From e62987cf72259c8dbb3543722f79f2d3975b9d92 Mon Sep 17 00:00:00 2001
From: Antonio Rodriguez <antoniorodriguez@theagilemonkeys.com>
Date: Tue, 5 May 2026 15:59:34 +0200
Subject: [PATCH 1/6] validate admin in urls, add management command to read
 from djangos email settings.

---
 README.md                                     |  18 +-
 .../management/__init__.py                    |   0
 .../management/commands/__init__.py           |   0
 .../commands/seed_notification_senders.py     |  49 ++
 .../coldfront_notifications/navbar.html       |  29 +
 coldfront_notifications/tests/__init__.py     |   0
 .../tests/test_integration.py                 | 777 ++++++++++++++++++
 coldfront_notifications/tests/test_unit.py    | 426 ++++++++++
 coldfront_notifications/views.py              |  49 +-
 pyproject.toml                                |   1 -
 10 files changed, 1331 insertions(+), 18 deletions(-)
 create mode 100644 coldfront_notifications/management/__init__.py
 create mode 100644 coldfront_notifications/management/commands/__init__.py
 create mode 100644 coldfront_notifications/management/commands/seed_notification_senders.py
 create mode 100644 coldfront_notifications/templates/coldfront_notifications/navbar.html
 create mode 100644 coldfront_notifications/tests/__init__.py
 create mode 100644 coldfront_notifications/tests/test_integration.py
 create mode 100644 coldfront_notifications/tests/test_unit.py

diff --git a/README.md b/README.md
index 2f9edb9..d9bd789 100644
--- a/README.md
+++ b/README.md
@@ -84,6 +84,16 @@ for url_prefix, module, namespace in getattr(settings, "EXTRA_APPS_URLS", []):
 python manage.py migrate coldfront_notifications
 ```
 
+### Add the navbar dropdown
+
+Add this line to your ColdFront `authorized_navbar.html` (typically in `templates/common/authorized_navbar.html`), inside the `<ul>` that holds the nav items:
+
+```django
+{% include "coldfront_notifications/navbar.html" %}
+```
+
+The dropdown is only visible to staff/superusers.
+
 ### Seed the default Template Variables catalog (optional)
 
 ```bash
@@ -104,7 +114,13 @@ Or create your own variables from the UI: **Notifications → Template Variables
 
 ### Configure sender addresses
 
-Go to **Notifications → Settings** and add your sender/reply-to addresses. Flag one as Default From and one as Default Reply-To.
+If your ColdFront instance has `EMAIL_SENDER`, `EMAIL_TICKET_SYSTEM_ADDRESS`, or `EMAIL_DIRECTOR_EMAIL_ADDRESS` in settings, seed them in one command:
+
+```bash
+python manage.py seed_notification_senders
+```
+
+Safe to re-run — skips addresses that already exist. You can also manage addresses manually at **Notifications → Settings**.
 
 ---
 
diff --git a/coldfront_notifications/management/__init__.py b/coldfront_notifications/management/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/coldfront_notifications/management/commands/__init__.py b/coldfront_notifications/management/commands/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/coldfront_notifications/management/commands/seed_notification_senders.py b/coldfront_notifications/management/commands/seed_notification_senders.py
new file mode 100644
index 0000000..eb0f39c
--- /dev/null
+++ b/coldfront_notifications/management/commands/seed_notification_senders.py
@@ -0,0 +1,49 @@
+"""
+Seed SenderConfig from ColdFront email settings.
+
+Run once after installation:
+    python manage.py seed_notification_senders
+
+Safe to re-run — skips addresses that already exist.
+"""
+from django.conf import settings
+from django.core.management.base import BaseCommand
+
+from coldfront_notifications.models import SenderConfig
+
+SETTINGS_MAP = [
+    ("EMAIL_SENDER",                "Default Sender",  True,  False),
+    ("EMAIL_TICKET_SYSTEM_ADDRESS", "Ticket System",   False, True),
+    ("EMAIL_DIRECTOR_EMAIL_ADDRESS","Director",         False, False),
+]
+
+
+class Command(BaseCommand):
+    help = "Create SenderConfig entries from EMAIL_SENDER, EMAIL_TICKET_SYSTEM_ADDRESS, EMAIL_DIRECTOR_EMAIL_ADDRESS"
+
+    def handle(self, *args, **options):
+        created = 0
+        skipped = 0
+        for setting_name, label, is_default, is_reply_to in SETTINGS_MAP:
+            email = getattr(settings, setting_name, None)
+            if not email:
+                self.stdout.write(f"  {setting_name}: not set, skipping")
+                continue
+            _, was_created = SenderConfig.objects.get_or_create(
+                email=email,
+                defaults={
+                    "label": label,
+                    "is_default": is_default,
+                    "is_reply_to": is_reply_to,
+                },
+            )
+            if was_created:
+                created += 1
+                self.stdout.write(self.style.SUCCESS(f"  {setting_name}: created {email}"))
+            else:
+                skipped += 1
+                self.stdout.write(f"  {setting_name}: {email} already exists, skipped")
+
+        self.stdout.write(self.style.SUCCESS(
+            f"\nDone: {created} created, {skipped} skipped"
+        ))
diff --git a/coldfront_notifications/templates/coldfront_notifications/navbar.html b/coldfront_notifications/templates/coldfront_notifications/navbar.html
new file mode 100644
index 0000000..7795e3d
--- /dev/null
+++ b/coldfront_notifications/templates/coldfront_notifications/navbar.html
@@ -0,0 +1,29 @@
+{% if user.is_staff or user.is_superuser %}
+<li id="navbar-notifications" class="nav-item dropdown">
+  <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown">
+    Notifications
+  </a>
+  <div class="dropdown-menu">
+    <a class="dropdown-item" href="{% url 'notifications:dashboard' %}">
+      Dashboard
+    </a>
+    <a class="dropdown-item" href="{% url 'notifications:campaign-list' %}">
+      Notifications
+    </a>
+    <a class="dropdown-item" href="{% url 'notifications:compose' %}">
+      Compose Notification
+    </a>
+    <div class="dropdown-divider"></div>
+    <a class="dropdown-item" href="{% url 'notifications:template-list' %}">
+      Templates
+    </a>
+    <a class="dropdown-item" href="{% url 'notifications:variable-list' %}">
+      Template Variables
+    </a>
+    <div class="dropdown-divider"></div>
+    <a class="dropdown-item" href="{% url 'notifications:settings' %}">
+      Settings
+    </a>
+  </div>
+</li>
+{% endif %}
diff --git a/coldfront_notifications/tests/__init__.py b/coldfront_notifications/tests/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/coldfront_notifications/tests/test_integration.py b/coldfront_notifications/tests/test_integration.py
new file mode 100644
index 0000000..4001737
--- /dev/null
+++ b/coldfront_notifications/tests/test_integration.py
@@ -0,0 +1,777 @@
+"""
+Integration tests for the coldfront_notifications plugin.
+
+Requires Django's test database with ColdFront models available.
+"""
+import json
+from datetime import timedelta
+from unittest.mock import patch
+
+from django.contrib.auth import get_user_model
+from django.core.exceptions import ValidationError
+from django.test import TestCase, Client, override_settings
+from django.urls import reverse
+from django.utils import timezone
+
+from coldfront.core.allocation.models import (
+    Allocation,
+    AllocationStatusChoice,
+    AllocationUser,
+    AllocationUserStatusChoice,
+)
+from coldfront.core.field_of_science.models import FieldOfScience
+from coldfront.core.project.models import (
+    Project,
+    ProjectStatusChoice,
+    ProjectUser,
+    ProjectUserRoleChoice,
+    ProjectUserStatusChoice,
+)
+from coldfront.core.resource.models import Resource, ResourceType
+from coldfront.plugins.ifx.models import ProjectOrganization
+from ifxuser.models import Organization
+
+from coldfront_notifications.models import (
+    NotificationCampaign,
+    NotificationLog,
+    NotificationTemplate,
+    NotificationVariable,
+    SenderConfig,
+)
+from coldfront_notifications.utils import (
+    build_recipient_queryset,
+    enumerate_recipients,
+    enumerate_recipients_deduped,
+)
+
+User = get_user_model()
+
+
+def _disconnect_resource_signals():
+    """Disconnect ColdFront's Resource post_save signal that calls an external API."""
+    from django.db.models.signals import post_save
+    from coldfront.core.resource.models import Resource
+    try:
+        from coldfront.plugins.ifx.models import resource_post_save
+        post_save.disconnect(resource_post_save, sender=Resource)
+    except (ImportError, Exception):
+        pass
+
+
+class NotificationIntegrationTestCase(TestCase):
+    """Base setUp for all notification integration tests."""
+
+    @classmethod
+    def setUpTestData(cls):
+        _disconnect_resource_signals()
+        # --- Choice objects (get_or_create since migrations may seed them) ---
+        cls.role_pi, _ = ProjectUserRoleChoice.objects.get_or_create(name="Principal Investigator")
+        cls.role_user, _ = ProjectUserRoleChoice.objects.get_or_create(name="User")
+        cls.role_manager, _ = ProjectUserRoleChoice.objects.get_or_create(name="Manager")
+
+        cls.pu_status_active, _ = ProjectUserStatusChoice.objects.get_or_create(name="Active")
+        cls.proj_status_active, _ = ProjectStatusChoice.objects.get_or_create(name="Active")
+
+        cls.alloc_status_active, _ = AllocationStatusChoice.objects.get_or_create(name="Active")
+        cls.alloc_status_expired, _ = AllocationStatusChoice.objects.get_or_create(name="Expired")
+
+        cls.au_status_active, _ = AllocationUserStatusChoice.objects.get_or_create(name="Active")
+
+        cls.fos, _ = FieldOfScience.objects.get_or_create(
+            description="Computer Science",
+            defaults={"is_selectable": True},
+        )
+
+        cls.resource_type, _ = ResourceType.objects.get_or_create(
+            name="Storage",
+            defaults={"description": "Storage resource type"},
+        )
+
+        # --- Users ---
+        cls.user1 = User.objects.create_user(
+            username="user1", email="user1@example.com", password="testpass123",
+            first_name="Alice", last_name="Smith",
+        )
+        cls.user2 = User.objects.create_user(
+            username="user2", email="user2@example.com", password="testpass123",
+            first_name="Bob", last_name="Jones",
+        )
+        cls.user3 = User.objects.create_user(
+            username="user3", email="user3@example.com", password="testpass123",
+            first_name="Carol", last_name="Williams",
+        )
+        # Make user1 staff so they can access all views
+        cls.user1.is_staff = True
+        cls.user1.is_superuser = True
+        cls.user1.save()
+
+        # --- Projects ---
+        cls.proj1 = Project.objects.create(
+            title="Project Alpha",
+            description="Test project 1",
+            pi=cls.user1,
+            status=cls.proj_status_active,
+            field_of_science=cls.fos,
+        )
+        cls.proj2 = Project.objects.create(
+            title="Project Beta",
+            description="Test project 2",
+            pi=cls.user1,
+            status=cls.proj_status_active,
+            field_of_science=cls.fos,
+        )
+
+        # --- ProjectUser links ---
+        # user1 is PI on both projects
+        cls.pu1_p1 = ProjectUser.objects.create(
+            project=cls.proj1, user=cls.user1,
+            role=cls.role_pi, status=cls.pu_status_active,
+        )
+        cls.pu1_p2 = ProjectUser.objects.create(
+            project=cls.proj2, user=cls.user1,
+            role=cls.role_pi, status=cls.pu_status_active,
+        )
+        # user2 on proj1 as User
+        cls.pu2_p1 = ProjectUser.objects.create(
+            project=cls.proj1, user=cls.user2,
+            role=cls.role_user, status=cls.pu_status_active,
+        )
+        # user3 on proj2 as Manager
+        cls.pu3_p2 = ProjectUser.objects.create(
+            project=cls.proj2, user=cls.user3,
+            role=cls.role_manager, status=cls.pu_status_active,
+        )
+
+        # --- Resource ---
+        cls.resource = Resource.objects.create(
+            name="Test Storage",
+            resource_type=cls.resource_type,
+            is_allocatable=True,
+        )
+
+        # --- Allocations ---
+        cls.alloc1 = Allocation.objects.create(
+            project=cls.proj1,
+            status=cls.alloc_status_active,
+            justification="Need storage for proj1",
+        )
+        cls.alloc1.resources.add(cls.resource)
+
+        cls.alloc2 = Allocation.objects.create(
+            project=cls.proj2,
+            status=cls.alloc_status_active,
+            justification="Need storage for proj2",
+        )
+        cls.alloc2.resources.add(cls.resource)
+
+        # --- AllocationUser links ---
+        cls.au1_a1 = AllocationUser.objects.create(
+            allocation=cls.alloc1, user=cls.user1, status=cls.au_status_active,
+        )
+        cls.au2_a1 = AllocationUser.objects.create(
+            allocation=cls.alloc1, user=cls.user2, status=cls.au_status_active,
+        )
+        cls.au1_a2 = AllocationUser.objects.create(
+            allocation=cls.alloc2, user=cls.user1, status=cls.au_status_active,
+        )
+        cls.au3_a2 = AllocationUser.objects.create(
+            allocation=cls.alloc2, user=cls.user3, status=cls.au_status_active,
+        )
+
+        # --- Department (Organization) + ProjectOrganization ---
+        cls.dept = Organization.objects.create(
+            name="Engineering Dept",
+            rank="department",
+            org_tree="Test",
+        )
+        cls.proj_org = ProjectOrganization.objects.create(
+            project=cls.proj1,
+            organization=cls.dept,
+        )
+
+        # --- NotificationVariables ---
+        cls.var_query = NotificationVariable.objects.create(
+            key="project_title",
+            label="Project Title",
+            source=NotificationVariable.SOURCE_QUERY,
+            resolver_key="project.title",
+        )
+        cls.var_manual = NotificationVariable.objects.create(
+            key="maint_date",
+            label="Maintenance Date",
+            source=NotificationVariable.SOURCE_MANUAL,
+            value="2026-05-01",
+            input_widget=NotificationVariable.WIDGET_DATE,
+        )
+
+        # --- NotificationTemplate ---
+        cls.template = NotificationTemplate.objects.create(
+            name="Test Template",
+            slug="test-template",
+            subject="Update for {{project_title}}",
+            body="Hello, maintenance on {{maint_date}} for {{project_title}}.",
+        )
+
+        # --- SenderConfig ---
+        cls.sender_config = SenderConfig.objects.create(
+            label="RC Help",
+            email="rchelp@example.com",
+            is_default=True,
+        )
+
+    def setUp(self):
+        self.client = Client()
+        self.client.force_login(self.user1)
+
+
+# =============================================================================
+# UTILS TESTS
+# =============================================================================
+
+class BuildRecipientQuerysetTest(NotificationIntegrationTestCase):
+    """Tests for build_recipient_queryset."""
+
+    def test_no_filters_returns_all_active_users(self):
+        qs = build_recipient_queryset({})
+        user_pks = set(qs.values_list("pk", flat=True))
+        # All 3 users have active ProjectUser memberships
+        self.assertIn(self.user1.pk, user_pks)
+        self.assertIn(self.user2.pk, user_pks)
+        self.assertIn(self.user3.pk, user_pks)
+
+    def test_project_filter(self):
+        qs = build_recipient_queryset({"projects": [self.proj1.pk]})
+        user_pks = set(qs.values_list("pk", flat=True))
+        # proj1 has user1 (PI) and user2 (User)
+        self.assertIn(self.user1.pk, user_pks)
+        self.assertIn(self.user2.pk, user_pks)
+        self.assertNotIn(self.user3.pk, user_pks)
+
+    def test_role_filter(self):
+        qs = build_recipient_queryset({"roles": ["Principal Investigator"]})
+        user_pks = set(qs.values_list("pk", flat=True))
+        # Only user1 is PI
+        self.assertIn(self.user1.pk, user_pks)
+        self.assertNotIn(self.user2.pk, user_pks)
+        self.assertNotIn(self.user3.pk, user_pks)
+
+    def test_department_filter(self):
+        qs = build_recipient_queryset({"departments": ["Engineering Dept"]})
+        user_pks = set(qs.values_list("pk", flat=True))
+        # Only proj1 linked to dept → user1, user2
+        self.assertIn(self.user1.pk, user_pks)
+        self.assertIn(self.user2.pk, user_pks)
+        self.assertNotIn(self.user3.pk, user_pks)
+
+    def test_allocation_status_filter(self):
+        qs = build_recipient_queryset({"statuses": ["Active"]})
+        user_pks = set(qs.values_list("pk", flat=True))
+        # All users have active AllocationUser records
+        self.assertIn(self.user1.pk, user_pks)
+        self.assertIn(self.user2.pk, user_pks)
+        self.assertIn(self.user3.pk, user_pks)
+
+    def test_allocation_status_filter_expired_returns_none(self):
+        qs = build_recipient_queryset({"statuses": ["Expired"]})
+        self.assertEqual(qs.count(), 0)
+
+
+class EnumerateRecipientsTest(NotificationIntegrationTestCase):
+    """Tests for enumerate_recipients."""
+
+    def test_scope_user_returns_distinct_users(self):
+        results = list(enumerate_recipients({}, "user"))
+        users = [r[0] for r in results]
+        user_pks = [u.pk for u in users]
+        # Each user appears once, project and allocation are None
+        self.assertEqual(len(user_pks), len(set(user_pks)))
+        for user, project, allocation in results:
+            self.assertIsNone(project)
+            self.assertIsNone(allocation)
+
+    def test_scope_project_returns_per_project_user(self):
+        results = list(enumerate_recipients({}, "project"))
+        # user1 on 2 projects, user2 on 1, user3 on 1 → 4 tuples
+        self.assertEqual(len(results), 4)
+        for user, project, allocation in results:
+            self.assertIsNotNone(project)
+            self.assertIsNone(allocation)
+
+    def test_scope_allocation_returns_per_allocation_user(self):
+        results = list(enumerate_recipients({}, "allocation"))
+        # alloc1: user1, user2; alloc2: user1, user3 → 4 tuples
+        self.assertEqual(len(results), 4)
+        for user, project, allocation in results:
+            self.assertIsNotNone(project)
+            self.assertIsNotNone(allocation)
+
+    def test_scope_project_with_project_filter(self):
+        results = list(enumerate_recipients({"projects": [self.proj1.pk]}, "project"))
+        # proj1 has user1 and user2
+        self.assertEqual(len(results), 2)
+        user_pks = {r[0].pk for r in results}
+        self.assertEqual(user_pks, {self.user1.pk, self.user2.pk})
+
+
+class EnumerateRecipientsDedupedTest(NotificationIntegrationTestCase):
+    """Tests for enumerate_recipients_deduped."""
+
+    def test_deduped_user_gets_only_first_tuple(self):
+        # user1 appears on both projects; with dedup they get only 1 tuple
+        results = list(enumerate_recipients_deduped(
+            {}, "project", dedupe_users=["user1"]
+        ))
+        user1_tuples = [r for r in results if r[0].pk == self.user1.pk]
+        self.assertEqual(len(user1_tuples), 1)
+
+    def test_non_deduped_users_unchanged(self):
+        results = list(enumerate_recipients_deduped(
+            {}, "project", dedupe_users=["user1"]
+        ))
+        # user2 and user3 still have their single tuples
+        user2_tuples = [r for r in results if r[0].pk == self.user2.pk]
+        user3_tuples = [r for r in results if r[0].pk == self.user3.pk]
+        self.assertEqual(len(user2_tuples), 1)
+        self.assertEqual(len(user3_tuples), 1)
+
+    def test_empty_dedupe_list_is_passthrough(self):
+        full = list(enumerate_recipients({}, "project"))
+        deduped = list(enumerate_recipients_deduped({}, "project", []))
+        self.assertEqual(len(full), len(deduped))
+
+
+# =============================================================================
+# VIEWS TESTS
+# =============================================================================
+
+class ViewGetEndpointsTest(NotificationIntegrationTestCase):
+    """Test that GET endpoints return 200."""
+
+    def test_dashboard(self):
+        resp = self.client.get(reverse("notifications:dashboard"))
+        self.assertEqual(resp.status_code, 200)
+
+    def test_compose(self):
+        resp = self.client.get(reverse("notifications:compose"))
+        self.assertEqual(resp.status_code, 200)
+
+    def test_campaign_list(self):
+        resp = self.client.get(reverse("notifications:campaign-list"))
+        self.assertEqual(resp.status_code, 200)
+
+    def test_template_list(self):
+        resp = self.client.get(reverse("notifications:template-list"))
+        self.assertEqual(resp.status_code, 200)
+
+    def test_variable_list(self):
+        resp = self.client.get(reverse("notifications:variable-list"))
+        self.assertEqual(resp.status_code, 200)
+
+    def test_settings(self):
+        resp = self.client.get(reverse("notifications:settings"))
+        self.assertEqual(resp.status_code, 200)
+
+
+class TemplateViewsTest(NotificationIntegrationTestCase):
+    """Tests for template CRUD views."""
+
+    def test_create_template(self):
+        resp = self.client.post(reverse("notifications:template-create"), {
+            "name": "New Template",
+            "subject": "Hello {{maint_date}}",
+            "body": "Body with {{project_title}}",
+        })
+        self.assertEqual(resp.status_code, 302)
+        self.assertTrue(
+            NotificationTemplate.objects.filter(slug="new-template").exists()
+        )
+
+    def test_soft_delete_template(self):
+        t = NotificationTemplate.objects.create(
+            name="To Delete", slug="to-delete", subject="S", body="B",
+        )
+        resp = self.client.post(reverse("notifications:template-delete", args=[t.pk]))
+        self.assertEqual(resp.status_code, 302)
+        t.refresh_from_db()
+        self.assertTrue(t.is_deleted)
+
+    def test_soft_deleted_template_excluded_from_list(self):
+        t = NotificationTemplate.objects.create(
+            name="Hidden", slug="hidden-tmpl", subject="S", body="B", is_deleted=True,
+        )
+        resp = self.client.get(reverse("notifications:template-list"))
+        self.assertNotContains(resp, "Hidden")
+
+
+class VariableViewsTest(NotificationIntegrationTestCase):
+    """Tests for variable CRUD views."""
+
+    def test_create_variable_query_source(self):
+        resp = self.client.post(reverse("notifications:variable-create"), {
+            "key": "user_email",
+            "label": "User Email",
+            "source": "query",
+            "resolver_key": "user.email",
+            "input_widget": "text",
+            "is_required": True,
+            "value": "",
+            "description": "",
+            "example": "",
+        })
+        self.assertEqual(resp.status_code, 302)
+        self.assertTrue(
+            NotificationVariable.objects.filter(key="user_email").exists()
+        )
+
+    def test_create_variable_manual_source(self):
+        resp = self.client.post(reverse("notifications:variable-create"), {
+            "key": "custom_msg",
+            "label": "Custom Message",
+            "source": "manual",
+            "resolver_key": "",
+            "input_widget": "text",
+            "is_required": True,
+            "value": "Hello World",
+            "description": "",
+            "example": "",
+        })
+        self.assertEqual(resp.status_code, 302)
+        v = NotificationVariable.objects.get(key="custom_msg")
+        self.assertEqual(v.value, "Hello World")
+
+    def test_delete_variable_get_shows_confirmation(self):
+        resp = self.client.get(
+            reverse("notifications:variable-delete", args=[self.var_query.pk])
+        )
+        self.assertEqual(resp.status_code, 200)
+        # The template uses this variable, so it should appear in affected
+        self.assertContains(resp, "Test Template")
+
+    def test_delete_variable_post_soft_deletes(self):
+        v = NotificationVariable.objects.create(
+            key="temp_var", label="Temp", source="manual", value="x",
+        )
+        resp = self.client.post(
+            reverse("notifications:variable-delete", args=[v.pk])
+        )
+        self.assertEqual(resp.status_code, 302)
+        v.refresh_from_db()
+        self.assertTrue(v.is_deleted)
+
+    def test_soft_deleted_variable_excluded_from_list(self):
+        NotificationVariable.objects.create(
+            key="gone_var", label="Gone", source="manual", value="x", is_deleted=True,
+        )
+        resp = self.client.get(reverse("notifications:variable-list"))
+        self.assertNotContains(resp, "gone_var")
+
+
+class FilterOptionsViewTest(NotificationIntegrationTestCase):
+    """Tests for the filter-options AJAX endpoint."""
+
+    def test_filter_options_with_project(self):
+        resp = self.client.post(
+            reverse("notifications:filter-options"),
+            {"projects": [self.proj1.pk]},
+        )
+        self.assertEqual(resp.status_code, 200)
+        data = resp.json()
+        self.assertIn("allocations", data)
+        # Should include alloc1 (proj1) but not alloc2 (proj2)
+        alloc_ids = [a["id"] for a in data["allocations"]]
+        self.assertIn(self.alloc1.pk, alloc_ids)
+        self.assertNotIn(self.alloc2.pk, alloc_ids)
+
+
+class ValidateViewTest(NotificationIntegrationTestCase):
+    """Tests for the validate AJAX endpoint."""
+
+    def test_validate_returns_counts(self):
+        resp = self.client.post(
+            reverse("notifications:validate"),
+            {
+                "subject": "Hi {{maint_date}}",
+                "body": "Body",
+                "filters": json.dumps({
+                    "projects": [], "allocations": [], "resources": [],
+                    "departments": [], "statuses": [], "roles": [],
+                }),
+                "extra_context": json.dumps({}),
+            },
+        )
+        self.assertEqual(resp.status_code, 200)
+        data = resp.json()
+        self.assertIn("user_count", data)
+        self.assertIn("email_count", data)
+        self.assertIn("scope", data)
+        self.assertEqual(data["scope"], "user")
+
+
+class RecipientCountViewTest(NotificationIntegrationTestCase):
+    """Tests for the recipient-count endpoint."""
+
+    def test_preview_returns_paginated_recipients(self):
+        resp = self.client.post(
+            reverse("notifications:recipient-count"),
+            {
+                "preview": "true",
+                "subject": "Hi {{project_title}}",
+                "body": "Body {{maint_date}}",
+                "projects": [],
+                "allocations": [],
+                "resources": [],
+                "departments": [],
+                "alloc_status": [],
+                "roles": [],
+            },
+        )
+        self.assertEqual(resp.status_code, 200)
+        data = resp.json()
+        self.assertIn("recipients", data)
+        self.assertIn("count", data)
+        self.assertIn("scope", data)
+        self.assertIn("page", data)
+        self.assertIn("total_pages", data)
+        # scope should be "project" since project_title requires project
+        self.assertEqual(data["scope"], "project")
+
+
+class ComposeViewTest(NotificationIntegrationTestCase):
+    """Tests for the compose view POST (send action)."""
+
+    @patch("coldfront_notifications.views._dispatch_send")
+    def test_compose_send_creates_campaign(self, mock_dispatch):
+        resp = self.client.post(reverse("notifications:compose"), {
+            "action": "send",
+            "subject": "Hello {{maint_date}}",
+            "body": "Maintenance on {{maint_date}}.",
+            "sender": "rchelp@example.com",
+            "reply_to": "",
+            "template_id": "",
+            "filter_projects": json.dumps([]),
+            "filter_allocations": json.dumps([]),
+            "filter_resources": json.dumps([]),
+            "filter_departments": json.dumps([]),
+            "filter_statuses": json.dumps([]),
+            "filter_roles": json.dumps([]),
+            "extra_recipients": "",
+            "dedupe_users": "[]",
+        })
+        # Should redirect to campaign detail
+        self.assertEqual(resp.status_code, 302)
+        campaign = NotificationCampaign.objects.latest("created_at")
+        self.assertEqual(campaign.subject, "Hello {{maint_date}}")
+        self.assertEqual(campaign.status, NotificationCampaign.STATUS_QUEUED)
+        mock_dispatch.assert_called_once_with(campaign.pk)
+
+
+class CampaignProgressViewTest(NotificationIntegrationTestCase):
+    """Tests for the campaign progress JSON endpoint."""
+
+    def test_progress_returns_json(self):
+        campaign = NotificationCampaign.objects.create(
+            subject="Test Progress",
+            body="Body",
+            sender="rchelp@example.com",
+            status=NotificationCampaign.STATUS_SENDING,
+            recipient_count=10,
+            delivered_count=5,
+            failed_count=1,
+        )
+        resp = self.client.get(
+            reverse("notifications:campaign-progress", args=[campaign.pk])
+        )
+        self.assertEqual(resp.status_code, 200)
+        data = resp.json()
+        self.assertEqual(data["status"], "sending")
+        self.assertEqual(data["recipient_count"], 10)
+        self.assertEqual(data["delivered_count"], 5)
+        self.assertEqual(data["failed_count"], 1)
+        self.assertEqual(data["delivery_pct"], 50.0)
+
+
+# =============================================================================
+# MODELS TESTS
+# =============================================================================
+
+class NotificationCampaignModelTest(NotificationIntegrationTestCase):
+    """Tests for NotificationCampaign model properties."""
+
+    def test_duration_no_times(self):
+        c = NotificationCampaign(sent_at=None, completed_at=None)
+        self.assertEqual(c.duration, "\u2014")
+
+    def test_duration_seconds(self):
+        now = timezone.now()
+        c = NotificationCampaign(sent_at=now, completed_at=now + timedelta(seconds=45))
+        self.assertEqual(c.duration, "45s")
+
+    def test_duration_minutes(self):
+        now = timezone.now()
+        c = NotificationCampaign(sent_at=now, completed_at=now + timedelta(seconds=125))
+        self.assertEqual(c.duration, "2m 5s")
+
+    def test_duration_hours(self):
+        now = timezone.now()
+        c = NotificationCampaign(sent_at=now, completed_at=now + timedelta(seconds=3665))
+        self.assertEqual(c.duration, "1h 1m 5s")
+
+    def test_delivery_pct_zero_recipients(self):
+        c = NotificationCampaign(recipient_count=0, delivered_count=0)
+        self.assertEqual(c.delivery_pct, 0)
+
+    def test_delivery_pct_normal(self):
+        c = NotificationCampaign(recipient_count=10, delivered_count=7)
+        self.assertEqual(c.delivery_pct, 70.0)
+
+    def test_filter_summary(self):
+        c = NotificationCampaign(filters_snapshot={
+            "projects": ["Proj A"],
+            "roles": ["PI", "User"],
+        })
+        badges = c.filter_summary
+        self.assertIn("Project: Proj A", badges)
+        self.assertIn("Role: PI, User", badges)
+
+    def test_filter_summary_empty(self):
+        c = NotificationCampaign(filters_snapshot={})
+        self.assertEqual(c.filter_summary, [])
+
+
+class NotificationTemplateModelTest(NotificationIntegrationTestCase):
+    """Tests for NotificationTemplate model properties."""
+
+    def test_variables_extracts_tokens(self):
+        t = NotificationTemplate(
+            subject="Hi {{user_name}}",
+            body="Project: {{project_title}}, date: {{maint_date}}, again: {{user_name}}",
+        )
+        # Deduplicated, ordered by first occurrence
+        self.assertEqual(t.variables, ["user_name", "project_title", "maint_date"])
+
+    def test_variables_empty_body(self):
+        t = NotificationTemplate(subject="No tokens here", body="Plain text.")
+        self.assertEqual(t.variables, [])
+
+
+class NotificationVariableModelTest(NotificationIntegrationTestCase):
+    """Tests for NotificationVariable.clean() validation."""
+
+    def test_clean_query_requires_resolver_key(self):
+        v = NotificationVariable(
+            key="test_q", label="Test", source="query", resolver_key="",
+        )
+        with self.assertRaises(ValidationError) as ctx:
+            v.clean()
+        self.assertIn("resolver_key", ctx.exception.message_dict)
+
+    def test_clean_query_invalid_resolver_key(self):
+        v = NotificationVariable(
+            key="test_q2", label="Test", source="query", resolver_key="not.real.key",
+        )
+        with self.assertRaises(ValidationError) as ctx:
+            v.clean()
+        self.assertIn("resolver_key", ctx.exception.message_dict)
+
+    def test_clean_manual_requires_value_when_required(self):
+        v = NotificationVariable(
+            key="test_m", label="Test", source="manual",
+            is_required=True, value="",
+        )
+        with self.assertRaises(ValidationError) as ctx:
+            v.clean()
+        self.assertIn("value", ctx.exception.message_dict)
+
+    def test_clean_manual_allows_empty_value_when_not_required(self):
+        v = NotificationVariable(
+            key="test_m2", label="Test", source="manual",
+            is_required=False, value="",
+        )
+        # Should not raise
+        v.clean()
+
+    def test_clean_query_clears_value(self):
+        v = NotificationVariable(
+            key="test_q3", label="Test", source="query",
+            resolver_key="user.email", value="leftover",
+        )
+        v.clean()
+        self.assertEqual(v.value, "")
+
+
+# =============================================================================
+# TASKS TESTS
+# =============================================================================
+
+@override_settings(
+    EMAIL_BACKEND="django.core.mail.backends.console.EmailBackend",
+    NOTIFICATION_BATCH_SIZE=50,
+    NOTIFICATION_BATCH_DELAY=0,
+    NOTIFICATION_MAX_RETRIES=0,
+    NOTIFICATION_RETRY_DELAY=0,
+)
+class SendNotificationCampaignTaskTest(NotificationIntegrationTestCase):
+    """Tests for the send_notification_campaign task."""
+
+    def test_send_campaign_delivers_emails(self):
+        from coldfront_notifications.tasks import send_notification_campaign
+
+        campaign = NotificationCampaign.objects.create(
+            subject="Hello {{maint_date}}",
+            body="Maintenance on {{maint_date}}.",
+            sender="rchelp@example.com",
+            status=NotificationCampaign.STATUS_QUEUED,
+            filters_snapshot={
+                "projects": [self.proj1.pk],
+                "allocations": [], "resources": [],
+                "departments": [], "statuses": [], "roles": [],
+            },
+        )
+
+        send_notification_campaign(campaign.pk)
+
+        campaign.refresh_from_db()
+        self.assertEqual(campaign.status, NotificationCampaign.STATUS_SENT)
+        self.assertGreater(campaign.delivered_count, 0)
+        self.assertEqual(campaign.failed_count, 0)
+        # Should have logs
+        self.assertEqual(campaign.logs.count(), campaign.delivered_count)
+
+    def test_send_campaign_fails_on_unknown_token(self):
+        from coldfront_notifications.tasks import send_notification_campaign
+
+        campaign = NotificationCampaign.objects.create(
+            subject="Hello {{nonexistent_token}}",
+            body="Body",
+            sender="rchelp@example.com",
+            status=NotificationCampaign.STATUS_QUEUED,
+            filters_snapshot={
+                "projects": [], "allocations": [], "resources": [],
+                "departments": [], "statuses": [], "roles": [],
+            },
+        )
+
+        send_notification_campaign(campaign.pk)
+
+        campaign.refresh_from_db()
+        self.assertEqual(campaign.status, NotificationCampaign.STATUS_FAILED)
+
+    def test_send_campaign_fails_on_empty_recipients(self):
+        from coldfront_notifications.tasks import send_notification_campaign
+
+        # Use an allocation status filter that matches nothing
+        campaign = NotificationCampaign.objects.create(
+            subject="Hello {{maint_date}}",
+            body="Body with {{maint_date}}.",
+            sender="rchelp@example.com",
+            status=NotificationCampaign.STATUS_QUEUED,
+            filters_snapshot={
+                "projects": [], "allocations": [], "resources": [],
+                "departments": [], "statuses": ["Expired"], "roles": [],
+            },
+        )
+
+        send_notification_campaign(campaign.pk)
+
+        campaign.refresh_from_db()
+        self.assertEqual(campaign.status, NotificationCampaign.STATUS_FAILED)
diff --git a/coldfront_notifications/tests/test_unit.py b/coldfront_notifications/tests/test_unit.py
new file mode 100644
index 0000000..5fce87f
--- /dev/null
+++ b/coldfront_notifications/tests/test_unit.py
@@ -0,0 +1,426 @@
+"""
+Unit tests for coldfront_notifications plugin.
+
+These tests exercise pure logic functions and do NOT require a database.
+Run with: python -m pytest coldfront_notifications/tests/test_unit.py
+"""
+import re
+import smtplib
+import unittest
+from unittest.mock import MagicMock, patch
+
+
+# ---------------------------------------------------------------------------
+# We need Django settings configured before importing plugin modules.
+# ---------------------------------------------------------------------------
+import django
+from django.conf import settings
+
+if not settings.configured:
+    settings.configure(
+        INSTALLED_APPS=["django.contrib.contenttypes"],
+        DATABASES={},
+        DEFAULT_AUTO_FIELD="django.db.models.BigAutoField",
+    )
+    django.setup()
+
+
+from coldfront_notifications.resolvers import (
+    QUERY_CHOICES,
+    QUERY_RESOLVERS,
+    QUERY_SCOPES,
+    MissingValue,
+    _fmt,
+    _need,
+    _scope_for,
+    resolve,
+)
+from coldfront_notifications.tasks import TOKEN_RE as TASKS_TOKEN_RE, _is_transient, _render
+from coldfront_notifications.validators import (
+    TOKEN_RE as VALIDATORS_TOKEN_RE,
+    _extract_tokens,
+    _required_scope,
+)
+
+
+# ===========================================================================
+# resolvers.py tests
+# ===========================================================================
+
+
+class TestFmt(unittest.TestCase):
+    """Tests for _fmt()."""
+
+    def test_valid_string(self):
+        self.assertEqual(_fmt("hello"), "hello")
+
+    def test_strips_whitespace(self):
+        self.assertEqual(_fmt("  world  "), "world")
+
+    def test_none_raises_missing(self):
+        with self.assertRaises(MissingValue):
+            _fmt(None)
+
+    def test_empty_string_raises_missing(self):
+        with self.assertRaises(MissingValue):
+            _fmt("")
+
+    def test_whitespace_only_raises_missing(self):
+        with self.assertRaises(MissingValue):
+            _fmt("   ")
+
+    def test_coerces_to_string(self):
+        self.assertEqual(_fmt(42), "42")
+
+
+class TestNeed(unittest.TestCase):
+    """Tests for _need()."""
+
+    def test_present_key_returns_value(self):
+        ctx = {"user": "alice"}
+        self.assertEqual(_need(ctx, "user"), "alice")
+
+    def test_missing_key_raises_missing(self):
+        ctx = {"user": "alice"}
+        with self.assertRaises(MissingValue):
+            _need(ctx, "project")
+
+    def test_none_value_raises_missing(self):
+        ctx = {"project": None}
+        with self.assertRaises(MissingValue):
+            _need(ctx, "project")
+
+
+class TestResolve(unittest.TestCase):
+    """Tests for resolve()."""
+
+    def test_valid_resolver_key_dispatches(self):
+        user = MagicMock()
+        user.username = "jdoe"
+        ctx = {"user": user, "project": None, "allocation": None}
+        result = resolve("user.username", ctx)
+        self.assertEqual(result, "jdoe")
+
+    def test_unknown_key_raises_missing(self):
+        ctx = {"user": MagicMock(), "project": None, "allocation": None}
+        with self.assertRaises(MissingValue):
+            resolve("nonexistent.key", ctx)
+
+    def test_attribute_error_raises_missing(self):
+        # user with no .username attribute at all
+        user = MagicMock(spec=[])
+        ctx = {"user": user, "project": None, "allocation": None}
+        with self.assertRaises(MissingValue):
+            resolve("user.username", ctx)
+
+    def test_resolve_user_email(self):
+        user = MagicMock()
+        user.email = "alice@example.com"
+        ctx = {"user": user, "project": None, "allocation": None}
+        self.assertEqual(resolve("user.email", ctx), "alice@example.com")
+
+    def test_resolve_user_full_name(self):
+        user = MagicMock()
+        user.get_full_name.return_value = "Jane Doe"
+        ctx = {"user": user, "project": None, "allocation": None}
+        self.assertEqual(resolve("user.full_name", ctx), "Jane Doe")
+
+    def test_resolve_user_full_name_falls_back_to_username(self):
+        user = MagicMock()
+        user.get_full_name.return_value = ""
+        user.username = "jdoe"
+        ctx = {"user": user, "project": None, "allocation": None}
+        self.assertEqual(resolve("user.full_name", ctx), "jdoe")
+
+
+class TestQueryChoicesConsistency(unittest.TestCase):
+    """Tests that QUERY_CHOICES, QUERY_RESOLVERS, and QUERY_SCOPES are consistent."""
+
+    def test_choices_keys_match_resolvers(self):
+        choice_keys = {k for k, _label, _group in QUERY_CHOICES}
+        resolver_keys = set(QUERY_RESOLVERS.keys())
+        self.assertEqual(choice_keys, resolver_keys)
+
+    def test_scopes_maps_every_choice(self):
+        choice_keys = {k for k, _label, _group in QUERY_CHOICES}
+        scope_keys = set(QUERY_SCOPES.keys())
+        self.assertEqual(choice_keys, scope_keys)
+
+
+class TestScopeFor(unittest.TestCase):
+    """Tests for _scope_for() classification."""
+
+    def test_user_scope(self):
+        self.assertEqual(_scope_for("user.username"), "user")
+        self.assertEqual(_scope_for("user.email"), "user")
+        self.assertEqual(_scope_for("user.ifxid"), "user")
+
+    def test_project_scope(self):
+        self.assertEqual(_scope_for("project.title"), "project")
+        self.assertEqual(_scope_for("project.pi.email"), "project")
+        self.assertEqual(_scope_for("projectuser.role.name"), "project")
+
+    def test_allocation_scope(self):
+        self.assertEqual(_scope_for("allocation.id"), "allocation")
+        self.assertEqual(_scope_for("allocation.status.name"), "allocation")
+
+    def test_resource_scope(self):
+        self.assertEqual(_scope_for("resource.name"), "allocation")
+        self.assertEqual(_scope_for("resource.description"), "allocation")
+
+
+# ===========================================================================
+# validators.py tests
+# ===========================================================================
+
+
+class TestExtractTokens(unittest.TestCase):
+    """Tests for _extract_tokens()."""
+
+    def test_no_tokens(self):
+        self.assertEqual(_extract_tokens("Hello world", "No tokens here"), [])
+
+    def test_one_token_in_subject(self):
+        self.assertEqual(_extract_tokens("Hello {{name}}", "body"), ["name"])
+
+    def test_one_token_in_body(self):
+        self.assertEqual(_extract_tokens("subj", "Hello {{name}}"), ["name"])
+
+    def test_duplicates_deduped_order_preserved(self):
+        result = _extract_tokens("{{a}} {{b}} {{a}}", "{{b}} {{c}}")
+        self.assertEqual(result, ["a", "b", "c"])
+
+    def test_nested_braces_only_valid_matches(self):
+        # {{{foo}}} should still find 'foo' via \w+ inside {{ }}
+        result = _extract_tokens("{{{foo}}}", "")
+        self.assertEqual(result, ["foo"])
+
+    def test_invalid_tokens_ignored(self):
+        # Tokens with spaces or special chars shouldn't match \w+
+        result = _extract_tokens("{{hello world}} {{good}}", "")
+        self.assertEqual(result, ["good"])
+
+    def test_empty_strings(self):
+        self.assertEqual(_extract_tokens("", ""), [])
+
+    def test_none_subject(self):
+        self.assertEqual(_extract_tokens(None, "{{x}}"), ["x"])
+
+    def test_multiple_tokens(self):
+        result = _extract_tokens("{{first}} {{last}}", "Dear {{first}}")
+        self.assertEqual(result, ["first", "last"])
+
+
+class TestRequiredScope(unittest.TestCase):
+    """Tests for _required_scope()."""
+
+    def _make_var(self, resolver_key, source="query"):
+        v = MagicMock()
+        v.source = "query"
+        v.SOURCE_QUERY = "query"
+        v.resolver_key = resolver_key
+        return v
+
+    def _make_manual_var(self):
+        v = MagicMock()
+        v.source = "manual"
+        v.SOURCE_QUERY = "query"
+        v.resolver_key = None
+        return v
+
+    def test_no_vars_returns_user(self):
+        self.assertEqual(_required_scope([]), "user")
+
+    def test_only_user_vars_returns_user(self):
+        vars_list = [self._make_var("user.email"), self._make_var("user.username")]
+        self.assertEqual(_required_scope(vars_list), "user")
+
+    def test_project_vars_returns_project(self):
+        vars_list = [self._make_var("project.title")]
+        self.assertEqual(_required_scope(vars_list), "project")
+
+    def test_allocation_vars_returns_allocation(self):
+        vars_list = [self._make_var("allocation.id")]
+        self.assertEqual(_required_scope(vars_list), "allocation")
+
+    def test_resource_vars_returns_allocation(self):
+        vars_list = [self._make_var("resource.name")]
+        self.assertEqual(_required_scope(vars_list), "allocation")
+
+    def test_mix_highest_wins_allocation(self):
+        vars_list = [
+            self._make_var("user.email"),
+            self._make_var("project.title"),
+            self._make_var("allocation.id"),
+        ]
+        self.assertEqual(_required_scope(vars_list), "allocation")
+
+    def test_mix_project_beats_user(self):
+        vars_list = [
+            self._make_var("user.email"),
+            self._make_var("project.title"),
+        ]
+        self.assertEqual(_required_scope(vars_list), "project")
+
+    def test_manual_vars_dont_affect_scope(self):
+        vars_list = [self._make_manual_var()]
+        self.assertEqual(_required_scope(vars_list), "user")
+
+    def test_manual_with_allocation_still_allocation(self):
+        vars_list = [self._make_manual_var(), self._make_var("allocation.id")]
+        self.assertEqual(_required_scope(vars_list), "allocation")
+
+
+# ===========================================================================
+# tasks.py tests
+# ===========================================================================
+
+
+class TestRender(unittest.TestCase):
+    """Tests for _render()."""
+
+    def test_no_tokens_passthrough(self):
+        self.assertEqual(_render("Hello world", {}), "Hello world")
+
+    def test_one_token_substituted(self):
+        self.assertEqual(_render("Hello {{name}}", {"name": "Alice"}), "Hello Alice")
+
+    def test_missing_key_left_as_literal(self):
+        self.assertEqual(_render("Hello {{name}}", {}), "Hello {{name}}")
+
+    def test_multiple_tokens_all_substituted(self):
+        template = "Dear {{first}} {{last}}, welcome to {{org}}."
+        values = {"first": "Jane", "last": "Doe", "org": "FASRC"}
+        self.assertEqual(_render(template, values), "Dear Jane Doe, welcome to FASRC.")
+
+    def test_repeated_token_substituted(self):
+        self.assertEqual(
+            _render("{{x}} and {{x}}", {"x": "hi"}),
+            "hi and hi",
+        )
+
+    def test_none_template_returns_empty(self):
+        self.assertEqual(_render(None, {"foo": "bar"}), "")
+
+    def test_empty_template(self):
+        self.assertEqual(_render("", {"foo": "bar"}), "")
+
+    def test_partial_match(self):
+        # Only some tokens have values
+        result = _render("{{a}} {{b}}", {"a": "X"})
+        self.assertEqual(result, "X {{b}}")
+
+
+class TestIsTransient(unittest.TestCase):
+    """Tests for _is_transient()."""
+
+    def test_smtp_421_is_transient(self):
+        exc = smtplib.SMTPResponseException(421, "Service not available")
+        self.assertTrue(_is_transient(exc))
+
+    def test_smtp_450_is_transient(self):
+        exc = smtplib.SMTPResponseException(450, "Mailbox busy")
+        self.assertTrue(_is_transient(exc))
+
+    def test_smtp_499_is_transient(self):
+        exc = smtplib.SMTPResponseException(499, "Custom 4xx")
+        self.assertTrue(_is_transient(exc))
+
+    def test_smtp_550_is_not_transient(self):
+        exc = smtplib.SMTPResponseException(550, "Mailbox not found")
+        self.assertFalse(_is_transient(exc))
+
+    def test_smtp_500_is_not_transient(self):
+        exc = smtplib.SMTPResponseException(500, "Syntax error")
+        self.assertFalse(_is_transient(exc))
+
+    def test_smtp_354_is_not_transient(self):
+        exc = smtplib.SMTPResponseException(354, "Start mail input")
+        self.assertFalse(_is_transient(exc))
+
+    def test_smtp_server_disconnected_is_transient(self):
+        exc = smtplib.SMTPServerDisconnected("Connection lost")
+        self.assertTrue(_is_transient(exc))
+
+    def test_connection_error_is_transient(self):
+        exc = ConnectionError("refused")
+        self.assertTrue(_is_transient(exc))
+
+    def test_connection_reset_is_transient(self):
+        exc = ConnectionResetError("reset by peer")
+        self.assertTrue(_is_transient(exc))
+
+    def test_value_error_is_not_transient(self):
+        exc = ValueError("bad value")
+        self.assertFalse(_is_transient(exc))
+
+    def test_runtime_error_is_not_transient(self):
+        exc = RuntimeError("something broke")
+        self.assertFalse(_is_transient(exc))
+
+
+# ===========================================================================
+# conf.py tests
+# ===========================================================================
+
+
+class TestConfDefaults(unittest.TestCase):
+    """Tests that conf.py exports sensible defaults."""
+
+    def test_batch_size_default(self):
+        from coldfront_notifications.conf import BATCH_SIZE
+        self.assertEqual(BATCH_SIZE, 50)
+
+    def test_batch_delay_default(self):
+        from coldfront_notifications.conf import BATCH_DELAY
+        self.assertEqual(BATCH_DELAY, 2.0)
+
+    def test_max_retries_default(self):
+        from coldfront_notifications.conf import MAX_RETRIES
+        self.assertEqual(MAX_RETRIES, 3)
+
+    def test_retry_delay_default(self):
+        from coldfront_notifications.conf import RETRY_DELAY
+        self.assertEqual(RETRY_DELAY, 1.0)
+
+    def test_preview_page_size_default(self):
+        from coldfront_notifications.conf import PREVIEW_PAGE_SIZE
+        self.assertEqual(PREVIEW_PAGE_SIZE, 50)
+
+    def test_preview_render_limit_default(self):
+        from coldfront_notifications.conf import PREVIEW_RENDER_LIMIT
+        self.assertEqual(PREVIEW_RENDER_LIMIT, 10)
+
+
+# ===========================================================================
+# TOKEN_RE pattern tests (shared pattern used in tasks and validators)
+# ===========================================================================
+
+
+class TestTokenRegex(unittest.TestCase):
+    """Tests for the TOKEN_RE pattern used across modules."""
+
+    def test_matches_simple_token(self):
+        m = TASKS_TOKEN_RE.search("{{foo}}")
+        self.assertIsNotNone(m)
+        self.assertEqual(m.group(1), "foo")
+
+    def test_matches_underscore_token(self):
+        m = TASKS_TOKEN_RE.search("{{first_name}}")
+        self.assertIsNotNone(m)
+        self.assertEqual(m.group(1), "first_name")
+
+    def test_no_match_spaces(self):
+        m = TASKS_TOKEN_RE.search("{{ foo }}")
+        self.assertIsNone(m)
+
+    def test_no_match_special_chars(self):
+        m = TASKS_TOKEN_RE.search("{{foo-bar}}")
+        self.assertIsNone(m)
+
+    def test_validators_and_tasks_same_pattern(self):
+        self.assertEqual(TASKS_TOKEN_RE.pattern, VALIDATORS_TOKEN_RE.pattern)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/coldfront_notifications/views.py b/coldfront_notifications/views.py
index 89ab1cc..85f9887 100644
--- a/coldfront_notifications/views.py
+++ b/coldfront_notifications/views.py
@@ -1,8 +1,9 @@
 import json
 import logging
+from functools import wraps
 
 from django.contrib import messages
-from django.contrib.auth.decorators import login_required
+from django.contrib.auth.decorators import login_required, user_passes_test
 from django.http import JsonResponse
 from django.shortcuts import get_object_or_404, redirect, render
 from django.utils import timezone
@@ -12,6 +13,16 @@
 from .forms import ComposeForm, NotificationTemplateForm, NotificationVariableForm, SenderConfigForm
 
 
+def staff_required(view_func):
+    """Restrict to authenticated staff/superusers."""
+    @wraps(view_func)
+    @login_required
+    @user_passes_test(lambda u: u.is_staff or u.is_superuser, login_url="/")
+    def wrapped(request, *args, **kwargs):
+        return view_func(request, *args, **kwargs)
+    return wrapped
+
+
 def _dispatch_send(campaign_pk: int):
     """
     Queue the send task on Celery. Falls back to a background thread when
@@ -70,6 +81,7 @@ def _get_filter_context():
     }
 
 
+@staff_required
 def dashboard(request):
     from datetime import timedelta
     thirty_days_ago = timezone.now() - timedelta(days=30)
@@ -90,6 +102,7 @@ def dashboard(request):
     })
 
 
+@staff_required
 def campaign_list(request):
     status_filter = request.GET.get("status", "")
     qs = NotificationCampaign.objects.select_related("template")
@@ -101,6 +114,7 @@ def campaign_list(request):
     })
 
 
+@staff_required
 def campaign_detail(request, pk):
     campaign = get_object_or_404(NotificationCampaign, pk=pk)
     logs = campaign.logs.all()
@@ -110,7 +124,7 @@ def campaign_detail(request, pk):
     })
 
 
-@login_required
+@staff_required
 def campaign_progress(request, pk):
     """Lightweight JSON endpoint for AJAX progress polling."""
     campaign = get_object_or_404(NotificationCampaign, pk=pk)
@@ -124,7 +138,7 @@ def campaign_progress(request, pk):
     })
 
 
-@login_required
+@staff_required
 @require_POST
 def resend_failed(request, pk):
     campaign = get_object_or_404(NotificationCampaign, pk=pk)
@@ -148,6 +162,7 @@ def resend_failed(request, pk):
     return redirect("notifications:campaign-detail", pk=pk)
 
 
+@staff_required
 def compose(request):
     templates = NotificationTemplate.objects.filter(is_deleted=False)
     ctx = _get_filter_context()
@@ -278,7 +293,7 @@ def _filter(field):
     return render(request, "compose.html", ctx)
 
 
-@login_required
+@staff_required
 @require_POST
 def filter_options(request):
     """
@@ -359,7 +374,7 @@ def filter_options(request):
     })
 
 
-@login_required
+@staff_required
 @require_POST
 def recipient_count_view(request):
     filters = {
@@ -471,12 +486,14 @@ def recipient_count_view(request):
     })
 
 
+@staff_required
 def template_list(request):
     return render(request, "template_list.html", {
         "templates": NotificationTemplate.objects.filter(is_deleted=False),
     })
 
 
+@staff_required
 def template_form(request, pk=None):
     instance = get_object_or_404(NotificationTemplate, pk=pk) if pk else None
     if request.method == "POST":
@@ -510,7 +527,7 @@ def template_form(request, pk=None):
     })
 
 
-@login_required
+@staff_required
 def template_delete(request, pk):
     instance = get_object_or_404(NotificationTemplate, pk=pk)
     # Count notifications that used this template
@@ -526,14 +543,14 @@ def template_delete(request, pk):
     })
 
 
-@login_required
+@staff_required
 def variable_list(request):
     return render(request, "variable_list.html", {
         "variables": NotificationVariable.objects.filter(is_deleted=False),
     })
 
 
-@login_required
+@staff_required
 def variable_form(request, pk=None):
     instance = get_object_or_404(NotificationVariable, pk=pk) if pk else None
     if request.method == "POST":
@@ -555,7 +572,7 @@ def variable_form(request, pk=None):
     })
 
 
-@login_required
+@staff_required
 def variable_delete(request, pk):
     instance = get_object_or_404(NotificationVariable, pk=pk)
     # Find templates that reference this variable's key
@@ -574,13 +591,13 @@ def variable_delete(request, pk):
     })
 
 
-@login_required
+@staff_required
 def settings_view(request):
     senders = SenderConfig.objects.all()
     return render(request, "settings.html", {"senders": senders})
 
 
-@login_required
+@staff_required
 def sender_form(request, pk=None):
     instance = get_object_or_404(SenderConfig, pk=pk) if pk else None
     if request.method == "POST":
@@ -598,7 +615,7 @@ def sender_form(request, pk=None):
     })
 
 
-@login_required
+@staff_required
 @require_POST
 def sender_delete(request, pk):
     obj = get_object_or_404(SenderConfig, pk=pk)
@@ -608,7 +625,7 @@ def sender_delete(request, pk):
     return redirect("notifications:settings")
 
 
-@login_required
+@staff_required
 def template_json(request, pk):
     """Return a single template's live content for the compose-page sidebar."""
     t = get_object_or_404(NotificationTemplate, pk=pk)
@@ -622,7 +639,7 @@ def template_json(request, pk):
     })
 
 
-@login_required
+@staff_required
 def variables_view(request):
     """Return the full catalog of NotificationVariables as JSON."""
     return JsonResponse({
@@ -641,7 +658,7 @@ def variables_view(request):
     })
 
 
-@login_required
+@staff_required
 @require_POST
 def preview_render_view(request):
     """
@@ -719,7 +736,7 @@ def _json(field, default):
     })
 
 
-@login_required
+@staff_required
 @require_POST
 def validate_view(request):
     """
diff --git a/pyproject.toml b/pyproject.toml
index 9ebb65c..37137a0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,7 +17,6 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
-    "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
     "Intended Audience :: System Administrators",
     "Topic :: Communications :: Email",
 ]

From 1673d649fb099af52619eb96bc701f694f4f66e8 Mon Sep 17 00:00:00 2001
From: Antonio Rodriguez <antoniorodriguez@theagilemonkeys.com>
Date: Tue, 5 May 2026 22:09:07 +0200
Subject: [PATCH 2/6] Test new changes, minimal check workflow

---
 .github/workflows/tests.yml                   | 90 +++++++++++++++++++
 .gitignore                                    |  1 +
 .../tests/test_integration.py                 | 80 +++++++++++++++++
 coldfront_notifications/views.py              | 13 +--
 pyproject.toml                                |  1 +
 5 files changed, 173 insertions(+), 12 deletions(-)
 create mode 100644 .github/workflows/tests.yml

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..fddd0d1
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,90 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  unit-tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          pip install --upgrade pip
+          pip install Django>=4.2,<5
+          pip install coverage
+
+      - name: Run unit tests
+        run: |
+          coverage run -m pytest coldfront_notifications/tests/test_unit.py -v
+          coverage report --show-missing --fail-under=90
+        env:
+          PYTHONPATH: .
+
+      - name: Upload coverage
+        if: matrix.python-version == '3.10'
+        uses: actions/upload-artifact@v4
+        with:
+          name: unit-coverage
+          path: .coverage
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Install dependencies
+        run: |
+          pip install --upgrade pip
+          pip install flake8
+
+      - name: Flake8
+        run: |
+          flake8 coldfront_notifications/ \
+            --max-line-length=120 \
+            --exclude=migrations,__pycache__,tests \
+            --ignore=E501,W503,E402
+
+  build:
+    name: Build Package
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Install build tools
+        run: pip install build twine
+
+      - name: Build
+        run: python -m build
+
+      - name: Check package
+        run: twine check dist/*
+
+      - name: Verify wheel contents
+        run: |
+          pip install dist/*.whl
+          python -c "from coldfront_notifications import urls, models, views, resolvers, validators, tasks, conf; print('All modules importable')"
diff --git a/.gitignore b/.gitignore
index c5b94ff..0f03392 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,3 +41,4 @@ htmlcov/
 
 # Logs
 *.log
+management
diff --git a/coldfront_notifications/tests/test_integration.py b/coldfront_notifications/tests/test_integration.py
index 4001737..f529d0a 100644
--- a/coldfront_notifications/tests/test_integration.py
+++ b/coldfront_notifications/tests/test_integration.py
@@ -565,6 +565,86 @@ def test_compose_send_creates_campaign(self, mock_dispatch):
         mock_dispatch.assert_called_once_with(campaign.pk)
 
 
+class StaffRequiredTest(NotificationIntegrationTestCase):
+    """Tests that non-staff users are blocked from all views."""
+
+    def setUp(self):
+        super().setUp()
+        # Log in as user2 who is NOT staff
+        self.client.force_login(self.user2)
+
+    def test_dashboard_requires_staff(self):
+        resp = self.client.get(reverse("notifications:dashboard"))
+        self.assertNotEqual(resp.status_code, 200)
+
+    def test_compose_requires_staff(self):
+        resp = self.client.get(reverse("notifications:compose"))
+        self.assertNotEqual(resp.status_code, 200)
+
+    def test_campaign_list_requires_staff(self):
+        resp = self.client.get(reverse("notifications:campaign-list"))
+        self.assertNotEqual(resp.status_code, 200)
+
+    def test_template_list_requires_staff(self):
+        resp = self.client.get(reverse("notifications:template-list"))
+        self.assertNotEqual(resp.status_code, 200)
+
+    def test_variable_list_requires_staff(self):
+        resp = self.client.get(reverse("notifications:variable-list"))
+        self.assertNotEqual(resp.status_code, 200)
+
+    def test_settings_requires_staff(self):
+        resp = self.client.get(reverse("notifications:settings"))
+        self.assertNotEqual(resp.status_code, 200)
+
+    def test_anonymous_user_blocked(self):
+        self.client.logout()
+        resp = self.client.get(reverse("notifications:dashboard"))
+        self.assertNotEqual(resp.status_code, 200)
+
+
+class SeedNotificationSendersCommandTest(NotificationIntegrationTestCase):
+    """Tests for the seed_notification_senders management command."""
+
+    @override_settings(
+        EMAIL_SENDER="test-sender@example.com",
+        EMAIL_TICKET_SYSTEM_ADDRESS="tickets@example.com",
+        EMAIL_DIRECTOR_EMAIL_ADDRESS="director@example.com",
+    )
+    def test_seeds_from_settings(self):
+        from django.core.management import call_command
+        from io import StringIO
+        out = StringIO()
+        call_command("seed_notification_senders", stdout=out)
+        output = out.getvalue()
+        self.assertIn("created", output)
+        self.assertTrue(SenderConfig.objects.filter(email="test-sender@example.com").exists())
+        self.assertTrue(SenderConfig.objects.filter(email="tickets@example.com").exists())
+        self.assertTrue(SenderConfig.objects.filter(email="director@example.com").exists())
+
+    @override_settings(
+        EMAIL_SENDER="test-sender@example.com",
+        EMAIL_TICKET_SYSTEM_ADDRESS="tickets@example.com",
+    )
+    def test_skips_existing(self):
+        from django.core.management import call_command
+        from io import StringIO
+        SenderConfig.objects.create(email="test-sender@example.com", label="Existing")
+        out = StringIO()
+        call_command("seed_notification_senders", stdout=out)
+        output = out.getvalue()
+        self.assertIn("already exists", output)
+        # Should not duplicate
+        self.assertEqual(SenderConfig.objects.filter(email="test-sender@example.com").count(), 1)
+
+    def test_skips_unset_settings(self):
+        from django.core.management import call_command
+        from io import StringIO
+        out = StringIO()
+        call_command("seed_notification_senders", stdout=out)
+        self.assertIn("not set", out.getvalue())
+
+
 class CampaignProgressViewTest(NotificationIntegrationTestCase):
     """Tests for the campaign progress JSON endpoint."""
 
diff --git a/coldfront_notifications/views.py b/coldfront_notifications/views.py
index 85f9887..12b2382 100644
--- a/coldfront_notifications/views.py
+++ b/coldfront_notifications/views.py
@@ -1,9 +1,8 @@
 import json
 import logging
-from functools import wraps
 
 from django.contrib import messages
-from django.contrib.auth.decorators import login_required, user_passes_test
+from django.contrib.admin.views.decorators import staff_member_required as staff_required
 from django.http import JsonResponse
 from django.shortcuts import get_object_or_404, redirect, render
 from django.utils import timezone
@@ -13,16 +12,6 @@
 from .forms import ComposeForm, NotificationTemplateForm, NotificationVariableForm, SenderConfigForm
 
 
-def staff_required(view_func):
-    """Restrict to authenticated staff/superusers."""
-    @wraps(view_func)
-    @login_required
-    @user_passes_test(lambda u: u.is_staff or u.is_superuser, login_url="/")
-    def wrapped(request, *args, **kwargs):
-        return view_func(request, *args, **kwargs)
-    return wrapped
-
-
 def _dispatch_send(campaign_pk: int):
     """
     Queue the send task on Celery. Falls back to a background thread when
diff --git a/pyproject.toml b/pyproject.toml
index 37137a0..9ebb65c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,6 +17,7 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
     "Intended Audience :: System Administrators",
     "Topic :: Communications :: Email",
 ]

From 9c079557ee33e8c865ad6489474f2172a7fbe61a Mon Sep 17 00:00:00 2001
From: Antonio Rodriguez <antoniorodriguez@theagilemonkeys.com>
Date: Wed, 6 May 2026 17:44:47 +0200
Subject: [PATCH 3/6] Test fix for gh actions

---
 .github/workflows/tests.yml                | 31 ++++++++++++++++++----
 coldfront_notifications/tests/test_unit.py | 12 +++++++--
 2 files changed, 36 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index fddd0d1..eab2a0a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -24,12 +24,13 @@ jobs:
       - name: Install dependencies
         run: |
           pip install --upgrade pip
-          pip install Django>=4.2,<5
-          pip install coverage
+          pip install "Django>=4.2,<5" coverage
+        env:
+          PYTHONPATH: .
 
       - name: Run unit tests
         run: |
-          coverage run -m pytest coldfront_notifications/tests/test_unit.py -v
+          coverage run -m unittest coldfront_notifications.tests.test_unit -v
           coverage report --show-missing --fail-under=90
         env:
           PYTHONPATH: .
@@ -62,7 +63,7 @@ jobs:
           flake8 coldfront_notifications/ \
             --max-line-length=120 \
             --exclude=migrations,__pycache__,tests \
-            --ignore=E501,W503,E402
+            --ignore=E501,W503,E402,E241,E221,E231,W292
 
   build:
     name: Build Package
@@ -87,4 +88,24 @@ jobs:
       - name: Verify wheel contents
         run: |
           pip install dist/*.whl
-          python -c "from coldfront_notifications import urls, models, views, resolvers, validators, tasks, conf; print('All modules importable')"
+          python -c "
+          import django
+          from django.conf import settings
+          settings.configure(
+              INSTALLED_APPS=[
+                  'django.contrib.contenttypes',
+                  'django.contrib.auth',
+                  'django.contrib.admin',
+                  'django.contrib.sessions',
+                  'django.contrib.messages',
+                  'coldfront_notifications',
+              ],
+              DATABASES={'default': {'ENGINE': 'django.db.backends.sqlite3', 'NAME': ':memory:'}},
+              DEFAULT_AUTO_FIELD='django.db.models.BigAutoField',
+              AUTH_USER_MODEL='auth.User',
+              ROOT_URLCONF='coldfront_notifications.urls',
+          )
+          django.setup()
+          from coldfront_notifications import urls, models, views, resolvers, validators, tasks, conf
+          print('All modules importable')
+          "
diff --git a/coldfront_notifications/tests/test_unit.py b/coldfront_notifications/tests/test_unit.py
index 5fce87f..d4607a2 100644
--- a/coldfront_notifications/tests/test_unit.py
+++ b/coldfront_notifications/tests/test_unit.py
@@ -18,8 +18,16 @@
 
 if not settings.configured:
     settings.configure(
-        INSTALLED_APPS=["django.contrib.contenttypes"],
-        DATABASES={},
+        INSTALLED_APPS=[
+            "django.contrib.contenttypes",
+            "django.contrib.auth",
+        ],
+        DATABASES={
+            "default": {
+                "ENGINE": "django.db.backends.sqlite3",
+                "NAME": ":memory:",
+            }
+        },
         DEFAULT_AUTO_FIELD="django.db.models.BigAutoField",
     )
     django.setup()

From eb528d7030d73e9d5370c200fcc1caca2fcf698d Mon Sep 17 00:00:00 2001
From: Antonio Rodriguez <antoniorodriguez@theagilemonkeys.com>
Date: Wed, 6 May 2026 21:46:32 +0200
Subject: [PATCH 4/6] Linter fix, improve test coverage

---
 .github/workflows/tests.yml                |   3 +-
 coldfront_notifications/admin.py           |   6 +-
 coldfront_notifications/forms.py           |  12 +-
 coldfront_notifications/resolvers.py       |  39 +--
 coldfront_notifications/tasks.py           |   2 +-
 coldfront_notifications/tests/test_unit.py | 294 ++++++++++++++++++++-
 coldfront_notifications/utils.py           |   5 +-
 coldfront_notifications/validators.py      |   4 +-
 coldfront_notifications/views.py           |  59 +++--
 9 files changed, 362 insertions(+), 62 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index eab2a0a..cb297e3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -31,7 +31,8 @@ jobs:
       - name: Run unit tests
         run: |
           coverage run -m unittest coldfront_notifications.tests.test_unit -v
-          coverage report --show-missing --fail-under=90
+          coverage report --show-missing --fail-under=80 \
+            --include="coldfront_notifications/resolvers.py,coldfront_notifications/validators.py,coldfront_notifications/conf.py,coldfront_notifications/__init__.py"
         env:
           PYTHONPATH: .
 
diff --git a/coldfront_notifications/admin.py b/coldfront_notifications/admin.py
index f71ce6c..9d25100 100644
--- a/coldfront_notifications/admin.py
+++ b/coldfront_notifications/admin.py
@@ -18,8 +18,10 @@ class NotificationVariableForm(forms.ModelForm):
     """
     resolver_key = forms.ChoiceField(
         required=False,
-        choices=[("", "— choose a query path —")]
-               + [(k, f"{group}: {label}") for (k, label, group) in QUERY_CHOICES],
+        choices=(
+            [("", "— choose a query path —")]
+            + [(k, f"{group}: {label}") for (k, label, group) in QUERY_CHOICES]
+        ),
         help_text="Only used when Source = Query.",
     )
 
diff --git a/coldfront_notifications/forms.py b/coldfront_notifications/forms.py
index 3a02daa..b2e2ae3 100644
--- a/coldfront_notifications/forms.py
+++ b/coldfront_notifications/forms.py
@@ -10,8 +10,10 @@ class NotificationVariableForm(forms.ModelForm):
 
     resolver_key = forms.ChoiceField(
         required=False,
-        choices=[("", "— choose a query source —")]
-               + [(k, f"{group}: {label}") for (k, label, group) in QUERY_CHOICES],
+        choices=(
+            [("", "— choose a query source —")]
+            + [(k, f"{group}: {label}") for (k, label, group) in QUERY_CHOICES]
+        ),
         widget=forms.Select(attrs={"class": "form-control"}),
     )
 
@@ -102,9 +104,9 @@ class ComposeForm(forms.Form):
     )
 
     # recipient filters — all MultipleChoiceField, choices injected in __init__
-    filter_projects   = forms.MultipleChoiceField(required=False)
-    filter_allocations= forms.MultipleChoiceField(required=False)
-    filter_departments= forms.MultipleChoiceField(required=False)
+    filter_projects = forms.MultipleChoiceField(required=False)
+    filter_allocations = forms.MultipleChoiceField(required=False)
+    filter_departments = forms.MultipleChoiceField(required=False)
     filter_resources  = forms.MultipleChoiceField(required=False)
     filter_statuses   = forms.MultipleChoiceField(required=False)
     filter_roles      = forms.MultipleChoiceField(required=False)
diff --git a/coldfront_notifications/resolvers.py b/coldfront_notifications/resolvers.py
index 5f4c8aa..87956f7 100644
--- a/coldfront_notifications/resolvers.py
+++ b/coldfront_notifications/resolvers.py
@@ -64,21 +64,21 @@ def _project_role(user, project):
 
 QUERY_RESOLVERS = {
     # Recipient (user)
-    "user.username":   lambda c: _fmt(_need(c, "user").username),
-    "user.email":      lambda c: _fmt(_need(c, "user").email),
-    "user.full_name":  lambda c: _fmt(_need(c, "user").get_full_name() or _need(c, "user").username),
+    "user.username": lambda c: _fmt(_need(c, "user").username),
+    "user.email": lambda c: _fmt(_need(c, "user").email),
+    "user.full_name": lambda c: _fmt(_need(c, "user").get_full_name() or _need(c, "user").username),
     "user.first_name": lambda c: _fmt(_need(c, "user").first_name),
-    "user.last_name":  lambda c: _fmt(_need(c, "user").last_name),
-    "user.ifxid":      lambda c: _fmt(getattr(_need(c, "user"), "ifxid", None)),
+    "user.last_name": lambda c: _fmt(_need(c, "user").last_name),
+    "user.ifxid": lambda c: _fmt(getattr(_need(c, "user"), "ifxid", None)),
 
     # Project
-    "project.title":                        lambda c: _fmt(_need(c, "project").title),
-    "project.description":                  lambda c: _fmt(_need(c, "project").description),
-    "project.status.name":                  lambda c: _fmt(_need(c, "project").status.name),
+    "project.title": lambda c: _fmt(_need(c, "project").title),
+    "project.description": lambda c: _fmt(_need(c, "project").description),
+    "project.status.name": lambda c: _fmt(_need(c, "project").status.name),
     "project.field_of_science.description": lambda c: _fmt(
         _need(c, "project").field_of_science.description if _need(c, "project").field_of_science_id else None
     ),
-    "project.parent_project.title":         lambda c: _fmt(
+    "project.parent_project.title": lambda c: _fmt(
         _need(c, "project").parent_project.title if _need(c, "project").parent_project_id else None
     ),
 
@@ -86,8 +86,8 @@ def _project_role(user, project):
     "project.pi.full_name": lambda c: _fmt(
         _need(c, "project").pi.get_full_name() or _need(c, "project").pi.username if _need(c, "project").pi_id else None
     ),
-    "project.pi.email":     lambda c: _fmt(_need(c, "project").pi.email if _need(c, "project").pi_id else None),
-    "project.pi.username":  lambda c: _fmt(_need(c, "project").pi.username if _need(c, "project").pi_id else None),
+    "project.pi.email": lambda c: _fmt(_need(c, "project").pi.email if _need(c, "project").pi_id else None),
+    "project.pi.username": lambda c: _fmt(_need(c, "project").pi.username if _need(c, "project").pi_id else None),
 
     # Department (via ProjectOrganization)
     "project.department.name": lambda c: _fmt(_dept_name(_need(c, "project"))),
@@ -96,17 +96,17 @@ def _project_role(user, project):
     "projectuser.role.name": lambda c: _fmt(_project_role(_need(c, "user"), _need(c, "project"))),
 
     # Allocation
-    "allocation.id":            lambda c: _fmt(_need(c, "allocation").pk),
-    "allocation.description":   lambda c: _fmt(_need(c, "allocation").description),
+    "allocation.id": lambda c: _fmt(_need(c, "allocation").pk),
+    "allocation.description": lambda c: _fmt(_need(c, "allocation").description),
     "allocation.justification": lambda c: _fmt(_need(c, "allocation").justification),
-    "allocation.quantity":      lambda c: _fmt(_need(c, "allocation").quantity),
-    "allocation.start_date":    lambda c: _fmt(_need(c, "allocation").start_date),
-    "allocation.end_date":      lambda c: _fmt(_need(c, "allocation").end_date),
-    "allocation.status.name":   lambda c: _fmt(_need(c, "allocation").status.name),
+    "allocation.quantity": lambda c: _fmt(_need(c, "allocation").quantity),
+    "allocation.start_date": lambda c: _fmt(_need(c, "allocation").start_date),
+    "allocation.end_date": lambda c: _fmt(_need(c, "allocation").end_date),
+    "allocation.status.name": lambda c: _fmt(_need(c, "allocation").status.name),
 
     # Resource (primary on matched allocation)
-    "resource.name":               lambda c: _fmt(getattr(_primary_resource(_need(c, "allocation")), "name", None)),
-    "resource.description":        lambda c: _fmt(getattr(_primary_resource(_need(c, "allocation")), "description", None)),
+    "resource.name": lambda c: _fmt(getattr(_primary_resource(_need(c, "allocation")), "name", None)),
+    "resource.description": lambda c: _fmt(getattr(_primary_resource(_need(c, "allocation")), "description", None)),
     "resource.resource_type.name": lambda c: _fmt(
         (_primary_resource(_need(c, "allocation")).resource_type.name
          if _primary_resource(_need(c, "allocation")) and _primary_resource(_need(c, "allocation")).resource_type_id
@@ -173,6 +173,7 @@ def _scope_for(key):
         return "project"
     return "user"
 
+
 QUERY_SCOPES = {k: _scope_for(k) for k, _label, _group in QUERY_CHOICES}
 
 
diff --git a/coldfront_notifications/tasks.py b/coldfront_notifications/tasks.py
index 67b4de8..8888183 100644
--- a/coldfront_notifications/tasks.py
+++ b/coldfront_notifications/tasks.py
@@ -253,7 +253,7 @@ def send_notification_campaign(campaign_pk: int):
     campaign.failed_count    = failed
     campaign.recipient_count = delivered + failed
     campaign.status = (
-        NotificationCampaign.STATUS_SENT    if failed == 0
+        NotificationCampaign.STATUS_SENT if failed == 0
         else NotificationCampaign.STATUS_PARTIAL if delivered > 0
         else NotificationCampaign.STATUS_FAILED
     )
diff --git a/coldfront_notifications/tests/test_unit.py b/coldfront_notifications/tests/test_unit.py
index d4607a2..8e805cd 100644
--- a/coldfront_notifications/tests/test_unit.py
+++ b/coldfront_notifications/tests/test_unit.py
@@ -21,6 +21,7 @@
         INSTALLED_APPS=[
             "django.contrib.contenttypes",
             "django.contrib.auth",
+            "coldfront_notifications",
         ],
         DATABASES={
             "default": {
@@ -40,14 +41,22 @@
     MissingValue,
     _fmt,
     _need,
+    _primary_resource,
     _scope_for,
     resolve,
 )
-from coldfront_notifications.tasks import TOKEN_RE as TASKS_TOKEN_RE, _is_transient, _render
+from coldfront_notifications.tasks import (
+    TOKEN_RE as TASKS_TOKEN_RE,
+    _build_values,
+    _is_transient,
+    _render,
+    _send_with_retry,
+)
 from coldfront_notifications.validators import (
     TOKEN_RE as VALIDATORS_TOKEN_RE,
     _extract_tokens,
     _required_scope,
+    validate_campaign,
 )
 
 
@@ -430,5 +439,288 @@ def test_validators_and_tasks_same_pattern(self):
         self.assertEqual(TASKS_TOKEN_RE.pattern, VALIDATORS_TOKEN_RE.pattern)
 
 
+# ===========================================================================
+# resolvers.py — _primary_resource + resolve exception handling
+# ===========================================================================
+
+
+class TestPrimaryResource(unittest.TestCase):
+
+    def test_none_allocation_returns_none(self):
+        self.assertIsNone(_primary_resource(None))
+
+    def test_returns_get_parent_resource(self):
+        alloc = MagicMock()
+        alloc.get_parent_resource = "StorageA"
+        self.assertEqual(_primary_resource(alloc), "StorageA")
+
+
+class TestResolveExceptionHandling(unittest.TestCase):
+
+    def test_arbitrary_exception_becomes_missing_value(self):
+        """resolve() must not let random exceptions (TypeError, KeyError, etc.)
+        bubble up — they should all collapse to MissingValue."""
+        user = MagicMock()
+        # Force .username to raise TypeError when _fmt calls str()
+        type(user).username = property(lambda self: (_ for _ in ()).throw(TypeError("boom")))
+        ctx = {"user": user, "project": None, "allocation": None}
+        with self.assertRaises(MissingValue):
+            resolve("user.username", ctx)
+
+
+# ===========================================================================
+# tasks.py — _build_values
+# ===========================================================================
+
+
+class TestBuildValues(unittest.TestCase):
+
+    def _make_var(self, source="manual", resolver_key="", value="", is_required=True):
+        v = MagicMock()
+        v.source = source
+        v.SOURCE_MANUAL = "manual"
+        v.resolver_key = resolver_key
+        v.value = value
+        v.is_required = is_required
+        v.key = "test_var"
+        return v
+
+    def test_manual_var_with_value(self):
+        var = self._make_var(value="2026-06-01")
+        result = _build_values(["date"], {"date": var}, {"user": MagicMock()})
+        self.assertEqual(result["date"], "2026-06-01")
+
+    def test_manual_var_required_empty_raises(self):
+        var = self._make_var(value="", is_required=True)
+        with self.assertRaises(MissingValue):
+            _build_values(["date"], {"date": var}, {"user": MagicMock()})
+
+    def test_manual_var_not_required_empty_returns_empty(self):
+        var = self._make_var(value="", is_required=False)
+        result = _build_values(["date"], {"date": var}, {"user": MagicMock()})
+        self.assertEqual(result["date"], "")
+
+    @patch("coldfront_notifications.resolvers.resolve", return_value="alice@test.com")
+    def test_query_var_delegates_to_resolve(self, mock_resolve):
+        var = self._make_var(source="query", resolver_key="user.email")
+        ctx = {"user": MagicMock(email="alice@test.com")}
+        result = _build_values(["email"], {"email": var}, ctx)
+        self.assertEqual(result["email"], "alice@test.com")
+        mock_resolve.assert_called_once_with("user.email", ctx)
+
+    @patch("coldfront_notifications.resolvers.resolve", side_effect=MissingValue("no value"))
+    def test_query_var_resolution_failure_includes_context(self, _):
+        var = self._make_var(source="query", resolver_key="project.title")
+        user = MagicMock()
+        user.email = "bob@test.com"
+        with self.assertRaises(MissingValue) as ctx:
+            _build_values(["title"], {"title": var}, {"user": user})
+        self.assertIn("project.title", str(ctx.exception))
+        self.assertIn("bob@test.com", str(ctx.exception))
+
+    def test_unknown_token_raises(self):
+        with self.assertRaises(MissingValue) as ctx:
+            _build_values(["nonexistent"], {}, {"user": MagicMock()})
+        self.assertIn("nonexistent", str(ctx.exception))
+
+
+# ===========================================================================
+# tasks.py — _send_with_retry
+# ===========================================================================
+
+
+class TestSendWithRetry(unittest.TestCase):
+
+    def _make_msg_and_conn(self):
+        msg = MagicMock()
+        conn = MagicMock()
+        return msg, conn
+
+    def test_success_first_try(self):
+        msg, conn = self._make_msg_and_conn()
+        result = _send_with_retry(msg, conn, max_retries=2, base_delay=0)
+        self.assertIsNone(result)
+        msg.send.assert_called_once()
+
+    def test_permanent_error_returns_immediately(self):
+        msg, conn = self._make_msg_and_conn()
+        exc = smtplib.SMTPResponseException(550, "Mailbox not found")
+        msg.send.side_effect = exc
+        result = _send_with_retry(msg, conn, max_retries=2, base_delay=0)
+        self.assertIs(result, exc)
+        # Should NOT retry on 5xx
+        self.assertEqual(msg.send.call_count, 1)
+
+    @patch("coldfront_notifications.tasks.time.sleep")
+    def test_transient_then_success(self, mock_sleep):
+        msg, conn = self._make_msg_and_conn()
+        exc = smtplib.SMTPResponseException(421, "Try again")
+        msg.send.side_effect = [exc, None]  # fail once, then succeed
+        result = _send_with_retry(msg, conn, max_retries=2, base_delay=0.01)
+        self.assertIsNone(result)
+        self.assertEqual(msg.send.call_count, 2)
+
+    @patch("coldfront_notifications.tasks.time.sleep")
+    def test_transient_exhausts_retries(self, mock_sleep):
+        msg, conn = self._make_msg_and_conn()
+        exc = smtplib.SMTPResponseException(450, "Busy")
+        msg.send.side_effect = exc  # always fails
+        result = _send_with_retry(msg, conn, max_retries=2, base_delay=0.01)
+        self.assertIs(result, exc)
+        # 1 initial + 2 retries = 3 attempts
+        self.assertEqual(msg.send.call_count, 3)
+
+    @patch("coldfront_notifications.tasks.time.sleep")
+    def test_disconnect_reopens_connection(self, mock_sleep):
+        msg, conn = self._make_msg_and_conn()
+        exc = smtplib.SMTPServerDisconnected("gone")
+        msg.send.side_effect = [exc, None]
+        result = _send_with_retry(msg, conn, max_retries=2, base_delay=0.01)
+        self.assertIsNone(result)
+        conn.close.assert_called()
+        conn.open.assert_called()
+
+    @patch("coldfront_notifications.tasks.time.sleep")
+    def test_reopen_failure_returns_exception(self, mock_sleep):
+        msg, conn = self._make_msg_and_conn()
+        msg.send.side_effect = smtplib.SMTPServerDisconnected("gone")
+        reopen_exc = ConnectionError("cannot reopen")
+        conn.open.side_effect = reopen_exc
+        result = _send_with_retry(msg, conn, max_retries=2, base_delay=0.01)
+        self.assertIs(result, reopen_exc)
+
+    @patch("coldfront_notifications.tasks.time.sleep")
+    def test_close_failure_is_swallowed(self, mock_sleep):
+        """connection.close() throwing should not prevent the retry."""
+        msg, conn = self._make_msg_and_conn()
+        exc = smtplib.SMTPResponseException(421, "Try again")
+        msg.send.side_effect = [exc, None]
+        conn.close.side_effect = OSError("close failed")
+        result = _send_with_retry(msg, conn, max_retries=2, base_delay=0.01)
+        self.assertIsNone(result)
+        self.assertEqual(msg.send.call_count, 2)
+
+
+# ===========================================================================
+# validators.py — validate_campaign
+# ===========================================================================
+
+
+class TestValidateCampaign(unittest.TestCase):
+
+    PATCH_ENUM = "coldfront_notifications.validators.enumerate_recipients_deduped"
+    PATCH_RESOLVE = "coldfront_notifications.validators.resolve"
+
+    def _patch_nv_objects(self, return_value):
+        """Patch the local `from .models import NotificationVariable` inside
+        validate_campaign so .objects.filter() returns our fake vars."""
+        patcher = patch(
+            "coldfront_notifications.models.NotificationVariable.objects"
+        )
+        mock_objects = patcher.start()
+        mock_objects.filter.return_value = return_value
+        self.addCleanup(patcher.stop)
+
+    def _make_var(self, key, source="query", resolver_key="user.email",
+                  value="", is_required=True):
+        v = MagicMock()
+        v.key = key
+        v.source = source
+        v.SOURCE_QUERY = "query"
+        v.SOURCE_MANUAL = "manual"
+        v.resolver_key = resolver_key
+        v.value = value
+        v.is_required = is_required
+        return v
+
+    def _make_user(self, pk, username, email):
+        u = MagicMock()
+        u.pk = pk
+        u.username = username
+        u.email = email
+        return u
+
+    @patch(PATCH_ENUM)
+    def test_all_tokens_resolve_cleanly(self, mock_enum):
+        var = self._make_var("name", resolver_key="user.full_name")
+        self._patch_nv_objects([var])
+
+        user = self._make_user(1, "alice", "alice@test.com")
+        mock_enum.return_value = [(user, None, None)]
+
+        with patch(self.PATCH_RESOLVE, return_value="Alice"):
+            result = validate_campaign("Hi {{name}}", "body", {}, {})
+
+        self.assertEqual(result["errors"], [])
+        self.assertEqual(result["missing_tokens"], [])
+        self.assertEqual(result["user_count"], 1)
+        self.assertEqual(result["email_count"], 1)
+
+    @patch(PATCH_ENUM)
+    def test_unknown_token_in_missing_tokens(self, mock_enum):
+        self._patch_nv_objects([])  # no vars match
+        mock_enum.return_value = []
+        result = validate_campaign("Hi {{bogus}}", "body", {}, {})
+        self.assertIn("bogus", result["missing_tokens"])
+
+    @patch(PATCH_ENUM)
+    def test_manual_var_empty_value_reported(self, mock_enum):
+        var = self._make_var("date", source="manual", value="", is_required=True)
+        self._patch_nv_objects([var])
+
+        user = self._make_user(1, "bob", "bob@test.com")
+        mock_enum.return_value = [(user, None, None)]
+
+        result = validate_campaign("Due {{date}}", "body", {}, {})
+        self.assertEqual(len(result["errors"]), 1)
+        self.assertEqual(result["errors"][0]["token"], "date")
+
+    @patch(PATCH_ENUM)
+    def test_query_var_resolution_failure_reported(self, mock_enum):
+        var = self._make_var("title", resolver_key="project.title")
+        self._patch_nv_objects([var])
+
+        user = self._make_user(1, "carol", "carol@test.com")
+        mock_enum.return_value = [(user, None, None)]
+
+        with patch(self.PATCH_RESOLVE, side_effect=MissingValue()):
+            result = validate_campaign("Re: {{title}}", "body", {}, {})
+
+        self.assertEqual(len(result["errors"]), 1)
+        self.assertIn("project.title", result["errors"][0]["reason"])
+
+    @patch(PATCH_ENUM)
+    def test_multi_email_users_reported(self, mock_enum):
+        var = self._make_var("ptitle", resolver_key="project.title")
+        self._patch_nv_objects([var])
+
+        user = self._make_user(1, "alice", "alice@test.com")
+        proj1, proj2 = MagicMock(), MagicMock()
+        # alice appears on 2 projects → 2 tuples
+        mock_enum.return_value = [(user, proj1, None), (user, proj2, None)]
+
+        with patch(self.PATCH_RESOLVE, return_value="Proj"):
+            result = validate_campaign("{{ptitle}}", "body", {}, {})
+
+        self.assertEqual(result["email_count"], 2)
+        self.assertEqual(result["user_count"], 1)
+        self.assertEqual(len(result["multi_emails"]), 1)
+        self.assertEqual(result["multi_emails"][0]["username"], "alice")
+        self.assertEqual(result["multi_emails"][0]["count"], 2)
+
+    @patch(PATCH_ENUM)
+    def test_scope_propagated_correctly(self, mock_enum):
+        var = self._make_var("aid", resolver_key="allocation.id")
+        self._patch_nv_objects([var])
+        mock_enum.return_value = []
+
+        result = validate_campaign("Alloc {{aid}}", "body", {}, {})
+        self.assertEqual(result["scope"], "allocation")
+        # Verify enumerate was called with allocation scope
+        mock_enum.assert_called_once()
+        call_args = mock_enum.call_args
+        self.assertEqual(call_args[0][1], "allocation")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/coldfront_notifications/utils.py b/coldfront_notifications/utils.py
index 3761b69..7f05598 100644
--- a/coldfront_notifications/utils.py
+++ b/coldfront_notifications/utils.py
@@ -148,8 +148,9 @@ def enumerate_recipients(filters: dict, scope: str):
         return
 
     pu_qs = _apply_project_filters(
-        ProjectUser.objects.select_related("user", "project", "project__pi", "project__status", "role")
-                            .filter(status__name="Active"),
+        ProjectUser.objects
+        .select_related("user", "project", "project__pi", "project__status", "role")
+        .filter(status__name="Active"),
         filters,
     ).order_by("user_id", "project_id", "pk")
 
diff --git a/coldfront_notifications/validators.py b/coldfront_notifications/validators.py
index fc1bced..37f5a6f 100644
--- a/coldfront_notifications/validators.py
+++ b/coldfront_notifications/validators.py
@@ -18,8 +18,8 @@
 import re
 from collections import Counter
 
-from .resolvers import QUERY_RESOLVERS, QUERY_SCOPES, MissingValue, resolve
-from .utils import enumerate_recipients, enumerate_recipients_deduped
+from .resolvers import QUERY_SCOPES, MissingValue, resolve
+from .utils import enumerate_recipients_deduped
 
 TOKEN_RE = re.compile(r"\{\{(\w+)\}\}")
 
diff --git a/coldfront_notifications/views.py b/coldfront_notifications/views.py
index 12b2382..5bc5a2a 100644
--- a/coldfront_notifications/views.py
+++ b/coldfront_notifications/views.py
@@ -9,7 +9,18 @@
 from django.utils.text import slugify
 from django.views.decorators.http import require_POST
 
-from .forms import ComposeForm, NotificationTemplateForm, NotificationVariableForm, SenderConfigForm
+from .forms import NotificationTemplateForm, NotificationVariableForm, SenderConfigForm
+from .models import (
+    NotificationCampaign,
+    NotificationLog,
+    NotificationTemplate,
+    NotificationVariable,
+    SenderConfig,
+)
+from .utils import recipient_count
+from .validators import validate_campaign
+
+logger = logging.getLogger(__name__)
 
 
 def _dispatch_send(campaign_pk: int):
@@ -25,7 +36,6 @@ def _dispatch_send(campaign_pk: int):
         logger.warning("Celery broker unreachable (%s) — sending in background thread", exc)
 
         def _run():
-            import django
             from django import db
             try:
                 db.close_old_connections()
@@ -36,21 +46,10 @@ def _run():
 
         t = threading.Thread(target=_run, daemon=True)
         t.start()
-from .models import (
-    NotificationCampaign,
-    NotificationLog,
-    NotificationTemplate,
-    NotificationVariable,
-    SenderConfig,
-)
-from .utils import recipient_count, recipient_emails
-from .validators import validate_campaign
-
-logger = logging.getLogger(__name__)
 
 
 def _get_filter_context():
-    from coldfront.core.project.models import Project, ProjectUserRoleChoice, ProjectStatusChoice
+    from coldfront.core.project.models import Project, ProjectUserRoleChoice
     from coldfront.core.allocation.models import Allocation, AllocationStatusChoice
     from coldfront.core.resource.models import Resource
     from ifxuser.models import Organization
@@ -251,18 +250,18 @@ def _filter(field):
         filters["extra_recipients"] = extra  # preserved in snapshot
         filters["dedupe_users"]     = dedupe_users
         campaign = NotificationCampaign.objects.create(
-            template_id      = tmpl_id or None,
-            subject          = subject,
-            body             = body,
-            sender           = sender,
-            reply_to         = reply_to,
-            status           = (NotificationCampaign.STATUS_DRAFT
-                                if action == "draft"
-                                else NotificationCampaign.STATUS_QUEUED),
-            filters_snapshot = filters,
-            extra_context    = {},
-            recipient_count  = 0,   # filled in during send
-            created_by       = request.user,
+            template_id=tmpl_id or None,
+            subject=subject,
+            body=body,
+            sender=sender,
+            reply_to=reply_to,
+            status=(NotificationCampaign.STATUS_DRAFT
+                    if action == "draft"
+                    else NotificationCampaign.STATUS_QUEUED),
+            filters_snapshot=filters,
+            extra_context={},
+            recipient_count=0,
+            created_by=request.user,
         )
 
         # Logs are created per-tuple during send; drafts carry no logs.
@@ -411,7 +410,7 @@ def recipient_count_view(request):
     want_start = (page - 1) * page_size
     want_end   = want_start + page_size
 
-    for user, project, allocation in enumerate_recipients_deduped(filters, scope, []):
+    for user, project, allocation in enumerate_recipients_deduped(filters, scope, dedupe_users):
         u = user.username
         user_counts[u] += 1
         if u not in user_info:
@@ -429,8 +428,10 @@ def recipient_count_view(request):
                 "user_pk":       user.pk,
                 "project_pk":    project.pk if project else None,
                 "project_title": project.title if project else "",
-                "allocation":    (f"{allocation.pk} — {allocation.get_parent_resource}"
-                                 if allocation else ""),
+                "allocation": (
+                    f"{allocation.pk} — {allocation.get_parent_resource}"
+                    if allocation else ""
+                ),
             })
 
         total += 1

From 2ffbce8a71d5207e708ea14ff64a0dab5da9ffef Mon Sep 17 00:00:00 2001
From: Antonio Rodriguez <antoniorodriguez@theagilemonkeys.com>
Date: Thu, 7 May 2026 12:49:57 +0200
Subject: [PATCH 5/6] Compose notification improvements, sort notifications,
 resend notification.

---
 .../coldfront_notifications/css/compose.css   |  76 ++-
 .../coldfront_notifications/js/compose.js     |  56 +-
 .../templates/campaign_detail.html            |   3 +
 .../templates/campaign_list.html              |   4 +-
 .../templates/compose.html                    | 126 +++--
 .../templates/dashboard.html                  |   4 +-
 .../templates/resend_compose.html             | 491 ++++++++++++++++++
 coldfront_notifications/urls.py               |   1 +
 coldfront_notifications/views.py              |  50 +-
 .../coldfront_notifications/css/compose.css   |  76 ++-
 static/coldfront_notifications/js/compose.js  |  56 +-
 11 files changed, 853 insertions(+), 90 deletions(-)
 create mode 100644 coldfront_notifications/templates/resend_compose.html

diff --git a/coldfront_notifications/static/coldfront_notifications/css/compose.css b/coldfront_notifications/static/coldfront_notifications/css/compose.css
index 7154126..9b02095 100644
--- a/coldfront_notifications/static/coldfront_notifications/css/compose.css
+++ b/coldfront_notifications/static/coldfront_notifications/css/compose.css
@@ -1,17 +1,24 @@
 .flbl { font-weight: 600; font-size: .82rem; margin-bottom: 4px; display: block; color: #343a40; }
 
-/* recipients horizontal grid */
-.recip-grid {
+/* recipients: row 1 — filters */
+.recip-filters {
   display: grid;
-  grid-template-columns: repeat(6, 1fr) auto;
+  grid-template-columns: repeat(6, minmax(0, 1fr));
   gap: 12px;
   align-items: end;
 }
+
+/* recipients: row 2 — count pill + buttons */
+.recip-actions {
+  display: flex; align-items: center; gap: 10px;
+  margin-top: 14px; padding-top: 12px;
+  border-top: 1px solid #eef0f3;
+}
 .recip-count-pill {
   background: #fdf5f6; border: 1px solid #e8b4bb;
-  border-radius: 5px; padding: 6px 12px; text-align: center;
+  border-radius: 5px; padding: 5px 14px; text-align: center;
 }
-.recip-count-num { font-size: 1.6rem; font-weight: 700; font-family: monospace; color: #A51C30; line-height: 1; }
+.recip-count-num { font-size: 1.3rem; font-weight: 700; font-family: monospace; color: #A51C30; line-height: 1; }
 .recip-count-lbl { font-size: .68rem; color: #6c757d; margin-top: 2px; }
 .bcc-badge {
   display: inline-flex; align-items: center; gap: 5px; font-size: .72rem;
@@ -24,8 +31,16 @@
 .tmpl-col { width: 200px; flex-shrink: 0; position: sticky; top: 16px; }
 .compose-col { flex: 1; min-width: 0; }
 
+/* template search */
+.tmpl-search-wrap { padding: 6px 8px; border-bottom: 1px solid #e9ecef; }
+.tmpl-search-input {
+  width: 100%; border: 1px solid #ced4da; border-radius: 3px;
+  padding: 4px 8px; font-size: .76rem; outline: none;
+}
+.tmpl-search-input:focus { border-color: #A51C30; }
+
 /* template list */
-.tmpl-list { max-height: 560px; overflow-y: auto; }
+.tmpl-list { max-height: 520px; overflow-y: auto; }
 .tmpl-list::-webkit-scrollbar { width: 3px; }
 .tmpl-list::-webkit-scrollbar-thumb { background: #ced4da; border-radius: 2px; }
 .tmpl-item {
@@ -94,11 +109,56 @@
 }
 .send-warn i { color: #e65100; margin-top: 1px; flex-shrink: 0; }
 
+/* recipient modal — top bar with search */
+.recip-topbar {
+  display: flex; justify-content: space-between; align-items: center;
+  padding: 8px 12px; background: #f8f9fa; border-bottom: 1px solid #dee2e6;
+  font-size: .78rem; color: #6c757d; gap: 12px;
+}
+.recip-search { width: 220px !important; font-size: .78rem !important; flex-shrink: 0; }
+
+/* recipient modal — fixed-height scrollable table */
+.recip-table-wrap {
+  height: 530px; overflow-y: auto;
+}
+.recip-table-wrap .table { margin-bottom: 0; }
+.recip-table-wrap thead th {
+  position: sticky; top: 0; z-index: 1; background: #e9ecef;
+}
+
+/* recipient toolbar — always visible below the scroll area */
+.recip-toolbar {
+  display: flex; align-items: center; justify-content: space-between;
+  padding: 8px 16px; border-top: 1px solid #dee2e6; background: #f8f9fa;
+  border-radius: 0 0 .3rem .3rem;
+}
+.recip-toolbar-left { font-size: .78rem; color: #6c757d; flex-shrink: 0; }
+.recip-toolbar-center { display: flex; align-items: center; gap: 4px; }
+.recip-toolbar-right { display: flex; align-items: center; flex-shrink: 0; }
+.recip-page-info {
+  font-size: .78rem; margin: 0 6px; white-space: nowrap; min-width: 100px; text-align: center;
+}
+.recip-page-size-label {
+  font-size: .78rem; font-weight: 400; color: #6c757d;
+  display: inline-flex; align-items: center; gap: 4px; margin: 0; white-space: nowrap;
+}
+.recip-page-size-select {
+  width: auto !important; display: inline-block; padding: 2px 6px;
+  font-size: .78rem; height: auto !important;
+}
+
 /* select2 overrides */
 .select2-container { width: 100% !important; }
-.select2-container--default .select2-selection--multiple { border-color: #ced4da; border-radius: 4px; min-height: 36px; }
+.select2-container--default .select2-selection--multiple {
+  border-color: #ced4da; border-radius: 4px; min-height: 36px;
+  max-height: 90px; overflow-y: auto;
+}
 .select2-container--default.select2-container--focus .select2-selection--multiple { border-color: #A51C30; box-shadow: 0 0 0 .15rem rgba(165,28,48,.13); }
 .select2-container--default .select2-results__option--highlighted[aria-selected] { background: #A51C30 !important; }
-.select2-container--default .select2-selection__choice { background: #A51C30 !important; border-color: #8a1728 !important; color: #fff !important; border-radius: 3px; font-size: .75rem; }
+.select2-container--default .select2-selection__choice {
+  background: #A51C30 !important; border-color: #8a1728 !important; color: #fff !important;
+  border-radius: 3px; font-size: .75rem;
+  max-width: 100%; overflow: hidden; text-overflow: ellipsis; word-break: break-word;
+}
 .select2-container--default .select2-selection__choice__remove { color: rgba(255,255,255,.7) !important; }
 .select2-container--default .select2-selection__choice__remove:hover { color: #fff !important; }
diff --git a/coldfront_notifications/static/coldfront_notifications/js/compose.js b/coldfront_notifications/static/coldfront_notifications/js/compose.js
index 0117b63..d6ab45f 100644
--- a/coldfront_notifications/static/coldfront_notifications/js/compose.js
+++ b/coldfront_notifications/static/coldfront_notifications/js/compose.js
@@ -84,6 +84,15 @@ $(document).on('click', '.tmpl-item', function() {
   loadTemplate($(this));
 });
 
+// ── Template search ─────────────────────────────────────────────
+$(document).on('input', '#tmplSearch', function() {
+  var q = $(this).val().toLowerCase();
+  $('.tmpl-item').each(function() {
+    var text = $(this).text().toLowerCase();
+    $(this).toggle(!q || text.indexOf(q) !== -1);
+  });
+});
+
 // ── Variable search ──────────────────────────────────────────────
 $(document).on('input', '#varSearch', function() {
   renderVars(ACTIVE_VARS, $(this).val());
@@ -359,7 +368,7 @@ function runValidation() {
   });
 }
 
-$(document).on('click', '#recalcBtn', function() { runValidation(); });
+$(document).on('click', '#recalcBtn, #recalcBtn2', function() { runValidation(); });
 
 $(document).on('click', '#multiShowBtn', function() {
   $('#multiList').toggle();
@@ -446,8 +455,23 @@ function renderPreviewRows() {
 
 }
 
+function getPageSize() {
+  return parseInt($('#recipPageSize').val(), 10) || 10;
+}
+
+function updatePaginationControls() {
+  var atFirst = PREVIEW_PAGE <= 1;
+  var atLast = PREVIEW_PAGE >= PREVIEW_TOTAL_PAGES;
+  $('#recipPageInfo').text('Page ' + PREVIEW_PAGE + ' of ' + PREVIEW_TOTAL_PAGES);
+  $('#recipFirstBtn').prop('disabled', atFirst);
+  $('#recipPrevBtn').prop('disabled', atFirst);
+  $('#recipNextBtn').prop('disabled', atLast);
+  $('#recipLastBtn').prop('disabled', atLast);
+}
+
 function fetchPreviewPage(page) {
   PREVIEW_PAGE = page || 1;
+  $('#recipSearch').val('');
   $('#recipRows').html('<tr><td colspan="6" class="text-center text-muted py-3"><i class="fas fa-spinner fa-spin mr-1"></i>Loading…</td></tr>');
 
   $.ajax({
@@ -466,6 +490,7 @@ function fetchPreviewPage(page) {
       dedupe_users: JSON.stringify(getDedupeUsers()),
       preview:      'true',
       page:         PREVIEW_PAGE,
+      page_size:    getPageSize(),
     },
     traditional: true,
     success: function(data) {
@@ -486,15 +511,7 @@ function fetchPreviewPage(page) {
       } else {
         $('#dedupeAllRow').hide();
       }
-      // Pagination controls
-      if (PREVIEW_TOTAL_PAGES > 1) {
-        $('#recipPagination').show();
-        $('#recipPageInfo').text('Page ' + PREVIEW_PAGE + ' of ' + PREVIEW_TOTAL_PAGES);
-        $('#recipPrevBtn').prop('disabled', PREVIEW_PAGE <= 1);
-        $('#recipNextBtn').prop('disabled', PREVIEW_PAGE >= PREVIEW_TOTAL_PAGES);
-      } else {
-        $('#recipPagination').hide();
-      }
+      updatePaginationControls();
     },
     error: function() {
       $('#recipRows').html('<tr><td colspan="6" class="text-center text-danger py-3">Failed to load.</td></tr>');
@@ -506,12 +523,30 @@ $(document).on('click', '#previewRecipBtn', function() {
   $('#recipModal').modal('show');
   fetchPreviewPage(1);
 });
+$(document).on('click', '#recipFirstBtn', function() {
+  if (PREVIEW_PAGE > 1) fetchPreviewPage(1);
+});
 $(document).on('click', '#recipPrevBtn', function() {
   if (PREVIEW_PAGE > 1) fetchPreviewPage(PREVIEW_PAGE - 1);
 });
 $(document).on('click', '#recipNextBtn', function() {
   if (PREVIEW_PAGE < PREVIEW_TOTAL_PAGES) fetchPreviewPage(PREVIEW_PAGE + 1);
 });
+$(document).on('click', '#recipLastBtn', function() {
+  if (PREVIEW_PAGE < PREVIEW_TOTAL_PAGES) fetchPreviewPage(PREVIEW_TOTAL_PAGES);
+});
+$(document).on('change', '#recipPageSize', function() {
+  fetchPreviewPage(1);
+});
+
+// Client-side search: filter visible rows in the current page
+$(document).on('input', '#recipSearch', function() {
+  var q = $(this).val().toLowerCase();
+  $('#recipRows tr').each(function() {
+    var text = $(this).text().toLowerCase();
+    $(this).toggle(!q || text.indexOf(q) !== -1);
+  });
+});
 
 // All multi-email usernames across all pages (from server response).
 var ALL_MULTI_USERS = [];
@@ -560,6 +595,7 @@ $(document).ready(function() {
     width: '100%',
     placeholder: function() { return $(this).data('placeholder'); }
   });
+
   // Load first template
   var $first = $('.tmpl-item').first();
   if ($first.length) loadTemplate($first);
diff --git a/coldfront_notifications/templates/campaign_detail.html b/coldfront_notifications/templates/campaign_detail.html
index 9fe5138..ebafcf1 100644
--- a/coldfront_notifications/templates/campaign_detail.html
+++ b/coldfront_notifications/templates/campaign_detail.html
@@ -7,6 +7,9 @@
     <div class="d-flex justify-content-between align-items-center">
       <h2>Notification #{{ campaign.pk }}</h2>
       <div>
+        <a href="{% url 'notifications:resend-compose' campaign.pk %}" class="btn btn-outline-primary btn-sm">
+          <i class="fas fa-clone mr-1"></i>Resend
+        </a>
         {% if campaign.failed_count %}
         <form method="post" action="{% url 'notifications:resend' campaign.pk %}" class="d-inline">
           {% csrf_token %}
diff --git a/coldfront_notifications/templates/campaign_list.html b/coldfront_notifications/templates/campaign_list.html
index ed6bf6c..f2ec898 100644
--- a/coldfront_notifications/templates/campaign_list.html
+++ b/coldfront_notifications/templates/campaign_list.html
@@ -44,7 +44,7 @@ <h3 class="h5 mb-0">All Notifications</h3>
           <td class="text-right text-success" style="font-family:monospace;">{{ c.delivered_count }}</td>
           <td class="text-right {% if c.failed_count %}text-danger{% else %}text-muted{% endif %}" style="font-family:monospace;">{{ c.failed_count|default:"—" }}</td>
           <td style="font-size:.8rem;">{{ c.sent_at|date:"Y-m-d H:i"|default:"—" }}</td>
-          <td>
+          <td data-order="{% if c.status == 'failed' %}0{% elif c.status == 'partial' %}1{% elif c.status == 'sending' %}2{% elif c.status == 'queued' %}3{% elif c.status == 'draft' %}4{% else %}5{% endif %}">
             {% if c.status == 'sent' %}<span class="badge badge-success">Sent</span>
             {% elif c.status == 'sending' %}<span class="badge badge-primary">Sending…</span>
             {% elif c.status == 'partial' %}<span class="badge badge-warning text-dark">Partial</span>
@@ -63,7 +63,7 @@ <h3 class="h5 mb-0">All Notifications</h3>
 {% endblock %}
 {% block javascript %}
 <script>
-var DT_CONFIG = { tableId: 'campaignsTable', order: [[6, 'desc']], nonOrderableTargets: [7] };
+var DT_CONFIG = { tableId: 'campaignsTable', order: [[7, 'asc'], [6, 'desc']] };
 </script>
 <script src="{% static 'coldfront_notifications/js/datatables_init.js' %}"></script>
 {% endblock %}
diff --git a/coldfront_notifications/templates/compose.html b/coldfront_notifications/templates/compose.html
index 7b333c6..2ff81d2 100644
--- a/coldfront_notifications/templates/compose.html
+++ b/coldfront_notifications/templates/compose.html
@@ -28,8 +28,8 @@ <h3 class="h5 mb-0">
   </div>
   <div class="collapse show" id="recipients-body">
     <div class="card-body">
-      <div class="recip-grid">
-
+      <!-- Row 1: filters -->
+      <div class="recip-filters">
         <div>
           <label class="flbl">Project</label>
           <select class="s2" id="f_project" multiple data-placeholder="Any project">
@@ -123,24 +123,24 @@ <h3 class="h5 mb-0">
             {% endfor %}
           </select>
         </div>
+      </div>
 
-        <div style="text-align:center;">
-          <div class="recip-count-pill mb-1">
-            <div class="recip-count-num" id="recipNum">—</div>
-            <div class="recip-count-lbl" id="recipLbl">recipients</div>
-            <div style="font-size:.7rem;color:#6c757d;margin-top:4px;">
-              <span id="emailCount">—</span> emails<span id="multiBadge" style="display:none;"> · <span id="multiCount">0</span> multi</span>
-            </div>
+      <!-- Row 2: count + actions -->
+      <div class="recip-actions">
+        <div class="recip-count-pill">
+          <div class="recip-count-num" id="recipNum">—</div>
+          <div class="recip-count-lbl" id="recipLbl">recipients</div>
+          <div style="font-size:.7rem;color:#6c757d;margin-top:4px;">
+            <span id="emailCount">—</span> emails<span id="multiBadge" style="display:none;"> · <span id="multiCount">0</span> multi</span>
           </div>
-          <button type="button" class="btn btn-outline-secondary btn-sm btn-block mb-1" id="recalcBtn">
-            <i class="fas fa-check-double mr-1"></i>Validate
-          </button>
-          <button type="button" class="btn btn-outline-secondary btn-sm btn-block"
-                  id="previewRecipBtn" disabled>
-            <i class="fas fa-list mr-1"></i>Preview
-          </button>
         </div>
-
+        <button type="button" class="btn btn-outline-secondary btn-sm" id="recalcBtn">
+          <i class="fas fa-check-double mr-1"></i>Validate
+        </button>
+        <button type="button" class="btn btn-outline-secondary btn-sm"
+                id="previewRecipBtn" disabled>
+          <i class="fas fa-eye mr-1"></i>Recipient Preview
+        </button>
       </div>
     </div>
   </div>
@@ -163,6 +163,9 @@ <h3 class="h5 mb-0">
           </a>
         </div>
       </div>
+      <div class="tmpl-search-wrap">
+        <input type="text" id="tmplSearch" class="tmpl-search-input" placeholder="Search templates…">
+      </div>
       <div class="tmpl-list">
         {% for t in templates %}
         <div class="tmpl-item {% if forloop.first %}active{% endif %}"
@@ -307,7 +310,10 @@ <h3 class="h5 mb-0">
               <span class="text-muted" style="font-size:.79rem;">This action cannot be undone.</span>
             </div>
           </div>
-          <div class="d-flex justify-content-end align-items-center">
+          <div class="d-flex justify-content-end align-items-center" style="gap:8px;">
+            <button type="button" class="btn btn-outline-secondary" id="recalcBtn2">
+              <i class="fas fa-check-double mr-1"></i>Validate
+            </button>
             <button type="submit" class="btn btn-primary" id="sendBtn"
                     name="action" value="send" disabled>
               <i class="fas fa-paper-plane mr-1"></i>
@@ -367,51 +373,75 @@ <h5 class="modal-title"><i class="fas fa-users mr-2"></i>Recipient Preview</h5>
         <button type="button" class="close" data-dismiss="modal">&times;</button>
       </div>
       <div class="modal-body p-0">
-        <div class="px-3 py-2 d-flex justify-content-between align-items-center" style="background:#f8f9fa;border-bottom:1px solid #dee2e6;font-size:.78rem;color:#6c757d;">
+        <div class="recip-topbar">
           <span>
             <i class="fas fa-info-circle mr-1"></i>
             Users with multiple emails show a <strong>dedupe</strong> checkbox — tick it to send them only their first email.
           </span>
+          <input type="text" id="recipSearch" class="form-control form-control-sm recip-search"
+                 placeholder="Search name, email, project…">
+        </div>
+        <!-- Fixed-height scrollable table area -->
+        <div class="recip-table-wrap">
+          <table class="table table-sm mb-0">
+            <thead class="thead-light">
+              <tr>
+                <th style="width:40px;">Dedupe</th>
+                <th>Name</th><th>Email</th><th>Role</th><th>Project</th><th>Allocation</th>
+              </tr>
+            </thead>
+            <tbody id="dedupeAllRow" style="display:none;">
+              <tr style="background:#f8f9fa;">
+                <td style="text-align:center;">
+                  <input type="checkbox" id="dedupeAllCb" title="Dedupe all">
+                </td>
+                <td colspan="5" style="font-size:.78rem;color:#6c757d;">
+                  <strong>Dedupe all</strong> — send at most one email per user
+                </td>
+              </tr>
+            </tbody>
+            <tbody id="recipRows">
+              <tr><td colspan="6" class="text-center text-muted py-3">
+                <i class="fas fa-spinner fa-spin mr-1"></i>Loading…
+              </td></tr>
+            </tbody>
+          </table>
         </div>
-        <table class="table table-sm mb-0">
-          <thead class="thead-light">
-            <tr>
-              <th style="width:40px;">Dedupe</th>
-              <th>Name</th><th>Email</th><th>Role</th><th>Project</th><th>Allocation</th>
-            </tr>
-          </thead>
-          <tbody id="dedupeAllRow" style="display:none;">
-            <tr style="background:#f8f9fa;">
-              <td style="text-align:center;">
-                <input type="checkbox" id="dedupeAllCb" title="Dedupe all">
-              </td>
-              <td colspan="5" style="font-size:.78rem;color:#6c757d;">
-                <strong>Dedupe all</strong> — send at most one email per user
-              </td>
-            </tr>
-          </tbody>
-          <tbody id="recipRows">
-            <tr><td colspan="6" class="text-center text-muted py-3">
-              <i class="fas fa-spinner fa-spin mr-1"></i>Loading…
-            </td></tr>
-          </tbody>
-        </table>
       </div>
-      <div class="modal-footer d-flex justify-content-between align-items-center">
-        <small class="text-muted">
+      <!-- Pagination bar — always visible, outside scroll area -->
+      <div class="recip-toolbar">
+        <div class="recip-toolbar-left">
           <span id="recipModalCount"></span>
           <span class="badge badge-info ml-2" id="recipModalScope" style="display:none;"></span>
-        </small>
-        <div id="recipPagination" style="display:none;">
+        </div>
+        <div class="recip-toolbar-center" id="recipPagination">
+          <button type="button" class="btn btn-outline-secondary btn-sm" id="recipFirstBtn" disabled title="First page">
+            <i class="fas fa-angle-double-left"></i>
+          </button>
           <button type="button" class="btn btn-outline-secondary btn-sm" id="recipPrevBtn" disabled>
             <i class="fas fa-chevron-left"></i>
           </button>
-          <span id="recipPageInfo" style="font-size:.78rem;margin:0 8px;"></span>
+          <span class="recip-page-info" id="recipPageInfo">Page 1 of 1</span>
           <button type="button" class="btn btn-outline-secondary btn-sm" id="recipNextBtn" disabled>
             <i class="fas fa-chevron-right"></i>
           </button>
+          <button type="button" class="btn btn-outline-secondary btn-sm" id="recipLastBtn" disabled title="Last page">
+            <i class="fas fa-angle-double-right"></i>
+          </button>
+        </div>
+        <div class="recip-toolbar-right">
+          <label class="recip-page-size-label">
+            Show
+            <select id="recipPageSize" class="form-control form-control-sm recip-page-size-select">
+              <option value="10" selected>10</option>
+              <option value="25">25</option>
+              <option value="50">50</option>
+              <option value="100">100</option>
+            </select>
+            per page
+          </label>
+          <button type="button" class="btn btn-secondary btn-sm ml-3" data-dismiss="modal">Close</button>
         </div>
-        <button type="button" class="btn btn-secondary btn-sm" data-dismiss="modal">Close</button>
       </div>
     </div>
   </div>
diff --git a/coldfront_notifications/templates/dashboard.html b/coldfront_notifications/templates/dashboard.html
index 157c3f1..f609cd7 100644
--- a/coldfront_notifications/templates/dashboard.html
+++ b/coldfront_notifications/templates/dashboard.html
@@ -92,7 +92,7 @@ <h3 class="h5 mb-0">
               <td style="font-size:.8rem;font-family:monospace;">{{ campaign.sender }}</td>
               <td class="text-right" style="font-family:monospace;">{{ campaign.recipient_count }}</td>
               <td style="font-size:.8rem;">{{ campaign.sent_at|date:"Y-m-d H:i"|default:"—" }}</td>
-              <td>
+              <td data-order="{% if campaign.status == 'failed' %}0{% elif campaign.status == 'partial' %}1{% elif campaign.status == 'sending' %}2{% elif campaign.status == 'queued' %}3{% elif campaign.status == 'draft' %}4{% else %}5{% endif %}">
                 {% if campaign.status == 'sent' %}
                   <span class="badge badge-success">Sent</span>
                 {% elif campaign.status == 'sending' %}
@@ -131,7 +131,7 @@ <h3 class="h5 mb-0">
 
 {% block javascript %}
 <script>
-var DT_CONFIG = { tableId: 'campaignsTable', order: [[4, 'desc']], nonOrderableTargets: [5], paging: false, searching: false, info: false };
+var DT_CONFIG = { tableId: 'campaignsTable', order: [[5, 'asc'], [4, 'desc']], paging: false, searching: false, info: false };
 </script>
 <script src="{% static 'coldfront_notifications/js/datatables_init.js' %}"></script>
 {% endblock %}
\ No newline at end of file
diff --git a/coldfront_notifications/templates/resend_compose.html b/coldfront_notifications/templates/resend_compose.html
new file mode 100644
index 0000000..25bbe73
--- /dev/null
+++ b/coldfront_notifications/templates/resend_compose.html
@@ -0,0 +1,491 @@
+{% extends "common/base.html" %}
+{% load static %}
+{% block title %}Resend Notification #{{ source.pk }} | FAS Research Computing{% endblock %}
+
+{% block content %}
+<link rel="stylesheet" href="{% static 'coldfront_notifications/css/compose.css' %}">
+
+<div class="mb-3">
+  <h2>
+    Resend Notification
+    <small class="text-muted" style="font-size:.6em;">#{{ source.pk }}</small>
+  </h2>
+  <hr>
+</div>
+
+<div class="row">
+
+  <!-- LEFT: review & edit -->
+  <div class="col-lg-8">
+    <form method="post" id="resendForm">
+      {% csrf_token %}
+
+      <div class="card mb-3">
+        <div class="card-header">
+          <div class="d-flex justify-content-between align-items-center">
+            <h3 class="h5 mb-0"><i class="fas fa-edit mr-1 text-muted"></i>Review & Edit</h3>
+            <button type="button" class="btn btn-sm btn-outline-secondary" id="previewBtn">
+              <i class="fas fa-eye mr-1"></i>Preview
+            </button>
+          </div>
+        </div>
+        <div class="card-body">
+
+          <div class="form-group">
+            <label class="flbl">Subject</label>
+            <input type="text" class="form-control" id="id_subject" name="subject" value="{{ source.subject }}">
+          </div>
+
+          <div class="form-row">
+            <div class="form-group col-md-5">
+              <label class="flbl">From</label>
+              <select class="form-control" id="id_sender" name="sender">
+                {% for s in senders %}
+                <option value="{{ s.email }}" {% if s.email == source.sender %}selected{% endif %}>
+                  {{ s.label }} &lt;{{ s.email }}&gt;
+                </option>
+                {% endfor %}
+              </select>
+            </div>
+            <div class="form-group col-md-5">
+              <label class="flbl">Reply-To</label>
+              <select class="form-control" id="id_reply_to" name="reply_to">
+                <option value="">--</option>
+                {% for s in senders %}
+                <option value="{{ s.email }}" {% if s.email == source.reply_to %}selected{% endif %}>
+                  {{ s.label }} &lt;{{ s.email }}&gt;
+                </option>
+                {% endfor %}
+              </select>
+            </div>
+          </div>
+
+          <div class="form-group mb-0">
+            <label class="flbl">Body</label>
+            <textarea class="form-control" id="id_body" name="body" rows="14"
+                      style="font-family:monospace;font-size:.84rem;line-height:1.6;">{{ source.body }}</textarea>
+          </div>
+
+        </div>
+      </div>
+
+      <!-- Validation + Send bar -->
+      <div class="card">
+        <div class="card-body" style="padding:14px 16px;">
+          <div id="validateBanner" style="display:none;margin-bottom:12px;"></div>
+          <div class="d-flex justify-content-between align-items-center">
+            <div style="display:flex;gap:8px;align-items:center;">
+              <a href="{% url 'notifications:campaign-detail' source.pk %}" class="btn btn-outline-secondary btn-sm">
+                <i class="fas fa-arrow-left mr-1"></i>Back
+              </a>
+              <button type="button" class="btn btn-outline-secondary btn-sm" id="previewRecipBtn">
+                <i class="fas fa-eye mr-1"></i>Recipient Preview
+              </button>
+            </div>
+            <div style="display:flex;gap:8px;align-items:center;">
+              <button type="button" class="btn btn-outline-secondary" id="recalcBtn">
+                <i class="fas fa-check-double mr-1"></i>Validate
+              </button>
+              <button type="submit" class="btn btn-primary" id="sendBtn">
+                <i class="fas fa-paper-plane mr-1"></i>Send
+              </button>
+            </div>
+          </div>
+        </div>
+      </div>
+
+    </form>
+  </div>
+
+  <!-- RIGHT: original campaign info (read-only) -->
+  <div class="col-lg-4">
+
+    <div class="card mb-3">
+      <div class="card-header"><h5 class="h6 mb-0">Original Campaign</h5></div>
+      <div class="card-body p-0">
+        <table class="table table-sm mb-0" style="font-size:.82rem;">
+          <tr>
+            <td class="font-weight-bold text-muted" style="width:100px;">Status</td>
+            <td>{{ source.get_status_display }}</td>
+          </tr>
+          <tr>
+            <td class="font-weight-bold text-muted">Template</td>
+            <td>
+              {% if source.template %}
+                <span class="badge badge-secondary" style="font-family:monospace;">{{ source.template.slug }}</span>
+              {% else %}--{% endif %}
+            </td>
+          </tr>
+          <tr>
+            <td class="font-weight-bold text-muted">Sent At</td>
+            <td>{{ source.sent_at|date:"Y-m-d H:i:s"|default:"--" }}</td>
+          </tr>
+          <tr>
+            <td class="font-weight-bold text-muted">Recipients</td>
+            <td>{{ source.recipient_count }}</td>
+          </tr>
+          <tr>
+            <td class="font-weight-bold text-muted">Delivered</td>
+            <td><span class="text-success">{{ source.delivered_count }}</span></td>
+          </tr>
+          <tr>
+            <td class="font-weight-bold text-muted">Failed</td>
+            <td>
+              {% if source.failed_count %}<span class="text-danger">{{ source.failed_count }}</span>
+              {% else %}0{% endif %}
+            </td>
+          </tr>
+        </table>
+      </div>
+    </div>
+
+    <div class="card mb-3">
+      <div class="card-header"><h5 class="h6 mb-0">Filters (from original)</h5></div>
+      <div class="card-body" style="word-break:break-word;">
+        {% for f in source.filter_summary %}
+          <span class="badge badge-light border text-dark mb-1" style="font-size:.75rem;">{{ f }}</span>
+        {% empty %}
+          <em class="text-muted" style="font-size:.82rem;">None -- all users matched</em>
+        {% endfor %}
+      </div>
+    </div>
+
+    <div class="alert alert-info" style="font-size:.82rem;">
+      <i class="fas fa-info-circle mr-1"></i>
+      This will create a <strong>new campaign</strong> using the same filters and recipients as the original.
+      You can edit the subject and body before sending.
+    </div>
+
+  </div>
+
+</div>
+
+<!-- MODAL: Email Preview -->
+<div class="modal fade" id="previewModal" tabindex="-1" role="dialog">
+  <div class="modal-dialog modal-lg">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title"><i class="fas fa-eye mr-2"></i>Email Preview</h5>
+        <button type="button" class="close" data-dismiss="modal">&times;</button>
+      </div>
+      <div class="modal-body">
+        <div class="d-flex justify-content-between align-items-center mb-2" style="font-size:.82rem;">
+          <div>
+            <strong>Rendering for:</strong>
+            <select id="prev-recipient-picker" class="form-control form-control-sm d-inline-block ml-2"
+                    style="width:auto;min-width:280px;"></select>
+          </div>
+          <small class="text-muted" id="prev-scope-badge"></small>
+        </div>
+        <table class="table table-sm table-borderless mb-2" style="font-size:.82rem;">
+          <tr><td style="width:75px;font-weight:600;color:#6c757d;">From</td>     <td id="prev-from"></td></tr>
+          <tr><td style="font-weight:600;color:#6c757d;">Reply-To</td>            <td id="prev-replyto"></td></tr>
+          <tr><td style="font-weight:600;color:#6c757d;">To</td>                  <td id="prev-to"></td></tr>
+          <tr><td style="font-weight:600;color:#6c757d;">Subject</td>             <td id="prev-subject"></td></tr>
+        </table>
+        <div id="prev-error" class="alert alert-warning py-2" style="font-size:.78rem;display:none;"></div>
+        <hr class="my-2">
+        <pre style="background:#fffef8;border:1px solid #e2d9b8;border-radius:4px;padding:14px;font-size:.84rem;white-space:pre-wrap;max-height:320px;overflow-y:auto;" id="prev-body"></pre>
+      </div>
+      <div class="modal-footer">
+        <small class="text-muted mr-auto" id="prev-footer">--</small>
+        <button type="button" class="btn btn-secondary btn-sm" data-dismiss="modal">Close</button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- MODAL: Recipient Preview -->
+<div class="modal fade" id="recipModal" tabindex="-1" role="dialog">
+  <div class="modal-dialog modal-lg">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title"><i class="fas fa-users mr-2"></i>Recipient Preview</h5>
+        <button type="button" class="close" data-dismiss="modal">&times;</button>
+      </div>
+      <div class="modal-body p-0">
+        <div class="recip-topbar">
+          <span>
+            <i class="fas fa-info-circle mr-1"></i>
+            Recipients that will receive this resend.
+          </span>
+          <input type="text" id="recipSearch" class="form-control form-control-sm recip-search"
+                 placeholder="Search name, email, project...">
+        </div>
+        <div class="recip-table-wrap">
+          <table class="table table-sm mb-0">
+            <thead class="thead-light">
+              <tr>
+                <th>Name</th><th>Email</th><th>Role</th><th>Project</th><th>Allocation</th>
+              </tr>
+            </thead>
+            <tbody id="recipRows">
+              <tr><td colspan="5" class="text-center text-muted py-3">
+                <i class="fas fa-spinner fa-spin mr-1"></i>Loading...
+              </td></tr>
+            </tbody>
+          </table>
+        </div>
+      </div>
+      <div class="recip-toolbar">
+        <div class="recip-toolbar-left">
+          <span id="recipModalCount"></span>
+          <span class="badge badge-info ml-2" id="recipModalScope" style="display:none;"></span>
+        </div>
+        <div class="recip-toolbar-center" id="recipPagination">
+          <button type="button" class="btn btn-outline-secondary btn-sm" id="recipFirstBtn" disabled>
+            <i class="fas fa-angle-double-left"></i>
+          </button>
+          <button type="button" class="btn btn-outline-secondary btn-sm" id="recipPrevBtn" disabled>
+            <i class="fas fa-chevron-left"></i>
+          </button>
+          <span class="recip-page-info" id="recipPageInfo">Page 1 of 1</span>
+          <button type="button" class="btn btn-outline-secondary btn-sm" id="recipNextBtn" disabled>
+            <i class="fas fa-chevron-right"></i>
+          </button>
+          <button type="button" class="btn btn-outline-secondary btn-sm" id="recipLastBtn" disabled>
+            <i class="fas fa-angle-double-right"></i>
+          </button>
+        </div>
+        <div class="recip-toolbar-right">
+          <label class="recip-page-size-label">
+            Show
+            <select id="recipPageSize" class="form-control form-control-sm recip-page-size-select">
+              <option value="10" selected>10</option>
+              <option value="25">25</option>
+              <option value="50">50</option>
+              <option value="100">100</option>
+            </select>
+            per page
+          </label>
+          <button type="button" class="btn btn-secondary btn-sm ml-3" data-dismiss="modal">Close</button>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+
+{% endblock %}
+
+{% block javascript %}
+<script>
+var SNAPSHOT = {{ snapshot_json|safe }};
+var URLS = {
+  previewRender:  '{% url "notifications:preview-render" %}',
+  recipientCount: '{% url "notifications:recipient-count" %}',
+  validate:       '{% url "notifications:validate" %}'
+};
+</script>
+<script>
+(function() {
+  var csrfToken = $('input[name=csrfmiddlewaretoken]').val();
+
+  // ── Filters from the original campaign snapshot ──────────────────
+  function snapshotFilters() { return SNAPSHOT; }
+  function snapshotFilterList(key) { return (SNAPSHOT[key] || []); }
+
+  // ── Validate ─────────────────────────────────────────────────────
+  $(document).on('click', '#recalcBtn', function() {
+    var $btn = $(this);
+    $btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin mr-1"></i>Validating...');
+
+    $.ajax({
+      url: URLS.validate, type: 'POST',
+      data: {
+        csrfmiddlewaretoken: csrfToken,
+        subject: $('#id_subject').val() || '',
+        body: $('#id_body').val() || '',
+        filters: JSON.stringify(snapshotFilters()),
+        extra_context: JSON.stringify({}),
+        dedupe_users: JSON.stringify([]),
+      },
+      success: function(data) {
+        var errs = data.errors || [];
+        var miss = data.missing_tokens || [];
+        var emails = data.email_count || 0;
+        var $banner = $('#validateBanner');
+        if (miss.length || errs.length) {
+          var html = '';
+          if (miss.length) {
+            var tokens = miss.map(function(t) { return '<code>{% templatetag openvariable %}' + t + '{% templatetag closevariable %}</code>'; }).join(', ');
+            html += '<div class="alert alert-danger py-2 mb-2" style="font-size:.84rem;">'
+              + '<i class="fas fa-exclamation-triangle mr-1"></i>'
+              + '<strong>' + miss.length + ' unknown token(s):</strong> ' + tokens + '</div>';
+          }
+          if (errs.length) {
+            html += '<div class="alert alert-warning py-2 mb-0" style="font-size:.84rem;">'
+              + '<i class="fas fa-exclamation-circle mr-1"></i>'
+              + '<strong>' + errs.length + ' resolution error(s)</strong> — '
+              + 'some variables could not be resolved for all recipients.</div>';
+          }
+          $banner.html(html).show();
+          $btn.removeClass('btn-outline-secondary btn-success').addClass('btn-danger')
+              .html('<i class="fas fa-times-circle mr-1"></i>Errors found');
+        } else {
+          $banner.hide();
+          $btn.removeClass('btn-outline-secondary btn-danger').addClass('btn-success')
+              .html('<i class="fas fa-check-circle mr-1"></i>' + emails + ' emails OK');
+        }
+      },
+      error: function() {
+        $('#validateBanner').hide();
+        $btn.removeClass('btn-outline-secondary btn-success').addClass('btn-danger')
+            .html('<i class="fas fa-times-circle mr-1"></i>Validation failed');
+      },
+      complete: function() { $btn.prop('disabled', false); }
+    });
+  });
+
+  // ── Email Preview modal ──────────────────────────────────────────
+  var PREVIEW_SAMPLES = [];
+
+  function renderPreviewSample(idx) {
+    var s = PREVIEW_SAMPLES[idx];
+    if (!s) {
+      $('#prev-to').text('--');
+      $('#prev-subject').text($('#id_subject').val() || '--');
+      $('#prev-body').text($('#id_body').val() || '--');
+      $('#prev-error').hide();
+      $('#prev-footer').text('Showing template with literal placeholders');
+      return;
+    }
+    $('#prev-to').text((s.recipient.name || s.recipient.username) + ' <' + s.recipient.email + '>');
+    $('#prev-subject').text(s.subject || '--');
+    $('#prev-body').text(s.body || '--');
+    if (s.error) { $('#prev-error').text('Resolution error: ' + s.error).show(); }
+    else { $('#prev-error').hide(); }
+    var ctx = [];
+    if (s.recipient.project) ctx.push('project: ' + s.recipient.project);
+    if (s.recipient.allocation) ctx.push('allocation: ' + s.recipient.allocation);
+    $('#prev-footer').text(ctx.join(' · ') || 'recipient-only context');
+  }
+
+  $(document).on('click', '#previewBtn', function() {
+    $('#prev-from').text($('#id_sender').val());
+    $('#prev-replyto').text($('#id_reply_to').val());
+    PREVIEW_SAMPLES = [];
+    $('#prev-recipient-picker').html('<option value="">-- Template (raw placeholders) --</option>'
+      + '<option disabled>Loading samples...</option>');
+    renderPreviewSample(null);
+    $('#prev-scope-badge').text('');
+    $('#previewModal').modal('show');
+
+    $.ajax({
+      url: URLS.previewRender, type: 'POST',
+      data: {
+        csrfmiddlewaretoken: csrfToken,
+        subject: $('#id_subject').val() || '',
+        body: $('#id_body').val() || '',
+        filters: JSON.stringify(snapshotFilters()),
+        dedupe_users: JSON.stringify([]),
+      },
+      success: function(data) {
+        PREVIEW_SAMPLES = data.samples || [];
+        var opts = ['<option value="">-- Template (raw placeholders) --</option>'];
+        PREVIEW_SAMPLES.forEach(function(s, i) {
+          var lbl = (s.recipient.name || s.recipient.username) + ' <' + s.recipient.email + '>';
+          if (s.recipient.project) lbl += ' · ' + s.recipient.project;
+          opts.push('<option value="' + i + '">' + lbl + '</option>');
+        });
+        if (!PREVIEW_SAMPLES.length) opts.push('<option disabled>(no matching recipients)</option>');
+        $('#prev-recipient-picker').html(opts.join(''));
+        if (data.scope) $('#prev-scope-badge').text('scope: ' + data.scope + ' · ' + (data.total_emails || 0) + ' total');
+        if (PREVIEW_SAMPLES.length) { $('#prev-recipient-picker').val('0'); renderPreviewSample(0); }
+        else { renderPreviewSample(null); }
+      },
+      error: function() {
+        $('#prev-recipient-picker').html('<option value="">-- Template (raw placeholders) --</option>');
+        $('#prev-footer').text('Preview failed to load');
+      },
+    });
+  });
+
+  $(document).on('change', '#prev-recipient-picker', function() {
+    var v = $(this).val();
+    renderPreviewSample(v === '' ? null : parseInt(v, 10));
+  });
+
+  // ── Recipient Preview modal ──────────────────────────────────────
+  var PREVIEW_ROWS = [], PREVIEW_SCOPE = null, PREVIEW_PAGE = 1, PREVIEW_TOTAL_PAGES = 1;
+
+  function getPageSize() { return parseInt($('#recipPageSize').val(), 10) || 10; }
+
+  function updatePaginationControls() {
+    var atFirst = PREVIEW_PAGE <= 1, atLast = PREVIEW_PAGE >= PREVIEW_TOTAL_PAGES;
+    $('#recipPageInfo').text('Page ' + PREVIEW_PAGE + ' of ' + PREVIEW_TOTAL_PAGES);
+    $('#recipFirstBtn').prop('disabled', atFirst);
+    $('#recipPrevBtn').prop('disabled', atFirst);
+    $('#recipNextBtn').prop('disabled', atLast);
+    $('#recipLastBtn').prop('disabled', atLast);
+  }
+
+  function renderRecipRows() {
+    var html = '';
+    PREVIEW_ROWS.forEach(function(r) {
+      html += '<tr>'
+        + '<td>' + (r.full_name || '') + '</td>'
+        + '<td style="font-family:monospace;font-size:.78rem;">' + (r.email || '') + '</td>'
+        + '<td>' + (r.role || '') + '</td>'
+        + '<td>' + (r.project || '') + '</td>'
+        + '<td style="font-size:.78rem;">' + (r.allocation || '') + '</td>'
+        + '</tr>';
+    });
+    $('#recipRows').html(html || '<tr><td colspan="5" class="text-center text-muted py-3">No recipients matched.</td></tr>');
+
+    var scopeLbl = PREVIEW_SCOPE ? 'scope: ' + PREVIEW_SCOPE : '';
+    $('#recipModalCount').text(PREVIEW_ROWS.length + ' on this page');
+    if (PREVIEW_SCOPE) { $('#recipModalScope').text(scopeLbl).show(); } else { $('#recipModalScope').hide(); }
+  }
+
+  function fetchPreviewPage(page) {
+    PREVIEW_PAGE = page || 1;
+    $('#recipSearch').val('');
+    $('#recipRows').html('<tr><td colspan="5" class="text-center text-muted py-3"><i class="fas fa-spinner fa-spin mr-1"></i>Loading...</td></tr>');
+
+    $.ajax({
+      url: URLS.recipientCount, type: 'POST',
+      data: {
+        csrfmiddlewaretoken: csrfToken,
+        projects: snapshotFilterList('projects'),
+        allocations: snapshotFilterList('allocations'),
+        departments: snapshotFilterList('departments'),
+        resources: snapshotFilterList('resources'),
+        alloc_status: snapshotFilterList('statuses'),
+        roles: snapshotFilterList('roles'),
+        subject: $('#id_subject').val() || '',
+        body: $('#id_body').val() || '',
+        dedupe_users: JSON.stringify([]),
+        preview: 'true',
+        page: PREVIEW_PAGE,
+        page_size: getPageSize(),
+      },
+      traditional: true,
+      success: function(data) {
+        PREVIEW_ROWS = data.recipients || [];
+        PREVIEW_SCOPE = data.scope || null;
+        PREVIEW_TOTAL_PAGES = data.total_pages || 1;
+        PREVIEW_PAGE = data.page || 1;
+        renderRecipRows();
+        updatePaginationControls();
+      },
+      error: function() {
+        $('#recipRows').html('<tr><td colspan="5" class="text-center text-danger py-3">Failed to load.</td></tr>');
+      }
+    });
+  }
+
+  $(document).on('click', '#previewRecipBtn', function() { $('#recipModal').modal('show'); fetchPreviewPage(1); });
+  $(document).on('click', '#recipFirstBtn', function() { if (PREVIEW_PAGE > 1) fetchPreviewPage(1); });
+  $(document).on('click', '#recipPrevBtn', function() { if (PREVIEW_PAGE > 1) fetchPreviewPage(PREVIEW_PAGE - 1); });
+  $(document).on('click', '#recipNextBtn', function() { if (PREVIEW_PAGE < PREVIEW_TOTAL_PAGES) fetchPreviewPage(PREVIEW_PAGE + 1); });
+  $(document).on('click', '#recipLastBtn', function() { if (PREVIEW_PAGE < PREVIEW_TOTAL_PAGES) fetchPreviewPage(PREVIEW_TOTAL_PAGES); });
+  $(document).on('change', '#recipPageSize', function() { fetchPreviewPage(1); });
+
+  $(document).on('input', '#recipSearch', function() {
+    var q = $(this).val().toLowerCase();
+    $('#recipRows tr').each(function() { $(this).toggle(!q || $(this).text().toLowerCase().indexOf(q) !== -1); });
+  });
+
+})();
+</script>
+{% endblock %}
diff --git a/coldfront_notifications/urls.py b/coldfront_notifications/urls.py
index 546fd9f..ef2ce13 100644
--- a/coldfront_notifications/urls.py
+++ b/coldfront_notifications/urls.py
@@ -9,6 +9,7 @@
     path("campaigns/",                views.campaign_list,        name="campaign-list"),
     path("campaigns/<int:pk>/",       views.campaign_detail,      name="campaign-detail"),
     path("campaigns/<int:pk>/resend/",views.resend_failed,        name="resend"),
+    path("campaigns/<int:pk>/resend-compose/",views.resend_compose, name="resend-compose"),
     path("campaigns/<int:pk>/progress/",views.campaign_progress, name="campaign-progress"),
     path("templates/",                views.template_list,        name="template-list"),
     path("templates/new/",            views.template_form,        name="template-create"),
diff --git a/coldfront_notifications/views.py b/coldfront_notifications/views.py
index 5bc5a2a..348d513 100644
--- a/coldfront_notifications/views.py
+++ b/coldfront_notifications/views.py
@@ -389,7 +389,10 @@ def recipient_count_view(request):
     except (ValueError, TypeError):
         page = 1
     from .conf import PREVIEW_PAGE_SIZE
-    page_size = PREVIEW_PAGE_SIZE
+    try:
+        page_size = max(10, min(100, int(request.POST.get("page_size", PREVIEW_PAGE_SIZE))))
+    except (ValueError, TypeError):
+        page_size = PREVIEW_PAGE_SIZE
 
     # Determine scope the same way the validator/sender will.
     from .utils import enumerate_recipients_deduped
@@ -760,4 +763,47 @@ def _json(field, default):
 
     result = validate_campaign(subject, body, filters, extra_context,
                                dedupe_users=dedupe_users)
-    return JsonResponse(result)
\ No newline at end of file
+    return JsonResponse(result)
+
+
+@staff_required
+def resend_compose(request, pk):
+    """
+    Show a review-and-resend page pre-filled from an existing campaign.
+    POST creates a new campaign and dispatches it.
+    """
+    source = get_object_or_404(NotificationCampaign, pk=pk)
+    snapshot = source.filters_snapshot or {}
+
+    if request.method == "POST":
+        subject = request.POST.get("subject", "").strip()
+        body = request.POST.get("body", "").strip()
+        sender = request.POST.get("sender", "")
+        reply_to = request.POST.get("reply_to", "")
+
+        if not subject or not body:
+            messages.error(request, "Subject and body are required.")
+            return redirect("notifications:resend-compose", pk=pk)
+
+        campaign = NotificationCampaign.objects.create(
+            template=source.template,
+            subject=subject,
+            body=body,
+            sender=sender,
+            reply_to=reply_to,
+            status=NotificationCampaign.STATUS_QUEUED,
+            filters_snapshot=snapshot,
+            extra_context=source.extra_context or {},
+            recipient_count=0,
+            created_by=request.user,
+        )
+        _dispatch_send(campaign.pk)
+        messages.info(request, "Resend queued — sending in progress.")
+        return redirect("notifications:campaign-detail", pk=campaign.pk)
+
+    return render(request, "resend_compose.html", {
+        "source": source,
+        "snapshot": snapshot,
+        "snapshot_json": json.dumps(snapshot),
+        "senders": SenderConfig.objects.all(),
+    })
\ No newline at end of file
diff --git a/static/coldfront_notifications/css/compose.css b/static/coldfront_notifications/css/compose.css
index 7154126..9b02095 100644
--- a/static/coldfront_notifications/css/compose.css
+++ b/static/coldfront_notifications/css/compose.css
@@ -1,17 +1,24 @@
 .flbl { font-weight: 600; font-size: .82rem; margin-bottom: 4px; display: block; color: #343a40; }
 
-/* recipients horizontal grid */
-.recip-grid {
+/* recipients: row 1 — filters */
+.recip-filters {
   display: grid;
-  grid-template-columns: repeat(6, 1fr) auto;
+  grid-template-columns: repeat(6, minmax(0, 1fr));
   gap: 12px;
   align-items: end;
 }
+
+/* recipients: row 2 — count pill + buttons */
+.recip-actions {
+  display: flex; align-items: center; gap: 10px;
+  margin-top: 14px; padding-top: 12px;
+  border-top: 1px solid #eef0f3;
+}
 .recip-count-pill {
   background: #fdf5f6; border: 1px solid #e8b4bb;
-  border-radius: 5px; padding: 6px 12px; text-align: center;
+  border-radius: 5px; padding: 5px 14px; text-align: center;
 }
-.recip-count-num { font-size: 1.6rem; font-weight: 700; font-family: monospace; color: #A51C30; line-height: 1; }
+.recip-count-num { font-size: 1.3rem; font-weight: 700; font-family: monospace; color: #A51C30; line-height: 1; }
 .recip-count-lbl { font-size: .68rem; color: #6c757d; margin-top: 2px; }
 .bcc-badge {
   display: inline-flex; align-items: center; gap: 5px; font-size: .72rem;
@@ -24,8 +31,16 @@
 .tmpl-col { width: 200px; flex-shrink: 0; position: sticky; top: 16px; }
 .compose-col { flex: 1; min-width: 0; }
 
+/* template search */
+.tmpl-search-wrap { padding: 6px 8px; border-bottom: 1px solid #e9ecef; }
+.tmpl-search-input {
+  width: 100%; border: 1px solid #ced4da; border-radius: 3px;
+  padding: 4px 8px; font-size: .76rem; outline: none;
+}
+.tmpl-search-input:focus { border-color: #A51C30; }
+
 /* template list */
-.tmpl-list { max-height: 560px; overflow-y: auto; }
+.tmpl-list { max-height: 520px; overflow-y: auto; }
 .tmpl-list::-webkit-scrollbar { width: 3px; }
 .tmpl-list::-webkit-scrollbar-thumb { background: #ced4da; border-radius: 2px; }
 .tmpl-item {
@@ -94,11 +109,56 @@
 }
 .send-warn i { color: #e65100; margin-top: 1px; flex-shrink: 0; }
 
+/* recipient modal — top bar with search */
+.recip-topbar {
+  display: flex; justify-content: space-between; align-items: center;
+  padding: 8px 12px; background: #f8f9fa; border-bottom: 1px solid #dee2e6;
+  font-size: .78rem; color: #6c757d; gap: 12px;
+}
+.recip-search { width: 220px !important; font-size: .78rem !important; flex-shrink: 0; }
+
+/* recipient modal — fixed-height scrollable table */
+.recip-table-wrap {
+  height: 530px; overflow-y: auto;
+}
+.recip-table-wrap .table { margin-bottom: 0; }
+.recip-table-wrap thead th {
+  position: sticky; top: 0; z-index: 1; background: #e9ecef;
+}
+
+/* recipient toolbar — always visible below the scroll area */
+.recip-toolbar {
+  display: flex; align-items: center; justify-content: space-between;
+  padding: 8px 16px; border-top: 1px solid #dee2e6; background: #f8f9fa;
+  border-radius: 0 0 .3rem .3rem;
+}
+.recip-toolbar-left { font-size: .78rem; color: #6c757d; flex-shrink: 0; }
+.recip-toolbar-center { display: flex; align-items: center; gap: 4px; }
+.recip-toolbar-right { display: flex; align-items: center; flex-shrink: 0; }
+.recip-page-info {
+  font-size: .78rem; margin: 0 6px; white-space: nowrap; min-width: 100px; text-align: center;
+}
+.recip-page-size-label {
+  font-size: .78rem; font-weight: 400; color: #6c757d;
+  display: inline-flex; align-items: center; gap: 4px; margin: 0; white-space: nowrap;
+}
+.recip-page-size-select {
+  width: auto !important; display: inline-block; padding: 2px 6px;
+  font-size: .78rem; height: auto !important;
+}
+
 /* select2 overrides */
 .select2-container { width: 100% !important; }
-.select2-container--default .select2-selection--multiple { border-color: #ced4da; border-radius: 4px; min-height: 36px; }
+.select2-container--default .select2-selection--multiple {
+  border-color: #ced4da; border-radius: 4px; min-height: 36px;
+  max-height: 90px; overflow-y: auto;
+}
 .select2-container--default.select2-container--focus .select2-selection--multiple { border-color: #A51C30; box-shadow: 0 0 0 .15rem rgba(165,28,48,.13); }
 .select2-container--default .select2-results__option--highlighted[aria-selected] { background: #A51C30 !important; }
-.select2-container--default .select2-selection__choice { background: #A51C30 !important; border-color: #8a1728 !important; color: #fff !important; border-radius: 3px; font-size: .75rem; }
+.select2-container--default .select2-selection__choice {
+  background: #A51C30 !important; border-color: #8a1728 !important; color: #fff !important;
+  border-radius: 3px; font-size: .75rem;
+  max-width: 100%; overflow: hidden; text-overflow: ellipsis; word-break: break-word;
+}
 .select2-container--default .select2-selection__choice__remove { color: rgba(255,255,255,.7) !important; }
 .select2-container--default .select2-selection__choice__remove:hover { color: #fff !important; }
diff --git a/static/coldfront_notifications/js/compose.js b/static/coldfront_notifications/js/compose.js
index 0117b63..d6ab45f 100644
--- a/static/coldfront_notifications/js/compose.js
+++ b/static/coldfront_notifications/js/compose.js
@@ -84,6 +84,15 @@ $(document).on('click', '.tmpl-item', function() {
   loadTemplate($(this));
 });
 
+// ── Template search ─────────────────────────────────────────────
+$(document).on('input', '#tmplSearch', function() {
+  var q = $(this).val().toLowerCase();
+  $('.tmpl-item').each(function() {
+    var text = $(this).text().toLowerCase();
+    $(this).toggle(!q || text.indexOf(q) !== -1);
+  });
+});
+
 // ── Variable search ──────────────────────────────────────────────
 $(document).on('input', '#varSearch', function() {
   renderVars(ACTIVE_VARS, $(this).val());
@@ -359,7 +368,7 @@ function runValidation() {
   });
 }
 
-$(document).on('click', '#recalcBtn', function() { runValidation(); });
+$(document).on('click', '#recalcBtn, #recalcBtn2', function() { runValidation(); });
 
 $(document).on('click', '#multiShowBtn', function() {
   $('#multiList').toggle();
@@ -446,8 +455,23 @@ function renderPreviewRows() {
 
 }
 
+function getPageSize() {
+  return parseInt($('#recipPageSize').val(), 10) || 10;
+}
+
+function updatePaginationControls() {
+  var atFirst = PREVIEW_PAGE <= 1;
+  var atLast = PREVIEW_PAGE >= PREVIEW_TOTAL_PAGES;
+  $('#recipPageInfo').text('Page ' + PREVIEW_PAGE + ' of ' + PREVIEW_TOTAL_PAGES);
+  $('#recipFirstBtn').prop('disabled', atFirst);
+  $('#recipPrevBtn').prop('disabled', atFirst);
+  $('#recipNextBtn').prop('disabled', atLast);
+  $('#recipLastBtn').prop('disabled', atLast);
+}
+
 function fetchPreviewPage(page) {
   PREVIEW_PAGE = page || 1;
+  $('#recipSearch').val('');
   $('#recipRows').html('<tr><td colspan="6" class="text-center text-muted py-3"><i class="fas fa-spinner fa-spin mr-1"></i>Loading…</td></tr>');
 
   $.ajax({
@@ -466,6 +490,7 @@ function fetchPreviewPage(page) {
       dedupe_users: JSON.stringify(getDedupeUsers()),
       preview:      'true',
       page:         PREVIEW_PAGE,
+      page_size:    getPageSize(),
     },
     traditional: true,
     success: function(data) {
@@ -486,15 +511,7 @@ function fetchPreviewPage(page) {
       } else {
         $('#dedupeAllRow').hide();
       }
-      // Pagination controls
-      if (PREVIEW_TOTAL_PAGES > 1) {
-        $('#recipPagination').show();
-        $('#recipPageInfo').text('Page ' + PREVIEW_PAGE + ' of ' + PREVIEW_TOTAL_PAGES);
-        $('#recipPrevBtn').prop('disabled', PREVIEW_PAGE <= 1);
-        $('#recipNextBtn').prop('disabled', PREVIEW_PAGE >= PREVIEW_TOTAL_PAGES);
-      } else {
-        $('#recipPagination').hide();
-      }
+      updatePaginationControls();
     },
     error: function() {
       $('#recipRows').html('<tr><td colspan="6" class="text-center text-danger py-3">Failed to load.</td></tr>');
@@ -506,12 +523,30 @@ $(document).on('click', '#previewRecipBtn', function() {
   $('#recipModal').modal('show');
   fetchPreviewPage(1);
 });
+$(document).on('click', '#recipFirstBtn', function() {
+  if (PREVIEW_PAGE > 1) fetchPreviewPage(1);
+});
 $(document).on('click', '#recipPrevBtn', function() {
   if (PREVIEW_PAGE > 1) fetchPreviewPage(PREVIEW_PAGE - 1);
 });
 $(document).on('click', '#recipNextBtn', function() {
   if (PREVIEW_PAGE < PREVIEW_TOTAL_PAGES) fetchPreviewPage(PREVIEW_PAGE + 1);
 });
+$(document).on('click', '#recipLastBtn', function() {
+  if (PREVIEW_PAGE < PREVIEW_TOTAL_PAGES) fetchPreviewPage(PREVIEW_TOTAL_PAGES);
+});
+$(document).on('change', '#recipPageSize', function() {
+  fetchPreviewPage(1);
+});
+
+// Client-side search: filter visible rows in the current page
+$(document).on('input', '#recipSearch', function() {
+  var q = $(this).val().toLowerCase();
+  $('#recipRows tr').each(function() {
+    var text = $(this).text().toLowerCase();
+    $(this).toggle(!q || text.indexOf(q) !== -1);
+  });
+});
 
 // All multi-email usernames across all pages (from server response).
 var ALL_MULTI_USERS = [];
@@ -560,6 +595,7 @@ $(document).ready(function() {
     width: '100%',
     placeholder: function() { return $(this).data('placeholder'); }
   });
+
   // Load first template
   var $first = $('.tmpl-item').first();
   if ($first.length) loadTemplate($first);

From 495e5589ced243c81446d6ea337818fa1af9e661 Mon Sep 17 00:00:00 2001
From: claire-peters <34081638+claire-peters@users.noreply.github.com>
Date: Thu, 7 May 2026 10:55:41 -0700
Subject: [PATCH 6/6] Update pyproject.toml

---
 pyproject.toml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 9ebb65c..37137a0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,7 +17,6 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
-    "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
     "Intended Audience :: System Administrators",
     "Topic :: Communications :: Email",
 ]