRntkOLDpFY87oItBSHJrsoYkXC3vBRhjYoCjQ==",
+			"cpu": [
+				"arm64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"android"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-darwin-arm64": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-darwin-arm64/-/argon2-darwin-arm64-2.2.2.tgz",
+			"integrity": "sha512-vxVAXcIG0iiHizkCuImmzVhOFsRnU4Z79xiOxdISLyI+QhOAWbbTaVSXw0PNfThB3zAdkzzDJ/WWu52Hs/qHGg==",
+			"cpu": [
+				"arm64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"darwin"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-darwin-x64": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-darwin-x64/-/argon2-darwin-x64-2.2.2.tgz",
+			"integrity": "sha512-r7GbSFpFZZ9EAV9cvIm9prUjOupK7QQXTyP+FJ6bWSMq0h+qRDBlUOXQXduDIIrLEGoBVelixKUtf4ksZ0ljoQ==",
+			"cpu": [
+				"x64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"darwin"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-freebsd-x64": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-freebsd-x64/-/argon2-freebsd-x64-2.2.2.tgz",
+			"integrity": "sha512-AmWxDSmQgprilD6NX3jmxCgcDvWAW7kGJnnWQo+0qav6nfMXdPZYgSezK/skmw1GBWipr4yZMIUzpeNHnVpMxg==",
+			"cpu": [
+				"x64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"freebsd"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-linux-arm-gnueabihf": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-linux-arm-gnueabihf/-/argon2-linux-arm-gnueabihf-2.2.2.tgz",
+			"integrity": "sha512-M1gnPBTr9GFeEUWkQ53qCJeTsX03C3kcUeHnDbN7dU2xkI58wMP4Z1sEBN7WmKJ/fTHYEgti4truz7r4A82DLg==",
+			"cpu": [
+				"arm"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-linux-arm64-gnu": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-linux-arm64-gnu/-/argon2-linux-arm64-gnu-2.2.2.tgz",
+			"integrity": "sha512-4CYDlIdITlLSVcAXYUtEoGUahRaayPXM+4Rcfg3BZx9WGi6UB8HUycs6GNMTPYXV5kVXCpyE2u1HmYUpgmIzOQ==",
+			"cpu": [
+				"arm64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-linux-arm64-musl": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-linux-arm64-musl/-/argon2-linux-arm64-musl-2.2.2.tgz",
+			"integrity": "sha512-FYlfj3XgQ1xrx6HzQbKbUcKiYMG/3iSi/X81KyhHaItTJ7vZlMwrbVLl9yqDmvotKUF6VjrhrlZ8KRbbzchseA==",
+			"cpu": [
+				"arm64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-linux-x64-gnu": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-linux-x64-gnu/-/argon2-linux-x64-gnu-2.2.2.tgz",
+			"integrity": "sha512-ULXLs8UFYZANlwiROM7AeccxZndr2Xk3IstADq3jAUhnwV2W75mxMBTABUZ+7AdKRhPLOrxU77OgnMWlDkYJQg==",
+			"cpu": [
+				"x64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-linux-x64-musl": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-linux-x64-musl/-/argon2-linux-x64-musl-2.2.2.tgz",
+			"integrity": "sha512-zgjIwc9TyGodn62vGc+36DGwFqVV5e7L8Ptd2FQWuBxe5aFrcFxvtDGn1/qfYwoHLv09utgtR+RBAPCXepWG3Q==",
+			"cpu": [
+				"x64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-win32-arm64-msvc": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-win32-arm64-msvc/-/argon2-win32-arm64-msvc-2.2.2.tgz",
+			"integrity": "sha512-3nLhvLie/ec5xfxUBXXqGMb7oGeqF+YXrcGckqaTaGkPtOBozho0Kh2IuP/zi9BcOriirTG2LW3gtIOfpuh+mQ==",
+			"cpu": [
+				"arm64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"win32"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-win32-ia32-msvc": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-win32-ia32-msvc/-/argon2-win32-ia32-msvc-2.2.2.tgz",
+			"integrity": "sha512-6RJKD6cFl7UeiYJLjRsXPywVXSFSaSDdr6xGpztNDV31QHCEecWnsnNmKxzi4gVpln2F9XeWEtIgM4Nqw1hLbA==",
+			"cpu": [
+				"ia32"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"win32"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
+		"node_modules/@node-rs/argon2-win32-x64-msvc": {
+			"version": "2.2.2",
+			"resolved": "https://registry.npmjs.org/@node-rs/argon2-win32-x64-msvc/-/argon2-win32-x64-msvc-2.2.2.tgz",
+			"integrity": "sha512-dQOO9S4QKBaVul0Uyk/2quJc/OBeHNZRJP+GZZTy1A5kYIaAfIJGHUYLY6oFoAlcuLIkdFouLaHX3fCl8tZm/w==",
+			"cpu": [
+				"x64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"win32"
+			],
+			"engines": {
+				"node": ">= 10"
+			}
+		},
 		"node_modules/@oxc-project/types": {
 			"version": "0.154.0",
 			"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.154.0.tgz",
@@ -2209,6 +2443,15 @@
 				"node": "^18 || ^20 || >= 21"
 			}
 		},
+		"node_modules/nodemailer": {
+			"version": "10.1.7",
+			"resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-10.1.7.tgz",
+			"integrity": "sha512-OQa6FDln5fLttmqSbjDiRYvFDOFNrBqfiOwHPlEbURil3b+vPB1v8xpi+Sp46drzNDlsTnNsS502vthmz56r4w==",
+			"license": "MIT-0",
+			"engines": {
+				"node": ">=20.0.0"
+			}
+		},
 		"node_modules/obug": {
 			"version": "2.2.1",
 			"resolved": "https://registry.npmjs.org/obug/-/obug-2.2.1.tgz",
@@ -1,15 +1,15 @@
 {
 	"name": "sendewerk",
 	"private": true,
-	"version": "0.1.1",
+	"version": "0.2.0",
 	"type": "module",
 	"engines": {
 		"node": ">=22.17 <25"
 	},
 	"scripts": {
-		"dev": "vite dev",
-		"build": "vite build",
-		"preview": "vite preview",
+		"dev": "npm run db:migrate && node --env-file-if-exists=.env ./node_modules/vite/bin/vite.js dev",
+		"build": "node --env-file-if-exists=.env ./node_modules/vite/bin/vite.js build",
+		"preview": "node --env-file-if-exists=.env ./node_modules/vite/bin/vite.js preview",
 		"start": "npm run db:migrate && node --env-file-if-exists=.env build",
 		"setup": "npm run db:migrate && npm run db:seed",
 		"db:migrate": "node --env-file-if-exists=.env scripts/migrate.mjs",
@@ -24,7 +24,9 @@
 		"test:e2e": "playwright test"
 	},
 	"dependencies": {
-		"better-sqlite3": "^13.0.3"
+		"@node-rs/argon2": "^2.2.2",
+		"better-sqlite3": "^13.0.3",
+		"nodemailer": "^10.1.7"
 	},
 	"devDependencies": {
 		"@eslint/js": "^10.0.1",
@@ -3,7 +3,11 @@ import { mkdtempSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';

-const dataDirectory = mkdtempSync(path.join(tmpdir(), 'sendewerk-e2e-'));
+const dataDirectory =
+	process.env.SENDEWERK_E2E_DATA_DIR || mkdtempSync(path.join(tmpdir(), 'sendewerk-e2e-'));
+const mailOutboxDirectory = path.join(dataDirectory, 'mail-outbox');
+process.env.SENDEWERK_E2E_DATA_DIR = dataDirectory;
+process.env.SENDEWERK_E2E_OUTBOX_DIR = mailOutboxDirectory;

 export default defineConfig({
 	testDir: 'tests',
@@ -18,6 +22,11 @@ export default defineConfig({
 		env: {
 			SENDEWERK_DB_PATH: path.join(dataDirectory, 'e2e.sqlite'),
 			SENDEWERK_UPLOAD_DIR: path.join(dataDirectory, 'uploads'),
+			SENDEWERK_MAIL_OUTBOX_DIR: mailOutboxDirectory,
+			SENDEWERK_MAIL_TRANSPORT: 'local',
+			SENDEWERK_APP_ORIGIN: 'http://127.0.0.1:4173',
+			SENDEWERK_SETUP_TOKEN: 'e2e-only-setup-token-32-characters',
+			ORIGIN: 'http://127.0.0.1:4173',
 			HOST: '127.0.0.1',
 			PORT: '4173'
 		}
@@ -78,7 +78,8 @@ body {
 }

 button,
-input {
+input,
+select {
 	font: inherit;
 }

@@ -1179,6 +1180,290 @@ a {
 	font-size: 0.72rem;
 }

+.auth-shell {
+	min-height: 100vh;
+	background:
+		radial-gradient(
+			circle at 12% 8%,
+			color-mix(in srgb, var(--accent) 12%, transparent),
+			transparent 28rem
+		),
+		var(--bg);
+}
+
+.auth-header {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	min-height: 4.25rem;
+	padding: 0.65rem clamp(1rem, 4vw, 3rem);
+	border-bottom: 1px solid var(--line);
+	background: color-mix(in srgb, var(--bg-elevated) 86%, transparent);
+	backdrop-filter: blur(20px);
+}
+
+.auth-header .theme-toggle {
+	width: auto;
+}
+
+.auth-main {
+	display: grid;
+	min-height: calc(100vh - 4.25rem);
+	padding: clamp(1.25rem, 6vw, 4rem) 1rem;
+	place-items: start center;
+}
+
+.auth-card {
+	width: min(100%, 30rem);
+	padding: clamp(1.25rem, 4vw, 2rem);
+	border: 1px solid var(--line);
+	border-radius: var(--radius-large);
+	background: var(--panel);
+	box-shadow: var(--shadow);
+}
+
+.auth-card h1 {
+	margin: 0.3rem 0 0.5rem;
+	font-size: clamp(1.6rem, 5vw, 2.1rem);
+	letter-spacing: -0.04em;
+	line-height: 1.1;
+}
+
+.auth-card > p:not(.eyebrow),
+.quiet-copy {
+	margin: 0 0 1rem;
+	color: var(--text-muted);
+	font-size: 0.85rem;
+}
+
+.auth-form,
+.compact-form {
+	display: grid;
+	gap: 0.85rem;
+}
+
+.auth-form label,
+.compact-form label {
+	display: grid;
+	gap: 0.32rem;
+	color: var(--text-muted);
+	font-size: 0.75rem;
+	font-weight: 700;
+}
+
+.auth-form input,
+.compact-form input,
+.compact-form select,
+.inline-account-form select {
+	width: 100%;
+	min-height: 2.65rem;
+	padding: 0.55rem 0.7rem;
+	border: 1px solid var(--line-strong);
+	border-radius: var(--radius-small);
+	background: var(--panel-strong);
+	color: var(--text);
+}
+
+.primary-button,
+.secondary-button,
+.logout-button,
+.mobile-logout,
+.text-button {
+	border: 0;
+	cursor: pointer;
+	font-weight: 700;
+}
+
+.primary-button {
+	min-height: 2.7rem;
+	padding: 0.6rem 0.9rem;
+	border-radius: var(--radius-small);
+	background: var(--accent);
+	color: var(--panel-strong);
+}
+
+.secondary-button,
+.logout-button {
+	min-height: 2.35rem;
+	padding: 0.48rem 0.7rem;
+	border: 1px solid var(--line);
+	border-radius: var(--radius-small);
+	background: transparent;
+}
+
+.secondary-button:disabled {
+	cursor: not-allowed;
+	opacity: 0.55;
+}
+
+.logout-button {
+	width: 100%;
+	color: var(--text-muted);
+	text-align: left;
+}
+
+.mobile-logout {
+	width: 2.4rem;
+	height: 2.4rem;
+	border-radius: 50%;
+	background: transparent;
+	color: var(--text-muted);
+}
+
+.text-button {
+	padding: 0.25rem;
+	background: transparent;
+	color: var(--accent);
+	font-size: 0.7rem;
+}
+
+.auth-link {
+	display: inline-block;
+	margin-top: 1rem;
+	color: var(--accent);
+	font-size: 0.78rem;
+	font-weight: 700;
+}
+
+.field-hint {
+	margin: -0.35rem 0 0;
+	color: var(--text-faint);
+	font-size: 0.68rem;
+}
+
+.form-message {
+	margin: 0 0 1rem;
+	padding: 0.7rem 0.8rem;
+	border: 1px solid var(--line);
+	border-radius: var(--radius-small);
+	font-size: 0.76rem;
+}
+
+.form-message.error {
+	border-color: color-mix(in srgb, var(--danger) 45%, var(--line));
+	background: color-mix(in srgb, var(--danger) 8%, var(--panel));
+}
+
+.form-message.success {
+	border-color: color-mix(in srgb, var(--accent) 38%, var(--line));
+	background: color-mix(in srgb, var(--accent-soft) 55%, var(--panel));
+}
+
+.account-summary {
+	display: grid;
+	padding: 0 0.7rem;
+}
+
+.account-summary span {
+	font-size: 0.75rem;
+	font-weight: 700;
+}
+
+.account-summary small {
+	color: var(--text-faint);
+	font-size: 0.65rem;
+}
+
+.account-panel,
+.invite-panel {
+	padding: 1rem;
+}
+
+.account-panel {
+	margin-bottom: 0.75rem;
+}
+
+.panel-heading {
+	display: flex;
+	align-items: flex-start;
+	justify-content: space-between;
+	gap: 1rem;
+}
+
+.panel-heading h2,
+.invite-panel h2,
+.section-heading {
+	margin: 0.18rem 0 0.7rem;
+	font-size: 1rem;
+}
+
+.mail-mode,
+.account-status {
+	padding: 0.22rem 0.45rem;
+	border-radius: 2rem;
+	background: var(--accent-soft);
+	color: var(--accent-text);
+	font-size: 0.65rem;
+	font-weight: 700;
+}
+
+.account-status.locked {
+	background: color-mix(in srgb, var(--danger) 12%, var(--panel));
+	color: var(--danger);
+}
+
+.account-list {
+	display: grid;
+	border-top: 1px solid var(--line);
+}
+
+.account-row {
+	display: grid;
+	grid-template-columns: minmax(10rem, 1fr) auto minmax(11rem, auto) auto;
+	align-items: center;
+	gap: 0.7rem;
+	padding: 0.7rem 0;
+	border-bottom: 1px solid var(--line);
+}
+
+.account-row > div,
+.invitation-list span {
+	display: grid;
+	min-width: 0;
+}
+
+.account-row small,
+.invitation-list small {
+	color: var(--text-muted);
+	font-size: 0.68rem;
+	overflow-wrap: anywhere;
+}
+
+.inline-account-form {
+	display: flex;
+	align-items: center;
+	gap: 0.35rem;
+}
+
+.inline-account-form select {
+	min-height: 2.2rem;
+	padding-block: 0.35rem;
+}
+
+.management-grid {
+	display: grid;
+	grid-template-columns: repeat(2, minmax(0, 1fr));
+	gap: 0.75rem;
+	margin-bottom: 1rem;
+}
+
+.invitation-list {
+	display: grid;
+}
+
+.invitation-list > div {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	gap: 0.7rem;
+	padding: 0.55rem 0;
+	border-bottom: 1px solid var(--line);
+}
+
+.section-heading {
+	margin-top: 1rem;
+}
+
@media (max-width: 72rem) {
 	.page-wrap {
 		padding-inline: 2rem;
@@ -1250,12 +1535,15 @@ a {
 		z-index: 30;
 		display: grid;
 		height: calc(var(--mobile-nav) + env(safe-area-inset-bottom));
-		grid-template-columns: repeat(5, 1fr);
+		grid-template-columns: repeat(4, 1fr);
 		padding: 0.45rem 0.35rem env(safe-area-inset-bottom);
 		border-top: 1px solid var(--line);
 		background: color-mix(in srgb, var(--bg-elevated) 92%, transparent);
 		backdrop-filter: blur(22px) saturate(1.3);
 	}
+	.mobile-navigation:has(a:nth-child(5)) {
+		grid-template-columns: repeat(5, 1fr);
+	}
 	.mobile-navigation a {
 		display: flex;
 		min-width: 0;
@@ -1399,6 +1687,19 @@ a {
 	.settings-grid {
 		grid-template-columns: 1fr;
 	}
+	.management-grid {
+		grid-template-columns: 1fr;
+	}
+	.account-row {
+		grid-template-columns: minmax(0, 1fr) auto;
+	}
+	.inline-account-form,
+	.account-row > form:last-child {
+		grid-column: 1 / -1;
+	}
+	.inline-account-form select {
+		flex: 1;
+	}
 }

@media (max-width: 24rem) {
@@ -1,5 +1,14 @@
+import type { AuthUser } from '#lib/server/auth.js';
+
 declare global {
-	namespace App {}
+	namespace App {
+		interface Locals {
+			user: AuthUser | null;
+		}
+		interface PageData {
+			user?: AuthUser | null;
+		}
+	}
 }

 export {};
@@ -0,0 +1,32 @@
+import { redirect } from '@sveltejs/kit';
+import type { Handle } from '@sveltejs/kit/hooks';
+import { deleteSession, getSessionUser, hasUsers, SESSION_COOKIE } from '#lib/server/auth.js';
+
+const publicPaths = new Set([
+	'/',
+	'/healthz',
+	'/login',
+	'/setup',
+	'/einladung',
+	'/passwort-vergessen',
+	'/passwort-zuruecksetzen'
+]);
+
+export const handle: Handle = async ({ event, resolve }) => {
+	const token = event.cookies.get(SESSION_COOKIE);
+	event.locals.user = getSessionUser(token);
+	if (token && !event.locals.user) deleteSession(event.cookies);
+
+	if (!publicPaths.has(event.url.pathname) && !event.locals.user) {
+		redirect(303, hasUsers() ? '/login' : '/setup');
+	}
+
+	const response = await resolve(event);
+	response.headers.set('Referrer-Policy', 'same-origin');
+	response.headers.set('X-Content-Type-Options', 'nosniff');
+	response.headers.set('X-Frame-Options', 'DENY');
+	if (event.url.pathname === '/einladung' || event.url.pathname === '/passwort-zuruecksetzen') {
+		response.headers.set('Cache-Control', 'no-store');
+	}
+	return response;
+};
@@ -0,0 +1,255 @@
+import Database from 'better-sqlite3';
+import { execFileSync } from 'node:child_process';
+import { readFileSync, readdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import type { Cookies } from '@sveltejs/kit';
+
+const temporaryDirectories: string[] = [];
+let directory: string;
+let databasePath: string;
+
+function testCookies(): Cookies {
+	const values = new Map<string, string>();
+	return {
+		get: (name: string) => values.get(name),
+		getAll: () => Array.from(values, ([name, value]) => ({ name, value })),
+		set: (name: string, value: string) => {
+			values.set(name, value);
+		},
+		delete: (name: string) => {
+			values.delete(name);
+		},
+		serialize: () => ''
+	} as unknown as Cookies;
+}
+
+function tokenFromLatestMail(): string {
+	const outbox = path.join(directory, 'outbox');
+	const files = readdirSync(outbox).sort();
+	const message = JSON.parse(readFileSync(path.join(outbox, files.at(-1)!), 'utf8')) as {
+		text: string;
+	};
+	const match = message.text.match(/[?&]token=([^\s]+)/);
+	if (!match) throw new Error('Testmail enthält keinen Token.');
+	return decodeURIComponent(match[1]);
+}
+
+beforeEach(() => {
+	directory = mkdtempSync(path.join(tmpdir(), 'sendewerk-auth-test-'));
+	temporaryDirectories.push(directory);
+	databasePath = path.join(directory, 'test.sqlite');
+	process.env.SENDEWERK_DB_PATH = databasePath;
+	process.env.SENDEWERK_UPLOAD_DIR = path.join(directory, 'uploads');
+	process.env.SENDEWERK_MAIL_OUTBOX_DIR = path.join(directory, 'outbox');
+	process.env.SENDEWERK_MAIL_TRANSPORT = 'local';
+	process.env.SENDEWERK_APP_ORIGIN = 'http://localhost:5173';
+	process.env.SENDEWERK_SETUP_TOKEN = 'a'.repeat(32);
+	execFileSync(process.execPath, ['scripts/migrate.mjs'], { cwd: process.cwd(), env: process.env });
+});
+
+afterEach(async () => {
+	const { closeDatabase } = await import('./database.js');
+	closeDatabase();
+	for (const name of [
+		'SENDEWERK_DB_PATH',
+		'SENDEWERK_UPLOAD_DIR',
+		'SENDEWERK_MAIL_OUTBOX_DIR',
+		'SENDEWERK_MAIL_TRANSPORT',
+		'SENDEWERK_MAIL_FROM',
+		'SENDEWERK_SMTP_HOST',
+		'SENDEWERK_APP_ORIGIN',
+		'SENDEWERK_SETUP_TOKEN'
+	]) {
+		delete process.env[name];
+	}
+	for (const temporaryDirectory of temporaryDirectories.splice(0)) {
+		rmSync(temporaryDirectory, { recursive: true, force: true });
+	}
+});
+
+describe('authentication', () => {
+	it('creates the first Barkeeper once and stores no plaintext secret', async () => {
+		const { createFirstAdmin } = await import('./auth.js');
+		const password = 'Ein-sehr-langes-Testpasswort';
+		const user = await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'Bar@example.org',
+			displayName: 'Erster Barkeeper',
+			password
+		});
+		const database = new Database(databasePath, { readonly: true });
+		const row = database.prepare('SELECT * FROM users').get() as {
+			role: string;
+			email_normalized: string;
+			password_hash: string;
+		};
+		database.close();
+
+		expect(user.role).toBe('barkeeper');
+		expect(row.email_normalized).toBe('bar@example.org');
+		expect(row.password_hash).not.toContain(password);
+		await expect(
+			createFirstAdmin({
+				setupToken: 'a'.repeat(32),
+				email: 'second@example.org',
+				displayName: 'Zweiter Admin',
+				password
+			})
+		).rejects.toThrow('SETUP_CLOSED');
+	});
+
+	it('accepts an invitation only once and rejects an expired invitation', async () => {
+		const { acceptInvitation, createFirstAdmin, inviteUser } = await import('./auth.js');
+		const admin = await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'admin@example.org',
+			displayName: 'Admin',
+			password: 'Admin-Passwort-1234'
+		});
+		await inviteUser(admin, 'crew@example.org', 'thekencrew');
+		const firstToken = tokenFromLatestMail();
+		const crew = await acceptInvitation({
+			token: firstToken,
+			displayName: 'Crew',
+			password: 'Crew-Passwort-1234'
+		});
+		expect(crew.role).toBe('thekencrew');
+		await expect(
+			acceptInvitation({
+				token: firstToken,
+				displayName: 'Crew',
+				password: 'Crew-Passwort-1234'
+			})
+		).rejects.toThrow('TOKEN_INVALID');
+
+		await inviteUser(admin, 'late@example.org', 'thekencrew');
+		const expiredToken = tokenFromLatestMail();
+		const database = new Database(databasePath);
+		database.prepare("UPDATE invitations SET expires_at_utc = '2000-01-01T00:00:00.000Z'").run();
+		database.close();
+		await expect(
+			acceptInvitation({
+				token: expiredToken,
+				displayName: 'Zu spät',
+				password: 'Crew-Passwort-1234'
+			})
+		).rejects.toThrow('TOKEN_INVALID');
+	});
+
+	it('revokes active sessions immediately when a user is locked', async () => {
+		const { createFirstAdmin, createSession, getSessionUser, setUserLocked, SESSION_COOKIE } =
+			await import('./auth.js');
+		const admin = await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'admin@example.org',
+			displayName: 'Admin',
+			password: 'Admin-Passwort-1234'
+		});
+		const database = new Database(databasePath);
+		const crewId = crypto.randomUUID();
+		database
+			.prepare(
+				`INSERT INTO users (id, email, email_normalized, display_name, password_hash, role,
+				 password_changed_at_utc, created_at_utc, updated_at_utc)
+				 SELECT ?, 'crew@example.org', 'crew@example.org', 'Crew', password_hash, 'thekencrew',
+				 password_changed_at_utc, created_at_utc, updated_at_utc FROM users WHERE id = ?`
+			)
+			.run(crewId, admin.id);
+		database.close();
+		const cookies = testCookies();
+		createSession(crewId, cookies);
+		const token = cookies.get(SESSION_COOKIE);
+		expect(getSessionUser(token)?.id).toBe(crewId);
+
+		setUserLocked(admin, crewId, true);
+		expect(getSessionUser(token)).toBeNull();
+	});
+
+	it('uses password reset links once and invalidates prior sessions', async () => {
+		const {
+			authenticate,
+			createFirstAdmin,
+			createSession,
+			getSessionUser,
+			requestPasswordReset,
+			resetPassword,
+			SESSION_COOKIE
+		} = await import('./auth.js');
+		const admin = await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'admin@example.org',
+			displayName: 'Admin',
+			password: 'Altes-Passwort-1234'
+		});
+		const cookies = testCookies();
+		createSession(admin.id, cookies);
+		const sessionToken = cookies.get(SESSION_COOKIE);
+		await requestPasswordReset(admin.email);
+		const expiredToken = tokenFromLatestMail();
+		const database = new Database(databasePath);
+		database
+			.prepare("UPDATE password_reset_tokens SET expires_at_utc = '2000-01-01T00:00:00.000Z'")
+			.run();
+		database.close();
+		await expect(resetPassword(expiredToken, 'Neues-Passwort-1234')).rejects.toThrow(
+			'TOKEN_INVALID'
+		);
+		await requestPasswordReset(admin.email);
+		const resetToken = tokenFromLatestMail();
+		await resetPassword(resetToken, 'Neues-Passwort-1234');
+
+		expect(getSessionUser(sessionToken)).toBeNull();
+		expect(await authenticate(admin.email, 'Altes-Passwort-1234')).toBeNull();
+		expect(await authenticate(admin.email, 'Neues-Passwort-1234')).not.toBeNull();
+		await expect(resetPassword(resetToken, 'Noch-ein-Passwort-1234')).rejects.toThrow(
+			'TOKEN_INVALID'
+		);
+	});
+
+	it('rate limits repeated failed login attempts without locking the account', async () => {
+		const { authenticate, createFirstAdmin, loginIsRateLimited, reserveLoginAttempt } =
+			await import('./auth.js');
+		await createFirstAdmin({
+			setupToken: 'a'.repeat(32),
+			email: 'admin@example.org',
+			displayName: 'Admin',
+			password: 'Admin-Passwort-1234'
+		});
+		for (let attempt = 0; attempt < 5; attempt += 1) {
+			expect(reserveLoginAttempt('admin@example.org', '127.0.0.1')).toBe(true);
+			expect(await authenticate('admin@example.org', 'falsch')).toBeNull();
+		}
+		expect(loginIsRateLimited('admin@example.org', '127.0.0.1')).toBe(true);
+		const database = new Database(databasePath, { readonly: true });
+		const user = database.prepare('SELECT locked_at_utc FROM users').get() as {
+			locked_at_utc: string | null;
+		};
+		database.close();
+		expect(user.locked_at_utc).toBeNull();
+	});
+
+	it('denies administrative operations to Thekencrew', async () => {
+		const { requireBarkeeper } = await import('./auth.js');
+		expect(() =>
+			requireBarkeeper({
+				id: 'crew',
+				email: 'crew@example.org',
+				displayName: 'Crew',
+				role: 'thekencrew',
+				lockedAtUtc: null
+			})
+		).toThrow();
+	});
+
+	it('never falls back to local delivery when SMTP was selected', async () => {
+		process.env.SENDEWERK_MAIL_TRANSPORT = 'smtp';
+		process.env.SENDEWERK_MAIL_FROM = '';
+		process.env.SENDEWERK_SMTP_HOST = '';
+		const { sendMail } = await import('./mail.js');
+		await expect(
+			sendMail({ to: 'test@example.org', subject: 'Test', text: 'Keine echte Nachricht' })
+		).rejects.toThrow('SMTP-Konfiguration');
+	});
+});
@@ -0,0 +1,610 @@
+import { hash, verify } from '@node-rs/argon2';
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { error } from '@sveltejs/kit';
+import type { Cookies } from '@sveltejs/kit';
+import { getAuthConfig } from './config.js';
+import { getDatabase } from './database.js';
+import { sendMail } from './mail.js';
+
+export const SESSION_COOKIE = 'sendewerk_session';
+export const INVITATION_COOKIE = 'sendewerk_invitation';
+export const RESET_COOKIE = 'sendewerk_password_reset';
+const SESSION_DURATION_MS = 30 * 24 * 60 * 60 * 1000;
+const LINK_DURATION_MS = 24 * 60 * 60 * 1000;
+const LOGIN_WINDOW_MS = 15 * 60 * 1000;
+const EMAIL_ATTEMPT_LIMIT = 5;
+const ADDRESS_ATTEMPT_LIMIT = 20;
+const RESET_WINDOW_MS = 60 * 60 * 1000;
+const RESET_EMAIL_LIMIT = 3;
+const RESET_ADDRESS_LIMIT = 10;
+const PASSWORD_OPTIONS = {
+	algorithm: 2,
+	memoryCost: 19_456,
+	timeCost: 2,
+	parallelism: 1,
+	outputLen: 32
+} as const;
+
+export type Role = 'barkeeper' | 'thekencrew';
+export type AuthUser = {
+	id: string;
+	email: string;
+	displayName: string;
+	role: Role;
+	lockedAtUtc: string | null;
+};
+
+type UserRow = {
+	id: string;
+	email: string;
+	display_name: string;
+	password_hash: string;
+	role: Role;
+	locked_at_utc: string | null;
+};
+
+type InvitationRow = {
+	id: string;
+	email: string;
+	role: Role;
+	expires_at_utc: string;
+	accepted_at_utc: string | null;
+	revoked_at_utc: string | null;
+};
+
+function toUser(row: UserRow): AuthUser {
+	return {
+		id: row.id,
+		email: row.email,
+		displayName: row.display_name,
+		role: row.role,
+		lockedAtUtc: row.locked_at_utc
+	};
+}
+
+export function normalizeEmail(email: string): string {
+	return email.trim().toLowerCase();
+}
+
+export function validEmail(email: string): boolean {
+	return email.length <= 254 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+
+export function validDisplayName(name: string): boolean {
+	return name.trim().length >= 2 && name.trim().length <= 80;
+}
+
+export function validPassword(password: string): boolean {
+	return password.length >= 12 && Buffer.byteLength(password, 'utf8') <= 256;
+}
+
+export function isRole(value: string): value is Role {
+	return value === 'barkeeper' || value === 'thekencrew';
+}
+
+export async function hashPassword(password: string): Promise<string> {
+	return hash(password, PASSWORD_OPTIONS);
+}
+
+export async function verifyPassword(passwordHash: string, password: string): Promise<boolean> {
+	return verify(passwordHash, password, PASSWORD_OPTIONS);
+}
+
+const dummyPasswordHash = hashPassword(randomBytes(32).toString('hex'));
+
+function createToken(): string {
+	return randomBytes(32).toString('base64url');
+}
+
+function hashToken(token: string): string {
+	return createHash('sha256').update(token).digest('hex');
+}
+
+function nowUtc(): string {
+	return new Date().toISOString();
+}
+
+function futureUtc(durationMs: number): string {
+	return new Date(Date.now() + durationMs).toISOString();
+}
+
+export function hasUsers(): boolean {
+	const row = getDatabase().prepare('SELECT count(*) AS count FROM users').get() as {
+		count: number;
+	};
+	return row.count > 0;
+}
+
+export function setupIsConfigured(): boolean {
+	return getAuthConfig().setupToken.length >= 32;
+}
+
+function setupTokenMatches(candidate: string): boolean {
+	const configured = getAuthConfig().setupToken;
+	if (configured.length < 32 || candidate.length !== configured.length) return false;
+	return timingSafeEqual(Buffer.from(candidate), Buffer.from(configured));
+}
+
+export async function createFirstAdmin(input: {
+	setupToken: string;
+	email: string;
+	displayName: string;
+	password: string;
+}): Promise<AuthUser> {
+	if (!setupTokenMatches(input.setupToken)) throw new Error('SETUP_TOKEN_INVALID');
+	const email = input.email.trim();
+	const emailNormalized = normalizeEmail(email);
+	const displayName = input.displayName.trim();
+	if (!validEmail(email) || !validDisplayName(displayName) || !validPassword(input.password)) {
+		throw new Error('VALIDATION');
+	}
+	const passwordHash = await hashPassword(input.password);
+	const database = getDatabase();
+	const create = database.transaction(() => {
+		const count = database.prepare('SELECT count(*) AS count FROM users').get() as {
+			count: number;
+		};
+		if (count.count !== 0) throw new Error('SETUP_CLOSED');
+		const id = randomUUID();
+		const timestamp = nowUtc();
+		database
+			.prepare(
+				`INSERT INTO users (
+					id, email, email_normalized, display_name, password_hash, role,
+					password_changed_at_utc, created_at_utc, updated_at_utc
+				) VALUES (?, ?, ?, ?, ?, 'barkeeper', ?, ?, ?)`
+			)
+			.run(id, email, emailNormalized, displayName, passwordHash, timestamp, timestamp, timestamp);
+		return { id, email, displayName, role: 'barkeeper', lockedAtUtc: null } satisfies AuthUser;
+	});
+	return create();
+}
+
+function sessionCookieOptions(expires?: Date) {
+	return {
+		path: '/',
+		httpOnly: true,
+		sameSite: 'lax' as const,
+		secure: getAuthConfig().secureCookies,
+		expires
+	};
+}
+
+function linkCookieOptions() {
+	return {
+		path: '/',
+		httpOnly: true,
+		sameSite: 'strict' as const,
+		secure: getAuthConfig().secureCookies,
+		maxAge: 10 * 60
+	};
+}
+
+export function storeLinkToken(cookies: Cookies, name: string, token: string): void {
+	cookies.set(name, token, linkCookieOptions());
+}
+
+export function readLinkToken(cookies: Cookies, name: string): string {
+	return cookies.get(name) || '';
+}
+
+export function deleteLinkToken(cookies: Cookies, name: string): void {
+	cookies.delete(name, { ...linkCookieOptions(), maxAge: 0 });
+}
+
+export function createSession(userId: string, cookies: Cookies): void {
+	const token = createToken();
+	const expires = new Date(Date.now() + SESSION_DURATION_MS);
+	getDatabase()
+		.prepare(
+			'INSERT INTO sessions (token_hash, user_id, created_at_utc, expires_at_utc) VALUES (?, ?, ?, ?)'
+		)
+		.run(hashToken(token), userId, nowUtc(), expires.toISOString());
+	cookies.set(SESSION_COOKIE, token, sessionCookieOptions(expires));
+}
+
+export function deleteSession(cookies: Cookies): void {
+	const token = cookies.get(SESSION_COOKIE);
+	if (token)
+		getDatabase().prepare('DELETE FROM sessions WHERE token_hash = ?').run(hashToken(token));
+	cookies.delete(SESSION_COOKIE, sessionCookieOptions());
+}
+
+export function getSessionUser(token: string | undefined): AuthUser | null {
+	if (!token) return null;
+	const database = getDatabase();
+	const row = database
+		.prepare(
+			`SELECT u.id, u.email, u.display_name, u.password_hash, u.role, u.locked_at_utc
+			 FROM sessions s
+			 JOIN users u ON u.id = s.user_id
+			 WHERE s.token_hash = ? AND s.expires_at_utc > ? AND u.locked_at_utc IS NULL`
+		)
+		.get(hashToken(token), nowUtc()) as UserRow | undefined;
+	if (!row) return null;
+	return toUser(row);
+}
+
+function rateKey(value: string): string {
+	return hashToken(value || 'unknown');
+}
+
+export function loginIsRateLimited(email: string, address: string): boolean {
+	const database = getDatabase();
+	const since = new Date(Date.now() - LOGIN_WINDOW_MS).toISOString();
+	database.prepare('DELETE FROM login_attempts WHERE attempted_at_utc < ?').run(since);
+	const emailCount = database
+		.prepare(
+			'SELECT count(*) AS count FROM login_attempts WHERE email_key = ? AND attempted_at_utc >= ?'
+		)
+		.get(rateKey(normalizeEmail(email)), since) as { count: number };
+	const addressCount = database
+		.prepare(
+			'SELECT count(*) AS count FROM login_attempts WHERE address_key = ? AND attempted_at_utc >= ?'
+		)
+		.get(rateKey(address), since) as { count: number };
+	return emailCount.count >= EMAIL_ATTEMPT_LIMIT || addressCount.count >= ADDRESS_ATTEMPT_LIMIT;
+}
+
+export function reserveLoginAttempt(email: string, address: string): boolean {
+	const database = getDatabase();
+	const reserve = database.transaction(() => {
+		if (loginIsRateLimited(email, address)) return false;
+		database
+			.prepare(
+				'INSERT INTO login_attempts (id, email_key, address_key, attempted_at_utc) VALUES (?, ?, ?, ?)'
+			)
+			.run(randomUUID(), rateKey(normalizeEmail(email)), rateKey(address), nowUtc());
+		return true;
+	});
+	return reserve();
+}
+
+export async function authenticate(email: string, password: string): Promise<AuthUser | null> {
+	const database = getDatabase();
+	const normalized = normalizeEmail(email);
+	const row = database
+		.prepare(
+			`SELECT id, email, display_name, password_hash, role, locked_at_utc
+			 FROM users WHERE email_normalized = ?`
+		)
+		.get(normalized) as UserRow | undefined;
+	const matches = row
+		? await verifyPassword(row.password_hash, password)
+		: await verifyPassword(await dummyPasswordHash, password);
+	if (!row || !matches || row.locked_at_utc) {
+		return null;
+	}
+	database.prepare('DELETE FROM login_attempts WHERE email_key = ?').run(rateKey(normalized));
+	return toUser(row);
+}
+
+export function requireUser(user: AuthUser | null): AuthUser {
+	if (!user) error(401, 'Anmeldung erforderlich');
+	return user;
+}
+
+export function requireBarkeeper(user: AuthUser | null): AuthUser {
+	const authenticated = requireUser(user);
+	if (authenticated.role !== 'barkeeper') error(403, 'Diese Aktion erfordert Barkeeper-Rechte.');
+	return authenticated;
+}
+
+function requireCurrentBarkeeper(actor: AuthUser): AuthUser {
+	const row = getDatabase()
+		.prepare(
+			`SELECT id, email, display_name, password_hash, role, locked_at_utc
+			 FROM users WHERE id = ? AND role = 'barkeeper' AND locked_at_utc IS NULL`
+		)
+		.get(actor.id) as UserRow | undefined;
+	if (!row) error(403, 'Diese Aktion erfordert aktive Barkeeper-Rechte.');
+	return toUser(row);
+}
+
+export function listUsers(): AuthUser[] {
+	const rows = getDatabase()
+		.prepare(
+			`SELECT id, email, display_name, password_hash, role, locked_at_utc
+			 FROM users ORDER BY display_name COLLATE NOCASE`
+		)
+		.all() as UserRow[];
+	return rows.map(toUser);
+}
+
+export function listOpenInvitations() {
+	return getDatabase()
+		.prepare(
+			`SELECT id, email, role, expires_at_utc
+			 FROM invitations
+			 WHERE accepted_at_utc IS NULL AND revoked_at_utc IS NULL AND expires_at_utc > ?
+			 ORDER BY created_at_utc DESC`
+		)
+		.all(nowUtc()) as Array<{ id: string; email: string; role: Role; expires_at_utc: string }>;
+}
+
+export async function inviteUser(
+	actor: AuthUser,
+	emailValue: string,
+	role: Role
+): Promise<'local' | 'smtp'> {
+	actor = requireCurrentBarkeeper(actor);
+	const email = emailValue.trim();
+	const normalized = normalizeEmail(email);
+	if (!validEmail(email) || !isRole(role)) throw new Error('VALIDATION');
+	const database = getDatabase();
+	if (database.prepare('SELECT 1 FROM users WHERE email_normalized = ?').get(normalized)) {
+		throw new Error('USER_EXISTS');
+	}
+	const token = createToken();
+	const id = randomUUID();
+	const timestamp = nowUtc();
+	const expiresAt = futureUtc(LINK_DURATION_MS);
+	const store = database.transaction(() => {
+		database
+			.prepare(
+				`UPDATE invitations SET revoked_at_utc = ?
+				 WHERE email_normalized = ? AND accepted_at_utc IS NULL AND revoked_at_utc IS NULL`
+			)
+			.run(timestamp, normalized);
+		database
+			.prepare(
+				`INSERT INTO invitations (
+					id, email, email_normalized, role, token_hash, created_by_user_id,
+					created_at_utc, expires_at_utc
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+			)
+			.run(id, email, normalized, role, hashToken(token), actor.id, timestamp, expiresAt);
+	});
+	store();
+	const link = new URL(
+		`/einladung?token=${encodeURIComponent(token)}`,
+		getAuthConfig().origin
+	).toString();
+	try {
+		return await sendMail({
+			to: email,
+			subject: 'Einladung zu Sendewerk',
+			text: `Du wurdest zu Sendewerk eingeladen. Der Link ist 24 Stunden gültig und einmalig nutzbar:\n\n${link}`
+		});
+	} catch (mailError) {
+		database.prepare('UPDATE invitations SET revoked_at_utc = ? WHERE id = ?').run(nowUtc(), id);
+		throw mailError;
+	}
+}
+
+export function getInvitation(token: string): InvitationRow | null {
+	if (!token || token.length > 100) return null;
+	return (
+		(getDatabase()
+			.prepare(
+				`SELECT id, email, role, expires_at_utc, accepted_at_utc, revoked_at_utc
+				 FROM invitations WHERE token_hash = ?`
+			)
+			.get(hashToken(token)) as InvitationRow | undefined) ?? null
+	);
+}
+
+export async function acceptInvitation(input: {
+	token: string;
+	displayName: string;
+	password: string;
+}): Promise<AuthUser> {
+	const invitation = getInvitation(input.token);
+	const displayName = input.displayName.trim();
+	if (
+		!invitation ||
+		invitation.accepted_at_utc ||
+		invitation.revoked_at_utc ||
+		invitation.expires_at_utc <= nowUtc()
+	) {
+		throw new Error('TOKEN_INVALID');
+	}
+	if (!validDisplayName(displayName) || !validPassword(input.password))
+		throw new Error('VALIDATION');
+	const passwordHash = await hashPassword(input.password);
+	const database = getDatabase();
+	const accept = database.transaction(() => {
+		const current = database
+			.prepare(
+				`SELECT id, email, role, expires_at_utc, accepted_at_utc, revoked_at_utc
+				 FROM invitations WHERE id = ?`
+			)
+			.get(invitation.id) as InvitationRow;
+		if (current.accepted_at_utc || current.revoked_at_utc || current.expires_at_utc <= nowUtc()) {
+			throw new Error('TOKEN_INVALID');
+		}
+		const id = randomUUID();
+		const timestamp = nowUtc();
+		database
+			.prepare(
+				`INSERT INTO users (
+					id, email, email_normalized, display_name, password_hash, role,
+					password_changed_at_utc, created_at_utc, updated_at_utc
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			)
+			.run(
+				id,
+				current.email,
+				normalizeEmail(current.email),
+				displayName,
+				passwordHash,
+				current.role,
+				timestamp,
+				timestamp,
+				timestamp
+			);
+		database
+			.prepare('UPDATE invitations SET accepted_at_utc = ? WHERE id = ?')
+			.run(timestamp, current.id);
+		return {
+			id,
+			email: current.email,
+			displayName,
+			role: current.role,
+			lockedAtUtc: null
+		} satisfies AuthUser;
+	});
+	return accept();
+}
+
+export function reservePasswordResetRequest(email: string, address: string): boolean {
+	const database = getDatabase();
+	const since = new Date(Date.now() - RESET_WINDOW_MS).toISOString();
+	const emailKey = rateKey(`reset-email:${normalizeEmail(email)}`);
+	const addressKey = rateKey(`reset-address:${address}`);
+	const reserve = database.transaction(() => {
+		database.prepare('DELETE FROM login_attempts WHERE attempted_at_utc < ?').run(since);
+		const emailCount = database
+			.prepare(
+				'SELECT count(*) AS count FROM login_attempts WHERE email_key = ? AND attempted_at_utc >= ?'
+			)
+			.get(emailKey, since) as { count: number };
+		const addressCount = database
+			.prepare(
+				'SELECT count(*) AS count FROM login_attempts WHERE address_key = ? AND attempted_at_utc >= ?'
+			)
+			.get(addressKey, since) as { count: number };
+		if (emailCount.count >= RESET_EMAIL_LIMIT || addressCount.count >= RESET_ADDRESS_LIMIT)
+			return false;
+		database
+			.prepare(
+				'INSERT INTO login_attempts (id, email_key, address_key, attempted_at_utc) VALUES (?, ?, ?, ?)'
+			)
+			.run(randomUUID(), emailKey, addressKey, nowUtc());
+		return true;
+	});
+	return reserve();
+}
+
+export async function requestPasswordReset(emailValue: string): Promise<void> {
+	const normalized = normalizeEmail(emailValue);
+	const database = getDatabase();
+	const row = database
+		.prepare('SELECT id, email FROM users WHERE email_normalized = ?')
+		.get(normalized) as { id: string; email: string } | undefined;
+	if (!row) return;
+	const token = createToken();
+	const id = randomUUID();
+	const timestamp = nowUtc();
+	database
+		.prepare(
+			`INSERT INTO password_reset_tokens
+			 (id, user_id, token_hash, created_at_utc, expires_at_utc)
+			 VALUES (?, ?, ?, ?, ?)`
+		)
+		.run(id, row.id, hashToken(token), timestamp, futureUtc(LINK_DURATION_MS));
+	const link = new URL(
+		`/passwort-zuruecksetzen?token=${encodeURIComponent(token)}`,
+		getAuthConfig().origin
+	).toString();
+	try {
+		await sendMail({
+			to: row.email,
+			subject: 'Sendewerk-Passwort zurücksetzen',
+			text: `Mit diesem 24 Stunden gültigen, einmaligen Link kannst du dein Passwort zurücksetzen:\n\n${link}`
+		});
+	} catch (mailError) {
+		database.prepare('DELETE FROM password_reset_tokens WHERE id = ?').run(id);
+		throw mailError;
+	}
+}
+
+export function passwordResetIsValid(token: string): boolean {
+	if (!token || token.length > 100) return false;
+	return Boolean(
+		getDatabase()
+			.prepare(
+				`SELECT 1 FROM password_reset_tokens
+				 WHERE token_hash = ? AND consumed_at_utc IS NULL AND expires_at_utc > ?`
+			)
+			.get(hashToken(token), nowUtc())
+	);
+}
+
+export async function resetPassword(token: string, password: string): Promise<void> {
+	if (!passwordResetIsValid(token)) throw new Error('TOKEN_INVALID');
+	if (!validPassword(password)) throw new Error('VALIDATION');
+	const passwordHash = await hashPassword(password);
+	const database = getDatabase();
+	const reset = database.transaction(() => {
+		const row = database
+			.prepare(
+				`SELECT id, user_id FROM password_reset_tokens
+				 WHERE token_hash = ? AND consumed_at_utc IS NULL AND expires_at_utc > ?`
+			)
+			.get(hashToken(token), nowUtc()) as { id: string; user_id: string } | undefined;
+		if (!row) throw new Error('TOKEN_INVALID');
+		const timestamp = nowUtc();
+		database
+			.prepare(
+				`UPDATE users SET password_hash = ?, password_changed_at_utc = ?, updated_at_utc = ?
+				 WHERE id = ?`
+			)
+			.run(passwordHash, timestamp, timestamp, row.user_id);
+		database
+			.prepare(
+				'UPDATE password_reset_tokens SET consumed_at_utc = ? WHERE user_id = ? AND consumed_at_utc IS NULL'
+			)
+			.run(timestamp, row.user_id);
+		database.prepare('DELETE FROM sessions WHERE user_id = ?').run(row.user_id);
+	});
+	reset();
+}
+
+function activeBarkeeperCount(): number {
+	const row = getDatabase()
+		.prepare(
+			"SELECT count(*) AS count FROM users WHERE role = 'barkeeper' AND locked_at_utc IS NULL"
+		)
+		.get() as { count: number };
+	return row.count;
+}
+
+export function setUserLocked(actor: AuthUser, userId: string, locked: boolean): void {
+	actor = requireCurrentBarkeeper(actor);
+	const database = getDatabase();
+	const row = database.prepare('SELECT role, locked_at_utc FROM users WHERE id = ?').get(userId) as
+		{ role: Role; locked_at_utc: string | null } | undefined;
+	if (!row) throw new Error('NOT_FOUND');
+	if (locked && actor.id === userId) throw new Error('SELF_LOCK');
+	if (locked && row.role === 'barkeeper' && !row.locked_at_utc && activeBarkeeperCount() <= 1) {
+		throw new Error('LAST_BARKEEPER');
+	}
+	const update = database.transaction(() => {
+		database
+			.prepare('UPDATE users SET locked_at_utc = ?, updated_at_utc = ? WHERE id = ?')
+			.run(locked ? nowUtc() : null, nowUtc(), userId);
+		if (locked) database.prepare('DELETE FROM sessions WHERE user_id = ?').run(userId);
+	});
+	update();
+}
+
+export function setUserRole(actor: AuthUser, userId: string, role: Role): void {
+	requireCurrentBarkeeper(actor);
+	if (!isRole(role)) throw new Error('VALIDATION');
+	const database = getDatabase();
+	const row = database.prepare('SELECT role, locked_at_utc FROM users WHERE id = ?').get(userId) as
+		{ role: Role; locked_at_utc: string | null } | undefined;
+	if (!row) throw new Error('NOT_FOUND');
+	if (
+		row.role === 'barkeeper' &&
+		role === 'thekencrew' &&
+		!row.locked_at_utc &&
+		activeBarkeeperCount() <= 1
+	) {
+		throw new Error('LAST_BARKEEPER');
+	}
+	database
+		.prepare('UPDATE users SET role = ?, updated_at_utc = ? WHERE id = ?')
+		.run(role, nowUtc(), userId);
+}
+
+export function revokeInvitation(actor: AuthUser, invitationId: string): void {
+	requireCurrentBarkeeper(actor);
+	getDatabase()
+		.prepare(
+			`UPDATE invitations SET revoked_at_utc = ?
+			 WHERE id = ? AND accepted_at_utc IS NULL AND revoked_at_utc IS NULL`
+		)
+		.run(nowUtc(), invitationId);
+}
@@ -7,6 +7,38 @@ function configuredPath(value: string | undefined, fallback: string): string {
 export function getServerPaths() {
 	return {
 		database: configuredPath(process.env.SENDEWERK_DB_PATH, '.data/sendewerk.sqlite'),
-		uploads: configuredPath(process.env.SENDEWERK_UPLOAD_DIR, '.data/uploads')
+		uploads: configuredPath(process.env.SENDEWERK_UPLOAD_DIR, '.data/uploads'),
+		mailOutbox: configuredPath(process.env.SENDEWERK_MAIL_OUTBOX_DIR, '.data/mail-outbox')
+	};
+}
+
+export function getAuthConfig() {
+	const configuredOrigin = process.env.SENDEWERK_APP_ORIGIN || process.env.CLOUDRON_APP_ORIGIN;
+	if (process.env.NODE_ENV === 'production' && !configuredOrigin) {
+		throw new Error('SENDEWERK_APP_ORIGIN muss im Produktionsbetrieb gesetzt sein.');
+	}
+	const origin = new URL(configuredOrigin || 'http://localhost:5173');
+	return {
+		origin,
+		setupToken: process.env.SENDEWERK_SETUP_TOKEN || '',
+		secureCookies: origin.protocol === 'https:'
+	};
+}
+
+export function getMailConfig() {
+	const transport = process.env.SENDEWERK_MAIL_TRANSPORT || 'local';
+	if (transport !== 'local' && transport !== 'smtp') {
+		throw new Error('SENDEWERK_MAIL_TRANSPORT muss local oder smtp sein.');
+	}
+	return {
+		transport,
+		from:
+			process.env.SENDEWERK_MAIL_FROM ||
+			(transport === 'local' ? 'Sendewerk <sendewerk@localhost>' : ''),
+		host: process.env.SENDEWERK_SMTP_HOST || '',
+		port: Number(process.env.SENDEWERK_SMTP_PORT || '587'),
+		secure: process.env.SENDEWERK_SMTP_SECURE === 'true',
+		user: process.env.SENDEWERK_SMTP_USER || '',
+		password: process.env.SENDEWERK_SMTP_PASSWORD || ''
 	};
 }
@@ -52,7 +52,7 @@ describe('database setup', () => {
 			.get() as { migrations: number; pieces: number; shows: number; usages: number };
 		database.close();

-		expect(counts).toEqual({ migrations: 1, pieces: 4, shows: 1, usages: 3 });
+		expect(counts).toEqual({ migrations: 2, pieces: 4, shows: 1, usages: 3 });
 		expect(databasePath).not.toBe(path.resolve('.data/sendewerk.sqlite'));
 	});

@@ -0,0 +1,49 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import nodemailer from 'nodemailer';
+import { getMailConfig, getServerPaths } from './config.js';
+
+export type MailMessage = {
+	to: string;
+	subject: string;
+	text: string;
+};
+
+export async function sendMail(message: MailMessage): Promise<'local' | 'smtp'> {
+	const config = getMailConfig();
+	if (config.transport === 'local') {
+		const outbox = getServerPaths().mailOutbox;
+		await mkdir(outbox, { recursive: true, mode: 0o700 });
+		const filename = `${new Date().toISOString().replaceAll(':', '-')}-${randomUUID()}.json`;
+		await writeFile(
+			path.join(outbox, filename),
+			JSON.stringify({ from: config.from, ...message }, null, 2),
+			{ encoding: 'utf8', mode: 0o600 }
+		);
+		return 'local';
+	}
+
+	if (
+		!config.host ||
+		!config.from ||
+		!Number.isInteger(config.port) ||
+		config.port < 1 ||
+		config.port > 65_535 ||
+		Boolean(config.user) !== Boolean(config.password)
+	) {
+		throw new Error('Die SMTP-Konfiguration ist unvollständig.');
+	}
+	const transporter = nodemailer.createTransport({
+		host: config.host,
+		port: config.port,
+		secure: config.secure,
+		requireTLS: !config.secure,
+		connectionTimeout: 10_000,
+		greetingTimeout: 10_000,
+		socketTimeout: 20_000,
+		auth: config.user ? { user: config.user, pass: config.password } : undefined
+	});
+	await transporter.sendMail({ from: config.from, ...message });
+	return 'smtp';
+}
@@ -0,0 +1,3 @@
+import type { LayoutServerLoad } from './$types';
+
+export const load: LayoutServerLoad = ({ locals }) => ({ user: locals.user });
@@ -5,7 +5,7 @@
 	import NavIcon from '#lib/components/NavIcon.svelte';
 	import ThemeToggle from '#lib/components/ThemeToggle.svelte';

