@podosoft/podokit 0.3.0 → 0.5.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.svelte

@@ -0,0 +1,181 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { page } from "$app/state";
+  import { Button } from "$lib/components/ui/button";
+  import { Input } from "$lib/components/ui/input";
+  import { Label } from "$lib/components/ui/label";
+  import * as Card from "$lib/components/ui/card";
+  import * as Alert from "$lib/components/ui/alert";
+  import { api } from "$lib/api";
+  import { getI18n } from "$lib/i18n";
+
+  import type { PageData } from "./$types";
+
+  let { data }: { data: PageData } = $props();
+  const i18n = getI18n();
+  let email = $state("");
+  let password = $state("");
+  let error = $state<string | null>(null);
+  let unverified = $state(false);
+  let loading = $state(false);
+
+  // Passwordless sign-in, shown only when the server enabled the magic-link plugin.
+  const magicLinkEnabled = $derived(data.capabilities?.magicLink ?? false);
+  let magicLoading = $state(false);
+  let magicSent = $state(false);
+  async function sendMagicLink(): Promise<void> {
+    if (!email) {
+      error = i18n.t.auth.magicLinkNeedsEmail;
+      return;
+    }
+    magicLoading = true;
+    error = null;
+    const { error: authError } = await api.auth.signIn.magicLink({
+      email,
+      callbackURL: page.url.searchParams.get("redirect") ?? "/admin",
+    });
+    magicLoading = false;
+    if (authError) {
+      error = authError.message ?? i18n.t.auth.signInFailed;
+      return;
+    }
+    magicSent = true;
+  }
+
+  // Passwordless sign-in with an emailed one-time code (two steps: send, verify).
+  const usernameEnabled = $derived(data.capabilities?.username ?? false);
+  const emailOtpEnabled = $derived(data.capabilities?.emailOtp ?? false);
+  let otpSent = $state(false);
+  let otpCode = $state("");
+  let otpLoading = $state(false);
+  async function sendOtp(): Promise<void> {
+    if (!email) {
+      error = i18n.t.auth.magicLinkNeedsEmail;
+      return;
+    }
+    otpLoading = true;
+    error = null;
+    const { error: authError } = await api.auth.emailOtp.sendVerificationOtp({ email, type: "sign-in" });
+    otpLoading = false;
+    if (authError) {
+      error = authError.message ?? i18n.t.auth.signInFailed;
+      return;
+    }
+    otpSent = true;
+  }
+  async function verifyOtp(): Promise<void> {
+    otpLoading = true;
+    error = null;
+    const { error: authError } = await api.auth.signIn.emailOtp({ email, otp: otpCode });
+    otpLoading = false;
+    if (authError) {
+      error = authError.message ?? i18n.t.auth.signInFailed;
+      return;
+    }
+    await goto(page.url.searchParams.get("redirect") ?? "/admin", { invalidateAll: true });
+  }
+
+  // Passwordless sign-in with a registered passkey (WebAuthn), shown when enabled.
+  const passkeyEnabled = $derived(data.capabilities?.passkey ?? false);
+  let passkeyLoading = $state(false);
+  async function signInWithPasskey(): Promise<void> {
+    passkeyLoading = true;
+    error = null;
+    const res = await api.auth.signIn.passkey();
+    passkeyLoading = false;
+    if (res?.error) {
+      error = res.error.message ?? i18n.t.auth.signInFailed;
+      return;
+    }
+    await goto(page.url.searchParams.get("redirect") ?? "/admin", { invalidateAll: true });
+  }
+
+  async function submit(event: SubmitEvent): Promise<void> {
+    event.preventDefault();
+    loading = true;
+    error = null;
+    unverified = false;
+    // With the username plugin on, an identifier without "@" is treated as a username.
+    const asUsername = usernameEnabled && !email.includes("@");
+    const { error: authError } = asUsername
+      ? await api.auth.signIn.username({ username: email, password })
+      : await api.auth.signIn.email({ email, password });
+    loading = false;
+    if (authError) {
+      // Surface an unverified address with a path to a fresh verification link.
+      unverified = authError.code === "EMAIL_NOT_VERIFIED";
+      error = unverified ? i18n.t.auth.emailNotVerified : (authError.message ?? i18n.t.auth.signInFailed);
+      return;
+    }
+    await goto(page.url.searchParams.get("redirect") ?? "/admin", { invalidateAll: true });
+  }
+</script>
+
+<Card.Root>
+  <Card.Header>
+    <Card.Title>{i18n.t.auth.signInTitle}</Card.Title>
+    <Card.Description>{i18n.t.auth.signInDesc}</Card.Description>
+  </Card.Header>
+  <Card.Content>
+    <form class="flex flex-col gap-4" onsubmit={submit}>
+      {#if error}
+        <Alert.Root variant="destructive">
+          <Alert.Description>
+            {error}
+            {#if unverified}
+              <a href="/verify-email?email={encodeURIComponent(email)}" class="font-medium underline">{i18n.t.auth.resendVerification}</a>
+            {/if}
+          </Alert.Description>
+        </Alert.Root>
+      {/if}
+      <div class="flex flex-col gap-2">
+        <Label for="email">{usernameEnabled ? i18n.t.auth.emailOrUsername : i18n.t.auth.email}</Label>
+        <Input id="email" type={usernameEnabled ? "text" : "email"} bind:value={email} required autocomplete="username" />
+      </div>
+      <div class="flex flex-col gap-2">
+        <div class="flex items-center justify-between">
+          <Label for="password">{i18n.t.auth.password}</Label>
+          <a href="/forgot-password" class="text-muted-foreground text-xs hover:underline">{i18n.t.auth.forgot}</a>
+        </div>
+        <Input id="password" type="password" bind:value={password} required autocomplete="current-password" />
+      </div>
+      <Button type="submit" disabled={loading}>{loading ? i18n.t.auth.signingIn : i18n.t.auth.signIn}</Button>
+    </form>
+    {#if magicLinkEnabled || emailOtpEnabled || passkeyEnabled}
+      <div class="mt-4 flex flex-col gap-3 border-t pt-4">
+        {#if passkeyEnabled}
+          <Button type="button" variant="outline" class="w-full" disabled={passkeyLoading} onclick={signInWithPasskey}>
+            {passkeyLoading ? i18n.t.auth.signingIn : i18n.t.auth.passkeyButton}
+          </Button>
+        {/if}
+        {#if magicLinkEnabled}
+          {#if magicSent}
+            <p class="text-muted-foreground text-sm" data-testid="magic-link-sent">{i18n.t.auth.magicLinkSent}</p>
+          {:else}
+            <Button type="button" variant="outline" class="w-full" disabled={magicLoading} onclick={sendMagicLink}>
+              {magicLoading ? i18n.t.auth.sending : i18n.t.auth.magicLinkButton}
+            </Button>
+          {/if}
+        {/if}
+        {#if emailOtpEnabled}
+          {#if otpSent}
+            <div class="flex flex-col gap-2">
+              <Label for="otp">{i18n.t.auth.otpCode}</Label>
+              <Input id="otp" bind:value={otpCode} inputmode="numeric" autocomplete="one-time-code" />
+              <Button type="button" class="w-full" disabled={otpLoading || !otpCode} onclick={verifyOtp}>
+                {otpLoading ? i18n.t.auth.signingIn : i18n.t.auth.otpVerify}
+              </Button>
+            </div>
+          {:else}
+            <Button type="button" variant="outline" class="w-full" disabled={otpLoading} onclick={sendOtp}>
+              {otpLoading ? i18n.t.auth.sending : i18n.t.auth.otpButton}
+            </Button>
+          {/if}
+        {/if}
+      </div>
+    {/if}
+  </Card.Content>
+  <Card.Footer class="justify-center">
+    <p class="text-muted-foreground text-sm">{i18n.t.auth.noAccount} <a href="/signup" class="text-foreground hover:underline">{i18n.t.auth.signUp}</a></p>
+  </Card.Footer>
+</Card.Root>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/reset-password/+page.svelte

@@ -0,0 +1,51 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { page } from "$app/state";
+  import { Button } from "$lib/components/ui/button";
+  import { Input } from "$lib/components/ui/input";
+  import { Label } from "$lib/components/ui/label";
+  import * as Card from "$lib/components/ui/card";
+  import * as Alert from "$lib/components/ui/alert";
+  import { api } from "$lib/api";
+  import { getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+  let password = $state("");
+  let error = $state<string | null>(null);
+  let loading = $state(false);
+  const token = $derived(page.url.searchParams.get("token") ?? "");
+
+  async function submit(event: SubmitEvent): Promise<void> {
+    event.preventDefault();
+    loading = true;
+    error = null;
+    const { error: authError } = await api.auth.resetPassword({ newPassword: password, token });
+    loading = false;
+    if (authError) {
+      error = authError.message ?? i18n.t.auth.resetFailed;
+      return;
+    }
+    await goto("/login", { invalidateAll: true });
+  }
+</script>
+
+<Card.Root>
+  <Card.Header>
+    <Card.Title>{i18n.t.auth.newTitle}</Card.Title>
+  </Card.Header>
+  <Card.Content>
+    <form class="flex flex-col gap-4" onsubmit={submit}>
+      {#if error}
+        <Alert.Root variant="destructive"><Alert.Description>{error}</Alert.Description></Alert.Root>
+      {/if}
+      {#if !token}
+        <Alert.Root variant="destructive"><Alert.Description>{i18n.t.auth.missingToken}</Alert.Description></Alert.Root>
+      {/if}
+      <div class="flex flex-col gap-2">
+        <Label for="password">{i18n.t.auth.newPassword}</Label>
+        <Input id="password" type="password" bind:value={password} required autocomplete="new-password" />
+      </div>
+      <Button type="submit" disabled={loading || !token}>{loading ? i18n.t.auth.updating : i18n.t.auth.updatePassword}</Button>
+    </form>
+  </Card.Content>
+</Card.Root>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/signup/+page.svelte

@@ -0,0 +1,76 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { page } from "$app/state";
+  import { Button } from "$lib/components/ui/button";
+  import { Input } from "$lib/components/ui/input";
+  import { Label } from "$lib/components/ui/label";
+  import * as Card from "$lib/components/ui/card";
+  import * as Alert from "$lib/components/ui/alert";
+  import { api } from "$lib/api";
+  import { getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+  let name = $state("");
+  let email = $state("");
+  let password = $state("");
+  let error = $state<string | null>(null);
+  let loading = $state(false);
+
+  async function submit(event: SubmitEvent): Promise<void> {
+    event.preventDefault();
+    loading = true;
+    error = null;
+    // callbackURL: where the verification link lands once confirmed (absolute so
+    // it returns to the web app, not the API origin). Ignored when verification is off.
+    const { error: authError } = await api.auth.signUp.email({
+      name,
+      email,
+      password,
+      callbackURL: `${page.url.origin}/admin`,
+    });
+    if (authError) {
+      loading = false;
+      error = authError.message ?? i18n.t.auth.signUpFailed;
+      return;
+    }
+    // When email verification is required, sign-up creates no session — send the
+    // user to confirm their address instead of into the (guarded) app.
+    const { data: session } = await api.auth.getSession();
+    loading = false;
+    if (!session?.session) {
+      await goto(`/verify-email?email=${encodeURIComponent(email)}`);
+      return;
+    }
+    await goto("/admin", { invalidateAll: true });
+  }
+</script>
+
+<Card.Root>
+  <Card.Header>
+    <Card.Title>{i18n.t.auth.createTitle}</Card.Title>
+    <Card.Description>{i18n.t.auth.createDesc}</Card.Description>
+  </Card.Header>
+  <Card.Content>
+    <form class="flex flex-col gap-4" onsubmit={submit}>
+      {#if error}
+        <Alert.Root variant="destructive"><Alert.Description>{error}</Alert.Description></Alert.Root>
+      {/if}
+      <div class="flex flex-col gap-2">
+        <Label for="name">{i18n.t.auth.name}</Label>
+        <Input id="name" bind:value={name} required autocomplete="name" />
+      </div>
+      <div class="flex flex-col gap-2">
+        <Label for="email">{i18n.t.auth.email}</Label>
+        <Input id="email" type="email" bind:value={email} required autocomplete="email" />
+      </div>
+      <div class="flex flex-col gap-2">
+        <Label for="password">{i18n.t.auth.password}</Label>
+        <Input id="password" type="password" bind:value={password} required autocomplete="new-password" />
+      </div>
+      <Button type="submit" disabled={loading}>{loading ? i18n.t.auth.creating : i18n.t.auth.create}</Button>
+    </form>
+  </Card.Content>
+  <Card.Footer class="justify-center">
+    <p class="text-muted-foreground text-sm">{i18n.t.auth.haveAccount} <a href="/login" class="text-foreground hover:underline">{i18n.t.auth.signIn}</a></p>
+  </Card.Footer>
+</Card.Root>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/verify-email/+page.svelte

@@ -0,0 +1,63 @@
+<script lang="ts">
+  import { page } from "$app/state";
+  import { Button } from "$lib/components/ui/button";
+  import { Input } from "$lib/components/ui/input";
+  import { Label } from "$lib/components/ui/label";
+  import * as Card from "$lib/components/ui/card";
+  import * as Alert from "$lib/components/ui/alert";
+  import { api } from "$lib/api";
+  import { fmt, getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+  // ?email from the sign-up redirect; ?error when the API bounces a bad/expired link here.
+  let email = $state(page.url.searchParams.get("email") ?? "");
+  const linkError = $derived(page.url.searchParams.get("error"));
+  let sent = $state(false);
+  let error = $state<string | null>(null);
+  let loading = $state(false);
+
+  async function resend(event: SubmitEvent): Promise<void> {
+    event.preventDefault();
+    loading = true;
+    error = null;
+    const { error: authError } = await api.auth.sendVerificationEmail({
+      email,
+      callbackURL: `${page.url.origin}/admin`,
+    });
+    loading = false;
+    if (authError) {
+      error = authError.message ?? i18n.t.auth.requestFailed;
+      return;
+    }
+    sent = true;
+  }
+</script>
+
+<Card.Root>
+  <Card.Header>
+    <Card.Title>{i18n.t.auth.verifyTitle}</Card.Title>
+    <Card.Description>{email ? fmt(i18n.t.auth.verifyDesc, { email }) : i18n.t.auth.verifyDescNoEmail}</Card.Description>
+  </Card.Header>
+  <Card.Content>
+    {#if linkError}
+      <Alert.Root variant="destructive" class="mb-4"><Alert.Description>{i18n.t.auth.verifyLinkError}</Alert.Description></Alert.Root>
+    {/if}
+    {#if sent}
+      <Alert.Root><Alert.Description>{i18n.t.auth.verifySent}</Alert.Description></Alert.Root>
+    {:else}
+      <form class="flex flex-col gap-4" onsubmit={resend}>
+        {#if error}
+          <Alert.Root variant="destructive"><Alert.Description>{error}</Alert.Description></Alert.Root>
+        {/if}
+        <div class="flex flex-col gap-2">
+          <Label for="email">{i18n.t.auth.email}</Label>
+          <Input id="email" type="email" bind:value={email} required autocomplete="email" />
+        </div>
+        <Button type="submit" disabled={loading || !email}>{loading ? i18n.t.auth.sending : i18n.t.auth.resendVerification}</Button>
+      </form>
+    {/if}
+  </Card.Content>
+  <Card.Footer class="justify-center">
+    <a href="/login" class="text-muted-foreground text-sm hover:underline">{i18n.t.auth.backToSignIn}</a>
+  </Card.Footer>
+</Card.Root>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.server.ts

@@ -0,0 +1,22 @@
+import type { LayoutServerLoad } from "./$types";
+import { redirect } from "@sveltejs/kit";
+
+// "/" is a public landing page. Auth pages send signed-in users to /admin, and
+// the admin area requires a session.
+const PUBLIC_PATHS = ["/", "/login", "/signup", "/forgot-password", "/reset-password"];
+const AUTH_PATHS = ["/login", "/signup", "/forgot-password", "/reset-password"];
+
+function isPublic(pathname: string): boolean {
+  return PUBLIC_PATHS.some((path) => pathname === path || (path !== "/" && pathname.startsWith(`${path}/`)));
+}
+
+export const load: LayoutServerLoad = ({ locals, url }) => {
+  const { pathname } = url;
+  if (locals.user && AUTH_PATHS.includes(pathname)) {
+    redirect(303, "/admin");
+  }
+  if (!locals.user && !isPublic(pathname)) {
+    redirect(303, `/login?redirect=${encodeURIComponent(pathname)}`);
+  }
+  return { user: locals.user, locale: locals.locale };
+};

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.svelte

@@ -0,0 +1,20 @@
+<script lang="ts">
+  import "../app.css";
+  import { ModeWatcher } from "mode-watcher";
+  import { setI18nContext } from "$lib/i18n";
+  import { messages, resolveLocale } from "$lib/i18n/messages";
+
+  let { children, data } = $props();
+  const locale = $derived(resolveLocale(data.locale));
+  setI18nContext({
+    get t() {
+      return messages[locale];
+    },
+    get locale() {
+      return locale;
+    },
+  });
+</script>
+
+<ModeWatcher />
+{@render children()}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+page.svelte

@@ -0,0 +1,22 @@
+<script lang="ts">
+  import { Button } from "$lib/components/ui/button";
+  import LanguageSwitch from "$lib/components/language-switch.svelte";
+  import ThemeToggle from "$lib/components/theme-toggle.svelte";
+  import { getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+</script>
+
+<div class="flex min-h-svh flex-col">
+  <header class="flex items-center justify-end gap-2 p-4">
+    <LanguageSwitch />
+    <ThemeToggle />
+  </header>
+  <main class="flex flex-1 flex-col items-center justify-center gap-6 px-4 text-center">
+    <div class="flex flex-col gap-3">
+      <h1 class="text-3xl font-semibold">{i18n.t.landing.title}</h1>
+      <p class="text-muted-foreground max-w-md">{i18n.t.landing.subtitle}</p>
+    </div>
+    <Button href="/admin">{i18n.t.landing.openAdmin}</Button>
+  </main>
+</div>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/oauth2/consent/+page.svelte

@@ -0,0 +1,54 @@
+<script lang="ts">
+  import { page } from "$app/state";
+  import { Button } from "$lib/components/ui/button";
+  import * as Card from "$lib/components/ui/card";
+  import { getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+  // The OAuth provider redirects here with the authorization request in the query
+  // (and a pending-request cookie). Show what's being requested, then approve/deny.
+  const clientId = $derived(page.url.searchParams.get("client_id") ?? "");
+  const scopes = $derived((page.url.searchParams.get("scope") ?? "").split(/[+\s]/).filter(Boolean));
+  let busy = $state(false);
+
+  async function decide(accept: boolean): Promise<void> {
+    busy = true;
+    // The authorization request is carried in the signed query params we were
+    // redirected here with; forward them verbatim so the server can validate and
+    // restore it. Credentials carry the user's session. The response says where next.
+    const res = await fetch(`/api/auth/oauth2/consent${page.url.search}`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ accept }),
+    });
+    const data = (await res.json().catch(() => ({}))) as { url?: string; redirectURI?: string };
+    const next = data.url ?? data.redirectURI;
+    if (next) window.location.href = next;
+    else busy = false;
+  }
+</script>
+
+<div class="mx-auto flex min-h-[70vh] max-w-md items-center">
+  <Card.Root class="w-full">
+    <Card.Header>
+      <Card.Title>{i18n.t.consent.title}</Card.Title>
+      <Card.Description>{i18n.t.consent.subtitle}</Card.Description>
+    </Card.Header>
+    <Card.Content class="flex flex-col gap-4">
+      <div class="text-sm">
+        <p class="font-medium">{clientId}</p>
+        {#if scopes.length}
+          <p class="text-muted-foreground mt-1">{i18n.t.consent.requests}</p>
+          <ul class="text-muted-foreground mt-1 list-inside list-disc">
+            {#each scopes as s (s)}<li>{s}</li>{/each}
+          </ul>
+        {/if}
+      </div>
+      <div class="flex justify-end gap-2">
+        <Button variant="outline" disabled={busy} onclick={() => decide(false)}>{i18n.t.consent.deny}</Button>
+        <Button disabled={busy} onclick={() => decide(true)}>{i18n.t.consent.allow}</Button>
+      </div>
+    </Card.Content>
+  </Card.Root>
+</div>

package/dist/templates/modules/admin-dashboard/files/tests/api/audit.api.spec.ts

@@ -0,0 +1,97 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN, USER } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+async function signedIn(
+  playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"],
+  account: { email: string; password: string },
+) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: account });
+  return ctx;
+}
+
+test("audit log records auth/admin actions", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const probe = await admin.get("/api/audit-logs");
+  test.skip(probe.status() === 404, "audit-log module not installed");
+
+  // an admin action that flows through better-auth (bypasses the interceptor)
+  const email = `audit-${Date.now()}@example.com`;
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "Audit", role: "user" },
+  });
+  expect(created.ok()).toBeTruthy();
+  const userId = (await created.json())?.user?.id as string;
+
+  const res = await admin.get("/api/audit-logs");
+  expect(res.ok()).toBeTruthy();
+  const entries = (await res.json()) as Array<{ action: string; actorEmail: string | null; targetLabel: string | null }>;
+  const entry = entries.find((e) => e.action === "user.create" && e.targetLabel === email);
+  expect(entry, "user.create should be audited with the target").toBeTruthy();
+  expect(entry?.actorEmail, "audit entry records the acting admin").toBe(ADMIN.email);
+
+  await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  await admin.dispose();
+});
+
+test("the audit log is admin-only", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
+  await admin.dispose();
+
+  const user = await signedIn(playwright, USER);
+  expect((await user.get("/api/audit-logs")).status()).toBe(403);
+  await user.dispose();
+});
+
+test("sending a verification email is audited", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
+  const email = `verif-audit-${Date.now()}@example.com`;
+  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "VA", role: "user" } });
+  await admin.post("/api/auth/send-verification-email", { data: { email, callbackURL: `${base}/admin` } });
+  const entries = (await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>;
+  expect(entries.some((e) => e.action === "auth.verification_sent"), "verification send should be audited").toBeTruthy();
+  await admin.dispose();
+});
+
+// Audit logging is a DB-backed on/off toggle (auth_config `server`, applied live).
+// Runs after the recording tests and restores the flag so nothing else is affected.
+test("audit logging honours the DB on/off toggle @smoke", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
+  const auditLog = async () => (await (await admin.get("/api/account/capabilities")).json()).auditLog as boolean;
+  const recorded = async (label: string) =>
+    ((await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>).some(
+      (e) => e.action === "user.create" && e.targetLabel === label,
+    );
+  const createUser = async (email: string) =>
+    (await (await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "T", role: "user" } })).json())?.user?.id as string;
+
+  try {
+    // OFF → the action is not recorded. Wait past the config-store cache TTL so the
+    // audit gate sees the new value (its cache is independent of the capabilities one).
+    await admin.put("/api/account/auth-config", { data: { server: { auditLog: false } } });
+    await expect.poll(auditLog, { timeout: 8000 }).toBe(false);
+    await new Promise((r) => setTimeout(r, 4000));
+    const offEmail = `audit-off-${Date.now()}@example.com`;
+    const offId = await createUser(offEmail);
+    expect(await recorded(offEmail), "no audit entry while disabled").toBe(false);
+    await admin.post("/api/auth/admin/remove-user", { data: { userId: offId } });
+
+    // ON → recording resumes.
+    await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
+    await expect.poll(auditLog, { timeout: 8000 }).toBe(true);
+    await new Promise((r) => setTimeout(r, 4000));
+    const onEmail = `audit-on-${Date.now()}@example.com`;
+    const onId = await createUser(onEmail);
+    expect(await recorded(onEmail), "audit entry recorded once re-enabled").toBe(true);
+    await admin.post("/api/auth/admin/remove-user", { data: { userId: onId } });
+  } finally {
+    await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
+    await admin.dispose();
+  }
+});