@podosoft/podokit 0.17.0 → 0.17.2

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -219,9 +219,16 @@
   // Security — change password
   let currentPassword = $state("");
   let newPassword = $state("");
+  let confirmNewPassword = $state("");
   let changing = $state(false);
   async function changePassword(event: SubmitEvent): Promise<void> {
     event.preventDefault();
+    // Checked here rather than by the API, which only sees one new password and
+    // has no way to know it is not the one that was meant.
+    if (newPassword !== confirmNewPassword) {
+      toast.error(i18n.t.account.passwordMismatch);
+      return;
+    }
     changing = true;
     const { error } = await api.auth.changePassword({ currentPassword, newPassword, revokeOtherSessions: true });
     changing = false;
@@ -230,6 +237,7 @@
       toast.success(i18n.t.account.changed);
       currentPassword = "";
       newPassword = "";
+      confirmNewPassword = "";
       await loadSessions();
     }
   }
@@ -376,6 +384,8 @@
   }
 
   // Sessions — this user's own devices
+  /** better-auth's code for "this session is older than `session.freshAge`". */
+  const SESSION_NOT_FRESH = "SESSION_NOT_FRESH";
   type Session = { id: string; token: string; userAgent?: string | null; ipAddress?: string | null; createdAt: string | Date };
   const PAGE_SIZE = DEFAULT_PAGE_SIZE;
   let sessions = $state<Session[]>([]);
@@ -389,8 +399,30 @@
     { key: "status", label: i18n.t.sessions.status },
     { key: "actions", label: "", class: "w-10" },
   ];
+  /**
+   * True when the session is too old to list sessions.
+   *
+   * better-auth guards `/list-sessions` (and `/unlink-account`) with its freshness
+   * middleware, and `session.freshAge` defaults to 24 hours. So for anyone who signed
+   * in yesterday — which is most people, most of the time — this call returns 403
+   * `SESSION_NOT_FRESH`. It is not a failure to report as one: the tab has to say what
+   * happened and what to do, or it is a blank table under an untranslated toast.
+   */
+  let sessionsStale = $state(false);
+  async function signOutToRefresh(): Promise<void> {
+    busy = true;
+    await api.auth.signOut();
+    await goto("/login", { invalidateAll: true });
+  }
   async function loadSessions(): Promise<void> {
     const { data: res, error } = await api.auth.listSessions();
+    if (error?.code === SESSION_NOT_FRESH) {
+      // Explained in the panel below, not thrown at the corner of the screen.
+      sessionsStale = true;
+      sessions = [];
+      return;
+    }
+    sessionsStale = false;
     if (error) return void toast.error(error.message ?? i18n.t.sessions.loadFailed);
     // Current session first (users expect it on top; also keeps it on page 1),
     // then newest to oldest.
@@ -633,6 +665,10 @@
                   <Label for="new">{i18n.t.account.newPassword}</Label>
                   <Input id="new" type="password" bind:value={newPassword} required autocomplete="new-password" />
                 </div>
+                <div class="flex flex-col gap-2">
+                  <Label for="new-confirm">{i18n.t.account.confirmNewPassword}</Label>
+                  <Input id="new-confirm" type="password" bind:value={confirmNewPassword} required autocomplete="new-password" />
+                </div>
                 <Button type="submit" class="w-fit" disabled={changing}>{changing ? i18n.t.account.updating : i18n.t.account.update}</Button>
               </form>
             </Card.Content>
@@ -779,9 +815,21 @@
         <Card.Root>
           <Card.Header class="flex flex-row items-center justify-between gap-2">
             <Card.Title>{i18n.t.sessions.title}</Card.Title>
-            <Button variant="outline" size="sm" disabled={busy || sessions.length <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
+            <Button variant="outline" size="sm" disabled={busy || sessionsStale || sessions.length <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
           </Card.Header>
           <Card.Content>
+            {#if sessionsStale}
+              <!-- The list is withheld by the server, so the card explains the rule and
+                   offers the only thing that satisfies it. A toast would have scrolled
+                   away and left an empty table behind it. -->
+              <div class="flex flex-col items-start gap-3" data-testid="sessions-stale">
+                <p class="text-muted-foreground text-sm">{i18n.t.sessions.staleTitle}</p>
+                <p class="text-muted-foreground text-xs">{i18n.t.sessions.staleHint}</p>
+                <Button variant="outline" size="sm" disabled={busy} onclick={signOutToRefresh} data-testid="sessions-stale-signin">
+                  {i18n.t.sessions.staleAction}
+                </Button>
+              </div>
+            {:else}
             <DataTable
               columns={sessionsColumns}
               rows={sessions}
@@ -803,6 +851,7 @@
                 </Table.Cell>
               {/snippet}
             </DataTable>
+            {/if}
           </Card.Content>
         </Card.Root>
       {:else if section === "apiKeys"}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/en.json

@@ -53,6 +53,8 @@
     "email": "Email",
     "emailOrUsername": "Email or username",
     "password": "Password",
+    "confirmPassword": "Confirm password",
+    "passwordMismatch": "Passwords do not match",
     "forgot": "Forgot?",
     "signIn": "Sign in",
     "signingIn": "Signing in…",
@@ -93,6 +95,7 @@
     "requestFailed": "Request failed",
     "newTitle": "Set a new password",
     "newPassword": "New password",
+    "confirmNewPassword": "Confirm new password",
     "updatePassword": "Update password",
     "updating": "Updating…",
     "missingToken": "Missing or invalid reset token.",
@@ -480,7 +483,10 @@
     "switchAccount": "Switch",
     "switchFailed": "Failed to switch account",
     "othersRevoked": "Signed out other sessions",
-    "total": "{count} sessions"
+    "total": "{count} sessions",
+    "staleTitle": "Sign in again to see where you are signed in.",
+    "staleHint": "For your security this list is only shown to a session that signed in recently.",
+    "staleAction": "Sign in again"
   },
   "adminSessions": {
     "title": "User sessions",
@@ -528,6 +534,8 @@
     "changePassword": "Change password",
     "currentPassword": "Current password",
     "newPassword": "New password",
+    "confirmNewPassword": "Confirm new password",
+    "passwordMismatch": "Passwords do not match",
     "update": "Update password",
     "updating": "Updating…",
     "changed": "Password changed",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/ko.json

@@ -53,6 +53,8 @@
     "email": "이메일",
     "emailOrUsername": "이메일 또는 사용자명",
     "password": "비밀번호",
+    "confirmPassword": "비밀번호 확인",
+    "passwordMismatch": "비밀번호가 일치하지 않습니다",
     "forgot": "비밀번호 찾기",
     "signIn": "로그인",
     "signingIn": "로그인 중…",
@@ -92,6 +94,7 @@
     "requestFailed": "요청에 실패했습니다",
     "newTitle": "새 비밀번호 설정",
     "newPassword": "새 비밀번호",
+    "confirmNewPassword": "새 비밀번호 확인",
     "updatePassword": "비밀번호 변경",
     "updating": "변경 중…",
     "missingToken": "재설정 토큰이 없거나 유효하지 않습니다.",
@@ -480,7 +483,10 @@
     "switchAccount": "전환",
     "switchFailed": "계정 전환에 실패했습니다",
     "othersRevoked": "다른 세션을 모두 종료했습니다",
-    "total": "세션 {count}개"
+    "total": "세션 {count}개",
+    "staleTitle": "어디에서 로그인되어 있는지 보려면 다시 로그인하세요.",
+    "staleHint": "보안을 위해 이 목록은 최근에 로그인한 세션에만 보여줍니다.",
+    "staleAction": "다시 로그인"
   },
   "adminSessions": {
     "title": "사용자 세션",
@@ -528,6 +534,8 @@
     "changePassword": "비밀번호 변경",
     "currentPassword": "현재 비밀번호",
     "newPassword": "새 비밀번호",
+    "confirmNewPassword": "새 비밀번호 확인",
+    "passwordMismatch": "비밀번호가 일치하지 않습니다",
     "update": "비밀번호 변경",
     "updating": "변경 중…",
     "changed": "비밀번호를 변경했습니다",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/reset-password/+page.svelte

@@ -11,14 +11,21 @@
 
   const i18n = getI18n();
   let password = $state("");
+  let confirmPassword = $state("");
   let error = $state<string | null>(null);
   let loading = $state(false);
   const token = $derived(page.url.searchParams.get("token") ?? "");
 
   async function submit(event: SubmitEvent): Promise<void> {
     event.preventDefault();
-    loading = true;
     error = null;
+    // The token is single-use: a mistyped password here is not a retry, it is
+    // another round trip through the mailbox to get a link that still works.
+    if (password !== confirmPassword) {
+      error = i18n.t.auth.passwordMismatch;
+      return;
+    }
+    loading = true;
     const { error: authError } = await api.auth.resetPassword({ newPassword: password, token });
     loading = false;
     if (authError) {
@@ -45,6 +52,10 @@
         <Label for="password">{i18n.t.auth.newPassword}</Label>
         <Input id="password" type="password" bind:value={password} required autocomplete="new-password" />
       </div>
+      <div class="flex flex-col gap-2">
+        <Label for="confirm-password">{i18n.t.auth.confirmNewPassword}</Label>
+        <Input id="confirm-password" type="password" bind:value={confirmPassword} required autocomplete="new-password" />
+      </div>
       <Button type="submit" disabled={loading || !token}>{loading ? i18n.t.auth.updating : i18n.t.auth.updatePassword}</Button>
     </form>
   </Card.Content>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/signup/+page.svelte

@@ -18,14 +18,22 @@
   let name = $state("");
   let email = $state("");
   let password = $state("");
+  let confirmPassword = $state("");
   let error = $state<string | null>(null);
   let loading = $state(false);
   const redirectTo = (): string => safeAuthRedirect(page.url.searchParams.get("redirect"));
 
   async function submit(event: SubmitEvent): Promise<void> {
     event.preventDefault();
-    loading = true;
     error = null;
+    // Before the request, not after: a typo here costs the account. Sign-up is the
+    // one password entry with no way back — the address is not verified yet, so the
+    // reset link that would rescue it goes somewhere the user cannot read.
+    if (password !== confirmPassword) {
+      error = i18n.t.auth.passwordMismatch;
+      return;
+    }
+    loading = true;
     // callbackURL: where the verification link lands once confirmed (absolute so
     // it returns to the web app, not the API origin). Ignored when verification is off.
     const { error: authError } = await api.auth.signUp.email({
@@ -85,6 +93,10 @@
         <Label for="password">{i18n.t.auth.password}</Label>
         <Input id="password" type="password" bind:value={password} required autocomplete="new-password" />
       </div>
+      <div class="flex flex-col gap-2">
+        <Label for="confirm-password">{i18n.t.auth.confirmPassword}</Label>
+        <Input id="confirm-password" type="password" bind:value={confirmPassword} required autocomplete="new-password" />
+      </div>
       <Button type="submit" disabled={loading}>{loading ? i18n.t.auth.creating : i18n.t.auth.create}</Button>
     </form>
   </Card.Content>

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -1,6 +1,31 @@
 export type Account = { name: string; email: string; password: string };
-export const ADMIN = { name: "Admin", email: "admin@example.com", password: "Podokit3e-Str0ng!pw" };
-export const USER = { name: "Normal User", email: "user@example.com", password: "Podokit3e-Str0ng!pw" };
+
+/**
+ * The password the suite signs in with, per account.
+ *
+ * A test must never change an existing account's credentials. `seed.setup.ts` signs up
+ * idempotently and then signs in with these values, which is right on a stack the suite
+ * created — and wrong on every stack where the account already exists with a password of
+ * its own. An install bootstrapped with `admin:bootstrap` is exactly that: `admin@example.com`
+ * is a real account somebody logs in as, and resetting it to match the constant takes their
+ * login with it while the run goes green.
+ *
+ * So the constant is a DEFAULT and the environment wins:
+ *
+ * ```bash
+ * E2E_BASE_URL=https://app.example.com E2E_ADMIN_PASSWORD='…' npx playwright test …
+ * ```
+ *
+ * Without the override the run fails with `INVALID_EMAIL_OR_PASSWORD`, which is the correct
+ * outcome — a refusal, not a silent overwrite. Do not commit a real value here.
+ */
+function seedPassword(envVar: "E2E_ADMIN_PASSWORD" | "E2E_USER_PASSWORD"): string {
+  const value = process.env[envVar];
+  return value !== undefined && value.length > 0 ? value : "Podokit3e-Str0ng!pw";
+}
+
+export const ADMIN = { name: "Admin", email: "admin@example.com", password: seedPassword("E2E_ADMIN_PASSWORD") };
+export const USER = { name: "Normal User", email: "user@example.com", password: seedPassword("E2E_USER_PASSWORD") };
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
 export const userBaselineState = "playwright/.auth/user-baseline.json";

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -161,12 +161,64 @@ test("account security and sessions sub-navigation", async ({ page }) => {
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();
   await expect(page.getByLabel("Current password")).toBeVisible();
+  // `exact` because "Confirm new password" also contains "New password".
+  await expect(page.getByLabel("New password", { exact: true })).toBeVisible();
+  await expect(page.getByLabel("Confirm new password")).toBeVisible();
   await page.getByRole("button", { name: "Sessions" }).click();
   await expect(page.getByText("Active sessions")).toBeVisible();
   await expect(page.getByText("Current", { exact: true })).toBeVisible();
   await expect(page.getByRole("button", { name: "Sign out other sessions" })).toBeVisible();
 });
 
+/**
+ * ⚠ THE SUITE ALWAYS SIGNS IN FIRST, WHICH IS WHY THIS NEEDED A MOCK.
+ *
+ * better-auth guards `/list-sessions` with its freshness middleware and
+ * `session.freshAge` defaults to 24 hours, so the endpoint returns 403
+ * `SESSION_NOT_FRESH` to anyone who signed in yesterday. The seeded session is
+ * minutes old, so the test above passes for every run while the screen is broken for
+ * real users — the tab showed an empty table under an untranslated "Session is not
+ * fresh" toast. Forcing the response is the only way to reach the state the suite's
+ * own setup prevents.
+ */
+test("sessions tab explains a session that is too old to list them", async ({ page }) => {
+  await page.route("**/api/auth/list-sessions", (route) =>
+    route.fulfill({
+      status: 403,
+      contentType: "application/json",
+      body: JSON.stringify({ message: "Session is not fresh", code: "SESSION_NOT_FRESH" }),
+    }),
+  );
+
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Sessions" }).click();
+
+  const panel = page.getByTestId("sessions-stale");
+  await expect(panel).toBeVisible();
+  // The raw upstream string must not be what a person reads.
+  await expect(page.getByText("Session is not fresh")).toHaveCount(0);
+  // And the one action that satisfies the rule is offered rather than described.
+  await expect(page.getByTestId("sessions-stale-signin")).toBeVisible();
+  // Revoking is meaningless while the list is withheld, so it is not offered either.
+  await expect(page.getByRole("button", { name: "Sign out other sessions" })).toBeDisabled();
+});
+
+// Changing a password is the one form here whose mistake is silent: the change
+// succeeds, and the person finds out at the next sign-in with a password they
+// cannot reproduce.
+test("changing a password refuses a mistyped confirmation", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Security" }).click();
+  await page.getByLabel("Current password").fill(ADMIN.password);
+  await page.getByLabel("New password", { exact: true }).fill("Podokit3e-N3wStr0ng!pw");
+  await page.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pwX");
+  // The control: the message must not already be on screen, or this test would pass
+  // against a form that shows it unconditionally.
+  await expect(page.getByText("Passwords do not match")).toBeHidden();
+  await page.getByRole("button", { name: "Update password" }).click();
+  await expect(page.getByText("Passwords do not match")).toBeVisible();
+});
+
 test("account nav shows the core sections", async ({ page }) => {
   await ready(page, "/admin/account");
   await expect(page.getByRole("button", { name: "Profile", exact: true })).toBeVisible();
@@ -182,7 +234,7 @@ test("two-factor setup shows a scannable QR code when enabled", async ({ page })
   await expect(page.getByRole("button", { name: "Enable", exact: true })).toBeVisible();
   // Start setup (password + Enable) and confirm the QR renders. Stop before
   // verifying so 2FA stays inactive and the shared admin session keeps working.
-  await page.locator("#tf-on-pw").fill("Podokit3e-Str0ng!pw");
+  await page.locator("#tf-on-pw").fill(ADMIN.password);
   await page.getByRole("button", { name: "Enable", exact: true }).click();
   await expect(page.getByRole("img", { name: "TOTP QR code" })).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -47,6 +47,8 @@ test("authentication return targets reject external and recursive redirects", ()
 test("signup page renders", async ({ page }) => {
   await page.goto("/signup");
   await expect(page.getByLabel("Name")).toBeVisible();
+  await expect(page.getByLabel("Password", { exact: true })).toBeVisible();
+  await expect(page.getByLabel("Confirm password")).toBeVisible();
   await expect(page.getByRole("button", { name: "Create account" })).toBeVisible();
 });
 
@@ -120,8 +122,31 @@ test("signup creates an account and enters the app @smoke", async ({ page }) =>
   const email = `signup-${Date.now()}@example.com`;
   await page.getByLabel("Name").fill("New User");
   await page.getByLabel("Email").fill(email);
-  await page.getByLabel("Password").fill("Podokit3e-Str0ng!pw");
+  // `exact` because "Confirm password" also contains "Password".
+  await page.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
+  await page.getByLabel("Confirm password").fill("Podokit3e-Str0ng!pw");
   await page.getByRole("button", { name: "Create account" }).click();
   // Verification off → straight into the app; on → the verify-email page.
   await expect(page).toHaveURL((url) => url.pathname === "/" || url.pathname === "/verify-email");
 });
+
+// A typo here is not recoverable the way a mistyped login is: the address has not
+// been verified, so the reset link that would rescue the account is sent to an
+// inbox the person cannot open.
+test("signup refuses a mistyped password confirmation", async ({ page }) => {
+  await ready(page, "/signup");
+  const email = `signup-mismatch-${Date.now()}@example.com`;
+  await page.getByLabel("Name").fill("New User");
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
+  await page.getByLabel("Confirm password").fill("Podokit3e-Str0ng!pwX");
+  await page.getByRole("button", { name: "Create account" }).click();
+  await expect(page.getByText("Passwords do not match")).toBeVisible();
+  // Still on the form, and no account was created for that address.
+  await expect(page).toHaveURL(/\/signup/);
+  const probe = await page.context().request.post("/api/auth/sign-in/email", {
+    data: { email, password: "Podokit3e-Str0ng!pw" },
+    headers: { origin: new URL(page.url()).origin },
+  });
+  expect(probe.ok()).toBeFalsy();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -31,7 +31,16 @@ test("forgot password: request, open the emailed link, set a new password, sign
   await page.goto(await waitForLink(email));
   await page.waitForLoadState("load");
   await page.waitForTimeout(400);
-  await page.getByLabel("New password").fill("Podokit3e-N3wStr0ng!pw");
+  // `exact` because "Confirm new password" also contains "New password".
+  await page.getByLabel("New password", { exact: true }).fill("Podokit3e-N3wStr0ng!pw");
+  // A mismatch is refused, and the single-use token survives it: the same page
+  // still accepts the corrected pair below.
+  await page.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pwX");
+  await page.getByRole("button", { name: "Update password" }).click();
+  await expect(page.getByText("Passwords do not match")).toBeVisible();
+  await expect(page).not.toHaveURL(/\/login/);
+
+  await page.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pw");
   await page.getByRole("button", { name: "Update password" }).click();
   await expect(page).toHaveURL(/\/login/);
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/two-factor.ui.spec.ts

@@ -1,5 +1,5 @@
 import { expect, test, type Page } from "@playwright/test";
-import { anonState } from "../helpers/accounts";
+import { ADMIN, USER, anonState } from "../helpers/accounts";
 import { totpCode } from "../helpers/totp";
 
 test.use({ storageState: anonState });
@@ -59,7 +59,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await admin.get("/api/account/capabilities")).json();
   test.skip(!caps?.twoFactor, "two-factor not enabled");
-  await admin.post("/api/auth/sign-in/email", { data: { email: "admin@example.com", password: "Podokit3e-Str0ng!pw" } });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
 
   const email = `rq-ui-${Date.now()}@example.com`;
   const pw = "Podokit3e-Str0ng!pw";
@@ -97,7 +97,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
     await admin.put("/api/account/settings", { data: { require2fa: false } });
     await expect(async () => {
       const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-      await probe.post("/api/auth/sign-in/email", { data: { email: "user@example.com", password: "Podokit3e-Str0ng!pw" } });
+      await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
       const status = (await probe.get("/api/account/me")).status();
       await probe.dispose();
       expect(status).toBe(200);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {