@podosoft/podokit 1.1.6 → 1.2.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(admin)/admin/settings/+page.server.ts

@@ -1,4 +1,5 @@
 import type { PageServerLoad } from "./$types";
+import { getCapabilities, type CapabilitiesEvent } from "#lib/server/capabilities.js";
 import { requireAdmin } from "#lib/server/guards.js";
 
 // Non-secret view of the DB-backed auth config (OAuth providers, SMTP, server
@@ -20,23 +21,23 @@ export type AuthConfigView = {
   };
 };
 
-export const load: PageServerLoad = async ({ locals, fetch }) => {
-  requireAdmin(locals.user, locals);
-  let authConfig: AuthConfigView | null = null;
+async function loadAuthConfig(fetch: CapabilitiesEvent["fetch"]): Promise<AuthConfigView | null> {
   try {
     const res = await fetch("/api/account/auth-config");
-    if (res.ok) authConfig = (await res.json()) as AuthConfigView;
+    if (res.ok) return (await res.json()) as AuthConfigView;
   } catch {
     /* leave null — the page shows the DB-config sections as unavailable */
   }
-  // The require-two-factor policy lives in the feature-flag store (not the typed
-  // Capabilities), so read it from its own endpoint for the Settings toggle.
-  let require2fa = false;
-  try {
-    const res = await fetch("/api/account/require-2fa");
-    if (res.ok) require2fa = ((await res.json()) as { require2fa?: boolean }).require2fa === true;
-  } catch {
-    /* default off */
-  }
-  return { authConfig, require2fa };
+  return null;
+}
+
+export const load: PageServerLoad = async ({ locals, fetch }) => {
+  requireAdmin(locals.user, locals);
+  // The admin layout loads the same capabilities in this request, so the
+  // require-two-factor policy comes from that shared response.
+  const [authConfig, capabilities] = await Promise.all([
+    loadAuthConfig(fetch),
+    getCapabilities({ locals, fetch }),
+  ]);
+  return { authConfig, require2fa: capabilities.require2fa };
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(admin)/admin/settings/+page.svelte

@@ -24,8 +24,8 @@
   const ac = $derived(data.authConfig);
 
   type EditableFlag = "twoFactor" | "magicLink" | "emailOtp" | "username" | "multiSession" | "phoneNumber" | "apiKey" | "passkey" | "organization" | "oidcProvider";
-  // require2fa is a policy flag stored alongside the feature flags but not part of
-  // the typed Capabilities, so it is toggled but never read from `caps`.
+  // require2fa is an enrolment policy rather than a feature, so its card reads
+  // `data.require2fa` instead of the feature flags in `caps`.
   type ToggleFlag = EditableFlag | "require2fa";
   type ServerKey = "requireEmailVerification" | "requireSignupApproval" | "hibp" | "allowDelete" | "auditLog";
 

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(admin)/admin/users/+page.svelte

@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { untrack } from "svelte";
   import { goto } from "$app/navigation";
   import { Button } from "#lib/components/ui/button/index.js";
   import { Input } from "#lib/components/ui/input/index.js";
@@ -15,6 +16,8 @@
   import PlusIcon from "@lucide/svelte/icons/plus";
   import { toast } from "svelte-sonner";
   import { api } from "#lib/api.js";
+  import { listAdminSessions, revokeAdminSession, type AdminSession } from "#lib/admin/sessions.js";
+  import { DEFAULT_USER_SORT, keepLatestFilter, listUsersQuery } from "#lib/admin/users.js";
   import { getI18n, fmt, formatDateTime } from "#lib/i18n/index.js";
   import { cn } from "#lib/utils.js";
   import { deviceLabel } from "#lib/device-label.js";
@@ -42,11 +45,16 @@
   };
 
   const PAGE_SIZE = DEFAULT_PAGE_SIZE;
-  const LOAD_LIMIT = 500; // bounded client-side list; add server-side filtering for larger deployments
+  // Sessions shown in the manage dialog: the newest page for one user.
+  const MANAGED_SESSIONS_LIMIT = 100;
   let users = $state<Row[]>([]);
+  let total = $state(0);
   let page = $state(1);
-  let sort = $state<SortState | null>(null);
+  let sort = $state<SortState | null>({ ...DEFAULT_USER_SORT });
+  let loading = $state(false);
   let busy = $state(false);
+  let latestRequest = 0;
+  let loadedSortKey = `${DEFAULT_USER_SORT.key}:${DEFAULT_USER_SORT.dir}`;
 
   // Toolbar: filters + search both commit on the Search button (nothing applies
   // until then), so multiple filter/search conditions apply together.
@@ -56,6 +64,19 @@
   let appliedSearchField = $state("email");
   let filterValues = $state<Record<string, string>>({ role: "", status: "" });
   let appliedFilters = $state<Record<string, string>>({ role: "", status: "" });
+  let stagedFilters = { role: "", status: "" };
+
+  // The list endpoint takes a single filter, so picking a role clears the status
+  // and vice versa (see keepLatestFilter).
+  $effect(() => {
+    const next = keepLatestFilter(stagedFilters, {
+      role: filterValues.role ?? "",
+      status: filterValues.status ?? "",
+    });
+    stagedFilters = next;
+    if (filterValues.role !== next.role) filterValues.role = next.role;
+    if (filterValues.status !== next.status) filterValues.status = next.status;
+  });
 
   const columns = $derived<DataTableColumn<Row>[]>([
     { key: "name", label: i18n.t.users.name, sortable: true },
@@ -82,7 +103,6 @@
       label: i18n.t.users.status,
       options: [
         { value: "", label: i18n.t.toolbar.all },
-        { value: "active", label: i18n.t.users.active },
         { value: "pending", label: i18n.t.users.pendingApproval },
         { value: "banned", label: i18n.t.users.banned },
       ],
@@ -93,32 +113,44 @@
     { value: "name", label: i18n.t.users.name },
   ]);
 
-  const filtered = $derived(
-    users.filter((u) => {
-      if (appliedSearch) {
-        const hay = (appliedSearchField === "name" ? u.name : u.email).toLowerCase();
-        if (!hay.includes(appliedSearch.toLowerCase())) return false;
-      }
-      if (appliedFilters.role && (u.role ?? "user") !== appliedFilters.role) return false;
-      if (appliedFilters.status === "banned" && !u.banned) return false;
-      if (appliedFilters.status === "pending" && u.signupApproved !== false) return false;
-      if (appliedFilters.status === "active" && (u.banned || u.signupApproved === false)) return false;
-      return true;
-    }),
-  );
-
+  // Loads only the current page; a newer request supersedes one still in flight.
   async function load(): Promise<void> {
-    const { data: res, error } = await api.auth.admin.listUsers({ query: { limit: LOAD_LIMIT } });
-    if (error) return void toast.error(error.message ?? i18n.t.users.loadFailed);
-    users = (res?.users ?? []) as Row[];
+    const request = ++latestRequest;
+    const sortKey = sort ? `${sort.key}:${sort.dir}` : "";
+    if (sortKey !== loadedSortKey) page = 1;
+    const query = listUsersQuery({
+      page,
+      perPage: PAGE_SIZE,
+      sort,
+      search: appliedSearch,
+      searchField: appliedSearchField,
+      role: appliedFilters.role ?? "",
+      status: appliedFilters.status ?? "",
+    });
+    loading = true;
+    const { data: res, error } = await api.auth.admin.listUsers({ query });
+    if (request !== latestRequest) return;
+    loading = false;
+    if (error) return void toast.error(i18n.t.users.loadFailed);
+    const rows = (res?.users ?? []) as Row[];
+    const count = res?.total ?? rows.length;
+    // An action can empty the last page; show the one before it instead.
+    const lastPage = Math.max(Math.ceil(count / PAGE_SIZE), 1);
+    if (rows.length === 0 && page > lastPage) {
+      page = lastPage;
+      return load();
+    }
+    loadedSortKey = sortKey;
+    users = rows;
+    total = count;
   }
 
-  async function applySearch(): Promise<void> {
-    await load(); // refresh from the server on explicit search, then filter client-side
+  function applySearch(): void {
     appliedSearch = search;
     appliedSearchField = searchField;
     appliedFilters = { ...filterValues };
     page = 1;
+    void load();
   }
 
   // Impersonate — become the user, then continue on the signed-in account page
@@ -176,7 +208,6 @@
 
