TOTP google authenticator implemented properly well

nothing
fix for the cart checkout
2026-06-20 22:48:15 +02:00 · 2026-06-20 20:43:33 +02:00 · 2026-06-20 13:29:18 +02:00 · 2026-06-20 12:22:31 +02:00 · 2026-06-20 12:13:15 +02:00 · 2026-06-19 23:07:39 +02:00
57 changed files with 2545 additions and 218 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,8 @@ target/
 *.sqlite-*
 .env
 .env.production
+.envrc
+.direnv/
 uploads/
 *.report.html
 favicon_io.zip
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -572,6 +572,12 @@ dependencies = [
 "thiserror 1.0.69",
 ]

+[[package]]
+name = "base32"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "022dfe9eb35f19ebbcb51e0b40a5ab759f46ad60cadf7297e0bd085afb50e076"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -755,12 +761,24 @@ version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"

+[[package]]
+name = "bytemuck"
+version = "1.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"

+[[package]]
+name = "byteorder-lite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
+
 [[package]]
 name = "bytes"
 version = "1.12.0"
@@ -1059,6 +1077,12 @@ dependencies = [
 "tiny-keccak",
 ]

+[[package]]
+name = "constant_time_eq"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6"
+
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -1581,6 +1605,15 @@ version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"

+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -2424,6 +2457,19 @@ dependencies = [
 "winapi-util",
 ]

+[[package]]
+name = "image"
+version = "0.25.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
+dependencies = [
+ "bytemuck",
+ "byteorder-lite",
+ "moxcms",
+ "num-traits",
+ "png",
+]
+
 [[package]]
 name = "include_dir"
 version = "0.7.4"
@@ -2619,6 +2665,7 @@ dependencies = [
 "serial_test",
 "time",
 "tokio",
+ "totp-rs",
 "tower-sessions",
 "tracing",
 "tracing-subscriber",
@@ -3052,6 +3099,16 @@ dependencies = [
 "uuid",
 ]

+[[package]]
+name = "moxcms"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
+dependencies = [
+ "num-traits",
+ "pxfm",
+]
+
 [[package]]
 name = "multer"
 version = "3.1.0"
@@ -3654,6 +3711,19 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"

+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "polling"
 version = "3.11.0"
@@ -3816,6 +3886,29 @@ dependencies = [
 "unicase",
 ]

+[[package]]
+name = "pxfm"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f"
+
+[[package]]
+name = "qrcodegen"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4339fc7a1021c9c1621d87f5e3505f2805c8c105420ba2f2a4df86814590c142"
+
+[[package]]
+name = "qrcodegen-image"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99530e45ded4640c0eab5420fc60f9a0ec1be51a22e49cc8578b9a0d8be70712"
+dependencies = [
+ "base64",
+ "image",
+ "qrcodegen",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.38.4"
@@ -5739,6 +5832,23 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"

+[[package]]
+name = "totp-rs"
+version = "5.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b36a9dd327e9f401320a2cb4572cc76ff43742bcfc3291f871691050f140ba"
+dependencies = [
+ "base32",
+ "constant_time_eq",
+ "hmac",
+ "qrcodegen-image",
+ "rand 0.9.4",
+ "sha1",
+ "sha2",
+ "url",
+ "urlencoding",
+]
+
 [[package]]
 name = "tower"
 version = "0.4.13"
@@ -6144,6 +6254,12 @@ dependencies = [
 "serde_derive",
 ]

+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
 [[package]]
 name = "utf-8"
 version = "0.7.6"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -49,6 +49,8 @@ axum-casbin = "1.3.0"
 loco-oauth2 = "0.5.0"
 passwords = "3.1.16"
 tower-sessions = "0.14"
+# TOTP (Google Authenticator) for optional two-factor auth
+totp-rs = { version = "5", features = ["qr", "gen_secret"] }

 [[bin]]
 name = "kompress-eshop-cli"
--- a/assets/i18n/en/main.ftl
+++ b/assets/i18n/en/main.ftl
@@ -273,6 +273,67 @@ profile-title = My profile
 profile-intro = We'll use these details to prefill checkout.
 profile-saved = Profile saved.
 profile-save = Save profile
+profile-company-required = For a company account, please fill in company name, IČO and DIČ.
+profile-first-name = First name
+profile-last-name = Surname
+profile-edit = Edit profile
+profile-cancel = Cancel
+profile-not-set = Not set
+nav-account = My account
+account-orders = My orders
+account-change-password = Change password
+orders-active = Active orders
+orders-past = Past orders
+orders-empty = You don't have any orders yet.
+password-change-title = Change password
+password-current = Current password
+password-current-wrong = Your current password is incorrect.
+password-changed = Your password has been changed.
+
+# Two-factor authentication (TOTP / Google Authenticator)
+security-title = Security
+security-2fa-intro = Two-factor authentication (2FA) adds a one-time code from an app like Google Authenticator to your sign-in.
+security-2fa-on = 2FA is on
+security-2fa-off = 2FA is off
+security-2fa-enable = Enable two-factor authentication
+security-2fa-scan = Scan this QR code in Google Authenticator (or any compatible app).
+security-2fa-manual = Or enter the key manually:
+security-2fa-enter-code = Enter the 6-digit code from the app
+security-2fa-confirm = Confirm and enable
+security-2fa-code-wrong = That code is wrong or expired. Please try again.
+security-2fa-enroll-error = Could not start 2FA setup. Please try again.
+security-2fa-enabled-ok = Two-factor authentication is enabled.
+security-2fa-backup-intro = Save these backup codes somewhere safe. Each can be used once if you lose access to your app.
+security-2fa-backup-remaining = Backup codes remaining
+security-2fa-regenerate = Generate new backup codes
+security-2fa-disable = Disable two-factor authentication
+security-2fa-disable-hint = Enter your current password to confirm.
+
+# Second login step (after password)
+login-totp-title = Two-factor authentication
+login-totp-intro = Enter the code from your authenticator app.
+login-totp-error = That code is wrong or expired.
+login-totp-code = Verification code
+login-totp-submit = Verify
+login-totp-backup-hint = No access to your app? Enter one of your backup codes.
+
+account-type-locked = Account type can't be changed after registration.
+checkout-create-account = Create an account from this order
+checkout-create-account-hint = We'll email you a link to set your password. This order will be linked to your account.
+order-account-created = We created an account for you. Check your email to set your password.
+set-password-title = Set your password
+set-password-intro = Choose a password to finish setting up your account.
+set-password-new = New password
+set-password-confirm = Confirm password
+set-password-submit = Set password
+set-password-invalid = This link is invalid or has expired.
+set-password-weak = Password must be at least 8 characters.
+set-password-mismatch = Passwords don't match.
+resend-verification-title = Resend verification email
+resend-verification-intro = Enter your email and we'll send a fresh verification link.
+resend-verification-submit = Resend
+resend-verification-done = If that email belongs to an unverified account, we've sent a new verification link. Check your inbox (and spam). You can request another in a minute.
+login-resend = Didn't get the verification email? Resend it
 order-confirmed-title = Thank you for your order!
 order-confirmed-sub = We have received your order.
 order-number = Order number
@@ -285,6 +346,7 @@ admin-no-orders = No orders yet.
 order-status-pending = Pending
 order-status-paid = Paid
 order-status-shipped = Shipped
+order-status-delivered = Delivered
 order-status-cancelled = Cancelled
 order-update-status = Update status

--- a/assets/i18n/sk/main.ftl
+++ b/assets/i18n/sk/main.ftl
@@ -273,6 +273,67 @@ profile-title = Môj profil
 profile-intro = Tieto údaje použijeme na predvyplnenie pokladne.
 profile-saved = Profil bol uložený.
 profile-save = Uložiť profil
+profile-company-required = Pri firemnom účte vyplňte názov firmy, IČO a DIČ.
+profile-first-name = Meno
+profile-last-name = Priezvisko
+profile-edit = Upraviť profil
+profile-cancel = Zrušiť
+profile-not-set = Neuvedené
+nav-account = Môj účet
+account-orders = Moje objednávky
+account-change-password = Zmeniť heslo
+orders-active = Aktívne objednávky
+orders-past = Staršie objednávky
+orders-empty = Zatiaľ nemáte žiadne objednávky.
+password-change-title = Zmeniť heslo
+password-current = Súčasné heslo
+password-current-wrong = Vaše súčasné heslo je nesprávne.
+password-changed = Vaše heslo bolo zmenené.
+
+# Two-factor authentication (TOTP / Google Authenticator)
+security-title = Zabezpečenie
+security-2fa-intro = Dvojfaktorové overenie (2FA) pridáva k prihláseniu jednorazový kód z aplikácie ako Google Authenticator.
+security-2fa-on = 2FA je zapnuté
+security-2fa-off = 2FA je vypnuté
+security-2fa-enable = Zapnúť dvojfaktorové overenie
+security-2fa-scan = Naskenujte tento QR kód v aplikácii Google Authenticator (alebo inej kompatibilnej).
+security-2fa-manual = Alebo zadajte kľúč ručne:
+security-2fa-enter-code = Zadajte 6-miestny kód z aplikácie
+security-2fa-confirm = Potvrdiť a zapnúť
+security-2fa-code-wrong = Kód je nesprávny alebo vypršal. Skúste to znova.
+security-2fa-enroll-error = Nepodarilo sa pripraviť 2FA. Skúste to znova.
+security-2fa-enabled-ok = Dvojfaktorové overenie je zapnuté.
+security-2fa-backup-intro = Uložte si tieto záložné kódy na bezpečné miesto. Každý sa dá použiť iba raz, ak nemáte prístup k aplikácii.
+security-2fa-backup-remaining = Zostávajúce záložné kódy
+security-2fa-regenerate = Vygenerovať nové záložné kódy
+security-2fa-disable = Vypnúť dvojfaktorové overenie
+security-2fa-disable-hint = Na potvrdenie zadajte svoje súčasné heslo.
+
+# Second login step (after password)
+login-totp-title = Dvojfaktorové overenie
+login-totp-intro = Zadajte kód z vašej autentifikačnej aplikácie.
+login-totp-error = Kód je nesprávny alebo vypršal.
+login-totp-code = Overovací kód
+login-totp-submit = Overiť
+login-totp-backup-hint = Nemáte prístup k aplikácii? Zadajte jeden zo svojich záložných kódov.
+
+account-type-locked = Typ účtu sa po registrácii nedá zmeniť.
+checkout-create-account = Vytvoriť účet z tejto objednávky
+checkout-create-account-hint = Pošleme vám e-mail na nastavenie hesla. Objednávka sa priradí k vášmu účtu.
+order-account-created = Vytvorili sme vám účet. Skontrolujte si e-mail a nastavte si heslo.
+set-password-title = Nastavte si heslo
+set-password-intro = Zvoľte si heslo a dokončite vytvorenie účtu.
+set-password-new = Nové heslo
+set-password-confirm = Potvrďte heslo
+set-password-submit = Nastaviť heslo
+set-password-invalid = Odkaz je neplatný alebo vypršal.
+set-password-weak = Heslo musí mať aspoň 8 znakov.
+set-password-mismatch = Heslá sa nezhodujú.
+resend-verification-title = Znova odoslať overovací e-mail
+resend-verification-intro = Zadajte svoj e-mail a pošleme vám nový overovací odkaz.
+resend-verification-submit = Odoslať znova
+resend-verification-done = Ak k tomuto e-mailu patrí neoverený účet, poslali sme naň nový overovací odkaz. Skontrolujte si schránku aj priečinok so spamom. Ďalšiu žiadosť môžete odoslať o minútu.
+login-resend = Nedostali ste overovací e-mail? Poslať znova
 order-confirmed-title = Ďakujeme za objednávku!
 order-confirmed-sub = Vašu objednávku sme prijali.
 order-number = Číslo objednávky
@@ -285,6 +346,7 @@ admin-no-orders = Zatiaľ žiadne objednávky.
 order-status-pending = Čaká na spracovanie
 order-status-paid = Zaplatené
 order-status-shipped = Odoslané
+order-status-delivered = Doručené
 order-status-cancelled = Zrušené
 order-update-status = Zmeniť stav

--- a/assets/static/css/app.css
+++ b/assets/static/css/app.css
--- a/assets/static/vendor/alpine/alpine-focus-3.14.9.min.js
+++ b/assets/static/vendor/alpine/alpine-focus-3.14.9.min.js
--- a/assets/views/account/order_detail.html
+++ b/assets/views/account/order_detail.html
@@ -0,0 +1,76 @@
+{% extends "base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ order.order_number }}{% endblock title %}
+
+{% macro status_badge(status) %}
+{% if status == "delivered" %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="success") }}
+{% elif status == "shipped" %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="primary") }}
+{% elif status == "paid" %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="info") }}
+{% elif status == "cancelled" %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="danger") }}
+{% else %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="warning") }}
+{% endif %}
+{% endmacro status_badge %}
+
+{% block content %}
+<div class="mx-auto max-w-2xl space-y-6">
+  <a href="/account/orders" class="inline-flex items-center gap-1 text-sm text-primary underline-offset-2 hover:underline dark:text-primary-dark">
+    <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" class="size-4"><path stroke-linecap="round" stroke-linejoin="round" d="M15.75 19.5 8.25 12l7.5-7.5" /></svg>
+    {{ t(key="account-orders", lang=lang | default(value='sk')) }}
+  </a>
+
+  <div class="flex flex-wrap items-center justify-between gap-3">
+    <h1 class="font-mono text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ order.order_number }}</h1>
+    {{ self::status_badge(status=order.status) }}
+  </div>
+  <p class="text-sm text-on-surface/60 dark:text-on-surface-dark/60">{{ order.created_at | truncate(length=10, end="") }}</p>
+
+  <div class="rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+    <ul class="space-y-2 pb-3 text-sm">
+      {% for item in items %}
+      <li class="flex justify-between gap-2">
+        <span class="text-on-surface/80 dark:text-on-surface-dark/80">{{ item.product_name }} × {{ item.quantity }}</span>
+        <span class="tabular-nums">{{ item.line_total }} {{ order.currency }}</span>
+      </li>
+      {% endfor %}
+    </ul>
+    <div class="space-y-1 border-t border-outline py-3 text-sm dark:border-outline-dark">
+      <div class="flex justify-between"><span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="checkout-subtotal", lang=lang | default(value='sk')) }}</span><span class="tabular-nums">{{ order.subtotal }} {{ order.currency }}</span></div>
+      <div class="flex justify-between"><span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ order.carrier_name }}</span><span class="tabular-nums">{{ order.shipping }} {{ order.currency }}</span></div>
+      {% if order.pickup_point_name %}<div class="text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ order.pickup_point_name }}</div>{% endif %}
+    </div>
+    <div class="flex justify-between border-t border-outline pt-3 font-bold dark:border-outline-dark">
+      <span>{{ t(key="order-total", lang=lang | default(value='sk')) }}</span>
+      <span class="tabular-nums text-primary dark:text-primary-dark">{{ order.total }} {{ order.currency }}</span>
+    </div>
+  </div>
+
+  {% if order.tracking_number %}
+  <div class="rounded-radius border border-outline bg-surface p-4 text-sm dark:border-outline-dark dark:bg-surface-dark-alt">
+    <div class="flex flex-wrap items-center justify-between gap-2">
+      <span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="order-tracking", lang=lang | default(value='sk')) }}</span>
+      <span class="font-mono font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ order.tracking_number }}</span>
+    </div>
+  </div>
+  {% endif %}
+
+  <div class="rounded-radius border border-outline bg-surface p-6 text-sm dark:border-outline-dark dark:bg-surface-dark-alt">
+    <h2 class="mb-2 font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-shipping", lang=lang | default(value='sk')) }}</h2>
+    <p class="text-on-surface/80 dark:text-on-surface-dark/80">{{ order.customer_name }}</p>
+    {% if order.address %}<p class="text-on-surface/80 dark:text-on-surface-dark/80">{{ order.address }}</p>{% endif %}
+    <p class="text-on-surface/80 dark:text-on-surface-dark/80">{{ order.zip }} {{ order.city }}{% if order.country %}, {{ order.country }}{% endif %}</p>
+  </div>
+
+  {% if order.payment_method == "bank_transfer" and order.status == "pending" %}
+  <div class="space-y-2 rounded-radius border border-primary/40 bg-primary/5 p-6 text-sm dark:border-primary-dark/40">
+    <p class="font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="payment-bank-instructions", lang=lang | default(value='sk')) }}</p>
+    <div class="grid grid-cols-[auto_1fr] gap-x-4 gap-y-1">
+      <span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="bank-account-name", lang=lang | default(value='sk')) }}</span><span class="font-medium">{{ order.bank_account_name }}</span>
+      <span class="text-on-surface/70 dark:text-on-surface-dark/70">IBAN</span><span class="font-mono font-medium">{{ order.bank_iban }}</span>
+      <span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="bank-variable-symbol", lang=lang | default(value='sk')) }}</span><span class="font-mono font-medium">{{ order.variable_symbol }}</span>
+      <span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="bank-amount", lang=lang | default(value='sk')) }}</span><span class="font-medium tabular-nums">{{ order.total }} {{ order.currency }}</span>
+    </div>
+  </div>
+  {% endif %}
+</div>
+{% endblock content %}
--- a/assets/views/account/orders.html
+++ b/assets/views/account/orders.html
@@ -0,0 +1,52 @@
+{% extends "base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="account-orders", lang=lang | default(value='sk')) }}{% endblock title %}
+
+{# status → badge variant #}
+{% macro status_badge(status) %}
+{% if status == "delivered" %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="success") }}
+{% elif status == "shipped" %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="primary") }}
+{% elif status == "paid" %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="info") }}
+{% elif status == "cancelled" %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="danger") }}
+{% else %}{{ ui::badge(label=t(key="order-status-" ~ status, lang=lang | default(value='sk')), variant="warning") }}
+{% endif %}
+{% endmacro status_badge %}
+
+{% macro order_row(order) %}
+<a href="/account/orders/{{ order.order_number }}"
+  class="flex flex-wrap items-center justify-between gap-3 rounded-radius border border-outline bg-surface p-4 transition hover:border-primary hover:bg-primary/5 dark:border-outline-dark dark:bg-surface-dark-alt dark:hover:border-primary-dark">
+  <div class="min-w-0">
+    <p class="font-mono text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ order.order_number }}</p>
+    <p class="text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ order.created_at | truncate(length=10, end="") }}</p>
+  </div>
+  <div class="flex items-center gap-4">
+    {{ self::status_badge(status=order.status) }}
+    <span class="tabular-nums text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ order.total }} {{ order.currency }}</span>
+  </div>
+</a>
+{% endmacro order_row %}
+
+{% block content %}
+<div class="mx-auto max-w-3xl space-y-8">
+  <h1 class="text-3xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-orders", lang=lang | default(value='sk')) }}</h1>
+
+  {% if active_orders | length == 0 and past_orders | length == 0 %}
+  <p class="rounded-radius border border-outline bg-surface p-6 text-sm text-on-surface/70 dark:border-outline-dark dark:bg-surface-dark-alt dark:text-on-surface-dark/70">{{ t(key="orders-empty", lang=lang | default(value='sk')) }}</p>
+  {% endif %}
+
+  {% if active_orders | length > 0 %}
+  <section class="space-y-3">
+    <h2 class="text-lg font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="orders-active", lang=lang | default(value='sk')) }}</h2>
+    {% for order in active_orders %}{{ self::order_row(order=order) }}{% endfor %}
+  </section>
+  {% endif %}
+
+  {% if past_orders | length > 0 %}
+  <section class="space-y-3">
+    <h2 class="text-lg font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="orders-past", lang=lang | default(value='sk')) }}</h2>
+    {% for order in past_orders %}{{ self::order_row(order=order) }}{% endfor %}
+  </section>
+  {% endif %}
+</div>
+{% endblock content %}
--- a/assets/views/account/password.html
+++ b/assets/views/account/password.html
@@ -0,0 +1,43 @@
+{% extends "base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="password-change-title", lang=lang | default(value='sk')) }}{% endblock title %}
+
+{% block content %}
+<div class="mx-auto max-w-md">
+  <h1 class="text-3xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="password-change-title", lang=lang | default(value='sk')) }}</h1>
+
+  {% if changed %}
+  <div class="mt-4 rounded-radius border border-success bg-success/10 px-4 py-3 text-sm text-success" role="status">
+    {{ t(key="password-changed", lang=lang | default(value='sk')) }}
+  </div>
+  {% endif %}
+  {% if error == "current" %}
+  {{ ui::alert_danger(message=t(key="password-current-wrong", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% elif error == "mismatch" %}
+  {{ ui::alert_danger(message=t(key="set-password-mismatch", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% elif error == "weak" %}
+  {{ ui::alert_danger(message=t(key="set-password-weak", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% endif %}
+
+  <form method="post" action="/account/password" hx-boost="false" class="mt-6 flex flex-col gap-4"
+    x-data="{ password: '', confirm: '' }">
+    <div class="flex flex-col gap-1">
+      <label for="current_password" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="password-current", lang=lang | default(value='sk')) }}</label>
+      {{ ui::input(name="current_password", id="current_password", type="password", required=true, autocomplete="current-password") }}
+    </div>
+    <div class="flex flex-col gap-1">
+      <label for="password" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="set-password-new", lang=lang | default(value='sk')) }}</label>
+      {{ ui::input(name="password", id="password", type="password", required=true, autocomplete="new-password", attrs='x-model="password"') }}
+    </div>
+    <div class="flex flex-col gap-1">
+      <label for="password_confirm" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="set-password-confirm", lang=lang | default(value='sk')) }}</label>
+      {{ ui::input(name="password_confirm", id="password_confirm", type="password", required=true, autocomplete="new-password", attrs='x-model="confirm"') }}
+      <span x-cloak x-show="confirm.length > 0 && password !== confirm" class="text-xs text-danger dark:text-danger">
+        {{ t(key="set-password-mismatch", lang=lang | default(value='sk')) }}
+      </span>
+    </div>
+    {{ ui::button(label=t(key="password-change-title", lang=lang | default(value='sk')), type="submit", extra="mt-1 w-full", attrs=':disabled="password !== confirm"') }}
+  </form>
+</div>
+{% endblock content %}
--- a/assets/views/account/profile.html
+++ b/assets/views/account/profile.html
@@ -3,8 +3,19 @@

 {% block title %}{{ t(key="profile-title", lang=lang | default(value='sk')) }}{% endblock title %}

+{% macro field(label, value) %}
+<div class="space-y-1.5">
+  <label class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ label }}</label>
+  {% if value %}
+  <p class="text-sm text-on-surface/80 dark:text-on-surface-dark/80">{{ value }}</p>
+  {% else %}
+  <p class="text-sm italic text-on-surface/50 dark:text-on-surface-dark/50">{{ t(key="profile-not-set", lang=lang | default(value='sk')) }}</p>
+  {% endif %}
+</div>
+{% endmacro field %}
+
 {% block content %}
-<div class="mx-auto max-w-2xl">
+<div class="mx-auto max-w-2xl" x-data="{ editing: {% if error %}true{% else %}false{% endif %} }">
  <h1 class="text-3xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="profile-title", lang=lang | default(value='sk')) }}</h1>
  <p class="mt-2 text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="profile-intro", lang=lang | default(value='sk')) }}</p>

@@ -13,38 +24,92 @@
    {{ t(key="profile-saved", lang=lang | default(value='sk')) }}
  </div>
  {% endif %}
+  {% if error %}
+  {{ ui::alert_danger(message=t(key="profile-company-required", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% endif %}

-  <form method="post" action="/account/profile" hx-boost="false" class="mt-6 space-y-6"
-    x-data="{ accountType: '{{ account_type | default(value='personal') }}' }">
-    <!-- personal vs company: an account is exactly one of the two -->
-    <fieldset class="space-y-3 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+  <!-- read-only view (default) -->
+  <div x-show="!editing" class="mt-6 space-y-6">
+    <fieldset class="space-y-2 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-type", lang=lang | default(value='sk')) }}</legend>
-      <div class="grid gap-3 sm:grid-cols-2">
-        <label class="flex cursor-pointer items-center gap-3 rounded-radius border border-outline px-4 py-3 transition has-[:checked]:border-primary dark:border-outline-dark dark:has-[:checked]:border-primary-dark">
-          {{ ui::radio(name="account_type", value="personal", attrs='x-model="accountType"') }}
-          <span class="font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-personal", lang=lang | default(value='sk')) }}</span>
-        </label>
-        <label class="flex cursor-pointer items-center gap-3 rounded-radius border border-outline px-4 py-3 transition has-[:checked]:border-primary dark:border-outline-dark dark:has-[:checked]:border-primary-dark">
-          {{ ui::radio(name="account_type", value="company", attrs='x-model="accountType"') }}
-          <span class="font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-company", lang=lang | default(value='sk')) }}</span>
-        </label>
+      <div class="flex items-center gap-2">
+        {% if account_type == "company" %}
+        {{ ui::badge(label=t(key="account-company", lang=lang | default(value='sk')), variant="primary") }}
+        {% else %}
+        {{ ui::badge(label=t(key="account-personal", lang=lang | default(value='sk')), variant="neutral") }}
+        {% endif %}
+        <span class="text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="account-type-locked", lang=lang | default(value='sk')) }}</span>
      </div>
    </fieldset>

+    {% if account_type == "company" %}
+    <fieldset class="space-y-4 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-company-details", lang=lang | default(value='sk')) }}</legend>
+      {{ self::field(label=t(key="company-name", lang=lang | default(value='sk')), value=company_name) }}
+      <div class="grid gap-4 sm:grid-cols-3">
+        {{ self::field(label=t(key="company-ico", lang=lang | default(value='sk')), value=company_id) }}
+        {{ self::field(label=t(key="company-dic", lang=lang | default(value='sk')), value=tax_id) }}
+        {{ self::field(label=t(key="company-icdph", lang=lang | default(value='sk')), value=vat_id) }}
+      </div>
+    </fieldset>
+    {% endif %}
+
+    <fieldset class="space-y-4 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-contact", lang=lang | default(value='sk')) }}</legend>
+      {{ self::field(label=t(key="checkout-name", lang=lang | default(value='sk')), value=name) }}
+      {{ self::field(label=t(key="checkout-email", lang=lang | default(value='sk')), value=email) }}
+      {% if phone %}
+      {% set phone_full = phone_prefix | default(value='') %}
+      {% set phone_full = phone_full ~ ' ' ~ phone %}
+      {{ self::field(label=t(key="checkout-phone", lang=lang | default(value='sk')), value=phone_full) }}
+      {% else %}
+      {{ self::field(label=t(key="checkout-phone", lang=lang | default(value='sk')), value='') }}
+      {% endif %}
+    </fieldset>
+
+    <fieldset class="space-y-4 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-shipping", lang=lang | default(value='sk')) }}</legend>
+      {{ self::field(label=t(key="checkout-address", lang=lang | default(value='sk')), value=address) }}
+      <div class="grid gap-4 sm:grid-cols-3">
+        {{ self::field(label=t(key="checkout-city", lang=lang | default(value='sk')), value=city) }}
+        {{ self::field(label=t(key="checkout-zip", lang=lang | default(value='sk')), value=zip) }}
+        {{ self::field(label=t(key="checkout-country", lang=lang | default(value='sk')), value=country) }}
+      </div>
+    </fieldset>
+
+    {{ ui::button(label=t(key="profile-edit", lang=lang | default(value='sk')), type="button", size="px-6 py-2.5 text-sm", attrs='@click="editing = true"') }}
+  </div>
+
+  <!-- edit form -->
+  <form x-show="editing" x-cloak method="post" action="/account/profile" hx-boost="false" class="mt-6 space-y-6">
+    <!-- account type is fixed at registration and shown read-only -->
+    <fieldset class="space-y-2 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-type", lang=lang | default(value='sk')) }}</legend>
+      <div class="flex items-center gap-2">
+        {% if account_type == "company" %}
+        {{ ui::badge(label=t(key="account-company", lang=lang | default(value='sk')), variant="primary") }}
+        {% else %}
+        {{ ui::badge(label=t(key="account-personal", lang=lang | default(value='sk')), variant="neutral") }}
+        {% endif %}
+        <span class="text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="account-type-locked", lang=lang | default(value='sk')) }}</span>
+      </div>
+    </fieldset>
+
+    {% if account_type == "company" %}
    <!-- company billing details (company accounts only) -->
-    <fieldset x-show="accountType === 'company'" x-cloak class="space-y-4 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+    <fieldset class="space-y-4 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-company-details", lang=lang | default(value='sk')) }}</legend>
      <div class="space-y-1.5">
-        <label for="company_name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-name", lang=lang | default(value='sk')) }}</label>
+        <label for="company_name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-name", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
        {{ ui::input(name="company_name", id="company_name", value=company_name | default(value=''), autocomplete="organization") }}
      </div>
      <div class="grid gap-4 sm:grid-cols-3">
        <div class="space-y-1.5">
-          <label for="company_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-ico", lang=lang | default(value='sk')) }}</label>
+          <label for="company_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-ico", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
          {{ ui::input(name="company_id", id="company_id", value=company_id | default(value='')) }}
        </div>
        <div class="space-y-1.5">
-          <label for="tax_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-dic", lang=lang | default(value='sk')) }}</label>
+          <label for="tax_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-dic", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
          {{ ui::input(name="tax_id", id="tax_id", value=tax_id | default(value='')) }}
        </div>
        <div class="space-y-1.5">
@@ -53,13 +118,20 @@
        </div>
      </div>
    </fieldset>
+    {% endif %}

    <!-- contact (name/email are managed by the login) -->
    <fieldset class="space-y-4 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-contact", lang=lang | default(value='sk')) }}</legend>
-      <div class="space-y-1.5">
-        <label class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-name", lang=lang | default(value='sk')) }}</label>
-        <p class="text-sm text-on-surface/80 dark:text-on-surface-dark/80">{{ name }}</p>
+      <div class="grid gap-4 sm:grid-cols-2">
+        <div class="space-y-1.5">
+          <label for="first_name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="profile-first-name", lang=lang | default(value='sk')) }}</label>
+          {{ ui::input(name="first_name", id="first_name", value=first_name | default(value=''), autocomplete="given-name") }}
+        </div>
+        <div class="space-y-1.5">
+          <label for="last_name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="profile-last-name", lang=lang | default(value='sk')) }}</label>
+          {{ ui::input(name="last_name", id="last_name", value=last_name | default(value=''), autocomplete="family-name") }}
+        </div>
      </div>
      <div class="space-y-1.5">
        <label class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-email", lang=lang | default(value='sk')) }}</label>
@@ -147,7 +219,10 @@
      </div>
    </fieldset>

-    {{ ui::button(label=t(key="profile-save", lang=lang | default(value='sk')), type="submit", size="px-6 py-2.5 text-sm") }}
+    <div class="flex items-center gap-3">
+      {{ ui::button(label=t(key="profile-save", lang=lang | default(value='sk')), type="submit", size="px-6 py-2.5 text-sm") }}
+      {{ ui::button(label=t(key="profile-cancel", lang=lang | default(value='sk')), type="button", variant="outline-secondary", size="px-6 py-2.5 text-sm", attrs='@click="editing = false"') }}
+    </div>
  </form>
 </div>
 {% endblock content %}
--- a/assets/views/account/security.html
+++ b/assets/views/account/security.html
@@ -0,0 +1,80 @@
+{% extends "base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="security-title", lang=lang | default(value='sk')) }}{% endblock title %}
+
+{% block content %}
+<div class="mx-auto max-w-md">
+  <h1 class="text-3xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="security-title", lang=lang | default(value='sk')) }}</h1>
+  <p class="mt-2 text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-intro", lang=lang | default(value='sk')) }}</p>
+
+  {% if error == "password" %}
+  {{ ui::alert_danger(message=t(key="password-current-wrong", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% elif error == "code" %}
+  {{ ui::alert_danger(message=t(key="security-2fa-code-wrong", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% elif error == "enroll" %}
+  {{ ui::alert_danger(message=t(key="security-2fa-enroll-error", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% endif %}
+
+  {# --- One-time backup codes, shown right after enabling / regenerating --- #}
+  {% if backup_codes and backup_codes | length > 0 %}
+  <div class="mt-6 rounded-radius border border-success bg-success/10 px-4 py-3" role="status">
+    <p class="text-sm font-medium text-success">{{ t(key="security-2fa-enabled-ok", lang=lang | default(value='sk')) }}</p>
+    <p class="mt-2 text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-backup-intro", lang=lang | default(value='sk')) }}</p>
+    <ul class="mt-3 grid grid-cols-2 gap-2 font-mono text-sm text-on-surface-strong dark:text-on-surface-dark-strong">
+      {% for code in backup_codes %}
+      <li class="rounded-radius bg-surface px-3 py-1.5 text-center tracking-wider dark:bg-surface-dark">{{ code }}</li>
+      {% endfor %}
+    </ul>
+  </div>
+  {% endif %}
+
+  {% if enrolling %}
+  {# --- Step 2: scan the QR and confirm a code --- #}
+  <div class="mt-6 flex flex-col gap-4 rounded-radius border border-outline bg-surface-alt p-5 dark:border-outline-dark dark:bg-surface-dark-alt">
+    <p class="text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-scan", lang=lang | default(value='sk')) }}</p>
+    <img src="{{ qr }}" alt="TOTP QR" class="mx-auto size-48 rounded-radius bg-white p-2" />
+    <div class="text-center">
+      <p class="text-xs text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-manual", lang=lang | default(value='sk')) }}</p>
+      <code class="mt-1 inline-block break-all font-mono text-sm text-on-surface-strong dark:text-on-surface-dark-strong">{{ secret }}</code>
+    </div>
+    <form method="post" action="/account/security/confirm" hx-boost="false" class="flex flex-col gap-3">
+      <label for="code" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="security-2fa-enter-code", lang=lang | default(value='sk')) }}</label>
+      {{ ui::input(name="code", id="code", type="text", required=true, autocomplete="one-time-code", attrs='inputmode="numeric" pattern="[0-9]*" maxlength="6" autofocus') }}
+      {{ ui::button(label=t(key="security-2fa-confirm", lang=lang | default(value='sk')), type="submit", extra="w-full") }}
+    </form>
+  </div>
+
+  {% elif totp_enabled %}
+  {# --- Enabled: status + remaining backup codes + disable / regenerate --- #}
+  <div class="mt-6 flex items-center gap-2">
+    {{ ui::badge(label=t(key="security-2fa-on", lang=lang | default(value='sk')), variant="success") }}
+    <span class="text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-backup-remaining", lang=lang | default(value='sk')) }}: {{ backup_remaining }}</span>
+  </div>
+
+  <form method="post" action="/account/security/backup-codes" hx-boost="false" class="mt-6 flex flex-col gap-3 rounded-radius border border-outline bg-surface-alt p-5 dark:border-outline-dark dark:bg-surface-dark-alt">
+    <p class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="security-2fa-regenerate", lang=lang | default(value='sk')) }}</p>
+    <label for="regen_pw" class="text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="password-current", lang=lang | default(value='sk')) }}</label>
+    {{ ui::input(name="current_password", id="regen_pw", type="password", required=true, autocomplete="current-password") }}
+    {{ ui::button(label=t(key="security-2fa-regenerate", lang=lang | default(value='sk')), type="submit", variant="outline-secondary", extra="w-full") }}
+  </form>
+
+  <form method="post" action="/account/security/disable" hx-boost="false" class="mt-4 flex flex-col gap-3 rounded-radius border border-danger/40 bg-danger/5 p-5">
+    <p class="text-sm font-medium text-danger">{{ t(key="security-2fa-disable", lang=lang | default(value='sk')) }}</p>
+    <p class="text-xs text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-disable-hint", lang=lang | default(value='sk')) }}</p>
+    <label for="disable_pw" class="text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="password-current", lang=lang | default(value='sk')) }}</label>
+    {{ ui::input(name="current_password", id="disable_pw", type="password", required=true, autocomplete="current-password") }}
+    {{ ui::button(label=t(key="security-2fa-disable", lang=lang | default(value='sk')), type="submit", variant="danger", extra="w-full") }}
+  </form>
+
+  {% else %}
+  {# --- Disabled: offer to enable --- #}
+  <form method="post" action="/account/security/enable" hx-boost="false" class="mt-6">
+    <div class="flex items-center gap-2">
+      {{ ui::badge(label=t(key="security-2fa-off", lang=lang | default(value='sk')), variant="neutral") }}
+    </div>
+    {{ ui::button(label=t(key="security-2fa-enable", lang=lang | default(value='sk')), type="submit", extra="mt-4 w-full") }}
+  </form>
+  {% endif %}
+</div>
+{% endblock content %}
--- a/assets/views/admin/base.html
+++ b/assets/views/admin/base.html
@@ -117,8 +117,8 @@
          {% block crumb %}{{ t(key="admin-title", lang=lang | default(value='sk')) }}{% endblock crumb %}
        </span>

-        <!-- settings (language + theme) dropdown -->
-        <div x-data="{ open: false }" @keydown.escape="open = false" class="relative ml-auto">
+        <!-- settings (language + theme) dropdown (self-contained Alpine state) -->
+        <div class="ml-auto">
          {% include "partials/settings_dropdown.html" %}
        </div>
      </header>
--- a/assets/views/admin/orders/show.html
+++ b/assets/views/admin/orders/show.html
@@ -6,7 +6,15 @@

 {% block content %}
 <div class="flex flex-wrap items-center justify-between gap-3">
-  <h1 class="font-mono text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ order.order_number }}</h1>
+  <div class="flex flex-wrap items-center gap-3">
+    <h1 class="font-mono text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ order.order_number }}</h1>
+    {% if order.status == "delivered" %}{{ ui::badge(label=t(key="order-status-" ~ order.status, lang=lang | default(value='sk')), variant="success") }}
+    {% elif order.status == "shipped" %}{{ ui::badge(label=t(key="order-status-" ~ order.status, lang=lang | default(value='sk')), variant="primary") }}
+    {% elif order.status == "paid" %}{{ ui::badge(label=t(key="order-status-" ~ order.status, lang=lang | default(value='sk')), variant="info") }}
+    {% elif order.status == "cancelled" %}{{ ui::badge(label=t(key="order-status-" ~ order.status, lang=lang | default(value='sk')), variant="danger") }}
+    {% else %}{{ ui::badge(label=t(key="order-status-" ~ order.status, lang=lang | default(value='sk')), variant="warning") }}
+    {% endif %}
+  </div>
  {{ ui::button(variant="outline-secondary", label=t(key="admin-orders", lang=lang | default(value='sk')), href="/admin/orders", size="px-3 py-2 text-sm") }}
 </div>

--- a/assets/views/auth/login.html
+++ b/assets/views/auth/login.html
@@ -22,6 +22,9 @@

      {% if error == "unverified" %}
      {{ ui::alert_danger(message=t(key="login-error-unverified", lang=lang | default(value='sk')), extra="mt-3") }}
+      <p class="mt-2 text-sm text-on-surface dark:text-on-surface-dark">
+        <a href="/resend-verification" class="font-medium text-primary underline-offset-2 hover:underline dark:text-primary-dark">{{ t(key="login-resend", lang=lang | default(value='sk')) }}</a>
+      </p>
      {% elif error %}
      {{ ui::alert_danger(message=t(key="login-error", lang=lang | default(value='sk')), extra="mt-3") }}
      {% endif %}
--- a/assets/views/auth/login_totp.html
+++ b/assets/views/auth/login_totp.html
@@ -0,0 +1,47 @@
+{% extends "base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="login-totp-title", lang=lang | default(value='sk')) }}{% endblock title %}
+
+{% block content %}
+<div class="mx-auto mt-8 max-w-sm">
+  <div
+    class="rounded-radius border border-outline bg-surface-alt shadow-sm dark:border-outline-dark dark:bg-surface-dark-alt">
+    <div
+      class="flex items-center justify-between border-b border-outline px-5 py-3 dark:border-outline-dark">
+      <span class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
+        {{ t(key="brand", lang=lang | default(value='sk')) }}
+      </span>
+      {{ ui::badge(label=t(key="auth", lang=lang | default(value='sk')), variant="primary") }}
+    </div>
+
+    <div class="p-5">
+      <h1 class="text-xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">
+        {{ t(key="login-totp-title", lang=lang | default(value='sk')) }}
+      </h1>
+      <p class="mt-2 text-sm text-on-surface dark:text-on-surface-dark">
+        {{ t(key="login-totp-intro", lang=lang | default(value='sk')) }}
+      </p>
+
+      {% if error %}
+      {{ ui::alert_danger(message=t(key="login-totp-error", lang=lang | default(value='sk')), extra="mt-3") }}
+      {% endif %}
+
+      <form method="post" action="/login/totp" hx-boost="false" class="mt-4 flex flex-col gap-4">
+        <div class="flex flex-col gap-1">
+          <label for="code"
+            class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
+            {{ t(key="login-totp-code", lang=lang | default(value='sk')) }}
+          </label>
+          {{ ui::input(name="code", id="code", type="text", required=true, autocomplete="one-time-code", attrs='inputmode="numeric" autofocus') }}
+        </div>
+        {{ ui::button(label=t(key="login-totp-submit", lang=lang | default(value='sk')), type="submit", extra="mt-1 w-full") }}
+      </form>
+
+      <p class="mt-4 text-xs text-on-surface dark:text-on-surface-dark">
+        {{ t(key="login-totp-backup-hint", lang=lang | default(value='sk')) }}
+      </p>
+    </div>
+  </div>
+</div>
+{% endblock content %}
--- a/assets/views/auth/register.html
+++ b/assets/views/auth/register.html
@@ -22,17 +22,29 @@

      {% if error == "exists" %}
      {{ ui::alert_danger(message=t(key="register-error-exists", lang=lang | default(value='sk')), extra="mt-3") }}
+      {% elif error == "mismatch" %}
+      {{ ui::alert_danger(message=t(key="set-password-mismatch", lang=lang | default(value='sk')), extra="mt-3") }}
+      {% elif error == "weak" %}
+      {{ ui::alert_danger(message=t(key="set-password-weak", lang=lang | default(value='sk')), extra="mt-3") }}
      {% elif error %}
      {{ ui::alert_danger(message=t(key="register-error-invalid", lang=lang | default(value='sk')), extra="mt-3") }}
      {% endif %}

-      <form method="post" action="/register" hx-boost="false" class="mt-4 flex flex-col gap-4">
-        <div class="flex flex-col gap-1">
-          <label for="name"
-            class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
-            {{ t(key="register-name", lang=lang | default(value='sk')) }}
-          </label>
-          {{ ui::input(name="name", id="name", required=true, autocomplete="name", attrs="autofocus") }}
+      <form method="post" action="/register" hx-boost="false" class="mt-4 flex flex-col gap-4"
+        x-data="{ password: '', confirm: '' }">
+        <div class="flex flex-col gap-1.5">
+          <span class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-type", lang=lang | default(value='sk')) }}</span>
+          <div class="grid grid-cols-2 gap-2">
+            <label class="flex cursor-pointer items-center gap-2 rounded-radius border border-outline px-3 py-2 text-sm transition has-[:checked]:border-primary dark:border-outline-dark dark:has-[:checked]:border-primary-dark">
+              {{ ui::radio(name="account_type", value="personal", checked=true) }}
+              <span class="font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-personal", lang=lang | default(value='sk')) }}</span>
+            </label>
+            <label class="flex cursor-pointer items-center gap-2 rounded-radius border border-outline px-3 py-2 text-sm transition has-[:checked]:border-primary dark:border-outline-dark dark:has-[:checked]:border-primary-dark">
+              {{ ui::radio(name="account_type", value="company") }}
+              <span class="font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-company", lang=lang | default(value='sk')) }}</span>
+            </label>
+          </div>
+          <span class="text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="account-type-locked", lang=lang | default(value='sk')) }}</span>
        </div>

        <div class="flex flex-col gap-1">
@@ -40,7 +52,7 @@
            class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
            {{ t(key="login-email", lang=lang | default(value='sk')) }}
          </label>
-          {{ ui::input(name="email", id="email", type="email", required=true, autocomplete="email") }}
+          {{ ui::input(name="email", id="email", type="email", required=true, autocomplete="email", attrs="autofocus") }}
        </div>

        <div class="flex flex-col gap-1">
@@ -48,10 +60,22 @@
            class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
            {{ t(key="login-password", lang=lang | default(value='sk')) }}
          </label>
-          {{ ui::input(name="password", id="password", type="password", required=true, autocomplete="new-password") }}
+          {{ ui::input(name="password", id="password", type="password", required=true, autocomplete="new-password", attrs='x-model="password"') }}
        </div>

-        {{ ui::button(label=t(key="register-submit", lang=lang | default(value='sk')), type="submit", extra="mt-1 w-full") }}
+        <div class="flex flex-col gap-1">
+          <label for="password_confirm"
+            class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
+            {{ t(key="set-password-confirm", lang=lang | default(value='sk')) }}
+          </label>
+          {{ ui::input(name="password_confirm", id="password_confirm", type="password", required=true, autocomplete="new-password", attrs='x-model="confirm"') }}
+          <span x-cloak x-show="confirm.length > 0 && password !== confirm"
+            class="text-xs text-danger dark:text-danger">
+            {{ t(key="set-password-mismatch", lang=lang | default(value='sk')) }}
+          </span>
+        </div>
+
+        {{ ui::button(label=t(key="register-submit", lang=lang | default(value='sk')), type="submit", extra="mt-1 w-full", attrs=':disabled="password !== confirm"') }}
      </form>

      <div class="mt-5 flex items-center gap-3 text-xs text-on-surface/50 dark:text-on-surface-dark/50">
--- a/assets/views/auth/resend_verification.html
+++ b/assets/views/auth/resend_verification.html
@@ -0,0 +1,37 @@
+{% extends "base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="resend-verification-title", lang=lang | default(value='sk')) }}{% endblock title %}
+
+{% block content %}
+<div class="mx-auto mt-8 max-w-sm">
+  <div class="rounded-radius border border-outline bg-surface-alt shadow-sm dark:border-outline-dark dark:bg-surface-dark-alt">
+    <div class="flex items-center justify-between border-b border-outline px-5 py-3 dark:border-outline-dark">
+      <span class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="brand", lang=lang | default(value='sk')) }}</span>
+      {{ ui::badge(label=t(key="auth", lang=lang | default(value='sk')), variant="primary") }}
+    </div>
+
+    <div class="p-5">
+      <h1 class="text-xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="resend-verification-title", lang=lang | default(value='sk')) }}</h1>
+
+      {% if done %}
+      <div class="mt-3 rounded-radius border border-success bg-success/10 px-4 py-3 text-sm text-success" role="status">
+        {{ t(key="resend-verification-done", lang=lang | default(value='sk')) }}
+      </div>
+      <p class="mt-4 text-sm text-on-surface dark:text-on-surface-dark">
+        <a href="/login" class="font-medium text-primary underline-offset-2 hover:underline dark:text-primary-dark">{{ t(key="nav-login", lang=lang | default(value='sk')) }}</a>
+      </p>
+      {% else %}
+      <p class="mt-1 text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="resend-verification-intro", lang=lang | default(value='sk')) }}</p>
+      <form method="post" action="/resend-verification" hx-boost="false" class="mt-4 flex flex-col gap-4">
+        <div class="flex flex-col gap-1">
+          <label for="email" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="login-email", lang=lang | default(value='sk')) }}</label>
+          {{ ui::input(name="email", id="email", type="email", required=true, autocomplete="email", attrs="autofocus") }}
+        </div>
+        {{ ui::button(label=t(key="resend-verification-submit", lang=lang | default(value='sk')), type="submit", extra="mt-1 w-full") }}
+      </form>
+      {% endif %}
+    </div>
+  </div>
+</div>
+{% endblock content %}
--- a/assets/views/auth/set_password.html
+++ b/assets/views/auth/set_password.html
@@ -0,0 +1,47 @@
+{% extends "base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="set-password-title", lang=lang | default(value='sk')) }}{% endblock title %}
+
+{% block content %}
+<div class="mx-auto mt-8 max-w-sm">
+  <div class="rounded-radius border border-outline bg-surface-alt shadow-sm dark:border-outline-dark dark:bg-surface-dark-alt">
+    <div class="flex items-center justify-between border-b border-outline px-5 py-3 dark:border-outline-dark">
+      <span class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="brand", lang=lang | default(value='sk')) }}</span>
+      {{ ui::badge(label=t(key="auth", lang=lang | default(value='sk')), variant="primary") }}
+    </div>
+
+    <div class="p-5">
+      <h1 class="text-xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="set-password-title", lang=lang | default(value='sk')) }}</h1>
+
+      {% if not valid %}
+      {{ ui::alert_danger(message=t(key="set-password-invalid", lang=lang | default(value='sk')), extra="mt-3") }}
+      <p class="mt-4 text-sm text-on-surface dark:text-on-surface-dark">
+        <a href="/login" class="font-medium text-primary underline-offset-2 hover:underline dark:text-primary-dark">{{ t(key="nav-login", lang=lang | default(value='sk')) }}</a>
+      </p>
+      {% else %}
+      <p class="mt-1 text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="set-password-intro", lang=lang | default(value='sk')) }}</p>
+
+      {% if error == "mismatch" %}
+      {{ ui::alert_danger(message=t(key="set-password-mismatch", lang=lang | default(value='sk')), extra="mt-3") }}
+      {% elif error == "weak" %}
+      {{ ui::alert_danger(message=t(key="set-password-weak", lang=lang | default(value='sk')), extra="mt-3") }}
+      {% endif %}
+
+      <form method="post" action="/set-password" hx-boost="false" class="mt-4 flex flex-col gap-4">
+        <input type="hidden" name="token" value="{{ token }}">
+        <div class="flex flex-col gap-1">
+          <label for="password" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="set-password-new", lang=lang | default(value='sk')) }}</label>
+          {{ ui::input(name="password", id="password", type="password", required=true, autocomplete="new-password", attrs="autofocus") }}
+        </div>
+        <div class="flex flex-col gap-1">
+          <label for="password_confirm" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="set-password-confirm", lang=lang | default(value='sk')) }}</label>
+          {{ ui::input(name="password_confirm", id="password_confirm", type="password", required=true, autocomplete="new-password") }}
+        </div>
+        {{ ui::button(label=t(key="set-password-submit", lang=lang | default(value='sk')), type="submit", extra="mt-1 w-full") }}
+      </form>
+      {% endif %}
+    </div>
+  </div>
+</div>
+{% endblock content %}
--- a/assets/views/base.html
+++ b/assets/views/base.html
@@ -48,6 +48,12 @@
        if (!v) return 0;
        return v.split(',').reduce(function (s, e) { return s + (parseInt(e.split(':')[1]) || 0) }, 0);
      }
+      // True while any other navbar menu (profile / settings / mobile / category
+      // toggle) is open — those triggers expose aria-expanded="true". Used to
+      // suppress the cart hover preview so menus don't stack/overlap.
+      function anyMenuOpen() {
+        return !!document.querySelector('header [aria-expanded="true"]');
+      }
      // Show a floating toast notification. Usage: toast('Saved').
      // Bridges to the vendored Penguin UI toast component, which listens for a
      // `notify` event with { variant, title, message }.
@@ -57,6 +63,9 @@
    </script>
    <link href="/static/css/app.css?v=2026-06-16" rel="stylesheet" type="text/css">
    <script src="/static/vendor/htmx/htmx-1.9.12.min.js"></script>
+    <!-- Alpine Focus plugin (x-trap / $focus) — must load before Alpine core;
+         required by the Penguin UI keyboard-accessible dropdowns. -->
+    <script defer src="/static/vendor/alpine/alpine-focus-3.14.9.min.js"></script>
    <script defer src="/static/vendor/alpine/alpinejs-3.14.9.min.js"></script>
  </head>
  <body hx-boost="true"
@@ -86,12 +95,7 @@
            </form>
          </li>
          {% elif logged_in_customer %}
-          <li>{{ ui::nav_link(label=t(key="nav-profile", lang=lang | default(value='sk')), href="/account/profile", data_nav="/account") }}</li>
-          <li>
-            <form method="post" action="/logout" hx-boost="false">
-              <button type="submit" class="text-sm font-medium text-danger underline-offset-2 transition hover:opacity-75 focus:outline-hidden focus-visible:underline">{{ t(key="logout", lang=lang | default(value='sk')) }}</button>
-            </form>
-          </li>
+          {# customer account links live in the profile dropdown next to the cart #}
          {% else %}
          <li>{{ ui::nav_link(label=t(key="nav-login", lang=lang | default(value='sk')), href="/login", data_nav="/login") }}</li>
          <li>{{ ui::nav_link(label=t(key="nav-register", lang=lang | default(value='sk')), href="/register", data_nav="/register") }}</li>
@@ -99,23 +103,47 @@
        </ul>

        <!-- right side: cart + settings + mobile toggle -->
-        <div class="ml-auto flex items-center gap-1">
-          <!-- cart with live item-count badge read from the `cart` cookie -->
-          <a href="/cart" data-nav="/cart"
-            x-data="{ count: 0 }"
-            x-init="count = cartCount(); ['htmx:afterSwap', 'htmx:afterRequest'].forEach(function (e) { window.addEventListener(e, function () { count = cartCount() }) })"
-            aria-label="{{ t(key='cart-title', lang=lang | default(value='sk')) }}"
-            title="{{ t(key='cart-title', lang=lang | default(value='sk')) }}"
-            class="relative inline-flex size-9 shrink-0 items-center justify-center rounded-radius bg-transparent text-secondary transition hover:opacity-75 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-secondary active:opacity-100 active:outline-offset-0 dark:text-secondary-dark dark:focus-visible:outline-secondary-dark">
-            {{ ui::icon(name="cart") }}
-            <span x-show="count > 0" x-cloak x-text="count"
-              class="absolute -right-1 -top-1 inline-flex min-w-4 items-center justify-center rounded-full bg-primary px-1 text-[10px] font-semibold leading-4 text-on-primary dark:bg-primary-dark dark:text-on-primary-dark"></span>
-          </a>
-          <!-- settings (language + theme) dropdown -->
-          <div x-data="{ open: false }" @keydown.escape="open = false" class="relative">
-            {% include "partials/settings_dropdown.html" %}
+        <div class="ml-auto flex items-center gap-3">
+          <!-- customer profile dropdown (avatar + name + account type) -->
+          {% if logged_in_customer %}
+          {% include "partials/profile_menu.html" %}
+          {% endif %}
+          <!-- cart: hover opens an Alza-style mini-cart preview (Penguin
+               dropdown-with-hover), lazy-loaded from /partials/cart on each hover
+               so it's always fresh. Click still does a full navigation to /cart
+               (hx-boost=false; the explicit hx-trigger is mouseenter, so click is
+               not an htmx trigger). The badge reads the `cart` cookie client-side. -->
+          <div x-data="{ isOpen: false, leaveTimeout: null }"
+            x-on:mouseleave="leaveTimeout = setTimeout(() => isOpen = false, 250)"
+            x-on:mouseenter="leaveTimeout && clearTimeout(leaveTimeout)"
+            x-on:keydown.esc.window="isOpen = false"
+            class="relative">
+            <a href="/cart" data-nav="/cart" hx-boost="false"
+              x-on:mouseenter="if (!anyMenuOpen()) isOpen = true"
+              x-data="{ count: 0 }"
+              x-init="count = cartCount(); ['htmx:afterSwap', 'htmx:afterRequest'].forEach(function (e) { window.addEventListener(e, function () { count = cartCount() }) })"
+              hx-get="/partials/cart" hx-trigger="mouseenter delay:150ms" hx-target="#cart-preview-body" hx-swap="innerHTML"
+              aria-label="{{ t(key='cart-title', lang=lang | default(value='sk')) }}"
+              title="{{ t(key='cart-title', lang=lang | default(value='sk')) }}"
+              class="relative inline-flex size-9 shrink-0 items-center justify-center rounded-radius bg-transparent text-secondary transition hover:opacity-75 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-secondary active:opacity-100 active:outline-offset-0 dark:text-secondary-dark dark:focus-visible:outline-secondary-dark">
+              {{ ui::icon(name="cart") }}
+              <span x-show="count > 0" x-cloak x-text="count"
+                class="absolute -right-1 -top-1 inline-flex min-w-4 items-center justify-center rounded-full bg-primary px-1 text-[10px] font-semibold leading-4 text-on-primary dark:bg-primary-dark dark:text-on-primary-dark"></span>
+            </a>
+            <!-- hover preview panel (no id on the panel → not htmx-settled on boosted nav) -->
+            <div x-cloak x-show="isOpen" x-transition
+              x-on:mouseenter="isOpen = true"
+              class="absolute right-0 mt-2 w-80 overflow-hidden rounded-radius border border-outline bg-surface-alt shadow-lg dark:border-outline-dark dark:bg-surface-dark-alt"
+              role="dialog" aria-label="{{ t(key='cart-title', lang=lang | default(value='sk')) }}">
+              <div id="cart-preview-body">
+                <div class="px-4 py-10 text-center text-sm text-on-surface dark:text-on-surface-dark">…</div>
+              </div>
+            </div>
          </div>

+          <!-- settings (language + theme) dropdown (self-contained Alpine state) -->
+          {% include "partials/settings_dropdown.html" %}
+
          <!-- mobile hamburger — Penguin animated icon swap (bars ↔ X), kept in
               our ghost-square icon-button shell for consistency with cart/gear -->
          <button type="button" @click="mobile = !mobile" :aria-expanded="mobile" aria-label="{{ t(key='menu', lang=lang | default(value='sk')) }}"
@@ -158,6 +186,23 @@
      class="fixed inset-0 z-30 bg-black/50 lg:hidden"></div>

    <div class="mx-auto flex w-full max-w-7xl gap-8 px-4 py-8">
+      {% if account_nav %}
+      <!-- account-area sidebar: replaces the storefront categories while the
+           customer is inside /account/*. -->
+      <aside x-cloak x-show="cats || lg" aria-label="{{ t(key='nav-account', lang=lang | default(value='sk')) }}"
+        class="fixed inset-y-0 left-0 z-40 w-64 overflow-y-auto border-r border-outline bg-surface-alt p-4 lg:static lg:z-auto lg:w-64 lg:shrink-0 lg:self-start lg:overflow-visible lg:rounded-radius lg:border lg:p-3 dark:border-outline-dark dark:bg-surface-dark-alt">
+        <h2 class="px-3 pb-2 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="nav-account", lang=lang | default(value='sk')) }}</h2>
+        <ul class="space-y-1">
+          <li><a href="/account/orders" data-nav="/account/orders" class="block rounded-radius px-3 py-2 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-primary focus:outline-hidden focus-visible:underline aria-[current=page]:font-semibold aria-[current=page]:bg-primary/10 aria-[current=page]:text-primary dark:text-on-surface-dark dark:hover:text-primary-dark dark:aria-[current=page]:text-primary-dark">{{ t(key="account-orders", lang=lang | default(value='sk')) }}</a></li>
+          <li><a href="/account/profile" data-nav="/account/profile" class="block rounded-radius px-3 py-2 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-primary focus:outline-hidden focus-visible:underline aria-[current=page]:font-semibold aria-[current=page]:bg-primary/10 aria-[current=page]:text-primary dark:text-on-surface-dark dark:hover:text-primary-dark dark:aria-[current=page]:text-primary-dark">{{ t(key="profile-title", lang=lang | default(value='sk')) }}</a></li>
+          <li><a href="/account/password" data-nav="/account/password" class="block rounded-radius px-3 py-2 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-primary focus:outline-hidden focus-visible:underline aria-[current=page]:font-semibold aria-[current=page]:bg-primary/10 aria-[current=page]:text-primary dark:text-on-surface-dark dark:hover:text-primary-dark dark:aria-[current=page]:text-primary-dark">{{ t(key="account-change-password", lang=lang | default(value='sk')) }}</a></li>
+          <li><a href="/account/security" data-nav="/account/security" class="block rounded-radius px-3 py-2 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-primary focus:outline-hidden focus-visible:underline aria-[current=page]:font-semibold aria-[current=page]:bg-primary/10 aria-[current=page]:text-primary dark:text-on-surface-dark dark:hover:text-primary-dark dark:aria-[current=page]:text-primary-dark">{{ t(key="security-title", lang=lang | default(value='sk')) }}</a></li>
+        </ul>
+        <form method="post" action="/logout" hx-boost="false" class="mt-4 border-t border-outline pt-3 dark:border-outline-dark">
+          <button type="submit" class="block w-full rounded-radius px-3 py-2 text-left text-sm font-medium text-danger underline-offset-2 transition hover:bg-primary/5 focus:outline-hidden focus-visible:underline">{{ t(key="logout", lang=lang | default(value='sk')) }}</button>
+        </form>
+      </aside>
+      {% else %}
      <!-- persistent category sidebar (off-canvas drawer on mobile).
           hx-preserve keeps this node across boosted page swaps, so it is
           fetched once (hx-trigger=load) and never reloaded on navigation. -->
@@ -166,6 +211,7 @@
        hx-get="/partials/categories" hx-trigger="load"
        class="fixed inset-y-0 left-0 z-40 w-64 overflow-y-auto border-r border-outline bg-surface-alt p-4 lg:static lg:z-auto lg:w-64 lg:shrink-0 lg:self-start lg:overflow-visible lg:rounded-radius lg:border lg:p-3 dark:border-outline-dark dark:bg-surface-dark-alt">
      </aside>
+      {% endif %}

      <main class="min-w-0 flex-1">
        {% block content %}{% endblock content %}
--- a/assets/views/macros/ui.html
+++ b/assets/views/macros/ui.html
@@ -82,6 +82,11 @@
 {# Compact danger alert (form/inline errors). Adapted from
   penguinui/alert/default-alert.html (danger variant), trimmed to a single line
   with the danger icon. #}
+{# Required-field marker: a red asterisk appended to a field label. #}
+{% macro req() -%}
+<span class="ml-0.5 text-danger" aria-hidden="true">*</span>
+{%- endmacro req %}
+
 {% macro alert_danger(message, extra="") -%}
 <div class="flex w-full items-center gap-2 overflow-hidden rounded-radius border border-danger bg-danger/10 px-3 py-2 text-sm text-danger {{ extra }}" role="alert">
  <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" class="size-5 shrink-0" aria-hidden="true">
--- a/assets/views/partials/profile_menu.html
+++ b/assets/views/partials/profile_menu.html
@@ -0,0 +1,77 @@
+{# Customer profile dropdown in the storefront navbar.
+
+   Proper Penguin UI dropdown: behaviour is the vendored
+   dropdowns/dropdown-with-icons.html verbatim (isOpen / openedWithKeyboard,
+   x-trap + $focus keyboard nav, x-cloak x-show, @click.outside). Trigger is the
+   round initials avatar (avatar-with-initials.html, primary variant). Menu items
+   are our account links.
+
+   Needs the Alpine Focus plugin (loaded before Alpine core in base.html) for
+   x-trap / $focus. Self-contained Alpine state; the host only needs to place it
+   in the navbar flex row. The panel has NO id on purpose — an id would make htmx
+   hx-boost "settle" it across boosted navigations and reappear; id-less Penguin
+   dropdowns are unaffected. #}
+
+{# initials from the full name, e.g. "Filip Priec" -> "FP" #}
+{% set _name = customer_name | default(value='') | trim %}
+{% set _parts = _name | split(pat=' ') %}
+{% set _initials = _parts.0 | truncate(length=1, end='') | upper %}
+{% if _parts | length > 1 %}{% set _second = _parts | last | truncate(length=1, end='') | upper %}{% set _initials = _initials ~ _second %}{% endif %}
+{% if customer_account_type == "company" %}{% set _type_label = t(key="account-company", lang=lang | default(value='sk')) %}{% else %}{% set _type_label = t(key="account-personal", lang=lang | default(value='sk')) %}{% endif %}
+
+{% set _person_icon = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor" class="size-5"><path fill-rule="evenodd" d="M7.5 6a4.5 4.5 0 119 0 4.5 4.5 0 01-9 0zM3.751 20.105a8.25 8.25 0 0116.498 0 .75.75 0 01-.437.695A18.683 18.683 0 0112 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 01-.437-.695z" clip-rule="evenodd"/></svg>' %}
+
+<div x-data="{ isOpen: false, openedWithKeyboard: false }"
+  x-on:keydown.esc.window="isOpen = false, openedWithKeyboard = false"
+  class="relative">
+  <!-- Toggle Button: round initials avatar -->
+  <button type="button" x-on:click="isOpen = ! isOpen"
+    x-on:keydown.space.prevent="openedWithKeyboard = true" x-on:keydown.enter.prevent="openedWithKeyboard = true" x-on:keydown.down.prevent="openedWithKeyboard = true"
+    x-bind:aria-expanded="isOpen || openedWithKeyboard" aria-haspopup="true"
+    aria-label="{{ t(key='nav-account', lang=lang | default(value='sk')) }}"
+    class="flex size-9 shrink-0 items-center justify-center overflow-hidden rounded-full border border-primary bg-primary text-sm font-bold tracking-wider text-on-primary/90 transition hover:opacity-90 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary dark:border-primary-dark dark:bg-primary-dark dark:text-on-primary-dark/90 dark:focus-visible:outline-primary-dark">
+    {%- if _initials %}{{ _initials }}{% else %}{{ _person_icon | safe }}{% endif -%}
+  </button>
+  <!-- Dropdown Menu (positioned like the settings cog: right-0 mt-2) -->
+  <div x-cloak x-show="isOpen || openedWithKeyboard" x-transition x-trap="openedWithKeyboard"
+    x-on:click.outside="isOpen = false, openedWithKeyboard = false"
+    x-on:keydown.down.prevent="$focus.wrap().next()" x-on:keydown.up.prevent="$focus.wrap().previous()"
+    class="absolute right-0 mt-2 flex w-60 min-w-48 flex-col divide-y divide-outline overflow-hidden rounded-radius border border-outline bg-surface-alt shadow-lg dark:divide-outline-dark dark:border-outline-dark dark:bg-surface-dark-alt" role="menu">
+    <!-- header: avatar + name + account type -->
+    <div class="flex items-center gap-3 px-4 py-2.5">
+      <span class="flex size-11 shrink-0 items-center justify-center overflow-hidden rounded-full border border-primary bg-primary text-base font-bold tracking-wider text-on-primary/90 dark:border-primary-dark dark:bg-primary-dark dark:text-on-primary-dark/90">
+        {%- if _initials %}{{ _initials }}{% else %}{{ _person_icon | safe }}{% endif -%}
+      </span>
+      <div class="flex min-w-0 flex-col">
+        <span class="truncate text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ _name }}</span>
+        <p class="truncate text-xs text-on-surface dark:text-on-surface-dark">{{ _type_label }}</p>
+      </div>
+    </div>
+    <!-- account links (with icons) -->
+    <div class="flex flex-col py-1.5">
+      <a href="/account/orders" data-nav="/account/orders" role="menuitem" class="flex items-center gap-2 bg-surface-alt px-4 py-2 text-sm text-on-surface hover:bg-surface-dark-alt/5 hover:text-on-surface-strong focus-visible:bg-surface-dark-alt/10 focus-visible:text-on-surface-strong focus-visible:outline-hidden dark:bg-surface-dark-alt dark:text-on-surface-dark dark:hover:bg-surface-alt/5 dark:hover:text-on-surface-dark-strong dark:focus-visible:bg-surface-alt/10 dark:focus-visible:text-on-surface-dark-strong">
+        {{ ui::icon(name="cart", size="size-4", extra="shrink-0") }}
+        {{ t(key="account-orders", lang=lang | default(value='sk')) }}
+      </a>
+      <a href="/account/profile" data-nav="/account/profile" role="menuitem" class="flex items-center gap-2 bg-surface-alt px-4 py-2 text-sm text-on-surface hover:bg-surface-dark-alt/5 hover:text-on-surface-strong focus-visible:bg-surface-dark-alt/10 focus-visible:text-on-surface-strong focus-visible:outline-hidden dark:bg-surface-dark-alt dark:text-on-surface-dark dark:hover:bg-surface-alt/5 dark:hover:text-on-surface-dark-strong dark:focus-visible:bg-surface-alt/10 dark:focus-visible:text-on-surface-dark-strong">
+        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor" class="size-4 shrink-0"><path fill-rule="evenodd" d="M7.5 6a4.5 4.5 0 119 0 4.5 4.5 0 01-9 0zM3.751 20.105a8.25 8.25 0 0116.498 0 .75.75 0 01-.437.695A18.683 18.683 0 0112 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 01-.437-.695z" clip-rule="evenodd"/></svg>
+        {{ t(key="profile-title", lang=lang | default(value='sk')) }}
+      </a>
+      <a href="/account/password" data-nav="/account/password" role="menuitem" class="flex items-center gap-2 bg-surface-alt px-4 py-2 text-sm text-on-surface hover:bg-surface-dark-alt/5 hover:text-on-surface-strong focus-visible:bg-surface-dark-alt/10 focus-visible:text-on-surface-strong focus-visible:outline-hidden dark:bg-surface-dark-alt dark:text-on-surface-dark dark:hover:bg-surface-alt/5 dark:hover:text-on-surface-dark-strong dark:focus-visible:bg-surface-alt/10 dark:focus-visible:text-on-surface-dark-strong">
+        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor" class="size-4 shrink-0"><path fill-rule="evenodd" d="M15.75 1.5a6.75 6.75 0 00-6.651 7.906c.067.39-.032.717-.221.906l-6.5 6.499a3 3 0 00-.878 2.121v2.818c0 .414.336.75.75.75H6a.75.75 0 00.75-.75v-1.5h1.5A.75.75 0 009 21v-1.5h1.5a.75.75 0 00.53-.22l2.658-2.658c.19-.189.517-.288.906-.22A6.75 6.75 0 1015.75 1.5zm0 3a.75.75 0 000 1.5A2.25 2.25 0 0118 8.25a.75.75 0 001.5 0 3.75 3.75 0 00-3.75-3.75z" clip-rule="evenodd"/></svg>
+        {{ t(key="account-change-password", lang=lang | default(value='sk')) }}
+      </a>
+      <a href="/account/security" data-nav="/account/security" role="menuitem" class="flex items-center gap-2 bg-surface-alt px-4 py-2 text-sm text-on-surface hover:bg-surface-dark-alt/5 hover:text-on-surface-strong focus-visible:bg-surface-dark-alt/10 focus-visible:text-on-surface-strong focus-visible:outline-hidden dark:bg-surface-dark-alt dark:text-on-surface-dark dark:hover:bg-surface-alt/5 dark:hover:text-on-surface-dark-strong dark:focus-visible:bg-surface-alt/10 dark:focus-visible:text-on-surface-dark-strong">
+        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor" class="size-4 shrink-0"><path fill-rule="evenodd" d="M12 1.5a5.25 5.25 0 00-5.25 5.25v3a3 3 0 00-3 3v6.75a3 3 0 003 3h10.5a3 3 0 003-3v-6.75a3 3 0 00-3-3v-3c0-2.9-2.35-5.25-5.25-5.25zm3.75 8.25v-3a3.75 3.75 0 10-7.5 0v3h7.5z" clip-rule="evenodd"/></svg>
+        {{ t(key="security-title", lang=lang | default(value='sk')) }}
+      </a>
+    </div>
+    <!-- logout -->
+    <div class="flex flex-col py-1.5">
+      <form method="post" action="/logout" hx-boost="false"><button type="submit" role="menuitem" class="flex w-full items-center gap-2 bg-surface-alt px-4 py-2 text-left text-sm text-on-surface hover:bg-surface-dark-alt/5 hover:text-on-surface-strong focus-visible:bg-surface-dark-alt/10 focus-visible:text-on-surface-strong focus-visible:outline-hidden dark:bg-surface-dark-alt dark:text-on-surface-dark dark:hover:bg-surface-alt/5 dark:hover:text-on-surface-dark-strong dark:focus-visible:bg-surface-alt/10 dark:focus-visible:text-on-surface-dark-strong">
+        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor" class="size-4 shrink-0"><path fill-rule="evenodd" d="M7.5 3.75A1.5 1.5 0 006 5.25v13.5a1.5 1.5 0 001.5 1.5h6a1.5 1.5 0 001.5-1.5V15a.75.75 0 011.5 0v3.75a3 3 0 01-3 3h-6a3 3 0 01-3-3V5.25a3 3 0 013-3h6a3 3 0 013 3V9A.75.75 0 0115 9V5.25a1.5 1.5 0 00-1.5-1.5h-6zm10.72 4.72a.75.75 0 011.06 0l3 3a.75.75 0 010 1.06l-3 3a.75.75 0 11-1.06-1.06l1.72-1.72H9a.75.75 0 010-1.5h10.94l-1.72-1.72a.75.75 0 010-1.06z" clip-rule="evenodd"/></svg>
+        {{ t(key="logout", lang=lang | default(value='sk')) }}
+      </button></form>
+    </div>
+  </div>
+</div>
--- a/assets/views/partials/settings_dropdown.html
+++ b/assets/views/partials/settings_dropdown.html
@@ -1,18 +1,22 @@
 {# Settings dropdown (language + theme). Shared by base.html and admin/base.html
   to kill the former ~100-line copy-paste duplication.

-   Adapted from the vendored Penguin UI component
-   penguinui-components/dropdowns/dropdown-with-click.html: Penguin's dropdown
-   menu container + item treatment. Deviations: kept our gear icon-only trigger
-   and our core-Alpine open / @click.outside toggle (upstream's x-trap / $focus
-   need the Alpine Focus plugin, which we don't bundle); item hover uses
-   bg-primary/5 to stay consistent with the rest of our Penguin-ified UI.
+   Proper Penguin UI dropdown: behaviour is the vendored
+   dropdowns/dropdown-with-icons.html verbatim (isOpen / openedWithKeyboard,
+   x-trap + $focus keyboard nav, x-cloak x-show, @click.outside). Trigger is our
+   gear icon-only button; content is the language form + theme toggle. Needs the
+   Alpine Focus plugin (loaded in base.html) for x-trap / $focus.

-   The host template provides the wrapper
-   <div x-data="{ open: false }" @keydown.escape="open = false" class="relative ...">
-   so it controls its own positioning (e.g. ml-auto in admin). #}
-{{ ui::icon_button(aria_label=t(key='settings', lang=lang | default(value='sk')), attrs='@click="open = !open" :aria-expanded="open"', icon='<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="size-5"><path stroke-linecap="round" stroke-linejoin="round" d="M9.594 3.94c.09-.542.56-.94 1.11-.94h2.593c.55 0 1.02.398 1.11.94l.213 1.281c.063.374.313.686.645.87.074.04.147.083.22.127.324.196.72.257 1.075.124l1.217-.456a1.125 1.125 0 0 1 1.37.49l1.296 2.247a1.125 1.125 0 0 1-.26 1.431l-1.003.827c-.293.241-.438.613-.43.992a7.723 7.723 0 0 1 0 .255c-.008.378.137.75.43.991l1.004.827c.424.35.534.955.26 1.43l-1.298 2.247a1.125 1.125 0 0 1-1.369.491l-1.217-.456c-.355-.133-.75-.072-1.076.124a6.47 6.47 0 0 1-.22.128c-.331.183-.581.495-.644.869l-.213 1.281c-.09.543-.56.94-1.11.94h-2.594c-.55 0-1.019-.398-1.11-.94l-.213-1.281c-.062-.374-.312-.686-.644-.87a6.52 6.52 0 0 1-.22-.127c-.325-.196-.72-.257-1.076-.124l-1.217.456a1.125 1.125 0 0 1-1.369-.49l-1.297-2.247a1.125 1.125 0 0 1 .26-1.431l1.004-.827c.292-.24.437-.613.43-.991a6.932 6.932 0 0 1 0-.255c.007-.38-.138-.751-.43-.992l-1.004-.827a1.125 1.125 0 0 1-.26-1.43l1.297-2.247a1.125 1.125 0 0 1 1.37-.491l1.216.456c.356.133.751.072 1.076-.124.072-.044.146-.086.22-.128.332-.183.582-.495.644-.869l.214-1.28Z" /><path stroke-linecap="round" stroke-linejoin="round" d="M15 12a3 3 0 1 1-6 0 3 3 0 0 1 6 0Z" /></svg>') }}
-<div x-show="open" x-cloak @click.outside="open = false" x-transition.origin.top.right
+   Self-contained Alpine state + relative positioning; the host only places it
+   (e.g. ml-auto in admin). The panel has NO id on purpose (see profile_menu.html
+   for why — htmx hx-boost settles by id). #}
+<div x-data="{ isOpen: false, openedWithKeyboard: false }"
+  x-on:keydown.esc.window="isOpen = false, openedWithKeyboard = false"
+  class="relative">
+{{ ui::icon_button(aria_label=t(key='settings', lang=lang | default(value='sk')), attrs='x-on:click="isOpen = ! isOpen" x-on:keydown.space.prevent="openedWithKeyboard = true" x-on:keydown.enter.prevent="openedWithKeyboard = true" x-on:keydown.down.prevent="openedWithKeyboard = true" x-bind:aria-expanded="isOpen || openedWithKeyboard" aria-haspopup="true"', icon='<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="size-5"><path stroke-linecap="round" stroke-linejoin="round" d="M9.594 3.94c.09-.542.56-.94 1.11-.94h2.593c.55 0 1.02.398 1.11.94l.213 1.281c.063.374.313.686.645.87.074.04.147.083.22.127.324.196.72.257 1.075.124l1.217-.456a1.125 1.125 0 0 1 1.37.49l1.296 2.247a1.125 1.125 0 0 1-.26 1.431l-1.003.827c-.293.241-.438.613-.43.992a7.723 7.723 0 0 1 0 .255c-.008.378.137.75.43.991l1.004.827c.424.35.534.955.26 1.43l-1.298 2.247a1.125 1.125 0 0 1-1.369.491l-1.217-.456c-.355-.133-.75-.072-1.076.124a6.47 6.47 0 0 1-.22.128c-.331.183-.581.495-.644.869l-.213 1.281c-.09.543-.56.94-1.11.94h-2.594c-.55 0-1.019-.398-1.11-.94l-.213-1.281c-.062-.374-.312-.686-.644-.87a6.52 6.52 0 0 1-.22-.127c-.325-.196-.72-.257-1.076-.124l-1.217.456a1.125 1.125 0 0 1-1.369-.49l-1.297-2.247a1.125 1.125 0 0 1 .26-1.431l1.004-.827c.292-.24.437-.613.43-.991a6.932 6.932 0 0 1 0-.255c.007-.38-.138-.751-.43-.992l-1.004-.827a1.125 1.125 0 0 1-.26-1.43l1.297-2.247a1.125 1.125 0 0 1 1.37-.491l1.216.456c.356.133.751.072 1.076-.124.072-.044.146-.086.22-.128.332-.183.582-.495.644-.869l.214-1.28Z" /><path stroke-linecap="round" stroke-linejoin="round" d="M15 12a3 3 0 1 1-6 0 3 3 0 0 1 6 0Z" /></svg>') }}
+<div x-cloak x-show="isOpen || openedWithKeyboard" x-transition x-trap="openedWithKeyboard"
+  x-on:click.outside="isOpen = false, openedWithKeyboard = false"
+  x-on:keydown.down.prevent="$focus.wrap().next()" x-on:keydown.up.prevent="$focus.wrap().previous()"
  class="absolute right-0 mt-2 flex w-56 flex-col overflow-hidden rounded-radius border border-outline bg-surface-alt py-1 shadow-lg dark:border-outline-dark dark:bg-surface-dark-alt"
  role="menu">
  <form method="post" action="/lang" hx-boost="false">
@@ -54,3 +58,4 @@
    </label>
  </div>
 </div>
+</div>
--- a/assets/views/shop/_cart_body.html
+++ b/assets/views/shop/_cart_body.html
@@ -62,7 +62,7 @@

 <div class="mt-6 flex flex-wrap justify-between gap-3">
  {{ ui::button(variant="outline-secondary", label=t(key="cart-continue", lang=lang | default(value='sk')), href="/shop") }}
-  {{ ui::button(label=t(key="cart-checkout", lang=lang | default(value='sk')), href="/checkout", size="px-5 py-2 text-sm") }}
+  {{ ui::button(label=t(key="cart-checkout", lang=lang | default(value='sk')), href="/checkout", size="px-5 py-2 text-sm", attrs='hx-boost="false"') }}
 </div>
 {% else %}
 <div class="rounded-radius border border-outline px-6 py-16 text-center dark:border-outline-dark">
--- a/assets/views/shop/_cart_preview.html
+++ b/assets/views/shop/_cart_preview.html
@@ -0,0 +1,31 @@
+{# Mini-cart preview shown on hover over the navbar cart (Alza-style).
+   Lazy-loaded via htmx from /partials/cart into the hover dropdown panel in
+   base.html. Receives: items[], total, currency, lang. #}
+{% import "macros/ui.html" as ui %}
+{% if items | length > 0 %}
+<div class="max-h-80 divide-y divide-outline overflow-y-auto dark:divide-outline-dark">
+  {% for item in items %}
+  <div class="flex items-start gap-3 px-4 py-3">
+    <div class="min-w-0 flex-1">
+      <a href="/shop/{{ item.slug }}" class="block truncate text-sm font-medium text-on-surface-strong hover:text-primary dark:text-on-surface-dark-strong dark:hover:text-primary-dark">{{ item.name }}</a>
+      <p class="mt-0.5 text-xs tabular-nums text-on-surface dark:text-on-surface-dark">{{ item.quantity }} × {{ item.price }} {{ item.currency }}</p>
+    </div>
+    <span class="shrink-0 text-sm font-semibold tabular-nums text-on-surface-strong dark:text-on-surface-dark-strong">{{ item.line_total }} {{ item.currency }}</span>
+  </div>
+  {% endfor %}
+</div>
+<div class="border-t border-outline px-4 py-3 dark:border-outline-dark">
+  <div class="mb-3 flex items-center justify-between">
+    <span class="text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="cart-total", lang=lang | default(value='sk')) }}</span>
+    <span class="text-base font-bold tabular-nums text-primary dark:text-primary-dark">{{ total }} {{ currency }}</span>
+  </div>
+  <div class="flex gap-2">
+    {{ ui::button(href="/cart", variant="outline-primary", label=t(key="cart-title", lang=lang | default(value='sk')), extra="flex-1", attrs='hx-boost="false"') }}
+    {{ ui::button(href="/checkout", variant="primary", label=t(key="cart-checkout", lang=lang | default(value='sk')), extra="flex-1", attrs='hx-boost="false"') }}
+  </div>
+</div>
+{% else %}
+<div class="px-4 py-10 text-center text-sm text-on-surface dark:text-on-surface-dark">
+  {{ t(key="cart-empty", lang=lang | default(value='sk')) }}
+</div>
+{% endif %}
--- a/assets/views/shop/checkout.html
+++ b/assets/views/shop/checkout.html
@@ -32,9 +32,20 @@
  class="mt-6 grid gap-8 lg:grid-cols-3">

  <div class="space-y-6 lg:col-span-2">
-    <!-- personal vs company -->
+    <!-- personal vs company. Fixed (read-only) for a logged-in account; a guest
+         picks it and the choice will type any account they create. -->
    <fieldset class="space-y-3 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-type", lang=lang | default(value='sk')) }}</legend>
+      {% if account_fixed %}
+      <div class="flex items-center gap-2">
+        {% if prefill_account_type == "company" %}
+        {{ ui::badge(label=t(key="account-company", lang=lang | default(value='sk')), variant="primary") }}
+        {% else %}
+        {{ ui::badge(label=t(key="account-personal", lang=lang | default(value='sk')), variant="neutral") }}
+        {% endif %}
+        <span class="text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="account-type-locked", lang=lang | default(value='sk')) }}</span>
+      </div>
+      {% else %}
      <div class="grid gap-3 sm:grid-cols-2">
        <label class="flex cursor-pointer items-center gap-3 rounded-radius border border-outline px-4 py-3 transition has-[:checked]:border-primary dark:border-outline-dark dark:has-[:checked]:border-primary-dark">
          {{ ui::radio(name="account_type", value="personal", attrs='x-model="accountType"') }}
@@ -45,22 +56,23 @@
          <span class="font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-company", lang=lang | default(value='sk')) }}</span>
        </label>
      </div>
+      {% endif %}
    </fieldset>

    <!-- company billing details (company accounts only) -->
    <fieldset x-show="accountType === 'company'" x-cloak class="space-y-4 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-company-details", lang=lang | default(value='sk')) }}</legend>
      <div class="space-y-1.5">
-        <label for="company_name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-name", lang=lang | default(value='sk')) }}</label>
+        <label for="company_name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-name", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
        {{ ui::input(name="company_name", id="company_name", value=prefill_company_name | default(value=''), autocomplete="organization") }}
      </div>
      <div class="grid gap-4 sm:grid-cols-3">
        <div class="space-y-1.5">
-          <label for="company_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-ico", lang=lang | default(value='sk')) }}</label>
+          <label for="company_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-ico", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
          {{ ui::input(name="company_id", id="company_id", value=prefill_company_id | default(value='')) }}
        </div>
        <div class="space-y-1.5">
-          <label for="tax_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-dic", lang=lang | default(value='sk')) }}</label>
+          <label for="tax_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="company-dic", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
          {{ ui::input(name="tax_id", id="tax_id", value=prefill_tax_id | default(value='')) }}
        </div>
        <div class="space-y-1.5">
@@ -74,15 +86,15 @@
    <fieldset class="space-y-4 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-contact", lang=lang | default(value='sk')) }}</legend>
      <div class="space-y-1.5">
-        <label for="email" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-email", lang=lang | default(value='sk')) }}</label>
+        <label for="email" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-email", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
        {{ ui::input(name="email", id="email", type="email", value=prefill_email | default(value=''), required=true, autocomplete="email") }}
      </div>
      <div class="space-y-1.5">
-        <label for="customer_name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-name", lang=lang | default(value='sk')) }}</label>
+        <label for="customer_name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-name", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
        {{ ui::input(name="customer_name", id="customer_name", value=prefill_name | default(value=''), required=true, autocomplete="name") }}
      </div>
      <div class="space-y-1.5">
-        <label for="phone" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-phone", lang=lang | default(value='sk')) }}</label>
+        <label for="phone" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-phone", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
        <div class="flex gap-2">
          <!-- editable combobox: type freely or pick from the dropdown -->
          <div class="relative w-28 shrink-0" @click.outside="prefixOpen = false"
@@ -119,20 +131,20 @@
    <fieldset class="space-y-4 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-shipping", lang=lang | default(value='sk')) }}</legend>
      <div class="space-y-1.5">
-        <label for="address" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-address", lang=lang | default(value='sk')) }}</label>
+        <label for="address" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-address", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
        {{ ui::input(name="address", id="address", value=prefill_address | default(value=''), required=true, autocomplete="street-address") }}
      </div>
      <div class="grid gap-4 sm:grid-cols-3">
        <div class="space-y-1.5">
-          <label for="city" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-city", lang=lang | default(value='sk')) }}</label>
+          <label for="city" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-city", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
          {{ ui::input(name="city", id="city", value=prefill_city | default(value=''), required=true, autocomplete="address-level2") }}
        </div>
        <div class="space-y-1.5">
-          <label for="zip" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-zip", lang=lang | default(value='sk')) }}</label>
+          <label for="zip" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-zip", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
          {{ ui::input(name="zip", id="zip", value=prefill_zip | default(value=''), required=true, autocomplete="postal-code") }}
        </div>
        <div class="space-y-1.5">
-          <label for="country" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-country", lang=lang | default(value='sk')) }}</label>
+          <label for="country" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-country", lang=lang | default(value='sk')) }}{{ ui::req() }}</label>
          <div class="relative" @click.outside="countryOpen = false"
            x-data="{ countryOpen: false, country: '{{ prefill_country | default(value=t(key='country-sk', lang=lang | default(value='sk'))) }}', opts: [
              { v: '{{ t(key='country-sk', lang=lang | default(value='sk')) }}', l: '🇸🇰 {{ t(key='country-sk', lang=lang | default(value='sk')) }}' },
@@ -165,7 +177,7 @@

    <!-- carrier -->
    <fieldset class="space-y-3 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
-      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-carrier", lang=lang | default(value='sk')) }}</legend>
+      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-carrier", lang=lang | default(value='sk')) }}{{ ui::req() }}</legend>
      {% for m in shipping_methods %}
      <label class="flex cursor-pointer items-center justify-between gap-3 rounded-radius border border-outline px-4 py-3 transition has-[:checked]:border-primary dark:border-outline-dark dark:has-[:checked]:border-primary-dark">
        <span class="flex items-center gap-3">
@@ -201,7 +213,7 @@

    <!-- payment -->
    <fieldset class="space-y-3 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
-      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-payment", lang=lang | default(value='sk')) }}</legend>
+      <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="checkout-payment", lang=lang | default(value='sk')) }}{{ ui::req() }}</legend>
      <label class="flex cursor-pointer items-center gap-3 rounded-radius border border-outline px-4 py-3 transition has-[:checked]:border-primary dark:border-outline-dark dark:has-[:checked]:border-primary-dark">
        {{ ui::radio(name="payment_method", value="cod", attrs='required x-model="paymentMethod"') }}
        <span class="font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="payment-cod", lang=lang | default(value='sk')) }}</span>
@@ -217,9 +229,18 @@
      {{ ui::textarea(name="note", id="note", rows="3") }}
    </div>

-    {% if logged_in_customer %}
-    <!-- logged-in customers can persist this address to their profile for next time -->
-    {{ ui::checkbox(name="save_profile", id="save_profile", label=t(key="checkout-save-profile", lang=lang | default(value='sk')), checked=true) }}
+    {% if logged_in_customer and not profile_filled %}
+    <!-- offered only when the profile has no saved address yet; if it was filled
+         in advance we leave it untouched -->
+    {{ ui::checkbox(name="save_profile", id="save_profile", label=t(key="checkout-save-profile", lang=lang | default(value='sk'))) }}
+    {% endif %}
+
+    {% if can_create_account %}
+    <!-- guests may turn this order into an account (typed by their choice above) -->
+    <div class="space-y-1.5 rounded-radius border border-outline bg-surface p-4 dark:border-outline-dark dark:bg-surface-dark-alt">
+      {{ ui::checkbox(name="create_account", id="create_account", label=t(key="checkout-create-account", lang=lang | default(value='sk'))) }}
+      <p class="pl-6 text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="checkout-create-account-hint", lang=lang | default(value='sk')) }}</p>
+    </div>
    {% endif %}
  </div>

--- a/assets/views/shop/order_confirmed.html
+++ b/assets/views/shop/order_confirmed.html
@@ -15,6 +15,12 @@
    <p class="mt-1 text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="order-confirmed-sub", lang=lang | default(value='sk')) }}</p>
  </div>

+  {% if account_created %}
+  <div class="rounded-radius border border-primary/40 bg-primary/5 p-4 text-sm text-on-surface dark:border-primary-dark/40 dark:text-on-surface-dark" role="status">
+    {{ t(key="order-account-created", lang=lang | default(value='sk')) }}
+  </div>
+  {% endif %}
+
  <div class="rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
    <div class="flex flex-wrap justify-between gap-2 border-b border-outline pb-3 dark:border-outline-dark">
      <span class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="order-number", lang=lang | default(value='sk')) }}</span>
--- a/config/development.yaml
+++ b/config/development.yaml
@@ -45,19 +45,24 @@ workers:

 # Mailer Configuration.
 mailer:
-  # SMTP mailer configuration.
+  # SMTP mailer configuration. Defaults target a local catcher (MailHog/Mailpit
+  # on localhost:1025); set the SMTP_* env vars to point at a real server. The
+  # auth block is only emitted when SMTP_PASSWORD is provided, so the secret is
+  # never stored here — pass it in at launch (e.g. from `pass`).
  smtp:
    # Enable/Disable smtp mailer.
-    enable: true
+    enable: {{ get_env(name="SMTP_ENABLE", default="true") }}
    # SMTP server host. e.x localhost, smtp.gmail.com
-    host: localhost
+    host: "{{ get_env(name="SMTP_HOST", default="localhost") }}"
    # SMTP server port
-    port: 1025
+    port: {{ get_env(name="SMTP_PORT", default="1025") }}
    # Use secure connection (SSL/TLS).
-    secure: false
-    # auth:
-    #   user:
-    #   password:
+    secure: {{ get_env(name="SMTP_SECURE", default="false") }}
+{% if get_env(name="SMTP_PASSWORD", default="") != "" %}
+    auth:
+      user: "{{ get_env(name="SMTP_USER", default="") }}"
+      password: "{{ get_env(name="SMTP_PASSWORD", default="") }}"
+{% endif %}
    # Override the SMTP hello name (default is the machine's hostname)
    # hello_name:

--- a/config/test.yaml
+++ b/config/test.yaml
@@ -42,33 +42,58 @@ workers:
  

 # Mailer Configuration.
+# Defaults keep the whole suite on the in-memory stub mailer. The real-SMTP
+# smoke test (tests/mailer/smtp_send.rs) opts in by setting these env vars
+# before boot; nothing else in the suite sends real mail.
 mailer:
-  stub: true
+  stub: {{ get_env(name="MAILER_STUB", default="true") }}
  # SMTP mailer configuration.
  smtp:
    # Enable/Disable smtp mailer.
-    enable: true
+    enable: {{ get_env(name="SMTP_ENABLE", default="true") }}
    # SMTP server host. e.x localhost, smtp.gmail.com
-    host: localhost
+    host: "{{ get_env(name="SMTP_HOST", default="localhost") }}"
    # SMTP server port
-    port: 1025
+    port: {{ get_env(name="SMTP_PORT", default="1025") }}
    # Use secure connection (SSL/TLS).
-    secure: false
-    # auth:
-    #   user:
-    #   password:
+    secure: {{ get_env(name="SMTP_SECURE", default="false") }}
+    auth:
+      user: "{{ get_env(name="SMTP_USER", default="") }}"
+      password: "{{ get_env(name="SMTP_PASSWORD", default="") }}"

 # Initializers Configuration
-# initializers:
-#  oauth2:
-#    authorization_code: # Authorization code grant type
-#      - client_identifier: google # Identifier for the OAuth2 provider. Replace 'google' with your provider's name if different, must be unique within the oauth2 config.
-#        ... other fields
+# OAuth2StoreInitializer requires this block to boot (it builds the client store
+# in after_routes). Static, non-secret placeholders: tests never perform a real
+# OAuth2 handshake, they just need the store to construct successfully.
+initializers:
+  oauth2:
+    # Private-cookie key: a ", "-separated list of >=64 byte values (not a
+    # plain string). This is loco-oauth2's documented sample key; fine for tests.
+    secret_key: "144, 76, 183, 1, 15, 184, 233, 174, 214, 251, 190, 186, 122, 61, 74, 84, 225, 110, 189, 115, 10, 251, 133, 128, 52, 46, 15, 66, 85, 1, 245, 73, 27, 113, 189, 15, 209, 205, 61, 100, 73, 31, 18, 58, 235, 105, 141, 36, 70, 92, 231, 151, 27, 32, 243, 117, 30, 244, 110, 89, 233, 196, 137, 130"
+    authorization_code:
+      - client_identifier: google
+        client_credentials:
+          client_id: test-client-id
+          client_secret: test-client-secret
+        url_config:
+          auth_url: https://accounts.google.com/o/oauth2/auth
+          token_url: https://www.googleapis.com/oauth2/v3/token
+          redirect_url: http://localhost:5150/api/oauth2/google/callback
+          profile_url: https://openidconnect.googleapis.com/v1/userinfo
+          scopes:
+            - https://www.googleapis.com/auth/userinfo.email
+            - https://www.googleapis.com/auth/userinfo.profile
+        cookie_config:
+          protected_url: http://localhost:5150/
+        timeout_seconds: 600

 # Database Configuration
 database:
-  # Database connection URI
-  uri: {{ get_env(name="DATABASE_URL", default="postgres://uni_loco_web_user:3@localhost:5432/kompress_eshop_test") }}
+  # Database connection URI. Pinned to the throwaway test DB and intentionally
+  # NOT read from `DATABASE_URL`: the app loads `.env` on boot (app.rs
+  # `load_config`), and this config has `dangerously_recreate: true`, so honoring
+  # an env override here would let `cargo test` recreate the dev/prod database.
+  uri: "postgres://uni_loco_web_user:3@localhost:5432/kompress_eshop_test"
  # When enabled, the sql query will be logged.
  enable_logging: false
  # Set the timeout duration when acquiring a connection.
--- a/migration/src/lib.rs
+++ b/migration/src/lib.rs
@@ -33,6 +33,8 @@ mod m20260617_000003_add_phone_to_orders;
 mod m20260618_000001_o_auth2_sessions;
 mod m20260618_000002_customer_profiles;
 mod m20260618_000003_account_type;
+mod m20260618_000004_account_ownership;
+mod m20260620_000001_add_totp_to_users;
 pub struct Migrator;

 #[async_trait::async_trait]
@@ -70,6 +72,8 @@ impl MigratorTrait for Migrator {
            Box::new(m20260618_000001_o_auth2_sessions::Migration),
            Box::new(m20260618_000002_customer_profiles::Migration),
            Box::new(m20260618_000003_account_type::Migration),
+            Box::new(m20260618_000004_account_ownership::Migration),
+            Box::new(m20260620_000001_add_totp_to_users::Migration),
            // inject-above (do not remove this comment)
        ]
    }
--- a/migration/src/m20260618_000004_account_ownership.rs
+++ b/migration/src/m20260618_000004_account_ownership.rs
@@ -0,0 +1,38 @@
+use loco_rs::schema::*;
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+// Account type becomes a permanent property of the *user* (chosen at
+// registration, never switchable), so it moves off `customer_profiles`. Orders
+// gain a nullable `user_id` linking them to the account that placed them
+// (null for guest orders that didn't create an account).
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        add_column(
+            m,
+            "users",
+            "account_type",
+            ColType::StringWithDefault("personal".to_string()),
+        )
+        .await?;
+        add_column(m, "orders", "user_id", ColType::IntegerNull).await?;
+        remove_column(m, "customer_profiles", "account_type").await?;
+        Ok(())
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        add_column(
+            m,
+            "customer_profiles",
+            "account_type",
+            ColType::StringWithDefault("personal".to_string()),
+        )
+        .await?;
+        remove_column(m, "orders", "user_id").await?;
+        remove_column(m, "users", "account_type").await?;
+        Ok(())
+    }
+}
--- a/migration/src/m20260620_000001_add_totp_to_users.rs
+++ b/migration/src/m20260620_000001_add_totp_to_users.rs
@@ -0,0 +1,32 @@
+use loco_rs::schema::*;
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+// Optional TOTP (Google Authenticator) two-factor auth. All three columns are
+// nullable and only populated once a user opts in:
+//   - `totp_secret`         base32 shared secret; present while enrolling/enabled.
+//                           TODO(security): stored PLAINTEXT and is password-
+//                           equivalent (must stay reversible to recompute codes).
+//                           Encrypt at rest later with an out-of-DB key. See the
+//                           TODO(security) block in src/models/users.rs.
+//   - `totp_enabled_at`     NULL = 2FA off. Set only after the user confirms a
+//                           code, so a half-finished enrollment never gates login.
+//   - `totp_backup_codes`   JSON array of hashed one-time recovery codes.
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        add_column(m, "users", "totp_secret", ColType::TextNull).await?;
+        add_column(m, "users", "totp_enabled_at", ColType::TimestampWithTimeZoneNull).await?;
+        add_column(m, "users", "totp_backup_codes", ColType::TextNull).await?;
+        Ok(())
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        remove_column(m, "users", "totp_backup_codes").await?;
+        remove_column(m, "users", "totp_enabled_at").await?;
+        remove_column(m, "users", "totp_secret").await?;
+        Ok(())
+    }
+}
--- a/src/controllers/account.rs
+++ b/src/controllers/account.rs
@@ -2,21 +2,35 @@
 //! fields prefill the checkout form. Gated to authenticated non-admin users:
 //! anonymous visitors are bounced to `/login`. Admins have their own area and
 //! are sent to the dashboard.
+//!
+//! The account *type* (personal vs company) is fixed at registration and lives
+//! on the user — it is shown here read-only and can never be changed. The
+//! profile only edits the type-specific details (company identity + address).

 use axum_extra::extract::cookie::CookieJar;
 use loco_rs::prelude::*;
+use sea_orm::QueryOrder;
 use serde::Deserialize;
 use serde_json::json;

 use crate::{
    controllers::i18n::current_lang,
-    models::customer_profiles::{self, ProfileFields},
-    shared::guard,
+    models::{
+        customer_profiles::{self, ProfileFields},
+        order_items, orders, users,
+    },
+    shared::{guard, settings},
+    views::checkout as order_view,
 };

+/// Active (still-being-fulfilled) order statuses. Anything else
+/// (`delivered`, `cancelled`) is considered closed/past.
+const ACTIVE_STATUSES: [&str; 3] = ["pending", "paid", "shipped"];
+
 #[derive(Debug, Deserialize)]
 struct ProfileForm {
-    account_type: Option<String>,
+    first_name: Option<String>,
+    last_name: Option<String>,
    company_name: Option<String>,
    company_id: Option<String>,
    tax_id: Option<String>,
@@ -33,68 +47,104 @@ fn trimmed(value: Option<&str>) -> Option<String> {
    value.map(str::trim).filter(|v| !v.is_empty()).map(String::from)
 }

-/// Normalize an account type to one of the two known values, defaulting to
-/// "personal" for anything unexpected.
-pub fn normalize_account_type(value: Option<&str>) -> String {
-    match value.map(str::trim) {
-        Some("company") => "company".to_string(),
-        _ => "personal".to_string(),
+/// Split a stored full name into (first name, surname). The surname is
+/// everything after the first whitespace, so multi-word surnames round-trip.
+fn split_name(name: &str) -> (String, String) {
+    match name.trim().split_once(char::is_whitespace) {
+        Some((first, rest)) => (first.to_string(), rest.trim().to_string()),
+        None => (name.trim().to_string(), String::new()),
    }
 }

-impl From<ProfileForm> for ProfileFields {
-    fn from(form: ProfileForm) -> Self {
-        let is_company = normalize_account_type(form.account_type.as_deref()) == "company";
-        // Company identifiers are only stored for company accounts, so switching
-        // back to personal clears stale data.
-        let company = |v: Option<&str>| if is_company { trimmed(v) } else { None };
-        Self {
-            account_type: normalize_account_type(form.account_type.as_deref()),
-            company_name: company(form.company_name.as_deref()),
-            company_id: company(form.company_id.as_deref()),
-            tax_id: company(form.tax_id.as_deref()),
-            vat_id: company(form.vat_id.as_deref()),
-            phone_prefix: trimmed(form.phone_prefix.as_deref()),
-            phone: trimmed(form.phone.as_deref()),
-            address: trimmed(form.address.as_deref()),
-            city: trimmed(form.city.as_deref()),
-            zip: trimmed(form.zip.as_deref()),
-            country: trimmed(form.country.as_deref()),
-        }
+/// Recombine the two name fields into the single stored `name`. Returns `None`
+/// when the result is too short to be a valid name (the user can't blank it out).
+fn full_name_from_form(form: &ProfileForm) -> Option<String> {
+    let first = form.first_name.as_deref().unwrap_or("").trim();
+    let last = form.last_name.as_deref().unwrap_or("").trim();
+    let full = format!("{first} {last}").trim().to_string();
+    (full.chars().count() >= 2).then_some(full)
+}
+
+/// Build the persisted fields from the submitted form. Company identifiers are
+/// only kept for company accounts (a personal account can never carry them).
+fn fields_from_form(form: &ProfileForm, is_company: bool) -> ProfileFields {
+    let company = |v: Option<&str>| if is_company { trimmed(v) } else { None };
+    ProfileFields {
+        company_name: company(form.company_name.as_deref()),
+        company_id: company(form.company_id.as_deref()),
+        tax_id: company(form.tax_id.as_deref()),
+        vat_id: company(form.vat_id.as_deref()),
+        phone_prefix: trimmed(form.phone_prefix.as_deref()),
+        phone: trimmed(form.phone.as_deref()),
+        address: trimmed(form.address.as_deref()),
+        city: trimmed(form.city.as_deref()),
+        zip: trimmed(form.zip.as_deref()),
+        country: trimmed(form.country.as_deref()),
    }
 }

-/// Render the profile form for `profile` (which may be `None` for a customer
-/// who hasn't saved anything yet). `saved` shows the success banner after a
-/// POST.
+/// The profile fields held by a saved profile, for re-prefilling the form.
+fn fields_of(profile: Option<&customer_profiles::Model>) -> ProfileFields {
+    match profile {
+        Some(p) => ProfileFields {
+            company_name: p.company_name.clone(),
+            company_id: p.company_id.clone(),
+            tax_id: p.tax_id.clone(),
+            vat_id: p.vat_id.clone(),
+            phone_prefix: p.phone_prefix.clone(),
+            phone: p.phone.clone(),
+            address: p.address.clone(),
+            city: p.city.clone(),
+            zip: p.zip.clone(),
+            country: p.country.clone(),
+        },
+        None => ProfileFields::default(),
+    }
+}
+
+/// A company account must carry its invoicing identity (company name + IČO +
+/// DIČ; IČ DPH stays optional). Personal accounts have no such requirement.
+fn company_fields_missing(fields: &ProfileFields) -> bool {
+    fields.company_name.is_none() || fields.company_id.is_none() || fields.tax_id.is_none()
+}
+
+/// Render the profile form for `user`, prefilled from `fields`. `saved` shows
+/// the success banner; `error` shows the company-required validation message.
 fn profile_view(
    v: &TeraView,
    jar: &CookieJar,
-    name: &str,
-    email: &str,
-    profile: Option<&customer_profiles::Model>,
+    user: &users::Model,
+    fields: &ProfileFields,
    saved: bool,
+    error: bool,
 ) -> Result<Response> {
+    let (first_name, last_name) = split_name(&user.name);
    format::view(
        v,
        "account/profile.html",
        json!({
            "logged_in_admin": false,
            "logged_in_customer": true,
+            "account_nav": true,
+            "customer_name": user.name,
+            "customer_account_type": user.account_type,
            "saved": saved,
-            "name": name,
-            "email": email,
-            "account_type": profile.map_or("personal", |p| p.account_type.as_str()),
-            "company_name": profile.and_then(|p| p.company_name.clone()),
-            "company_id": profile.and_then(|p| p.company_id.clone()),
-            "tax_id": profile.and_then(|p| p.tax_id.clone()),
-            "vat_id": profile.and_then(|p| p.vat_id.clone()),
-            "phone_prefix": profile.and_then(|p| p.phone_prefix.clone()),
-            "phone": profile.and_then(|p| p.phone.clone()),
-            "address": profile.and_then(|p| p.address.clone()),
-            "city": profile.and_then(|p| p.city.clone()),
-            "zip": profile.and_then(|p| p.zip.clone()),
-            "country": profile.and_then(|p| p.country.clone()),
+            "error": error,
+            "name": user.name,
+            "first_name": first_name,
+            "last_name": last_name,
+            "email": user.email,
+            "account_type": user.account_type,
+            "company_name": fields.company_name,
+            "company_id": fields.company_id,
+            "tax_id": fields.tax_id,
+            "vat_id": fields.vat_id,
+            "phone_prefix": fields.phone_prefix,
+            "phone": fields.phone,
+            "address": fields.address,
+            "city": fields.city,
+            "zip": fields.zip,
+            "country": fields.country,
            "lang": current_lang(jar),
        }),
    )
@@ -113,7 +163,7 @@ async fn profile_page(
        return format::redirect("/admin/dashboard");
    }
    let profile = customer_profiles::Model::find_for_user(&ctx.db, user.id).await?;
-    profile_view(&v, &jar, &user.name, &user.email, profile.as_ref(), false)
+    profile_view(&v, &jar, &user, &fields_of(profile.as_ref()), false, false)
 }

 #[debug_handler]
@@ -129,12 +179,372 @@ async fn save_profile(
    if guard::is_admin(&ctx, &user) {
        return format::redirect("/admin/dashboard");
    }
-    let profile = customer_profiles::Model::upsert(&ctx.db, user.id, form.into()).await?;
-    profile_view(&v, &jar, &user.name, &user.email, Some(&profile), true)
+    // Apply the edited name to a working copy so it's reflected on both the
+    // success and re-rendered-error views. A blank/too-short name is ignored —
+    // the field can't be cleared.
+    let mut user = user;
+    let new_name = full_name_from_form(&form).filter(|n| *n != user.name);
+    if let Some(name) = new_name.clone() {
+        user.name = name;
+    }
+    let fields = fields_from_form(&form, user.is_company());
+    // A company account's profile is rejected (and re-shown with the entered
+    // values) until it carries its required identifiers.
+    if user.is_company() && company_fields_missing(&fields) {
+        return profile_view(&v, &jar, &user, &fields, false, true);
+    }
+    if let Some(name) = new_name {
+        let mut active = user.clone().into_active_model();
+        active.name = ActiveValue::set(name);
+        active.update(&ctx.db).await?;
+    }
+    customer_profiles::Model::upsert(&ctx.db, user.id, fields.clone()).await?;
+    profile_view(&v, &jar, &user, &fields, true, false)
+}
+
+/// Lists the signed-in customer's orders, split into still-active and past.
+#[debug_handler]
+async fn orders_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    let Some(user) = guard::current_user(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if guard::is_admin(&ctx, &user) {
+        return format::redirect("/admin/dashboard");
+    }
+    let rows = orders::Entity::find()
+        .filter(orders::Column::UserId.eq(user.id))
+        .order_by_desc(orders::Column::CreatedAt)
+        .all(&ctx.db)
+        .await?;
+    let (active, past): (Vec<_>, Vec<_>) = rows
+        .iter()
+        .partition(|o| ACTIVE_STATUSES.contains(&o.status.as_str()));
+    let shape = |list: Vec<&orders::Model>| -> Vec<_> {
+        list.into_iter().map(order_view::summary).collect()
+    };
+
+    format::view(
+        &v,
+        "account/orders.html",
+        json!({
+            "logged_in_admin": false,
+            "logged_in_customer": true,
+            "account_nav": true,
+            "customer_name": user.name,
+            "customer_account_type": user.account_type,
+            "active_orders": shape(active),
+            "past_orders": shape(past),
+            "lang": current_lang(&jar),
+        }),
+    )
+}
+
+/// Shows a single order belonging to the signed-in customer. Orders owned by
+/// someone else (or guest orders) are not found here.
+#[debug_handler]
+async fn order_detail_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Path(order_number): Path<String>,
+) -> Result<Response> {
+    let Some(user) = guard::current_user(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if guard::is_admin(&ctx, &user) {
+        return format::redirect("/admin/dashboard");
+    }
+    let order = orders::Entity::find()
+        .filter(orders::Column::OrderNumber.eq(order_number))
+        .one(&ctx.db)
+        .await?
+        .filter(|o| o.user_id == Some(user.id))
+        .ok_or_else(|| Error::NotFound)?;
+    let items = order_items::Entity::find()
+        .filter(order_items::Column::OrderId.eq(order.id))
+        .all(&ctx.db)
+        .await?;
+
+    format::view(
+        &v,
+        "account/order_detail.html",
+        json!({
+            "logged_in_admin": false,
+            "logged_in_customer": true,
+            "account_nav": true,
+            "customer_name": user.name,
+            "customer_account_type": user.account_type,
+            "order": order_view::detail(
+                &order,
+                settings::get(&ctx, "bank_iban").unwrap_or(""),
+                settings::get(&ctx, "bank_account_name").unwrap_or(""),
+            ),
+            "items": order_view::items(&items),
+            "lang": current_lang(&jar),
+        }),
+    )
+}
+
+#[derive(Debug, Deserialize)]
+struct ChangePasswordForm {
+    current_password: String,
+    password: String,
+    password_confirm: String,
+}
+
+fn password_view(
+    v: &TeraView,
+    jar: &CookieJar,
+    user: &users::Model,
+    changed: bool,
+    error: Option<&str>,
+) -> Result<Response> {
+    format::view(
+        v,
+        "account/password.html",
+        json!({
+            "logged_in_admin": false,
+            "logged_in_customer": true,
+            "account_nav": true,
+            "customer_name": user.name,
+            "customer_account_type": user.account_type,
+            "changed": changed,
+            "error": error,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn change_password_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    let Some(user) = guard::current_user(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if guard::is_admin(&ctx, &user) {
+        return format::redirect("/admin/dashboard");
+    }
+    password_view(&v, &jar, &user, false, None)
+}
+
+#[debug_handler]
+async fn change_password(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<ChangePasswordForm>,
+) -> Result<Response> {
+    let Some(user) = guard::current_user(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if guard::is_admin(&ctx, &user) {
+        return format::redirect("/admin/dashboard");
+    }
+    if !user.verify_password(&form.current_password) {
+        return password_view(&v, &jar, &user, false, Some("current"));
+    }
+    if form.password != form.password_confirm {
+        return password_view(&v, &jar, &user, false, Some("mismatch"));
+    }
+    if form.password.len() < 8 {
+        return password_view(&v, &jar, &user, false, Some("weak"));
+    }
+    let user = user
+        .into_active_model()
+        .reset_password(&ctx.db, &form.password)
+        .await?;
+    password_view(&v, &jar, &user, true, None)
+}
+
+// ---- Two-factor authentication (TOTP / Google Authenticator) -------------
+//
+// Entirely opt-in. The security page has three shapes, all rendered from
+// `security.html`:
+//   * disabled  -> an "enable" button,
+//   * enrolling -> the QR + a confirm-code field (secret staged, not yet on),
+//   * enabled   -> status, remaining backup codes, disable/regenerate forms.
+// Both turning 2FA off and regenerating backup codes require re-entering the
+// account password, so a walk-up attacker on an open session can't weaken it.
+
+#[derive(Debug, Deserialize)]
+struct ConfirmTotpForm {
+    code: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct PasswordConfirmForm {
+    current_password: String,
+}
+
+/// Render the security page. Exactly one of (`enrolling`, plain status) applies;
+/// `backup_codes` is non-empty only on the one render right after enabling or
+/// regenerating, where the plaintext codes are shown once.
+#[allow(clippy::too_many_arguments)]
+fn security_view(
+    v: &TeraView,
+    jar: &CookieJar,
+    user: &users::Model,
+    enrolling: bool,
+    qr: Option<&str>,
+    secret: Option<&str>,
+    backup_codes: &[String],
+    error: Option<&str>,
+) -> Result<Response> {
+    format::view(
+        v,
+        "account/security.html",
+        json!({
+            "logged_in_admin": false,
+            "logged_in_customer": true,
+            "account_nav": true,
+            "customer_name": user.name,
+            "customer_account_type": user.account_type,
+            "totp_enabled": user.totp_enabled(),
+            "enrolling": enrolling,
+            "qr": qr,
+            "secret": secret,
+            "backup_codes": backup_codes,
+            "backup_remaining": user.backup_codes_remaining(),
+            "error": error,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+/// Common guard for every security handler: a signed-in, non-admin customer.
+async fn require_customer(ctx: &AppContext, jar: &CookieJar) -> Result<users::Model> {
+    match guard::current_user(ctx, jar).await {
+        Some(user) if guard::is_admin(ctx, &user) => Err(Error::string("admin")),
+        Some(user) => Ok(user),
+        None => Err(Error::Unauthorized("login required".into())),
+    }
+}
+
+#[debug_handler]
+async fn security_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    let Some(user) = guard::current_user(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if guard::is_admin(&ctx, &user) {
+        return format::redirect("/admin/dashboard");
+    }
+    security_view(&v, &jar, &user, false, None, None, &[], None)
+}
+
+/// Stage a fresh secret and show the QR + confirm-code field.
+#[debug_handler]
+async fn enable_totp(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    let Ok(user) = require_customer(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    // Already on — nothing to enroll.
+    if user.totp_enabled() {
+        return security_view(&v, &jar, &user, false, None, None, &[], None);
+    }
+    let user = user.into_active_model().begin_totp_enrollment(&ctx.db).await?;
+    let Some((qr, secret)) = user.totp_provisioning() else {
+        return security_view(&v, &jar, &user, false, None, None, &[], Some("enroll"));
+    };
+    security_view(&v, &jar, &user, true, Some(&qr), Some(&secret), &[], None)
+}
+
+/// Verify the first code against the staged secret; on success flip 2FA on and
+/// show the one-time backup codes. On a wrong code, re-show the QR to retry.
+#[debug_handler]
+async fn confirm_totp(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<ConfirmTotpForm>,
+) -> Result<Response> {
+    let Ok(user) = require_customer(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if user.totp_enabled() {
+        return security_view(&v, &jar, &user, false, None, None, &[], None);
+    }
+    if !user.verify_totp_code(&form.code) {
+        let qr = user.totp_provisioning();
+        let (qr, secret) = match &qr {
+            Some((q, s)) => (Some(q.as_str()), Some(s.as_str())),
+            None => (None, None),
+        };
+        return security_view(&v, &jar, &user, true, qr, secret, &[], Some("code"));
+    }
+    let (user, backup_codes) = user.into_active_model().enable_totp(&ctx.db).await?;
+    security_view(&v, &jar, &user, false, None, None, &backup_codes, None)
+}
+
+/// Turn 2FA off — requires the account password as confirmation.
+#[debug_handler]
+async fn disable_totp(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<PasswordConfirmForm>,
+) -> Result<Response> {
+    let Ok(user) = require_customer(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if !user.totp_enabled() {
+        return security_view(&v, &jar, &user, false, None, None, &[], None);
+    }
+    if !user.verify_password(&form.current_password) {
+        return security_view(&v, &jar, &user, false, None, None, &[], Some("password"));
+    }
+    let user = user.into_active_model().disable_totp(&ctx.db).await?;
+    security_view(&v, &jar, &user, false, None, None, &[], None)
+}
+
+/// Issue a fresh set of backup codes (invalidating the old ones) — also gated by
+/// the account password.
+#[debug_handler]
+async fn regenerate_backup_codes(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<PasswordConfirmForm>,
+) -> Result<Response> {
+    let Ok(user) = require_customer(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if !user.totp_enabled() {
+        return security_view(&v, &jar, &user, false, None, None, &[], None);
+    }
+    if !user.verify_password(&form.current_password) {
+        return security_view(&v, &jar, &user, false, None, None, &[], Some("password"));
+    }
+    let (user, backup_codes) =
+        user.into_active_model().regenerate_backup_codes(&ctx.db).await?;
+    security_view(&v, &jar, &user, false, None, None, &backup_codes, None)
 }

 pub fn routes() -> Routes {
    Routes::new()
        .add("/account/profile", get(profile_page))
        .add("/account/profile", post(save_profile))
+        .add("/account/orders", get(orders_page))
+        .add("/account/orders/{order_number}", get(order_detail_page))
+        .add("/account/password", get(change_password_page))
+        .add("/account/password", post(change_password))
+        .add("/account/security", get(security_page))
+        .add("/account/security/enable", post(enable_totp))
+        .add("/account/security/confirm", post(confirm_totp))
+        .add("/account/security/disable", post(disable_totp))
+        .add("/account/security/backup-codes", post(regenerate_backup_codes))
 }
--- a/src/controllers/admin_orders.rs
+++ b/src/controllers/admin_orders.rs
@@ -14,7 +14,8 @@ use crate::{
    shared::{guard, settings},
 };

-pub(crate) const ORDER_STATUSES: [&str; 4] = ["pending", "paid", "shipped", "cancelled"];
+pub(crate) const ORDER_STATUSES: [&str; 5] =
+    ["pending", "paid", "shipped", "delivered", "cancelled"];

 /// Fallback parcel weight when products carry no weight of their own.
 const DEFAULT_PARCEL_WEIGHT_GRAMS: i32 = 1000;
--- a/src/controllers/auth.rs
+++ b/src/controllers/auth.rs
@@ -13,6 +13,13 @@ use time::Duration as TimeDuration;

 pub static EMAIL_DOMAIN_RE: OnceLock<Regex> = OnceLock::new();
 pub(crate) const AUTH_COOKIE: &str = "auth_token";
+/// Short-lived cookie that carries a half-authenticated session between the
+/// password step and the TOTP step. It is a *separate* name from `auth_token`
+/// on purpose: the auth guards only read `auth_token`, so this cookie can never
+/// authenticate a request on its own — it only proves the password step passed.
+pub(crate) const TOTP_PENDING_COOKIE: &str = "totp_pending";
+/// How long the user has to enter their 2FA code after the password step.
+pub(crate) const TOTP_PENDING_TTL_SECS: u64 = 300;

 fn get_allow_email_domain_re() -> &'static Regex {
    EMAIL_DOMAIN_RE.get_or_init(|| {
@@ -38,6 +45,24 @@ pub(crate) fn clear_auth_cookie() -> Cookie<'static> {
        .build()
 }

+pub(crate) fn totp_pending_cookie(token: &str, max_age_seconds: u64) -> Cookie<'static> {
+    Cookie::build((TOTP_PENDING_COOKIE, token.to_string()))
+        .path("/")
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .max_age(TimeDuration::seconds(max_age_seconds as i64))
+        .build()
+}
+
+pub(crate) fn clear_totp_pending_cookie() -> Cookie<'static> {
+    Cookie::build((TOTP_PENDING_COOKIE, ""))
+        .path("/")
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .max_age(TimeDuration::seconds(0))
+        .build()
+}
+
 #[derive(Debug, Deserialize, Serialize)]
 pub struct ForgotParams {
    pub email: String,
--- a/src/controllers/auth_pages.rs
+++ b/src/controllers/auth_pages.rs
@@ -85,6 +85,23 @@ async fn login(
    }

    let jwt_secret = ctx.config.get_jwt_config()?;
+
+    // If the user opted into 2FA, the password is only the first factor: don't
+    // issue the real auth cookie yet. Hand out a short-lived, separate "pending"
+    // cookie and send them to the code-entry page. Everyone without 2FA logs in
+    // in a single step exactly as before.
+    if user.totp_enabled() {
+        let pending = user
+            .generate_jwt(&jwt_secret.secret, auth_controller::TOTP_PENDING_TTL_SECS)
+            .or_else(|_| unauthorized("unauthorized!"))?;
+        return format::render()
+            .cookies(&[auth_controller::totp_pending_cookie(
+                &pending,
+                auth_controller::TOTP_PENDING_TTL_SECS,
+            )])?
+            .redirect("/login/totp");
+    }
+
    let token = user
        .generate_jwt(&jwt_secret.secret, jwt_secret.expiration)
        .or_else(|_| unauthorized("unauthorized!"))?;
@@ -94,6 +111,89 @@ async fn login(
        .redirect(home_for(&ctx, &user))
 }

+/// Resolve the user behind a valid, unexpired `totp_pending` cookie. Returns
+/// `None` (never errors) when the cookie is missing, malformed, or expired —
+/// the caller bounces such requests back to `/login`.
+async fn user_from_pending(ctx: &AppContext, jar: &CookieJar) -> Option<users::Model> {
+    let cookie = jar.get(auth_controller::TOTP_PENDING_COOKIE)?;
+    let jwt_config = ctx.config.get_jwt_config().ok()?;
+    let claims = loco_rs::auth::jwt::JWT::new(&jwt_config.secret)
+        .validate(cookie.value())
+        .ok()?;
+    let user = users::Model::find_by_pid(&ctx.db, &claims.claims.pid).await.ok()?;
+    // Defend against a stale pending cookie outliving a 2FA disable.
+    user.totp_enabled().then_some(user)
+}
+
+fn login_totp_view(v: &TeraView, jar: &CookieJar, error: Option<&str>) -> Result<Response> {
+    format::view(
+        v,
+        "auth/login_totp.html",
+        json!({
+            "error": error,
+            "logged_in_admin": false,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn login_totp_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    if user_from_pending(&ctx, &jar).await.is_none() {
+        return format::redirect("/login");
+    }
+    login_totp_view(&v, &jar, None)
+}
+
+/// Second login factor. Accepts either a 6-digit authenticator code or one of
+/// the one-time backup codes (auto-detected by length). On success the pending
+/// cookie is cleared and the real `auth_token` is issued.
+#[derive(Debug, serde::Deserialize)]
+struct TotpLoginForm {
+    code: String,
+}
+
+#[debug_handler]
+async fn login_totp(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<TotpLoginForm>,
+) -> Result<Response> {
+    let Some(user) = user_from_pending(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+
+    let code = form.code.trim();
+    let via_totp = user.verify_totp_code(code);
+    let via_backup = !via_totp && user.matches_backup_code(code);
+
+    if !via_totp && !via_backup {
+        return login_totp_view(&v, &jar, Some("invalid"));
+    }
+
+    // A used backup code must be burned so it can't be replayed.
+    if via_backup {
+        user.clone().into_active_model().consume_backup_code(&ctx.db, code).await?;
+    }
+
+    let jwt_secret = ctx.config.get_jwt_config()?;
+    let token = user
+        .generate_jwt(&jwt_secret.secret, jwt_secret.expiration)
+        .or_else(|_| unauthorized("unauthorized!"))?;
+
+    format::render()
+        .cookies(&[
+            auth_controller::auth_cookie(&token, jwt_secret.expiration),
+            auth_controller::clear_totp_pending_cookie(),
+        ])?
+        .redirect(home_for(&ctx, &user))
+}
+
 #[debug_handler]
 async fn register_page(
    jar: CookieJar,
@@ -106,13 +206,50 @@ async fn register_page(
    register_view(&v, &jar, None)
 }

+/// Registration form. The name is no longer collected from the user — it is
+/// derived from the email — and the password is entered twice to guard against
+/// typos.
+#[derive(Debug, serde::Deserialize)]
+struct RegisterForm {
+    email: String,
+    password: String,
+    password_confirm: String,
+    #[serde(default)]
+    account_type: Option<String>,
+}
+
+/// Derive a display name from an email address (its local part), falling back to
+/// the full address when the local part is too short for the name validator.
+fn name_from_email(email: &str) -> String {
+    let local = email.split('@').next().unwrap_or("").trim();
+    if local.chars().count() >= 2 {
+        local.to_string()
+    } else {
+        email.trim().to_string()
+    }
+}
+
 #[debug_handler]
 async fn register(
    jar: CookieJar,
    ViewEngine(v): ViewEngine<TeraView>,
    State(ctx): State<AppContext>,
-    Form(params): Form<RegisterParams>,
+    Form(form): Form<RegisterForm>,
 ) -> Result<Response> {
+    if form.password != form.password_confirm {
+        return register_view(&v, &jar, Some("mismatch"));
+    }
+    if form.password.len() < 8 {
+        return register_view(&v, &jar, Some("weak"));
+    }
+
+    let params = RegisterParams {
+        name: name_from_email(&form.email),
+        email: form.email,
+        password: form.password,
+        account_type: form.account_type,
+    };
+
    let user = match users::Model::create_with_password(&ctx.db, &params).await {
        Ok(user) => user,
        Err(ModelError::EntityAlreadyExists {}) => {
@@ -185,6 +322,127 @@ fn verified_view(v: &TeraView, jar: &CookieJar, ok: bool) -> Result<Response> {
    )
 }

+/// Resend the email-verification link. Throttled per account (see
+/// [`users::Model::verification_resend_wait_secs`]) so it can't be used to spam
+/// an inbox, and always returns the same neutral message so it can't be used to
+/// probe which addresses are registered.
+#[derive(Debug, serde::Deserialize)]
+struct ResendVerificationForm {
+    email: String,
+}
+
+fn resend_verification_view(v: &TeraView, jar: &CookieJar, done: bool) -> Result<Response> {
+    format::view(
+        v,
+        "auth/resend_verification.html",
+        json!({
+            "done": done,
+            "logged_in_admin": false,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn resend_verification_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+) -> Result<Response> {
+    resend_verification_view(&v, &jar, false)
+}
+
+#[debug_handler]
+async fn resend_verification(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<ResendVerificationForm>,
+) -> Result<Response> {
+    // Resend only for a real, still-unverified account that is past its cooldown.
+    // Anything else (unknown email, already verified, too soon) silently does
+    // nothing — the response is identical either way.
+    if let Ok(user) = users::Model::find_by_email(&ctx.db, form.email.trim()).await {
+        if user.email_verified_at.is_none() && user.verification_resend_wait_secs() == 0 {
+            match user.into_active_model().set_email_verification_sent(&ctx.db).await {
+                Ok(user) => {
+                    if let Err(err) = AuthMailer::send_welcome(&ctx, &user).await {
+                        tracing::error!(error = %err, "failed to resend verification email");
+                    }
+                }
+                Err(err) => tracing::error!(error = %err, "failed to refresh verification token"),
+            }
+        } else {
+            tracing::info!("verification resend skipped (already verified or within cooldown)");
+        }
+    }
+    resend_verification_view(&v, &jar, true)
+}
+
+/// Set-password form for accounts created during checkout (and any account that
+/// has a valid reset token). Reuses the password-reset token machinery.
+#[derive(Debug, serde::Deserialize)]
+struct SetPasswordForm {
+    token: String,
+    password: String,
+    password_confirm: String,
+}
+
+fn set_password_view(
+    v: &TeraView,
+    jar: &CookieJar,
+    token: &str,
+    valid: bool,
+    error: Option<&str>,
+) -> Result<Response> {
+    format::view(
+        v,
+        "auth/set_password.html",
+        json!({
+            "token": token,
+            "valid": valid,
+            "error": error,
+            "logged_in_admin": false,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn set_password_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Path(token): Path<String>,
+) -> Result<Response> {
+    let valid = users::Model::find_by_reset_token(&ctx.db, &token).await.is_ok();
+    set_password_view(&v, &jar, &token, valid, None)
+}
+
+#[debug_handler]
+async fn set_password(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<SetPasswordForm>,
+) -> Result<Response> {
+    let Ok(user) = users::Model::find_by_reset_token(&ctx.db, &form.token).await else {
+        return set_password_view(&v, &jar, &form.token, false, None);
+    };
+    if form.password != form.password_confirm {
+        return set_password_view(&v, &jar, &form.token, true, Some("mismatch"));
+    }
+    if form.password.len() < 8 {
+        return set_password_view(&v, &jar, &form.token, true, Some("weak"));
+    }
+    // Setting the password through an emailed link also proves email ownership,
+    // so the account is marked verified here.
+    let user = user.into_active_model().reset_password(&ctx.db, &form.password).await?;
+    if user.email_verified_at.is_none() {
+        user.into_active_model().verified(&ctx.db).await?;
+    }
+    format::redirect("/login")
+}
+
 #[debug_handler]
 async fn logout() -> Result<Response> {
    format::render()
@@ -208,9 +466,15 @@ pub fn routes() -> Routes {
    Routes::new()
        .add("/login", get(login_page))
        .add("/login", post(login))
+        .add("/login/totp", get(login_totp_page))
+        .add("/login/totp", post(login_totp))
        .add("/register", get(register_page))
        .add("/register", post(register))
        .add("/verify/{token}", get(verify))
+        .add("/resend-verification", get(resend_verification_page))
+        .add("/resend-verification", post(resend_verification))
+        .add("/set-password/{token}", get(set_password_page))
+        .add("/set-password", post(set_password))
        .add("/logout", post(logout))
        .add("/admin", get(admin_entry))
 }
--- a/src/controllers/cart.rs
+++ b/src/controllers/cart.rs
@@ -234,7 +234,7 @@ async fn show(

    // Drop any now-invalid lines from the cookie so the badge stays accurate.
    let rebuilt = serialize_cart(&valid);
-    let (logged_in_admin, logged_in_customer) = guard::chrome(&ctx, &jar).await;
+    let c = guard::chrome(&ctx, &jar).await;
    let response = format::view(
        &v,
        "shop/cart.html",
@@ -242,8 +242,10 @@ async fn show(
            "items": lines,
            "total": format_price(total),
            "currency": currency,
-            "logged_in_admin": logged_in_admin,
-            "logged_in_customer": logged_in_customer,
+            "logged_in_admin": c.logged_in_admin,
+            "logged_in_customer": c.logged_in_customer,
+            "customer_name": c.customer_name,
+            "customer_account_type": c.customer_account_type,
            "lang": current_lang(&jar),
        }),
    )?;
@@ -251,10 +253,39 @@ async fn show(
    Ok((jar.add(cart_cookie(rebuilt)), response).into_response())
 }

+/// Mini-cart preview for the navbar hover dropdown. Lazy-loaded via htmx from
+/// the header; returns just the `shop/_cart_preview.html` fragment.
+#[debug_handler]
+async fn preview(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    let (lines, valid, total) = resolve_cart(&ctx, &jar).await?;
+    let currency = lines
+        .first()
+        .and_then(|line| line["currency"].as_str())
+        .unwrap_or("EUR")
+        .to_string();
+    let rebuilt = serialize_cart(&valid);
+    let response = format::view(
+        &v,
+        "shop/_cart_preview.html",
+        json!({
+            "items": lines,
+            "total": format_price(total),
+            "currency": currency,
+            "lang": current_lang(&jar),
+        }),
+    )?;
+    Ok((jar.add(cart_cookie(rebuilt)), response).into_response())
+}
+
 pub fn routes() -> Routes {
    Routes::new()
        .add("/cart", get(show))
        .add("/cart/add", post(add))
        .add("/cart/update", post(update))
        .add("/cart/remove", post(remove))
+        .add("/partials/cart", get(preview))
 }
--- a/src/controllers/checkout.rs
+++ b/src/controllers/checkout.rs
@@ -1,6 +1,7 @@
 //! Public checkout flow: the checkout form, placing an order, and the order
 //! confirmation page.

+use axum::extract::Query;
 use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
 use loco_rs::prelude::*;
 use sea_orm::{ColumnTrait, EntityTrait, QueryFilter, QueryOrder};
@@ -9,9 +10,13 @@ use serde_json::json;
 use time::Duration as TimeDuration;

 use crate::{
-    controllers::account::normalize_account_type,
    controllers::cart::{resolve_cart, CART_COOKIE},
-    models::{customer_profiles::{self, ProfileFields}, order_items, orders, shipping_methods},
+    mailers::auth::AuthMailer,
+    models::{
+        customer_profiles::{self, ProfileFields},
+        order_items, orders, shipping_methods,
+        users::{self, normalize_account_type},
+    },
    controllers::i18n::current_lang,
    shared::{guard, money::format_price, settings},
    views::checkout as view,
@@ -41,6 +46,8 @@ struct CheckoutForm {
    pickup_point_name: Option<String>,
    // Present (as "on") only when a logged-in customer ticks "save my address".
    save_profile: Option<String>,
+    // Present only when a guest ticks "create an account from this order".
+    create_account: Option<String>,
 }

 fn trimmed(value: &str) -> Option<String> {
@@ -106,6 +113,12 @@ async fn checkout_page(
    let p = |get: fn(&customer_profiles::Model) -> Option<String>| {
        profile.as_ref().and_then(get)
    };
+    // Whether the customer already has a shipping address on file. When they do,
+    // the "save this address to my profile" opt-in is pointless (the profile was
+    // filled in advance), so it's hidden and the existing profile is left alone.
+    let profile_filled = profile
+        .as_ref()
+        .is_some_and(|pr| pr.address.is_some() && pr.city.is_some() && pr.zip.is_some());

    format::view(
        &v,
@@ -119,9 +132,18 @@ async fn checkout_page(
            "packeta_api_key": settings::get(&ctx, "packeta_api_key").unwrap_or(""),
            "logged_in_admin": is_admin,
            "logged_in_customer": is_customer,
+            // Required by the navbar profile menu (base.html includes it whenever
+            // logged_in_customer is true); None for admins/guests.
+            "customer_name": user.as_ref().filter(|_| is_customer).map(|u| u.name.clone()),
+            "customer_account_type": user.as_ref().filter(|_| is_customer).map(|u| u.account_type.clone()),
+            "profile_filled": profile_filled,
+            // A logged-in customer's account type is fixed; only guests pick it
+            // and may opt to create an account from the order.
+            "account_fixed": is_customer,
+            "can_create_account": user.is_none(),
            "prefill_email": user.as_ref().filter(|_| is_customer).map(|u| u.email.clone()),
            "prefill_name": user.as_ref().filter(|_| is_customer).map(|u| u.name.clone()),
-            "prefill_account_type": profile.as_ref().map_or("personal", |x| x.account_type.as_str()),
+            "prefill_account_type": user.as_ref().filter(|_| is_customer).map_or("personal", |u| u.account_type.as_str()),
            "prefill_company_name": p(|x| x.company_name.clone()),
            "prefill_company_id": p(|x| x.company_id.clone()),
            "prefill_tax_id": p(|x| x.tax_id.clone()),
@@ -169,9 +191,20 @@ async fn place_order(
    let zip = require(&form.zip, "zip")?;
    let country = require(&form.country, "country")?;

+    // The account type is fixed for a logged-in customer (taken from their
+    // account, never the form); a guest picks it on the form. Admins are treated
+    // as guests here.
+    let current_user = guard::current_user(&ctx, &jar).await;
+    let logged_in_customer = current_user
+        .as_ref()
+        .filter(|u| !guard::is_admin(&ctx, u));
+    let account_type = match logged_in_customer {
+        Some(u) => u.account_type.clone(),
+        None => normalize_account_type(form.account_type.as_deref()),
+    };
+
    // Company purchases must carry the invoicing identifiers (IČO + DIČ
    // required, IČ DPH optional). Personal orders carry none.
-    let account_type = normalize_account_type(form.account_type.as_deref());
    let (company_name, company_id, tax_id, vat_id) = if account_type == "company" {
        (
            Some(require(form.company_name.as_deref().unwrap_or(""), "company name")?),
@@ -207,29 +240,70 @@ async fn place_order(
        (None, None)
    };

-    // If a logged-in customer opted in, persist this address to their profile
-    // so the next checkout is prefilled. Phone is stored split (prefix + number)
-    // to match the profile/checkout fields. Best-effort: a failure here is logged
-    // but must not block the order.
-    if form.save_profile.is_some() {
-        if let Some(user) = guard::current_user(&ctx, &jar).await {
-            if !guard::is_admin(&ctx, &user) {
-                let fields = ProfileFields {
-                    account_type: account_type.clone(),
-                    company_name: company_name.clone(),
-                    company_id: company_id.clone(),
-                    tax_id: tax_id.clone(),
-                    vat_id: vat_id.clone(),
-                    phone_prefix: trimmed(&form.phone_prefix),
-                    phone: Some(number.clone()),
-                    address: Some(address.clone()),
-                    city: Some(city.clone()),
-                    zip: Some(zip.clone()),
-                    country: Some(country.clone()),
-                };
-                if let Err(err) = customer_profiles::Model::upsert(&ctx.db, user.id, fields).await {
-                    tracing::error!(error = %err, user_id = user.id, "failed to save checkout profile");
+    // The address/contact captured here, ready to seed a profile (for the
+    // logged-in "save my address" opt-in or a freshly created guest account).
+    let entered_profile = || ProfileFields {
+        company_name: company_name.clone(),
+        company_id: company_id.clone(),
+        tax_id: tax_id.clone(),
+        vat_id: vat_id.clone(),
+        phone_prefix: trimmed(&form.phone_prefix),
+        phone: Some(number.clone()),
+        address: Some(address.clone()),
+        city: Some(city.clone()),
+        zip: Some(zip.clone()),
+        country: Some(country.clone()),
+    };
+
+    // Resolve the account that will own this order. A logged-in customer always
+    // owns their orders. A guest may opt to create an account from the order;
+    // the new account's type matches what they bought as, its profile is seeded
+    // from the entered details, and a "set your password" link is emailed. If
+    // the email already belongs to an account we silently fall back to a guest
+    // order (no hijacking an existing account).
+    let mut order_user_id = logged_in_customer.map(|u| u.id);
+    let mut account_created = false;
+    if order_user_id.is_none() && form.create_account.is_some() {
+        match users::Model::create_guest_account(&ctx.db, &email, &customer_name, &account_type)
+            .await
+        {
+            Ok(new_user) => {
+                if let Err(err) =
+                    customer_profiles::Model::upsert(&ctx.db, new_user.id, entered_profile()).await
+                {
+                    tracing::error!(error = %err, user_id = new_user.id, "failed to seed guest profile");
                }
+                let user_id = new_user.id;
+                match new_user.into_active_model().set_forgot_password_sent(&ctx.db).await {
+                    Ok(user) => {
+                        if let Err(err) = AuthMailer::send_set_password(&ctx, &user).await {
+                            tracing::error!(error = %err, "failed to send set-password email");
+                        }
+                        order_user_id = Some(user_id);
+                        account_created = true;
+                    }
+                    Err(err) => {
+                        tracing::error!(error = %err, "failed to issue set-password token");
+                        order_user_id = Some(user_id);
+                    }
+                }
+            }
+            Err(ModelError::EntityAlreadyExists {}) => {
+                tracing::info!(email = %email, "checkout account-create skipped: email already registered");
+            }
+            Err(err) => tracing::error!(error = %err, "failed to create checkout account"),
+        }
+    }
+
+    // If a logged-in customer opted in, persist this address to their profile so
+    // the next checkout is prefilled. Best-effort: a failure here is logged but
+    // must not block the order.
+    if form.save_profile.is_some() {
+        if let Some(user) = logged_in_customer {
+            if let Err(err) =
+                customer_profiles::Model::upsert(&ctx.db, user.id, entered_profile()).await
+            {
+                tracing::error!(error = %err, user_id = user.id, "failed to save checkout profile");
            }
        }
    }
@@ -241,6 +315,7 @@ async fn place_order(
            email,
            phone,
            customer_name: Some(customer_name),
+            user_id: order_user_id,
            account_type,
            company_name,
            company_id,
@@ -259,9 +334,14 @@ async fn place_order(
    )
    .await?;

+    let target = if account_created {
+        format!("/orders/{}?account_created=1", order.order_number)
+    } else {
+        format!("/orders/{}", order.order_number)
+    };
    format::render()
        .cookies(&[cleared_cart_cookie()])?
-        .redirect(&format!("/orders/{}", order.order_number))
+        .redirect(&target)
 }

 #[debug_handler]
@@ -269,6 +349,7 @@ async fn order_confirmation(
    jar: CookieJar,
    ViewEngine(v): ViewEngine<TeraView>,
    Path(order_number): Path<String>,
+    Query(params): Query<std::collections::HashMap<String, String>>,
    State(ctx): State<AppContext>,
 ) -> Result<Response> {
    let order = orders::Entity::find()
@@ -280,7 +361,8 @@ async fn order_confirmation(
        .filter(order_items::Column::OrderId.eq(order.id))
        .all(&ctx.db)
        .await?;
-    let (logged_in_admin, logged_in_customer) = guard::chrome(&ctx, &jar).await;
+    let c = guard::chrome(&ctx, &jar).await;
+    let account_created = params.contains_key("account_created");

    format::view(
        &v,
@@ -292,8 +374,11 @@ async fn order_confirmation(
                settings::get(&ctx, "bank_account_name").unwrap_or(""),
            ),
            "items": view::items(&items),
-            "logged_in_admin": logged_in_admin,
-            "logged_in_customer": logged_in_customer,
+            "logged_in_admin": c.logged_in_admin,
+            "logged_in_customer": c.logged_in_customer,
+            "customer_name": c.customer_name,
+            "customer_account_type": c.customer_account_type,
+            "account_created": account_created,
            "lang": current_lang(&jar),
        }),
    )
--- a/src/controllers/home.rs
+++ b/src/controllers/home.rs
@@ -13,15 +13,17 @@ async fn index(
    State(ctx): State<AppContext>,
 ) -> Result<Response> {
    let products = shop::featured_products(&ctx, 8).await?;
-    let (logged_in_admin, logged_in_customer) = guard::chrome(&ctx, &jar).await;
+    let c = guard::chrome(&ctx, &jar).await;

    format::view(
        &v,
        "home/index.html",
        json!({
            "products": products,
-            "logged_in_admin": logged_in_admin,
-            "logged_in_customer": logged_in_customer,
+            "logged_in_admin": c.logged_in_admin,
+            "logged_in_customer": c.logged_in_customer,
+            "customer_name": c.customer_name,
+            "customer_account_type": c.customer_account_type,
            "lang": current_lang(&jar),
        }),
    )
--- a/src/controllers/shop.rs
+++ b/src/controllers/shop.rs
@@ -69,14 +69,16 @@ async fn index(
        .all(&ctx.db)
        .await?;

-    let (logged_in_admin, logged_in_customer) = guard::chrome(&ctx, &jar).await;
+    let c = guard::chrome(&ctx, &jar).await;
    format::view(
        &v,
        "shop/index.html",
        json!({
            "products": product_rows(&ctx, list).await?,
-            "logged_in_admin": logged_in_admin,
-            "logged_in_customer": logged_in_customer,
+            "logged_in_admin": c.logged_in_admin,
+            "logged_in_customer": c.logged_in_customer,
+            "customer_name": c.customer_name,
+            "customer_account_type": c.customer_account_type,
            "lang": current_lang(&jar),
        }),
    )
@@ -110,7 +112,7 @@ async fn show(
        None => None,
    };

-    let (logged_in_admin, logged_in_customer) = guard::chrome(&ctx, &jar).await;
+    let c = guard::chrome(&ctx, &jar).await;
    format::view(
        &v,
        "shop/show.html",
@@ -118,8 +120,10 @@ async fn show(
            "product": view::product_card(&product, None, category.as_ref().map(|c| c.name.clone())),
            "images": images.iter().map(|i| i.image_id.clone()).collect::<Vec<_>>(),
            "category": category,
-            "logged_in_admin": logged_in_admin,
-            "logged_in_customer": logged_in_customer,
+            "logged_in_admin": c.logged_in_admin,
+            "logged_in_customer": c.logged_in_customer,
+            "customer_name": c.customer_name,
+            "customer_account_type": c.customer_account_type,
            "lang": current_lang(&jar),
        }),
    )
@@ -155,7 +159,7 @@ async fn category(
        .all(&ctx.db)
        .await?;

-    let (logged_in_admin, logged_in_customer) = guard::chrome(&ctx, &jar).await;
+    let c = guard::chrome(&ctx, &jar).await;
    format::view(
        &v,
        "shop/category.html",
@@ -164,8 +168,10 @@ async fn category(
            "breadcrumbs": breadcrumbs,
            "children": children,
            "products": product_rows(&ctx, list).await?,
-            "logged_in_admin": logged_in_admin,
-            "logged_in_customer": logged_in_customer,
+            "logged_in_admin": c.logged_in_admin,
+            "logged_in_customer": c.logged_in_customer,
+            "customer_name": c.customer_name,
+            "customer_account_type": c.customer_account_type,
            "lang": current_lang(&jar),
        }),
    )
--- a/src/fixtures/users.yaml
+++ b/src/fixtures/users.yaml
@@ -6,6 +6,7 @@
  api_key: lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758
  name: user1
  theme: light
+  account_type: personal
  created_at: "2023-11-12T12:34:56.789Z"
  updated_at: "2023-11-12T12:34:56.789Z"
 - id: 3
@@ -15,5 +16,6 @@
  api_key: lo-153561ca-fa84-4e1b-813a-c62526d0a77e
  name: user2
  theme: light
+  account_type: personal
  created_at: "2023-11-12T12:34:56.789Z"
  updated_at: "2023-11-12T12:34:56.789Z"
--- a/src/initializers/admin_seeder.rs
+++ b/src/initializers/admin_seeder.rs
@@ -43,6 +43,7 @@ impl Initializer for AdminSeeder {
                    email: email.clone(),
                    password,
                    name,
+                    account_type: None,
                },
            )
            .await?;
--- a/src/mailers/auth.rs
+++ b/src/mailers/auth.rs
@@ -9,10 +9,21 @@ use crate::models::users;
 static welcome: Dir<'_> = include_dir!("src/mailers/auth/welcome");
 static forgot: Dir<'_> = include_dir!("src/mailers/auth/forgot");
 static magic_link: Dir<'_> = include_dir!("src/mailers/auth/magic_link");
+static set_password: Dir<'_> = include_dir!("src/mailers/auth/set_password");

 #[allow(clippy::module_name_repetitions)]
 pub struct AuthMailer {}
-impl Mailer for AuthMailer {}
+impl Mailer for AuthMailer {
+    /// Override the framework default (`System <system@example.com>`), which any
+    /// real MX rejects (`example.com` is nullMX). Must be a sender the SMTP
+    /// account is allowed to send as.
+    fn opts() -> mailer::MailerOpts {
+        mailer::MailerOpts {
+            from: "Kompress <info@kompress.sk>".to_string(),
+            ..Default::default()
+        }
+    }
+}
 impl AuthMailer {
    /// Sending welcome email the the given user
    ///
@@ -62,6 +73,31 @@ impl AuthMailer {
        Ok(())
    }

+    /// Sends a "set your password" email to a checkout-created account. Reuses
+    /// the reset token; the link lands on the HTML `/set-password/{token}` page.
+    ///
+    /// # Errors
+    ///
+    /// When email sending is failed
+    pub async fn send_set_password(ctx: &AppContext, user: &users::Model) -> Result<()> {
+        Self::mail_template(
+            ctx,
+            &set_password,
+            mailer::Args {
+                to: user.email.to_string(),
+                locals: json!({
+                  "name": user.name,
+                  "resetToken": user.reset_token,
+                  "domain": ctx.config.server.full_url()
+                }),
+                ..Default::default()
+            },
+        )
+        .await?;
+
+        Ok(())
+    }
+
    /// Sends a magic link authentication email to the user.
    ///
    /// # Errors
--- a/src/mailers/auth/set_password/html.t
+++ b/src/mailers/auth/set_password/html.t
@@ -0,0 +1,10 @@
+<html>
+
+<body>
+  Hey {{name}},
+  Thanks for your order! We created an account for you. Set your password to finish, then you can track your orders:
+  <a href="{{domain}}/set-password/{{resetToken}}">Set your password</a>
+  If you didn't place this order, you can ignore this email.
+</body>
+
+</html>
--- a/src/mailers/auth/set_password/subject.t
+++ b/src/mailers/auth/set_password/subject.t
@@ -0,0 +1 @@
+Set your password
--- a/src/mailers/auth/set_password/text.t
+++ b/src/mailers/auth/set_password/text.t
@@ -0,0 +1,7 @@
+Hey {{name}},
+
+Thanks for your order! We created an account for you. Set your password to finish, then you can track your orders:
+
+{{domain}}/set-password/{{resetToken}}
+
+If you didn't place this order, you can ignore this email.
--- a/src/models/_entities/customer_profiles.rs
+++ b/src/models/_entities/customer_profiles.rs
@@ -13,7 +13,6 @@ pub struct Model {
    pub id: i32,
    #[sea_orm(unique)]
    pub user_id: i32,
-    pub account_type: String,
    pub company_name: Option<String>,
    pub company_id: Option<String>,
    pub tax_id: Option<String>,
--- a/src/models/_entities/orders.rs
+++ b/src/models/_entities/orders.rs
@@ -18,6 +18,7 @@ pub struct Model {
    pub status: String,
    pub total_cents: i64,
    pub currency: String,
+    pub user_id: Option<i32>,
    pub account_type: String,
    pub company_name: Option<String>,
    pub company_id: Option<String>,
--- a/src/models/_entities/users.rs
+++ b/src/models/_entities/users.rs
@@ -25,6 +25,10 @@ pub struct Model {
    pub magic_link_token: Option<String>,
    pub magic_link_expiration: Option<DateTimeWithTimeZone>,
    pub theme: String,
+    pub account_type: String,
+    pub totp_secret: Option<String>,
+    pub totp_enabled_at: Option<DateTimeWithTimeZone>,
+    pub totp_backup_codes: Option<String>,
 }

 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
--- a/src/models/customer_profiles.rs
+++ b/src/models/customer_profiles.rs
@@ -9,11 +9,10 @@ use sea_orm::{ActiveValue, IntoActiveModel, QueryFilter, TryIntoModel};
 pub type CustomerProfiles = Entity;

 /// The editable profile fields, shared by the profile page and the checkout
-/// "save my address" path. `account_type` is "personal" or "company"; the
-/// `company_*` fields are only meaningful for company accounts.
+/// "save my address" path. The `company_*` fields are only meaningful for
+/// company accounts (account type now lives on `users`, fixed at registration).
 #[derive(Debug, Default, Clone)]
 pub struct ProfileFields {
-    pub account_type: String,
    pub company_name: Option<String>,
    pub company_id: Option<String>,
    pub tax_id: Option<String>,
@@ -59,7 +58,6 @@ impl Model {
                ..Default::default()
            },
        };
-        active.account_type = ActiveValue::set(fields.account_type);
        active.company_name = ActiveValue::set(fields.company_name);
        active.company_id = ActiveValue::set(fields.company_id);
        active.tax_id = ActiveValue::set(fields.tax_id);
--- a/src/models/orders.rs
+++ b/src/models/orders.rs
@@ -14,6 +14,9 @@ pub struct Checkout {
    pub email: String,
    pub phone: String,
    pub customer_name: Option<String>,
+    /// The account that owns this order, if any (a logged-in buyer or a guest
+    /// who created an account during checkout). `None` for pure guest orders.
+    pub user_id: Option<i32>,
    pub account_type: String,
    pub company_name: Option<String>,
    pub company_id: Option<String>,
@@ -75,6 +78,7 @@ pub async fn place(ctx: &AppContext, items: &[(i32, i32)], details: Checkout) ->
        status: Set("pending".to_string()),
        total_cents: Set(subtotal + details.method.price_cents),
        currency: Set(currency),
+        user_id: Set(details.user_id),
        account_type: Set(details.account_type),
        company_name: Set(details.company_name),
        company_id: Set(details.company_id),
--- a/src/models/users.rs
+++ b/src/models/users.rs
@@ -5,6 +5,7 @@ use loco_rs::{auth::jwt, hash, prelude::*};
 use passwords::PasswordGenerator;
 use serde::{Deserialize, Serialize};
 use serde_json::Map;
+use totp_rs::{Algorithm, Secret, TOTP};
 use uuid::Uuid;

 use crate::models::_entities::o_auth2_sessions;
@@ -13,6 +14,48 @@ pub use crate::models::_entities::users::{self, ActiveModel, Entity, Model};
 pub const MAGIC_LINK_LENGTH: i8 = 32;
 pub const MAGIC_LINK_EXPIRATION_MIN: i8 = 5;

+/// Minimum gap between verification-email resends for one account, in seconds.
+pub const VERIFICATION_RESEND_COOLDOWN_SECS: i64 = 60;
+
+// TODO(security): `users.totp_secret` is stored as a PLAINTEXT base32 string.
+// Unlike `password` (a one-way hash) the TOTP secret must be kept in reversible
+// form — the server needs the original value to recompute codes — so it is
+// effectively password-equivalent: anyone who can read this column can mint
+// valid 2FA codes for that user. It is deliberately left in plaintext for now
+// and treated like the app's other server-side secrets (e.g. the SMTP password,
+// kept out of the DB entirely). When secrets get a proper at-rest story, encrypt
+// this column with a key held OUTSIDE the database (env / `pass`), decrypting
+// only in memory. The single read/write site is `build_totp` +
+// `begin_totp_enrollment` below; `totp_backup_codes` are already hashed and need
+// no change. Grep `TODO(security)` to find this.
+
+/// TOTP (Google Authenticator) parameters. These are the values Google
+/// Authenticator assumes; it ignores anything else encoded in the otpauth URL,
+/// so they must stay SHA1 / 6 digits / 30s or codes won't match.
+const TOTP_ISSUER: &str = "Kompress";
+const TOTP_DIGITS: usize = 6;
+/// Accept codes ±1 time-step (~30s) to tolerate client/server clock drift.
+const TOTP_SKEW: u8 = 1;
+const TOTP_STEP: u64 = 30;
+/// Number of one-time recovery codes generated when 2FA is enabled.
+pub const TOTP_BACKUP_CODE_COUNT: usize = 8;
+
+/// Build a [`TOTP`] from a stored base32 secret and the account label (email).
+/// Returns `None` if the secret can't be decoded.
+fn build_totp(secret_base32: &str, account: &str) -> Option<TOTP> {
+    let bytes = Secret::Encoded(secret_base32.to_string()).to_bytes().ok()?;
+    TOTP::new(
+        Algorithm::SHA1,
+        TOTP_DIGITS,
+        TOTP_SKEW,
+        TOTP_STEP,
+        bytes,
+        Some(TOTP_ISSUER.to_string()),
+        account.to_string(),
+    )
+    .ok()
+}
+
 #[derive(Debug, Deserialize, Serialize)]
 pub struct LoginParams {
    pub email: String,
@@ -24,6 +67,21 @@ pub struct RegisterParams {
    pub email: String,
    pub password: String,
    pub name: String,
+    /// "personal" or "company"; permanent for the account. Optional on the wire
+    /// (older/JSON callers omit it) and normalized via [`normalize_account_type`].
+    #[serde(default)]
+    pub account_type: Option<String>,
+}
+
+/// Normalize an account type to one of the two permanent values, defaulting to
+/// "personal" for anything missing or unexpected. An account's type is chosen
+/// once at registration and never changes.
+#[must_use]
+pub fn normalize_account_type(value: Option<&str>) -> String {
+    match value.map(str::trim) {
+        Some("company") => "company".to_string(),
+        _ => "personal".to_string(),
+    }
 }

 #[derive(Debug, Validate, Deserialize)]
@@ -216,6 +274,91 @@ impl Model {
        hash::verify_password(password, &self.password)
    }

+    /// Whether this is a company account (vs a personal one). Fixed at
+    /// registration.
+    #[must_use]
+    pub fn is_company(&self) -> bool {
+        self.account_type == "company"
+    }
+
+    /// Whether two-factor auth is active for this account. This is the single
+    /// source of truth used by the login flow: a secret may be present during a
+    /// half-finished enrollment, but 2FA only gates login once it is *confirmed*
+    /// (which is what sets `totp_enabled_at`).
+    #[must_use]
+    pub fn totp_enabled(&self) -> bool {
+        self.totp_enabled_at.is_some()
+    }
+
+    /// Build the [`TOTP`] for this user from its stored secret, if any.
+    fn totp(&self) -> Option<TOTP> {
+        let secret = self.totp_secret.as_deref()?;
+        build_totp(secret, &self.email)
+    }
+
+    /// A `data:image/png;base64,...` QR for the *pending* secret plus the secret
+    /// itself (shown as a manual-entry fallback). Used on the enrollment page.
+    /// Returns `None` if no secret is staged or QR rendering fails.
+    #[must_use]
+    pub fn totp_provisioning(&self) -> Option<(String, String)> {
+        let totp = self.totp()?;
+        let qr = totp.get_qr_base64().ok()?;
+        Some((
+            format!("data:image/png;base64,{qr}"),
+            self.totp_secret.clone()?,
+        ))
+    }
+
+    /// Verify a 6-digit authenticator code against the stored secret. Returns
+    /// false if no secret is staged or the code is wrong. Works both during
+    /// enrollment confirmation and at login.
+    #[must_use]
+    pub fn verify_totp_code(&self, code: &str) -> bool {
+        let code = code.trim().replace(' ', "");
+        self.totp()
+            .and_then(|t| t.check_current(&code).ok())
+            .unwrap_or(false)
+    }
+
+    /// Whether `code` matches one of the still-unused backup codes.
+    #[must_use]
+    pub fn matches_backup_code(&self, code: &str) -> bool {
+        let code = code.trim().replace([' ', '-'], "");
+        self.backup_code_hashes()
+            .iter()
+            .any(|h| hash::verify_password(&code, h))
+    }
+
+    /// The stored hashed backup codes (empty if none).
+    fn backup_code_hashes(&self) -> Vec<String> {
+        self.totp_backup_codes
+            .as_deref()
+            .and_then(|s| serde_json::from_str::<Vec<String>>(s).ok())
+            .unwrap_or_default()
+    }
+
+    /// How many unused backup codes remain.
+    #[must_use]
+    pub fn backup_codes_remaining(&self) -> usize {
+        self.backup_code_hashes().len()
+    }
+
+    /// Seconds the user must still wait before another verification email may be
+    /// sent — 0 means a resend is allowed now. Throttling resends off the last
+    /// `email_verification_sent_at` keeps the endpoint from being an easy way to
+    /// spam someone's inbox.
+    #[must_use]
+    pub fn verification_resend_wait_secs(&self) -> i64 {
+        match self.email_verification_sent_at {
+            Some(sent) => {
+                let elapsed =
+                    (chrono::Utc::now() - sent.with_timezone(&chrono::Utc)).num_seconds();
+                (VERIFICATION_RESEND_COOLDOWN_SECS - elapsed).max(0)
+            }
+            None => 0,
+        }
+    }
+
    /// Asynchronously creates a user with a password and saves it to the
    /// database.
    ///
@@ -247,6 +390,7 @@ impl Model {
            email: ActiveValue::set(params.email.to_string()),
            password: ActiveValue::set(password_hash),
            name: ActiveValue::set(params.name.to_string()),
+            account_type: ActiveValue::set(normalize_account_type(params.account_type.as_deref())),
            ..Default::default()
        }
        .insert(&txn)
@@ -257,6 +401,41 @@ impl Model {
        Ok(user)
    }

+    /// Creates an account on behalf of a checkout guest. The user never picks a
+    /// password here (a strong random one satisfies the NOT NULL column, as in
+    /// the OAuth path); they receive a "set your password" link by email. Errors
+    /// with [`ModelError::EntityAlreadyExists`] if the email is already taken.
+    ///
+    /// # Errors
+    ///
+    /// When the email already exists or the insert fails.
+    pub async fn create_guest_account(
+        db: &DatabaseConnection,
+        email: &str,
+        name: &str,
+        account_type: &str,
+    ) -> ModelResult<Self> {
+        let password = PasswordGenerator::new()
+            .length(16)
+            .numbers(true)
+            .lowercase_letters(true)
+            .uppercase_letters(true)
+            .symbols(true)
+            .strict(true)
+            .generate_one()
+            .map_err(|e| ModelError::Any(e.into()))?;
+        Self::create_with_password(
+            db,
+            &RegisterParams {
+                email: email.to_string(),
+                password,
+                name: name.to_string(),
+                account_type: Some(account_type.to_string()),
+            },
+        )
+        .await
+    }
+
    /// Creates a JWT
    ///
    /// # Errors
@@ -369,6 +548,96 @@ impl ActiveModel {
        self.magic_link_expiration = ActiveValue::set(None);
        self.update(db).await.map_err(ModelError::from)
    }
+
+    /// Stage a fresh TOTP secret for enrollment. This does **not** turn 2FA on —
+    /// `totp_enabled_at` stays null until the user proves they scanned it by
+    /// confirming a code (see [`Self::enable_totp`]). Any previously staged
+    /// secret/backup codes are discarded so re-enrolling always starts clean.
+    pub async fn begin_totp_enrollment(mut self, db: &DatabaseConnection) -> ModelResult<Model> {
+        let secret = match Secret::generate_secret().to_encoded() {
+            Secret::Encoded(s) => s,
+            // generate_secret() always yields raw bytes that encode cleanly.
+            Secret::Raw(_) => unreachable!("to_encoded() returns Encoded"),
+        };
+        self.totp_secret = ActiveValue::set(Some(secret));
+        self.totp_enabled_at = ActiveValue::set(None);
+        self.totp_backup_codes = ActiveValue::set(None);
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Confirm enrollment and switch 2FA on. The caller must have already
+    /// verified a code against the staged secret. Generates and stores hashed
+    /// one-time backup codes and returns the plaintext codes to display **once**.
+    pub async fn enable_totp(
+        mut self,
+        db: &DatabaseConnection,
+    ) -> ModelResult<(Model, Vec<String>)> {
+        let (plain, hashes) = generate_backup_codes()?;
+        let encoded = serde_json::to_string(&hashes).map_err(|e| ModelError::Any(e.into()))?;
+        self.totp_enabled_at = ActiveValue::set(Some(Local::now().into()));
+        self.totp_backup_codes = ActiveValue::set(Some(encoded));
+        let model = self.update(db).await.map_err(ModelError::from)?;
+        Ok((model, plain))
+    }
+
+    /// Turn 2FA off and wipe all TOTP state. Callers gate this behind a fresh
+    /// confirmation (password or a current code).
+    pub async fn disable_totp(mut self, db: &DatabaseConnection) -> ModelResult<Model> {
+        self.totp_secret = ActiveValue::set(None);
+        self.totp_enabled_at = ActiveValue::set(None);
+        self.totp_backup_codes = ActiveValue::set(None);
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Remove a used backup code from the stored set so it can't be reused.
+    /// `code` is matched against the remaining hashes; a no-op if it doesn't
+    /// match (the caller decides whether a match was required).
+    pub async fn consume_backup_code(
+        mut self,
+        db: &DatabaseConnection,
+        code: &str,
+    ) -> ModelResult<Model> {
+        let code = code.trim().replace([' ', '-'], "");
+        let current: Vec<String> = match self.totp_backup_codes.as_ref() {
+            Some(s) => serde_json::from_str(s.as_str()).unwrap_or_default(),
+            None => Vec::new(),
+        };
+        let remaining: Vec<String> = current
+            .into_iter()
+            .filter(|h| !hash::verify_password(&code, h))
+            .collect();
+        let encoded = serde_json::to_string(&remaining).map_err(|e| ModelError::Any(e.into()))?;
+        self.totp_backup_codes = ActiveValue::set(Some(encoded));
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Replace the backup codes with a fresh set (e.g. after the user used some).
+    /// Only meaningful while 2FA is enabled; returns the new plaintext codes.
+    pub async fn regenerate_backup_codes(
+        mut self,
+        db: &DatabaseConnection,
+    ) -> ModelResult<(Model, Vec<String>)> {
+        let (plain, hashes) = generate_backup_codes()?;
+        let encoded = serde_json::to_string(&hashes).map_err(|e| ModelError::Any(e.into()))?;
+        self.totp_backup_codes = ActiveValue::set(Some(encoded));
+        let model = self.update(db).await.map_err(ModelError::from)?;
+        Ok((model, plain))
+    }
+}
+
+/// Generate `TOTP_BACKUP_CODE_COUNT` recovery codes, returning
+/// `(plaintext, hashes)`. Only the hashes are persisted; the plaintext is shown
+/// to the user once and never stored.
+fn generate_backup_codes() -> ModelResult<(Vec<String>, Vec<String>)> {
+    let mut plain = Vec::with_capacity(TOTP_BACKUP_CODE_COUNT);
+    let mut hashes = Vec::with_capacity(TOTP_BACKUP_CODE_COUNT);
+    for _ in 0..TOTP_BACKUP_CODE_COUNT {
+        let code = hash::random_string(10).to_lowercase();
+        let hashed = hash::hash_password(&code).map_err(|e| ModelError::Any(e.into()))?;
+        plain.push(code);
+        hashes.push(hashed);
+    }
+    Ok((plain, hashes))
 }

 /// Google OpenID Connect user profile (the fields our scopes request).
--- a/src/shared/guard.rs
+++ b/src/shared/guard.rs
@@ -46,13 +46,30 @@ pub async fn logged_in(ctx: &AppContext, jar: &CookieJar) -> bool {
    }
 }

-/// Nav chrome flags for storefront pages, in one DB lookup: returns
-/// `(logged_in_admin, logged_in_customer)`. A customer is any authenticated
-/// non-admin user. Both are `false` for anonymous visitors.
-pub async fn chrome(ctx: &AppContext, jar: &CookieJar) -> (bool, bool) {
+/// Nav chrome for storefront pages, resolved in one DB lookup. A customer is any
+/// authenticated non-admin user; `customer_name`/`customer_account_type` are set
+/// only for such a customer (used by the navbar profile menu). Everything is the
+/// zero value for anonymous visitors and the name/type stay `None` for admins.
+#[derive(Debug, Default)]
+pub struct Chrome {
+    pub logged_in_admin: bool,
+    pub logged_in_customer: bool,
+    pub customer_name: Option<String>,
+    pub customer_account_type: Option<String>,
+}
+
+pub async fn chrome(ctx: &AppContext, jar: &CookieJar) -> Chrome {
    match current_user(ctx, jar).await {
-        Some(user) if is_admin(ctx, &user) => (true, false),
-        Some(_) => (false, true),
-        None => (false, false),
+        Some(user) if is_admin(ctx, &user) => Chrome {
+            logged_in_admin: true,
+            ..Default::default()
+        },
+        Some(user) => Chrome {
+            logged_in_customer: true,
+            customer_name: Some(user.name),
+            customer_account_type: Some(user.account_type),
+            ..Default::default()
+        },
+        None => Chrome::default(),
    }
 }
--- a/tests/mailer/mod.rs
+++ b/tests/mailer/mod.rs
@@ -0,0 +1 @@
+mod smtp_send;
--- a/tests/mailer/smtp_send.rs
+++ b/tests/mailer/smtp_send.rs
@@ -0,0 +1,104 @@
+//! Real-SMTP smoke test.
+//!
+//! Sends an actual email through the live SMTP server using the real
+//! `AuthMailer` pipeline (config -> Loco mailer -> templates -> SMTP). The test
+//! PASSES when the SMTP server accepts the message (the send returns `Ok`);
+//! confirm real delivery by checking the recipient's inbox.
+//!
+//! It is `#[ignore]`d so it never runs in CI or a normal `cargo test` (it opens
+//! a real network connection, uses real credentials, and sends a real email).
+//! Run it explicitly, inside `nix develop` so `SMTP_PASSWORD` is present:
+//!
+//! ```sh
+//! nix develop -c cargo test --test mod -- --ignored mailer::smtp_send
+//! # optional: choose the recipient (defaults to the address below)
+//! MAILER_TEST_TO=you@example.com \
+//!   nix develop -c cargo test --test mod -- --ignored mailer::smtp_send
+//! ```
+
+use kompress_eshop::{
+    app::App,
+    mailers::auth::AuthMailer,
+    models::users::{Model, RegisterParams},
+};
+use loco_rs::testing::prelude::*;
+use sea_orm::IntoActiveModel;
+use serial_test::serial;
+
+// Non-secret production SMTP settings (mirror `.env`). The password is
+// intentionally NOT here: it is supplied at runtime via `SMTP_PASSWORD`
+// (direnv -> `pass`), and never committed.
+// Dial the name the TLS cert is actually valid for. `smtp.kompress.sk` is a
+// DNS alias for the same server (213.215.124.101) but the cert only lists
+// smtp.euronet.sk, so connecting via the alias fails certificate validation.
+const SMTP_HOST: &str = "smtp.euronet.sk";
+const SMTP_PORT: &str = "587";
+const SMTP_USER: &str = "kompres";
+const SMTP_SECURE: &str = "true";
+
+// Where the test email is sent. Override with `MAILER_TEST_TO`.
+const DEFAULT_RECIPIENT: &str = "filippriec@tutanota.com";
+
+#[tokio::test]
+#[serial]
+#[ignore = "sends a real email via live SMTP; run explicitly with --ignored"]
+async fn sends_real_email() {
+    // The actual secret must come from the environment (direnv -> `pass`).
+    // Fail loudly with guidance rather than silently sending nothing.
+    let password = std::env::var("SMTP_PASSWORD").unwrap_or_default();
+    assert!(
+        !password.is_empty(),
+        "SMTP_PASSWORD is not set. Run inside `nix develop` so direnv loads it from `pass`."
+    );
+
+    let recipient =
+        std::env::var("MAILER_TEST_TO").unwrap_or_else(|_| DEFAULT_RECIPIENT.to_string());
+
+    // Flip the booted context onto the real SMTP transport. `config/test.yaml`
+    // reads these via `get_env` at boot. We deliberately do NOT load `.env`
+    // here: it carries `DATABASE_URL`, and `test.yaml` has
+    // `dangerously_recreate: true`, so loading it would recreate the real DB.
+    // Leaving `DATABASE_URL` untouched keeps boot on the throwaway test DB.
+    //
+    // SAFETY: edition 2024 marks `set_var` as unsafe. This test is `#[serial]`,
+    // so no other test mutates the process environment concurrently.
+    unsafe {
+        std::env::set_var("MAILER_STUB", "false");
+        std::env::set_var("SMTP_ENABLE", "true");
+        std::env::set_var("SMTP_HOST", SMTP_HOST);
+        std::env::set_var("SMTP_PORT", SMTP_PORT);
+        std::env::set_var("SMTP_USER", SMTP_USER);
+        std::env::set_var("SMTP_SECURE", SMTP_SECURE);
+    }
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+
+    // A real user whose address is the recipient, so `send_welcome` targets it.
+    let user = Model::create_with_password(
+        &boot.app_context.db,
+        &RegisterParams {
+            email: recipient.clone(),
+            password: "smtp-smoke-test".to_string(),
+            name: "SMTP smoke test".to_string(),
+            account_type: Some("personal".to_string()),
+        },
+    )
+    .await
+    .expect("failed to create test user");
+
+    // Give the welcome email a realistic verification token/link.
+    user.into_active_model()
+        .set_email_verification_sent(&boot.app_context.db)
+        .await
+        .expect("failed to set email verification token");
+    let user = Model::find_by_email(&boot.app_context.db, &recipient)
+        .await
+        .expect("failed to reload test user");
+
+    // The assertion: the live SMTP server must accept the message.
+    AuthMailer::send_welcome(&boot.app_context, &user)
+        .await
+        .unwrap_or_else(|e| panic!("real SMTP send to {recipient} failed: {e:?}"));
+}
--- a/tests/mod.rs
+++ b/tests/mod.rs
@@ -1,3 +1,4 @@
+mod mailer;
 mod models;
 mod requests;
 mod tasks;
--- a/tests/models/users.rs
+++ b/tests/models/users.rs
@@ -50,6 +50,7 @@ async fn can_create_with_password() {
        email: "test@framework.com".to_string(),
        password: "1234".to_string(),
        name: "framework".to_string(),
+        account_type: Some("personal".to_string()),
    };

    let res = Model::create_with_password(&boot.app_context.db, &params).await;
@@ -78,6 +79,7 @@ async fn handle_create_with_password_with_duplicate() {
            email: "user1@example.com".to_string(),
            password: "1234".to_string(),
            name: "framework".to_string(),
+            account_type: Some("personal".to_string()),
        },
    )
    .await;
Author	SHA1	Message	Date
Priec	5b203ed248	TOTP google authenticator implemented properly well Some checks are pending CI / Check Style (push) Waiting to run Details CI / Run Clippy (push) Waiting to run Details CI / Run Tests (push) Waiting to run Details	2026-06-20 22:48:15 +02:00
Priec	b787d48665	nothing	2026-06-20 20:43:33 +02:00
Priec	e138fb6579	fix for the cart checkout Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-20 13:29:18 +02:00
Priec	3da840c0c9	the cart hover only when possible Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-20 12:22:31 +02:00
Priec	0310f2d2f4	hover menu	2026-06-20 12:13:15 +02:00
Priec	42f30261d0	proper spacing and bascket icon Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-19 23:07:39 +02:00
Priec	ffda718a46	fixed menus now	2026-06-19 22:54:15 +02:00
Priec	673b28c361	working profile pic, but its trash, redoing the navbar icons now	2026-06-19 22:34:11 +02:00
Priec	454d5cb349	navbar profile	2026-06-19 13:59:31 +02:00
Priec	14ae859152	status in the admin page order Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-19 12:22:17 +02:00
Priec	43c6c04dcf	my profile orders and sidebar Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-19 11:59:56 +02:00
Priec	e51eda9a8c	default unchecked Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-19 11:39:40 +02:00
Priec	12e00a782d	profile name surname and save profile data	2026-06-19 11:37:51 +02:00
Priec	5278988842	registration password match	2026-06-19 11:19:30 +02:00
Priec	e70743996b	register form fields	2026-06-19 11:14:47 +02:00
Priec	11762728c9	mail sent over test working fully now Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-19 10:54:30 +02:00
Priec	ebb208baba	not working smtp test	2026-06-19 10:40:43 +02:00
Priec	7cba3d9eba	resend verification mail	2026-06-19 01:05:18 +02:00
Priec	35e2b6edc9	hide .env credentials Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-19 00:35:48 +02:00
Priec	f3daa27ce7	account type is permanent and password registration is now working at checkout Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-18 22:10:17 +02:00
Priec	46cc2459bd	required Some checks failed CI / Check Style (push) Has been cancelled Details CI / Run Clippy (push) Has been cancelled Details CI / Run Tests (push) Has been cancelled Details	2026-06-18 21:38:32 +02:00