@podosoft/podokit 0.16.4 → 0.17.1

package/dist/templates/fullstack-nest-svelte/infra/k3s/README.md

@@ -0,0 +1,18 @@
+# Example k3s manifests
+
+These are **illustrative**. `podo deploy` does not read or apply them.
+
+For a real deployment, initialize a profile and let PodoKit render the manifests it
+will actually apply — with image digests, probes, disruption budgets, a migration
+Job, and a confirmation hash:
+
+```bash
+podo deploy init --profile production --context production --host app.example.com
+podo deploy render --profile production --release v1.2.3
+```
+
+Keep these files if you want a starting point for hand-managed manifests, or delete
+the directory if you deploy with `podo deploy`. If you do apply them by hand, replace
+every `example.com` and `ghcr.io/example/...` placeholder first, and note that the
+image tags below are placeholders too: the deployment tooling rejects `latest`,
+branch tags, and empty tags, and so should you.

package/dist/templates/fullstack-nest-svelte/infra/k3s/api-deployment.yaml

@@ -1,3 +1,4 @@
+# Example only. See README.md in this directory; `podo deploy` renders its own.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -13,7 +14,8 @@ spec:
     spec:
       containers:
         - name: api
-          image: ghcr.io/example/podokit-api:latest
+          # Placeholder. Use one immutable, stable SemVer tag for api and web.
+          image: ghcr.io/example/podokit-api:v0.0.0
           ports:
             - containerPort: 3000
           envFrom:
@@ -22,3 +24,6 @@ spec:
           readinessProbe:
             httpGet: { path: /health/ready, port: 3000 }
             initialDelaySeconds: 5
+          livenessProbe:
+            httpGet: { path: /health, port: 3000 }
+            initialDelaySeconds: 15

package/dist/templates/fullstack-nest-svelte/infra/k3s/ingress.yaml

@@ -1,3 +1,4 @@
+# Example only. See README.md in this directory; `podo deploy` renders its own.
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
@@ -14,6 +15,13 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.middlewares: podokit-compression@kubernetescrd
 spec:
+  # Name the controller explicitly rather than relying on a default IngressClass.
+  ingressClassName: traefik
+  # app-config sets an https:// origin, so the route has to terminate TLS. Create the
+  # Secret out of band (cert-manager, or an existing certificate) and name it here.
+  tls:
+    - hosts: [example.com]
+      secretName: app-tls
   rules:
     - host: example.com
       http:

package/dist/templates/fullstack-nest-svelte/infra/k3s/web-deployment.yaml

@@ -1,3 +1,4 @@
+# Example only. See README.md in this directory; `podo deploy` renders its own.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -13,8 +14,17 @@ spec:
     spec:
       containers:
         - name: web
-          image: ghcr.io/example/podokit-web:latest
+          # Placeholder. Use one immutable, stable SemVer tag for api and web.
+          image: ghcr.io/example/podokit-web:v0.0.0
           ports:
             - containerPort: 3000
           envFrom:
             - configMapRef: { name: app-config }
+          # Without these a rolling update sends traffic to a process that has not
+          # bound its port yet.
+          readinessProbe:
+            httpGet: { path: /, port: 3000 }
+            initialDelaySeconds: 5
+          livenessProbe:
+            httpGet: { path: /, port: 3000 }
+            initialDelaySeconds: 15

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -9,6 +9,7 @@
   import * as Table from "$lib/components/ui/table";
   import * as Dialog from "$lib/components/ui/dialog";
   import DataTable, { type DataTableColumn, type SortState, DEFAULT_PAGE_SIZE } from "$lib/components/data-table.svelte";
+  import { deviceLabel } from "$lib/device-label";
   import { toast } from "svelte-sonner";
   import { api } from "$lib/api";
   import { getI18n, fmt, formatDateTime } from "$lib/i18n";
@@ -218,9 +219,16 @@
   // Security — change password
   let currentPassword = $state("");
   let newPassword = $state("");
+  let confirmNewPassword = $state("");
   let changing = $state(false);
   async function changePassword(event: SubmitEvent): Promise<void> {
     event.preventDefault();
+    // Checked here rather than by the API, which only sees one new password and
+    // has no way to know it is not the one that was meant.
+    if (newPassword !== confirmNewPassword) {
+      toast.error(i18n.t.account.passwordMismatch);
+      return;
+    }
     changing = true;
     const { error } = await api.auth.changePassword({ currentPassword, newPassword, revokeOtherSessions: true });
     changing = false;
@@ -229,6 +237,7 @@
       toast.success(i18n.t.account.changed);
       currentPassword = "";
       newPassword = "";
+      confirmNewPassword = "";
       await loadSessions();
     }
   }
@@ -382,7 +391,7 @@
   let sessionsSort = $state<SortState | null>(null);
   let busy = $state(false);
   const sessionsColumns: DataTableColumn<Session>[] = [
-    { key: "userAgent", label: i18n.t.sessions.device, sortable: true, value: (s) => s.userAgent ?? "" },
+    { key: "userAgent", label: i18n.t.sessions.device, sortable: true, value: (s) => deviceLabel(s.userAgent) ?? s.userAgent ?? "" },
     { key: "ipAddress", label: i18n.t.sessions.ip, sortable: true, value: (s) => s.ipAddress ?? "" },
     { key: "createdAt", label: i18n.t.sessions.since, sortable: true, value: (s) => new Date(s.createdAt).getTime() },
     { key: "status", label: i18n.t.sessions.status },
@@ -632,6 +641,10 @@
                   <Label for="new">{i18n.t.account.newPassword}</Label>
                   <Input id="new" type="password" bind:value={newPassword} required autocomplete="new-password" />
                 </div>
+                <div class="flex flex-col gap-2">
+                  <Label for="new-confirm">{i18n.t.account.confirmNewPassword}</Label>
+                  <Input id="new-confirm" type="password" bind:value={confirmNewPassword} required autocomplete="new-password" />
+                </div>
                 <Button type="submit" class="w-fit" disabled={changing}>{changing ? i18n.t.account.updating : i18n.t.account.update}</Button>
               </form>
             </Card.Content>
@@ -793,7 +806,7 @@
             >
               {#snippet row(s)}
                 {@const isCurrent = s.id === data.currentSessionId}
-                <Table.Cell class="max-w-xs truncate">{s.userAgent ?? i18n.t.sessions.unknown}</Table.Cell>
+                <Table.Cell class="max-w-xs truncate" title={s.userAgent ?? ""}>{deviceLabel(s.userAgent) ?? s.userAgent ?? i18n.t.sessions.unknown}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{s.ipAddress ?? "—"}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{formatDateTime(s.createdAt)}</Table.Cell>
                 <Table.Cell>{#if isCurrent}<Badge>{i18n.t.sessions.current}</Badge>{/if}</Table.Cell>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/device-label.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from "vitest";
+import { deviceLabel } from "./device-label";
+
+describe("deviceLabel", () => {
+  it("names the browser and the machine", () => {
+    expect(
+      deviceLabel(
+        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
+      ),
+    ).toBe("Chrome · macOS");
+    expect(
+      deviceLabel(
+        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
+      ),
+    ).toBe("Chrome · Windows");
+  });
+
+  // Each of these contains an earlier engine's token, so a naive check in the wrong
+  // order reports every one of them as Chrome or Safari.
+  it("does not mistake a derivative for the engine it embeds", () => {
+    expect(deviceLabel("Mozilla/5.0 (Windows NT 10.0) Chrome/141.0.0.0 Safari/537.36 Edg/141.0.0.0")).toBe(
+      "Edge · Windows",
+    );
+    expect(deviceLabel("Mozilla/5.0 (Windows NT 10.0) Chrome/141.0.0.0 Safari/537.36 OPR/121.0.0.0")).toBe(
+      "Opera · Windows",
+    );
+    expect(
+      deviceLabel("Mozilla/5.0 (Linux; Android 15) AppleWebKit/537.36 Chrome/141.0.0.0 SamsungBrowser/28.0 Safari/537.36"),
+    ).toBe("Samsung Internet · Android");
+    expect(
+      deviceLabel("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/18.0 Safari/605.1.15"),
+    ).toBe("Safari · macOS");
+  });
+
+  it("names an iPhone and an iPad rather than the engine's host platform", () => {
+    expect(
+      deviceLabel("Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 Version/18.0 Mobile/15E148 Safari/604.1"),
+    ).toBe("Safari · iPhone");
+    // iPadOS reports Macintosh in the same string, so order decides this one.
+    expect(
+      deviceLabel("Mozilla/5.0 (iPad; CPU OS 18_0 like Mac OS X) AppleWebKit/605.1.15 Version/18.0 Mobile/15E148 Safari/604.1"),
+    ).toBe("Safari · iPad");
+    expect(deviceLabel("Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) CriOS/141.0.0.0 Mobile/15E148 Safari/604.1")).toBe(
+      "Chrome · iPhone",
+    );
+  });
+
+  it("gives up on something that is not a browser, so the caller can show it raw", () => {
+    // The exact value is the whole point for these: "node" is the symptom of a
+    // proxy that forgot to forward the header, and a CLI's name identifies it.
+    expect(deviceLabel("node")).toBeNull();
+    expect(deviceLabel("curl/8.7.1")).toBeNull();
+    expect(deviceLabel("")).toBeNull();
+    expect(deviceLabel(null)).toBeNull();
+    expect(deviceLabel(undefined)).toBeNull();
+  });
+
+  it("reports whichever half it can read", () => {
+    expect(deviceLabel("Mozilla/5.0 (Windows NT 10.0; Win64; x64)")).toBe("Windows");
+    expect(deviceLabel("Firefox/142.0")).toBe("Firefox");
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/device-label.ts

@@ -0,0 +1,50 @@
+/**
+ * A readable device name for a session's user agent.
+ *
+ * The sessions tables label this column "device", and a raw user agent does not
+ * answer that question — truncated to fit a cell, every modern browser starts with
+ * the same "Mozilla/5.0 (…" and the part that differs is off the end. This reduces
+ * it to the two things someone scanning their own sessions is looking for: which
+ * browser, on which machine.
+ *
+ * Returns null when the string is not a browser at all — a CLI, a script, or the
+ * proxy's own default. The caller shows the raw value then, because for those the
+ * exact string is the only useful information.
+ */
+
+/** Order matters: every one of these also contains an earlier engine's token. */
+const BROWSERS: Array<[RegExp, string]> = [
+  [/\bEdg(?:e|A|iOS)?\//, "Edge"],
+  [/\bOPR\/|\bOpera\//, "Opera"],
+  [/\bSamsungBrowser\//, "Samsung Internet"],
+  [/\bFirefox\/|\bFxiOS\//, "Firefox"],
+  [/\bCriOS\//, "Chrome"],
+  [/\bChrome\/|\bChromium\//, "Chrome"],
+  [/\bSafari\//, "Safari"],
+];
+
+/** iPadOS reports as Macintosh, so the iPad check has to come before macOS. */
+const PLATFORMS: Array<[RegExp, string]> = [
+  [/\biPhone\b/, "iPhone"],
+  [/\biPad\b/, "iPad"],
+  [/\bAndroid\b/, "Android"],
+  [/\bCrOS\b/, "ChromeOS"],
+  [/\bWindows NT\b/, "Windows"],
+  [/\bMacintosh\b|\bMac OS X\b/, "macOS"],
+  [/\bLinux\b/, "Linux"],
+];
+
+function match(candidates: Array<[RegExp, string]>, value: string): string | null {
+  for (const [pattern, label] of candidates) {
+    if (pattern.test(value)) return label;
+  }
+  return null;
+}
+
+export function deviceLabel(userAgent: string | null | undefined): string | null {
+  if (!userAgent) return null;
+  const browser = match(BROWSERS, userAgent);
+  const platform = match(PLATFORMS, userAgent);
+  if (browser && platform) return `${browser} · ${platform}`;
+  return browser ?? platform;
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/en.json

@@ -53,6 +53,8 @@
     "email": "Email",
     "emailOrUsername": "Email or username",
     "password": "Password",
+    "confirmPassword": "Confirm password",
+    "passwordMismatch": "Passwords do not match",
     "forgot": "Forgot?",
     "signIn": "Sign in",
     "signingIn": "Signing in…",
@@ -93,6 +95,7 @@
     "requestFailed": "Request failed",
     "newTitle": "Set a new password",
     "newPassword": "New password",
+    "confirmNewPassword": "Confirm new password",
     "updatePassword": "Update password",
     "updating": "Updating…",
     "missingToken": "Missing or invalid reset token.",
@@ -528,6 +531,8 @@
     "changePassword": "Change password",
     "currentPassword": "Current password",
     "newPassword": "New password",
+    "confirmNewPassword": "Confirm new password",
+    "passwordMismatch": "Passwords do not match",
     "update": "Update password",
     "updating": "Updating…",
     "changed": "Password changed",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/ko.json

@@ -53,6 +53,8 @@
     "email": "이메일",
     "emailOrUsername": "이메일 또는 사용자명",
     "password": "비밀번호",
+    "confirmPassword": "비밀번호 확인",
+    "passwordMismatch": "비밀번호가 일치하지 않습니다",
     "forgot": "비밀번호 찾기",
     "signIn": "로그인",
     "signingIn": "로그인 중…",
@@ -92,6 +94,7 @@
     "requestFailed": "요청에 실패했습니다",
     "newTitle": "새 비밀번호 설정",
     "newPassword": "새 비밀번호",
+    "confirmNewPassword": "새 비밀번호 확인",
     "updatePassword": "비밀번호 변경",
     "updating": "변경 중…",
     "missingToken": "재설정 토큰이 없거나 유효하지 않습니다.",
@@ -528,6 +531,8 @@
     "changePassword": "비밀번호 변경",
     "currentPassword": "현재 비밀번호",
     "newPassword": "새 비밀번호",
+    "confirmNewPassword": "새 비밀번호 확인",
+    "passwordMismatch": "비밀번호가 일치하지 않습니다",
     "update": "비밀번호 변경",
     "updating": "변경 중…",
     "changed": "비밀번호를 변경했습니다",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(admin)/admin/sessions/+page.svelte

@@ -9,6 +9,7 @@
   import { toast } from "svelte-sonner";
   import { api } from "$lib/api";
   import { getI18n, fmt, formatDateTime } from "$lib/i18n";
+  import { deviceLabel } from "$lib/device-label";
 
   const i18n = getI18n();
 
@@ -43,7 +44,7 @@
 
   const columns = $derived<DataTableColumn<Row>[]>([
     { key: "user", label: i18n.t.adminSessions.user, sortable: true, value: (r) => r.userName },
-    { key: "device", label: i18n.t.adminSessions.device, sortable: true, value: (r) => r.userAgent },
+    { key: "device", label: i18n.t.adminSessions.device, sortable: true, value: (r) => deviceLabel(r.userAgent) ?? r.userAgent ?? "" },
     { key: "ip", label: i18n.t.adminSessions.ip, sortable: true, value: (r) => r.ipAddress },
     { key: "createdAt", label: i18n.t.adminSessions.since, sortable: true },
     { key: "expiresAt", label: i18n.t.adminSessions.expires, sortable: true, value: (r) => (r.expiresAt ? new Date(r.expiresAt).getTime() : 0) },
@@ -134,7 +135,7 @@
         </div>
         <div class="text-muted-foreground text-xs">{r.userEmail}</div>
       </Table.Cell>
-      <Table.Cell class="max-w-xs truncate">{r.userAgent ?? i18n.t.adminSessions.unknown}</Table.Cell>
+      <Table.Cell class="max-w-xs truncate" title={r.userAgent ?? ""}>{deviceLabel(r.userAgent) ?? r.userAgent ?? i18n.t.adminSessions.unknown}</Table.Cell>
       <Table.Cell class="text-muted-foreground">{r.ipAddress ?? "—"}</Table.Cell>
       <Table.Cell class="text-muted-foreground">{formatDateTime(r.createdAt)}</Table.Cell>
       <Table.Cell class="text-muted-foreground">{r.expiresAt ? formatDateTime(r.expiresAt) : "—"}</Table.Cell>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(admin)/admin/users/+page.svelte

@@ -17,6 +17,7 @@
   import { api } from "$lib/api";
   import { getI18n, fmt, formatDateTime } from "$lib/i18n";
   import { cn } from "$lib/utils";
+  import { deviceLabel } from "$lib/device-label";
   import type { PageData } from "./$types";
 
   let { data }: { data: PageData } = $props();
@@ -194,7 +195,7 @@
   let mSessionsPage = $state(1);
   let mSessionsSort = $state<SortState | null>(null);
   const mSessionsColumns: DataTableColumn<Session>[] = [
-    { key: "userAgent", label: i18n.t.adminSessions.device, sortable: true },
+    { key: "userAgent", label: i18n.t.adminSessions.device, sortable: true, value: (s) => deviceLabel(s.userAgent) ?? s.userAgent ?? "" },
     { key: "ipAddress", label: i18n.t.adminSessions.ip, sortable: true },
     { key: "createdAt", label: i18n.t.adminSessions.since, sortable: true, value: (s) => new Date(s.createdAt).getTime() },
     { key: "actions", label: "", class: "w-10" },
@@ -557,7 +558,7 @@
               empty={i18n.t.adminSessions.empty}
             >
               {#snippet row(s)}
-                <Table.Cell class="max-w-40 truncate">{s.userAgent ?? i18n.t.adminSessions.unknown}</Table.Cell>
+                <Table.Cell class="max-w-40 truncate" title={s.userAgent ?? ""}>{deviceLabel(s.userAgent) ?? s.userAgent ?? i18n.t.adminSessions.unknown}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{s.ipAddress ?? "—"}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{formatDateTime(s.createdAt)}</Table.Cell>
                 <Table.Cell><Button variant="ghost" size="sm" disabled={busy} onclick={() => revokeSession(s.token)}>{i18n.t.users.revokeSession}</Button></Table.Cell>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/reset-password/+page.svelte

@@ -11,14 +11,21 @@
 
   const i18n = getI18n();
   let password = $state("");
+  let confirmPassword = $state("");
   let error = $state<string | null>(null);
   let loading = $state(false);
   const token = $derived(page.url.searchParams.get("token") ?? "");
 
   async function submit(event: SubmitEvent): Promise<void> {
     event.preventDefault();
-    loading = true;
     error = null;
+    // The token is single-use: a mistyped password here is not a retry, it is
+    // another round trip through the mailbox to get a link that still works.
+    if (password !== confirmPassword) {
+      error = i18n.t.auth.passwordMismatch;
+      return;
+    }
+    loading = true;
     const { error: authError } = await api.auth.resetPassword({ newPassword: password, token });
     loading = false;
     if (authError) {
@@ -45,6 +52,10 @@
         <Label for="password">{i18n.t.auth.newPassword}</Label>
         <Input id="password" type="password" bind:value={password} required autocomplete="new-password" />
       </div>
+      <div class="flex flex-col gap-2">
+        <Label for="confirm-password">{i18n.t.auth.confirmNewPassword}</Label>
+        <Input id="confirm-password" type="password" bind:value={confirmPassword} required autocomplete="new-password" />
+      </div>
       <Button type="submit" disabled={loading || !token}>{loading ? i18n.t.auth.updating : i18n.t.auth.updatePassword}</Button>
     </form>
   </Card.Content>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/signup/+page.svelte

@@ -18,14 +18,22 @@
   let name = $state("");
   let email = $state("");
   let password = $state("");
+  let confirmPassword = $state("");
   let error = $state<string | null>(null);
   let loading = $state(false);
   const redirectTo = (): string => safeAuthRedirect(page.url.searchParams.get("redirect"));
 
   async function submit(event: SubmitEvent): Promise<void> {
     event.preventDefault();
-    loading = true;
     error = null;
+    // Before the request, not after: a typo here costs the account. Sign-up is the
+    // one password entry with no way back — the address is not verified yet, so the
+    // reset link that would rescue it goes somewhere the user cannot read.
+    if (password !== confirmPassword) {
+      error = i18n.t.auth.passwordMismatch;
+      return;
+    }
+    loading = true;
     // callbackURL: where the verification link lands once confirmed (absolute so
     // it returns to the web app, not the API origin). Ignored when verification is off.
     const { error: authError } = await api.auth.signUp.email({
@@ -85,6 +93,10 @@
         <Label for="password">{i18n.t.auth.password}</Label>
         <Input id="password" type="password" bind:value={password} required autocomplete="new-password" />
       </div>
+      <div class="flex flex-col gap-2">
+        <Label for="confirm-password">{i18n.t.auth.confirmPassword}</Label>
+        <Input id="confirm-password" type="password" bind:value={confirmPassword} required autocomplete="new-password" />
+      </div>
       <Button type="submit" disabled={loading}>{loading ? i18n.t.auth.creating : i18n.t.auth.create}</Button>
     </form>
   </Card.Content>

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -1,6 +1,31 @@
 export type Account = { name: string; email: string; password: string };
-export const ADMIN = { name: "Admin", email: "admin@example.com", password: "Podokit3e-Str0ng!pw" };
-export const USER = { name: "Normal User", email: "user@example.com", password: "Podokit3e-Str0ng!pw" };
+
+/**
+ * The password the suite signs in with, per account.
+ *
+ * A test must never change an existing account's credentials. `seed.setup.ts` signs up
+ * idempotently and then signs in with these values, which is right on a stack the suite
+ * created — and wrong on every stack where the account already exists with a password of
+ * its own. An install bootstrapped with `admin:bootstrap` is exactly that: `admin@example.com`
+ * is a real account somebody logs in as, and resetting it to match the constant takes their
+ * login with it while the run goes green.
+ *
+ * So the constant is a DEFAULT and the environment wins:
+ *
+ * ```bash
+ * E2E_BASE_URL=https://app.example.com E2E_ADMIN_PASSWORD='…' npx playwright test …
+ * ```
+ *
+ * Without the override the run fails with `INVALID_EMAIL_OR_PASSWORD`, which is the correct
+ * outcome — a refusal, not a silent overwrite. Do not commit a real value here.
+ */
+function seedPassword(envVar: "E2E_ADMIN_PASSWORD" | "E2E_USER_PASSWORD"): string {
+  const value = process.env[envVar];
+  return value !== undefined && value.length > 0 ? value : "Podokit3e-Str0ng!pw";
+}
+
+export const ADMIN = { name: "Admin", email: "admin@example.com", password: seedPassword("E2E_ADMIN_PASSWORD") };
+export const USER = { name: "Normal User", email: "user@example.com", password: seedPassword("E2E_USER_PASSWORD") };
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
 export const userBaselineState = "playwright/.auth/user-baseline.json";

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -161,12 +161,31 @@ test("account security and sessions sub-navigation", async ({ page }) => {
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();
   await expect(page.getByLabel("Current password")).toBeVisible();
+  // `exact` because "Confirm new password" also contains "New password".
+  await expect(page.getByLabel("New password", { exact: true })).toBeVisible();
+  await expect(page.getByLabel("Confirm new password")).toBeVisible();
   await page.getByRole("button", { name: "Sessions" }).click();
   await expect(page.getByText("Active sessions")).toBeVisible();
   await expect(page.getByText("Current", { exact: true })).toBeVisible();
   await expect(page.getByRole("button", { name: "Sign out other sessions" })).toBeVisible();
 });
 
+// Changing a password is the one form here whose mistake is silent: the change
+// succeeds, and the person finds out at the next sign-in with a password they
+// cannot reproduce.
+test("changing a password refuses a mistyped confirmation", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Security" }).click();
+  await page.getByLabel("Current password").fill(ADMIN.password);
+  await page.getByLabel("New password", { exact: true }).fill("Podokit3e-N3wStr0ng!pw");
+  await page.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pwX");
+  // The control: the message must not already be on screen, or this test would pass
+  // against a form that shows it unconditionally.
+  await expect(page.getByText("Passwords do not match")).toBeHidden();
+  await page.getByRole("button", { name: "Update password" }).click();
+  await expect(page.getByText("Passwords do not match")).toBeVisible();
+});
+
 test("account nav shows the core sections", async ({ page }) => {
   await ready(page, "/admin/account");
   await expect(page.getByRole("button", { name: "Profile", exact: true })).toBeVisible();
@@ -182,7 +201,7 @@ test("two-factor setup shows a scannable QR code when enabled", async ({ page })
   await expect(page.getByRole("button", { name: "Enable", exact: true })).toBeVisible();
   // Start setup (password + Enable) and confirm the QR renders. Stop before
   // verifying so 2FA stays inactive and the shared admin session keeps working.
-  await page.locator("#tf-on-pw").fill("Podokit3e-Str0ng!pw");
+  await page.locator("#tf-on-pw").fill(ADMIN.password);
   await page.getByRole("button", { name: "Enable", exact: true }).click();
   await expect(page.getByRole("img", { name: "TOTP QR code" })).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -47,6 +47,8 @@ test("authentication return targets reject external and recursive redirects", ()
 test("signup page renders", async ({ page }) => {
   await page.goto("/signup");
   await expect(page.getByLabel("Name")).toBeVisible();
+  await expect(page.getByLabel("Password", { exact: true })).toBeVisible();
+  await expect(page.getByLabel("Confirm password")).toBeVisible();
   await expect(page.getByRole("button", { name: "Create account" })).toBeVisible();
 });
 
@@ -120,8 +122,31 @@ test("signup creates an account and enters the app @smoke", async ({ page }) =>
   const email = `signup-${Date.now()}@example.com`;
   await page.getByLabel("Name").fill("New User");
   await page.getByLabel("Email").fill(email);
-  await page.getByLabel("Password").fill("Podokit3e-Str0ng!pw");
+  // `exact` because "Confirm password" also contains "Password".
+  await page.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
+  await page.getByLabel("Confirm password").fill("Podokit3e-Str0ng!pw");
   await page.getByRole("button", { name: "Create account" }).click();
   // Verification off → straight into the app; on → the verify-email page.
   await expect(page).toHaveURL((url) => url.pathname === "/" || url.pathname === "/verify-email");
 });
+
+// A typo here is not recoverable the way a mistyped login is: the address has not
+// been verified, so the reset link that would rescue the account is sent to an
+// inbox the person cannot open.
+test("signup refuses a mistyped password confirmation", async ({ page }) => {
+  await ready(page, "/signup");
+  const email = `signup-mismatch-${Date.now()}@example.com`;
+  await page.getByLabel("Name").fill("New User");
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
+  await page.getByLabel("Confirm password").fill("Podokit3e-Str0ng!pwX");
+  await page.getByRole("button", { name: "Create account" }).click();
+  await expect(page.getByText("Passwords do not match")).toBeVisible();
+  // Still on the form, and no account was created for that address.
+  await expect(page).toHaveURL(/\/signup/);
+  const probe = await page.context().request.post("/api/auth/sign-in/email", {
+    data: { email, password: "Podokit3e-Str0ng!pw" },
+    headers: { origin: new URL(page.url()).origin },
+  });
+  expect(probe.ok()).toBeFalsy();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -31,7 +31,16 @@ test("forgot password: request, open the emailed link, set a new password, sign
   await page.goto(await waitForLink(email));
   await page.waitForLoadState("load");
   await page.waitForTimeout(400);
-  await page.getByLabel("New password").fill("Podokit3e-N3wStr0ng!pw");
+  // `exact` because "Confirm new password" also contains "New password".
+  await page.getByLabel("New password", { exact: true }).fill("Podokit3e-N3wStr0ng!pw");
+  // A mismatch is refused, and the single-use token survives it: the same page
+  // still accepts the corrected pair below.
+  await page.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pwX");
+  await page.getByRole("button", { name: "Update password" }).click();
+  await expect(page.getByText("Passwords do not match")).toBeVisible();
+  await expect(page).not.toHaveURL(/\/login/);
+
+  await page.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pw");
   await page.getByRole("button", { name: "Update password" }).click();
   await expect(page).toHaveURL(/\/login/);
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/two-factor.ui.spec.ts

@@ -1,5 +1,5 @@
 import { expect, test, type Page } from "@playwright/test";
-import { anonState } from "../helpers/accounts";
+import { ADMIN, USER, anonState } from "../helpers/accounts";
 import { totpCode } from "../helpers/totp";
 
 test.use({ storageState: anonState });
@@ -59,7 +59,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await admin.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
-  await admin.post("/api/auth/sign-in/email", { data: { email: "admin@example.com", password: "Podokit3e-Str0ng!pw" } });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
 
   const email = `rq-ui-${Date.now()}@example.com`;
   const pw = "Podokit3e-Str0ng!pw";
@@ -97,7 +97,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
     await admin.put("/api/account/settings", { data: { require2fa: false } });
     await expect(async () => {
       const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-      await probe.post("/api/auth/sign-in/email", { data: { email: "user@example.com", password: "Podokit3e-Str0ng!pw" } });
+      await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
       const status = (await probe.get("/api/account/me")).status();
       await probe.dispose();
       expect(status).toBe(200);

package/dist/templates/modules/bullmq/files/infra/k3s/worker-deployment.yaml

@@ -1,3 +1,4 @@
+# Example only. See infra/k3s/README.md; `podo deploy` renders its own.
 # BullMQ worker — runs the same API image with the worker entrypoint.
 # It has no HTTP server, so there is no Service or Ingress.
 apiVersion: apps/v1
@@ -15,7 +16,7 @@ spec:
     spec:
       containers:
         - name: worker
-          image: ghcr.io/example/podokit-api:latest
+          image: ghcr.io/example/podokit-api:v0.0.0
           command: ["node", "dist/main-worker"]
           envFrom:
             - configMapRef: { name: app-config }

package/dist/templates/todo/AGENTS.md

@@ -70,7 +70,8 @@ Useful commands:
 - `podo remove <module>` — un-apply a module (inverse of add; refuses if another module needs it, keeps files you edited).
 - `podo status` / `podo diff` — see your local edits vs. what PodoKit generated.
 - `podo update` — pull in template/module improvements (3-way merges your edits; never touches owned files).
-- `podo deploy` — plan, apply, verify, or roll back an immutable Kubernetes release. Use `.agents/skills/podokit-deploy`.
+- `podo deploy` — plan, apply, verify, or roll back an immutable release on Kubernetes or one Docker host. Tag `vX.Y.Z` to build and push the images (`.github/workflows/release.yml`; check its runner — GitHub-hosted minutes are free for public repositories only). Use `.agents/skills/podokit-deploy`.
+- `podo deploy sync` — copy local build output into a running Compose deployment and restart it, for iterating without a release. Not a release: no image is published and the next `apply` discards it. Use `.agents/skills/podokit-deploy-fast`.
 
 ## Commit conventions