   // Manage user — a two-pane modal mirroring the account settings, admin-scoped.
   type ManageSection = "profile" | "security" | "sessions" | "danger";
-  type Session = { id: string; token: string; userAgent?: string | null; ipAddress?: string | null; createdAt: string | Date };
   let manageOpen = $state(false);
   let mUser = $state<Row | null>(null);
   let mSection = $state<ManageSection>("profile");
@@ -192,10 +223,11 @@
   let mBanReason = $state("");
   let mBanDays = $state("");
   // sessions
-  let mSessions = $state<Session[]>([]);
+  let mSessions = $state<AdminSession[]>([]);
+  let mSessionsTotal = $state(0);
   let mSessionsPage = $state(1);
   let mSessionsSort = $state<SortState | null>(null);
-  const mSessionsColumns: DataTableColumn<Session>[] = [
+  const mSessionsColumns: DataTableColumn<AdminSession>[] = [
     { key: "userAgent", label: i18n.t.adminSessions.device, sortable: true, value: (s) => deviceLabel(s.userAgent) ?? s.userAgent ?? "" },
     { key: "ipAddress", label: i18n.t.adminSessions.ip, sortable: true },
     { key: "createdAt", label: i18n.t.adminSessions.since, sortable: true, value: (s) => new Date(s.createdAt).getTime() },
@@ -217,6 +249,7 @@
     mBanDays = "";
     mDeleteArmed = false;
     mSessions = [];
+    mSessionsTotal = 0;
     mSessionsPage = 1;
     manageOpen = true;
     await loadManagedSessions();
@@ -224,8 +257,15 @@
 
   async function loadManagedSessions(): Promise<void> {
     if (!mUser) return;
-    const { data: res } = await api.auth.admin.listUserSessions({ userId: mUser.id });
-    mSessions = (res?.sessions ?? []) as Session[];
+    const userId = mUser.id;
+    try {
+      const result = await listAdminSessions(api, { limit: MANAGED_SESSIONS_LIMIT, userId });
+      if (mUser?.id !== userId) return;
+      mSessions = result.items;
+      mSessionsTotal = result.total;
+    } catch {
+      toast.error(i18n.t.adminSessions.loadFailed);
+    }
   }
 
   async function saveProfile(event: Event): Promise<void> {
@@ -329,11 +369,15 @@
     await load();
   }
 
-  async function revokeSession(token: string): Promise<void> {
+  async function revokeSession(id: string): Promise<void> {
     busy = true;
-    const { error } = await api.auth.admin.revokeUserSession({ sessionToken: token });
-    busy = false;
-    if (error) return void toast.error(error.message ?? i18n.t.adminSessions.loadFailed);
+    try {
+      await revokeAdminSession(api, id);
+    } catch {
+      return void toast.error(i18n.t.adminSessions.revokeFailed);
+    } finally {
+      busy = false;
+    }
     toast.success(i18n.t.adminSessions.revoked);
     await loadManagedSessions();
   }
@@ -343,7 +387,7 @@
     busy = true;
     const { error } = await api.auth.admin.revokeUserSessions({ userId: mUser.id });
     busy = false;
-    if (error) return void toast.error(error.message ?? i18n.t.adminSessions.loadFailed);
+    if (error) return void toast.error(error.message ?? i18n.t.adminSessions.revokeFailed);
     toast.success(i18n.t.adminSessions.allRevoked);
     await loadManagedSessions();
   }
@@ -360,7 +404,7 @@
   }
 
   $effect(() => {
-    void load();
+    untrack(() => void load());
   });
 </script>
 
@@ -383,14 +427,18 @@
 
   <DataTable
     {columns}
-    rows={filtered}
+    rows={users}
     getKey={(u) => u.id}
-    empty={i18n.t.users.empty}
+    empty={loading ? "…" : i18n.t.users.empty}
     bind:sort
     bind:page
+    manualSort
+    manualPagination
     perPage={PAGE_SIZE}
+    {total}
     ariaLabel={i18n.t.users.title}
-    label={fmt(i18n.t.users.total, { count: filtered.length })}
+    label={fmt(i18n.t.users.total, { count: total })}
+    onChange={() => void load()}
   >
     {#snippet row(user, { cellClass })}
       <Table.Cell class={cn(cellClass("name"), "font-medium")}>{user.name}</Table.Cell>
@@ -555,14 +603,14 @@
               bind:sort={mSessionsSort}
               bind:page={mSessionsPage}
               perPage={PAGE_SIZE}
-              label={fmt(i18n.t.adminSessions.total, { count: mSessions.length })}
+              label={fmt(i18n.t.adminSessions.total, { count: mSessionsTotal })}
               empty={i18n.t.adminSessions.empty}
             >
               {#snippet row(s)}
                 <Table.Cell class="max-w-40 truncate" title={s.userAgent ?? ""}>{deviceLabel(s.userAgent) ?? s.userAgent ?? i18n.t.adminSessions.unknown}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{s.ipAddress ?? "—"}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{formatDateTime(s.createdAt)}</Table.Cell>
-                <Table.Cell><Button variant="ghost" size="sm" disabled={busy} onclick={() => revokeSession(s.token)}>{i18n.t.users.revokeSession}</Button></Table.Cell>
+                <Table.Cell><Button variant="ghost" size="sm" disabled={busy} onclick={() => revokeSession(s.id)}>{i18n.t.users.revokeSession}</Button></Table.Cell>
               {/snippet}
             </DataTable>
           </div>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.server.ts

@@ -1,9 +1,8 @@
 import type { LayoutServerLoad } from "./$types";
 import { redirect } from "@sveltejs/kit";
 import { safeAuthRedirect } from "#lib/auth-redirect.js";
-import { loadMessages } from "#lib/i18n/messages.js";
+import { getCapabilities } from "#lib/server/capabilities.js";
 import { isPublicPath, requireBackendAvailable } from "#lib/server/guards.js";
-import type { Capabilities } from "@podosoft/podokit-api-client";
 
 // "/" is a public landing page. Auth pages return signed-in users to their safe
 // requested page, and the admin area requires a session. /maintenance is public
@@ -43,19 +42,13 @@ export const load: LayoutServerLoad = async (event) => {
   if (!locals.user && !isPublicPath(pathname)) {
     redirect(303, `/login?redirect=${encodeURIComponent(`${pathname}${url.search}`)}`);
   }
-  let sessionIdleTimeoutMinutes: number | null = null;
-  if (locals.user) {
-    try {
-      const response = await event.fetch("/api/account/capabilities");
-      if (response.ok) {
-        const capabilities = (await response.json()) as Capabilities;
-        sessionIdleTimeoutMinutes = capabilities.sessionIdleTimeoutMinutes ?? null;
-      }
-    } catch {
-      // Keep automatic logout disabled in the browser if policy lookup fails.
-      // The server-side session expiration remains authoritative.
-    }
-  }
-  const messages = await loadMessages(locals.locale, site?.locale);
-  return { user: locals.user, locale: locals.locale, messages, site, sessionIdleTimeoutMinutes };
+  // Automatic logout stays disabled in the browser if the policy lookup fails;
+  // the server-side session expiration remains authoritative. Protected loads
+  // of the same request reuse this capabilities response.
+  const sessionIdleTimeoutMinutes = locals.user
+    ? ((await getCapabilities(event)).sessionIdleTimeoutMinutes ?? null)
+    : null;
+  // Messages are resolved by the universal +layout.ts. This load re-runs on every
+  // client navigation for the path checks above and must not resend them.
+  return { user: locals.user, locale: locals.locale, site, sessionIdleTimeoutMinutes };
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.ts

@@ -0,0 +1,10 @@
+import { loadMessages } from "#lib/i18n/messages.js";
+import type { LayoutLoad } from "./$types";
+
+// Runs on the server for the first render and in the browser afterwards, so the
+// catalogs never travel in `__data.json`. loadMessages() reuses one merged
+// object per locale pair; the language switch changes `data.locale`.
+export const load: LayoutLoad = async ({ data }) => ({
+  ...data,
+  messages: await loadMessages(data.locale, data.site?.locale),
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/oauth2/consent/+page.svelte

