@podosoft/podokit 0.9.0 → 0.10.1

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/settings/+page.svelte

@@ -7,8 +7,10 @@
   import { Button } from "$lib/components/ui/button";
   import * as Card from "$lib/components/ui/card";
   import * as Dialog from "$lib/components/ui/dialog";
+  import * as Select from "$lib/components/ui/select";
   import * as Tabs from "$lib/components/ui/tabs";
   import GeneralSettings from "./general-settings.svelte";
+  import AppearanceCard from "$lib/components/settings/appearance-card.svelte";
   import { moduleSettingsSections } from "$lib/admin/registry.svelte";
   import { toast } from "svelte-sonner";
   import { api } from "$lib/api";
@@ -237,6 +239,7 @@
   <Tabs.Root value="general">
     <Tabs.List>
       <Tabs.Trigger value="general">{i18n.t.general.tab}</Tabs.Trigger>
+      <Tabs.Trigger value="appearance">{i18n.t.general.appearanceTitle}</Tabs.Trigger>
       <Tabs.Trigger value="auth">{i18n.t.settings.tab}</Tabs.Trigger>
       {#each moduleSettingsSections as s (s.value)}
         <Tabs.Trigger value={s.value}>{s.label(i18n.t)}</Tabs.Trigger>
@@ -247,6 +250,10 @@
       <GeneralSettings />
     </Tabs.Content>
 
+    <Tabs.Content value="appearance" class="mt-6">
+      <AppearanceCard />
+    </Tabs.Content>
+
     <Tabs.Content value="auth" class="mt-6 flex flex-col gap-6">
       {#each sections as section (section.title)}
         <section class="flex flex-col gap-3">
@@ -306,15 +313,16 @@
         {#if socialForm.adding}
           <div class="flex flex-col gap-1">
             <Label for="social-provider">{i18n.t.settings.provider}</Label>
-            <select
-              id="social-provider"
-              bind:value={socialForm.id}
-              class="border-input bg-background ring-offset-background focus-visible:ring-ring h-9 rounded-md border px-3 text-sm focus-visible:ring-2 focus-visible:outline-none"
-            >
-              {#each addable as p (p.id)}
-                <option value={p.id}>{p.label}</option>
-              {/each}
-            </select>
+            <Select.Root type="single" bind:value={socialForm.id}>
+              <Select.Trigger id="social-provider" class="w-full">
+                {addable.find((p) => p.id === socialForm.id)?.label ?? i18n.t.settings.provider}
+              </Select.Trigger>
+              <Select.Content>
+                {#each addable as p (p.id)}
+                  <Select.Item value={p.id} label={p.label}>{p.label}</Select.Item>
+                {/each}
+              </Select.Content>
+            </Select.Root>
           </div>
         {/if}
         <label class="flex items-center justify-between gap-3 text-sm font-medium">{i18n.t.settings.smtpEnabled}<Switch aria-label={i18n.t.settings.smtpEnabled} bind:checked={socialForm.enabled} /></label>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(app)/admin/settings/general-settings.svelte

@@ -19,7 +19,6 @@
     description: "",
     supportEmail: "",
     footerText: "",
-    brandColor: "",
     termsUrl: "",
     privacyUrl: "",
     locale: "",
@@ -35,7 +34,6 @@
       description: s.description ?? "",
       supportEmail: s.supportEmail ?? "",
       footerText: s.footerText ?? "",
-      brandColor: s.brandColor ?? "",
       termsUrl: s.termsUrl ?? "",
       privacyUrl: s.privacyUrl ?? "",
       locale: s.locale ?? "",
@@ -127,11 +125,6 @@
           </div>
         </div>
       </div>
-
-      <div class="flex flex-col gap-1.5">
-        <Label for="brand-color">{t.brandColor}</Label>
-        <Input id="brand-color" bind:value={form.brandColor} placeholder="#6d28d9" />
-      </div>
     </Card.Content>
   </Card.Root>
 

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/account/+page.server.ts

@@ -0,0 +1,4 @@
+import { loadAccountData } from "$lib/account-data.server";
+import type { PageServerLoad } from "./$types";
+
+export const load: PageServerLoad = ({ locals, fetch }) => loadAccountData(locals, fetch);

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/account/+page.svelte

@@ -0,0 +1,35 @@
+<script lang="ts">
+  import AccountPage from "$lib/components/account-page.svelte";
+  import LanguageSwitch from "$lib/components/language-switch.svelte";
+  import SiteFooter from "$lib/components/site-footer.svelte";
+  import ThemeToggle from "$lib/components/theme-toggle.svelte";
+  import { Button } from "$lib/components/ui/button";
+  import { Toaster } from "$lib/components/ui/sonner";
+  import { getI18n } from "$lib/i18n";
+  import type { Capabilities } from "@podosoft/podokit-api-client";
+  import type { SessionUser } from "../../app.d.ts";
+
+  let {
+    data,
+  }: {
+    data: { user: SessionUser; currentSessionId: string | null; capabilities: Capabilities };
+  } = $props();
+  const i18n = getI18n();
+</script>
+
+<div class="flex min-h-svh flex-col">
+  <header class="flex h-14 items-center gap-2 border-b px-4">
+    <Button href="/" variant="ghost">{i18n.t.nav.home}</Button>
+    <div class="flex-1"></div>
+    {#if data.user.role === "admin"}
+      <Button href="/admin" variant="outline">{i18n.t.common.appName}</Button>
+    {/if}
+    <LanguageSwitch />
+    <ThemeToggle />
+  </header>
+  <main class="mx-auto w-full max-w-6xl flex-1 p-4 sm:p-6">
+    <AccountPage {data} />
+  </main>
+  <SiteFooter />
+</div>
+<Toaster />

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -0,0 +1,56 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Fresh admin context so these never rotate the seeded admin session.
+async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  return ctx;
+}
+
+test("theme settings: valid preset/radius/accent round-trip @smoke", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const put = await admin.put("/api/site/settings", {
+    data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
+  });
+  expect(put.ok()).toBeTruthy();
+
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const settings = await (await anon.get("/api/site/settings")).json();
+  expect(settings.themePreset).toBe("slate");
+  expect(settings.themeRadius).toBe("0.75");
+  expect(settings.brandColor).toBe("#2563eb");
+
+  // restore
+  await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
+  await anon.dispose();
+});
+
+test("theme settings: valid per-token overrides accepted @smoke", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
+  const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
+  expect(put.ok()).toBeTruthy();
+  await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
+});
+
+test("theme settings: invalid values are rejected (no CSS injection)", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const bad = [
+    { brandColor: "red; } body{display:none" },
+    { brandColor: "notacolor" },
+    { themeRadius: "9" },
+    { themeRadius: "-1" },
+    { themePreset: "bad preset!" },
+    { themeOverrides: "{not json" },
+    { themeOverrides: JSON.stringify({ light: { primary: "nothex" } }) },
+    { themeOverrides: JSON.stringify({ light: { bogusToken: "#ffffff" } }) },
+    { unknownKey: "x" },
+  ];
+  for (const data of bad) {
+    expect((await admin.put("/api/site/settings", { data })).status(), JSON.stringify(data)).toBe(400);
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -16,6 +16,16 @@ async function seedSession(
     data: { email: account.email, password: account.password },
   });
   expect(res.ok(), `sign-in ${account.email}`).toBeTruthy();
+  // Keep repeated local runs from filling better-auth's 100-session response
+  // before the newly created current session can appear in account tests. The
+  // endpoint clears at most one response page, so drain several pages when a
+  // long-lived local database has accumulated them.
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    const sessionsResponse = await ctx.get("/api/auth/list-sessions");
+    const sessions = sessionsResponse.ok() ? (await sessionsResponse.json()) as unknown : [];
+    if (!Array.isArray(sessions) || sessions.length <= 1) break;
+    expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
+  }
   await ctx.storageState({ path });
   await ctx.dispose();
 }

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
+import { ADMIN } from "../helpers/accounts";
 
 // admin storageState (project default)
 test("account opens on the profile section @smoke", async ({ page }) => {
@@ -9,7 +10,7 @@ test("account opens on the profile section @smoke", async ({ page }) => {
   await expect(page.getByLabel("Email")).toHaveValue("admin@example.com");
   // save is enabled only once the name changes
   await expect(page.getByRole("button", { name: "Save changes" })).toBeDisabled();
-  await page.getByLabel("Name", { exact: true }).fill("Admin Renamed");
+  await page.getByLabel("Name", { exact: true }).fill(`Admin Preview ${Date.now()}`);
   await expect(page.getByRole("button", { name: "Save changes" })).toBeEnabled();
 });
 
@@ -82,7 +83,13 @@ test("account shows a phone field when enabled @smoke", async ({ page }) => {
 
 test("admin can update their profile name", async ({ page }) => {
   await ready(page, "/admin/account");
-  await page.getByLabel("Name", { exact: true }).fill("Admin Renamed");
+  const name = page.getByLabel("Name", { exact: true });
+  await name.fill(`Admin Updated ${Date.now()}`);
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("Profile updated")).toBeVisible();
+  await ready(page, "/admin/account");
+  const refreshedName = page.getByLabel("Name", { exact: true });
+  await refreshedName.fill(ADMIN.name);
   await page.getByRole("button", { name: "Save changes" }).click();
   await expect(page.getByText("Profile updated")).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -0,0 +1,64 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default). The Appearance controls live in their
+// own "Appearance" settings tab.
+async function openAppearance(page: import("@playwright/test").Page): Promise<void> {
+  await ready(page, "/admin/settings");
+  const tab = page.getByRole("tab", { name: "Appearance" });
+  await expect(async () => {
+    await tab.click();
+    await expect(tab).toHaveAttribute("data-state", "active");
+  }).toPass();
+}
+
+test("appearance: has its own tab with theme controls @smoke", async ({ page }) => {
+  await openAppearance(page);
+  await expect(page.getByRole("heading", { name: "Featured themes" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Default", exact: true })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Violet" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Zinc" })).toBeHidden();
+  await expect(page.getByLabel("Brand color").first()).toBeVisible();
+  await expect(page.getByText("Corner style", { exact: true })).toBeVisible();
+  await expect(page.getByText("Preview", { exact: true })).toBeVisible();
+});
+
+test("appearance: keeps the full preset catalog behind a disclosure", async ({ page }) => {
+  await openAppearance(page);
+  await page.getByRole("button", { name: "Show more themes" }).click();
+  await expect(page.getByRole("button", { name: "Zinc" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "GitHub" })).toBeVisible();
+  await page.getByRole("button", { name: "Show fewer themes" }).click();
+  await expect(page.getByRole("button", { name: "Zinc" })).toBeHidden();
+});
+
+test("appearance: preview light/dark toggle switches modes", async ({ page }) => {
+  await openAppearance(page);
+  await expect(page.getByRole("button", { name: "Light" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Dark" })).toBeVisible();
+  await page.getByRole("button", { name: "Dark" }).click();
+});
+
+test("appearance: advanced reveals per-token pickers", async ({ page }) => {
+  await openAppearance(page);
+  await page.getByRole("button", { name: "Fine-tune colors" }).click();
+  await expect(page.getByRole("button", { name: "Clear color adjustments" })).toBeVisible();
+  await expect(page.getByLabel("Primary light")).toBeVisible();
+  await page.getByRole("button", { name: "Dark", exact: true }).last().click();
+  await expect(page.getByLabel("Primary dark")).toBeVisible();
+});
+
+test("appearance: pick a preset, save, apply live, then restore @smoke", async ({ page }) => {
+  await openAppearance(page);
+  await page.getByRole("button", { name: "Slate" }).click();
+  await page.getByRole("button", { name: "Medium" }).click();
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("General settings saved.").first()).toBeVisible();
+  // Applied globally via the scoped override stylesheet.
+  await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
+
+  // "Restore defaults" reverts everything in one click and persists.
+  await page.getByRole("button", { name: "Restore defaults" }).click();
+  await expect(page.getByText("General settings saved.").first()).toBeVisible();
+  await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -8,29 +8,58 @@ import { ready } from "../helpers/hydration";
 // toggle-then-restore pattern safe for the rest of the suite; restores run in a
 // `finally` so a mid-test failure still leaves the shared site settings clean.
 
