@podosoft/podokit 1.0.1 → 1.1.2

package/dist/templates/modules/admin-dashboard/files/apps/api/src/profile-image/profile-image.service.spec.ts

@@ -1,18 +1,24 @@
 import { afterAll, afterEach, describe, expect, mock, test } from "bun:test";
 import type { Logger } from "pino";
+import type { ObjectStore } from "@podosoft/podokit-runtime";
 import { runUserDeletedHandlers } from "../auth/user-delete-handlers";
-import { StorageService } from "../storage/storage.service";
 import { ProfileImageService } from "./profile-image.service";
 
 describe("ProfileImageService account deletion cleanup", () => {
   const storage = {
     put: mock(async () => undefined),
-    get: mock(async () => Buffer.alloc(0)),
-    presignedGetUrl: mock(async () => "https://example.com/image"),
+    get: mock(async () => ({
+      key: "profile-images/example.webp",
+      size: 0,
+      body: (async function* (): AsyncGenerator<Uint8Array> { yield Buffer.alloc(0); })(),
+    })),
+    exists: mock(async () => true),
+    getDownloadUrl: mock(async () => "https://example.com/image"),
     delete: mock(async () => undefined),
+    close: mock(() => undefined),
   };
   const logger = { warn: mock(() => undefined) } as unknown as Logger;
-  const service = new ProfileImageService(storage as unknown as StorageService, logger);
+  const service = new ProfileImageService(storage as unknown as ObjectStore, logger);
 
   service.connect();
 

package/dist/templates/modules/admin-dashboard/files/apps/api/src/profile-image/profile-image.service.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { Logger } from "pino";
+import type { ObjectData, ObjectStore } from "@podosoft/podokit-runtime";
 import {
   AppException,
   PROFILE_IMAGE_NOT_FOUND,
@@ -7,7 +8,6 @@ import {
 } from "@podosoft/podokit-contracts";
 import { getAuth } from "../auth/auth-provider";
 import { registerUserDeletedHandler } from "../auth/user-delete-handlers";
-import type { StorageService } from "../storage/storage.service";
 import { validateProfileImage, type ProfileImageUpload } from "./profile-image.validation";
 
 const FILE_NAME = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.(?:jpg|png|webp)$/;
@@ -33,11 +33,17 @@ export type UpdateAuthUser = (
 const updateAuthUser: UpdateAuthUser = (image, headers) =>
   getAuth().api.updateUser({ body: { image }, headers });
 
+async function objectBuffer(object: ObjectData): Promise<Buffer> {
+  const chunks: Uint8Array[] = [];
+  for await (const chunk of object.body) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
 export class ProfileImageService {
   private unregisterUserDeleted?: () => void;
 
   constructor(
-    private readonly storage: StorageService,
+    private readonly storage: ObjectStore,
     private readonly logger: Logger,
     private readonly updateUser: UpdateAuthUser = updateAuthUser,
   ) {}
@@ -63,7 +69,7 @@ export class ProfileImageService {
     const key = STORAGE_PREFIX + fileName;
     const image = PUBLIC_PREFIX + fileName;
 
-    await this.storage.put(key, file.buffer, metadata.contentType);
+    await this.storage.put(key, file.buffer, { contentType: metadata.contentType });
     try {
       await this.updateUser(image, headers);
     } catch (error: unknown) {
@@ -86,7 +92,7 @@ export class ProfileImageService {
     try {
       const extension = fileName.slice(fileName.lastIndexOf(".") + 1);
       return {
-        body: await this.storage.get(key),
+        body: await objectBuffer(await this.storage.get(key)),
         contentType: CONTENT_TYPES[extension] ?? "application/octet-stream",
       };
     } catch {

package/dist/templates/modules/admin-dashboard/files/apps/api/src/site-settings/site-settings.service.ts

@@ -1,5 +1,5 @@
 import type { SQL } from "bun";
-import type { StorageService } from "../storage/storage.service";
+import type { ObjectData, ObjectStore } from "@podosoft/podokit-runtime";
 
 const PREFIX = "site.";
 const FAVICON_KEY = "site/favicon";
@@ -31,10 +31,16 @@ export interface SiteFavicon {
   contentType: string;
 }
 
