@podosoft/podokit 0.12.3 → 0.13.0

package/dist/templates/modules/auth/files/apps/api/src/auth/auth-provider.ts

@@ -1,6 +1,5 @@
 import { auth as bootstrapAuth, buildAuth } from "./auth";
-import { pool } from "./db";
-import { createConfigStore } from "@podosoft/podokit-auth";
+import { authConfigStore } from "./auth-config-store";
 
 // Runtime auth instance that rebuilds when the DB config changes, so admin edits
 // (OAuth credentials, SMTP, server-enforced toggles) apply WITHOUT a restart.
@@ -12,7 +11,6 @@ import { createConfigStore } from "@podosoft/podokit-auth";
 // current instance too. The guard/session behavior is unchanged (session tokens are
 // signed with the stable BETTER_AUTH_SECRET; trustedOrigins is baked into every build).
 
-const store = createConfigStore(pool);
 const TTL_MS = 3_000;
 
 let current = bootstrapAuth;
@@ -32,7 +30,7 @@ export async function refreshIfStale(): Promise<void> {
   checkedAt = Date.now();
   let latest: string;
   try {
-    latest = await store.currentVersion();
+    latest = await authConfigStore.currentVersion();
   } catch {
     return; // DB blip — keep serving the last-good instance
   }
@@ -40,7 +38,7 @@ export async function refreshIfStale(): Promise<void> {
   if (inflight) return inflight;
   inflight = (async () => {
     try {
-      const config = await store.load();
+      const config = await authConfigStore.load();
       current = buildAuth(config);
       currentVersion = config.version;
     } catch (err) {
@@ -52,6 +50,15 @@ export async function refreshIfStale(): Promise<void> {
   return inflight;
 }
 
+/** Apply a successful in-process admin write before the response is returned. */
+export async function refreshAuthNow(): Promise<void> {
+  authConfigStore.invalidate();
+  checkedAt = 0;
+  // Force a rebuild even if two writes receive the same millisecond timestamp.
+  currentVersion = `stale:${Date.now()}`;
+  await refreshIfStale();
+}
+
 // Stable handler reference the adapter captures once; redispatches per request.
 const dynamicHandler: typeof bootstrapAuth.handler = async (request) => {
   await refreshIfStale();

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.ts

@@ -6,7 +6,7 @@ import { sendSms } from "../sms/sms";
 import { assertUserCreationAllowed, createFeatureGate, createSignupOpenCheck } from "./feature-gate";
 import { orgAc, orgRoles } from "./org-permissions";
 import { pool } from "./db";
-import { type AuthConfig, envAuthConfig, SUPPORTED_PROVIDER_IDS } from "@podosoft/podokit-auth";
+import { type AuthConfig, envAuthConfig, sessionIdleOptions, SUPPORTED_PROVIDER_IDS } from "@podosoft/podokit-auth";
 import { apiKey } from "@better-auth/api-key";
 import { passkey } from "@better-auth/passkey";
 import { oauthProvider } from "@better-auth/oauth-provider";
@@ -176,6 +176,8 @@ export function buildAuth(config: AuthConfig) {
   // podokit:begin:auth-hooks
   // podokit:end:auth-hooks
 
+  const session = sessionIdleOptions(config.sessionIdleTimeoutMinutes);
+
   return betterAuth({
     database: pool,
     emailAndPassword: {
@@ -208,6 +210,7 @@ export function buildAuth(config: AuthConfig) {
       },
     },
     socialProviders: buildSocial(config),
+    ...(session ? { session } : {}),
     plugins,
     hooks,
     secret: process.env.BETTER_AUTH_SECRET ?? "change-me-in-production-min-32-characters",

package/dist/templates/modules/auth/files/apps/api/src/auth-config/auth-config.service.ts

@@ -2,7 +2,17 @@ import { BadRequestException, Injectable } from "@nestjs/common";
 import { InjectRepository } from "@nestjs/typeorm";
 import { Repository } from "typeorm";
 import { AuthConfigRow } from "./auth-config.entity";
-import { encryptSecret, envAuthConfig, socialKey, SUPPORTED_PROVIDER_IDS, SUPPORTED_SOCIAL_PROVIDERS } from "@podosoft/podokit-auth";
+import {
+  DEFAULT_SESSION_LIFETIME_SECONDS,
+  encryptSecret,
+  envAuthConfig,
+  isSessionIdleTimeoutMinutes,
+  resolveSessionIdleTimeoutMinutes,
+  socialKey,
+  SUPPORTED_PROVIDER_IDS,
+  SUPPORTED_SOCIAL_PROVIDERS,
+} from "@podosoft/podokit-auth";
+import { refreshAuthNow } from "../auth/auth-provider";
 
 /** One configured social provider as shown to the admin (no secret — just a
  *  `hasSecret` flag). */
@@ -16,7 +26,14 @@ export type AuthConfigView = {
   /** Catalog of addable providers (id + display label) for the "add provider" picker. */
   catalog: ReadonlyArray<{ id: string; label: string }>;
   smtp: { enabled: boolean; host: string; port: number; secure: boolean; user: string; from: string; hasSecret: boolean };
-  server: { requireEmailVerification: boolean; requireSignupApproval: boolean; allowDelete: boolean; hibp: boolean; auditLog: boolean };
+  server: {
+    requireEmailVerification: boolean;
+    requireSignupApproval: boolean;
+    allowDelete: boolean;
+    hibp: boolean;
+    auditLog: boolean;
+    sessionIdleTimeoutMinutes: number | null;
+  };
 };
 
 type ProviderUpdate = { enabled?: boolean; clientId?: string; clientSecret?: string; redirectURI?: string; delete?: boolean };
@@ -24,7 +41,14 @@ export type AuthConfigUpdate = {
   /** Per-provider upsert (keyed by provider id); `{ delete: true }` removes it. */
   social?: Record<string, ProviderUpdate>;
   smtp?: { enabled?: boolean; host?: string; port?: number; secure?: boolean; user?: string; pass?: string; from?: string };
-  server?: { requireEmailVerification?: boolean; requireSignupApproval?: boolean; allowDelete?: boolean; hibp?: boolean; auditLog?: boolean };
+  server?: {
+    requireEmailVerification?: boolean;
+    requireSignupApproval?: boolean;
+    allowDelete?: boolean;
+    hibp?: boolean;
+    auditLog?: boolean;
+    sessionIdleTimeoutMinutes?: number | null;
+  };
 };
 
 @Injectable()
@@ -59,6 +83,7 @@ export class AuthConfigService {
       allowDelete?: boolean;
       hibp?: boolean;
       auditLog?: boolean;
+      sessionIdleTimeoutMinutes?: number | null;
     };
     return {
       social,
@@ -78,6 +103,10 @@ export class AuthConfigService {
         allowDelete: serverC.allowDelete ?? env.allowDelete,
         hibp: serverC.hibp ?? env.hibp,
         auditLog: serverC.auditLog ?? env.auditLog,
+        sessionIdleTimeoutMinutes: resolveSessionIdleTimeoutMinutes(
+          serverC.sessionIdleTimeoutMinutes,
+          env.sessionIdleTimeoutMinutes,
+        ),
       },
     };
   }
@@ -90,6 +119,10 @@ export class AuthConfigService {
     }
     if (dto.smtp) await this.upsertSmtp(dto.smtp);
     if (dto.server) await this.upsertServer(dto.server);
+    await refreshAuthNow();
+    if (dto.server?.sessionIdleTimeoutMinutes !== undefined) {
+      await this.resetSessionExpirations(dto.server.sessionIdleTimeoutMinutes);
+    }
     return this.describe();
   }
 
@@ -116,12 +149,31 @@ export class AuthConfigService {
   }
 
   private async upsertServer(u: NonNullable<AuthConfigUpdate["server"]>): Promise<void> {
+    if (u.sessionIdleTimeoutMinutes !== undefined && !isSessionIdleTimeoutMinutes(u.sessionIdleTimeoutMinutes)) {
+      throw new BadRequestException("Session idle timeout must be null or an integer from 5 to 10080 minutes");
+    }
     const row = (await this.repo.findOneBy({ key: "server" })) ?? this.repo.create({ key: "server", enabled: true, config: {}, secret: null });
     const config = { ...(row.config as Record<string, unknown>) };
     for (const f of ["requireEmailVerification", "requireSignupApproval", "allowDelete", "hibp", "auditLog"] as const) {
       if (u[f] !== undefined) config[f] = u[f];
     }
+    if (u.sessionIdleTimeoutMinutes !== undefined) {
+      config.sessionIdleTimeoutMinutes = u.sessionIdleTimeoutMinutes;
+    }
     row.config = config;
     await this.repo.save(row);
   }
+
+  private async resetSessionExpirations(minutes: number | null): Promise<void> {
+    const lifetimeSeconds = minutes === null
+      ? DEFAULT_SESSION_LIFETIME_SECONDS
+      : minutes * 60;
+    await this.repo.manager.query(
+      `UPDATE "session"
+       SET "expiresAt" = CURRENT_TIMESTAMP + ($1 * INTERVAL '1 second'),
+           "updatedAt" = CURRENT_TIMESTAMP
+       WHERE "expiresAt" > CURRENT_TIMESTAMP`,
+      [lifetimeSeconds],
+    );
+  }
 }

package/dist/templates/modules/auth/module.manifest.json

@@ -7,8 +7,8 @@
     ".claude/skills/podokit-configure-auth/**"
   ],
   "dependencies": {
-    "@podosoft/podokit-auth": "^0.2.0",
-    "@podosoft/podokit-contracts": "^0.2.0",
+    "@podosoft/podokit-auth": "^0.3.0",
+    "@podosoft/podokit-contracts": "^0.3.0",
     "better-auth": "^1.6.23",
     "@thallesp/nestjs-better-auth": "^2.7.0",
     "pg": "^8.12.0",
@@ -44,6 +44,7 @@
     "# AUTH_EMAIL_VERIFICATION=false",
     "# AUTH_REQUIRE_SIGNUP_APPROVAL=false",
     "# AUTH_ALLOW_DELETE=false",
+    "# AUTH_SESSION_IDLE_TIMEOUT_MINUTES=30",
     "# GOOGLE_CLIENT_ID=",
     "# GOOGLE_CLIENT_SECRET=",
     "# GITHUB_CLIENT_ID=",
@@ -109,7 +110,7 @@
       "file": "AGENTS.md",
       "marker": "<!-- podokit:end:agents-modules -->",
       "optional": true,
-      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, sign-up approval, and the other server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Use `npm run auth:configure -w <app>-api -- ...` and `.claude/skills/podokit-configure-auth` to apply OAuth/SMTP credentials without committing secrets. The sign-up approval gate is provider-independent; do not add provider-specific approval checks.\n- Development setup: create auth tables with `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`, then run TypeORM migrations. Production images can run both from compiled output with `npm run migrate:all`.\n"
+      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, sign-up approval, automatic logout, and the other server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Use `npm run auth:configure -w <app>-api -- ...` and `.claude/skills/podokit-configure-auth` to apply OAuth/SMTP credentials without committing secrets. The sign-up approval gate is provider-independent; do not add provider-specific approval checks.\n- Development setup: create auth tables with `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`, then run TypeORM migrations. Production images can run both from compiled output with `npm run migrate:all`.\n"
     }
   ],
   "instructions": [
@@ -120,6 +121,6 @@
     "Sign up:  curl -c cookies.txt -XPOST localhost:5002/api/auth/sign-up/email -H 'content-type: application/json' -d '{\"email\":\"a@example.com\",\"password\":\"password123\",\"name\":\"A\"}'",
     "Call a protected route with the session:  curl -b cookies.txt localhost:5002/account/me",
     "Use npm run auth:configure -w <app>-api -- --help for redacted OAuth, SMTP, and sign-up approval automation.",
-    "Everything is protected by default; mark public routes with @Public(). Configure OAuth providers, SMTP, and server-enforced toggles on the admin Settings page \u2014 stored encrypted in the DB and applied live (no restart). Environment variables (GOOGLE_CLIENT_*, SMTP_*, AUTH_*) still work as an optional fallback/override."
+    "Everything is protected by default; mark public routes with @Public(). Configure OAuth providers, SMTP, automatic logout, and server-enforced toggles on the admin Settings page \u2014 stored in the DB and applied live (no restart). Environment variables (GOOGLE_CLIENT_*, SMTP_*, AUTH_*) still work as an optional fallback/override."
   ]
 }

package/dist/templates/modules/file-upload/files/tests/api/files.api.spec.ts

@@ -23,7 +23,7 @@ test("file upload: multipart upload returns a key and url @smoke", async ({ play
   await ctx.dispose();
 });
 
-test("file upload: a request with no file is a 400 @smoke", async ({ playwright }) => {
+test("file upload: a request with no file is a 400", async ({ playwright }) => {
   const ctx = await session(playwright);
   const res = await ctx.post("/api/files", { multipart: { notfile: "x" } });
   expect(res.status()).toBe(400);

package/dist/templates/modules/mailer/module.manifest.json

@@ -5,7 +5,7 @@
   "targetApp": "api",
   "dependencies": {
     "nodemailer": "^7.0.9",
-    "@podosoft/podokit-auth": "^0.2.0",
+    "@podosoft/podokit-auth": "^0.3.0",
     "pg": "^8.12.0"
   },
   "devDependencies": {

package/dist/templates/modules/sse/files/tests/api/events.api.spec.ts

@@ -10,7 +10,7 @@ async function session(playwright: import("@playwright/test").PlaywrightWorkerAr
   return ctx;
 }
 
-test("sse: publish accepts a message @smoke", async ({ playwright }) => {
+test("sse: publish accepts a message", async ({ playwright }) => {
   const ctx = await session(playwright);
   const pub = await ctx.post("/api/events", { data: { message: `hi-${Date.now()}` } });
   expect(pub.ok()).toBeTruthy();

package/dist/templates/todo/apps/api/package.json

@@ -14,7 +14,7 @@
     "migration:generate": "npm run typeorm -- migration:generate"
   },
   "dependencies": {
-    "@podosoft/podokit-contracts": "^0.2.0",
+    "@podosoft/podokit-contracts": "^0.3.0",
     "@nestjs/common": "^11.1.27",
     "@nestjs/config": "^4.0.4",
     "@nestjs/core": "^11.1.27",

package/dist/templates/todo/apps/web/package.json

@@ -13,7 +13,7 @@
   "dependencies": {
     "@internationalized/date": "^3.12.2",
     "@lucide/svelte": "^1.23.0",
-    "@podosoft/podokit-api-client": "^0.6.0",
+    "@podosoft/podokit-api-client": "^0.7.0",
     "bits-ui": "^2.18.1",
     "clsx": "^2.1.1",
     "mode-watcher": "^1.1.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.12.3",
+  "version": "0.13.0",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {