Monorepo: consolidate 7 repos into one

Combines shared, blog, market, cart, events, federation, and account into a single repository. Eliminates submodule sync, sibling model copying at build time, and per-app CI orchestration. Changes: - Remove per-app .git, .gitmodules, .gitea, submodule shared/ dirs - Remove stale sibling model copies from each app - Update all 6 Dockerfiles for monorepo build context (root = .) - Add build directives to docker-compose.yml - Add single .gitea/workflows/ci.yml with change detection - Add .dockerignore for monorepo build context - Create __init__.py for federation and account (cross-app imports)
2026-02-24 19:44:17 +00:00
commit f42042ccb7
895 changed files with 61147 additions and 0 deletions
--- a/account/Dockerfile
+++ b/account/Dockerfile
@@ -0,0 +1,50 @@
+# syntax=docker/dockerfile:1
+
+# ---------- Python application ----------
+FROM python:3.11-slim AS base
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PYTHONPATH=/app \
+    PIP_NO_CACHE_DIR=1 \
+    APP_PORT=8000 \
+    APP_MODULE=app:app
+
+WORKDIR /app
+
+# Install system deps + psql client
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates \
+      postgresql-client \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY shared/requirements.txt ./requirements.txt
+RUN pip install -r requirements.txt
+
+# Shared code (replaces submodule)
+COPY shared/ ./shared/
+
+# App code
+COPY account/ ./
+
+# Sibling models for cross-domain SQLAlchemy imports
+COPY blog/__init__.py ./blog/__init__.py
+COPY blog/models/ ./blog/models/
+COPY market/__init__.py ./market/__init__.py
+COPY market/models/ ./market/models/
+COPY cart/__init__.py ./cart/__init__.py
+COPY cart/models/ ./cart/models/
+COPY events/__init__.py ./events/__init__.py
+COPY events/models/ ./events/models/
+COPY federation/__init__.py ./federation/__init__.py
+COPY federation/models/ ./federation/models/
+
+# ---------- Runtime setup ----------
+COPY account/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+RUN useradd -m -u 10001 appuser && chown -R appuser:appuser /app
+USER appuser
+
+EXPOSE ${APP_PORT}
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
--- a/account/init.py
+++ b/account/init.py
--- a/account/app.py
+++ b/account/app.py
@@ -0,0 +1,65 @@
+from __future__ import annotations
+import path_setup  # noqa: F401  # adds shared/ to sys.path
+from pathlib import Path
+
+from quart import g, request
+from jinja2 import FileSystemLoader, ChoiceLoader
+
+from shared.infrastructure.factory import create_base_app
+from shared.services.registry import services
+
+from bp import register_account_bp, register_auth_bp, register_fragments
+
+
+async def account_context() -> dict:
+    """Account app context processor."""
+    from shared.infrastructure.context import base_context
+    from shared.services.navigation import get_navigation_tree
+    from shared.infrastructure.cart_identity import current_cart_identity
+    from shared.infrastructure.fragments import fetch_fragment
+
+    ctx = await base_context()
+
+    ctx["nav_tree_html"] = await fetch_fragment(
+        "blog", "nav-tree",
+        params={"app_name": "account", "path": request.path},
+    )
+    # Fallback for _nav.html when nav-tree fragment fetch fails
+    ctx["menu_items"] = await get_navigation_tree(g.s)
+
+    # Cart data (consistent with all other apps)
+    ident = current_cart_identity()
+    summary = await services.cart.cart_summary(
+        g.s, user_id=ident["user_id"], session_id=ident["session_id"],
+    )
+    ctx["cart_count"] = summary.count + summary.calendar_count + summary.ticket_count
+    ctx["cart_total"] = float(summary.total + summary.calendar_total + summary.ticket_total)
+
+    return ctx
+
+
+def create_app() -> "Quart":
+    from services import register_domain_services
+
+    app = create_base_app(
+        "account",
+        context_fn=account_context,
+        domain_services_fn=register_domain_services,
+    )
+
+    # App-specific templates override shared templates
+    app_templates = str(Path(__file__).resolve().parent / "templates")
+    app.jinja_loader = ChoiceLoader([
+        FileSystemLoader(app_templates),
+        app.jinja_loader,
+    ])
+
+    # --- blueprints ---
+    app.register_blueprint(register_auth_bp())
+    app.register_blueprint(register_account_bp())
+    app.register_blueprint(register_fragments())
+
+    return app
+
+
+app = create_app()
--- a/account/bp/init.py
+++ b/account/bp/init.py
@@ -0,0 +1,3 @@
+from .account.routes import register as register_account_bp
+from .auth.routes import register as register_auth_bp
+from .fragments import register_fragments
--- a/account/bp/account/init.py
+++ b/account/bp/account/init.py
--- a/account/bp/account/routes.py
+++ b/account/bp/account/routes.py
@@ -0,0 +1,168 @@
+"""Account pages blueprint.
+
+Moved from federation/bp/auth — newsletters, fragment pages (tickets, bookings).
+Mounted at root /.
+"""
+from __future__ import annotations
+
+from quart import (
+    Blueprint,
+    request,
+    render_template,
+    make_response,
+    redirect,
+    g,
+)
+from sqlalchemy import select
+
+from shared.models import UserNewsletter
+from shared.models.ghost_membership_entities import GhostNewsletter
+from shared.infrastructure.urls import login_url
+from shared.infrastructure.fragments import fetch_fragment, fetch_fragments
+
+oob = {
+    "oob_extends": "oob_elements.html",
+    "extends": "_types/root/_index.html",
+    "parent_id": "root-header-child",
+    "child_id": "auth-header-child",
+    "header": "_types/auth/header/_header.html",
+    "parent_header": "_types/root/header/_header.html",
+    "nav": "_types/auth/_nav.html",
+    "main": "_types/auth/_main_panel.html",
+}
+
+
+def register(url_prefix="/"):
+    account_bp = Blueprint("account", __name__, url_prefix=url_prefix)
+
+    @account_bp.context_processor
+    async def context():
+        events_nav, cart_nav = await fetch_fragments([
+            ("events", "account-nav-item", {}),
+            ("cart", "account-nav-item", {}),
+        ])
+        return {"oob": oob, "account_nav_html": events_nav + cart_nav}
+
+    @account_bp.get("/")
+    async def account():
+        from shared.browser.app.utils.htmx import is_htmx_request
+
+        if not g.get("user"):
+            return redirect(login_url("/"))
+
+        if not is_htmx_request():
+            html = await render_template("_types/auth/index.html")
+        else:
+            html = await render_template("_types/auth/_oob_elements.html")
+
+        return await make_response(html)
+
+    @account_bp.get("/newsletters/")
+    async def newsletters():
+        from shared.browser.app.utils.htmx import is_htmx_request
+
+        if not g.get("user"):
+            return redirect(login_url("/newsletters/"))
+
+        result = await g.s.execute(
+            select(GhostNewsletter).order_by(GhostNewsletter.name)
+        )
+        all_newsletters = result.scalars().all()
+
+        sub_result = await g.s.execute(
+            select(UserNewsletter).where(
+                UserNewsletter.user_id == g.user.id,
+            )
+        )
+        user_subs = {un.newsletter_id: un for un in sub_result.scalars().all()}
+
+        newsletter_list = []
+        for nl in all_newsletters:
+            un = user_subs.get(nl.id)
+            newsletter_list.append({
