@podosoft/podokit 0.11.1 → 0.12.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/site.svelte.ts

@@ -40,14 +40,21 @@ const empty: SiteSettings = {
 };
 
 let current = $state<SiteSettings>({ ...empty });
+let initialized = $state(false);
 
 export const site = {
   get value(): SiteSettings {
     return current;
   },
+  get initialized(): boolean {
+    return initialized;
+  },
   /** Seed from the server load (idempotent). */
   init(v: Partial<SiteSettings> | null | undefined): void {
-    if (v) current = { ...empty, ...v };
+    if (v) {
+      current = { ...empty, ...v };
+      initialized = true;
+    }
   },
   /** Merge in changes so the layout re-applies title/favicon immediately. */
   patch(v: Partial<SiteSettings>): void {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/audit/+page.svelte

@@ -28,13 +28,13 @@
   let searchField = $state("actor");
   let appliedSearchField = $state("actor");
 
-  const columns: DataTableColumn<Entry>[] = [
+  const columns = $derived<DataTableColumn<Entry>[]>([
     { key: "createdAt", label: i18n.t.audit.when, sortable: true, class: "whitespace-nowrap" },
     { key: "actor", label: i18n.t.audit.actor, sortable: true, value: (e) => e.actorName ?? e.actorEmail },
     { key: "action", label: i18n.t.audit.action, sortable: true },
     { key: "target", label: i18n.t.audit.target, sortable: true, value: (e) => e.targetLabel },
     { key: "ip", label: i18n.t.audit.ip, sortable: true },
-  ];
+  ]);
 
   const actions = $derived([...new Set(entries.map((e) => e.action))].sort());
   const filters = $derived<ToolbarFilter[]>([
@@ -45,10 +45,10 @@
     },
   ]);
 
-  const searchFields: ToolbarSearchField[] = [
+  const searchFields = $derived<ToolbarSearchField[]>([
     { value: "actor", label: i18n.t.audit.actor },
     { value: "target", label: i18n.t.audit.target },
-  ];
+  ]);
 
   const filtered = $derived(
     entries.filter((e) => {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/organizations/+page.svelte

@@ -17,13 +17,13 @@
   let orgs = $state<Org[]>([]);
   let sort = $state<SortState | null>({ key: "createdAt", dir: "desc" });
   let listPage = $state(1);
-  const columns: DataTableColumn<Org>[] = [
+  const columns = $derived<DataTableColumn<Org>[]>([
     { key: "name", label: i18n.t.organizations.name, sortable: true },
     { key: "slug", label: i18n.t.organizations.slug, sortable: true },
     { key: "parent", label: i18n.t.organizations.parent, sortable: true, value: (o) => orgName(o.parentOrganizationId) },
     { key: "createdAt", label: i18n.t.organizations.created, sortable: true },
     { key: "actions", label: "", class: "w-10" },
-  ];
+  ]);
   let busy = $state(false);
   let createOpen = $state(false);
   let form = $state({ name: "", slug: "", parentOrganizationId: "" });

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/sessions/+page.svelte

@@ -41,19 +41,19 @@
   let searchField = $state("email");
   let appliedSearchField = $state("email");
 
-  const columns: DataTableColumn<Row>[] = [
+  const columns = $derived<DataTableColumn<Row>[]>([
     { key: "user", label: i18n.t.adminSessions.user, sortable: true, value: (r) => r.userName },
     { key: "device", label: i18n.t.adminSessions.device, sortable: true, value: (r) => r.userAgent },
     { key: "ip", label: i18n.t.adminSessions.ip, sortable: true, value: (r) => r.ipAddress },
     { key: "createdAt", label: i18n.t.adminSessions.since, sortable: true },
     { key: "expiresAt", label: i18n.t.adminSessions.expires, sortable: true, value: (r) => (r.expiresAt ? new Date(r.expiresAt).getTime() : 0) },
     { key: "actions", label: "", class: "w-10" },
-  ];
+  ]);
 
-  const searchFields: ToolbarSearchField[] = [
+  const searchFields = $derived<ToolbarSearchField[]>([
     { value: "email", label: i18n.t.users.email },
     { value: "name", label: i18n.t.users.name },
-  ];
+  ]);
 
   const filtered = $derived(
     rows.filter((r) => {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/settings/+page.svelte

@@ -72,6 +72,7 @@
   }
 
   const callbackBase = $derived(typeof window === "undefined" ? "" : window.location.origin);
+  const providerCallback = (id: string): string => `${callbackBase}/api/auth/callback/${id}`;
   const labelOf = (id: string): string => ac?.catalog.find((c) => c.id === id)?.label ?? id;
   const configured = $derived(Object.values(ac?.social ?? {}));
   const enabledProviders = $derived(configured.filter((p) => p.enabled && p.clientId && p.hasSecret));
@@ -102,6 +103,11 @@
   });
   const editingView = $derived(socialForm.adding ? undefined : ac?.social[socialForm.id]);
 
+  function socialRedirectURI(): string {
+    const configured = socialForm.redirectURI.trim();
+    return socialForm.adding || !configured ? providerCallback(socialForm.id) : configured;
+  }
+
   function openSocialManager(): void {
     socialView = "list";
     openDialog = "social";
@@ -122,7 +128,7 @@
         [socialForm.id]: {
           enabled: socialForm.enabled,
           clientId: socialForm.clientId,
-          redirectURI: socialForm.redirectURI,
+          redirectURI: socialRedirectURI(),
           ...(socialForm.clientSecret ? { clientSecret: socialForm.clientSecret } : {}),
         },
       },
@@ -335,7 +341,7 @@
         <div class="flex flex-col gap-1"><Label for="social-id">{i18n.t.settings.clientId}</Label><Input id="social-id" bind:value={socialForm.clientId} autocomplete="off" /></div>
         <div class="flex flex-col gap-1"><Label for="social-secret">{i18n.t.settings.clientSecret}</Label><Input id="social-secret" type="password" bind:value={socialForm.clientSecret} autocomplete="off" placeholder={editingView?.hasSecret ? i18n.t.settings.secretSet : ""} /></div>
         {#if socialForm.id}
-          <p class="text-muted-foreground text-xs">{i18n.t.settings.redirectUri}: <code class="break-all">{callbackBase}/api/auth/callback/{socialForm.id}</code></p>
+          <p class="text-muted-foreground text-xs">{i18n.t.settings.redirectUri}: <code class="break-all">{socialRedirectURI()}</code></p>
         {/if}
       </div>
       <Dialog.Footer>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/settings/general-settings.svelte

@@ -3,10 +3,12 @@
   import { Label } from "$lib/components/ui/label";
   import { Button } from "$lib/components/ui/button";
   import { Switch } from "$lib/components/ui/switch";
+  import * as Select from "$lib/components/ui/select";
   import * as Card from "$lib/components/ui/card";
   import { toast } from "svelte-sonner";
   import { api } from "$lib/api";
   import { getI18n } from "$lib/i18n";
+  import { defaultLocale, LOCALES, localeNames, resolveLocale } from "$lib/i18n/messages";
   import { site, type SiteSettings } from "$lib/site.svelte";
 
   const i18n = getI18n();
@@ -21,14 +23,14 @@
     footerText: "",
     termsUrl: "",
     privacyUrl: "",
-    locale: "",
+    locale: defaultLocale,
     timezone: "",
   });
   let maintenanceMode = $state(false);
   let allowSignup = $state(true);
   let seeded = $state(false);
   $effect(() => {
-    if (seeded) return;
+    if (seeded || !site.initialized) return;
     form = {
       name: s.name ?? "",
       description: s.description ?? "",
@@ -36,7 +38,7 @@
       footerText: s.footerText ?? "",
       termsUrl: s.termsUrl ?? "",
       privacyUrl: s.privacyUrl ?? "",
-      locale: s.locale ?? "",
+      locale: resolveLocale(s.locale),
       timezone: s.timezone ?? "",
     };
     maintenanceMode = s.maintenanceMode === "true";
@@ -157,7 +159,16 @@
         </div>
         <div class="flex flex-col gap-1.5">
           <Label for="locale">{t.locale}</Label>
-          <Input id="locale" bind:value={form.locale} placeholder="en" />
+          <Select.Root type="single" bind:value={form.locale}>
+            <Select.Trigger id="locale" class="w-full">
+              {localeNames[form.locale] ?? form.locale ?? ""}
+            </Select.Trigger>
+            <Select.Content>
+              {#each LOCALES as locale (locale)}
+                <Select.Item value={locale}>{localeNames[locale] ?? locale}</Select.Item>
+              {/each}
+            </Select.Content>
+          </Select.Root>
         </div>
         <div class="flex flex-col gap-1.5">
           <Label for="timezone">{t.timezone}</Label>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/users/+page.svelte

@@ -55,14 +55,14 @@
   let filterValues = $state<Record<string, string>>({ role: "", status: "" });
   let appliedFilters = $state<Record<string, string>>({ role: "", status: "" });
 
-  const columns: DataTableColumn<Row>[] = [
+  const columns = $derived<DataTableColumn<Row>[]>([
     { key: "name", label: i18n.t.users.name, sortable: true },
     { key: "email", label: i18n.t.users.email, sortable: true },
     { key: "role", label: i18n.t.users.role, sortable: true },
     { key: "status", label: i18n.t.users.status },
     { key: "createdAt", label: i18n.t.users.joined, sortable: true, value: (u) => (u.createdAt ? new Date(u.createdAt).getTime() : 0) },
     { key: "actions", label: "", class: "w-10" },
-  ];
+  ]);
   const filters = $derived<ToolbarFilter[]>([
     {
       key: "role",
@@ -80,10 +80,10 @@
       ],
     },
   ]);
-  const searchFields: ToolbarSearchField[] = [
+  const searchFields = $derived<ToolbarSearchField[]>([
     { value: "email", label: i18n.t.users.email },
     { value: "name", label: i18n.t.users.name },
-  ];
+  ]);
 
   const filtered = $derived(
     users.filter((u) => {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.svelte

@@ -7,6 +7,8 @@
   import * as Card from "$lib/components/ui/card";
   import * as Alert from "$lib/components/ui/alert";
   import { api } from "$lib/api";
+  import { PUBLIC_SIGNUP_DISABLED } from "$lib/auth-errors";
+  import { safeAuthRedirect, withAuthRedirect } from "$lib/auth-redirect";
   import { getI18n, fmt } from "$lib/i18n";
   import { SIGNUP_APPROVAL_REQUIRED } from "@podosoft/podokit-api-client";
   import { site } from "$lib/site.svelte";
@@ -24,7 +26,8 @@
   let loading = $state(false);
 
   $effect(() => {
-    if (data.oauthError) error = i18n.t.auth.signInFailed;
+    if (data.oauthError === PUBLIC_SIGNUP_DISABLED) error = i18n.t.auth.publicSignupDisabled;
+    else if (data.oauthError) error = i18n.t.auth.signInFailed;
   });
 
   // Second-factor step: a password/OTP sign-in with 2FA enabled returns
@@ -34,7 +37,10 @@
   let twoFaCode = $state("");
   let useBackupCode = $state(false);
   let twoFaLoading = $state(false);
-  const redirectTo = (): string => page.url.searchParams.get("redirect") ?? "/admin";
+  const redirectTo = (): string => safeAuthRedirect(page.url.searchParams.get("redirect"));
+  const authErrorCallback = (): string =>
+    new URL(withAuthRedirect("/login", redirectTo()), page.url.origin).toString();
+  const signupHref = (): string => withAuthRedirect("/signup", redirectTo());
   const socialProviders = $derived(data.capabilities?.providers ?? []);
   const providerLabels: Record<string, string> = {
     github: "GitHub",
@@ -45,6 +51,18 @@
   const providerLabel = (provider: string): string =>
     providerLabels[provider] ?? provider.charAt(0).toUpperCase() + provider.slice(1);
 
+  async function handlePolicyError(code: string | undefined): Promise<boolean> {
+    if (code === SIGNUP_APPROVAL_REQUIRED) {
+      await goto("/pending-approval");
+      return true;
+    }
+    if (code === PUBLIC_SIGNUP_DISABLED) {
+      error = i18n.t.auth.publicSignupDisabled;
+      return true;
+    }
+    return false;
+  }
+
   async function signInSocial(provider: string): Promise<void> {
     error = null;
     const callbackURL = new URL(redirectTo(), page.url.origin).toString();
@@ -52,14 +70,11 @@
     const { error: authError } = await api.auth.signIn.social({
       provider: provider as SocialProvider,
       callbackURL,
-      errorCallbackURL: `${page.url.origin}/login`,
+      errorCallbackURL: authErrorCallback(),
       newUserCallbackURL: callbackURL,
     });
     if (authError) {
-      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
-        await goto("/pending-approval");
-        return;
-      }
+      if (await handlePolicyError(authError.code)) return;
       error = authError.message ?? i18n.t.auth.signInFailed;
     }
   }
@@ -92,10 +107,7 @@
       : await api.auth.twoFactor.verifyTotp({ code: twoFaCode.trim() });
     twoFaLoading = false;
     if (authError) {
-      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
-        await goto("/pending-approval");
-        return;
-      }
+      if (await handlePolicyError(authError.code)) return;
       error = twoFactorError(authError.code);
       return;
     }
@@ -116,14 +128,11 @@
     const { error: authError } = await api.auth.signIn.magicLink({
       email,
       callbackURL: new URL(redirectTo(), page.url.origin).toString(),
-      errorCallbackURL: `${page.url.origin}/login`,
+      errorCallbackURL: authErrorCallback(),
     });
     magicLoading = false;
     if (authError) {
-      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
-        await goto("/pending-approval");
-        return;
-      }
+      if (await handlePolicyError(authError.code)) return;
       error = authError.message ?? i18n.t.auth.signInFailed;
       return;
     }
@@ -146,10 +155,7 @@
     const { error: authError } = await api.auth.emailOtp.sendVerificationOtp({ email, type: "sign-in" });
     otpLoading = false;
     if (authError) {
-      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
-        await goto("/pending-approval");
-        return;
-      }
+      if (await handlePolicyError(authError.code)) return;
       error = authError.message ?? i18n.t.auth.signInFailed;
       return;
     }
@@ -161,10 +167,7 @@
     const { data, error: authError } = await api.auth.signIn.emailOtp({ email, otp: otpCode });
     otpLoading = false;
     if (authError) {
-      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
-        await goto("/pending-approval");
-        return;
-      }
+      if (await handlePolicyError(authError.code)) return;
       error = authError.message ?? i18n.t.auth.signInFailed;
       return;
     }
@@ -184,14 +187,11 @@
     const res = await api.auth.signIn.passkey();
     passkeyLoading = false;
     if (res?.error) {
-      if ("code" in res.error && res.error.code === SIGNUP_APPROVAL_REQUIRED) {
-        await goto("/pending-approval");
-        return;
-      }
+      if (await handlePolicyError("code" in res.error ? res.error.code : undefined)) return;
       error = res.error.message ?? i18n.t.auth.signInFailed;
       return;
     }
-    await goto(page.url.searchParams.get("redirect") ?? "/admin", { invalidateAll: true });
+    await goto(redirectTo(), { invalidateAll: true });
   }
 
   async function submit(event: SubmitEvent): Promise<void> {
@@ -206,10 +206,7 @@
       : await api.auth.signIn.email({ email, password });
     loading = false;
     if (authError) {
-      if (authError.code === SIGNUP_APPROVAL_REQUIRED) {
-        await goto("/pending-approval");
-        return;
-      }
+      if (await handlePolicyError(authError.code)) return;
       // Surface an unverified address with a path to a fresh verification link.
       unverified = authError.code === "EMAIL_NOT_VERIFIED";
       error = unverified ? i18n.t.auth.emailNotVerified : (authError.message ?? i18n.t.auth.signInFailed);
@@ -230,7 +227,7 @@
   </Card.Header>
   <Card.Content>
     {#if error}
-      <Alert.Root variant="destructive" class="mb-4">
+      <Alert.Root data-testid="auth-error" variant="destructive" class="mb-4">
         <Alert.Description>
           {error}
           {#if unverified}
@@ -325,7 +322,7 @@
   </Card.Content>
   {#if signupOpen}
     <Card.Footer class="justify-center">
-      <p class="text-muted-foreground text-sm">{i18n.t.auth.noAccount} <a href="/signup" class="text-foreground hover:underline">{i18n.t.auth.signUp}</a></p>
+      <p class="text-muted-foreground text-sm">{i18n.t.auth.noAccount} <a href={signupHref()} class="text-foreground hover:underline">{i18n.t.auth.signUp}</a></p>
     </Card.Footer>
   {/if}
 </Card.Root>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/signup/+page.svelte

@@ -7,6 +7,8 @@
   import * as Card from "$lib/components/ui/card";
   import * as Alert from "$lib/components/ui/alert";
   import { api } from "$lib/api";
+  import { PUBLIC_SIGNUP_DISABLED } from "$lib/auth-errors";
+  import { safeAuthRedirect, withAuthRedirect } from "$lib/auth-redirect";
   import { getI18n } from "$lib/i18n";
   import { SIGNUP_APPROVAL_REQUIRED } from "@podosoft/podokit-api-client";
   import type { PageData } from "./$types";
@@ -18,6 +20,7 @@
   let password = $state("");
   let error = $state<string | null>(null);
   let loading = $state(false);
+  const redirectTo = (): string => safeAuthRedirect(page.url.searchParams.get("redirect"));
 
   async function submit(event: SubmitEvent): Promise<void> {
     event.preventDefault();
@@ -29,7 +32,7 @@
       name,
       email,
       password,
-      callbackURL: `${page.url.origin}/admin`,
+      callbackURL: new URL(redirectTo(), page.url.origin).toString(),
     });
     if (authError) {
       loading = false;
@@ -37,6 +40,10 @@
         await goto("/pending-approval");
         return;
       }
+      if (authError.code === PUBLIC_SIGNUP_DISABLED) {
+        error = i18n.t.auth.publicSignupDisabled;
+        return;
+      }
       error = authError.message ?? i18n.t.auth.signUpFailed;
       return;
     }
@@ -52,7 +59,7 @@
       await goto(`/verify-email?email=${encodeURIComponent(email)}`);
       return;
     }
-    await goto("/admin", { invalidateAll: true });
+    await goto(redirectTo(), { invalidateAll: true });
   }
 </script>
 
@@ -82,6 +89,6 @@
     </form>
   </Card.Content>
   <Card.Footer class="justify-center">
-    <p class="text-muted-foreground text-sm">{i18n.t.auth.haveAccount} <a href="/login" class="text-foreground hover:underline">{i18n.t.auth.signIn}</a></p>
+    <p class="text-muted-foreground text-sm">{i18n.t.auth.haveAccount} <a href={withAuthRedirect("/login", redirectTo())} class="text-foreground hover:underline">{i18n.t.auth.signIn}</a></p>
   </Card.Footer>
 </Card.Root>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.server.ts

@@ -1,9 +1,11 @@
 import type { LayoutServerLoad } from "./$types";
 import { redirect } from "@sveltejs/kit";
+import { safeAuthRedirect } from "$lib/auth-redirect";
+import { loadMessages } from "$lib/i18n/messages";
 
-// "/" is a public landing page. Auth pages send signed-in users to /admin, and
-// the admin area requires a session. /maintenance is public so it renders while
-// the rest of the site is held back.
+// "/" is a public landing page. Auth pages return signed-in users to their safe
+// requested page, and the admin area requires a session. /maintenance is public
+// so it renders while the rest of the site is held back.
 const PUBLIC_PATHS = [
   "/",
   "/login",
@@ -41,14 +43,16 @@ export const load: LayoutServerLoad = async (event) => {
   }
   // Registration closed from the admin Settings: send /signup back to /login.
   if (site?.allowSignup === "false" && pathname === "/signup") {
-    redirect(303, "/login");
+    const returnTo = safeAuthRedirect(url.searchParams.get("redirect"));
+    redirect(303, `/login?redirect=${encodeURIComponent(returnTo)}`);
   }
 
   if (locals.user && AUTH_PATHS.includes(pathname)) {
-    redirect(303, "/admin");
+    redirect(303, safeAuthRedirect(url.searchParams.get("redirect")));
   }
   if (!locals.user && !isPublic(pathname)) {
-    redirect(303, `/login?redirect=${encodeURIComponent(pathname)}`);
+    redirect(303, `/login?redirect=${encodeURIComponent(`${pathname}${url.search}`)}`);
   }
-  return { user: locals.user, locale: locals.locale, site };
+  const messages = await loadMessages(locals.locale, site?.locale);
+  return { user: locals.user, locale: locals.locale, messages, site };
 };

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -1,4 +1,8 @@
 import { expect, test } from "@playwright/test";
+import {
+  PUBLIC_SIGNUP_DISABLED,
+  isUserCreationAllowed,
+} from "../../apps/api/src/auth/feature-gate";
 import { ADMIN } from "../helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -157,3 +161,77 @@ test("new registrations require approval when the policy is enabled @smoke", asy
     await admin.dispose();
   }
 });
+
+test("closed public sign-up blocks new OAuth users but preserves existing sign-in @smoke", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const password = "Podokit3e-Str0ng!pw";
+  const adminCreatedEmail = `closed-admin-${Date.now()}@example.com`;
+  const initialSite = (await (await anon.get("/api/site/settings")).json()) as {
+    allowSignup?: string | null;
+  };
+  const initialAllowSignup = initialSite.allowSignup === "false" ? "false" : "true";
+  let adminCreatedId = "";
+
+  try {
+    expect(
+      (await admin.put("/api/account/auth-config", {
+        data: {
+          social: {
+            google: {
+              enabled: true,
+              clientId: "dummy-google-client-id",
+              clientSecret: "dummy-google-client-secret",
+            },
+          },
+        },
+      })).ok(),
+    ).toBeTruthy();
+    expect((await admin.put("/api/site/settings", { data: { allowSignup: "false" } })).ok()).toBeTruthy();
+
+    // The site policy uses a short cache shared by sign-up requests and user
+    // creation hooks, so wait for the setting to become live.
+    await new Promise((resolve) => setTimeout(resolve, 3_200));
+
+    const signup = await anon.post("/api/auth/sign-up/email", {
+      data: {
+        email: `closed-${Date.now()}@example.com`,
+        password,
+        name: "Closed Registration",
+      },
+    });
+    expect(signup.status()).toBe(403);
+    expect((await signup.json()).code).toBe(PUBLIC_SIGNUP_DISABLED);
+
+    // OAuth initiation must stay available for existing social users. Only a
+    // callback that attempts to create a new user is rejected by the DB hook.
+    const social = await anon.post("/api/auth/sign-in/social", {
+      data: { provider: "google", callbackURL: `${base}/` },
+    });
+    expect(social.ok()).toBeTruthy();
+    expect(((await social.json()).url as string)).toContain("accounts.google.com");
+    expect(isUserCreationAllowed(false, "/callback/google")).toBe(false);
+    expect(isUserCreationAllowed(false, undefined)).toBe(false);
+
+    // Deliberate administrator provisioning remains available while the public
+    // site is closed.
+    expect(isUserCreationAllowed(false, "/admin/create-user")).toBe(true);
+    const adminCreated = await admin.post("/api/auth/admin/create-user", {
+      data: { email: adminCreatedEmail, password, name: "Admin Created", role: "user" },
+    });
+    expect(adminCreated.ok()).toBeTruthy();
+    adminCreatedId = ((await adminCreated.json()).user as { id: string }).id;
+  } finally {
+    if (adminCreatedId) {
+      await admin.post("/api/auth/admin/remove-user", { data: { userId: adminCreatedId } });
+    }
+    await admin.put("/api/site/settings", { data: { allowSignup: initialAllowSignup } });
+    await admin.put("/api/account/auth-config", {
+      data: { social: { google: { enabled: false } } },
+    });
+    await new Promise((resolve) => setTimeout(resolve, 3_200));
+    await anon.get("/api/auth/get-session");
+    await anon.dispose();
+    await admin.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "@playwright/test";
+import { safeAuthRedirect, withAuthRedirect } from "../../apps/web/src/lib/auth-redirect";
 import { anonState, ADMIN } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
 
@@ -24,6 +25,25 @@ test("invalid credentials show an error", async ({ page }) => {
   await expect(page).toHaveURL(/\/login/);
 });
 
+test("login returns to the requested page instead of the admin dashboard", async ({ page }) => {
+  await ready(page, "/login?redirect=%2F%3Ffrom%3Dlogin");
+  await page.locator("#email").fill(ADMIN.email);
+  await page.locator("#password").fill(ADMIN.password);
+  await page.locator('form button[type="submit"]').click();
+  await expect(page).toHaveURL((url) => url.pathname === "/" && url.searchParams.get("from") === "login");
+});
+
+test("authentication return targets reject external and recursive redirects", () => {
+  expect(safeAuthRedirect("/products?page=2")).toBe("/products?page=2");
+  expect(safeAuthRedirect("https://example.com/steal")).toBe("/");
+  expect(safeAuthRedirect("//example.com/steal")).toBe("/");
+  expect(safeAuthRedirect("/\\example.com/steal")).toBe("/");
+  expect(safeAuthRedirect("/login")).toBe("/");
+  expect(withAuthRedirect("/login", "/products?page=2")).toBe(
+    "/login?redirect=%2Fproducts%3Fpage%3D2",
+  );
+});
+
 test("signup page renders", async ({ page }) => {
   await page.goto("/signup");
   await expect(page.getByLabel("Name")).toBeVisible();
@@ -36,6 +56,13 @@ test("pending approval errors show the approval status page", async ({ page }) =
   await expect(page.getByRole("heading", { name: "Waiting for approval" })).toBeVisible();
 });
 
+test("closed social registration errors explain that existing users may sign in", async ({ page }) => {
+  await page.goto("/login?error=PUBLIC_SIGNUP_DISABLED");
+  await expect(page.getByTestId("auth-error")).toContainText(
+    /Public sign-up is closed|공개 가입이 닫혀 있습니다/,
+  );
+});
+
 test("configured social providers appear on the login page", async ({ page, playwright }) => {
   const admin = await playwright.request.newContext({
     baseURL: base,
@@ -96,5 +123,5 @@ test("signup creates an account and enters the app @smoke", async ({ page }) =>
   await page.getByLabel("Password").fill("Podokit3e-Str0ng!pw");
   await page.getByRole("button", { name: "Create account" }).click();
   // Verification off → straight into the app; on → the verify-email page.
-  await expect(page).toHaveURL(/\/admin|\/verify-email/);
+  await expect(page).toHaveURL((url) => url.pathname === "/" || url.pathname === "/verify-email");
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -38,5 +38,5 @@ test("forgot password: request, open the emailed link, set a new password, sign
   await page.getByLabel("Email").fill(email);
   await page.getByLabel("Password").fill("Podokit3e-N3wStr0ng!pw");
   await page.getByRole("button", { name: "Sign in" }).click();
-  await expect(page).toHaveURL(/\/admin/);
+  await expect(page).toHaveURL(new URL("/", base).toString());
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -28,6 +28,21 @@ async function saveGeneral(
   await expect(page.getByText("General settings saved.").last()).toBeVisible();
 }
 
+test("general: empty locale displays the application default", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  const settingsUrl = `${origin}/api/site/settings`;
+  const previous = await (await page.request.get(settingsUrl)).json() as { locale?: string };
+
+  try {
+    expect((await page.request.put(settingsUrl, { data: { locale: "" } })).ok()).toBeTruthy();
+    await ready(page, "/admin/settings");
+    await expect(page.locator("#locale")).toContainText("English");
+  } finally {
+    await page.request.put(settingsUrl, { data: { locale: previous.locale ?? "" } });
+  }
+});
+
 test("general: footer text and links render on public pages @smoke", async ({ page, browser }) => {
   await ready(page, "/admin/settings");
   const origin = new URL(page.url()).origin;