Logan2234 · Logan2234 · Sep 5, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 5, 2026
diff --git a/.pnpm-store/v11/index.db b/.pnpm-store/v11/index.db
diff --git a/.pnpm-store/v11/index.db-shm b/.pnpm-store/v11/index.db-shm
diff --git a/.pnpm-store/v11/index.db-wal b/.pnpm-store/v11/index.db-wal
diff --git a/apps/api/src/admin/admin-emails.controller.spec.ts b/apps/api/src/admin/admin-emails.controller.spec.ts
@@ -36,12 +36,30 @@
     );
   });
 
+  it("passes the selected locale separately from template overrides", () => {
+    const { controller, mail } = makeController();
+    (mail.renderTemplatePreview as Mock).mockReturnValue({
+      subject: "Welcome",
+      html: "<html></html>",
+      text: "Welcome",
+    });
+
+    controller.previewEmailTemplate("welcome", {
+      locale: "en",
+      displayName: "Alice",
+    });
+
+    expect(mail.renderTemplatePreview).toHaveBeenCalledWith("welcome", "en", {
+      displayName: "Alice",
+    });
+  });
+
   it("rejects test-send when SMTP isn't configured", async () => {
     const { controller, mail } = makeController();
     (mail.isConfigured as Mock).mockReturnValue(false);
 
     await expect(
-      controller.sendTestEmail("welcome", { to: "a@b.com" }),
+      controller.sendTestEmail("welcome", { to: "a@b.com", locale: "fr" }),
     ).rejects.toThrow(AppException);
     expect(mail.sendTemplateTest).not.toHaveBeenCalled();
   });
@@ -51,7 +69,24 @@
     (mail.sendTemplateTest as Mock).mockResolvedValue(false);
 
     await expect(
-      controller.sendTestEmail("nope", { to: "a@b.com" }),
+      controller.sendTestEmail("nope", { to: "a@b.com", locale: "fr" }),
     ).rejects.toThrow(AppException);
   });
+
+  it("sends the test email in the selected locale", async () => {
+    const { controller, mail } = makeController();
+    (mail.sendTemplateTest as Mock).mockResolvedValue(true);
+
+    await controller.sendTestEmail("welcome", {
+      to: "a@b.com",
+      locale: "en",
+      values: { displayName: "Alice" },
+    });
+
+    expect(mail.sendTemplateTest).toHaveBeenCalledWith(
+      "welcome",
+      { email: "a@b.com", locale: "en" },
+      { displayName: "Alice" },
+    );
+  });
 });
diff --git a/apps/api/src/admin/admin-emails.controller.ts b/apps/api/src/admin/admin-emails.controller.ts
@@ -46,9 +46,10 @@
   @ApiOkResponse({ type: MailTemplatePreviewResponseDto })
   previewEmailTemplate(
     @Param("key") key: string,
-    @Query() overrides: Record<string, string>,
+    @Query() query: Record<string, string>,
   ): MailTemplatePreviewDto {
-    const preview = this.mail.renderTemplatePreview(key, overrides);
+    const { locale = "fr", ...overrides } = query;
+    const preview = this.mail.renderTemplatePreview(key, locale, overrides);
     if (!preview)
       throw new AppException(
         HttpStatus.NOT_FOUND,
@@ -71,7 +72,11 @@
       );
     }
 
-    const sent = await this.mail.sendTemplateTest(key, dto.to, dto.values);
+    const sent = await this.mail.sendTemplateTest(
+      key,
+      { email: dto.to, locale: dto.locale },
+      dto.values,
+    );
     if (!sent)
       throw new AppException(
         HttpStatus.NOT_FOUND,

diff --git a/apps/api/src/admin/admin-reports.controller.ts b/apps/api/src/admin/admin-reports.controller.ts
@@ -167,7 +167,7 @@ export class AdminReportsController {
       if (authorId) {
         const author = await this.prisma.user.findUnique({
           where: { id: authorId },
-          select: { email: true, username: true },
+          select: { email: true, locale: true, username: true },
         });
 
         if (author) {
@@ -177,6 +177,7 @@ export class AdminReportsController {
             targetId: report.targetId,
             subjectUserId: authorId,
             subjectEmail: author.email,
+            subjectLocale: author.locale,
             subjectUsername: author.username,
             legalBasis: body.legalBasis,
             reasonCategory: report.category,

diff --git a/apps/api/src/admin/admin-users.controller.ts b/apps/api/src/admin/admin-users.controller.ts
@@ -396,6 +396,7 @@ export class AdminUsersController {
       targetId: userId,
       subjectUserId: userId,
       subjectEmail: user.email,
+      subjectLocale: user.locale,
       subjectUsername: user.username,
       legalBasis: body.legalBasis,
       reasonText: body.reasonText,

diff --git a/apps/api/src/admin/dto/send-test-email.dto.ts b/apps/api/src/admin/dto/send-test-email.dto.ts
@@ -1,10 +1,17 @@
-import type { SendTestEmailRequestDto } from "@loomkeep/shared";
-import { IsEmail, IsObject, IsOptional } from "class-validator";
+import {
+  Locale,
+  type Locale as LocaleCode,
+  type SendTestEmailRequestDto,
+} from "@loomkeep/shared";
+import { IsEmail, IsIn, IsObject, IsOptional } from "class-validator";
 
 export class SendTestEmailDto implements SendTestEmailRequestDto {
   @IsEmail()
   to!: string;
 
+  @IsIn(Locale)
+  locale!: LocaleCode;
+
   @IsOptional()
   @IsObject()
   values?: Record<string, string>;

diff --git a/apps/api/src/auth/auth.service.spec.ts b/apps/api/src/auth/auth.service.spec.ts
@@ -281,9 +281,12 @@
         data: expect.objectContaining({ type: "EMAIL_VERIFICATION" }),
       }),
     );
-    expect(mail.sendWelcome).toHaveBeenCalledWith("alice@example.com", "Alice");
+    expect(mail.sendWelcome).toHaveBeenCalledWith(
+      { email: "alice@example.com", locale: "en" },
+      "Alice",
+    );
     expect(mail.sendVerifyEmail).toHaveBeenCalledWith(
-      "alice@example.com",
+      { email: "alice@example.com", locale: "en" },
       expect.any(String),
     );
     expect(security.record).toHaveBeenCalledWith(
@@ -293,6 +296,67 @@
     );
   });
 
+  it("uses the explicit page locale instead of the header fallback", async () => {
+    const { service, prisma, mail } = makeService();
+    (prisma.user.findUnique as Mock)
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce(null);
+    (prisma.user.create as Mock).mockImplementation(
+      async ({ data }: { data: Partial<User> }) => makeUser(data),
+    );
+
+    await service.register(
+      {
+        email: "alice@example.com",
+        password: "secret1234",
+        displayName: "Alice",
+        acceptedTerms: true,
+        certifiedAge: true,
+        locale: "en",
+      },
+      undefined,
+      undefined,
+      "fr",
+    );
+
+    expect(prisma.user.create).toHaveBeenCalledWith(
+      expect.objectContaining({ data: expect.objectContaining({ locale: "en" }) }),
+    );
+    expect(mail.sendWelcome).toHaveBeenCalledWith(
+      expect.objectContaining({ email: "alice@example.com", locale: "en" }),
+      "Alice",
+    );
+  });
+
+  it("falls back to Accept-Language for clients that do not send a locale", async () => {
+    const { service, prisma } = makeService();
+    (prisma.user.findUnique as Mock)
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce(null);
+    (prisma.user.create as Mock).mockImplementation(
+      async ({ data }: { data: Partial<User> }) => makeUser(data),
+    );
+
+    await service.register(
+      {
+        email: "alice@example.com",
+        password: "secret1234",
+        displayName: "Alice",
+        acceptedTerms: true,
+        certifiedAge: true,
+      },
+      undefined,
+      undefined,
+      "fr-FR,fr;q=0.9,en;q=0.8",
+    );
+
+    expect(prisma.user.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ locale: "fr" }),
+      }),
+    );
+  });
+
   it("appends a random suffix when the slugified username is taken", async () => {
     const { service, prisma } = makeService();
     (prisma.user.findUnique as Mock)
@@ -422,7 +486,7 @@
       }),
     );
     expect(mail.sendNewDeviceLogin).toHaveBeenCalledWith(
-      user.email,
+      { email: user.email, locale: user.locale },
       "Chrome · Windows",
       "203.0.113.42",
     );
@@ -760,7 +824,7 @@
     expect(createArgs.data.type).toBe("PASSWORD_RESET");
 
     expect(mail.sendPasswordResetLink).toHaveBeenCalledWith(
-      user.email,
+      { email: user.email, locale: user.locale },
       expect.any(String),
     );
     const [, token] = (mail.sendPasswordResetLink as Mock).mock.calls[0];
@@ -843,7 +907,10 @@
     expect(prisma.refreshToken.deleteMany).toHaveBeenCalledWith({
       where: { userId: "user-1" },
     });
-    expect(mail.sendPasswordChanged).toHaveBeenCalledWith(user.email);
+    expect(mail.sendPasswordChanged).toHaveBeenCalledWith({
+      email: user.email,
+      locale: user.locale,
+    });
     expect(security.record).toHaveBeenCalledWith(
       expect.objectContaining({
         type: "PASSWORD_RESET",
@@ -899,7 +966,7 @@
       }),
     );
     expect(mail.sendVerifyEmail).toHaveBeenCalledWith(
-      user.email,
+      { email: user.email, locale: user.locale },
       expect.any(String),
     );
   });
@@ -999,7 +1066,7 @@
     });
 
     expect(mail.sendMfaEmailCode).toHaveBeenCalledWith(
-      user.email,
+      { email: user.email, locale: user.locale },
       expect.stringMatching(/^\d{6}$/),
     );
     expect(result).toMatchObject({ availableMethods: ["email", "recovery"] });
@@ -1057,7 +1124,7 @@
     await service.resendMfaEmailCode("challenge-1");
 
     expect(mail.sendMfaEmailCode).toHaveBeenCalledWith(
-      user.email,
+      { email: user.email, locale: user.locale },
       expect.stringMatching(/^\d{6}$/),
     );
     expect(prisma.mfaLoginChallenge.update).toHaveBeenCalledWith(

diff --git a/apps/api/src/auth/auth.service.ts b/apps/api/src/auth/auth.service.ts
@@ -106,7 +106,7 @@
         passwordHash: await bcrypt.hash(dto.password, BCRYPT_ROUNDS),
         displayName: dto.displayName,
         username: await this.generateUniqueUsername(dto.displayName),
-        locale: detectLocale(acceptLanguage),
+        locale: dto.locale ?? detectLocale(acceptLanguage),
         acceptedTermsAt: new Date(),
         acceptedTermsVersion: LEGAL_VERSION,
         certifiedAgeAt: new Date(),
@@ -123,8 +123,9 @@
         expiresAt: new Date(Date.now() + VERIFY_TOKEN_TTL_HOURS * 60 * 60_000),
       },
     });
-    await this.mail.sendWelcome(user.email, user.displayName);
-    await this.mail.sendVerifyEmail(user.email, verifyToken);
+    const recipient = { email: user.email, locale: user.locale };
+    await this.mail.sendWelcome(recipient, user.displayName);
+    await this.mail.sendVerifyEmail(recipient, verifyToken);
     await this.security.record({
       type: "USER_REGISTERED",
       userId: user.id,
@@ -207,7 +208,10 @@
         },
       }),
     ]);
-    await this.mail.sendVerifyEmail(user.email, verifyToken);
+    await this.mail.sendVerifyEmail(
+      { email: user.email, locale: user.locale },
+      verifyToken,
+    );
   }
 
   /** Accepts either the email or the username as the login identifier. */
@@ -260,7 +264,10 @@
       emailCodeExpiresAt = new Date(
         Date.now() + MFA_EMAIL_CODE_TTL_MINUTES * 60_000,
       );
-      await this.mail.sendMfaEmailCode(user.email, code);
+      await this.mail.sendMfaEmailCode(
+        { email: user.email, locale: user.locale },
+        code,
+      );
     }
 
     const challenge = await this.prisma.mfaLoginChallenge.create({
@@ -315,7 +322,10 @@
         ),
       },
     });
-    await this.mail.sendMfaEmailCode(challenge.user.email, code);
+    await this.mail.sendMfaEmailCode(
+      { email: challenge.user.email, locale: challenge.user.locale },
+      code,
+    );
   }
 
   /**
@@ -397,8 +407,11 @@
     const tokens = await this.startSession(promoted, userAgent);
 
     if (isNewDevice) {
-      const label = deviceLabel(userAgent) ?? "Appareil inconnu";
-      await this.mail.sendNewDeviceLogin(promoted.email, label, ip ?? null);
+      await this.mail.sendNewDeviceLogin(
+        { email: promoted.email, locale: promoted.locale },
+        deviceLabel(userAgent),
+        ip ?? null,
+      );
       await this.security.record({
         type: "NEW_DEVICE_LOGIN",
         userId: promoted.id,
@@ -583,7 +596,10 @@
         },
       }),
     ]);
-    await this.mail.sendPasswordResetLink(user.email, token);
+    await this.mail.sendPasswordResetLink(
+      { email: user.email, locale: user.locale },
+      token,
+    );
   }
 
   /**
@@ -630,7 +646,10 @@
         where: { userId: stored.userId },
       }),
     ]);
-    await this.mail.sendPasswordChanged(stored.user.email);
+    await this.mail.sendPasswordChanged({
+      email: stored.user.email,
+      locale: stored.user.locale,
+    });
     await this.security.record({
       type: "PASSWORD_RESET",
       userId: stored.userId,

diff --git a/apps/api/src/auth/dto/register.dto.ts b/apps/api/src/auth/dto/register.dto.ts
@@ -1,12 +1,15 @@
 import type { RegisterRequestDto } from "@loomkeep/shared";
 import {
+  Locale,
+  type Locale as LocaleCode,
   PASSWORD_DIGIT_RE,
   PASSWORD_SPECIAL_RE,
   PASSWORD_UPPERCASE_RE,
 } from "@loomkeep/shared";
 import {
   Equals,
   IsEmail,
+  IsIn,
   IsOptional,
   IsString,
   Matches,
@@ -38,6 +41,10 @@ export class RegisterDto implements RegisterRequestDto {
   @MaxLength(50)
   displayName!: string;
 
+  @IsOptional()
+  @IsIn(Locale)
+  locale?: LocaleCode;
+
   @Equals(true, { message: "terms of service must be accepted" })
   acceptedTerms!: boolean;