@actuate-media/cms-admin 0.67.0 → 0.69.0

package/dist/views/settings/useSecuritySettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSecuritySettings.d.ts","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE9D,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAA;IACpB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,qBAAqB,EAAE,MAAM,CAAA;CAC9B;AAED,KAAK,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;AAuBxD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;IAChF,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,OAAO,EAAE,MAAM,IAAI,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;IAClD,sBAAsB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,CAiIzE"}
+{"version":3,"file":"useSecuritySettings.d.ts","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE9D,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAA;IACpB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,qBAAqB,EAAE,MAAM,CAAA;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,EAAE,OAAO,CAAA;CAC7B;AAED,KAAK,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;AAYxD,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOzD;AA6BD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;IAChF,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,OAAO,EAAE,MAAM,IAAI,CAAA;IACnB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,oBAAoB,EAAE,MAAM,IAAI,CAAA;IAChC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;IAClD,sBAAsB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,CAuJzE"}

package/dist/views/settings/useSecuritySettings.js

@@ -6,18 +6,44 @@ const EMPTY_FORM = {
     mfaRequired: false,
     mfaGracePeriodDays: 7,
     maxConcurrentSessions: 5,
+    timeoutHours: 168,
+    idleLogoutEnabled: false,
+    ipAllowlistText: '',
+    auditLoggingEnabled: true,
 };
+/** Split the textarea into trimmed, de-duplicated entries (one per line). */
+export function parseAllowlistText(text) {
+    const out = [];
+    for (const line of text.split('\n')) {
+        const entry = line.trim();
+        if (entry && !out.includes(entry))
+            out.push(entry);
+    }
+    return out;
+}
 function formFromSettings(s) {
     return {
         mfaRequired: s.mfa.required,
         mfaGracePeriodDays: s.mfa.gracePeriodDays,
         maxConcurrentSessions: s.session.maxConcurrentSessions,
+        timeoutHours: s.session.timeoutHours ?? 168,
+        idleLogoutEnabled: s.session.idleLogoutEnabled ?? false,
+        ipAllowlistText: (s.access?.ipAllowlist ?? []).join('\n'),
+        auditLoggingEnabled: s.access?.auditLoggingEnabled ?? true,
     };
 }
 function formToSettings(f) {
     return {
         mfa: { required: f.mfaRequired, gracePeriodDays: f.mfaGracePeriodDays },
-        session: { maxConcurrentSessions: f.maxConcurrentSessions },
+        session: {
+            maxConcurrentSessions: f.maxConcurrentSessions,
+            timeoutHours: f.timeoutHours,
+            idleLogoutEnabled: f.idleLogoutEnabled,
+        },
+        access: {
+            ipAllowlist: parseAllowlistText(f.ipAllowlistText),
+            auditLoggingEnabled: f.auditLoggingEnabled,
+        },
     };
 }
 /**
@@ -35,6 +61,7 @@ export function useSecuritySettings(canEdit) {
     const [form, setForm] = useState(EMPTY_FORM);
     const [saveState, setSaveState] = useState('idle');
     const [saveError, setSaveError] = useState(null);
+    const [lockoutPrompt, setLockoutPrompt] = useState(null);
     const [revokeState, setRevokeState] = useState('idle');
     const [reloadKey, setReloadKey] = useState(0);
     useEffect(() => {
@@ -85,18 +112,30 @@ export function useSecuritySettings(canEdit) {
         return list;
     }, [form, baseline.mfaRequired, data]);
     const hasErrors = issues.some((i) => i.severity === 'error');
-    const save = useCallback(async () => {
+    const save = useCallback(async (options) => {
         if (!canEdit || hasErrors || !dirty)
             return;
         setSaveState('saving');
         setSaveError(null);
+        setLockoutPrompt(null);
         try {
             const res = await cmsApi('/security', {
                 method: 'PUT',
-                body: JSON.stringify(formToSettings(form)),
+                body: JSON.stringify({
+                    ...formToSettings(form),
+                    ...(options?.confirmLockout ? { confirmLockout: true } : {}),
+                }),
             });
-            if (res.error || !res.data)
+            // The server's lockout guard: surface a confirm dialog instead of a
+            // generic failure so the operator can retry with confirmLockout.
+            if (res.code === 'IP_LOCKOUT_RISK') {
+                setSaveState('idle');
+                setLockoutPrompt(res.error ?? 'This allowlist may lock you out. Save anyway?');
+                return;
+            }
+            if (res.error || !res.data) {
                 throw new Error(res.error ?? 'Failed to save security settings.');
+            }
             setData(res.data);
             const f = formFromSettings(res.data.settings);
             setBaseline(f);
@@ -108,10 +147,12 @@ export function useSecuritySettings(canEdit) {
             setSaveError(err instanceof Error ? err.message : 'Failed to save security settings.');
         }
     }, [canEdit, hasErrors, dirty, form]);
+    const dismissLockoutPrompt = useCallback(() => setLockoutPrompt(null), []);
     const reset = useCallback(() => {
         setForm(baseline);
         setSaveState('idle');
         setSaveError(null);
+        setLockoutPrompt(null);
     }, [baseline]);
     const refetch = useCallback(() => setReloadKey((k) => k + 1), []);
     const revokeAllOtherSessions = useCallback(async () => {
@@ -147,6 +188,8 @@ export function useSecuritySettings(canEdit) {
         save,
         reset,
         refetch,
+        lockoutPrompt,
+        dismissLockoutPrompt,
         revokeState,
         revokeAllOtherSessions,
     };

package/dist/views/settings/useSecuritySettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"useSecuritySettings.js","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACjE,OAAO,EACL,wBAAwB,GAGzB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAYzC,MAAM,UAAU,GAAiB;IAC/B,WAAW,EAAE,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,qBAAqB,EAAE,CAAC;CACzB,CAAA;AAED,SAAS,gBAAgB,CAAC,CAAmB;IAC3C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC3B,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;QACzC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB;KACvD,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAAe;IACrC,OAAO;QACL,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE;QACvE,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,EAAE;KAC5D,CAAA;AACH,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAA4B,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAC1D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAY,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAwC,MAAM,CAAC,CAAA;IAC7F,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAE7C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,MAAM,CAAqB,WAAW,CAAC;aACpC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,SAAS;gBAAE,OAAM;YACrB,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,mCAAmC,CAAC,CAAA;QACnE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,UAAU,CAAC,KAAK,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QACJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAEf,MAAM,QAAQ,GAAG,WAAW,CAAC,CAA+B,GAAM,EAAE,KAAsB,EAAE,EAAE;QAC5F,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAC9C,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3F,CAAC,IAAI,EAAE,QAAQ,CAAC,CACjB,CAAA;IAED,MAAM,MAAM,GAAG,OAAO,CAAoB,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,aAAa;gBACpB,OAAO,EACL,2GAA2G;gBAC7G,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAA;IAE5D,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,OAAM;QAC3C,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAqB,WAAW,EAAE;gBACxD,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;aAC3C,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;YAC7F,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;YACV,YAAY,CAAC,SAAS,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAA;QACxF,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IAErC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjB,YAAY,CAAC,MAAM,CAAC,CAAA;QACpB,YAAY,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjE,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,IAA4B,EAAE;QAC5E,cAAc,CAAC,SAAS,CAAC,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAsB,+BAA+B,EAAE;gBAC7E,MAAM,EAAE,MAAM;aACf,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACzC,cAAc,CAAC,MAAM,CAAC,CAAA;YACtB,oCAAoC;YACpC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,OAAO,CAAC,CAAA;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO;QACL,OAAO;QACP,SAAS;QACT,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,MAAM;QACN,SAAS;QACT,OAAO;QACP,SAAS;QACT,SAAS;QACT,IAAI;QACJ,KAAK;QACL,OAAO;QACP,WAAW;QACX,sBAAsB;KACvB,CAAA;AACH,CAAC"}
+{"version":3,"file":"useSecuritySettings.js","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACjE,OAAO,EACL,wBAAwB,GAGzB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAiBzC,MAAM,UAAU,GAAiB;IAC/B,WAAW,EAAE,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,qBAAqB,EAAE,CAAC;IACxB,YAAY,EAAE,GAAG;IACjB,iBAAiB,EAAE,KAAK;IACxB,eAAe,EAAE,EAAE;IACnB,mBAAmB,EAAE,IAAI;CAC1B,CAAA;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACzB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAmB;IAC3C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC3B,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;QACzC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB;QACtD,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,GAAG;QAC3C,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK;QACvD,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,mBAAmB,IAAI,IAAI;KAC3D,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAAe;IACrC,OAAO;QACL,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE;QACvE,OAAO,EAAE;YACP,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;YAC9C,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;SACvC;QACD,MAAM,EAAE;YACN,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC;YAClD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;SAC3C;KACF,CAAA;AACH,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAA4B,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAC1D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAY,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACvE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAwC,MAAM,CAAC,CAAA;IAC7F,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAE7C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,MAAM,CAAqB,WAAW,CAAC;aACpC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,SAAS;gBAAE,OAAM;YACrB,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,mCAAmC,CAAC,CAAA;QACnE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,UAAU,CAAC,KAAK,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QACJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAEf,MAAM,QAAQ,GAAG,WAAW,CAAC,CAA+B,GAAM,EAAE,KAAsB,EAAE,EAAE;QAC5F,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAC9C,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3F,CAAC,IAAI,EAAE,QAAQ,CAAC,CACjB,CAAA;IAED,MAAM,MAAM,GAAG,OAAO,CAAoB,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,aAAa;gBACpB,OAAO,EACL,2GAA2G;gBAC7G,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAA;IAE5D,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,OAAsC,EAAE,EAAE;QAC/C,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,OAAM;QAC3C,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAqB,WAAW,EAAE;gBACxD,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,GAAG,cAAc,CAAC,IAAI,CAAC;oBACvB,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7D,CAAC;aACH,CAAC,CAAA;YACF,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACnC,YAAY,CAAC,MAAM,CAAC,CAAA;gBACpB,gBAAgB,CAAC,GAAG,CAAC,KAAK,IAAI,+CAA+C,CAAC,CAAA;gBAC9E,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;YACnE,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;YACV,YAAY,CAAC,SAAS,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAA;QACxF,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAClC,CAAA;IAED,MAAM,oBAAoB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAE1E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjB,YAAY,CAAC,MAAM,CAAC,CAAA;QACpB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjE,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,IAA4B,EAAE;QAC5E,cAAc,CAAC,SAAS,CAAC,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAsB,+BAA+B,EAAE;gBAC7E,MAAM,EAAE,MAAM;aACf,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACzC,cAAc,CAAC,MAAM,CAAC,CAAA;YACtB,oCAAoC;YACpC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,OAAO,CAAC,CAAA;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO;QACL,OAAO;QACP,SAAS;QACT,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,MAAM;QACN,SAAS;QACT,OAAO;QACP,SAAS;QACT,SAAS;QACT,IAAI;QACJ,KAAK;QACL,OAAO;QACP,aAAa;QACb,oBAAoB;QACpB,WAAW;QACX,sBAAsB;KACvB,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-admin",
-  "version": "0.67.0",
+  "version": "0.69.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",
@@ -95,7 +95,7 @@
     "tailwindcss": "^4.0.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
-    "@actuate-media/cms-core": "0.87.0",
+    "@actuate-media/cms-core": "0.89.0",
     "@actuate-media/component-blocks": "0.2.1"
   },
   "scripts": {

package/src/AdminRoot.tsx

@@ -5,7 +5,7 @@ import * as Dialog from '@radix-ui/react-dialog'
 import { toast } from 'sonner'
 import { Layout } from './layout/Layout.js'
 import { adminPortalContainer } from './lib/portal-container.js'
-import { useAdminRouter } from './router/index.js'
+import { useAdminRouter, parseRouteQuery } from './router/index.js'
 import { cmsApi, ensureCsrfToken } from './lib/api.js'
 import { setDocumentFavicon, BRAND_UPDATED_EVENT } from './lib/favicon.js'
 import {
@@ -38,6 +38,7 @@ import { ThemeProvider } from './components/ThemeProvider.js'
 import { LocaleProvider } from './components/LocaleProvider.js'
 import { useKeyboardShortcuts } from './hooks/useKeyboardShortcuts.js'
 import { useAppearanceBootstrap } from './hooks/useAppearanceBootstrap.js'
+import { useIdleLogout } from './hooks/useIdleLogout.js'
 import { PageBuilder } from './views/page-builder/PageBuilder.js'
 import { PageSectionEditor } from './views/page-editor/PageSectionEditor.js'
 import { PagePreview } from './views/page-editor/PagePreview.js'
@@ -52,6 +53,7 @@ import { PagesListView } from './views/Pages/PagesListView.js'
 import { PageTagManager } from './views/Pages/PageTagManager.js'
 import { PostsListView } from './views/Posts/PostsListView.js'
 import { PostTypesView } from './views/Posts/PostTypesView.js'
+import { PostTypeEditor } from './views/Posts/PostTypeEditor.js'
 import { NewPostPicker } from './views/Posts/NewPostPicker.js'
 import { NewPostTypeInstructions } from './views/Posts/NewPostTypeInstructions.js'
 import { PostSectionEditor } from './views/post-editor/PostSectionEditor.js'
@@ -179,6 +181,55 @@ function AdminShell({
     [buildHref],
   )
 
+  // Idle auto-logout (Settings → Security). The policy is read from the
+  // non-admin-gated /auth/session-policy endpoint so every member's client
+  // enforces it, not just admins. When enabled, `timeoutHours` of inactivity
+  // signs the user out through the normal logout flow (server revocation +
+  // cookie clear + local state reset).
+  const [sessionPolicy, setSessionPolicy] = useState<{
+    timeoutHours: number
+    idleLogoutEnabled: boolean
+  } | null>(null)
+  useEffect(() => {
+    if (!session) {
+      setSessionPolicy(null)
+      return
+    }
+    let cancelled = false
+    void cmsApi<{ timeoutHours: number; idleLogoutEnabled: boolean }>('/auth/session-policy').then(
+      (res) => {
+        if (!cancelled && res.data && typeof res.data.timeoutHours === 'number') {
+          setSessionPolicy(res.data)
+        }
+      },
+    )
+    return () => {
+      cancelled = true
+    }
+  }, [session])
+
+  const { stayActive } = useIdleLogout({
+    enabled: Boolean(session && sessionPolicy?.idleLogoutEnabled),
+    timeoutMs: (sessionPolicy?.timeoutHours ?? 0) * 3_600_000,
+    onIdle: handleLogout,
+    // One-minute heads-up so the sign-out is never a surprise. Any activity
+    // (or the toast action) resets the clock and dismisses the warning.
+    warningMs: 60_000,
+    onWarn: () => {
+      toast.warning('You will be signed out in about a minute due to inactivity.', {
+        id: 'idle-logout-warning',
+        duration: 60_000,
+        action: {
+          label: 'Stay signed in',
+          onClick: () => stayActive(),
+        },
+      })
+    },
+    onWarnCancelled: () => {
+      toast.dismiss('idle-logout-warning')
+    },
+  })
+
   useBranding(config)
   useAppearanceBootstrap(session)
   useAdminPageTitle(config, currentPath)
@@ -292,10 +343,11 @@ function AdminShell({
 
     const resetMatch = matchRoute('/reset-password')
     if (resetMatch) {
-      const params = new URLSearchParams(
-        typeof window !== 'undefined' ? window.location.search : '',
+      // currentPath carries the query string (router syncs it from the URL on
+      // mount/popstate), so the emailed `?token=` deep link survives reloads.
+      return (
+        <ResetPassword onNavigate={navigate} token={parseRouteQuery(currentPath).get('token')} />
       )
-      return <ResetPassword onNavigate={navigate} token={params.get('token')} />
     }
 
     if (onLogin) {
@@ -332,7 +384,7 @@ function AdminShell({
     // a collection slugged `media`, `users`, or `settings`).
 
     if (matchRoute('/media')) {
-      return <MediaBrowser onNavigate={navigate} />
+      return <MediaBrowser onNavigate={navigate} currentPath={currentPath} />
     }
 
     // ─── Posts area ────────────────────────────────────────────────
@@ -358,13 +410,7 @@ function AdminShell({
     }
     const postTypeEdit = matchRoute('/posts/types/:slug/edit')
     if (postTypeEdit?.slug) {
-      // V1 falls through to the per-collection list view; future
-      // PR introduces a dedicated PostTypeEditor with field-level
-      // metadata. The list view is the natural per-type management
-      // surface today (it already shows posts in that type).
-      return (
-        <CollectionList collectionSlug={postTypeEdit.slug} config={config} onNavigate={navigate} />
-      )
+      return <PostTypeEditor slug={postTypeEdit.slug} onNavigate={navigate} />
     }
     if (matchRoute('/posts/types')) {
       return <PostTypesView onNavigate={navigate} />
@@ -434,7 +480,7 @@ function AdminShell({
       // "Add sub-page" in the Pages tree view arrives with the parent id
       // in the query string (`/pages/new?parent=<id>`); matchRoute ignores
       // the query so it's parsed here and preselected in the editor.
-      const newPageQuery = new URLSearchParams(currentPath.split('?')[1] ?? '')
+      const newPageQuery = parseRouteQuery(currentPath)
       return (
         <PageSectionEditor
           initialParentId={newPageQuery.get('parent')}
@@ -538,17 +584,38 @@ function AdminShell({
     // Users + API Keys moved into the Settings view as tabs. The legacy
     // top-level routes still resolve — they just land on the matching tab.
     if (matchRoute('/users')) {
-      return <Settings onNavigate={navigate} config={config} session={session} initialTab="users" />
+      return (
+        <Settings
+          onNavigate={navigate}
+          config={config}
+          session={session}
+          initialTab="users"
+          currentPath={currentPath}
+        />
+      )
     }
 
     if (matchRoute('/api-keys')) {
       return (
-        <Settings onNavigate={navigate} config={config} session={session} initialTab="api-keys" />
+        <Settings
+          onNavigate={navigate}
+          config={config}
+          session={session}
+          initialTab="api-keys"
+          currentPath={currentPath}
+        />
       )
     }
 
     if (matchRoute('/settings')) {
-      return <Settings onNavigate={navigate} config={config} session={session} />
+      return (
+        <Settings
+          onNavigate={navigate}
+          config={config}
+          session={session}
+          currentPath={currentPath}
+        />
+      )
     }
 
     if (matchRoute('/profile')) {
@@ -687,7 +754,8 @@ function AdminShell({
   // Preview routes render as standalone pages (no sidebar/header) so a
   // new-tab preview looks like the real published page rather than an
   // embedded admin view. Everything else gets the full admin chrome.
-  if (currentPath.endsWith('/preview')) {
+  // Query string is stripped — currentPath carries it after reloads.
+  if (currentPath.split('?')[0]!.endsWith('/preview')) {
     return (
       <div className="bg-background h-full min-h-screen">
         <ErrorBoundary>{renderView()}</ErrorBoundary>
@@ -838,7 +906,9 @@ function useAdminPageTitle(config: any, currentPath: string) {
     const baseName = branding?.title ?? (branding?.name ? `${branding.name} Admin` : null)
     if (!baseName) return
 
-    const segment = currentPath === '/' ? 'Dashboard' : currentPath.split('/').filter(Boolean)[0]
+    // Strip the query so `/settings?tab=users` titles as "Settings".
+    const pathname = currentPath.split('?')[0]!.split('#')[0]!
+    const segment = pathname === '/' ? 'Dashboard' : pathname.split('/').filter(Boolean)[0]
     const pageName = segment ? segment.charAt(0).toUpperCase() + segment.slice(1) : 'Dashboard'
     document.title = `${pageName} — ${baseName}`
   }, [config, currentPath])

package/src/__tests__/hooks/useIdleLogout.test.tsx

@@ -0,0 +1,188 @@
+// @vitest-environment happy-dom
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { render } from '@testing-library/react'
+
+import { useIdleLogout } from '../../hooks/useIdleLogout.js'
+
+function Harness({
+  enabled,
+  timeoutMs,
+  onIdle,
+  warningMs,
+  onWarn,
+  onWarnCancelled,
+  stayActiveRef,
+}: {
+  enabled: boolean
+  timeoutMs: number
+  onIdle: () => void
+  warningMs?: number
+  onWarn?: () => void
+  onWarnCancelled?: () => void
+  stayActiveRef?: { current: (() => void) | null }
+}) {
+  const { stayActive } = useIdleLogout({
+    enabled,
+    timeoutMs,
+    onIdle,
+    warningMs,
+    onWarn,
+    onWarnCancelled,
+  })
+  if (stayActiveRef) stayActiveRef.current = stayActive
+  return null
+}
+
+const TIMEOUT_MS = 60_000
+
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('useIdleLogout', () => {
+  it('fires onIdle exactly once after the timeout with no activity', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+
+    vi.advanceTimersByTime(TIMEOUT_MS - 1_000)
+    expect(onIdle).not.toHaveBeenCalled()
+
+    vi.advanceTimersByTime(TIMEOUT_MS)
+    expect(onIdle).toHaveBeenCalledTimes(1)
+
+    // The idle callback must not re-fire on subsequent ticks.
+    vi.advanceTimersByTime(TIMEOUT_MS * 3)
+    expect(onIdle).toHaveBeenCalledTimes(1)
+  })
+
+  it('resets the idle deadline on user activity', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+
+    // Just before the deadline the user types — the clock restarts.
+    vi.advanceTimersByTime(TIMEOUT_MS - 5_000)
+    window.dispatchEvent(new Event('keydown'))
+    vi.advanceTimersByTime(TIMEOUT_MS - 5_000)
+    expect(onIdle).not.toHaveBeenCalled()
+
+    // A full quiet timeout after the last activity signs the user out.
+    vi.advanceTimersByTime(TIMEOUT_MS)
+    expect(onIdle).toHaveBeenCalledTimes(1)
+  })
+
+  it('does nothing when disabled', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled={false} timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+    vi.advanceTimersByTime(TIMEOUT_MS * 10)
+    expect(onIdle).not.toHaveBeenCalled()
+  })
+
+  it('tears everything down on unmount', () => {
+    const onIdle = vi.fn()
+    const { unmount } = render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+    unmount()
+    vi.advanceTimersByTime(TIMEOUT_MS * 10)
+    expect(onIdle).not.toHaveBeenCalled()
+  })
+
+  it('checks the deadline immediately when a hidden tab becomes visible', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+
+    // Simulate the deadline passing while the tab was hidden (the interval is
+    // shared with visibility, so freeze it by only moving the mocked clock).
+    vi.setSystemTime(Date.now() + TIMEOUT_MS + 1_000)
+    document.dispatchEvent(new Event('visibilitychange'))
+    expect(onIdle).toHaveBeenCalledTimes(1)
+  })
+
+  describe('warning window', () => {
+    const WARNING_MS = 20_000
+
+    it('fires onWarn once inside the warning window, then onIdle at the deadline', () => {
+      const onIdle = vi.fn()
+      const onWarn = vi.fn()
+      render(
+        <Harness
+          enabled
+          timeoutMs={TIMEOUT_MS}
+          warningMs={WARNING_MS}
+          onIdle={onIdle}
+          onWarn={onWarn}
+        />,
+      )
+
+      // Before the warning window: nothing.
+      vi.advanceTimersByTime(TIMEOUT_MS - WARNING_MS - 5_000)
+      expect(onWarn).not.toHaveBeenCalled()
+
+      // Inside the window: warn exactly once, no logout yet.
+      vi.advanceTimersByTime(10_000)
+      expect(onWarn).toHaveBeenCalledTimes(1)
+      expect(onIdle).not.toHaveBeenCalled()
+
+      // Deadline: logout, and the warning doesn't re-fire.
+      vi.advanceTimersByTime(TIMEOUT_MS)
+      expect(onIdle).toHaveBeenCalledTimes(1)
+      expect(onWarn).toHaveBeenCalledTimes(1)
+    })
+
+    it('activity after the warning cancels it and resets the clock', () => {
+      const onIdle = vi.fn()
+      const onWarn = vi.fn()
+      const onWarnCancelled = vi.fn()
+      render(
+        <Harness
+          enabled
+          timeoutMs={TIMEOUT_MS}
+          warningMs={WARNING_MS}
+          onIdle={onIdle}
+          onWarn={onWarn}
+          onWarnCancelled={onWarnCancelled}
+        />,
+      )
+
+      vi.advanceTimersByTime(TIMEOUT_MS - 10_000)
+      expect(onWarn).toHaveBeenCalledTimes(1)
+
+      window.dispatchEvent(new Event('keydown'))
+      expect(onWarnCancelled).toHaveBeenCalledTimes(1)
+
+      // The clock restarted: warn again on the next quiet cycle, no logout yet.
+      vi.advanceTimersByTime(TIMEOUT_MS - 10_000)
+      expect(onWarn).toHaveBeenCalledTimes(2)
+      expect(onIdle).not.toHaveBeenCalled()
+    })
+
+    it('stayActive resets the clock like real activity', () => {
+      const onIdle = vi.fn()
+      const onWarn = vi.fn()
+      const onWarnCancelled = vi.fn()
+      const stayActiveRef: { current: (() => void) | null } = { current: null }
+      render(
+        <Harness
+          enabled
+          timeoutMs={TIMEOUT_MS}
+          warningMs={WARNING_MS}
+          onIdle={onIdle}
+          onWarn={onWarn}
+          onWarnCancelled={onWarnCancelled}
+          stayActiveRef={stayActiveRef}
+        />,
+      )
+
+      vi.advanceTimersByTime(TIMEOUT_MS - 10_000)
+      expect(onWarn).toHaveBeenCalledTimes(1)
+
+      stayActiveRef.current?.()
+      expect(onWarnCancelled).toHaveBeenCalledTimes(1)
+
+      vi.advanceTimersByTime(TIMEOUT_MS - 15_000)
+      expect(onIdle).not.toHaveBeenCalled()
+    })
+  })
+})

package/src/__tests__/lib/post-types-service.test.ts

@@ -0,0 +1,112 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const cmsApiMock = vi.fn()
+vi.mock('../../lib/api.js', () => ({
+  cmsApi: (...args: unknown[]) => cmsApiMock(...args),
+}))
+
+const {
+  fetchPostTypeDetail,
+  fieldKeyFromName,
+  fieldTypeLabel,
+  humanizeFieldName,
+  renderFieldSnippet,
+} = await import('../../lib/post-types-service.js')
+
+const COLLECTIONS = [
+  {
+    slug: 'blog',
+    labels: { singular: 'Blog Post', plural: 'Blog' },
+    type: 'post',
+    urlPrefix: 'blog',
+    description: 'Long-form articles',
+    icon: 'file-text',
+    color: 'purple',
+    hidden: false,
+    fields: [
+      { name: 'title', type: 'text', required: true },
+      { name: 'body', type: 'richText', required: false },
+      { name: 'author', type: 'relationship', required: false, relationTo: 'users' },
+    ],
+  },
+]
+
+describe('fetchPostTypeDetail', () => {
+  beforeEach(() => {
+    cmsApiMock.mockReset()
+    cmsApiMock.mockResolvedValue({ data: COLLECTIONS })
+  })
+
+  it('maps the matching collection row onto PostTypeDetail', async () => {
+    const detail = await fetchPostTypeDetail('blog')
+    expect(detail).toEqual({
+      slug: 'blog',
+      singular: 'Blog Post',
+      plural: 'Blog',
+      description: 'Long-form articles',
+      urlPrefix: 'blog',
+      icon: 'file-text',
+      color: 'purple',
+      fields: COLLECTIONS[0]!.fields,
+    })
+  })
+
+  it('returns null when the slug is unknown', async () => {
+    expect(await fetchPostTypeDetail('missing')).toBeNull()
+  })
+
+  it('throws on an API error envelope', async () => {
+    cmsApiMock.mockResolvedValue({ error: 'boom' })
+    await expect(fetchPostTypeDetail('blog')).rejects.toThrow('boom')
+  })
+})
+
+describe('field name helpers', () => {
+  it('humanizes camelCase and snake_case keys', () => {
+    expect(humanizeFieldName('clientName')).toBe('Client Name')
+    expect(humanizeFieldName('meta_description')).toBe('Meta Description')
+    expect(humanizeFieldName('seo-score')).toBe('Seo Score')
+  })
+
+  it('derives camelCase keys from display names', () => {
+    expect(fieldKeyFromName('Client Name')).toBe('clientName')
+    expect(fieldKeyFromName('  Featured   Image!  ')).toBe('featuredImage')
+    expect(fieldKeyFromName('')).toBe('')
+  })
+
+  it('labels known field types and passes through unknown ones', () => {
+    expect(fieldTypeLabel('text')).toBe('Short Text')
+    expect(fieldTypeLabel('relationship')).toBe('Relation')
+    expect(fieldTypeLabel('customThing')).toBe('customThing')
+  })
+})
+
+describe('renderFieldSnippet', () => {
+  it('renders a minimal optional field', () => {
+    expect(
+      renderFieldSnippet({ key: 'subtitle', label: 'Subtitle', type: 'text', required: false }),
+    ).toBe("subtitle: { type: 'text', label: 'Subtitle' },")
+  })
+
+  it('includes required, help text, and escapes quotes', () => {
+    const snippet = renderFieldSnippet({
+      key: 'clientName',
+      label: "Client's Name",
+      type: 'text',
+      required: true,
+      helpText: "Editor's hint",
+    })
+    expect(snippet).toContain("label: 'Client\\'s Name'")
+    expect(snippet).toContain('required: true')
+    expect(snippet).toContain("admin: { description: 'Editor\\'s hint' }")
+  })
+
+  it('seeds placeholder options for select and relationTo for relationship', () => {
+    expect(
+      renderFieldSnippet({ key: 'tone', label: 'Tone', type: 'select', required: false }),
+    ).toContain("options: [{ label: 'Option A', value: 'option-a' }]")
+    expect(
+      renderFieldSnippet({ key: 'owner', label: 'Owner', type: 'relationship', required: false }),
+    ).toContain("relationTo: 'posts'")
+  })
+})