edited230126

app/routes/admin.py

@@ -38,8 +38,7 @@ def _try_delete_upload(file_path: str | None, upload_folder: str):
 def dashboard():
     admin_required()
     companies = Company.query.order_by(Company.name.asc()).all()
-    users = User.query.order_by(User.username.asc()).all()
-    return render_template("admin/dashboard.html", companies=companies, users=users)
+    return render_template("admin/dashboard.html", companies=companies)
 
 
 @bp.post("/companies")
@@ -77,22 +76,19 @@ def create_company_user(company_id: int):
     company = db.session.get(Company, company_id)
     if not company:
         abort(404)
-    username = request.form.get("username", "").strip()
     email = (request.form.get("email", "") or "").strip().lower() or None
     password = request.form.get("password", "")
-    if not username or not email or not password:
-        flash("Username, email and password required", "danger")
-        return redirect(url_for("admin.company_detail", company_id=company_id))
-    if User.query.filter_by(username=username).first():
-        flash("Username already exists", "danger")
+    if not email or not password:
+        flash("Email and password required", "danger")
         return redirect(url_for("admin.company_detail", company_id=company_id))
 
     if User.query.filter_by(email=email).first():
         flash("Email already exists", "danger")
         return redirect(url_for("admin.company_detail", company_id=company_id))
 
-    u = User(username=username, is_admin=False, company=company)
+    u = User(is_admin=False, company=company)
     u.email = email
+    u.username = email
     u.set_password(password)
     db.session.add(u)
     db.session.commit()
@@ -167,7 +163,7 @@ def impersonate(user_id: int):
     # Save admin id in session so we can return without any password.
     session["impersonator_admin_id"] = current_user.id
     login_user(target)
-    flash(f"Impersonating {target.username}.", "warning")
+    flash(f"Impersonating {target.email or '(no email)'}.", "warning")
     return redirect(url_for("company.dashboard"))
 
 
@@ -179,14 +175,40 @@ def update_user_email(user_id: int):
     if not u:
         abort(404)
 
-    email = (request.form.get("email", "") or "").strip().lower() or None
-    if email:
-        existing = User.query.filter(User.email == email, User.id != u.id).first()
-        if existing:
-            flash("Email already exists", "danger")
-            return redirect(url_for("admin.company_detail", company_id=u.company_id))
+    email = (request.form.get("email", "") or "").strip().lower()
+    if not email:
+        flash("Email is required", "danger")
+        return redirect(url_for("admin.company_detail", company_id=u.company_id))
+
+    existing = User.query.filter(User.email == email, User.id != u.id).first()
+    if existing:
+        flash("Email already exists", "danger")
+        return redirect(url_for("admin.company_detail", company_id=u.company_id))
 
     u.email = email
+    # keep backwards-compatible username column in sync
+    u.username = email
     db.session.commit()
     flash("Email updated", "success")
     return redirect(url_for("admin.company_detail", company_id=u.company_id))
+
+
+@bp.post("/displays/<int:display_id>/name")
+@login_required
+def update_display_name(display_id: int):
+    """Admin: rename a display."""
+    admin_required()
+
+    display = db.session.get(Display, display_id)
+    if not display:
+        abort(404)
+
+    name = (request.form.get("name") or "").strip()
+    if not name:
+        flash("Display name is required", "danger")
+        return redirect(url_for("admin.company_detail", company_id=display.company_id))
+
+    display.name = name[:120]
+    db.session.commit()
+    flash("Display name updated", "success")
+    return redirect(url_for("admin.company_detail", company_id=display.company_id))