feat: public events/polls, friends graph, captcha, SSE hardening, and admin UX

Ship product gaps: register/vote pages, friend add/accept/decline/remove, email verify TTL, captcha on login/forgot, soft-fail user actions, SSE abort/shared client, Commando Centrum error toasts, admin delete for events/polls, and IT/NL i18n fills.

Co-authored-by: Cursor <[email protected]>

src/app/(site)/friends/loading.tsx

@@ -0,0 +1,15 @@
+export default function FriendsLoading() {
+	return (
+		<div
+			style={{ display: "flex", justifyContent: "center", padding: "4rem 0" }}
+		>
+			<div
+				className="animate-spin w-8 h-8 border-4 rounded-full"
+				style={{
+					borderColor: "var(--color-primary)",
+					borderTopColor: "transparent",
+				}}
+			/>
+		</div>
+	);
+}

src/app/(site)/friends/page.tsx

@@ -1,6 +1,8 @@
 import Link from "next/link";
 import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
+import type { CSSProperties } from "react";
+import { removeFriendship } from "@/actions/messenger";
 import { ContentCard, EmptyState, OnlineBadge } from "@/components/public/ui";
 import { auth } from "@/lib/auth";
 import { avatarImageUrl } from "@/lib/format";
@@ -11,16 +13,38 @@ export const dynamic = "force-dynamic";
 
 export const metadata = { title: "Friends" };
 
-export default async function FriendsPage() {
+type SearchParams = Promise<{ removed?: string; error?: string }>;
+
+function feedbackStyle(tone: "success" | "error"): CSSProperties {
+	const accent =
+		tone === "error" ? "var(--color-danger)" : "var(--color-primary)";
+	return {
+		margin: 0,
+		padding: "0.85rem 1rem",
+		borderRadius: "var(--radius-md)",
+		border: `1px solid ${accent}`,
+		color: "var(--color-text-readable, var(--color-text))",
+		fontSize: "0.9rem",
+		fontWeight: 600,
+		background: "var(--color-surface)",
+		borderLeft: `4px solid ${accent}`,
+	};
+}
+
+export default async function FriendsPage({
+	searchParams,
+}: {
+	searchParams: SearchParams;
+}) {
 	const t = await getTranslations("pages.friends");
 	const session = await auth();
 	if (!session?.user?.id) redirect("/login");
 
 	const userId = Number(session.user.id);
+	const { removed, error } = await searchParams;
 
-	// Friendships are bidirectional and stored once: the session user can appear
-	// as either user_one_id or user_two_id, with the *other* column being the
-	// friend. Read both directions, then dedupe the friend ids.
+	// Friendships are stored as TWO directional rows (user_one_id→user_two_id
+	// and the reverse). Read both directions, then dedupe the friend ids.
 	const friendships = await prisma.messengerFriendships
 		.findMany({
 			where: {
@@ -60,8 +84,28 @@ export default async function FriendsPage() {
 		),
 	]);
 
+	const errorMessage =
+		error === "not_found"
+			? t("errors.notFound")
+			: error === "invalid"
+				? t("errors.invalid")
+				: error
+					? t("errors.error")
+					: null;
+
 	return (
 		<main style={{ display: "grid", gap: "1.5rem" }}>
+			{removed === "1" ? (
+				<div role="status" style={feedbackStyle("success")}>
+					{t("success.removed")}
+				</div>
+			) : null}
+			{errorMessage ? (
+				<div role="alert" style={feedbackStyle("error")}>
+					{errorMessage}
+				</div>
+			) : null}
+
 			<ContentCard
 				icon="🤝"
 				title={t("title")}
@@ -120,6 +164,16 @@ export default async function FriendsPage() {
 										</p>
 										<OnlineBadge online={isOnline} />
 									</div>
+									<form action={removeFriendship}>
+										<input
+											type="hidden"
+											name="friendId"
+											value={String(friend.id)}
+										/>
+										<button type="submit" className="btn">
+											{t("remove")}
+										</button>
+									</form>
 								</div>
 							);
 						})}