@podosoft/podokit 0.9.0 → 0.10.0

package/dist/templates/modules/object-storage-s3/files/tests/api/storage.api.spec.ts

@@ -0,0 +1,28 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `storage-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "S" } }).catch(() => undefined);
+  return ctx;
+}
+
+test("object storage: put, get, and presign @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const key = `obj-${Date.now()}`;
+  const put = await ctx.put(`/api/storage/${key}`, { data: { content: "hello world" } });
+  test.skip(put.status() >= 500, "object storage (MinIO/S3) not reachable");
+  expect(put.ok()).toBeTruthy();
+  expect(await put.json()).toMatchObject({ key });
+
+  const got = await (await ctx.get(`/api/storage/${key}`)).json();
+  expect(got).toMatchObject({ key, content: "hello world" });
+
+  const pre = await (await ctx.get(`/api/storage/${key}/presigned`)).json();
+  expect(String(pre.url)).toContain(key);
+
+  await ctx.dispose();
+});

package/dist/templates/modules/rate-limit/files/tests/api/rate-limit.api.spec.ts

@@ -0,0 +1,35 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// rate-limit installs a global throttler guard (default RATE_LIMIT_MAX requests
+// per RATE_LIMIT_TTL seconds, per client). This module ships a global guard, so
+// it never joins the shared Outer smoke app (it would throttle every other
+// spec); this spec ships with the module and runs against a dedicated app.
+//
+// Honor RATE_LIMIT_MAX when the test runner has it (a dedicated app sets a small
+// value so the window is crossed in a handful of requests); otherwise fall back
+// to the module default and allow a little headroom.
+const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
+
+test("rate limit: exceeding the window returns 429 @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  // /health is public — no session needed. If the first hit is a 5xx the
+  // throttler's Redis backing isn't reachable; nothing to assert.
+  const probe = await ctx.get("/api/health");
+  test.skip(probe.status() >= 500, "throttler storage (redis) not reachable");
+
+  let seen200 = probe.status() === 200;
+  let got429 = false;
+  for (let i = 0; i < limit + 5 && !got429; i++) {
+    const r = await ctx.get("/api/health");
+    if (r.status() === 200) seen200 = true;
+    if (r.status() === 429) got429 = true;
+  }
+  // A fresh window serves the first requests (200) and rejects once the limit is
+  // crossed (429).
+  expect(seen200).toBe(true);
+  expect(got429).toBe(true);
+  await ctx.dispose();
+});

package/dist/templates/modules/redis/files/tests/api/redis.api.spec.ts

@@ -0,0 +1,30 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Self-contained: sign up + sign in a disposable account so the test works when
+// `auth`'s global guard is installed (the common case). Harmless if the API is open.
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `redis-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "R" } }).catch(() => undefined);
+  return ctx;
+}
+
+test("redis cache: set, get, and miss @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const key = `k-${Date.now()}`;
+  const put = await ctx.put(`/api/cache/${key}`, { data: { value: "hello", ttl: 60 } });
+  test.skip(put.status() >= 500, "redis not reachable");
+  expect(put.ok()).toBeTruthy();
+  expect(await put.json()).toMatchObject({ key });
+
+  const got = await (await ctx.get(`/api/cache/${key}`)).json();
+  expect(got).toMatchObject({ key, value: "hello" });
+
+  const miss = await (await ctx.get(`/api/cache/missing-${Date.now()}`)).json();
+  expect(miss.value).toBeNull();
+
+  await ctx.dispose();
+});

package/dist/templates/modules/sse/files/tests/api/events.api.spec.ts

@@ -0,0 +1,46 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `sse-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "E" } }).catch(() => undefined);
+  return ctx;
+}
+
+test("sse: publish accepts a message @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const pub = await ctx.post("/api/events", { data: { message: `hi-${Date.now()}` } });
+  expect(pub.ok()).toBeTruthy();
+  expect(await pub.json()).toMatchObject({ ok: true });
+  await ctx.dispose();
+});
+
+test("sse: a published message is delivered over the event stream @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  // The stream is behind the auth guard — carry the session cookie on the raw fetch.
+  const cookies = (await ctx.storageState()).cookies.map((c) => `${c.name}=${c.value}`).join("; ");
+  const ac = new AbortController();
+  const stream = await fetch(`${base}/api/events/stream`, { headers: { ...origin, cookie: cookies }, signal: ac.signal }).catch(() => null);
+  test.skip(!stream || !stream.ok || !stream.body, "sse stream not reachable");
+  expect(stream!.headers.get("content-type")).toContain("text/event-stream");
+
+  // Subscriber is attached now; publish, then read until the message arrives.
+  const msg = `sse-${Date.now()}`;
+  await ctx.post("/api/events", { data: { message: msg } });
+
+  const reader = stream!.body!.getReader();
+  const decoder = new TextDecoder();
+  let seen = false;
+  const deadline = Date.now() + 8000;
+  while (Date.now() < deadline && !seen) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    if (decoder.decode(value).includes(msg)) seen = true;
+  }
+  ac.abort();
+  expect(seen).toBe(true);
+  await ctx.dispose();
+});

package/dist/templates/todo/apps/web/src/lib/components/site-runtime.svelte

@@ -0,0 +1,7 @@
+<script lang="ts">
+  // Modules can replace this managed component with global site behavior while
+  // the surrounding route layout remains application-owned.
+  import { ModeWatcher } from "mode-watcher";
+</script>
+
+<ModeWatcher />

package/dist/templates/todo/apps/web/src/lib/server/backend-proxy.ts

@@ -37,7 +37,9 @@ export async function proxyRequest(
   const upstream = await fetch(targetUrl, {
     method: request.method,
     headers,
-    body: hasBody ? await request.text() : undefined,
+    // Preserve multipart uploads and other binary bodies byte-for-byte. Reading
+    // them as text corrupts bytes that are not valid UTF-8 before forwarding.
+    body: hasBody ? await request.arrayBuffer() : undefined,
     redirect: "manual",
   });
 

package/dist/templates/todo/apps/web/src/routes/+layout.svelte

@@ -1,9 +1,9 @@
 <script lang="ts">
   import "../app.css";
-  import { ModeWatcher } from "mode-watcher";
+  import SiteRuntime from "$lib/components/site-runtime.svelte";
 
   let { children } = $props();
 </script>
 
-<ModeWatcher />
+<SiteRuntime />
 {@render children()}

package/dist/templates/todo/dot-gitignore

@@ -12,3 +12,9 @@ build/
 tests/playwright/
 tests/playwright-report/
 tests/test-results/
+playwright/.auth/
+playwright-report/
+test-results/
+
+# local performance reports
+output/lighthouse/

package/dist/templates/todo/infra/k3s/ingress.yaml

@@ -1,8 +1,18 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: compression
+  namespace: podokit
+spec:
+  compress: {}
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: app
   namespace: podokit
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: podokit-compression@kubernetescrd
 spec:
   rules:
     - host: example.com

package/dist/templates/todo/infra/traefik/dynamic.yml

@@ -5,7 +5,11 @@ http:
     web:
       rule: "PathPrefix(`/`)"  # any host on this dedicated proxy -> web
       entryPoints: [web]
+      middlewares: [compression]
       service: web
+  middlewares:
+    compression:
+      compress: {}
   services:
     web:
       loadBalancer:

package/dist/update.js

@@ -9,6 +9,7 @@ const podokit_template_engine_1 = require("@podosoft/podokit-template-engine");
 const assemble_1 = require("./assemble");
 const lockfile_1 = require("./lockfile");
 const inspect_1 = require("./inspect");
+const add_1 = require("./add");
 function treeText(tree, path) {
     const file = tree.get(path);
     if (!file)
@@ -32,7 +33,8 @@ function planUpdate(projectRoot, templatesDir) {
         templatesDir,
         template: manifest.template,
         answers: manifest.answers,
-        modules: manifest.modules.map((m) => m.name),
+        modules: manifest.modules,
+        projectRoot,
     });
     const changes = [];
     const paths = new Set([...newTree.keys(), ...Object.keys(lock.files)]);
@@ -92,6 +94,40 @@ function writeFile(projectRoot, path, content) {
     (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(abs), { recursive: true });
     (0, node_fs_1.writeFileSync)(abs, content);
 }
+/**
+ * Refresh update metadata without teaching the lock that a clean 3-way merge is
+ * PodoKit's new baseline. Managed files keep the newly assembled template hash,
+ * so the user's merged lines are still recognised as edits on the next update.
+ * Files that are neither in the assembled tree nor explicitly owned stay out of
+ * the lock instead of being accidentally adopted as managed files.
+ */
+function updatedFilesLock(projectRoot, newTree, previous, ownedGlobs) {
+    const next = (0, lockfile_1.computeFilesLock)(projectRoot, ownedGlobs);
+    for (const [path, entry] of Object.entries(next.files)) {
+        const newText = treeText(newTree, path);
+        if (newText !== null) {
+            if (entry.tier !== "owned") {
+                entry.tier = previous.files[path]?.tier ?? entry.tier;
+                entry.outHash = (0, podokit_template_engine_1.hashContent)(newText);
+            }
+            continue;
+        }
+        if (entry.tier === "owned")
+            continue;
+        const oldEntry = previous.files[path];
+        if (oldEntry && oldEntry.tier !== "owned") {
+            // Removed upstream but kept on disk because it was edited: continue to
+            // report the removal conflict until the user deletes or ejects it.
+            entry.tier = oldEntry.tier;
+            entry.outHash = oldEntry.outHash;
+        }
+        else {
+            // A file created by the application is not implicitly PodoKit-managed.
+            delete next.files[path];
+        }
+    }
+    return next;
+}
 /**
  * Apply an update to the working copy. Clean updates and additions are written,
  * upstream removals deleted, and user-edited files 3-way merged against the old
@@ -101,13 +137,26 @@ function writeFile(projectRoot, path, content) {
  */
 function applyUpdate(projectRoot, templatesDir, options = {}) {
     const manifest = (0, lockfile_1.readManifest)(projectRoot);
-    if (!manifest)
+    const previousLock = (0, lockfile_1.readFilesLock)(projectRoot);
+    if (!manifest || !previousLock)
         throw new inspect_1.NotAProjectError();
     const plan = planUpdate(projectRoot, templatesDir);
-    const modules = manifest.modules.map((m) => m.name);
-    const newTree = (0, assemble_1.assembleProject)({ templatesDir, template: manifest.template, answers: manifest.answers, modules });
+    const modules = manifest.modules;
+    const newTree = (0, assemble_1.assembleProject)({
+        templatesDir,
+        template: manifest.template,
+        answers: manifest.answers,
+        modules,
+        projectRoot,
+    });
     const oldTree = options.oldTemplatesDir
-        ? (0, assemble_1.assembleProject)({ templatesDir: options.oldTemplatesDir, template: manifest.template, answers: manifest.answers, modules })
+        ? (0, assemble_1.assembleProject)({
+            templatesDir: options.oldTemplatesDir,
+            template: manifest.template,
+            answers: manifest.answers,
+            modules,
+            projectRoot,
+        })
         : null;
     const result = { written: [], removed: [], merged: [], conflicts: [] };
     for (const change of plan.changes) {
@@ -136,9 +185,26 @@ function applyUpdate(projectRoot, templatesDir, options = {}) {
                 result.merged.push(change.path);
         }
     }
-    // Refresh the lock to match what we just wrote and stamp the new version.
-    (0, lockfile_1.writeFilesLock)(projectRoot, (0, lockfile_1.computeFilesLock)(projectRoot, manifest.ownedGlobs));
-    (0, lockfile_1.writeManifest)(projectRoot, { ...manifest, podokitVersion: (0, lockfile_1.podokitVersion)() });
+    // Keep the assembled target as the managed baseline. A merged working file
+    // intentionally remains drifted so a future update performs another 3-way
+    // merge instead of treating the user's lines as clean generated output.
+    (0, lockfile_1.writeFilesLock)(projectRoot, updatedFilesLock(projectRoot, newTree, previousLock, manifest.ownedGlobs));
+    const modulesDir = (0, node_path_1.join)(templatesDir, "modules");
+    const refreshedModules = manifest.modules.map((module) => {
+        const resolved = (0, add_1.resolveModule)(module.packageName ?? module.name, modulesDir, projectRoot);
+        return resolved?.packageName
+            ? {
+                ...module,
+                packageName: resolved.packageName,
+                moduleVersion: resolved.moduleVersion,
+            }
+            : module;
+    });
+    (0, lockfile_1.writeManifest)(projectRoot, {
+        ...manifest,
+        modules: refreshedModules,
+        podokitVersion: (0, lockfile_1.podokitVersion)(),
+    });
     return result;
 }
 /** Count actions for a one-line summary. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.svelte

