@podosoft/podokit 0.12.4 → 0.14.0

package/dist/templates/modules/auth/files/apps/api/src/auth-config/auth-config.service.ts

@@ -2,7 +2,17 @@ import { BadRequestException, Injectable } from "@nestjs/common";
 import { InjectRepository } from "@nestjs/typeorm";
 import { Repository } from "typeorm";
 import { AuthConfigRow } from "./auth-config.entity";
-import { encryptSecret, envAuthConfig, socialKey, SUPPORTED_PROVIDER_IDS, SUPPORTED_SOCIAL_PROVIDERS } from "@podosoft/podokit-auth";
+import {
+  DEFAULT_SESSION_LIFETIME_SECONDS,
+  encryptSecret,
+  envAuthConfig,
+  isSessionIdleTimeoutMinutes,
+  resolveSessionIdleTimeoutMinutes,
+  socialKey,
+  SUPPORTED_PROVIDER_IDS,
+  SUPPORTED_SOCIAL_PROVIDERS,
+} from "@podosoft/podokit-auth";
+import { refreshAuthNow } from "../auth/auth-provider";
 
 /** One configured social provider as shown to the admin (no secret — just a
  *  `hasSecret` flag). */
@@ -16,7 +26,14 @@ export type AuthConfigView = {
   /** Catalog of addable providers (id + display label) for the "add provider" picker. */
   catalog: ReadonlyArray<{ id: string; label: string }>;
   smtp: { enabled: boolean; host: string; port: number; secure: boolean; user: string; from: string; hasSecret: boolean };
-  server: { requireEmailVerification: boolean; requireSignupApproval: boolean; allowDelete: boolean; hibp: boolean; auditLog: boolean };
+  server: {
+    requireEmailVerification: boolean;
+    requireSignupApproval: boolean;
+    allowDelete: boolean;
+    hibp: boolean;
+    auditLog: boolean;
+    sessionIdleTimeoutMinutes: number | null;
+  };
 };
 
 type ProviderUpdate = { enabled?: boolean; clientId?: string; clientSecret?: string; redirectURI?: string; delete?: boolean };
@@ -24,7 +41,14 @@ export type AuthConfigUpdate = {
   /** Per-provider upsert (keyed by provider id); `{ delete: true }` removes it. */
   social?: Record<string, ProviderUpdate>;
   smtp?: { enabled?: boolean; host?: string; port?: number; secure?: boolean; user?: string; pass?: string; from?: string };
-  server?: { requireEmailVerification?: boolean; requireSignupApproval?: boolean; allowDelete?: boolean; hibp?: boolean; auditLog?: boolean };
+  server?: {
+    requireEmailVerification?: boolean;
+    requireSignupApproval?: boolean;
+    allowDelete?: boolean;
+    hibp?: boolean;
+    auditLog?: boolean;
+    sessionIdleTimeoutMinutes?: number | null;
+  };
 };
 
 @Injectable()
@@ -59,6 +83,7 @@ export class AuthConfigService {
       allowDelete?: boolean;
       hibp?: boolean;
       auditLog?: boolean;
+      sessionIdleTimeoutMinutes?: number | null;
     };
     return {
       social,
@@ -78,6 +103,10 @@ export class AuthConfigService {
         allowDelete: serverC.allowDelete ?? env.allowDelete,
         hibp: serverC.hibp ?? env.hibp,
         auditLog: serverC.auditLog ?? env.auditLog,
+        sessionIdleTimeoutMinutes: resolveSessionIdleTimeoutMinutes(
+          serverC.sessionIdleTimeoutMinutes,
+          env.sessionIdleTimeoutMinutes,
+        ),
       },
     };
   }
@@ -90,6 +119,10 @@ export class AuthConfigService {
     }
     if (dto.smtp) await this.upsertSmtp(dto.smtp);
     if (dto.server) await this.upsertServer(dto.server);
+    await refreshAuthNow();
+    if (dto.server?.sessionIdleTimeoutMinutes !== undefined) {
+      await this.resetSessionExpirations(dto.server.sessionIdleTimeoutMinutes);
+    }
     return this.describe();
   }
 
@@ -116,12 +149,31 @@ export class AuthConfigService {
   }
 
   private async upsertServer(u: NonNullable<AuthConfigUpdate["server"]>): Promise<void> {
+    if (u.sessionIdleTimeoutMinutes !== undefined && !isSessionIdleTimeoutMinutes(u.sessionIdleTimeoutMinutes)) {
+      throw new BadRequestException("Session idle timeout must be null or an integer from 5 to 10080 minutes");
+    }
     const row = (await this.repo.findOneBy({ key: "server" })) ?? this.repo.create({ key: "server", enabled: true, config: {}, secret: null });
     const config = { ...(row.config as Record<string, unknown>) };
     for (const f of ["requireEmailVerification", "requireSignupApproval", "allowDelete", "hibp", "auditLog"] as const) {
       if (u[f] !== undefined) config[f] = u[f];
     }
+    if (u.sessionIdleTimeoutMinutes !== undefined) {
+      config.sessionIdleTimeoutMinutes = u.sessionIdleTimeoutMinutes;
+    }
     row.config = config;
     await this.repo.save(row);
   }
+
+  private async resetSessionExpirations(minutes: number | null): Promise<void> {
+    const lifetimeSeconds = minutes === null
+      ? DEFAULT_SESSION_LIFETIME_SECONDS
+      : minutes * 60;
+    await this.repo.manager.query(
+      `UPDATE "session"
+       SET "expiresAt" = CURRENT_TIMESTAMP + ($1 * INTERVAL '1 second'),
+           "updatedAt" = CURRENT_TIMESTAMP
+       WHERE "expiresAt" > CURRENT_TIMESTAMP`,
+      [lifetimeSeconds],
+    );
+  }
 }

package/dist/templates/modules/auth/module.manifest.json

@@ -7,8 +7,8 @@
     ".claude/skills/podokit-configure-auth/**"
   ],
   "dependencies": {
-    "@podosoft/podokit-auth": "^0.2.0",
-    "@podosoft/podokit-contracts": "^0.2.0",
+    "@podosoft/podokit-auth": "^0.3.0",
+    "@podosoft/podokit-contracts": "^0.4.0",
     "better-auth": "^1.6.23",
     "@thallesp/nestjs-better-auth": "^2.7.0",
     "pg": "^8.12.0",
@@ -44,6 +44,7 @@
     "# AUTH_EMAIL_VERIFICATION=false",
     "# AUTH_REQUIRE_SIGNUP_APPROVAL=false",
     "# AUTH_ALLOW_DELETE=false",
+    "# AUTH_SESSION_IDLE_TIMEOUT_MINUTES=30",
     "# GOOGLE_CLIENT_ID=",
     "# GOOGLE_CLIENT_SECRET=",
     "# GITHUB_CLIENT_ID=",
@@ -109,7 +110,7 @@
       "file": "AGENTS.md",
       "marker": "<!-- podokit:end:agents-modules -->",
       "optional": true,
-      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, sign-up approval, and the other server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Use `npm run auth:configure -w <app>-api -- ...` and `.claude/skills/podokit-configure-auth` to apply OAuth/SMTP credentials without committing secrets. The sign-up approval gate is provider-independent; do not add provider-specific approval checks.\n- Development setup: create auth tables with `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`, then run TypeORM migrations. Production images can run both from compiled output with `npm run migrate:all`.\n"
+      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, sign-up approval, automatic logout, and the other server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Use `npm run auth:configure -w <app>-api -- ...` and `.claude/skills/podokit-configure-auth` to apply OAuth/SMTP credentials without committing secrets. The sign-up approval gate is provider-independent; do not add provider-specific approval checks.\n- Development setup: create auth tables with `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`, then run TypeORM migrations. Production images can run both from compiled output with `npm run migrate:all`.\n"
     }
   ],
   "instructions": [
@@ -120,6 +121,6 @@
     "Sign up:  curl -c cookies.txt -XPOST localhost:5002/api/auth/sign-up/email -H 'content-type: application/json' -d '{\"email\":\"a@example.com\",\"password\":\"password123\",\"name\":\"A\"}'",
     "Call a protected route with the session:  curl -b cookies.txt localhost:5002/account/me",
     "Use npm run auth:configure -w <app>-api -- --help for redacted OAuth, SMTP, and sign-up approval automation.",
-    "Everything is protected by default; mark public routes with @Public(). Configure OAuth providers, SMTP, and server-enforced toggles on the admin Settings page \u2014 stored encrypted in the DB and applied live (no restart). Environment variables (GOOGLE_CLIENT_*, SMTP_*, AUTH_*) still work as an optional fallback/override."
+    "Everything is protected by default; mark public routes with @Public(). Configure OAuth providers, SMTP, automatic logout, and server-enforced toggles on the admin Settings page \u2014 stored in the DB and applied live (no restart). Environment variables (GOOGLE_CLIENT_*, SMTP_*, AUTH_*) still work as an optional fallback/override."
   ]
 }

package/dist/templates/modules/file-upload/files/tests/api/files.api.spec.ts

@@ -23,7 +23,7 @@ test("file upload: multipart upload returns a key and url @smoke", async ({ play
   await ctx.dispose();
 });
 
-test("file upload: a request with no file is a 400 @smoke", async ({ playwright }) => {
+test("file upload: a request with no file is a 400", async ({ playwright }) => {
   const ctx = await session(playwright);
   const res = await ctx.post("/api/files", { multipart: { notfile: "x" } });
   expect(res.status()).toBe(400);

package/dist/templates/modules/mailer/module.manifest.json

@@ -5,7 +5,7 @@
   "targetApp": "api",
   "dependencies": {
     "nodemailer": "^7.0.9",
-    "@podosoft/podokit-auth": "^0.2.0",
+    "@podosoft/podokit-auth": "^0.3.0",
     "pg": "^8.12.0"
   },
   "devDependencies": {

package/dist/templates/modules/sse/files/tests/api/events.api.spec.ts

@@ -10,7 +10,7 @@ async function session(playwright: import("@playwright/test").PlaywrightWorkerAr
   return ctx;
 }
 
-test("sse: publish accepts a message @smoke", async ({ playwright }) => {
+test("sse: publish accepts a message", async ({ playwright }) => {
   const ctx = await session(playwright);
   const pub = await ctx.post("/api/events", { data: { message: `hi-${Date.now()}` } });
   expect(pub.ok()).toBeTruthy();

package/dist/templates/todo/Dockerfile.dev

@@ -17,7 +17,9 @@ WORKDIR /app
 COPY package.json ./
 COPY apps/api/package.json ./apps/api/package.json
 COPY apps/web/package.json ./apps/web/package.json
-RUN npm install
+ARG PODOKIT_NPM_REGISTRY=""
+RUN if [ -n "$PODOKIT_NPM_REGISTRY" ]; then npm config set registry "$PODOKIT_NPM_REGISTRY"; fi \
+  && npm install
 
 # Baked source (kept in sync during development by `docker compose watch`).
 COPY . .

package/dist/templates/todo/apps/api/package.json

@@ -14,7 +14,7 @@
     "migration:generate": "npm run typeorm -- migration:generate"
   },
   "dependencies": {
-    "@podosoft/podokit-contracts": "^0.2.0",
+    "@podosoft/podokit-contracts": "^0.4.0",
     "@nestjs/common": "^11.1.27",
     "@nestjs/config": "^4.0.4",
     "@nestjs/core": "^11.1.27",

package/dist/templates/todo/apps/web/package.json

@@ -13,7 +13,7 @@
   "dependencies": {
     "@internationalized/date": "^3.12.2",
     "@lucide/svelte": "^1.23.0",
-    "@podosoft/podokit-api-client": "^0.6.0",
+    "@podosoft/podokit-api-client": "^0.8.0",
     "bits-ui": "^2.18.1",
     "clsx": "^2.1.1",
     "mode-watcher": "^1.1.0",

package/dist/templates/todo/compose.dev.yaml

@@ -41,6 +41,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.dev
+      args:
+        PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
     command: npm run dev -w {{projectName}}-web -- --host 0.0.0.0
     working_dir: /app
     env_file: .env.docker
@@ -64,6 +66,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.dev
+      args:
+        PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
     init: true
     command: npm run dev -w {{projectName}}-api
     working_dir: /app
@@ -87,6 +91,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.dev
+      args:
+        PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
     init: true
     command: npm run dev:worker -w {{projectName}}-api
     working_dir: /app

package/dist/update.d.ts

@@ -5,9 +5,11 @@ import { type Tier } from "./lockfile";
  * working copy, classifying each file. Applying the plan (writing files, 3-way
  * merging) is a later step (see ADR-0009).
  */
-export type Action = "update" | "merge" | "conflict" | "add" | "remove" | "skip" | "up-to-date";
+export type Action = "update" | "merge" | "conflict" | "add" | "move" | "remove" | "skip" | "up-to-date";
 export interface FileChange {
     path: string;
+    /** Previous path when this change is an update migration move. */
+    fromPath?: string;
     tier: Tier;
     action: Action;
     /** Why the action was chosen (for the report). */
@@ -33,6 +35,11 @@ export interface ApplyOptions {
 }
 export interface ApplyResult {
     written: string[];
+    /** Files relocated by module update migrations. */
+    moved: {
+        from: string;
+        to: string;
+    }[];
     removed: string[];
     /** Files 3-way merged cleanly. */
     merged: string[];

package/dist/update.js

@@ -12,6 +12,7 @@ const assemble_1 = require("./assemble");
 const lockfile_1 = require("./lockfile");
 const inspect_1 = require("./inspect");
 const add_1 = require("./add");
+const module_migrations_1 = require("./module-migrations");
 function treeText(tree, path) {
     const file = tree.get(path);
     if (!file)
@@ -64,9 +65,29 @@ function planUpdate(projectRoot, templatesDir) {
     });
     const managedOverrides = targetManagedOverrides(projectRoot, templatesDir, manifest.modules, manifest.managedOverrides);
     const ownedGlobs = targetOwnedGlobs(projectRoot, templatesDir, manifest.modules, manifest.ownedGlobs);
-    const changes = [];
+    const pendingMigrations = (0, module_migrations_1.collectPendingMigrations)(projectRoot, templatesDir, manifest.modules);
+    const migrationPlan = (0, module_migrations_1.planModuleMigrations)(projectRoot, newTree, lock, pendingMigrations);
+    const changes = migrationPlan.moves.map((move) => ({
+        path: move.to,
+        fromPath: move.from,
+        tier: move.tier,
+        action: "move",
+        note: "module path migration",
+    }));
+    for (const conflict of migrationPlan.conflicts) {
+        changes.push({
+            path: "module migration",
+            tier: "managed",
+            action: "conflict",
+            note: conflict,
+        });
+    }
+    const movedSources = new Set(migrationPlan.moves.map((move) => move.from));
+    const movedTargets = new Set(migrationPlan.moves.map((move) => move.to));
     const paths = new Set([...newTree.keys(), ...Object.keys(lock.files)]);
     for (const path of [...paths].sort()) {
+        if (movedSources.has(path) || movedTargets.has(path))
+            continue;
         const locked = lock.files[path];
         const newText = treeText(newTree, path);
         const disk = diskContent(projectRoot, path);
@@ -232,6 +253,19 @@ function applyUpdate(projectRoot, templatesDir, options = {}) {
     });
     const managedOverrides = targetManagedOverrides(projectRoot, templatesDir, modules, manifest.managedOverrides);
     const ownedGlobs = targetOwnedGlobs(projectRoot, templatesDir, modules, manifest.ownedGlobs);
+    const pendingMigrations = (0, module_migrations_1.collectPendingMigrations)(projectRoot, templatesDir, modules);
+    const migrationPlan = (0, module_migrations_1.planModuleMigrations)(projectRoot, newTree, previousLock, pendingMigrations);
+    if (migrationPlan.conflicts.length) {
+        throw new Error(`Cannot apply module path migration:\n${migrationPlan.conflicts
+            .map((conflict) => `  - ${conflict}`)
+            .join("\n")}`);
+    }
+    const migratedOwnedGlobs = [
+        ...new Set(ownedGlobs.map((glob) => (0, module_migrations_1.migrateConfiguredPath)(glob, pendingMigrations))),
+    ];
+    const migratedManagedOverrides = [
+        ...new Set(managedOverrides.map((glob) => (0, module_migrations_1.migrateConfiguredPath)(glob, pendingMigrations))),
+    ];
     const needsMergeBase = plan.changes.some((change) => change.action === "conflict");
     let oldTree = null;
     if (options.oldTemplatesDir && needsMergeBase) {
@@ -250,7 +284,13 @@ function applyUpdate(projectRoot, templatesDir, options = {}) {
                 (0, node_fs_1.rmSync)(previousModules.root, { recursive: true, force: true });
         }
     }
-    const result = { written: [], removed: [], merged: [], conflicts: [] };
+    const result = {
+        written: [],
+        moved: (0, module_migrations_1.applyModuleMigrations)(projectRoot, migrationPlan),
+        removed: [],
+        merged: [],
+        conflicts: [],
+    };
     for (const change of plan.changes) {
         const newText = treeText(newTree, change.path);
         if (change.action === "update" || change.action === "add") {
@@ -280,22 +320,37 @@ function applyUpdate(projectRoot, templatesDir, options = {}) {
     // Keep the assembled target as the managed baseline. A merged working file
     // intentionally remains drifted so a future update performs another 3-way
     // merge instead of treating the user's lines as clean generated output.
-    (0, lockfile_1.writeFilesLock)(projectRoot, updatedFilesLock(projectRoot, newTree, previousLock, ownedGlobs, managedOverrides));
+    (0, lockfile_1.writeFilesLock)(projectRoot, updatedFilesLock(projectRoot, newTree, previousLock, migratedOwnedGlobs, migratedManagedOverrides));
     const modulesDir = (0, node_path_1.join)(templatesDir, "modules");
+    const appliedMigrations = new Map();
+    for (const pending of pendingMigrations) {
+        const ids = appliedMigrations.get(pending.module) ?? [];
+        ids.push(pending.migration.id);
+        appliedMigrations.set(pending.module, ids);
+    }
     const refreshedModules = manifest.modules.map((module) => {
         const resolved = (0, add_1.resolveModule)(module.packageName ?? module.name, modulesDir, projectRoot);
-        return resolved?.packageName
-            ? {
-                ...module,
-                packageName: resolved.packageName,
-                moduleVersion: resolved.moduleVersion,
-            }
-            : module;
+        const applied = [
+            ...new Set([
+                ...(module.appliedMigrations ?? []),
+                ...(appliedMigrations.get(module.name) ?? []),
+            ]),
+        ];
+        return {
+            ...module,
+            ...(resolved?.packageName
+                ? {
+                    packageName: resolved.packageName,
+                    moduleVersion: resolved.moduleVersion,
+                }
+                : {}),
+            ...(applied.length ? { appliedMigrations: applied } : {}),
+        };
     });
     (0, lockfile_1.writeManifest)(projectRoot, {
         ...manifest,
-        ownedGlobs,
-        managedOverrides,
+        ownedGlobs: migratedOwnedGlobs,
+        managedOverrides: migratedManagedOverrides,
         modules: refreshedModules,
         podokitVersion: (0, lockfile_1.podokitVersion)(),
     });
@@ -308,6 +363,7 @@ function summarize(plan) {
         merge: 0,
         conflict: 0,
         add: 0,
+        move: 0,
         remove: 0,
         skip: 0,
         "up-to-date": 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.12.4",
+  "version": "0.14.0",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {