Add reviewed duplicate account consolidation and prevent duplicate imports

frontend/app/admin/identities/DuplicateAccountRepair.tsx

@@ -0,0 +1,74 @@
+'use client'
+
+import { useEffect, useRef, useState } from 'react'
+import { authFetch, getApiBase } from '../../lib/auth'
+import { FEATURES, type FeatureAccess } from '../../lib/features'
+import type { Row } from './IdentityReviewPanel'
+
+type Account = { id: number; username: string; email: string | null; profile_id: number | null; last_login_at: string | null }
+type Preview = {
+  accounts: Account[]; keep_id: number; recommended_id: number; revision: string; can_confirm: boolean; issues: string[]
+  proposed: Account & { jellyfin_user_id: string; seerr_user_id: number; features: FeatureAccess; expires_at: string | null; is_blocked: boolean; auto_search_enabled: boolean }
+}
+
+export default function DuplicateAccountRepair({ row, onClose, onSaved }: { row: Row; onClose: () => void; onSaved: () => void }) {
+  const dialog = useRef<HTMLDialogElement>(null)
+  const controller = useRef<AbortController | null>(null)
+  const [preview, setPreview] = useState<Preview | null>(null)
+  const [busy, setBusy] = useState(false)
+  const [saving, setSaving] = useState(false)
+  const [acknowledged, setAcknowledged] = useState(false)
+  const [error, setError] = useState('')
+  const submit = async (confirm = false, keepId?: number) => {
+    const abort = new AbortController()
+    controller.current?.abort(); controller.current = abort
+    setError(''); setAcknowledged(false)
+    if (confirm) setSaving(true)
+    else setBusy(true)
+    try {
+      const response = await authFetch(`${getApiBase()}/admin/identities/duplicates/${confirm ? 'confirm' : 'check'}`, {
+        method: 'POST', signal: abort.signal, headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ user_id: row.user.id, ...(keepId ? { keep_id: keepId } : {}), ...(confirm ? { keep_id: preview?.keep_id, revision: preview?.revision } : {}) }),
+      })
+      const data = await response.json()
+      if (!response.ok) throw new Error(typeof data.detail === 'string' ? data.detail : 'Could not review these accounts.')
+      if (!abort.signal.aborted) { if (confirm) onSaved(); else setPreview(data) }
+    } catch (err) { if (!abort.signal.aborted) { setError(err instanceof Error ? err.message : 'Repair failed. Preview again.'); setPreview(null) } }
+    finally { if (!abort.signal.aborted) { setBusy(false); setSaving(false) } }
+  }
+  useEffect(() => {
+    const previous = document.activeElement as HTMLElement | null
+    const overflow = document.body.style.overflow
+    document.body.style.overflow = 'hidden'; dialog.current?.showModal()
+    void submit()
+    return () => { controller.current?.abort(); document.body.style.overflow = overflow; previous?.focus() }
+  }, [])
+  return <dialog ref={dialog} className="identity-resolve-dialog" aria-labelledby="duplicates-title" onCancel={(event) => { event.preventDefault(); if (!saving) onClose() }}>
+    <div className="identity-resolve-content">
+      <header><h2 id="duplicates-title">Repair duplicate accounts</h2><button type="button" className="ghost-button" disabled={saving} onClick={onClose}>Close</button></header>
+      <p>Review the Magent accounts for <strong>{row.user.username}</strong>. This repair keeps one account linked to the verified Jellyfin identity.</p>
+      {busy && <p role="status">Checking live service IDs and duplicate ownership...</p>}
+      {error && <p className="error-banner" role="alert">{error}</p>}
+      {!preview && !busy && <button type="button" disabled={saving} onClick={() => void submit()}>Check again</button>}
+      {preview && <section className="identity-confirm-panel" aria-label="Duplicate repair preview">
+        <label>Magent account to keep<select disabled={busy || saving} value={preview.keep_id} onChange={(event) => void submit(false, Number(event.target.value))}>
+          {preview.accounts.map((account) => <option key={account.id} value={account.id}>{account.username} — Magent {account.id}{account.id === preview.recommended_id ? ' (recommended)' : ''}</option>)}
+        </select></label>
+        <p>The recommended row already owns the Jellyfin link, or is the oldest row when neither owns it.</p>
+        <div className="identity-mapping">{preview.accounts.map((account) => <div key={account.id}><strong>Magent {account.id}{account.id === preview.keep_id ? ' · Keep' : ' · Consolidate'}</strong><p>{account.username}</p><p>{account.email || 'No email'} · Profile {account.profile_id ?? 'None'}</p><p>Last login: {account.last_login_at ? new Date(account.last_login_at).toLocaleString() : 'Never'}</p></div>)}</div>
+        <h3>Resulting account</h3>
+        <p><strong>{preview.proposed.username}</strong> · Magent {preview.keep_id} · Seerr {preview.proposed.seerr_user_id ?? 'Not verified'}</p>
+        <p>Jellyfin / Jellystat: <code>{preview.proposed.jellyfin_user_id ?? 'Not verified'}</code></p>
+        <p>Email: {preview.proposed.email || 'None'} · Profile: {preview.proposed.profile_id ?? 'None'}</p>
+        <p>Access: {preview.proposed.is_blocked ? 'Blocked' : 'Not blocked'} · Expiry: {preview.proposed.expires_at ? new Date(preview.proposed.expires_at).toLocaleString() : 'None'} · Automatic search: {preview.proposed.auto_search_enabled ? 'Enabled' : 'Disabled'}</p>
+        <ul>{FEATURES.map((feature) => <li key={feature.key}>{feature.label}: {preview.proposed.features[feature.key] ? 'Enabled' : 'Disabled'}</li>)}</ul>
+        <p>Request, issue, invitation and login activity history is retained. The selected account keeps its email and profile. Any block, earlier expiry or disabled permission on either row is preserved.</p>
+        <p>Extra Magent rows are removed from the active directory after their details are archived. Their outstanding emails are cancelled and their email subscriptions are not inherited. The kept account retains its own subscriptions where still eligible. Password reset links must be requested again.</p>
+        <p>Jellyfin, Seerr and Jellystat accounts and media are unchanged. This action does not merge different Jellyfin identities or delete upstream users.</p>
+        {preview.issues.length > 0 && <ul className="identity-issues">{preview.issues.map((issue) => <li key={issue}>{issue}</li>)}</ul>}
+        <label className="identity-import-option"><span><input type="checkbox" checked={acknowledged} disabled={busy || saving || !preview.can_confirm} onChange={(event) => setAcknowledged(event.target.checked)} /> I confirm these rows belong to the same person and have reviewed the account to keep.</span></label>
+        <button type="button" disabled={!preview.can_confirm || !acknowledged || busy || saving} onClick={() => void submit(true)}>{saving ? 'Rechecking and repairing...' : 'Confirm duplicate repair'}</button>
+      </section>}
+    </div>
+  </dialog>
+}

frontend/app/admin/identities/IdentityReviewPanel.tsx

@@ -4,6 +4,7 @@ import { useEffect, useRef, useState } from 'react'
 import { useRouter } from 'next/navigation'
 import { authFetch, getApiBase } from '../../lib/auth'
 import './identities.css'
+import DuplicateAccountRepair from './DuplicateAccountRepair'
 import ResolveIdentityLink from './ResolveIdentityLink'
 
 type Identity = { id: string; name: string }
@@ -44,12 +45,14 @@ export default function IdentityReviewPanel() {
   const [query, setQuery] = useState('')
   const [filter, setFilter] = useState('all')
   const [selected, setSelected] = useState<number[]>([])
+  const [duplicates, setDuplicates] = useState<Row | null>(null)
   const [resolving, setResolving] = useState<Row | null>(null)
   const [reviewing, setReviewing] = useState(false)
   const controller = useRef<AbortController | null>(null)
   const reviewPanel = useRef<HTMLElement | null>(null)
 
   useEffect(() => {
+    setQuery(new URLSearchParams(window.location.search).get('user') ?? '')
     const abort = new AbortController()
     void authFetch(`${getApiBase()}/auth/me`, { signal: abort.signal }).then(async (response) => {
       if (response.status === 401) { router.replace('/login'); return }
@@ -150,7 +153,7 @@ export default function IdentityReviewPanel() {
                 <div><dt>Jellystat user ID</dt><dd><code>{row.jellystat.id ?? 'Not verified'}</code><span>{statsLabels[row.jellystat.state] ?? row.jellystat.state}</span></dd></div>
               </dl>
               {row.issues.length > 0 && <ul className="identity-issues">{row.issues.map((issue) => <li key={issue}>{issue}</li>)}</ul>}
-              {(row.state === 'unlinked' || row.state === 'conflict') && <div className="identity-resolution-entry"><p className="identity-meta">Compare the correct Jellyfin identity with the stored links and review the smallest safe repair.</p><button type="button" className="ghost-button" disabled={saving || report.services.jellyfin !== 'available'} onClick={() => setResolving(row)}>Review repair</button></div>}
+              {(row.state === 'unlinked' || row.state === 'conflict') && <div className="identity-resolution-entry"><p className="identity-meta">Compare the correct Jellyfin identity with the stored links and review the smallest safe repair.</p><button type="button" className="ghost-button" disabled={saving || report.services.jellyfin !== 'available'} onClick={() => setResolving(row)}>Review repair</button>{row.issues.some((issue) => issue.includes("share this username")) && <button type="button" className="ghost-button" disabled={saving} onClick={() => setDuplicates(row)}>Repair duplicate accounts</button>}</div>}
               {row.state === 'unavailable' && <p className="identity-meta">A required service could not be checked. Check its connection and run this again.</p>}
               {row.confirmed_at && <p className="identity-meta">Last confirmed {new Date(row.confirmed_at).toLocaleString()}</p>}
             </article>)}
@@ -158,6 +161,7 @@ export default function IdentityReviewPanel() {
           {report.upstream.length > 0 && <details className="identity-upstream"><summary>{report.upstream.length} upstream accounts need review</summary><ul>{report.upstream.map((entry) => <li key={`${entry.platform}-${entry.id}`}><strong>{entry.platform}: {entry.name}</strong> · ID <code>{entry.id}</code>{entry.jellyfin_id && <span> · Jellyfin <code>{entry.jellyfin_id}</code></span>}<p>{entry.detail}</p></li>)}</ul></details>}
         </>}
       </>}
+      {duplicates && <DuplicateAccountRepair row={duplicates} onClose={() => setDuplicates(null)} onSaved={() => { setDuplicates(null); void runCheck().then(() => setNotice('Duplicate accounts repaired. History retained and links rechecked.')) }} />}
       {resolving && report && <ResolveIdentityLink row={resolving} accounts={report.jellyfin_users} onClose={() => setResolving(null)} onSaved={() => {
         setResolving(null); setReport(null); setSelected([]); setReviewing(false)
         setNotice('Account links repaired and saved. Run another check to see the updated mappings.')

frontend/app/users/[id]/page.tsx

@@ -587,6 +587,7 @@ export default function UserDetailPage() {
                 <header className="user-management-heading"><div><h2 id="manage-this-user-title">Manage {user.username}</h2><p>Feature access, account settings and account restrictions.</p></div><button type="button" className="ghost-button" onClick={() => setManageOpen(false)}>Close</button></header>
                 {error && <p className="error-banner" role="alert">{error}</p>}
                 {actionStatus && <p className="status-banner" role="status">{actionStatus}</p>}
+                <p><a className="ghost-button" href={`/users?view=identities&user=${encodeURIComponent(user.username)}`}>Review service links &amp; duplicate accounts</a></p>
                 {manageOpen && <FeatureControls key={user.role} username={user.username} onSaved={() => void loadUser()} />}
                 <div className="user-management-grid">
               <div className="admin-panel user-detail-panel">