-async function saveGeneral(page: Page): Promise<void> {
-  await page.getByRole("button", { name: "Save changes" }).click();
-  await expect(page.getByText("General settings saved.")).toBeVisible();
+async function saveGeneral(
+  page: Page,
+  prepare?: () => Promise<void>,
+  expected?: Record<string, string>,
+): Promise<void> {
+  const button = page.getByRole("button", { name: "Save changes" });
+  await expect(async () => {
+    await prepare?.();
+    const saved = page.waitForResponse(
+      (response) => response.url().endsWith("/api/site/settings") && response.request().method() === "PUT",
+      { timeout: 3_000 },
+    );
+    await button.click();
+    const response = await saved;
+    expect(response.ok()).toBeTruthy();
+    if (expected) expect(await response.json()).toMatchObject(expected);
+  }).toPass({ timeout: 10_000 });
+  await expect(page.getByText("General settings saved.").last()).toBeVisible();
 }
 
-test("general: footer text and links render on public pages @smoke", async ({ page }) => {
+test("general: footer text and links render on public pages @smoke", async ({ page, browser }) => {
   await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
   const footer = page.getByLabel("Footer text");
   const support = page.getByLabel("Support email");
   const origFooter = await footer.inputValue();
   const origSupport = await support.inputValue();
-  await footer.fill("© 2026 PodoKit Test");
-  await support.fill("help@example.com");
-  await saveGeneral(page);
+  await saveGeneral(
+    page,
+    async () => {
+      await footer.fill("© 2026 PodoKit Test");
+      await support.fill("help@example.com");
+    },
+    { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
+  );
   try {
-    await page.goto("/");
-    await expect(page.getByText("© 2026 PodoKit Test")).toBeVisible();
-    await expect(page.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}/login`);
+    await expect(anon.getByText("© 2026 PodoKit Test")).toBeVisible();
+    await expect(anon.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
+    await ctx.close();
   } finally {
     await ready(page, "/admin/settings");
-    await page.getByLabel("Footer text").fill(origFooter);
-    await page.getByLabel("Support email").fill(origSupport);
-    await saveGeneral(page);
+    await saveGeneral(
+      page,
+      async () => {
+        await page.getByLabel("Footer text").fill(origFooter);
+        await page.getByLabel("Support email").fill(origSupport);
+      },
+      { footerText: origFooter, supportEmail: origSupport },
+    );
   }
 });
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/guards.ui.spec.ts

@@ -4,8 +4,20 @@ import { anonState, userState } from "../helpers/accounts";
 test.describe("unauthenticated", () => {
   test.use({ storageState: anonState });
   test("protected route redirects to login @smoke", async ({ page }) => {
-    await page.goto("/admin");
-    await expect(page).toHaveURL(/\/login\?redirect=/);
+    for (const route of ["/admin", "/account"]) {
+      await page.goto(route);
+      await expect(page).toHaveURL(/\/login\?redirect=/);
+    }
+  });
+
+  test("private and authentication routes prevent search indexing @smoke", async ({ request }) => {
+    for (const route of ["/admin", "/account", "/login", "/api/account/me"]) {
+      const response = await request.get(route, { maxRedirects: 0 });
+      expect(response.headers()["x-robots-tag"]).toBe("noindex, nofollow");
+    }
+
+    const landing = await request.get("/");
+    expect(landing.headers()["x-robots-tag"]).toBeUndefined();
   });
 });
 
@@ -19,4 +31,11 @@ test.describe("normal user (non-admin)", () => {
     expect((await page.goto("/admin/sessions"))?.status()).toBe(403);
     expect((await page.goto("/admin/settings"))?.status()).toBe(403);
   });
+
+  test("account is available without the admin shell @smoke", async ({ page }) => {
+    await page.goto("/account");
+    await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
+    await expect(page.getByLabel("Name", { exact: true })).toBeVisible();
+    await expect(page.getByRole("link", { name: "Overview" })).toHaveCount(0);
+  });
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/passkey.ui.spec.ts

@@ -18,7 +18,7 @@ test("register a passkey and sign in with it @smoke", async ({ page, baseURL })
   const email = `pk-${Date.now()}@example.com`;
   const pw = "Podokit3e-Str0ng!pw";
   const signup = await page.context().request.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "PK" }, headers: origin });
-  expect(signup.ok()).toBeTruthy();
+  expect(signup.ok(), await signup.text()).toBeTruthy();
 
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings-dialogs.ui.spec.ts

@@ -22,9 +22,11 @@ test("settings: add and remove a social login provider @smoke", async ({ page })
   }).toPass({ timeout: 25000 });
 
   await addBtn.click();
-  const select = dialog.locator("#social-provider");
-  await expect(select.locator("option").first()).toBeAttached();
-  const providerId = await select.inputValue(); // first addable provider (not hard-coded)
+  const provider = dialog.locator("#social-provider");
+  await expect(provider).toBeVisible();
+  const callback = await dialog.locator("code").textContent();
+  const providerId = callback?.trim().split("/").pop() ?? ""; // first addable provider (not hard-coded)
+  expect(providerId).not.toBe("");
   try {
     await dialog.locator("#social-id").fill("test-client-id");
     await dialog.locator("#social-secret").fill("test-secret");

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings.ui.spec.ts

@@ -1,8 +1,17 @@
-import { expect, test } from "@playwright/test";
+import { expect, test, type Page } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default)
 
+async function saveGeneral(page: Page): Promise<void> {
+  const saved = page.waitForResponse(
+    (response) => response.url().endsWith("/api/site/settings") && response.request().method() === "PUT",
+  );
+  await page.getByRole("button", { name: "Save changes" }).click();
+  expect((await saved).ok()).toBeTruthy();
+  await expect(page.getByText("General settings saved.").last()).toBeVisible();
+}
+
 test("settings has General and Authentication tabs @smoke", async ({ page }) => {
   await ready(page, "/admin/settings");
   await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
@@ -23,14 +32,12 @@ test("general settings: edit the site name, save, and apply live @smoke", async
   const name = page.getByLabel("Site name");
   const original = await name.inputValue();
   await name.fill("PodoKit Test Site");
-  await page.getByRole("button", { name: "Save changes" }).click();
-  await expect(page.getByText("General settings saved.")).toBeVisible();
+  await saveGeneral(page);
   // the browser tab title reflects the new name live (no reload)
   await expect(page).toHaveTitle("PodoKit Test Site");
   // restore so other specs start clean
   await name.fill(original);
-  await page.getByRole("button", { name: "Save changes" }).click();
-  await expect(page.getByText("General settings saved.")).toBeVisible();
+  await saveGeneral(page);
 });
 
 test("settings lists the auth features under the Authentication tab @smoke", async ({ page }) => {
@@ -49,8 +56,8 @@ test("sidebar: back-to-home link returns to the landing page @smoke", async ({ p
   // the home link lives in the sidebar footer, above the user menu
   await page.getByRole("link", { name: "Back to home" }).click();
   await expect(page).toHaveURL(/\/$/);
-  // the landing page shows the "Open admin" entry point
-  await expect(page.getByRole("link", { name: "Open admin" })).toBeVisible();
+  // Landing routes are app-owned, so only verify the shared page shell.
+  await expect(page.locator("main").first()).toBeVisible();
 });
 
 test("settings is reachable from the sidebar @smoke", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/two-factor.ui.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test, type Page } from "@playwright/test";
 import { anonState } from "../helpers/accounts";
 import { totpCode } from "../helpers/totp";
 
@@ -7,6 +7,14 @@ test.use({ storageState: anonState });
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
+async function openHydratedLogin(page: Page, redirect?: string): Promise<void> {
+  const query = redirect ? `?redirect=${encodeURIComponent(redirect)}` : "";
+  await page.goto(`/login${query}`);
+  // The form is server-rendered before Svelte attaches its submit handler. Wait
+  // for the client bundle so a fast test click cannot trigger a native reload.
+  await page.waitForLoadState("networkidle");
+}
+
 // A disposable account (never the shared admin/user) so enabling 2FA here can't
 // invalidate the seeded sessions the other auth specs rely on.
 test("two-factor: sign in with a backup code from the login page @smoke", async ({ page, playwright }) => {
@@ -23,7 +31,7 @@ test("two-factor: sign in with a backup code from the login page @smoke", async
   await api.dispose();
 
   // Password sign-in hands off to the second-factor step (no session yet).
-  await page.goto(`/login?redirect=${encodeURIComponent("/admin/account")}`);
+  await openHydratedLogin(page, "/admin/account");
   await page.getByLabel("Email").fill(email);
   await page.getByLabel("Password").fill(pw);
   await page.getByRole("button", { name: "Sign in", exact: true }).click();
@@ -66,7 +74,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page @smoke", a
     await probe.dispose();
 
     // Signing in through the UI lands on the mandatory enrolment page.
-    await page.goto("/login");
+    await openHydratedLogin(page);
     await page.getByLabel("Email").fill(email);
     await page.getByLabel("Password").fill(pw);
     await page.getByRole("button", { name: "Sign in", exact: true }).click();
@@ -111,7 +119,7 @@ test("account: regenerate backup codes shows a fresh set @smoke", async ({ page,
   await api.dispose();
 
   // Sign in (backup-code path) straight to the account page.
-  await page.goto(`/login?redirect=${encodeURIComponent("/admin/account")}`);
+  await openHydratedLogin(page, "/admin/account");
   await page.getByLabel("Email").fill(email);
   await page.getByLabel("Password").fill(pw);
   await page.getByRole("button", { name: "Sign in", exact: true }).click();

package/dist/templates/modules/admin-dashboard/module.manifest.json

@@ -59,7 +59,7 @@
     "Set ADMIN_EMAILS in .env (comma-separated). Those emails become admins on sign-up.",
     "Re-run the auth migration to add the admin columns:  npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts",
     "Start the app (npm run dev), open /signup, register an ADMIN_EMAILS address, then sign in.",
-    "Admin pages: /admin/users (list, ban, set role, revoke sessions). Everyone: /admin/sessions, /admin/account.",
+    "Admin pages: /admin/users (list, ban, set role, revoke sessions). Signed-in users manage their profile and security at /account; /admin/account remains available in the admin shell. Admin, account, authentication, maintenance, and API responses include X-Robots-Tag: noindex, nofollow by default.",
     "Password reset emails go through the mailer module (installed automatically with auth); in dev without SMTP they are logged to the API console. Configure SMTP in admin settings or via SMTP_* env for production."
   ]
 }

package/dist/templates/modules/api-key-auth/files/tests/api/machine.api.spec.ts

@@ -0,0 +1,25 @@
+import { expect, test } from "@playwright/test";
+
+// api-key auth is machine-to-machine: clients call the backend API directly, not
+// through the browser web proxy (which strips custom headers by design). So this
+// test targets the backend URL (`E2E_API_URL`) and skips when it isn't provided.
+const apiBase = process.env.E2E_API_URL;
+const apiOrigin = { origin: apiBase ?? "" };
+
+// The static service key(s) come from the `API_KEYS` env var; the module ships
+// `dev-key-please-change` as the default in .env.example.
+const KEY = process.env.E2E_API_KEY ?? "dev-key-please-change";
+
+test("api-key auth: a valid key passes, missing/invalid are 401 @smoke", async ({ request }) => {
+  test.skip(!apiBase, "E2E_API_URL (backend base) not set");
+  const ok = await request.get(`${apiBase}/machine/ping`, { headers: { ...apiOrigin, "x-api-key": KEY } });
+  test.skip(ok.status() === 404, "api-key-auth not installed");
+  expect(ok.status()).toBe(200);
+  expect(await ok.json()).toMatchObject({ ok: true, via: "api-key" });
+
+  const missing = await request.get(`${apiBase}/machine/ping`, { headers: apiOrigin });
+  expect(missing.status()).toBe(401);
+
+  const invalid = await request.get(`${apiBase}/machine/ping`, { headers: { ...apiOrigin, "x-api-key": "wrong-key" } });
+  expect(invalid.status()).toBe(401);
+});

package/dist/templates/modules/auth/files/apps/api/src/health/health.controller.ts

@@ -1,4 +1,4 @@
-import { Controller, Get } from "@nestjs/common";
+import { Controller, Get, ServiceUnavailableException } from "@nestjs/common";
 import { InjectDataSource } from "@nestjs/typeorm";
 import { DataSource } from "typeorm";
 import { Public } from "@thallesp/nestjs-better-auth";
@@ -20,7 +20,7 @@ export class HealthController {
       await this.dataSource.query("SELECT 1");
       return { status: "ready", db: "up" };
     } catch {
-      return { status: "degraded", db: "down" };
+      throw new ServiceUnavailableException({ status: "degraded", db: "down" });
     }
   }
 }

package/dist/templates/modules/auth/files/apps/api/src/migrate.ts

@@ -0,0 +1,22 @@
+import { getMigrations } from "better-auth/db/migration";
+import { auth } from "./auth/auth";
+import { pool } from "./auth/db";
+import dataSource from "./database/data-source";
+
+async function runMigrations(): Promise<void> {
+  const authMigrations = await getMigrations(auth.options);
+  await authMigrations.runMigrations();
+
+  await dataSource.initialize();
+  await dataSource.runMigrations();
+}
+
+runMigrations()
+  .catch((error: unknown) => {
+    console.error("Run database migrations failed", error);
+    process.exitCode = 1;
+  })
+  .finally(async (): Promise<void> => {
+    if (dataSource.isInitialized) await dataSource.destroy();
+    await pool.end();
+  });

package/dist/templates/modules/auth/module.manifest.json

@@ -16,6 +16,9 @@
   "devDependencies": {
     "@types/pg": "^8.11.10"
   },
+  "scripts": {
+    "migrate:all": "node dist/migrate"
+  },
   "env": [
     "# \u2500\u2500 Auth (better-auth) \u2014 the only required secrets \u2500\u2500",
     "# BETTER_AUTH_SECRET also derives the key that encrypts config secrets stored in the",
@@ -101,13 +104,14 @@
       "file": "AGENTS.md",
       "marker": "<!-- podokit:end:agents-modules -->",
       "optional": true,
-      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, and the server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Create the auth tables: `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`.\n"
+      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, and the server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Development setup: create auth tables with `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`, then run TypeORM migrations. Production images can run both from compiled output with `npm run migrate:all`.\n"
     }
   ],
   "instructions": [
     "Set BETTER_AUTH_SECRET in .env (>= 32 chars). This also derives the key that encrypts config secrets stored in the DB, so keep it stable and secret.",
     "Create the auth tables:  npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts",
     "Create the app tables (auth_config, app_setting):  npm run migration:run",
+    "After building a production image, run all Better Auth and TypeORM migrations:  npm run migrate:all",
     "Sign up:  curl -c cookies.txt -XPOST localhost:5002/api/auth/sign-up/email -H 'content-type: application/json' -d '{\"email\":\"a@example.com\",\"password\":\"password123\",\"name\":\"A\"}'",
     "Call a protected route with the session:  curl -b cookies.txt localhost:5002/account/me",
     "Everything is protected by default; mark public routes with @Public(). Configure OAuth (Google/GitHub), SMTP, and server-enforced toggles on the admin Settings page \u2014 stored encrypted in the DB and applied live (no restart). Environment variables (GOOGLE_CLIENT_*, SMTP_*, AUTH_*) still work as an optional fallback/override."