Release v2.11.3

CHANGELOG.md

@@ -2,13 +2,87 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.11.3 - 2026-09-08
+
+### Fixed
+
+- Added the reload confirmation prompt to individual client actions in the mobile clients view.
+
+## 2.11.2 - 2026-09-05
+
+### Changed
+
+- Refreshed the vendored AdminLTE assets to 4.9.1, including the print-layout fixes and extended palette updates.
+- Added independently configurable verification, password-reset, and invitation email expiry periods, with an `[[expiry_time]]` template variable.
+- Updated default account email templates with inline formatting, action buttons, and links, and improved rendering when both button and URL placeholders are used.
+- Shortened user-agent labels across audit logs and account session lists, and removed red/green change highlighting from audit entries.
+
+## 2.11.1 - 2026-09-02
+
+### Added
+
+- Secure administrator invitations that create accounts only after the recipient accepts the invitation.
+- Configurable API progress-bar placeholders with AdminLTE and announcement palette colors, custom colors, striped and animated variants, and quoted numeric literals.
+- An optional `textless` progress-bar modifier to hide the visible percentage while retaining progress accessibility metadata.
+- Configurable progress-bar radius options including `square`, `pill`, `rounded`, and validated `radius(...)` values.
+- Arithmetic API placeholder transforms for adding, subtracting, multiplying, and dividing numeric values.
+- Time-based progress bars using start and end date/time fields to show elapsed timetable-item progress.
+- Audit events for invitation sending and acceptance, email verification, password-reset requests, and account email changes.
+- A pending invitations page with invitation-specific Read, Create, Delete, and Allow permissions.
+- Invitation deletion and resend actions with confirmation prompts.
+- An opt-in Weather audit category for weather-location changes and manually queued refreshes.
+- Opt-in per-command Screen Controls auditing, with forward and back navigation grouped together and disabled by default.
+- The pending invitations list now supports pagination, search, and sorting, with Users, Roles, and Invitations grouped under expandable User management navigation.
+- API progress calculations now support object-wrapped amounts.
+
+### Changed
+
+- Updated the invitation registration page to show fields only for valid tokens, use the themed failure state for invalid links, and pre-fill the invited email and display name.
+- Made the invited email visibly disabled, kept the display name editable and required, and aligned invitation actions with the existing user forms.
+- Added bold, italic, and underline formatting controls to the user invitation email message template editor.
+- Fixed application-settings cleanup SQL so media and icon saves preserve all supported settings and no longer fail with MariaDB placeholder errors.
+- Updated API progress bars to inherit the surrounding WYSIWYG text size and text color, preserve rounded corners, and render consistently in the editor preview, player, and thumbnails.
+
+## 2.11.0 - 2026-09-02
+
+### Added
+
+- Optional account emails with administrator verification bypass, email verification, password recovery, and confirmed email changes.
+- SMTP configuration and mail delivery for account notifications.
+- Autofill restrictions for Bitwarden, LastPass, and 1Password on account profile and new-password fields while preserving current-password autofill.
+
+### Changed
+
+- Updated account email templates and previews to support both line breaks and paragraph spacing.
+
+## 2.10.7 - 2026-09-02
+
+### Added
+
+- API token authentication now reuses access tokens until their expiry and can renew them with a refresh token, including refresh-token rotation.
+- API sources can configure a refresh URL, JSON request body, and refresh-token response path.
+- Client status badges now show Live, Paused, and Blackout states in the responsive Connected clients view.
+
+### Changed
+
+- Reorganized the API source editor into compact Connection, Authentication, and Latest response cards, with authentication collapsed by default on edit pages.
+- Redesigned the Connected clients page for responsive mobile cards with compact controls, expandable search, pairing access, two-line detail clamping, and aligned desktop screen-group controls.
+
+### Fixed
+
+- Fixed client screen moves from mobile cards so the next move disables the client’s current screen group rather than its previous one.
+- Removed unused Bootstrap Icons font preloads that triggered browser warnings on pages where icons were not rendered.
+
 ## 2.10.6 - 2026-08-29
 
+### Added
+
+- Playlist recovery now uses cached browser and server snapshots, reports offline status, and recovers after cached responses.
+
 ### Changed
 
 - Refactored the player runtime into focused animation, media, transition, command, playback, and rendering modules.
 - Improved player slide transitions and video playback by preloading media, preserving precise durations, pausing outgoing videos during crossfades, and deferring expensive post-render setup.
-- Added resilient playlist recovery through cached browser and server snapshots, offline status reporting, and refresh handling that recovers after cached responses.
 
 ### Fixed
 
@@ -34,6 +108,11 @@ All notable changes to this project will be documented in this file.
 
 ## 2.10.3 - 2026-08-28
 
+### Added
+
+- Remote screens now poll periodically to recover from missed refresh commands after bridge reconnects.
+- Screens now use cached playlist snapshots while the bridge or web service is temporarily unavailable.
+
 ### Fixed
 
 - Fixed the weather edit preview so the daily forecast is shown initially, the 24-hour forecast is hidden until selected, and the redundant hourly heading is removed.
@@ -44,8 +123,6 @@ All notable changes to this project will be documented in this file.
 - Fixed remote player heartbeats to update the central onboarding bindings for active browser clients without treating the physical player registry ID as a client binding.
 - Fixed targeted commands after browser reconnects by falling back to the stable client ID when a transient connection ID is stale.
 - Fixed stale browser command connections remaining active indefinitely when the physical player heartbeat was still healthy.
-- Added periodic playlist polling so remote screens recover from missed refresh commands after bridge reconnects.
-- Added cached playlist snapshots so screens can continue displaying their last known playlist while the bridge or web service is temporarily unavailable.
 - Fixed media synchronization so generated player caches are excluded while remote image caches remain available to players.
 - Fixed weather screen notifications so changes in the fetched data or the current forecast hour trigger a refresh.
 - Fixed player runtime script loading and slide rendering so region modules, transitions, and cached playlists initialize consistently.
@@ -54,39 +131,42 @@ All notable changes to this project will be documented in this file.
 
 ## 2.10.2 - 2026-08-28
 
+### Added
+
+- Onboarding client heartbeats are now persisted so records inactive for 24 hours can be pruned without relying on player connectivity after the fact.
+
 ### Fixed
 
 - Fixed the weather forecast preview to show only its first-fetch message until a successful forecast is available.
-- Added persisted onboarding client heartbeats so records inactive for 24 hours can be pruned without relying on player connectivity after the fact.
 
 ## 2.10.1 - 2026-08-28
 
 ### Added
 
-- Added linear gradient backgrounds to templates, including multiple colours and angle control.
-- Added a visual gradient stop editor with draggable stops, click-to-add support, and stop reordering.
+- Linear gradient backgrounds to templates, including multiple colours and angle control.
+- A visual gradient stop editor with draggable stops, click-to-add support, and stop reordering.
 
 ## 2.10.0 - 2026-08-28
 
 ### Added
 
-- Added secure kiosk onboarding with QR-first and manual pairing flows.
-- Added browser-specific pairing sessions with expiring pairing codes.
-- Added circular QR presentation and a compatible QR scanner with decoder fallbacks.
-- Added responsive player onboarding and a post-pair option to connect another player.
-- Added stable player identity bindings for paired players and moved-client aliases.
-- Added per-tab client identities backed by browser session storage for commands, pairing, and screen moves.
-- Added RBAC protection for player pairing through the `pairing.allow` permission.
-- Added a dedicated web onboarding workflow for pairing and managing player setup.
+- Secure kiosk onboarding with QR-first and manual pairing flows.
+- Browser-specific pairing sessions with expiring pairing codes.
+- Circular QR presentation and a compatible QR scanner with decoder fallbacks.
+- Responsive player onboarding and a post-pair option to connect another player.
+- Stable player identity bindings for paired players and moved-client aliases.
+- Per-tab client identities backed by browser session storage for commands, pairing, and screen moves.
+- RBAC protection for player pairing through the `pairing.allow` permission.
+- A dedicated web onboarding workflow for pairing and managing player setup.
+- Pairing entry points now appear in the dashboard and connected clients workflows.
+- A mobile-friendly connected clients link is now shown after successful pairing.
+- Player keyboard feedback now includes slide navigation, plus `P` pause/unpause and `B` blackout toggles.
 
 ### Changed
 
 - Restricted direct screen URLs to the player configured for the requested screen.
-- Added pairing entry points to the dashboard and connected clients workflows.
 - Made pairing QR codes easier to scan by encoding only the short pairing code.
-- Added a mobile-friendly connected clients link after successful pairing.
 - Made connected-client controls and player pairing UI render independently according to their permissions.
-- Added player keyboard feedback for slide navigation, plus `P` pause/unpause and `B` blackout toggles.
 - Removed client identities from onboarding and screen-move URLs; authorized player data now loads after the tab identity handshake.
 - Updated connected-client commands and screen moves to resolve tab and registered-player identities reliably.
 
@@ -95,9 +175,10 @@ All notable changes to this project will be documented in this file.
 ### Added
 
 - API sources, RSS feeds, and weather locations can be enabled or disabled without deleting their cached data.
-- Added Weather slide regions with current, daily, and hourly placeholders, date/time transforms, and Bootstrap weather icon transforms.
-- Added multiple saved weather locations with provider, coordinate, unit, and refresh settings.
-- Added separate Allow permissions for manually refreshing API sources, RSS feeds, and weather locations.
+- Weather slide regions with current, daily, and hourly placeholders, date/time transforms, and Bootstrap weather icon transforms.
+- Multiple saved weather locations with provider, coordinate, unit, and refresh settings.
+- Separate Allow permissions for manually refreshing API sources, RSS feeds, and weather locations.
+- Announcement colour choices and player rendering now include the AdminLTE extended palette colours.
 
 ### Changed
 
@@ -110,7 +191,6 @@ All notable changes to this project will be documented in this file.
 - Startup data-source refreshes now respect each API, RSS, and weather source's configured repull interval.
 - RSS feeds now persist their last collection timestamp.
 - Refreshed the vendored AdminLTE assets to 4.8.5.
-- Added AdminLTE extended palette colours to announcement colour choices and player rendering.
 - Removed Digital Signage Subheading and top padding.
 - API and RSS source saves now preserve cached data without pulling; added explicit manual refresh actions.
 
@@ -118,13 +198,16 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added configurable JSON POST requests and two-step login-then-token authentication for API sources.
+- Configurable JSON POST requests and two-step login-then-token authentication for API sources.
 
 ## 2.8.6 - 2026-08-18
 
+### Added
+
+- URL fields now provide live validation with inline feedback and explicit HTTP or HTTPS scheme enforcement.
+
 ### Fixed
 
-- Added live URL validation with inline feedback and explicit HTTP or HTTPS scheme enforcement for URL fields.
 - Prevented Enter in slide editor inputs from implicitly saving the slide.
 - Collapsed nested API response JSON sections by default while keeping the root response visible.
 
@@ -139,8 +222,8 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added local caching for API and RSS image placeholders under `player-cache/remote-images` for offline player playback.
-- Added reconciliation of cached remote images so files no longer referenced by slides are removed.
+- Local caching for API and RSS image placeholders under `player-cache/remote-images` for offline player playback.
+- Reconciliation of cached remote images so files no longer referenced by slides are removed.
 
 ### Fixed
 
@@ -152,8 +235,8 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added API, RSS, Timetable, and Time / Date placeholder help panels with shared transform and date-token documentation.
-- Added render-time API and RSS image placeholders with proportional sizing and preview-only bounding boxes.
+- API, RSS, Timetable, and Time / Date placeholder help panels with shared transform and date-token documentation.
+- Render-time API and RSS image placeholders with proportional sizing and preview-only bounding boxes.
 
 ### Changed
 
@@ -198,6 +281,7 @@ All notable changes to this project will be documented in this file.
 - A permissions-gated System Settings page for announcement icon suggestions, media upload limits and MIME types, session lifetime, and password-change policies.
 - Configurable forced password changes for newly created users and administrator password resets.
 - The database foundation for key-based application settings, including typed defaults and validation.
+- All tables now use numeric auto-increment identifiers while retaining natural or relationship keys as unique constraints.
 
 ### Changed
 
@@ -212,7 +296,6 @@ All notable changes to this project will be documented in this file.
 - Replaced password strength presets with customizable length, category, and character requirements.
 - Session expiration now uses the configured system setting, and user and role administration is grouped under the Settings area.
 - Renamed the system settings permissions to the `system-settings.*` namespace and migrated existing role assignments.
-- Added numeric auto-increment identifiers to every table and retained natural or relationship keys as unique constraints.
 
 ## 2.7.6 - 2026-08-15
 
@@ -510,7 +593,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added branded Windows and Linux kiosk launcher downloads on the dashboard, with updated copy that explains the launcher behavior more clearly.
+- Branded Windows and Linux kiosk launcher downloads on the dashboard, with updated copy that explains the launcher behavior more clearly.
 - Kiosk launchers now start the browser in kiosk mode, suppress notifications for Chromium-based browsers, and use the correct Firefox kiosk flag.
 
 
@@ -808,13 +891,13 @@ All notable changes to this project will be documented in this file.
 ### Added
 
 - Screen and dashboard player links now render the full player URL instead of only the player base host.
+- Notes near the singleton-player code paths to make the future multi-player migration work easier to revisit.
 
 ### Changed
 
 - The player registry now uses a singleton `d_players` row and `d_screens.player_id` points at that shared player record.
 - Player startup is now responsible for creating the shared player record, while onboarding and state polling no longer create extra player rows.
 - The screen/player binding path was simplified so opening a screen binds it to the shared player record without trying to re-register the player.
-- Added notes near the singleton-player code paths to make the future multi-player migration work easier to revisit.
 - Managed fonts now have dedicated editor/player sync handling, including a scheduled font sweep, sorted font-family lists, the TinyMCE fullscreen button, and shared font stylesheet loading in the WYSIWYG editor.
 - Text and RSS region types now own their own default style and fallback behavior instead of relying on shared slide helper fallbacks.
 - Image and video region handling was also pushed further into modular per-type modules, keeping their editor, preview, and player logic closer to the region itself instead of the shared slide helper layer.
@@ -1087,9 +1170,12 @@ All notable changes to this project will be documented in this file.
 
 ## 1.3.3 - 2026-07-21
 
+### Added
+
+- The first round of modular admin-page work, including a shared admin route layer and refreshed dashboard/list rendering.
+
 ### Changed
 
-- Added the first round of modular admin-page work, including a shared admin route layer and refreshed dashboard/list rendering.
 - Updated the admin shell styling and layout handling for the newer page structure.
 - Adjusted package metadata and lockfile state to match the release.
 
@@ -1175,4 +1261,4 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Initial release.
+- Initial release.

README.md

@@ -25,7 +25,7 @@ It gives you one place to publish playlists, slides, announcements, and live upd
 
 Docker Compose is the recommended way to deploy Pulse Signage. It keeps the web app, player, bridge, and database together in a predictable setup.
 
-If you want the details, start with the [Compose guide](docker-compose/README.md).
+For a complete installation, follow the [public stack setup](docker-compose/README.md#public-stack-setup). For screens on separate devices, use the [remote player setup](docker-compose/README.md#remote-player-setup).
 
 ## Docs
 
@@ -33,7 +33,6 @@ If you want the details, start with the [Compose guide](docker-compose/README.md
 - [API reference](docs/api.md) - the player HTTP surface and onboarding endpoints.
 - [Database schema](docs/schema.md) - the tables and data model the app maintains.
 - [WebSocket reference](docs/websocket.md) - the live player and snapshot channels.
-- [Compose guide](docker-compose/README.md) - deployment options and service layout.
 - [Changelog](CHANGELOG.md) - release history and notable changes.
 
 ## Explore The Docs

build/package.player.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage-player",
-  "version": "2.10.6",
+  "version": "2.11.3",
   "private": false,
   "description": "Pulse Signage player application bundle",
   "engines": {

build/package.web.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage-web",
-  "version": "2.10.6",
+  "version": "2.11.3",
   "private": false,
   "description": "Pulse Signage web and bridge application bundle",
   "engines": {
@@ -18,6 +18,7 @@
     "handlebars": "^4.7.8",
     "multer": "^2.2.0",
     "mysql2": "^3.23.3",
+    "nodemailer": "^9.1.1",
     "puppeteer-core": "^25.7.0",
     "sharp": "^0.35.3",
     "jsqr": "^1.4.0",

docker-compose/.env.remote.example

@@ -8,7 +8,7 @@ PULSE_SIGNAGE_SHARED_SECRET=""
 PLAYER_IDENTIFIER="player-remote"
 
 # Optional URL used by the kiosk launcher when the remote player is directly reachable
-# PLAYER_PUBLIC_URL="http://remote-player.example.com:8081"
+PLAYER_PUBLIC_URL="http://remote-player.example.com:8081"
 
 PLAYER_AGENT_RECONNECT_DELAY_MS=5000
 

docker-compose/README.md

@@ -2,6 +2,21 @@
 
 This folder contains the Docker Compose definitions for Pulse Signage, including the public stack and the remote player stack.
 
+## Contents
+
+- [Files](#files)
+- [Stack Overview](#stack-overview)
+- [Services](#services)
+- [Environment Files](#environment-files)
+- [Public Stack Setup](#public-stack-setup)
+- [Remote Player Setup](#remote-player-setup)
+- [Shared Secret](#shared-secret)
+- [Ports](#ports)
+- [Volumes](#volumes)
+- [Networks](#networks)
+- [Notes](#notes)
+- [Deployment Checklist](#deployment-checklist)
+
 ## Files
 
 - [docker-compose.yml](docker-compose.yml) - full public stack with web, player, player bridge, and MySQL.
@@ -45,6 +60,8 @@ Key configuration:
 
 - `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, `DB_PASSWORD`
 - `PULSE_SIGNAGE_SHARED_SECRET`
+- `WEB_PUBLIC_URL`
+- `BRIDGE_INTERNAL_URL`
 - `DEFAULT_ADMIN_USERNAME`
 - `DEFAULT_ADMIN_NAME`
 - `DEFAULT_ADMIN_PASSWORD`
@@ -62,11 +79,13 @@ Responsibilities:
 
 Key configuration:
 
+- `PLAYER_PUBLIC_URL`
 - `PLAYER_INTERNAL_URL`
 - `PLAYER_IDENTIFIER`
 - `BRIDGE_PUBLIC_URL` in remote mode
 - `PULSE_SIGNAGE_SHARED_SECRET`
-- database settings in local mode
+- `WEB_PUBLIC_URL`
+- `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, `DB_PASSWORD` in local mode
 
 ### `player-bridge`
 
@@ -96,46 +115,106 @@ Responsibilities:
 
 Key configuration:
 
-- `MYSQL_DATABASE`
-- `MYSQL_USER`
-- `MYSQL_PASSWORD`
+- `DB_NAME`
+- `DB_USER`
+- `DB_PASSWORD`
 - `MYSQL_ROOT_PASSWORD`
 
 ## Environment Files
 
-### `.env.example`
+| File | Used by | How it is loaded |
+| --- | --- | --- |
+| `.env.example` | Public stack | Copy to `.env`; Compose loads it automatically, or pass it with `--env-file`. |
+| `.env.remote.example` | Published remote player | Copy to `.env.remote`; pass it with `--env-file .env.remote`. |
 
-Use this file as a starting point for the public compose stack.
+The example files are templates. Copy the appropriate file, review its defaults, and replace secrets or placeholder URLs before deploying.
+
+### Public stack: `.env.example`
+
+Use this file as a starting point for the public Compose stack.
 
 Important values:
 
-- `PULSE_SIGNAGE_WEB_IMAGE` - image to run for the web app and bridge services, typically `.../pulse-signage-web:latest`
-- `PULSE_SIGNAGE_PLAYER_IMAGE` - image to run for the player services, typically `.../pulse-signage-player:latest`
-- `PULSE_SIGNAGE_SHARED_SECRET` - long random secret shared by the web, player, and bridge services for authenticated requests
-- `DB_*` - MySQL credentials and database name for the stack
-- `MYSQL_ROOT_PASSWORD` - root password for the local MySQL container
-- `WEB_PUBLIC_URL` - public URL of the web application
-- `WEB_INTERNAL_URL` - internal URL the bridge uses to call the web app directly
-- `PLAYER_IDENTIFIER` - unique local player identifier
-- `PLAYER_PUBLIC_URL` - URL used by the kiosk launcher and direct player access
-- `PLAYER_INTERNAL_URL` - internal URL the web app uses for local player calls
-- `BRIDGE_INTERNAL_URL` - bridge URL the web app uses for player snapshot and command forwarding
-- `DEFAULT_ADMIN_*` - bootstrap admin account values
+| Variable | Purpose | Default |
+| --- | --- | --- |
+| `PULSE_SIGNAGE_WEB_IMAGE` | Image for the web app and bridge services. | `git.lzstealth.com/lzstealth/pulse-signage-web:latest` |
+| `PULSE_SIGNAGE_PLAYER_IMAGE` | Image for the player services. | `git.lzstealth.com/lzstealth/pulse-signage-player:latest` |
+| `PULSE_SIGNAGE_SHARED_SECRET` | Shared request-signing secret. | Blank; set this for a secured deployment. |
+| `DB_HOST` | MySQL host name. | `mysql` |
+| `DB_PORT` | MySQL port. | `3306` |
+| `DB_NAME` | MySQL database name. | `pulse-signage` |
+| `DB_USER` | MySQL user name. | `pulse-signage` |
+| `DB_PASSWORD` | MySQL user password. | `signage_password` |
+| `MYSQL_ROOT_PASSWORD` | Local MySQL root password. | `root_password` |
+| `WEB_PUBLIC_URL` | Public URL of the web application. | `http://localhost:8080` |
+| `WEB_INTERNAL_URL` | Internal URL the bridge uses to call the web app. | `http://web:8080` |
+| `PLAYER_IDENTIFIER` | Unique local player identifier. | `player-local` |
+| `PLAYER_PUBLIC_URL` | URL used by the kiosk launcher and direct player access. | `http://localhost:8081` |
+| `PLAYER_INTERNAL_URL` | Internal URL used for local player calls. | `http://player:8081` |
+| `BRIDGE_INTERNAL_URL` | Bridge URL used for snapshots and command forwarding. | `http://player-bridge:8090` |
+| `DEFAULT_ADMIN_USERNAME` | Bootstrap admin username. | `admin` |
+| `DEFAULT_ADMIN_NAME` | Bootstrap admin display name. | `Admin` |
+| `DEFAULT_ADMIN_PASSWORD` | Bootstrap admin password. | `password123!` |
 
-### `.env.remote.example`
+### Remote player: `.env.remote.example`
 
-Use this file on a remote player device.
+Use this file as the starting point for a remote player device. The production remote Compose file reads values from Compose's environment, so pass the copied file explicitly with `--env-file`.
 
 Important values:
 
-- `PULSE_SIGNAGE_PLAYER_IMAGE` - image to run on the device, typically `.../pulse-signage-player:latest`
-- `PULSE_SIGNAGE_SHARED_SECRET` - must match the public stack and should be the same long random value used everywhere in the deployment
-- `PLAYER_IDENTIFIER` - unique remote player identifier
-- `PLAYER_PUBLIC_URL` - optional URL used by the kiosk launcher when the remote player is directly reachable
-- `BRIDGE_PUBLIC_URL` - bridge URL the player connects back to
-- `PLAYER_AGENT_RECONNECT_DELAY_MS` - reconnect delay for the player agent
+| Variable | Purpose | Default |
+| --- | --- | --- |
+| `PULSE_SIGNAGE_PLAYER_IMAGE` | Image to run on the device. | `git.lzstealth.com/lzstealth/pulse-signage-player:latest` |
+| `PULSE_SIGNAGE_SHARED_SECRET` | Shared request-signing secret; must match the public stack. | Blank; set it to the public stack's secret. |
+| `PLAYER_IDENTIFIER` | Unique remote player identifier. | `player-remote` |
+| `PLAYER_PUBLIC_URL` | Optional URL for direct player access. | `http://remote-player.example.com:8081` |
+| `BRIDGE_PUBLIC_URL` | Bridge URL the player connects back to. | `http://player-bridge.example.com:8090`; replace this placeholder. |
+| `PLAYER_AGENT_RECONNECT_DELAY_MS` | Delay before reconnecting to the bridge. | `5000` |
 
-### `PULSE_SIGNAGE_SHARED_SECRET`
+## Public Stack Setup
+
+Install Docker Engine with Docker Compose, then run the public stack from this directory:
+
+```sh
+cp .env.example .env
+docker compose -f docker-compose.yml up -d
+```
+
+The command pulls the published images, creates the network and volumes, and starts the web app, local player, player bridge, and MySQL services. Check the installation with:
+
+```sh
+docker compose -f docker-compose.yml ps
+docker compose -f docker-compose.yml logs -f web
+```
+
+## Remote Player Setup
+
+A remote deployment has two parts:
+
+- the public stack runs the web app, database, and player bridge
+- each remote device runs only the player and connects back to the bridge
+
+The remote player does not need database credentials. Set `BRIDGE_PUBLIC_URL` to the externally reachable bridge URL, including its port when required. It must point to the bridge service, not the web dashboard URL. The bridge must be reachable from the device and allow both HTTP requests and the player websocket connection at `/ws/players`.
+
+### Published remote player
+
+On the remote device:
+
+```sh
+cp .env.remote.example .env.remote
+docker compose --env-file .env.remote -f docker-compose.remote.yml up -d
+```
+
+The published remote stack exposes the player on host port `8081`. Check its connection and startup output with:
+
+```sh
+docker compose --env-file .env.remote -f docker-compose.remote.yml ps
+docker compose --env-file .env.remote -f docker-compose.remote.yml logs -f player
+```
+
+Start the public stack and confirm that its bridge is reachable before starting the remote player. Once the player connects, it should appear in the dashboard's Connected clients view. If it does not, verify the bridge URL, shared secret, firewall or reverse-proxy websocket support, and the player logs.
+
+## Shared Secret
 
 This secret is the shared signing key for requests between the services. Use a single value for every service that needs to talk to the same stack, including the web app, player, bridge, and any remote player that connects back to that bridge.
 
@@ -149,34 +228,6 @@ If you want a quick local value, generate one with a password manager or a comma
 
 Leave it blank only if you intentionally want to run without request signing in a throwaway local setup.
 
-## Main Configuration Variables
-
-| Variable | Used By | Purpose |
-| --- | --- | --- |
-| `PULSE_SIGNAGE_WEB_IMAGE` | web, bridge | Docker image to run for the web app and bridge services. |
-| `PULSE_SIGNAGE_PLAYER_IMAGE` | player, remote player | Docker image to run for the player services. |
-| `PULSE_SIGNAGE_SHARED_SECRET` | web, player, bridge, remote player | Shared secret for authenticated requests between services. |
-| `DB_HOST` | web, player, bridge | Database host name. |
-| `DB_PORT` | web, player, bridge | Database port. |
-| `DB_NAME` | web, player, bridge, mysql | Database name. |
-| `DB_USER` | web, player, bridge, mysql | Database user. |
-| `DB_PASSWORD` | web, player, bridge, mysql | Database password. |
-| `MYSQL_ROOT_PASSWORD` | mysql | Root password for the local MySQL container. |
-| `MYSQL_DATABASE` | mysql | Database name used by the local MySQL container. |
-| `MYSQL_USER` | mysql | Database user used by the local MySQL container. |
-| `MYSQL_PASSWORD` | mysql | Database password used by the local MySQL container. |
-| `WEB_PUBLIC_URL` | web, player-bridge | Public URL of the web application. |
-| `WEB_INTERNAL_URL` | player-bridge | Internal web URL used by the bridge to call the dashboard app directly. |
-| `PLAYER_IDENTIFIER` | player | Stable player identifier. |
-| `PLAYER_PUBLIC_URL` | player, remote player | URL used by the kiosk launcher and direct player access; optional for bridge-only remote players. |
-| `PLAYER_INTERNAL_URL` | web, player | Internal player URL used by the dashboard and player runtime. |
-| `BRIDGE_INTERNAL_URL` | web | Bridge URL used by the web app for player snapshot and command forwarding. |
-| `DEFAULT_ADMIN_USERNAME` | web | Bootstrap admin username. |
-| `DEFAULT_ADMIN_NAME` | web | Bootstrap admin display name. |
-| `DEFAULT_ADMIN_PASSWORD` | web | Bootstrap admin password. |
-| `BRIDGE_PUBLIC_URL` | remote player | URL of the bridge service. |
-| `PLAYER_AGENT_RECONNECT_DELAY_MS` | remote player | Delay before reconnecting to the bridge. |
-
 ## Ports
 
 Public stack ports:
@@ -210,16 +261,16 @@ Each compose file creates its own named network:
 
 ## Notes
 
-- The public stack expects the app services and MySQL to share the same `PULSE_SIGNAGE_SHARED_SECRET`.
+- The public stack expects the web, player, and bridge services to share the same `PULSE_SIGNAGE_SHARED_SECRET`.
 - A remote player must use the same `PULSE_SIGNAGE_SHARED_SECRET` as the bridge it connects to.
 - The bridge service is the dashboard-facing command path for connected remote players.
 - The remote player should point `BRIDGE_PUBLIC_URL` at the bridge, not at the public web endpoint.
 - The `PULSE_SIGNAGE_WEB_IMAGE` and `PULSE_SIGNAGE_PLAYER_IMAGE` tags default to the published `pulse-signage-web` and `pulse-signage-player` repositories with `latest` tags, but they can be overridden for custom releases.
 
-## Recommended Setup
+## Deployment Checklist
 
-1. Copy `.env.example` to a local `.env` file for the public stack.
-2. Copy `.env.remote.example` to a device-specific `.env` file for the remote player.
-3. Make sure `PULSE_SIGNAGE_SHARED_SECRET` matches everywhere.
-4. Start the public stack first, then start the remote player after the bridge is reachable.
+1. Follow [Public Stack Setup](#public-stack-setup) to start the public stack with Docker Compose.
+2. Set the same `PULSE_SIGNAGE_SHARED_SECRET` in the public and remote environments.
+3. Set `BRIDGE_PUBLIC_URL` to the externally reachable bridge URL.
+4. Start the published remote player with the workflow above.
 5. Verify that the player appears in Connected clients before testing screen commands.

docs/README.md

@@ -7,6 +7,7 @@ This folder contains the technical reference material for Pulse Signage.
 - [API reference](api.md) - the player HTTP surface and onboarding endpoints.
 - [Database schema](schema.md) - the tables and data model used by the app.
 - [WebSocket reference](websocket.md) - the live player and snapshot channels.
+- [Compose guide](../docker-compose/README.md) - Docker Compose deployment and service configuration.
 
 ## How To Read It
 

docs/api.md

@@ -6,7 +6,7 @@ Player service base URL: `http://localhost:8081`
 
 This document covers the player HTTP surface only. The admin dashboard exposes its own routes for screen commands and onboarding management.
 
-Access note: most player endpoints are unauthenticated because they are meant to run inside a trusted deployment network. Anything that mutates state or writes files should be treated as internal-only unless you add your own auth layer in front of it. Pairing uses a short-lived random PIN displayed by the kiosk; the PIN is accepted only through the authenticated Web UI pairing flow.
+Access note: when `PULSE_SIGNAGE_SHARED_SECRET` is set, player-page endpoints require a valid `x-pulse-page-auth` token with the appropriate scope, and server-to-server endpoints require the signed request headers. When the secret is unset, these checks are disabled for compatibility, so the player service should remain inside a trusted deployment network. Pairing uses a short-lived random PIN displayed by the kiosk; the PIN is accepted only through the authenticated Web UI pairing flow.
 
 When `PULSE_SIGNAGE_SHARED_SECRET` is set, the player pages sign same-origin API fetches with `x-pulse-page-auth`, and the web app signs server-to-player requests with `x-pulse-request-timestamp` plus `x-pulse-request-signature`. Page tokens auto-renew before expiry while the page stays active, and signed server requests are only accepted when their timestamp is fresh. If the secret is unset, those checks stay disabled for compatibility.
 
@@ -26,23 +26,50 @@ Access: the configured player may load only its persisted paired screen. An unpa
 
 ### `GET /api/onboarding/status`
 Returns the persisted onboarding status for a device.
-Access: public within the trusted player deployment.
+Access: requires a page-auth token with the `onboarding` or `player` scope when shared-secret authentication is enabled.
 
 Query fields:
 
-- `deviceId` required
+- `deviceId` optional; the player device ID is used when omitted
 
 ### `GET /api/onboarding/screens`
 Returns the list of screens available for onboarding.
-Access: public within the trusted player deployment.
+Access: requires a page-auth token with the `onboarding` scope when shared-secret authentication is enabled.
 
 ### `GET /api/onboarding/qr`
 Returns an SVG QR code that points to the onboarding form.
-Access: public within the trusted player deployment.
+Access: public on the player service; the bridge version requires a signed server request when shared-secret authentication is enabled.
 
 Query fields:
 
-- `deviceId` required
+- `deviceId` optional; the player device ID is used when omitted
+
+### `GET /api/onboarding/resolve`
+Resolves a short-lived kiosk pairing code to its device and client identifiers.
+Access: requires an onboarding page token or signed server request when shared-secret authentication is enabled.
+
+Query fields:
+
+- `pairingCode` required
+
+Response fields:
+
+- `deviceId`
+- `clientId`
+
+### `GET /api/onboarding/session`
+Returns the current pairing session for the player page.
+Access: requires an onboarding page-auth token when shared-secret authentication is enabled.
+
+Query fields:
+
+- `deviceId` optional
+- `clientId` optional
+
+Response fields:
+
+- `deviceId`
+- `pairingCode`
 
 ### `POST /api/auth/page`
 Renews the current page-auth token before it expires.
@@ -54,15 +81,28 @@ Response fields:
 - `issuedAt`
 - `expiresAt`
 
+### `POST /api/screen-move-authorize`
+Stores a short-lived screen-move authorization token in an HTTP-only cookie.
+Access: requires a valid screen-move page-auth token in the request body.
+
+Accepted request fields:
+
+- `moveToken` required
+
+Response fields:
+
+- `ok`
+
 ### `POST /api/onboarding`
 Binds a device to a screen and client name.
-Access: internal-only. Browser submissions must go through the authenticated Web UI pairing page. The Web UI resolves the short-lived kiosk PIN to a device ID before forwarding the signed request. Protect this endpoint if the player service is reachable outside your trusted network.
+Access: internal-only. Requires an onboarding page-auth token or signed request when shared-secret authentication is enabled, plus a valid short-lived kiosk pairing code. Browser submissions must go through the authenticated Web UI pairing page.
 
 Accepted request fields:
 
-- `deviceId` required
 - `clientName` required
 - `screenSlug` required
+- `pairingCode` required
+- `clientId` required
 
 Response fields:
 
@@ -76,7 +116,7 @@ Response fields:
 
 ### `GET /api/media/config`
 Returns the upload directory configured for the player service.
-Access: internal-only.
+Access: internal-only and requires signed request headers when shared-secret authentication is enabled.
 
 Response fields:
 
@@ -85,15 +125,15 @@ Response fields:
 
 ### `PUT /api/media/{filename}`
 Writes an uploaded file into the player upload directory.
-Access: internal-only and write-protected behind your deployment boundary.
+Access: internal-only and requires signed request headers when shared-secret authentication is enabled.
 
 ### `DELETE /api/media/{filename}`
 Deletes a file from the player upload directory.
-Access: internal-only and write-protected behind your deployment boundary.
+Access: internal-only and requires signed request headers when shared-secret authentication is enabled.
 
 ### `GET /api/rtmp/session`
 Creates or reuses an RTMP-to-HLS session for a source URL.
-Access: internal-only.
+Access: requires a page-auth token with the `player` scope when shared-secret authentication is enabled.
 
 Query fields:
 
@@ -118,7 +158,7 @@ Access: internal-only.
 
 ### `GET /api/screens/{slug}/playlist`
 Returns the current playlist payload for a screen.
-Access: public within the trusted player deployment.
+Access: requires a page-auth token with the `player` scope when shared-secret authentication is enabled. The player also checks that the browser is authorized for the requested screen.
 
 Response fields:
 
@@ -130,10 +170,19 @@ Response fields:
 - `timetableGroups`
 - `revision`
 
+### `GET /api/screens/{slug}/announcement`
+Returns the active announcement for a screen.
+Access: requires a page-auth token with the `player` scope when shared-secret authentication is enabled. The player also checks that the browser is authorized for the requested screen.
+
+Response fields:
+
+- `announcement`
+- `revision`
+
 ### `GET /api/screens/{slug}/connections`
 ### `GET /api/screens/{slug}/clients`
 Returns the live player connection snapshot for a screen.
-Access: public within the trusted player deployment, but it exposes live connection state.
+Access: internal-only and requires signed request headers when shared-secret authentication is enabled; it exposes live connection state.
 
 Response fields:
 
@@ -143,9 +192,19 @@ Response fields:
 - `connections`
 - `degraded`
 
+### `POST /api/screens/{slug}/announcements/refresh`
+Notifies connected players that the active announcement should be refreshed.
+Access: internal-only and requires signed request headers when shared-secret authentication is enabled.
+
+Response fields:
+
+- `ok`
+- `screenSlug`
+- `sent`
+
 ### `POST /api/screens/{slug}/commands`
 Sends a command to the player connections for a screen.
-Access: internal-only. The admin dashboard should remain the protected control surface for commands.
+Access: internal-only and requires signed request headers when shared-secret authentication is enabled. The admin dashboard should remain the protected control surface for commands.
 
 Accepted request fields:
 

docs/schema.md

@@ -13,12 +13,34 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 - `a_role_permissions` - many-to-many mapping between roles and permissions.
 - `a_user_roles` - many-to-many mapping between users and roles.
 - `a_sessions` - persisted admin session tokens.
+- `a_account_tokens` - short-lived account verification and password-reset tokens.
+- `a_user_invitations` - pending user invitations and assigned role ids.
+- `a_login_attempts` - login rate-limit and lockout state.
 
 ### `a_users`
 
-- `id`, `name`, `username`, `password_hash`, `password_salt`, `password_iterations`, `must_change_password`, `account_locked`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `name`, `username`, `email`, `email_verified_at`, `pending_email`, `pending_email_token_hash`, `pending_email_expires_at`, `password_hash`, `password_salt`, `password_iterations`, `must_change_password`, `account_locked`, `last_login_at`, `last_login_ip`, `created_at`, `created_by`, `modified_at`, `modified_by`
 - `username` is unique.
 
+### `a_account_tokens`
+
+- `id`, `user_id`, `token_type`, `token_hash`, `expires_at`, `used_at`, `created_at`
+- `token_hash` is unique.
+- Foreign key:
+        - `user_id` -> `a_users.id` with `ON DELETE CASCADE`
+- Indexed by `(token_type, token_hash, expires_at)` and `(user_id, token_type)`.
+
+### `a_user_invitations`
+
+- `id`, `email`, `name`, `role_ids_json`, `token_hash`, `expires_at`, `used_at`, `created_at`, `created_by`
+- `token_hash` is unique.
+- Indexed by `(email, used_at, expires_at)` and `(created_by, created_at)`.
+
+### `a_login_attempts`
+
+- `id`, `rate_key`, `failed_count`, `last_failed_at`, `locked_until`, `created_at`, `modified_at`
+- `rate_key` is unique.
+
 ### `a_roles`
 
 - `id`, `role_key`, `name`, `description`, `created_at`, `created_by`, `modified_at`, `modified_by`
@@ -134,7 +156,7 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 
 ### `d_onboarding_devices`
 
-- `id`, `device_id`, `client_name`, `screen_id`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `device_id`, `client_name`, `screen_id`, `created_at`, `created_by`, `modified_at`, `modified_by`, `last_seen_at`
 - `device_id` is unique.
 - Foreign key:
         - `screen_id` -> `d_screens.id` with `ON DELETE SET NULL`
@@ -166,6 +188,7 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 - `i_rss_feeds` - RSS feed definitions and refresh cadence.
 - `i_rss_feed_items` - cached RSS feed items.
 - `i_api_sources` - API source definitions and last response snapshot.
+- `i_weather_locations` - configured weather locations and last response snapshot.
 - `i_timetable_groups` - grouped timetable definitions used by the timetable region.
 - `i_timetable_entries` - dated entries that belong to a timetable group.
 
@@ -183,7 +206,7 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 
 ### `i_api_sources`
 
-- `id`, `name`, `api_url`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `items_path`, `update_interval_value`, `update_interval_unit`, `enabled`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `name`, `api_url`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `token_url`, `token_request_body_json`, `token_response_path`, `token_refresh_url`, `token_refresh_request_body_json`, `token_refresh_response_path`, `token_header_name`, `token_header_prefix`, `items_path`, `update_interval_value`, `update_interval_unit`, `enabled`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by`
 
 ### `i_weather_locations`
 
@@ -237,6 +260,7 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 - The schema is initialized with `CREATE TABLE IF NOT EXISTS`, so new installs can start from an empty database.
 - `src/db/bootstrap.js` seeds the canvas size defaults, default permissions, and the default administrator role.
 - `src/db/migrations.js` records the current schema version in `o_app_state` during startup so later launches can tell whether an update is happening.
+- The ER diagram shows declared foreign keys and the logical audit actor association; player registry and JSON-based references are intentionally not shown as foreign-key relationships.
 
 ```mermaid
 erDiagram
@@ -252,6 +276,12 @@ erDiagram
         }
         A_SESSIONS {
         }
+        A_ACCOUNT_TOKENS {
+        }
+        A_USER_INVITATIONS {
+        }
+        A_LOGIN_ATTEMPTS {
+        }
         C_CANVAS_SIZES {
         }
         C_PLAYLISTS {
@@ -282,6 +312,8 @@ erDiagram
         }
         I_API_SOURCES {
         }
+        I_WEATHER_LOCATIONS {
+        }
         I_TIMETABLE_GROUPS {
         }
         I_TIMETABLE_ENTRIES {
@@ -300,18 +332,19 @@ erDiagram
         A_ROLES ||--o{ A_ROLE_PERMISSIONS : has
         A_PERMISSIONS ||--o{ A_ROLE_PERMISSIONS : granted_to
         A_USERS ||--o{ A_SESSIONS : owns
-        A_USERS ||--o{ O_AUDIT_EVENTS : acts
+        A_USERS ||--o{ A_ACCOUNT_TOKENS : has
+        A_USERS o|--o{ O_AUDIT_EVENTS : acts
 
-        C_CANVAS_SIZES ||--o{ C_TEMPLATES : used_by
-        C_CANVAS_SIZES ||--o{ C_PLAYLISTS : used_by
+        C_CANVAS_SIZES o|--o{ C_TEMPLATES : used_by
+        C_CANVAS_SIZES o|--o{ C_PLAYLISTS : used_by
         C_TEMPLATES ||--o{ C_TEMPLATE_REGIONS : contains
-        C_TEMPLATES ||--o{ C_SLIDES : used_by
+        C_TEMPLATES o|--o{ C_SLIDES : used_by
         C_PLAYLISTS ||--o{ C_PLAYLIST_SLIDES : contains
         C_SLIDES ||--o{ C_PLAYLIST_SLIDES : included_in
         C_PLAYLIST_SLIDES ||--o{ C_PLAYLIST_SLIDE_SCHEDULE_RULES : has_rules
 
-        C_PLAYLISTS ||--o{ D_SCREENS : uses
-        D_SCREENS ||--o{ D_ONBOARDING_DEVICES : binds
+        C_PLAYLISTS o|--o{ D_SCREENS : uses
+        D_SCREENS o|--o{ D_ONBOARDING_DEVICES : binds
         D_ANNOUNCEMENTS ||--o{ D_ANNOUNCEMENT_SCREENS : targets
         D_SCREENS ||--o{ D_ANNOUNCEMENT_SCREENS : receives
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pulse-signage",
-  "version": "2.10.6",
+  "version": "2.11.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pulse-signage",
-      "version": "2.10.6",
+      "version": "2.11.3",
       "dependencies": {
         "@sparticuz/chromium": "^149.0.0",
         "animate.css": "^4.1.1",
@@ -19,6 +19,7 @@
         "jsqr": "^1.4.0",
         "multer": "^2.2.0",
         "mysql2": "^3.23.3",
+        "nodemailer": "^9.1.1",
         "puppeteer-core": "^25.7.0",
         "sharp": "^0.35.3",
         "ws": "^8.21.3"
@@ -1989,6 +1990,15 @@
       "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==",
       "license": "MIT"
     },
+    "node_modules/nodemailer": {
+      "version": "9.1.1",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.1.1.tgz",
+      "integrity": "sha512-izw9mVKFix6YSnC9eLgV6g1opl9DUlRio9ZNcq+Wu9Ujn2UwF+8Nl0B8nz22kEC+CTZCvinkxwJ0DeFbb6NwcQ==",
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/nodemon": {
       "version": "3.1.14",
       "resolved": "https://registry.npmjs.org/nodemon/-/nodemon-3.1.14.tgz",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage",
-  "version": "2.10.6",
+  "version": "2.11.3",
   "private": false,
   "description": "Pulse Signage application with MySQL and media storage",
   "engines": {
@@ -31,6 +31,7 @@
     "jsqr": "^1.4.0",
     "multer": "^2.2.0",
     "mysql2": "^3.23.3",
+    "nodemailer": "^9.1.1",
     "puppeteer-core": "^25.7.0",
     "sharp": "^0.35.3",
     "ws": "^8.21.3"

src/auth.js

@@ -7,6 +7,10 @@ const PASSWORD_KEY_LENGTH = 32;
 const PASSWORD_DIGEST = 'sha256';
 const SESSION_BYTES = 32;
 
+function createOneTimeToken() {
+  return crypto.randomBytes(32).toString('hex');
+}
+
 function validatePasswordStrength(password, options) {
   const value = String(password || '');
   const requirements = options && options.policy
@@ -91,5 +95,6 @@ module.exports = {
   verifyPassword,
   validatePasswordStrength,
   createSessionToken,
-  hashSessionToken
+  hashSessionToken,
+  createOneTimeToken
 };

src/data/account-email-templates.js

@@ -0,0 +1,54 @@
+const DEFAULT_ACCOUNT_EMAIL_TEMPLATES = {
+  verificationSubject: 'Verify your Pulse Signage email address',
+  verificationBody: 'Hello [b][[display_name]][/b]!\n[[action_button]]\nThis [u]link[/u] expires in [i][[expiry_time]][/i].\nConfirm this email address: [[url]]',
+  resetSubject: 'Reset your Pulse Signage password',
+  resetBody: 'Hello [b][[display_name]][/b]!\n[[action_button]]\nThis [u]link[/u] expires in [i][[expiry_time]][/i].\nChoose a new password: [[url]]'
+};
+
+function formatAccountEmailExpiry(value, unit) {
+  const amount = Number(value);
+  const normalizedAmount = Number.isFinite(amount) && amount > 0 ? Math.round(amount) : 30;
+  const normalizedUnit = unit === 'hours' ? 'hour' : 'minute';
+  return normalizedAmount + ' ' + normalizedUnit + (normalizedAmount === 1 ? '' : 's');
+}
+
+function renderAccountEmailTemplate(subject, body, variables) {
+  const values = variables || {};
+  const replaceVariables = function (value) {
+    return String(value || '').replace(/\[\[([a-z_]+)\]\]/g, function (_match, key) {
+      return Object.prototype.hasOwnProperty.call(values, key) ? String(values[key]) : _match;
+    });
+  };
+  const renderedSubject = replaceVariables(subject);
+  const renderedText = replaceVariables(body);
+  const plainText = renderedText.replace(/\[(?:b|i|u)\]([\s\S]*?)\[\/(?:b|i|u)\]/gi, '$1');
+  const escapedBody = renderedText.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/\[b\]([\s\S]*?)\[\/b\]/gi, '<strong>$1</strong>').replace(/\[i\]([\s\S]*?)\[\/i\]/gi, '<em>$1</em>').replace(/\[u\]([\s\S]*?)\[\/u\]/gi, '<u>$1</u>');
+  const actionLabel = String(values.action_label || 'Continue').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  const actionUrl = values.url ? String(values.url).replace(/&/g, '&amp;').replace(/"/g, '&quot;') : '';
+  const actionAlignment = values.action_alignment === 'left' || values.action_alignment === 'right' ? values.action_alignment : 'center';
+  const actionButton = actionUrl ? '<a href="' + actionUrl + '" style="display:inline-block;background:#111827;color:#ffffff;padding:12px 22px;text-decoration:none;border-radius:4px;font-weight:600;">' + actionLabel + '</a>' : '';
+  const actionBlock = actionButton ? '<div style="margin:24px 0;text-align:' + actionAlignment + ';">' + actionButton + '</div>' : '';
+  const plainLink = actionUrl ? '<a href="' + actionUrl + '">' + actionUrl + '</a>' : '';
+  const escapedBodyUrl = values.url ? String(values.url).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;') : '';
+  const hasButtonPlaceholder = escapedBody.indexOf('[[action_button]]') !== -1;
+  const hasUrlPlaceholder = String(body || '').indexOf('[[url]]') !== -1;
+  const bodyWithAction = hasButtonPlaceholder
+    ? escapedBody.split(escapedBodyUrl).join(plainLink).replace(/\[\[action_button\]\]/g, actionBlock).replace(/\[\[action_link\]\]/g, plainLink)
+    : hasUrlPlaceholder
+      ? escapedBody.split(actionUrl).join(actionBlock + plainLink)
+      : escapedBody.replace(/\[\[action_link\]\]/g, plainLink).replace(actionUrl, plainLink);
+  const bodyHtml = bodyWithAction.split(/\r?\n(?:[ \t]*\r?\n)+/).map(function (paragraph) {
+    const paragraphHtml = paragraph.replace(/\r?\n/g, '<br>');
+    if (paragraphHtml.indexOf(actionBlock) !== -1 && actionBlock) {
+      return paragraphHtml.split(actionBlock).map(function (part, index, parts) {
+        const text = part ? '<p style="margin:0 0 16px;">' + part + '</p>' : '';
+        return text + (index < parts.length - 1 ? actionBlock : '');
+      }).join('');
+    }
+    return paragraphHtml ? '<p style="margin:0 0 16px;">' + paragraphHtml + '</p>' : '';
+  }).join('');
+  const html = '<!doctype html><html><body style="margin:0;background:#f4f4f5;font-family:Arial,sans-serif;color:#27364b;"><div style="padding:24px 12px;"><div style="max-width:560px;margin:0 auto;text-align:center;color:#111827;font-size:20px;font-weight:700;padding:0 0 16px;">Pulse Signage</div><div style="max-width:560px;margin:0 auto;background:#ffffff;padding:32px;border-radius:4px;text-align:left;">' + bodyHtml + '</div></div></body></html>';
+  return { subject: renderedSubject, text: plainText, html: html };
+}
+
+module.exports = { DEFAULT_ACCOUNT_EMAIL_TEMPLATES, formatAccountEmailExpiry, renderAccountEmailTemplate };

src/data/api-sources.js

@@ -13,6 +13,7 @@ const TOKEN_URL_MAX_LENGTH = 1024;
 const TOKEN_RESPONSE_PATH_MAX_LENGTH = 255;
 const TOKEN_HEADER_PREFIX_MAX_LENGTH = 64;
 const tokenCache = new Map();
+const tokenRequests = new Map();
 
 function normalizeUpdateIntervalUnit(value) {
   const unit = String(value || '').trim().toLowerCase();
@@ -59,7 +60,7 @@ function buildAuthHeaders(source) {
 
 async function fetchApiSourcesData(pool) {
   const [apiSources] = await pool.query(
-    'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC'
+    'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_refresh_url, token_refresh_request_body_json, token_refresh_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC'
   );
 
   return { apiSources: apiSources };
@@ -67,7 +68,7 @@ async function fetchApiSourcesData(pool) {
 
 async function fetchApiSourcesPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) {
   const paged = await fetchPagedRows(pool, {
-    selectSql: 'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC',
+    selectSql: 'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_refresh_url, token_refresh_request_body_json, token_refresh_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC',
     countSql: 'SELECT COUNT(*) AS count FROM i_api_sources',
     searchColumns: ['name', 'api_url', 'last_pull_error'],
     searchTerm: searchTerm,
@@ -91,7 +92,7 @@ async function fetchApiSourcesPage(pool, page, pageSize, searchTerm, sortKey, so
 
 async function fetchApiSourceById(pool, id) {
   const [rows] = await pool.query(
-    'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources WHERE id = ?',
+    'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_refresh_url, token_refresh_request_body_json, token_refresh_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources WHERE id = ?',
     [id]
   );
 
@@ -184,6 +185,9 @@ function getTokenCacheKey(source) {
     source && (source.token_url || source.tokenUrl) || '',
     source && (source.token_request_body_json || source.tokenRequestBodyJson) || '',
     source && (source.token_response_path || source.tokenResponsePath) || 'access_token',
+    source && (source.token_refresh_url || source.tokenRefreshUrl) || '',
+    source && (source.token_refresh_request_body_json || source.tokenRefreshRequestBodyJson) || '',
+    source && (source.token_refresh_response_path || source.tokenRefreshResponsePath) || 'refresh_token',
     source && (source.token_header_name || source.tokenHeaderName) || 'Authorization',
     source && (source.token_header_prefix || source.tokenHeaderPrefix) || 'Bearer'
   ]);
@@ -193,11 +197,118 @@ function clearCachedToken(source) {
   tokenCache.delete(getTokenCacheKey(source));
 }
 
-async function fetchLoginToken(source) {
+function replaceRefreshToken(value, refreshToken) {
+  if (typeof value === 'string') {
+    return value.split('{{refresh_token}}').join(refreshToken);
+  }
+  if (Array.isArray(value)) {
+    return value.map(function (item) {
+      return replaceRefreshToken(item, refreshToken);
+    });
+  }
+  if (value && typeof value === 'object') {
+    return Object.keys(value).reduce(function (result, key) {
+      result[key] = replaceRefreshToken(value[key], refreshToken);
+      return result;
+    }, {});
+  }
+  return value;
+}
+
+function resolveTokenExpiry(parsed, token) {
+  const expiresIn = Number(parsed && (parsed.expires_in || parsed.expiresIn));
+  if (Number.isFinite(expiresIn) && expiresIn > 0) {
+    return { lifetimeMs: expiresIn * 1000 };
+  }
+
+  const explicitExpiry = parsed && (parsed.expires_at || parsed.expiresAt);
+  if (explicitExpiry !== undefined && explicitExpiry !== null) {
+    const expiryNumber = Number(explicitExpiry);
+    const expiryMs = Number.isFinite(expiryNumber)
+      ? (expiryNumber < 100000000000 ? expiryNumber * 1000 : expiryNumber)
+      : Date.parse(String(explicitExpiry));
+    if (Number.isFinite(expiryMs) && expiryMs > Date.now()) {
+      return { expiresAt: expiryMs };
+    }
+  }
+
+  const tokenParts = String(token).split('.');
+  if (tokenParts.length === 3) {
+    try {
+      const payload = JSON.parse(Buffer.from(tokenParts[1], 'base64url').toString('utf8'));
+      const expiryMs = Number(payload.exp) * 1000;
+      if (Number.isFinite(expiryMs) && expiryMs > Date.now()) {
+        return { expiresAt: expiryMs };
+      }
+    } catch (_error) {
+      // Opaque tokens do not contain a readable JWT expiry.
+    }
+  }
+
+  return { lifetimeMs: 300000 };
+}
+
+function cacheTokenResponse(source, parsed, previousRefreshToken) {
+  const tokenPath = source.token_response_path || source.tokenResponsePath || 'access_token';
+  const token = resolveResponsePath(parsed, tokenPath);
+  if (token === undefined || token === null || String(token).trim() === '') {
+    throw new Error('Token response did not contain a token at the configured path.');
+  }
+
+  const refreshPath = source.token_refresh_response_path || source.tokenRefreshResponsePath || 'refresh_token';
+  const responseRefreshToken = resolveResponsePath(parsed, refreshPath);
+  const refreshToken = responseRefreshToken === undefined || responseRefreshToken === null || String(responseRefreshToken).trim() === ''
+    ? previousRefreshToken
+    : String(responseRefreshToken);
+  const expiry = resolveTokenExpiry(parsed, token);
+  const expiresAt = expiry.expiresAt || Date.now() + Math.max(1000, expiry.lifetimeMs - Math.min(60000, expiry.lifetimeMs * 0.1));
+  const record = { value: String(token), refreshToken: refreshToken, expiresAt: expiresAt };
+  tokenCache.set(getTokenCacheKey(source), record);
+  return record;
+}
+
+async function parseTokenResponse(response, source, previousRefreshToken) {
+  if (!response.ok) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(String(response.bodyText || '').trim());
+  } catch (_error) {
+    throw new Error('Token response was not valid JSON.');
+  }
+  return cacheTokenResponse(source, parsed, previousRefreshToken);
+}
+
+async function refreshLoginToken(source, cached) {
+  const refreshUrl = source.token_refresh_url || source.tokenRefreshUrl || source.token_url || source.tokenUrl;
+  if (!cached || !cached.refreshToken) {
+    return null;
+  }
+  const configuredBody = parseJsonRequestBody(source.token_refresh_request_body_json || source.tokenRefreshRequestBodyJson, 'Refresh request body');
+  const refreshBody = configuredBody === undefined
+    ? { grant_type: 'refresh_token', refresh_token: cached.refreshToken }
+    : replaceRefreshToken(configuredBody, cached.refreshToken);
+  const response = await loadUrlText(refreshUrl, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(refreshBody)
+  });
+  return parseTokenResponse(response, source, cached.refreshToken);
+}
+
+async function fetchLoginTokenUncached(source) {
   const cacheKey = getTokenCacheKey(source);
   const cached = tokenCache.get(cacheKey);
   if (cached && cached.expiresAt > Date.now()) {
-    return cached.value;
+    return cached;
+  }
+
+  if (cached && cached.refreshToken) {
+    const refreshed = await refreshLoginToken(source, cached);
+    if (refreshed) {
+      return refreshed;
+    }
   }
 
   const tokenUrl = source.token_url || source.tokenUrl;
@@ -208,29 +319,25 @@ async function fetchLoginToken(source) {
     headers: tokenHeaders,
     body: tokenBody === undefined ? undefined : JSON.stringify(tokenBody)
   });
-  if (!response.ok) {
+  const record = await parseTokenResponse(response, source, cached && cached.refreshToken);
+  if (!record) {
     throw new Error(`Unable to obtain API token (${response.statusCode}).`);
   }
+  return record;
+}
 
-  let parsed;
-  try {
-    parsed = JSON.parse(String(response.bodyText || '').trim());
-  } catch (_error) {
-    throw new Error('Token response was not valid JSON.');
+async function fetchLoginToken(source) {
+  const cacheKey = getTokenCacheKey(source);
+  const cached = tokenCache.get(cacheKey);
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.value;
   }
-
-  const tokenPath = source.token_response_path || source.tokenResponsePath || 'access_token';
-  const token = resolveResponsePath(parsed, tokenPath);
-  if (token === undefined || token === null || String(token).trim() === '') {
-    throw new Error('Token response did not contain a token at the configured path.');
+  if (!tokenRequests.has(cacheKey)) {
+    tokenRequests.set(cacheKey, fetchLoginTokenUncached(source).finally(function () {
+      tokenRequests.delete(cacheKey);
+    }));
   }
-
-  const expiresIn = Number(parsed && (parsed.expires_in || parsed.expiresIn));
-  const lifetimeMs = Number.isFinite(expiresIn) && expiresIn > 0
-    ? Math.max(30000, expiresIn * 1000 - 60000)
-    : 300000;
-  tokenCache.set(cacheKey, { value: String(token), expiresAt: Date.now() + lifetimeMs });
-  return String(token);
+  return (await tokenRequests.get(cacheKey)).value;
 }
 
 async function buildRequestHeaders(source) {
@@ -310,6 +417,9 @@ function buildApiSourcePayload(req, existingApiSource) {
   const tokenUrl = validateMaxLength(readBodyValue('token_url', readBodyValue('tokenUrl', fallback.token_url || '')) || '', TOKEN_URL_MAX_LENGTH, 'API token URL');
   const tokenRequestBodyJson = validateMaxLength(readBodyValue('token_request_body_json', readBodyValue('tokenRequestBodyJson', fallback.token_request_body_json || '')) || '', REQUEST_BODY_MAX_LENGTH, 'Login request body');
   const tokenResponsePath = validateMaxLength(readBodyValue('token_response_path', readBodyValue('tokenResponsePath', fallback.token_response_path || 'access_token')) || 'access_token', TOKEN_RESPONSE_PATH_MAX_LENGTH, 'Token response path');
+  const tokenRefreshUrl = validateMaxLength(readBodyValue('token_refresh_url', readBodyValue('tokenRefreshUrl', fallback.token_refresh_url || '')) || '', TOKEN_URL_MAX_LENGTH, 'API refresh URL');
+  const tokenRefreshRequestBodyJson = validateMaxLength(readBodyValue('token_refresh_request_body_json', readBodyValue('tokenRefreshRequestBodyJson', fallback.token_refresh_request_body_json || '')) || '', REQUEST_BODY_MAX_LENGTH, 'Refresh request body');
+  const tokenRefreshResponsePath = validateMaxLength(readBodyValue('token_refresh_response_path', readBodyValue('tokenRefreshResponsePath', fallback.token_refresh_response_path || 'refresh_token')) || 'refresh_token', TOKEN_RESPONSE_PATH_MAX_LENGTH, 'Refresh token response path');
   const tokenHeaderName = validateMaxLength(readBodyValue('token_header_name', readBodyValue('tokenHeaderName', fallback.token_header_name || 'Authorization')) || 'Authorization', AUTH_MAX_LENGTH, 'Token header name');
   const tokenHeaderPrefix = validateMaxLength(readBodyValue('token_header_prefix', readBodyValue('tokenHeaderPrefix', fallback.token_header_prefix || 'Bearer')) || '', TOKEN_HEADER_PREFIX_MAX_LENGTH, 'Token prefix');
   const itemsPath = validateMaxLength(readBodyValue('items_path', readBodyValue('itemsPath', fallback.items_path || '')) || '', ITEMS_PATH_MAX_LENGTH, 'API source items path');
@@ -369,6 +479,7 @@ function buildApiSourcePayload(req, existingApiSource) {
 
   parseJsonRequestBody(requestBodyJson, 'API request body');
   parseJsonRequestBody(tokenRequestBodyJson, 'Login request body');
+  parseJsonRequestBody(tokenRefreshRequestBodyJson, 'Refresh request body');
 
   if (authMethod === 'token_login') {
     if (!tokenUrl) {
@@ -393,6 +504,19 @@ function buildApiSourcePayload(req, existingApiSource) {
     }
   }
 
+  if (tokenRefreshUrl) {
+    try {
+      const refreshParsedUrl = new URL(tokenRefreshUrl);
+      if (refreshParsedUrl.protocol !== 'http:' && refreshParsedUrl.protocol !== 'https:') {
+        throw new Error('invalid protocol');
+      }
+    } catch (_error) {
+      const error = new Error('Enter a valid API refresh URL.');
+      error.statusCode = 400;
+      throw error;
+    }
+  }
+
   return {
     name: name,
     apiUrl: parsedUrl.toString(),
@@ -407,6 +531,9 @@ function buildApiSourcePayload(req, existingApiSource) {
     tokenUrl: tokenUrl,
     tokenRequestBodyJson: tokenRequestBodyJson,
     tokenResponsePath: tokenResponsePath,
+    tokenRefreshUrl: tokenRefreshUrl,
+    tokenRefreshRequestBodyJson: tokenRefreshRequestBodyJson,
+    tokenRefreshResponsePath: tokenRefreshResponsePath,
     tokenHeaderName: tokenHeaderName,
     tokenHeaderPrefix: tokenHeaderPrefix,
     itemsPath: itemsPath,

src/data/app-settings.js

@@ -21,8 +21,33 @@ const SETTING_DEFINITIONS = [
   { key: 'security.login_max_attempts', type: 'integer', min: 1, defaultValue: 5 },
   { key: 'security.login_lockout_minutes', type: 'integer', min: 1, defaultValue: 15 },
   { key: 'security.login_rate_limit_scope', type: 'enum', values: ['both', 'username', 'ip'], defaultValue: 'both' },
+  { key: 'security.allow_admin_email_verification_bypass', type: 'boolean', defaultValue: true },
+  { key: 'email.smtp_enabled', type: 'boolean', defaultValue: false },
+  { key: 'email.smtp_host', type: 'string', defaultValue: '' },
+  { key: 'email.smtp_port', type: 'integer', min: 1, defaultValue: 587 },
+  { key: 'email.smtp_security', type: 'enum', values: ['none', 'starttls', 'tls'], defaultValue: 'starttls' },
+  { key: 'email.smtp_username', type: 'string', defaultValue: '' },
+  { key: 'email.smtp_password', type: 'string', defaultValue: '' },
+  { key: 'email.from_address', type: 'string', defaultValue: '' },
+  { key: 'email.from_name', type: 'string', defaultValue: 'Pulse Signage' },
+  { key: 'email.verification_expiry_minutes', type: 'integer', min: 1, defaultValue: 30 },
+  { key: 'email.reset_expiry_minutes', type: 'integer', min: 1, defaultValue: 30 },
+  { key: 'email.invitation_expiry_hours', type: 'integer', min: 1, defaultValue: 24 },
+  { key: 'email.verification_subject', type: 'string', defaultValue: 'Verify your Pulse Signage email address' },
+  { key: 'email.verification_body', type: 'string', defaultValue: 'Hello [b][[display_name]][/b]!\n[[action_button]]\nThis [u]link[/u] expires in [i][[expiry_time]][/i].\nConfirm this email address: [[url]]' },
+  { key: 'email.reset_subject', type: 'string', defaultValue: 'Reset your Pulse Signage password' },
+  { key: 'email.reset_body', type: 'string', defaultValue: 'Hello [b][[display_name]][/b]!\n[[action_button]]\nThis [u]link[/u] expires in [i][[expiry_time]][/i].\nChoose a new password: [[url]]' },
+  { key: 'email.verification_button_alignment', type: 'enum', values: ['left', 'center', 'right'], defaultValue: 'center' },
+  { key: 'email.verification_button_text', type: 'string', defaultValue: 'Verify email address' },
+  { key: 'email.reset_button_alignment', type: 'enum', values: ['left', 'center', 'right'], defaultValue: 'center' },
+  { key: 'email.reset_button_text', type: 'string', defaultValue: 'Reset password' },
+  { key: 'email.invitation_subject', type: 'string', defaultValue: 'You have been invited to Pulse Signage' },
+  { key: 'email.invitation_body', type: 'string', defaultValue: 'Hello [b][[display_name]][/b]!\n[[action_button]]\nThis [u]invitation link[/u] expires in [i][[expiry_time]][/i].\nCreate your account: [[url]]' },
+  { key: 'email.invitation_button_alignment', type: 'enum', values: ['left', 'center', 'right'], defaultValue: 'center' },
+  { key: 'email.invitation_button_text', type: 'string', defaultValue: 'Accept invitation' },
   { key: 'audit.enabled', type: 'boolean', defaultValue: true },
   { key: 'audit.categories', type: 'string_array', defaultValue: ['authentication', 'security', 'sessions', 'users', 'roles', 'system-settings'] },
+  { key: 'audit.screen_control_commands', type: 'string_array', defaultValue: [] },
   { key: 'audit.include_request_metadata', type: 'boolean', defaultValue: true },
   { key: 'audit.retention_days', type: 'integer', min: 0, defaultValue: 180 },
   { key: 'uploads.image_max_bytes', type: 'integer', min: 1, defaultValue: 100 * 1024 * 1024 },

src/data/audit-log.js

@@ -15,7 +15,9 @@ const AUDIT_EVENT_CATEGORIES = Object.freeze({
   CANVAS_SIZES: 'canvas-sizes',
   API_SOURCES: 'api-sources',
   RSS_FEEDS: 'rss-feeds',
-  TIMETABLES: 'timetables'
+  TIMETABLES: 'timetables',
+  WEATHER: 'weather',
+  SCREEN_CONTROLS: 'screen-controls'
 });
 const AUDIT_CATEGORY_KEYS = Object.freeze(Object.values(AUDIT_EVENT_CATEGORIES));
 const AUDIT_CATEGORY_LABELS = Object.freeze({
@@ -33,10 +35,42 @@ const AUDIT_CATEGORY_LABELS = Object.freeze({
   'canvas-sizes': 'Canvas Sizes',
   'api-sources': 'API Sources',
   'rss-feeds': 'RSS Feeds',
-  timetables: 'Timetables'
+  timetables: 'Timetables',
+  weather: 'Weather',
+  'screen-controls': 'Screen Controls'
+});
+const SCREEN_CONTROL_COMMAND_KEYS = Object.freeze(['pause', 'blackout', 'reload', 'navigation', 'moveclient', 'setclientname']);
+const SCREEN_CONTROL_COMMAND_LABELS = Object.freeze({
+  pause: 'Pause / Resume',
+  blackout: 'Blackout / Restore',
+  reload: 'Reload',
+  navigation: 'Forward / Back',
+  moveclient: 'Move client',
+  setclientname: 'Rename client'
 });
 const { fetchAppSettings } = require('./app-settings');
 
+function formatUserAgentLabel(userAgent) {
+  const value = String(userAgent || '').trim();
+  if (!value) return '';
+  const browserMatch = value.match(/(?:Edg|OPR|Chrome|Firefox|Version|Electron)\/([\d.]+)/i);
+  let browser = '';
+  if (/Edg\//i.test(value)) browser = 'Edge';
+  else if (/OPR\//i.test(value)) browser = 'Opera';
+  else if (/Electron\//i.test(value)) browser = 'Electron';
+  else if (/Chrome\//i.test(value)) browser = 'Chrome';
+  else if (/Firefox\//i.test(value)) browser = 'Firefox';
+  else if (/Version\/.*Safari\//i.test(value)) browser = 'Safari';
+  const browserLabel = browserMatch && browser ? browser + ' ' + browserMatch[1] : browser;
+  let operatingSystem = '';
+  if (/Windows NT/i.test(value)) operatingSystem = 'Windows';
+  else if (/Macintosh|Mac OS X/i.test(value)) operatingSystem = 'macOS';
+  else if (/Android/i.test(value)) operatingSystem = 'Android';
+  else if (/iPhone|iPad|iPod/i.test(value)) operatingSystem = 'iOS';
+  else if (/Linux/i.test(value)) operatingSystem = 'Linux';
+  return [browserLabel, operatingSystem].filter(Boolean).join(' on ') || value;
+}
+
 function normalizeDetails(details) {
   if (details === undefined || details === null) {
     return null;
@@ -101,6 +135,14 @@ async function recordRequestAuditEvent(pool, req, event) {
     if (!settings['audit.enabled'] || !enabledCategories.includes(category)) {
       return;
     }
+    if (category === 'screen-controls') {
+      const command = String(event && event.eventType || '').replace(/^screen-control\./, '').trim().toLowerCase();
+      const commandGroup = command === 'previous' || command === 'next' ? 'navigation' : command;
+      const enabledCommands = Array.isArray(settings['audit.screen_control_commands']) ? settings['audit.screen_control_commands'] : [];
+      if (!enabledCommands.includes(commandGroup)) {
+        return;
+      }
+    }
     const metadata = settings['audit.include_request_metadata'] ? getRequestMetadata(req) : {};
     await recordAuditEvent(pool, Object.assign({}, event, metadata));
   } catch (error) {
@@ -113,6 +155,9 @@ module.exports = {
   AUDIT_EVENT_CATEGORIES,
   AUDIT_CATEGORY_KEYS,
   AUDIT_CATEGORY_LABELS,
+  SCREEN_CONTROL_COMMAND_KEYS,
+  SCREEN_CONTROL_COMMAND_LABELS,
+  formatUserAgentLabel,
   getRequestMetadata,
   buildAuditChanges,
   recordAuditEvent,

src/data/mailer.js

@@ -0,0 +1,43 @@
+// SMTP delivery for account notifications.
+
+const nodemailer = require('nodemailer');
+
+function getSmtpConfig(settings) {
+  return {
+    enabled: Boolean(settings['email.smtp_enabled']),
+    host: String(settings['email.smtp_host'] || '').trim(),
+    port: Number(settings['email.smtp_port']) || 587,
+    security: String(settings['email.smtp_security'] || 'starttls'),
+    username: String(settings['email.smtp_username'] || '').trim(),
+    password: String(settings['email.smtp_password'] || ''),
+    fromAddress: String(settings['email.from_address'] || '').trim(),
+    fromName: String(settings['email.from_name'] || '').trim()
+  };
+}
+
+function createMailTransport(settings) {
+  const config = getSmtpConfig(settings);
+  if (!config.enabled || !config.host || !config.fromAddress) {
+    return null;
+  }
+  return nodemailer.createTransport({
+    host: config.host,
+    port: config.port,
+    secure: config.security === 'tls',
+    requireTLS: config.security === 'starttls',
+    auth: config.username ? { user: config.username, pass: config.password } : undefined
+  });
+}
+
+async function sendAccountEmail(settings, message) {
+  const transport = createMailTransport(settings);
+  if (!transport) {
+    throw new Error('Email delivery is not configured.');
+  }
+  const config = getSmtpConfig(settings);
+  return transport.sendMail(Object.assign({}, message, {
+    from: config.fromName ? '"' + config.fromName.replace(/"/g, '') + '" <' + config.fromAddress + '>' : config.fromAddress,
+  }));
+}
+
+module.exports = { getSmtpConfig, createMailTransport, sendAccountEmail };

src/db/index.js

@@ -249,6 +249,9 @@ async function ensureSchema(pool, options) {
       token_url VARCHAR(1024) NULL,
       token_request_body_json MEDIUMTEXT NULL,
       token_response_path VARCHAR(255) NULL DEFAULT 'access_token',
+      token_refresh_url VARCHAR(1024) NULL,
+      token_refresh_request_body_json MEDIUMTEXT NULL,
+      token_refresh_response_path VARCHAR(255) NULL DEFAULT 'refresh_token',
       token_header_name VARCHAR(255) NULL DEFAULT 'Authorization',
       token_header_prefix VARCHAR(64) NULL DEFAULT 'Bearer',
       items_path VARCHAR(255) NULL,
@@ -343,11 +346,18 @@ async function ensureSchema(pool, options) {
       id INT AUTO_INCREMENT PRIMARY KEY,
       name VARCHAR(255) NULL,
       username VARCHAR(255) NOT NULL UNIQUE,
+      email VARCHAR(320) NULL,
+      email_verified_at DATETIME NULL,
+      pending_email VARCHAR(320) NULL,
+      pending_email_token_hash CHAR(64) NULL,
+      pending_email_expires_at DATETIME NULL,
       password_hash CHAR(64) NOT NULL,
       password_salt VARCHAR(64) NOT NULL,
       password_iterations INT NOT NULL,
       must_change_password TINYINT(1) NOT NULL DEFAULT 0,
       account_locked TINYINT(1) NOT NULL DEFAULT 0,
+      last_login_at DATETIME NULL,
+      last_login_ip VARCHAR(255) NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -355,6 +365,37 @@ async function ensureSchema(pool, options) {
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
   `);
 
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS a_account_tokens (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      user_id INT NOT NULL,
+      token_type VARCHAR(32) NOT NULL,
+      token_hash CHAR(64) NOT NULL UNIQUE,
+      expires_at DATETIME NOT NULL,
+      used_at DATETIME NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      CONSTRAINT fk_account_tokens_user FOREIGN KEY (user_id) REFERENCES a_users(id) ON DELETE CASCADE,
+      INDEX idx_account_tokens_lookup (token_type, token_hash, expires_at),
+      INDEX idx_account_tokens_user_type (user_id, token_type)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS a_user_invitations (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      email VARCHAR(320) NOT NULL,
+      name VARCHAR(255) NULL,
+      role_ids_json TEXT NOT NULL,
+      token_hash CHAR(64) NOT NULL UNIQUE,
+      expires_at DATETIME NOT NULL,
+      used_at DATETIME NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      created_by INT NULL,
+      INDEX idx_user_invitations_email (email, used_at, expires_at),
+      INDEX idx_user_invitations_created_by (created_by, created_at)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
   await pool.query(`
     CREATE TABLE IF NOT EXISTS a_roles (
       id INT AUTO_INCREMENT PRIMARY KEY,

src/db/migrations.js

@@ -504,7 +504,10 @@ const VERSIONED_MIGRATIONS = [
       await ensureColumn(pool, 'i_api_sources', 'token_url', 'VARCHAR(1024) NULL', 'auth_header_value');
       await ensureColumn(pool, 'i_api_sources', 'token_request_body_json', 'MEDIUMTEXT NULL', 'token_url');
       await ensureColumn(pool, 'i_api_sources', 'token_response_path', "VARCHAR(255) NULL DEFAULT 'access_token'", 'token_request_body_json');
-      await ensureColumn(pool, 'i_api_sources', 'token_header_name', "VARCHAR(255) NULL DEFAULT 'Authorization'", 'token_response_path');
+      await ensureColumn(pool, 'i_api_sources', 'token_refresh_url', 'VARCHAR(1024) NULL', 'token_response_path');
+      await ensureColumn(pool, 'i_api_sources', 'token_refresh_request_body_json', 'MEDIUMTEXT NULL', 'token_refresh_url');
+      await ensureColumn(pool, 'i_api_sources', 'token_refresh_response_path', "VARCHAR(255) NULL DEFAULT 'refresh_token'", 'token_refresh_request_body_json');
+      await ensureColumn(pool, 'i_api_sources', 'token_header_name', "VARCHAR(255) NULL DEFAULT 'Authorization'", 'token_refresh_response_path');
       await ensureColumn(pool, 'i_api_sources', 'token_header_prefix', "VARCHAR(64) NULL DEFAULT 'Bearer'", 'token_header_name');
     }
   },
@@ -561,6 +564,63 @@ const VERSIONED_MIGRATIONS = [
     run: async function (pool) {
       await ensureColumn(pool, 'd_onboarding_devices', 'last_seen_at', 'TIMESTAMP NULL', 'screen_id');
     }
+  },
+  {
+    version: '2.10.7',
+    label: 'v2.10.7 API token refresh settings schema',
+    run: async function (pool) {
+      await ensureColumn(pool, 'i_api_sources', 'token_refresh_url', 'VARCHAR(1024) NULL', 'token_response_path');
+      await ensureColumn(pool, 'i_api_sources', 'token_refresh_request_body_json', 'MEDIUMTEXT NULL', 'token_refresh_url');
+      await ensureColumn(pool, 'i_api_sources', 'token_refresh_response_path', "VARCHAR(255) NULL DEFAULT 'refresh_token'", 'token_refresh_request_body_json');
+    }
+  },
+  {
+    version: '2.11.0',
+    label: 'v2.11.0 account email and password reset schema',
+    run: async function (pool) {
+      await ensureColumn(pool, 'a_users', 'email', 'VARCHAR(320) NULL', 'username');
+      await ensureColumn(pool, 'a_users', 'email_verified_at', 'DATETIME NULL', 'email');
+      await ensureColumn(pool, 'a_users', 'pending_email', 'VARCHAR(320) NULL', 'email_verified_at');
+      await ensureColumn(pool, 'a_users', 'pending_email_token_hash', 'CHAR(64) NULL', 'pending_email');
+      await ensureColumn(pool, 'a_users', 'pending_email_expires_at', 'DATETIME NULL', 'pending_email_token_hash');
+      await ensureColumn(pool, 'a_users', 'last_login_at', 'DATETIME NULL', 'modified_by');
+      await ensureColumn(pool, 'a_users', 'last_login_ip', 'VARCHAR(255) NULL', 'last_login_at');
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS a_account_tokens (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          user_id INT NOT NULL,
+          token_type VARCHAR(32) NOT NULL,
+          token_hash CHAR(64) NOT NULL UNIQUE,
+          expires_at DATETIME NOT NULL,
+          used_at DATETIME NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          CONSTRAINT fk_account_tokens_user FOREIGN KEY (user_id) REFERENCES a_users(id) ON DELETE CASCADE,
+          INDEX idx_account_tokens_lookup (token_type, token_hash, expires_at),
+          INDEX idx_account_tokens_user_type (user_id, token_type)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+    }
+  },
+  {
+    version: '2.11.1',
+    label: 'v2.11.1 user invitations schema',
+    run: async function (pool) {
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS a_user_invitations (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          email VARCHAR(320) NOT NULL,
+          name VARCHAR(255) NULL,
+          role_ids_json TEXT NOT NULL,
+          token_hash CHAR(64) NOT NULL UNIQUE,
+          expires_at DATETIME NOT NULL,
+          used_at DATETIME NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          created_by INT NULL,
+          INDEX idx_user_invitations_email (email, used_at, expires_at),
+          INDEX idx_user_invitations_created_by (created_by, created_at)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+    }
   }
 ];
 

src/player/public/css/player.css

@@ -32,6 +32,45 @@ body.onboarding-page #app {
   position: relative;
 }
 
+.api-progress {
+  --bs-progress-height: 1rem;
+  --bs-progress-font-size: 0.75rem;
+  --bs-border-radius: 0.375rem;
+  --bs-progress-border-radius: 0.375rem;
+  display: flex;
+  width: 100%;
+  box-sizing: border-box;
+  height: var(--bs-progress-height);
+  overflow: hidden;
+  font-size: var(--bs-progress-font-size);
+  border-radius: var(--bs-progress-border-radius);
+}
+
+.api-progress > .progress-bar {
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  overflow: hidden;
+  color: #fff;
+  text-align: center;
+  white-space: nowrap;
+  background-color: #0d6efd;
+}
+
+.api-progress > .progress-bar-striped {
+  background-image: linear-gradient(45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);
+  background-size: var(--bs-progress-height) var(--bs-progress-height);
+}
+
+.api-progress > .progress-bar-animated {
+  animation: api-progress-bar-stripes 1s linear infinite;
+}
+
+@keyframes api-progress-bar-stripes {
+  from { background-position-x: var(--bs-progress-height); }
+  to { background-position-x: 0; }
+}
+
 .onboarding-shell {
   min-height: 100%;
   display: flex;

src/player/regions/api.js

@@ -68,6 +68,9 @@ function substituteApiVariables(html, item, sourceId) {
     }
 
     var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression);
+    if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) {
+      return placeholderUtils.renderProgressPlaceholder(item, expression);
+    }
     if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) {
       var imageSource = placeholderUtils.formatPlaceholderValue(resolved);
       var source = getApiSourceById(sourceId);

src/player/regions/rss.js

@@ -74,6 +74,9 @@ function substituteRssVariables(html, item, feedId) {
       return '';
     }
     var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression);
+    if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) {
+      return placeholderUtils.renderProgressPlaceholder(item, expression);
+    }
     if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) {
       var imageSource = placeholderUtils.formatPlaceholderValue(resolved);
       var feed = getRssFeedById(feedId);

src/player/regions/timetable.js

@@ -13,6 +13,9 @@ function substituteTimetableVariables(html, entry) {
       return '';
     }
 
+    if (typeof window.placeholderUtils.isProgressPlaceholderExpression === 'function' && window.placeholderUtils.isProgressPlaceholderExpression(expression)) {
+      return window.placeholderUtils.renderProgressPlaceholder(entry, expression);
+    }
     return escapeHtml(window.placeholderUtils.formatPlaceholderValue(window.placeholderUtils.resolvePlaceholderExpression(entry, expression)));
   });
 }

src/player/regions/weather.js

@@ -51,6 +51,9 @@ function substituteWeatherVariables(html, value) {
     if (!value || typeof value !== 'object' || typeof weatherPlaceholderUtils.resolvePlaceholderExpression !== 'function' || typeof weatherPlaceholderUtils.formatPlaceholderValue !== 'function') return '';
     var rawExpression = String(expression).trim();
     var normalizedExpression = normalizeWeatherExpression(rawExpression);
+    if (typeof weatherPlaceholderUtils.isProgressPlaceholderExpression === 'function' && weatherPlaceholderUtils.isProgressPlaceholderExpression(rawExpression)) {
+      return weatherPlaceholderUtils.renderProgressPlaceholder(value, rawExpression);
+    }
     var iconMatch = normalizedExpression.match(/^(?:current\.weather_code|daily\.weather_code\.\d+|hourly\.weather_code\.\d+)\.icon(?:\((\d+)(?:\s*,\s*(\d+))?\))?$/);
     if (iconMatch) {
       var codeExpression = normalizedExpression.replace(/\.icon(?:\(.*\))?$/, '');

src/rbac.js

@@ -191,6 +191,17 @@ const PERMISSION_SECTIONS = [
           { key: 'delete', name: 'Delete', description: 'Delete users.' }
         ]
       },
+      {
+        key: 'invitations',
+        order: 15,
+        name: 'Invitations',
+        permissions: [
+          { key: 'read', name: 'Read', description: 'View pending user invitations.' },
+          { key: 'create', name: 'Create', description: 'Send new user invitations.' },
+          { key: 'delete', name: 'Delete', description: 'Delete pending user invitations.' },
+          { key: 'allow', name: 'Allow', description: 'Resend pending user invitations.' }
+        ]
+      },
       {
         key: 'rbac',
         order: 20,

src/web.js

@@ -6,7 +6,7 @@ const multer = require('multer');
 const fs = require('fs');
 const crypto = require('crypto');
 const common = require('./common');
-const { verifyPassword, createSessionToken, hashSessionToken, hashPassword, validatePasswordStrength } = require('#src/auth');
+const { verifyPassword, createSessionToken, hashSessionToken, hashPassword, validatePasswordStrength, createOneTimeToken } = require('#src/auth');
 const pages = require('#src/web/pages');
 const registerMiddleware = require('#src/web/middleware');
 const registerNotFoundHandler = require('#src/web/middleware/not-found');
@@ -23,8 +23,9 @@ const { requirePermission: createRequirePermission, PERMISSION_DENIED_MESSAGE }
 const { rbacData } = require('#src/web/lib/auth');
 const { createPlayerActionService } = require('#src/web/lib/player-actions');
 const { isClientNameAvailable, withClientNameReservation } = require('#src/data/client-name-check');
-const { createSessionService } = require('#src/web/lib/auth');
+const { createSessionService, getRequestOrigin } = require('#src/web/lib/auth');
 const { fetchAppSettings } = require('#src/data/app-settings');
+const { sendAccountEmail } = require('#src/data/mailer');
 const { recordRequestAuditEvent } = require('#src/data/audit-log');
 const { hasAnyPermission } = require('#src/rbac');
 const { ensureFontLibrary } = require('#src/web/lib/media/font-library');
@@ -150,7 +151,10 @@ async function start() {
     sessionCookieName: webConfig.sessionCookieName,
     formatDashboardDate: formatDashboardDate,
     getAuditUserId: getAuditUserId,
+    getRequestOrigin: getRequestOrigin,
     recordRequestAuditEvent: recordRequestAuditEvent,
+    sendAccountEmail: function (settings, message) { return sendAccountEmail(settings, message); },
+    createOneTimeToken: createOneTimeToken,
     hashPassword: hashPassword,
     validatePasswordStrength: validatePasswordStrength,
     readArrayField: readArrayField,

src/web/lib/auth/index.js

@@ -2,5 +2,6 @@
 
 module.exports = {
   createSessionService: require('./session').createSessionService,
+  getRequestOrigin: require('./session').getRequestOrigin,
   rbacData: require('./rbac-data')
 };

src/web/lib/auth/rbac-data.js

@@ -57,6 +57,32 @@ async function fetchRolesPage(pool, page, pageSize, searchTerm, sortKey, sortDir
   return Object.assign({ roles: paged.rows }, paged);
 }
 
+async function fetchInvitationsPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) {
+  const paged = await fetchPagedRows(pool, {
+    selectSql: `SELECT i.id, i.email, i.name, i.role_ids_json, i.created_at, i.expires_at, u.username AS created_by_username
+                  FROM a_user_invitations i
+             LEFT JOIN a_users u ON u.id = i.created_by
+                 WHERE i.used_at IS NULL AND i.expires_at > NOW()
+                 ORDER BY i.created_at DESC`,
+    countSql: 'SELECT COUNT(*) AS count FROM a_user_invitations WHERE used_at IS NULL AND expires_at > NOW()',
+    searchColumns: ['i.email', 'i.name', 'u.username'],
+    searchTerm: searchTerm,
+    sortColumns: {
+      email: 'i.email',
+      name: 'i.name',
+      created: 'i.created_at',
+      expires: 'i.expires_at',
+      createdBy: 'u.username'
+    },
