@podosoft/podokit 0.8.0 → 0.10.0

package/dist/templates/fullstack-nest-svelte/infra/k3s/ingress.yaml

@@ -1,8 +1,18 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: compression
+  namespace: podokit
+spec:
+  compress: {}
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: app
   namespace: podokit
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: podokit-compression@kubernetescrd
 spec:
   rules:
     - host: example.com

package/dist/templates/fullstack-nest-svelte/infra/traefik/dynamic.yml

@@ -5,7 +5,11 @@ http:
     web:
       rule: "PathPrefix(`/`)"  # any host on this dedicated proxy -> web
       entryPoints: [web]
+      middlewares: [compression]
       service: web
+  middlewares:
+    compression:
+      compress: {}
   services:
     web:
       loadBalancer:

package/dist/templates/modules/admin-dashboard/files/apps/api/src/site-settings/site-settings.controller.ts

@@ -26,6 +26,65 @@ const ALLOWED = new Set<string>(PUBLIC_SITE_KEYS);
 const MAX_ICON_BYTES = 1024 * 1024; // 1 MB
 const ICON_TYPES = new Set(["image/svg+xml", "image/png", "image/x-icon", "image/vnd.microsoft.icon"]);
 
+// Theme values are injected into a client-side <style>, so validate them to
+// prevent CSS injection. Colors must be hex, radius a bounded rem number,
+// preset a slug, and overrides a JSON map of hex colors under known token keys.
+const HEX = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
+const PRESET = /^[a-z0-9-]{1,32}$/;
+const THEME_TOKEN_KEYS = new Set([
+  "background",
+  "card",
+  "foreground",
+  "mutedForeground",
+  "border",
+  "secondary",
+  "accent",
+  "primary",
+  "primaryForeground",
+]);
+
+/** Validate/normalize a single theme setting value. Empty string clears it. */
+function validateThemeValue(key: string, value: string): string {
+  if (value === "") return "";
+  if (key === "brandColor") {
+    if (!HEX.test(value)) throw new BadRequestException("brandColor must be a hex color");
+    return value;
+  }
+  if (key === "themePreset") {
+    if (!PRESET.test(value)) throw new BadRequestException("Invalid themePreset");
+    return value;
+  }
+  if (key === "themeRadius") {
+    const n = Number(value);
+    if (!Number.isFinite(n) || n < 0 || n > 4) throw new BadRequestException("themeRadius must be 0–4");
+    return String(n);
+  }
+  if (key === "themeOverrides") {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      throw new BadRequestException("themeOverrides must be valid JSON");
+    }
+    if (!parsed || typeof parsed !== "object") throw new BadRequestException("themeOverrides must be an object");
+    const out: Record<string, Record<string, string>> = {};
+    for (const mode of ["light", "dark"] as const) {
+      const block = (parsed as Record<string, unknown>)[mode];
+      if (block === undefined) continue;
+      if (!block || typeof block !== "object") throw new BadRequestException(`themeOverrides.${mode} must be an object`);
+      const clean: Record<string, string> = {};
+      for (const [k, v] of Object.entries(block as Record<string, unknown>)) {
+        if (!THEME_TOKEN_KEYS.has(k)) throw new BadRequestException(`Unknown theme token: ${k}`);
+        if (typeof v !== "string" || !HEX.test(v)) throw new BadRequestException(`themeOverrides.${mode}.${k} must be a hex color`);
+        clean[k] = v;
+      }
+      if (Object.keys(clean).length) out[mode] = clean;
+    }
+    return JSON.stringify(out);
+  }
+  return value;
+}
+
 @ApiTags("site")
 @Controller("site")
 export class SiteSettingsController {
@@ -53,7 +112,7 @@ export class SiteSettingsController {
     const update: Record<string, string> = {};
     for (const [key, value] of Object.entries(body ?? {})) {
       if (!ALLOWED.has(key)) throw new BadRequestException(`Unknown setting: ${key}`);
-      update[key] = String(value ?? "");
+      update[key] = validateThemeValue(key, String(value ?? ""));
     }
     return this.site.setMany(update);
   }

package/dist/templates/modules/admin-dashboard/files/apps/api/src/site-settings/site-settings.service.ts

@@ -18,6 +18,9 @@ export const PUBLIC_SITE_KEYS = [
   "supportEmail",
   "footerText",
   "brandColor",
+  "themePreset",
+  "themeRadius",
+  "themeOverrides",
   "termsUrl",
   "privacyUrl",
   "locale",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/hooks.server.ts

@@ -1,6 +1,7 @@
 import type { Handle } from "@sveltejs/kit";
 import { serverApiClient } from "$lib/server/api";
 import { resolveLocale } from "$lib/i18n/messages";
+import { applySearchIndexingHeaders } from "$lib/server/search-indexing";
 import type { SiteSettings } from "$lib/site.svelte";
 
 export const handle: Handle = async ({ event, resolve }) => {
@@ -25,7 +26,8 @@ export const handle: Handle = async ({ event, resolve }) => {
     event.locals.user = null;
     event.locals.session = null;
   }
-  return resolve(event, {
+  const response = await resolve(event, {
     transformPageChunk: ({ html }) => html.replace('lang="en"', `lang="${event.locals.locale}"`),
   });
+  return applySearchIndexingHeaders(response, event.url.pathname);
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/account-data.server.ts

@@ -0,0 +1,42 @@
+import type { Capabilities } from "@podosoft/podokit-api-client";
+
+type ServerFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+const defaultCapabilities: Capabilities = {
+  twoFactor: false,
+  providers: [],
+  deleteAccount: false,
+  auditLog: false,
+  emailVerification: false,
+  passwordBreachCheck: false,
+  magicLink: false,
+  emailOtp: false,
+  username: false,
+  multiSession: false,
+  phoneNumber: false,
+  apiKey: false,
+  passkey: false,
+  organization: false,
+  oidcProvider: false,
+  roles: ["admin", "user"],
+};
+
+export async function loadAccountData(locals: App.Locals, fetch: ServerFetch): Promise<{
+  user: App.Locals["user"];
+  currentSessionId: string | null;
+  capabilities: Capabilities;
+}> {
+  let capabilities = defaultCapabilities;
+  try {
+    const response = await fetch("/api/account/capabilities");
+    if (response.ok) capabilities = (await response.json()) as Capabilities;
+  } catch {
+    /* Keep safe defaults if the capability endpoint is unavailable. */
+  }
+
+  return {
+    user: locals.user,
+    currentSessionId: locals.session?.id ?? null,
+    capabilities,
+  };
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-menu.svelte

@@ -0,0 +1,46 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import { Button } from "$lib/components/ui/button";
+  import * as DropdownMenu from "$lib/components/ui/dropdown-menu";
+  import LayoutDashboardIcon from "@lucide/svelte/icons/layout-dashboard";
+  import LogOutIcon from "@lucide/svelte/icons/log-out";
+  import UserIcon from "@lucide/svelte/icons/user";
+  import { api } from "$lib/api";
+  import { getI18n } from "$lib/i18n";
+  import type { SessionUser } from "../../app.d.ts";
+  import UserAvatar from "./user-avatar.svelte";
+
+  let { user }: { user: SessionUser | null } = $props();
+  const i18n = getI18n();
+
+  async function signOut(): Promise<void> {
+    await api.auth.signOut();
+    await goto("/login", { invalidateAll: true });
+  }
+</script>
+
+{#if user}
+  <DropdownMenu.Root>
+    <DropdownMenu.Trigger
+      class="hover:bg-muted focus-visible:border-ring focus-visible:ring-ring/50 inline-flex size-8 items-center justify-center rounded-full outline-none focus-visible:ring-3"
+      aria-label={i18n.t.nav.account}
+    >
+      <UserAvatar {user} class="size-8" />
+    </DropdownMenu.Trigger>
+    <DropdownMenu.Content align="end" class="w-56">
+      <DropdownMenu.Label>
+        <span class="block truncate font-medium">{user.name}</span>
+        <span class="text-muted-foreground block truncate text-xs font-normal">{user.email}</span>
+      </DropdownMenu.Label>
+      <DropdownMenu.Separator />
+      <DropdownMenu.Item onSelect={() => goto("/account")}><UserIcon class="mr-2 size-4" /> {i18n.t.nav.account}</DropdownMenu.Item>
+      {#if user.role === "admin"}
+        <DropdownMenu.Item onSelect={() => goto("/admin")}><LayoutDashboardIcon class="mr-2 size-4" /> {i18n.t.common.appName}</DropdownMenu.Item>
+      {/if}
+      <DropdownMenu.Separator />
+      <DropdownMenu.Item onSelect={signOut}><LogOutIcon class="mr-2 size-4" /> {i18n.t.nav.signOut}</DropdownMenu.Item>
+    </DropdownMenu.Content>
+  </DropdownMenu.Root>
+{:else}
+  <Button href="/login" variant="ghost">{i18n.t.auth.signIn}</Button>
+{/if}