+async function objectBuffer(object: ObjectData): Promise<Buffer> {
+  const chunks: Uint8Array[] = [];
+  for await (const chunk of object.body) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
 export class SiteSettingsService {
   constructor(
     private readonly sql: SQL,
-    private readonly storage: StorageService,
+    private readonly storage: ObjectStore,
   ) {}
 
   async getAll(): Promise<Record<string, string>> {
@@ -66,7 +72,7 @@ export class SiteSettingsService {
   }
 
   async setFavicon(body: Uint8Array, contentType: string): Promise<void> {
-    await this.storage.put(FAVICON_KEY, body, contentType);
+    await this.storage.put(FAVICON_KEY, body, { contentType });
     await this.setMany({
       faviconContentType: contentType,
       faviconUpdatedAt: String(Date.now()),
@@ -77,7 +83,7 @@ export class SiteSettingsService {
     const contentType = await this.get("faviconContentType");
     if (!contentType) return null;
     try {
-      return { body: await this.storage.get(FAVICON_KEY), contentType };
+      return { body: await objectBuffer(await this.storage.get(FAVICON_KEY)), contentType };
     } catch {
       return null;
     }

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -265,7 +265,7 @@
     const { data: res, error } = await api.auth.twoFactor.enable({ password: twoFaPassword });
     twoFaBusy = false;
     if (error) return void toast.error(error.message ?? i18n.t.account.changeFailed);
-    if (!res?.totpURI || !Array.isArray(res.backupCodes)) {
+    if (!res || !("totpURI" in res) || !res.totpURI || !Array.isArray(res.backupCodes)) {
       return void toast.error(i18n.t.account.changeFailed);
     }
     setup = { totpURI: res.totpURI, backupCodes: res.backupCodes };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/setup-2fa/+page.svelte

@@ -39,7 +39,7 @@
       error = e.code === "INVALID_PASSWORD" ? i18n.t.setup2fa.wrongPassword : i18n.t.setup2fa.enableFailed;
       return;
     }
-    if (!data?.totpURI || !Array.isArray(data.backupCodes)) {
+    if (!data || !("totpURI" in data) || !data.totpURI || !Array.isArray(data.backupCodes)) {
       error = i18n.t.setup2fa.enableFailed;
       return;
     }

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -14,7 +14,11 @@ const REDIRECT = "https://example.com/callback";
 // docs/modules.md for the manual round-trip checklist.
 test("OIDC provider: discovery, JWKS, client registration, authorize handoff", async ({ page, baseURL }) => {
   const headers = { origin: baseURL ?? "" };
-  await page.request.put("/api/account/settings", { data: { oidcProvider: true }, headers });
+  const enabled = await page.request.put("/api/account/settings", {
+    data: { oidcProvider: true },
+    headers,
+  });
+  expect(enabled.ok(), await enabled.text()).toBeTruthy();
   await expect
     .poll(async () => (await page.request.get("/api/auth/.well-known/openid-configuration")).status(), { timeout: 8000 })
     .toBe(200);
@@ -61,6 +65,10 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
     await page.goto(consentUrl);
     await expect(page.getByRole("button", { name: "Allow" })).toBeVisible();
   } finally {
-    await page.request.put("/api/account/settings", { data: { oidcProvider: false }, headers });
+    const disabled = await page.request.put("/api/account/settings", {
+      data: { oidcProvider: false },
+      headers,
+    });
+    expect(disabled.ok(), await disabled.text()).toBeTruthy();
   }
 });

package/dist/templates/modules/admin-dashboard/module.manifest.json

@@ -1,11 +1,9 @@
 {
-  "manifestVersion": 2,
+  "manifestVersion": 3,
   "name": "admin-dashboard",
   "description": "Admin console UI (SvelteKit + shadcn-svelte): the `(admin)` route group and `admin-sidebar.svelte` are reserved for `/admin/*`; put protected product pages in `(app)` or their own guarded layout. Requires auth.",
-  "requires": [
-    "auth",
-    "object-storage-s3"
-  ],
+  "requires": ["auth"],
+  "requiresCapabilities": ["object-storage"],
   "targetApp": "web",
   "dependencies": {
     "qrcode": "^1.5.4"

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit-enabled.ts

@@ -1,15 +1,12 @@
-import { pool } from "../auth/db";
-import { createConfigStore } from "@podosoft/podokit-auth";
+import { authConfigStore } from "../auth/auth-config-store";
 
 // Audit logging is an admin-managed, DB-backed server toggle (auth_config `server`
 // row, env fallback AUDIT_LOG_ENABLED), read through the shared config store's
 // short TTL cache — the same mechanism as the other server-enforced toggles.
 // Toggling it on the Settings page takes effect within the cache TTL, no restart.
-const store = createConfigStore(pool);
-
 export async function auditEnabled(): Promise<boolean> {
   try {
-    return (await store.capabilitiesSnapshot()).auditLog;
+    return (await authConfigStore.capabilitiesSnapshot()).auditLog;
   } catch {
     return true; // never let a config read failure silently drop the audit trail
   }

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.migration.spec.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from "bun:test";
+import type { QueryRunner } from "typeorm";
+import { InitAuditLogs1720300000000 } from "../migrations/1720300000000-InitAuditLogs";
+
+function runner(type: "postgres" | "better-sqlite3", queries: string[]): QueryRunner {
+  return {
+    connection: { options: { type } },
+    query: (sql: string): Promise<unknown[]> => {
+      queries.push(sql);
+      return Promise.resolve([]);
+    },
+  } as unknown as QueryRunner;
+}
+
+describe("audit log migration", () => {
+  it("retains PostgreSQL UUID and JSONB storage", async () => {
+    const queries: string[] = [];
+    await new InitAuditLogs1720300000000().up(runner("postgres", queries));
+    expect(queries[0]).toContain("CREATE EXTENSION");
+    expect(queries[1]).toContain("uuid NOT NULL DEFAULT gen_random_uuid()");
+    expect(queries[1]).toContain("jsonb");
+  });
+
+  it("uses portable SQLite column types and defaults", async () => {
+    const queries: string[] = [];
+    await new InitAuditLogs1720300000000().up(runner("better-sqlite3", queries));
+    expect(queries).toHaveLength(3);
+    expect(queries[0]).toContain('"id" text NOT NULL');
+    expect(queries[0]).toContain('"metadata" text');
+    expect(queries[0]).toContain("DEFAULT CURRENT_TIMESTAMP");
+    expect(queries.join("\n")).not.toContain("CREATE EXTENSION");
+  });
+});

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.service.spec.ts

@@ -26,6 +26,7 @@ describe("AuditService", () => {
       expect(recorder.values).toHaveLength(1);
       expect(recorder.values[0]).toContain("invoice.paid");
       expect(recorder.values[0]).toContain('{"amount":42}');
+      expect(recorder.values[0]?.[0]).toBeString();
     } finally {
       service.close();
     }
@@ -41,6 +42,18 @@ describe("AuditService", () => {
     expect(entries[0]?.createdAt).toBe("2026-01-02T03:04:05.000Z");
   });
 
+  test("normalizes SQLite timestamps and JSON text", async () => {
+    const recorder = sqlRecorder([{
+      id: "audit-1",
+      action: "auth.login",
+      metadata: '{"method":"password"}',
+      createdAt: "2026-01-02T03:04:05.000Z",
+    }]);
+    const entries = await new AuditService(recorder.sql).recent();
+    expect(entries[0]?.metadata).toEqual({ method: "password" });
+    expect(entries[0]?.createdAt).toBe("2026-01-02T03:04:05.000Z");
+  });
+
   test("does not propagate persistence failures", async () => {
     const sql = mock(() => Promise.reject(new Error("database unavailable"))) as unknown as SQL;
     await expect(new AuditService(sql).record({ action: "auth.login" })).resolves.toBeUndefined();

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.service.ts

@@ -8,9 +8,10 @@ export interface AuditLogView extends AuditEntry {
   createdAt: string;
 }
 
-interface AuditLogRow extends Omit<AuditLogView, "createdAt"> {
-  createdAt: Date;
-}
+type AuditLogRow = Omit<AuditLogView, "createdAt" | "metadata"> & {
+  createdAt: Date | string;
+  metadata: unknown;
+};
 
 export interface AuditTarget {
   type?: string;
@@ -40,13 +41,13 @@ export class AuditService {
         : JSON.stringify(entry.metadata);
       await this.sql`
         INSERT INTO "audit_logs" (
-          "action", "actorId", "actorName", "actorEmail",
-          "targetType", "targetId", "targetLabel", "ip", "metadata"
+          "id", "action", "actorId", "actorName", "actorEmail",
+          "targetType", "targetId", "targetLabel", "ip", "metadata", "createdAt"
         ) VALUES (
-          ${entry.action}, ${entry.actorId ?? null}, ${entry.actorName ?? null},
+          ${crypto.randomUUID()}, ${entry.action}, ${entry.actorId ?? null}, ${entry.actorName ?? null},
           ${entry.actorEmail ?? null}, ${entry.targetType ?? null},
           ${entry.targetId ?? null}, ${entry.targetLabel ?? null}, ${entry.ip ?? null},
-          ${metadata}::jsonb
+          CAST(${metadata} AS JSON), ${new Date().toISOString()}
         )
       `;
     } catch {
@@ -62,7 +63,15 @@ export class AuditService {
       ORDER BY "createdAt" DESC
       LIMIT ${limit}
     `;
-    return rows.map((row) => ({ ...row, createdAt: row.createdAt.toISOString() }));
+    return rows.map((row) => ({
+      ...row,
+      metadata: typeof row.metadata === "string"
+        ? JSON.parse(row.metadata) as Record<string, unknown>
+        : row.metadata as Record<string, unknown> | null,
+      createdAt: row.createdAt instanceof Date
+        ? row.createdAt.toISOString()
+        : new Date(row.createdAt).toISOString(),
+    }));
   }
 
   async recordRequest(

package/dist/templates/modules/audit-log/files/apps/api/src/migrations/1720300000000-InitAuditLogs.ts

@@ -4,10 +4,11 @@ export class InitAuditLogs1720300000000 implements MigrationInterface {
   name = "InitAuditLogs1720300000000";
 
   async up(queryRunner: QueryRunner): Promise<void> {
-    await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS "pgcrypto"`);
+    const sqlite = queryRunner.connection.options.type === "better-sqlite3";
+    if (!sqlite) await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS "pgcrypto"`);
     await queryRunner.query(`
       CREATE TABLE "audit_logs" (
-        "id" uuid NOT NULL DEFAULT gen_random_uuid(),
+        "id" ${sqlite ? "text" : "uuid"} NOT NULL${sqlite ? "" : " DEFAULT gen_random_uuid()"},
         "action" character varying(128) NOT NULL,
         "actorId" character varying,
         "actorName" character varying,
@@ -16,8 +17,8 @@ export class InitAuditLogs1720300000000 implements MigrationInterface {
         "targetId" character varying,
         "targetLabel" character varying,
         "ip" character varying,
-        "metadata" jsonb,
-        "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+        "metadata" ${sqlite ? "text" : "jsonb"},
+        "createdAt" ${sqlite ? "datetime" : "TIMESTAMP WITH TIME ZONE"} NOT NULL DEFAULT ${sqlite ? "CURRENT_TIMESTAMP" : "now()"},
         CONSTRAINT "PK_audit_logs_id" PRIMARY KEY ("id")
       )
     `);

package/dist/templates/modules/audit-log/module.manifest.json

@@ -36,6 +36,6 @@
     "List recent entries (admin session required): curl -b cookies.txt localhost:5002/audit-logs"
   ],
   "dependencies": {
-    "@podosoft/podokit-auth": "^0.3.0"
+    "@podosoft/podokit-auth": "^0.4.0"
   }
 }

package/dist/templates/modules/auth/files/apps/api/src/auth/account-issuer-migration.spec.ts

@@ -0,0 +1,170 @@
+import { describe, expect, it } from "bun:test";
+import { SUPPORTED_SOCIAL_PROVIDERS } from "@podosoft/podokit-auth";
+import {
+  legacyAccountIssuer,
+  legacyAccountIssuerTriggerSql,
+  migrateLegacyAccountIssuers,
+  type AccountIssuerMigrationClient,
+  type AccountIssuerMigrationDatabase,
+} from "./account-issuer-migration";
+
+type Statement = { sql: string; values?: readonly unknown[] };
+type LegacyAccountOptions = {
+  tableExists?: boolean;
+  column?: { dataType: string; isNullable: "YES" | "NO" };
+  counts?: {
+    blankIssuer?: number;
+    credentialMismatch?: number;
+    unresolvedIssuer?: number;
+    collision?: number;
+  };
+};
+
+class LegacyAccountClient implements AccountIssuerMigrationClient {
+  readonly statements: Statement[] = [];
+  released = false;
+
+  constructor(
+    private readonly providers: readonly string[],
+    private readonly options: LegacyAccountOptions = {},
+  ) {}
+
+  async query<Row extends Record<string, unknown>>(
+    sql: string,
+    values?: readonly unknown[],
+  ): Promise<readonly Row[]> {
+    this.statements.push({ sql, ...(values ? { values } : {}) });
+    if (sql.includes("information_schema.tables")) {
+      return [{ exists: this.options.tableExists ?? true }] as unknown as Row[];
+    }
+    if (sql.includes("information_schema.columns")) {
+      return (this.options.column ? [this.options.column] : []) as unknown as Row[];
+    }
+    if (sql.includes('SELECT DISTINCT "providerId"')) {
+      return this.providers.map((providerId) => ({ providerId })) as unknown as Row[];
+    }
+    if (sql.includes('COUNT(*)::int AS "count"')) {
+      const count = sql.includes('"accountId" <> "userId"')
+        ? this.options.counts?.credentialMismatch
+        : sql.includes("AS collisions")
+          ? this.options.counts?.collision
+          : sql.includes('"issuer" IS NULL OR')
+            ? this.options.counts?.unresolvedIssuer
+            : this.options.counts?.blankIssuer;
+      return [{ count: count ?? 0 }] as unknown as Row[];
+    }
+    return [];
+  }
+
+  release(): void {
+    this.released = true;
+  }
+}
+
+function database(client: LegacyAccountClient): AccountIssuerMigrationDatabase {
+  return { connect: async (): Promise<AccountIssuerMigrationClient> => client };
+}
+
+describe("Better Auth account issuer migration", () => {
+  it("maps every safely derivable provider and refuses identities that need trusted external data", () => {
+    expect(legacyAccountIssuer("credential")).toBe("local:credential");
+    expect(legacyAccountIssuer("google")).toBe("https://accounts.google.com");
+    expect(legacyAccountIssuer("apple")).toBe("https://appleid.apple.com");
+    expect(legacyAccountIssuer("facebook")).toBe("https://www.facebook.com");
+    expect(legacyAccountIssuer("line")).toBe("https://access.line.me");
+    expect(legacyAccountIssuer("github")).toBe("local:oauth:github");
+    expect(legacyAccountIssuer("microsoft")).toBeUndefined();
+    expect(legacyAccountIssuer("unknown-provider")).toBeUndefined();
+
+    for (const { id } of SUPPORTED_SOCIAL_PROVIDERS) {
+      if (id !== "microsoft") expect(legacyAccountIssuer(id), id).toBeDefined();
+    }
+  });
+
+  it("installs a fail-closed compatibility trigger for the release that is still serving", () => {
+    const sql = legacyAccountIssuerTriggerSql();
+    expect(sql).toContain("BEFORE INSERT");
+    expect(sql).toContain('WHEN (NEW."issuer" IS NULL)');
+    expect(sql).toContain("NEW.\"accountId\" := NEW.\"userId\"");
+    expect(sql).toContain("RAISE EXCEPTION");
+    expect(sql).not.toContain("WHEN 'microsoft'");
+  });
+
+  it("adds, backfills, validates, constrains, and indexes a legacy account table in one transaction", async () => {
+    const client = new LegacyAccountClient(["credential", "google", "github"]);
+
+    await expect(migrateLegacyAccountIssuers(database(client))).resolves.toBe("migrated");
+
+    const statements = client.statements.map(({ sql }) => sql.trim());
+    expect(statements[0]).toBe("BEGIN");
+    expect(statements.some((sql) => sql.includes('ADD COLUMN "issuer" text'))).toBe(true);
+    expect(
+      client.statements.some(
+        ({ sql, values }) => sql.includes('UPDATE "account"') && values?.[0] === "local:credential",
+      ),
+    ).toBe(true);
+    expect(
+      client.statements.some(
+        ({ sql, values }) => sql.includes('UPDATE "account"') && values?.[0] === "https://accounts.google.com",
+      ),
+    ).toBe(true);
+    expect(statements.some((sql) => sql.includes("CREATE TRIGGER podokit_fill_legacy_account_issuer"))).toBe(
+      true,
+    );
+    expect(statements.some((sql) => sql.includes('ALTER COLUMN "issuer" SET NOT NULL'))).toBe(true);
+    expect(statements.some((sql) => sql.includes('CREATE UNIQUE INDEX IF NOT EXISTS'))).toBe(true);
+    expect(statements.at(-1)).toBe("COMMIT");
+    expect(client.released).toBe(true);
+  });
+
+  it("rolls back instead of guessing a Microsoft or unknown issuer", async () => {
+    const client = new LegacyAccountClient(["microsoft"]);
+
+    await expect(migrateLegacyAccountIssuers(database(client))).rejects.toThrow(
+      "Cannot infer a trusted Better Auth issuer for legacy provider microsoft",
+    );
+
+    expect(client.statements.map(({ sql }) => sql.trim())).toContain("ROLLBACK");
+    expect(client.statements.some(({ sql }) => sql.includes('SET NOT NULL'))).toBe(false);
+    expect(client.released).toBe(true);
+  });
+
+  it("leaves a fresh database to the normal migrator and protects a current schema", async () => {
+    const absent = new LegacyAccountClient([], { tableExists: false });
+    const current = new LegacyAccountClient([], {
+      column: { dataType: "text", isNullable: "NO" },
+    });
+
+    await expect(migrateLegacyAccountIssuers(database(absent))).resolves.toBe("absent");
+    await expect(migrateLegacyAccountIssuers(database(current))).resolves.toBe("current");
+
+    expect(absent.statements.some(({ sql }) => sql.includes("CREATE TRIGGER"))).toBe(false);
+    expect(current.statements.some(({ sql }) => sql.includes("CREATE TRIGGER"))).toBe(true);
+    for (const client of [absent, current]) {
+      expect(client.statements.at(-1)?.sql.trim()).toBe("COMMIT");
+      expect(client.released).toBe(true);
+    }
+  });
+
+  it("rolls back before constraints when credentials mismatch or identity keys collide", async () => {
+    const mismatch = new LegacyAccountClient(["credential"], {
+      counts: { credentialMismatch: 1 },
+    });
+    const collision = new LegacyAccountClient(["google"], {
+      counts: { collision: 1 },
+    });
+
+    await expect(migrateLegacyAccountIssuers(database(mismatch))).rejects.toThrow(
+      "accountId differs from the linked userId",
+    );
+    await expect(migrateLegacyAccountIssuers(database(collision))).rejects.toThrow(
+      "collide on the new issuer and accountId identity key",
+    );
+
+    for (const client of [mismatch, collision]) {
+      expect(client.statements.map(({ sql }) => sql.trim())).toContain("ROLLBACK");
+      expect(client.statements.some(({ sql }) => sql.includes('SET NOT NULL'))).toBe(false);
+      expect(client.released).toBe(true);
+    }
+  });
+});