+    sortKey: sortKey,
+    sortDirection: sortDirection,
+    page: page,
+    pageSize: pageSize
+  });
+
+  return Object.assign({ invitations: paged.rows }, paged);
+}
+
 async function fetchRoleById(pool, roleId) {
   const [rows] = await pool.query(
     `SELECT r.id, r.role_key, r.name, r.description, r.created_at, r.modified_at,
@@ -142,7 +168,7 @@ async function fetchUsersWithRolesPage(pool, page, pageSize, searchTerm, sortKey
   const whereSql = hasExcludedUserId ? 'WHERE u.id <> ?' : '';
   const queryArgs = hasExcludedUserId ? [excludedUserId] : [];
   const paged = await fetchPagedRows(pool, {
-    selectSql: `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at,
+    selectSql: `SELECT u.id, u.name, u.username, u.email, u.email_verified_at, u.account_locked, u.created_at, u.modified_at,
             COALESCE(role_data.role_names, '') AS role_names,
             COALESCE(role_data.role_ids_csv, '') AS role_ids_csv
     FROM a_users u
@@ -189,7 +215,7 @@ async function fetchUsersWithRolesPage(pool, page, pageSize, searchTerm, sortKey
 
 async function fetchUserWithRoles(pool, userId) {
   const [rows] = await pool.query(
-    `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at,
+    `SELECT u.id, u.name, u.username, u.email, u.email_verified_at, u.account_locked, u.created_at, u.modified_at,
             COALESCE(role_data.role_names, '') AS role_names,
             COALESCE(role_data.role_ids_csv, '') AS role_ids_csv
     FROM a_users u
@@ -299,6 +325,7 @@ module.exports = {
   fetchPermissions,
   fetchRoles,
   fetchRolesPage,
+  fetchInvitationsPage,
   fetchRoleById,
   fetchRolePermissionKeys,
   fetchRoleUserIds,

src/web/lib/auth/session.js

@@ -128,7 +128,7 @@ function createSessionService(options) {
 
     const tokenHash = hashSessionToken(token);
     const [rows] = await pool.query(
-      `SELECT s.user_id, u.id, u.name, u.username, u.must_change_password
+      `SELECT s.user_id, u.id, u.name, u.username, u.email, u.email_verified_at, u.pending_email, u.must_change_password
       FROM a_sessions s
       JOIN a_users u ON u.id = s.user_id
        WHERE s.session_hash = ?

src/web/lib/media/slide-thumbnails.js

@@ -184,6 +184,9 @@ function substitutePlaceholders(html, regionContent, options) {
     const resolved = typeof placeholderUtils.resolvePlaceholderExpression === 'function'
       ? placeholderUtils.resolvePlaceholderExpression(item, weatherExpression, { timeZone: item.timezone })
       : resolvePlaceholderPath(item, expression);
+    if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) {
+      return placeholderUtils.renderProgressPlaceholder(item, expression);
+    }
     if (type === 'weather' && /(?:^|\.)weather_code\.\d+\.icon(?:\(|$)|^current\.weather_code\.icon/.test(weatherExpression)) {
       const codeExpression = weatherExpression.replace(/\.icon(?:\(.*\))?$/, '');
       const iconSize = String(expression).match(/\.icon\(\s*(\d+)(?:\s*,\s*(\d+))?\s*\)$/);

src/web/middleware.js

@@ -29,7 +29,7 @@ module.exports = function registerMiddleware(app, deps) {
   });
 
   app.use(function (req, res, next) {
-    if (req.path === '/' || req.path === '/login' || req.path === '/logout' || req.path === '/slides/popup-preview' || req.path.indexOf('/api/internal/slide-thumbnails/') === 0 || req.path === '/api/internal/sync/player-media' || req.path === '/api/internal/sync/player-font') {
+    if (req.path === '/' || req.path === '/login' || req.path === '/logout' || req.path === '/forgot-password' || req.path === '/reset-password' || req.path === '/verify-email' || req.path === '/slides/popup-preview' || req.path.indexOf('/api/internal/slide-thumbnails/') === 0 || req.path === '/api/internal/sync/player-media' || req.path === '/api/internal/sync/player-font') {
       return next();
     }
 

src/web/pages/index.js

@@ -8,11 +8,18 @@ function routePath(...segments) {
 
 module.exports = {
   renderLoginPage: require(routePath('auth', 'login')),
+  renderForgotPasswordPage: require(routePath('auth', 'forgot-password')),
+  renderResetPasswordPage: require(routePath('auth', 'reset-password')),
+  renderAcceptInvitePage: require(routePath('auth', 'accept-invite')),
+  renderEmailVerifiedPage: require(routePath('auth', 'email-verified')),
+  renderEmailVerificationErrorPage: require(routePath('auth', 'email-verification-error')),
   renderAccountPage: require(routePath('account', 'password')),
   renderSettingsPage: require(routePath('settings', 'index')),
   renderAboutPage: require(routePath('settings', 'about', 'index')),
   renderUsersPage: require(routePath('settings', 'users', 'list')),
+  renderInvitationsPage: require(routePath('settings', 'invitations', 'list')),
   renderUsersAddPage: require(routePath('settings', 'users', 'add')),
+  renderUsersInvitePage: require(routePath('settings', 'users', 'invite')),
   renderUsersEditPage: require(routePath('settings', 'users', 'edit')),
   renderDashboardPage: require(routePath('signage', 'dashboard', 'index')),
   renderConnectedClientsPage: require(routePath('signage', 'clients', 'list')),

src/web/public/adminlte/css/adminlte-colors.min.css

@@ -1,5 +1,5 @@
 @charset "UTF-8";/*!
- *   AdminLTE v4.8.5 — Extended color palette
+ *   AdminLTE v4.9.1 — Extended color palette
  *   Opt-in. Nothing here is in adminlte.css: load this sheet after it and you
  *   get fourteen additional colours (orange, amber, olive, teal, sky, indigo,
  *   violet, fuchsia, pink, navy, steel, slate, graphite, midnight) as `--bs-*`

src/web/public/adminlte/js/adminlte.min.js

@@ -1,5 +1,5 @@
 /*!
- * AdminLTE v4.3.1 (https://adminlte.io)
+ * AdminLTE v4.9.1 (https://adminlte.io)
  * Copyright 2014-2026 Colorlib <https://colorlib.com>
  * Licensed under MIT (https://github.com/ColorlibHQ/AdminLTE/blob/master/LICENSE)
  */

src/web/public/js/account/account-page.js

@@ -0,0 +1,56 @@
+(function () {
+  var currentPasswordInput = document.querySelector('[data-account-current-password]');
+  var profileFormInput = document.querySelector('[data-account-profile-current-password]');
+  var passwordFormInput = document.querySelector('[data-account-password-current-password]');
+  var profileForm = profileFormInput && profileFormInput.form;
+  var passwordForm = passwordFormInput && passwordFormInput.form;
+
+  if (!currentPasswordInput || !profileFormInput || !passwordFormInput || !profileForm || !passwordForm) {
+    return;
+  }
+
+  function syncCurrentPassword() {
+    profileFormInput.value = currentPasswordInput.value;
+    passwordFormInput.value = currentPasswordInput.value;
+  }
+
+  function clearCurrentPassword() {
+    currentPasswordInput.value = '';
+    currentPasswordInput.setCustomValidity('');
+    currentPasswordInput.removeAttribute('required');
+    profileFormInput.value = '';
+    passwordFormInput.value = '';
+    passwordForm.querySelectorAll('input[type="password"]').forEach(function (input) {
+      input.value = '';
+      input.setCustomValidity('');
+    });
+    profileForm.classList.remove('was-validated');
+    passwordForm.classList.remove('was-validated');
+  }
+
+  currentPasswordInput.addEventListener('input', syncCurrentPassword);
+  currentPasswordInput.addEventListener('input', function () {
+    currentPasswordInput.setCustomValidity('');
+  });
+  document.addEventListener('submit', function (event) {
+    if (event.target !== profileForm && event.target !== passwordForm) {
+      return;
+    }
+    if (!currentPasswordInput.value) {
+      event.preventDefault();
+      event.stopImmediatePropagation();
+      currentPasswordInput.setCustomValidity('Current password is required.');
+      currentPasswordInput.reportValidity();
+      return;
+    }
+    currentPasswordInput.setCustomValidity('');
+    syncCurrentPassword();
+  }, true);
+  passwordForm.addEventListener('submit', syncCurrentPassword);
+  document.addEventListener('web-async-save:success', function (event) {
+    if (event.detail && event.detail.form !== profileForm && event.detail.form !== passwordForm) {
+      return;
+    }
+    clearCurrentPassword();
+  });
+})();

src/web/public/js/dashboard/dashboard-page.js

@@ -72,9 +72,13 @@
     var allBlackout = hasClients && clients.every(function (client) {
       return Boolean(client && client.blackout);
     });
+    var isClientsMobile = Boolean(document.querySelector('.clients-screen-command-card'));
+    var useShortMobileLabels = isClientsMobile && window.innerWidth < 768;
 
     if (action === 'pause') {
-      var pauseLabel = allPaused ? 'Resume ' + (isAllScreens ? 'all clients' : 'screen') : 'Pause ' + (isAllScreens ? 'all clients' : 'screen');
+      var pauseLabel = useShortMobileLabels
+        ? (allPaused ? 'Resume' : 'Pause')
+        : (allPaused ? 'Resume ' + (isAllScreens ? 'all clients' : 'screen') : 'Pause ' + (isAllScreens ? 'all clients' : 'screen'));
       var pauseConfirm = allPaused ? 'Resume ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?' : 'Pause ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?';
       var pauseIcon = allPaused ? 'bi-play-fill' : 'bi-pause-fill';
       button.innerHTML = '<i class="bi ' + pauseIcon + ' me-1" aria-hidden="true"></i>' + escapeHtml(pauseLabel);
@@ -92,7 +96,9 @@
     }
 
     if (action === 'blackout') {
-      var blackoutLabel = allBlackout ? 'Restore ' + (isAllScreens ? 'all clients' : 'screen') : 'Blackout ' + (isAllScreens ? 'all clients' : 'screen');
+      var blackoutLabel = useShortMobileLabels
+        ? (allBlackout ? 'Restore' : 'Blackout')
+        : (allBlackout ? 'Restore ' + (isAllScreens ? 'all clients' : 'screen') : 'Blackout ' + (isAllScreens ? 'all clients' : 'screen'));
       var blackoutConfirm = allBlackout ? 'Restore ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?' : 'Blackout ' + (isAllScreens ? 'all connected clients' : selectedLabel) + '?';
       var blackoutIcon = allBlackout ? 'bi-eye' : 'bi-eye-slash';
       button.innerHTML = '<i class="bi ' + blackoutIcon + ' me-1" aria-hidden="true"></i>' + escapeHtml(blackoutLabel);
@@ -147,6 +153,9 @@
       }
 
       if (button) {
+        if (Boolean(document.querySelector('.clients-screen-command-card')) && window.innerWidth < 768) {
+          button.innerHTML = '<i class="bi bi-arrow-repeat me-1" aria-hidden="true"></i>Reload';
+        }
         button.setAttribute('aria-label', selectedName ? selectedName : 'Selected screen group');
       }
     });
@@ -372,7 +381,7 @@
     var connectionId = String(row.getAttribute('data-client-client-id') || row.getAttribute('data-client-id') || '').trim();
     var clientId = String(row.getAttribute('data-client-client-id') || '').trim();
     var playerBaseUrl = String(row.getAttribute('data-client-player-base-url') || '').trim();
-    var clientNameCell = row.querySelector('td[data-label="Client"] > div');
+    var clientNameCell = row.querySelector('td[data-label="Client"] > div, [data-mobile-client-name]');
     var clientName = String(clientNameCell && clientNameCell.textContent || '').trim();
     var options = Array.prototype.slice.call(elements.targetSelect.options || []);
 
@@ -826,7 +835,7 @@
     if (typeof elements.modal.addEventListener === 'function') {
       elements.modal.addEventListener('show.bs.modal', function (event) {
         var trigger = event && event.relatedTarget ? event.relatedTarget : null;
-        var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key]') : null;
+        var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key], article[data-mobile-client-key]') : null;
         if (row) {
           updateClientMoveModalFromRow(row);
         }
@@ -843,7 +852,7 @@
         event.preventDefault();
       }
 
-      var row = moveButton.closest ? moveButton.closest('tr[data-client-key]') : null;
+      var row = moveButton.closest ? moveButton.closest('tr[data-client-key], article[data-mobile-client-key]') : null;
       if (!row) {
         return;
       }
@@ -1038,6 +1047,60 @@
     blackoutButton.setAttribute('aria-label', label);
   }
 
+  function updateMobileClientCards(state) {
+    document.querySelectorAll('[data-mobile-client-id]').forEach(function (card) {
+      var id = String(card.getAttribute('data-mobile-client-id') || '').trim();
+      var clientId = String(card.getAttribute('data-mobile-client-client-id') || '').trim();
+      var client = (state.clients || []).find(function (candidate) {
+        return String(candidate.id || '').trim() === id || String(candidate.clientId || '').trim() === clientId;
+      });
+      if (!client) {
+        return;
+      }
+      var paused = Boolean(client.paused);
+      var blackout = Boolean(client.blackout);
+      var badge = card.querySelector('.badge');
+      var heading = card.querySelector('h4');
+      var details = card.querySelectorAll('.clients-mobile-client-details strong');
+      var pauseButton = card.querySelector('button[type="submit"].btn-info');
+      var blackoutButton = card.querySelector('button[type="submit"].btn-secondary, button[type="submit"].btn-success');
+      card.setAttribute('data-client-screen-slug', client.screen_slug || '');
+      card.setAttribute('data-client-client-id', client.clientId || client.id || '');
+      card.setAttribute('data-client-player-base-url', client.player_url || '');
+      card.classList.toggle('card-warning', paused);
+      card.classList.toggle('card-primary', !paused);
+      if (badge) {
+        badge.className = 'badge ' + (blackout ? 'text-bg-secondary' : paused ? 'text-bg-warning' : 'text-bg-success');
+        badge.textContent = blackout ? 'Blackout' : paused ? 'Paused' : 'Live';
+      }
+      if (heading) {
+        heading.textContent = client.client_name || 'Unknown';
+      }
+      if (details[0]) {
+        details[0].textContent = client.screen_name || client.screen_slug || 'Unknown';
+      }
+      if (details[1]) {
+        details[1].textContent = client.currentSlideTitle || 'No slide currently showing';
+      }
+      if (pauseButton) {
+        pauseButton.innerHTML = '<i class="bi ' + (paused ? 'bi-play-fill' : 'bi-pause-fill') + ' me-1" aria-hidden="true"></i>' + (paused ? 'Resume' : 'Pause');
+      }
+      if (blackoutButton) {
+        blackoutButton.innerHTML = '<i class="bi ' + (blackout ? 'bi-eye' : 'bi-eye-slash') + ' me-1" aria-hidden="true"></i>' + (blackout ? 'Restore' : 'Blackout');
+        blackoutButton.className = 'btn btn-sm ' + (blackout ? 'btn-success' : 'btn-secondary') + ' w-100';
+      }
+      card.querySelectorAll('form').forEach(function (form) {
+        var connectionInput = form.querySelector('input[name="connectionId"]');
+        var baseUrlInput = form.querySelector('input[name="playerBaseUrl"]');
+        if (connectionInput) connectionInput.value = client.clientId || client.id || '';
+        if (baseUrlInput) baseUrlInput.value = client.player_url || '';
+        form.action = '/clients/' + encodeURIComponent(client.screen_slug || '') + '/commands';
+        var blackoutInput = form.querySelector('input[name="blackout"]');
+        if (blackoutInput) blackoutInput.value = blackout ? 'false' : 'true';
+      });
+    });
+  }
+
   function handleDashboardState(state) {
     if (!state) {
       return;
@@ -1047,6 +1110,7 @@
     updateStats(state);
     updateScreenGrid(state);
     updateClientTable(state);
+    updateMobileClientCards(state);
     updateKioskLauncherModal(state);
     updateDashboardQuickActions(state);
     updateScreenCommandControls();
@@ -1142,10 +1206,24 @@
       return;
     }
 
+    document.querySelectorAll('article[data-mobile-client-key] .clients-mobile-client-actions').forEach(function (actions) {
+      if (actions.querySelector('button[data-action="move-screen"]')) {
+        return;
+      }
+      var button = document.createElement('button');
+      button.type = 'button';
+      button.className = 'btn btn-sm btn-danger';
+      button.setAttribute('data-action', 'move-screen');
+      button.setAttribute('aria-label', 'Change screen');
+      button.setAttribute('title', 'Change screen');
+      button.innerHTML = '<i class="bi bi-display" aria-hidden="true"></i>';
+      actions.insertBefore(button, actions.children[1] || null);
+    });
+
     if (typeof elements.modal.addEventListener === 'function') {
       elements.modal.addEventListener('show.bs.modal', function (event) {
         var trigger = event && event.relatedTarget ? event.relatedTarget : null;
-        var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key]') : null;
+        var row = trigger && trigger.closest ? trigger.closest('tr[data-client-key], article[data-mobile-client-key]') : null;
         if (row) {
           updateClientMoveModalFromRow(row);
         }
@@ -1162,7 +1240,7 @@
         event.preventDefault();
       }
 
-      var row = moveButton.closest ? moveButton.closest('tr[data-client-key]') : null;
+      var row = moveButton.closest ? moveButton.closest('tr[data-client-key], article[data-mobile-client-key]') : null;
       if (!row) {
         return;
       }

src/web/public/js/data-sources/api-source-form.js

@@ -7,6 +7,7 @@
   }
 
   var methodSelect = form.querySelector('[data-api-source-auth-method]');
+  var authCard = form.querySelector('[data-api-source-auth-card]');
   var authDetailsSection = form.querySelector('[data-api-source-auth-details-section]');
   var panels = Array.prototype.slice.call(form.querySelectorAll('[data-api-source-auth-panel]'));
   var bearerTokenInput = form.querySelector('[data-api-source-bearer-token-input]');
@@ -36,10 +37,20 @@
     bearerTokenInput.focus();
   }
 
-  function updatePanels() {
+  function updatePanels(shouldExpandAuth) {
     var method = String(methodSelect && methodSelect.value || 'none').trim();
     var hasAuth = method !== 'none';
 
+    if (authCard) {
+      authCard.hidden = !hasAuth;
+      if (shouldExpandAuth && hasAuth && authCard.classList.contains('collapsed-card')) {
+        var collapseButton = authCard.querySelector('[data-lte-toggle="card-collapse"]');
+        if (collapseButton) {
+          collapseButton.click();
+        }
+      }
+    }
+
     if (authDetailsSection) {
       authDetailsSection.hidden = !hasAuth;
     }
@@ -60,7 +71,9 @@
   }
 
   if (methodSelect) {
-    methodSelect.addEventListener('change', updatePanels);
+    methodSelect.addEventListener('change', function () {
+      updatePanels(true);
+    });
   }
 
   if (requestMethodSelect) {
@@ -72,6 +85,6 @@
     updateBearerTokenToggle();
   }
 
-  updatePanels();
+  updatePanels(false);
   updateRequestBodyVisibility();
 }());

src/web/public/js/regions/type/api.js

@@ -106,6 +106,9 @@
       }
 
       var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression);
+      if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) {
+        return placeholderUtils.renderProgressPlaceholder(item, expression);
+      }
       if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) {
         var imageSource = placeholderUtils.formatPlaceholderValue(resolved);
         if (!/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/])/i.test(imageSource)) {
@@ -164,8 +167,11 @@
         '<div class="offcanvas-body">' +
           '<p class="small text-body-secondary">Placeholders read values from the selected API item. Nested fields use dots.</p>' +
           (window.placeholderInfo ? window.placeholderInfo.renderTextTransforms() : '') +
+          (window.placeholderInfo ? window.placeholderInfo.renderMathTransforms() : '') +
           (window.placeholderInfo ? window.placeholderInfo.renderDateFormatTokens() : '') +
           (window.placeholderInfo ? window.placeholderInfo.renderImageTransform() : '') +
+          '<h3 class="fs-6 mt-4 fw-normal">Progress bar</h3>' +
+          '<p class="small">Use <code>{{progress(current,total,success,light,striped,animated,textless)}}</code> to render a configurable bar, or use start and end date/time fields such as <code>{{progress(start_datetime,end_datetime)}}</code> to show elapsed time. The first color controls the bar and the second controls its background. Choose AdminLTE or announcement colors such as <code>orange</code> or <code>midnight</code>, a hex color, <code>striped</code>, <code>animated</code>, or <code>textless</code> in any order. Set the radius with <code>square</code>, <code>pill</code>, or <code>radius(12px)</code>. The bar height follows the API region text size, and all options after the two field paths are optional.</p>' +
         '</div>' +
       '</div>';
   }

src/web/public/js/regions/type/rss.js

@@ -125,6 +125,9 @@
         return '';
       }
       var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression);
+      if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) {
+        return placeholderUtils.renderProgressPlaceholder(item, expression);
+      }
       if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) {
         var imageSource = placeholderUtils.formatPlaceholderValue(resolved);
         if (!/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/])/i.test(imageSource)) {
@@ -224,6 +227,7 @@
       '<h3 class="fs-6 mt-4 fw-normal">Placeholder paths</h3>' +
       '<p class="small">Nested values use dots. Missing values render as empty text.</p>' +
       (window.placeholderInfo ? window.placeholderInfo.renderTextTransforms() : '') +
+      (window.placeholderInfo ? window.placeholderInfo.renderMathTransforms() : '') +
       '<h3 class="fs-6 mt-4 fw-normal">Date formatting</h3>' +
       '<p class="small">Use <code>format("MMM D, YYYY")</code> with date fields. Use <code>tz()</code> for a short timezone name and <code>tz_long()</code> for the full timezone name.</p>' +
       (window.placeholderInfo ? window.placeholderInfo.renderDateFormatTokens() : '') +

src/web/public/js/regions/type/timetable.js

@@ -140,6 +140,9 @@
 
     if (placeholderUtils && typeof placeholderUtils.resolvePlaceholderExpression === 'function' && typeof placeholderUtils.formatPlaceholderValue === 'function') {
       return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {
+        if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(expression)) {
+          return placeholderUtils.renderProgressPlaceholder(context, expression);
+        }
         return escapeHtml(placeholderUtils.formatPlaceholderValue(placeholderUtils.resolvePlaceholderExpression(context, expression)));
       });
     }
@@ -248,6 +251,7 @@
       '<h3 class="fs-6 mt-4 fw-normal">Placeholder paths</h3>' +
       '<p class="small">Use the available field chips. Nested values use dots, and missing values render as empty text.</p>' +
       window.placeholderInfo.renderTextTransforms() +
+      window.placeholderInfo.renderMathTransforms() +
       '<h3 class="fs-6 mt-4 fw-normal">Date and time formatting</h3>' +
       '<p class="small">Use <code>format("MMM D, YYYY h:mm A")</code> with date fields. Use <code>tz()</code> for a short timezone name and <code>tz_long()</code> for the full timezone name.</p>' +
       window.placeholderInfo.renderDateFormatTokens() +

src/web/public/js/regions/type/weather.js

@@ -114,6 +114,9 @@
       if (!value || typeof value !== 'object' || typeof placeholderUtils.resolvePlaceholderExpression !== 'function' || typeof placeholderUtils.formatPlaceholderValue !== 'function') return '';
       var rawExpression = String(expression).trim();
       var normalizedExpression = normalizeWeatherExpression(rawExpression);
+      if (typeof placeholderUtils.isProgressPlaceholderExpression === 'function' && placeholderUtils.isProgressPlaceholderExpression(rawExpression)) {
+        return placeholderUtils.renderProgressPlaceholder(value, rawExpression);
+      }
       var iconMatch = normalizedExpression.match(/^(?:current\.weather_code|daily\.weather_code\.\d+|hourly\.weather_code\.\d+)\.icon(?:\((\d+)(?:\s*,\s*(\d+))?\))?$/);
       if (iconMatch) {
         var codeExpression = normalizedExpression.replace(/\.icon(?:\(.*\))?$/, '');
@@ -137,6 +140,7 @@
         '<div class="offcanvas-body"><p class="small text-body-secondary">Placeholders read values from the selected weather snapshot. Nested fields use dots.</p>' +
           '<h3 class="h6 mt-3">Weather icons</h3><p class="small text-body-secondary">Use the icon property to insert a Bootstrap weather icon. Add width and height in pixels when sizing is needed.</p><ul class="small"><li><code>{{current.icon}}</code></li><li><code>{{current.icon(48,48)}}</code></li><li><code>{{daily.0.icon(32,24)}}</code></li></ul>' +
           (window.placeholderInfo ? window.placeholderInfo.renderTextTransforms() : '') +
+          (window.placeholderInfo ? window.placeholderInfo.renderMathTransforms() : '') +
           (window.placeholderInfo ? window.placeholderInfo.renderDateFormatTokens() : '') +
         '</div>' +
       '</div>';

src/web/public/js/settings/settings-page.js

@@ -384,9 +384,111 @@
     setActiveSection(initialSection);
   }
 
+  function initEmailTemplatePreviews() {
+    var previewUser = document.querySelector('[data-email-preview-user]');
+    var signedInUser = {
+      username: previewUser ? previewUser.getAttribute('data-username') : '',
+      display_name: previewUser ? previewUser.getAttribute('data-display-name') : '',
+      email: previewUser ? previewUser.getAttribute('data-email') : '',
+      verification_expiry: previewUser ? previewUser.getAttribute('data-verification-expiry') : '30',
+      reset_expiry: previewUser ? previewUser.getAttribute('data-reset-expiry') : '30',
+      invitation_expiry: previewUser ? previewUser.getAttribute('data-invitation-expiry') : '24'
+    };
+    document.querySelectorAll('[data-email-template-editor]').forEach(function (editor) {
+      var subject = editor.querySelector('[data-email-template-subject]');
+      var body = editor.querySelector('[data-email-template-body]');
+      var alignment = editor.querySelector('[data-email-template-alignment]');
+      var buttonText = editor.querySelector('[data-email-template-button-text]');
+      var preview = editor.querySelector('[data-email-template-preview]');
+      if (!subject || !body || !preview) return;
+      var isVerificationTemplate = Boolean(editor.querySelector('[name="verification_subject"]'));
+      var isResetTemplate = Boolean(editor.querySelector('[name="reset_subject"]'));
+      var isInvitationTemplate = Boolean(editor.querySelector('[name="invitation_subject"]'));
+
+      function render() {
+        preview.innerHTML = '';
+        var shell = document.createElement('div');
+        shell.className = 'email-template-preview__shell';
+        var brand = document.createElement('div');
+        brand.className = 'email-template-preview__brand';
+        brand.textContent = 'Pulse Signage';
+        var message = document.createElement('div');
+        message.className = 'email-template-preview__message';
+        var sampleValues = {
+          username: signedInUser.username || 'username',
+          display_name: signedInUser.display_name || signedInUser.username || 'Your name',
+          email: signedInUser.email || 'your-email@example.com',
+          expiry_time: isInvitationTemplate ? signedInUser.invitation_expiry + ' hours' : (isResetTemplate ? signedInUser.reset_expiry : signedInUser.verification_expiry) + ' minutes'
+        };
+        var button = document.createElement('div');
+        button.className = 'email-template-preview__button';
+        var buttonAlignment = alignment ? alignment.value : 'center';
+        var buttonWrap = document.createElement('div');
+        buttonWrap.className = 'email-template-preview__button-wrap';
+        buttonWrap.style.textAlign = buttonAlignment;
+        buttonWrap.appendChild(button);
+        var previewActionPlaceholder = '[[url]]';
+        button.textContent = buttonText && buttonText.value ? buttonText.value : (isVerificationTemplate ? 'Verify email address' : (isInvitationTemplate ? 'Accept invitation' : 'Reset password'));
+        var previewOrigin = window.location.origin || 'https://pulse-signage.example';
+        var previewVerificationUrl = previewOrigin + '/verify-email?token=preview-token';
+        var previewResetUrl = previewOrigin + '/reset-password?token=preview-token';
+        var previewActionUrl = isVerificationTemplate ? previewVerificationUrl : (isInvitationTemplate ? previewOrigin + '/accept-invite?token=preview-token' : previewResetUrl);
+        var hasExplicitButton = body.value.indexOf('[[action_button]]') !== -1;
+        body.value.split(/\r?\n(?:[ \t]*\r?\n)+/).forEach(function (sourceParagraph) {
+          var line = sourceParagraph.replace(/\[\[(username|display_name|email|expiry_time)\]\]/g, function (_match, key) { return sampleValues[key]; }).replace(previewActionPlaceholder, previewActionUrl);
+          var hasButtonToken = sourceParagraph.indexOf('[[action_button]]') !== -1;
+          var hasUrlToken = !hasExplicitButton && sourceParagraph.indexOf(previewActionPlaceholder) !== -1;
+          if (hasButtonToken) {
+            var buttonParts = line.split('[[action_button]]');
+            if (buttonParts[0]) appendPreviewParagraph(buttonParts[0]);
+            message.appendChild(buttonWrap);
+            if (buttonParts[1]) appendPreviewParagraph(buttonParts[1]);
+            return;
+          }
+          if (hasUrlToken) {
+            var legacyParts = sourceParagraph.split(previewActionPlaceholder);
+            if (legacyParts[0]) appendPreviewParagraph(legacyParts[0]);
+            message.appendChild(buttonWrap);
+            appendPreviewParagraph(previewActionUrl + legacyParts[1]);
+            return;
+          }
+          appendPreviewParagraph(line);
+        });
+        function appendPreviewParagraph(line) {
+          var paragraph = document.createElement('p');
+          paragraph.innerHTML = (line || '\u00a0').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\r?\n/g, '<br>').replace(/(https?:\/\/[^\s<]+)/g, '<a href="$1">$1</a>').replace(/\[b\]([\s\S]*?)\[\/b\]/gi, '<strong>$1</strong>').replace(/\[i\]([\s\S]*?)\[\/i\]/gi, '<em>$1</em>').replace(/\[u\]([\s\S]*?)\[\/u\]/gi, '<u>$1</u>');
+          message.appendChild(paragraph);
+        }
+        preview.appendChild(brand);
+        shell.appendChild(message);
+        preview.appendChild(shell);
+      }
+
+      subject.addEventListener('input', render);
+      body.addEventListener('input', render);
+      if (alignment) alignment.addEventListener('change', render);
+      if (buttonText) buttonText.addEventListener('input', render);
+      editor.querySelectorAll('[data-email-format]').forEach(function (formatButton) {
+        formatButton.addEventListener('click', function () {
+          var tag = formatButton.getAttribute('data-email-format');
+          var start = body.selectionStart;
+          var end = body.selectionEnd;
+          var selected = body.value.slice(start, end) || 'text';
+          var markerPattern = new RegExp('^\\[' + tag + '\\]([\\s\\S]*)\\[\\/' + tag + '\\]$');
+          var replacement = markerPattern.test(selected) ? markerPattern.exec(selected)[1] : '[' + tag + ']' + selected + '[/' + tag + ']';
+          body.setRangeText(replacement, start, end, 'select');
+          body.dispatchEvent(new Event('input', { bubbles: true }));
+          body.focus();
+        });
+      });
+      render();
+    });
+  }
+
   document.addEventListener('DOMContentLoaded', function () {
     initIconSuggestions();
     initDefaultAnnouncementIconPicker();
     initSettingsSectionNavigation();
+    initEmailTemplatePreviews();
   });
 }());

src/web/public/js/shared/placeholder-info.js

@@ -36,6 +36,11 @@
       '</dl>';
   }
 
+  function renderMathTransforms() {
+    return '<h3 class="fs-6 mt-4 fw-normal">Math transforms</h3>' +
+      '<p class="small">Use <code>add(number)</code>, <code>subtract(number)</code>, <code>multiply(number)</code>, or <code>divide(number)</code>, for example <code>{{amount.multiply(10)}}</code>. Transforms can be chained, such as <code>{{amount.add(3).multiply(10)}}</code>.</p>';
+  }
+
   function renderDateFormatTokens() {
     return '<h3 class="fs-6 mt-4 fw-normal">Date format tokens</h3>' +
       '<p class="small">Use the <code>format("...")</code> transform with these tokens. Text inside square brackets is treated as a literal.</p>' +
@@ -61,6 +66,7 @@
     escapeHtml: escapeHtml,
     render: render,
     renderTextTransforms: renderTextTransforms,
+    renderMathTransforms: renderMathTransforms,
     renderDateFormatTokens: renderDateFormatTokens,
     renderImageTransform: renderImageTransform
   };

src/web/public/js/shared/placeholder-utils.js

@@ -27,9 +27,30 @@
     return current === undefined || current === null ? '' : current;
   }
 
+  function splitExpressionSegments(value) {
+    var segments = [];
+    var current = '';
+    var depth = 0;
+    String(value || '').split('').forEach(function (character) {
+      if (character === '(') {
+        depth += 1;
+      } else if (character === ')' && depth > 0) {
+        depth -= 1;
+      }
+      if (character === '.' && depth === 0) {
+        segments.push(current);
+        current = '';
+        return;
+      }
+      current += character;
+    });
+    segments.push(current);
+    return segments;
+  }
+
   function parsePlaceholderExpression(expression) {
     var raw = String(expression || '').trim();
-    var segments = raw ? raw.split('.') : [];
+    var segments = raw ? splitExpressionSegments(raw) : [];
     var transforms = [];
 
     while (segments.length) {
@@ -57,13 +78,33 @@
     if (!source) {
       return [];
     }
-
-    if ((source[0] === '"' && source[source.length - 1] === '"') || (source[0] === '\'' && source[source.length - 1] === '\'')) {
-      return [source.slice(1, -1)];
+    var args = [];
+    var current = '';
+    var quote = '';
+    source.split('').forEach(function (character) {
+      if ((character === '"' || character === '\'') && (!quote || quote === character)) {
+        quote = quote ? '' : character;
+        current += character;
+        return;
+      }
+      if (character === ',' && !quote) {
+        if (current.trim()) {
+          args.push(current.trim());
+        }
+        current = '';
+        return;
+      }
+      current += character;
+    });
+    if (current.trim()) {
+      args.push(current.trim());
     }
-
-    return source.split(',').map(function (item) {
-      return String(item || '').trim();
+    return args.map(function (item) {
+      var normalized = String(item || '').trim();
+      if ((normalized[0] === '"' && normalized[normalized.length - 1] === '"') || (normalized[0] === '\'' && normalized[normalized.length - 1] === '\'')) {
+        return normalized.slice(1, -1);
+      }
+      return normalized;
     }).filter(Boolean);
   }
 
@@ -253,6 +294,26 @@
     return resolveTimeZone((args && args[0]) || (options && options.timeZone) || '');
   }
 
+  function toNumericValue(value) {
+    if (value && typeof value === 'object') {
+      var numericKeys = ['value', 'amount', 'current', 'total', 'goal', 'raised'];
+      for (var keyIndex = 0; keyIndex < numericKeys.length; keyIndex += 1) {
+        var nestedValue = value[numericKeys[keyIndex]];
+        if (nestedValue !== undefined && nestedValue !== null && nestedValue !== value) {
+          var nestedNumber = toNumericValue(nestedValue);
+          if (Number.isFinite(nestedNumber)) {
+            return nestedNumber;
+          }
+        }
+      }
+      return NaN;
+    }
+
+    var normalized = String(value === undefined || value === null ? '' : value).replace(/[^0-9.eE+-]/g, '');
+    var number = Number(normalized);
+    return Number.isFinite(number) ? number : NaN;
+  }
+
   function applyTransform(value, transform, options) {
     var text = String(value === undefined || value === null ? '' : value);
     var name = String(transform && transform.name || '').trim().toLowerCase();
@@ -284,6 +345,18 @@
       return getTimeZoneLongName(getTransformTimeZone(args, options));
     }
 
+    if (name === 'add' || name === 'subtract' || name === 'multiply' || name === 'divide') {
+      var arithmeticValue = toNumericValue(value);
+      var operand = toNumericValue(args[0]);
+      if (!Number.isFinite(arithmeticValue) || !Number.isFinite(operand) || (name === 'divide' && operand === 0)) {
+        return value;
+      }
+      if (name === 'add') return arithmeticValue + operand;
+      if (name === 'subtract') return arithmeticValue - operand;
+      if (name === 'multiply') return arithmeticValue * operand;
+      return arithmeticValue / operand;
+    }
+
     return text;
   }
 
@@ -319,6 +392,147 @@
     };
   }
 
+  function isProgressPlaceholderExpression(expression) {
+    var parsed = parsePlaceholderExpression(expression);
+    return parsed.transforms.some(function (transform) {
+      return transform && transform.name === 'progress';
+    });
+  }
+
+  function renderProgressPlaceholder(value, expression) {
+    var parsed = parsePlaceholderExpression(expression);
+    var transform = parsed.transforms.find(function (candidate) {
+      return candidate && candidate.name === 'progress';
+    });
+    if (!transform || !value || typeof value !== 'object' || transform.args.length < 2) {
+      return '';
+    }
+
+    function toNumber(raw) {
+      if (raw && typeof raw === 'object') {
+        var numericKeys = ['value', 'amount', 'current', 'total', 'goal', 'raised'];
+        for (var keyIndex = 0; keyIndex < numericKeys.length; keyIndex += 1) {
+          var nestedValue = raw[numericKeys[keyIndex]];
+          if (nestedValue !== undefined && nestedValue !== null && nestedValue !== raw) {
+            var nestedNumber = toNumber(nestedValue);
+            if (Number.isFinite(nestedNumber)) {
+              return nestedNumber;
+            }
+          }
+        }
+        return 0;
+      }
+      var normalized = String(raw === undefined || raw === null ? '' : raw).replace(/[^0-9.eE+-]/g, '');
+      var number = Number(normalized);
+      return Number.isFinite(number) ? number : 0;
+    }
+
+    function resolveProgressValue(argument) {
+      var raw = String(argument === undefined || argument === null ? '' : argument).trim();
+      var literal = raw.replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/, '$1$2');
+      if (/^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i.test(literal)) {
+        return literal;
+      }
+      return resolvePath(value, raw);
+    }
+
+    var startValue = resolveProgressValue(transform.args[0]);
+    var endValue = resolveProgressValue(transform.args[1]);
+    var startDate = startValue instanceof Date ? startValue : new Date(startValue);
+    var endDate = endValue instanceof Date ? endValue : new Date(endValue);
+    var percentage;
+    if (typeof startValue === 'string' && typeof endValue === 'string' && /[-T]/.test(startValue) && /[-T]/.test(endValue) && !Number.isNaN(startDate.getTime()) && !Number.isNaN(endDate.getTime()) && endDate.getTime() > startDate.getTime()) {
+      percentage = Math.max(0, Math.min(100, ((Date.now() - startDate.getTime()) / (endDate.getTime() - startDate.getTime())) * 100));
+    } else {
+      var current = toNumber(startValue);
+      var goal = toNumber(endValue);
+      percentage = goal > 0 ? Math.max(0, Math.min(100, (current / goal) * 100)) : 0;
+    }
+    var roundedPercentage = Math.round(percentage * 10) / 10;
+    var label = roundedPercentage + '%';
+    var variants = ['primary', 'secondary', 'success', 'danger', 'warning', 'info', 'light', 'dark'];
+    var variantColors = {
+      primary: '#0d6efd',
+      secondary: '#6c757d',
+      success: '#198754',
+      danger: '#dc3545',
+      warning: '#ffc107',
+      info: '#0dcaf0',
+      light: '#f8f9fa',
+      dark: '#212529'
+    };
+    var announcementColors = {
+      orange: '#c84e10',
+      amber: '#a56710',
+      olive: '#5f7f0f',
+      teal: '#12827d',
+      sky: '#127caf',
+      indigo: '#6f60ea',
+      violet: '#9553db',
+      fuchsia: '#b347be',
+      pink: '#cd388d',
+      navy: '#1d2d4c',
+      steel: '#3a4860',
+      slate: '#566577',
+      graphite: '#32363c',
+      midnight: '#1e1d2d'
+    };
+    var variant = 'primary';
+    var barVariant = '';
+    var customColor = '';
+    var backgroundColor = '';
+    var colorCount = 0;
+    var modifiers = [];
+    var textless = false;
+    var borderRadius = 'var(--bs-border-radius)';
+    transform.args.slice(2).forEach(function (argument) {
+      var option = String(argument || '').trim().toLowerCase();
+      var isNamedColor = variants.indexOf(option) !== -1 || Object.prototype.hasOwnProperty.call(announcementColors, option);
+      var isHexColor = /^#[0-9a-f]{3}(?:[0-9a-f]{3})?$/i.test(option);
+      if (isNamedColor || isHexColor) {
+        var color = isHexColor ? option : (variantColors[option] || announcementColors[option]);
+        if (colorCount === 0) {
+          if (variants.indexOf(option) !== -1) {
+            variant = option;
+            barVariant = option;
+          }
+          customColor = color;
+        } else if (colorCount === 1) {
+          backgroundColor = color;
+        }
+        colorCount += 1;
+      }
+      if (option === 'striped' || option === 'animated') {
+        modifiers.push('progress-bar-' + option);
+      }
+      if (option === 'textless') {
+        textless = true;
+      }
+      if (option === 'square') {
+        borderRadius = '0';
+      } else if (option === 'pill') {
+        borderRadius = '50rem';
+      } else if (option === 'rounded') {
+        borderRadius = 'var(--bs-border-radius)';
+      } else {
+        var radiusMatch = option.match(/^radius\((0|[0-9]+(?:\.[0-9]+)?(?:px|rem|em|%)?)\)$/);
+        if (radiusMatch) {
+          borderRadius = radiusMatch[1];
+        }
+      }
+    });
+    var progressClass = 'progress';
+    var barClass = 'progress-bar' + (barVariant ? ' bg-' + barVariant : '') + (modifiers.length ? ' ' + modifiers.join(' ') : '');
+    var barStyle = 'width:' + roundedPercentage + '%;color:inherit;';
+    if (customColor) {
+      barStyle += 'background-color:' + customColor + ';';
+    }
+    var progressStyleValue = (backgroundColor ? 'background-color:' + backgroundColor + ';' : '') + 'font-size:inherit;--bs-progress-font-size:inherit;--bs-progress-height:1em;height:1em;border-radius:' + borderRadius + ';';
+    var progressStyle = progressStyleValue ? ' style="' + progressStyleValue + '"' : '';
+    return '<span class="' + progressClass + ' api-progress"' + progressStyle + ' role="progressbar" aria-valuemin="0" aria-valuemax="100" aria-valuenow="' + roundedPercentage + '" aria-label="' + label + '">' +
+      '<span class="' + barClass + '" style="' + barStyle + '">' + (textless ? '' : label) + '</span></span>';
+  }
+
   function formatPlaceholderValue(value) {
     if (value === undefined || value === null) {
       return '';
@@ -372,6 +586,8 @@
     resolvePlaceholderExpression: resolvePlaceholderExpression,
     isImagePlaceholderExpression: isImagePlaceholderExpression,
     getImagePlaceholderConfig: getImagePlaceholderConfig,
+    isProgressPlaceholderExpression: isProgressPlaceholderExpression,
+    renderProgressPlaceholder: renderProgressPlaceholder,
     formatPlaceholderValue: formatPlaceholderValue,
     collectPlaceholderFieldPaths: collectPlaceholderFieldPaths
   };

src/web/public/js/slides/slide-form-regions.js

@@ -138,7 +138,7 @@ export function createSlideFormRegionHelpers(options) {
         ? placeholderChips.renderChip(field)
         : '<span class="chip">{{' + escapeHtml(field) + '}}</span>';
     }).join('');
-    var transformHint = includeTransformHint === false ? '' : '<div class="text-body-secondary small mt-1">Placeholder values support transforms, for example <code>{{title.upper()}}</code>, <code>{{title.title()}}</code>, <code>{{title.lower()}}</code>, <code>{{publishedAt.format("MMM D, YYYY")}}</code>.</div>';
+    var transformHint = includeTransformHint === false ? '' : '<div class="text-body-secondary small mt-1">Placeholder values support transforms, for example <code>{{title.upper()}}</code>, <code>{{title.title()}}</code>, <code>{{title.lower()}}</code>, <code>{{publishedAt.format("MMM D, YYYY")}}</code>, or <code>{{amount.multiply(10)}}</code>.</div>';
 
     if (!overflowFields.length) {
       return visibleMarkup + transformHint;

src/web/public/js/table/table-search.js

@@ -129,6 +129,26 @@
 
       input.value = String(currentUrl.searchParams.get(searchParam) || '').trim();
 
+      var searchGroup = input.closest('.table-search-group');
+      if (searchGroup) {
+        var actionButton = searchGroup.parentNode ? searchGroup.parentNode.querySelector('.btn:not(.table-search-group .btn)') : null;
+        if (actionButton && actionButton.getBoundingClientRect) {
+          searchGroup.style.setProperty('--table-search-action-offset', (actionButton.getBoundingClientRect().width + 8) + 'px');
+        }
+        var searchToggle = searchGroup.querySelector('[data-table-search-toggle]');
+        if (searchToggle) {
+          searchToggle.addEventListener('click', function () {
+            focusSearchInput(input);
+          });
+          searchToggle.addEventListener('keydown', function (event) {
+            if (event.key === 'Enter' || event.key === ' ') {
+              event.preventDefault();
+              focusSearchInput(input);
+            }
+          });
+        }
+      }
+
       function updateSearch() {
         var query = String(input.value || '').trim();
         var nextUrl = new URL(window.location.href);

src/web/routes/account/password.js

@@ -33,17 +33,22 @@ module.exports = function renderAccountPage(currentUser, message, returnUrl, all
       ? 'Use at least ' + requirements.minimumLength + ' characters and include uppercase, lowercase, number, and symbol.'
       : 'Use at least ' + requirements.minimumLength + ' characters and include ' + requirements.minimumCategories + ' of: uppercase, lowercase, number, and symbol.';
 
-  return renderView('account/password', {
+  return renderView('account/index', {
     title: 'My account',
     active: 'account',
     currentUser: currentUser || null,
     message: message || '',
     username: currentUser ? currentUser.username : '',
     name: currentUser ? String(currentUser.name || '') : '',
+    email: currentUser ? String(currentUser.email || '') : '',
+    emailPending: Boolean(currentUser && currentUser.pending_email),
+    pendingEmail: currentUser ? String(currentUser.pending_email || '') : '',
+    emailVerified: Boolean(currentUser && currentUser.email_verified_at),
     returnUrl: normalizeReturnUrl(returnUrl),
     allowUserSessionRevocation: Boolean(allowUserSessionRevocation),
     sessions: Array.isArray(sessions) ? sessions : [],
     passwordMinimumLength: requirements.minimumLength,
-    passwordRequirementsText: passwordRequirementsText
+    passwordRequirementsText: passwordRequirementsText,
+    scripts: ['js/account/account-page.js']
   });
 };

src/web/routes/admin/account.js

@@ -1,6 +1,8 @@
 // Admin account route registration and profile helpers.
 
 const { fetchAppSettings } = require('#src/data/app-settings');
+const { formatAccountEmailExpiry, renderAccountEmailTemplate } = require('#src/data/account-email-templates');
+const { formatUserAgentLabel } = require('#src/data/audit-log');
 
 module.exports = function registerAccountRoutes(app, deps) {
   const pool = deps.pool;
@@ -18,6 +20,8 @@ module.exports = function registerAccountRoutes(app, deps) {
   const hashSessionToken = deps.hashSessionToken;
   const sessionCookieName = deps.sessionCookieName;
   const recordRequestAuditEvent = deps.recordRequestAuditEvent;
+  const sendAccountEmail = deps.sendAccountEmail;
+  const createOneTimeToken = deps.createOneTimeToken;
 
   async function getPasswordRequirements() {
     const settings = await fetchAppSettings(pool);
@@ -43,6 +47,30 @@ module.exports = function registerAccountRoutes(app, deps) {
     };
   }
 
+  function getRequestOrigin(req) {
+    const forwardedProto = String(req.headers['x-forwarded-proto'] || req.protocol || 'http').split(',')[0].trim();
+    const forwardedHost = String(req.headers['x-forwarded-host'] || req.headers.host || '').split(',')[0].trim();
+    return forwardedHost ? forwardedProto + '://' + forwardedHost : '';
+  }
+
+  app.post('/account/email', async function (req, res, next) {
+    try {
+      const email = String(req.body.email || '').trim().toLowerCase();
+      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return res.status(400).send('Email address is invalid.');
+      const settings = await fetchAppSettings(pool);
+      if (!settings['email.smtp_enabled'] || typeof sendAccountEmail !== 'function') return res.status(400).send('Email delivery is not configured.');
+      const token = createOneTimeToken();
+      const expiryMinutes = Number(settings['email.verification_expiry_minutes']);
+      await pool.query('UPDATE a_users SET pending_email = ?, pending_email_token_hash = ?, pending_email_expires_at = DATE_ADD(NOW(), INTERVAL ' + expiryMinutes + ' MINUTE) WHERE id = ?', [email, hashSessionToken(token), req.currentUser.id]);
+      const url = getRequestOrigin(req) + '/verify-email?token=' + encodeURIComponent(token);
+      await sendAccountEmail(settings, Object.assign({ to: email }, renderAccountEmailTemplate(settings['email.verification_subject'], settings['email.verification_body'], { url: url, username: req.currentUser.username, display_name: req.currentUser.name, email: email, expiry_time: formatAccountEmailExpiry(expiryMinutes, 'minutes'), action_alignment: settings['email.verification_button_alignment'], action_label: settings['email.verification_button_text'] })));
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.email_change_requested', actorUserId: req.currentUser.id, targetType: 'user', targetId: req.currentUser.id, targetLabel: email });
+      res.redirect('/account?message=' + encodeURIComponent('Check your new email address for a verification link.'));
+    } catch (error) {
+      next(error);
+    }
+  });
+
   app.get('/account', function (req, res) {
     fetchAppSettings(pool).then(function (settings) {
       const passwordRequirements = buildPasswordRequirements(settings);
@@ -61,7 +89,7 @@ module.exports = function registerAccountRoutes(app, deps) {
             id: Number(session.id),
             isCurrent: Boolean(tokenHash && session.session_hash === tokenHash),
             ipAddress: String(session.ip_address || 'Unknown'),
-            userAgent: String(session.user_agent || 'Unknown browser'),
+            userAgent: formatUserAgentLabel(session.user_agent) || 'Unknown browser',
             createdAtLabel: formatDashboardDate(session.created_at),
             lastUsedAtLabel: formatDashboardDate(session.last_used_at),
             expiresAtLabel: formatDashboardDate(session.expires_at)
@@ -74,6 +102,53 @@ module.exports = function registerAccountRoutes(app, deps) {
     });
   });
 
+  app.post('/account/profile', async function (req, res, next) {
+    try {
+      const name = String(req.body.name || '').trim();
+      const username = common.validateMaxLength(req.body.username || '', 64, 'Username');
+      const email = String(req.body.email || '').trim().toLowerCase();
+      const currentPassword = String(req.body.current_password || '');
+      if (!name) return res.status(400).send('Name is required.');
+      if (!username) return res.status(400).send('Username is required.');
+      if (email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return res.status(400).send('Email address is invalid.');
+      if (!currentPassword) return res.status(400).send('Current password is required.');
+
+      const [rows] = await pool.query('SELECT id, username, name, email, password_hash, password_salt, password_iterations FROM a_users WHERE id = ? LIMIT 1', [req.currentUser.id]);
+      const user = rows[0] || null;
+      if (!user) return res.status(404).send('User not found.');
+      if (!verifyPassword(currentPassword, user)) return res.status(400).send('Current password is incorrect.');
+      if (username !== user.username && await common.fetchDuplicateName(pool, 'a_users', username, user.id, 'username')) return res.status(400).send('That username already exists.');
+      if (name !== user.name && await common.fetchDuplicateName(pool, 'a_users', name, user.id)) return res.status(400).send('That name already exists.');
+
+      const confirmedEmail = String(user.email || '').trim().toLowerCase();
+      const pendingEmail = String(user.pending_email || '').trim().toLowerCase();
+      const emailChanged = email !== confirmedEmail && email !== pendingEmail;
+      const pendingEmailCleared = Boolean(pendingEmail && email === confirmedEmail);
+      const settings = emailChanged ? await fetchAppSettings(pool) : null;
+      if (emailChanged && email && (!settings['email.smtp_enabled'] || typeof sendAccountEmail !== 'function')) return res.status(400).send('Email delivery is not configured.');
+
+      const actorId = getAuditUserId(req);
+      await pool.query('UPDATE a_users SET username = ?, name = ?, modified_by = ? WHERE id = ?', [username, name, actorId, user.id]);
+      if (emailChanged || pendingEmailCleared) {
+        if (!email) {
+          await pool.query('UPDATE a_users SET email = NULL, email_verified_at = NULL, pending_email = NULL, pending_email_token_hash = NULL, pending_email_expires_at = NULL WHERE id = ?', [user.id]);
+        } else if (pendingEmailCleared) {
+          await pool.query('UPDATE a_users SET pending_email = NULL, pending_email_token_hash = NULL, pending_email_expires_at = NULL WHERE id = ?', [user.id]);
+        } else {
+          const token = createOneTimeToken();
+          const expiryMinutes = Number(settings['email.verification_expiry_minutes']);
+          await pool.query('UPDATE a_users SET pending_email = ?, pending_email_token_hash = ?, pending_email_expires_at = DATE_ADD(NOW(), INTERVAL ' + expiryMinutes + ' MINUTE) WHERE id = ?', [email, hashSessionToken(token), user.id]);
+          const url = getRequestOrigin(req) + '/verify-email?token=' + encodeURIComponent(token);
+          await sendAccountEmail(settings, Object.assign({ to: email }, renderAccountEmailTemplate(settings['email.verification_subject'], settings['email.verification_body'], { url: url, username: req.currentUser.username, display_name: req.currentUser.name, email: email, expiry_time: formatAccountEmailExpiry(expiryMinutes, 'minutes'), action_alignment: settings['email.verification_button_alignment'], action_label: settings['email.verification_button_text'] })));
+        }
+      }
+      if (emailChanged && typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: email ? 'user.email_change_requested' : 'user.email_cleared', actorUserId: user.id, targetType: 'user', targetId: user.id, targetLabel: email || user.email, details: { previousEmail: confirmedEmail || null, email: email || null, verificationRequired: Boolean(email) } });
+      res.redirect('/account?message=' + encodeURIComponent(emailChanged && email ? 'Account details updated. Check your new email address for a verification link.' : 'Account details updated.'));
+    } catch (error) {
+      next(error);
+    }
+  });
+
   app.post('/account/sessions/:id/revoke', async function (req, res, next) {
     try {
       const sessionId = Number(req.params.id);
@@ -161,6 +236,26 @@ module.exports = function registerAccountRoutes(app, deps) {
     }
   });
 
+  app.post('/account/username', async function (req, res, next) {
+    try {
+      const username = common.validateMaxLength(req.body.username || '', 255, 'Username');
+      const currentPassword = String(req.body.current_password || '');
+      if (!username) return res.status(400).send('Username is required.');
+      if (!currentPassword) return res.status(400).send('Current password is required.');
+      const [rows] = await pool.query('SELECT id, username, password_hash, password_salt, password_iterations FROM a_users WHERE id = ? LIMIT 1', [req.currentUser.id]);
+      const user = rows[0] || null;
+      if (!user) return res.status(404).send('User not found.');
+      if (!verifyPassword(currentPassword, user)) return res.status(400).send('Current password is incorrect.');
+      const [existingRows] = await pool.query('SELECT id FROM a_users WHERE username = ? AND id <> ? LIMIT 1', [username, user.id]);
+      if (existingRows.length) return res.status(400).send('That username already exists.');
+      await pool.query('UPDATE a_users SET username = ?, modified_by = ? WHERE id = ?', [username, getAuditUserId(req), user.id]);
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.username_updated', actorUserId: user.id, targetType: 'user', targetId: user.id, targetLabel: username, details: { previousUsername: user.username, username: username } });
+      res.redirect('/account?message=' + encodeURIComponent('Username updated.'));
+    } catch (error) {
+      next(error);
+    }
+  });
+
   app.post('/account/password', async function (req, res, next) {
     try {
       const currentPassword = String(req.body.current_password || '');

src/web/routes/admin/client-commands.js

@@ -14,6 +14,21 @@ module.exports = function registerScreenCommandRoutes(app, deps) {
   const withClientNameReservation = deps.withClientNameReservation;
   const broadcastDashboardState = deps.broadcastDashboardState;
   const requirePermission = deps.requirePermission;
+  const recordRequestAuditEvent = deps.recordRequestAuditEvent;
+
+  async function recordScreenControlAudit(req, screenSlug, command, details) {
+    if (typeof recordRequestAuditEvent !== 'function') {
+      return;
+    }
+    await recordRequestAuditEvent(pool, req, {
+      category: 'screen-controls',
+      eventType: 'screen-control.' + command,
+      actorUserId: req.currentUser && req.currentUser.id,
+      targetType: screenSlug === '__all__' ? 'all-screens' : 'screen',
+      targetLabel: screenSlug === '__all__' ? 'All screens' : screenSlug,
+      details: details || {}
+    });
+  }
 
   function normalizeExplicitPlayerBaseUrl(value) {
     return String(value || '').trim().replace(/\/$/, '');
@@ -250,6 +265,13 @@ module.exports = function registerScreenCommandRoutes(app, deps) {
           await broadcastDashboardState();
         }
 
+        await recordScreenControlAudit(req, '__all__', command, {
+          targetScreenCount: targets.length,
+          targetPlayerCount: sentCount,
+          blackout: command === 'blackout' ? Boolean(commandPayload.blackout) : undefined,
+          paused: command === 'pause' ? Boolean(commandPayload.paused) : undefined
+        });
+
         return res.json({
           ok: true,
           allScreens: true,
@@ -364,6 +386,8 @@ module.exports = function registerScreenCommandRoutes(app, deps) {
               await broadcastDashboardState();
             }
 
+            await recordScreenControlAudit(req, slug, command, { clientName: selectedClientName, deviceId: deviceId });
+
             return res.json({
               screen: screenRows[0],
               screenSlug: slug,
@@ -386,6 +410,8 @@ module.exports = function registerScreenCommandRoutes(app, deps) {
             return res.status(404).json({ error: 'Client not found' });
           }
 
+          await recordScreenControlAudit(req, slug, command, { clientName: selectedClientName, deviceId: deviceId });
+
           return res.json({
             screen: screenRows[0],
             screenSlug: slug,
@@ -604,6 +630,13 @@ module.exports = function registerScreenCommandRoutes(app, deps) {
           await broadcastDashboardState();
         }
 
+        await recordScreenControlAudit(req, slug, command, {
+          connectionId: connectionId || null,
+          deviceId: physicalPlayerId,
+          targetScreenSlug: targetScreenSlug,
+          clientName: status ? status.client_name : resolvedClientName
+        });
+
         return res.json({
           screen: screenRows[0],
           screenSlug: slug,
@@ -645,6 +678,12 @@ module.exports = function registerScreenCommandRoutes(app, deps) {
         await broadcastDashboardState();
       }
 
+      await recordScreenControlAudit(req, slug, command, {
+        connectionId: connectionId || null,
+        blackout: command === 'blackout' ? Boolean(commandPayload.blackout) : undefined,
+        paused: command === 'pause' ? Boolean(commandPayload.paused) : undefined
+      });
+
       return res.json(Object.assign({
         screen: screenRows[0],
         screenSlug: slug,

src/web/routes/admin/users.js

@@ -1,7 +1,8 @@
 	// Admin user route registration and user-role management.
 
 	const { fetchAppSettings } = require('#src/data/app-settings');
-	const { buildAuditChanges } = require('#src/data/audit-log');
+	const { formatAccountEmailExpiry, renderAccountEmailTemplate } = require('#src/data/account-email-templates');
+	const { buildAuditChanges, formatUserAgentLabel } = require('#src/data/audit-log');
 
 	module.exports = function registerUsersRoutes(app, deps) {
 	const pool = deps.pool;
@@ -10,6 +11,10 @@
 	const formatDashboardDate = deps.formatDashboardDate;
 	const getAuditUserId = deps.getAuditUserId;
 	const recordRequestAuditEvent = deps.recordRequestAuditEvent;
+	const sendAccountEmail = deps.sendAccountEmail;
+	const createOneTimeToken = deps.createOneTimeToken;
+	const hashSessionToken = deps.hashSessionToken;
+	const getRequestOrigin = deps.getRequestOrigin;
 	const hashPassword = deps.hashPassword;
 	const validatePasswordStrength = deps.validatePasswordStrength;
 	const readArrayField = deps.readArrayField;
@@ -20,6 +25,8 @@
 
 	const USER_NAME_MAX_LENGTH = 255;
 	const USER_USERNAME_MAX_LENGTH = 255;
+	const USER_EMAIL_MAX_LENGTH = 320;
+	const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
 	const LIST_PAGE_SIZE = 25;
 
@@ -78,6 +85,23 @@
 		return { ok: true, roleIds: normalizedRoleIds };
 	}
 
+	function mapInvitationForView(invitation, roleNamesById) {
+		let roleIds = [];
+		try {
+			roleIds = JSON.parse(invitation.role_ids_json || '[]');
+		} catch (error) {
+			roleIds = [];
+		}
+		return Object.assign({}, invitation, {
+			roleNames: roleIds.map(function (roleId) {
+				return roleNamesById.get(Number(roleId));
+			}).filter(Boolean).join(', ') || 'No roles assigned',
+			createdAtLabel: formatDashboardDate(invitation.created_at),
+			expiresAtLabel: formatDashboardDate(invitation.expires_at),
+			createdByLabel: invitation.created_by_username || 'System'
+		});
+	}
+
 	app.get('/settings/users', requirePermission('users.read'), async function (req, res, next) {
 		try {
 			const page = Math.max(1, Math.floor(Number(req.query.page) || 1));
@@ -102,6 +126,77 @@
 		}
 	});
 
+	app.get('/settings/invitations', requirePermission('invitations.read'), async function (req, res, next) {
+		try {
+			const page = Math.max(1, Math.floor(Number(req.query.page) || 1));
+			const search = common.getSearchQuery(req);
+			const sort = common.getSortQuery(req);
+			const direction = common.getSortDirectionQuery(req);
+			const data = await rbacData.fetchInvitationsPage(pool, page, LIST_PAGE_SIZE, search, sort, direction);
+			const roles = await fetchRoleOptions();
+			const roleNamesById = new Map((roles || []).map(function (role) {
+				return [Number(role.id), role.name];
+			}));
+			const invitations = (data.invitations || []).map(function (invitation) {
+				return mapInvitationForView(invitation, roleNamesById);
+			});
+			res.send(pages.renderInvitationsPage({
+				invitations: invitations,
+				pagination: buildPagination(data.totalItems, data.currentPage, 'page', { search: search, sort: sort, direction: direction }, LIST_PAGE_SIZE, 'invitations', 'Invitation pages'),
+				message: req.query.message ? String(req.query.message) : ''
+			}, req.currentUser));
+		} catch (error) {
+			next(error);
+		}
+	});
+
+	app.post('/settings/invitations/:id/delete', requirePermission('invitations.delete'), async function (req, res, next) {
+		try {
+			const invitationId = Number(req.params.id);
+			if (!Number.isInteger(invitationId) || invitationId <= 0) {
+				return res.status(400).send('Invalid invitation.');
+			}
+			const [result] = await pool.query('DELETE FROM a_user_invitations WHERE id = ? AND used_at IS NULL', [invitationId]);
+			if (!result || !result.affectedRows) {
+				return res.status(404).send('Invitation not found.');
+			}
+			if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.invitation_deleted', actorUserId: getAuditUserId(req), targetType: 'invitation', targetId: invitationId });
+			res.redirect('/settings/invitations?message=' + encodeURIComponent('Invitation deleted.'));
+		} catch (error) {
+			next(error);
+		}
+	});
+
+	app.post('/settings/invitations/:id/resend', requirePermission('invitations.allow'), async function (req, res, next) {
+		try {
+			const invitationId = Number(req.params.id);
+			if (!Number.isInteger(invitationId) || invitationId <= 0) {
+				return res.status(400).send('Invalid invitation.');
+			}
+			if (typeof sendAccountEmail !== 'function' || typeof createOneTimeToken !== 'function' || typeof hashSessionToken !== 'function') {
+				return res.status(503).send('Email delivery is not available.');
+			}
+			const settings = await fetchAppSettings(pool);
+			if (!settings['email.smtp_enabled']) {
+				return res.status(503).send('Email delivery is not configured.');
+			}
+			const [rows] = await pool.query('SELECT email, name, role_ids_json FROM a_user_invitations WHERE id = ? AND used_at IS NULL AND expires_at > NOW() LIMIT 1', [invitationId]);
+			if (!rows.length) {
+				return res.status(404).send('Invitation not found.');
+			}
+			const invitation = rows[0];
+			const token = createOneTimeToken();
+			const invitationUrl = getRequestOrigin(req) + '/accept-invite?token=' + encodeURIComponent(token);
+			const expiryHours = Number(settings['email.invitation_expiry_hours']);
+			await sendAccountEmail(settings, Object.assign({ to: invitation.email }, renderAccountEmailTemplate(settings['email.invitation_subject'], settings['email.invitation_body'], { url: invitationUrl, username: '', display_name: invitation.name || 'there', email: invitation.email, expiry_time: formatAccountEmailExpiry(expiryHours, 'hours'), action_alignment: settings['email.invitation_button_alignment'], action_label: settings['email.invitation_button_text'] })));
+			await pool.query('UPDATE a_user_invitations SET token_hash = ?, expires_at = DATE_ADD(NOW(), INTERVAL ' + expiryHours + ' HOUR), created_at = NOW(), created_by = ? WHERE id = ? AND used_at IS NULL', [hashSessionToken(token), getAuditUserId(req), invitationId]);
+			if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.invitation_resent', actorUserId: getAuditUserId(req), targetType: 'invitation', targetId: invitationId, targetLabel: invitation.email });
+			res.redirect('/settings/invitations?message=' + encodeURIComponent('Invitation resent.'));
+		} catch (error) {
+			next(error);
+		}
+	});
+
 	app.get('/settings/users/new', requirePermission('users.create'), function (req, res) {
 		fetchRoleOptions().then(function (roles) {
 			res.send(pages.renderUsersAddPage(req.query.message ? String(req.query.message) : '', req.currentUser, mapRolesForForm(roles, []), {}, 'primary'));
@@ -110,6 +205,54 @@
 		});
 	});
 
+	app.get('/settings/users/invite', requirePermission('invitations.create'), async function (req, res, next) {
+		try {
+			const roles = await fetchRoleOptions();
+			res.send(pages.renderUsersInvitePage('', req.currentUser, mapRolesForForm(roles, []), {}, 'success'));
+		} catch (error) {
+			next(error);
+		}
+	});
+
+	app.post('/settings/users/invite', requirePermission('invitations.create'), async function (req, res, next) {
+		try {
+			const email = common.validateMaxLength(req.body.email || '', USER_EMAIL_MAX_LENGTH, 'Email').toLowerCase();
+			const name = common.validateMaxLength(req.body.name || '', USER_NAME_MAX_LENGTH, 'Name');
+			const selectedRoleIds = readArrayField(req.body, ['role_ids[]', 'role_ids']);
+			const roleCheck = await validateRoleIds(selectedRoleIds);
+			const formValues = { email: email, name: name };
+			async function renderInviteError(message) {
+				const roles = await fetchRoleOptions();
+				return res.status(400).send(pages.renderUsersInvitePage(message, req.currentUser, mapRolesForForm(roles, selectedRoleIds), formValues, 'warning'));
+			}
+			if (!email || !EMAIL_PATTERN.test(email)) return renderInviteError('Email address is invalid.');
+			if (!name) return renderInviteError('Display name is required.');
+			if (!roleCheck.ok) return renderInviteError(roleCheck.message);
+			if (typeof sendAccountEmail !== 'function' || typeof createOneTimeToken !== 'function' || typeof hashSessionToken !== 'function') return renderInviteError('Email delivery is not available.');
+			const settings = await fetchAppSettings(pool);
+			if (!settings['email.smtp_enabled']) return renderInviteError('Email delivery is not configured.');
+			const [existingUsers] = await pool.query('SELECT id FROM a_users WHERE email = ? OR pending_email = ? LIMIT 1', [email, email]);
+			if (existingUsers.length) return renderInviteError('That email address is already associated with an account.');
+			const [recentInvites] = await pool.query('SELECT COUNT(*) AS invite_count FROM a_user_invitations WHERE created_by = ? AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)', [getAuditUserId(req)]);
+			if (Number(recentInvites[0] && recentInvites[0].invite_count) >= 25) return renderInviteError('Invitation sending is temporarily limited. Try again later.');
+			const token = createOneTimeToken();
+			await pool.query('UPDATE a_user_invitations SET used_at = NOW() WHERE email = ? AND used_at IS NULL', [email]);
+			const expiryHours = Number(settings['email.invitation_expiry_hours']);
+			await pool.query('INSERT INTO a_user_invitations (email, name, role_ids_json, token_hash, expires_at, created_by) VALUES (?, ?, ?, ?, DATE_ADD(NOW(), INTERVAL ' + expiryHours + ' HOUR), ?)', [email, name || null, JSON.stringify(roleCheck.roleIds), hashSessionToken(token), getAuditUserId(req)]);
+			const invitationUrl = getRequestOrigin(req) + '/accept-invite?token=' + encodeURIComponent(token);
+			try {
+				await sendAccountEmail(settings, Object.assign({ to: email }, renderAccountEmailTemplate(settings['email.invitation_subject'], settings['email.invitation_body'], { url: invitationUrl, username: '', display_name: name || 'there', email: email, expiry_time: formatAccountEmailExpiry(expiryHours, 'hours'), action_alignment: settings['email.invitation_button_alignment'], action_label: settings['email.invitation_button_text'] })));
+			} catch (mailError) {
+				await pool.query('DELETE FROM a_user_invitations WHERE token_hash = ?', [hashSessionToken(token)]);
+				throw mailError;
+			}
+			if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.invitation_sent', actorUserId: getAuditUserId(req), targetType: 'email', targetLabel: email, details: { roleIds: roleCheck.roleIds } });
+			res.redirect('/settings/users?message=' + encodeURIComponent('Invitation sent.'));
+		} catch (error) {
+			next(error);
+		}
+	});
+
 	app.get('/settings/users/:id/duplicate', requirePermission('users.read'), requirePermission('users.create'), async function (req, res, next) {
 		try {
 			const userId = Number(req.params.id);
@@ -166,7 +309,7 @@
 				return {
 					id: Number(session.id),
 					ipAddress: String(session.ip_address || 'Unknown'),
-					userAgent: String(session.user_agent || 'Unknown browser'),
+					userAgent: formatUserAgentLabel(session.user_agent) || 'Unknown browser',
 					createdAtLabel: formatDashboardDate(session.created_at),
 					lastUsedAtLabel: formatDashboardDate(session.last_used_at),
 					expiresAtLabel: formatDashboardDate(session.expires_at)
@@ -222,6 +365,7 @@
 		try {
 			const name = common.validateMaxLength(req.body.name || '', USER_NAME_MAX_LENGTH, 'Name');
 			const username = common.validateMaxLength(req.body.username || '', USER_USERNAME_MAX_LENGTH, 'Username');
+			const email = common.validateMaxLength(req.body.email || '', USER_EMAIL_MAX_LENGTH, 'Email').toLowerCase();
 			const password = String(req.body.password || '');
 			const confirmPassword = String(req.body.confirm_password || '');
 			const saveAction = String(req.body.save_action || req.body.action || '').trim().toLowerCase();
@@ -229,7 +373,8 @@
 			const roleCheck = await validateRoleIds(selectedRoleIds);
 			const formValues = {
 				username: username,
-				name: name
+				name: name,
+				email: email
 			};
 
 			async function renderValidationError(message) {
@@ -243,6 +388,9 @@
 			if (!username) {
 				return renderValidationError('Username is required.');
 			}
+			if (email && !EMAIL_PATTERN.test(email)) {
+				return renderValidationError('Email address is invalid.');
+			}
 			const passwordStrengthMessage = validatePasswordStrength(password, await getPasswordRequirements());
 			if (passwordStrengthMessage) {
 				return renderValidationError(passwordStrengthMessage);
@@ -267,8 +415,8 @@
 			const actorId = getAuditUserId(req);
 			await connection.beginTransaction();
 			const [result] = await connection.query(
-				'INSERT INTO a_users (name, username, password_hash, password_salt, password_iterations, must_change_password, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
-				[name, username, passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations, mustChangePassword ? 1 : 0, actorId, actorId]
+				'INSERT INTO a_users (name, username, email, password_hash, password_salt, password_iterations, must_change_password, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
+				[name, username, email || null, passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations, mustChangePassword ? 1 : 0, actorId, actorId]
 			);
 			await rbacData.syncUserRoles(connection, result.insertId, roleCheck.roleIds);
 			await connection.commit();
@@ -364,7 +512,9 @@
 			}
 
 			const username = common.validateMaxLength(req.body.username || user.username || '', USER_USERNAME_MAX_LENGTH, 'Username');
+			const email = common.validateMaxLength(req.body.email || '', USER_EMAIL_MAX_LENGTH, 'Email').toLowerCase();
 			const accountLocked = req.body.account_locked === '1' || (Array.isArray(req.body.account_locked) && req.body.account_locked.includes('1'));
+			const emailVerified = req.body.email_verified === '1' || (Array.isArray(req.body.email_verified) && req.body.email_verified.includes('1'));
 
 			const [countRows] = await pool.query('SELECT COUNT(*) AS user_count FROM a_users');
 			const canDelete = !countRows.length || Number(countRows[0].user_count) > 1;
@@ -386,6 +536,9 @@
 			if (!username) {
 				return renderValidationError('Username is required.');
 			}
+			if (email && !EMAIL_PATTERN.test(email)) {
+				return renderValidationError('Email address is invalid.');
+			}
 			if (shouldUpdatePassword) {
 				const passwordStrengthMessage = validatePasswordStrength(password, await getPasswordRequirements());
 				if (passwordStrengthMessage) {
@@ -410,12 +563,14 @@
 			const changes = buildAuditChanges({
 				name: user.name,
 				username: user.username,
+				email: user.email || '',
 				roleIds: user.roleIds,
 				accountLocked: Boolean(user.account_locked),
 				passwordReset: false
 			}, {
 				name: name,
 				username: username,
+				email: email,
 				roleIds: roleCheck.roleIds,
 				accountLocked: accountLocked,
 				passwordReset: shouldUpdatePassword
@@ -426,6 +581,10 @@
 				await connection.rollback();
 				return res.status(404).send('User not found.');
 			}
+			await connection.query('UPDATE a_users SET email = ?, email_verified_at = CASE WHEN email = ? THEN email_verified_at ELSE NULL END, modified_by = ? WHERE id = ?', [email || null, email || null, getAuditUserId(req), userId]);
+			if (emailVerified && email && (await fetchAppSettings(pool))['security.allow_admin_email_verification_bypass']) {
+				await connection.query('UPDATE a_users SET email_verified_at = NOW() WHERE id = ? AND email = ?', [userId, email]);
+			}
 			await rbacData.syncUserRoles(connection, userId, roleCheck.roleIds);
 			if (accountLocked) {
 				await connection.query('DELETE FROM a_sessions WHERE user_id = ?', [userId]);
@@ -471,6 +630,17 @@
 						details: { source: 'administrator' }
 					});
 				}
+				if (emailVerified && !user.email_verified_at && email) {
+					await recordRequestAuditEvent(pool, req, {
+						category: 'security',
+						eventType: 'email.verification_bypassed',
+						actorUserId: req.currentUser.id,
+						targetType: 'user',
+						targetId: userId,
+						targetLabel: username,
+						details: { source: 'administrator' }
+					});
+				}
 			}
 			if (saveAction === 'new') {
 				return res.redirect('/settings/users/new?message=' + encodeURIComponent('User updated.'));

src/web/routes/auth/accept-invite.js

@@ -0,0 +1,27 @@
+const { renderView } = require('../../view');
+
+module.exports = function renderAcceptInvitePage(message, token, email, name, passwordRequirements, isValidInvitation) {
+  const requirements = passwordRequirements || { minimumLength: 10, minimumCategories: 3, requireLowercase: false, requireUppercase: false, requireNumber: false, requireSymbol: false };
+  const requiredCategories = [];
+  if (requirements.requireLowercase) requiredCategories.push('lowercase');
+  if (requirements.requireUppercase) requiredCategories.push('uppercase');
+  if (requirements.requireNumber) requiredCategories.push('number');
+  if (requirements.requireSymbol) requiredCategories.push('symbol');
+  const passwordRequirementsText = requiredCategories.length
+    ? 'Use at least ' + requirements.minimumLength + ' characters and include ' + requiredCategories.join(', ') + '.'
+    : requirements.minimumCategories === 4
+      ? 'Use at least ' + requirements.minimumLength + ' characters and include uppercase, lowercase, number, and symbol.'
+      : 'Use at least ' + requirements.minimumLength + ' characters and include ' + requirements.minimumCategories + ' of: uppercase, lowercase, number, and symbol.';
+  return renderView('auth/accept-invite', {
+    title: 'Accept invitation',
+    authShell: true,
+    bodyClass: 'login-page-body',
+    message: message || '',
+    isValidInvitation: Boolean(isValidInvitation),
+    token: token || '',
+    email: email || '',
+    name: name || '',
+    passwordMinimumLength: requirements.minimumLength,
+    passwordRequirementsText: passwordRequirementsText
+  });
+};

src/web/routes/auth/email-verification-error.js

@@ -0,0 +1,5 @@
+const { renderView } = require('../../view');
+
+module.exports = function renderEmailVerificationErrorPage(message) {
+  return renderView('auth/email-verification-error', { title: 'Verification link unavailable', authShell: true, bodyClass: 'login-page-body', message: message || 'This email verification link is invalid or has expired.' });
+};

src/web/routes/auth/email-verified.js

@@ -0,0 +1,5 @@
+const { renderView } = require('../../view');
+
+module.exports = function renderEmailVerifiedPage() {
+  return renderView('auth/email-verified', { title: 'Email verified', authShell: true, bodyClass: 'login-page-body' });
+};

src/web/routes/auth/forgot-password.js

@@ -0,0 +1,5 @@
+const { renderView } = require('../../view');
+
+module.exports = function renderForgotPasswordPage(message) {
+  return renderView('auth/forgot-password', { title: 'Reset password', authShell: true, bodyClass: 'login-page-body', message: message || '' });
+};

src/web/routes/auth/index.js

@@ -2,6 +2,7 @@
 
 const { normalizeReturnToPath, getRequestOrigin } = require('../../lib/auth/session');
 const { fetchAppSettings } = require('#src/data/app-settings');
+const { formatAccountEmailExpiry, renderAccountEmailTemplate } = require('#src/data/account-email-templates');
 
 module.exports = function registerAuthRoutes(app, deps) {
   const pool = deps.pool;
@@ -17,6 +18,10 @@ module.exports = function registerAuthRoutes(app, deps) {
   const verifyPassword = deps.verifyPassword;
   const sessionCookieName = deps.sessionCookieName;
   const recordRequestAuditEvent = deps.recordRequestAuditEvent;
+  const sendAccountEmail = deps.sendAccountEmail;
+  const createOneTimeToken = deps.createOneTimeToken;
+  const getConnection = deps.getConnection;
+  const rbacData = deps.rbacData;
 
   function getReturnTo(req) {
     return normalizeReturnToPath(req && (req.query && req.query.returnTo || req.body && req.body.returnTo), getRequestOrigin(req));
@@ -77,6 +82,142 @@ module.exports = function registerAuthRoutes(app, deps) {
     await pool.query('DELETE FROM a_login_attempts WHERE rate_key = ?', [rateKey]);
   }
 
+  async function getPasswordRequirements() {
+    const settings = await fetchAppSettings(pool);
+    return {
+      minimumLength: settings['security.password_min_length'],
+      minimumCategories: settings['security.password_min_categories'],
+      requireLowercase: settings['security.password_require_lowercase'],
+      requireUppercase: settings['security.password_require_uppercase'],
+      requireNumber: settings['security.password_require_number'],
+      requireSymbol: settings['security.password_require_symbol']
+    };
+  }
+
+  app.get('/accept-invite', async function (req, res, next) {
+    try {
+      const token = String(req.query.token || '').trim();
+      const [rows] = await pool.query('SELECT email, name FROM a_user_invitations WHERE token_hash = ? AND used_at IS NULL AND expires_at > NOW() LIMIT 1', [hashSessionToken(token)]);
+      const invitation = rows[0] || null;
+      if (!invitation) return res.status(400).send(pages.renderAcceptInvitePage('This invitation is invalid or has expired.', token, '', '', await getPasswordRequirements(), false));
+      res.send(pages.renderAcceptInvitePage('', token, invitation.email, invitation.name, await getPasswordRequirements(), true));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  app.post('/accept-invite', async function (req, res, next) {
+    const connection = typeof getConnection === 'function' ? await getConnection() : pool;
+    try {
+      const token = String(req.body.token || '').trim();
+      const username = String(req.body.username || '').trim();
+      const name = String(req.body.name || '').trim();
+      const password = String(req.body.password || '');
+      const confirmPassword = String(req.body.confirm_password || '');
+      const [rows] = await connection.query('SELECT id, email, name, role_ids_json FROM a_user_invitations WHERE token_hash = ? AND used_at IS NULL AND expires_at > NOW() LIMIT 1', [hashSessionToken(token)]);
+      const invitation = rows[0] || null;
+      const requirements = await getPasswordRequirements();
+      const renderError = function (message) { return res.status(400).send(pages.renderAcceptInvitePage(message, token, invitation ? invitation.email : '', name || (invitation && invitation.name) || '', requirements, Boolean(invitation))); };
+      if (!invitation) return renderError('This invitation is invalid or has expired.');
+      if (!username) return renderError('Username is required.');
+      if (!name) return renderError('Name is required.');
+        const [existingUsers] = await connection.query('SELECT id FROM a_users WHERE username = ? LIMIT 1', [username]);
+        if (existingUsers.length) return renderError('That username already exists.');
+      const strengthMessage = deps.validatePasswordStrength(password, requirements);
+      if (strengthMessage) return renderError(strengthMessage);
+      if (password !== confirmPassword) return renderError('Passwords do not match.');
+      const passwordRecord = deps.hashPassword(password);
+      const roleIds = JSON.parse(invitation.role_ids_json || '[]');
+      await connection.beginTransaction();
+      const [result] = await connection.query('INSERT INTO a_users (name, username, email, email_verified_at, password_hash, password_salt, password_iterations, created_by, modified_by) VALUES (?, ?, ?, NOW(), ?, ?, ?, NULL, NULL)', [name, username, invitation.email, passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations]);
+      if (rbacData && typeof rbacData.syncUserRoles === 'function') await rbacData.syncUserRoles(connection, result.insertId, roleIds);
+      await connection.query('UPDATE a_user_invitations SET used_at = NOW() WHERE id = ? AND used_at IS NULL', [invitation.id]);
+      await connection.commit();
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'users', eventType: 'user.invitation_accepted', targetType: 'user', targetId: result.insertId, targetLabel: username, details: { invitationId: invitation.id } });
+      res.redirect('/login?message=' + encodeURIComponent('Account created. You can now sign in.'));
+    } catch (error) {
+      try { await connection.rollback(); } catch (_rollbackError) {}
+      next(error);
+    } finally {
+      if (connection !== pool && connection && typeof connection.release === 'function') connection.release();
+    }
+  });
+
+  app.get('/forgot-password', function (req, res) {
+    res.send(pages.renderForgotPasswordPage(''));
+  });
+
+  app.post('/forgot-password', async function (req, res, next) {
+    try {
+      const identity = String(req.body.identity || '').trim();
+      const genericMessage = 'If that account has a verified email address, a reset link has been sent.';
+      const [rows] = await pool.query('SELECT id, name, username, email FROM a_users WHERE username = ? OR (email = ? AND email_verified_at IS NOT NULL) LIMIT 1', [identity, identity.toLowerCase()]);
+      const user = rows[0] || null;
+      const settings = await fetchAppSettings(pool);
+      if (user && user.email && user.email_verified_at && typeof sendAccountEmail === 'function' && typeof createOneTimeToken === 'function') {
+        const token = createOneTimeToken();
+        await pool.query('DELETE FROM a_account_tokens WHERE user_id = ? AND token_type = ?', [user.id, 'password-reset']);
+        const expiryMinutes = Number(settings['email.reset_expiry_minutes']);
+        await pool.query('INSERT INTO a_account_tokens (user_id, token_type, token_hash, expires_at) VALUES (?, ?, ?, DATE_ADD(NOW(), INTERVAL ' + expiryMinutes + ' MINUTE))', [user.id, 'password-reset', hashSessionToken(token)]);
+        const resetUrl = getRequestOrigin(req) + '/reset-password?token=' + encodeURIComponent(token);
+        try {
+          await sendAccountEmail(settings, Object.assign({ to: user.email }, renderAccountEmailTemplate(settings['email.reset_subject'], settings['email.reset_body'], { url: resetUrl, username: user.username, display_name: user.name, email: user.email, expiry_time: formatAccountEmailExpiry(expiryMinutes, 'minutes'), action_alignment: settings['email.reset_button_alignment'], action_label: settings['email.reset_button_text'] })));
+          if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'security', eventType: 'password.reset_requested', targetType: 'user', targetId: user.id, targetLabel: user.username });
+        } catch (_mailError) {
+          await pool.query('DELETE FROM a_account_tokens WHERE token_hash = ?', [hashSessionToken(token)]);
+        }
+      }
+      res.send(pages.renderForgotPasswordPage(genericMessage));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  app.get('/reset-password', async function (req, res, next) {
+    try {
+      const token = String(req.query.token || '').trim();
+      if (!token) return res.redirect('/forgot-password');
+      res.send(pages.renderResetPasswordPage('', token, await getPasswordRequirements()));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  app.post('/reset-password', async function (req, res, next) {
+    try {
+      const token = String(req.body.token || '');
+      const password = String(req.body.password || '');
+      const confirmPassword = String(req.body.confirm_password || '');
+      const [rows] = await pool.query('SELECT t.id AS token_id, t.user_id, u.username, u.email FROM a_account_tokens t JOIN a_users u ON u.id = t.user_id WHERE t.token_hash = ? AND t.token_type = ? AND t.used_at IS NULL AND t.expires_at > NOW() LIMIT 1', [hashSessionToken(token), 'password-reset']);
+      const record = rows[0] || null;
+      if (!record) return res.status(400).send(pages.renderResetPasswordPage('This reset link is invalid or has expired.', token, await getPasswordRequirements()));
+      const strengthMessage = deps.validatePasswordStrength(password, await getPasswordRequirements());
+      if (strengthMessage || password !== confirmPassword) return res.status(400).send(pages.renderResetPasswordPage(strengthMessage || 'Passwords do not match.', token, await getPasswordRequirements()));
+      const passwordRecord = deps.hashPassword(password);
+      await pool.query('UPDATE a_users SET password_hash = ?, password_salt = ?, password_iterations = ?, must_change_password = 0, modified_at = CURRENT_TIMESTAMP WHERE id = ?', [passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations, record.user_id]);
+      await pool.query('UPDATE a_account_tokens SET used_at = NOW() WHERE id = ?', [record.token_id]);
+      await pool.query('DELETE FROM a_sessions WHERE user_id = ?', [record.user_id]);
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'security', eventType: 'password.reset', targetType: 'user', targetId: record.user_id, targetLabel: record.username, details: { source: 'email' } });
+      res.redirect('/login?message=' + encodeURIComponent('Password updated. You can now sign in.'));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  app.get('/verify-email', async function (req, res, next) {
+    try {
+      const tokenHash = hashSessionToken(String(req.query.token || ''));
+      const [rows] = await pool.query('SELECT id FROM a_users WHERE pending_email_token_hash = ? AND pending_email_expires_at > NOW() LIMIT 1', [tokenHash]);
+      const user = rows[0] || null;
+      if (!user) return res.status(400).send(pages.renderEmailVerificationErrorPage('This email verification link is invalid or has expired.'));
+      await pool.query('UPDATE a_users SET email = pending_email, email_verified_at = NOW(), pending_email = NULL, pending_email_token_hash = NULL, pending_email_expires_at = NULL WHERE id = ?', [user.id]);
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'security', eventType: 'email.verification_completed', targetType: 'user', targetId: user.id });
+      res.send(pages.renderEmailVerifiedPage());
+    } catch (error) {
+      next(error);
+    }
+  });
+
   app.get('/', function (req, res) {
     res.redirect(req.currentUser ? '/dashboard' : '/login');
   });
@@ -90,7 +231,11 @@ module.exports = function registerAuthRoutes(app, deps) {
     const message = typeof consumeAuthMessageCookie === 'function'
       ? consumeAuthMessageCookie(req, res)
       : (req.query.message ? String(req.query.message) : '');
-    res.send(pages.renderLoginPage(message, returnTo, req.query.username ? String(req.query.username) : ''));
+    fetchAppSettings(pool).then(function (settings) {
+      res.send(pages.renderLoginPage(message, returnTo, req.query.username ? String(req.query.username) : '', Boolean(settings['email.smtp_enabled'])));
+    }).catch(function (error) {
+      res.status(500).send(error.message || 'Unable to load login settings.');
+    });
   });
 
   app.post('/login', async function (req, res, next) {
@@ -123,8 +268,12 @@ module.exports = function registerAuthRoutes(app, deps) {
         return res.status(401).send(pages.renderLoginPage(message, returnTo, username));
       }
 
-      const [rows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations, account_locked FROM a_users WHERE username = ? LIMIT 1', [username]);
-      const user = rows[0] || null;
+      const [usernameRows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations, account_locked FROM a_users WHERE username = ? LIMIT 1', [username]);
+      let user = usernameRows[0] || null;
+      if (!user) {
+        const [emailRows] = await pool.query('SELECT id, name, username, password_hash, password_salt, password_iterations, account_locked FROM a_users WHERE email = ? AND email_verified_at IS NOT NULL LIMIT 1', [username.toLowerCase()]);
+        user = emailRows[0] || null;
+      }
       if (user && user.account_locked) {
         if (typeof recordRequestAuditEvent === 'function') {
           await recordRequestAuditEvent(pool, req, {

src/web/routes/auth/login.js

@@ -2,7 +2,7 @@
 
 const { renderView } = require('../../view');
 
-module.exports = function renderLoginPage(message, returnTo, username) {
+module.exports = function renderLoginPage(message, returnTo, username, showForgotPassword) {
   return renderView('auth/login', {
     title: 'Sign in',
     authShell: true,
@@ -10,6 +10,7 @@ module.exports = function renderLoginPage(message, returnTo, username) {
     message: message || '',
     returnTo: returnTo || '',
     username: username || '',
+    showForgotPassword: Boolean(showForgotPassword),
     messageVariant: 'warning'
   });
 };

src/web/routes/auth/reset-password.js

@@ -0,0 +1,16 @@
+const { renderView } = require('../../view');
+
+module.exports = function renderResetPasswordPage(message, token, passwordRequirements) {
+  const requirements = passwordRequirements || { minimumLength: 10, minimumCategories: 3, requireLowercase: false, requireUppercase: false, requireNumber: false, requireSymbol: false };
+  const requiredCategories = [];
+  if (requirements.requireLowercase) requiredCategories.push('lowercase');
+  if (requirements.requireUppercase) requiredCategories.push('uppercase');
+  if (requirements.requireNumber) requiredCategories.push('number');
+  if (requirements.requireSymbol) requiredCategories.push('symbol');
+  const passwordRequirementsText = requiredCategories.length
+    ? 'Use at least ' + requirements.minimumLength + ' characters and include ' + requiredCategories.join(', ') + '.'
+    : requirements.minimumCategories === 4
+      ? 'Use at least ' + requirements.minimumLength + ' characters and include uppercase, lowercase, number, and symbol.'
+      : 'Use at least ' + requirements.minimumLength + ' characters and include ' + requirements.minimumCategories + ' of: uppercase, lowercase, number, and symbol.';
+  return renderView('auth/reset-password', { title: 'Choose a new password', authShell: true, bodyClass: 'login-page-body', message: message || '', token: token || '', passwordMinimumLength: requirements.minimumLength, passwordRequirementsText: passwordRequirementsText });
+};

src/web/routes/data-sources/api-sources/duplicate.js

@@ -26,6 +26,9 @@ function buildDuplicateApiSource(apiSource, duplicateName) {
     tokenUrl: apiSource.token_url || '',
     tokenRequestBodyJson: apiSource.token_request_body_json || '',
     tokenResponsePath: apiSource.token_response_path || 'access_token',
+    tokenRefreshUrl: apiSource.token_refresh_url || '',
+    tokenRefreshRequestBodyJson: apiSource.token_refresh_request_body_json || '',
+    tokenRefreshResponsePath: apiSource.token_refresh_response_path || 'refresh_token',
     tokenHeaderName: apiSource.token_header_name || 'Authorization',
     tokenHeaderPrefix: apiSource.token_header_prefix || 'Bearer',
     itemsPath: apiSource.items_path || ''

src/web/routes/data-sources/api-sources/edit.js

@@ -21,6 +21,9 @@ module.exports = function renderApiSourceEditPage(apiSource, data, message, curr
     tokenUrl: apiSource.token_url || '',
     tokenRequestBodyJson: apiSource.token_request_body_json || '',
     tokenResponsePath: apiSource.token_response_path || 'access_token',
+    tokenRefreshUrl: apiSource.token_refresh_url || '',
+    tokenRefreshRequestBodyJson: apiSource.token_refresh_request_body_json || '',
+    tokenRefreshResponsePath: apiSource.token_refresh_response_path || 'refresh_token',
     tokenHeaderName: apiSource.token_header_name || 'Authorization',
     tokenHeaderPrefix: apiSource.token_header_prefix || 'Bearer',
     itemsPath: apiSource.items_path || '',

src/web/routes/data-sources/api-sources/form-view-model.js

@@ -17,6 +17,9 @@ function buildDefaultApiSource() {
     tokenUrl: '',
     tokenRequestBodyJson: '',
     tokenResponsePath: 'access_token',
+    tokenRefreshUrl: '',
+    tokenRefreshRequestBodyJson: '',
+    tokenRefreshResponsePath: 'refresh_token',
     tokenHeaderName: 'Authorization',
     tokenHeaderPrefix: 'Bearer',
     itemsPath: '',

src/web/routes/data-sources/api-sources/routes.js

@@ -105,6 +105,9 @@ module.exports = function registerApiSourceRoutes(app, deps) {
           authHeaderValue: apiSource.auth_header_value || '',
           tokenUrl: apiSource.token_url || '',
           tokenResponsePath: apiSource.token_response_path || 'access_token',
+          tokenRefreshUrl: apiSource.token_refresh_url || '',
+          tokenRefreshRequestBodyJson: apiSource.token_refresh_request_body_json || '',
+          tokenRefreshResponsePath: apiSource.token_refresh_response_path || 'refresh_token',
           itemsPath: apiSource.items_path || '',
           intervalLabel: apiSource.update_interval_unit === 'seconds'
             ? (Math.max(1, Number(apiSource.update_interval_value) || 0) === 1 ? 'Every second' : `Every ${Math.max(1, Number(apiSource.update_interval_value) || 0)} seconds`)
@@ -183,6 +186,9 @@ module.exports = function registerApiSourceRoutes(app, deps) {
         tokenUrl: apiSource.token_url || '',
         tokenRequestBodyJson: apiSource.token_request_body_json || '',
         tokenResponsePath: apiSource.token_response_path || 'access_token',
+        tokenRefreshUrl: apiSource.token_refresh_url || '',
+        tokenRefreshRequestBodyJson: apiSource.token_refresh_request_body_json || '',
+        tokenRefreshResponsePath: apiSource.token_refresh_response_path || 'refresh_token',
         tokenHeaderName: apiSource.token_header_name || 'Authorization',
         tokenHeaderPrefix: apiSource.token_header_prefix || 'Bearer',
         itemsPath: apiSource.items_path || '',
@@ -242,8 +248,8 @@ module.exports = function registerApiSourceRoutes(app, deps) {
       const actorId = getAuditUserId(req);
       await connection.beginTransaction();
       const [result] = await connection.query(
-        'INSERT INTO i_api_sources (name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
-        [payload.name, payload.apiUrl, payload.requestMethod, payload.requestBodyJson || null, payload.authMethod, payload.authUsername || null, payload.authPassword || null, payload.authBearerToken || null, payload.authHeaderName || null, payload.authHeaderValue || null, payload.tokenUrl || null, payload.tokenRequestBodyJson || null, payload.tokenResponsePath || null, payload.tokenHeaderName || null, payload.tokenHeaderPrefix || null, payload.itemsPath || null, payload.updateIntervalValue, payload.updateIntervalUnit, null, null, null, null, null, actorId, actorId]
+        'INSERT INTO i_api_sources (name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_refresh_url, token_refresh_request_body_json, token_refresh_response_path, token_header_name, token_header_prefix, items_path, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        [payload.name, payload.apiUrl, payload.requestMethod, payload.requestBodyJson || null, payload.authMethod, payload.authUsername || null, payload.authPassword || null, payload.authBearerToken || null, payload.authHeaderName || null, payload.authHeaderValue || null, payload.tokenUrl || null, payload.tokenRequestBodyJson || null, payload.tokenResponsePath || null, payload.tokenRefreshUrl || null, payload.tokenRefreshRequestBodyJson || null, payload.tokenRefreshResponsePath || null, payload.tokenHeaderName || null, payload.tokenHeaderPrefix || null, payload.itemsPath || null, payload.updateIntervalValue, payload.updateIntervalUnit, null, null, null, null, null, actorId, actorId]
       );
       await connection.commit();
       dataSourceTasks.registerRecurringRefresh('api-source', result.insertId, payload.name, payload.updateIntervalValue, payload.updateIntervalUnit, function () {
@@ -308,8 +314,8 @@ module.exports = function registerApiSourceRoutes(app, deps) {
       const actorId = getAuditUserId(req);
       await connection.beginTransaction();
       await connection.query(
-        'UPDATE i_api_sources SET name = ?, api_url = ?, request_method = ?, request_body_json = ?, auth_method = ?, auth_username = ?, auth_password = ?, auth_bearer_token = ?, auth_header_name = ?, auth_header_value = ?, token_url = ?, token_request_body_json = ?, token_response_path = ?, token_header_name = ?, token_header_prefix = ?, items_path = ?, update_interval_value = ?, update_interval_unit = ?, modified_by = ? WHERE id = ?',
-        [payload.name, payload.apiUrl, payload.requestMethod, payload.requestBodyJson || null, payload.authMethod, payload.authUsername || null, payload.authPassword || null, payload.authBearerToken || null, payload.authHeaderName || null, payload.authHeaderValue || null, payload.tokenUrl || null, payload.tokenRequestBodyJson || null, payload.tokenResponsePath || null, payload.tokenHeaderName || null, payload.tokenHeaderPrefix || null, payload.itemsPath || null, payload.updateIntervalValue, payload.updateIntervalUnit, actorId, apiSource.id]
+        'UPDATE i_api_sources SET name = ?, api_url = ?, request_method = ?, request_body_json = ?, auth_method = ?, auth_username = ?, auth_password = ?, auth_bearer_token = ?, auth_header_name = ?, auth_header_value = ?, token_url = ?, token_request_body_json = ?, token_response_path = ?, token_refresh_url = ?, token_refresh_request_body_json = ?, token_refresh_response_path = ?, token_header_name = ?, token_header_prefix = ?, items_path = ?, update_interval_value = ?, update_interval_unit = ?, modified_by = ? WHERE id = ?',
+        [payload.name, payload.apiUrl, payload.requestMethod, payload.requestBodyJson || null, payload.authMethod, payload.authUsername || null, payload.authPassword || null, payload.authBearerToken || null, payload.authHeaderName || null, payload.authHeaderValue || null, payload.tokenUrl || null, payload.tokenRequestBodyJson || null, payload.tokenResponsePath || null, payload.tokenRefreshUrl || null, payload.tokenRefreshRequestBodyJson || null, payload.tokenRefreshResponsePath || null, payload.tokenHeaderName || null, payload.tokenHeaderPrefix || null, payload.itemsPath || null, payload.updateIntervalValue, payload.updateIntervalUnit, actorId, apiSource.id]
       );
       await connection.commit();
       if (apiSource.enabled === 0 || apiSource.enabled === false) {

src/web/routes/data-sources/weather.js

@@ -6,6 +6,7 @@ const renderWeatherLocationAddPage = require('./weather/add');
 const renderWeatherLocationEditPage = require('./weather/edit');
 const { buildDuplicateWeatherLocationName, buildDuplicateWeatherLocation } = require('./weather/duplicate');
 const { fetchAppSettings } = require('../../../data/app-settings');
+const { buildAuditChanges } = require('../../../data/audit-log');
 
 async function getWeatherLocationUsageIds(pool, common) {
   const [slides] = await pool.query('SELECT content_json FROM c_slides WHERE content_json IS NOT NULL');
@@ -42,6 +43,7 @@ module.exports = function registerWeatherRoutes(app, deps) {
   const dataSourceTasks = deps.dataSourceTasks;
   const backgroundTaskQueue = deps.backgroundTaskQueue;
   const requirePermission = deps.requirePermission;
+  const recordRequestAuditEvent = deps.recordRequestAuditEvent;
   const listPageSize = 25;
   async function getProviderAvailability() {
     const settings = await fetchAppSettings(pool);
@@ -121,6 +123,7 @@ module.exports = function registerWeatherRoutes(app, deps) {
         return dataSourceTasks.refreshWeatherLocationInBackground(result.insertId, null);
       });
       await backgroundTaskQueue.enqueueTask({ key: 'weather-location-refresh:' + result.insertId, title: 'Weather location refresh', category: 'data-source', taskType: 'data-source-refresh', payload: { sourceType: 'weather-location', sourceId: result.insertId, sourceName: payload.name, actorId: actorId }, metadata: { sourceType: 'weather-location', sourceId: result.insertId, sourceName: payload.name } });
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: 'weather-location.created', actorUserId: actorId, targetType: 'weather-location', targetId: result.insertId, targetLabel: payload.name });
       redirectAfterSave(req, res, '/data-sources/weather/' + result.insertId + '/edit', { closeUrl: '/data-sources/weather', newUrl: '/data-sources/weather/new', message: 'Weather location created.' });
     } catch (error) {
       try { await connection.rollback(); } catch (_rollbackError) { }
@@ -143,6 +146,7 @@ module.exports = function registerWeatherRoutes(app, deps) {
         } else {
           dataSourceTasks.removeRecurringRefresh('weather-location', location.id);
         }
+        if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: enabled ? 'weather-location.enabled' : 'weather-location.disabled', actorUserId: getAuditUserId(req), targetType: 'weather-location', targetId: location.id, targetLabel: location.name });
         return res.redirect('/data-sources/weather/' + location.id + '/edit?message=' + encodeURIComponent(enabled ? 'Weather location enabled.' : 'Weather location disabled.'));
       }
       const payload = common.buildWeatherLocationPayload(req, location);
@@ -159,6 +163,7 @@ module.exports = function registerWeatherRoutes(app, deps) {
           return dataSourceTasks.refreshWeatherLocationInBackground(location.id, null);
         });
       }
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: 'weather-location.updated', actorUserId: getAuditUserId(req), targetType: 'weather-location', targetId: location.id, targetLabel: payload.name, details: { changes: buildAuditChanges({ name: location.name, locationLabel: location.location_label, latitude: location.latitude, longitude: location.longitude, timezone: location.timezone, provider: location.provider, temperatureUnit: location.temperature_unit, windUnit: location.wind_unit, precipitationUnit: location.precipitation_unit, updateIntervalValue: location.update_interval_value, updateIntervalUnit: location.update_interval_unit }, payload) } });
       redirectAfterSave(req, res, '/data-sources/weather/' + location.id + '/edit', { closeUrl: '/data-sources/weather', newUrl: '/data-sources/weather/new', message: 'Weather location updated.' });
     } catch (error) {
       try { await connection.rollback(); } catch (_rollbackError) { }
@@ -174,6 +179,7 @@ module.exports = function registerWeatherRoutes(app, deps) {
         return res.redirect('/data-sources/weather/' + location.id + '/edit?message=' + encodeURIComponent('Weather location is disabled.'));
       }
       await backgroundTaskQueue.enqueueTask({ key: 'weather-location-refresh:' + location.id, title: 'Weather location refresh', category: 'data-source', taskType: 'data-source-refresh', payload: { sourceType: 'weather-location', sourceId: location.id, sourceName: location.name, actorId: getAuditUserId(req) }, metadata: { sourceType: 'weather-location', sourceId: location.id, sourceName: location.name } });
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: 'weather-location.refresh_requested', actorUserId: getAuditUserId(req), targetType: 'weather-location', targetId: location.id, targetLabel: location.name });
       res.redirect('/data-sources/weather/' + location.id + '/edit?message=' + encodeURIComponent('Weather refresh queued.'));
     } catch (error) { next(error); }
   });
@@ -187,6 +193,7 @@ module.exports = function registerWeatherRoutes(app, deps) {
       }
       await pool.query('DELETE FROM i_weather_locations WHERE id = ?', [location.id]);
       dataSourceTasks.removeRecurringRefresh('weather-location', location.id);
+      if (typeof recordRequestAuditEvent === 'function') await recordRequestAuditEvent(pool, req, { category: 'weather', eventType: 'weather-location.deleted', actorUserId: getAuditUserId(req), targetType: 'weather-location', targetId: location.id, targetLabel: location.name });
       res.redirect('/data-sources/weather?message=' + encodeURIComponent('Weather location deleted.'));
     } catch (error) { next(error); }
   });

src/web/routes/register.js

@@ -40,6 +40,8 @@ function registerRoutes(app, deps) {
     mediaDir: deps.mediaDir,
     requirePermission: deps.requirePermission,
     recordRequestAuditEvent: deps.recordRequestAuditEvent
+    ,sendAccountEmail: deps.sendAccountEmail
+    ,createOneTimeToken: deps.createOneTimeToken
   });
   registerAuditLogRoutes(app, {
     pool: deps.pool,
@@ -81,8 +83,14 @@ function registerAuthAndAccountRoutes(app, deps) {
     parseCookies: deps.parseCookies,
     hashSessionToken: deps.hashSessionToken,
     verifyPassword: deps.verifyPassword,
+    hashPassword: deps.hashPassword,
+    validatePasswordStrength: deps.validatePasswordStrength,
     sessionCookieName: deps.sessionCookieName,
     recordRequestAuditEvent: deps.recordRequestAuditEvent
+    ,sendAccountEmail: deps.sendAccountEmail
+    ,createOneTimeToken: deps.createOneTimeToken
+    ,getConnection: deps.pool.getConnection ? deps.pool.getConnection.bind(deps.pool) : null
+    ,rbacData: deps.rbacData
   });
 
   registerPagesRoutes(app, {
@@ -112,6 +120,8 @@ function registerAuthAndAccountRoutes(app, deps) {
     hashSessionToken: deps.hashSessionToken,
     sessionCookieName: deps.sessionCookieName,
     recordRequestAuditEvent: deps.recordRequestAuditEvent
+    ,sendAccountEmail: deps.sendAccountEmail
+    ,createOneTimeToken: deps.createOneTimeToken
   });
 
   registerUsersRoutes(app, {
@@ -126,6 +136,10 @@ function registerAuthAndAccountRoutes(app, deps) {
     rbacData: deps.rbacData,
     requirePermission: deps.requirePermission,
     recordRequestAuditEvent: deps.recordRequestAuditEvent
+    ,sendAccountEmail: deps.sendAccountEmail
+    ,createOneTimeToken: deps.createOneTimeToken
+    ,hashSessionToken: deps.hashSessionToken
+    ,getRequestOrigin: deps.getRequestOrigin
   });
 }
 
@@ -186,6 +200,7 @@ function registerSignageRoutes(app, deps) {
     findAvailableClientName: deps.findAvailableClientName,
     withClientNameReservation: deps.withClientNameReservation,
     broadcastDashboardState: deps.broadcastDashboardState,
+    recordRequestAuditEvent: deps.recordRequestAuditEvent,
     requirePermission: deps.requirePermission
   });
 }
@@ -298,6 +313,7 @@ function registerSettingsAndContentRoutes(app, deps) {
     redirectAfterSave: deps.redirectAfterSave,
     dataSourceTasks: deps.dataSourceTasks,
     backgroundTaskQueue: deps.backgroundTaskQueue,
+    recordRequestAuditEvent: deps.recordRequestAuditEvent,
     requirePermission: deps.requirePermission
   });
 

src/web/routes/settings/audit-log.js

@@ -1,6 +1,6 @@
 const { renderView } = require('#src/web/view');
 const { hasPermission, PERMISSION_DENIED_MESSAGE } = require('#src/rbac');
-const { AUDIT_CATEGORY_KEYS } = require('#src/data/audit-log');
+const { AUDIT_CATEGORY_KEYS, formatUserAgentLabel } = require('#src/data/audit-log');
 const { buildPagination } = require('#src/web/lib/pagination');
 const { createSearchMatcher, getSearchQuery, getSortDirectionQuery, getSortQuery, parsePageNumber, sortRows } = require('#src/web/lib/list-query');
 
@@ -160,6 +160,7 @@ function mapAuditRow(row, formatDashboardDate) {
     occurredAtValue: Number.isNaN(occurredAt.getTime()) ? '' : occurredAt.toISOString(),
     occurredAtLabel: formatDashboardDate(row.occurred_at),
     actorLabel: row.actor_name || row.actor_username || 'System',
+    userAgentLabel: formatUserAgentLabel(row.user_agent),
     eventLabel: String(row.event_type || '').replace(/[._-]+/g, ' '),
     targetLabelDisplay: row.target_label || (row.target_type && row.target_id ? row.target_type + ' #' + row.target_id : ''),
     detailsDisplay: details,

src/web/routes/settings/invitations/list.js

@@ -0,0 +1,15 @@
+// Pending invitations page renderer.
+
+const { renderView } = require('../../../view');
+
+module.exports = function renderInvitationsPage(data, currentUser) {
+  return renderView('settings/invitations/list', {
+    title: 'Pending invitations',
+    active: 'users-invitations',
+    userManagementMenuOpen: true,
+    currentUser: currentUser || null,
+    message: data.message || '',
+    invitations: data.invitations || [],
+    pagination: data.pagination || null
+  });
+};

src/web/routes/settings/rbac/form-view-model.js

@@ -98,6 +98,7 @@ function buildRbacAddViewModel(message, currentUser, formValues, permissionGroup
   return {
     title: 'Create role',
     active: 'rbac',
+    userManagementMenuOpen: true,
     isEdit: false,
     usersPresent: true,
     formId: 'role-create-form',
@@ -130,6 +131,7 @@ function buildRbacEditViewModel(role, message, currentUser, permissionGroups, us
   return {
     title: 'Edit role',
     active: 'rbac',
+    userManagementMenuOpen: true,
     isEdit: true,
     usersPresent: true,
     formId: 'role-edit-form',

src/web/routes/settings/rbac/list.js

@@ -6,6 +6,7 @@ module.exports = function renderRbacPage(data, message, currentUser) {
   return renderView('settings/rbac/list', {
     title: 'Roles and permissions',
     active: 'rbac',
+    userManagementMenuOpen: true,
     message: message,
     currentUser: currentUser || null,
     roles: data.roles || [],

src/web/routes/settings/routes.js

@@ -1,7 +1,7 @@
 // Settings page route registration.
 
 const { ANNOUNCEMENT_ICON_CATALOG } = require('#src/data/announcement-icons');
-const { AUDIT_CATEGORY_KEYS, AUDIT_CATEGORY_LABELS } = require('#src/data/audit-log');
+const { AUDIT_CATEGORY_KEYS, AUDIT_CATEGORY_LABELS, SCREEN_CONTROL_COMMAND_KEYS, SCREEN_CONTROL_COMMAND_LABELS } = require('#src/data/audit-log');
 const { fetchAppSettings, saveAppSettings } = require('#src/data/app-settings');
 const { appVersion, detectSchemaVersion } = require('#src/db/migrations');
 
@@ -20,6 +20,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
   const pages = deps.pages;
   const pool = deps.pool;
   const recordRequestAuditEvent = deps.recordRequestAuditEvent;
+  const sendAccountEmail = deps.sendAccountEmail;
 
   if (!pages || !pool || typeof deps.requirePermission !== 'function') {
     throw new Error('registerSettingsPageRoutes requires pool, pages, and requirePermission.');
@@ -54,13 +55,22 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
       'security.password_require_number',
       'security.password_require_symbol',
       'security.require_password_change_for_new_users',
-      'security.require_password_change_after_admin_reset'
+      'security.require_password_change_after_admin_reset',
+      'security.allow_admin_email_verification_bypass'
     ],
-    audit: ['audit.enabled', 'audit.categories', 'audit.include_request_metadata', 'audit.retention_days'],
+    email: ['email.smtp_enabled', 'email.smtp_host', 'email.smtp_port', 'email.smtp_security', 'email.smtp_username', 'email.from_address', 'email.from_name'],
+    'email-templates': ['email.verification_subject', 'email.verification_body', 'email.verification_button_alignment', 'email.verification_button_text', 'email.reset_subject', 'email.reset_body', 'email.reset_button_alignment', 'email.reset_button_text', 'email.invitation_subject', 'email.invitation_body', 'email.invitation_button_alignment', 'email.invitation_button_text'],
+    audit: ['audit.enabled', 'audit.categories', 'audit.screen_control_commands', 'audit.include_request_metadata', 'audit.retention_days'],
     media: ['uploads.image_max_bytes', 'uploads.video_max_bytes', 'uploads.wysiwyg_image_max_bytes', 'uploads.allowed_mime_types'],
     weather: ['weather.open_meteo_api_key', 'weather.pirate_weather_api_key'],
     icons: ['announcements.suggested_icons']
   };
+  const ALL_SETTING_KEYS = Object.keys(SECTION_SETTING_KEYS).reduce(function (keys, section) {
+    return keys.concat(SECTION_SETTING_KEYS[section].filter(function (key) {
+      return !keys.includes(key);
+    }));
+  }, []);
+  const ALL_SETTING_KEY_PLACEHOLDERS = ALL_SETTING_KEYS.map(function () { return '?'; }).join(', ');
 
   function maskApiKey(value) {
     const key = String(value || '');
@@ -156,6 +166,30 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
           passwordRequireSymbol: Boolean(settings['security.password_require_symbol']),
           requirePasswordChangeForNewUsers: Boolean(settings['security.require_password_change_for_new_users']),
               requirePasswordChangeAfterAdminReset: Boolean(settings['security.require_password_change_after_admin_reset']),
+              allowAdminEmailVerificationBypass: Boolean(settings['security.allow_admin_email_verification_bypass']),
+              smtpEnabled: Boolean(settings['email.smtp_enabled']),
+              smtpHost: String(settings['email.smtp_host'] || ''),
+              smtpPort: Number(settings['email.smtp_port']) || 587,
+              smtpSecurity: String(settings['email.smtp_security'] || 'starttls'),
+              smtpUsername: String(settings['email.smtp_username'] || ''),
+              smtpConfigured: Boolean(settings['email.smtp_password']),
+              emailFromAddress: String(settings['email.from_address'] || ''),
+              emailFromName: String(settings['email.from_name'] || ''),
+              verificationExpiryMinutes: Number(settings['email.verification_expiry_minutes']) || 30,
+              resetExpiryMinutes: Number(settings['email.reset_expiry_minutes']) || 30,
+              invitationExpiryHours: Number(settings['email.invitation_expiry_hours']) || 24,
+              verificationEmailSubject: String(settings['email.verification_subject'] || ''),
+              verificationEmailBody: String(settings['email.verification_body'] || ''),
+              verificationButtonAlignment: String(settings['email.verification_button_alignment'] || 'center'),
+              verificationButtonText: String(settings['email.verification_button_text'] || 'Verify email address'),
+              resetEmailSubject: String(settings['email.reset_subject'] || ''),
+              resetEmailBody: String(settings['email.reset_body'] || ''),
+              resetButtonAlignment: String(settings['email.reset_button_alignment'] || 'center'),
+              resetButtonText: String(settings['email.reset_button_text'] || 'Reset password'),
+              invitationEmailSubject: String(settings['email.invitation_subject'] || ''),
+              invitationEmailBody: String(settings['email.invitation_body'] || ''),
+              invitationButtonAlignment: String(settings['email.invitation_button_alignment'] || 'center'),
+              invitationButtonText: String(settings['email.invitation_button_text'] || 'Accept invitation'),
               defaultSlideDurationSeconds: Number(settings['player.default_slide_duration_seconds']) || 10,
               defaultFadeBetweenSlides: Boolean(settings['player.default_fade_between_slides']),
               defaultSkipUnavailableRtmp: Boolean(settings['player.skip_unavailable_rtmp']),
@@ -176,7 +210,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
               ,auditCategories: AUDIT_CATEGORY_KEYS.map(function (category) {
                 return { key: category, label: AUDIT_CATEGORY_LABELS[category] || category, isSelected: settings['audit.categories'].includes(category) };
               })
-              ,auditEventCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category !== 'users' && category !== 'roles' && category !== 'system-settings' && category !== 'slides' && category !== 'templates' && category !== 'playlists' && category !== 'screens' && category !== 'announcements' && category !== 'canvas-sizes' && category !== 'api-sources' && category !== 'rss-feeds' && category !== 'timetables'; }).map(function (category) {
+              ,auditEventCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category !== 'users' && category !== 'roles' && category !== 'system-settings' && category !== 'slides' && category !== 'templates' && category !== 'playlists' && category !== 'screens' && category !== 'announcements' && category !== 'canvas-sizes' && category !== 'api-sources' && category !== 'rss-feeds' && category !== 'timetables' && category !== 'weather' && category !== 'screen-controls'; }).map(function (category) {
                 return { key: category, label: AUDIT_CATEGORY_LABELS[category] || category, isSelected: settings['audit.categories'].includes(category) };
               })
               ,auditAdministrationCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category === 'users' || category === 'roles' || category === 'system-settings'; }).map(function (category) {
@@ -185,9 +219,13 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
               ,auditContentCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category === 'slides' || category === 'templates' || category === 'playlists' || category === 'screens' || category === 'announcements' || category === 'canvas-sizes'; }).map(function (category) {
                 return { key: category, label: AUDIT_CATEGORY_LABELS[category] || category, isSelected: settings['audit.categories'].includes(category) };
               })
-              ,auditDataSourceCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category === 'api-sources' || category === 'rss-feeds' || category === 'timetables'; }).map(function (category) {
+              ,auditDataSourceCategories: AUDIT_CATEGORY_KEYS.filter(function (category) { return category === 'api-sources' || category === 'rss-feeds' || category === 'timetables' || category === 'weather'; }).map(function (category) {
                 return { key: category, label: AUDIT_CATEGORY_LABELS[category] || category, isSelected: settings['audit.categories'].includes(category) };
               })
+              ,auditScreenControlCommands: SCREEN_CONTROL_COMMAND_KEYS.map(function (command) {
+                const selectedCommands = Array.isArray(settings['audit.screen_control_commands']) ? settings['audit.screen_control_commands'] : [];
+                return { key: command, label: SCREEN_CONTROL_COMMAND_LABELS[command] || command, isSelected: selectedCommands.includes(command) };
+              })
     }, diagnostics));
   }
 
@@ -244,7 +282,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
   app.post('/settings/system', deps.requirePermission('system-settings.update'), async function (req, res, next) {
     try {
       const section = String(req.body && req.body.settings_section || '').trim().toLowerCase();
-      if (section !== 'icons' && section !== 'media' && section !== 'security' && section !== 'defaults' && section !== 'audit' && section !== 'weather') {
+      if (section !== 'icons' && section !== 'media' && section !== 'security' && section !== 'email' && section !== 'email-templates' && section !== 'defaults' && section !== 'audit' && section !== 'weather') {
         const error = new Error('Unknown settings section.');
         error.statusCode = 400;
         error.expose = true;
@@ -252,6 +290,62 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
       }
       const previousSettings = await fetchAppSettings(pool);
 
+      if (section === 'email' && String(req.body && req.body.settings_action || '').trim().toLowerCase() === 'test_email') {
+        const recipient = String(req.currentUser && req.currentUser.email || '').trim();
+        if (!previousSettings['email.smtp_enabled'] || typeof sendAccountEmail !== 'function') {
+          const error = new Error('Email delivery is not configured.');
+          error.statusCode = 400;
+          error.expose = true;
+          throw error;
+        }
+        if (!recipient) {
+          const error = new Error('Your account does not have an email address.');
+          error.statusCode = 400;
+          error.expose = true;
+          throw error;
+        }
+        await sendAccountEmail(previousSettings, {
+          to: recipient,
+          subject: 'Pulse Signage SMTP test email',
+          text: 'This is a test email from Pulse Signage. Your SMTP settings are working.'
+        });
+        return res.redirect('/settings/system?message=' + encodeURIComponent('Test email sent to ' + recipient + '.') + '#email-delivery');
+      }
+
+      if (section === 'email-templates') {
+        const verificationSubject = String(req.body && req.body.verification_subject || '').trim();
+        const verificationBody = String(req.body && req.body.verification_body || '').trim();
+        const resetSubject = String(req.body && req.body.reset_subject || '').trim();
+        const resetBody = String(req.body && req.body.reset_body || '').trim();
+        const verificationButtonText = String(req.body && req.body.verification_button_text || '').trim();
+        const resetButtonText = String(req.body && req.body.reset_button_text || '').trim();
+        const invitationSubject = String(req.body && req.body.invitation_subject || '').trim();
+        const invitationBody = String(req.body && req.body.invitation_body || '').trim();
+        const invitationButtonText = String(req.body && req.body.invitation_button_text || '').trim();
+        if (!verificationSubject || !verificationBody.includes('[[url]]') || !resetSubject || !resetBody.includes('[[url]]') || !invitationSubject || !invitationBody.includes('[[url]]') || !verificationButtonText || !resetButtonText || !invitationButtonText) {
+          const error = new Error('Email templates require a subject, message, and the correct link placeholder.');
+          error.statusCode = 400;
+          error.expose = true;
+          throw error;
+        }
+        const savedSettings = await saveAppSettings(pool, {
+          'email.verification_subject': verificationSubject,
+          'email.verification_body': verificationBody,
+          'email.verification_button_alignment': ['left', 'center', 'right'].includes(String(req.body && req.body.verification_button_alignment || '').trim()) ? String(req.body.verification_button_alignment).trim() : 'center',
+          'email.verification_button_text': verificationButtonText,
+          'email.reset_subject': resetSubject,
+          'email.reset_body': resetBody,
+          'email.reset_button_alignment': ['left', 'center', 'right'].includes(String(req.body && req.body.reset_button_alignment || '').trim()) ? String(req.body.reset_button_alignment).trim() : 'center',
+          'email.reset_button_text': resetButtonText
+          ,'email.invitation_subject': invitationSubject
+          ,'email.invitation_body': invitationBody
+          ,'email.invitation_button_alignment': ['left', 'center', 'right'].includes(String(req.body && req.body.invitation_button_alignment || '').trim()) ? String(req.body.invitation_button_alignment).trim() : 'center'
+          ,'email.invitation_button_text': invitationButtonText
+        }, req.currentUser && req.currentUser.id);
+        await recordSettingsAuditEvent(req, previousSettings, savedSettings, section);
+        return res.redirect('/settings/system?message=' + encodeURIComponent('Account email templates saved.') + '#email-templates');
+      }
+
       if (section === 'defaults') {
         const defaultSlideDurationSeconds = Number(req.body && req.body.default_slide_duration_seconds);
         const defaultAnnouncementDurationValue = Number(req.body && req.body.default_announcement_duration_value);
@@ -322,11 +416,47 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
           'security.password_require_symbol': passwordRequireSymbol,
           'security.require_password_change_for_new_users': requirePasswordChangeForNewUsers,
           'security.require_password_change_after_admin_reset': requirePasswordChangeAfterAdminReset
+          ,'security.allow_admin_email_verification_bypass': req.body && (req.body.allow_admin_email_verification_bypass === '1' || req.body.allow_admin_email_verification_bypass === 'true')
         }, req.currentUser && req.currentUser.id);
         await recordSettingsAuditEvent(req, previousSettings, savedSettings, section);
         return res.redirect('/settings/system?message=' + encodeURIComponent('Security settings saved.') + '#security-sessions');
       }
 
+      if (section === 'email') {
+        const smtpEnabled = req.body && (req.body.smtp_enabled === '1' || req.body.smtp_enabled === 'true');
+        const smtpHost = String(req.body && req.body.smtp_host || '').trim();
+        const smtpPort = Number(req.body && req.body.smtp_port);
+        const smtpSecurity = String(req.body && req.body.smtp_security || 'starttls').trim().toLowerCase();
+        const smtpUsername = String(req.body && req.body.smtp_username || '').trim();
+        const smtpPassword = String(req.body && req.body.smtp_password || '');
+        const fromAddress = String(req.body && req.body.from_address || '').trim();
+        const fromName = String(req.body && req.body.from_name || '').trim();
+        const verificationExpiryMinutes = Number(req.body && req.body.verification_expiry_minutes);
+        const resetExpiryMinutes = Number(req.body && req.body.reset_expiry_minutes);
+        const invitationExpiryHours = Number(req.body && req.body.invitation_expiry_hours);
+        if (!Number.isInteger(verificationExpiryMinutes) || verificationExpiryMinutes < 1 || verificationExpiryMinutes > 10080 || !Number.isInteger(resetExpiryMinutes) || resetExpiryMinutes < 1 || resetExpiryMinutes > 10080 || !Number.isInteger(invitationExpiryHours) || invitationExpiryHours < 1 || invitationExpiryHours > 720 || (smtpEnabled && (!smtpHost || !Number.isInteger(smtpPort) || smtpPort < 1 || smtpPort > 65535 || !fromAddress))) {
+          const error = new Error('Enabled email delivery requires an SMTP host, valid port, and from address.');
+          error.statusCode = 400;
+          error.expose = true;
+          throw error;
+        }
+        const savedSettings = await saveAppSettings(pool, {
+          'email.smtp_enabled': smtpEnabled,
+          'email.smtp_host': smtpHost,
+          'email.smtp_port': smtpPort || 587,
+          'email.smtp_security': smtpSecurity,
+          'email.smtp_username': smtpUsername,
+          'email.smtp_password': smtpPassword || previousSettings['email.smtp_password'],
+          'email.from_address': fromAddress,
+          'email.from_name': fromName,
+          'email.verification_expiry_minutes': verificationExpiryMinutes,
+          'email.reset_expiry_minutes': resetExpiryMinutes,
+          'email.invitation_expiry_hours': invitationExpiryHours
+        }, req.currentUser && req.currentUser.id);
+        await recordSettingsAuditEvent(req, previousSettings, savedSettings, section);
+        return res.redirect('/settings/system?message=' + encodeURIComponent('Email settings saved.') + '#email-delivery');
+      }
+
       if (section === 'audit') {
         const auditEnabled = req.body && (req.body.audit_enabled === '1' || req.body.audit_enabled === 'true');
         const includeRequestMetadata = req.body && (req.body.include_request_metadata === '1' || req.body.include_request_metadata === 'true');
@@ -334,8 +464,17 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
         const auditCategories = Array.from(new Set((Array.isArray(selectedCategories) ? selectedCategories : selectedCategories ? [selectedCategories] : []).map(function (category) {
           return String(category || '').trim().toLowerCase();
         }).filter(function (category) {
-          return AUDIT_CATEGORY_KEYS.includes(category);
+          return AUDIT_CATEGORY_KEYS.includes(category) && category !== 'screen-controls';
         })));
+        const selectedScreenControlCommands = req.body && (req.body['audit_screen_control_commands[]'] !== undefined ? req.body['audit_screen_control_commands[]'] : req.body.audit_screen_control_commands);
+        const screenControlCommands = Array.from(new Set((Array.isArray(selectedScreenControlCommands) ? selectedScreenControlCommands : selectedScreenControlCommands ? [selectedScreenControlCommands] : []).map(function (command) {
+          return String(command || '').trim().toLowerCase();
+        }).filter(function (command) {
+          return SCREEN_CONTROL_COMMAND_KEYS.includes(command);
+        })));
+        if (screenControlCommands.length) {
+          auditCategories.push('screen-controls');
+        }
         const retentionDays = Number(req.body && req.body.audit_retention_days);
         if (!auditCategories.length || !Number.isInteger(retentionDays) || retentionDays < 0 || retentionDays > 3650) {
           const error = new Error('Select at least one audit category and use a retention period between 0 and 3650 days.');
@@ -346,6 +485,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
         const savedSettings = await saveAppSettings(pool, {
           'audit.enabled': auditEnabled,
           'audit.categories': auditCategories,
+          'audit.screen_control_commands': screenControlCommands,
           'audit.include_request_metadata': includeRequestMetadata,
           'audit.retention_days': retentionDays
         }, req.currentUser && req.currentUser.id);
@@ -371,7 +511,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
           error.expose = true;
           throw error;
         }
-        await pool.query('DELETE FROM o_app_settings WHERE setting_key NOT IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', ['announcements.suggested_icons', 'announcements.default_icon', 'announcements.default_duration_value', 'announcements.default_duration_unit', 'player.default_slide_duration_seconds', 'player.default_fade_between_slides', 'player.skip_unavailable_rtmp', 'data-sources.rss_default_interval_value', 'data-sources.rss_default_interval_unit', 'data-sources.api_default_interval_value', 'data-sources.api_default_interval_unit', 'weather.open_meteo_api_key', 'weather.pirate_weather_api_key', 'uploads.image_max_bytes', 'uploads.video_max_bytes', 'uploads.wysiwyg_image_max_bytes', 'uploads.allowed_mime_types', 'security.session_lifetime_days', 'security.allow_user_session_revocation', 'security.max_active_sessions', 'security.login_max_attempts', 'security.login_lockout_minutes', 'security.login_rate_limit_scope', 'security.password_min_length', 'security.password_min_categories', 'security.password_require_lowercase', 'security.password_require_uppercase', 'security.password_require_number', 'security.password_require_symbol', 'security.require_password_change_for_new_users', 'security.require_password_change_after_admin_reset', 'audit.enabled', 'audit.categories', 'audit.include_request_metadata', 'audit.retention_days']);
+        await pool.query('DELETE FROM o_app_settings WHERE setting_key NOT IN (' + ALL_SETTING_KEY_PLACEHOLDERS + ')', ALL_SETTING_KEYS);
         const savedSettings = await saveAppSettings(pool, {
           'uploads.image_max_bytes': imageMaxMb * 1024 * 1024,
           'uploads.video_max_bytes': videoMaxMb * 1024 * 1024,
@@ -408,7 +548,7 @@ module.exports = function registerSettingsPageRoutes(app, deps) {
         error.expose = true;
         throw error;
       }
-      await pool.query('DELETE FROM o_app_settings WHERE setting_key NOT IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', ['announcements.suggested_icons', 'announcements.default_icon', 'announcements.default_duration_value', 'announcements.default_duration_unit', 'player.default_slide_duration_seconds', 'player.default_fade_between_slides', 'player.skip_unavailable_rtmp', 'data-sources.rss_default_interval_value', 'data-sources.rss_default_interval_unit', 'data-sources.api_default_interval_value', 'data-sources.api_default_interval_unit', 'weather.open_meteo_api_key', 'weather.pirate_weather_api_key', 'uploads.image_max_bytes', 'uploads.video_max_bytes', 'uploads.wysiwyg_image_max_bytes', 'uploads.allowed_mime_types', 'security.session_lifetime_days', 'security.allow_user_session_revocation', 'security.max_active_sessions', 'security.login_max_attempts', 'security.login_lockout_minutes', 'security.login_rate_limit_scope', 'security.password_min_length', 'security.password_min_categories', 'security.password_require_lowercase', 'security.password_require_uppercase', 'security.password_require_number', 'security.password_require_symbol', 'security.require_password_change_for_new_users', 'security.require_password_change_after_admin_reset', 'audit.enabled', 'audit.categories', 'audit.include_request_metadata', 'audit.retention_days']);
+      await pool.query('DELETE FROM o_app_settings WHERE setting_key NOT IN (' + ALL_SETTING_KEY_PLACEHOLDERS + ')', ALL_SETTING_KEYS);
       const savedSettings = await saveAppSettings(pool, {
         'announcements.suggested_icons': suggestedIcons
       }, req.currentUser && req.currentUser.id);

src/web/routes/settings/users/form-view-model.js

@@ -22,6 +22,7 @@ function buildUsersAddViewModel(message, currentUser, roles, formValues, message
   return {
     title: 'Add user',
     active: 'users',
+    userManagementMenuOpen: true,
     isEdit: false,
     formId: 'user-form',
     formAction: '/settings/users',
@@ -44,6 +45,7 @@ function buildUsersEditViewModel(user, message, currentUser, roles, sessions) {
   return {
     title: 'Edit user',
     active: 'users',
+    userManagementMenuOpen: true,
     isEdit: true,
     formId: 'user-profile-form',
     formAction: '/settings/users/' + user.id + '/username',

src/web/routes/settings/users/invite.js

@@ -0,0 +1,14 @@
+const { renderView } = require('../../../view');
+
+module.exports = function renderUsersInvitePage(message, currentUser, roles, formValues, messageVariant) {
+  return renderView('settings/users/invite', {
+    title: 'Invite user',
+    active: 'users',
+    userManagementMenuOpen: true,
+    currentUser: currentUser || null,
+    message: message || '',
+    messageVariant: messageVariant || 'success',
+    roles: Array.isArray(roles) ? roles : [],
+    formValues: formValues || {}
+  });
+};

src/web/routes/settings/users/list.js

@@ -6,6 +6,7 @@ module.exports = function renderUsersPage(data, message, currentUser) {
   return renderView('settings/users/list', {
     title: 'Users',
     active: 'users',
+    userManagementMenuOpen: true,
     message: message,
     currentUser: currentUser || null,
     users: data.users || [],

src/web/views/account/index.hbs

@@ -0,0 +1,113 @@
+<div class="page-header">
+  <div>
+    <h2>My account</h2>
+    <p>Update your username, email, display name, and password.</p>
+  </div>
+</div>
+
+<div class="row g-4">
+  <div class="col-12 col-xl-6">
+    <div class="card card-outline card-primary admin-form-card">
+      <div class="card-header bg-body-tertiary">
+        <h3 class="card-title">Account details</h3>
+      </div>
+      <form id="account-profile-form" method="post" action="/account/profile" autocomplete="off" data-async-save data-async-save-refresh-page="true">
+        <div class="card-body">
+          <div class="row g-3">
+            <div class="col-12 col-md-6">
+              <label for="account-username" class="form-label">Username</label>
+              <input id="account-username" type="text" name="username" class="form-control" value="{{username}}" autocomplete="username" data-bwignore="true" data-lpignore="true" data-1p-ignore="true" maxlength="64" required />
+            </div>
+            <div class="col-12 col-md-6">
+              <label for="account-name" class="form-label">Display name</label>
+              <input id="account-name" type="text" name="name" class="form-control" value="{{name}}" autocomplete="name" data-bwignore="true" data-lpignore="true" data-1p-ignore="true" required />
+            </div>
+            <div class="col-12">
+              <label for="account-email" class="form-label">Email address</label>
+              <input id="account-email" type="email" name="email" class="form-control" value="{{email}}" autocomplete="off" data-bwignore="true" data-lpignore="true" data-1p-ignore="true" />
+              <div class="form-text">{{#if emailPending}}Pending verification for {{pendingEmail}}. Enter a different address here to replace it, or resend the verification email below.{{else}}{{#if emailVerified}}Verified{{else}}Not verified{{/if}}. Email is optional; changing the address requires confirmation by email.{{/if}}</div>
+            </div>
+          </div>
+          <input type="hidden" name="current_password" data-account-profile-current-password />
+        </div>
+      </form>
+      {{#if emailPending}}<form method="post" action="/account/email" class="px-3 pb-3"><input type="hidden" name="email" value="{{pendingEmail}}"><button type="submit" class="btn btn-sm btn-outline-primary">Send verification email</button></form>{{/if}}
+    </div>
+
+    {{#if allowUserSessionRevocation}}
+      <div class="card card-outline card-secondary admin-form-card mt-3">
+        <div class="card-header bg-body-tertiary">
+          <h3 class="card-title">Active sessions</h3>
+        </div>
+        <div class="card-body">
+          <div class="d-flex flex-column gap-2">
+            {{#if sessions.length}}
+              {{#each sessions}}
+                <div class="border rounded p-3 {{#if isCurrent}}border-primary bg-primary-subtle{{/if}}">
+                  <div class="d-flex align-items-start justify-content-between gap-3">
+                    <div>
+                      <div class="fw-semibold">{{#if isCurrent}}Current session{{else}}Active session{{/if}}</div>
+                    </div>
+                    {{#unless isCurrent}}
+                      <form method="post" action="/account/sessions/{{id}}/revoke">
+                        <button type="submit" class="btn btn-sm btn-outline-danger">Sign out</button>
+                      </form>
+                    {{/unless}}
+                  </div>
+                  <div class="text-body-secondary small mt-2">{{ipAddress}} · {{userAgent}}</div>
+                  <div class="text-body-secondary small">Created {{createdAtLabel}} · Last used {{lastUsedAtLabel}} · Expires {{expiresAtLabel}}</div>
+                </div>
+              {{/each}}
+            {{else}}
+              <p class="mb-0 text-body-secondary">No active sessions were found.</p>
+            {{/if}}
+          </div>
+        </div>
+        <div class="card-footer d-flex justify-content-end">
+          <form method="post" action="/account/sessions/revoke">
+            <button type="submit" class="btn btn-danger">Sign out other sessions</button>
+          </form>
+        </div>
+      </div>
+    {{/if}}
+  </div>
+
+  <div class="col-12 col-xl-6">
+    <div class="card card-outline card-warning admin-form-card">
+      <div class="card-header bg-body-tertiary">
+        <h3 class="card-title">Password</h3>
+      </div>
+      <form id="account-password-form" method="post" action="/account/password" autocomplete="off" data-async-save data-async-save-refresh-page="true">
+        <div class="card-body">
+          <input type="hidden" name="current_password" data-account-password-current-password />
+          <div class="mb-3">
+            <label for="account-new-password" class="form-label">New password</label>
+            <input id="account-new-password" type="password" name="new_password" class="form-control" autocomplete="off" data-bwignore="true" data-lpignore="true" data-1p-ignore="true" minlength="{{passwordMinimumLength}}" required />
+          </div>
+          <div class="mb-0">
+            <label for="account-confirm-password" class="form-label">Confirm new password</label>
+            <input id="account-confirm-password" type="password" name="confirm_password" class="form-control" autocomplete="off" data-bwignore="true" data-lpignore="true" data-1p-ignore="true" minlength="{{passwordMinimumLength}}" required />
+          </div>
+          <div class="form-text mt-2">{{passwordRequirementsText}}</div>
+        </div>
+      </form>
+    </div>
+    <div class="card card-outline card-secondary admin-form-card mt-3">
+      <div class="card-header bg-body-tertiary">
+        <h3 class="card-title">Confirmation</h3>
+      </div>
+      <div class="card-body">
+        <label for="account-current-password" class="form-label">Current password</label>
+        <input id="account-current-password" type="password" class="form-control" autocomplete="current-password" data-account-current-password required />
+        <div class="form-text">Required to save account details or change your password.</div>
+      </div>
+      <div class="card-footer d-flex justify-content-end">
+        <div class="btn-group" role="group" aria-label="Account change actions">
+          <button type="submit" class="btn btn-success" form="account-profile-form" name="save_action" value="save">Save account details</button>
+          <button type="submit" class="btn btn-warning" form="account-password-form" name="save_action" value="save">Change password</button>
+          <a class="btn btn-secondary" href="{{returnUrl}}" data-confirm-unsaved="You have unsaved changes. Leave this page?">Cancel</a>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>

src/web/views/account/password.hbs

@@ -1,95 +0,0 @@
-<div class="page-header">
-  <div>
-    <h2>My account</h2>
-    <p>Update your display name and password.</p>
-  </div>
-</div>
-
-<div class="row g-4">
-  <div class="col-12 col-xl-6">
-    <div class="card card-outline card-primary admin-form-card">
-      <div class="card-header">
-        <h3 class="card-title">Display name</h3>
-      </div>
-      <form id="account-name-form" method="post" action="/account/name" data-async-save>
-        <div class="card-body">
-          <input id="account-name" type="text" name="name" class="form-control" value="{{name}}" autocomplete="name" required />
-        </div>
-        <div class="card-footer d-flex justify-content-end">
-          <div class="btn-group" role="group" aria-label="Display name actions">
-            <button type="submit" class="btn btn-success" form="account-name-form" name="save_action" value="save">Save</button>
-            <a class="btn btn-warning" href="/dashboard" data-confirm-unsaved="You have unsaved changes. Leave this page?">Cancel</a>
-          </div>
-        </div>
-      </form>
-    </div>
-
-    {{#if allowUserSessionRevocation}}
-      <div class="card card-outline card-secondary admin-form-card mt-3">
-        <div class="card-header">
-          <h3 class="card-title">Active sessions</h3>
-        </div>
-        <div class="card-body">
-          <div class="d-flex flex-column gap-2">
-            {{#if sessions.length}}
-              {{#each sessions}}
-                <div class="border rounded p-3 {{#if isCurrent}}border-primary bg-primary-subtle{{/if}}">
-                  <div class="d-flex align-items-start justify-content-between gap-3">
-                    <div>
-                      <div class="fw-semibold">{{#if isCurrent}}Current session{{else}}Active session{{/if}}</div>
-                    </div>
-                    {{#unless isCurrent}}
-                      <form method="post" action="/account/sessions/{{id}}/revoke">
-                        <button type="submit" class="btn btn-sm btn-outline-danger">Sign out</button>
-                      </form>
-                    {{/unless}}
-                  </div>
-                  <div class="text-body-secondary small mt-2">{{ipAddress}} · {{userAgent}}</div>
-                  <div class="text-body-secondary small">Created {{createdAtLabel}} · Last used {{lastUsedAtLabel}} · Expires {{expiresAtLabel}}</div>
-                </div>
-              {{/each}}
-            {{else}}
-              <p class="mb-0 text-body-secondary">No active sessions were found.</p>
-            {{/if}}
-          </div>
-        </div>
-        <div class="card-footer d-flex justify-content-end">
-          <form method="post" action="/account/sessions/revoke">
-            <button type="submit" class="btn btn-danger">Sign out other sessions</button>
-          </form>
-        </div>
-      </div>
-    {{/if}}
-  </div>
-
-  <div class="col-12 col-xl-6">
-    <div class="card card-outline card-warning admin-form-card">
-      <div class="card-header">
-        <h3 class="card-title">Password</h3>
-      </div>
-      <form id="account-password-form" method="post" action="/account/password" data-async-save data-async-save-refresh-page="true">
-        <div class="card-body">
-          <div class="mb-3">
-            <label for="account-current-password" class="form-label">Current password</label>
-            <input id="account-current-password" type="password" name="current_password" class="form-control" autocomplete="current-password" required />
-          </div>
-          <div class="mb-3">
-            <label for="account-new-password" class="form-label">New password</label>
-            <input id="account-new-password" type="password" name="new_password" class="form-control" autocomplete="new-password" minlength="{{passwordMinimumLength}}" required />
-          </div>
-          <div class="mb-0">
-            <label for="account-confirm-password" class="form-label">Confirm new password</label>
-            <input id="account-confirm-password" type="password" name="confirm_password" class="form-control" autocomplete="new-password" minlength="{{passwordMinimumLength}}" required />
-          </div>
-          <div class="form-text mt-2">{{passwordRequirementsText}}</div>
-        </div>
-        <div class="card-footer d-flex justify-content-end">
-          <div class="btn-group" role="group" aria-label="Password actions">
-            <button type="submit" class="btn btn-success" form="account-password-form" name="save_action" value="save">Save</button>
-            <a class="btn btn-warning" href="{{returnUrl}}" data-confirm-unsaved="You have unsaved changes. Leave this page?">Cancel</a>
-          </div>
-        </div>
-      </form>
-    </div>
-  </div>
-</div>

src/web/views/auth/accept-invite.hbs

@@ -0,0 +1,27 @@
+<div class="login-logo text-center mb-3"><strong>Pulse</strong> Signage</div>
+{{#if isValidInvitation}}
+<div class="card mx-auto" style="max-width: 30rem;"><div class="card-body p-4">
+  {{#if message}}<div class="alert alert-warning">{{message}}</div>{{/if}}
+  <form method="post" action="/accept-invite">
+    <input type="hidden" name="token" value="{{token}}">
+    <div class="mb-3"><label for="invite-email" class="form-label">Email address</label><input id="invite-email" type="email" class="form-control" value="{{email}}" disabled></div>
+    <div class="mb-3"><label for="invite-username" class="form-label">Username</label><input id="invite-username" name="username" type="text" class="form-control" autocomplete="username" maxlength="255" required></div>
+    <div class="mb-3"><label for="invite-name" class="form-label">Display name</label><input id="invite-name" name="name" type="text" class="form-control" value="{{name}}" autocomplete="name" maxlength="255" required></div>
+    <div class="mb-3"><label for="invite-password" class="form-label">Password</label><input id="invite-password" name="password" type="password" class="form-control" autocomplete="new-password" minlength="{{passwordMinimumLength}}" required></div>
+    <div class="mb-3"><label for="invite-confirm-password" class="form-label">Confirm password</label><input id="invite-confirm-password" name="confirm_password" type="password" class="form-control" autocomplete="new-password" minlength="{{passwordMinimumLength}}" required></div>
+    <div class="form-text mb-3">{{passwordRequirementsText}}</div>
+    <button type="submit" class="btn btn-primary w-100">Create account</button>
+  </form>
+</div></div>
+{{else}}
+<div class="card login-card email-verification-error-card mx-auto">
+  <div class="email-verification-error-card__header">
+    <div class="email-verification-error-card__icon"><i class="bi bi-exclamation-lg" aria-hidden="true"></i></div>
+    <h1 class="h4 mb-0">Invitation link unavailable</h1>
+  </div>
+  <div class="card-body login-card-body text-center">
+    <p class="mb-4">{{message}}</p>
+    <a href="/login" class="btn btn-primary w-100">Return to sign in</a>
+  </div>
+</div>
+{{/if}}

src/web/views/auth/email-verification-error.hbs

@@ -0,0 +1,11 @@
+<div class="login-logo text-center mb-3"><strong>Pulse</strong> Signage</div>
+<div class="card login-card email-verification-error-card mx-auto">
+  <div class="email-verification-error-card__header">
+    <div class="email-verification-error-card__icon"><i class="bi bi-exclamation-lg" aria-hidden="true"></i></div>
+    <h1 class="h4 mb-0">Verification link unavailable</h1>
+  </div>
+  <div class="card-body login-card-body text-center">
+    <p class="mb-4">{{message}}</p>
+    <a href="/login" class="btn btn-primary w-100">Return to sign in</a>
+  </div>
+</div>

src/web/views/auth/email-verified.hbs

@@ -0,0 +1,11 @@
+<div class="login-logo text-center mb-3"><strong>Pulse</strong> Signage</div>
+<div class="card login-card email-verified-card mx-auto">
+  <div class="email-verified-card__header">
+    <div class="email-verified-card__icon"><i class="bi bi-check-lg" aria-hidden="true"></i></div>
+    <h1 class="h4 mb-0">Email verified</h1>
+  </div>
+  <div class="card-body login-card-body text-center">
+    <p class="mb-4">Your email address has been verified successfully.</p>
+    <a href="/login" class="btn btn-primary w-100">Continue to sign in</a>
+  </div>
+</div>

src/web/views/auth/forgot-password.hbs

@@ -0,0 +1,11 @@
+<div class="login-logo text-center mb-3"><strong>Pulse</strong> Signage</div>
+<div class="card mx-auto" style="max-width: 26rem;"><div class="card-body p-4">
+  <h1 class="h4 mb-3">Reset password</h1>
+  {{#if message}}<div class="alert alert-warning">{{message}}</div>{{/if}}
+  <form method="post" action="/forgot-password">
+    <label for="reset-identity" class="form-label">Username or email</label>
+    <input id="reset-identity" name="identity" type="text" class="form-control mb-3" autocomplete="username" required>
+    <button type="submit" class="btn btn-primary w-100">Email reset link</button>
+  </form>
+  <a class="d-block text-center mt-3" href="/login">Back to sign in</a>
+</div></div>

src/web/views/auth/login.hbs

@@ -1,29 +1,44 @@
 <div class="login-logo text-center mb-3">
   <strong>Pulse</strong> Signage
 </div>
-<div class="card mx-auto" style="max-width: 26rem;">
-  <div class="card-body p-4">
-    <h1 class="h4 mb-3">Sign in</h1>
+<div class="card login-card mx-auto">
+  <div class="card-body login-card-body">
+    <p class="login-box-msg">Sign in to start your session</p>
     {{#if message}}
-      <div class="alert alert-warning">{{message}}</div>
+      <div class="alert alert-warning py-2">{{message}}</div>
     {{/if}}
     <form method="post" action="/login">
       {{#if returnTo}}
         <input type="hidden" name="returnTo" value="{{returnTo}}" />
       {{/if}}
       <div class="mb-3">
-        <label for="username" class="form-label">Username</label>
-        <input id="username" name="username" type="text" class="form-control" autocomplete="username" value="{{username}}" required />
+        <label for="username" class="visually-hidden">Username or email</label>
+        <div class="input-group">
+          <input id="username" name="username" type="text" class="form-control" placeholder="Username or email" autocomplete="username" value="{{username}}" required />
+          <span class="input-group-text" aria-hidden="true"><i class="bi bi-person"></i></span>
+        </div>
       </div>
       <div class="mb-3">
-        <label for="password" class="form-label">Password</label>
-        <input id="password" name="password" type="password" class="form-control" autocomplete="current-password" required />
+        <label for="password" class="visually-hidden">Password</label>
+        <div class="input-group">
+          <input id="password" name="password" type="password" class="form-control" placeholder="Password" autocomplete="current-password" required />
+          <span class="input-group-text" aria-hidden="true"><i class="bi bi-lock"></i></span>
+        </div>
       </div>
-      <div class="form-check mb-3">
-        <input id="remember-me" name="remember_me" type="checkbox" class="form-check-input" value="1" />
-        <label for="remember-me" class="form-check-label">Remember me</label>
+      <div class="row align-items-center g-3 mb-3">
+        <div class="col-7">
+          <div class="form-check">
+            <input id="remember-me" name="remember_me" type="checkbox" class="form-check-input" value="1" />
+            <label for="remember-me" class="form-check-label">Remember me</label>
+          </div>
+        </div>
+        <div class="col-5">
+          <button type="submit" class="btn btn-primary w-100">Sign in</button>
+        </div>
       </div>
-      <button type="submit" class="btn btn-primary w-100">Sign in</button>
     </form>
+    {{#if showForgotPassword}}
+      <p class="mb-0 text-center"><a href="/forgot-password">I forgot my password</a></p>
+    {{/if}}
   </div>
 </div>

src/web/views/auth/reset-password.hbs

@@ -0,0 +1,14 @@
+<div class="login-logo text-center mb-3"><strong>Pulse</strong> Signage</div>
+<div class="card mx-auto" style="max-width: 26rem;"><div class="card-body p-4">
+  <h1 class="h4 mb-3">Choose a new password</h1>
+  {{#if message}}<div class="alert alert-warning">{{message}}</div>{{/if}}
+  <form method="post" action="/reset-password">
+    <input type="hidden" name="token" value="{{token}}">
+    <label for="reset-password" class="form-label">New password</label>
+    <input id="reset-password" name="password" type="password" class="form-control mb-3" autocomplete="new-password" minlength="{{passwordMinimumLength}}" required>
+    <label for="reset-confirm-password" class="form-label">Confirm password</label>
+    <input id="reset-confirm-password" name="confirm_password" type="password" class="form-control mb-3" autocomplete="new-password" minlength="{{passwordMinimumLength}}" required>
+    <div class="form-text mb-3">{{passwordRequirementsText}}</div>
+    <button type="submit" class="btn btn-primary w-100">Update password</button>
+  </form>
+</div></div>

src/web/views/data-sources/api-sources/form.hbs

@@ -5,190 +5,222 @@
   </div>
 </div>
 
-<form id="api-source-form" method="post" action="{{formAction}}" {{{formAttrs}}}>
-  <div class="card card-outline card-primary admin-form-card">
-    <div class="card-header">
-      <h3 class="card-title">API source details</h3>
-    </div>
-    <div class="card-body">
-      <div class="row g-3 mb-4">
-        <div class="col-12 col-lg-5">
-          <label for="api-source-name" class="form-label">Name</label>
-          <input id="api-source-name" name="name" class="form-control" value="{{apiSource.name}}" maxlength="128" data-limit-text-length required />
-        </div>
-        <div class="col-12 col-lg-5">
-          <label for="api-source-url" class="form-label">API URL</label>
-          <input id="api-source-url" name="api_url" type="url" class="form-control" value="{{apiSource.apiUrl}}" maxlength="1024" data-limit-text-length placeholder="https://example.com/api.json" required />
-        </div>
-        <div class="col-12 col-lg-2">
-          <label for="api-source-request-method" class="form-label">Request method</label>
-          <select id="api-source-request-method" name="request_method" class="form-select" data-api-source-request-method>
-            <option value="GET" {{#if (eq apiSource.requestMethod 'GET')}}selected{{/if}}>GET</option>
-            <option value="POST" {{#if (eq apiSource.requestMethod 'POST')}}selected{{/if}}>POST</option>
-          </select>
-        </div>
+{{#if isEdit}}<form id="api-source-toggle-form" method="post" action="/data-sources/api-sources/{{apiSource.id}}" data-async-command><input type="hidden" name="data_source_action" value="toggle" /></form>{{/if}}
+
+<div class="row g-3 align-items-start api-source-layout">
+  <div class="col-12">
+    <form id="api-source-form" method="post" action="{{formAction}}" {{{formAttrs}}}>
+      <div class="card card-outline card-primary admin-form-card">
+      <div class="card-header bg-body-tertiary">
+        <h3 class="card-title">Connection</h3>
       </div>
-      <div class="mb-4" data-api-source-request-section>
-        <h4 class="api-source-section-heading">Request</h4>
-        <div class="row g-3 align-items-end">
-          <div class="col-12">
-            <div class="form-text mb-2">POST requests use JSON with the existing authentication settings.</div>
-            <textarea id="api-source-request-body" name="request_body_json" class="form-control font-monospace" rows="5" data-api-source-request-body placeholder="{&#10;  &quot;ids&quot;: [1, 2, 3]&#10;}" spellcheck="false">{{apiSource.requestBodyJson}}</textarea>
+      <div class="card-body">
+        <div class="row g-3 g-md-3">
+          <div class="col-12 col-lg-5">
+            <label for="api-source-name" class="form-label">Name</label>
+            <input id="api-source-name" name="name" class="form-control" value="{{apiSource.name}}" maxlength="128" data-limit-text-length required />
           </div>
-        </div>
-      </div>
-      <div class="mb-4">
-        <h4 class="api-source-section-heading">Access and parsing</h4>
-        <div class="row g-3 align-items-end">
-          <div class="col-12 col-md-4">
-            <label for="api-source-auth-method" class="form-label">Auth method</label>
-            <select id="api-source-auth-method" name="auth_method" class="form-select" data-api-source-auth-method>
-              <option value="none" {{#if (eq apiSource.authMethod 'none')}}selected{{/if}}>None</option>
-              <option value="basic" {{#if (eq apiSource.authMethod 'basic')}}selected{{/if}}>Basic</option>
-              <option value="bearer" {{#if (eq apiSource.authMethod 'bearer')}}selected{{/if}}>Bearer token</option>
-              <option value="api_key_header" {{#if (eq apiSource.authMethod 'api_key_header')}}selected{{/if}}>API key header</option>
-              <option value="token_login" {{#if (eq apiSource.authMethod 'token_login')}}selected{{/if}}>Login then token</option>
+          <div class="col-12 col-lg-5">
+            <label for="api-source-url" class="form-label">API URL</label>
+            <input id="api-source-url" name="api_url" type="url" class="form-control" value="{{apiSource.apiUrl}}" maxlength="1024" data-limit-text-length placeholder="https://example.com/api.json" required />
+          </div>
+          <div class="col-12 col-lg-2">
+            <label for="api-source-request-method" class="form-label">Request method</label>
+            <select id="api-source-request-method" name="request_method" class="form-select" data-api-source-request-method>
+              <option value="GET" {{#if (eq apiSource.requestMethod 'GET')}}selected{{/if}}>GET</option>
+              <option value="POST" {{#if (eq apiSource.requestMethod 'POST')}}selected{{/if}}>POST</option>
             </select>
           </div>
-          <div class="col-12 col-md-8">
-            <label for="api-source-items-path" class="form-label">Items path</label>
-            <input id="api-source-items-path" name="items_path" class="form-control" value="{{apiSource.itemsPath}}" maxlength="255" data-limit-text-length placeholder="items, results.data, or another array path" />
-          </div>
         </div>
-        <div class="row mt-2">
-          <div class="col-12 col-md-8 offset-md-4">
-            <div class="form-text">Optional. Use dot notation to change the default base for placeholders.</div>
-          </div>
-        </div>
-      </div>
-      <div class="mb-4" data-api-source-auth-details-section>
-        <h4 class="api-source-section-heading">Authentication details</h4>
-        <div class="row g-3 mb-3" data-api-source-auth-panel="basic" hidden>
-          <div class="col-12 col-md-6">
-            <label for="api-source-auth-username" class="form-label">Username</label>
-            <input id="api-source-auth-username" name="auth_username" class="form-control" value="{{apiSource.authUsername}}" maxlength="255" data-limit-text-length autocomplete="username" />
-          </div>
-          <div class="col-12 col-md-6">
-            <label for="api-source-auth-password" class="form-label">Password</label>
-            <input id="api-source-auth-password" name="auth_password" type="password" class="form-control" value="{{apiSource.authPassword}}" maxlength="255" data-limit-text-length autocomplete="current-password" />
-          </div>
-        </div>
-        <div class="row g-3 mb-3" data-api-source-auth-panel="bearer" hidden>
-          <div class="col-12">
-            <label for="api-source-auth-bearer-token" class="form-label">Bearer token</label>
-            <div class="input-group">
-              <input id="api-source-auth-bearer-token" name="auth_bearer_token" type="password" class="form-control" value="{{apiSource.authBearerToken}}" maxlength="255" data-limit-text-length autocomplete="off" spellcheck="false" autocapitalize="off" autocorrect="off" data-api-source-bearer-token-input />
-              <button type="button" class="btn btn-outline-secondary" aria-label="Show bearer token" aria-pressed="false" data-api-source-bearer-token-toggle>
-                <i class="bi bi-eye" aria-hidden="true"></i>
-              </button>
+        <div class="mb-2" data-api-source-request-section>
+          <h4 class="api-source-section-heading">Request</h4>
+          <div class="row g-3 align-items-end">
+            <div class="col-12">
+              <div class="form-text mb-2">POST requests use JSON with the existing authentication settings.</div>
+              <textarea id="api-source-request-body" name="request_body_json" class="form-control font-monospace" rows="5" data-api-source-request-body placeholder="{&#10;  &quot;ids&quot;: [1, 2, 3]&#10;}" spellcheck="false">{{apiSource.requestBodyJson}}</textarea>
             </div>
           </div>
         </div>
-        <div class="row g-3 mb-3" data-api-source-auth-panel="api_key_header" hidden>
-          <div class="col-12 col-md-5">
-            <label for="api-source-auth-header-name" class="form-label">Header name</label>
-            <input id="api-source-auth-header-name" name="auth_header_name" class="form-control" value="{{apiSource.authHeaderName}}" maxlength="255" data-limit-text-length placeholder="X-API-Key" />
+        <div class="mt-3 mb-2">
+          <h4 class="api-source-section-heading">Access and parsing</h4>
+          <div class="row g-3 align-items-end">
+            <div class="col-12 col-md-4">
+              <label for="api-source-auth-method" class="form-label">Auth method</label>
+              <select id="api-source-auth-method" name="auth_method" class="form-select" data-api-source-auth-method>
+                <option value="none" {{#if (eq apiSource.authMethod 'none')}}selected{{/if}}>None</option>
+                <option value="basic" {{#if (eq apiSource.authMethod 'basic')}}selected{{/if}}>Basic</option>
+                <option value="bearer" {{#if (eq apiSource.authMethod 'bearer')}}selected{{/if}}>Bearer token</option>
+                <option value="api_key_header" {{#if (eq apiSource.authMethod 'api_key_header')}}selected{{/if}}>API key header</option>
+                <option value="token_login" {{#if (eq apiSource.authMethod 'token_login')}}selected{{/if}}>Login then token</option>
+              </select>
+            </div>
+            <div class="col-12 col-md-8">
+              <label for="api-source-items-path" class="form-label">Items path</label>
+              <input id="api-source-items-path" name="items_path" class="form-control" value="{{apiSource.itemsPath}}" maxlength="255" data-limit-text-length placeholder="items, results.data, or another array path" />
+            </div>
           </div>
-          <div class="col-12 col-md-7">
-            <label for="api-source-auth-header-value" class="form-label">Header value</label>
-            <input id="api-source-auth-header-value" name="auth_header_value" class="form-control" value="{{apiSource.authHeaderValue}}" maxlength="255" data-limit-text-length />
+          <div class="row">
+            <div class="col-12 col-md-8 offset-md-4">
+              <div class="form-text">Optional. Use dot notation to change the default base for placeholders.</div>
+            </div>
           </div>
         </div>
-        <div class="row g-3 mb-3" data-api-source-auth-panel="token_login" hidden>
-          <div class="col-12 col-md-8">
-            <label for="api-source-token-url" class="form-label">Login / token URL</label>
-            <input id="api-source-token-url" name="token_url" type="url" class="form-control" value="{{apiSource.tokenUrl}}" maxlength="1024" placeholder="https://example.com/login" />
-            <div class="form-text">The login request is sent as POST with the JSON body below.</div>
-          </div>
-          <div class="col-12 col-md-4">
-            <label for="api-source-token-response-path" class="form-label">Token response path</label>
-            <input id="api-source-token-response-path" name="token_response_path" class="form-control" value="{{apiSource.tokenResponsePath}}" placeholder="access_token" />
-            <div class="form-text">Example: <code>data.token</code></div>
-          </div>
-          <div class="col-12">
-            <label for="api-source-token-body" class="form-label">Login request body</label>
-            <textarea id="api-source-token-body" name="token_request_body_json" class="form-control font-monospace" rows="4" placeholder="{&#10;  &quot;username&quot;: &quot;...&quot;,&#10;  &quot;password&quot;: &quot;...&quot;&#10;}" spellcheck="false">{{apiSource.tokenRequestBodyJson}}</textarea>
-          </div>
-          <div class="col-12 col-md-6">
-            <label for="api-source-token-header-name" class="form-label">API token header</label>
-            <input id="api-source-token-header-name" name="token_header_name" class="form-control" value="{{apiSource.tokenHeaderName}}" placeholder="Authorization" />
-          </div>
-          <div class="col-12 col-md-6">
-            <label for="api-source-token-header-prefix" class="form-label">Token prefix</label>
-            <input id="api-source-token-header-prefix" name="token_header_prefix" class="form-control" value="{{apiSource.tokenHeaderPrefix}}" placeholder="Bearer" />
+        <div>
+          <h4 class="api-source-section-heading">Refresh</h4>
+          <div class="row g-3">
+            <div class="col-12 col-md-4">
+              <label for="api-source-interval" class="form-label">Update interval</label>
+              <input id="api-source-interval" name="update_interval_value" type="number" min="1" class="form-control" value="{{apiSource.updateIntervalValue}}" required />
+            </div>
+            <div class="col-12 col-md-4">
+              <label for="api-source-interval-unit" class="form-label">Unit</label>
+              <select id="api-source-interval-unit" name="update_interval_unit" class="form-select">
+                <option value="seconds" {{#if (eq apiSource.updateIntervalUnit 'seconds')}}selected{{/if}}>Seconds</option>
+                <option value="minutes" {{#if (eq apiSource.updateIntervalUnit 'minutes')}}selected{{/if}}>Minutes</option>
+                <option value="hours" {{#if (eq apiSource.updateIntervalUnit 'hours')}}selected{{/if}}>Hours</option>
+              </select>
+            </div>
           </div>
         </div>
       </div>
-      <div>
-        <h4 class="api-source-section-heading">Refresh</h4>
-        <div class="row g-3">
-          <div class="col-12 col-md-4">
-            <label for="api-source-interval" class="form-label">Update interval</label>
-            <input id="api-source-interval" name="update_interval_value" type="number" min="1" class="form-control" value="{{apiSource.updateIntervalValue}}" required />
+        <div class="card-footer d-flex justify-content-end align-items-center">
+          <div class="me-auto">{{#if isEdit}}{{#if (hasPermission currentUser "api-sources.update")}}<button type="submit" form="api-source-toggle-form" data-async-data-source-toggle data-enabled="{{#if apiSource.enabled}}true{{else}}false{{/if}}" class="btn {{#if apiSource.enabled}}btn-danger{{else}}btn-success{{/if}}"><i class="bi {{#if apiSource.enabled}}bi-pause-fill{{else}}bi-play-fill{{/if}} me-1" aria-hidden="true"></i>{{#if apiSource.enabled}}Disable{{else}}Enable{{/if}}</button>{{/if}} {{#if (hasPermission currentUser "api-sources.allow")}}<button type="button" data-manual-refresh-url="/data-sources/api-sources/{{apiSource.id}}/refresh" class="btn btn-outline-secondary"><i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh now</button>{{/if}}{{/if}}</div>
+          {{{saveActionButtons formId="api-source-form" saveUrl=formAction cancelUrl=cancelUrl deleteUrl=deleteUrl deleteDisabled=deleteDisabled showSaveAndClose=showSaveSecondaryActions showSaveAndNew=showSaveSecondaryActions}}}
+        </div>
+      </div>
+      <div class="card card-outline card-info admin-form-card mt-3 overflow-hidden api-source-auth-card{{#if isEdit}} collapsed-card{{/if}}" data-api-source-auth-card hidden>
+        <div class="card-header bg-body-tertiary d-flex align-items-center">
+          <h3 class="card-title mb-0">Authentication</h3>
+          <div class="card-tools d-flex align-items-center ms-auto me-0 flex-shrink-0">
+            <button type="button" class="btn btn-tool p-0 text-body-secondary" data-lte-toggle="card-collapse" aria-label="Toggle authentication settings" title="Toggle authentication settings">
+              <i class="bi bi-plus-lg" aria-hidden="true" data-lte-icon="expand"></i>
+              <i class="bi bi-dash-lg" aria-hidden="true" data-lte-icon="collapse"></i>
+            </button>
           </div>
-          <div class="col-12 col-md-4">
-            <label for="api-source-interval-unit" class="form-label">Unit</label>
-            <select id="api-source-interval-unit" name="update_interval_unit" class="form-select">
-              <option value="seconds" {{#if (eq apiSource.updateIntervalUnit 'seconds')}}selected{{/if}}>Seconds</option>
-              <option value="minutes" {{#if (eq apiSource.updateIntervalUnit 'minutes')}}selected{{/if}}>Minutes</option>
-              <option value="hours" {{#if (eq apiSource.updateIntervalUnit 'hours')}}selected{{/if}}>Hours</option>
-            </select>
+        </div>
+        <div class="card-body">
+          <div class="mb-4" data-api-source-auth-details-section>
+            <h4 class="api-source-section-heading">Authentication details</h4>
+            <div class="row g-3 mb-3" data-api-source-auth-panel="basic" hidden>
+              <div class="col-12 col-md-6">
+                <label for="api-source-auth-username" class="form-label">Username</label>
+                <input id="api-source-auth-username" name="auth_username" class="form-control" value="{{apiSource.authUsername}}" maxlength="255" data-limit-text-length autocomplete="username" />
+              </div>
+              <div class="col-12 col-md-6">
+                <label for="api-source-auth-password" class="form-label">Password</label>
+                <input id="api-source-auth-password" name="auth_password" type="password" class="form-control" value="{{apiSource.authPassword}}" maxlength="255" data-limit-text-length autocomplete="current-password" />
+              </div>
+            </div>
+            <div class="row g-3 mb-3" data-api-source-auth-panel="bearer" hidden>
+              <div class="col-12">
+                <label for="api-source-auth-bearer-token" class="form-label">Bearer token</label>
+                <div class="input-group">
+                  <input id="api-source-auth-bearer-token" name="auth_bearer_token" type="password" class="form-control" value="{{apiSource.authBearerToken}}" maxlength="255" data-limit-text-length autocomplete="off" spellcheck="false" autocapitalize="off" autocorrect="off" data-api-source-bearer-token-input />
+                  <button type="button" class="btn btn-outline-secondary" aria-label="Show bearer token" aria-pressed="false" data-api-source-bearer-token-toggle>
+                    <i class="bi bi-eye" aria-hidden="true"></i>
+                  </button>
+                </div>
+              </div>
+            </div>
+            <div class="row g-3 mb-3" data-api-source-auth-panel="api_key_header" hidden>
+              <div class="col-12 col-md-5">
+                <label for="api-source-auth-header-name" class="form-label">Header name</label>
+                <input id="api-source-auth-header-name" name="auth_header_name" class="form-control" value="{{apiSource.authHeaderName}}" maxlength="255" data-limit-text-length placeholder="X-API-Key" />
+              </div>
+              <div class="col-12 col-md-7">
+                <label for="api-source-auth-header-value" class="form-label">Header value</label>
+                <input id="api-source-auth-header-value" name="auth_header_value" class="form-control" value="{{apiSource.authHeaderValue}}" maxlength="255" data-limit-text-length />
+              </div>
+            </div>
+            <div class="row g-3 mb-3" data-api-source-auth-panel="token_login" hidden>
+              <div class="col-12 col-md-8">
+                <label for="api-source-token-url" class="form-label">Login / token URL</label>
+                <input id="api-source-token-url" name="token_url" type="url" class="form-control" value="{{apiSource.tokenUrl}}" maxlength="1024" placeholder="https://example.com/login" />
