@podosoft/podokit 0.5.1 → 0.7.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/settings/general-settings.svelte

@@ -0,0 +1,203 @@
+<script lang="ts">
+  import { Input } from "$lib/components/ui/input";
+  import { Label } from "$lib/components/ui/label";
+  import { Button } from "$lib/components/ui/button";
+  import { Switch } from "$lib/components/ui/switch";
+  import * as Card from "$lib/components/ui/card";
+  import { toast } from "svelte-sonner";
+  import { api } from "$lib/api";
+  import { getI18n } from "$lib/i18n";
+  import { site, type SiteSettings } from "$lib/site.svelte";
+
+  const i18n = getI18n();
+  const t = $derived(i18n.t.general);
+
+  // Text fields, seeded from the current site settings.
+  const s = $derived(site.value);
+  let form = $state({
+    name: "",
+    description: "",
+    supportEmail: "",
+    footerText: "",
+    brandColor: "",
+    termsUrl: "",
+    privacyUrl: "",
+    locale: "",
+    timezone: "",
+  });
+  let maintenanceMode = $state(false);
+  let allowSignup = $state(true);
+  let seeded = $state(false);
+  $effect(() => {
+    if (seeded) return;
+    form = {
+      name: s.name ?? "",
+      description: s.description ?? "",
+      supportEmail: s.supportEmail ?? "",
+      footerText: s.footerText ?? "",
+      brandColor: s.brandColor ?? "",
+      termsUrl: s.termsUrl ?? "",
+      privacyUrl: s.privacyUrl ?? "",
+      locale: s.locale ?? "",
+      timezone: s.timezone ?? "",
+    };
+    maintenanceMode = s.maintenanceMode === "true";
+    allowSignup = s.allowSignup !== "false";
+    seeded = true;
+  });
+
+  let saving = $state(false);
+  async function save(): Promise<void> {
+    saving = true;
+    try {
+      const payload: Record<string, string> = {
+        ...form,
+        maintenanceMode: String(maintenanceMode),
+        allowSignup: String(allowSignup),
+      };
+      await api.put("/site/settings", payload);
+      site.patch(payload as Partial<SiteSettings>); // live: browser title updates now
+      toast.success(t.saved);
+    } catch {
+      toast.error(t.saveError);
+    } finally {
+      saving = false;
+    }
+  }
+
+  const ICON_TYPES = ".svg,.png,.ico";
+  let uploading = $state(false);
+  const faviconSrc = $derived(
+    s.hasFavicon ? `/api/site/favicon?v=${s.faviconVersion ?? ""}` : "/favicon.svg",
+  );
+  async function uploadFavicon(e: Event): Promise<void> {
+    const input = e.currentTarget as HTMLInputElement;
+    const file = input.files?.[0];
+    if (!file) return;
+    if (file.size > 1024 * 1024) {
+      toast.error(t.iconTooBig);
+      input.value = "";
+      return;
+    }
+    uploading = true;
+    try {
+      const body = new FormData();
+      body.append("file", file);
+      const res = await fetch("/api/site/favicon", { method: "POST", body });
+      if (!res.ok) throw new Error(String(res.status));
+      const { version } = (await res.json()) as { version: string | null };
+      site.patch({ hasFavicon: true, faviconVersion: version }); // live: favicon refetches
+      toast.success(t.iconSaved);
+    } catch {
+      toast.error(t.iconError);
+    } finally {
+      uploading = false;
+      input.value = "";
+    }
+  }
+</script>
+
+<div class="flex flex-col gap-6">
+  <div class="grid items-start gap-6 lg:grid-cols-2">
+    <Card.Root>
+    <Card.Header>
+      <Card.Title>{t.brandingTitle}</Card.Title>
+      <Card.Description>{t.brandingDesc}</Card.Description>
+    </Card.Header>
+    <Card.Content class="flex flex-col gap-4">
+      <div class="flex flex-col gap-1.5">
+        <Label for="site-name">{t.siteName}</Label>
+        <Input id="site-name" bind:value={form.name} placeholder={t.siteNamePlaceholder} />
+        <p class="text-muted-foreground text-xs">{t.siteNameHint}</p>
+      </div>
+
+      <div class="flex flex-col gap-1.5">
+        <Label>{t.favicon}</Label>
+        <div class="flex items-center gap-3">
+          <img src={faviconSrc} alt="favicon" class="bg-muted size-12 rounded-md border p-1" />
+          <div class="flex flex-col gap-1.5">
+            <input
+              type="file"
+              accept={ICON_TYPES}
+              disabled={uploading}
+              onchange={uploadFavicon}
+              class="text-sm file:mr-3 file:rounded-md file:border-0 file:bg-secondary file:px-3 file:py-1.5 file:text-sm"
+            />
+            <p class="text-muted-foreground text-xs">{t.faviconHint}</p>
+          </div>
+        </div>
+      </div>
+
+      <div class="flex flex-col gap-1.5">
+        <Label for="brand-color">{t.brandColor}</Label>
+        <Input id="brand-color" bind:value={form.brandColor} placeholder="#6d28d9" />
+      </div>
+    </Card.Content>
+  </Card.Root>
+
+  <Card.Root class="lg:row-span-2">
+    <Card.Header>
+      <Card.Title>{t.infoTitle}</Card.Title>
+      <Card.Description>{t.infoDesc}</Card.Description>
+    </Card.Header>
+    <Card.Content class="flex flex-col gap-4">
+      <div class="flex flex-col gap-1.5">
+        <Label for="site-desc">{t.description}</Label>
+        <Input id="site-desc" bind:value={form.description} placeholder={t.descriptionPlaceholder} />
+      </div>
+      <div class="grid gap-4 sm:grid-cols-2">
+        <div class="flex flex-col gap-1.5">
+          <Label for="support-email">{t.supportEmail}</Label>
+          <Input id="support-email" type="email" bind:value={form.supportEmail} placeholder="support@example.com" />
+        </div>
+        <div class="flex flex-col gap-1.5">
+          <Label for="footer">{t.footerText}</Label>
+          <Input id="footer" bind:value={form.footerText} placeholder="© 2026 Example" />
+        </div>
+        <div class="flex flex-col gap-1.5">
+          <Label for="terms">{t.termsUrl}</Label>
+          <Input id="terms" bind:value={form.termsUrl} placeholder="/terms" />
+        </div>
+        <div class="flex flex-col gap-1.5">
+          <Label for="privacy">{t.privacyUrl}</Label>
+          <Input id="privacy" bind:value={form.privacyUrl} placeholder="/privacy" />
+        </div>
+        <div class="flex flex-col gap-1.5">
+          <Label for="locale">{t.locale}</Label>
+          <Input id="locale" bind:value={form.locale} placeholder="en" />
+        </div>
+        <div class="flex flex-col gap-1.5">
+          <Label for="timezone">{t.timezone}</Label>
+          <Input id="timezone" bind:value={form.timezone} placeholder="UTC" />
+        </div>
+      </div>
+    </Card.Content>
+  </Card.Root>
+
+  <Card.Root>
+    <Card.Header>
+      <Card.Title>{t.opsTitle}</Card.Title>
+    </Card.Header>
+    <Card.Content class="flex flex-col gap-4">
+      <div class="flex items-center justify-between gap-4">
+        <div class="flex flex-col">
+          <Label>{t.maintenance}</Label>
+          <p class="text-muted-foreground text-sm">{t.maintenanceDesc}</p>
+        </div>
+        <Switch bind:checked={maintenanceMode} aria-label={t.maintenance} />
+      </div>
+      <div class="flex items-center justify-between gap-4">
+        <div class="flex flex-col">
+          <Label>{t.allowSignup}</Label>
+          <p class="text-muted-foreground text-sm">{t.allowSignupDesc}</p>
+        </div>
+        <Switch bind:checked={allowSignup} aria-label={t.allowSignup} />
+      </div>
+    </Card.Content>
+  </Card.Root>
+  </div>
+
+  <div>
+    <Button onclick={save} disabled={saving}>{saving ? t.saving : t.save}</Button>
+  </div>
+</div>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/+layout.svelte

