@podosoft/podokit 1.1.6 → 1.2.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/admin/users.ts

@@ -0,0 +1,71 @@
+// Builds the Better Auth `admin.listUsers` query for the server-paged users table.
+
+export type UserListSort = { key: string; dir: "asc" | "desc" };
+
+export type UserListState = {
+  page: number;
+  perPage: number;
+  sort: UserListSort | null;
+  search: string;
+  searchField: string;
+  role: string;
+  status: string;
+};
+
+export type ListUsersQuery = {
+  limit: number;
+  offset: number;
+  sortBy: string;
+  sortDirection: "asc" | "desc";
+  searchValue?: string;
+  searchField?: "email" | "name";
+  searchOperator?: "contains";
+  filterField?: "role" | "banned" | "signupApproved";
+  filterValue?: string | boolean;
+  filterOperator?: "eq";
+};
+
+export const DEFAULT_USER_SORT: UserListSort = { key: "createdAt", dir: "desc" };
+
+const SORTABLE_FIELDS = new Set(["name", "email", "role", "createdAt"]);
+
+function filterFor(role: string, status: string): Pick<ListUsersQuery, "filterField" | "filterValue" | "filterOperator"> {
+  if (status === "pending") return { filterField: "signupApproved", filterValue: false, filterOperator: "eq" };
+  if (status === "banned") return { filterField: "banned", filterValue: true, filterOperator: "eq" };
+  if (role) return { filterField: "role", filterValue: role, filterOperator: "eq" };
+  return {};
+}
+
+export function listUsersQuery(state: UserListState): ListUsersQuery {
+  const sort = state.sort && SORTABLE_FIELDS.has(state.sort.key) ? state.sort : DEFAULT_USER_SORT;
+  const searchField = state.searchField === "name" ? "name" : "email";
+  const search = state.search.trim();
+  return {
+    limit: state.perPage,
+    offset: (Math.max(state.page, 1) - 1) * state.perPage,
+    sortBy: sort.key,
+    sortDirection: sort.dir,
+    ...(search
+      ? {
+          // Better Auth matches with a case-sensitive LIKE on PostgreSQL and stores
+          // emails in lower case, so lower-casing makes email search case-insensitive.
+          searchValue: searchField === "email" ? search.toLowerCase() : search,
+          searchField,
+          searchOperator: "contains" as const,
+        }
+      : {}),
+    ...filterFor(state.role, state.status),
+  };
+}
+
+/**
+ * `listUsers` accepts one filter, so the role and status selects are mutually
+ * exclusive: when both hold a value, the one that just changed wins.
+ */
+export function keepLatestFilter(
+  previous: { role: string; status: string },
+  next: { role: string; status: string },
+): { role: string; status: string } {
+  if (!next.role || !next.status) return next;
+  return next.status !== previous.status ? { role: "", status: next.status } : { role: next.role, status: "" };
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/audit-log.test.ts

@@ -0,0 +1,68 @@
+import { describe, expect, it } from "vitest";
+import {
+  auditLogUrl,
+  cursorForPage,
+  emptyTrail,
+  fetchAuditLogPage,
+  recordPage,
+  trailCount,
+} from "./audit-log";
+
+const none = { action: "", actor: "", target: "" };
+
+describe("auditLogUrl", () => {
+  it("sends only the filters that are set", () => {
+    expect(auditLogUrl(none, "desc", null, 15)).toBe("/api/audit-logs?limit=15");
+    expect(auditLogUrl({ action: "user.ban", actor: " a@example.com ", target: "" }, "asc", "abc", 15))
+      .toBe("/api/audit-logs?limit=15&order=asc&cursor=abc&action=user.ban&actor=a%40example.com");
+  });
+});
+
+describe("fetchAuditLogPage", () => {
+  it("reads the entries and the next cursor header", async () => {
+    const fetcher = async (): Promise<Response> =>
+      new Response(JSON.stringify([{ id: "1" }]), { headers: { "x-next-cursor": "next" } });
+    await expect(fetchAuditLogPage(fetcher, none, "desc", null, 15)).resolves.toEqual({
+      entries: [{ id: "1" }],
+      nextCursor: "next",
+    });
+  });
+
+  it("fails on an error status", async () => {
+    const fetcher = async (): Promise<Response> => new Response("{}", { status: 403 });
+    await expect(fetchAuditLogPage(fetcher, none, "desc", null, 15)).rejects.toThrow("403");
+  });
+});
+
+describe("cursor trail", () => {
+  it("reaches one page past the last one loaded until the end appears", () => {
+    let trail = emptyTrail();
+    expect(cursorForPage(trail, 1)).toBeNull();
+    expect(cursorForPage(trail, 2)).toBeUndefined();
+
+    trail = recordPage(trail, 1, 15, "c2");
+    expect(cursorForPage(trail, 2)).toBe("c2");
+    expect(trailCount(trail, 15)).toBe(30);
+
+    trail = recordPage(trail, 2, 15, "c3");
+    trail = recordPage(trail, 3, 4, null);
+    expect(trail.cursors).toEqual([null, "c2", "c3"]);
+    expect(trailCount(trail, 15)).toBe(34);
+  });
+
+  it("keeps later pages when an earlier page still leads to them", () => {
+    let trail = recordPage(recordPage(emptyTrail(), 1, 15, "c2"), 2, 15, "c3");
+    trail = recordPage(trail, 1, 15, "c2");
+    expect(cursorForPage(trail, 3)).toBe("c3");
+  });
+
+  it("forgets later pages when new entries shift an earlier page", () => {
+    let trail = recordPage(recordPage(emptyTrail(), 1, 15, "c2"), 2, 3, null);
+    trail = recordPage(trail, 1, 15, "c2-shifted");
+    expect(trail).toEqual({ cursors: [null, "c2-shifted"], end: null });
+  });
+
+  it("counts an empty first page as no rows", () => {
+    expect(trailCount(recordPage(emptyTrail(), 1, 0, null), 15)).toBe(0);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/audit-log.ts

@@ -0,0 +1,108 @@
+// Client for the audit-log module's cursor-paged list (GET /api/audit-logs).
+// The body is an array; the cursor for the next page arrives in a header.
+
+export type AuditLogEntry = {
+  id: string;
+  action: string;
+  actorId: string | null;
+  actorName: string | null;
+  actorEmail: string | null;
+  targetLabel: string | null;
+  ip: string | null;
+  createdAt: string;
+};
+
+export type AuditLogOrder = "asc" | "desc";
+
+export type AuditLogFilters = {
+  action: string;
+  /** Exact actor email. */
+  actor: string;
+  /** Exact target label. */
+  target: string;
+};
+
+export type AuditLogPage = {
+  entries: AuditLogEntry[];
+  nextCursor: string | null;
+};
+
+export const AUDIT_NEXT_CURSOR_HEADER = "x-next-cursor";
+
+export type Fetcher = (url: string) => Promise<Response>;
+
+export function auditLogUrl(
+  filters: AuditLogFilters,
+  order: AuditLogOrder,
+  cursor: string | null,
+  limit: number,
+): string {
+  const params = new URLSearchParams({ limit: String(limit) });
+  if (order === "asc") params.set("order", "asc");
+  if (cursor) params.set("cursor", cursor);
+  for (const key of ["action", "actor", "target"] as const) {
+    const value = filters[key].trim();
+    if (value) params.set(key, value);
+  }
+  return `/api/audit-logs?${params.toString()}`;
+}
+
+export async function fetchAuditLogPage(
+  fetcher: Fetcher,
+  filters: AuditLogFilters,
+  order: AuditLogOrder,
+  cursor: string | null,
+  limit: number,
+): Promise<AuditLogPage> {
+  const response = await fetcher(auditLogUrl(filters, order, cursor, limit));
+  if (!response.ok) throw new Error(`Audit log request failed with status ${response.status}`);
+  return {
+    entries: (await response.json()) as AuditLogEntry[],
+    nextCursor: response.headers.get(AUDIT_NEXT_CURSOR_HEADER),
+  };
+}
+
+export async function fetchAuditActions(fetcher: Fetcher): Promise<string[]> {
+  const response = await fetcher("/api/audit-logs/actions");
+  if (!response.ok) throw new Error(`Audit action request failed with status ${response.status}`);
+  return (await response.json()) as string[];
+}
+
+// A cursor-paged list has no total, so the pager learns its pages as they load:
+// `cursors[n]` opens page n + 1, and `end` is set once a page comes back
+// without a next cursor.
+export type CursorTrail = {
+  cursors: Array<string | null>;
+  end: { page: number; size: number } | null;
+};
+
+export function emptyTrail(): CursorTrail {
+  return { cursors: [null], end: null };
+}
+
+/** The cursor that opens `page`, or undefined when that page is not reachable yet. */
+export function cursorForPage(trail: CursorTrail, page: number): string | null | undefined {
+  return page >= 1 ? trail.cursors[page - 1] : undefined;
+}
+
+/** Records what loading `page` revealed about the pages after it. */
+export function recordPage(
+  trail: CursorTrail,
+  page: number,
+  size: number,
+  nextCursor: string | null,
+): CursorTrail {
+  // An unchanged next cursor means the later pages learned earlier still line up.
+  if (nextCursor !== null && trail.cursors[page] === nextCursor) return trail;
+  return {
+    cursors: [...trail.cursors.slice(0, page), ...(nextCursor === null ? [] : [nextCursor])],
+    end: nextCursor === null ? { page, size } : null,
+  };
+}
+
+/** Row count for the pager: exact once the end is known, else every reachable page as full. */
+export function trailCount(trail: CursorTrail, perPage: number): number {
+  return trail.end
+    ? (trail.end.page - 1) * perPage + trail.end.size
+    : trail.cursors.length * perPage;
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -1,6 +1,5 @@
 <script lang="ts">
   import { goto, invalidateAll } from "$app/navigation";
-  import QRCode from "qrcode";
   import { Button } from "#lib/components/ui/button/index.js";
   import { Input } from "#lib/components/ui/input/index.js";
   import { Label } from "#lib/components/ui/label/index.js";
@@ -252,13 +251,20 @@
   let qrDataUrl = $state("");
   $effect(() => {
     const uri = setup?.totpURI;
-    if (!uri) {
-      qrDataUrl = "";
-      return;
-    }
-    QRCode.toDataURL(uri, { margin: 1, width: 176 })
-      .then((url) => (qrDataUrl = url))
-      .catch(() => (qrDataUrl = ""));
+    qrDataUrl = "";
+    if (!uri) return;
+    let active = true;
+    import("qrcode")
+      .then(({ toDataURL }) => toDataURL(uri, { margin: 1, width: 176 }))
+      .then((url) => {
+        if (active && setup?.totpURI === uri) qrDataUrl = url;
+      })
+      .catch(() => {
+        if (active) qrDataUrl = "";
+      });
+    return () => {
+      active = false;
+    };
   });
   async function enable2fa(): Promise<void> {
     twoFaBusy = true;

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/session-idle-timeout.svelte

@@ -1,21 +1,27 @@
 <script lang="ts">
   import { goto } from "$app/navigation";
-  import { onMount } from "svelte";
   import { api } from "#lib/api.js";
 
   let { timeoutMinutes }: { timeoutMinutes: number | null } = $props();
 
   const ACTIVITY_KEY = "podokit:session-last-activity";
   const SERVER_REFRESH_INTERVAL_MS = 60_000;
+  // Every localStorage write fires a `storage` event in each other open tab.
+  const ACTIVITY_WRITE_INTERVAL_MS = 5_000;
   const activityEvents = ["pointerdown", "keydown", "touchstart", "scroll"] as const;
 
-  let mounted = $state(false);
-  let lastActivityAt = $state(Date.now());
-  let lastServerRefreshAt = $state(Date.now());
   let signingOut = false;
-  let previousTimeoutMs: number | null = null;
   const timeoutMs = $derived(timeoutMinutes === null ? null : timeoutMinutes * 60_000);
 
+  function readStoredActivity(): number {
+    try {
+      const value = Number(localStorage.getItem(ACTIVITY_KEY));
+      return Number.isFinite(value) ? value : 0;
+    } catch {
+      return 0;
+    }
+  }
+
   function storeActivity(value: number): void {
     try {
       localStorage.setItem(ACTIVITY_KEY, String(value));
@@ -44,66 +50,85 @@
     if (error || !data) await signOutForIdleTimeout();
   }
 
-  function recordActivity(): void {
-    if (timeoutMs === null || signingOut) return;
-    const now = Date.now();
-    if (now - lastActivityAt >= timeoutMs) {
+  function trackActivity(limit: number): () => void {
+    // The policy only exists for a signed-in user, so a new tracker means a new session.
+    signingOut = false;
+    let lastActivityAt = Date.now();
+    let storedActivityAt = lastActivityAt;
+    let lastWriteAt = lastActivityAt;
+    let lastServerRefreshAt = lastActivityAt;
+    let deadlineTimer: number | undefined;
+    let flushTimer: number | undefined;
+    storeActivity(lastActivityAt);
+
+    function flush(): void {
+      window.clearTimeout(flushTimer);
+      flushTimer = undefined;
+      if (signingOut || lastActivityAt <= storedActivityAt) return;
+      storedActivityAt = lastActivityAt;
+      lastWriteAt = Date.now();
+      storeActivity(storedActivityAt);
+    }
+
+    function expire(): void {
+      window.clearTimeout(deadlineTimer);
+      window.clearTimeout(flushTimer);
       void signOutForIdleTimeout();
-      return;
     }
-    lastActivityAt = now;
-    storeActivity(now);
-    if (now - lastServerRefreshAt >= SERVER_REFRESH_INTERVAL_MS) {
-      lastServerRefreshAt = now;
-      void refreshServerSession();
+
+    // The deadline is re-read when the timer fires rather than re-armed on every
+    // event; other tabs' activity arrives through storage.
+    function check(): void {
+      if (signingOut) return;
+      const latest = Math.max(lastActivityAt, readStoredActivity());
+      const remaining = limit - (Date.now() - latest);
+      if (remaining <= 0) return expire();
+      window.clearTimeout(deadlineTimer);
+      deadlineTimer = window.setTimeout(check, remaining);
     }
-  }
 
-  function receiveActivity(event: StorageEvent): void {
-    if (event.key !== ACTIVITY_KEY || event.newValue === null) return;
-    const value = Number(event.newValue);
-    if (Number.isFinite(value) && value > lastActivityAt) lastActivityAt = value;
-  }
+    function recordActivity(): void {
+      if (signingOut) return;
+      const now = Date.now();
+      // Timers can be suspended (sleep, background throttling), so a late event may arrive past the deadline.
+      if (now - lastActivityAt >= limit && now - readStoredActivity() >= limit) return expire();
+      lastActivityAt = now;
+      const sinceWrite = now - lastWriteAt;
+      if (sinceWrite >= ACTIVITY_WRITE_INTERVAL_MS) flush();
+      else flushTimer ??= window.setTimeout(flush, ACTIVITY_WRITE_INTERVAL_MS - sinceWrite);
+      if (now - lastServerRefreshAt >= SERVER_REFRESH_INTERVAL_MS) {
+        lastServerRefreshAt = now;
+        void refreshServerSession();
+      }
+    }
+
+    function onVisibilityChange(): void {
+      if (document.visibilityState === "hidden") flush();
+      else check();
+    }
 
-  onMount(() => {
-    mounted = true;
-    const now = Date.now();
-    lastActivityAt = now;
-    lastServerRefreshAt = now;
-    storeActivity(now);
     for (const event of activityEvents) {
       document.addEventListener(event, recordActivity, { passive: true, capture: true });
     }
     window.addEventListener("focus", recordActivity);
-    window.addEventListener("storage", receiveActivity);
+    document.addEventListener("visibilitychange", onVisibilityChange);
+    window.addEventListener("pagehide", flush);
+    deadlineTimer = window.setTimeout(check, limit);
+
     return () => {
       for (const event of activityEvents) {
         document.removeEventListener(event, recordActivity, { capture: true });
       }
       window.removeEventListener("focus", recordActivity);
-      window.removeEventListener("storage", receiveActivity);
+      document.removeEventListener("visibilitychange", onVisibilityChange);
+      window.removeEventListener("pagehide", flush);
+      window.clearTimeout(deadlineTimer);
+      window.clearTimeout(flushTimer);
     };
-  });
+  }
 
   $effect(() => {
-    if (!mounted) return;
-    const currentTimeoutMs = timeoutMs;
-    if (currentTimeoutMs !== previousTimeoutMs) {
-      previousTimeoutMs = currentTimeoutMs;
-      if (currentTimeoutMs !== null) {
-        const now = Date.now();
-        lastActivityAt = now;
-        lastServerRefreshAt = now;
-        storeActivity(now);
-      }
-    }
-    if (currentTimeoutMs === null) return;
-    const remaining = currentTimeoutMs - (Date.now() - lastActivityAt);
-    if (remaining <= 0) {
-      void signOutForIdleTimeout();
-      return;
-    }
-    const timer = window.setTimeout(() => void signOutForIdleTimeout(), remaining);
-    return () => window.clearTimeout(timer);
+    if (timeoutMs === null) return;
+    return trackActivity(timeoutMs);
   });
 </script>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/en.json

@@ -393,7 +393,10 @@
     "empty": "No audit entries.",
     "loadFailed": "Failed to load audit log",
     "total": "{count} entries",
-    "searchField": "Actor or target"
+    "range": "Entries {from}–{to}",
+    "searchField": "Actor or target",
+    "actorHint": "Full email address",
+    "targetHint": "Full target as shown"
   },
   "users": {
     "title": "Users",
@@ -503,6 +506,8 @@
     "revoked": "Session revoked",
     "allRevoked": "All sessions revoked for user",
     "loadFailed": "Failed to load sessions",
+    "revokeFailed": "Failed to revoke the session",
+    "searchPlaceholder": "Email or name",
     "total": "{count} sessions"
   },
   "account": {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/ko.json

@@ -393,7 +393,10 @@
     "empty": "감사 기록이 없습니다.",
     "loadFailed": "감사 로그를 불러오지 못했습니다",
     "total": "항목 {count}개",
-    "searchField": "수행자·대상"
+    "range": "{from}–{to}번째 항목",
+    "searchField": "수행자·대상",
+    "actorHint": "전체 이메일 주소",
+    "targetHint": "표시된 대상 전체"
   },
   "users": {
     "title": "회원",
@@ -503,6 +506,8 @@
     "revoked": "세션을 종료했습니다",
     "allRevoked": "사용자의 세션을 모두 종료했습니다",
     "loadFailed": "세션을 불러오지 못했습니다",
+    "revokeFailed": "세션을 종료하지 못했습니다",
+    "searchPlaceholder": "이메일 또는 이름",
     "total": "세션 {count}개"
   },
   "account": {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/messages.test.ts

@@ -0,0 +1,29 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { loadMessages } from "./messages";
+
+describe("loadMessages", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("reuses one merged catalog per locale pair in a build", async () => {
+    vi.stubEnv("DEV", false);
+
+    const korean = await loadMessages("ko", "en");
+
+    expect(korean.nav.users).toBe("회원");
+    expect(await loadMessages("ko", "en")).toBe(korean);
+    expect(await loadMessages("KO", null)).toBe(korean);
+    expect(await loadMessages("en", "en")).not.toBe(korean);
+  });
+
+  it("merges again in development so edited catalogs appear", async () => {
+    vi.stubEnv("DEV", true);
+
+    const first = await loadMessages("en");
+    const second = await loadMessages("en");
+
+    expect(second).not.toBe(first);
+    expect(second).toEqual(first);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/messages.ts

@@ -83,12 +83,7 @@ async function loadCatalog(code: string): Promise<JsonObject> {
   return catalog;
 }
 
-export async function loadMessages(
-  locale: string,
-  configuredFallback?: string | null,
-): Promise<Messages> {
-  const selected = resolveLocale(locale);
-  const fallback = resolveLocale(configuredFallback);
+async function mergeMessages(selected: Locale, fallback: Locale): Promise<Messages> {
   const candidates = [defaultLocale, fallback, selected];
   // A later catalog has higher priority. Keep the last occurrence so selecting
   // the built-in English fallback still overrides a non-English site default.
@@ -97,3 +92,25 @@ export async function loadMessages(
   for (const code of chain) catalog = mergeCatalog(catalog, await loadCatalog(code));
   return catalog as Messages;
 }
+
+// Catalogs are static in a build, so each locale pair is merged once and every
+// caller shares the same object. Treat it as read-only.
+const merged = new Map<string, Promise<Messages>>();
+
+export function loadMessages(
+  locale: string,
+  configuredFallback?: string | null,
+): Promise<Messages> {
+  const selected = resolveLocale(locale);
+  const fallback = resolveLocale(configuredFallback);
+  // Development re-merges so an edited catalog shows up on the next load.
+  if (import.meta.env.DEV) return mergeMessages(selected, fallback);
+  const key = `${selected}\u0000${fallback}`;
+  let messages = merged.get(key);
+  if (!messages) {
+    messages = mergeMessages(selected, fallback);
+    messages.catch(() => merged.delete(key));
+    merged.set(key, messages);
+  }
+  return messages;
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/oauth-query.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { signedOAuthQuery } from "./oauth-query";
+
+describe("signed OAuth query", () => {
+  it("keeps only the signed parameters", () => {
+    const search = "?client_id=c1&scope=openid&exp=9&ba_param=client_id&ba_param=exp&ba_param=scope&sig=abc&extra=1";
+    const query = new URLSearchParams(signedOAuthQuery(search));
+    expect(query.get("client_id")).toBe("c1");
+    expect(query.get("sig")).toBe("abc");
+    expect(query.getAll("ba_param")).toEqual(["client_id", "exp", "scope"]);
+    expect(query.has("extra")).toBe(false);
+  });
+
+  it("forwards the whole query when the server lists no signed names", () => {
+    expect(signedOAuthQuery("?client_id=c1&sig=abc")).toBe("client_id=c1&sig=abc");
+  });
+
+  it("returns nothing without a signature", () => {
+    expect(signedOAuthQuery("?client_id=c1")).toBeUndefined();
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/oauth-query.ts

@@ -0,0 +1,15 @@
+// The OAuth provider's consent endpoint verifies a signed copy of the authorization
+// request sent in the body. Like Better Auth's own client plugin, forward only the
+// parameters the server signed, so extra page parameters cannot break the signature.
+export function signedOAuthQuery(search: string): string | undefined {
+  const params = new URLSearchParams(search);
+  if (!params.has("sig")) return undefined;
+  const signedNames = params.getAll("ba_param");
+  if (signedNames.length === 0) return params.toString();
+  const allowed = new Set(signedNames);
+  const signed = new URLSearchParams();
+  for (const [key, value] of params.entries()) {
+    if (key === "sig" || key === "ba_param" || allowed.has(key)) signed.append(key, value);
+  }
+  return signed.toString();
+}