@podosoft/podokit 0.12.3 → 0.13.0

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -14,7 +14,7 @@ test("account opens on the profile section @smoke", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Save changes" })).toBeEnabled();
 });
 
-test("account exposes a change-email action when the address is edited @smoke", async ({ page }) => {
+test("account exposes a change-email action when the address is edited", async ({ page }) => {
   await ready(page, "/admin/account");
   const email = page.getByLabel("Email");
   await expect(email).toHaveValue("admin@example.com");
@@ -27,14 +27,14 @@ test("account exposes a change-email action when the address is edited @smoke",
   await expect(page.getByRole("button", { name: "Change email" })).toHaveCount(0);
 });
 
-test("account shows a username field when enabled @smoke", async ({ page }) => {
+test("account shows a username field when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   const username = page.getByLabel("Username", { exact: true });
   test.skip((await username.count()) === 0, "username not enabled");
   await expect(username).toBeVisible();
 });
 
-test("account can create and revoke an API key when enabled @smoke", async ({ page }) => {
+test("account can create and revoke an API key when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   const nav = page.getByRole("button", { name: "API keys" });
   test.skip((await nav.count()) === 0, "api keys not enabled");
@@ -52,7 +52,7 @@ test("account can create and revoke an API key when enabled @smoke", async ({ pa
   await expect(page.getByText("Key revoked")).toBeVisible();
 });
 
-test("account can register and remove a passkey when enabled @smoke", async ({ page }) => {
+test("account can register and remove a passkey when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();
   const addBtn = page.getByRole("button", { name: "Add passkey" });
@@ -74,7 +74,7 @@ test("account can register and remove a passkey when enabled @smoke", async ({ p
   await expect(page.getByText("Passkey removed")).toBeVisible();
 });
 
-test("account shows a phone field when enabled @smoke", async ({ page }) => {
+test("account shows a phone field when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   const phone = page.getByLabel("Phone number", { exact: true });
   test.skip((await phone.count()) === 0, "phone number not enabled");
@@ -111,7 +111,7 @@ test("account nav shows the core sections", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Sessions" })).toBeVisible();
 });
 
-test("two-factor setup shows a scannable QR code when enabled @smoke", async ({ page }) => {
+test("two-factor setup shows a scannable QR code when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();
   const heading = page.getByText("Two-factor authentication");

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -12,7 +12,7 @@ async function openAppearance(page: import("@playwright/test").Page): Promise<vo
   }).toPass();
 }
 
-test("appearance: has its own tab with theme controls @smoke", async ({ page }) => {
+test("appearance: has its own tab with theme controls", async ({ page }) => {
   await openAppearance(page);
   await expect(page.getByRole("heading", { name: "Featured themes" })).toBeVisible();
   await expect(page.getByRole("button", { name: "Default", exact: true })).toBeVisible();

package/dist/templates/modules/admin-dashboard/files/tests/ui/dashboard.ui.spec.ts

@@ -10,7 +10,7 @@ test("overview shows the signed-in admin @smoke", async ({ page }) => {
   await expect(page.getByRole("main").getByText(ADMIN.email)).toBeVisible();
 });
 
-test("sidebar navigates to sessions and account", async ({ page }) => {
+test("sidebar navigates to sessions and account @smoke", async ({ page }) => {
   await ready(page, "/admin");
   await page.getByRole("link", { name: "Sessions" }).click();
   await expect(page).toHaveURL(/\/admin\/sessions/);
@@ -19,7 +19,7 @@ test("sidebar navigates to sessions and account", async ({ page }) => {
   await expect(page.getByRole("link", { name: "Account" })).toHaveCount(0);
   await page.getByRole("button", { name: /admin@example.com/ }).click();
   await page.getByRole("menuitem", { name: "Account" }).click();
-  await expect(page).toHaveURL(/\/admin\/account/);
+  await expect(page).toHaveURL((url) => url.pathname === "/account");
   await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
   await expect(page.getByLabel("Name", { exact: true })).toBeVisible(); // profile section (exact: "Username" also contains "Name")
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/data-table.ui.spec.ts

@@ -3,7 +3,7 @@ import { ready } from "../helpers/hydration";
 
 // Sorting via the shared DataTable. Users is server-sorted (manual), audit is
 // client-sorted — both drive the same clickable headers + aria-sort.
-test("users table sorts by a column header (server) @smoke", async ({ page }) => {
+test("users table sorts by a column header (server)", async ({ page }) => {
   await ready(page, "/admin/users");
   const header = page.getByRole("columnheader", { name: /Name/ });
   // Click the sort button *inside* the header — a bare name match collides with

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -9,7 +9,7 @@ const origin = { origin: base };
 // The reset flow is for signed-out users — run without the seeded session.
 test.use({ storageState: anonState });
 
-test("forgot password: request, open the emailed link, set a new password, sign in @smoke", async ({ page, playwright }) => {
+test("forgot password: request, open the emailed link, set a new password, sign in", async ({ page, playwright }) => {
   test.skip(!(await mailpitReachable()), "Mailpit not available");
   const email = `ui-reset-${Date.now()}@example.com`;
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -43,7 +43,7 @@ test("general: empty locale displays the application default", async ({ page })
   }
 });
 
-test("general: footer text and links render on public pages @smoke", async ({ page, browser }) => {
+test("general: footer text and links render on public pages", async ({ page, browser }) => {
   await ready(page, "/admin/settings");
   const origin = new URL(page.url()).origin;
   const footer = page.getByLabel("Footer text");
@@ -78,7 +78,7 @@ test("general: footer text and links render on public pages @smoke", async ({ pa
   }
 });
 
-test("general: maintenance mode holds non-admins on the maintenance page @smoke", async ({ page, browser }) => {
+test("general: maintenance mode holds non-admins on the maintenance page", async ({ page, browser }) => {
   await ready(page, "/admin/settings");
   const origin = new URL(page.url()).origin;
   await page.getByRole("switch", { name: "Maintenance mode" }).click();
@@ -102,7 +102,7 @@ test("general: maintenance mode holds non-admins on the maintenance page @smoke"
   }
 });
 
-test("general: closing sign-up redirects /signup and hides the link @smoke", async ({ page, browser }) => {
+test("general: closing sign-up redirects /signup and hides the link", async ({ page, browser }) => {
   await ready(page, "/admin/settings");
   const origin = new URL(page.url()).origin;
   await page.getByRole("switch", { name: "Allow public sign-up" }).click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/guards.ui.spec.ts

@@ -10,7 +10,7 @@ test.describe("unauthenticated", () => {
     }
   });
 
-  test("private and authentication routes prevent search indexing @smoke", async ({ request }) => {
+  test("private and authentication routes prevent search indexing", async ({ request }) => {
     for (const route of ["/admin", "/account", "/login", "/api/account/me"]) {
       const response = await request.get(route, { maxRedirects: 0 });
       expect(response.headers()["x-robots-tag"]).toBe("noindex, nofollow");
@@ -32,7 +32,7 @@ test.describe("normal user (non-admin)", () => {
     expect((await page.goto("/admin/settings"))?.status()).toBe(403);
   });
 
-  test("account is available without the admin shell @smoke", async ({ page }) => {
+  test("account is available without the admin shell", async ({ page }) => {
     await page.goto("/account");
     await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
     await expect(page.getByLabel("Name", { exact: true })).toBeVisible();

package/dist/templates/modules/admin-dashboard/files/tests/ui/impersonation.ui.spec.ts

@@ -4,7 +4,7 @@ import { USER } from "../helpers/accounts";
 
 // admin storageState (project default)
 
-test("admin can impersonate a user and stop @smoke", async ({ page }) => {
+test("admin can impersonate a user and stop", async ({ page }) => {
   await ready(page, "/admin/users");
   await page.locator("#toolbar-search").fill(USER.email);
   await page.getByRole("button", { name: "Search", exact: true }).click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/login-methods.ui.spec.ts

@@ -8,7 +8,7 @@ test.use({ storageState: anonState });
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
-test("login: magic link shows a sent confirmation @smoke", async ({ page, playwright }) => {
+test("login: magic link shows a sent confirmation", async ({ page, playwright }) => {
   const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await api.get("/api/account/capabilities")).json();
   await api.dispose();
@@ -20,7 +20,7 @@ test("login: magic link shows a sent confirmation @smoke", async ({ page, playwr
   await expect(page.getByTestId("magic-link-sent")).toBeVisible();
 });
 
-test("login: an emailed one-time code signs a user in @smoke", async ({ page, playwright }) => {
+test("login: an emailed one-time code signs a user in", async ({ page, playwright }) => {
   const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await api.get("/api/account/capabilities")).json();
   test.skip(!caps?.emailOtp, "email otp disabled");

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -10,7 +10,7 @@ const REDIRECT = "http://localhost:9999/callback";
 // (with PKCE) that validates the client and hands off to the consent page. The
 // back-channel token exchange is driven by an OIDC client SDK / real RP — see
 // docs/modules.md for the manual round-trip checklist.
-test("OIDC provider: discovery, JWKS, client registration, authorize handoff @smoke", async ({ page, baseURL }) => {
+test("OIDC provider: discovery, JWKS, client registration, authorize handoff", async ({ page, baseURL }) => {
   const headers = { origin: baseURL ?? "" };
   await page.request.put("/api/account/settings", { data: { oidcProvider: true }, headers });
   await expect

package/dist/templates/modules/admin-dashboard/files/tests/ui/organizations.ui.spec.ts

@@ -19,7 +19,7 @@ test("admin can create an organization @smoke", async ({ page }) => {
   await expect(page.getByText("Organization deleted").first()).toBeVisible();
 });
 
-test("create an org with a non-ascii name, a parent, and a manager @smoke", async ({ page }) => {
+test("create an org with a non-ascii name, a parent, and a manager", async ({ page }) => {
   await ready(page, "/admin/organizations");
   const newBtn = page.getByRole("button", { name: "New organization" });
   test.skip((await newBtn.count()) === 0, "organizations not enabled");
@@ -54,7 +54,7 @@ test("create an org with a non-ascii name, a parent, and a manager @smoke", asyn
   await expect(page.getByText("Organization deleted").first()).toBeVisible();
 });
 
-test("organization manage: remove a member, invite one, and cancel the invite @smoke", async ({ page }) => {
+test("organization manage: remove a member, invite one, and cancel the invite", async ({ page }) => {
   await ready(page, "/admin/organizations");
   const newBtn = page.getByRole("button", { name: "New organization" });
   test.skip((await newBtn.count()) === 0, "organizations not enabled");

package/dist/templates/modules/admin-dashboard/files/tests/ui/passkey.ui.spec.ts

@@ -4,7 +4,7 @@ import { ready } from "../helpers/hydration";
 // Full passkey round trip on a throwaway account — never touches the shared admin.
 test.use({ storageState: { cookies: [], origins: [] } });
 
-test("register a passkey and sign in with it @smoke", async ({ page, baseURL }) => {
+test("register a passkey and sign in with it", async ({ page, baseURL }) => {
   const origin = { origin: baseURL ?? "" };
   // A virtual authenticator answers both the register (create) and sign-in (get)
   // WebAuthn ceremonies without hardware.

package/dist/templates/modules/admin-dashboard/files/tests/ui/sessions.ui.spec.ts

@@ -2,12 +2,12 @@ import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — sessions is an admin-only view
-test("sessions table shows the expires column @smoke", async ({ page }) => {
+test("sessions table shows the expires column", async ({ page }) => {
   await ready(page, "/admin/sessions");
   await expect(page.getByRole("columnheader", { name: "Expires" })).toBeVisible();
 });
 
-test("admin sees user sessions across users @smoke", async ({ page }) => {
+test("admin sees user sessions across users", async ({ page }) => {
   await ready(page, "/admin/sessions");
   await expect(page.getByRole("heading", { name: "User sessions" })).toBeVisible();
   // Search by exact address — robust to pagination as sessions accumulate (the

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings-dialogs.ui.spec.ts

@@ -3,7 +3,7 @@ import { ready } from "../helpers/hydration";
 
 // admin storageState (project default)
 
-test("settings: add and remove a social login provider @smoke", async ({ page }) => {
+test("settings: add and remove a social login provider", async ({ page }) => {
   const dialog = page.getByRole("dialog");
   const addBtn = dialog.getByRole("button", { name: "Add provider" });
   const openConfigure = async (): Promise<void> => {
@@ -47,7 +47,7 @@ test("settings: add and remove a social login provider @smoke", async ({ page })
   }
 });
 
-test("settings: open and save the SMTP dialog @smoke", async ({ page }) => {
+test("settings: open and save the SMTP dialog", async ({ page }) => {
   await ready(page, "/admin/settings");
   await page.getByRole("tab", { name: "Authentication" }).click();
   await page.getByRole("button", { name: "SMTP settings" }).click();
@@ -66,3 +66,33 @@ test("settings: open and save the SMTP dialog @smoke", async ({ page }) => {
       .catch(() => undefined);
   }
 });
+
+test("settings: configure automatic logout", async ({ page }) => {
+  await page.request.put("/api/account/auth-config", {
+    data: { server: { sessionIdleTimeoutMinutes: null } },
+  });
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Authentication" }).click();
+
+  const toggle = page.getByRole("switch", { name: "Automatic logout" });
+  await expect(toggle).not.toBeChecked();
+  await toggle.click();
+  await expect(toggle).toBeChecked();
+
+  const card = page
+    .getByText("Automatic logout", { exact: true })
+    .locator('xpath=ancestor::div[@data-slot="card"]');
+  await card.getByRole("button", { name: "Configure" }).click();
+  const dialog = page.getByRole("dialog");
+  await dialog.getByLabel("Idle time (minutes)").fill("45");
+  await dialog.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(page.getByText("45 min", { exact: true })).toBeVisible();
+
+  const saved = await (await page.request.get("/api/account/auth-config")).json();
+  expect(saved.server.sessionIdleTimeoutMinutes).toBe(45);
+  const caps = await (await page.request.get("/api/account/capabilities")).json();
+  expect(caps.sessionIdleTimeoutMinutes).toBe(45);
+
+  await toggle.click();
+  await expect(toggle).not.toBeChecked();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings.ui.spec.ts

@@ -3,6 +3,8 @@ import { ready } from "../helpers/hydration";
 
 // admin storageState (project default)
 
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
 async function saveGeneral(page: Page): Promise<void> {
   const saved = page.waitForResponse(
     (response) => response.url().endsWith("/api/site/settings") && response.request().method() === "PUT",
@@ -12,7 +14,7 @@ async function saveGeneral(page: Page): Promise<void> {
   await expect(page.getByText("General settings saved.").last()).toBeVisible();
 }
 
-test("settings has General and Authentication tabs @smoke", async ({ page }) => {
+test("settings has General and Authentication tabs", async ({ page }) => {
   await ready(page, "/admin/settings");
   await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
   await expect(page.getByRole("tab", { name: "General" })).toBeVisible();
@@ -21,13 +23,13 @@ test("settings has General and Authentication tabs @smoke", async ({ page }) =>
   await expect(page.getByLabel("Site name")).toBeVisible();
 });
 
-test("general settings: shows the favicon uploader @smoke", async ({ page }) => {
+test("general settings: shows the favicon uploader", async ({ page }) => {
   await ready(page, "/admin/settings");
   await expect(page.getByText("Browser icon (favicon)")).toBeVisible();
   await expect(page.locator('input[type="file"]')).toBeVisible();
 });
 
-test("general settings: edit the site name, save, and apply live @smoke", async ({ page }) => {
+test("general settings: edit the site name, save, and apply live", async ({ page }) => {
   await ready(page, "/admin/settings");
   const name = page.getByLabel("Site name");
   const original = await name.inputValue();
@@ -40,7 +42,7 @@ test("general settings: edit the site name, save, and apply live @smoke", async
   await saveGeneral(page);
 });
 
-test("settings lists the auth features under the Authentication tab @smoke", async ({ page }) => {
+test("settings lists the auth features under the Authentication tab", async ({ page }) => {
   await ready(page, "/admin/settings");
   await page.getByRole("tab", { name: "Authentication" }).click();
   await expect(page.getByText("Email & password")).toBeVisible();
@@ -51,7 +53,7 @@ test("settings lists the auth features under the Authentication tab @smoke", asy
   await expect(page.getByText("Enabled", { exact: true }).first()).toBeVisible();
 });
 
-test("sidebar: back-to-home link returns to the landing page @smoke", async ({ page }) => {
+test("sidebar: back-to-home link returns to the landing page", async ({ page }) => {
   await ready(page, "/admin/settings");
   // the home link lives in the sidebar footer, above the user menu
   await page.getByRole("link", { name: "Back to home" }).click();
@@ -60,7 +62,7 @@ test("sidebar: back-to-home link returns to the landing page @smoke", async ({ p
   await expect(page.locator("main").first()).toBeVisible();
 });
 
