Add TRUST_PROXY env var for reverse-proxy deployments

Fixes express-rate-limit's ERR_ERL_UNEXPECTED_X_FORWARDED_FOR warning
and incorrect IP keying when nginx runs on a separate server in front
of the app.

CHANGELOG.md

@@ -7,6 +7,28 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.9.4] - 2026-08-26
+
+### Added
+
+- New `TRUST_PROXY` backend env var — set it when the app runs behind a reverse proxy (e.g. nginx on a separate server) so rate limiting reads the real client IP from `X-Forwarded-For` instead of the proxy's. Accepts a hop count, `true`/`false`, or trusted proxy IP(s)/CIDR(s).
+
+## [1.9.3] - 2026-08-26
+
+### Fixed
+
+- The server used to hard-crash (`process.exit(1)`) on any unhandled promise rejection, so a single missed error handler anywhere in the app's fire-and-forget notification code (email/WhatsApp sending) could take the whole server down. It now logs the error and keeps running.
+- Accounts created on someone's behalf (at-the-door walk-in registration, or manual registration from the Admin/Supervisor dashboard) now get their activation link (email or WhatsApp, whichever they have) sent immediately when the account is created, instead of only on their first failed login attempt — matching what the Terms of Use already promised.
+- Manual registration with a real email address used to create the account already active with a fixed, undisclosed password (`Hope123`) — the visitor had no way to know it. That account is now created inactive and gets the same immediate activation link, so the visitor sets their own password — unless a password was supplied directly (see below), in which case it's activated immediately with no link needed.
+- The self-service kiosk's "Create an account" password field never actually worked — the account was always created with a different password behind the scenes, so visitors who set one couldn't log in with it. Manual registration now honours a caller-supplied password and activates the account immediately instead of discarding it.
+- Removed the "Guest (no account)" checkboxes from the Manual Registration pages (both the current one and the legacy form) and the equivalent flag from the at-the-door kiosk — they stopped affecting backend behaviour once every walk-in account started being created inactive with an activation link. The self-service kiosk's own "Create an account" toggle still controls whether that link is sent, since that one is the visitor's own choice rather than staff acting on their behalf.
+
+## [1.9.2] - 2026-08-22
+
+### Fixed
+
+- Contact-only events (no registration possible) were still getting the daily summary email — it now skips them since there's nothing to summarize.
+
 ## [1.9.1] - 2026-08-22
 
 ### Fixed

backend/.env.example

@@ -8,6 +8,13 @@ JWT_SECRET=your_jwt_secret_here_minimum_32_characters
 PORT=5000
 NODE_ENV=development
 
+# Set this if the app runs behind a reverse proxy (e.g. nginx on a separate
+# server) so rate limiting reads the real client IP instead of the proxy's.
+# Accepts a hop count ("1"), "true"/"false", or comma-separated IP(s)/CIDR(s)
+# of your trusted proxy (e.g. "10.0.0.5" or "10.0.0.0/8"). Leave unset if the
+# app is not behind a proxy.
+# TRUST_PROXY=1
+
 # ─── CORS ─────────────────────────────────────────────────────────────────────
 # Comma-separated list of allowed frontend origins
 FRONTEND_URL=http://localhost:3000

backend/README.md

@@ -84,6 +84,7 @@ Create `backend/.env` from `.env.example`. The only variables you must set are:
 | `APP_BASE_URL` | — | Public frontend URL — used in email links (fallback if not set via admin panel) |
 | `BACKEND_URL` | — | Public backend URL — used to serve ticket PDFs over WhatsApp |
 | `PORT` | — | Port to listen on (default `3000`) |
+| `TRUST_PROXY` | — | Set when running behind a reverse proxy (e.g. nginx on a separate server), so `req.ip`/`X-Forwarded-For` are read correctly by rate limiting. Accepts a hop count (`1`), `true`/`false`, or comma-separated trusted proxy IP(s)/CIDR(s). |
 | `NODE_ENV` | — | `production` or `development` |
 | `WAWP_ACCESS_TOKEN` | — | WAWP fallback token (preferred: set via Admin → Site Settings) |
 | `WAWP_INSTANCE_ID` | — | WAWP fallback instance ID (preferred: set via Admin → Site Settings) |

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.9.1",
+  "version": "1.9.4",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {

backend/src/controllers/registrationController.js

@@ -1,6 +1,5 @@
 const prisma = require('../config/db');
 const { v4: uuidv4 } = require('uuid');
-const axios = require("axios");
 const { generateTicketsForRegistration } = require('../utils/ticketUtils');
 const { emailTickets } = require('./ticketController');
 const { hashPassword } = require('../config/auth');
@@ -760,7 +759,7 @@ const getRegistrationsByEvent = async (req, res) => {
 const createManualRegistration = async (req, res) => {
   let userRecord;
   try {
-    const { eventId, options, user, guestOnly, notificationPreference: prefFromBody } = req.body;
+    const { eventId, options, user, notificationPreference: prefFromBody, skipActivationNotice } = req.body;
 
     if (!eventId || !options || !user || !user.name || (!user.email && !user.phoneNumber)) {
       res.status(400);
@@ -844,7 +843,7 @@ const createManualRegistration = async (req, res) => {
       ? prefFromBody
       : (hasValidEmail && phone ? 'both' : phone ? 'whatsapp' : 'email');
 
-    // Always search by email AND/OR phone regardless of guestOnly.
+    // Always search by email AND/OR phone.
     // Resolve each channel independently (rather than a single findFirst with an OR
     // across both) so that an email belonging to one account and a phone number
     // belonging to a *different* account can never be silently collapsed into
@@ -907,25 +906,36 @@ const createManualRegistration = async (req, res) => {
       if (Object.keys(updateData).length > 0) {
         await prisma.user.update({ where: { id: userId }, data: updateData }).catch(() => {});
       }
-    } else if (!guestOnly && hasValidEmail) {
-      // Create a real active account (non-guest with email)
-      try {
-        const password = 'Hope123';
-        const response = await axios.post(
-          `${process.env.NEXT_PUBLIC_API_URL || 'http://localhost:5000'}/api/users`,
-          { name: user.name, email: user.email, password, phoneNumber: phone || null }
-        );
-        const createdUser = response.data.user || response.data;
-        if (!createdUser?.id) { res.status(400); throw new Error('User creation failed: No user ID returned'); }
-        userId = createdUser.id;
-        // Set derived preference on the new account
-        await prisma.user.update({ where: { id: userId }, data: { notificationPreference: derivedPref } }).catch(() => {});
-      } catch (userErr) {
-        res.status(400);
-        throw new Error(`Failed to create user: ${userErr.response?.data?.message || userErr.message}`);
-      }
     } else {
-      // Guest path: phone-only, guestOnly=true, or no valid email
+      const suppliedPassword = typeof user.password === 'string' && user.password.trim().length >= 6
+        ? user.password.trim()
+        : null;
+
+      if (hasValidEmail && suppliedPassword) {
+        // Caller supplied their own password (the self-service kiosk, where the
+        // visitor sets it themselves on the spot) — activate immediately, since
+        // there's nothing left for them to do via an activation link.
+        const hashed = await hashPassword(suppliedPassword);
+        const created = await prisma.user.create({
+          data: {
+            id: uuidv4(),
+            name: user.name,
+            email: user.email,
+            password: hashed,
+            phoneNumber: phone || null,
+            isActive: true,
+            notificationPreference: derivedPref,
+            updatedAt: new Date(),
+          }
+        });
+        userId = created.id;
+      } else {
+        // New account: uses the real email if a valid one was given, otherwise a
+        // guest.local placeholder (phone-only registration). Always created inactive
+        // with a random password — the visitor activates it themselves via the link
+        // sent immediately below (email or WhatsApp), unless the caller explicitly
+        // opted out of that nudge (e.g. a self-service visitor who declined to
+        // create an account at all).
         const placeholderEmail = hasValidEmail
           ? user.email
           : `guest+${uuidv4().slice(0, 8)}@guest.local`;
@@ -943,6 +953,11 @@ const createManualRegistration = async (req, res) => {
           }
         });
         userId = created.id;
+        if (!skipActivationNotice) {
+          const { sendActivationLink } = require('./userController');
+          sendActivationLink(created);
+        }
+      }
     }
 
     // Merge into existing non-cancelled registration if one exists, otherwise create new

backend/src/controllers/userController.js

@@ -23,6 +23,53 @@ function getClientIp(req) {
 
 const PRIVATE_IP_RE = /^(::1|::ffff:127\.|127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/;
 
+// Fire-and-forget: create a 24h activation token and deliver it to an inactive
+// account — via email if it has a real (non-guest) address, otherwise via
+// WhatsApp if it has a phone number. Used both when a login attempt hits an
+// inactive account, and immediately when an admin/supervisor creates an
+// account on someone's behalf (walk-in / manual registration).
+async function sendActivationLink(user) {
+  const hasRealEmail = !!(user?.email && !user.email.endsWith('@guest.local'));
+  if (!hasRealEmail && !user?.phoneNumber) return;
+  try {
+    const token = uuidv4();
+    const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24h
+    await prisma.passwordReset.updateMany({
+      where: { userId: user.id, used: false },
+      data: { used: true }
+    });
+    await prisma.passwordReset.create({
+      data: { id: uuidv4(), userId: user.id, token, expiresAt, used: false }
+    });
+    const baseUrl = process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001';
+    const activationUrl = `${baseUrl.replace(/\/$/, '')}/activate-account?token=${encodeURIComponent(token)}`;
+
+    if (hasRealEmail) {
+      const { sendMail, buildAccountActivationEmail } = require('../utils/email');
+      const content = buildAccountActivationEmail({ name: user.name, activationUrl });
+      sendMail({ to: user.email, subject: `Activate your ${getOrgName()} account`, ...content })
+        .catch(e => console.warn('[activation email] Failed:', e?.message || e));
+    } else {
+      const orgName = getOrgName();
+      const waMessage = [
+        `🔓 *Activate your ${orgName} account*`,
+        '',
+        `Hi ${user.name || 'there'},`,
+        '',
+        `Your account needs to be activated before you can log in. Tap the link below to set a password and activate your account:`,
+        '',
+        activationUrl,
+        '',
+        `_This link expires in 24 hours._`,
+      ].join('\n');
+      const { waTextAny } = require('../utils/notify');
+      waTextAny(user, waMessage).catch(e => console.warn('[activation WA] Failed:', e?.message || e));
+    }
+  } catch (e) {
+    console.warn('[activation token] Failed to create activation token:', e?.message || e);
+  }
+}
+
 // Fire-and-forget: send a login notification email with approximate geo location
 async function sendLoginNotification(user, req) {
   try {
@@ -176,61 +223,16 @@ const loginUser = async (req, res) => {
 
     // Check if user is active
     if (!user.isActive) {
-      // If the account has a real email (not a guest placeholder), send an activation link via email
+      // Resend the activation link on each failed login attempt against an inactive
+      // account, in case the original one (sent at creation, or a prior attempt) expired.
+      await sendActivationLink(user);
+      // If the account has a real email (not a guest placeholder), it went out via email
       if (user.email && !user.email.endsWith('@guest.local')) {
-        try {
-          const token = uuidv4();
-          const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24h
-          await prisma.passwordReset.updateMany({
-            where: { userId: user.id, used: false },
-            data: { used: true }
-          });
-          await prisma.passwordReset.create({
-            data: { id: uuidv4(), userId: user.id, token, expiresAt, used: false }
-          });
-          const baseUrl = process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001';
-          const activationUrl = `${baseUrl.replace(/\/$/, '')}/activate-account?token=${encodeURIComponent(token)}`;
-          const { sendMail, buildAccountActivationEmail } = require('../utils/email');
-          const content = buildAccountActivationEmail({ name: user.name, activationUrl });
-          sendMail({ to: user.email, subject: `Activate your ${getOrgName()} account`, ...content })
-            .catch(e => console.warn('[activation email] Failed:', e?.message || e));
-        } catch (e) {
-          console.warn('[activation token] Failed to create activation token:', e?.message || e);
-        }
         res.status(401);
         throw new Error('Your account is not yet active. We\'ve sent you an email with a link to activate your account.');
       }
-      // No real email — if they have a phone number, send the activation link via WhatsApp
+      // No real email — if they have a phone number, it went out via WhatsApp
       if (user.phoneNumber) {
-        try {
-          const token = uuidv4();
-          const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24h
-          await prisma.passwordReset.updateMany({
-            where: { userId: user.id, used: false },
-            data: { used: true }
-          });
-          await prisma.passwordReset.create({
-            data: { id: uuidv4(), userId: user.id, token, expiresAt, used: false }
-          });
-          const baseUrl = process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001';
-          const activationUrl = `${baseUrl.replace(/\/$/, '')}/activate-account?token=${encodeURIComponent(token)}`;
-          const orgName = getOrgName();
-          const waMessage = [
-            `🔓 *Activate your ${orgName} account*`,
-            '',
-            `Hi ${user.name || 'there'},`,
-            '',
-            `Your account needs to be activated before you can log in. Tap the link below to set a password and activate your account:`,
-            '',
-            activationUrl,
-            '',
-            `_This link expires in 24 hours._`,
-          ].join('\n');
-          const { waTextAny } = require('../utils/notify');
-          waTextAny(user, waMessage).catch(e => console.warn('[activation WA] Failed:', e?.message || e));
-        } catch (e) {
-          console.warn('[activation token WA] Failed to create activation token:', e?.message || e);
-        }
         res.status(401);
         throw new Error('Your account is not yet active. We\'ve sent you a WhatsApp message with a link to activate your account.');
       }
@@ -970,4 +972,5 @@ module.exports = {
   adminRevokeUserSessions,
   closeAccount,
   getMyActivity,
+  sendActivationLink,
 };

backend/src/index.js

@@ -18,6 +18,22 @@ const prisma = new PrismaClient();
 const app = express();
 const PORT = process.env.PORT || 3000;
 
+// Trust proxy — required when running behind a reverse proxy (e.g. nginx on a
+// separate server) so req.ip / X-Forwarded-For are read correctly by
+// express-rate-limit and friends. Accepts a hop count ("1"), "true"/"false",
+// or a comma-separated list of trusted proxy IPs/CIDRs.
+if (process.env.TRUST_PROXY) {
+  const raw = process.env.TRUST_PROXY.trim();
+  let trustProxyValue;
+  if (raw === 'true') trustProxyValue = true;
+  else if (raw === 'false') trustProxyValue = false;
+  else if (/^\d+$/.test(raw)) trustProxyValue = parseInt(raw, 10);
+  else if (raw.includes(',')) trustProxyValue = raw.split(',').map((s) => s.trim());
+  else trustProxyValue = raw;
+  app.set('trust proxy', trustProxyValue);
+  console.log(`[startup] trust proxy set to: ${JSON.stringify(trustProxyValue)}`);
+}
+
 // CORS — allow only the configured frontend origin
 const allowedOrigins = (process.env.FRONTEND_URL || 'http://localhost:3000')
   .split(',')
@@ -1265,11 +1281,12 @@ app.listen(PORT, () => {
   }
 });
 
-// Handle unhandled promise rejections
+// Log unhandled promise rejections without killing the server, since a single
+// missed .catch() on fire-and-forget notification code (email/WhatsApp sends)
+// would otherwise take the whole app down.
 process.on('unhandledRejection', (err) => {
-  console.log('UNHANDLED REJECTION! Shutting down...');
-  console.log(err.name, err.message);
-  process.exit(1);
+  console.error('UNHANDLED REJECTION!', err?.name, err?.message);
+  console.error(err?.stack || err);
 });
 
 module.exports = { app, prisma };

backend/src/utils/notifications.js

@@ -1370,14 +1370,14 @@ async function sendDailyEventSummaries(now = new Date()) {
     const today = new Date(now);
     const notifyInclude = { createdBy: { select: { id: true, name: true, email: true } }, notifyRecipients: { select: { id: true, name: true, email: true } } };
     let events = await prisma.event.findMany({
-      where: { isActive: true, startDate: { gte: today } },
+      where: { isActive: true, startDate: { gte: today }, requiresRegistration: true },
       include: notifyInclude,
       orderBy: { startDate: 'asc' },
     });
 
     try {
       events = await prisma.event.findMany({
-        where: { isActive: true, startDate: { gte: today }, goLiveAt: { lte: today } },
+        where: { isActive: true, startDate: { gte: today }, goLiveAt: { lte: today }, requiresRegistration: true },
         include: notifyInclude,
         orderBy: { startDate: 'asc' },
       });

ecosystem.config.js

@@ -0,0 +1,17 @@
+module.exports = {
+  apps: [
+    {
+      name: 'hope-events-backend',
+      cwd: __dirname + '/backend',
+      script: 'src/index.js',
+      env: { NODE_ENV: 'production' },
+    },
+    {
+      name: 'hope-events-frontend',
+      cwd: __dirname + '/frontend',
+      script: 'npm',
+      args: 'start -- -p 3001',
+      env: { NODE_ENV: 'production' },
+    },
+  ],
+};

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.9.1",
+  "version": "1.9.4",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",

frontend/src/app/dashboard/supervisor/at-the-door/page.tsx

@@ -242,7 +242,6 @@ export default function AtTheDoorPage() {
                     authToken: token,
                     body: {
                         eventId,
-                        guestOnly: pendingUser.guestOnly,
                         user: {
                             name: pendingUser.name,
                             ...(pendingUser.email ? { email: pendingUser.email } : {}),
@@ -282,7 +281,7 @@ export default function AtTheDoorPage() {
         });
         setQuantities(qtyMap);
         setMinQuantities({});
-        setPendingUser({ guestOnly: true, name, email: email || null, phone: phone || null, notifPref });
+        setPendingUser({ name, email: email || null, phone: phone || null, notifPref });
         setPendingEditReg(null);
         setShowNewAttendeeModal(false);
         setShowOptionsModal(true);

frontend/src/app/dashboard/supervisor/manual-registration/page.tsx

@@ -18,7 +18,6 @@ export default function ManualRegistrationPage() {
   const [name, setName] = useState("");
   const [email, setEmail] = useState("");
   const [phoneNumber, setPhoneNumber] = useState("");
-  const [registerAsGuest, setRegisterAsGuest] = useState(false);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useDismissingState<string | null>(null);
   const [createdReg, setCreatedReg] = useState<any | null>(null);
@@ -43,7 +42,6 @@ export default function ManualRegistrationPage() {
           eventId,
           options: [{ eventOptionId: optionId, quantity }],
           user: { name, ...(email ? { email } : {}), ...(phoneNumber ? { phoneNumber } : {}) },
-          guestOnly: registerAsGuest,
         },
       });
       setCreatedReg(res);
@@ -89,10 +87,7 @@ export default function ManualRegistrationPage() {
             <input className="w-full border rounded px-3 py-2" value={name} onChange={(e) => setName(e.target.value)} required />
           </div>
           <div>
-            <div className="flex items-center justify-between">
             <label className="block text-sm font-medium">Email</label>
-              <label className="text-xs flex items-center gap-2"><input type="checkbox" checked={registerAsGuest} onChange={e=>setRegisterAsGuest(e.target.checked)} /> Guest (no account)</label>
-            </div>
             <input type="email" className="w-full border rounded px-3 py-2" value={email} onChange={(e) => setEmail(e.target.value)} placeholder="email@example.com" />
           </div>
         </div>
@@ -100,7 +95,7 @@ export default function ManualRegistrationPage() {
           <label className="block text-sm font-medium">Cell Number</label>
           <input type="tel" className="w-full border rounded px-3 py-2" value={phoneNumber} onChange={(e) => setPhoneNumber(e.target.value)} placeholder="+27…" />
         </div>
-        <p className="text-xs text-gray-500">At least one of email or cell number is required. If no email is provided, a guest account is created automatically.</p>
+        <p className="text-xs text-gray-500">At least one of email or cell number is required. The account is created inactive, and an activation link is sent immediately (by email if provided, otherwise WhatsApp) so the attendee can set their own password.</p>
         {error && <p className="text-sm text-red-600">{error}</p>}
         <button type="submit" disabled={busy} className="bg-brand-600 hover:bg-brand-700 text-white rounded px-4 py-2 disabled:opacity-60">
           {busy ? "Submitting..." : "Create"}

frontend/src/app/dashboard/supervisor/manual/page.tsx

@@ -76,7 +76,6 @@ export default function ManualRegistrationPage() {
   const [allUsers, setAllUsers] = useState<any[]>([]);
 
   const [guest, setGuest] = useState({ name: "", email: "", phoneNumber: "" });
-  const [registerAsGuest, setRegisterAsGuest] = useState(false);
   const [notifPref, setNotifPref] = useState<"email" | "whatsapp" | "both">("email");
   const [quantities, setQuantities] = useState<Record<string, number>>({});
 
@@ -287,7 +286,7 @@ export default function ManualRegistrationPage() {
     setError(null);
     setMessage(null);
     if (!selectedEventId) { setError("Please select an event."); return; }
-    if (!guest.name || (!registerAsGuest && !guest.email)) { setError("Guest name and email are required."); return; }
+    if (!guest.name || (!guest.email.trim() && !guest.phoneNumber.trim())) { setError("Guest name and at least one of email or phone are required."); return; }
     const opts = Object.entries(quantities)
       .filter(([, qty]) => qty > 0)
       .map(([key, quantity]) => {
@@ -308,7 +307,6 @@ export default function ManualRegistrationPage() {
           eventId: selectedEventId,
           options: opts,
           user: guest,
-          guestOnly: registerAsGuest,
           notificationPreference: resolvedPref,
         }
       });
@@ -324,7 +322,6 @@ export default function ManualRegistrationPage() {
 
       // Reset guest/ticket fields so the next registration starts from a clean slate
       setGuest({ name: "", email: "", phoneNumber: "" });
-      setRegisterAsGuest(false);
       setNotifPref("email");
       setUserQuery("");
       setDropdownOpen(false);
@@ -442,13 +439,6 @@ export default function ManualRegistrationPage() {
             )}
           </div>
 
-          <div className="border-t pt-3 mb-3">
-            <div className="flex items-center gap-2">
-              <input id="registerAsGuest" type="checkbox" checked={registerAsGuest} onChange={e => setRegisterAsGuest(e.target.checked)} />
-              <label htmlFor="registerAsGuest" className="text-sm text-gray-700">Guest (do not link to an existing account)</label>
-            </div>
-          </div>
-
           <div className="grid gap-2">
             <input
               className="border rounded px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400"
@@ -458,11 +448,10 @@ export default function ManualRegistrationPage() {
             />
             <input
               className="border rounded px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400"
-              placeholder={registerAsGuest ? "Email (optional for guest)" : "Email"}
+              placeholder="Email (or provide a phone number below)"
               type="email"
               value={guest.email}
               onChange={e => setGuest({ ...guest, email: e.target.value })}
-              required={!registerAsGuest}
             />
             <input
               className="border rounded px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400"

frontend/src/app/self-service/page.tsx

@@ -386,7 +386,9 @@ export default function SelfServicePage() {
           ...(visitorEmail.trim() ? { email: visitorEmail.trim() } : {}),
           ...(visitorPhone.trim() ? { phoneNumber: visitorPhone.trim() } : {}),
         },
-        guestOnly: !createAccount,
+        // If the visitor declined to create an account, don't push an unsolicited
+        // activation email/WhatsApp at them afterward.
+        skipActivationNotice: !createAccount,
         notificationPreference: notificationPref,
       };
       if (createAccount && visitorPassword) {

frontend/src/content/help/supervisor-manual.tsx

@@ -14,7 +14,7 @@ export const supervisorManualHelpContent: HelpContent = {
       icon: UserPlus,
       content: (
         <div className="space-y-4">
-          <p>Pick an event, then either search for an existing user or enter guest details (name, email, phone) and tick &quot;Guest&quot; to skip linking an account. Choose ticket options and quantities — early-bird pricing is applied automatically — then create the registration.</p>
+          <p>Pick an event, then either search for an existing user or enter guest details (name, and at least one of email or phone). Choose ticket options and quantities — early-bird pricing is applied automatically — then create the registration. A new guest account is created inactive, and an activation link is sent immediately (by email if provided, otherwise WhatsApp) so they can set their own password.</p>
           <p className="text-xs text-gray-500">After creating a registration, the Record Payment tab is pre-filled with it — switch tabs to take payment right away.</p>
         </div>
       ),

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.9.1",
+  "version": "1.9.4",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",