refactor: review remarks

lib/mv_web/components/layouts.ex

@@ -17,16 +17,24 @@ defmodule MvWeb.Layouts do
   Renders the public (unauthenticated) page layout: header with logo + "Mitgliederverwaltung" left,
   club name centered, language selector right; plus main content and flash group. Use for sign-in, join, and join-confirm pages so they
   share the same chrome without the sidebar or authenticated layout logic.
+
+  Pass optional `:club_name` from the parent (e.g. LiveView mount) to avoid a settings read in the component.
   """
   attr :flash, :map, required: true, doc: "the map of flash messages"
+
+  attr :club_name, :string,
+    default: nil,
+    doc: "optional; if set, avoids get_settings() in the component"
+
   slot :inner_block, required: true
 
   def public_page(assigns) do
     club_name =
-      case Mv.Membership.get_settings() do
-        {:ok, s} -> s.club_name || "Mitgliederverwaltung"
-        _ -> "Mitgliederverwaltung"
-      end
+      assigns[:club_name] ||
+        case Mv.Membership.get_settings() do
+          {:ok, s} -> s.club_name || "Mitgliederverwaltung"
+          _ -> "Mitgliederverwaltung"
+        end
 
     assigns = assign(assigns, :club_name, club_name)
 

lib/mv_web/controllers/join_confirm_controller.ex

@@ -48,15 +48,8 @@ defmodule MvWeb.JoinConfirmController do
   end
 
   defp assign_confirm_assigns(conn, result) do
-    club_name =
-      case Mv.Membership.get_settings() do
-        {:ok, settings} -> settings.club_name || "Mitgliederverwaltung"
-        _ -> "Mitgliederverwaltung"
-      end
-
     conn
     |> assign(:result, result)
-    |> assign(:club_name, club_name)
-    |> assign(:csrf_token, Plug.CSRFProtection.get_csrf_token())
+    |> assign(:flash, conn.assigns[:flash] || conn.flash || %{})
   end
 end

lib/mv_web/controllers/join_confirm_html/confirm.html.heex

@@ -1,24 +1,4 @@
-<%!-- Public header (same structure as Layouts.app unauthenticated branch) --%>
-<header class="flex items-center gap-3 p-4 border-b border-base-300 bg-base-100">
-  <img src={~p"/images/mila.svg"} alt="Mila Logo" class="size-8 shrink-0" />
-  <span class="menu-label text-lg font-bold truncate flex-1">
-    {@club_name}
-  </span>
-  <form method="post" action={~p"/set_locale"} class="shrink-0">
-    <input type="hidden" name="_csrf_token" value={@csrf_token} />
-    <select
-      name="locale"
-      onchange="this.form.submit()"
-      class="select select-sm focus:outline-none focus:ring-2 focus:ring-primary focus:ring-offset-2"
-      aria-label={gettext("Select language")}
-    >
-      <option value="de" selected={Gettext.get_locale() == "de"}>Deutsch</option>
-      <option value="en" selected={Gettext.get_locale() == "en"}>English</option>
-    </select>
-  </form>
-</header>
-
-<main class="px-4 py-8 sm:px-6">
+<Layouts.public_page flash={@flash}>
   <div class="max-w-4xl mx-auto">
     <div class="hero min-h-[60vh] bg-base-200 rounded-lg">
       <div class="hero-content flex-col items-start text-left">
@@ -62,4 +42,4 @@
       </div>
     </div>
   </div>
-</main>
+</Layouts.public_page>

lib/mv_web/join_notifier_impl.ex

@@ -0,0 +1,25 @@
+defmodule MvWeb.JoinNotifierImpl do
+  @moduledoc """
+  Default implementation of Mv.Membership.JoinNotifier that delegates to MvWeb.Emails.
+  """
+  @behaviour Mv.Membership.JoinNotifier
+
+  alias MvWeb.Emails.JoinAlreadyMemberEmail
+  alias MvWeb.Emails.JoinAlreadyPendingEmail
+  alias MvWeb.Emails.JoinConfirmationEmail
+
+  @impl true
+  def send_confirmation(email, token, opts \\ []) do
+    JoinConfirmationEmail.send(email, token, opts)
+  end
+
+  @impl true
+  def send_already_member(email) do
+    JoinAlreadyMemberEmail.send(email)
+  end
+
+  @impl true
+  def send_already_pending(email) do
+    JoinAlreadyPendingEmail.send(email)
+  end
+end

lib/mv_web/live/join_live.ex

@@ -12,12 +12,22 @@ defmodule MvWeb.JoinLive do
   # Honeypot field name (legitimate-sounding to avoid bot detection)
   @honeypot_field "website"
 
+  # Anti-enumeration: delay before showing success (ms). Applied in LiveView so the process is not blocked.
+  @anti_enumeration_delay_ms_min 100
+  @anti_enumeration_delay_ms_rand 200
+
   @impl true
   def mount(_params, _session, socket) do
     allowlist = Membership.get_join_form_allowlist()
     join_fields = build_join_fields_with_labels(allowlist)
     client_ip = client_ip_from_socket(socket)
 
+    club_name =
+      case Membership.get_settings() do
+        {:ok, s} -> s.club_name || "Mitgliederverwaltung"
+        _ -> "Mitgliederverwaltung"
+      end
+
     socket =
       socket
       |> assign(:join_fields, join_fields)
@@ -25,6 +35,7 @@ defmodule MvWeb.JoinLive do
       |> assign(:rate_limit_error, nil)
       |> assign(:client_ip, client_ip)
       |> assign(:honeypot_field, @honeypot_field)
+      |> assign(:club_name, club_name)
       |> assign(:form, to_form(initial_form_params(join_fields)))
 
     {:ok, socket}
@@ -33,7 +44,7 @@ defmodule MvWeb.JoinLive do
   @impl true
   def render(assigns) do
     ~H"""
-    <Layouts.public_page flash={@flash}>
+    <Layouts.public_page flash={@flash} club_name={@club_name}>
       <div class="max-w-4xl mx-auto">
         <div class="hero min-h-[60vh] bg-base-200 rounded-lg">
           <div class="hero-content flex-col items-start text-left">
@@ -149,7 +160,11 @@ defmodule MvWeb.JoinLive do
       {:ok, attrs} ->
         case Membership.submit_join_request(attrs, actor: nil) do
           {:ok, _} ->
-            {:noreply, assign(socket, :submitted, true)}
+            delay_ms =
+              @anti_enumeration_delay_ms_min + :rand.uniform(@anti_enumeration_delay_ms_rand)
+
+            Process.send_after(self(), :show_join_success, delay_ms)
+            {:noreply, socket}
 
           {:error, :email_delivery_failed} ->
             {:noreply,
@@ -181,6 +196,16 @@ defmodule MvWeb.JoinLive do
      |> assign(:form, to_form(params, as: "join"))}
   end
 
+  @impl true
+  def handle_info(:show_join_success, socket) do
+    {:noreply, assign(socket, :submitted, true)}
+  end
+
+  # Swoosh (e.g. in test) may send {:email, email} to the LiveView process; ignore.
+  def handle_info(_msg, socket) do
+    {:noreply, socket}
+  end
+
   defp rate_limited_reply(socket, params) do
     {:noreply,
      socket