feat(userVignette): add external badge when needed

static/js/components/pendingEmailVignette.js

@@ -49,14 +49,6 @@ export function createPendingEmailVignette(email, size = 'sm') {
     const [local, domain] = trimmed.split('@');
     const synthName = local && domain ? `${local[0]} ${domain[0]}` : trimmed.slice(0, 2);
     avatar.textContent = _initials(synthName);
-
-    // Forced external badge — this is the whole point of the component.
-    const badge = document.createElement('i');
-    badge.className = 'user-vignette__origin user-vignette__origin--external fa-solid fa-building-circle-xmark';
-    badge.title = 'External invitation';
-    badge.setAttribute('aria-hidden', 'true');
-    avatar.appendChild(badge);
-
     wrapper.appendChild(avatar);
 
     // The "name" for a pending invite is just the email itself — there
@@ -66,5 +58,16 @@ export function createPendingEmailVignette(email, size = 'sm') {
     nameEl.textContent = trimmed;
     wrapper.appendChild(nameEl);
 
+    // Forced external badge — this is the whole point of the component.
+    // Lives as a sibling at the end of the wrapper (mirrors the
+    // userVignette layout) so it stays visible regardless of avatar
+    // content (initials today, possibly a photo in a future "saved
+    // email contact" mode).
+    const badge = document.createElement('i');
+    badge.className = 'user-vignette__origin user-vignette__origin--external fa-solid fa-building-circle-xmark';
+    badge.title = 'External invitation';
+    badge.setAttribute('aria-hidden', 'true');
+    wrapper.appendChild(badge);
+
     return wrapper;
 }

static/js/components/userVignette.js

@@ -119,18 +119,6 @@ export function createUserVignette(userId, size = 'sm', { showName = true, showE
     avatar.textContent = userId.slice(0, 2).toUpperCase();
     wrapper.appendChild(avatar);
 
-    // Origin badge (external-only — internal users render unchanged).
-    // Created hidden; revealed once `getIsExternal` resolves to true.
-    // FontAwesome glyph classes are added alongside the component
-    // class so the icon renders as a building-with-x glyph.
-    /** @type {HTMLElement | null} */
-    const originEl = showOrigin ? document.createElement('i') : null;
-    if (originEl) {
-        originEl.className = 'user-vignette__origin user-vignette__origin--external hidden fa-solid fa-building-circle-xmark';
-        originEl.setAttribute('aria-hidden', 'true');
-        avatar.appendChild(originEl);
-    }
-
     /** @type {HTMLElement | null} */
     const nameEl = showName ? document.createElement('span') : null;
 
@@ -157,11 +145,21 @@ export function createUserVignette(userId, size = 'sm', { showName = true, showE
     // Resolve name, photo, email, and (when requested) is_external
     // asynchronously. All four go through the systemUsers cache so a
     // single fetch back-fills every facet.
+    //
+    // The origin badge (external-user marker) is created here only
+    // when `isExternal` is true — NOT pre-created hidden — because the
+    // global icon-replacement `MutationObserver` (core/icons.js) swaps
+    // every `<i class="fa-…">` for an `<svg>`, invalidating any
+    // reference we'd otherwise hold across the await. Late-resolve
+    // calls used to toggle `.hidden` on the original `<i>` that no
+    // longer existed in the DOM, leaving the badge invisible until
+    // the next render. Creating-then-appending keeps the icon system
+    // and our reveal step in agreement.
     Promise.all([
         systemUsers.getDisplayName(userId),
         systemUsers.getPhoto(userId),
         emailEl ? systemUsers.getEmail(userId) : Promise.resolve(null),
-        originEl ? systemUsers.getIsExternal(userId) : Promise.resolve(false)
+        showOrigin ? systemUsers.getIsExternal(userId) : Promise.resolve(false)
     ]).then(([name, photo, email, isExternal]) => {
         if (nameEl) nameEl.textContent = name;
         if (emailEl) emailEl.textContent = email ?? '';
@@ -170,14 +168,23 @@ export function createUserVignette(userId, size = 'sm', { showName = true, showE
         } else {
             avatar.textContent = _initials(name);
         }
-        // Both branches above replace the avatar's children, wiping the
-        // pre-attached badge node. Re-attach AFTER the avatar's content
-        // is final so the badge sits on top.
-        if (originEl) {
-            avatar.appendChild(originEl);
-            if (isExternal) {
-                originEl.classList.remove('hidden');
-                originEl.title = 'External user';
+        if (showOrigin && isExternal) {
+            const badge = document.createElement('i');
+            // In avatar-only mode (no name span), overlay the badge on
+            // the bottom-right corner of the picture — the right-hand
+            // sibling spot doesn't exist there and a row-end position
+            // would visually float in nothing. With a name, keep the
+            // badge as a sibling on the right of the row.
+            const overlay = !showName;
+            badge.className = overlay
+                ? 'user-vignette__origin user-vignette__origin--external user-vignette__origin--overlay fa-solid fa-building-circle-xmark'
+                : 'user-vignette__origin user-vignette__origin--external fa-solid fa-building-circle-xmark';
+            badge.title = 'External user';
+            badge.setAttribute('aria-hidden', 'true');
+            if (overlay) {
+                avatar.appendChild(badge);
+            } else {
+                wrapper.appendChild(badge);
             }
         }
     });

static/js/model/systemUsers.js

@@ -62,7 +62,22 @@ function _nameFor(c) {
  */
 async function _ensureIndex() {
     if (_index !== null) return;
-    const contacts = await addressBook.listContacts(SYSTEM_BOOK_ID);
+
+    // System address book load. Tolerates ANY error (most relevantly the
+    // 403 external users receive on `/api/address-books/system/contacts`
+    // since PR 11.1's defense-in-depth lockout): treat as "empty book"
+    // and fall through to the per-user localStorage injection below so
+    // at least the logged-in user resolves correctly. Without this
+    // try/catch an external user's systemUsers cache stays unbuilt and
+    // every userVignette (including their own avatar in the user menu)
+    // falls back to the UUID-prefix placeholder.
+    /** @type {ContactItem[]} */
+    let contacts = [];
+    try {
+        contacts = await addressBook.listContacts(SYSTEM_BOOK_ID);
+    } catch {
+        // 403 / 5xx / network error — leave contacts empty.
+    }
     _index = new Map(contacts.map((c) => [c.id, _nameFor(c)]));
     _photoIndex = new Map(contacts.map((c) => [c.id, c.photo_url ?? null]));
     _emailIndex = new Map(