From 9ed576a029d56b5d7b2ac48eb7ea5ae9c95ccd6f Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Thu, 7 May 2026 17:48:44 -0400
Subject: [PATCH] fix(ci): pgconn import path + reset-password token type +
 SMTP label
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three CI fixes from the U1+U2+U3 push:

- internal/api/admin_users.go imported the standalone
  github.com/jackc/pgconn — that module isn't in go.sum and
  go vet caught it. Switch to github.com/jackc/pgx/v5/pgconn
  (the path used elsewhere in the package, e.g. auth_register.go
  and me_profile.go).

- /reset-password/[token] dereferenced page.params.token without
  the undefined narrowing svelte-kit's typegen requires. Coalesce
  to '' on read and reject empty token at submit time with a
  clear error.

- /admin/integrations SMTP card had a label without an associated
  control as the TLS row's leading column header. Switched to a
  span — the actual checkbox lives in the wrapping label below it.
---
 internal/api/admin_users.go                        | 2 +-
 web/src/routes/admin/integrations/+page.svelte     | 2 +-
 web/src/routes/reset-password/[token]/+page.svelte | 6 +++++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/internal/api/admin_users.go b/internal/api/admin_users.go
index 7d5e6b64..491f08cb 100644
--- a/internal/api/admin_users.go
+++ b/internal/api/admin_users.go
@@ -7,9 +7,9 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/jackc/pgconn"
 	"github.com/jackc/pgerrcode"
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"golang.org/x/crypto/bcrypt"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/audit"
diff --git a/web/src/routes/admin/integrations/+page.svelte b/web/src/routes/admin/integrations/+page.svelte
index 8ef6d5e1..2796eb0d 100644
--- a/web/src/routes/admin/integrations/+page.svelte
+++ b/web/src/routes/admin/integrations/+page.svelte
@@ -594,7 +594,7 @@
       <input id="smtp-from-name" type="text" bind:value={smtpForm.from_name}
              class="mt-1 w-full rounded-md border border-border bg-background px-3 py-2 font-mono text-sm text-text-primary placeholder:text-text-muted focus:outline-none focus:ring-2 focus:ring-accent" />
 
-      <label class="text-sm text-text-secondary">TLS</label>
+      <span class="text-sm text-text-secondary">TLS</span>
       <label class="flex items-center gap-2 text-sm">
         <input type="checkbox" bind:checked={smtpForm.use_tls} />
         Use STARTTLS
diff --git a/web/src/routes/reset-password/[token]/+page.svelte b/web/src/routes/reset-password/[token]/+page.svelte
index 2854e3ed..6e62f8d2 100644
--- a/web/src/routes/reset-password/[token]/+page.svelte
+++ b/web/src/routes/reset-password/[token]/+page.svelte
@@ -9,11 +9,15 @@
   let submitting = $state(false);
   let error = $state<string | null>(null);
 
-  const token = $derived(page.params.token);
+  const token = $derived(page.params.token ?? '');
 
   async function onSubmit(e: SubmitEvent) {
     e.preventDefault();
     error = null;
+    if (!token) {
+      error = 'This reset link is invalid. Request a new one.';
+      return;
+    }
     if (newPassword !== confirmPassword) {
       error = 'Passwords do not match.';
       return;