@podosoft/podokit 0.12.3 → 0.13.0

package/dist/templates/fullstack-nest-svelte/apps/api/package.json

@@ -14,7 +14,7 @@
     "migration:generate": "npm run typeorm -- migration:generate"
   },
   "dependencies": {
-    "@podosoft/podokit-contracts": "^0.2.0",
+    "@podosoft/podokit-contracts": "^0.3.0",
     "@nestjs/common": "^11.1.27",
     "@nestjs/config": "^4.0.4",
     "@nestjs/core": "^11.1.27",

package/dist/templates/fullstack-nest-svelte/apps/web/package.json

@@ -13,7 +13,7 @@
   "dependencies": {
     "@internationalized/date": "^3.12.2",
     "@lucide/svelte": "^1.23.0",
-    "@podosoft/podokit-api-client": "^0.6.0",
+    "@podosoft/podokit-api-client": "^0.7.0",
     "bits-ui": "^2.18.1",
     "clsx": "^2.1.1",
     "mode-watcher": "^1.1.0",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/session-idle-timeout.svelte

@@ -0,0 +1,109 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { onMount } from "svelte";
+  import { api } from "$lib/api";
+
+  let { timeoutMinutes }: { timeoutMinutes: number | null } = $props();
+
+  const ACTIVITY_KEY = "podokit:session-last-activity";
+  const SERVER_REFRESH_INTERVAL_MS = 60_000;
+  const activityEvents = ["pointerdown", "keydown", "touchstart", "scroll"] as const;
+
+  let mounted = $state(false);
+  let lastActivityAt = $state(Date.now());
+  let lastServerRefreshAt = $state(Date.now());
+  let signingOut = false;
+  let previousTimeoutMs: number | null = null;
+  const timeoutMs = $derived(timeoutMinutes === null ? null : timeoutMinutes * 60_000);
+
+  function storeActivity(value: number): void {
+    try {
+      localStorage.setItem(ACTIVITY_KEY, String(value));
+    } catch {
+      // Storage can be unavailable in hardened browser modes; this tab still works.
+    }
+  }
+
+  async function signOutForIdleTimeout(): Promise<void> {
+    if (signingOut) return;
+    signingOut = true;
+    try {
+      await api.auth.signOut();
+    } finally {
+      try {
+        localStorage.removeItem(ACTIVITY_KEY);
+      } catch {
+        // Ignore unavailable storage while completing sign-out.
+      }
+      await goto("/login?reason=idle", { invalidateAll: true });
+    }
+  }
+
+  async function refreshServerSession(): Promise<void> {
+    const { data, error } = await api.auth.getSession();
+    if (error || !data) await signOutForIdleTimeout();
+  }
+
+  function recordActivity(): void {
+    if (timeoutMs === null || signingOut) return;
+    const now = Date.now();
+    if (now - lastActivityAt >= timeoutMs) {
+      void signOutForIdleTimeout();
+      return;
+    }
+    lastActivityAt = now;
+    storeActivity(now);
+    if (now - lastServerRefreshAt >= SERVER_REFRESH_INTERVAL_MS) {
+      lastServerRefreshAt = now;
+      void refreshServerSession();
+    }
+  }
+
+  function receiveActivity(event: StorageEvent): void {
+    if (event.key !== ACTIVITY_KEY || event.newValue === null) return;
+    const value = Number(event.newValue);
+    if (Number.isFinite(value) && value > lastActivityAt) lastActivityAt = value;
+  }
+
+  onMount(() => {
+    mounted = true;
+    const now = Date.now();
+    lastActivityAt = now;
+    lastServerRefreshAt = now;
+    storeActivity(now);
+    for (const event of activityEvents) {
+      document.addEventListener(event, recordActivity, { passive: true, capture: true });
+    }
+    window.addEventListener("focus", recordActivity);
+    window.addEventListener("storage", receiveActivity);
+    return () => {
+      for (const event of activityEvents) {
+        document.removeEventListener(event, recordActivity, { capture: true });
+      }
+      window.removeEventListener("focus", recordActivity);
+      window.removeEventListener("storage", receiveActivity);
+    };
+  });
+
+  $effect(() => {
+    if (!mounted) return;
+    const currentTimeoutMs = timeoutMs;
+    if (currentTimeoutMs !== previousTimeoutMs) {
+      previousTimeoutMs = currentTimeoutMs;
+      if (currentTimeoutMs !== null) {
+        const now = Date.now();
+        lastActivityAt = now;
+        lastServerRefreshAt = now;
+        storeActivity(now);
+      }
+    }
+    if (currentTimeoutMs === null) return;
+    const remaining = currentTimeoutMs - (Date.now() - lastActivityAt);
+    if (remaining <= 0) {
+      void signOutForIdleTimeout();
+      return;
+    }
+    const timer = window.setTimeout(() => void signOutForIdleTimeout(), remaining);
+    return () => window.clearTimeout(timer);
+  });
+</script>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/site-runtime.svelte

@@ -3,10 +3,14 @@
   import { ModeWatcher } from "mode-watcher";
   import { site, type SiteSettings } from "$lib/site.svelte";
   import { applyTheme, themeConfigFromSettings } from "$lib/site/apply-theme";
+  import SessionIdleTimeout from "$lib/components/session-idle-timeout.svelte";
 
   const loadedSite = $derived(
     (page.data as { site?: Partial<SiteSettings> | null }).site,
   );
+  const sessionIdleTimeoutMinutes = $derived(
+    (page.data as { sessionIdleTimeoutMinutes?: number | null }).sessionIdleTimeoutMinutes ?? null,
+  );
 
   // Seed the reactive site settings for every route without taking ownership of
   // the application's root layout or public pages.
@@ -37,3 +41,4 @@
 </svelte:head>
 
 <ModeWatcher />
+<SessionIdleTimeout timeoutMinutes={sessionIdleTimeoutMinutes} />

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/en.json

@@ -75,6 +75,7 @@
     "noAccount": "No account?",
     "signUp": "Sign up",
     "signInFailed": "Sign in failed",
+    "idleLogout": "You were signed out after a period of inactivity. Sign in to continue.",
     "createTitle": "Create account",
     "createDesc": "Sign up to get started.",
     "name": "Name",
@@ -317,6 +318,12 @@
     "twoFactorDesc": "TOTP second factor with backup codes.",
     "require2fa": "Require two-factor",
     "require2faDesc": "Every user must enrol in 2FA after signing up before using the app.",
+    "autoLogout": "Automatic logout",
+    "autoLogoutDesc": "End sessions after a period without user activity.",
+    "autoLogoutMinutes": "{minutes} min",
+    "autoLogoutDialogDesc": "Choose how long a signed-in user can remain inactive. The policy applies to every account and open browser tab.",
+    "autoLogoutField": "Idle time (minutes)",
+    "autoLogoutHint": "Enter a whole number from 5 to 10080 minutes (7 days).",
     "socialProviders": "Social providers",
     "socialProvidersDesc": "OAuth sign-in (Google, GitHub).",
     "breachCheck": "Breached-password check",
@@ -330,7 +337,7 @@
     "emailTitle": "Email",
     "emailSubtitle": "Outgoing mail (SMTP) and the email-verification policy.",
     "securityTitle": "Security & policy",
-    "securitySubtitle": "Second factor, breached-password rejection, account deletion, and audit logging.",
+    "securitySubtitle": "Second factor, automatic logout, breached-password rejection, account deletion, and audit logging.",
     "advancedTitle": "Advanced",
     "advancedSubtitle": "API keys, organizations, and acting as an OIDC identity provider.",
     "socialTitle": "Social login",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/ko.json

@@ -75,6 +75,7 @@
     "noAccount": "계정이 없으신가요?",
     "signUp": "회원가입",
     "signInFailed": "로그인에 실패했습니다",
+    "idleLogout": "활동이 없어 자동으로 로그아웃되었습니다. 계속하려면 다시 로그인하세요.",
     "createTitle": "회원가입",
     "createDesc": "가입하고 시작하세요.",
     "name": "이름",
@@ -317,6 +318,12 @@
     "twoFactorDesc": "TOTP 2차 인증 + 백업 코드.",
     "require2fa": "2FA 필수화",
     "require2faDesc": "모든 사용자가 가입 후 2FA를 등록해야 앱을 사용할 수 있습니다.",
+    "autoLogout": "자동 로그아웃",
+    "autoLogoutDesc": "사용자 활동이 없는 시간이 지나면 세션을 종료합니다.",
+    "autoLogoutMinutes": "{minutes}분",
+    "autoLogoutDialogDesc": "로그인한 사용자가 활동 없이 유지할 수 있는 시간을 설정합니다. 모든 계정과 열린 브라우저 탭에 적용됩니다.",
+    "autoLogoutField": "활동 없음 시간(분)",
+    "autoLogoutHint": "5분부터 10080분(7일) 사이의 정수를 입력하세요.",
     "socialProviders": "소셜 로그인",
     "socialProvidersDesc": "OAuth 로그인 (Google, GitHub).",
     "breachCheck": "유출 비밀번호 검사",
@@ -330,7 +337,7 @@
     "emailTitle": "이메일",
     "emailSubtitle": "메일 발송(SMTP) 설정과 이메일 인증 정책.",
     "securityTitle": "보안·정책",
-    "securitySubtitle": "2단계 인증, 유출 비밀번호 거부, 계정 삭제, 감사 로그.",
+    "securitySubtitle": "2단계 인증, 자동 로그아웃, 유출 비밀번호 거부, 계정 삭제, 감사 로그.",
     "advancedTitle": "고급",
     "advancedSubtitle": "API 키, 조직, OIDC 공급자(자체 IdP) 역할.",
     "socialTitle": "소셜 로그인",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/settings/+page.server.ts

@@ -10,7 +10,14 @@ export type AuthConfigView = {
   social: Record<string, SocialProviderView>;
   catalog: ReadonlyArray<{ id: string; label: string }>;
   smtp: { enabled: boolean; host: string; port: number; secure: boolean; user: string; from: string; hasSecret: boolean };
-  server: { requireEmailVerification: boolean; requireSignupApproval: boolean; allowDelete: boolean; hibp: boolean; auditLog: boolean };
+  server: {
+    requireEmailVerification: boolean;
+    requireSignupApproval: boolean;
+    allowDelete: boolean;
+    hibp: boolean;
+    auditLog: boolean;
+    sessionIdleTimeoutMinutes: number | null;
+  };
 };
 
 export const load: PageServerLoad = async ({ locals, fetch }) => {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/settings/+page.svelte

@@ -14,7 +14,7 @@
   import { moduleSettingsSections } from "$lib/admin/registry.svelte";
   import { toast } from "svelte-sonner";
   import { api } from "$lib/api";
-  import { getI18n } from "$lib/i18n";
+  import { fmt, getI18n } from "$lib/i18n";
   import type { Capabilities } from "@podosoft/podokit-api-client";
   import type { AuthConfigView, SocialProviderView } from "./+page.server";
 
@@ -93,14 +93,21 @@
   // ── Dialogs. Secret fields are write-only; leaving them blank keeps the stored
   //    secret. The Social login dialog manages every provider (list ⇄ add/edit
   //    form) in one popup. ──
-  let openDialog = $state<"social" | "smtp" | null>(null);
+  let openDialog = $state<"social" | "smtp" | "sessionIdle" | null>(null);
   let socialView = $state<"list" | "form">("list");
   let socialForm = $state({ id: "", clientId: "", clientSecret: "", redirectURI: "", enabled: true, adding: false });
   let smtp = $state({ enabled: false, host: "", port: 587, secure: false, user: "", from: "", pass: "" });
+  let sessionIdleTimeoutMinutes = $state(30);
   $effect(() => {
     if (!ac) return;
     smtp = { enabled: ac.smtp.enabled, host: ac.smtp.host, port: ac.smtp.port, secure: ac.smtp.secure, user: ac.smtp.user, from: ac.smtp.from, pass: "" };
+    sessionIdleTimeoutMinutes = ac.server.sessionIdleTimeoutMinutes ?? 30;
   });
+  const sessionIdleTimeoutValid = $derived(
+    Number.isInteger(Number(sessionIdleTimeoutMinutes))
+      && Number(sessionIdleTimeoutMinutes) >= 5
+      && Number(sessionIdleTimeoutMinutes) <= 10_080,
+  );
   const editingView = $derived(socialForm.adding ? undefined : ac?.social[socialForm.id]);
 
   function socialRedirectURI(): string {
@@ -142,6 +149,22 @@
     const done = await put({ smtp: { enabled: smtp.enabled, host: smtp.host, port: Number(smtp.port), secure: smtp.secure, user: smtp.user, from: smtp.from, ...(smtp.pass ? { pass: smtp.pass } : {}) } });
     if (done) openDialog = null;
   }
+  async function toggleSessionIdle(enabled: boolean): Promise<void> {
+    await put({
+      server: {
+        sessionIdleTimeoutMinutes: enabled
+          ? (ac?.server.sessionIdleTimeoutMinutes ?? 30)
+          : null,
+      },
+    });
+  }
+  async function saveSessionIdleTimeout(): Promise<void> {
+    if (!sessionIdleTimeoutValid) return;
+    const done = await put({
+      server: { sessionIdleTimeoutMinutes: Number(sessionIdleTimeoutMinutes) },
+    });
+    if (done) openDialog = null;
+  }
 
   // ── Card builders (uniform Item shape) ──
   const flagCard = (flag: EditableFlag, name: string, desc: string): Item => ({
@@ -199,6 +222,28 @@
       // Only meaningful when 2FA itself is on; disabled otherwise.
       toggle: { checked: data.require2fa, disabled: saving || !caps.twoFactor, onChange: (v) => toggleFlag("require2fa", v) },
     },
+    {
+      key: "session-idle-timeout",
+      name: i18n.t.settings.autoLogout,
+      desc: i18n.t.settings.autoLogoutDesc,
+      status: ac?.server.sessionIdleTimeoutMinutes
+        ? {
+            on: true,
+            label: fmt(i18n.t.settings.autoLogoutMinutes, {
+              minutes: ac.server.sessionIdleTimeoutMinutes,
+            }),
+          }
+        : { on: false, label: i18n.t.settings.disabled },
+      toggle: {
+        checked: ac?.server.sessionIdleTimeoutMinutes !== null && ac?.server.sessionIdleTimeoutMinutes !== undefined,
+        disabled: saving || !ac,
+        onChange: toggleSessionIdle,
+      },
+      configure: {
+        label: i18n.t.settings.configure,
+        onClick: () => (openDialog = "sessionIdle"),
+      },
+    },
     serverCard("hibp", i18n.t.settings.breachCheck, i18n.t.settings.breachCheckDesc, caps.passwordBreachCheck),
     serverCard("allowDelete", i18n.t.settings.accountDeletion, i18n.t.settings.accountDeletionDesc, caps.deleteAccount),
     serverCard("auditLog", i18n.t.settings.auditLog, i18n.t.settings.auditLogDesc, caps.auditLog),
@@ -352,6 +397,32 @@
   </Dialog.Content>
 </Dialog.Root>
 
+<!-- Sliding session expiration — enforced by better-auth and mirrored by the browser timer. -->
+<Dialog.Root open={openDialog === "sessionIdle"} onOpenChange={(v) => { if (!v) openDialog = null; }}>
+  <Dialog.Content>
+    <Dialog.Header>
+      <Dialog.Title>{i18n.t.settings.autoLogout}</Dialog.Title>
+      <Dialog.Description>{i18n.t.settings.autoLogoutDialogDesc}</Dialog.Description>
+    </Dialog.Header>
+    <div class="flex flex-col gap-2">
+      <Label for="session-idle-timeout">{i18n.t.settings.autoLogoutField}</Label>
+      <Input
+        id="session-idle-timeout"
+        type="number"
+        min="5"
+        max="10080"
+        step="1"
+        bind:value={sessionIdleTimeoutMinutes}
+      />
+      <p class="text-muted-foreground text-xs">{i18n.t.settings.autoLogoutHint}</p>
+    </div>
+    <Dialog.Footer>
+      <Button variant="outline" onclick={() => (openDialog = null)}>{i18n.t.settings.cancel}</Button>
+      <Button disabled={saving || !sessionIdleTimeoutValid} onclick={saveSessionIdleTimeout}>{i18n.t.settings.save}</Button>
+    </Dialog.Footer>
+  </Dialog.Content>
+</Dialog.Root>
+
 <!-- SMTP (email delivery) dialog — reached from the email-verification card -->
 <Dialog.Root open={openDialog === "smtp"} onOpenChange={(v) => { if (!v) openDialog = null; }}>
   <Dialog.Content>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.server.ts

@@ -6,12 +6,13 @@ import { SIGNUP_APPROVAL_REQUIRED, type Capabilities } from "@podosoft/podokit-a
 // (magic link, ...) the server actually enabled.
 export const load: PageServerLoad = async ({ fetch, url }) => {
   const oauthError = url.searchParams.get("error");
+  const idleLogout = url.searchParams.get("reason") === "idle";
   if (oauthError === SIGNUP_APPROVAL_REQUIRED) redirect(302, "/pending-approval");
   try {
     const res = await fetch("/api/account/capabilities");
-    if (res.ok) return { capabilities: (await res.json()) as Capabilities, oauthError };
+    if (res.ok) return { capabilities: (await res.json()) as Capabilities, oauthError, idleLogout };
   } catch {
     /* fall through to defaults */
   }
-  return { capabilities: null, oauthError };
+  return { capabilities: null, oauthError, idleLogout };
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.svelte

@@ -226,6 +226,11 @@
     <Card.Description>{i18n.t.auth.signInDesc}</Card.Description>
   </Card.Header>
   <Card.Content>
+    {#if data.idleLogout}
+      <Alert.Root data-testid="session-timeout-message" class="mb-4">
+        <Alert.Description>{i18n.t.auth.idleLogout}</Alert.Description>
+      </Alert.Root>
+    {/if}
     {#if error}
       <Alert.Root data-testid="auth-error" variant="destructive" class="mb-4">
         <Alert.Description>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.server.ts

@@ -3,6 +3,7 @@ import { redirect } from "@sveltejs/kit";
 import { safeAuthRedirect } from "$lib/auth-redirect";
 import { loadMessages } from "$lib/i18n/messages";
 import { isPublicPath, requireBackendAvailable } from "$lib/server/guards";
+import type { Capabilities } from "@podosoft/podokit-api-client";
 
 // "/" is a public landing page. Auth pages return signed-in users to their safe
 // requested page, and the admin area requires a session. /maintenance is public
@@ -42,6 +43,19 @@ export const load: LayoutServerLoad = async (event) => {
   if (!locals.user && !isPublicPath(pathname)) {
     redirect(303, `/login?redirect=${encodeURIComponent(`${pathname}${url.search}`)}`);
   }
+  let sessionIdleTimeoutMinutes: number | null = null;
+  if (locals.user) {
+    try {
+      const response = await event.fetch("/api/account/capabilities");
+      if (response.ok) {
+        const capabilities = (await response.json()) as Capabilities;
+        sessionIdleTimeoutMinutes = capabilities.sessionIdleTimeoutMinutes ?? null;
+      }
+    } catch {
+      // Keep automatic logout disabled in the browser if policy lookup fails.
+      // The server-side session expiration remains authoritative.
+    }
+  }
   const messages = await loadMessages(locals.locale, site?.locale);
-  return { user: locals.user, locale: locals.locale, messages, site };
+  return { user: locals.user, locale: locals.locale, messages, site, sessionIdleTimeoutMinutes };
 };

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -16,7 +16,7 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
   return ctx;
 }
 
-test("admin can enable Google OAuth from the DB and it applies without a restart @smoke", async ({ playwright }) => {
+test("admin can enable Google OAuth from the DB and it applies without a restart", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
   const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -50,7 +50,7 @@ test("admin can enable Google OAuth from the DB and it applies without a restart
   await admin.dispose();
 });
 
-test("admin can add and remove a social provider dynamically @smoke", async ({ playwright }) => {
+test("admin can add and remove a social provider dynamically", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   // The catalog offers providers beyond the two legacy env-backed ones.
   const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
@@ -83,7 +83,47 @@ test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwr
   await user.dispose();
 });
 
-test("new registrations require approval when the policy is enabled @smoke", async ({ playwright }) => {
+test("automatic logout validates and applies a sliding session lifetime", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const freshAdmin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+
+  try {
+    expect(
+      (await admin.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: 4 } },
+      })).status(),
+    ).toBe(400);
+
+    const enabled = await admin.put("/api/account/auth-config", {
+      data: { server: { sessionIdleTimeoutMinutes: 30 } },
+    });
+    expect(enabled.ok()).toBeTruthy();
+    expect((await enabled.json()).server.sessionIdleTimeoutMinutes).toBe(30);
+
+    const caps = await (await admin.get("/api/account/capabilities")).json();
+    expect(caps.sessionIdleTimeoutMinutes).toBe(30);
+
+    const signIn = await freshAdmin.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    expect(signIn.ok()).toBeTruthy();
+    expect(signIn.headers()["set-cookie"]).toMatch(/Max-Age=1800(?:;|,)/i);
+
+    const sessions = (await (await admin.get("/api/auth/list-sessions")).json()) as Array<{
+      expiresAt: string;
+    }>;
+    const latestExpiry = Math.max(...sessions.map((session) => new Date(session.expiresAt).getTime()));
+    expect(latestExpiry).toBeLessThanOrEqual(Date.now() + 30 * 60_000 + 10_000);
+  } finally {
+    await admin.put("/api/account/auth-config", {
+      data: { server: { sessionIdleTimeoutMinutes: null } },
+    });
+    await freshAdmin.dispose();
+    await admin.dispose();
+  }
+});
+
+test("new registrations require approval when the policy is enabled", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const password = "Podokit3e-Str0ng!pw";
@@ -162,7 +202,7 @@ test("new registrations require approval when the policy is enabled @smoke", asy
   }
 });
 
-test("closed public sign-up blocks new OAuth users but preserves existing sign-in @smoke", async ({ playwright }) => {
+test("closed public sign-up blocks new OAuth users but preserves existing sign-in", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const password = "Podokit3e-Str0ng!pw";

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -12,7 +12,7 @@ test("account/me is 401 when unauthenticated @smoke", async ({ request }) => {
   expect(res.status()).toBe(401);
 });
 
-test("rejects a breached password on sign-up @smoke", async ({ playwright }) => {
+test("rejects a breached password on sign-up", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
@@ -25,7 +25,7 @@ test("rejects a breached password on sign-up @smoke", async ({ playwright }) =>
   await ctx.dispose();
 });
 
-test("phone number: verify with the code delivered to the SMS sink @smoke", async ({ playwright }) => {
+test("phone number: verify with the code delivered to the SMS sink", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.phoneNumber, "phone number not enabled");
@@ -74,7 +74,7 @@ test("two-factor: enable with a real TOTP code and require it at sign-in @smoke"
   await ctx2.dispose();
 });
 
-test("two-factor: a backup code completes sign-in and is single-use @smoke", async ({ playwright }) => {
+test("two-factor: a backup code completes sign-in and is single-use", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
@@ -110,7 +110,7 @@ test("two-factor: a backup code completes sign-in and is single-use @smoke", asy
   await ctx3.dispose();
 });
 
-test("two-factor: regenerating backup codes invalidates the old set @smoke", async ({ playwright }) => {
+test("two-factor: regenerating backup codes invalidates the old set", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
@@ -142,7 +142,7 @@ test("two-factor: regenerating backup codes invalidates the old set @smoke", asy
   await ctxNew.dispose();
 });
 
-test("require-2fa: gates an un-enrolled user until they enrol @smoke", async ({ playwright }) => {
+test("require-2fa: gates an un-enrolled user until they enrol", async ({ playwright }) => {
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await admin.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
@@ -180,7 +180,7 @@ test("require-2fa: gates an un-enrolled user until they enrol @smoke", async ({
   }
 });
 
-test("multi-session holds several accounts and switches between them @smoke", async ({ playwright }) => {
+test("multi-session holds several accounts and switches between them", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.multiSession, "multi-session not enabled");
@@ -201,7 +201,7 @@ test("multi-session holds several accounts and switches between them @smoke", as
   await ctx.dispose();
 });
 
-test("a user can sign in with a username @smoke", async ({ playwright }) => {
+test("a user can sign in with a username", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.username, "username not enabled");
@@ -219,7 +219,7 @@ test("a user can sign in with a username @smoke", async ({ playwright }) => {
   await ctx2.dispose();
 });
 
-test("bearer token authenticates API requests without a cookie @smoke", async ({ playwright }) => {
+test("bearer token authenticates API requests without a cookie", async ({ playwright }) => {
   const email = `bearer-${Date.now()}@example.com`;
   const pw = "Podokit3e-Str0ng!pw";
   const signup = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -241,7 +241,7 @@ test("bearer token authenticates API requests without a cookie @smoke", async ({
   await api.dispose();
 });
 
-test("a user can create, list and revoke a personal API key @smoke", async ({ playwright }) => {
+test("a user can create, list and revoke a personal API key", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.apiKey, "api keys not enabled");
@@ -310,7 +310,7 @@ test("a user can create, list and delete an organization @smoke", async ({ playw
   await ctx.dispose();
 });
 
-test("an organization can have a parent and manager members @smoke", async ({ playwright }) => {
+test("an organization can have a parent and manager members", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.organization, "organizations not enabled");

package/dist/templates/modules/admin-dashboard/files/tests/api/email.api.spec.ts

@@ -4,7 +4,7 @@ import { clearMailpit, mailpitReachable, waitForLink, waitForOtp } from "../help
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
-test("email one-time code signs a user in @smoke", async ({ playwright }) => {
+test("email one-time code signs a user in", async ({ playwright }) => {
   test.skip(!(await mailpitReachable()), "Mailpit not available");
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
@@ -22,7 +22,7 @@ test("email one-time code signs a user in @smoke", async ({ playwright }) => {
   await ctx.dispose();
 });
 
-test("organization invitation can be sent and accepted @smoke", async ({ playwright }) => {
+test("organization invitation can be sent and accepted", async ({ playwright }) => {
   const owner = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await owner.get("/api/account/capabilities")).json();
   test.skip(!caps?.organization, "organizations not enabled");
@@ -49,7 +49,7 @@ test("organization invitation can be sent and accepted @smoke", async ({ playwri
   await owner.dispose();
 });
 
-test("magic link signs a user in @smoke", async ({ playwright }) => {
+test("magic link signs a user in", async ({ playwright }) => {
   test.skip(!(await mailpitReachable()), "Mailpit not available");
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -11,7 +11,7 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
   return ctx;
 }
 
-test("theme settings: valid preset/radius/accent round-trip @smoke", async ({ playwright }) => {
+test("theme settings: valid preset/radius/accent round-trip", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const put = await admin.put("/api/site/settings", {
     data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
@@ -29,7 +29,7 @@ test("theme settings: valid preset/radius/accent round-trip @smoke", async ({ pl
   await anon.dispose();
 });
 
-test("theme settings: valid per-token overrides accepted @smoke", async ({ playwright }) => {
+test("theme settings: valid per-token overrides accepted", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
   const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-flows.ui.spec.ts

@@ -22,7 +22,7 @@ async function loginFresh(page: import("@playwright/test").Page, playwright: imp
   await expect(page).toHaveURL(/\/admin\/account/);
 }
 
-test("account: register and verify a phone number @smoke", async ({ page, playwright }) => {
+test("account: register and verify a phone number", async ({ page, playwright }) => {
   test.skip(!(await smsSinkReachable()), "sms sink unreachable");
   await loginFresh(page, playwright, `acc-ph-${Date.now()}@example.com`);
   const phoneInput = page.locator("#phone");
@@ -38,14 +38,14 @@ test("account: register and verify a phone number @smoke", async ({ page, playwr
   await expect(page.getByText("Phone verified")).toBeVisible();
 });
 
-test("account: change email address @smoke", async ({ page, playwright }) => {
+test("account: change email address", async ({ page, playwright }) => {
   await loginFresh(page, playwright, `acc-em-${Date.now()}@example.com`);
   await page.locator("#email").fill(`changed-${Date.now()}@example.com`);
   await page.getByRole("button", { name: "Change email" }).click();
   await expect(page.getByText(/Email address updated|approve the change/)).toBeVisible();
 });
 
-test("account: delete my own account @smoke", async ({ page, playwright }) => {
+test("account: delete my own account", async ({ page, playwright }) => {
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   await admin.post("/api/auth/sign-in/email", { data: { email: "admin@example.com", password: PW } });
   try {