+                "newsletter": nl,
+                "un": un,
+                "subscribed": un.subscribed if un else False,
+            })
+
+        nl_oob = {**oob, "main": "_types/auth/_newsletters_panel.html"}
+
+        if not is_htmx_request():
+            html = await render_template(
+                "_types/auth/index.html",
+                oob=nl_oob,
+                newsletter_list=newsletter_list,
+            )
+        else:
+            html = await render_template(
+                "_types/auth/_oob_elements.html",
+                oob=nl_oob,
+                newsletter_list=newsletter_list,
+            )
+
+        return await make_response(html)
+
+    @account_bp.post("/newsletter/<int:newsletter_id>/toggle/")
+    async def toggle_newsletter(newsletter_id: int):
+        if not g.get("user"):
+            return "", 401
+
+        result = await g.s.execute(
+            select(UserNewsletter).where(
+                UserNewsletter.user_id == g.user.id,
+                UserNewsletter.newsletter_id == newsletter_id,
+            )
+        )
+        un = result.scalar_one_or_none()
+
+        if un:
+            un.subscribed = not un.subscribed
+        else:
+            un = UserNewsletter(
+                user_id=g.user.id,
+                newsletter_id=newsletter_id,
+                subscribed=True,
+            )
+            g.s.add(un)
+
+        await g.s.flush()
+
+        return await render_template(
+            "_types/auth/_newsletter_toggle.html",
+            un=un,
+        )
+
+    # Catch-all for fragment-provided pages — must be last
+    @account_bp.get("/<slug>/")
+    async def fragment_page(slug):
+        from shared.browser.app.utils.htmx import is_htmx_request
+        from quart import abort
+
+        if not g.get("user"):
+            return redirect(login_url(f"/{slug}/"))
+
+        fragment_html = await fetch_fragment(
+            "events", "account-page",
+            params={"slug": slug, "user_id": str(g.user.id)},
+        )
+        if not fragment_html:
+            abort(404)
+
+        w_oob = {**oob, "main": "_types/auth/_fragment_panel.html"}
+
+        if not is_htmx_request():
+            html = await render_template(
+                "_types/auth/index.html",
+                oob=w_oob,
+                page_fragment_html=fragment_html,
+            )
+        else:
+            html = await render_template(
+                "_types/auth/_oob_elements.html",
+                oob=w_oob,
+                page_fragment_html=fragment_html,
+            )
+
+        return await make_response(html)
+
+    return account_bp
--- a/account/bp/auth/init.py
+++ b/account/bp/auth/init.py
--- a/account/bp/auth/routes.py
+++ b/account/bp/auth/routes.py
@@ -0,0 +1,486 @@
+"""Authentication routes for the account app.
+
+Account is the OAuth authorization server. Owns magic link login/logout,
+OAuth2 authorize endpoint, grant verification, and SSO logout.
+"""
+from __future__ import annotations
+
+import secrets
+from datetime import datetime, timezone, timedelta
+
+from quart import (
+    Blueprint,
+    request,
+    render_template,
+    redirect,
+    url_for,
+    session as qsession,
+    g,
+    current_app,
+    jsonify,
+)
+from sqlalchemy import select, update
+from sqlalchemy.exc import SQLAlchemyError
+
+from shared.db.session import get_session
+from shared.models import User
+from shared.models.oauth_code import OAuthCode
+from shared.models.oauth_grant import OAuthGrant
+from shared.infrastructure.urls import account_url, app_url
+from shared.infrastructure.cart_identity import current_cart_identity
+from shared.events import emit_activity
+
+from .services import (
+    pop_login_redirect_target,
+    store_login_redirect_target,
+    send_magic_email,
+    find_or_create_user,
+    create_magic_link,
+    validate_magic_link,
+    validate_email,
+)
+
+SESSION_USER_KEY = "uid"
+ACCOUNT_SESSION_KEY = "account_sid"
+
+ALLOWED_CLIENTS = {"blog", "market", "cart", "events", "federation", "artdag"}
+
+
+def register(url_prefix="/auth"):
+    auth_bp = Blueprint("auth", __name__, url_prefix=url_prefix)
+
+    # --- OAuth2 authorize endpoint -------------------------------------------
+
+    @auth_bp.get("/oauth/authorize")
+    @auth_bp.get("/oauth/authorize/")
+    async def oauth_authorize():
+        client_id = request.args.get("client_id", "")
+        redirect_uri = request.args.get("redirect_uri", "")
+        state = request.args.get("state", "")
+        device_id = request.args.get("device_id", "")
+        prompt = request.args.get("prompt", "")
+
+        if client_id not in ALLOWED_CLIENTS:
+            return "Invalid client_id", 400
+
+        expected_redirect = app_url(client_id, "/auth/callback")
+        if redirect_uri != expected_redirect:
+            return "Invalid redirect_uri", 400
+
+        # Account's own device id — always available via factory hook
+        account_did = g.device_id
+
+        # Not logged in
+        if not g.get("user"):
+            if prompt == "none":
+                # Silent check — pass account_did so client can watch for future logins
+                sep = "&" if "?" in redirect_uri else "?"
+                return redirect(
+                    f"{redirect_uri}{sep}error=login_required"
+                    f"&state={state}&account_did={account_did}"
+                )
+            authorize_path = request.full_path
+            store_login_redirect_target()
+            return redirect(url_for("auth.login_form", next=authorize_path))
+
+        # Logged in — create grant + authorization code
+        account_sid = qsession.get(ACCOUNT_SESSION_KEY)
+        if not account_sid:
+            account_sid = secrets.token_urlsafe(32)
+            qsession[ACCOUNT_SESSION_KEY] = account_sid
+
+        grant_token = secrets.token_urlsafe(48)
+        code = secrets.token_urlsafe(48)
+        now = datetime.now(timezone.utc)
+        expires = now + timedelta(minutes=5)
+
+        async with get_session() as s:
+            async with s.begin():
+                grant = OAuthGrant(
+                    token=grant_token,
+                    user_id=g.user.id,
+                    client_id=client_id,
+                    issuer_session=account_sid,
+                    device_id=device_id or None,
+                )
+                s.add(grant)
+
+                oauth_code = OAuthCode(
+                    code=code,
+                    user_id=g.user.id,
+                    client_id=client_id,
+                    redirect_uri=redirect_uri,
+                    expires_at=expires,
+                    grant_token=grant_token,
+                )
+                s.add(oauth_code)
+
+        sep = "&" if "?" in redirect_uri else "?"
+        return redirect(
+            f"{redirect_uri}{sep}code={code}&state={state}"
+            f"&account_did={account_did}"
+        )
+
+    # --- OAuth2 token exchange (for external clients like artdag) -------------
+
+    from shared.browser.app.csrf import csrf_exempt
+
+    @csrf_exempt
+    @auth_bp.post("/oauth/token")
+    @auth_bp.post("/oauth/token/")
+    async def oauth_token():
+        """Exchange an authorization code for user info + grant token.
+
+        Used by clients that don't share the coop database (e.g. artdag).
+        Accepts JSON: {code, client_id, redirect_uri}
+        Returns JSON: {user_id, username, display_name, grant_token}
+        """
+        data = await request.get_json()
+        if not data:
+            return jsonify({"error": "invalid_request"}), 400
+
+        code = data.get("code", "")
+        client_id = data.get("client_id", "")
+        redirect_uri = data.get("redirect_uri", "")
+
+        if client_id not in ALLOWED_CLIENTS:
+            return jsonify({"error": "invalid_client"}), 400
+
+        now = datetime.now(timezone.utc)
+
+        async with get_session() as s:
+            async with s.begin():
+                result = await s.execute(
+                    select(OAuthCode)
+                    .where(OAuthCode.code == code)
+                    .with_for_update()
+                )
+                oauth_code = result.scalar_one_or_none()
+
+                if not oauth_code:
+                    return jsonify({"error": "invalid_grant"}), 400
+
+                if oauth_code.used_at is not None:
+                    return jsonify({"error": "invalid_grant"}), 400
+
+                if oauth_code.expires_at < now:
+                    return jsonify({"error": "invalid_grant"}), 400
+
+                if oauth_code.client_id != client_id:
+                    return jsonify({"error": "invalid_grant"}), 400
+
+                if oauth_code.redirect_uri != redirect_uri:
+                    return jsonify({"error": "invalid_grant"}), 400
+
+                oauth_code.used_at = now
+                user_id = oauth_code.user_id
+                grant_token = oauth_code.grant_token
+
+                user = await s.get(User, user_id)
+                if not user:
+                    return jsonify({"error": "invalid_grant"}), 400
+
+                return jsonify({
+                    "user_id": user_id,
+                    "username": user.email or "",
+                    "display_name": user.name or "",
+                    "grant_token": grant_token,
+                })
+
+    # --- Grant verification (internal endpoint) ------------------------------
+
+    @auth_bp.get("/internal/verify-grant")
+    async def verify_grant():
+        """Called by client apps to check if a grant is still valid."""
+        token = request.args.get("token", "")
+        if not token:
+            return jsonify({"valid": False}), 200
+
+        async with get_session() as s:
+            grant = await s.scalar(
+                select(OAuthGrant).where(OAuthGrant.token == token)
+            )
+            if not grant or grant.revoked_at is not None:
+                return jsonify({"valid": False}), 200
+            return jsonify({"valid": True}), 200
+
+    @auth_bp.get("/internal/check-device")
+    async def check_device():
+        """Called by client apps to check if a device has an active auth.
+
+        Looks up the most recent grant for (device_id, client_id).
+        If the grant is active → {active: true}.
+        If revoked but user has logged in since → {active: true} (re-auth needed).
+        Otherwise → {active: false}.
+        """
+        device_id = request.args.get("device_id", "")
+        app_name = request.args.get("app", "")
+        if not device_id or not app_name:
+            return jsonify({"active": False}), 200
+
+        async with get_session() as s:
+            # Find the most recent grant for this device + app
+            result = await s.execute(
+                select(OAuthGrant)
+                .where(OAuthGrant.device_id == device_id)
+                .where(OAuthGrant.client_id == app_name)
+                .order_by(OAuthGrant.created_at.desc())
+                .limit(1)
+            )
+            grant = result.scalar_one_or_none()
+
+            if not grant:
+                return jsonify({"active": False}), 200
+
+            # Grant still active
+            if grant.revoked_at is None:
+                return jsonify({"active": True}), 200
+
+            # Grant revoked — check if user logged in since
+            user = await s.get(User, grant.user_id)
+            if user and user.last_login_at and user.last_login_at > grant.revoked_at:
+                return jsonify({"active": True}), 200
+
+            return jsonify({"active": False}), 200
+
+    # --- Magic link login flow -----------------------------------------------
+
+    @auth_bp.get("/login/")
+    async def login_form():
+        store_login_redirect_target()
+        cross_cart_sid = request.args.get("cart_sid")
+        if cross_cart_sid:
+            qsession["cart_sid"] = cross_cart_sid
+        if g.get("user"):
+            redirect_url = pop_login_redirect_target()
+            return redirect(redirect_url)
+        return await render_template("auth/login.html")
+
+    @auth_bp.post("/start/")
+    async def start_login():
+        form = await request.form
+        email_input = form.get("email") or ""
+
+        is_valid, email = validate_email(email_input)
+        if not is_valid:
+            return (
+                await render_template(
+                    "auth/login.html",
+                    error="Please enter a valid email address.",
+                    email=email_input,
+                ),
+                400,
+            )
+
+        user = await find_or_create_user(g.s, email)
+        token, expires = await create_magic_link(g.s, user.id)
+
+        from shared.utils import host_url
+        magic_url = host_url(url_for("auth.magic", token=token))
+
+        email_error = None
+        try:
+            await send_magic_email(email, magic_url)
+        except Exception as e:
+            current_app.logger.error("EMAIL SEND FAILED: %r", e)
+            email_error = (
+                "We couldn't send the email automatically. "
+                "Please try again in a moment."
+            )
+
+        return await render_template(
+            "auth/check_email.html",
+            email=email,
+            email_error=email_error,
+        )
+
+    @auth_bp.get("/magic/<token>/")
+    async def magic(token: str):
+        now = datetime.now(timezone.utc)
+        user_id: int | None = None
+
+        try:
+            async with get_session() as s:
+                async with s.begin():
+                    user, error = await validate_magic_link(s, token)
+
+                    if error:
+                        return (
+                            await render_template("auth/login.html", error=error),
+                            400,
+                        )
+                    user_id = user.id
+
+        except Exception:
+            return (
+                await render_template(
+                    "auth/login.html",
+                    error="Could not sign you in right now. Please try again.",
+                ),
+                502,
+            )
+
+        assert user_id is not None
+
+        ident = current_cart_identity()
+        anon_session_id = ident.get("session_id")
+
+        try:
+            async with get_session() as s:
+                async with s.begin():
+                    u2 = await s.get(User, user_id)
+                    if u2:
+                        u2.last_login_at = now
+                    if anon_session_id:
+                        await emit_activity(
+                            s,
+                            activity_type="rose:Login",
+                            actor_uri="internal:system",
+                            object_type="Person",
+                            object_data={
+                                "user_id": user_id,
+                                "session_id": anon_session_id,
+                            },
+                        )
+                    # Notify external services of device login
+                    await emit_activity(
+                        s,
+                        activity_type="rose:DeviceAuth",
+                        actor_uri="internal:system",
+                        object_type="Device",
+                        object_data={
+                            "device_id": g.device_id,
+                            "action": "login",
+                        },
+                    )
+        except SQLAlchemyError:
+            current_app.logger.exception(
+                "[auth] non-fatal DB update for user_id=%s", user_id
+            )
+
+        qsession[SESSION_USER_KEY] = user_id
+        # Fresh account session ID for grant tracking
+        qsession[ACCOUNT_SESSION_KEY] = secrets.token_urlsafe(32)
+
+        # Signal login for this device so client apps can detect it
+        try:
+            from shared.browser.app.redis_cacher import get_redis
+            import time as _time
+            _redis = get_redis()
+            if _redis:
+                await _redis.set(
+                    f"did_auth:{g.device_id}",
+                    str(_time.time()).encode(),
+                    ex=30 * 24 * 3600,
+                )
+        except Exception:
+            current_app.logger.exception("[auth] failed to set did_auth in Redis")
+
+        redirect_url = pop_login_redirect_target()
+        return redirect(redirect_url, 303)
+
+    @auth_bp.post("/logout/")
+    async def logout():
+        # Revoke all grants issued by this account session
+        account_sid = qsession.get(ACCOUNT_SESSION_KEY)
+        if account_sid:
+            try:
+                async with get_session() as s:
+                    async with s.begin():
+                        await s.execute(
+                            update(OAuthGrant)
+                            .where(OAuthGrant.issuer_session == account_sid)
+                            .where(OAuthGrant.revoked_at.is_(None))
+                            .values(revoked_at=datetime.now(timezone.utc))
+                        )
+            except SQLAlchemyError:
+                current_app.logger.exception("[auth] failed to revoke grants")
+
+        # Clear login signal for this device
+        try:
+            from shared.browser.app.redis_cacher import get_redis
+            _redis = get_redis()
+            if _redis:
+                await _redis.delete(f"did_auth:{g.device_id}")
+        except Exception:
+            pass
+
+        # Notify external services of device logout
+        try:
+            async with get_session() as s:
+                async with s.begin():
+                    await emit_activity(
+                        s,
+                        activity_type="rose:DeviceAuth",
+                        actor_uri="internal:system",
+                        object_type="Device",
+                        object_data={
+                            "device_id": g.device_id,
+                            "action": "logout",
+                        },
+                    )
+        except Exception:
+            current_app.logger.exception("[auth] failed to emit DeviceAuth logout")
+
+        qsession.pop(SESSION_USER_KEY, None)
+        qsession.pop(ACCOUNT_SESSION_KEY, None)
+        from shared.infrastructure.urls import blog_url
+        return redirect(blog_url("/"))
+
+    @auth_bp.get("/sso-logout/")
+    async def sso_logout():
+        """SSO logout called by client apps: revoke grants, clear session."""
+        account_sid = qsession.get(ACCOUNT_SESSION_KEY)
+        if account_sid:
+            try:
+                async with get_session() as s:
+                    async with s.begin():
+                        await s.execute(
+                            update(OAuthGrant)
+                            .where(OAuthGrant.issuer_session == account_sid)
+                            .where(OAuthGrant.revoked_at.is_(None))
+                            .values(revoked_at=datetime.now(timezone.utc))
+                        )
+            except SQLAlchemyError:
+                current_app.logger.exception("[auth] failed to revoke grants")
+
+        # Clear login signal for this device
+        try:
+            from shared.browser.app.redis_cacher import get_redis
+            _redis = get_redis()
+            if _redis:
+                await _redis.delete(f"did_auth:{g.device_id}")
+        except Exception:
+            pass
+
+        # Notify external services of device logout
+        try:
+            async with get_session() as s:
+                async with s.begin():
+                    await emit_activity(
+                        s,
+                        activity_type="rose:DeviceAuth",
+                        actor_uri="internal:system",
+                        object_type="Device",
+                        object_data={
+                            "device_id": g.device_id,
+                            "action": "logout",
+                        },
+                    )
+        except Exception:
+            current_app.logger.exception("[auth] failed to emit DeviceAuth logout")
+
+        qsession.pop(SESSION_USER_KEY, None)
+        qsession.pop(ACCOUNT_SESSION_KEY, None)
+        from shared.infrastructure.urls import blog_url
+        return redirect(blog_url("/"))
+
+    @auth_bp.get("/clear/")
+    async def clear():
+        """One-time migration helper: clear all session cookies."""
+        qsession.clear()
+        resp = redirect(account_url("/"))
+        resp.delete_cookie("blog_session", domain=".rose-ash.com", path="/")
+        return resp
+
+    return auth_bp
--- a/account/bp/auth/services/init.py
+++ b/account/bp/auth/services/init.py
@@ -0,0 +1,24 @@
+from .login_redirect import pop_login_redirect_target, store_login_redirect_target
+from .auth_operations import (
+    get_app_host,
+    get_app_root,
+    send_magic_email,
+    load_user_by_id,
+    find_or_create_user,
+    create_magic_link,
+    validate_magic_link,
+    validate_email,
+)
+
+__all__ = [
+    "pop_login_redirect_target",
+    "store_login_redirect_target",
+    "get_app_host",
+    "get_app_root",
+    "send_magic_email",
+    "load_user_by_id",
+    "find_or_create_user",
+    "create_magic_link",
+    "validate_magic_link",
+    "validate_email",
+]
--- a/account/bp/auth/services/auth_operations.py
+++ b/account/bp/auth/services/auth_operations.py
@@ -0,0 +1,156 @@
+"""Auth operations for the account app.
+
+Owns magic-link login. Shared models, shared config.
+"""
+from __future__ import annotations
+
+import os
+import secrets
+from datetime import datetime, timedelta, timezone
+from typing import Optional, Tuple
+
+from quart import current_app, render_template, request, g
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
+
+from shared.models import User, MagicLink
+from shared.config import config
+
+
+def get_app_host() -> str:
+    host = (
+        config().get("host") or os.getenv("APP_HOST") or "http://localhost:8000"
+    ).rstrip("/")
+    return host
+
+
+def get_app_root() -> str:
+    root = (g.root).rstrip("/")
+    return root
+
+
+async def send_magic_email(to_email: str, link_url: str) -> None:
+    host = os.getenv("SMTP_HOST")
+    port = int(os.getenv("SMTP_PORT") or "587")
+    username = os.getenv("SMTP_USER")
+    password = os.getenv("SMTP_PASS")
+    mail_from = os.getenv("MAIL_FROM") or "no-reply@example.com"
+
+    site_name = config().get("title", "Rose Ash")
+    subject = f"Your sign-in link \u2014 {site_name}"
+
+    tpl_vars = dict(site_name=site_name, link_url=link_url)
+    text_body = await render_template("_email/magic_link.txt", **tpl_vars)
+    html_body = await render_template("_email/magic_link.html", **tpl_vars)
+
+    if not host or not username or not password:
+        current_app.logger.warning(
+            "SMTP not configured. Printing magic link to console for %s: %s",
+            to_email,
+            link_url,
+        )
+        print(f"[DEV] Magic link for {to_email}: {link_url}")
+        return
+
+    import aiosmtplib
+    from email.message import EmailMessage
+
+    msg = EmailMessage()
+    msg["From"] = mail_from
+    msg["To"] = to_email
+    msg["Subject"] = subject
+    msg.set_content(text_body)
+    msg.add_alternative(html_body, subtype="html")
+
+    is_secure = port == 465
+    if is_secure:
+        smtp = aiosmtplib.SMTP(
+            hostname=host, port=port, use_tls=True,
+            username=username, password=password,
+        )
+    else:
+        smtp = aiosmtplib.SMTP(
+            hostname=host, port=port, start_tls=True,
+            username=username, password=password,
+        )
+
+    async with smtp:
+        await smtp.send_message(msg)
+
+
+async def load_user_by_id(session: AsyncSession, user_id: int) -> Optional[User]:
+    stmt = (
+        select(User)
+        .options(selectinload(User.labels))
+        .where(User.id == user_id)
+    )
+    result = await session.execute(stmt)
+    return result.scalar_one_or_none()
+
+
+async def find_or_create_user(session: AsyncSession, email: str) -> User:
+    result = await session.execute(select(User).where(User.email == email))
+    user = result.scalar_one_or_none()
+
+    if user is None:
+        user = User(email=email)
+        session.add(user)
+        await session.flush()
+
+    return user
+
+
+async def create_magic_link(
+    session: AsyncSession,
+    user_id: int,
+    purpose: str = "signin",
+    expires_minutes: int = 15,
+) -> Tuple[str, datetime]:
+    token = secrets.token_urlsafe(32)
+    expires = datetime.now(timezone.utc) + timedelta(minutes=expires_minutes)
+
+    ml = MagicLink(
+        token=token,
+        user_id=user_id,
+        purpose=purpose,
+        expires_at=expires,
+        ip=request.headers.get("x-forwarded-for", request.remote_addr),
+        user_agent=request.headers.get("user-agent"),
+    )
+    session.add(ml)
+
+    return token, expires
+
+
+async def validate_magic_link(
+    session: AsyncSession,
+    token: str,
+) -> Tuple[Optional[User], Optional[str]]:
+    now = datetime.now(timezone.utc)
+
+    ml = await session.scalar(
+        select(MagicLink)
+        .where(MagicLink.token == token)
+        .with_for_update()
+    )
+
+    if not ml or ml.purpose != "signin":
+        return None, "Invalid or expired link."
+
+    if ml.used_at or ml.expires_at < now:
+        return None, "This link has expired. Please request a new one."
+
+    user = await session.get(User, ml.user_id)
+    if not user:
+        return None, "User not found."
+
+    ml.used_at = now
+    return user, None
+
+
+def validate_email(email: str) -> Tuple[bool, str]:
+    email = email.strip().lower()
+    if not email or "@" not in email:
+        return False, email
+    return True, email
--- a/account/bp/auth/services/login_redirect.py
+++ b/account/bp/auth/services/login_redirect.py
@@ -0,0 +1,45 @@
+from urllib.parse import urlparse
+from quart import session
+
+from shared.infrastructure.urls import account_url
+
+
+LOGIN_REDIRECT_SESSION_KEY = "login_redirect_to"
+
+
+def store_login_redirect_target() -> None:
+    from quart import request
+
+    target = request.args.get("next")
+    if not target:
+        ref = request.referrer or ""
+        try:
+            parsed = urlparse(ref)
+            target = parsed.path or ""
+        except Exception:
+            target = ""
+
+    if not target:
+        return
+
+    # Accept both relative paths and absolute URLs (cross-app redirects)
+    if target.startswith("http://") or target.startswith("https://"):
+        session[LOGIN_REDIRECT_SESSION_KEY] = target
+    elif target.startswith("/") and not target.startswith("//"):
+        session[LOGIN_REDIRECT_SESSION_KEY] = target
+
+
+def pop_login_redirect_target() -> str:
+    path = session.pop(LOGIN_REDIRECT_SESSION_KEY, None)
+    if not path or not isinstance(path, str):
+        return account_url("/")
+
+    # Absolute URL: return as-is (cross-app redirect)
+    if path.startswith("http://") or path.startswith("https://"):
+        return path
+
+    # Relative path: must start with / and not //
+    if path.startswith("/") and not path.startswith("//"):
+        return account_url(path)
+
+    return account_url("/")
--- a/account/bp/fragments/init.py
+++ b/account/bp/fragments/init.py
@@ -0,0 +1 @@
+from .routes import register as register_fragments
--- a/account/bp/fragments/routes.py
+++ b/account/bp/fragments/routes.py
@@ -0,0 +1,52 @@
+"""Account app fragment endpoints.
+
+Exposes HTML fragments at ``/internal/fragments/<type>`` for consumption
+by other coop apps via the fragment client.
+
+Fragments:
+  auth-menu   Desktop + mobile auth menu (sign-in or user link)
+"""
+
+from __future__ import annotations
+
+from quart import Blueprint, Response, request, render_template
+
+from shared.infrastructure.fragments import FRAGMENT_HEADER
+
+
+def register():
+    bp = Blueprint("fragments", __name__, url_prefix="/internal/fragments")
+
+    # ---------------------------------------------------------------
+    # Fragment handlers
+    # ---------------------------------------------------------------
+
+    async def _auth_menu():
+        user_email = request.args.get("email", "")
+        return await render_template(
+            "fragments/auth_menu.html",
+            user_email=user_email,
+        )
+
+    _handlers = {
+        "auth-menu": _auth_menu,
+    }
+
+    # ---------------------------------------------------------------
+    # Routing
+    # ---------------------------------------------------------------
+
+    @bp.before_request
+    async def _require_fragment_header():
+        if not request.headers.get(FRAGMENT_HEADER):
+            return Response("", status=403)
+
+    @bp.get("/<fragment_type>")
+    async def get_fragment(fragment_type: str):
+        handler = _handlers.get(fragment_type)
+        if handler is None:
+            return Response("", status=200, content_type="text/html")
+        html = await handler()
+        return Response(html, status=200, content_type="text/html")
+
+    return bp
--- a/account/entrypoint.sh
+++ b/account/entrypoint.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Optional: wait for Postgres to be reachable
+if [[ -n "${DATABASE_HOST:-}" && -n "${DATABASE_PORT:-}" ]]; then
+  echo "Waiting for Postgres at ${DATABASE_HOST}:${DATABASE_PORT}..."
+  for i in {1..60}; do
+    (echo > /dev/tcp/${DATABASE_HOST}/${DATABASE_PORT}) >/dev/null 2>&1 && break || true
+    sleep 1
+  done
+fi
+
+# Clear Redis page cache on deploy
+if [[ -n "${REDIS_URL:-}" && "${REDIS_URL}" != "no" ]]; then
+  echo "Flushing Redis cache..."
+  python3 -c "
+import redis, os
+r = redis.from_url(os.environ['REDIS_URL'])
+r.flushall()
+print('Redis cache cleared.')
+" || echo "Redis flush failed (non-fatal), continuing..."
+fi
+
+# Start the app
+echo "Starting Hypercorn (${APP_MODULE:-app:app})..."
+PYTHONUNBUFFERED=1 exec hypercorn "${APP_MODULE:-app:app}" --bind 0.0.0.0:${PORT:-8000}
--- a/account/models/init.py
+++ b/account/models/init.py
--- a/account/path_setup.py
+++ b/account/path_setup.py
@@ -0,0 +1,9 @@
+import sys
+import os
+
+_app_dir = os.path.dirname(os.path.abspath(__file__))
+_project_root = os.path.dirname(_app_dir)
+
+for _p in (_project_root, _app_dir):
+    if _p not in sys.path:
+        sys.path.insert(0, _p)
--- a/account/services/init.py
+++ b/account/services/init.py
@@ -0,0 +1,27 @@
+"""Account app service registration."""
+from __future__ import annotations
+
+
+def register_domain_services() -> None:
+    """Register services for the account app.
+
+    Account needs all domain services since widgets (tickets, bookings)
+    pull data from blog, calendar, market, cart, and federation.
+    """
+    from shared.services.registry import services
+    from shared.services.federation_impl import SqlFederationService
+    from shared.services.blog_impl import SqlBlogService
+    from shared.services.calendar_impl import SqlCalendarService
+    from shared.services.market_impl import SqlMarketService
+    from shared.services.cart_impl import SqlCartService
+
+    if not services.has("federation"):
+        services.federation = SqlFederationService()
+    if not services.has("blog"):
+        services.blog = SqlBlogService()
+    if not services.has("calendar"):
+        services.calendar = SqlCalendarService()
+    if not services.has("market"):
+        services.market = SqlMarketService()
+    if not services.has("cart"):
+        services.cart = SqlCartService()
--- a/account/templates/_email/magic_link.html
+++ b/account/templates/_email/magic_link.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8"></head>
+<body style="margin:0;padding:0;background:#f5f5f4;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;">
+  <table width="100%" cellpadding="0" cellspacing="0" style="background:#f5f5f4;padding:40px 0;">
+    <tr><td align="center">
+      <table width="480" cellpadding="0" cellspacing="0" style="background:#ffffff;border-radius:12px;border:1px solid #e7e5e4;padding:40px;">
+        <tr><td>
+          <h1 style="margin:0 0 8px;font-size:20px;font-weight:600;color:#1c1917;">{{ site_name }}</h1>
+          <p style="margin:0 0 24px;font-size:15px;color:#57534e;">Sign in to your account</p>
+          <p style="margin:0 0 24px;font-size:15px;line-height:1.5;color:#44403c;">
+            Click the button below to sign in. This link will expire in 15&nbsp;minutes.
+          </p>
+          <table cellpadding="0" cellspacing="0" style="margin:0 0 24px;"><tr><td style="border-radius:8px;background:#1c1917;">
+            <a href="{{ link_url }}" target="_blank"
+               style="display:inline-block;padding:12px 32px;font-size:15px;font-weight:500;color:#ffffff;text-decoration:none;border-radius:8px;">
+              Sign in
+            </a>
+          </td></tr></table>
+          <p style="margin:0 0 8px;font-size:13px;color:#78716c;">Or copy and paste this link into your browser:</p>
+          <p style="margin:0 0 24px;font-size:13px;word-break:break-all;">
+            <a href="{{ link_url }}" style="color:#1c1917;">{{ link_url }}</a>
+          </p>
+          <hr style="border:none;border-top:1px solid #e7e5e4;margin:24px 0;">
+          <p style="margin:0;font-size:12px;color:#a8a29e;">
+            If you did not request this email, you can safely ignore it.
+          </p>
+        </td></tr>
+      </table>
+    </td></tr>
+  </table>
+</body>
+</html>
--- a/account/templates/_email/magic_link.txt
+++ b/account/templates/_email/magic_link.txt
@@ -0,0 +1,8 @@
+Hello,
+
+Click this link to sign in:
+{{ link_url }}
+
+This link will expire in 15 minutes.
+
+If you did not request this, you can ignore this email.
--- a/account/templates/_types/auth/_bookings_panel.html
+++ b/account/templates/_types/auth/_bookings_panel.html
@@ -0,0 +1,44 @@
+<div class="w-full max-w-3xl mx-auto px-4 py-6">
+  <div class="bg-white/70 backdrop-blur rounded-2xl shadow border border-stone-200 p-6 sm:p-8 space-y-6">
+
+    <h1 class="text-xl font-semibold tracking-tight">Bookings</h1>
+
+    {% if bookings %}
+      <div class="divide-y divide-stone-100">
+        {% for booking in bookings %}
+          <div class="py-4 first:pt-0 last:pb-0">
+            <div class="flex items-start justify-between gap-4">
+              <div class="min-w-0 flex-1">
+                <p class="text-sm font-medium text-stone-800">{{ booking.name }}</p>
+                <div class="mt-1 flex flex-wrap items-center gap-x-3 gap-y-1 text-xs text-stone-500">
+                  <span>{{ booking.start_at.strftime('%d %b %Y, %H:%M') }}</span>
+                  {% if booking.end_at %}
+                    <span>&ndash; {{ booking.end_at.strftime('%H:%M') }}</span>
+                  {% endif %}
+                  {% if booking.calendar_name %}
+                    <span>&middot; {{ booking.calendar_name }}</span>
+                  {% endif %}
+                  {% if booking.cost %}
+                    <span>&middot; &pound;{{ booking.cost }}</span>
+                  {% endif %}
+                </div>
+              </div>
+              <div class="flex-shrink-0">
+                {% if booking.state == 'confirmed' %}
+                  <span class="inline-flex items-center rounded-full bg-emerald-50 border border-emerald-200 px-2.5 py-0.5 text-xs font-medium text-emerald-700">confirmed</span>
+                {% elif booking.state == 'provisional' %}
+                  <span class="inline-flex items-center rounded-full bg-amber-50 border border-amber-200 px-2.5 py-0.5 text-xs font-medium text-amber-700">provisional</span>
+                {% else %}
+                  <span class="inline-flex items-center rounded-full bg-stone-50 border border-stone-200 px-2.5 py-0.5 text-xs font-medium text-stone-600">{{ booking.state }}</span>
+                {% endif %}
+              </div>
+            </div>
+          </div>
+        {% endfor %}
+      </div>
+    {% else %}
+      <p class="text-sm text-stone-500">No bookings yet.</p>
+    {% endif %}
+
+  </div>
+</div>
--- a/account/templates/_types/auth/_fragment_panel.html
+++ b/account/templates/_types/auth/_fragment_panel.html
@@ -0,0 +1 @@
+{{ page_fragment_html | safe }}
--- a/account/templates/_types/auth/_main_panel.html
+++ b/account/templates/_types/auth/_main_panel.html
@@ -0,0 +1,49 @@
+<div class="w-full max-w-3xl mx-auto px-4 py-6">
+  <div class="bg-white/70 backdrop-blur rounded-2xl shadow border border-stone-200 p-6 sm:p-8 space-y-8">
+
+    {% if error %}
+      <div class="rounded-lg border border-red-200 bg-red-50 text-red-800 px-4 py-3 text-sm">
+        {{ error }}
+      </div>
+    {% endif %}
+
+    {# Account header #}
+    <div class="flex items-center justify-between">
+      <div>
+        <h1 class="text-xl font-semibold tracking-tight">Account</h1>
+        {% if g.user %}
+          <p class="text-sm text-stone-500 mt-1">{{ g.user.email }}</p>
+          {% if g.user.name %}
+            <p class="text-sm text-stone-600">{{ g.user.name }}</p>
+          {% endif %}
+        {% endif %}
+      </div>
+      <form action="/auth/logout/" method="post">
+        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+        <button
+          type="submit"
+          class="inline-flex items-center gap-2 rounded-full border border-stone-300 px-4 py-2 text-sm font-medium text-stone-700 hover:bg-stone-50 transition"
+        >
+          <i class="fa-solid fa-right-from-bracket text-xs"></i>
+          Sign out
+        </button>
+      </form>
+    </div>
+
+    {# Labels #}
+    {% set labels = g.user.labels if g.user is defined and g.user.labels is defined else [] %}
+    {% if labels %}
+      <div>
+        <h2 class="text-base font-semibold tracking-tight mb-3">Labels</h2>
+        <div class="flex flex-wrap gap-2">
+          {% for label in labels %}
+            <span class="inline-flex items-center rounded-full border border-stone-200 px-3 py-1 text-xs font-medium bg-white/60">
+              {{ label.name }}
+            </span>
+          {% endfor %}
+        </div>
+      </div>
+    {% endif %}
+
+  </div>
+</div>
--- a/account/templates/_types/auth/_nav.html
+++ b/account/templates/_types/auth/_nav.html
@@ -0,0 +1,7 @@
+{% import 'macros/links.html' as links %}
+{% call links.link(account_url('/newsletters/'), hx_select_search, select_colours, True, aclass=styles.nav_button) %}
+  newsletters
+{% endcall %}
+{% if account_nav_html %}
+  {{ account_nav_html | safe }}
+{% endif %}
--- a/account/templates/_types/auth/_newsletter_toggle.html
+++ b/account/templates/_types/auth/_newsletter_toggle.html
@@ -0,0 +1,17 @@
+<div id="nl-{{ un.newsletter_id }}" class="flex items-center">
+  <button
+    hx-post="{{ account_url('/newsletter/' ~ un.newsletter_id ~ '/toggle/') }}"
+    hx-headers='{"X-CSRFToken": "{{ csrf_token() }}"}'
+    hx-target="#nl-{{ un.newsletter_id }}"
+    hx-swap="outerHTML"
+    class="relative inline-flex h-6 w-11 items-center rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-emerald-500 focus:ring-offset-2
+      {% if un.subscribed %}bg-emerald-500{% else %}bg-stone-300{% endif %}"
+    role="switch"
+    aria-checked="{{ 'true' if un.subscribed else 'false' }}"
+  >
+    <span
+      class="inline-block h-4 w-4 rounded-full bg-white shadow transform transition-transform
+        {% if un.subscribed %}translate-x-6{% else %}translate-x-1{% endif %}"
+    ></span>
+  </button>
+</div>
--- a/account/templates/_types/auth/_newsletters_panel.html
+++ b/account/templates/_types/auth/_newsletters_panel.html
@@ -0,0 +1,46 @@
+<div class="w-full max-w-3xl mx-auto px-4 py-6">
+  <div class="bg-white/70 backdrop-blur rounded-2xl shadow border border-stone-200 p-6 sm:p-8 space-y-6">
+
+    <h1 class="text-xl font-semibold tracking-tight">Newsletters</h1>
+
+    {% if newsletter_list %}
+      <div class="divide-y divide-stone-100">
+        {% for item in newsletter_list %}
+          <div class="flex items-center justify-between py-4 first:pt-0 last:pb-0">
+            <div class="min-w-0 flex-1">
+              <p class="text-sm font-medium text-stone-800">{{ item.newsletter.name }}</p>
+              {% if item.newsletter.description %}
+                <p class="text-xs text-stone-500 mt-0.5 truncate">{{ item.newsletter.description }}</p>
+              {% endif %}
+            </div>
+            <div class="ml-4 flex-shrink-0">
+              {% if item.un %}
+                {% with un=item.un %}
+                  {% include "_types/auth/_newsletter_toggle.html" %}
+                {% endwith %}
+              {% else %}
+                {# No subscription row yet — show an off toggle that will create one #}
+                <div id="nl-{{ item.newsletter.id }}" class="flex items-center">
+                  <button
+                    hx-post="{{ account_url('/newsletter/' ~ item.newsletter.id ~ '/toggle/') }}"
+                    hx-headers='{"X-CSRFToken": "{{ csrf_token() }}"}'
+                    hx-target="#nl-{{ item.newsletter.id }}"
+                    hx-swap="outerHTML"
+                    class="relative inline-flex h-6 w-11 items-center rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-emerald-500 focus:ring-offset-2 bg-stone-300"
+                    role="switch"
+                    aria-checked="false"
+                  >
+                    <span class="inline-block h-4 w-4 rounded-full bg-white shadow transform transition-transform translate-x-1"></span>
+                  </button>
+                </div>
+              {% endif %}
+            </div>
+          </div>
+        {% endfor %}
+      </div>
+    {% else %}
+      <p class="text-sm text-stone-500">No newsletters available.</p>
+    {% endif %}
+
+  </div>
+</div>
--- a/account/templates/_types/auth/_oob_elements.html
+++ b/account/templates/_types/auth/_oob_elements.html
@@ -0,0 +1,29 @@
+{% extends 'oob_elements.html' %}
+
+{# OOB elements for HTMX navigation - all elements that need updating #}
+
+{# Import shared OOB macros #}
+{% from '_types/root/_oob_menu.html' import mobile_menu with context %}
+
+{# Header with app title - includes cart-mini, navigation, and market-specific header #}
+
+{% block oobs %}
+
+  {% from '_types/root/_n/macros.html' import oob_header with context %}
+  {{oob_header('root-header-child', 'auth-header-child', '_types/auth/header/_header.html')}}
+
+  {% from '_types/root/header/_header.html' import header_row with context %}
+  {{ header_row(oob=True) }}
+{% endblock %}
+
+
+{% block mobile_menu %}
+  {% include '_types/auth/_nav.html' %}
+{% endblock %}
+
+
+{% block content %}
+    {% include oob.main %}
+{% endblock %}
+
+
--- a/account/templates/_types/auth/_tickets_panel.html
+++ b/account/templates/_types/auth/_tickets_panel.html
@@ -0,0 +1,44 @@
+<div class="w-full max-w-3xl mx-auto px-4 py-6">
+  <div class="bg-white/70 backdrop-blur rounded-2xl shadow border border-stone-200 p-6 sm:p-8 space-y-6">
+
+    <h1 class="text-xl font-semibold tracking-tight">Tickets</h1>
+
+    {% if tickets %}
+      <div class="divide-y divide-stone-100">
+        {% for ticket in tickets %}
+          <div class="py-4 first:pt-0 last:pb-0">
+            <div class="flex items-start justify-between gap-4">
+              <div class="min-w-0 flex-1">
+                <a href="{{ events_url('/tickets/' ~ ticket.code ~ '/') }}"
+                   class="text-sm font-medium text-stone-800 hover:text-emerald-700 transition">
+                  {{ ticket.entry_name }}
+                </a>
+                <div class="mt-1 flex flex-wrap items-center gap-x-3 gap-y-1 text-xs text-stone-500">
+                  <span>{{ ticket.entry_start_at.strftime('%d %b %Y, %H:%M') }}</span>
+                  {% if ticket.calendar_name %}
+                    <span>&middot; {{ ticket.calendar_name }}</span>
+                  {% endif %}
+                  {% if ticket.ticket_type_name %}
+                    <span>&middot; {{ ticket.ticket_type_name }}</span>
+                  {% endif %}
+                </div>
+              </div>
+              <div class="flex-shrink-0">
+                {% if ticket.state == 'checked_in' %}
+                  <span class="inline-flex items-center rounded-full bg-blue-50 border border-blue-200 px-2.5 py-0.5 text-xs font-medium text-blue-700">checked in</span>
+                {% elif ticket.state == 'confirmed' %}
+                  <span class="inline-flex items-center rounded-full bg-emerald-50 border border-emerald-200 px-2.5 py-0.5 text-xs font-medium text-emerald-700">confirmed</span>
+                {% else %}
+                  <span class="inline-flex items-center rounded-full bg-amber-50 border border-amber-200 px-2.5 py-0.5 text-xs font-medium text-amber-700">{{ ticket.state }}</span>
+                {% endif %}
+              </div>
+            </div>
+          </div>
+        {% endfor %}
+      </div>
+    {% else %}
+      <p class="text-sm text-stone-500">No tickets yet.</p>
+    {% endif %}
+
+  </div>
+</div>
--- a/account/templates/_types/auth/check_email.html
+++ b/account/templates/_types/auth/check_email.html
@@ -0,0 +1,33 @@
+{% extends "_types/root/index.html" %}
+{% block content %}
+  <div class="w-full max-w-md">
+    <div class="bg-white/70 dark:bg-neutral-900/70 backdrop-blur rounded-2xl shadow p-6 sm:p-8 border border-neutral-200 dark:border-neutral-800">
+      <h1 class="text-2xl font-semibold tracking-tight">Check your email</h1>
+
+      <p class="text-base text-stone-700 dark:text-stone-300 mt-3">
+        If an account exists for
+        <strong class="text-stone-900 dark:text-white">{{ email }}</strong>,
+        you’ll receive a link to sign in. It expires in 15 minutes.
+      </p>
+
+      {% if email_error %}
+        <div
+          class="mt-4 rounded-lg border border-red-300 bg-red-50 text-red-700 text-sm px-3 py-2 flex items-start gap-2"
+          role="alert"
+        >
+          <span class="font-medium">Heads up:</span>
+          <span>{{ email_error }}</span>
+        </div>
+      {% endif %}
+
+      <p class="mt-6 text-sm">
+        <a
+          href="{{ blog_url('/auth/login/') }}"
+          class="text-stone-600 dark:text-stone-300 hover:underline"
+        >
+          ← Back
+        </a>
+      </p>
+    </div>
+  </div>
+{% endblock %}
--- a/account/templates/_types/auth/header/_header.html
+++ b/account/templates/_types/auth/header/_header.html
@@ -0,0 +1,12 @@
+{% import 'macros/links.html' as links %}
+{% macro header_row(oob=False) %}
+  {% call links.menu_row(id='auth-row', oob=oob) %}
+    {% call links.link(account_url('/'), hx_select_search  ) %}
+      <i class="fa-solid fa-user"></i>
+      <div>account</div>
+    {% endcall %}
+    {% call links.desktop_nav() %}    
+     {% include "_types/auth/_nav.html" %}
+    {% endcall %}
+  {% endcall %}
+{% endmacro %}
--- a/account/templates/_types/auth/index
+++ b/account/templates/_types/auth/index
@@ -0,0 +1,18 @@
+{% extends "_types/root/_index.html" %}
+
+
+{% block root_header_child %}
+  {% from '_types/root/_n/macros.html' import index_row with context %}
+  {% call index_row('auth-header-child', '_types/auth/header/_header.html') %}
+    {% block auth_header_child %}
+    {% endblock %}
+  {% endcall %}
+{% endblock %}
+
+{% block _main_mobile_menu %}
+  {% include "_types/auth/_nav.html" %}
+{% endblock %}
+
+{% block content %}
+  {% include '_types/auth/_main_panel.html' %}
+{% endblock %}
--- a/account/templates/_types/auth/index.html
+++ b/account/templates/_types/auth/index.html
@@ -0,0 +1,18 @@
+{% extends oob.extends %}
+
+
+{% block root_header_child %}
+  {% from '_types/root/_n/macros.html' import index_row with context %}
+  {% call index_row(oob.child_id, oob.header) %}
+    {% block auth_header_child %}
+    {% endblock %}
+  {% endcall %}
+{% endblock %}
+
+{% block _main_mobile_menu %}
+  {% include oob.nav %}
+{% endblock %}
+
+{% block content %}
+  {% include oob.main %}
+{% endblock %}
--- a/account/templates/_types/auth/login.html
+++ b/account/templates/_types/auth/login.html
@@ -0,0 +1,46 @@
+{% extends "_types/root/index.html" %}
+{% block content %}
+    <div class="w-full max-w-md">
+      <div class="bg-white/70 dark:bg-neutral-900/70 backdrop-blur rounded-2xl shadow p-6 sm:p-8 border border-neutral-200 dark:border-neutral-800">
+        <h1 class="text-2xl font-semibold tracking-tight">Sign in</h1>
+        <p class="mt-2 text-sm text-neutral-600 dark:text-neutral-400">
+          Enter your email and we’ll email you a one-time sign-in link.
+        </p>
+
+        {% if error %}
+          <div class="mt-4 rounded-lg border border-red-200 bg-red-50 text-red-800 dark:border-red-900/40 dark:bg-red-950/40 dark:text-red-200 px-4 py-3 text-sm">
+            {{ error }}
+          </div>
+        {% endif %}
+
+        <form
+          method="post" action="{{ blog_url('/auth/start/') }}"
+          class="mt-6 space-y-5"
+        >
+          <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+          <div>
+            <label for="email" class="block text-sm font-medium text-neutral-700 dark:text-neutral-300">
+              Email
+            </label>
+            <input
+              type="email"
+              id="email"
+              name="email"
+              value="{{ email or '' }}"
+              required
+              class="mt-2 block w-full rounded-lg border border-neutral-300 dark:border-neutral-700 bg-white dark:bg-neutral-900 px-3 py-2 text-neutral-900 dark:text-neutral-100 shadow-sm focus:outline-none focus:ring-2 focus:ring-offset-0 focus:ring-neutral-900 dark:focus:ring-neutral-200"
+              autocomplete="email"
+              inputmode="email"
+            >
+          </div>
+
+          <button
+            type="submit"
+            class="inline-flex w-full items-center justify-center rounded-lg bg-neutral-900 px-4 py-2.5 text-sm font-medium text-white hover:bg-neutral-800 focus:outline-none focus:ring-2 focus:ring-neutral-900 disabled:opacity-50 dark:bg-neutral-50 dark:text-neutral-900 dark:hover:bg-white"
+          >
+            Send link
+          </button>
+        </form>
+      </div>
+    </div>
+{% endblock %}
--- a/account/templates/auth/check_email.html
+++ b/account/templates/auth/check_email.html
@@ -0,0 +1,19 @@
+{% extends "_types/root/_index.html" %}
+{% block meta %}{% endblock %}
+{% block title %}Check your email — Rose Ash{% endblock %}
+{% block content %}
+<div class="py-8 max-w-md mx-auto text-center">
+  <h1 class="text-2xl font-bold mb-4">Check your email</h1>
+  <p class="text-stone-600 mb-2">
+    We sent a sign-in link to <strong>{{ email }}</strong>.
+  </p>
+  <p class="text-stone-500 text-sm">
+    Click the link in the email to sign in. The link expires in 15 minutes.
+  </p>
+  {% if email_error %}
+    <div class="bg-yellow-50 border border-yellow-200 text-yellow-700 p-3 rounded mt-4">
+      {{ email_error }}
+    </div>
+  {% endif %}
+</div>
+{% endblock %}
--- a/account/templates/auth/login.html
+++ b/account/templates/auth/login.html
@@ -0,0 +1,36 @@
+{% extends "_types/root/_index.html" %}
+{% block meta %}{% endblock %}
+{% block title %}Login — Rose Ash{% endblock %}
+{% block content %}
+<div class="py-8 max-w-md mx-auto">
+  <h1 class="text-2xl font-bold mb-6">Sign in</h1>
+
+  {% if error %}
+    <div class="bg-red-50 border border-red-200 text-red-700 p-3 rounded mb-4">
+      {{ error }}
+    </div>
+  {% endif %}
+
+  <form method="post" action="{{ url_for('auth.start_login') }}" class="space-y-4">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+    <div>
+      <label for="email" class="block text-sm font-medium mb-1">Email address</label>
+      <input
+        type="email"
+        name="email"
+        id="email"
+        value="{{ email | default('') }}"
+        required
+        autofocus
+        class="w-full border border-stone-300 rounded px-3 py-2 focus:outline-none focus:ring-2 focus:ring-stone-500"
+      >
+    </div>
+    <button
+      type="submit"
+      class="w-full bg-stone-800 text-white py-2 px-4 rounded hover:bg-stone-700 transition"
+    >
+      Send magic link
+    </button>
+  </form>
+</div>
+{% endblock %}
--- a/account/templates/fragments/auth_menu.html
+++ b/account/templates/fragments/auth_menu.html
@@ -0,0 +1,36 @@
+{# Desktop auth menu #}
+<span id="auth-menu-desktop" class="hidden md:inline-flex">
+{% if user_email %}
+  <a
+    href="{{ account_url('/') }}"
+    class="justify-center cursor-pointer flex flex-row items-center p-3 gap-2 rounded bg-stone-200 text-black"
+    data-close-details
+  >
+    <i class="fa-solid fa-user"></i>
+    <span>{{ user_email }}</span>
+  </a>
+{% else %}
+  <a
+    href="{{ account_url('/') }}"
+    class="justify-center cursor-pointer flex flex-row items-center p-3 gap-2 rounded bg-stone-200 text-black"
+    data-close-details
+  >
+    <i class="fa-solid fa-key"></i>
+    <span>sign in or register</span>
+  </a>
+{% endif %}
+</span>
+{# Mobile auth menu #}
+<span id="auth-menu-mobile" class="block md:hidden text-md font-bold">
+{% if user_email %}
+  <a href="{{ account_url('/') }}" data-close-details>
+    <i class="fa-solid fa-user"></i>
+    <span>{{ user_email }}</span>
+  </a>
+{% else %}
+  <a href="{{ account_url('/') }}">
+    <i class="fa-solid fa-key"></i>
+    <span>sign in or register</span>
+  </a>
+{% endif %}
+</span>
				`@@ -0,0 +1 @@`
				`from .routes import register as register_fragments`