@podosoft/podokit 0.17.0 → 0.17.1

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -219,9 +219,16 @@
   // Security — change password
   let currentPassword = $state("");
   let newPassword = $state("");
+  let confirmNewPassword = $state("");
   let changing = $state(false);
   async function changePassword(event: SubmitEvent): Promise<void> {
     event.preventDefault();
+    // Checked here rather than by the API, which only sees one new password and
+    // has no way to know it is not the one that was meant.
+    if (newPassword !== confirmNewPassword) {
+      toast.error(i18n.t.account.passwordMismatch);
+      return;
+    }
     changing = true;
     const { error } = await api.auth.changePassword({ currentPassword, newPassword, revokeOtherSessions: true });
     changing = false;
@@ -230,6 +237,7 @@
       toast.success(i18n.t.account.changed);
       currentPassword = "";
       newPassword = "";
+      confirmNewPassword = "";
       await loadSessions();
     }
   }
@@ -633,6 +641,10 @@
                   <Label for="new">{i18n.t.account.newPassword}</Label>
                   <Input id="new" type="password" bind:value={newPassword} required autocomplete="new-password" />
                 </div>
+                <div class="flex flex-col gap-2">
+                  <Label for="new-confirm">{i18n.t.account.confirmNewPassword}</Label>
+                  <Input id="new-confirm" type="password" bind:value={confirmNewPassword} required autocomplete="new-password" />
+                </div>
                 <Button type="submit" class="w-fit" disabled={changing}>{changing ? i18n.t.account.updating : i18n.t.account.update}</Button>
               </form>
             </Card.Content>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/en.json

@@ -53,6 +53,8 @@
     "email": "Email",
     "emailOrUsername": "Email or username",
     "password": "Password",
+    "confirmPassword": "Confirm password",
+    "passwordMismatch": "Passwords do not match",
     "forgot": "Forgot?",
     "signIn": "Sign in",
     "signingIn": "Signing in…",
@@ -93,6 +95,7 @@
     "requestFailed": "Request failed",
     "newTitle": "Set a new password",
     "newPassword": "New password",
+    "confirmNewPassword": "Confirm new password",
     "updatePassword": "Update password",
     "updating": "Updating…",
     "missingToken": "Missing or invalid reset token.",
@@ -528,6 +531,8 @@
     "changePassword": "Change password",
     "currentPassword": "Current password",
     "newPassword": "New password",
+    "confirmNewPassword": "Confirm new password",
+    "passwordMismatch": "Passwords do not match",
     "update": "Update password",
     "updating": "Updating…",
     "changed": "Password changed",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/ko.json

@@ -53,6 +53,8 @@
     "email": "이메일",
     "emailOrUsername": "이메일 또는 사용자명",
     "password": "비밀번호",
+    "confirmPassword": "비밀번호 확인",
+    "passwordMismatch": "비밀번호가 일치하지 않습니다",
     "forgot": "비밀번호 찾기",
     "signIn": "로그인",
     "signingIn": "로그인 중…",
@@ -92,6 +94,7 @@
     "requestFailed": "요청에 실패했습니다",
     "newTitle": "새 비밀번호 설정",
     "newPassword": "새 비밀번호",
+    "confirmNewPassword": "새 비밀번호 확인",
     "updatePassword": "비밀번호 변경",
     "updating": "변경 중…",
     "missingToken": "재설정 토큰이 없거나 유효하지 않습니다.",
@@ -528,6 +531,8 @@
     "changePassword": "비밀번호 변경",
     "currentPassword": "현재 비밀번호",
     "newPassword": "새 비밀번호",
+    "confirmNewPassword": "새 비밀번호 확인",
+    "passwordMismatch": "비밀번호가 일치하지 않습니다",
     "update": "비밀번호 변경",
     "updating": "변경 중…",
     "changed": "비밀번호를 변경했습니다",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/reset-password/+page.svelte

@@ -11,14 +11,21 @@
 
   const i18n = getI18n();
   let password = $state("");
+  let confirmPassword = $state("");
   let error = $state<string | null>(null);
   let loading = $state(false);
   const token = $derived(page.url.searchParams.get("token") ?? "");
 
   async function submit(event: SubmitEvent): Promise<void> {
     event.preventDefault();
-    loading = true;
     error = null;
+    // The token is single-use: a mistyped password here is not a retry, it is
+    // another round trip through the mailbox to get a link that still works.
+    if (password !== confirmPassword) {
+      error = i18n.t.auth.passwordMismatch;
+      return;
+    }
+    loading = true;
     const { error: authError } = await api.auth.resetPassword({ newPassword: password, token });
     loading = false;
     if (authError) {
@@ -45,6 +52,10 @@
         <Label for="password">{i18n.t.auth.newPassword}</Label>
         <Input id="password" type="password" bind:value={password} required autocomplete="new-password" />
       </div>
+      <div class="flex flex-col gap-2">
+        <Label for="confirm-password">{i18n.t.auth.confirmNewPassword}</Label>
+        <Input id="confirm-password" type="password" bind:value={confirmPassword} required autocomplete="new-password" />
+      </div>
       <Button type="submit" disabled={loading || !token}>{loading ? i18n.t.auth.updating : i18n.t.auth.updatePassword}</Button>
     </form>
   </Card.Content>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/signup/+page.svelte

@@ -18,14 +18,22 @@
   let name = $state("");
   let email = $state("");
   let password = $state("");
+  let confirmPassword = $state("");
   let error = $state<string | null>(null);
   let loading = $state(false);
   const redirectTo = (): string => safeAuthRedirect(page.url.searchParams.get("redirect"));
 
   async function submit(event: SubmitEvent): Promise<void> {
     event.preventDefault();
-    loading = true;
     error = null;
+    // Before the request, not after: a typo here costs the account. Sign-up is the
+    // one password entry with no way back — the address is not verified yet, so the
+    // reset link that would rescue it goes somewhere the user cannot read.
+    if (password !== confirmPassword) {
+      error = i18n.t.auth.passwordMismatch;
+      return;
+    }
+    loading = true;
     // callbackURL: where the verification link lands once confirmed (absolute so
     // it returns to the web app, not the API origin). Ignored when verification is off.
     const { error: authError } = await api.auth.signUp.email({
@@ -85,6 +93,10 @@
         <Label for="password">{i18n.t.auth.password}</Label>
         <Input id="password" type="password" bind:value={password} required autocomplete="new-password" />
       </div>
+      <div class="flex flex-col gap-2">
+        <Label for="confirm-password">{i18n.t.auth.confirmPassword}</Label>
+        <Input id="confirm-password" type="password" bind:value={confirmPassword} required autocomplete="new-password" />
+      </div>
       <Button type="submit" disabled={loading}>{loading ? i18n.t.auth.creating : i18n.t.auth.create}</Button>
     </form>
   </Card.Content>

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -1,6 +1,31 @@
 export type Account = { name: string; email: string; password: string };
-export const ADMIN = { name: "Admin", email: "admin@example.com", password: "Podokit3e-Str0ng!pw" };
-export const USER = { name: "Normal User", email: "user@example.com", password: "Podokit3e-Str0ng!pw" };
+
+/**
+ * The password the suite signs in with, per account.
+ *
+ * A test must never change an existing account's credentials. `seed.setup.ts` signs up
+ * idempotently and then signs in with these values, which is right on a stack the suite
+ * created — and wrong on every stack where the account already exists with a password of
+ * its own. An install bootstrapped with `admin:bootstrap` is exactly that: `admin@example.com`
+ * is a real account somebody logs in as, and resetting it to match the constant takes their
+ * login with it while the run goes green.
+ *
+ * So the constant is a DEFAULT and the environment wins:
+ *
+ * ```bash
+ * E2E_BASE_URL=https://app.example.com E2E_ADMIN_PASSWORD='…' npx playwright test …
+ * ```
+ *
+ * Without the override the run fails with `INVALID_EMAIL_OR_PASSWORD`, which is the correct
+ * outcome — a refusal, not a silent overwrite. Do not commit a real value here.
+ */
+function seedPassword(envVar: "E2E_ADMIN_PASSWORD" | "E2E_USER_PASSWORD"): string {
+  const value = process.env[envVar];
+  return value !== undefined && value.length > 0 ? value : "Podokit3e-Str0ng!pw";
+}
+
+export const ADMIN = { name: "Admin", email: "admin@example.com", password: seedPassword("E2E_ADMIN_PASSWORD") };
+export const USER = { name: "Normal User", email: "user@example.com", password: seedPassword("E2E_USER_PASSWORD") };
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
 export const userBaselineState = "playwright/.auth/user-baseline.json";

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -161,12 +161,31 @@ test("account security and sessions sub-navigation", async ({ page }) => {
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();
   await expect(page.getByLabel("Current password")).toBeVisible();
+  // `exact` because "Confirm new password" also contains "New password".
+  await expect(page.getByLabel("New password", { exact: true })).toBeVisible();
+  await expect(page.getByLabel("Confirm new password")).toBeVisible();
   await page.getByRole("button", { name: "Sessions" }).click();
   await expect(page.getByText("Active sessions")).toBeVisible();
   await expect(page.getByText("Current", { exact: true })).toBeVisible();
   await expect(page.getByRole("button", { name: "Sign out other sessions" })).toBeVisible();
 });
 
+// Changing a password is the one form here whose mistake is silent: the change
+// succeeds, and the person finds out at the next sign-in with a password they
+// cannot reproduce.
+test("changing a password refuses a mistyped confirmation", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Security" }).click();
+  await page.getByLabel("Current password").fill(ADMIN.password);
+  await page.getByLabel("New password", { exact: true }).fill("Podokit3e-N3wStr0ng!pw");
+  await page.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pwX");
+  // The control: the message must not already be on screen, or this test would pass
+  // against a form that shows it unconditionally.
+  await expect(page.getByText("Passwords do not match")).toBeHidden();
+  await page.getByRole("button", { name: "Update password" }).click();
+  await expect(page.getByText("Passwords do not match")).toBeVisible();
+});
+
 test("account nav shows the core sections", async ({ page }) => {
   await ready(page, "/admin/account");
   await expect(page.getByRole("button", { name: "Profile", exact: true })).toBeVisible();
@@ -182,7 +201,7 @@ test("two-factor setup shows a scannable QR code when enabled", async ({ page })
   await expect(page.getByRole("button", { name: "Enable", exact: true })).toBeVisible();
   // Start setup (password + Enable) and confirm the QR renders. Stop before
   // verifying so 2FA stays inactive and the shared admin session keeps working.
-  await page.locator("#tf-on-pw").fill("Podokit3e-Str0ng!pw");
+  await page.locator("#tf-on-pw").fill(ADMIN.password);
   await page.getByRole("button", { name: "Enable", exact: true }).click();
   await expect(page.getByRole("img", { name: "TOTP QR code" })).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -47,6 +47,8 @@ test("authentication return targets reject external and recursive redirects", ()
 test("signup page renders", async ({ page }) => {
   await page.goto("/signup");
   await expect(page.getByLabel("Name")).toBeVisible();
+  await expect(page.getByLabel("Password", { exact: true })).toBeVisible();
+  await expect(page.getByLabel("Confirm password")).toBeVisible();
   await expect(page.getByRole("button", { name: "Create account" })).toBeVisible();
 });
 
@@ -120,8 +122,31 @@ test("signup creates an account and enters the app @smoke", async ({ page }) =>
   const email = `signup-${Date.now()}@example.com`;
   await page.getByLabel("Name").fill("New User");
   await page.getByLabel("Email").fill(email);
-  await page.getByLabel("Password").fill("Podokit3e-Str0ng!pw");
+  // `exact` because "Confirm password" also contains "Password".
+  await page.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
+  await page.getByLabel("Confirm password").fill("Podokit3e-Str0ng!pw");
   await page.getByRole("button", { name: "Create account" }).click();
   // Verification off → straight into the app; on → the verify-email page.
   await expect(page).toHaveURL((url) => url.pathname === "/" || url.pathname === "/verify-email");
 });
+
+// A typo here is not recoverable the way a mistyped login is: the address has not
+// been verified, so the reset link that would rescue the account is sent to an
+// inbox the person cannot open.
+test("signup refuses a mistyped password confirmation", async ({ page }) => {
+  await ready(page, "/signup");
+  const email = `signup-mismatch-${Date.now()}@example.com`;
+  await page.getByLabel("Name").fill("New User");
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
+  await page.getByLabel("Confirm password").fill("Podokit3e-Str0ng!pwX");
+  await page.getByRole("button", { name: "Create account" }).click();
+  await expect(page.getByText("Passwords do not match")).toBeVisible();
+  // Still on the form, and no account was created for that address.
+  await expect(page).toHaveURL(/\/signup/);
+  const probe = await page.context().request.post("/api/auth/sign-in/email", {
+    data: { email, password: "Podokit3e-Str0ng!pw" },
+    headers: { origin: new URL(page.url()).origin },
+  });
+  expect(probe.ok()).toBeFalsy();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -31,7 +31,16 @@ test("forgot password: request, open the emailed link, set a new password, sign
   await page.goto(await waitForLink(email));
   await page.waitForLoadState("load");
   await page.waitForTimeout(400);
-  await page.getByLabel("New password").fill("Podokit3e-N3wStr0ng!pw");
+  // `exact` because "Confirm new password" also contains "New password".
+  await page.getByLabel("New password", { exact: true }).fill("Podokit3e-N3wStr0ng!pw");
+  // A mismatch is refused, and the single-use token survives it: the same page
+  // still accepts the corrected pair below.
+  await page.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pwX");
+  await page.getByRole("button", { name: "Update password" }).click();
+  await expect(page.getByText("Passwords do not match")).toBeVisible();
+  await expect(page).not.toHaveURL(/\/login/);
+
+  await page.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pw");
   await page.getByRole("button", { name: "Update password" }).click();
   await expect(page).toHaveURL(/\/login/);
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/two-factor.ui.spec.ts

@@ -1,5 +1,5 @@
 import { expect, test, type Page } from "@playwright/test";
-import { anonState } from "../helpers/accounts";
+import { ADMIN, USER, anonState } from "../helpers/accounts";
 import { totpCode } from "../helpers/totp";
 
 test.use({ storageState: anonState });
@@ -59,7 +59,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await admin.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
-  await admin.post("/api/auth/sign-in/email", { data: { email: "admin@example.com", password: "Podokit3e-Str0ng!pw" } });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
 
   const email = `rq-ui-${Date.now()}@example.com`;
   const pw = "Podokit3e-Str0ng!pw";
@@ -97,7 +97,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
     await admin.put("/api/account/settings", { data: { require2fa: false } });
     await expect(async () => {
       const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-      await probe.post("/api/auth/sign-in/email", { data: { email: "user@example.com", password: "Podokit3e-Str0ng!pw" } });
+      await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
       const status = (await probe.get("/api/account/me")).status();
       await probe.dispose();
       expect(status).toBe(200);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {