@podosoft/podokit 0.17.1 → 0.17.2

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -384,6 +384,8 @@
   }
 
   // Sessions — this user's own devices
+  /** better-auth's code for "this session is older than `session.freshAge`". */
+  const SESSION_NOT_FRESH = "SESSION_NOT_FRESH";
   type Session = { id: string; token: string; userAgent?: string | null; ipAddress?: string | null; createdAt: string | Date };
   const PAGE_SIZE = DEFAULT_PAGE_SIZE;
   let sessions = $state<Session[]>([]);
@@ -397,8 +399,30 @@
     { key: "status", label: i18n.t.sessions.status },
     { key: "actions", label: "", class: "w-10" },
   ];
+  /**
+   * True when the session is too old to list sessions.
+   *
+   * better-auth guards `/list-sessions` (and `/unlink-account`) with its freshness
+   * middleware, and `session.freshAge` defaults to 24 hours. So for anyone who signed
+   * in yesterday — which is most people, most of the time — this call returns 403
+   * `SESSION_NOT_FRESH`. It is not a failure to report as one: the tab has to say what
+   * happened and what to do, or it is a blank table under an untranslated toast.
+   */
+  let sessionsStale = $state(false);
+  async function signOutToRefresh(): Promise<void> {
+    busy = true;
+    await api.auth.signOut();
+    await goto("/login", { invalidateAll: true });
+  }
   async function loadSessions(): Promise<void> {
     const { data: res, error } = await api.auth.listSessions();
+    if (error?.code === SESSION_NOT_FRESH) {
+      // Explained in the panel below, not thrown at the corner of the screen.
+      sessionsStale = true;
+      sessions = [];
+      return;
+    }
+    sessionsStale = false;
     if (error) return void toast.error(error.message ?? i18n.t.sessions.loadFailed);
     // Current session first (users expect it on top; also keeps it on page 1),
     // then newest to oldest.
@@ -791,9 +815,21 @@
         <Card.Root>
           <Card.Header class="flex flex-row items-center justify-between gap-2">
             <Card.Title>{i18n.t.sessions.title}</Card.Title>
-            <Button variant="outline" size="sm" disabled={busy || sessions.length <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
+            <Button variant="outline" size="sm" disabled={busy || sessionsStale || sessions.length <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
           </Card.Header>
           <Card.Content>
+            {#if sessionsStale}
+              <!-- The list is withheld by the server, so the card explains the rule and
+                   offers the only thing that satisfies it. A toast would have scrolled
+                   away and left an empty table behind it. -->
+              <div class="flex flex-col items-start gap-3" data-testid="sessions-stale">
+                <p class="text-muted-foreground text-sm">{i18n.t.sessions.staleTitle}</p>
+                <p class="text-muted-foreground text-xs">{i18n.t.sessions.staleHint}</p>
+                <Button variant="outline" size="sm" disabled={busy} onclick={signOutToRefresh} data-testid="sessions-stale-signin">
+                  {i18n.t.sessions.staleAction}
+                </Button>
+              </div>
+            {:else}
             <DataTable
               columns={sessionsColumns}
               rows={sessions}
@@ -815,6 +851,7 @@
                 </Table.Cell>
               {/snippet}
             </DataTable>
+            {/if}
           </Card.Content>
         </Card.Root>
       {:else if section === "apiKeys"}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/en.json

@@ -483,7 +483,10 @@
     "switchAccount": "Switch",
     "switchFailed": "Failed to switch account",
     "othersRevoked": "Signed out other sessions",
-    "total": "{count} sessions"
+    "total": "{count} sessions",
+    "staleTitle": "Sign in again to see where you are signed in.",
+    "staleHint": "For your security this list is only shown to a session that signed in recently.",
+    "staleAction": "Sign in again"
   },
   "adminSessions": {
     "title": "User sessions",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/ko.json

@@ -483,7 +483,10 @@
     "switchAccount": "전환",
     "switchFailed": "계정 전환에 실패했습니다",
     "othersRevoked": "다른 세션을 모두 종료했습니다",
-    "total": "세션 {count}개"
+    "total": "세션 {count}개",
+    "staleTitle": "어디에서 로그인되어 있는지 보려면 다시 로그인하세요.",
+    "staleHint": "보안을 위해 이 목록은 최근에 로그인한 세션에만 보여줍니다.",
+    "staleAction": "다시 로그인"
   },
   "adminSessions": {
     "title": "사용자 세션",

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -170,6 +170,39 @@ test("account security and sessions sub-navigation", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Sign out other sessions" })).toBeVisible();
 });
 
+/**
+ * ⚠ THE SUITE ALWAYS SIGNS IN FIRST, WHICH IS WHY THIS NEEDED A MOCK.
+ *
+ * better-auth guards `/list-sessions` with its freshness middleware and
+ * `session.freshAge` defaults to 24 hours, so the endpoint returns 403
+ * `SESSION_NOT_FRESH` to anyone who signed in yesterday. The seeded session is
+ * minutes old, so the test above passes for every run while the screen is broken for
+ * real users — the tab showed an empty table under an untranslated "Session is not
+ * fresh" toast. Forcing the response is the only way to reach the state the suite's
+ * own setup prevents.
+ */
+test("sessions tab explains a session that is too old to list them", async ({ page }) => {
+  await page.route("**/api/auth/list-sessions", (route) =>
+    route.fulfill({
+      status: 403,
+      contentType: "application/json",
+      body: JSON.stringify({ message: "Session is not fresh", code: "SESSION_NOT_FRESH" }),
+    }),
+  );
+
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Sessions" }).click();
+
+  const panel = page.getByTestId("sessions-stale");
+  await expect(panel).toBeVisible();
+  // The raw upstream string must not be what a person reads.
+  await expect(page.getByText("Session is not fresh")).toHaveCount(0);
+  // And the one action that satisfies the rule is offered rather than described.
+  await expect(page.getByTestId("sessions-stale-signin")).toBeVisible();
+  // Revoking is meaningless while the list is withheld, so it is not offered either.
+  await expect(page.getByRole("button", { name: "Sign out other sessions" })).toBeDisabled();
+});
+
 // Changing a password is the one form here whose mistake is silent: the change
 // succeeds, and the person finds out at the next sign-in with a password they
 // cannot reproduce.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {