From 02b4a8ce56f33e119856a966e48ebb85cecb3654 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:22:09 +0200
Subject: [PATCH 01/16] fix(partners): the removal warning says partner
 permissions are withdrawn

data-fair and processings remove the permissions granted to an organization
that is no longer in the partners list of the identity webhook, so the old
warning (permissions not modified, do it yourself) was wrong.
---
 api/i18n/de.js | 2 +-
 api/i18n/en.js | 2 +-
 api/i18n/es.js | 2 +-
 api/i18n/fr.js | 2 +-
 api/i18n/it.js | 2 +-
 api/i18n/pt.js | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/api/i18n/de.js b/api/i18n/de.js
index ec640a90..71f2402f 100644
--- a/api/i18n/de.js
+++ b/api/i18n/de.js
@@ -300,7 +300,7 @@ Peut valoir 'anonym', 'authentifiziert' oder 'admin'.`,
       deletePartner: 'Löschen Sie diesen Partner',
       depSortCreation: 'Zuletzt erstellt',
       depSortAlpha: 'Alphabetische Reihenfolge',
-      deletePartnerWarning: 'Achtung! Die Berechtigungen, die der Partnerorganisation gewährt wurden, werden durch diese Operation nicht geändert. Sie sollten diese wahrscheinlich selbst ändern.',
+      deletePartnerWarning: 'Die Berechtigungen, die dieser Organisation für Ihre Ressourcen gewährt wurden, werden ihr entzogen.',
       fromCache: 'Letzte Synchronisierung dieser Liste mit dem Identitätsanbieter: {fromNow}.',
       roleLabel: 'Bezeichnung der Rolle "{role}"',
       nhisTitle: 'Dienstkonten (nicht-menschliche Identitäten)',
diff --git a/api/i18n/en.js b/api/i18n/en.js
index e3892df5..1110e8f7 100644
--- a/api/i18n/en.js
+++ b/api/i18n/en.js
@@ -302,7 +302,7 @@ Can be 'anonymous', 'authenticated' or 'admin'.`,
       deletePartner: 'Delete this partner',
       depSortCreation: 'Last created',
       depSortAlpha: 'Alphabetical order',
-      deletePartnerWarning: 'Warning: permissions granted to the partner organization will not be modified by this operation. You should probably modify them yourself.',
+      deletePartnerWarning: 'Permissions granted to this organization on your resources will be withdrawn.',
       fromCache: 'Last synchronization of this list with the identity provider: {fromNow}.',
       roleLabel: 'Label for the role "{role}"',
       nhisTitle: 'Service accounts (non-human identities)',
diff --git a/api/i18n/es.js b/api/i18n/es.js
index 5957d6f0..eb36a7d3 100644
--- a/api/i18n/es.js
+++ b/api/i18n/es.js
@@ -300,7 +300,7 @@ Puede ser 'anonymous', 'authenticated' o 'admin'.`,
       deletePartner: 'Eliminar este socio',
       depSortCreation: 'Última creación',
       depSortAlpha: 'Orden alfabético',
-      deletePartnerWarning: 'Atención, los permisos concedidos a la organización asociada no se modificarán con esta operación. Probablemente deberá modificarlos usted mismo.',
+      deletePartnerWarning: 'Se retirarán los permisos concedidos a esta organización sobre sus recursos.',
       fromCache: 'Última sincronización de esta lista con el proveedor de identidad: {fromNow}.',
       roleLabel: 'Etiqueta del rol "{role}"',
       nhisTitle: 'Cuentas de servicio (identidades no humanas)',
diff --git a/api/i18n/fr.js b/api/i18n/fr.js
index 1bb8876c..64929deb 100644
--- a/api/i18n/fr.js
+++ b/api/i18n/fr.js
@@ -302,7 +302,7 @@ Peut valoir 'anonymous', 'authenticated' ou 'admin'.`,
       deletePartner: 'Supprimer ce partenaire',
       depSortCreation: 'Derniers créés',
       depSortAlpha: 'Ordre alphabétique',
-      deletePartnerWarning: 'Attention les permissions accordées à l\'organisation partenaire ne seront pas modifiées par cette opération. Vous devriez probablement aller les modifier vous-même.',
+      deletePartnerWarning: 'Les permissions accordées à cette organisation sur vos ressources lui seront retirées.',
       fromCache: 'Dernière synchronisation de cette liste avec le fournisseur d\'identités : {fromNow}.',
       roleLabel: 'Libellé du rôle "{role}"',
       nhisTitle: 'Comptes de service (identités non humaines)',
diff --git a/api/i18n/it.js b/api/i18n/it.js
index 5060f5df..762278b9 100644
--- a/api/i18n/it.js
+++ b/api/i18n/it.js
@@ -300,7 +300,7 @@ Può essere 'anonimo', 'autenticato' o 'admin'.`,
       deletePartner: 'Elimina questo partner',
       depSortCreation: 'Ultimo creato',
       depSortAlpha: 'Ordine alfabetico',
-      deletePartnerWarning: 'Attenzione le autorizzazioni concesse all\'organizzazione partner non saranno modificate da questa operazione. Dovresti probabilmente modificarle tu stesso.',
+      deletePartnerWarning: 'Le autorizzazioni concesse a questa organizzazione sulle vostre risorse le saranno revocate.',
       fromCache: 'Ultima sincronizzazione di questo elenco con il provider di identità: {fromNow}.',
       roleLabel: 'Etichetta del ruolo "{role}"',
       nhisTitle: 'Account di servizio (identità non umane)',
diff --git a/api/i18n/pt.js b/api/i18n/pt.js
index a467073e..b44e869a 100644
--- a/api/i18n/pt.js
+++ b/api/i18n/pt.js
@@ -300,7 +300,7 @@ Pode ser 'anónimo', 'autenticado' ou 'administrador'.`,
       deletePartner: 'Eliminar este parceiro',
       depSortCreation: 'Último criado',
       depSortAlpha: 'Ordem alfabética',
-      deletePartnerWarning: 'Atenção, as permissões concedidas à organização parceira não serão modificadas por esta operação. Provavelmente deve ir modificá-las.',
+      deletePartnerWarning: 'As permissões concedidas a esta organização sobre os seus recursos serão retiradas.',
       fromCache: 'Última sincronização desta lista com o provedor de identidade: {fromNow}.',
       roleLabel: 'Nome do papel "{role}"',
       nhisTitle: 'Contas de serviço (identidades não humanas)',

From a379626a7bba404acb38be6be4ab7f80c6b709bf Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:22:49 +0200
Subject: [PATCH 02/16] fix(organizations): lock the settings form for members
 who are not admins

The organization avatar widget and the 2FA roles selector stayed editable and
the save button was shown to a simple member, while the other fields were
disabled and the API refuses the change.
---
 ui/src/pages/organization/[id]/index.vue | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/ui/src/pages/organization/[id]/index.vue b/ui/src/pages/organization/[id]/index.vue
index 2eab3623..6cd10421 100644
--- a/ui/src/pages/organization/[id]/index.vue
+++ b/ui/src/pages/organization/[id]/index.vue
@@ -28,7 +28,7 @@
       <load-avatar
         v-if="$uiConfig.avatars.orgs"
         :owner="{...orga, type: 'organization'}"
-        :disabled="$uiConfig.readonly"
+        :disabled="orgRole !== 'admin' || $uiConfig.readonly"
         class="mb-4"
       />
       <v-text-field
@@ -95,6 +95,7 @@
         :items="roleItems"
         :messages="[$t('pages.organization.2FARolesMsg')]"
         :placeholder="$t('pages.organization.2FARoles')"
+        :disabled="orgRole !== 'admin' || $uiConfig.readonly"
         multiple
         name="2FARoles"
         density="compact"
@@ -102,7 +103,10 @@
         @update:model-value="set2FARoles"
       />
 
-      <v-row class="mx-0 mb-0 mt-4">
+      <v-row
+        v-if="orgRole === 'admin' && !$uiConfig.readonly"
+        class="mx-0 mb-0 mt-4"
+      >
         <v-spacer />
         <v-btn
           color="primary"

From 1d66b8291fd182d1b919d325cdaa2fa62bb639af Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:23:07 +0200
Subject: [PATCH 03/16] fix(nhis): hide the avatar widget of a service account
 when user avatars are disabled

---
 ui/src/components/edit-nhi-menu.vue | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/src/components/edit-nhi-menu.vue b/ui/src/components/edit-nhi-menu.vue
index 9411065d..d1fb0f8c 100644
--- a/ui/src/components/edit-nhi-menu.vue
+++ b/ui/src/components/edit-nhi-menu.vue
@@ -23,6 +23,7 @@
       </v-card-title>
       <v-card-text>
         <load-avatar
+          v-if="$uiConfig.avatars.users"
           :owner="{type: 'user', id: nhi.id}"
           class="mb-4"
         />

From d052bba449ce41b1ac556ae9cfd583896247e643 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:23:44 +0200
Subject: [PATCH 04/16] fix(ui): use the admin color on every superadmin-only
 action

Impersonation from the members list, service account creation and edition
and the direct partner addition used primary or warning, unlike the same
actions in /admin/users.
---
 ui/src/components/add-nhi-menu.vue                | 4 ++--
 ui/src/components/add-partner-superadmin-menu.vue | 2 +-
 ui/src/components/edit-nhi-menu.vue               | 2 +-
 ui/src/components/organization-members.vue        | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/ui/src/components/add-nhi-menu.vue b/ui/src/components/add-nhi-menu.vue
index d220be81..5f085fd1 100644
--- a/ui/src/components/add-nhi-menu.vue
+++ b/ui/src/components/add-nhi-menu.vue
@@ -7,7 +7,7 @@
       <v-fab
         :title="$t('pages.organization.addNhi')"
         size="small"
-        color="primary"
+        color="admin"
         class="mx-2"
         :icon="mdiPlus"
         v-bind="props"
@@ -120,7 +120,7 @@
             {{ $t('common.confirmCancel') }}
           </v-btn>
           <v-btn
-            color="primary"
+            color="admin"
             variant="flat"
             @click="confirmCreate.execute()"
           >
diff --git a/ui/src/components/add-partner-superadmin-menu.vue b/ui/src/components/add-partner-superadmin-menu.vue
index 254673e4..839abf18 100644
--- a/ui/src/components/add-partner-superadmin-menu.vue
+++ b/ui/src/components/add-partner-superadmin-menu.vue
@@ -55,7 +55,7 @@
           {{ $t('common.confirmCancel') }}
         </v-btn>
         <v-btn
-          color="primary"
+          color="admin"
           variant="flat"
           @click="confirmCreate.execute()"
         >
diff --git a/ui/src/components/edit-nhi-menu.vue b/ui/src/components/edit-nhi-menu.vue
index d1fb0f8c..e25f2cc0 100644
--- a/ui/src/components/edit-nhi-menu.vue
+++ b/ui/src/components/edit-nhi-menu.vue
@@ -123,7 +123,7 @@
           {{ $t('common.confirmCancel') }}
         </v-btn>
         <v-btn
-          color="primary"
+          color="admin"
           variant="flat"
           @click="confirmEdit.execute()"
         >
diff --git a/ui/src/components/organization-members.vue b/ui/src/components/organization-members.vue
index 049b3261..19aee2c1 100644
--- a/ui/src/components/organization-members.vue
+++ b/ui/src/components/organization-members.vue
@@ -184,7 +184,7 @@
                 :title="$t('common.asAdmin')"
                 :aria-label="$t('common.asAdmin')"
                 :icon="mdiAccountSwitch"
-                color="warning"
+                color="admin"
                 variant="text"
                 density="compact"
                 :disabled="!member.emailConfirmed"

From babf9d8b9695d3aed78822643bf3a0d25ebd0819 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:25:59 +0200
Subject: [PATCH 05/16] fix(partners): show the default organization avatar for
 a pending partner

A partner whose invitation is not accepted yet has no id, the avatar circle
stayed empty; an unknown id serves the default organization image.
---
 ui/src/components/organization-partners.vue | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/src/components/organization-partners.vue b/ui/src/components/organization-partners.vue
index 32f8ad07..dec87d75 100644
--- a/ui/src/components/organization-partners.vue
+++ b/ui/src/components/organization-partners.vue
@@ -72,9 +72,9 @@
         <v-list-item>
           <template #prepend>
             <v-avatar>
+              <!-- a pending partner has no id yet: an unknown id serves the default organization avatar -->
               <v-img
-                v-if="partner.id"
-                :src="`${$sdUrl}/api/avatars/organization/${partner.id}/avatar.png`"
+                :src="`${$sdUrl}/api/avatars/organization/${partner.id ?? '_pending'}/avatar.png`"
                 alt=""
               />
             </v-avatar>

From 42a236ffa005ad3f5fa6cf0f67216eb3afc5b5b8 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:27:09 +0200
Subject: [PATCH 06/16] fix(partners): only offer to accept as an organization
 the user administers at its root

A department admin membership looked selectable and ended in a raw 403, and a
member of several departments saw the organization listed once per membership.
---
 ui/src/components/partner-invitation.vue | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/ui/src/components/partner-invitation.vue b/ui/src/components/partner-invitation.vue
index 0e3ecd7e..1791585e 100644
--- a/ui/src/components/partner-invitation.vue
+++ b/ui/src/components/partner-invitation.vue
@@ -84,7 +84,7 @@
           color="primary"
           :label="userOrg.name"
           hide-details
-          :disabled="userOrg.role !== 'admin'"
+          :disabled="userOrg.role !== 'admin' || !!userOrg.department"
           @update:model-value="v => toggleSelectedUserOrg(userOrg, v as boolean)"
         />
         <v-checkbox
@@ -141,9 +141,15 @@ const createNewOrg = ref(false)
 
 const token = reactiveSearchParams.partner_invit_token
 const invit = token ? jwtDecode(token) as ShortenedPartnerInvitation : undefined
+// one entry per organization: only an admin of the organization itself (not of a department) can accept
 const otherUserOrgs = computed(() => {
   if (!invit) return []
-  return user.value?.organizations.filter(o => invit.o !== o.id)
+  const byId = new Map<string, NonNullable<typeof user.value>['organizations'][number]>()
+  for (const o of user.value?.organizations ?? []) {
+    if (o.id === invit.o) continue
+    if (!byId.has(o.id) || (o.role === 'admin' && !o.department)) byId.set(o.id, o)
+  }
+  return [...byId.values()]
 })
 if (invit) {
   createOrganizationName.value = invit.n

From ecb05c60c98749feaf487b3a5705c22e1abd88d2 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:27:41 +0200
Subject: [PATCH 07/16] fix(admin): let the user dialog titles wrap instead of
 overflowing

---
 ui/src/pages/admin/users.vue | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ui/src/pages/admin/users.vue b/ui/src/pages/admin/users.vue
index 4df8b21e..9fd90bab 100644
--- a/ui/src/pages/admin/users.vue
+++ b/ui/src/pages/admin/users.vue
@@ -196,7 +196,7 @@
       max-width="500px"
     >
       <v-card v-if="currentUser">
-        <v-card-title>
+        <v-card-title class="text-wrap">
           {{ $t('common.confirmDeleteTitle', {name: currentUser.name}) }}
         </v-card-title>
         <v-card-text>
@@ -226,7 +226,7 @@
       max-width="500px"
     >
       <v-card v-if="currentUser">
-        <v-card-title>
+        <v-card-title class="text-wrap">
           {{ $t('pages.admin.users.editUserEmailTitle', {name: currentUser.name}) }}
         </v-card-title>
         <v-card-text>
@@ -263,7 +263,7 @@
       max-width="500px"
     >
       <v-card v-if="currentUser">
-        <v-card-title>
+        <v-card-title class="text-wrap">
           {{ $t('common.editTitle', {name: currentUser.name}) }}
         </v-card-title>
         <v-card-text>
@@ -308,7 +308,7 @@
       max-width="500px"
     >
       <v-card v-if="currentUser">
-        <v-card-title>
+        <v-card-title class="text-wrap">
           {{ $t('pages.admin.users.drop2FATitle', {name: currentUser.name}) }}
         </v-card-title>
         <v-card-text>
@@ -343,7 +343,7 @@
       max-width="500px"
     >
       <v-card v-if="currentUser">
-        <v-card-title>
+        <v-card-title class="text-wrap">
           {{ $t('pages.admin.users.transferTitle', {name: currentUser.name}) }}
         </v-card-title>
         <v-card-text>

From 68a15be1ba48fd4620b18ab1d0296e0b0622eeeb Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:28:41 +0200
Subject: [PATCH 08/16] fix(mails): contact form mail names its sender and
 keeps line breaks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Simple Directory now writes the sender in its fixed intro ("... émis par
<address>") instead of relying on the caller to add it, and the plain text
sent by its own contact form keeps its paragraphs and line breaks (it was
rendered on a single line). The html sent by the portal contact form is kept
as is, after the intro.
---
 api/src/mails/router.ts          | 13 +++++++++----
 tests/features/mails.api.spec.ts | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/api/src/mails/router.ts b/api/src/mails/router.ts
index ce1675f0..989ae91b 100644
--- a/api/src/mails/router.ts
+++ b/api/src/mails/router.ts
@@ -124,9 +124,14 @@ router.post('/contact', async (req, res) => {
     return res.status(429).send('Trop de messages dans un bref interval. Veuillez patienter avant d\'essayer de nouveau.')
   }
 
-  const text = `Message transmis par le formulaire de contact de ${reqSiteUrl(req)}
-  
-  ${req.body.text}`
+  const siteUrl = reqSiteUrl(req)
+  const intro = `Message transmis par le formulaire de contact de ${siteUrl} émis par ${req.body.from}`
+  const body: string = req.body.text ?? ''
+  const text = `${intro}\n\n${body}`
+  // the portal contact form sends html, the simple-directory one plain text whose line breaks must survive
+  const bodyHtml = /<\/?[a-z][^>]*>/i.test(body) ? body : `<p>${textToSafeHtml(body)}</p>`
+  const [safeUrl, safeFrom] = [textToSafeHtml(siteUrl), textToSafeHtml(req.body.from)]
+  const html = `<p>Message transmis par le formulaire de contact de <a href="${safeUrl}">${safeUrl}</a> émis par <a href="mailto:${safeFrom}">${safeFrom}</a></p>${bodyHtml}`
 
   const site = await reqSite(req)
 
@@ -141,7 +146,7 @@ router.post('/contact', async (req, res) => {
     // escape so that structure renders while scripts/dangerous hrefs are
     // stripped. The body is partly anonymous-visitor-controlled, so the
     // sanitizer (not raw passthrough) stays the trust boundary.
-    htmlMsg: sanitizeMailHtml(text),
+    htmlMsg: sanitizeMailHtml(html),
     htmlCaption: ''
   })
   res.send(req.body)
diff --git a/tests/features/mails.api.spec.ts b/tests/features/mails.api.spec.ts
index dfcf379d..60d0af87 100644
--- a/tests/features/mails.api.spec.ts
+++ b/tests/features/mails.api.spec.ts
@@ -145,6 +145,23 @@ test.describe('mails', () => {
     assert.ok(!email.html.includes('alert(1)'), 'script content must be stripped')
   })
 
+  test('Contact form: plain text keeps its line breaks', async () => {
+    await testEnvAx.patch('/config', { anonymousContactForm: true })
+    const ax = await axios()
+    const token = (await ax.get('/api/auth/anonymous-action')).data
+    const res = await ax.post('/api/mails/contact', {
+      token,
+      from: 'visitor@test.com',
+      subject: 'contact-plain',
+      text: 'first line\nsecond line'
+    })
+    assert.equal(res.status, 200)
+    const email = await findEmail('contact-plain')
+    assert.ok(email)
+    assert.ok(email.html.includes('first line<br />second line') || email.html.includes('first line<br>second line'), 'line breaks should render')
+    assert.ok(email.html.includes('href="mailto:visitor@test.com"'), 'the sender is named by simple-directory, as a link')
+  })
+
   test('Send email to address and with attachments', async () => {
     const ax = await axios()
     const readmeBuffer = fs.readFileSync('./README.md')

From 333fab82124954a62c7073a55eeb769573b3513e Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:44:00 +0200
Subject: [PATCH 09/16] chore(i18n): drop the unused emailCaption message

---
 api/i18n/de.js | 1 -
 api/i18n/en.js | 1 -
 api/i18n/es.js | 1 -
 api/i18n/fr.js | 1 -
 api/i18n/it.js | 1 -
 api/i18n/pt.js | 1 -
 6 files changed, 6 deletions(-)

diff --git a/api/i18n/de.js b/api/i18n/de.js
index 71f2402f..24eb3d82 100644
--- a/api/i18n/de.js
+++ b/api/i18n/de.js
@@ -217,7 +217,6 @@ Peut valoir 'anonym', 'authentifiziert' oder 'admin'.`,
     login: {
       title: 'Identifizieren Sie sich',
       emailLabel: 'Deine E-Mail',
-      emailCaption: 'Erfahren Sie mehr über die <a href="https://koumoul.com/blog/passwordless">kennwortlose Authentifizierung</a>',
       success: 'Sie erhalten eine E-Mail an die angegebene Adresse, die einen Link enthält. Bitte öffnen Sie diesen Link, um Ihre Identifikation zu vervollständigen.',
       maildevLink: 'Auf das Entwicklungspostfach zugreifen',
       newPassword: 'Neues Kennwort',
diff --git a/api/i18n/en.js b/api/i18n/en.js
index 1110e8f7..64aaa292 100644
--- a/api/i18n/en.js
+++ b/api/i18n/en.js
@@ -219,7 +219,6 @@ Can be 'anonymous', 'authenticated' or 'admin'.`,
     login: {
       title: 'Identify yourself',
       emailLabel: 'Your email address',
-      emailCaption: 'Learn more about <a href="https://medium.com/@ninjudd/passwords-are-obsolete-9ed56d483eb">passwordless</a> authentication',
       success: 'You will receive an email at the specified address. Please use the link in this email to conclude your identification.',
       maildevLink: 'Open the development mail box',
       newPassword: 'New password',
diff --git a/api/i18n/es.js b/api/i18n/es.js
index eb36a7d3..671f3ae8 100644
--- a/api/i18n/es.js
+++ b/api/i18n/es.js
@@ -217,7 +217,6 @@ Puede ser 'anonymous', 'authenticated' o 'admin'.`,
     login: {
       title: 'Identifícate',
       emailLabel: 'Tu correo electrónico',
-      emailCaption: 'Más información sobre la autenticación <a href="https://koumoul.com/blog/passwordless">sin contraseña</a>',
       success: 'Recibirá un correo electrónico a la dirección proporcionada que contendrá un enlace. Abra este enlace para completar su identificación.',
       maildevLink: 'Acceder al buzón de desarrollo',
       newPassword: 'Nueva contraseña',
diff --git a/api/i18n/fr.js b/api/i18n/fr.js
index 64929deb..25f44df3 100644
--- a/api/i18n/fr.js
+++ b/api/i18n/fr.js
@@ -219,7 +219,6 @@ Peut valoir 'anonymous', 'authenticated' ou 'admin'.`,
     login: {
       title: 'Identifiez-vous',
       emailLabel: 'Adresse mail',
-      emailCaption: 'En savoir plus sur l\'authentification <a href="https://koumoul.com/blog/passwordless">sans mot de passe</a>',
       success: 'Vous allez recevoir un email à l\'adresse renseignée qui contiendra un lien. Veuillez ouvrir ce lien pour terminer votre identification.',
       maildevLink: 'Accéder à la boîte mail de développement',
       newPassword: 'Nouveau mot de passe',
diff --git a/api/i18n/it.js b/api/i18n/it.js
index 762278b9..0d575aa7 100644
--- a/api/i18n/it.js
+++ b/api/i18n/it.js
@@ -217,7 +217,6 @@ Può essere 'anonimo', 'autenticato' o 'admin'.`,
     login: {
       title: 'Accedi al tuo conto',
       emailLabel: 'Il suo indirizzo e-mail',
-      emailCaption: 'Per saperne di più sull\'autenticazione <a href="https://koumoul.com/blog/passwordless">senza password</a>',
       success: "Riceverà un'e-mail all'indirizzo fornito che conterrà un link. La preghiamo di aprire questo link per completare la sua identificazione.",
       maildevLink: 'Accedere alla mailbox di sviluppo',
       newPassword: 'Nuova password',
diff --git a/api/i18n/pt.js b/api/i18n/pt.js
index b44e869a..bb696718 100644
--- a/api/i18n/pt.js
+++ b/api/i18n/pt.js
@@ -217,7 +217,6 @@ Pode ser 'anónimo', 'autenticado' ou 'administrador'.`,
     login: {
       title: 'Faça o login na sua conta',
       emailLabel: 'O seu endereço de e-mail',
-      emailCaption: 'Saiba mais sobre autenticação <a href="https://koumoul.com/blog/passwordless">sem senha</a>',
       success: 'Receberá um e-mail no endereço fornecido que conterá um link. Por favor, abra este link para completar a sua identificação.',
       maildevLink: 'Ir para a caixa de correio de desenvolvimento',
       newPassword: 'Nova palavra-passe',

From 7d58c6d418db924a3eca5eb2a1ecb80fdc4cd569 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 11:45:25 +0200
Subject: [PATCH 10/16] fix(organizations): reserve the members CSV export to
 admins

Any member could download the names and emails of every member. The export
now requires the admin role of the organization, or of the department it is
filtered on; the department page exports its own members only.
---
 api/src/organizations/router.ts            | 11 +++++++++++
 tests/features/organizations.api.spec.ts   |  7 +++++++
 ui/src/components/organization-members.vue |  3 ++-
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/api/src/organizations/router.ts b/api/src/organizations/router.ts
index cfffc375..5f6c4656 100644
--- a/api/src/organizations/router.ts
+++ b/api/src/organizations/router.ts
@@ -221,6 +221,17 @@ router.get('/:organizationId/members', async (req, res, next) => {
   if (!org) return res.status(404).send('organization not found')
   logContext.account = { type: 'organization', id: org.id, name: org.name }
 
+  // the export is for admins only (of the organization, or of the single department exported)
+  if (req.query.format === 'csv') {
+    const dep = typeof req.query.department === 'string' && !req.query.department.includes(',') ? req.query.department : undefined
+    const userRole = getAccountRole(
+      reqSession(req),
+      { type: 'organization', id: req.params.organizationId, department: dep },
+      { acceptDepAsRoot: config.depAdminIsOrgAdmin }
+    )
+    if (userRole !== 'admin') throw httpError(403, reqI18n(req).messages.errors.permissionDenied)
+  }
+
   const orgStorages: (SdStorage & { orgStorage?: boolean })[] = [storages.globalStorage]
 
   // org_storage can be yes, no or both (both is default)
diff --git a/tests/features/organizations.api.spec.ts b/tests/features/organizations.api.spec.ts
index ec538d43..d838953e 100644
--- a/tests/features/organizations.api.spec.ts
+++ b/tests/features/organizations.api.spec.ts
@@ -212,6 +212,13 @@ test.describe('organizations api', () => {
     const newMember = members.find((m: any) => m.email === 'test-member1@test.com')
     assert.equal(newMember.role, 'user')
 
+    // a simple member can list the members but not export them
+    await axMember.post('/api/auth/keepalive')
+    axMember.setOrg(org.id)
+    assert.equal((await axMember.get(`/api/organizations/${org.id}/members`)).status, 200)
+    await assert.rejects(axMember.get(`/api/organizations/${org.id}/members`, { params: { format: 'csv' } }), { status: 403 })
+    assert.ok((await ax.get(`/api/organizations/${org.id}/members`, { params: { format: 'csv' } })).data.includes('test-member1@test.com'))
+
     // the member cannot change his own role as a simple user
     await assert.rejects(
       axMember.patch(`/api/organizations/${org.id}/members/${memberUser.id}`, { role: 'admin' }),
diff --git a/ui/src/components/organization-members.vue b/ui/src/components/organization-members.vue
index 19aee2c1..a6f3f9fa 100644
--- a/ui/src/components/organization-members.vue
+++ b/ui/src/components/organization-members.vue
@@ -27,6 +27,7 @@
           :topics="notifyTopics"
         />
         <v-btn
+          v-if="isAdminOrga"
           icon
           color="primary"
           class="mx-2"
@@ -282,7 +283,7 @@ const notifyTopics = computed(() => {
   }
 })
 
-const csvUrl = computed(() => $sdUrl + `/api/organizations/${orga.id}/members?size=10000&format=csv`)
+const csvUrl = computed(() => $sdUrl + `/api/organizations/${orga.id}/members?size=10000&format=csv` + (adminDepartment ? `&department=${encodeURIComponent(adminDepartment)}` : ''))
 const filterMemberCols = $uiConfig.alwaysAcceptInvitation ? 6 : 4
 
 const departmentsList = computed(() => {

From de2f4b538b0b017bde905a917457571f8598af1e Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 12:00:44 +0200
Subject: [PATCH 11/16] fix(mails): no divider under a mail without caption,
 even out the margins

The divider only announces the caption; the contact form mail has none and
showed a lone line with a large empty block under the message. In the generic
templates the message has 16px above and 32px under it, and the divider 32px
on both sides.
---
 api/src/mails/generic-mail-nobutton.mjml | 6 +++---
 api/src/mails/generic-mail.mjml          | 8 ++++----
 api/src/mails/service.ts                 | 4 ++++
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/api/src/mails/generic-mail-nobutton.mjml b/api/src/mails/generic-mail-nobutton.mjml
index 61a954b7..400f873c 100644
--- a/api/src/mails/generic-mail-nobutton.mjml
+++ b/api/src/mails/generic-mail-nobutton.mjml
@@ -3,11 +3,11 @@
     <mj-section>
       <mj-column>
         <mj-image width="100px" src="{logo}"></mj-image>
-        <mj-text font-size="14px" font-weight="500" line-height="21px" color="#212121" font-family="helvetica" padding-top="16px" padding-bottom="24px">
+        <mj-text font-size="14px" font-weight="500" line-height="21px" color="#212121" font-family="helvetica" padding-top="16px" padding-bottom="32px">
           {htmlMsg}
         </mj-text>
-        <mj-divider border-width="1px" border-color="#757575" padding-top="48px"></mj-divider>
-        <mj-text font-size="12px" font-weight="400" line-height="18px" color="#424242" font-family="helvetica">
+        <mj-divider border-width="1px" border-color="#757575" padding="0px 25px"></mj-divider>
+        <mj-text font-size="12px" font-weight="400" line-height="18px" color="#424242" font-family="helvetica" padding-top="32px">
           {htmlCaption}
         </mj-text>
       </mj-column>
diff --git a/api/src/mails/generic-mail.mjml b/api/src/mails/generic-mail.mjml
index 9a8d150b..47058fc9 100644
--- a/api/src/mails/generic-mail.mjml
+++ b/api/src/mails/generic-mail.mjml
@@ -10,7 +10,7 @@
     <mj-section>
       <mj-column>
         <mj-image width="100px" src="{logo}"></mj-image>
-        <mj-text font-size="14px" font-weight="500" line-height="21px" color="#212121" font-family="helvetica" padding-top="16px" padding-bottom="24px">
+        <mj-text font-size="14px" font-weight="500" line-height="21px" color="#212121" font-family="helvetica" padding-top="16px" padding-bottom="32px">
           {htmlMsg}
         </mj-text>
         <mj-button background-color="{theme.colors.primary}" color="#fff" href="{link}" border-radius="4px">
@@ -19,11 +19,11 @@
         <mj-text font-size="14px" font-weight="500" line-height="21px" color="#212121" font-family="helvetica" padding-top="25px">
           {htmlAlternativeLink}
         </mj-text>
-        <mj-text font-size="10px" font-weight="400" line-height="14px" color="#424242" font-family="helvetica" padding-top="0px" css-class="raw-link">
+        <mj-text font-size="10px" font-weight="400" line-height="14px" color="#424242" font-family="helvetica" padding-top="0px" padding-bottom="32px" css-class="raw-link">
           {link}
         </mj-text>
-        <mj-divider border-width="1px" border-color="#757575" padding-top="20px"></mj-divider>
-        <mj-text font-size="12px" font-weight="400" line-height="18px" color="#424242" font-family="helvetica">
+        <mj-divider border-width="1px" border-color="#757575" padding="0px 25px"></mj-divider>
+        <mj-text font-size="12px" font-weight="400" line-height="18px" color="#424242" font-family="helvetica" padding-top="32px">
           {htmlCaption}
         </mj-text>
       </mj-column>
diff --git a/api/src/mails/service.ts b/api/src/mails/service.ts
index fa06ced7..9c0aaf5d 100644
--- a/api/src/mails/service.ts
+++ b/api/src/mails/service.ts
@@ -138,6 +138,10 @@ export const sendMail = async (to: string, params: SendMailParams, attachments?:
     if (site?.mails?.contact) contact = site.mails.contact
   }
 
+  // a mail without caption (the contact form for instance) does not need the divider that announces it
+  // ponytail: matches the divider + caption block shape of the bundled and documented custom templates only
+  if (!params.htmlCaption) template = template.replace(/<mj-divider[^>]*>\s*<\/mj-divider>\s*<mj-text[^>]*>\s*\{htmlCaption\}\s*<\/mj-text>/, '')
+
   const tmplParams: SendMailTmplParams = {
     ...params,
     ...flatTheme,

From b11a1d92adeed81e9761976576c3d1c3eacf0a71 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 12:31:32 +0200
Subject: [PATCH 12/16] chore: refresh outdated links (repository urls, release
 badge, samlify and vite docs)

The repository moved to the data-fair organization, the Travis and Coveralls
badges were frozen: the README now shows the release workflow (quality checks
and build), and the unused nyc report script is dropped since no coverage is
measured. The samlify and vite documentation links landed on a generic page.
---
 README.md              | 3 +--
 api/config/default.cjs | 4 ++--
 package.json           | 7 +++----
 ui/vite.config.ts      | 2 +-
 4 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index f1742229..0e79a06a 100644
--- a/README.md
+++ b/README.md
@@ -2,8 +2,7 @@
 
 This service aims to provide easy access to user and organizations structures and authentication mechanism using Json Web tokens.
 
-[![Build Status](https://travis-ci.org/koumoul-dev/simple-directory.svg?branch=master)](https://travis-ci.org/koumoul-dev/simple-directory)
-[![Coverage Status](https://coveralls.io/repos/github/koumoul-dev/simple-directory/badge.svg?branch=master)](https://coveralls.io/github/koumoul-dev/simple-directory?branch=master)
+[![Release](https://github.com/data-fair/simple-directory/actions/workflows/releases.yml/badge.svg)](https://github.com/data-fair/simple-directory/actions/workflows/releases.yml)
 
 ## Sponsors
 
diff --git a/api/config/default.cjs b/api/config/default.cjs
index 9406a676..68fe74d2 100644
--- a/api/config/default.cjs
+++ b/api/config/default.cjs
@@ -239,10 +239,10 @@ module.exports = {
   },
   saml2: {
     // certsDirectory: './security/saml2',
-    // Accepts all samlify options for service providers https://samlify.js.org/#/sp-configuration
+    // Accepts all samlify options for service providers https://samlify.js.org/sp-configuration
     sp: {},
     // providers have the usual title/color/icon/img attributes and all extra options accepted by samlify
-    // for identify provider https://samlify.js.org/#/idp-configuration
+    // for identify provider https://samlify.js.org/idp-configuration
     providers: []
   },
   applications: [],
diff --git a/package.json b/package.json
index 30750df1..28e36dc7 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,6 @@
     "test-api": "playwright test --project api --max-failures=1",
     "test-inproc": "playwright test --project api-inproc-ldap --project api-inproc-oidc --max-failures=1",
     "test-e2e": "playwright test --project e2e --max-failures=1",
-    "report": "nyc report --reporter=html",
     "lint": "eslint . && npm -w ui run lint",
     "lint-fix": "eslint --fix . && npm -w ui run lint-fix",
     "dev-api": "npm -w api run dev",
@@ -25,7 +24,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/koumoul-dev/simple-directory.git"
+    "url": "git+https://github.com/data-fair/simple-directory.git"
   },
   "workspaces": [
     "ui",
@@ -35,9 +34,9 @@
   "author": "",
   "license": "MIT",
   "bugs": {
-    "url": "https://github.com/koumoul-dev/simple-directory/issues"
+    "url": "https://github.com/data-fair/simple-directory/issues"
   },
-  "homepage": "https://github.com/koumoul-dev/simple-directory#readme",
+  "homepage": "https://github.com/data-fair/simple-directory#readme",
   "devDependencies": {
     "@commitlint/config-conventional": "^19.8.1",
     "@data-fair/lib-express": "^1.27.0",
diff --git a/ui/vite.config.ts b/ui/vite.config.ts
index 3fdcfb28..6ad5f3e4 100644
--- a/ui/vite.config.ts
+++ b/ui/vite.config.ts
@@ -15,7 +15,7 @@ import { commonjsDeps } from '@koumoul/vjsf/utils/build.js'
 // const devSitePath = '/site-prefix'
 const devSitePath = ''
 
-// https://vitejs.dev/config/
+// https://vite.dev/config/
 export default defineConfig({
   base: devSitePath + '/simple-directory',
   optimizeDeps: { include: commonjsDeps },

From 4e39386d93fdfd79d7f585818918f838a59e3646 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 12:44:50 +0200
Subject: [PATCH 13/16] fix(mails): serve the default mail logo from
 simple-directory, cached for good

When neither the site nor the config define a logo, mails pointed to the
v0.12.3 asset of the old koumoul-dev repository through rawgit, a CDN shut
down since 2019 (it only works through a redirect to jsdelivr). The same logo
is now bundled and served by GET /api/mails/logo.png, with a content hash in
the url and an immutable cache header.
---
 api/resources/logo.png           | Bin 0 -> 7990 bytes
 api/src/mails/router.ts          |  10 +++++++++-
 api/src/mails/service.ts         |   8 +++++++-
 tests/features/mails.api.spec.ts |  11 +++++++++++
 4 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 api/resources/logo.png

diff --git a/api/resources/logo.png b/api/resources/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..2e1fa0c78281570c3613289acef169a808bcbf98
GIT binary patch
literal 7990
zcmZ{JbyQSe)b=1liPD`z2+}ZsbTgC)NJ!VfphyhPfHcS;4I(w9bVv;h2uOp{B^}b8
zf`lOb;qP7FKkr)aUhCX_?>T#)XFq43bK~3yJstIj_ZjX30Dy;@8mjtt8vU;j;@=%*
zao()lDIii=(~$5^{0QyC@2-j5G)$2I0O$6<f}_W|`S-4p-W_7%ZUA?1_q0X80G^(n
zf{w0ENIP3Mm>?YSGJRi`;m(NcpOKP>`ztsCpyUd7^>%@KAlZQKfp={-|JqbxNIQh1
zo4X_26`+f7eCg<F>+I|e@^Ev8+uFnIK~Qgys;#T5H%Q6Z8RiOdfFnS<DoWZQVL=f|
zkozk~B*@VY?h3loZng+_5ZvLe5(aW`wsrq^;sPt;kZZcbV*7`sf`Hln0|FU3y1)Qn
zVG$7lVG#jQ5kq0Hw6KUYSdv!?!*gd0`5$H;2s;?ymAkteQd&p|?gn$Ub9Vd(@{gX7
zJ<Q$K(OF1D1S}>dBIMu>vv+hC@Ib;40#I)O+yBq>Ctdy9yADnMLx;P0-w}M}4p31M
z2I+Y~ogM8!s&E%uM^}*Qox9!t#P$#H4$tntSl`0z;4Ut3SLA<~ZvXk%|K}p)14F=t
zL<EI}x>lRd0RU!AO;sgBuZ&-xyxo~5J{`2Snm?`3cS;uMJ>r_Rv8@ydr4ttUP6nj_
z&s;5VX7mnl;%a&c9XlvHumHh_ZT7xwO$plgZd|dC66hV2DF}U`jMdZl&Q0d%N8WKR
zza|%arx1&*<@(0S4KO>io!7<ko8!f3fnu$RtebiBy8Y{G0Kxw$VKap5m%#h)&U|D3
zCT2i_mcx@sKD|_+m+fD;@OdFT+X;@cYjQC0FERul=$mqAE`{F*WG6h<(_YS3b5~uJ
z%|CUNoGMuP%f}1w-+Ni_SREi&s+wL79r;^(3SZBC#Md0ZcSczC<5~O`HSCs2V_%xW
z;!#6(Bat@#68CR9Dmi?Nni1v!2gS~W`cIjacI2|EmmWF34|Ewx0DYxk(^JUtDCzu9
zbh7i4h@?oJIv0fTkh#^sJggH{_eBTVLj5tHnlt>V)CiNCSGWdH1GxF%9X1BSHH0&Y
zgFzu7n?9`Le>LUE<+D#bnZiHKA@v!hDL=fGfDG42d`PqpwMgYme~uc&$9AQET@kwG
zUE;;?C-_lEX`K3{0JnYEO9)cJ!es$xZtQWRfv#Xl0szUwrTcFzmlZR1Ukk-X?;GOl
z+_L#>73A$G8VmotfKt7?uc)HWZ>PY4m%a@pue5sHaJ)~ERncJfn5Q`?;s{@OlJEls
z`w@~o0^!B{l|0T}j^y`a;}z}`o5lX+V4+qjg`3m*>0&us&}Vi_uv0Y=)mIx)BmR4B
zS`x0Oje@2|+~Gm7@mmcsDV4x%eX@EakHHhkw)UJLClL(Kr=J=J@G#P*6TdIp>#ptx
zu>ie~6#NE2K9hQfT$A^I(k&*8=OvAgjLSpzE|KhS>B;+~G%`tY$~g1rrgDx`FkI3T
zNbXFApY`XRs>i2nssu4yqYRz*rG1Fb<%5`%0VchR&ZLR_rp;z2M%UsA7S^0lK1D-i
zkO-@O%qKeX@E{F#E;Kl>Q+xs9B$V8@;i-PvphmtuVcTNxjP>TRhC`$Yu#C2^<;F0k
zD1XBaRl3E(MY!8$BL4j5eU&nRJSa$mYs8YzSmG+KahU;4w<TRbnmI09uZKrn<A5@G
zKj9gPyxn7bY7vwsBs%hkTFse0yy-1@-+de)J3d7ds=_^~Vp*jovaq&fGtF*TY^?5?
z<Si<$bhwkfY;mpR>UWm779{DGG55rg{e=p!9ivYl4H3F05@CM;J-ZSwZIkV$_!Nd3
zrm$PQ=lYYDDukcLcJ=%IPU)?E!5YzAe~KHi2rtLI;K2fLLbR2(O>U_^rrBBC8`tF!
z6Z~C6l~{*MG=!JN_L|Fhuq4)+$2+q1Vb>&O9<))t*g0Av24%r(EM$)B`Nk>N?iQ3d
zZ66!xEMUbJ33)ZgIoNzC%4hO?DZOLbhy94U#1LPzUXd&xdX`aO{BC;W?@X}DFvaAX
zaunSnuNanacZwK!vxO<p*F10T=tx&u6LK$p(8W$0q}honc`Eok7dLF;gB_b9-&c`x
zWy+_IZ^v)bS9y!C87cC0QJ+)dNyA<~2({qsD?kiJdSf#SuP>IiB{RasVU=y0w{lA*
zmN%wK2!HwxUWYV8e6_5o-b}6H*CG@yzCTZ<vrz-09L_vuIpGkK)?TBAokEY?eorBC
zb45ep&4B08^8%5%6@ECL^}5}<2fLvR6K*%>mbKYr@`rcXFEO4s<miKVl8sOdxD`Jj
z1OR!Ktl!Kg%SK^}ahLFxaF*_YIOyqsZ2>C$A;0mlqcLX}mVfx<)#LqS$f*a%xrA|h
zhnhg=9iwI)x-GN0>S2^UvJ+h|p7-y=$#UN0ZJBwkgSqNmx%IaB<L|dk6UtFqAO_bZ
z8ja`P5~;?rzGE!@{D_^p#yPlLhYQ#6DkmlY`}wLmV|sLE6zG5giY&FhUM+fG0)c5f
z33KJ_jQ>c{|KwTjr%rY;SE}Z9Vnz)z1+^yupJgY=6m3wPN#mF!E5xyWcmQiWd4EX0
z3A-~VwG9%hH95DF<hPy$Ao8d@tJjeNz5|Y|Ht(&nlJ{*SvHK!l5x4JMIFMJGk!jHk
zuE)Fcy)$Jj*Cu<3;(x(!A@HNshefrHK(jb{WB86428zSjx`jx3Vf|F~Pjx*U76Kgk
z)wqWi|NVmq)SLzTVCJ2CXM~L$m4cwQE(qVD0^2h9x(>)Ttq@6i7BAi#8l-5JHCc(u
z{F`cz-4^G(L2s$U^Zl|umV=-Jj48XOi0{gTRzjnfrfSHPv(GSH><;66l|m&&bkacW
zo6_UB3~%1P{c~d>_3Uq9y&NwV)~eRiH_oOSQ`XEL>Ig~>E&;>i9-}9OXx1oH_>aBN
z0vD!lDWd?w*rsvy+%G6XM2l|E2RCT0o}sA_+K`%!ClPDfiC~|Ue8>oFH?YF1lqT7j
zd+6|9QTycUrlk=<eMgL;!PW`3O7U}}T6`1a80Ra|oa^RG;%GcNWp7LIIjcJu6Er2Z
z4EVZ)Q|av#rP9Dz{WSeOB2;Ux@<-W?ZBZSA6r6jCX^IqI_0&P?WxX~XDHXX71nay%
zx7YIxghn+{5S3-nc3EI$ztJJjBU9JVaj$Qp!y!G#zD^R@aAF4B9s)!tJy(dLDvH=o
zner|gu%h%CA!q}~vm=d)T`?XaJR@Dob}$IC5yBDzB%{Cp!8=N8ZtUzEP}NBd7|Uz7
zJBA|f+C0pkE!94<JHOX1x;}wmM~B#tk9spTG}91FlVO}9I;MA>^`*$2m>{c5J`XyW
zv0TAOl4s9eHN3VcYEtJBt)-00|2mWt)}|?Q>-ocqP<qphokV*}e0l}fQ35L&6(T-5
zfdm*I`-9(xA~CyhBcMlAPW9C0HWFAe);(i!@r8%`;o|feyCp39jH47v97Vz9qs%ip
zWxwlB-?Kb?druf#CTai9-O@naH|&qsK*kTY17-SY&9b%5ExG)yJb%j!C$`Lzl64yt
zZU*w15y3108S9{7Dfa<tMw1_~v;`j-kIS^(+HrKltX;l$CYq|Ji3L*5m*eVvyFc1l
zMZ?-d{Fag!;4TLyn@pS*ag#$IBw!ykpoi6@8&0<L9u%W=6DHPE-|lhI5VTFSoQAUy
zJ;9Ov<}z$uNuS{qnS07|Fs^bflAjN*ZBplJvx3H)5r6Z|d=Qpq?ai3c9Um*e^gt2-
z&87NzHk)_hrVixEF&tZ9sy{+~>Hz13={7yd?ncP~=II}cf0r`GpVj4TNDuv3#!{Gi
znws{#>292&slufjbRI#kyX)S`4CdevNWQU*s@a!(=Or0r?+(@)gO#wLCGO(05sPRS
zeB|Z48(<m3iu+Y`PdGF)9H`=(<rvBm%kc<}g_ZcG(C%@erQVdHC7V1nn0EqL(pWzI
zdLD(#)KCb~-T#?KQcDmQ&l_~|IqA%StTM|)QA_aQwE%W&gtl(y^`4||0L4pji-=GZ
z+%>?{S#SJf-}C@^KRsv=by#emPTD%27wz5*uq6I5`MDEEr=g@vr@2~UWcJDXwN*ho
z(R^_33#$YChkK9F=VOIAyY6CMzdMajytY77^@olbFt=ADBRL~etTR$Cb|iu#5HP;W
zblSbgG&U_Vsu~gdfwd~XUf&4aO{k0?7@~JfOT*({TW!c$iuplY4ca~?tn(wZ<<x$G
zZbb~qbLGUa`5L~Bk9$r4yHRJ2E_B8OW>;(Rur`PG#+I1$Pt3h=obYHDTfhi5P&5}U
zkfz)i2@{qNGiTi!Hp$-4u&B48CmOXNvlF!tBpJ$4S0f0szAm!nD>^#`$VMjW<zW3E
z^!C7hHEmMML?yA*j6YscDN@Glgl3yqRNq5U(UlfTb7;zo#i*-!${qT79aNa-bh2xx
z6%p#|o8~2rP;D^FM8Q7B^U3xk_4HKAde(!yo}%AHETn$D5uT~g;)IsN_n8(>hi3^%
zfpPJD;V;PZ)%o)12YkQW+Y_QOwMvj5E_GDQGOQUMoa-cR1D<KWrby7|(JEX0ozuQ~
za4W|uEBZd)@Ol1I>dp=sWpfR@X={GmF=;94oi;38$}op9KQGseF+tZHkk_j|K5w_A
zBtvFI`f9HEN2#1T!N;AlFoE<p#;;Dwohi%TeIx5<r~w#-jE>PvJkqT*G^4etYHb+i
zNG2~%L~@%G1bQwaBSbHK1U`8jJIrzoXOne+HImh$kOjLM;dCD1L9Zh$Ajk+JD=mBs
zieg~PptCVOJv6iN%rj!l*B590W1kQ0E3u$1l~=P6zU<15dt5z9OA-6QY?fov1uONc
z`?<VbszThn;W>n^4~&W<G_KZU8pAR#C;PRg+HbHLNjzrs%x{mY+nY#39dbW*R7J*L
znT=(;i>Z(IC?+o*k_yAU@qqO``@x^PmWo&&lBk_3G{UwfSepv|)S1fcY-l8D^3Fnd
zgOw@z+xYvZArsl3oT51Kf1Dsfb=s|;cW@e$r)=FLpV1WN&{8s3-C3GB&2b@Bp!M7A
z<?#FB3rx*Rthc`FL%oa#dbP5XC#ThPx%G~QMG8_S(<2)Mr2vwKYif{qts7LXspwc5
zd5eiLx%eJ`TBc?7l3F-YBcRA3t6IFKS0U~?p_@G|9T)&&0msqdUM5B|u^)I<ep#A%
zeX;xvl#E~z3V$z4^n@$1P$?p8bzVL80o->hWaN`B(>VSIQk2uog~8-Tg-!lF2ee67
zCT;_U)U%V~W%^~(vO$rT{T3(X{QdeSmUloh%EE>S?b95|Fif#t-m(|m>FMuZ+}6x9
zH>-6?3BJDBz~B^FEz?UwJPvA`yq0bV)SkdWqcHCY#Wo|%MGheQ+nB1iroYtU&lJC#
zP}7DM*3XvXn93*t<QoB`rK3c!rJ8aLi9=$eAMnWymd6zulc>cW>`baRs_3zca6%$D
zcyt~VzYKUj=5+kor*`vQEp^#&N1uC3sKtAGAWa;v1t*6o|LDUuT+cS{M2W;G>f`<<
z;z@oQC$tdl)7P7##?K$wp$N38lsHi$w$7)jwRRt#st$`|c9}9thmDM4@WN`^MPIHK
zEjSXf&Q4-TJb>gZk&03D)v_@TgJe7(-0Q0bvEclw%-DKdIOE8D2tRV?yYr^=RhGC<
zuLeYz_Q6PG$+fbnzv2m+<|%a)-+Fz_aY)rqDOAxHly~G)%~L8$BKB}PauLpINu-Ul
zJn?1&OKj-L)^H`wKI;nt9nbEey<NSA*puD3xD=NCSPm92zR1Jp4~nC4hEmo&3PZ@5
z0C4BIp0u<~5o_YMxjJn)`>|lkd?%Q=6EM8K_!qLB6V@UOK81JTiCK?359ZZJh()S%
zoe5SDwD49e@f-^Gu0rGYpsuZ9vN#g;QS;iT^}rF1(um5wRq_zN<@fTVlt$l!-;A!5
zpu<1=$bJSfXemaerVFmt81YwIbUBskbuDpQUasc#TdW^vE;sn_yCW9Q7G~WIqP7p7
zv`CC8Pc#uZ7-P$nu{ER;<?hCl{>d69l&pI#PMg+3-b9WDDc#)l?MKyW$FE|b8`6Or
z(D>qKA0dQQfS?GQd%=a|?lCH30D(ddIsKF$-}%w?L}HxP7))>NbYi*h-hg^RZdDQB
ze)M%ZMos0%=`Zh7_3kHu>zt!_wSpBtW+juEJHan+V5O{crq*Hyqk;DEyGV_}k<C7h
z+YLEV%xyr~W#XSPS6AhMYoWZ!Xd^Ikoxk@)u4^GfW?r&I$}Fv*DiS6yv|8hVSMA{_
zOQ7iC;nWGa{X4f9<$7E9aeM#Mv8r?Saj#u^>rp~`-fUQ$r9P6k*YUd!v;b0^Hc{96
z(E9q^GIzF)NVP><A-hZYvZ3zgDzmoez)7XVR3!EcP^hagx;sdh{%U3b3M;(;j2-Bh
z+ee*jIa*%02Dni7{q_Hrc5vYOdrI(<UgYrSv85P>r<tSs?8;^lSK^k0vb(8_*re#0
zU}Ja^O##OD?{8{M--UWxhxq2TCWf0`j+;f{X!vCy!;X||^g~mjvU6100cbGSw7{;g
zS?Z|$OI;+)1zmnG^{nehKBgUo=R7arxxnU)yV!qf+ZW2f;B&cFy?E=;U8>-seyTL#
z7-jXA%*o<&Lk(j=r>86;cIjv#%D&pY{T0^DX>otizsUQTStd^2nrD_DaBP`hV-aq1
z-s&82E(Pv~QM*(Hkm6+T297r92$tXM<N2plwTXMUe}zq*od&-A4*w|M+;!#m#w^#k
zr4xKsutEEybx)I`V^^U^$Pk4q<KwAt>9)Ii>!bjVB{EIUdRej~Y?_$n%+#BPD`u`U
zd}vpGJ(9V;-xo@t`BC9i>BdzwB5t94@b+l)?4elmL|8;{`PdOa#u`fB4FgR7Ntco5
zxqQlk`<Y+8HH(kK-yEN``Lw#QyXAz1ORYki)^kOBV&Hk-)lVODxPNuot%Bfw4JmVj
zS;^;1R@B;s*vHG)Rc7oywa9)uPuAPm%QL%`*DSkC=NZIkQmlSlPL7gA;H}J=XfJZn
z@KY2GsW?Q&{I>i&qA}}X<{Wd!ny1}l57aG(HsIR|=~$PRG2C6?cJ%f<e~+&@N_BfD
z>LyQ+Z0OH)&xk}|<v}CsrBJ@EqmE4^Ww>^o$ttaP=O!yp$=7wH0{8Qq6L+SR-JjtU
z41NNm{wqnVt=?{zuf}%OctK7CvlroO%JLI4>`VeCx3v3dKm3llW~@(n;^*opo;&W}
zln`@_PMr4ppIM%LS7mqR=Mc>_HoMG{N^p|y)cRA@(wfJm=i7OAhnf&$Q3%1Pk8f>}
zJQ6$6`Eu5=kG2ljwfS=VG4AmbbD&I?3GkiP3rsRP;6|NqZKcEslKfI2VSe{naJn~#
z{9LpDVsPC8<u6BO#S3IF&$j2YWRq2W%Rj+#QBh9G%?~JOo{eFDkZy_ykjv%r9a8$R
z`)I|4=@x(Y|8=;W+1~T2`&I5Qldr44tW^QOy(MmSD@qF&Rx8Z(Icba&dxCcGQ2ou}
z5t(?Lkx?n2a=%s;ys;1l25H2}Nb6s-+n{pGo+ep^mxyO!|4^^<{9{^n3WO-0&x<il
zvEiDDd9D1mv%cC{@)gQbdc9ygw4SyT5wNOXey!P`)Y2Cc2+EZ*@Y4>{w23b*LrjEv
zjAYg_FAt#~S1pbNfC}}?-V|fbmlxJEcS0&Co_A8Q{8+wcn_HT{7isPq{#LA&e&02n
zqP|e8%rO6A0fU$MbG?-tiY(ePA)&=dSW}!SiM5jPbM9t53?e}m)MWICQ$q{bCklTd
zWr<(7KH}m}L9I&qDW<IPmVZ5(>>v7dF~RtnKc!rD9-@ifz0zN;n}1jbKk}iqJa>YA
zTVZ1T&KB0wnPiN)I7JhHG&=!)8W_rtacRr80c9TTYtqmdT}<QE{>$5th|zB3)g^Nw
zV8pnp@~Vn41T&Q-9nO^Wxxc_f?F)tcRY$!qaOS#B>S~_EAll+Z<EW+S;zH|LXLXNK
zM1w`tBa5@?ZN^9NC2QNo=m8RX5ZU>r<=b)=(pH(#(|y1wt7kJDi}<ra320c!sx|7r
zIVuuH(tI1@{aVO1u4<x;c$7d~Y+7^Bn3Ytz&G3GrG^FaHG(b&ts8SgxxAgGUtkC|A
z?Ua-53A?{-FT`U3$wq_I*3f$KYl1VJ5%K$ysgT~%2wJY|cg<~Cq2SH1E$SeYmLVPj
z_xHH*?bA5;<QB<8P1V2<TPyeHPj`b=;Am6g9<HwK5R4#wp}}cHG;Ro85rkC7+*6EF
zS5{|jUL6^lVu5#dB+amX-ZBuBp4sqTQSL?$az7PnUXE_`TX+WQJ5MwZo6Cj-bEpSg
zgs5LG`sOfi7q<j!6kOE~`FyoO@JxCwyx*@2@K)n3mp3sCJdf!BdXjut{-{F1;V&1)
zdI66m5pQ0IFf545b`*U{_C-*+9)!62%3`&i2Up%s1jv!kFq_n#N^|u=q$EG6kPv!`
zNgVhuZ453CZQ$f1ka#%JA6(e-(H|_`ZBfNu`Jy*I`M>5za?s4P{X(th6e9+P39EKe
zO$vXPmR;b#Zim!wRUVQuKIeI#sJFp2oI;s}KHRuw;x~rE8pYQSZ$A8;QIM@_c0PaT
zW;9?fPRXl5#b9By^3v+!aBMJkzCLL;O$y#bUi@GL!A>nK&ap;WWVzL_aNX6){KjZJ
z^K{CpAq_Zkx27p0;#&3#18=_NeVPqeh&JS&-+F4wVO02<mR5XDI4RbOi(iIy`tm4s
z=}>O=DSEL|<Ai2PXBo>3kRPpbItwC@kY$ne{mT@uZz{7LYN+;NBSQmEdk`A=MMgFM
zNY@+Sh4U8_3E?}q8O%aI!Q4LO_E~3n1eW#MF(#Fr$HI`r`i_qWJxGM|9|x7w8rTnY
z<?fpO7`m0E*?#5CSGksUo?AD)J-vBv=+E+ogy;V4zDq3WT`Gc3q-9g3x9?u%$KJCU
z%*53?AVuPb7-piI?;h`mm~IKfvhxmWqAG6VdPWE4!=NEi?wjKl>$5$d4J!S-tyFz~
z#?(~Nq)UMmyi!Vh-MH5b38~QuW48VaJE2EUTdU4b6~CwHqKJ;DvZkVyqC!w|GFbsN
zzj|9|i+3ZXaI5PPDfQn%q;O+vLfw@FuyrKa3}YhETkC4PKHjC6i-dFH+snG!Q3=oO
zhadzOv4fH^#bMC3kPF=ZYPX^@*q<%G=+Bd<FhW@Q8_9z0=%e^XoYcHzwiJSQ@co9_
z<nh22#yVdow8dt$f5C8)s^8WYW8=@8>&)`FA-nGyx|_^c=Tt<ut|OX0*v~#4XY@EI
zjq;`_{yG*?DYYxVsMoselyx}h)D)ERyQS)Ckn==UY%cIOsmuoj|64}vLIQ_I!Qm6*
zFO~N_TH<*`!G~srTd-e&G3wZrf+<6xo4q;(audWKR?!)Q_^h$afR*p_pRRqaf6m+t
zc)slp_9xfoSF}O*G3AsEE+pP<4V^nf!4M&wZSUzA`IPQypl%#|<mHX6OJ@?}&9s5k
z?S0`Vs~5HnB^}DY2uM6yPXB(`mk4-spR&}<WcQ#$SVS4tXGN$TY^ZpH{CJNtFWFSs
ziFKf<{$4UB-8``0a*A4_%!)60l3!r0g>FjxZl7s%wDor4OsDmCAZhV(JK-oXNlIQ~
z&8beI;o9WT`4>W%O|rx{pUsqK!bmx$;|1!kYYkE!5`pI`ox~L;+k#nvJQ49uX}6(g
zF*LF7zcH()6Qo-yjMlHee0JDAB+T`qS~y?iJ^06othGm!V~oDT9y_`{gwO#!FlWJF
z-CtEPZhjdj!-(5IDeklRgx@1+z|@{#<Zh6ewq-nc{Vv>Q+m>CrFW=tme8KRkCEVpX
z9Ez#7TNqf^FT*3sFq7W21-FAII_Z;nzjF~)sb?auvjp$+H@=N)eBCbVX=?e&(883X
zCv$~I%6G^^Tv|GVZvR(ArqjWLESDWR`PyUW+xEpX<*7j<-T~P2GDyb2NFP&bRgyS1
zL=XQhbw4P<=0)#-huZ*iAo8#v`VV4``p-h!XpPa$MHjDUCyIB3@plwUmbKgYHLCl7
z0~)O<SaJUTE2g-ig!3!L(Ttz&MP8n*0GL86`ZQMU@+U!X5os22ZL?gqs@mX>#i}GF
z5eZ)h>_8k}g7(J7(2KimI!pfG=&`Igc^WiNnrW0sDrCS=l-nSJ^4Os>&4BmX)_3El
zbZVqT>Uu9{d`*e*!lmA3o?ZvIvaorGrnidPrt1Ey>wxy7OK?O|vDZ6OUORYsPC~I>
zg18S%i!^h4f2dZOo+`}*e^T|@fvBwJ4Y)U<m@dJnq_;1V&R$FZiD^fgbN`FsDjR#S
z!DnbHwq<+r6<YHNvO3wZf1D~U*48G*Y?E(TY{uc{T-#0;k1erXo2)-tJpNg&X`V%G
zfYFoU2Vn7t7rj-QqNa}?WVhKP-2S&b7Q0cX1V2_%n64YY`*91<gy^VZlx<M|54b=|
Ai~s-t