-	let { children } = $props();
+	let { children, data } = $props();
 	const primaryNavigation = [
 		{ href: '/eingang', label: 'Eingang', icon: 'inbox' },
 		{ href: '/fundus', label: 'Fundus', icon: 'library' },
@@ -13,7 +13,9 @@
 		{ href: '/archiv', label: 'Archiv', icon: 'archive' }
 	] as const;
 	const administration = { href: '/verwaltung', label: 'Verwaltung', icon: 'settings' } as const;
-	const mobileNavigation = [...primaryNavigation, administration];
+	const mobileNavigation = $derived(
+		data.user?.role === 'barkeeper' ? [...primaryNavigation, administration] : primaryNavigation
+	);

 	function isActive(href: string) {
 		return (
@@ -29,7 +31,8 @@
 	/>
 </svelte:head>

-<div class="app-shell">
+{#if data.user}
+	<div class="app-shell">
 		<aside class="sidebar">
 			<a class="brand" href={resolve('/fundus')} aria-label="Sendewerk Startseite">
 				<span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>
@@ -50,6 +53,7 @@
 			</nav>

 			<div class="sidebar-footer">
+				{#if data.user.role === 'barkeeper'}
 					<nav class="utility-navigation" aria-label="Verwaltung">
 						<a
 							href={resolve(administration.href)}
@@ -60,6 +64,14 @@
 							<span>{administration.label}</span>
 						</a>
 					</nav>
+				{/if}
+				<div class="account-summary">
+					<span>{data.user.displayName}</span>
+					<small>{data.user.role === 'barkeeper' ? 'Barkeeper' : 'Thekencrew'}</small>
+				</div>
+				<form method="POST" action="/logout">
+					<button class="logout-button" type="submit">Abmelden</button>
+				</form>
 				<ThemeToggle />
 			</div>
 		</aside>
@@ -69,6 +81,9 @@
 				<span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>
 				<span>Sendewerk</span>
 			</a>
+			<form method="POST" action="/logout">
+				<button class="mobile-logout" type="submit" aria-label="Abmelden">↗</button>
+			</form>
 			<ThemeToggle />
 		</header>

@@ -86,4 +101,16 @@
 				</a>
 			{/each}
 		</nav>
-</div>
+	</div>
+{:else}
+	<div class="auth-shell">
+		<header class="auth-header">
+			<a class="brand" href={resolve('/login')} aria-label="Sendewerk Anmeldung">
+				<span class="brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>
+				<span>Sendewerk</span>
+			</a>
+			<ThemeToggle />
+		</header>
+		<main class="auth-main">{@render children()}</main>
+	</div>
+{/if}
@@ -1,5 +1,7 @@
 import { redirect } from '@sveltejs/kit';
+import { hasUsers } from '#lib/server/auth.js';

-export function load() {
-	redirect(307, '/fundus');
+export function load({ locals }) {
+	if (!hasUsers()) redirect(307, '/setup');
+	redirect(307, locals.user ? '/fundus' : '/login');
 }
@@ -0,0 +1,57 @@
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	acceptInvitation,
+	createSession,
+	deleteLinkToken,
+	getInvitation,
+	INVITATION_COOKIE,
+	readLinkToken,
+	storeLinkToken,
+	validDisplayName,
+	validPassword
+} from '#lib/server/auth.js';
+
+export const load: PageServerLoad = ({ url, cookies }) => {
+	const queryToken = url.searchParams.get('token');
+	if (queryToken) {
+		if (queryToken.length <= 100) storeLinkToken(cookies, INVITATION_COOKIE, queryToken);
+		else deleteLinkToken(cookies, INVITATION_COOKIE);
+		redirect(303, '/einladung');
+	}
+	const token = readLinkToken(cookies, INVITATION_COOKIE);
+	const invitation = getInvitation(token);
+	const valid = Boolean(
+		invitation &&
+		!invitation.accepted_at_utc &&
+		!invitation.revoked_at_utc &&
+		invitation.expires_at_utc > new Date().toISOString()
+	);
+	return { valid, email: valid ? invitation?.email : null };
+};
+
+export const actions = {
+	default: async ({ request, cookies }) => {
+		const data = await request.formData();
+		const token = readLinkToken(cookies, INVITATION_COOKIE);
+		const displayName = String(data.get('displayName') || '').trim();
+		const password = String(data.get('password') || '');
+		if (!validDisplayName(displayName) || !validPassword(password)) {
+			return fail(400, {
+				displayName,
+				error: 'Bitte Namen und ein Passwort mit mindestens 12 Zeichen prüfen.'
+			});
+		}
+		try {
+			const user = await acceptInvitation({ token, displayName, password });
+			deleteLinkToken(cookies, INVITATION_COOKIE);
+			createSession(user.id, cookies);
+		} catch {
+			return fail(400, {
+				displayName,
+				error: 'Die Einladung ist ungültig, abgelaufen oder bereits verwendet.'
+			});
+		}
+		redirect(303, '/fundus');
+	}
+} satisfies Actions;
@@ -0,0 +1,41 @@
+<script lang="ts">
+	import type { PageProps } from './$types';
+	let { data, form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Einladung annehmen | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Einladung</p>
+	<h1>Sendewerk-Konto aktivieren</h1>
+	{#if !data.valid && !form?.error}
+		<div class="form-message error" role="alert">
+			Die Einladung ist ungültig, abgelaufen oder bereits verwendet.
+		</div>
+	{:else}
+		<p>Die Einladung gilt für <strong>{data.email}</strong>.</p>
+		{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+		<form class="auth-form" method="POST">
+			<label
+				>Name<input
+					name="displayName"
+					required
+					maxlength="80"
+					value={form?.displayName ?? ''}
+					autocomplete="name"
+				/></label
+			>
+			<label
+				>Passwort<input
+					name="password"
+					type="password"
+					required
+					minlength="12"
+					maxlength="256"
+					autocomplete="new-password"
+				/></label
+			>
+			<button class="primary-button" type="submit">Konto aktivieren</button>
+		</form>
+	{/if}
+</section>
@@ -0,0 +1,36 @@
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	authenticate,
+	createSession,
+	hasUsers,
+	reserveLoginAttempt,
+	validEmail
+} from '#lib/server/auth.js';
+
+export const load: PageServerLoad = ({ locals }) => {
+	if (!hasUsers()) redirect(303, '/setup');
+	if (locals.user) redirect(303, '/fundus');
+};
+
+export const actions = {
+	default: async ({ request, cookies, getClientAddress }) => {
+		const data = await request.formData();
+		const email = String(data.get('email') || '').trim();
+		const password = String(data.get('password') || '');
+		const address = getClientAddress();
+		if (!validEmail(email) || !password || Buffer.byteLength(password, 'utf8') > 256) {
+			return fail(400, { email, error: 'E-Mail oder Passwort ist nicht korrekt.' });
+		}
+		if (!reserveLoginAttempt(email, address)) {
+			return fail(429, {
+				email,
+				error: 'Zu viele Anmeldeversuche. Bitte in 15 Minuten erneut versuchen.'
+			});
+		}
+		const user = await authenticate(email, password);
+		if (!user) return fail(400, { email, error: 'E-Mail oder Passwort ist nicht korrekt.' });
+		createSession(user.id, cookies);
+		redirect(303, '/fundus');
+	}
+} satisfies Actions;
@@ -0,0 +1,37 @@
+<script lang="ts">
+	import { resolve } from '$app/paths';
+	import type { PageProps } from './$types';
+	let { form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Anmelden | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Redaktionszugang</p>
+	<h1>Bei Sendewerk anmelden</h1>
+	<p>Für Barkeeper und Thekencrew. Eine öffentliche Registrierung gibt es nicht.</p>
+	{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+	<form class="auth-form" method="POST">
+		<label
+			>E-Mail<input
+				name="email"
+				type="email"
+				required
+				maxlength="254"
+				value={form?.email ?? ''}
+				autocomplete="email"
+			/></label
+		>
+		<label
+			>Passwort<input
+				name="password"
+				type="password"
+				required
+				maxlength="256"
+				autocomplete="current-password"
+			/></label
+		>
+		<button class="primary-button" type="submit">Anmelden</button>
+	</form>
+	<a class="auth-link" href={resolve('/passwort-vergessen')}>Passwort vergessen?</a>
+</section>
@@ -0,0 +1,8 @@
+import { redirect } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { deleteSession } from '#lib/server/auth.js';
+
+export const POST: RequestHandler = ({ cookies }) => {
+	deleteSession(cookies);
+	redirect(303, '/login');
+};
@@ -0,0 +1,22 @@
+import { fail } from '@sveltejs/kit';
+import type { Actions } from './$types';
+import { requestPasswordReset, reservePasswordResetRequest, validEmail } from '#lib/server/auth.js';
+
+export const actions = {
+	default: async ({ request, getClientAddress }) => {
+		const data = await request.formData();
+		const email = String(data.get('email') || '').trim();
+		if (!validEmail(email))
+			return fail(400, { email, error: 'Bitte eine gültige E-Mail eingeben.' });
+		if (!reservePasswordResetRequest(email, getClientAddress())) {
+			return { sent: true };
+		}
+		try {
+			await requestPasswordReset(email);
+		} catch {
+			// Die sichtbare Antwort bleibt identisch, damit der Mailzustand kein Konto verrät.
+			console.error('Eine Passwortreset-Nachricht konnte nicht bereitgestellt werden.');
+		}
+		return { sent: true };
+	}
+} satisfies Actions;
@@ -0,0 +1,31 @@
+<script lang="ts">
+	import { resolve } from '$app/paths';
+	import type { PageProps } from './$types';
+	let { form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Passwort vergessen | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Kontozugang</p>
+	<h1>Passwort zurücksetzen</h1>
+	<p>Wenn das Konto existiert, wird ein 24 Stunden gültiger, einmaliger Link bereitgestellt.</p>
+	{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+	{#if form?.sent}<div class="form-message success" role="status">
+			Anfrage verarbeitet. Bitte Postfach beziehungsweise lokale Outbox prüfen.
+		</div>{/if}
+	<form class="auth-form" method="POST">
+		<label
+			>E-Mail<input
+				name="email"
+				type="email"
+				required
+				maxlength="254"
+				value={form?.email ?? ''}
+				autocomplete="email"
+			/></label
+		>
+		<button class="primary-button" type="submit">Reset-Link anfordern</button>
+	</form>
+	<a class="auth-link" href={resolve('/login')}>Zurück zur Anmeldung</a>
+</section>
@@ -0,0 +1,39 @@
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	deleteLinkToken,
+	passwordResetIsValid,
+	readLinkToken,
+	RESET_COOKIE,
+	resetPassword,
+	storeLinkToken,
+	validPassword
+} from '#lib/server/auth.js';
+
+export const load: PageServerLoad = ({ url, cookies }) => {
+	const queryToken = url.searchParams.get('token');
+	if (queryToken) {
+		if (queryToken.length <= 100) storeLinkToken(cookies, RESET_COOKIE, queryToken);
+		else deleteLinkToken(cookies, RESET_COOKIE);
+		redirect(303, '/passwort-zuruecksetzen');
+	}
+	return { valid: passwordResetIsValid(readLinkToken(cookies, RESET_COOKIE)) };
+};
+
+export const actions = {
+	default: async ({ request, cookies }) => {
+		const data = await request.formData();
+		const token = readLinkToken(cookies, RESET_COOKIE);
+		const password = String(data.get('password') || '');
+		if (!validPassword(password)) {
+			return fail(400, { error: 'Das neue Passwort muss mindestens 12 Zeichen lang sein.' });
+		}
+		try {
+			await resetPassword(token, password);
+			deleteLinkToken(cookies, RESET_COOKIE);
+		} catch {
+			return fail(400, { error: 'Der Link ist ungültig, abgelaufen oder bereits verwendet.' });
+		}
+		redirect(303, '/login?reset=erfolgreich');
+	}
+} satisfies Actions;
@@ -0,0 +1,33 @@
+<script lang="ts">
+	import { resolve } from '$app/paths';
+	import type { PageProps } from './$types';
+	let { data, form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Neues Passwort | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Kontozugang</p>
+	<h1>Neues Passwort setzen</h1>
+	{#if !data.valid && !form?.error}
+		<div class="form-message error" role="alert">
+			Der Link ist ungültig, abgelaufen oder bereits verwendet.
+		</div>
+		<a class="auth-link" href={resolve('/passwort-vergessen')}>Neuen Link anfordern</a>
+	{:else}
+		{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+		<form class="auth-form" method="POST">
+			<label
+				>Neues Passwort<input
+					name="password"
+					type="password"
+					required
+					minlength="12"
+					maxlength="256"
+					autocomplete="new-password"
+				/></label
+			>
+			<button class="primary-button" type="submit">Passwort speichern</button>
+		</form>
+	{/if}
+</section>
@@ -0,0 +1,47 @@
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	createFirstAdmin,
+	createSession,
+	hasUsers,
+	setupIsConfigured,
+	validDisplayName,
+	validEmail,
+	validPassword
+} from '#lib/server/auth.js';
+
+export const load: PageServerLoad = () => {
+	if (hasUsers()) redirect(303, '/login');
+	return { configured: setupIsConfigured() };
+};
+
+export const actions = {
+	default: async ({ request, cookies }) => {
+		if (hasUsers()) redirect(303, '/login');
+		const data = await request.formData();
+		const setupToken = String(data.get('setupToken') || '');
+		const displayName = String(data.get('displayName') || '').trim();
+		const email = String(data.get('email') || '').trim();
+		const password = String(data.get('password') || '');
+		if (!validDisplayName(displayName) || !validEmail(email) || !validPassword(password)) {
+			return fail(400, {
+				error: 'Bitte Name, gültige E-Mail und ein Passwort mit mindestens 12 Zeichen prüfen.',
+				displayName,
+				email
+			});
+		}
+		try {
+			const user = await createFirstAdmin({ setupToken, displayName, email, password });
+			createSession(user.id, cookies);
+		} catch (cause) {
+			const code = cause instanceof Error ? cause.message : '';
+			if (code === 'SETUP_CLOSED') redirect(303, '/login');
+			return fail(403, {
+				error: 'Das Betreiber-Setup-Token ist ungültig.',
+				displayName,
+				email
+			});
+		}
+		redirect(303, '/fundus');
+	}
+} satisfies Actions;
@@ -0,0 +1,65 @@
+<script lang="ts">
+	import type { PageProps } from './$types';
+	let { data, form }: PageProps = $props();
+</script>
+
+<svelte:head><title>Erstadmin einrichten | Sendewerk</title></svelte:head>
+
+<section class="auth-card">
+	<p class="eyebrow">Einmalige Einrichtung</p>
+	<h1>Ersten Barkeeper anlegen</h1>
+	<p>
+		Dieses Konto verwaltet Einladungen, Rollen und Sperren. Danach wird die Einrichtung geschlossen.
+	</p>
+	{#if !data.configured}
+		<div class="form-message error" role="alert">
+			Vor dem Start muss ein mindestens 32 Zeichen langes <code>SENDEWERK_SETUP_TOKEN</code>
+			konfiguriert werden.
+		</div>
+	{:else}
+		{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+		<form class="auth-form" method="POST">
+			<label
+				>Betreiber-Setup-Token<input
+					name="setupToken"
+					type="password"
+					required
+					autocomplete="off"
+				/></label
+			>
+			<label
+				>Name<input
+					name="displayName"
+					required
+					maxlength="80"
+					value={form?.displayName ?? ''}
+					autocomplete="name"
+				/></label
+			>
+			<label
+				>E-Mail<input
+					name="email"
+					type="email"
+					required
+					maxlength="254"
+					value={form?.email ?? ''}
+					autocomplete="email"
+				/></label
+			>
+			<label
+				>Passwort<input
+					name="password"
+					type="password"
+					required
+					minlength="12"
+					maxlength="256"
+					autocomplete="new-password"
+				/></label
+			>
+			<p class="field-hint">
+				Mindestens 12 Zeichen. Das Passwort wird ausschließlich als Argon2id-Hash gespeichert.
+			</p>
+			<button class="primary-button" type="submit">Barkeeper anlegen</button>
+		</form>
+	{/if}
+</section>
@@ -1,5 +1,97 @@
+import { fail } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
 import { getTaxonomy } from '#lib/server/previews.js';
+import { getMailConfig } from '#lib/server/config.js';
+import {
+	inviteUser,
+	isRole,
+	listOpenInvitations,
+	listUsers,
+	requireBarkeeper,
+	revokeInvitation,
+	setUserLocked,
+	setUserRole,
+	validEmail
+} from '#lib/server/auth.js';

