v0.4.8 — capacity enforcement, branding upload, and admin UX

[0.4.8] - 2026-07-01

Fixed

• Event capacity: pass restore (status: registered) respects capacity limits; manual create and import share an advisory lock to prevent concurrent over-capacity writes
• PATCH reactivation from cancelled or revoked to registered enforces capacity the same way as manual create
• Event overview attendee_count excludes revoked attendees (aligned with capacity enforcement)
• Event overview admitted_count uses the same active scope as attendee_count (excludes revoked/cancelled)
• Event capacity counts exclude cancelled as well as revoked passes
• CSV import capacity override (?force=1) records forced: true in attendees_imported audit metadata
• Import overwrite-only commits allowed when toCreate === 0 even if event is already over capacity
• Event overview email card surfaces email_bounced separately from failed deliveries
• Branding upload validates magic bytes and uses async filesystem I/O

Added

• Admin: logo upload zone in setup wizard (server upload or external HTTPS URL)
• Admin: bounce alert on Communication page with link to delivery log
• Backend: saveEventUpload helper for event-scoped branding paths (/uploads/{orgId}/events/{eventId}/…; no HTTP endpoint yet)
• Branding save accepts validated /uploads/… logo paths in addition to HTTPS URLs
• Email template render absolutizes /uploads/… branding assets using BASE_URL (required for logo in outbound mail)
• Admin: revoke and restore pass on attendee detail (PATCH status, capacity-aware restore)
• Admin: CSV import shows event_full capacity banner; superadmin can override with force commit
• Admin: TOTP enrollment QR code on Account page
• Admin: device label pre-filled from browser user agent
• Admin: sidebar pin/unpin (desktop), lifecycle nav labels (Passes, Post-event), Administration section
• Event capacity enforcement on manual attendee create and CSV import commit: returns 409 event_full when the limit would be exceeded; instance superadmin may override with ?force=1 (audited)
• PATCH /api/admin/events/:eventId/attendees/:id supports status: registered | revoked with pass_revoked / pass_restored attendee action log entries
• Local branding upload API: POST /api/admin/uploads (PNG/JPG/WebP, max 2 MB, superadmin-only) and GET /uploads/* static serve; Docker Compose volume for ./uploads
• Event overview: separate email_bounced count distinct from email_failed (failed + rejected only)
• Attendee status revoked in database (migration) — revoked passes are not admittable at check-in

---

Deploy

• Container image: ghcr.io/solarssk/admitto:0.4.8 (rolling :0.4)
• Migrations apply automatically on container start (with pre-migration backup when pending). No manual migrate deploy.

Full changelog