-test("settings is reachable from the sidebar @smoke", async ({ page }) => {
+test("settings is reachable from the sidebar", async ({ page }) => {
   await ready(page, "/admin");
   await page.getByRole("link", { name: "Settings" }).click();
   await expect(page).toHaveURL(/\/admin\/settings/);
@@ -81,7 +83,7 @@ test("admin can toggle a feature flag and it applies live @smoke", async ({ page
   await expect(toggle).toBeChecked();
 });
 
-test("settings: the require-two-factor toggle is available @smoke", async ({ page }) => {
+test("settings: the require-two-factor toggle is available", async ({ page }) => {
   await ready(page, "/admin/settings");
   await page.getByRole("tab", { name: "Authentication" }).click();
   // The policy toggle renders under Authentication; its enforcement is covered by
@@ -89,4 +91,72 @@ test("settings: the require-two-factor toggle is available @smoke", async ({ pag
   // admin session.
   await expect(page.getByRole("switch", { name: "Require two-factor" })).toBeVisible();
   await expect(page.getByRole("switch", { name: "Sign-up approval" })).toBeVisible();
+  await expect(page.getByRole("switch", { name: "Automatic logout" })).toBeVisible();
+});
+
+test("inactive browser sessions are signed out automatically @smoke", async ({ browser, page: adminPage }) => {
+  // Idle sign-out revokes the active server session. Use a dedicated login so
+  // this test cannot invalidate the shared admin storageState used by later specs.
+  const context = await browser.newContext({ baseURL: base });
+  const page = await context.newPage();
+  const email = `idle-admin-${Date.now()}@example.com`;
+  let signOutRequests = 0;
+  let userId = "";
+  try {
+    const created = await adminPage.request.post("/api/auth/admin/create-user", {
+      headers: { origin: base },
+      data: { email, password: "Podokit3e-Str0ng!pw", name: "Idle Admin", role: "admin" },
+    });
+    expect(created.ok()).toBeTruthy();
+    userId = ((await created.json()).user?.id ?? "") as string;
+    expect(userId).toBeTruthy();
+
+    const signIn = await context.request.post("/api/auth/sign-in/email", {
+      headers: { origin: base },
+      data: { email, password: "Podokit3e-Str0ng!pw" },
+    });
+    expect(signIn.ok()).toBeTruthy();
+
+    const configured = await context.request.put("/api/account/auth-config", {
+      data: { server: { sessionIdleTimeoutMinutes: 5 } },
+    });
+    expect(configured.ok()).toBeTruthy();
+    await page.route("**/api/auth/sign-out", async (route) => {
+      signOutRequests += 1;
+      await route.fulfill({ status: 200, contentType: "application/json", body: '{"success":true}' });
+    });
+    await page.clock.install();
+
+    try {
+      await ready(page, "/admin");
+      await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
+    } finally {
+      // Keep the loaded page policy at five minutes while restoring the shared
+      // DB policy before the isolated session is revoked.
+      const restored = await context.request.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: null } },
+      });
+      expect(restored.ok()).toBeTruthy();
+    }
+
+    const removed = await adminPage.request.post("/api/auth/admin/remove-user", {
+      headers: { origin: base },
+      data: { userId },
+    });
+    expect(removed.ok()).toBeTruthy();
+    userId = "";
+
+    await page.clock.fastForward(5 * 60_000 + 1_000);
+    await expect.poll(() => signOutRequests).toBe(1);
+    await expect(page).toHaveURL(/\/login\?reason=idle$/);
+    await expect(page.getByTestId("session-timeout-message")).toBeVisible();
+  } finally {
+    if (userId) {
+      await adminPage.request.post("/api/auth/admin/remove-user", {
+        headers: { origin: base },
+        data: { userId },
+      });
+    }
+    await context.close();
+  }
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/sidebar.ui.spec.ts

@@ -2,7 +2,7 @@ import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default)
-test("collapsing the sidebar hides the brand instead of overflowing @smoke", async ({ page }) => {
+test("collapsing the sidebar hides the brand instead of overflowing", async ({ page }) => {
   await ready(page, "/admin");
   const brand = page.getByTestId("sidebar-brand");
   const toggle = page.getByRole("button", { name: "Toggle Sidebar" });

package/dist/templates/modules/admin-dashboard/files/tests/ui/table-toolbar.ui.spec.ts

@@ -3,7 +3,7 @@ import { ready } from "../helpers/hydration";
 
 // The shared toolbar: filters + search both commit on the Search button; the
 // search field itself is selectable (Email, Name, ...).
-test("users toolbar searches only when Search is pressed @smoke", async ({ page }) => {
+test("users toolbar searches only when Search is pressed", async ({ page }) => {
   await ready(page, "/admin/users");
   const main = page.getByRole("main");
   await page.locator("#toolbar-search").fill("admin@example.com");

package/dist/templates/modules/admin-dashboard/files/tests/ui/two-factor.ui.spec.ts

@@ -17,7 +17,7 @@ async function openHydratedLogin(page: Page, redirect?: string): Promise<void> {
 
 // A disposable account (never the shared admin/user) so enabling 2FA here can't
 // invalidate the seeded sessions the other auth specs rely on.
-test("two-factor: sign in with a backup code from the login page @smoke", async ({ page, playwright }) => {
+test("two-factor: sign in with a backup code from the login page", async ({ page, playwright }) => {
   const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await api.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
@@ -55,7 +55,7 @@ test("two-factor: sign in with a backup code from the login page @smoke", async
   await expect(page).toHaveURL(/\/admin\/account/);
 });
 
-test("require-2fa: a new sign-up is forced through the enrolment page @smoke", async ({ page, playwright }) => {
+test("require-2fa: a new sign-up is forced through the enrolment page", async ({ page, playwright }) => {
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await admin.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
@@ -106,7 +106,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page @smoke", a
   }
 });
 
-test("account: regenerate backup codes shows a fresh set @smoke", async ({ page, playwright }) => {
+test("account: regenerate backup codes shows a fresh set", async ({ page, playwright }) => {
   const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await api.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");

package/dist/templates/modules/admin-dashboard/files/tests/ui/users-crud.ui.spec.ts

@@ -51,7 +51,7 @@ test("create rejects mismatched passwords", async ({ page }) => {
   await expect(dialog.getByText("Passwords do not match")).toBeVisible();
 });
 
-test("manage: edit profile name @smoke", async ({ page }) => {
+test("manage: edit profile name", async ({ page }) => {
   await ready(page, "/admin/users");
   const email = `ui-edit-${Date.now()}@example.com`;
   await seedUser(page, email);

package/dist/templates/modules/admin-dashboard/files/tests/ui/users.ui.spec.ts

@@ -3,7 +3,7 @@ import { ready } from "../helpers/hydration";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
-test("admin can create a user with a custom role @smoke", async ({ page }) => {
+test("admin can create a user with a custom role", async ({ page }) => {
   await ready(page, "/admin/users");
   await page.getByRole("button", { name: "Add user" }).click();
   const role = page.locator("#c-role");
@@ -24,7 +24,7 @@ test("admin can create a user with a custom role @smoke", async ({ page }) => {
   await expect(page.getByRole("cell", { name: email })).toBeVisible();
 });
 
-test("admin sees the user list and can search @smoke", async ({ page }) => {
+test("admin sees the user list and can search", async ({ page }) => {
   await ready(page, "/admin/users");
   await expect(page.getByRole("heading", { name: "Users" })).toBeVisible();
   // Search by exact address — robust to pagination as the user count grows.
@@ -37,7 +37,7 @@ test("admin sees the user list and can search @smoke", async ({ page }) => {
   await expect(page.getByRole("cell", { name: "admin@example.com" })).toHaveCount(0);
 });
 
-test("user list shows the joined column @smoke", async ({ page }) => {
+test("user list shows the joined column", async ({ page }) => {
   await ready(page, "/admin/users");
   await expect(page.getByRole("columnheader", { name: "Joined" })).toBeVisible();
 });
@@ -52,7 +52,7 @@ test("row menu exposes admin actions", async ({ page }) => {
   await expect(page.getByRole("menuitem", { name: "Impersonate" })).toBeVisible();
 });
 
-test("admin can approve a pending registration from the user list @smoke", async ({ page }) => {
+test("admin can approve a pending registration from the user list", async ({ page }) => {
   const email = `pending-ui-${Date.now()}@example.com`;
   const created = await page.request.post("/api/auth/admin/create-user", {
     headers: { origin: base },

package/dist/templates/modules/admin-dashboard/files/tests/ui/verify-email.ui.spec.ts

@@ -4,7 +4,7 @@ import { ready } from "../helpers/hydration";
 
 test.use({ storageState: anonState });
 
-test("verify-email renders the resend form with the address prefilled @smoke", async ({ page }) => {
+test("verify-email renders the resend form with the address prefilled", async ({ page }) => {
   await ready(page, "/verify-email?email=someone%40example.com");
   await expect(page.getByLabel("Email")).toHaveValue("someone@example.com");
   await expect(page.getByRole("button", { name: "Resend verification email" })).toBeVisible();

package/dist/templates/modules/admin-dashboard/module.manifest.json

@@ -17,6 +17,19 @@
     "apps/web/src/lib/i18n/locales/**",
     "apps/web/src/lib/i18n/catalogs/app/**"
   ],
+  "managedOverrides": [
+    "apps/web/src/routes/(app)/+layout.server.ts",
+    "apps/web/src/routes/(app)/admin/account/+page.server.ts",
+    "apps/web/src/routes/(app)/admin/audit/+page.server.ts",
+    "apps/web/src/routes/(app)/admin/organizations/+page.server.ts",
+    "apps/web/src/routes/(app)/admin/sessions/+page.server.ts",
+    "apps/web/src/routes/(app)/admin/settings/+page.server.ts",
+    "apps/web/src/routes/(app)/admin/users/+page.server.ts",
+    "apps/web/src/routes/(auth)/login/+page.server.ts",
+    "apps/web/src/routes/(auth)/signup/+page.server.ts",
+    "apps/web/src/routes/account/+page.server.ts",
+    "apps/web/src/routes/setup-2fa/+page.server.ts"
+  ],
   "packageOverlays": {
     "api": {
       "scripts": {

package/dist/templates/modules/audit-log/module.manifest.json

@@ -40,6 +40,6 @@
     "List recent entries (admin session required):  curl -b cookies.txt localhost:5002/audit-logs"
   ],
   "dependencies": {
-    "@podosoft/podokit-auth": "^0.2.0"
+    "@podosoft/podokit-auth": "^0.3.0"
   }
 }

package/dist/templates/modules/auth/files/apps/api/src/account/account.controller.ts

@@ -6,13 +6,9 @@ import { ApiTags } from "@nestjs/swagger";
 import { FEATURE_FLAGS, SettingsService, type FeatureFlag } from "../settings/settings.service";
 import { ROLE_NAMES } from "../auth/permissions";
 import { auth } from "../auth/auth";
-import { pool } from "../auth/db";
-import { createConfigStore } from "@podosoft/podokit-auth";
+import { authConfigStore } from "../auth/auth-config-store";
 import type { Capabilities } from "@podosoft/podokit-contracts";
 
-// Reads OAuth/server-toggle state (DB-first, env fallback) for capabilities.
-const configStore = createConfigStore(pool);
-
 function isAdmin(session: UserSession): boolean {
   const role = session.user?.role;
   const roles = Array.isArray(role) ? role : (role ?? "").split(",").map((r: string) => r.trim());
@@ -45,7 +41,7 @@ export class AccountController {
     const flags = this.settings.flags();
     // OAuth providers + server-enforced toggles are DB-backed (env fallback) and
     // applied live, so read them from the config store rather than process.env.
-    const snapshot = await configStore.capabilitiesSnapshot();
+    const snapshot = await authConfigStore.capabilitiesSnapshot();
     return {
       twoFactor: flags.twoFactor,
       magicLink: flags.magicLink,
@@ -63,6 +59,7 @@ export class AccountController {
       signupApprovalRequired: snapshot.requireSignupApproval,
       passwordBreachCheck: snapshot.passwordBreachCheck,
       auditLog: snapshot.auditLog,
+      sessionIdleTimeoutMinutes: snapshot.sessionIdleTimeoutMinutes,
       roles: ROLE_NAMES,
     };
   }

package/dist/templates/modules/auth/files/apps/api/src/auth/auth-config-store.ts

@@ -0,0 +1,6 @@
+import { createConfigStore } from "@podosoft/podokit-auth";
+import { pool } from "./db";
+
+// One process-wide store keeps the auth runtime and capabilities endpoint on the
+// same cache snapshot. Admin writes invalidate this store before rebuilding auth.
+export const authConfigStore = createConfigStore(pool);