@podosoft/podokit 0.12.4 → 0.14.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/en.json

@@ -75,6 +75,7 @@
     "noAccount": "No account?",
     "signUp": "Sign up",
     "signInFailed": "Sign in failed",
+    "idleLogout": "You were signed out after a period of inactivity. Sign in to continue.",
     "createTitle": "Create account",
     "createDesc": "Sign up to get started.",
     "name": "Name",
@@ -317,6 +318,12 @@
     "twoFactorDesc": "TOTP second factor with backup codes.",
     "require2fa": "Require two-factor",
     "require2faDesc": "Every user must enrol in 2FA after signing up before using the app.",
+    "autoLogout": "Automatic logout",
+    "autoLogoutDesc": "End sessions after a period without user activity.",
+    "autoLogoutMinutes": "{minutes} min",
+    "autoLogoutDialogDesc": "Choose how long a signed-in user can remain inactive. The policy applies to every account and open browser tab.",
+    "autoLogoutField": "Idle time (minutes)",
+    "autoLogoutHint": "Enter a whole number from 5 to 10080 minutes (7 days).",
     "socialProviders": "Social providers",
     "socialProvidersDesc": "OAuth sign-in (Google, GitHub).",
     "breachCheck": "Breached-password check",
@@ -330,7 +337,7 @@
     "emailTitle": "Email",
     "emailSubtitle": "Outgoing mail (SMTP) and the email-verification policy.",
     "securityTitle": "Security & policy",
-    "securitySubtitle": "Second factor, breached-password rejection, account deletion, and audit logging.",
+    "securitySubtitle": "Second factor, automatic logout, breached-password rejection, account deletion, and audit logging.",
     "advancedTitle": "Advanced",
     "advancedSubtitle": "API keys, organizations, and acting as an OIDC identity provider.",
     "socialTitle": "Social login",
@@ -495,6 +502,19 @@
   "account": {
     "title": "Account",
     "profile": "Profile",
+    "profileImage": "Profile image",
+    "profileImageHint": "PNG, JPEG, or WebP. Up to {size} MB and {width} × {height} px.",
+    "profileImageUpload": "Upload image",
+    "profileImageReplace": "Replace image",
+    "profileImageRemove": "Remove image",
+    "profileImageUploading": "Uploading…",
+    "profileImageUpdated": "Profile image updated",
+    "profileImageRemoved": "Profile image removed",
+    "profileImageRequired": "Choose an image to upload",
+    "profileImageTypeInvalid": "Choose a valid PNG, JPEG, or WebP image",
+    "profileImageTooLarge": "The image must be 2 MB or smaller",
+    "profileImageDimensionsInvalid": "The image must not exceed 2048 × 2048 px",
+    "profileImageFailed": "Failed to update profile image",
     "name": "Name",
     "username": "Username",
     "phone": "Phone number",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/ko.json

@@ -75,6 +75,7 @@
     "noAccount": "계정이 없으신가요?",
     "signUp": "회원가입",
     "signInFailed": "로그인에 실패했습니다",
+    "idleLogout": "활동이 없어 자동으로 로그아웃되었습니다. 계속하려면 다시 로그인하세요.",
     "createTitle": "회원가입",
     "createDesc": "가입하고 시작하세요.",
     "name": "이름",
@@ -317,6 +318,12 @@
     "twoFactorDesc": "TOTP 2차 인증 + 백업 코드.",
     "require2fa": "2FA 필수화",
     "require2faDesc": "모든 사용자가 가입 후 2FA를 등록해야 앱을 사용할 수 있습니다.",
+    "autoLogout": "자동 로그아웃",
+    "autoLogoutDesc": "사용자 활동이 없는 시간이 지나면 세션을 종료합니다.",
+    "autoLogoutMinutes": "{minutes}분",
+    "autoLogoutDialogDesc": "로그인한 사용자가 활동 없이 유지할 수 있는 시간을 설정합니다. 모든 계정과 열린 브라우저 탭에 적용됩니다.",
+    "autoLogoutField": "활동 없음 시간(분)",
+    "autoLogoutHint": "5분부터 10080분(7일) 사이의 정수를 입력하세요.",
     "socialProviders": "소셜 로그인",
     "socialProvidersDesc": "OAuth 로그인 (Google, GitHub).",
     "breachCheck": "유출 비밀번호 검사",
@@ -330,7 +337,7 @@
     "emailTitle": "이메일",
     "emailSubtitle": "메일 발송(SMTP) 설정과 이메일 인증 정책.",
     "securityTitle": "보안·정책",
-    "securitySubtitle": "2단계 인증, 유출 비밀번호 거부, 계정 삭제, 감사 로그.",
+    "securitySubtitle": "2단계 인증, 자동 로그아웃, 유출 비밀번호 거부, 계정 삭제, 감사 로그.",
     "advancedTitle": "고급",
     "advancedSubtitle": "API 키, 조직, OIDC 공급자(자체 IdP) 역할.",
     "socialTitle": "소셜 로그인",
@@ -495,6 +502,19 @@
   "account": {
     "title": "계정",
     "profile": "프로필",
+    "profileImage": "프로필 이미지",
+    "profileImageHint": "PNG, JPEG, WebP · 최대 {size}MB · 최대 {width} × {height}px",
+    "profileImageUpload": "이미지 업로드",
+    "profileImageReplace": "이미지 교체",
+    "profileImageRemove": "이미지 제거",
+    "profileImageUploading": "업로드 중…",
+    "profileImageUpdated": "프로필 이미지를 변경했습니다",
+    "profileImageRemoved": "프로필 이미지를 제거했습니다",
+    "profileImageRequired": "업로드할 이미지를 선택해 주세요",
+    "profileImageTypeInvalid": "올바른 PNG, JPEG 또는 WebP 이미지를 선택해 주세요",
+    "profileImageTooLarge": "이미지는 2MB 이하여야 합니다",
+    "profileImageDimensionsInvalid": "이미지는 2048 × 2048px를 초과할 수 없습니다",
+    "profileImageFailed": "프로필 이미지 변경에 실패했습니다",
     "name": "이름",
     "username": "사용자명",
     "phone": "전화번호",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/protected-layout.ts

@@ -0,0 +1,78 @@
+import { redirect } from "@sveltejs/kit";
+import type { Capabilities } from "@podosoft/podokit-api-client";
+import { requireBackendAvailable } from "./guards";
+
+type ServerFetch = (
+  input: RequestInfo | URL,
+  init?: RequestInit,
+) => Promise<Response>;
+
+export interface ProtectedLayoutInput {
+  locals: App.Locals;
+  fetch: ServerFetch;
+}
+
+export interface ProtectedLayoutData {
+  user: App.Locals["user"];
+  impersonating: boolean;
+  capabilities: Capabilities;
+}
+
+/**
+ * Load the shared signed-in route context without imposing an application shell.
+ * The `(app)` group stays available for product UI, while `(admin)` adds admin chrome.
+ */
+export async function loadProtectedLayout({
+  locals,
+  fetch,
+}: ProtectedLayoutInput): Promise<ProtectedLayoutData> {
+  requireBackendAvailable(locals);
+
+  let capabilities: Capabilities = {
+    twoFactor: false,
+    providers: [],
+    deleteAccount: false,
+    auditLog: false,
+    emailVerification: false,
+    signupApprovalRequired: false,
+    passwordBreachCheck: false,
+    magicLink: false,
+    emailOtp: false,
+    username: false,
+    multiSession: false,
+    phoneNumber: false,
+    apiKey: false,
+    passkey: false,
+    organization: false,
+    oidcProvider: false,
+    roles: ["admin", "user"],
+  };
+  try {
+    const response = await fetch("/api/account/capabilities");
+    if (response.ok) capabilities = (await response.json()) as Capabilities;
+  } catch {
+    /* keep defaults */
+  }
+
+  // Require-two-factor policy: a signed-in user who has not enrolled is sent to
+  // setup. The API guard remains authoritative; this redirect provides the UX.
+  const user = locals.user as (App.Locals["user"] & { twoFactorEnabled?: boolean }) | null;
+  let mustEnrol = false;
+  if (user && !user.twoFactorEnabled) {
+    try {
+      const response = await fetch("/api/account/require-2fa");
+      mustEnrol =
+        response.ok &&
+        ((await response.json()) as { require2fa?: boolean }).require2fa === true;
+    } catch {
+      /* do not block the app if the policy check fails */
+    }
+  }
+  if (mustEnrol) redirect(302, "/setup-2fa");
+
+  return {
+    user: locals.user,
+    impersonating: Boolean(locals.session?.impersonatedBy),
+    capabilities,
+  };
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(admin)/+layout.server.ts

@@ -0,0 +1,8 @@
+import type { LayoutServerLoad } from "./$types";
+import { loadProtectedLayout } from "$lib/server/protected-layout";
+import { requireAdmin } from "$lib/server/guards";
+
+export const load: LayoutServerLoad = async ({ locals, fetch }) => {
+  requireAdmin(locals.user, locals);
+  return loadProtectedLayout({ locals, fetch });
+};

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/{(app) → (admin)}/+layout.svelte

@@ -3,7 +3,7 @@
   import * as Sidebar from "$lib/components/ui/sidebar";
   import { Separator } from "$lib/components/ui/separator";
   import { Button } from "$lib/components/ui/button";
-  import AppSidebar from "$lib/components/app-sidebar.svelte";
+  import AdminSidebar from "$lib/components/admin-sidebar.svelte";
   import ThemeToggle from "$lib/components/theme-toggle.svelte";
   import LanguageSwitch from "$lib/components/language-switch.svelte";
   import { Toaster } from "$lib/components/ui/sonner";
@@ -27,7 +27,7 @@
 </script>
 
 <Sidebar.Provider>
-  <AppSidebar user={data.user} capabilities={data.capabilities} />
+  <AdminSidebar user={data.user} capabilities={data.capabilities} />
   <Sidebar.Inset>
     {#if data.impersonating}
       <div class="bg-primary text-primary-foreground flex items-center justify-between gap-2 px-4 py-2 text-sm">

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/{(app) → (admin)}/admin/settings/+page.server.ts

@@ -10,7 +10,14 @@ export type AuthConfigView = {
   social: Record<string, SocialProviderView>;
   catalog: ReadonlyArray<{ id: string; label: string }>;
   smtp: { enabled: boolean; host: string; port: number; secure: boolean; user: string; from: string; hasSecret: boolean };
-  server: { requireEmailVerification: boolean; requireSignupApproval: boolean; allowDelete: boolean; hibp: boolean; auditLog: boolean };
+  server: {
+    requireEmailVerification: boolean;
+    requireSignupApproval: boolean;
+    allowDelete: boolean;
+    hibp: boolean;
+    auditLog: boolean;
+    sessionIdleTimeoutMinutes: number | null;
+  };
 };
 
 export const load: PageServerLoad = async ({ locals, fetch }) => {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/{(app) → (admin)}/admin/settings/+page.svelte

@@ -14,7 +14,7 @@
   import { moduleSettingsSections } from "$lib/admin/registry.svelte";
   import { toast } from "svelte-sonner";
   import { api } from "$lib/api";
-  import { getI18n } from "$lib/i18n";
+  import { fmt, getI18n } from "$lib/i18n";
   import type { Capabilities } from "@podosoft/podokit-api-client";
   import type { AuthConfigView, SocialProviderView } from "./+page.server";
 
@@ -93,14 +93,21 @@
   // ── Dialogs. Secret fields are write-only; leaving them blank keeps the stored
   //    secret. The Social login dialog manages every provider (list ⇄ add/edit
   //    form) in one popup. ──
-  let openDialog = $state<"social" | "smtp" | null>(null);
+  let openDialog = $state<"social" | "smtp" | "sessionIdle" | null>(null);
   let socialView = $state<"list" | "form">("list");
   let socialForm = $state({ id: "", clientId: "", clientSecret: "", redirectURI: "", enabled: true, adding: false });
   let smtp = $state({ enabled: false, host: "", port: 587, secure: false, user: "", from: "", pass: "" });
+  let sessionIdleTimeoutMinutes = $state(30);
   $effect(() => {
     if (!ac) return;
     smtp = { enabled: ac.smtp.enabled, host: ac.smtp.host, port: ac.smtp.port, secure: ac.smtp.secure, user: ac.smtp.user, from: ac.smtp.from, pass: "" };
+    sessionIdleTimeoutMinutes = ac.server.sessionIdleTimeoutMinutes ?? 30;
   });
+  const sessionIdleTimeoutValid = $derived(
+    Number.isInteger(Number(sessionIdleTimeoutMinutes))
+      && Number(sessionIdleTimeoutMinutes) >= 5
+      && Number(sessionIdleTimeoutMinutes) <= 10_080,
+  );
   const editingView = $derived(socialForm.adding ? undefined : ac?.social[socialForm.id]);
 
   function socialRedirectURI(): string {
@@ -142,6 +149,22 @@
     const done = await put({ smtp: { enabled: smtp.enabled, host: smtp.host, port: Number(smtp.port), secure: smtp.secure, user: smtp.user, from: smtp.from, ...(smtp.pass ? { pass: smtp.pass } : {}) } });
     if (done) openDialog = null;
   }
+  async function toggleSessionIdle(enabled: boolean): Promise<void> {
+    await put({
+      server: {
+        sessionIdleTimeoutMinutes: enabled
+          ? (ac?.server.sessionIdleTimeoutMinutes ?? 30)
+          : null,
+      },
+    });
+  }
+  async function saveSessionIdleTimeout(): Promise<void> {
+    if (!sessionIdleTimeoutValid) return;
+    const done = await put({
+      server: { sessionIdleTimeoutMinutes: Number(sessionIdleTimeoutMinutes) },
+    });
+    if (done) openDialog = null;
+  }
 
   // ── Card builders (uniform Item shape) ──
   const flagCard = (flag: EditableFlag, name: string, desc: string): Item => ({
@@ -199,6 +222,28 @@
       // Only meaningful when 2FA itself is on; disabled otherwise.
       toggle: { checked: data.require2fa, disabled: saving || !caps.twoFactor, onChange: (v) => toggleFlag("require2fa", v) },
     },
+    {
+      key: "session-idle-timeout",
+      name: i18n.t.settings.autoLogout,
+      desc: i18n.t.settings.autoLogoutDesc,
+      status: ac?.server.sessionIdleTimeoutMinutes
+        ? {
+            on: true,
+            label: fmt(i18n.t.settings.autoLogoutMinutes, {
+              minutes: ac.server.sessionIdleTimeoutMinutes,
+            }),
+          }
+        : { on: false, label: i18n.t.settings.disabled },
+      toggle: {
+        checked: ac?.server.sessionIdleTimeoutMinutes !== null && ac?.server.sessionIdleTimeoutMinutes !== undefined,
+        disabled: saving || !ac,
+        onChange: toggleSessionIdle,
+      },
+      configure: {
+        label: i18n.t.settings.configure,
+        onClick: () => (openDialog = "sessionIdle"),
+      },
+    },
     serverCard("hibp", i18n.t.settings.breachCheck, i18n.t.settings.breachCheckDesc, caps.passwordBreachCheck),
     serverCard("allowDelete", i18n.t.settings.accountDeletion, i18n.t.settings.accountDeletionDesc, caps.deleteAccount),
     serverCard("auditLog", i18n.t.settings.auditLog, i18n.t.settings.auditLogDesc, caps.auditLog),
@@ -352,6 +397,32 @@
   </Dialog.Content>
 </Dialog.Root>
 
+<!-- Sliding session expiration — enforced by better-auth and mirrored by the browser timer. -->
+<Dialog.Root open={openDialog === "sessionIdle"} onOpenChange={(v) => { if (!v) openDialog = null; }}>
+  <Dialog.Content>
+    <Dialog.Header>
+      <Dialog.Title>{i18n.t.settings.autoLogout}</Dialog.Title>
+      <Dialog.Description>{i18n.t.settings.autoLogoutDialogDesc}</Dialog.Description>
+    </Dialog.Header>
+    <div class="flex flex-col gap-2">
+      <Label for="session-idle-timeout">{i18n.t.settings.autoLogoutField}</Label>
+      <Input
+        id="session-idle-timeout"
+        type="number"
+        min="5"
+        max="10080"
+        step="1"
+        bind:value={sessionIdleTimeoutMinutes}
+      />
+      <p class="text-muted-foreground text-xs">{i18n.t.settings.autoLogoutHint}</p>
+    </div>
+    <Dialog.Footer>
+      <Button variant="outline" onclick={() => (openDialog = null)}>{i18n.t.settings.cancel}</Button>
+      <Button disabled={saving || !sessionIdleTimeoutValid} onclick={saveSessionIdleTimeout}>{i18n.t.settings.save}</Button>
+    </Dialog.Footer>
+  </Dialog.Content>
+</Dialog.Root>
+
 <!-- SMTP (email delivery) dialog — reached from the email-verification card -->
 <Dialog.Root open={openDialog === "smtp"} onOpenChange={(v) => { if (!v) openDialog = null; }}>
   <Dialog.Content>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/+layout.server.ts

@@ -1,51 +1,6 @@
-import { redirect } from "@sveltejs/kit";
 import type { LayoutServerLoad } from "./$types";
-import type { Capabilities } from "@podosoft/podokit-api-client";
-import { requireBackendAvailable } from "$lib/server/guards";
+import { loadProtectedLayout } from "$lib/server/protected-layout";
 
 export const load: LayoutServerLoad = async ({ locals, fetch }) => {
-  requireBackendAvailable(locals);
-
-  let capabilities: Capabilities = {
-    twoFactor: false,
-    providers: [],
-    deleteAccount: false,
-    auditLog: false,
-    emailVerification: false,
-    signupApprovalRequired: false,
-    passwordBreachCheck: false,
-    magicLink: false,
-    emailOtp: false,
-    username: false,
-    multiSession: false,
-    phoneNumber: false,
-    apiKey: false,
-    passkey: false,
-    organization: false,
-    oidcProvider: false,
-    roles: ["admin", "user"],
-  };
-  try {
-    const res = await fetch("/api/account/capabilities");
-    if (res.ok) capabilities = (await res.json()) as Capabilities;
-  } catch {
-    /* keep defaults */
-  }
-
-  // Require-two-factor policy: a signed-in user who hasn't enrolled is sent to the
-  // enrolment page until they do (the API's TwoFactorRequiredGuard is the real
-  // boundary; this is the UX). /setup-2fa lives outside this layout, so no loop.
-  const user = locals.user as (App.Locals["user"] & { twoFactorEnabled?: boolean }) | null;
-  let mustEnrol = false;
-  if (user && !user.twoFactorEnabled) {
-    try {
-      const res = await fetch("/api/account/require-2fa");
-      mustEnrol = res.ok && ((await res.json()) as { require2fa?: boolean }).require2fa === true;
-    } catch {
-      /* don't block the app if the policy check fails */
-    }
-  }
-  if (mustEnrol) redirect(302, "/setup-2fa");
-
-  return { user: locals.user, impersonating: !!locals.session?.impersonatedBy, capabilities };
+  return loadProtectedLayout({ locals, fetch });
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.server.ts

@@ -6,12 +6,13 @@ import { SIGNUP_APPROVAL_REQUIRED, type Capabilities } from "@podosoft/podokit-a
 // (magic link, ...) the server actually enabled.
 export const load: PageServerLoad = async ({ fetch, url }) => {
   const oauthError = url.searchParams.get("error");
+  const idleLogout = url.searchParams.get("reason") === "idle";
   if (oauthError === SIGNUP_APPROVAL_REQUIRED) redirect(302, "/pending-approval");
   try {
     const res = await fetch("/api/account/capabilities");
-    if (res.ok) return { capabilities: (await res.json()) as Capabilities, oauthError };
+    if (res.ok) return { capabilities: (await res.json()) as Capabilities, oauthError, idleLogout };
   } catch {
     /* fall through to defaults */
   }
-  return { capabilities: null, oauthError };
+  return { capabilities: null, oauthError, idleLogout };
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.svelte

@@ -226,6 +226,11 @@
     <Card.Description>{i18n.t.auth.signInDesc}</Card.Description>
   </Card.Header>
   <Card.Content>
+    {#if data.idleLogout}
+      <Alert.Root data-testid="session-timeout-message" class="mb-4">
+        <Alert.Description>{i18n.t.auth.idleLogout}</Alert.Description>
+      </Alert.Root>
+    {/if}
     {#if error}
       <Alert.Root data-testid="auth-error" variant="destructive" class="mb-4">
         <Alert.Description>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.server.ts

@@ -3,6 +3,7 @@ import { redirect } from "@sveltejs/kit";
 import { safeAuthRedirect } from "$lib/auth-redirect";
 import { loadMessages } from "$lib/i18n/messages";
 import { isPublicPath, requireBackendAvailable } from "$lib/server/guards";
+import type { Capabilities } from "@podosoft/podokit-api-client";
 
 // "/" is a public landing page. Auth pages return signed-in users to their safe
 // requested page, and the admin area requires a session. /maintenance is public
@@ -42,6 +43,19 @@ export const load: LayoutServerLoad = async (event) => {
   if (!locals.user && !isPublicPath(pathname)) {
     redirect(303, `/login?redirect=${encodeURIComponent(`${pathname}${url.search}`)}`);
   }
+  let sessionIdleTimeoutMinutes: number | null = null;
+  if (locals.user) {
+    try {
+      const response = await event.fetch("/api/account/capabilities");
+      if (response.ok) {
+        const capabilities = (await response.json()) as Capabilities;
+        sessionIdleTimeoutMinutes = capabilities.sessionIdleTimeoutMinutes ?? null;
+      }
+    } catch {
+      // Keep automatic logout disabled in the browser if policy lookup fails.
+      // The server-side session expiration remains authoritative.
+    }
+  }
   const messages = await loadMessages(locals.locale, site?.locale);
-  return { user: locals.user, locale: locals.locale, messages, site };
+  return { user: locals.user, locale: locals.locale, messages, site, sessionIdleTimeoutMinutes };
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+page.svelte

@@ -1,4 +1,6 @@
 <script lang="ts">
+  import { page } from "$app/state";
+  import AccountMenu from "$lib/components/account-menu.svelte";
   import { Button } from "$lib/components/ui/button";
   import LanguageSwitch from "$lib/components/language-switch.svelte";
   import ThemeToggle from "$lib/components/theme-toggle.svelte";
@@ -6,12 +8,14 @@
   import { getI18n } from "$lib/i18n";
 
   const i18n = getI18n();
+  const user = $derived(page.data.user ?? null);
 </script>
 
 <div class="flex min-h-svh flex-col">
   <header class="flex items-center justify-end gap-2 p-4">
     <LanguageSwitch />
     <ThemeToggle />
+    <AccountMenu {user} />
   </header>
   <main class="flex flex-1 flex-col items-center justify-center gap-6 px-4 text-center">
     <div class="flex flex-col gap-3">

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -16,7 +16,7 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
   return ctx;
 }
 
-test("admin can enable Google OAuth from the DB and it applies without a restart @smoke", async ({ playwright }) => {
+test("admin can enable Google OAuth from the DB and it applies without a restart", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
   const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -50,7 +50,7 @@ test("admin can enable Google OAuth from the DB and it applies without a restart
   await admin.dispose();
 });
 
-test("admin can add and remove a social provider dynamically @smoke", async ({ playwright }) => {
+test("admin can add and remove a social provider dynamically", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   // The catalog offers providers beyond the two legacy env-backed ones.
   const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
@@ -83,7 +83,47 @@ test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwr
   await user.dispose();
 });
 
-test("new registrations require approval when the policy is enabled @smoke", async ({ playwright }) => {
+test("automatic logout validates and applies a sliding session lifetime", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const freshAdmin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+
+  try {
+    expect(
+      (await admin.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: 4 } },
+      })).status(),
+    ).toBe(400);
+
+    const enabled = await admin.put("/api/account/auth-config", {
+      data: { server: { sessionIdleTimeoutMinutes: 30 } },
+    });
+    expect(enabled.ok()).toBeTruthy();
+    expect((await enabled.json()).server.sessionIdleTimeoutMinutes).toBe(30);
+
+    const caps = await (await admin.get("/api/account/capabilities")).json();
+    expect(caps.sessionIdleTimeoutMinutes).toBe(30);
+
+    const signIn = await freshAdmin.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    expect(signIn.ok()).toBeTruthy();
+    expect(signIn.headers()["set-cookie"]).toMatch(/Max-Age=1800(?:;|,)/i);
+
+    const sessions = (await (await admin.get("/api/auth/list-sessions")).json()) as Array<{
+      expiresAt: string;
+    }>;
+    const latestExpiry = Math.max(...sessions.map((session) => new Date(session.expiresAt).getTime()));
+    expect(latestExpiry).toBeLessThanOrEqual(Date.now() + 30 * 60_000 + 10_000);
+  } finally {
+    await admin.put("/api/account/auth-config", {
+      data: { server: { sessionIdleTimeoutMinutes: null } },
+    });
+    await freshAdmin.dispose();
+    await admin.dispose();
+  }
+});
+
+test("new registrations require approval when the policy is enabled", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const password = "Podokit3e-Str0ng!pw";
@@ -162,7 +202,7 @@ test("new registrations require approval when the policy is enabled @smoke", asy
   }
 });
 
-test("closed public sign-up blocks new OAuth users but preserves existing sign-in @smoke", async ({ playwright }) => {
+test("closed public sign-up blocks new OAuth users but preserves existing sign-in", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const password = "Podokit3e-Str0ng!pw";

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -12,7 +12,7 @@ test("account/me is 401 when unauthenticated @smoke", async ({ request }) => {
   expect(res.status()).toBe(401);
 });
 
-test("rejects a breached password on sign-up @smoke", async ({ playwright }) => {
+test("rejects a breached password on sign-up", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
@@ -25,7 +25,7 @@ test("rejects a breached password on sign-up @smoke", async ({ playwright }) =>
   await ctx.dispose();
 });
 
-test("phone number: verify with the code delivered to the SMS sink @smoke", async ({ playwright }) => {
+test("phone number: verify with the code delivered to the SMS sink", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.phoneNumber, "phone number not enabled");
@@ -74,7 +74,7 @@ test("two-factor: enable with a real TOTP code and require it at sign-in @smoke"
   await ctx2.dispose();
 });
 
-test("two-factor: a backup code completes sign-in and is single-use @smoke", async ({ playwright }) => {
+test("two-factor: a backup code completes sign-in and is single-use", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
@@ -110,7 +110,7 @@ test("two-factor: a backup code completes sign-in and is single-use @smoke", asy
   await ctx3.dispose();
 });
 
-test("two-factor: regenerating backup codes invalidates the old set @smoke", async ({ playwright }) => {
+test("two-factor: regenerating backup codes invalidates the old set", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
@@ -142,7 +142,7 @@ test("two-factor: regenerating backup codes invalidates the old set @smoke", asy
   await ctxNew.dispose();
 });
 
-test("require-2fa: gates an un-enrolled user until they enrol @smoke", async ({ playwright }) => {
+test("require-2fa: gates an un-enrolled user until they enrol", async ({ playwright }) => {
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await admin.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
@@ -180,7 +180,7 @@ test("require-2fa: gates an un-enrolled user until they enrol @smoke", async ({
   }
 });
 
-test("multi-session holds several accounts and switches between them @smoke", async ({ playwright }) => {
+test("multi-session holds several accounts and switches between them", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.multiSession, "multi-session not enabled");
@@ -201,7 +201,7 @@ test("multi-session holds several accounts and switches between them @smoke", as
   await ctx.dispose();
 });
 
-test("a user can sign in with a username @smoke", async ({ playwright }) => {
+test("a user can sign in with a username", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.username, "username not enabled");
@@ -219,7 +219,7 @@ test("a user can sign in with a username @smoke", async ({ playwright }) => {
   await ctx2.dispose();
 });
 
-test("bearer token authenticates API requests without a cookie @smoke", async ({ playwright }) => {
+test("bearer token authenticates API requests without a cookie", async ({ playwright }) => {
   const email = `bearer-${Date.now()}@example.com`;
   const pw = "Podokit3e-Str0ng!pw";
   const signup = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -241,7 +241,7 @@ test("bearer token authenticates API requests without a cookie @smoke", async ({
   await api.dispose();
 });
 
-test("a user can create, list and revoke a personal API key @smoke", async ({ playwright }) => {
+test("a user can create, list and revoke a personal API key", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.apiKey, "api keys not enabled");
@@ -310,7 +310,7 @@ test("a user can create, list and delete an organization @smoke", async ({ playw
   await ctx.dispose();
 });
 
-test("an organization can have a parent and manager members @smoke", async ({ playwright }) => {
+test("an organization can have a parent and manager members", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.organization, "organizations not enabled");