fix(api): readable marketing email + live-DB admin check

[thomasluizon]

Summary

Follow-ups to the marketing-consent / code-sender work (#287), from real testing:

• Marketing email was unreadable — the caller's body HTML rendered black-on-dark (the branded card is dark, the body had no text color). Now wrapped in a readable light-colored container.
• Banned dashes in the footer — removed the em dash + en dash from the LTDA legal line.
• Admin authorization now checks the DB live. Previously the Admin policy trusted a JWT admin claim minted at login — which meant revoking admin didn't take effect until the token expired. AdminAuthorizationHandler now reads User.IsAdmin from the DB on every request (immediate revocation, DB is the sole authority). The JWT carries identity only; the vestigial claim minting and AdminPolicy claim constants are removed.

Tests

AdminAuthorizationHandler unit tests (admin allowed / non-admin denied / missing id denied); JWT no longer contains an admin claim; auth session/token call-sites updated. Full suite green (Domain 492, Application 2602, Infrastructure 1387).

Refs thomasluizon/orbit-ui-mobile#397

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[claude]

Review Complete

Scope: PR #290, thomasluizon/orbit-api, branch fix/marketing-email-and-admin-dbcheck
Recommendation: APPROVE

Severity	Count
Critical (incl. ⚠️ old-client breaks)	0
High	0
Medium	0
Low / Info	1 (informational only, not a defect)

---

Summary

Two independent, small, well-scoped fixes: (1) the marketing-broadcast email body is now wrapped in a light-colored, legible <div> and the footer's em/en dashes are removed; (2) admin authorization moves from a JWT claim minted at login to a live IsAdmin DB check via a new AdminAuthorizationHandler, closing the "revoked admin still works until token expiry" gap. Both changes are internal (no DTO, endpoint, or packages/shared surface touched), so backward-compat and contract-drift checks don't apply. Tests were updated in lockstep across all call-sites removed (ITokenService, IAuthSessionService, AdminPolicy), and the new handler has direct unit-test coverage for all four branches (admin, non-admin, missing claim, unparseable claim).

Findings

Critical / High / Medium

None.

Low / Info

• src/Orbit.Infrastructure/Services/ResendEmailService.cs:107-116 — SendMarketingEmailAsync wraps the admin-supplied bodyHtml in a new <div> without additional HTML encoding. Confirmed this is not a new trust-boundary change: EmailTemplateRenderer.RenderLayout already injected bodyHtml verbatim before this PR, and the content is gated behind [Authorize(Policy = AdminPolicy.Name)] on AdminController — trusted-author HTML, not user input. No action required.

Subagents

Agent	Verdict
security-reviewer	PASS
contract-aligner	N/A — no DTO, Controller route, or packages/shared surface changed in this diff

Validation

Check	Result
Build / Tests (dotnet)	N/A — covered by required CI checks (Build / Unit Tests / SonarCloud)

What's good

• Fail-closed authorization: AdminAuthorizationHandler never calls context.Succeed when the NameIdentifier claim is missing or fails Guid.TryParse, directly unit-tested including asserting the repository is never queried in those cases.
• Full removal of the dead admin-claim path: AdminPolicy.ClaimType/ClaimValue deleted, and every call-site of ITokenService.GenerateToken / IAuthSessionService.CreateSessionAsync was updated in the same PR — no orphaned signatures.
• The email-contrast fix is verifiably correct: the layout's dark canvas (EmailTemplateRenderer.CanvasColor) is paired with a light wrapper text color — genuinely fixes the reported black-on-dark unreadability.
• Backward-compat guard: no DTO, endpoint, or packages/shared type changed, so there is no old-mobile-client break surface to guard here.

Recommendation

Merge as-is. No follow-ups required.

🤖 Generated with Claude Code