+                <div class="form-text">The login request is sent as POST with the JSON body below.</div>
+              </div>
+              <div class="col-12 col-md-4">
+                <label for="api-source-token-response-path" class="form-label">Token response path</label>
+                <input id="api-source-token-response-path" name="token_response_path" class="form-control" value="{{apiSource.tokenResponsePath}}" placeholder="access_token" />
+                <div class="form-text">Example: <code>data.token</code></div>
+              </div>
+              <div class="col-12">
+                <label for="api-source-token-body" class="form-label">Login request body</label>
+                <textarea id="api-source-token-body" name="token_request_body_json" class="form-control font-monospace" rows="4" placeholder="{&#10;  &quot;username&quot;: &quot;...&quot;,&#10;  &quot;password&quot;: &quot;...&quot;&#10;}" spellcheck="false">{{apiSource.tokenRequestBodyJson}}</textarea>
+              </div>
+              <div class="col-12 col-md-8">
+                <label for="api-source-token-refresh-url" class="form-label">Refresh URL</label>
+                <input id="api-source-token-refresh-url" name="token_refresh_url" type="url" class="form-control" value="{{apiSource.tokenRefreshUrl}}" maxlength="1024" placeholder="Optional; defaults to the login URL" />
+              </div>
+              <div class="col-12 col-md-4">
+                <label for="api-source-token-refresh-response-path" class="form-label">Refresh token response path</label>
+                <input id="api-source-token-refresh-response-path" name="token_refresh_response_path" class="form-control" value="{{apiSource.tokenRefreshResponsePath}}" maxlength="255" placeholder="refresh_token" />
+              </div>
+              <div class="col-12">
+                <label for="api-source-token-refresh-body" class="form-label">Refresh request body</label>
+                <textarea id="api-source-token-refresh-body" name="token_refresh_request_body_json" class="form-control font-monospace" rows="3" placeholder="{&#10;  &quot;grant_type&quot;: &quot;refresh_token&quot;,&#10;  &quot;refresh_token&quot;: &quot;&#123;&#123;refresh_token&#125;&#125;&quot;&#10;}" spellcheck="false">{{apiSource.tokenRefreshRequestBodyJson}}</textarea>
+                <div class="form-text">Optional. Leave blank for the standard JSON refresh request. Use <code>&#123;&#123;refresh_token&#125;&#125;</code> where the current refresh token belongs.</div>
+              </div>
+              <div class="col-12 col-md-6">
+                <label for="api-source-token-header-name" class="form-label">API token header</label>
+                <input id="api-source-token-header-name" name="token_header_name" class="form-control" value="{{apiSource.tokenHeaderName}}" placeholder="Authorization" />
+              </div>
+              <div class="col-12 col-md-6">
+                <label for="api-source-token-header-prefix" class="form-label">Token prefix</label>
+                <input id="api-source-token-header-prefix" name="token_header_prefix" class="form-control" value="{{apiSource.tokenHeaderPrefix}}" placeholder="Bearer" />
+              </div>
+            </div>
           </div>
         </div>
       </div>
-    </div>
-    <div class="card-footer d-flex justify-content-end align-items-center">
-      <div class="me-auto">{{#if isEdit}}{{#if (hasPermission currentUser "api-sources.update")}}<button type="submit" form="api-source-toggle-form" data-async-data-source-toggle data-enabled="{{#if apiSource.enabled}}true{{else}}false{{/if}}" class="btn {{#if apiSource.enabled}}btn-danger{{else}}btn-success{{/if}}"><i class="bi {{#if apiSource.enabled}}bi-pause-fill{{else}}bi-play-fill{{/if}} me-1" aria-hidden="true"></i>{{#if apiSource.enabled}}Disable{{else}}Enable{{/if}}</button>{{/if}} {{#if (hasPermission currentUser "api-sources.allow")}}<button type="button" data-manual-refresh-url="/data-sources/api-sources/{{apiSource.id}}/refresh" class="btn btn-outline-secondary"><i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh now</button>{{/if}}{{/if}}</div>
-      {{{saveActionButtons formId="api-source-form" saveUrl=formAction cancelUrl=cancelUrl deleteUrl=deleteUrl deleteDisabled=deleteDisabled showSaveAndClose=showSaveSecondaryActions showSaveAndNew=showSaveSecondaryActions}}}
-    </div>
+    </form>
   </div>
-</form>
-{{#if isEdit}}<form id="api-source-toggle-form" method="post" action="/data-sources/api-sources/{{apiSource.id}}" data-async-command><input type="hidden" name="data_source_action" value="toggle" /></form>{{/if}}
-
-<div class="card card-outline card-secondary mt-3" id="api-source-response-panel">
-  <div class="card-header d-flex align-items-center">
-    <h3 class="card-title mb-0">Latest response</h3>
-    {{#if lastResponseJson}}
-      <div class="btn-group btn-group-sm ms-auto" role="group" aria-label="JSON tree actions">
-        <button type="button" class="btn btn-outline-secondary" data-json-toggle-collapse-all>
-          <i class="bi bi-arrows-collapse me-1"></i>
-          Collapse all
-        </button>
-        <button type="button" class="btn btn-outline-secondary" data-json-toggle-expand-all>
-          <i class="bi bi-arrows-expand me-1"></i>
-          Expand all
-        </button>
-      </div>
-    {{/if}}
-  </div>
-  <div class="card-body">
-    {{#if lastPullError}}
-      <div class="alert alert-warning">{{lastPullError}}</div>
-    {{/if}}
-    <dl class="row">
-      <dt class="col-12 col-md-3">Last pulled</dt>
-      <dd class="col-12 col-md-9">
-        {{#if apiSource.lastPulledAtValue}}
-          <time data-local-datetime datetime="{{apiSource.lastPulledAtValue}}">{{#if apiSource.lastPulledAtLabel}}{{apiSource.lastPulledAtLabel}}{{else}}{{apiSource.lastPulledAtValue}}{{/if}}</time>
-        {{else}}
-          -
+  <div class="col-12">
+    <div class="card card-outline card-secondary api-source-response-card" id="api-source-response-panel">
+      <div class="card-header bg-body-tertiary d-flex align-items-center">
+        <h3 class="card-title mb-0">Latest response</h3>
+        {{#if lastResponseJson}}
+          <div class="btn-group btn-group-sm ms-auto" role="group" aria-label="JSON tree actions">
+            <button type="button" class="btn btn-outline-secondary" data-json-toggle-collapse-all>
+              <i class="bi bi-arrows-collapse me-1"></i>
+              Collapse all
+            </button>
+            <button type="button" class="btn btn-outline-secondary" data-json-toggle-expand-all>
+              <i class="bi bi-arrows-expand me-1"></i>
+              Expand all
+            </button>
+          </div>
         {{/if}}
-      </dd>
-
-      <dt class="col-12 col-md-3">Status</dt>
-      <dd class="col-12 col-md-9">{{#if apiSource.lastResponseStatus}}{{apiSource.lastResponseStatus}}{{else}}-{{/if}}</dd>
-
-      <dt class="col-12 col-md-3">Content type</dt>
-      <dd class="col-12 col-md-9">{{#if apiSource.lastResponseContentType}}{{apiSource.lastResponseContentType}}{{else}}-{{/if}}</dd>
-    </dl>
-    {{#if lastResponseJson}}
-      <div data-json-toggle-panel>
-        <script type="application/json" data-json-toggle-source>{{json lastResponseJson}}</script>
-        <div class="mb-0 small bg-body-tertiary border rounded p-3 font-monospace" style="white-space: pre-wrap; word-break: break-word;" data-json-toggle-output>{{lastResponseJson}}</div>
       </div>
-    {{else}}
-      <div class="alert alert-secondary mb-0">No JSON response is stored yet.</div>
-    {{/if}}
+      <div class="card-body">
+        {{#if lastPullError}}
+          <div class="alert alert-warning">{{lastPullError}}</div>
+        {{/if}}
+        <dl class="row">
+          <dt class="col-12 col-md-3">Last pulled</dt>
+          <dd class="col-12 col-md-9">
+            {{#if apiSource.lastPulledAtValue}}
+              <time data-local-datetime datetime="{{apiSource.lastPulledAtValue}}">{{#if apiSource.lastPulledAtLabel}}{{apiSource.lastPulledAtLabel}}{{else}}{{apiSource.lastPulledAtValue}}{{/if}}</time>
+            {{else}}
+              -
+            {{/if}}
+          </dd>
+
+          <dt class="col-12 col-md-3">Status</dt>
+          <dd class="col-12 col-md-9">{{#if apiSource.lastResponseStatus}}{{apiSource.lastResponseStatus}}{{else}}-{{/if}}</dd>
+
+          <dt class="col-12 col-md-3">Content type</dt>
+          <dd class="col-12 col-md-9">{{#if apiSource.lastResponseContentType}}{{apiSource.lastResponseContentType}}{{else}}-{{/if}}</dd>
+        </dl>
+        {{#if lastResponseJson}}
+          <div data-json-toggle-panel>
+            <script type="application/json" data-json-toggle-source>{{json lastResponseJson}}</script>
+            <div class="mb-0 small bg-body-tertiary border rounded p-3 font-monospace" style="white-space: pre-wrap; word-break: break-word;" data-json-toggle-output>{{lastResponseJson}}</div>
+          </div>
+        {{else}}
+          <div class="alert alert-secondary mb-0">No JSON response is stored yet.</div>
+        {{/if}}
+      </div>
+    </div>
   </div>
 </div>
 

src/web/views/data-sources/api-sources/list.hbs

@@ -9,12 +9,12 @@
   <div class="card-header">
     <h3 class="card-title">Saved sources</h3>
     <div class="card-tools d-flex flex-nowrap align-items-center gap-2">
-      <div class="input-group input-group-sm flex-shrink-1" style="width: min(14rem, 100%);">
-        <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
+      <div class="input-group input-group-sm flex-shrink-1 table-search-group" style="width: min(14rem, 100%);">
+        <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
         <input type="search" class="form-control" placeholder="Search API sources" aria-label="Search API sources" data-table-search />
       </div>
       {{#if (hasPermission currentUser 'api-sources.create')}}
-        <a class="btn btn-primary btn-sm" href="/data-sources/api-sources/new">Add API source</a>
+        <a class="btn btn-primary btn-sm" href="/data-sources/api-sources/new">Add<span class="table-action-context"> API source</span></a>
       {{/if}}
     </div>
   </div>

src/web/views/data-sources/rss-feeds/form.hbs

@@ -7,7 +7,7 @@
 
 <form id="rss-feed-form" method="post" action="{{formAction}}" {{{formAttrs}}}>
   <div class="card card-outline card-primary admin-form-card">
-    <div class="card-header">
+      <div class="card-header bg-body-tertiary">
       <h3 class="card-title">RSS feed details</h3>
     </div>
     <div class="card-body">
@@ -47,7 +47,7 @@
 {{#if isEdit}}<form id="rss-feed-toggle-form" method="post" action="/data-sources/rss-feeds/{{rssFeed.id}}" data-async-command><input type="hidden" name="data_source_action" value="toggle" /></form>{{/if}}
 
 <div class="card card-outline card-secondary admin-form-card mt-4">
-  <div class="card-header">
+  <div class="card-header bg-body-tertiary">
     <h3 class="card-title">Latest items</h3>
   </div>
   <div class="card-body">

src/web/views/data-sources/rss-feeds/list.hbs

@@ -9,12 +9,12 @@
   <div class="card-header">
     <h3 class="card-title">Saved feeds</h3>
     <div class="card-tools d-flex flex-nowrap align-items-center gap-2">
-      <div class="input-group input-group-sm flex-shrink-1" style="width: min(14rem, 100%);">
-        <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
+      <div class="input-group input-group-sm flex-shrink-1 table-search-group" style="width: min(14rem, 100%);">
+        <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
         <input type="search" class="form-control" placeholder="Search RSS feeds" aria-label="Search RSS feeds" data-table-search />
       </div>
       {{#if (hasPermission currentUser 'rss-feeds.create')}}
-        <a class="btn btn-primary btn-sm" href="/data-sources/rss-feeds/new">Add RSS feed</a>
+        <a class="btn btn-primary btn-sm" href="/data-sources/rss-feeds/new">Add<span class="table-action-context"> RSS feed</span></a>
       {{/if}}
     </div>
   </div>

src/web/views/data-sources/timetables/form.hbs

@@ -7,7 +7,7 @@
 
 <form id="timetable-group-form" method="post" action="{{formAction}}" {{{formAttrs}}}>
   <div class="card card-outline card-primary admin-form-card">
-    <div class="card-header">
+      <div class="card-header bg-body-tertiary">
       <h3 class="card-title">Timetable group details</h3>
     </div>
     <div class="card-body d-grid gap-4 pb-0">
@@ -42,7 +42,7 @@
   </div>
 
   <div class="card card-outline card-secondary admin-form-card mt-4">
-    <div class="card-header d-flex align-items-center">
+    <div class="card-header bg-body-tertiary d-flex align-items-center">
       <h3 class="card-title mb-0 flex-grow-1">Entries</h3>
       <button type="button" class="btn btn-primary btn-sm ms-auto" data-add-timetable-entry>Add entry</button>
     </div>

src/web/views/data-sources/timetables/list.hbs

@@ -9,12 +9,12 @@
   <div class="card-header">
     <h3 class="card-title">Saved groups</h3>
     <div class="card-tools d-flex flex-nowrap align-items-center gap-2">
-      <div class="input-group input-group-sm flex-shrink-1" style="width: min(14rem, 100%);">
-        <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
+      <div class="input-group input-group-sm flex-shrink-1 table-search-group" style="width: min(14rem, 100%);">
+        <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
         <input type="search" class="form-control" placeholder="Search timetables" aria-label="Search timetables" data-table-search />
       </div>
       {{#if (hasPermission currentUser 'timetables.create')}}
-        <a class="btn btn-primary btn-sm" href="/data-sources/timetables/new">Add timetable group</a>
+        <a class="btn btn-primary btn-sm" href="/data-sources/timetables/new">Add<span class="table-action-context"> timetable group</span></a>
       {{/if}}
     </div>
   </div>

src/web/views/data-sources/weather/form.hbs

@@ -5,7 +5,7 @@
 <div class="col-12 col-xl-7">
 <form id="weather-location-form" method="post" action="{{formAction}}" {{{formAttrs}}}>
   <div class="card card-outline card-primary admin-form-card">
-    <div class="card-header"><h3 class="card-title">Weather location details</h3></div>
+    <div class="card-header bg-body-tertiary"><h3 class="card-title">Weather location details</h3></div>
     <div class="card-body">
       <div class="mb-3"><label for="weather-name" class="form-label">Name</label><input id="weather-name" name="name" class="form-control" value="{{weatherLocation.name}}" maxlength="255" required /></div>
       <div class="mb-3 position-relative"><label for="weather-label" class="form-label">Location</label><input id="weather-label" name="location_label" class="form-control" value="{{weatherLocation.location_label}}" maxlength="255" placeholder="Start typing a town, city, or postcode" autocomplete="off" required /><div id="weather-location-results" class="list-group position-absolute w-100 d-none" style="z-index: 10;"></div><div class="form-text">Choose a result to fill the coordinates and timezone automatically.</div></div>

src/web/views/data-sources/weather/list.hbs

@@ -9,11 +9,11 @@
   <div class="card-header">
     <h3 class="card-title">Saved locations</h3>
     <div class="card-tools d-flex flex-nowrap align-items-center gap-2">
-      <div class="input-group input-group-sm" style="width: min(14rem, 100%);">
-        <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
+      <div class="input-group input-group-sm flex-shrink-1 table-search-group" style="width: min(14rem, 100%);">
+        <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
         <input type="search" class="form-control" placeholder="Search weather locations" aria-label="Search weather locations" data-table-search />
       </div>
-      {{#if (hasPermission currentUser 'weather.create')}}<a class="btn btn-primary btn-sm" href="/data-sources/weather/new">Add location</a>{{/if}}
+        {{#if (hasPermission currentUser 'weather.create')}}<a class="btn btn-primary btn-sm" href="/data-sources/weather/new">Add<span class="table-action-context"> location</span></a>{{/if}}
     </div>
   </div>
   <div class="card-body table-responsive p-0">

src/web/views/onboarding/pair.hbs

@@ -8,8 +8,8 @@
 <div class="row justify-content-center">
   <div class="col-12 col-lg-7 col-xl-6">
     <div class="card card-outline card-primary admin-form-card onboarding-pairing-card" id="onboarding-pair-card">
-      <div class="card-header">
-        <h3 class="card-title">Screen setup</h3>
+          <div class="card-header bg-body-tertiary">
+            <h3 class="card-title">Screen setup</h3>
       </div>
       <form id="onboarding-pair-form" method="post" action="/pairing" novalidate>
         <div class="card-body">

src/web/views/settings/audit-log/index.hbs

@@ -24,7 +24,10 @@
       </div>
       <div class="col-12 col-md-4">
         <label class="form-label small" for="audit-search">Search</label>
-        <input id="audit-search" name="search" type="search" class="form-control form-control-sm" value="{{search}}" placeholder="Event, actor, or target" data-table-search>
+        <div class="input-group input-group-sm table-search-group">
+          <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
+          <input id="audit-search" name="search" type="search" class="form-control" value="{{search}}" placeholder="Event, actor, or target" data-table-search>
+        </div>
       </div>
       <div class="col-12 col-md-2 d-flex gap-2">
         <button type="submit" class="btn btn-primary btn-sm flex-fill"><i class="bi bi-search me-1" aria-hidden="true"></i>Filter</button>
@@ -43,7 +46,7 @@
               <td><div class="fw-semibold text-capitalize">{{eventLabel}}</div><div class="text-muted small">{{category}}</div></td>
               <td>{{actorLabel}}</td>
               <td>{{targetLabelDisplay}}</td>
-              <td><div>{{ip_address}}</div><div class="text-muted small text-break">{{user_agent}}</div></td>
+              <td><div>{{ip_address}}</div><div class="text-muted small text-break">{{userAgentLabel}}</div></td>
               <td class="text-break">
                 {{#if auditDetailView.hasChanges}}
                   <div class="audit-change-list">

src/web/views/settings/fonts/list.hbs

@@ -36,8 +36,8 @@
   <div class="card-header">
     <h3 class="card-title">Managed fonts</h3>
     <div class="card-tools d-flex flex-nowrap align-items-center gap-2">
-      <div class="input-group input-group-sm flex-shrink-1" style="width: min(14rem, 100%);">
-        <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
+      <div class="input-group input-group-sm flex-shrink-1 table-search-group" style="width: min(14rem, 100%);">
+        <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
         <input type="search" class="form-control" placeholder="Search fonts" aria-label="Search fonts" data-table-search />
       </div>
     </div>

src/web/views/settings/invitations/list.hbs

@@ -0,0 +1,67 @@
+<div class="page-header">
+  <div>
+    <h2>Pending invitations</h2>
+    <p>Invitations that have not yet been accepted.</p>
+  </div>
+</div>
+
+<div class="card card-outline card-primary" data-table-search-container data-table-pagination-card>
+  <div class="card-header d-flex justify-content-between align-items-center">
+    <h3 class="card-title">Active invitations</h3>
+    <div class="card-tools d-flex flex-nowrap align-items-center gap-2">
+      <div class="input-group input-group-sm flex-shrink-1 table-search-group" style="width: min(14rem, 100%);">
+        <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
+        <input type="search" class="form-control" placeholder="Search invitations" aria-label="Search invitations" data-table-search />
+      </div>
+      {{#if (hasPermission currentUser 'invitations.create')}}
+        <a href="/settings/users/invite" class="btn btn-info btn-sm">Invite user</a>
+      {{/if}}
+    </div>
+  </div>
+  <div class="card-body table-responsive p-0">
+    <table class="table table-striped w-100 mb-0">
+      <thead>
+        <tr>
+          <th data-table-sort-key="email">Email</th>
+          <th data-table-sort-key="name">Name</th>
+          <th>Roles</th>
+          <th data-table-sort-key="created">Sent</th>
+          <th data-table-sort-key="expires">Expires</th>
+          <th data-table-sort-key="createdBy">Sent by</th>
+          <th>Actions</th>
+        </tr>
+      </thead>
+      <tbody>
+        {{#if invitations.length}}
+          {{#each invitations}}
+            <tr data-table-search-row>
+              <td data-label="Email">{{email}}</td>
+              <td data-label="Name">{{#if name}}{{name}}{{else}}-{{/if}}</td>
+              <td data-label="Roles">{{roleNames}}</td>
+              <td data-label="Sent">{{createdAtLabel}}</td>
+              <td data-label="Expires">{{expiresAtLabel}}</td>
+              <td data-label="Sent by">{{createdByLabel}}</td>
+              <td data-label="Actions">
+                <div class="actions users-row-actions">
+                  {{#if (hasPermission ../currentUser 'invitations.allow')}}
+                    <form method="post" action="/settings/invitations/{{id}}/resend" class="inline-form" data-confirm-message="Resend invitation to {{email}}?">
+                      <button type="submit" class="btn btn-sm btn-primary">Resend</button>
+                    </form>
+                  {{/if}}
+                  {{#if (hasPermission ../currentUser 'invitations.delete')}}
+                    <form method="post" action="/settings/invitations/{{id}}/delete" class="inline-form" data-confirm-message="Delete invitation for {{email}}?">
+                      <button type="submit" class="btn btn-sm btn-danger">Delete</button>
+                    </form>
+                  {{/if}}
+                </div>
+              </td>
+            </tr>
+          {{/each}}
+        {{else}}
+          <tr data-table-search-empty-default><td colspan="7" class="empty">No pending invitations.</td></tr>
+        {{/if}}
+      </tbody>
+    </table>
+  </div>
+  {{> table-pagination pagination=pagination basePath="/settings/invitations" alwaysShow=true}}
+</div>

src/web/views/settings/rbac/form.hbs

@@ -12,7 +12,7 @@
   <div class="row g-3">
     <div class="col-12 col-xl-4 d-flex flex-column gap-4">
       <div class="card card-outline card-primary admin-form-card">
-        <div class="card-header">
+        <div class="card-header bg-body-tertiary">
           <h3 class="card-title">Role details</h3>
         </div>
         <div class="card-body">
@@ -33,10 +33,10 @@
       </div>
 
       <div class="card card-outline card-secondary admin-form-card" data-table-search-container data-table-pagination-card>
-        <div class="card-header d-flex flex-wrap align-items-center justify-content-between">
+        <div class="card-header bg-body-tertiary d-flex flex-wrap align-items-center justify-content-between">
           <h3 class="card-title">Users</h3>
-          <div class="input-group input-group-sm flex-shrink-1 ms-auto" style="width: min(14rem, 100%);">
-            <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
+          <div class="input-group input-group-sm flex-shrink-1 ms-auto table-search-group" style="width: min(14rem, 100%);">
+            <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
             <input type="search" class="form-control" placeholder="Search users" aria-label="Search users" data-table-search />
           </div>
         </div>
@@ -82,7 +82,7 @@
 
     <div class="col-12 col-xl-8 d-flex flex-column gap-4">
       <div class="card card-outline card-secondary admin-form-card overflow-hidden">
-        <div class="card-header">
+        <div class="card-header bg-body-tertiary">
           <h3 class="card-title">Permissions</h3>
         </div>
         <div class="card-body p-0">

src/web/views/settings/rbac/list.hbs

@@ -11,12 +11,12 @@
       <div class="card-header">
         <h3 class="card-title">Existing roles</h3>
         <div class="card-tools d-flex flex-nowrap align-items-center gap-2">
-          <div class="input-group input-group-sm flex-shrink-1" style="width: min(14rem, 100%);">
-            <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
+          <div class="input-group input-group-sm flex-shrink-1 table-search-group" style="width: min(14rem, 100%);">
+            <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
             <input type="search" class="form-control" placeholder="Search roles" aria-label="Search roles" data-table-search />
           </div>
           {{#if (hasPermission currentUser 'rbac.create')}}
-            <a class="btn btn-primary btn-sm" href="/settings/roles/new">Add role</a>
+            <a class="btn btn-primary btn-sm" href="/settings/roles/new">Add<span class="table-action-context"> role</span></a>
           {{/if}}
         </div>
       </div>

src/web/views/settings/system/index.hbs

@@ -26,6 +26,12 @@
           <a class="nav-link" href="#security-sessions" data-settings-section-link>
             <i class="bi bi-shield-lock me-2" aria-hidden="true"></i>Security and Sessions
           </a>
+          <a class="nav-link" href="#email-delivery" data-settings-section-link>
+            <i class="bi bi-envelope me-2" aria-hidden="true"></i>Email Delivery
+          </a>
+          <a class="nav-link" href="#email-templates" data-settings-section-link>
+            <i class="bi bi-envelope-paper me-2" aria-hidden="true"></i>Email Templates
+          </a>
           <a class="nav-link" href="#audit-logging" data-settings-section-link>
             <i class="bi bi-journal-text me-2" aria-hidden="true"></i>Audit Logging
           </a>
@@ -104,7 +110,13 @@
             </div>
           </div>
         </div>
-        <div class="card-footer d-flex justify-content-end">{{#if (hasPermission currentUser 'system-settings.update')}}<button type="submit" class="btn btn-success">Save</button>{{else}}<button type="button" class="btn btn-outline-success" disabled>Save</button>{{/if}}</div>
+        <div class="card-footer d-flex justify-content-end">
+          {{#if (hasPermission currentUser 'system-settings.update')}}
+            <button type="submit" class="btn btn-success">Save</button>
+          {{else}}
+            <button type="button" class="btn btn-outline-success" disabled>Save</button>
+          {{/if}}
+        </div>
       </div>
     </form>
 
@@ -182,7 +194,7 @@
           </div>
         </div>
         <div class="card-footer d-flex justify-content-end">
-          {{#if (hasPermission currentUser 'system-settings.update')}}<button type="submit" class="btn btn-success"><i class="bi bi-check2 me-1"></i>Save</button>{{else}}<button type="button" class="btn btn-outline-success" disabled>Save</button>{{/if}}
+          {{#if (hasPermission currentUser 'system-settings.update')}}<button type="submit" class="btn btn-success">Save</button>{{else}}<button type="button" class="btn btn-outline-success" disabled>Save</button>{{/if}}
         </div>
       </div>
     </form>
@@ -257,6 +269,108 @@
       </div>
     </form>
 
+    <form method="post" action="/settings/system" data-async-save data-settings-form="email">
+      <input type="hidden" name="settings_section" value="email">
+      <div id="email-delivery" class="card settings-section-card" data-settings-section hidden>
+        <div class="card-header"><h3 class="h5 mb-1 fw-semibold"><i class="bi bi-envelope me-2 text-primary" aria-hidden="true"></i>Email delivery</h3><p class="text-muted small mb-0">Configure SMTP for password recovery and account verification.</p></div>
+        <div class="card-body"><div class="row g-3">
+          <div class="col-12"><div class="form-check form-switch"><input id="settings-smtp-enabled" name="smtp_enabled" type="checkbox" class="form-check-input" value="1" {{#if mediaSettings.smtpEnabled}}checked{{/if}}><label class="form-check-label" for="settings-smtp-enabled">Enable SMTP email delivery</label></div></div>
+          <div class="col-12 col-md-8"><label class="form-label" for="settings-smtp-host">SMTP host</label><input id="settings-smtp-host" name="smtp_host" type="text" class="form-control" value="{{mediaSettings.smtpHost}}"></div>
+          <div class="col-12 col-md-4"><label class="form-label" for="settings-smtp-port">Port</label><input id="settings-smtp-port" name="smtp_port" type="number" class="form-control" min="1" max="65535" value="{{mediaSettings.smtpPort}}"></div>
+          <div class="col-12 col-md-4"><label class="form-label" for="settings-smtp-security">Security</label><select id="settings-smtp-security" name="smtp_security" class="form-select"><option value="none" {{#if (eq mediaSettings.smtpSecurity 'none')}}selected{{/if}}>None</option><option value="starttls" {{#if (eq mediaSettings.smtpSecurity 'starttls')}}selected{{/if}}>STARTTLS</option><option value="tls" {{#if (eq mediaSettings.smtpSecurity 'tls')}}selected{{/if}}>TLS</option></select></div>
+          <div class="col-12 col-md-4"><label class="form-label" for="settings-smtp-username">SMTP username</label><input id="settings-smtp-username" name="smtp_username" type="text" class="form-control" value="{{mediaSettings.smtpUsername}}"></div>
+          <div class="col-12 col-md-4"><label class="form-label" for="settings-smtp-password">SMTP password</label><input id="settings-smtp-password" name="smtp_password" type="password" class="form-control" placeholder="{{#if mediaSettings.smtpConfigured}}Leave unchanged{{/if}}"></div>
+          <div class="col-12 col-md-6"><label class="form-label" for="settings-from-address">From address</label><input id="settings-from-address" name="from_address" type="email" class="form-control" value="{{mediaSettings.emailFromAddress}}"></div>
+          <div class="col-12 col-md-6"><label class="form-label" for="settings-from-name">From name</label><input id="settings-from-name" name="from_name" type="text" class="form-control" value="{{mediaSettings.emailFromName}}"></div>
+          <div class="col-12 col-md-4"><label class="form-label" for="settings-verification-expiry">Verification expiry</label><div class="input-group"><input id="settings-verification-expiry" name="verification_expiry_minutes" type="number" class="form-control" min="1" max="10080" value="{{mediaSettings.verificationExpiryMinutes}}"><span class="input-group-text">minutes</span></div></div>
+          <div class="col-12 col-md-4"><label class="form-label" for="settings-reset-expiry">Password reset expiry</label><div class="input-group"><input id="settings-reset-expiry" name="reset_expiry_minutes" type="number" class="form-control" min="1" max="10080" value="{{mediaSettings.resetExpiryMinutes}}"><span class="input-group-text">minutes</span></div></div>
+          <div class="col-12 col-md-4"><label class="form-label" for="settings-invitation-expiry">Invitation expiry</label><div class="input-group"><input id="settings-invitation-expiry" name="invitation_expiry_hours" type="number" class="form-control" min="1" max="720" value="{{mediaSettings.invitationExpiryHours}}"><span class="input-group-text">hours</span></div></div>
+        </div></div>
+        <div class="card-footer d-flex align-items-center">
+          {{#if (hasPermission currentUser 'system-settings.update')}}
+            <button type="submit" name="settings_action" value="test_email" class="btn btn-outline-primary">Send test email</button>
+            <button type="submit" class="btn btn-success ms-auto">Save</button>
+          {{else}}
+            <button type="button" class="btn btn-outline-primary" disabled>Send test email</button>
+            <button type="button" class="btn btn-outline-success ms-auto" disabled>Save</button>
+          {{/if}}
+        </div>
+      </div>
+    </form>
+
+    <form method="post" action="/settings/system" data-async-save data-settings-form="email-templates">
+      <input type="hidden" name="settings_section" value="email-templates">
+      <div id="email-templates" class="card settings-section-card" data-settings-section hidden>
+        <div class="card-header"><h3 class="h5 mb-1 fw-semibold"><i class="bi bi-envelope-paper me-2 text-primary" aria-hidden="true"></i>Email templates</h3><p class="text-muted small mb-0">Customize the messages sent for email verification and password resets.</p></div>
+        <div class="card-body">
+          <div data-email-preview-user data-username="{{currentUser.username}}" data-display-name="{{currentUser.name}}" data-email="{{currentUser.email}}" data-verification-expiry="{{mediaSettings.verificationExpiryMinutes}}" data-reset-expiry="{{mediaSettings.resetExpiryMinutes}}" data-invitation-expiry="{{mediaSettings.invitationExpiryHours}}" hidden></div>
+          <div class="email-template-editor" data-email-template-editor>
+            <div class="row g-4 align-items-start">
+              <div class="col-12 col-lg-6">
+                <h4 class="h6">Email verification</h4>
+                <label class="form-label" for="settings-verification-subject">Subject</label>
+                <input id="settings-verification-subject" name="verification_subject" type="text" class="form-control mb-2" value="{{mediaSettings.verificationEmailSubject}}" maxlength="255" data-email-template-subject>
+                <label class="form-label" for="settings-verification-body">Message</label>
+                <div class="btn-toolbar mb-2" role="toolbar" aria-label="Verification message formatting"><div class="btn-group btn-group-sm" role="group"><button type="button" class="btn btn-outline-secondary" data-email-format="b"><strong>B</strong></button><button type="button" class="btn btn-outline-secondary" data-email-format="i"><em>I</em></button><button type="button" class="btn btn-outline-secondary" data-email-format="u"><u>U</u></button></div></div>
+                <textarea id="settings-verification-body" name="verification_body" class="form-control" rows="5" data-email-template-body>{{mediaSettings.verificationEmailBody}}</textarea>
+                <div class="row g-2 mt-1">
+                  <div class="col-12 col-md-8"><label class="form-label" for="settings-verification-button-text">Button text</label><input id="settings-verification-button-text" name="verification_button_text" type="text" class="form-control" value="{{mediaSettings.verificationButtonText}}" maxlength="120" data-email-template-button-text></div>
+                  <div class="col-12 col-md-4"><label class="form-label" for="settings-verification-alignment">Alignment</label><select id="settings-verification-alignment" name="verification_button_alignment" class="form-select" data-email-template-alignment><option value="left" {{#if (eq mediaSettings.verificationButtonAlignment 'left')}}selected{{/if}}>Left</option><option value="center" {{#if (eq mediaSettings.verificationButtonAlignment 'center')}}selected{{/if}}>Center</option><option value="right" {{#if (eq mediaSettings.verificationButtonAlignment 'right')}}selected{{/if}}>Right</option></select></div>
+                </div>
+                <div class="form-text">Use <code>[[action_button]]</code> for a button or <code>[[url]]</code> for the verification link. Available values: <code>[[username]]</code>, <code>[[display_name]]</code>, <code>[[email]]</code>, <code>[[expiry_time]]</code>.</div>
+              </div>
+              <div class="col-12 col-lg-6">
+                <div class="email-template-preview" data-email-template-preview aria-label="Email verification preview"></div>
+              </div>
+            </div>
+          </div>
+          <hr class="my-4">
+          <div class="email-template-editor" data-email-template-editor>
+            <div class="row g-4 align-items-start">
+              <div class="col-12 col-lg-6">
+                <h4 class="h6">Password reset</h4>
+                <label class="form-label" for="settings-reset-subject">Subject</label>
+                <input id="settings-reset-subject" name="reset_subject" type="text" class="form-control mb-2" value="{{mediaSettings.resetEmailSubject}}" maxlength="255" data-email-template-subject>
+                <label class="form-label" for="settings-reset-body">Message</label>
+                <div class="btn-toolbar mb-2" role="toolbar" aria-label="Reset message formatting"><div class="btn-group btn-group-sm" role="group"><button type="button" class="btn btn-outline-secondary" data-email-format="b"><strong>B</strong></button><button type="button" class="btn btn-outline-secondary" data-email-format="i"><em>I</em></button><button type="button" class="btn btn-outline-secondary" data-email-format="u"><u>U</u></button></div></div>
+                <textarea id="settings-reset-body" name="reset_body" class="form-control" rows="5" data-email-template-body>{{mediaSettings.resetEmailBody}}</textarea>
+                <div class="row g-2 mt-1">
+                  <div class="col-12 col-md-8"><label class="form-label" for="settings-reset-button-text">Button text</label><input id="settings-reset-button-text" name="reset_button_text" type="text" class="form-control" value="{{mediaSettings.resetButtonText}}" maxlength="120" data-email-template-button-text></div>
+                  <div class="col-12 col-md-4"><label class="form-label" for="settings-reset-alignment">Alignment</label><select id="settings-reset-alignment" name="reset_button_alignment" class="form-select" data-email-template-alignment><option value="left" {{#if (eq mediaSettings.resetButtonAlignment 'left')}}selected{{/if}}>Left</option><option value="center" {{#if (eq mediaSettings.resetButtonAlignment 'center')}}selected{{/if}}>Center</option><option value="right" {{#if (eq mediaSettings.resetButtonAlignment 'right')}}selected{{/if}}>Right</option></select></div>
+                </div>
+                <div class="form-text">Use <code>[[action_button]]</code> for a button or <code>[[url]]</code> for the reset link. Available values: <code>[[username]]</code>, <code>[[display_name]]</code>, <code>[[email]]</code>, <code>[[expiry_time]]</code>.</div>
+              </div>
+              <div class="col-12 col-lg-6">
+                <div class="email-template-preview" data-email-template-preview aria-label="Password reset preview"></div>
+              </div>
+            </div>
+          </div>
+          <hr class="my-4">
+          <div class="email-template-editor" data-email-template-editor>
+            <div class="row g-4 align-items-start">
+              <div class="col-12 col-lg-6">
+                <h4 class="h6">User invitation</h4>
+                <label class="form-label" for="settings-invitation-subject">Subject</label>
+                <input id="settings-invitation-subject" name="invitation_subject" type="text" class="form-control mb-2" value="{{mediaSettings.invitationEmailSubject}}" maxlength="255" data-email-template-subject>
+                <label class="form-label" for="settings-invitation-body">Message</label>
+                <div class="btn-toolbar mb-2" role="toolbar" aria-label="Invitation message formatting"><div class="btn-group btn-group-sm" role="group"><button type="button" class="btn btn-outline-secondary" data-email-format="b"><strong>B</strong></button><button type="button" class="btn btn-outline-secondary" data-email-format="i"><em>I</em></button><button type="button" class="btn btn-outline-secondary" data-email-format="u"><u>U</u></button></div></div>
+                <textarea id="settings-invitation-body" name="invitation_body" class="form-control" rows="5" data-email-template-body>{{mediaSettings.invitationEmailBody}}</textarea>
+                <div class="row g-2 mt-1">
+                  <div class="col-12 col-md-8"><label class="form-label" for="settings-invitation-button-text">Button text</label><input id="settings-invitation-button-text" name="invitation_button_text" type="text" class="form-control" value="{{mediaSettings.invitationButtonText}}" maxlength="120" data-email-template-button-text></div>
+                  <div class="col-12 col-md-4"><label class="form-label" for="settings-invitation-alignment">Alignment</label><select id="settings-invitation-alignment" name="invitation_button_alignment" class="form-select" data-email-template-alignment><option value="left" {{#if (eq mediaSettings.invitationButtonAlignment 'left')}}selected{{/if}}>Left</option><option value="center" {{#if (eq mediaSettings.invitationButtonAlignment 'center')}}selected{{/if}}>Center</option><option value="right" {{#if (eq mediaSettings.invitationButtonAlignment 'right')}}selected{{/if}}>Right</option></select></div>
+                </div>
+                <div class="form-text">Use <code>[[action_button]]</code> for a button or <code>[[url]]</code> for the invitation link. Available values: <code>[[display_name]]</code>, <code>[[email]]</code>, <code>[[expiry_time]]</code>.</div>
+              </div>
+              <div class="col-12 col-lg-6"><div class="email-template-preview" data-email-template-preview aria-label="User invitation preview"></div></div>
+            </div>
+          </div>
+        </div>
+        <div class="card-footer d-flex justify-content-end">
+          {{#if (hasPermission currentUser 'system-settings.update')}}<button type="submit" class="btn btn-success">Save</button>{{else}}<button type="button" class="btn btn-outline-success" disabled>Save</button>{{/if}}
+        </div>
+      </div>
+    </form>
+
     <form method="post" action="/settings/system" data-async-save data-settings-form="security">
       <input type="hidden" name="settings_section" value="security">
       <div id="security-sessions" class="card settings-section-card" data-settings-section hidden>
@@ -449,6 +563,15 @@
                 {{/each}}
               </div>
             </div>
+            <div class="col-12">
+              <h4 class="settings-audit-category-label mb-1">Screen controls</h4>
+              <p class="text-muted small fst-italic mb-2">Commands sent to connected screens and players.</p>
+              <div class="d-flex flex-wrap gap-3">
+                {{#each mediaSettings.auditScreenControlCommands}}
+                  <div class="form-check"><input id="settings-audit-command-{{key}}" name="audit_screen_control_commands[]" type="checkbox" class="form-check-input" value="{{key}}" {{#if isSelected}}checked{{/if}}><label class="form-check-label" for="settings-audit-command-{{key}}">{{label}}</label></div>
+                {{/each}}
+              </div>
+            </div>
           </div>
         </div>
         <div class="card-footer d-flex justify-content-end">

src/web/views/settings/tasks-background/index.hbs

@@ -33,8 +33,8 @@
   <div class="card-header d-flex align-items-center">
     <h3 class="card-title mb-0">Task Queue</h3>
     <div class="ms-auto d-flex flex-nowrap align-items-center gap-2 background-tasks-task-tools">
-      <div class="input-group input-group-sm background-tasks-task-search" style="width: min(12rem, 100%);">
-        <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
+      <div class="input-group input-group-sm background-tasks-task-search table-search-group" style="width: min(12rem, 100%);">
+        <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
         <input type="search" class="form-control" placeholder="Search tasks" aria-label="Search tasks" data-table-search />
       </div>
       {{#if canManage}}

src/web/views/settings/tasks-scheduled/index.hbs

@@ -9,8 +9,8 @@
   <div class="card-header d-flex align-items-center">
     <h3 class="card-title mb-0">Scheduled Tasks</h3>
     <div class="ms-auto d-flex flex-nowrap align-items-center background-tasks-recurring-tools">
-      <div class="input-group input-group-sm background-tasks-recurring-search">
-        <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
+      <div class="input-group input-group-sm background-tasks-recurring-search table-search-group">
+        <span class="input-group-text" role="button" tabindex="0" aria-label="Search" data-table-search-toggle><i class="bi bi-search"></i></span>
         <input type="search" class="form-control" placeholder="Search scheduled" aria-label="Search scheduled refreshes" data-table-search />
       </div>
     </div>