-export function load() {
-	return { taxonomy: getTaxonomy() };
+export const load: PageServerLoad = ({ locals }) => {
+	requireBarkeeper(locals.user);
+	return {
+		taxonomy: getTaxonomy(),
+		users: listUsers(),
+		invitations: listOpenInvitations(),
+		mailTransport: getMailConfig().transport
+	};
+};
+
+function actionError(cause: unknown): string {
+	const code = cause instanceof Error ? cause.message : '';
+	if (code === 'USER_EXISTS') return 'Für diese E-Mail existiert bereits ein Konto.';
+	if (code === 'SELF_LOCK') return 'Das eigene Konto kann nicht gesperrt werden.';
+	if (code === 'LAST_BARKEEPER') return 'Mindestens ein aktiver Barkeeper muss erhalten bleiben.';
+	if (code === 'NOT_FOUND') return 'Das Konto wurde nicht gefunden.';
+	return 'Die Aktion konnte nicht ausgeführt werden.';
 }
+
+export const actions = {
+	invite: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		const email = String(data.get('email') || '').trim();
+		const role = String(data.get('role') || '');
+		if (!validEmail(email) || !isRole(role)) {
+			return fail(400, { intent: 'invite', email, error: 'E-Mail und Rolle bitte prüfen.' });
+		}
+		try {
+			const transport = await inviteUser(actor, email, role);
+			return {
+				intent: 'invite',
+				success:
+					transport === 'local'
+						? 'Einladung wurde in der lokalen Mail-Outbox abgelegt.'
+						: 'Einladung wurde versandt.'
+			};
+		} catch (cause) {
+			return fail(400, { intent: 'invite', email, error: actionError(cause) });
+		}
+	},
+	role: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		const userId = String(data.get('userId') || '');
+		const role = String(data.get('role') || '');
+		if (!userId || !isRole(role)) return fail(400, { intent: 'role', error: 'Ungültige Rolle.' });
+		try {
+			setUserRole(actor, userId, role);
+			return { intent: 'role', success: 'Rolle aktualisiert.' };
+		} catch (cause) {
+			return fail(400, { intent: 'role', error: actionError(cause) });
+		}
+	},
+	lock: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			setUserLocked(actor, String(data.get('userId') || ''), true);
+			return { intent: 'lock', success: 'Konto gesperrt und bestehende Sitzungen beendet.' };
+		} catch (cause) {
+			return fail(400, { intent: 'lock', error: actionError(cause) });
+		}
+	},
+	unlock: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			setUserLocked(actor, String(data.get('userId') || ''), false);
+			return { intent: 'unlock', success: 'Konto entsperrt.' };
+		} catch (cause) {
+			return fail(400, { intent: 'unlock', error: actionError(cause) });
+		}
+	},
+	revokeInvitation: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		revokeInvitation(actor, String(data.get('invitationId') || ''));
+		return { intent: 'revokeInvitation', success: 'Einladung widerrufen.' };
+	}
+} satisfies Actions;
@@ -1,6 +1,6 @@
 <script lang="ts">
-	import type { PageData } from './$types';
-	let { data }: { data: PageData } = $props();
+	import type { PageProps } from './$types';
+	let { data, form }: PageProps = $props();
 </script>

 <svelte:head><title>Verwaltung | Sendewerk</title></svelte:head>
@@ -8,8 +8,108 @@
 <div class="page-wrap narrow-page">
 	<header class="page-heading">
 		<h1>Verwaltung</h1>
-		<p class="page-intro">Abschnittskategorien, Formate und Themen im Überblick.</p>
+		<p class="page-intro">Konten, Rollen und bestehende Taxonomie verwalten.</p>
 	</header>
+	{#if form?.error}<div class="form-message error" role="alert">{form.error}</div>{/if}
+	{#if form?.success}<div class="form-message success" role="status">{form.success}</div>{/if}
+
+	<section class="quiet-panel account-panel">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">Konten & Rollen</p>
+				<h2>Redaktionszugänge</h2>
+			</div>
+			<span class="mail-mode"
+				>Mail: {data.mailTransport === 'local' ? 'lokale Outbox' : 'SMTP'}</span
+			>
+		</div>
+		<div class="account-list">
+			{#each data.users as user (user.id)}
+				<article class="account-row">
+					<div><strong>{user.displayName}</strong><small>{user.email}</small></div>
+					<span class:locked={user.lockedAtUtc} class="account-status"
+						>{user.lockedAtUtc ? 'Gesperrt' : 'Aktiv'}</span
+					>
+					<form method="POST" action="?/role" class="inline-account-form">
+						<input type="hidden" name="userId" value={user.id} />
+						<label class="sr-only" for={`role-${user.id}`}>Rolle für {user.displayName}</label>
+						<select id={`role-${user.id}`} name="role">
+							<option value="barkeeper" selected={user.role === 'barkeeper'}>Barkeeper</option>
+							<option value="thekencrew" selected={user.role === 'thekencrew'}>Thekencrew</option>
+						</select>
+						<button class="text-button" type="submit">Rolle speichern</button>
+					</form>
+					<form method="POST" action={user.lockedAtUtc ? '?/unlock' : '?/lock'}>
+						<input type="hidden" name="userId" value={user.id} />
+						<button
+							class="secondary-button"
+							type="submit"
+							disabled={user.id === data.user?.id}
+							title={user.id === data.user?.id
+								? 'Das eigene Konto kann nicht gesperrt werden.'
+								: undefined}
+							>{user.lockedAtUtc
+								? 'Entsperren'
+								: user.id === data.user?.id
+									? 'Eigenes Konto'
+									: 'Sperren'}</button
+						>
+					</form>
+				</article>
+			{/each}
+		</div>
+	</section>
+
+	<div class="management-grid">
+		<section class="quiet-panel invite-panel">
+			<p class="eyebrow">Einladung</p>
+			<h2>Neues Konto einladen</h2>
+			<form class="compact-form" method="POST" action="?/invite">
+				<label
+					>E-Mail<input
+						name="email"
+						type="email"
+						required
+						maxlength="254"
+						value={form?.intent === 'invite' ? (form.email ?? '') : ''}
+					/></label
+				>
+				<label
+					>Rolle<select name="role"
+						><option value="thekencrew">Thekencrew</option><option value="barkeeper"
+							>Barkeeper</option
+						></select
+					></label
+				>
+				<button class="primary-button" type="submit">Einladung erstellen</button>
+			</form>
+		</section>
+		<section class="quiet-panel invite-panel">
+			<p class="eyebrow">Offene Einladungen</p>
+			<h2>Noch nicht angenommen</h2>
+			{#if data.invitations.length}
+				<div class="invitation-list">
+					{#each data.invitations as invitation (invitation.id)}
+						<div>
+							<span
+								><strong>{invitation.email}</strong><small
+									>{invitation.role === 'barkeeper' ? 'Barkeeper' : 'Thekencrew'}</small
+								></span
+							>
+							<form method="POST" action="?/revokeInvitation">
+								<input type="hidden" name="invitationId" value={invitation.id} /><button
+									class="text-button"
+									type="submit">Widerrufen</button
+								>
+							</form>
+						</div>
+					{/each}
+				</div>
+			{:else}<p class="quiet-copy">Keine offenen Einladungen.</p>{/if}
+		</section>
+	</div>
+
+	<h2 class="section-heading">Taxonomie</h2>
 	<div class="settings-grid">
 		<section class="quiet-panel taxonomy-panel">
 			<p class="eyebrow">Abschnittskategorien</p>
@@ -35,5 +135,4 @@
 			</div>
 		</section>
 	</div>
-	<p class="settings-footnote">Konten und Rollen sind noch nicht verfügbar.</p>
 </div>
@@ -2,11 +2,19 @@

 set -eu

-mkdir -p /app/data/uploads
+mkdir -p /app/data/uploads /app/data/mail-outbox
 chown -R cloudron:cloudron /app/data

 export SENDEWERK_DB_PATH="${SENDEWERK_DB_PATH:-/app/data/sendewerk.sqlite}"
 export SENDEWERK_UPLOAD_DIR="${SENDEWERK_UPLOAD_DIR:-/app/data/uploads}"
+export SENDEWERK_MAIL_OUTBOX_DIR="${SENDEWERK_MAIL_OUTBOX_DIR:-/app/data/mail-outbox}"
+export SENDEWERK_APP_ORIGIN="${SENDEWERK_APP_ORIGIN:-${CLOUDRON_APP_ORIGIN:-}}"
+if [ -n "${CLOUDRON_APP_ORIGIN:-}" ]; then
+    export PROTOCOL_HEADER="${PROTOCOL_HEADER:-x-forwarded-proto}"
+    export HOST_HEADER="${HOST_HEADER:-x-forwarded-host}"
+    export ADDRESS_HEADER="${ADDRESS_HEADER:-x-forwarded-for}"
+    export XFF_DEPTH="${XFF_DEPTH:-1}"
+fi
 export HOST="${HOST:-0.0.0.0}"
 export PORT="${PORT:-3000}"

@@ -1,4 +1,11 @@
 import { expect, test, type Page } from '@playwright/test';
+import { readFileSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+
+const adminEmail = 'barkeeper@example.test';
+const adminPassword = 'Nur-fuer-E2E-Admin-1234';
+const crewEmail = 'crew@example.test';
+const crewPassword = 'Nur-fuer-E2E-Crew-1234';

 const routes = ['/fundus', '/sendungen', '/eingang', '/archiv', '/verwaltung', '/live'];
 const viewports = [
@@ -22,6 +29,137 @@ async function setTheme(page: Page, theme: 'light' | 'dark') {
 	await page.evaluate((value) => localStorage.setItem('sendewerk-theme', value), theme);
 }

+async function login(page: Page, email = adminEmail, password = adminPassword) {
+	await page.goto('/login');
+	await page.getByLabel('E-Mail').fill(email);
+	await page.getByLabel('Passwort', { exact: true }).fill(password);
+	await page.getByRole('button', { name: 'Anmelden' }).click();
+	await expect(page).toHaveURL(/\/fundus$/);
+}
+
+function latestMailLink(subject: string): string {
+	const outbox = process.env.SENDEWERK_E2E_OUTBOX_DIR;
+	if (!outbox) throw new Error('E2E-Outbox ist nicht konfiguriert.');
+	const messages = readdirSync(outbox)
+		.sort()
+		.map(
+			(file) =>
+				JSON.parse(readFileSync(path.join(outbox, file), 'utf8')) as {
+					subject: string;
+					text: string;
+				}
+		)
+		.filter((message) => message.subject === subject);
+	const match = messages.at(-1)?.text.match(/https?:\/\/[^\s]+/);
+	if (!match) throw new Error(`Keine Testmail mit Betreff ${subject} gefunden.`);
+	return match[0];
+}
+
+test.beforeAll(async ({ browser }) => {
+	const page = await browser.newPage();
+	await page.goto('/');
+	if (await page.getByRole('heading', { name: 'Ersten Barkeeper anlegen' }).isVisible()) {
+		await page.getByLabel('Betreiber-Setup-Token').fill('e2e-only-setup-token-32-characters');
+		await page.getByLabel('Name').fill('E2E Barkeeper');
+		await page.getByLabel('E-Mail').fill(adminEmail);
+		await page.getByLabel('Passwort').fill(adminPassword);
+		await page.getByRole('button', { name: 'Barkeeper anlegen' }).click();
+	} else {
+		await page.getByLabel('E-Mail').fill(adminEmail);
+		await page.getByLabel('Passwort').fill(adminPassword);
+		await page.getByRole('button', { name: 'Anmelden' }).click();
+	}
+	await expect(page).toHaveURL(/\/fundus$/);
+	const sessionCookie = (await page.context().cookies()).find(
+		(cookie) => cookie.name === 'sendewerk_session'
+	);
+	expect(sessionCookie?.httpOnly).toBe(true);
+	expect(sessionCookie?.secure).toBe(false);
+	expect(sessionCookie?.sameSite).toBe('Lax');
+	await page.goto('/setup');
+	await expect(page).toHaveURL(/\/fundus$/);
+	await page.getByRole('button', { name: 'Abmelden', exact: true }).click();
+	await expect(page).toHaveURL(/\/login$/);
+	await page.close();
+});
+
+test.beforeEach(async ({ page }) => {
+	await login(page);
+});
+
+test('invitations, direct authorization, locking and password reset work end to end', async ({
+	page,
+	browser
+}, testInfo) => {
+	await page.goto('/verwaltung');
+	await page.screenshot({
+		path: testInfo.outputPath('verwaltung-konten-desktop.png'),
+		fullPage: true
+	});
+	const crossSite = await page.request.post('/verwaltung?/invite', {
+		form: { email: 'cross-site@example.test', role: 'barkeeper' },
+		headers: { origin: 'https://example.invalid' }
+	});
+	expect(crossSite.status()).toBe(403);
+	const inviteForm = page.locator('.invite-panel').filter({ hasText: 'Neues Konto einladen' });
+	await inviteForm.getByLabel('E-Mail').fill(crewEmail);
+	await inviteForm.getByRole('button', { name: 'Einladung erstellen' }).click();
+	await expect(
+		page.getByText('Einladung wurde in der lokalen Mail-Outbox abgelegt.')
+	).toBeVisible();
+
+	const crewContext = await browser.newContext();
+	const crewPage = await crewContext.newPage();
+	await crewPage.goto(latestMailLink('Einladung zu Sendewerk'));
+	await expect(crewPage).toHaveURL(/\/einladung$/);
+	await crewPage.getByLabel('Name').fill('E2E Crew');
+	await crewPage.getByLabel('Passwort').fill(crewPassword);
+	await crewPage.getByRole('button', { name: 'Konto aktivieren' }).click();
+	await expect(crewPage).toHaveURL(/\/fundus$/);
+	await expect(crewPage.getByText('Verwaltung', { exact: true })).toHaveCount(0);
+
+	const forbidden = await crewPage.request.post('/verwaltung?/invite', {
+		form: { email: 'verboten@example.test', role: 'barkeeper' },
+		headers: { origin: 'http://127.0.0.1:4173' }
+	});
+	expect(forbidden.status()).toBe(403);
+
+	await page.reload();
+	const crewRow = page.locator('.account-row').filter({ hasText: crewEmail });
+	await crewRow.getByRole('button', { name: 'Sperren' }).click();
+	await crewPage.goto('/fundus');
+	await expect(crewPage).toHaveURL(/\/login$/);
+
+	await page.reload();
+	await page
+		.locator('.account-row')
+		.filter({ hasText: crewEmail })
+		.getByRole('button', { name: 'Entsperren' })
+		.click();
+	await crewPage.goto('/passwort-vergessen');
+	await crewPage.getByLabel('E-Mail').fill(crewEmail);
+	await crewPage.getByRole('button', { name: 'Reset-Link anfordern' }).click();
+	await expect(crewPage.getByText('Anfrage verarbeitet.')).toBeVisible();
+	await crewPage.goto(latestMailLink('Sendewerk-Passwort zurücksetzen'));
+	await expect(crewPage).toHaveURL(/\/passwort-zuruecksetzen$/);
+	await crewPage.getByLabel('Neues Passwort').fill('Neues-E2E-Crew-Passwort-1234');
+	await crewPage.getByRole('button', { name: 'Passwort speichern' }).click();
+	await login(crewPage, crewEmail, 'Neues-E2E-Crew-Passwort-1234');
+	await crewContext.close();
+
+	const anonymousContext = await browser.newContext({ viewport: { width: 390, height: 844 } });
+	const loginPage = await anonymousContext.newPage();
+	await loginPage.goto('/login');
+	await setTheme(loginPage, 'dark');
+	await loginPage.reload();
+	await expectNoHorizontalOverflow(loginPage);
+	await loginPage.screenshot({
+		path: testInfo.outputPath('login-mobile-dark.png'),
+		fullPage: true
+	});
+	await anonymousContext.close();
+});
+
 test('desktop fundus is a compact, filterable list with persistent themes', async ({
 	page
 }, testInfo) => {
@@ -9,7 +9,10 @@ export default defineConfig({
 				runes: ({ filename }) =>
 					filename.split(/[/\\]/).includes('node_modules') ? undefined : true
 			},
-			adapter: adapter()
+			adapter: adapter(),
+			paths: {
+				origin: process.env.SENDEWERK_APP_ORIGIN
+			}
 		})
 	],
 	test: {