@@ -1,13 +1,17 @@
 <script lang="ts">
   import LanguageSwitch from "$lib/components/language-switch.svelte";
+  import SiteFooter from "$lib/components/site-footer.svelte";
   let { children } = $props();
 </script>
 
-<div class="bg-muted/30 relative flex min-h-svh items-center justify-center p-6">
+<div class="bg-muted/30 relative flex min-h-svh flex-col p-6">
   <div class="absolute right-4 top-4">
     <LanguageSwitch />
   </div>
-  <div class="w-full max-w-sm">
-    {@render children()}
+  <div class="flex flex-1 items-center justify-center">
+    <div class="w-full max-w-sm">
+      {@render children()}
+    </div>
   </div>
+  <SiteFooter />
 </div>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.svelte

@@ -8,11 +8,14 @@
   import * as Alert from "$lib/components/ui/alert";
   import { api } from "$lib/api";
   import { getI18n } from "$lib/i18n";
+  import { site } from "$lib/site.svelte";
 
   import type { PageData } from "./$types";
 
   let { data }: { data: PageData } = $props();
   const i18n = getI18n();
+  // Hide the sign-up link when registration is closed from admin Settings.
+  const signupOpen = $derived(site.value.allowSignup !== "false");
   let email = $state("");
   let password = $state("");
   let error = $state<string | null>(null);
@@ -175,7 +178,9 @@
       </div>
     {/if}
   </Card.Content>
-  <Card.Footer class="justify-center">
-    <p class="text-muted-foreground text-sm">{i18n.t.auth.noAccount} <a href="/signup" class="text-foreground hover:underline">{i18n.t.auth.signUp}</a></p>
-  </Card.Footer>
+  {#if signupOpen}
+    <Card.Footer class="justify-center">
+      <p class="text-muted-foreground text-sm">{i18n.t.auth.noAccount} <a href="/signup" class="text-foreground hover:underline">{i18n.t.auth.signUp}</a></p>
+    </Card.Footer>
+  {/if}
 </Card.Root>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.server.ts

@@ -2,21 +2,51 @@ import type { LayoutServerLoad } from "./$types";
 import { redirect } from "@sveltejs/kit";
 
 // "/" is a public landing page. Auth pages send signed-in users to /admin, and
-// the admin area requires a session.
-const PUBLIC_PATHS = ["/", "/login", "/signup", "/forgot-password", "/reset-password"];
+// the admin area requires a session. /maintenance is public so it renders while
+// the rest of the site is held back.
+const PUBLIC_PATHS = [
+  "/",
+  "/login",
+  "/signup",
+  "/forgot-password",
+  "/reset-password",
+  "/maintenance",
+  // Modules add their public (no-session) page prefixes here.
+  // podokit:begin:public-paths
+  // podokit:end:public-paths
+];
 const AUTH_PATHS = ["/login", "/signup", "/forgot-password", "/reset-password"];
 
 function isPublic(pathname: string): boolean {
   return PUBLIC_PATHS.some((path) => pathname === path || (path !== "/" && pathname.startsWith(`${path}/`)));
 }
 
-export const load: LayoutServerLoad = ({ locals, url }) => {
+export const load: LayoutServerLoad = async (event) => {
+  const { locals, url } = event;
   const { pathname } = url;
+  // Site settings were loaded once in hooks.server.ts.
+  const site = locals.site;
+  const isAdmin = locals.user?.role === "admin";
+
+  // Maintenance mode holds everyone but admins on a maintenance page. /login and
+  // /maintenance stay reachable so an admin can still sign in and turn it off.
+  const maintenance = site?.maintenanceMode === "true";
+  if (maintenance && !isAdmin && pathname !== "/maintenance" && pathname !== "/login") {
+    redirect(303, "/maintenance");
+  }
+  if (!maintenance && pathname === "/maintenance") {
+    redirect(303, "/");
+  }
+  // Registration closed from the admin Settings: send /signup back to /login.
+  if (site?.allowSignup === "false" && pathname === "/signup") {
+    redirect(303, "/login");
+  }
+
   if (locals.user && AUTH_PATHS.includes(pathname)) {
     redirect(303, "/admin");
   }
   if (!locals.user && !isPublic(pathname)) {
     redirect(303, `/login?redirect=${encodeURIComponent(pathname)}`);
   }
-  return { user: locals.user, locale: locals.locale };
+  return { user: locals.user, locale: locals.locale, site };
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.svelte

@@ -3,6 +3,7 @@
   import { ModeWatcher } from "mode-watcher";
   import { setI18nContext } from "$lib/i18n";
   import { messages, resolveLocale } from "$lib/i18n/messages";
+  import { site } from "$lib/site.svelte";
 
   let { children, data } = $props();
   const locale = $derived(resolveLocale(data.locale));
@@ -14,7 +15,47 @@
       return locale;
     },
   });
+
+  // Seed the reactive site branding; the general-settings form patches it live.
+  $effect.pre(() => site.init(data.site));
+  // Prefer live store values (patched after a save); fall back to the server load
+  // so SSR renders the saved branding too. Empty falls back to the app.html default.
+  const branding = $derived({
+    name: site.value.name ?? data.site?.name ?? "",
+    description: site.value.description ?? data.site?.description ?? "",
+    brandColor: site.value.brandColor ?? data.site?.brandColor ?? "",
+    hasFavicon: site.value.hasFavicon || Boolean(data.site?.hasFavicon),
+    faviconVersion: site.value.faviconVersion ?? data.site?.faviconVersion ?? "",
+  });
+  // Apply the site name to the browser tab live (avoids a duplicate <title> vs
+  // the app.html default; the default project name stays as the SSR fallback).
+  $effect(() => {
+    if (branding.name) document.title = branding.name;
+  });
+  // Apply the brand color as the theme's primary accent live. Clearing it in
+  // Settings restores the stylesheet default (remove the inline override).
+  $effect(() => {
+    const root = document.documentElement;
+    if (branding.brandColor) {
+      root.style.setProperty("--primary", branding.brandColor);
+      root.style.setProperty("--sidebar-primary", branding.brandColor);
+      root.style.setProperty("--ring", branding.brandColor);
+    } else {
+      root.style.removeProperty("--primary");
+      root.style.removeProperty("--sidebar-primary");
+      root.style.removeProperty("--ring");
+    }
+  });
 </script>
 
+<svelte:head>
+  {#if branding.description}
+    <meta name="description" content={branding.description} />
+  {/if}
+  {#if branding.hasFavicon}
+    <link rel="icon" href={`/api/site/favicon?v=${branding.faviconVersion}`} />
+  {/if}
+</svelte:head>
+
 <ModeWatcher />
 {@render children()}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+page.svelte

@@ -2,6 +2,7 @@
   import { Button } from "$lib/components/ui/button";
   import LanguageSwitch from "$lib/components/language-switch.svelte";
   import ThemeToggle from "$lib/components/theme-toggle.svelte";
+  import SiteFooter from "$lib/components/site-footer.svelte";
   import { getI18n } from "$lib/i18n";
 
   const i18n = getI18n();
@@ -19,4 +20,5 @@
     </div>
     <Button href="/admin">{i18n.t.landing.openAdmin}</Button>
   </main>
+  <SiteFooter />
 </div>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/maintenance/+page.svelte

@@ -0,0 +1,25 @@
+<script lang="ts">
+  // Shown to non-admin visitors while maintenance mode is on (see +layout.server.ts).
+  // Admins are never redirected here and can sign in to turn it off.
+  import { Button } from "$lib/components/ui/button";
+  import LanguageSwitch from "$lib/components/language-switch.svelte";
+  import ThemeToggle from "$lib/components/theme-toggle.svelte";
+  import { getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+</script>
+
+<div class="flex min-h-svh flex-col">
+  <header class="flex items-center justify-end gap-2 p-4">
+    <LanguageSwitch />
+    <ThemeToggle />
+  </header>
+  <main class="flex flex-1 flex-col items-center justify-center gap-6 px-4 text-center">
+    <div class="flex flex-col gap-3">
+      <h1 class="text-3xl font-semibold">{i18n.t.maintenance.title}</h1>
+      <p class="text-muted-foreground max-w-md">{i18n.t.maintenance.subtitle}</p>
+      <p class="text-muted-foreground text-sm">{i18n.t.maintenance.adminHint}</p>
+    </div>
+    <Button href="/login" variant="outline">{i18n.t.maintenance.signIn}</Button>
+  </main>
+</div>

package/dist/templates/modules/admin-dashboard/files/dot-claude/skills/podokit-data-table/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: podokit-data-table
+description: Use when building ANY list or table view in this project (users, sessions, orders, any collection) — including inside dialogs. PodoKit requires the shared DataTable component; never assemble a table by hand.
+---
+
+# Build a list with the shared DataTable
+
+**Every** list/table in this project must use `$lib/components/data-table.svelte`
+(`DataTable`) — it provides sortable headers and a footer pagination, consistently.
+Do **not** assemble `Table.Root` / `Table.Header` / `Table.Body` by hand, and don't
+put pagination outside the table.
+
+```svelte
+<script lang="ts">
+  import DataTable from "$lib/components/data-table.svelte";
+  const columns = [
+    { key: "name", label: "Name", sortable: true },
+    { key: "email", label: "Email", sortable: true },
+    { key: "role", label: "Role", sortable: true },     // action/status columns: no `sortable`
+  ];
+  let { rows } = $props();   // Svelte 5 runes only
+</script>
+
+<DataTable {columns} {rows} label="{rows.length} users">
+  {#snippet row(item)}
+    <Table.Cell>{item.name}</Table.Cell>
+    <Table.Cell>{item.email}</Table.Cell>
+    <Table.Cell>{item.role}</Table.Cell>
+  {/snippet}
+</DataTable>
+```
+
+- **Client data** (bounded): pass `rows`; DataTable sorts/paginates internally.
+- **Server data** (huge lists): use `manualSort` + `manualPagination` + `total`
+  + `onChange` (re-fetch with `sortBy`/`sortDirection`/`page`).
+- Nested/derived sort keys: give the column a `value` accessor.
+- No footer needed: `perPage={0}`.
+- **Search & filters**: put the shared `table-toolbar.svelte` (`TableToolbar`)
+  above the DataTable. Filters + search apply together on the Search button/Enter
+  (don't query on every keystroke); the search field is a `select` of columns.
+
+The `/admin/users` page is the reference implementation. See `docs/development.md`
+("Data tables", "Search & filters") on the PodoKit repo.

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -0,0 +1,81 @@
+import { expect, test, type Page } from "@playwright/test";
+import { anonState } from "../helpers/accounts";
+import { ready } from "../helpers/hydration";
+
+// Verifies that the General settings actually take effect (not just persist).
+// The admin storageState (project default) drives the toggles; a fresh anonymous
+// context checks the public-facing result. Serial workers (workers:1) make the
+// toggle-then-restore pattern safe for the rest of the suite; restores run in a
+// `finally` so a mid-test failure still leaves the shared site settings clean.
+
+async function saveGeneral(page: Page): Promise<void> {
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("General settings saved.")).toBeVisible();
+}
+
+test("general: footer text and links render on public pages @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  const footer = page.getByLabel("Footer text");
+  const support = page.getByLabel("Support email");
+  const origFooter = await footer.inputValue();
+  const origSupport = await support.inputValue();
+  await footer.fill("© 2026 PodoKit Test");
+  await support.fill("help@example.com");
+  await saveGeneral(page);
+  try {
+    await page.goto("/");
+    await expect(page.getByText("© 2026 PodoKit Test")).toBeVisible();
+    await expect(page.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
+  } finally {
+    await ready(page, "/admin/settings");
+    await page.getByLabel("Footer text").fill(origFooter);
+    await page.getByLabel("Support email").fill(origSupport);
+    await saveGeneral(page);
+  }
+});
+
+test("general: maintenance mode holds non-admins on the maintenance page @smoke", async ({ page, browser }) => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  await page.getByRole("switch", { name: "Maintenance mode" }).click();
+  await saveGeneral(page);
+  try {
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}/`);
+    await expect(anon).toHaveURL(/\/maintenance$/);
+    await expect(anon.getByRole("heading", { name: "Under maintenance" })).toBeVisible();
+    await ctx.close();
+    // the admin is not held back
+    await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
+  } finally {
+    await ready(page, "/admin/settings");
+    const t = page.getByRole("switch", { name: "Maintenance mode" });
+    if (await t.isChecked()) {
+      await t.click();
+      await saveGeneral(page);
+    }
+  }
+});
+
+test("general: closing sign-up redirects /signup and hides the link @smoke", async ({ page, browser }) => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  await page.getByRole("switch", { name: "Allow public sign-up" }).click();
+  await saveGeneral(page);
+  try {
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}/signup`);
+    await expect(anon).toHaveURL(/\/login/);
+    await expect(anon.getByRole("link", { name: "Sign up" })).toHaveCount(0);
+    await ctx.close();
+  } finally {
+    await ready(page, "/admin/settings");
+    const t = page.getByRole("switch", { name: "Allow public sign-up" });
+    if (!(await t.isChecked())) {
+      await t.click();
+      await saveGeneral(page);
+    }
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings.ui.spec.ts

@@ -2,9 +2,40 @@ import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default)
-test("settings lists the auth features and their status @smoke", async ({ page }) => {
+
+test("settings has General and Authentication tabs @smoke", async ({ page }) => {
   await ready(page, "/admin/settings");
   await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
+  await expect(page.getByRole("tab", { name: "General" })).toBeVisible();
+  await expect(page.getByRole("tab", { name: "Authentication" })).toBeVisible();
+  // General is the default tab: the site name field is shown.
+  await expect(page.getByLabel("Site name")).toBeVisible();
+});
+
+test("general settings: shows the favicon uploader @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  await expect(page.getByText("Browser icon (favicon)")).toBeVisible();
+  await expect(page.locator('input[type="file"]')).toBeVisible();
+});
+
+test("general settings: edit the site name, save, and apply live @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  const name = page.getByLabel("Site name");
+  const original = await name.inputValue();
+  await name.fill("PodoKit Test Site");
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("General settings saved.")).toBeVisible();
+  // the browser tab title reflects the new name live (no reload)
+  await expect(page).toHaveTitle("PodoKit Test Site");
+  // restore so other specs start clean
+  await name.fill(original);
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("General settings saved.")).toBeVisible();
+});
+
+test("settings lists the auth features under the Authentication tab @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Authentication" }).click();
   await expect(page.getByText("Email & password")).toBeVisible();
   await expect(page.getByText("Two-factor authentication")).toBeVisible();
   await expect(page.getByText("Breached-password check")).toBeVisible();
@@ -13,6 +44,15 @@ test("settings lists the auth features and their status @smoke", async ({ page }
   await expect(page.getByText("Enabled", { exact: true }).first()).toBeVisible();
 });
 
+test("sidebar: back-to-home link returns to the landing page @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  // the home link lives in the sidebar footer, above the user menu
+  await page.getByRole("link", { name: "Back to home" }).click();
+  await expect(page).toHaveURL(/\/$/);
+  // the landing page shows the "Open admin" entry point
+  await expect(page.getByRole("link", { name: "Open admin" })).toBeVisible();
+});
+
 test("settings is reachable from the sidebar @smoke", async ({ page }) => {
   await ready(page, "/admin");
   await page.getByRole("link", { name: "Settings" }).click();
@@ -21,6 +61,7 @@ test("settings is reachable from the sidebar @smoke", async ({ page }) => {
 
 test("admin can toggle a feature flag and it applies live @smoke", async ({ page }) => {
   await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Authentication" }).click();
   const toggle = page.getByRole("switch", { name: "Magic link" });
   test.skip((await toggle.count()) === 0, "magic link toggle not present");
   // Serial workers (workers:1) make toggle-then-restore safe for other specs.

package/dist/templates/modules/admin-dashboard/module.manifest.json

@@ -2,14 +2,16 @@
   "name": "admin-dashboard",
   "description": "Admin dashboard UI (SvelteKit + shadcn-svelte): login/signup/password-reset, a sidebar shell, and user + session management via the better-auth admin plugin. Requires auth.",
   "requires": [
-    "auth"
+    "auth",
+    "object-storage-s3"
   ],
   "targetApp": "web",
   "dependencies": {
     "qrcode": "^1.5.4"
   },
   "devDependencies": {
-    "@types/qrcode": "^1.5.5"
+    "@types/qrcode": "^1.5.5",
+    "@types/multer": "^1.4.12"
   },
   "env": [
     "# admin-dashboard: emails auto-promoted to the admin role on sign-up (comma-separated)",
@@ -35,13 +37,29 @@
       "file": "apps/api/src/auth/auth.ts",
       "marker": "// podokit:end:auth-options",
       "text": "trustedOrigins: (process.env.CORS_ORIGIN ?? \"http://localhost:5001\").split(\",\").map((origin) => origin.trim()),\n  databaseHooks: {\n    user: {\n      create: {\n        before: async (user) => ({\n          data: {\n            ...user,\n            role: (process.env.ADMIN_EMAILS ?? \"\")\n              .split(\",\")\n              .map((email) => email.trim().toLowerCase())\n              .includes(user.email.toLowerCase())\n              ? \"admin\"\n              : \"user\",\n          },\n        }),\n      },\n    },\n  },"
+    },
+    {
+      "file": "AGENTS.md",
+      "marker": "<!-- podokit:end:agents-modules -->",
+      "optional": true,
+      "text": "### admin-dashboard\n- Admin console lives at `/admin/*` (users, sessions, organizations, audit, settings, account). Emails in `ADMIN_EMAILS` become admins on sign-up.\n- **Every list/table MUST use the shared `$lib/components/data-table.svelte` (`DataTable`)** \u2014 it gives sortable headers + a footer pagination. Add search/filters with `$lib/components/table-toolbar.svelte`. Never assemble `Table.Root`/`Table.Header`/`Table.Body` by hand.\n"
+    },
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:end:imports",
+      "text": "import { SiteSettingsModule } from \"./site-settings/site-settings.module\";"
+    },
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:end:module-imports",
+      "text": "SiteSettingsModule,"
     }
   ],
   "instructions": [
     "Set ADMIN_EMAILS in .env (comma-separated). Those emails become admins on sign-up.",
     "Re-run the auth migration to add the admin columns:  npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts",
     "Start the app (npm run dev), open /signup, register an ADMIN_EMAILS address, then sign in.",
-    "Admin pages: /dashboard/users (list, ban, set role, revoke sessions). Everyone: /dashboard/sessions, /dashboard/account.",
-    "Password reset: the reset link is logged to the API console in dev; wire a real mailer via emailAndPassword.sendResetPassword for production."
+    "Admin pages: /admin/users (list, ban, set role, revoke sessions). Everyone: /admin/sessions, /admin/account.",
+    "Password reset emails go through the mailer module (installed automatically with auth); in dev without SMTP they are logged to the API console. Configure SMTP in admin settings or via SMTP_* env for production."
   ]
 }