literal 0
HcmV?d00001

diff --git a/api/src/mails/router.ts b/api/src/mails/router.ts
index 989ae91b..c8000dab 100644
--- a/api/src/mails/router.ts
+++ b/api/src/mails/router.ts
@@ -7,7 +7,8 @@ import { RateLimiterMongo } from 'rate-limiter-flexible'
 import emailValidator from 'email-validator'
 import multer from 'multer'
 import { reqI18n } from '#i18n'
-import { sendMail } from './service.ts'
+import { sendMail, defaultLogoPng } from './service.ts'
+import { crossOriginResourcePolicy } from 'helmet'
 import { textToSafeHtml, sanitizeMailHtml } from './escape.ts'
 import type { FindMembersParams } from '../storages/interface.ts'
 import { reqSite } from '#services'
@@ -87,6 +88,13 @@ router.post('/', async (req, res, next) => {
   res.send(results)
 })
 
+// the url built by the mails service carries a hash of the content, the image can be cached forever
+router.get('/logo.png', crossOriginResourcePolicy({ policy: 'cross-origin' }), (req, res) => {
+  res.set('Content-Type', 'image/png')
+  res.set('Cache-Control', 'public, max-age=31536000, immutable')
+  res.send(defaultLogoPng)
+})
+
 // protect contact route with rate limiting to prevent spam
 let _contactLimiter: RateLimiterMongo | undefined
 router.post('/contact', async (req, res) => {
diff --git a/api/src/mails/service.ts b/api/src/mails/service.ts
index 9c0aaf5d..249cb9cf 100644
--- a/api/src/mails/service.ts
+++ b/api/src/mails/service.ts
@@ -2,6 +2,7 @@ import mjml2html from 'mjml'
 import microTemplate from '@data-fair/lib-utils/micro-template.js'
 import { join } from 'path'
 import { readFileSync, existsSync } from 'node:fs'
+import { createHash } from 'node:crypto'
 import config from '#config'
 import { flatten } from 'flat'
 import EventEmitter from 'node:events'
@@ -13,6 +14,11 @@ import { mailLimiter } from '../utils/limiter.ts'
 
 export const events = new EventEmitter()
 
+// logo used when neither the site nor the config define one, served by GET /api/mails/logo.png;
+// the content hash in the url lets it be cached forever and still change with a new image
+export const defaultLogoPng = readFileSync(join(import.meta.dirname, '../../resources/logo.png'))
+const defaultLogoUrl = `${config.publicUrl}/api/mails/logo.png?v=${createHash('sha256').update(defaultLogoPng).digest('hex').slice(0, 8)}`
+
 const genericTplPath = join(import.meta.dirname, 'generic-mail.mjml')
 const genericTemplate = readFileSync(genericTplPath, 'utf8')
 let mainSiteTemplate = genericTemplate
@@ -115,7 +121,7 @@ export const sendMail = async (to: string, params: SendMailParams, attachments?:
   if (mainSite) site = undefined
 
   const flatTheme: FlatTheme = flatten({ theme: config.theme })
-  let logo = config.theme.logo || 'https://cdn.rawgit.com/koumoul-dev/simple-directory/v0.12.3/public/assets/logo-150x150.png'
+  let logo = config.theme.logo || defaultLogoUrl
   let from = config.mails.from
   let contact = config.contact
   // the main site keeps the main template in both cases — it *is* the main
diff --git a/tests/features/mails.api.spec.ts b/tests/features/mails.api.spec.ts
index 60d0af87..aa2781c8 100644
--- a/tests/features/mails.api.spec.ts
+++ b/tests/features/mails.api.spec.ts
@@ -162,6 +162,17 @@ test.describe('mails', () => {
     assert.ok(email.html.includes('href="mailto:visitor@test.com"'), 'the sender is named by simple-directory, as a link')
   })
 
+  test('Default logo is served by simple-directory and cached for good', async () => {
+    const ax = await axios()
+    await ax.post('/api/mails', { to: ['logo@test.com'], subject: 'logo-test', text: 'logo' }, { params: { key: 'testkey' } })
+    const email = await findEmail('logo-test')
+    const logoUrl = email.html.match(/src="([^"]*\/api\/mails\/logo\.png\?v=[0-9a-f]{8})"/)?.[1]
+    assert.ok(logoUrl, 'the mail should use the bundled logo with a content hash')
+    const res = await ax.get(logoUrl, { responseType: 'arraybuffer' })
+    assert.equal(res.headers['content-type'], 'image/png')
+    assert.equal(res.headers['cache-control'], 'public, max-age=31536000, immutable')
+  })
+
   test('Send email to address and with attachments', async () => {
     const ax = await axios()
     const readmeBuffer = fs.readFileSync('./README.md')

From d92257f89ecc40805d37404b990dc9b0ca289e0f Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 13:15:52 +0200
Subject: [PATCH 14/16] fix(avatars): refuse uploads when avatars are disabled,
 keep deletion open

AVATARS_USERS / AVATARS_ORGS only hid the upload widgets since they were
added: the API still accepted any upload. Deletion stays allowed so an
instance can switch uploads off and still moderate the existing avatars.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 api/src/avatars/router.ts          | 10 ++++++++--
 tests/features/avatars.api.spec.ts | 15 +++++++++++++++
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/api/src/avatars/router.ts b/api/src/avatars/router.ts
index 8bd0e625..48fb1759 100644
--- a/api/src/avatars/router.ts
+++ b/api/src/avatars/router.ts
@@ -131,14 +131,20 @@ const isAdmin: RequestHandler<AvatarParams> = async (req, res, next) => {
   return next()
 }
 
+// AVATARS_USERS / AVATARS_ORGS = false stops new uploads; deleting stays open so existing avatars can be moderated
+const uploadEnabled: RequestHandler<AvatarParams> = (req, res, next) => {
+  if (!config.avatars[req.params.type === 'user' ? 'users' : 'orgs']) throw httpError(403, 'avatar upload is disabled')
+  next()
+}
+
 const writeAvatar: RequestHandler<AvatarParams> = async (req, res, next) => {
   if (!req.file) throw httpError(400)
   await setAvatar({ owner: req.params as unknown as Account, buffer: req.file.buffer })
   res.status(201).send()
 }
 
-router.post('/:type/:id/avatar.png', isAdmin, upload.single('avatar'), writeAvatar)
-router.post('/:type/:id/:department/avatar.png', isAdmin, upload.single('avatar'), writeAvatar)
+router.post('/:type/:id/avatar.png', isAdmin, uploadEnabled, upload.single('avatar'), writeAvatar)
+router.post('/:type/:id/:department/avatar.png', isAdmin, uploadEnabled, upload.single('avatar'), writeAvatar)
 
 const deleteAvatar: RequestHandler<AvatarParams> = async (req, res, next) => {
   if (!['user', 'organization'].includes(req.params.type)) {
diff --git a/tests/features/avatars.api.spec.ts b/tests/features/avatars.api.spec.ts
index 56d39942..9c136d6d 100644
--- a/tests/features/avatars.api.spec.ts
+++ b/tests/features/avatars.api.spec.ts
@@ -94,6 +94,21 @@ test.describe('avatars api', () => {
     await assertUnknown(ax, removedPath, 'unknown-department.png')
   })
 
+  test('should refuse uploads but keep deletion when avatars are disabled', async () => {
+    const { ax, user } = await createUser('avatar-disabled@test.com')
+    const path = `/api/avatars/user/${user.id}/avatar.png`
+    assert.equal((await uploadAvatar(ax, path)).status, 201)
+
+    await testEnvAx.patch('/config', { avatars: { users: false, orgs: true } })
+    try {
+      await assert.rejects(uploadAvatar(ax, path), { status: 403 })
+      assert.equal((await ax.delete(path)).status, 204)
+      assert.equal((await ax.get(path)).headers['x-avatar-custom'], 'false')
+    } finally {
+      await testEnvAx.patch('/config', { avatars: { users: true, orgs: true } })
+    }
+  })
+
   test('should delete a custom avatar and revert to default initials avatar', async () => {
     const { ax, user } = await createUser('avatar-reset@test.com')
     const path = `/api/avatars/user/${user.id}/avatar.png`

From 18ce84054c6075d7d7f171d5e8ef806f380fa3d7 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 13:28:29 +0200
Subject: [PATCH 15/16] fix(organizations): multi-roles member patch merges
 duplicates and keeps other memberships

Changing a membership to a role the member already holds answered 204 and
left both memberships: the patched one is now dropped. Moving a membership to
another department in multi-roles mode deleted every membership of the user
holding another role, in every organization (the filter returned false for
them): only a membership with the same role conflicts now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 api/src/storages/mongo.ts                | 11 +++++--
 tests/features/organizations.api.spec.ts | 38 ++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/api/src/storages/mongo.ts b/api/src/storages/mongo.ts
index 642a0eea..545aab40 100644
--- a/api/src/storages/mongo.ts
+++ b/api/src/storages/mongo.ts
@@ -492,12 +492,19 @@ class MongodbStorage implements SdStorage {
     const dupUserOrg = user.organizations.find(o => {
       return o.id === organizationId && (o.department || null) === (patch.department || null) && o.role === patch.role
     })
-    if (dupUserOrg) return
+    if (dupUserOrg) {
+      // the target membership already exists: merge by dropping the patched one
+      if (dupUserOrg !== userOrg) {
+        await mongo.users.updateOne({ _id: userId }, { $set: { organizations: user.organizations.filter(o => o !== userOrg) } })
+      }
+      return
+    }
 
     // if we are switching department remove potential conflict
     if ((patch.department || null) !== (department || null)) {
       user.organizations = user.organizations.filter(o => {
-        if (config.multiRoles && o.role !== patch.role) return false
+        // in multi-roles mode only a membership with the same role conflicts
+        if (config.multiRoles && o.role !== patch.role) return true
         const isConflict = o.id === organizationId && (o.department || null) === (patch.department || null)
         return !isConflict
       })
diff --git a/tests/features/organizations.api.spec.ts b/tests/features/organizations.api.spec.ts
index d838953e..ecca493a 100644
--- a/tests/features/organizations.api.spec.ts
+++ b/tests/features/organizations.api.spec.ts
@@ -281,6 +281,44 @@ test.describe('organizations api', () => {
     await testEnvAx.patch('/config', { alwaysAcceptInvitation: false })
   })
 
+  test('multi-roles: changing a membership to a role the member already has merges them', async () => {
+    await testEnvAx.patch('/config', { alwaysAcceptInvitation: true, multiRoles: true })
+    try {
+      const { ax } = await createUser('test-owner-mr1@test.com')
+      const { ax: axMember, user: member } = await createUser('test-member-mr1@test.com')
+      const org = (await ax.post('/api/organizations', { name: 'test' })).data
+      ax.setOrg(org.id)
+      await ax.post('/api/invitations', { id: org.id, name: org.name, email: member.email, role: 'user' })
+      await ax.post('/api/invitations', { id: org.id, name: org.name, email: member.email, role: 'admin' })
+
+      await ax.patch(`/api/organizations/${org.id}/members/${member.id}`, { role: 'admin' }, { params: { role: 'user' } })
+      const memberships = (await axMember.get(`/api/users/${member.id}`)).data.organizations.filter((o: any) => o.id === org.id)
+      assert.deepEqual(memberships.map((o: any) => o.role), ['admin'])
+    } finally {
+      await testEnvAx.patch('/config', { alwaysAcceptInvitation: false, multiRoles: false })
+    }
+  })
+
+  test('multi-roles: moving a membership to another department keeps the other memberships', async () => {
+    await testEnvAx.patch('/config', { alwaysAcceptInvitation: true, multiRoles: true })
+    try {
+      const { ax } = await createUser('test-owner-mr2@test.com')
+      const { ax: axMember, user: member } = await createUser('test-member-mr2@test.com')
+      // the member administers an organization of their own
+      const ownOrg = (await axMember.post('/api/organizations', { name: 'own' })).data
+      const org = (await ax.post('/api/organizations', { name: 'test', departments: [{ id: 'dep1', name: 'Department 1' }, { id: 'dep2', name: 'Department 2' }] })).data
+      ax.setOrg(org.id)
+      await ax.post('/api/invitations', { id: org.id, name: org.name, department: 'dep1', email: member.email, role: 'user' })
+
+      await ax.patch(`/api/organizations/${org.id}/members/${member.id}`, { role: 'user', department: 'dep2' }, { params: { role: 'user', department: 'dep1' } })
+      const memberships = (await axMember.get(`/api/users/${member.id}`)).data.organizations
+        .map((o: any) => `${o.id}/${o.department ?? ''}/${o.role}`).sort()
+      assert.deepEqual(memberships, [`${org.id}/dep2/user`, `${ownOrg.id}//admin`].sort())
+    } finally {
+      await testEnvAx.patch('/config', { alwaysAcceptInvitation: false, multiRoles: false })
+    }
+  })
+
   test('should send emails based on roles and departments', async () => {
     await getServerConfig()
     await testEnvAx.patch('/config', { alwaysAcceptInvitation: true })

From 0582a588ad7b559fc7b9a1c53849ec7438ab43f2 Mon Sep 17 00:00:00 2001
From: BatLeDev <baptiste.guerny@koumoul.com>
Date: Thu, 1 Oct 2026 13:54:55 +0200
Subject: [PATCH 16/16] fix(admin): separate the department from the
 organization name in the users lists

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ui/src/pages/admin/users.vue      | 2 +-
 ui/src/pages/site-admin/users.vue | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/src/pages/admin/users.vue b/ui/src/pages/admin/users.vue
index 9fd90bab..fae6c293 100644
--- a/ui/src/pages/admin/users.vue
+++ b/ui/src/pages/admin/users.vue
@@ -112,7 +112,7 @@
                   class="text-primary"
                   :to="`/organization/${orga.id}`"
                 >{{ orga.name }}</router-link>
-                <template v-if="orga.department">{{ orga.departmentName || orga.department }}</template>
+                <template v-if="orga.department"> / {{ orga.departmentName || orga.department }}</template>
                 ({{ orga.roleLabel || orga.role }})
               </span>
             </div>
diff --git a/ui/src/pages/site-admin/users.vue b/ui/src/pages/site-admin/users.vue
index 73849a8b..758cebd5 100644
--- a/ui/src/pages/site-admin/users.vue
+++ b/ui/src/pages/site-admin/users.vue
@@ -67,7 +67,7 @@
                   class="text-primary"
                   :to="`/organization/${orga.id}`"
                 >{{ orga.name }}</router-link>
-                <template v-if="orga.department">{{ orga.departmentName || orga.department }}</template>
+                <template v-if="orga.department"> / {{ orga.departmentName || orga.department }}</template>
                 ({{ orga.roleLabel || orga.role }})
               </span>
             </div>