@@ -3,6 +3,7 @@
   import { Button } from "#lib/components/ui/button/index.js";
   import * as Card from "#lib/components/ui/card/index.js";
   import { getI18n } from "#lib/i18n/index.js";
+  import { signedOAuthQuery } from "#lib/oauth-query.js";
 
   const i18n = getI18n();
   // The OAuth provider redirects here with the authorization request in the query
@@ -14,13 +15,13 @@
   async function decide(accept: boolean): Promise<void> {
     busy = true;
     // The authorization request is carried in the signed query params we were
-    // redirected here with; forward them verbatim so the server can validate and
-    // restore it. Credentials carry the user's session. The response says where next.
+    // redirected here with; the server verifies them from the body, then restores
+    // the request. Credentials carry the user's session. The response says where next.
     const res = await fetch(`/api/auth/oauth2/consent${page.url.search}`, {
       method: "POST",
       credentials: "include",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ accept }),
+      body: JSON.stringify({ accept, oauth_query: signedOAuthQuery(page.url.search) }),
     });
     const data = (await res.json().catch(() => ({}))) as { url?: string; redirectURI?: string };
     const next = data.url ?? data.redirectURI;

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/setup-2fa/+page.svelte

@@ -1,6 +1,5 @@
 <script lang="ts">
   import { goto } from "$app/navigation";
-  import QRCode from "qrcode";
   import { Button } from "#lib/components/ui/button/index.js";
   import { Input } from "#lib/components/ui/input/index.js";
   import { Label } from "#lib/components/ui/label/index.js";
@@ -21,13 +20,20 @@
 
   $effect(() => {
     const uri = setup?.totpURI;
-    if (!uri) {
-      qrDataUrl = "";
-      return;
-    }
-    QRCode.toDataURL(uri, { margin: 1, width: 176 })
-      .then((url) => (qrDataUrl = url))
-      .catch(() => (qrDataUrl = ""));
+    qrDataUrl = "";
+    if (!uri) return;
+    let active = true;
+    import("qrcode")
+      .then(({ toDataURL }) => toDataURL(uri, { margin: 1, width: 176 }))
+      .then((url) => {
+        if (active && setup?.totpURI === uri) qrDataUrl = url;
+      })
+      .catch(() => {
+        if (active) qrDataUrl = "";
+      });
+    return () => {
+      active = false;
+    };
   });
 
   async function begin(): Promise<void> {

package/dist/templates/modules/admin-dashboard/files/dot-claude/skills/podokit-data-table/SKILL.md

@@ -44,5 +44,6 @@ put pagination outside the table.
   above the DataTable. Filters + search apply together on the Search button/Enter
   (don't query on every keystroke); the search field is a `select` of columns.
 
-The `/admin/users` page is the reference implementation. See `docs/development.md`
+The `/admin/users` page is the reference implementation (server offset paging);
+`/admin/sessions` shows keyset paging with a cursor. See `docs/development.md`
 ("Data tables", "Search & filters") on the PodoKit repo.

package/dist/templates/modules/admin-dashboard/files/tests/api/admin-sessions.api.spec.ts

@@ -0,0 +1,124 @@
+import type { APIRequestContext, PlaywrightWorkerArgs } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
+import { ADMIN, USER } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+const PASSWORD = "Podokit3e-Str0ng!pw";
+// The rate-limit module's default ceiling for /api/auth/* per window. Listing
+// sessions through Better Auth took 1 + one request per user from that budget;
+// the sessions endpoint takes one general request per page.
+const DEFAULT_AUTH_RATE_LIMIT = 20;
+
+type SessionItem = {
+  id: string;
+  userId: string;
+  userEmail: string;
+  createdAt: string;
+  [key: string]: unknown;
+};
+type SessionPage = { items: SessionItem[]; nextCursor: string | null; total: number };
+
+async function signedIn(
+  playwright: PlaywrightWorkerArgs["playwright"],
+  account: { email: string; password: string },
+): Promise<APIRequestContext> {
+  const context = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await context.post("/api/auth/sign-in/email", { data: account })).ok()).toBeTruthy();
+  return context;
+}
+
+test("admin pages through every user's session with a few requests outside the auth budget", async ({
+  playwright,
+  disposableUsers,
+}) => {
+  test.setTimeout(180_000);
+  const prefix = `sess-page-${Date.now()}`;
+  const userCount = 27;
+  const pageSize = 10;
+  const userIds = new Set<string>();
+  const signIns = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  for (let index = 0; index < userCount; index += 1) {
+    const email = `${prefix}-${String(index).padStart(2, "0")}@example.com`;
+    userIds.add(await disposableUsers.create({ email, name: `Session pager ${index}` }));
+    expect((await signIns.post("/api/auth/sign-in/email", { data: { email, password: PASSWORD } })).ok())
+      .toBeTruthy();
+  }
+  await signIns.dispose();
+
+  const admin = await signedIn(playwright, ADMIN);
+  const seen: SessionItem[] = [];
+  let requests = 0;
+  let cursor: string | null = null;
+  do {
+    const query = new URLSearchParams({ limit: String(pageSize), search: prefix });
+    if (cursor) query.set("cursor", cursor);
+    const response = await admin.get(`/api/admin/sessions?${query.toString()}`);
+    requests += 1;
+    expect(response.status()).toBe(200);
+    const remaining = response.headers()["ratelimit-remaining"];
+    if (remaining !== undefined) expect(Number(remaining)).toBeGreaterThan(0);
+    const page = (await response.json()) as SessionPage;
+    expect(page.total).toBe(userCount);
+    for (const item of page.items) expect(item).not.toHaveProperty("token");
+    seen.push(...page.items);
+    cursor = page.nextCursor;
+  } while (cursor && requests <= userCount);
+
+  expect(requests).toBe(Math.ceil(userCount / pageSize));
+  expect(requests).toBeLessThan(DEFAULT_AUTH_RATE_LIMIT);
+  expect(new Set(seen.map((item) => item.id)).size).toBe(userCount);
+  expect(new Set(seen.map((item) => item.userId))).toEqual(userIds);
+  const created = seen.map((item) => Date.parse(item.createdAt));
+  expect(created).toEqual([...created].sort((left, right) => right - left));
+  await admin.dispose();
+});
+
+test("a normal user cannot list or revoke sessions", async ({ playwright }) => {
+  const user = await signedIn(playwright, USER);
+  expect((await user.get("/api/admin/sessions")).status()).toBe(403);
+  expect((await user.delete("/api/admin/sessions/any-session")).status()).toBe(403);
+  await user.dispose();
+});
+
+test("admin revokes a session by id and the action is audited", async ({ playwright, disposableUsers }) => {
+  const email = `sess-revoke-${Date.now()}@example.com`;
+  const userId = await disposableUsers.create({ email, name: "Revoke by id" });
+  const theirs = await signedIn(playwright, { email, password: PASSWORD });
+  const admin = await signedIn(playwright, ADMIN);
+
+  const listed = await admin.get(`/api/admin/sessions?userId=${encodeURIComponent(userId)}`);
+  expect(listed.ok()).toBeTruthy();
+  const page = (await listed.json()) as SessionPage;
+  expect(page.items).toHaveLength(1);
+  const sessionId = page.items[0]?.id ?? "";
+
+  const revoked = await admin.delete(`/api/admin/sessions/${encodeURIComponent(sessionId)}`);
+  expect(revoked.status()).toBe(204);
+  expect(await (await theirs.get("/api/auth/get-session")).json()).toBeNull();
+  expect((await admin.delete(`/api/admin/sessions/${encodeURIComponent(sessionId)}`)).status()).toBe(404);
+
+  // The revoke runs through Better Auth, so the audit-log module records it when
+  // the module is installed and auditing is on.
+  const capabilities = (await (await admin.get("/api/account/capabilities")).json()) as { auditLog?: boolean };
+  const audit = await admin.get("/api/audit-logs");
+  if (capabilities.auditLog === true && audit.ok()) {
+    const body = (await audit.json()) as unknown;
+    const entries = (Array.isArray(body) ? body : (body as { items?: unknown[] }).items ?? []) as Array<{
+      action?: string;
+      actorEmail?: string | null;
+    }>;
+    expect(entries.some((entry) => entry.action === "user.session_revoke" && entry.actorEmail === ADMIN.email))
+      .toBeTruthy();
+  }
+  await theirs.dispose();
+  await admin.dispose();
+});
+
+test("a forged cursor is rejected", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const response = await admin.get("/api/admin/sessions?cursor=forged");
+  expect(response.status()).toBe(400);
+  expect((await response.json())?.error?.code).toBe("ADMIN_SESSION_CURSOR_INVALID");
+  await admin.dispose();
+});