feat: Phase 6 — require_active_service decorator + wizard install wiring

Email/calendar/files routes now return 404 when the service is not
installed, using a require_active_service decorator that checks
ServiceRegistry. Status endpoints are exempt so health checks always work.

SetupManager.complete_setup() now accepts a service_store_manager and
installs any wizard-selected services in a background daemon thread after
setup completes. Failures are logged but do not fail the wizard.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/managers.py

@@ -66,7 +66,6 @@ cell_link_manager  = CellLinkManager(
     network_manager=network_manager,
 )
 auth_manager = AuthManager(data_dir=DATA_DIR, config_dir=CONFIG_DIR)
-setup_manager = SetupManager(config_manager=config_manager, auth_manager=auth_manager)
 caddy_manager = CaddyManager(config_manager=config_manager, data_dir=DATA_DIR, config_dir=CONFIG_DIR,
                               service_bus=service_bus, service_registry=service_registry)
 ddns_manager = DDNSManager(config_manager=config_manager, data_dir=DATA_DIR, config_dir=CONFIG_DIR)
@@ -96,6 +95,9 @@ service_store_manager = ServiceStoreManager(
     service_composer=service_composer,
 )
 
+setup_manager = SetupManager(config_manager=config_manager, auth_manager=auth_manager,
+                             service_store_manager=service_store_manager)
+
 # Service logger configuration
 _service_log_configs = {
     'network':   {'level': 'INFO', 'formatter': 'json', 'console': False},

api/routes/__init__.py

@@ -0,0 +1,19 @@
+from functools import wraps
+from flask import jsonify
+
+
+def require_active_service(service_id: str):
+    """Decorator: return 404 if the named service is not installed.
+
+    Apply to all email/calendar/files routes except /status endpoints,
+    so the UI can always check installation state without being blocked.
+    """
+    def decorator(fn):
+        @wraps(fn)
+        def wrapper(*args, **kwargs):
+            from app import service_registry
+            if service_registry.get(service_id) is None:
+                return jsonify({'error': f'Service {service_id!r} is not installed'}), 404
+            return fn(*args, **kwargs)
+        return wrapper
+    return decorator

api/routes/calendar.py

@@ -1,9 +1,12 @@
 import logging
 from flask import Blueprint, request, jsonify
+from routes import require_active_service
+
 logger = logging.getLogger('picell')
 bp = Blueprint('calendar', __name__)
 
 @bp.route('/api/calendar/users', methods=['GET'])
+@require_active_service('calendar')
 def get_calendar_users():
     """Get calendar users."""
     try:
@@ -15,6 +18,7 @@ def get_calendar_users():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/calendar/users', methods=['POST'])
+@require_active_service('calendar')
 def create_calendar_user():
     """Create calendar user."""
     try:
@@ -33,6 +37,7 @@ def create_calendar_user():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/calendar/users/<username>', methods=['DELETE'])
+@require_active_service('calendar')
 def delete_calendar_user(username):
     """Delete calendar user."""
     try:
@@ -44,6 +49,7 @@ def delete_calendar_user(username):
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/calendar/calendars', methods=['POST'])
+@require_active_service('calendar')
 def create_calendar():
     """Create calendar."""
     try:
@@ -67,6 +73,7 @@ def create_calendar():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/calendar/events', methods=['POST'])
+@require_active_service('calendar')
 def add_calendar_event():
     try:
         from app import calendar_manager
@@ -85,6 +92,7 @@ def add_calendar_event():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/calendar/events/<username>/<calendar_name>', methods=['GET'])
+@require_active_service('calendar')
 def get_calendar_events(username, calendar_name):
     """Get calendar events."""
     try:
@@ -108,6 +116,7 @@ def get_calendar_status():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/calendar/connectivity', methods=['GET'])
+@require_active_service('calendar')
 def test_calendar_connectivity():
     """Test calendar connectivity."""
     try:

api/routes/email.py

@@ -1,9 +1,12 @@
 import logging
 from flask import Blueprint, request, jsonify
+from routes import require_active_service
+
 logger = logging.getLogger('picell')
 bp = Blueprint('email', __name__)
 
 @bp.route('/api/email/users', methods=['GET'])
+@require_active_service('email')
 def get_email_users():
     """Get email users."""
     try:
@@ -15,6 +18,7 @@ def get_email_users():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/email/users', methods=['POST'])
+@require_active_service('email')
 def create_email_user():
     """Create email user."""
     try:
@@ -34,6 +38,7 @@ def create_email_user():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/email/users/<username>', methods=['DELETE'])
+@require_active_service('email')
 def delete_email_user(username):
     """Delete email user."""
     try:
@@ -57,6 +62,7 @@ def get_email_status():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/email/connectivity', methods=['GET'])
+@require_active_service('email')
 def test_email_connectivity():
     """Test email connectivity."""
     try:
@@ -68,6 +74,7 @@ def test_email_connectivity():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/email/send', methods=['POST'])
+@require_active_service('email')
 def send_email():
     try:
         from app import email_manager
@@ -81,6 +88,7 @@ def send_email():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/email/mailbox/<username>', methods=['GET'])
+@require_active_service('email')
 def get_mailbox_info(username):
     """Get mailbox information."""
     try:

api/routes/files.py

@@ -1,9 +1,12 @@
 import logging
 from flask import Blueprint, request, jsonify
+from routes import require_active_service
+
 logger = logging.getLogger('picell')
 bp = Blueprint('files', __name__)
 
 @bp.route('/api/files/users', methods=['GET'])
+@require_active_service('files')
 def get_file_users():
     """Get file storage users."""
     try:
@@ -15,6 +18,7 @@ def get_file_users():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/files/users', methods=['POST'])
+@require_active_service('files')
 def create_file_user():
     """Create file storage user."""
     try:
@@ -33,6 +37,7 @@ def create_file_user():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/files/users/<username>', methods=['DELETE'])
+@require_active_service('files')
 def delete_file_user(username):
     """Delete file storage user."""
     try:
@@ -44,6 +49,7 @@ def delete_file_user(username):
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/files/folders', methods=['POST'])
+@require_active_service('files')
 def create_folder():
     """Create folder."""
     try:
@@ -64,6 +70,7 @@ def create_folder():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/files/folders/<username>/<path:folder_path>', methods=['DELETE'])
+@require_active_service('files')
 def delete_folder(username, folder_path):
     """Delete folder."""
     try:
@@ -77,6 +84,7 @@ def delete_folder(username, folder_path):
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/files/upload/<username>', methods=['POST'])
+@require_active_service('files')
 def upload_file(username):
     """Upload file."""
     try:
@@ -97,6 +105,7 @@ def upload_file(username):
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/files/download/<username>/<path:file_path>', methods=['GET'])
+@require_active_service('files')
 def download_file(username, file_path):
     """Download file."""
     try:
@@ -110,6 +119,7 @@ def download_file(username, file_path):
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/files/delete/<username>/<path:file_path>', methods=['DELETE'])
+@require_active_service('files')
 def delete_file(username, file_path):
     """Delete file."""
     try:
@@ -123,6 +133,7 @@ def delete_file(username, file_path):
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/files/list/<username>', methods=['GET'])
+@require_active_service('files')
 def list_files(username):
     """List files."""
     try:
@@ -148,6 +159,7 @@ def get_file_status():
         return jsonify({"error": str(e)}), 500
 
 @bp.route('/api/files/connectivity', methods=['GET'])
+@require_active_service('files')
 def test_file_connectivity():
     """Test file service connectivity."""
     try:

api/setup_manager.py

@@ -10,6 +10,7 @@ import fcntl
 import logging
 import os
 import re
+import threading
 from typing import Any, Dict, List
 
 logger = logging.getLogger(__name__)
@@ -94,9 +95,10 @@ def _build_ddns_config(domain_mode: str, cloudflare_api_token: str = '',
 class SetupManager:
     """Manages the first-run setup wizard state and completion."""
 
-    def __init__(self, config_manager, auth_manager):
+    def __init__(self, config_manager, auth_manager, service_store_manager=None):
         self.config_manager = config_manager
         self.auth_manager = auth_manager
+        self.service_store_manager = service_store_manager
 
     # ── state helpers ─────────────────────────────────────────────────────
 
@@ -263,6 +265,21 @@ class SetupManager:
             # ── mark setup complete (must be last) ─────────────────────────
             self.config_manager.set_identity_field('setup_complete', True)
 
+            # Trigger service installs in background — non-blocking, failures are logged
+            if services_enabled and self.service_store_manager is not None:
+                def _install_services():
+                    for svc_id in services_enabled:
+                        try:
+                            result = self.service_store_manager.install(svc_id)
+                            if result.get('ok'):
+                                logger.info('Wizard: installed service %r', svc_id)
+                            else:
+                                logger.warning('Wizard: install %r failed: %s',
+                                               svc_id, result.get('error') or result.get('errors'))
+                        except Exception as exc:
+                            logger.warning('Wizard: install %r raised: %s', svc_id, exc)
+                threading.Thread(target=_install_services, daemon=True).start()
+
             logger.info(f"Setup completed. cell_name={cell_name!r}, domain_mode={domain_mode!r}")
             return {'success': True, 'redirect': '/login'}