@podosoft/podokit 0.17.2 → 0.17.4

package/dist/dev.js

@@ -156,10 +156,15 @@ function writeRuntimeFiles(runtime) {
     (0, node_fs_1.writeFileSync)(runtime.runtimeComposePath, renderRuntimeCompose(runtime));
 }
 function registerRoute(runtime) {
-    const collision = activeEntries().find((entry) => entry.hostname === runtime.config.hostname && entry.projectRoot !== runtime.projectRoot);
+    const entries = activeEntries();
+    const collision = entries.find((entry) => entry.hostname === runtime.config.hostname && entry.projectRoot !== runtime.projectRoot);
     if (collision) {
         throw new Error(`Development hostname ${runtime.config.hostname} is already registered by ${collision.projectRoot}. Change .podokit/dev.json or run podo dev down there.`);
     }
+    for (const stale of entries.filter((entry) => entry.projectRoot === runtime.projectRoot && entry.routeId !== runtime.routeId)) {
+        (0, node_fs_1.rmSync)((0, node_path_1.join)(registryDirectory(), `${stale.routeId}.json`), { force: true });
+        (0, node_fs_1.rmSync)((0, node_path_1.join)(routesDirectory(), `${stale.routeId}.yml`), { force: true });
+    }
     (0, node_fs_1.mkdirSync)(registryDirectory(), { recursive: true });
     (0, node_fs_1.mkdirSync)(routesDirectory(), { recursive: true });
     (0, node_fs_1.writeFileSync)(routePath(runtime), renderRoute(runtime));
@@ -307,6 +312,23 @@ function runDevCommand(projectRoot, action, args, runner = defaultRunner) {
         }
         return;
     }
+    if (action === "up") {
+        ensureNetwork(runner);
+        registerRoute(runtime);
+        try {
+            ensureGateway(runner);
+            process.stdout.write(`Development URL: http://${runtime.config.hostname}\n`);
+            if (runtime.config.publicUrl)
+                process.stdout.write(`Public OAuth URL: ${runtime.config.publicUrl}\n`);
+            runCompose(runtime, composeCommand("up", args, profiles), runner);
+        }
+        catch (error) {
+            unregisterRoute(runtime);
+            stopGatewayWhenUnused(runner);
+            throw error;
+        }
+        return;
+    }
     if (action === "down") {
         runCompose(runtime, composeCommand("down", args, profiles), runner);
         unregisterRoute(runtime);
@@ -317,5 +339,5 @@ function runDevCommand(projectRoot, action, args, runner = defaultRunner) {
         runCompose(runtime, composeCommand(action, args, profiles), runner);
         return;
     }
-    throw new Error("Usage: podo dev <watch|exec|logs|ps|down|url> [docker compose options]");
+    throw new Error("Usage: podo dev <watch|up|exec|logs|ps|down|url> [docker compose options]");
 }

package/dist/templates/fullstack-nest-svelte/README.md

@@ -27,6 +27,7 @@ Run lifecycle and container commands from a second terminal:
 
 ```bash
 npx @podosoft/podokit dev url
+npx @podosoft/podokit dev up -d # detached stack without source watching
 npx @podosoft/podokit dev ps
 npx @podosoft/podokit dev logs
 npx @podosoft/podokit dev exec api npm run migration:run -w {{projectName}}-api
@@ -35,6 +36,8 @@ npx @podosoft/podokit dev down
 
 `dev watch` reads `.podokit/manifest.json` and automatically activates `cache`,
 `storage`, and `queue` when installed modules require Redis, MinIO, or a worker.
+`dev up` uses the same shared gateway and module profiles without keeping Compose
+Watch attached.
 You can still activate an additional Compose profile explicitly:
 
 ```bash

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/account/+page.server.ts

@@ -1,4 +1,8 @@
 import { loadAccountData } from "$lib/account-data.server";
+import { loadProtectedLayout } from "$lib/server/protected-layout";
 import type { PageServerLoad } from "./$types";
 
-export const load: PageServerLoad = ({ locals, fetch }) => loadAccountData(locals, fetch);
+export const load: PageServerLoad = async ({ locals, fetch }) => {
+  await loadProtectedLayout({ locals, fetch });
+  return loadAccountData(locals, fetch);
+};

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/setup-2fa/+page.server.ts

@@ -8,6 +8,6 @@ export const load: PageServerLoad = ({ locals }) => {
   requireBackendAvailable(locals);
   if (!locals.user) redirect(302, "/login");
   const user = locals.user as App.Locals["user"] & { twoFactorEnabled?: boolean };
-  if (user.twoFactorEnabled) redirect(302, "/admin");
+  if (user.twoFactorEnabled) redirect(302, "/account");
   return { user: locals.user };
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/setup-2fa/+page.svelte

@@ -51,7 +51,7 @@
       error = i18n.t.auth.twoFactorInvalidCode;
       return;
     }
-    await goto("/admin", { invalidateAll: true });
+    await goto("/account", { invalidateAll: true });
   }
 
   function downloadCodes(): void {

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-flows.ui.spec.ts

@@ -15,11 +15,13 @@ async function loginFresh(page: import("@playwright/test").Page, playwright: imp
   const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   await api.post("/api/auth/sign-up/email", { data: { email, password: PW, name: "Acc" } });
   await api.dispose();
-  await ready(page, `/login?redirect=${encodeURIComponent("/admin/account")}`);
+  await ready(page, `/login?redirect=${encodeURIComponent("/account")}`);
   await page.locator("#email").fill(email);
   await page.locator("#password").fill(PW);
   await page.getByRole("button", { name: "Sign in", exact: true }).click();
-  await expect(page).toHaveURL(/\/admin\/account/);
+  await expect(page).toHaveURL((url) => url.pathname === "/account");
+  await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
+  await expect(page.getByLabel("Name", { exact: true })).toBeVisible();
 }
 
 test("account: register and verify a phone number", async ({ page, playwright }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/two-factor.ui.spec.ts

@@ -15,6 +15,12 @@ async function openHydratedLogin(page: Page, redirect?: string): Promise<void> {
   await page.waitForLoadState("networkidle");
 }
 
+async function expectAccountPage(page: Page): Promise<void> {
+  await expect(page).toHaveURL((url) => url.pathname === "/account");
+  await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
+  await expect(page.getByLabel("Name", { exact: true })).toBeVisible();
+}
+
 // A disposable account (never the shared admin/user) so enabling 2FA here can't
 // invalidate the seeded sessions the other auth specs rely on.
 test("two-factor: sign in with a backup code from the login page", async ({ page, playwright }) => {
@@ -31,7 +37,7 @@ test("two-factor: sign in with a backup code from the login page", async ({ page
   await api.dispose();
 
   // Password sign-in hands off to the second-factor step (no session yet).
-  await openHydratedLogin(page, "/admin/account");
+  await openHydratedLogin(page, "/account");
   await page.getByLabel("Email").fill(email);
   await page.getByLabel("Password").fill(pw);
   await page.getByRole("button", { name: "Sign in", exact: true }).click();
@@ -52,7 +58,30 @@ test("two-factor: sign in with a backup code from the login page", async ({ page
   // The real code completes the login.
   await page.getByLabel("Backup code").fill(backupCode);
   await page.getByRole("button", { name: "Verify", exact: true }).click();
-  await expect(page).toHaveURL(/\/admin\/account/);
+  await expectAccountPage(page);
+});
+
+test("two-factor: sign in with an authenticator code from the login page", async ({ page, playwright }) => {
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await api.get("/api/account/capabilities")).json();
+  test.skip(!caps?.twoFactor, "two-factor not enabled");
+
+  const email = `tf-totp-ui-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await api.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "UI" } });
+  const enable = await (await api.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+  await api.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+  await api.dispose();
+
+  await openHydratedLogin(page, "/account");
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Password").fill(pw);
+  await page.getByRole("button", { name: "Sign in", exact: true }).click();
+  await expect(page.getByTestId("two-factor-step")).toBeVisible();
+  await page.getByLabel("Authentication code").fill(totpCode(enable.totpURI));
+  await page.getByRole("button", { name: "Verify", exact: true }).click();
+
+  await expectAccountPage(page);
 });
 
 test("require-2fa: a new sign-up is forced through the enrolment page", async ({ page, playwright }) => {
@@ -74,7 +103,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
     await probe.dispose();
 
     // Signing in toward a protected route lands on the mandatory enrolment page.
-    await openHydratedLogin(page, "/admin");
+    await openHydratedLogin(page, "/account");
     await page.getByLabel("Email").fill(email);
     await page.getByLabel("Password").fill(pw);
     await page.getByRole("button", { name: "Sign in", exact: true }).click();
@@ -91,8 +120,12 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
     await page.getByLabel("3. Enter the 6-digit code").fill(totpCode(uri));
     await page.getByRole("button", { name: "Activate and continue" }).click();
 
-    // Enrolled → the gate lets them into the app (no longer bounced to /setup-2fa).
-    await expect(page).toHaveURL(/\/admin/);
+    // Enrolled → the gate lets the regular user into their account page.
+    await expectAccountPage(page);
+
+    // An enrolled user who revisits setup is returned to the same non-admin page.
+    await page.goto("/setup-2fa");
+    await expectAccountPage(page);
   } finally {
     await admin.put("/api/account/settings", { data: { require2fa: false } });
     await expect(async () => {
@@ -119,14 +152,14 @@ test("account: regenerate backup codes shows a fresh set", async ({ page, playwr
   await api.dispose();
 
   // Sign in (backup-code path) straight to the account page.
-  await openHydratedLogin(page, "/admin/account");
+  await openHydratedLogin(page, "/account");
   await page.getByLabel("Email").fill(email);
   await page.getByLabel("Password").fill(pw);
   await page.getByRole("button", { name: "Sign in", exact: true }).click();
   await page.getByRole("button", { name: "Use a backup code instead" }).click();
   await page.getByLabel("Backup code").fill(backupCode);
   await page.getByRole("button", { name: "Verify", exact: true }).click();
-  await expect(page).toHaveURL(/\/admin\/account/);
+  await expectAccountPage(page);
 
   // Security → regenerate backup codes → a fresh set is shown.
   await page.getByRole("button", { name: "Security" }).click();

package/dist/templates/todo/README.md

@@ -28,6 +28,7 @@ In a second terminal, apply the included Todo migration and use the lifecycle he
 ```bash
 npx @podosoft/podokit dev exec api npm run migration:run -w {{projectName}}-api
 npx @podosoft/podokit dev url
+npx @podosoft/podokit dev up -d # detached stack without source watching
 npx @podosoft/podokit dev ps
 npx @podosoft/podokit dev logs
 npx @podosoft/podokit dev down
@@ -35,6 +36,8 @@ npx @podosoft/podokit dev down
 
 `dev watch` reads `.podokit/manifest.json` and automatically activates `cache`,
 `storage`, and `queue` when installed modules require Redis, MinIO, or a worker.
+`dev up` uses the same shared gateway and module profiles without keeping Compose
+Watch attached.
 You can still activate an additional Compose profile explicitly:
 
 ```bash

package/dist/update.js

@@ -151,6 +151,14 @@ function planUpdate(projectRoot, templatesDir) {
         const classified = (0, lockfile_1.classifyTier)(path, newText ?? disk ?? "", ownedGlobs, managedOverrides);
         const tier = controlledByTarget ? classified : locked?.tier ?? classified;
         if (tier === "owned") {
+            // A file introduced by a newer template or module has no previous lock
+            // entry. Seed it once when the application has not already claimed that
+            // path; subsequent edits or deletions stay protected by the recorded
+            // owned entry.
+            if (!locked && disk === null && newText !== null) {
+                changes.push({ path, tier, action: "add", note: "new owned seed in this version" });
+                continue;
+            }
             const explicitlyOwned = ownedGlobs.some((glob) => !glob.includes("*") && (0, lockfile_1.matchGlob)(path, glob));
             changes.push({
                 path,
@@ -283,6 +291,18 @@ function updatedFilesLock(projectRoot, newTree, previous, ownedGlobs, managedOve
             delete next.files[path];
         }
     }
+    // Keep a tombstone for an owned seed that the application deleted or moved.
+    // Without the previous entry, the next update would mistake the missing path
+    // for a newly introduced seed and recreate it.
+    for (const [path, entry] of Object.entries(previous.files)) {
+        if (entry.tier !== "owned" || next.files[path])
+            continue;
+        const newText = treeText(newTree, path);
+        if (newText !== null &&
+            (0, lockfile_1.classifyTier)(path, newText, ownedGlobs, managedOverrides) === "owned") {
+            next.files[path] = entry;
+        }
+    }
     return next;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.17.2",
+  "version": "0.17.4",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {