@podosoft/podokit 0.4.0 → 0.5.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.svelte

@@ -9,20 +9,102 @@
   import { api } from "$lib/api";
   import { getI18n } from "$lib/i18n";
 
+  import type { PageData } from "./$types";
+
+  let { data }: { data: PageData } = $props();
   const i18n = getI18n();
   let email = $state("");
   let password = $state("");
   let error = $state<string | null>(null);
+  let unverified = $state(false);
   let loading = $state(false);
 
+  // Passwordless sign-in, shown only when the server enabled the magic-link plugin.
+  const magicLinkEnabled = $derived(data.capabilities?.magicLink ?? false);
+  let magicLoading = $state(false);
+  let magicSent = $state(false);
+  async function sendMagicLink(): Promise<void> {
+    if (!email) {
+      error = i18n.t.auth.magicLinkNeedsEmail;
+      return;
+    }
+    magicLoading = true;
+    error = null;
+    const { error: authError } = await api.auth.signIn.magicLink({
+      email,
+      callbackURL: page.url.searchParams.get("redirect") ?? "/admin",
+    });
+    magicLoading = false;
+    if (authError) {
+      error = authError.message ?? i18n.t.auth.signInFailed;
+      return;
+    }
+    magicSent = true;
+  }
+
+  // Passwordless sign-in with an emailed one-time code (two steps: send, verify).
+  const usernameEnabled = $derived(data.capabilities?.username ?? false);
+  const emailOtpEnabled = $derived(data.capabilities?.emailOtp ?? false);
+  let otpSent = $state(false);
+  let otpCode = $state("");
+  let otpLoading = $state(false);
+  async function sendOtp(): Promise<void> {
+    if (!email) {
+      error = i18n.t.auth.magicLinkNeedsEmail;
+      return;
+    }
+    otpLoading = true;
+    error = null;
+    const { error: authError } = await api.auth.emailOtp.sendVerificationOtp({ email, type: "sign-in" });
+    otpLoading = false;
+    if (authError) {
+      error = authError.message ?? i18n.t.auth.signInFailed;
+      return;
+    }
+    otpSent = true;
+  }
+  async function verifyOtp(): Promise<void> {
+    otpLoading = true;
+    error = null;
+    const { error: authError } = await api.auth.signIn.emailOtp({ email, otp: otpCode });
+    otpLoading = false;
+    if (authError) {
+      error = authError.message ?? i18n.t.auth.signInFailed;
+      return;
+    }
+    await goto(page.url.searchParams.get("redirect") ?? "/admin", { invalidateAll: true });
+  }
+
+  // Passwordless sign-in with a registered passkey (WebAuthn), shown when enabled.
+  const passkeyEnabled = $derived(data.capabilities?.passkey ?? false);
+  let passkeyLoading = $state(false);
+  async function signInWithPasskey(): Promise<void> {
+    passkeyLoading = true;
+    error = null;
+    const res = await api.auth.signIn.passkey();
+    passkeyLoading = false;
+    if (res?.error) {
+      error = res.error.message ?? i18n.t.auth.signInFailed;
+      return;
+    }
+    await goto(page.url.searchParams.get("redirect") ?? "/admin", { invalidateAll: true });
+  }
+
   async function submit(event: SubmitEvent): Promise<void> {
     event.preventDefault();
     loading = true;
     error = null;
-    const { error: authError } = await api.auth.signIn.email({ email, password });
+    unverified = false;
+    // With the username plugin on, an identifier without "@" is treated as a username.
+    const asUsername = usernameEnabled && !email.includes("@");
+    const { error: authError } = asUsername
+      ? await api.auth.signIn.username({ username: email, password })
+      : await api.auth.signIn.email({ email, password });
     loading = false;
     if (authError) {
-      error = authError.message ?? i18n.t.auth.signInFailed;
+      // Surface an unverified address with a path to a fresh verification link.
+      unverified = authError.code === "EMAIL_NOT_VERIFIED";
+      error = unverified ? i18n.t.auth.emailNotVerified : (authError.message ?? i18n.t.auth.signInFailed);
       return;
     }
     await goto(page.url.searchParams.get("redirect") ?? "/admin", { invalidateAll: true });
@@ -37,11 +119,18 @@
   <Card.Content>
     <form class="flex flex-col gap-4" onsubmit={submit}>
       {#if error}
-        <Alert.Root variant="destructive"><Alert.Description>{error}</Alert.Description></Alert.Root>
+        <Alert.Root variant="destructive">
+          <Alert.Description>
+            {error}
+            {#if unverified}
+              <a href="/verify-email?email={encodeURIComponent(email)}" class="font-medium underline">{i18n.t.auth.resendVerification}</a>
+            {/if}
+          </Alert.Description>
+        </Alert.Root>
       {/if}
       <div class="flex flex-col gap-2">
-        <Label for="email">{i18n.t.auth.email}</Label>
-        <Input id="email" type="email" bind:value={email} required autocomplete="email" />
+        <Label for="email">{usernameEnabled ? i18n.t.auth.emailOrUsername : i18n.t.auth.email}</Label>
+        <Input id="email" type={usernameEnabled ? "text" : "email"} bind:value={email} required autocomplete="username" />
       </div>
       <div class="flex flex-col gap-2">
         <div class="flex items-center justify-between">
@@ -52,6 +141,39 @@
       </div>
       <Button type="submit" disabled={loading}>{loading ? i18n.t.auth.signingIn : i18n.t.auth.signIn}</Button>
     </form>
+    {#if magicLinkEnabled || emailOtpEnabled || passkeyEnabled}
+      <div class="mt-4 flex flex-col gap-3 border-t pt-4">
+        {#if passkeyEnabled}
+          <Button type="button" variant="outline" class="w-full" disabled={passkeyLoading} onclick={signInWithPasskey}>
+            {passkeyLoading ? i18n.t.auth.signingIn : i18n.t.auth.passkeyButton}
+          </Button>
+        {/if}
+        {#if magicLinkEnabled}
+          {#if magicSent}
+            <p class="text-muted-foreground text-sm" data-testid="magic-link-sent">{i18n.t.auth.magicLinkSent}</p>
+          {:else}
+            <Button type="button" variant="outline" class="w-full" disabled={magicLoading} onclick={sendMagicLink}>
+              {magicLoading ? i18n.t.auth.sending : i18n.t.auth.magicLinkButton}
+            </Button>
+          {/if}
+        {/if}
+        {#if emailOtpEnabled}
+          {#if otpSent}
+            <div class="flex flex-col gap-2">
+              <Label for="otp">{i18n.t.auth.otpCode}</Label>
+              <Input id="otp" bind:value={otpCode} inputmode="numeric" autocomplete="one-time-code" />
+              <Button type="button" class="w-full" disabled={otpLoading || !otpCode} onclick={verifyOtp}>
+                {otpLoading ? i18n.t.auth.signingIn : i18n.t.auth.otpVerify}
+              </Button>
+            </div>
+          {:else}
+            <Button type="button" variant="outline" class="w-full" disabled={otpLoading} onclick={sendOtp}>
+              {otpLoading ? i18n.t.auth.sending : i18n.t.auth.otpButton}
+            </Button>
+          {/if}
+        {/if}
+      </div>
+    {/if}
   </Card.Content>
   <Card.Footer class="justify-center">
     <p class="text-muted-foreground text-sm">{i18n.t.auth.noAccount} <a href="/signup" class="text-foreground hover:underline">{i18n.t.auth.signUp}</a></p>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/signup/+page.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import { goto } from "$app/navigation";
+  import { page } from "$app/state";
   import { Button } from "$lib/components/ui/button";
   import { Input } from "$lib/components/ui/input";
   import { Label } from "$lib/components/ui/label";
@@ -19,12 +20,27 @@
     event.preventDefault();
     loading = true;
     error = null;
-    const { error: authError } = await api.auth.signUp.email({ name, email, password });
-    loading = false;
+    // callbackURL: where the verification link lands once confirmed (absolute so
+    // it returns to the web app, not the API origin). Ignored when verification is off.
+    const { error: authError } = await api.auth.signUp.email({
+      name,
+      email,
+      password,
+      callbackURL: `${page.url.origin}/admin`,
+    });
     if (authError) {
+      loading = false;
       error = authError.message ?? i18n.t.auth.signUpFailed;
       return;
     }
+    // When email verification is required, sign-up creates no session — send the
+    // user to confirm their address instead of into the (guarded) app.
+    const { data: session } = await api.auth.getSession();
+    loading = false;
+    if (!session?.session) {
+      await goto(`/verify-email?email=${encodeURIComponent(email)}`);
+      return;
+    }
     await goto("/admin", { invalidateAll: true });
   }
 </script>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/verify-email/+page.svelte

@@ -0,0 +1,63 @@
+<script lang="ts">
+  import { page } from "$app/state";
+  import { Button } from "$lib/components/ui/button";
+  import { Input } from "$lib/components/ui/input";
+  import { Label } from "$lib/components/ui/label";
+  import * as Card from "$lib/components/ui/card";
+  import * as Alert from "$lib/components/ui/alert";
+  import { api } from "$lib/api";
+  import { fmt, getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+  // ?email from the sign-up redirect; ?error when the API bounces a bad/expired link here.
+  let email = $state(page.url.searchParams.get("email") ?? "");
+  const linkError = $derived(page.url.searchParams.get("error"));
+  let sent = $state(false);
+  let error = $state<string | null>(null);
+  let loading = $state(false);
+
+  async function resend(event: SubmitEvent): Promise<void> {
+    event.preventDefault();
+    loading = true;
+    error = null;
+    const { error: authError } = await api.auth.sendVerificationEmail({
+      email,
+      callbackURL: `${page.url.origin}/admin`,
+    });
+    loading = false;
+    if (authError) {
+      error = authError.message ?? i18n.t.auth.requestFailed;
+      return;
+    }
+    sent = true;
+  }
+</script>
+
+<Card.Root>
+  <Card.Header>
+    <Card.Title>{i18n.t.auth.verifyTitle}</Card.Title>
+    <Card.Description>{email ? fmt(i18n.t.auth.verifyDesc, { email }) : i18n.t.auth.verifyDescNoEmail}</Card.Description>
+  </Card.Header>
+  <Card.Content>
+    {#if linkError}
+      <Alert.Root variant="destructive" class="mb-4"><Alert.Description>{i18n.t.auth.verifyLinkError}</Alert.Description></Alert.Root>
+    {/if}
+    {#if sent}
+      <Alert.Root><Alert.Description>{i18n.t.auth.verifySent}</Alert.Description></Alert.Root>
+    {:else}
+      <form class="flex flex-col gap-4" onsubmit={resend}>
+        {#if error}
+          <Alert.Root variant="destructive"><Alert.Description>{error}</Alert.Description></Alert.Root>
+        {/if}
+        <div class="flex flex-col gap-2">
+          <Label for="email">{i18n.t.auth.email}</Label>
+          <Input id="email" type="email" bind:value={email} required autocomplete="email" />
+        </div>
+        <Button type="submit" disabled={loading || !email}>{loading ? i18n.t.auth.sending : i18n.t.auth.resendVerification}</Button>
+      </form>
+    {/if}
+  </Card.Content>
+  <Card.Footer class="justify-center">
+    <a href="/login" class="text-muted-foreground text-sm hover:underline">{i18n.t.auth.backToSignIn}</a>
+  </Card.Footer>
+</Card.Root>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/oauth2/consent/+page.svelte

@@ -0,0 +1,54 @@
+<script lang="ts">
+  import { page } from "$app/state";
+  import { Button } from "$lib/components/ui/button";
+  import * as Card from "$lib/components/ui/card";
+  import { getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+  // The OAuth provider redirects here with the authorization request in the query
+  // (and a pending-request cookie). Show what's being requested, then approve/deny.
+  const clientId = $derived(page.url.searchParams.get("client_id") ?? "");
+  const scopes = $derived((page.url.searchParams.get("scope") ?? "").split(/[+\s]/).filter(Boolean));
+  let busy = $state(false);
+
+  async function decide(accept: boolean): Promise<void> {
+    busy = true;
+    // The authorization request is carried in the signed query params we were
+    // redirected here with; forward them verbatim so the server can validate and
+    // restore it. Credentials carry the user's session. The response says where next.
+    const res = await fetch(`/api/auth/oauth2/consent${page.url.search}`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ accept }),
+    });
+    const data = (await res.json().catch(() => ({}))) as { url?: string; redirectURI?: string };
+    const next = data.url ?? data.redirectURI;
+    if (next) window.location.href = next;
+    else busy = false;
+  }
+</script>
+
+<div class="mx-auto flex min-h-[70vh] max-w-md items-center">
+  <Card.Root class="w-full">
+    <Card.Header>
+      <Card.Title>{i18n.t.consent.title}</Card.Title>
+      <Card.Description>{i18n.t.consent.subtitle}</Card.Description>
+    </Card.Header>
+    <Card.Content class="flex flex-col gap-4">
+      <div class="text-sm">
+        <p class="font-medium">{clientId}</p>
+        {#if scopes.length}
+          <p class="text-muted-foreground mt-1">{i18n.t.consent.requests}</p>
+          <ul class="text-muted-foreground mt-1 list-inside list-disc">
+            {#each scopes as s (s)}<li>{s}</li>{/each}
+          </ul>
+        {/if}
+      </div>
+      <div class="flex justify-end gap-2">
+        <Button variant="outline" disabled={busy} onclick={() => decide(false)}>{i18n.t.consent.deny}</Button>
+        <Button disabled={busy} onclick={() => decide(true)}>{i18n.t.consent.allow}</Button>
+      </div>
+    </Card.Content>
+  </Card.Root>
+</div>

package/dist/templates/modules/admin-dashboard/files/tests/api/audit.api.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN, USER } from "../helpers/accounts";
 
-const base = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
 async function signedIn(
@@ -21,7 +21,7 @@ test("audit log records auth/admin actions", async ({ playwright }) => {
   // an admin action that flows through better-auth (bypasses the interceptor)
   const email = `audit-${Date.now()}@example.com`;
   const created = await admin.post("/api/auth/admin/create-user", {
-    data: { email, password: "password123", name: "Audit", role: "user" },
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "Audit", role: "user" },
   });
   expect(created.ok()).toBeTruthy();
   const userId = (await created.json())?.user?.id as string;
@@ -46,3 +46,52 @@ test("the audit log is admin-only", async ({ playwright }) => {
   expect((await user.get("/api/audit-logs")).status()).toBe(403);
   await user.dispose();
 });
+
+test("sending a verification email is audited", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
+  const email = `verif-audit-${Date.now()}@example.com`;
+  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "VA", role: "user" } });
+  await admin.post("/api/auth/send-verification-email", { data: { email, callbackURL: `${base}/admin` } });
+  const entries = (await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>;
+  expect(entries.some((e) => e.action === "auth.verification_sent"), "verification send should be audited").toBeTruthy();
+  await admin.dispose();
+});
+
+// Audit logging is a DB-backed on/off toggle (auth_config `server`, applied live).
+// Runs after the recording tests and restores the flag so nothing else is affected.
+test("audit logging honours the DB on/off toggle @smoke", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
+  const auditLog = async () => (await (await admin.get("/api/account/capabilities")).json()).auditLog as boolean;
+  const recorded = async (label: string) =>
+    ((await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>).some(
+      (e) => e.action === "user.create" && e.targetLabel === label,
+    );
+  const createUser = async (email: string) =>
+    (await (await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "T", role: "user" } })).json())?.user?.id as string;
+
+  try {
+    // OFF → the action is not recorded. Wait past the config-store cache TTL so the
+    // audit gate sees the new value (its cache is independent of the capabilities one).
+    await admin.put("/api/account/auth-config", { data: { server: { auditLog: false } } });
+    await expect.poll(auditLog, { timeout: 8000 }).toBe(false);
+    await new Promise((r) => setTimeout(r, 4000));
+    const offEmail = `audit-off-${Date.now()}@example.com`;
+    const offId = await createUser(offEmail);
+    expect(await recorded(offEmail), "no audit entry while disabled").toBe(false);
+    await admin.post("/api/auth/admin/remove-user", { data: { userId: offId } });
+
+    // ON → recording resumes.
+    await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
+    await expect.poll(auditLog, { timeout: 8000 }).toBe(true);
+    await new Promise((r) => setTimeout(r, 4000));
+    const onEmail = `audit-on-${Date.now()}@example.com`;
+    const onId = await createUser(onEmail);
+    expect(await recorded(onEmail), "audit entry recorded once re-enabled").toBe(true);
+    await admin.post("/api/auth/admin/remove-user", { data: { userId: onId } });
+  } finally {
+    await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
+    await admin.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -0,0 +1,80 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Fresh admin context (not the shared storageState) so these never rotate the
+// seeded admin session.
+async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  return ctx;
+}
+
+test("admin can enable Google OAuth from the DB and it applies without a restart @smoke", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const social = () => anon.post("/api/auth/sign-in/social", { data: { provider: "google", callbackURL: `${base}/admin` } });
+
+  // Before: provider not configured.
+  await expect.poll(async () => (await social()).status(), { timeout: 8000 }).toBe(404);
+
+  // Paste credentials via the admin API.
+  const put = await admin.put("/api/account/auth-config", {
+    data: { social: { google: { enabled: true, clientId: "dummy-google-client-id", clientSecret: "dummy-google-client-secret" } } },
+  });
+  expect(put.ok()).toBeTruthy();
+  const view = await put.json();
+  expect(view.social.google.hasSecret).toBe(true);
+  expect(view.social.google.clientId).toBe("dummy-google-client-id");
+  expect("clientSecret" in view.social.google).toBe(false); // secret is never returned
+
+  // Applied live (no restart): social sign-in now redirects to Google.
+  await expect
+    .poll(async () => {
+      const r = await social();
+      return r.ok() ? (((await r.json())?.url as string) ?? "") : "";
+    }, { timeout: 8000 })
+    .toContain("accounts.google.com");
+  const caps = await (await anon.get("/api/account/capabilities")).json();
+  expect(caps.providers).toContain("google");
+
+  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // restore
+  await anon.dispose();
+  await admin.dispose();
+});
+
+test("admin can add and remove a social provider dynamically @smoke", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  // The catalog offers providers beyond the two legacy env-backed ones.
+  const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
+  expect(catalog.map((c) => c.id)).toEqual(expect.arrayContaining(["google", "github", "apple"]));
+
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const github = () => anon.post("/api/auth/sign-in/social", { data: { provider: "github", callbackURL: `${base}/admin` } });
+
+  // Add GitHub (a provider with no env fallback) → applies live, no restart.
+  await admin.put("/api/account/auth-config", { data: { social: { github: { enabled: true, clientId: "dummy-github-client-id", clientSecret: "dummy-github-client-secret" } } } });
+  await expect
+    .poll(async () => { const r = await github(); return r.ok() ? (((await r.json())?.url as string) ?? "") : ""; }, { timeout: 8000 })
+    .toContain("github.com");
+
+  // Remove it → the row is deleted and the provider stops working (again live).
+  await admin.put("/api/account/auth-config", { data: { social: { github: { delete: true } } } });
+  expect("github" in (await (await admin.get("/api/account/auth-config")).json()).social).toBe(false);
+  await expect.poll(async () => (await github()).status(), { timeout: 8000 }).toBe(404);
+
+  await anon.dispose();
+  await admin.dispose();
+});
+
+test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwright }) => {
+  const user = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `acfg-${Date.now()}@example.com`;
+  await user.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "U" } });
+  expect((await user.get("/api/account/auth-config")).status()).toBe(403);
+  expect((await user.put("/api/account/auth-config", { data: { server: { hibp: true } } })).status()).toBe(403);
+  await user.dispose();
+});