test(nav): add ThemeToggle spec covering label derivation in both modes

Covers the concern raised during PR review: themeLabel $derived logic
had no tests. Adds 4 tests — aria-label and title=aria-label assertions
in light mode and dark mode — mirroring the NotificationBell pattern.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main/java/org/raddatz/familienarchiv/service/UserService.java

@@ -80,6 +80,34 @@ public class UserService {
         return saved;
     }
 
+    @Transactional
+    public AppUser createUserForBootstrap(CreateUserRequest request) {
+        log.info("Bootstrap user creation (no audit): {}", request.getEmail());
+
+        Set<UserGroup> groups = new HashSet<>();
+        if (request.getGroupIds() != null && !request.getGroupIds().isEmpty()) {
+            groups.addAll(groupRepository.findAllById(request.getGroupIds()));
+        }
+
+        Optional<AppUser> existingUser = userRepository.findByEmail(request.getEmail());
+        if (existingUser.isPresent()) {
+            AppUser updated = existingUser.get().updateFromRequest(request, passwordEncoder, groups);
+            return userRepository.save(updated);
+        }
+
+        AppUser user = AppUser.builder()
+                .email(request.getEmail())
+                .password(passwordEncoder.encode(request.getInitialPassword()))
+                .groups(groups)
+                .firstName(request.getFirstName())
+                .lastName(request.getLastName())
+                .birthDate(request.getBirthDate())
+                .contact(request.getContact())
+                .enabled(true)
+                .build();
+        return userRepository.save(user);
+    }
+
     @Transactional
     public AppUser createUser(String email, String rawPassword, String firstName, String lastName, Set<UUID> groupIds) {
         userRepository.findByEmail(email).ifPresent(existing -> {

backend/src/test/java/org/raddatz/familienarchiv/audit/UserManagementAuditIntegrationTest.java

@@ -45,18 +45,13 @@ class UserManagementAuditIntegrationTest {
 
     @Test
     void createAndDeleteUser_producesOrderedAuditEntries() {
-        // Create the actor (admin) user directly — bypasses audit logging so no FK issue
+        // Bootstrap actor with no audit event — clean slate guaranteed by @BeforeEach
         CreateUserRequest adminReq = new CreateUserRequest();
         adminReq.setEmail("admin@test.example.com");
         adminReq.setInitialPassword("admin-secret");
-        AppUser actor = transactionTemplate.execute(status ->
-                userService.createUserOrUpdate(null, adminReq));
+        AppUser actor = transactionTemplate.execute(status -> userService.createUserForBootstrap(adminReq));
         UUID actorId = actor.getId();
 
-        // The admin creation is logged with null actorId — clear to start with a clean slate
-        await().atMost(5, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_CREATED));
-        transactionTemplate.execute(status -> { auditLogRepository.deleteAll(); return null; });
-
         // Create the target user — should emit USER_CREATED
         CreateUserRequest req = new CreateUserRequest();
         req.setEmail("audit-test@example.com");
@@ -65,7 +60,7 @@ class UserManagementAuditIntegrationTest {
             userService.createUserOrUpdate(actorId, req);
             return null;
         });
-        await().atMost(5, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_CREATED));
+        await().atMost(10, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_CREATED));
 
         // Delete the target user — should emit USER_DELETED
         AppUser created = userRepository.findByEmail("audit-test@example.com").orElseThrow();
@@ -73,7 +68,7 @@ class UserManagementAuditIntegrationTest {
             userService.deleteUser(actorId, created.getId());
             return null;
         });
-        await().atMost(5, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_DELETED));
+        await().atMost(10, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_DELETED));
 
         List<AuditLog> events = auditLogQueryService.findRecentUserManagementEvents(10);
         assertThat(events).hasSize(2);
@@ -83,27 +78,24 @@ class UserManagementAuditIntegrationTest {
 
     @Test
     void updateUserGroups_producesGroupMembershipChangedEvent() {
-        // Create groups before creating users — required for group assignment on creation
         GroupDTO groupADto = new GroupDTO(); groupADto.setName("Viewers"); groupADto.setPermissions(Set.of("READ_ALL"));
         GroupDTO groupBDto = new GroupDTO(); groupBDto.setName("Editors"); groupBDto.setPermissions(Set.of("WRITE_ALL"));
         UserGroup gA = transactionTemplate.execute(status -> userService.createGroup(groupADto));
         UserGroup gB = transactionTemplate.execute(status -> userService.createGroup(groupBDto));
 
-        // Create actor (bootstrap — null actorId, event not relevant)
+        // Bootstrap actor with no audit event — clean slate guaranteed by @BeforeEach
         CreateUserRequest actorReq = new CreateUserRequest();
         actorReq.setEmail("actor-group-test@test.example.com");
         actorReq.setInitialPassword("secret");
-        AppUser actor = transactionTemplate.execute(status -> userService.createUserOrUpdate(null, actorReq));
-        await().atMost(5, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_CREATED));
-        transactionTemplate.execute(status -> { auditLogRepository.deleteAll(); return null; });
+        AppUser actor = transactionTemplate.execute(status -> userService.createUserForBootstrap(actorReq));
 
-        // Create target user pre-assigned to gA
+        // Create target user pre-assigned to gA — emits USER_CREATED
         CreateUserRequest targetReq = new CreateUserRequest();
         targetReq.setEmail("target-group-test@test.example.com");
         targetReq.setInitialPassword("secret");
         targetReq.setGroupIds(List.of(gA.getId()));
         transactionTemplate.execute(status -> userService.createUserOrUpdate(actor.getId(), targetReq));
-        await().atMost(5, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_CREATED));
+        await().atMost(10, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_CREATED));
         transactionTemplate.execute(status -> { auditLogRepository.deleteAll(); return null; });
 
         AppUser target = userRepository.findByEmail("target-group-test@test.example.com").orElseThrow();
@@ -113,7 +105,7 @@ class UserManagementAuditIntegrationTest {
         dto.setGroupIds(List.of(gB.getId()));
         transactionTemplate.execute(status -> userService.adminUpdateUser(actor.getId(), target.getId(), dto));
 
-        await().atMost(5, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.GROUP_MEMBERSHIP_CHANGED));
+        await().atMost(10, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.GROUP_MEMBERSHIP_CHANGED));
 
         List<AuditLog> events = auditLogQueryService.findRecentUserManagementEvents(10);
         assertThat(events).hasSize(1);

backend/src/test/java/org/raddatz/familienarchiv/controller/UserControllerTest.java

@@ -133,4 +133,28 @@ class UserControllerTest {
         mockMvc.perform(delete("/api/users/" + UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
+
+    // ─── unauthenticated access ───────────────────────────────────────────────
+
+    @Test
+    void createUser_returns401_whenUnauthenticated() throws Exception {
+        mockMvc.perform(post("/api/users")
+                        .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                        .content("{\"email\":\"x@x.com\",\"initialPassword\":\"secret123\"}"))
+                .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void adminUpdateUser_returns401_whenUnauthenticated() throws Exception {
+        mockMvc.perform(put("/api/users/" + UUID.randomUUID())
+                        .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                        .content("{}"))
+                .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void deleteUser_returns401_whenUnauthenticated() throws Exception {
+        mockMvc.perform(delete("/api/users/" + UUID.randomUUID()))
+                .andExpect(status().isUnauthorized());
+    }
 }

backend/src/test/java/org/raddatz/familienarchiv/service/UserServiceTest.java

@@ -837,6 +837,26 @@ class UserServiceTest {
         verify(auditService, never()).logAfterCommit(any(), any(), any(), any());
     }
 
+    // ─── createUserForBootstrap ───────────────────────────────────────────────
+
+    @Test
+    void createUserForBootstrap_createsUserWithoutAuditEvent() {
+        CreateUserRequest req = new CreateUserRequest();
+        req.setEmail("bootstrap@example.com");
+        req.setInitialPassword("secret");
+        req.setGroupIds(List.of());
+
+        when(userRepository.findByEmail("bootstrap@example.com")).thenReturn(Optional.empty());
+        when(passwordEncoder.encode("secret")).thenReturn("encoded");
+        AppUser saved = AppUser.builder().id(UUID.randomUUID()).email("bootstrap@example.com").build();
+        when(userRepository.save(any())).thenReturn(saved);
+
+        AppUser result = userService.createUserForBootstrap(req);
+
+        assertThat(result).isEqualTo(saved);
+        verify(auditService, never()).logAfterCommit(any(), any(), any(), any());
+    }
+
     // ─── createGroup ──────────────────────────────────────────────────────────
 
     @Test

frontend/messages/de.json

@@ -23,6 +23,8 @@
 	"nav_conversations": "Briefwechsel",
 	"nav_admin": "Admin",
 	"nav_logout": "Abmelden",
+	"theme_toggle_to_light": "Zu hellem Design wechseln",
+	"theme_toggle_to_dark": "Zu dunklem Design wechseln",
 	"btn_save": "Speichern",
 	"btn_cancel": "Abbrechen",
 	"btn_confirm": "Bestätigen",

frontend/messages/en.json

@@ -23,6 +23,8 @@
 	"nav_conversations": "Letters",
 	"nav_admin": "Admin",
 	"nav_logout": "Sign out",
+	"theme_toggle_to_light": "Switch to light mode",
+	"theme_toggle_to_dark": "Switch to dark mode",
 	"btn_save": "Save",
 	"btn_cancel": "Cancel",
 	"btn_confirm": "Confirm",

frontend/messages/es.json

@@ -23,6 +23,8 @@
 	"nav_conversations": "Cartas",
 	"nav_admin": "Admin",
 	"nav_logout": "Cerrar sesión",
+	"theme_toggle_to_light": "Cambiar a modo claro",
+	"theme_toggle_to_dark": "Cambiar a modo oscuro",
 	"btn_save": "Guardar",
 	"btn_cancel": "Cancelar",
 	"btn_confirm": "Confirmar",

frontend/src/lib/components/NotificationBell.svelte

@@ -48,6 +48,12 @@ function handleKeydown(event: KeyboardEvent) {
 	}
 }
 
+const bellLabel = $derived(
+	stream.unreadCount > 0
+		? m.notification_bell_unread_label({ count: stream.unreadCount })
+		: m.notification_bell_label()
+);
+
 function attachBellButton(node: HTMLButtonElement) {
 	bellButtonEl = node;
 	return () => {
@@ -72,12 +78,11 @@ onDestroy(() => {
 		{@attach attachBellButton}
 		type="button"
 		onclick={toggleDropdown}
-		aria-label={stream.unreadCount > 0
-			? m.notification_bell_unread_label({ count: stream.unreadCount })
-			: m.notification_bell_label()}
+		aria-label={bellLabel}
+		title={bellLabel}
 		aria-expanded={open}
 		aria-haspopup="true"
-		class="relative rounded-sm p-2 text-white/65 transition-colors hover:bg-white/10 hover:text-white focus:outline-none focus-visible:ring-2 focus-visible:ring-focus-ring"
+		class="relative cursor-pointer rounded-sm p-2 text-white/65 transition-colors hover:bg-white/10 hover:text-white focus:outline-none focus-visible:ring-2 focus-visible:ring-focus-ring"
 	>
 		<svg
 			xmlns="http://www.w3.org/2000/svg"

frontend/src/lib/components/NotificationBell.svelte.spec.ts

@@ -55,6 +55,34 @@ async function openDropdownAndClickFirstNotification() {
 	notifButton.click();
 }
 
+describe('NotificationBell — cursor and tooltip', () => {
+	it('bell button has cursor-pointer class', async () => {
+		render(NotificationBell);
+		const btn = document.querySelector<HTMLButtonElement>('button[aria-haspopup="true"]')!;
+		expect(btn.classList.contains('cursor-pointer')).toBe(true);
+	});
+
+	it('bell button title equals aria-label when unreadCount is 0', async () => {
+		mockNotificationList.value = [];
+		render(NotificationBell);
+		const btn = document.querySelector<HTMLButtonElement>('button[aria-haspopup="true"]')!;
+		expect(btn.getAttribute('title')).toBe('Benachrichtigungen');
+		expect(btn.getAttribute('aria-label')).toBe(btn.getAttribute('title'));
+	});
+
+	it('bell button title equals aria-label when unreadCount is 3', async () => {
+		mockNotificationList.value = [
+			makeNotification({ id: 'n1' }),
+			makeNotification({ id: 'n2' }),
+			makeNotification({ id: 'n3' })
+		];
+		render(NotificationBell);
+		const btn = document.querySelector<HTMLButtonElement>('button[aria-haspopup="true"]')!;
+		expect(btn.getAttribute('title')).toBe('3 ungelesene Benachrichtigungen');
+		expect(btn.getAttribute('aria-label')).toBe(btn.getAttribute('title'));
+	});
+});
+
 describe('NotificationBell', () => {
 	it('handleMarkRead navigates to URL including annotationId when notification has annotationId', async () => {
 		mockNotificationList.value = [makeNotification({ annotationId: 'annot-1' })];

frontend/src/lib/components/ThemeToggle.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
 import { onMount } from 'svelte';
+import { m } from '$lib/paraglide/messages.js';
 
 type Theme = 'light' | 'dark';
 
@@ -19,6 +20,10 @@ onMount(() => {
 	theme = resolveInitialTheme();
 });
 
+const themeLabel = $derived(
+	theme === 'dark' ? m.theme_toggle_to_light() : m.theme_toggle_to_dark()
+);
+
 function toggle() {
 	theme = theme === 'dark' ? 'light' : 'dark';
 	localStorage.setItem('theme', theme);
@@ -29,8 +34,8 @@ function toggle() {
 <button
 	type="button"
 	onclick={toggle}
-	aria-label={theme === 'dark' ? 'light mode' : 'dark mode'}
-	title={theme === 'dark' ? 'light mode' : 'dark mode'}
+	aria-label={themeLabel}
+	title={themeLabel}
 	class="rounded p-1.5 text-white/65 transition-colors hover:bg-white/10 hover:text-white focus:outline-none focus-visible:ring-2 focus-visible:ring-focus-ring"
 >
 	{#if theme === 'dark'}

frontend/src/lib/components/ThemeToggle.svelte.spec.ts

@@ -0,0 +1,45 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { cleanup, render } from 'vitest-browser-svelte';
+import { page } from 'vitest/browser';
+import ThemeToggle from './ThemeToggle.svelte';
+
+afterEach(() => {
+	cleanup();
+	localStorage.removeItem('theme');
+});
+
+describe('ThemeToggle — label derivation (light mode)', () => {
+	beforeEach(() => {
+		localStorage.setItem('theme', 'light');
+	});
+
+	it('aria-label invites switching to dark mode when theme is light', async () => {
+		render(ThemeToggle);
+		const btn = await page.getByRole('button').element();
+		expect(btn.getAttribute('aria-label')).toBe('Zu dunklem Design wechseln');
+	});
+
+	it('title equals aria-label in light mode', async () => {
+		render(ThemeToggle);
+		const btn = await page.getByRole('button').element();
+		expect(btn.getAttribute('title')).toBe(btn.getAttribute('aria-label'));
+	});
+});
+
+describe('ThemeToggle — label derivation (dark mode)', () => {
+	beforeEach(() => {
+		localStorage.setItem('theme', 'dark');
+	});
+
+	it('aria-label invites switching to light mode when theme is dark', async () => {
+		render(ThemeToggle);
+		const btn = await page.getByRole('button').element();
+		expect(btn.getAttribute('aria-label')).toBe('Zu hellem Design wechseln');
+	});
+
+	it('title equals aria-label in dark mode', async () => {
+		render(ThemeToggle);
+		const btn = await page.getByRole('button').element();
+		expect(btn.getAttribute('title')).toBe(btn.getAttribute('aria-label'));
+	});
+});

frontend/src/routes/layout.css

@@ -365,6 +365,11 @@
 		text-underline-offset: 4px;
 	}
 
+	/* Tailwind preflight resets cursor on *, overriding the browser default for buttons */
+	button {
+		cursor: pointer;
+	}
+
 	/* Fallback focus ring for any interactive element not styled with ring-focus-ring */
 	:focus-visible {
 		outline: 2px solid var(--c-focus-ring);