Summary

Adds Microsoft Teams notifications for events that need an administrator, and a way for users to request a different role.

Notifications (Teams)

• Posted to Teams through a Power Automate webhook (ADMIN_TEAMS_WEBHOOK_URL, the same Adaptive Card flow the recipe-proposal alerts use) when:
  • a user signs in for the first time, including a previously invited user;
  • equipment enters review: a new registration or changes by a non-admin, once per review cycle;
  • a user requests a role change.
• Each event is written to a platform_notifications outbox in the same transaction as the event, with a unique key, so it can't be lost or duplicated. The sign-in check runs on every page load but notifies once per user.
• Delivery runs in the background: each row is claimed individually with a lease and claim token, retried with backoff and bounded attempts, and stored errors are sanitized so webhook URLs never appear.
• Email (SMTP or a Power Automate email flow) is supported but off until configured; for now Teams is the only channel.

Role change requests

• Users: Settings → "Your role". Choose a role and explain why; one pending request at a time, can cancel, at most 3 per day.
• Admins: a new Admin → Role Requests page to approve or reject, with an optional note.
• Approval uses the same rules and audit log as the Users page role editor, which now shares that code. The requester sees the decision on their Settings page, and the new role applies on their next page load.
• Access: row-level security keeps requests visible to their owner and to admins only.

Security fix (existing hole)

• The web proxy forwarded GET /api/admin/users/{email}/role, the sign-in identity sync, using the system token, so any signed-in user could create or merge someone else's account. The proxy now refuses that route, and the API rejects calls to it that carry a user identity.

Also

• Invited users stay "invited" when an admin edits their role before they sign in, so their first sign-in still notifies.
• When duplicate accounts are merged, their role requests move to the remaining account.
• /api/health reports whether each notification channel is configured.
• The setup guide is api/ADMIN_NOTIFICATIONS.md.

Deploying

1. Run the dt-db-migrate Job with the new image; it creates platform_notifications and role_change_requests and their access rules.
2. Roll out the API and web images.
3. Set PLATFORM_BASE_URL for the "Open in the platform" links. ADMIN_TEAMS_WEBHOOK_URL is already in dt-api-secret.

Test plan

• New database integration suite (api/tests/test_admin_notifications_pg.py): 23/23 on a disposable Postgres 15. It covers first sign-in (once only, invited users, blocked proxied calls), equipment review cycles, the role-request lifecycle with audit, conflict and daily-limit errors, row-level security, delivery (Teams card, email webhook and SMTP, partial refusal, skipped channels, retry/backoff/give-up, stale-claim protection, sanitized errors) and account merging.
• Existing RLS suite 36/36; unit suite 153 passed.
• Web: tsc, eslint and next build pass.
• Reviewed by a second agent (Codex) over 5 rounds; all findings resolved, final verdict approve.

🤖 Generated with Claude Code