@podosoft/podokit 0.10.2 → 0.11.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/app.d.ts

@@ -8,6 +8,7 @@ export type SessionUser = {
   role?: string | null;
   image?: string | null;
   emailVerified?: boolean;
+  signupApproved?: boolean | null;
   twoFactorEnabled?: boolean | null;
   username?: string | null;
   phoneNumber?: string | null;

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/account-data.server.ts

@@ -8,6 +8,7 @@ const defaultCapabilities: Capabilities = {
   deleteAccount: false,
   auditLog: false,
   emailVerification: false,
+  signupApprovalRequired: false,
   passwordBreachCheck: false,
   magicLink: false,
   emailOtp: false,

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/messages.ts

@@ -83,6 +83,10 @@ const en = {
     verifyLinkError: "That verification link is invalid or has expired. Request a new one below.",
     resendVerification: "Resend verification email",
     emailNotVerified: "Verify your email before signing in.",
+    approvalPendingTitle: "Waiting for approval",
+    approvalPendingDesc: "Your account was created and is waiting for an administrator to approve it. Try signing in again after approval.",
+    approvalPending: "Your account is waiting for administrator approval.",
+    continueWith: "Continue with {provider}",
   },
   nav: { overview: "Overview", users: "Users", sessions: "Sessions", organizations: "Organizations", audit: "Audit log", account: "Account", settings: "Settings", home: "Back to home", signOut: "Sign out" },
   passkeys: {
@@ -161,6 +165,7 @@ const en = {
     saved: "Setting updated", saveFailed: "Failed to update setting",
     emailPassword: "Email & password", emailPasswordDesc: "Sign in with an email address and password.",
     emailVerification: "Email verification", emailVerificationDesc: "Require new sign-ups to confirm their address.",
+    signupApproval: "Sign-up approval", signupApprovalDesc: "Require an administrator to approve new self-registered users. Disabling this only affects future registrations.",
     magicLink: "Magic link", magicLinkDesc: "Passwordless sign-in via an emailed link.",
     emailOtp: "Email one-time code", emailOtpDesc: "Passwordless sign-in with an emailed code.",
     username: "Username sign-in", usernameDesc: "Let users sign in with a username instead of an email.",
@@ -259,6 +264,9 @@ const en = {
     sendResetEmail: "Send password reset email",
     resetEmailSent: "Password reset email sent",
     sendVerificationOnCreate: "Send verification email",
+    pendingApproval: "Pending approval",
+    approve: "Approve sign-up",
+    approved: "Sign-up approved",
   },
   sessions: {
     title: "Active sessions",
@@ -433,6 +441,10 @@ const ko: Messages = {
     verifyLinkError: "인증 링크가 유효하지 않거나 만료되었습니다. 아래에서 다시 요청하세요.",
     resendVerification: "인증 메일 다시 보내기",
     emailNotVerified: "로그인 전에 이메일을 인증해 주세요.",
+    approvalPendingTitle: "승인 대기 중",
+    approvalPendingDesc: "계정이 생성되었으며 관리자의 승인을 기다리고 있습니다. 승인 후 다시 로그인해 주세요.",
+    approvalPending: "관리자의 계정 승인을 기다리고 있습니다.",
+    continueWith: "{provider}(으)로 계속",
     resetFailed: "재설정에 실패했습니다",
   },
   nav: { overview: "개요", users: "회원", sessions: "세션", organizations: "조직", audit: "감사 로그", account: "계정", settings: "설정", home: "홈으로 돌아가기", signOut: "로그아웃" },
@@ -512,6 +524,7 @@ const ko: Messages = {
     saved: "설정을 변경했습니다", saveFailed: "설정 변경에 실패했습니다",
     emailPassword: "이메일·비밀번호", emailPasswordDesc: "이메일과 비밀번호로 로그인.",
     emailVerification: "이메일 인증", emailVerificationDesc: "신규 가입 시 이메일 확인 요구.",
+    signupApproval: "회원가입 승인", signupApprovalDesc: "신규 자가 가입 사용자를 관리자가 승인해야 로그인할 수 있습니다. 끄면 이후 가입부터 자동 승인됩니다.",
     magicLink: "매직 링크", magicLinkDesc: "이메일 링크로 비밀번호 없이 로그인.",
     emailOtp: "이메일 일회용 코드", emailOtpDesc: "이메일로 받은 코드로 비밀번호 없이 로그인.",
     username: "사용자명 로그인", usernameDesc: "이메일 대신 사용자명으로 로그인.",
@@ -610,6 +623,9 @@ const ko: Messages = {
     sendResetEmail: "비밀번호 재설정 메일 보내기",
     resetEmailSent: "재설정 메일을 보냈습니다",
     sendVerificationOnCreate: "인증 메일 보내기",
+    pendingApproval: "승인 대기",
+    approve: "회원가입 승인",
+    approved: "회원가입을 승인했습니다",
   },
   sessions: {
     title: "활성 세션",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/search-indexing.ts

@@ -7,6 +7,7 @@ const NON_INDEXABLE_PATH_PREFIXES = [
   "/forgot-password",
   "/reset-password",
   "/verify-email",
+  "/pending-approval",
   "/setup-2fa",
   "/oauth2",
   "/accept-invitation",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/+layout.server.ts

@@ -9,6 +9,7 @@ export const load: LayoutServerLoad = async ({ locals, fetch }) => {
     deleteAccount: false,
     auditLog: false,
     emailVerification: false,
+    signupApprovalRequired: false,
     passwordBreachCheck: false,
     magicLink: false,
     emailOtp: false,

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/settings/+page.server.ts

@@ -10,7 +10,7 @@ export type AuthConfigView = {
   social: Record<string, SocialProviderView>;
   catalog: ReadonlyArray<{ id: string; label: string }>;
   smtp: { enabled: boolean; host: string; port: number; secure: boolean; user: string; from: string; hasSecret: boolean };
-  server: { requireEmailVerification: boolean; allowDelete: boolean; hibp: boolean; auditLog: boolean };
+  server: { requireEmailVerification: boolean; requireSignupApproval: boolean; allowDelete: boolean; hibp: boolean; auditLog: boolean };
 };
 
 export const load: PageServerLoad = async ({ locals, fetch }) => {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/settings/+page.svelte

@@ -27,7 +27,7 @@
   // require2fa is a policy flag stored alongside the feature flags but not part of
   // the typed Capabilities, so it is toggled but never read from `caps`.
   type ToggleFlag = EditableFlag | "require2fa";
-  type ServerKey = "requireEmailVerification" | "hibp" | "allowDelete" | "auditLog";
+  type ServerKey = "requireEmailVerification" | "requireSignupApproval" | "hibp" | "allowDelete" | "auditLog";
 
   // Every card renders from this one shape, so they share size and structure: a
   // title (+ optional enable switch), a description, and a footer with a status
@@ -178,6 +178,12 @@
     },
   ]);
   const security = $derived<Item[]>([
+    serverCard(
+      "requireSignupApproval",
+      i18n.t.settings.signupApproval,
+      i18n.t.settings.signupApprovalDesc,
+      caps.signupApprovalRequired,
+    ),
     flagCard("twoFactor", i18n.t.settings.twoFactor, i18n.t.settings.twoFactorDesc),
     {
       key: "flag-require2fa",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/users/+page.svelte

@@ -32,6 +32,7 @@
     email: string;
     role?: string | null;
     banned?: boolean | null;
+    signupApproved?: boolean | null;
     emailVerified?: boolean | null;
     createdAt?: string | Date | null;
     banReason?: string | null;
@@ -74,6 +75,7 @@
       options: [
         { value: "", label: i18n.t.toolbar.all },
         { value: "active", label: i18n.t.users.active },
+        { value: "pending", label: i18n.t.users.pendingApproval },
         { value: "banned", label: i18n.t.users.banned },
       ],
     },
@@ -91,7 +93,8 @@
       }
       if (appliedFilters.role && (u.role ?? "user") !== appliedFilters.role) return false;
       if (appliedFilters.status === "banned" && !u.banned) return false;
-      if (appliedFilters.status === "active" && u.banned) return false;
+      if (appliedFilters.status === "pending" && u.signupApproved !== false) return false;
+      if (appliedFilters.status === "active" && (u.banned || u.signupApproved === false)) return false;
       return true;
     }),
   );
@@ -117,6 +120,19 @@
     await goto("/admin", { invalidateAll: true });
   }
 
+  async function approve(u: Row): Promise<void> {
+    busy = true;
+    const { error } = await api.auth.admin.updateUser({
+      userId: u.id,
+      data: { signupApproved: true },
+    });
+    busy = false;
+    if (error) return void toast.error(error.message ?? i18n.t.users.actionFailed);
+    if (mUser?.id === u.id) mUser = { ...mUser, signupApproved: true };
+    toast.success(i18n.t.users.approved);
+    await load();
+  }
+
   // Create user
   let createOpen = $state(false);
   let form = $state({ name: "", email: "", password: "", confirm: "", role: "user", sendVerify: true });
@@ -372,7 +388,13 @@
       <Table.Cell><Badge variant={user.role === "admin" ? "default" : "secondary"}>{user.role ?? "user"}</Badge></Table.Cell>
       <Table.Cell>
         <div class="flex flex-wrap gap-1">
-          {#if user.banned}<Badge variant="destructive">{i18n.t.users.banned}</Badge>{:else}<Badge variant="outline">{i18n.t.users.active}</Badge>{/if}
+          {#if user.signupApproved === false}
+            <Badge variant="secondary">{i18n.t.users.pendingApproval}</Badge>
+          {:else if user.banned}
+            <Badge variant="destructive">{i18n.t.users.banned}</Badge>
+          {:else}
+            <Badge variant="outline">{i18n.t.users.active}</Badge>
+          {/if}
           {#if emailVerificationEnabled}
             {#if user.emailVerified}<Badge variant="outline" class="text-green-600 dark:text-green-400">{i18n.t.users.verified}</Badge>{:else}<Badge variant="secondary">{i18n.t.users.unverified}</Badge>{/if}
           {/if}
@@ -387,8 +409,11 @@
             {/snippet}
           </DropdownMenu.Trigger>
           <DropdownMenu.Content align="end">
+            {#if user.signupApproved === false}
+              <DropdownMenu.Item onSelect={() => approve(user)}>{i18n.t.users.approve}</DropdownMenu.Item>
+            {/if}
             <DropdownMenu.Item onSelect={() => openManage(user)}>{i18n.t.users.manage}</DropdownMenu.Item>
-            <DropdownMenu.Item disabled={user.id === data.currentUserId} onSelect={() => impersonate(user)}>
+            <DropdownMenu.Item disabled={user.id === data.currentUserId || user.signupApproved === false} onSelect={() => impersonate(user)}>
               {i18n.t.users.impersonate}
             </DropdownMenu.Item>
           </DropdownMenu.Content>
@@ -461,6 +486,14 @@
               </Select.Root>
             </div>
             {#if mUser?.banned}<Badge variant="destructive" class="w-fit">{i18n.t.users.banned}</Badge>{/if}
+            {#if mUser?.signupApproved === false}
+              <div class="flex items-center gap-2">
+                <Badge variant="secondary">{i18n.t.users.pendingApproval}</Badge>
+                <Button type="button" variant="outline" size="sm" disabled={busy} onclick={() => { if (mUser) void approve(mUser); }}>
+                  {i18n.t.users.approve}
+                </Button>
+              </div>
+            {/if}
             {#if emailVerificationEnabled}
               <div class="flex items-center gap-2">
                 {#if mUser?.emailVerified}<Badge variant="outline" class="text-green-600 dark:text-green-400">{i18n.t.users.verified}</Badge>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.server.ts

@@ -1,14 +1,17 @@
+import { redirect } from "@sveltejs/kit";
 import type { PageServerLoad } from "./$types";
-import type { Capabilities } from "@podosoft/podokit-api-client";
+import { SIGNUP_APPROVAL_REQUIRED, type Capabilities } from "@podosoft/podokit-api-client";
 
 // Capabilities is public so the login page can offer whichever sign-in methods
 // (magic link, ...) the server actually enabled.
-export const load: PageServerLoad = async ({ fetch }) => {
+export const load: PageServerLoad = async ({ fetch, url }) => {
+  const oauthError = url.searchParams.get("error");
+  if (oauthError === SIGNUP_APPROVAL_REQUIRED) redirect(302, "/pending-approval");
   try {
     const res = await fetch("/api/account/capabilities");
-    if (res.ok) return { capabilities: (await res.json()) as Capabilities };
+    if (res.ok) return { capabilities: (await res.json()) as Capabilities, oauthError };
   } catch {
     /* fall through to defaults */
   }
-  return { capabilities: null };
+  return { capabilities: null, oauthError };
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.svelte

@@ -7,7 +7,8 @@
   import * as Card from "$lib/components/ui/card";
   import * as Alert from "$lib/components/ui/alert";
   import { api } from "$lib/api";
-  import { getI18n } from "$lib/i18n";
+  import { getI18n, fmt } from "$lib/i18n";
+  import { SIGNUP_APPROVAL_REQUIRED } from "@podosoft/podokit-api-client";
   import { site } from "$lib/site.svelte";
 
   import type { PageData } from "./$types";
@@ -22,6 +23,10 @@
   let unverified = $state(false);
   let loading = $state(false);
 
+  $effect(() => {
+    if (data.oauthError) error = i18n.t.auth.signInFailed;
+  });
+
   // Second-factor step: a password/OTP sign-in with 2FA enabled returns
   // `twoFactorRedirect` and no session; the user then verifies with an
   // authenticator code or a backup code to complete the login.
@@ -30,6 +35,34 @@
   let useBackupCode = $state(false);
   let twoFaLoading = $state(false);
   const redirectTo = (): string => page.url.searchParams.get("redirect") ?? "/admin";
+  const socialProviders = $derived(data.capabilities?.providers ?? []);
+  const providerLabels: Record<string, string> = {
+    github: "GitHub",
+    google: "Google",
+    apple: "Apple",
+    microsoft: "Microsoft",
+  };
+  const providerLabel = (provider: string): string =>
+    providerLabels[provider] ?? provider.charAt(0).toUpperCase() + provider.slice(1);
+
+  async function signInSocial(provider: string): Promise<void> {
+    error = null;
+    const callbackURL = new URL(redirectTo(), page.url.origin).toString();
+    type SocialProvider = Parameters<typeof api.auth.signIn.social>[0]["provider"];
+    const { error: authError } = await api.auth.signIn.social({
+      provider: provider as SocialProvider,
+      callbackURL,
+      errorCallbackURL: `${page.url.origin}/login`,
+      newUserCallbackURL: callbackURL,
+    });
+    if (authError) {
+      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
+        await goto("/pending-approval");
+        return;
+      }
+      error = authError.message ?? i18n.t.auth.signInFailed;
+    }
+  }
 
   // Returns true when 2FA is still owed (caller shows the step instead of leaving).
   function needsTwoFactor(data: unknown): boolean {
@@ -59,6 +92,10 @@
       : await api.auth.twoFactor.verifyTotp({ code: twoFaCode.trim() });
     twoFaLoading = false;
     if (authError) {
+      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
+        await goto("/pending-approval");
+        return;
+      }
       error = twoFactorError(authError.code);
       return;
     }
@@ -78,10 +115,15 @@
     error = null;
     const { error: authError } = await api.auth.signIn.magicLink({
       email,
-      callbackURL: page.url.searchParams.get("redirect") ?? "/admin",
+      callbackURL: new URL(redirectTo(), page.url.origin).toString(),
+      errorCallbackURL: `${page.url.origin}/login`,
     });
     magicLoading = false;
     if (authError) {
+      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
+        await goto("/pending-approval");
+        return;
+      }
       error = authError.message ?? i18n.t.auth.signInFailed;
       return;
     }
@@ -104,6 +146,10 @@
     const { error: authError } = await api.auth.emailOtp.sendVerificationOtp({ email, type: "sign-in" });
     otpLoading = false;
     if (authError) {
+      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
+        await goto("/pending-approval");
+        return;
+      }
       error = authError.message ?? i18n.t.auth.signInFailed;
       return;
     }
@@ -115,6 +161,10 @@
     const { data, error: authError } = await api.auth.signIn.emailOtp({ email, otp: otpCode });
     otpLoading = false;
     if (authError) {
+      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
+        await goto("/pending-approval");
+        return;
+      }
       error = authError.message ?? i18n.t.auth.signInFailed;
       return;
     }
@@ -134,6 +184,10 @@
     const res = await api.auth.signIn.passkey();
     passkeyLoading = false;
     if (res?.error) {
+      if ("code" in res.error && res.error.code === SIGNUP_APPROVAL_REQUIRED) {
+        await goto("/pending-approval");
+        return;
+      }
       error = res.error.message ?? i18n.t.auth.signInFailed;
       return;
     }
@@ -152,6 +206,10 @@
       : await api.auth.signIn.email({ email, password });
     loading = false;
     if (authError) {
+      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
+        await goto("/pending-approval");
+        return;
+      }
       // Surface an unverified address with a path to a fresh verification link.
       unverified = authError.code === "EMAIL_NOT_VERIFIED";
       error = unverified ? i18n.t.auth.emailNotVerified : (authError.message ?? i18n.t.auth.signInFailed);
@@ -225,8 +283,13 @@
       </div>
       <Button type="submit" disabled={loading}>{loading ? i18n.t.auth.signingIn : i18n.t.auth.signIn}</Button>
     </form>
-    {#if magicLinkEnabled || emailOtpEnabled || passkeyEnabled}
+    {#if socialProviders.length > 0 || magicLinkEnabled || emailOtpEnabled || passkeyEnabled}
       <div class="mt-4 flex flex-col gap-3 border-t pt-4">
+        {#each socialProviders as provider (provider)}
+          <Button type="button" variant="outline" class="w-full" onclick={() => signInSocial(provider)}>
+            {fmt(i18n.t.auth.continueWith, { provider: providerLabel(provider) })}
+          </Button>
+        {/each}
         {#if passkeyEnabled}
           <Button type="button" variant="outline" class="w-full" disabled={passkeyLoading} onclick={signInWithPasskey}>
             {passkeyLoading ? i18n.t.auth.signingIn : i18n.t.auth.passkeyButton}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/pending-approval/+page.svelte

@@ -0,0 +1,18 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { Button } from "$lib/components/ui/button";
+  import * as Card from "$lib/components/ui/card";
+  import { getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+</script>
+
+<Card.Root>
+  <Card.Header>
+    <Card.Title role="heading" aria-level={1}>{i18n.t.auth.approvalPendingTitle}</Card.Title>
+    <Card.Description>{i18n.t.auth.approvalPendingDesc}</Card.Description>
+  </Card.Header>
+  <Card.Footer>
+    <Button class="w-full" onclick={() => goto("/login")}>{i18n.t.auth.backToSignIn}</Button>
+  </Card.Footer>
+</Card.Root>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/signup/+page.server.ts

@@ -0,0 +1,12 @@
+import type { PageServerLoad } from "./$types";
+import type { Capabilities } from "@podosoft/podokit-api-client";
+
+export const load: PageServerLoad = async ({ fetch }) => {
+  try {
+    const res = await fetch("/api/account/capabilities");
+    if (res.ok) return { capabilities: (await res.json()) as Capabilities };
+  } catch {
+    /* fall through to a safe default */
+  }
+  return { capabilities: null };
+};

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/signup/+page.svelte

@@ -8,7 +8,10 @@
   import * as Alert from "$lib/components/ui/alert";
   import { api } from "$lib/api";
   import { getI18n } from "$lib/i18n";
+  import { SIGNUP_APPROVAL_REQUIRED } from "@podosoft/podokit-api-client";
+  import type { PageData } from "./$types";
 
+  let { data }: { data: PageData } = $props();
   const i18n = getI18n();
   let name = $state("");
   let email = $state("");
@@ -30,6 +33,10 @@
     });
     if (authError) {
       loading = false;
+      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
+        await goto("/pending-approval");
+        return;
+      }
       error = authError.message ?? i18n.t.auth.signUpFailed;
       return;
     }
@@ -38,6 +45,10 @@
     const { data: session } = await api.auth.getSession();
     loading = false;
     if (!session?.session) {
+      if (data.capabilities?.signupApprovalRequired) {
+        await goto("/pending-approval");
+        return;
+      }
       await goto(`/verify-email?email=${encodeURIComponent(email)}`);
       return;
     }

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.server.ts

@@ -11,6 +11,7 @@ const PUBLIC_PATHS = [
   "/forgot-password",
   "/reset-password",
   "/verify-email",
+  "/pending-approval",
   "/maintenance",
   // Modules add their public (no-session) page prefixes here.
   // podokit:begin:public-paths

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -78,3 +78,82 @@ test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwr
   expect((await user.put("/api/account/auth-config", { data: { server: { hibp: true } } })).status()).toBe(403);
   await user.dispose();
 });
+
+test("new registrations require approval when the policy is enabled @smoke", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const password = "Podokit3e-Str0ng!pw";
+  const email = `approval-${Date.now()}@example.com`;
+  const adminCreatedEmail = `approval-admin-${Date.now()}@example.com`;
+  let pendingId = "";
+  let adminCreatedId = "";
+
+  try {
+    const enabled = await admin.put("/api/account/auth-config", {
+      data: { server: { requireSignupApproval: true } },
+    });
+    expect(enabled.ok()).toBeTruthy();
+    expect((await enabled.json()).server.requireSignupApproval).toBe(true);
+
+    // authRuntime and its config store use a short cache; an auth request after
+    // the TTL applies the new policy without restarting the process.
+    await new Promise((resolve) => setTimeout(resolve, 3_200));
+    await anon.get("/api/auth/get-session");
+
+    const signup = await anon.post("/api/auth/sign-up/email", {
+      data: { email, password, name: "Pending User" },
+    });
+    expect(signup.ok()).toBeTruthy();
+    expect((await signup.json()).token).toBeNull();
+    expect((await anon.get("/api/auth/get-session")).status()).toBe(200);
+    expect((await (await anon.get("/api/auth/get-session")).json())?.session).toBeFalsy();
+
+    const listed = await admin.get(
+      `/api/auth/admin/list-users?searchValue=${encodeURIComponent(email)}&searchField=email`,
+    );
+    const pending = ((await listed.json()).users ?? [])[0] as {
+      id: string;
+      signupApproved?: boolean | null;
+    };
+    pendingId = pending.id;
+    expect(pending.signupApproved).toBe(false);
+
+    const blocked = await anon.post("/api/auth/sign-in/email", { data: { email, password } });
+    expect(blocked.status()).toBe(403);
+    expect((await blocked.json()).code).toBe("SIGNUP_APPROVAL_REQUIRED");
+
+    const approved = await admin.post("/api/auth/admin/update-user", {
+      data: { userId: pendingId, data: { signupApproved: true } },
+    });
+    expect(approved.ok()).toBeTruthy();
+    expect((await approved.json()).signupApproved).toBe(true);
+    expect((await anon.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+
+    // Accounts created intentionally by an administrator bypass the queue.
+    const adminCreated = await admin.post("/api/auth/admin/create-user", {
+      data: { email: adminCreatedEmail, password, name: "Admin Created", role: "user" },
+    });
+    expect(adminCreated.ok()).toBeTruthy();
+    const adminCreatedUser = (await adminCreated.json()).user as {
+      id: string;
+      signupApproved?: boolean | null;
+    };
+    adminCreatedId = adminCreatedUser.id;
+    expect(adminCreatedUser.signupApproved).toBe(true);
+    const adminCreatedSession = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    expect(
+      (await adminCreatedSession.post("/api/auth/sign-in/email", {
+        data: { email: adminCreatedEmail, password },
+      })).ok(),
+    ).toBeTruthy();
+    await adminCreatedSession.dispose();
+  } finally {
+    if (pendingId) await admin.post("/api/auth/admin/remove-user", { data: { userId: pendingId } });
+    if (adminCreatedId) await admin.post("/api/auth/admin/remove-user", { data: { userId: adminCreatedId } });
+    await admin.put("/api/account/auth-config", { data: { server: { requireSignupApproval: false } } });
+    await new Promise((resolve) => setTimeout(resolve, 3_200));
+    await anon.get("/api/auth/get-session");
+    await anon.dispose();
+    await admin.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -105,6 +105,7 @@ test("account capabilities reports optional-feature flags", async ({ playwright
   expect(typeof caps.twoFactor).toBe("boolean");
   expect(Array.isArray(caps.providers)).toBe(true);
   expect(typeof caps.deleteAccount).toBe("boolean");
+  expect(typeof caps.signupApprovalRequired).toBe("boolean");
   await ctx.dispose();
 });
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -4,6 +4,8 @@ import { ready } from "../helpers/hydration";
 
 test.use({ storageState: anonState });
 
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
 test("login page renders @smoke", async ({ page }) => {
   await page.goto("/login");
   await expect(page.getByLabel("Email")).toBeVisible();
@@ -28,6 +30,48 @@ test("signup page renders", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Create account" })).toBeVisible();
 });
 
+test("pending approval errors show the approval status page", async ({ page }) => {
+  await page.goto("/login?error=SIGNUP_APPROVAL_REQUIRED");
+  await expect(page).toHaveURL(/\/pending-approval$/);
+  await expect(page.getByRole("heading", { name: "Waiting for approval" })).toBeVisible();
+});
+
+test("configured social providers appear on the login page", async ({ page, playwright }) => {
+  const admin = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin: base },
+  });
+  await admin.post("/api/auth/sign-in/email", {
+    data: { email: ADMIN.email, password: ADMIN.password },
+  });
+  try {
+    expect(
+      (await admin.put("/api/account/auth-config", {
+        data: {
+          social: {
+            google: {
+              enabled: true,
+              clientId: "dummy-google-client-id",
+              clientSecret: "dummy-google-client-secret",
+            },
+          },
+        },
+      })).ok(),
+    ).toBeTruthy();
+    await expect
+      .poll(async () => {
+        await page.goto("/login");
+        return page.getByRole("button", { name: "Continue with Google" }).count();
+      }, { timeout: 8_000 })
+      .toBe(1);
+  } finally {
+    await admin.put("/api/account/auth-config", {
+      data: { social: { google: { enabled: false } } },
+    });
+    await admin.dispose();
+  }
+});
+
 test("forgot-password shows a sent confirmation", async ({ page }) => {
   await ready(page, "/forgot-password");
   // Retry the submit to absorb any first-load hydration timing.

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings.ui.spec.ts

@@ -88,4 +88,5 @@ test("settings: the require-two-factor toggle is available @smoke", async ({ pag
   // the require-2fa api/ui specs. Not toggled here — turning it on would gate this
   // admin session.
   await expect(page.getByRole("switch", { name: "Require two-factor" })).toBeVisible();
+  await expect(page.getByRole("switch", { name: "Sign-up approval" })).toBeVisible();
 });