@@ -1,61 +0,0 @@
-<script lang="ts">
-  import "../app.css";
-  import { ModeWatcher } from "mode-watcher";
-  import { setI18nContext } from "$lib/i18n";
-  import { messages, resolveLocale } from "$lib/i18n/messages";
-  import { site } from "$lib/site.svelte";
-
-  let { children, data } = $props();
-  const locale = $derived(resolveLocale(data.locale));
-  setI18nContext({
-    get t() {
-      return messages[locale];
-    },
-    get locale() {
-      return locale;
-    },
-  });
-
-  // Seed the reactive site branding; the general-settings form patches it live.
-  $effect.pre(() => site.init(data.site));
-  // Prefer live store values (patched after a save); fall back to the server load
-  // so SSR renders the saved branding too. Empty falls back to the app.html default.
-  const branding = $derived({
-    name: site.value.name ?? data.site?.name ?? "",
-    description: site.value.description ?? data.site?.description ?? "",
-    brandColor: site.value.brandColor ?? data.site?.brandColor ?? "",
-    hasFavicon: site.value.hasFavicon || Boolean(data.site?.hasFavicon),
-    faviconVersion: site.value.faviconVersion ?? data.site?.faviconVersion ?? "",
-  });
-  // Apply the site name to the browser tab live (avoids a duplicate <title> vs
-  // the app.html default; the default project name stays as the SSR fallback).
-  $effect(() => {
-    if (branding.name) document.title = branding.name;
-  });
-  // Apply the brand color as the theme's primary accent live. Clearing it in
-  // Settings restores the stylesheet default (remove the inline override).
-  $effect(() => {
-    const root = document.documentElement;
-    if (branding.brandColor) {
-      root.style.setProperty("--primary", branding.brandColor);
-      root.style.setProperty("--sidebar-primary", branding.brandColor);
-      root.style.setProperty("--ring", branding.brandColor);
-    } else {
-      root.style.removeProperty("--primary");
-      root.style.removeProperty("--sidebar-primary");
-      root.style.removeProperty("--ring");
-    }
-  });
-</script>
-
-<svelte:head>
-  {#if branding.description}
-    <meta name="description" content={branding.description} />
-  {/if}
-  {#if branding.hasFavicon}
-    <link rel="icon" href={`/api/site/favicon?v=${branding.faviconVersion}`} />
-  {/if}
-</svelte:head>
-
-<ModeWatcher />
-{@render children()}