@podosoft/podokit 1.1.6 → 1.3.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -1,6 +1,5 @@
 <script lang="ts">
   import { goto, invalidateAll } from "$app/navigation";
-  import QRCode from "qrcode";
   import { Button } from "#lib/components/ui/button/index.js";
   import { Input } from "#lib/components/ui/input/index.js";
   import { Label } from "#lib/components/ui/label/index.js";
@@ -252,13 +251,20 @@
   let qrDataUrl = $state("");
   $effect(() => {
     const uri = setup?.totpURI;
-    if (!uri) {
-      qrDataUrl = "";
-      return;
-    }
-    QRCode.toDataURL(uri, { margin: 1, width: 176 })
-      .then((url) => (qrDataUrl = url))
-      .catch(() => (qrDataUrl = ""));
+    qrDataUrl = "";
+    if (!uri) return;
+    let active = true;
+    import("qrcode")
+      .then(({ toDataURL }) => toDataURL(uri, { margin: 1, width: 176 }))
+      .then((url) => {
+        if (active && setup?.totpURI === uri) qrDataUrl = url;
+      })
+      .catch(() => {
+        if (active) qrDataUrl = "";
+      });
+    return () => {
+      active = false;
+    };
   });
   async function enable2fa(): Promise<void> {
     twoFaBusy = true;

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/session-idle-timeout.svelte

@@ -1,21 +1,27 @@
 <script lang="ts">
   import { goto } from "$app/navigation";
-  import { onMount } from "svelte";
   import { api } from "#lib/api.js";
 
   let { timeoutMinutes }: { timeoutMinutes: number | null } = $props();
 
   const ACTIVITY_KEY = "podokit:session-last-activity";
   const SERVER_REFRESH_INTERVAL_MS = 60_000;
+  // Every localStorage write fires a `storage` event in each other open tab.
+  const ACTIVITY_WRITE_INTERVAL_MS = 5_000;
   const activityEvents = ["pointerdown", "keydown", "touchstart", "scroll"] as const;
 
-  let mounted = $state(false);
-  let lastActivityAt = $state(Date.now());
-  let lastServerRefreshAt = $state(Date.now());
   let signingOut = false;
-  let previousTimeoutMs: number | null = null;
   const timeoutMs = $derived(timeoutMinutes === null ? null : timeoutMinutes * 60_000);
 
+  function readStoredActivity(): number {
+    try {
+      const value = Number(localStorage.getItem(ACTIVITY_KEY));
+      return Number.isFinite(value) ? value : 0;
+    } catch {
+      return 0;
+    }
+  }
+
   function storeActivity(value: number): void {
     try {
       localStorage.setItem(ACTIVITY_KEY, String(value));
@@ -44,66 +50,85 @@
     if (error || !data) await signOutForIdleTimeout();
   }
 
-  function recordActivity(): void {
-    if (timeoutMs === null || signingOut) return;
-    const now = Date.now();
-    if (now - lastActivityAt >= timeoutMs) {
+  function trackActivity(limit: number): () => void {
+    // The policy only exists for a signed-in user, so a new tracker means a new session.
+    signingOut = false;
+    let lastActivityAt = Date.now();
+    let storedActivityAt = lastActivityAt;
+    let lastWriteAt = lastActivityAt;
+    let lastServerRefreshAt = lastActivityAt;
+    let deadlineTimer: number | undefined;
+    let flushTimer: number | undefined;
+    storeActivity(lastActivityAt);
+
+    function flush(): void {
+      window.clearTimeout(flushTimer);
+      flushTimer = undefined;
+      if (signingOut || lastActivityAt <= storedActivityAt) return;
+      storedActivityAt = lastActivityAt;
+      lastWriteAt = Date.now();
+      storeActivity(storedActivityAt);
+    }
+
+    function expire(): void {
+      window.clearTimeout(deadlineTimer);
+      window.clearTimeout(flushTimer);
       void signOutForIdleTimeout();
-      return;
     }
-    lastActivityAt = now;
-    storeActivity(now);
-    if (now - lastServerRefreshAt >= SERVER_REFRESH_INTERVAL_MS) {
-      lastServerRefreshAt = now;
-      void refreshServerSession();
+
+    // The deadline is re-read when the timer fires rather than re-armed on every
+    // event; other tabs' activity arrives through storage.
+    function check(): void {
+      if (signingOut) return;
+      const latest = Math.max(lastActivityAt, readStoredActivity());
+      const remaining = limit - (Date.now() - latest);
+      if (remaining <= 0) return expire();
+      window.clearTimeout(deadlineTimer);
+      deadlineTimer = window.setTimeout(check, remaining);
     }
-  }
 
-  function receiveActivity(event: StorageEvent): void {
-    if (event.key !== ACTIVITY_KEY || event.newValue === null) return;
-    const value = Number(event.newValue);
-    if (Number.isFinite(value) && value > lastActivityAt) lastActivityAt = value;
-  }
+    function recordActivity(): void {
+      if (signingOut) return;
+      const now = Date.now();
+      // Timers can be suspended (sleep, background throttling), so a late event may arrive past the deadline.
+      if (now - lastActivityAt >= limit && now - readStoredActivity() >= limit) return expire();
+      lastActivityAt = now;
+      const sinceWrite = now - lastWriteAt;
+      if (sinceWrite >= ACTIVITY_WRITE_INTERVAL_MS) flush();
+      else flushTimer ??= window.setTimeout(flush, ACTIVITY_WRITE_INTERVAL_MS - sinceWrite);
+      if (now - lastServerRefreshAt >= SERVER_REFRESH_INTERVAL_MS) {
+        lastServerRefreshAt = now;
+        void refreshServerSession();
+      }
+    }
+
+    function onVisibilityChange(): void {
+      if (document.visibilityState === "hidden") flush();
+      else check();
+    }
 
-  onMount(() => {
-    mounted = true;
-    const now = Date.now();
-    lastActivityAt = now;
-    lastServerRefreshAt = now;
-    storeActivity(now);
     for (const event of activityEvents) {
       document.addEventListener(event, recordActivity, { passive: true, capture: true });
     }
     window.addEventListener("focus", recordActivity);
-    window.addEventListener("storage", receiveActivity);
+    document.addEventListener("visibilitychange", onVisibilityChange);
+    window.addEventListener("pagehide", flush);
+    deadlineTimer = window.setTimeout(check, limit);
+
     return () => {
       for (const event of activityEvents) {
         document.removeEventListener(event, recordActivity, { capture: true });
       }
       window.removeEventListener("focus", recordActivity);
-      window.removeEventListener("storage", receiveActivity);
+      document.removeEventListener("visibilitychange", onVisibilityChange);
+      window.removeEventListener("pagehide", flush);
+      window.clearTimeout(deadlineTimer);
+      window.clearTimeout(flushTimer);
     };
-  });
+  }
 
   $effect(() => {
-    if (!mounted) return;
-    const currentTimeoutMs = timeoutMs;
-    if (currentTimeoutMs !== previousTimeoutMs) {
-      previousTimeoutMs = currentTimeoutMs;
-      if (currentTimeoutMs !== null) {
-        const now = Date.now();
-        lastActivityAt = now;
-        lastServerRefreshAt = now;
-        storeActivity(now);
-      }
-    }
-    if (currentTimeoutMs === null) return;
-    const remaining = currentTimeoutMs - (Date.now() - lastActivityAt);
-    if (remaining <= 0) {
-      void signOutForIdleTimeout();
-      return;
-    }
-    const timer = window.setTimeout(() => void signOutForIdleTimeout(), remaining);
-    return () => window.clearTimeout(timer);
+    if (timeoutMs === null) return;
+    return trackActivity(timeoutMs);
   });
 </script>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/en.json

@@ -393,7 +393,10 @@
     "empty": "No audit entries.",
     "loadFailed": "Failed to load audit log",
     "total": "{count} entries",
-    "searchField": "Actor or target"
+    "range": "Entries {from}–{to}",
+    "searchField": "Actor or target",
+    "actorHint": "Full email address",
+    "targetHint": "Full target as shown"
   },
   "users": {
     "title": "Users",
@@ -503,6 +506,8 @@
     "revoked": "Session revoked",
     "allRevoked": "All sessions revoked for user",
     "loadFailed": "Failed to load sessions",
+    "revokeFailed": "Failed to revoke the session",
+    "searchPlaceholder": "Email or name",
     "total": "{count} sessions"
   },
   "account": {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/catalogs/admin-dashboard/ko.json

@@ -393,7 +393,10 @@
     "empty": "감사 기록이 없습니다.",
     "loadFailed": "감사 로그를 불러오지 못했습니다",
     "total": "항목 {count}개",
-    "searchField": "수행자·대상"
+    "range": "{from}–{to}번째 항목",
+    "searchField": "수행자·대상",
+    "actorHint": "전체 이메일 주소",
+    "targetHint": "표시된 대상 전체"
   },
   "users": {
     "title": "회원",
@@ -503,6 +506,8 @@
     "revoked": "세션을 종료했습니다",
     "allRevoked": "사용자의 세션을 모두 종료했습니다",
     "loadFailed": "세션을 불러오지 못했습니다",
+    "revokeFailed": "세션을 종료하지 못했습니다",
+    "searchPlaceholder": "이메일 또는 이름",
     "total": "세션 {count}개"
   },
   "account": {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/messages.test.ts

@@ -0,0 +1,29 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { loadMessages } from "./messages";
+
+describe("loadMessages", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("reuses one merged catalog per locale pair in a build", async () => {
+    vi.stubEnv("DEV", false);
+
+    const korean = await loadMessages("ko", "en");
+
+    expect(korean.nav.users).toBe("회원");
+    expect(await loadMessages("ko", "en")).toBe(korean);
+    expect(await loadMessages("KO", null)).toBe(korean);
+    expect(await loadMessages("en", "en")).not.toBe(korean);
+  });
+
+  it("merges again in development so edited catalogs appear", async () => {
+    vi.stubEnv("DEV", true);
+
+    const first = await loadMessages("en");
+    const second = await loadMessages("en");
+
+    expect(second).not.toBe(first);
+    expect(second).toEqual(first);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/i18n/messages.ts

@@ -83,12 +83,7 @@ async function loadCatalog(code: string): Promise<JsonObject> {
   return catalog;
 }
 
-export async function loadMessages(
-  locale: string,
-  configuredFallback?: string | null,
-): Promise<Messages> {
-  const selected = resolveLocale(locale);
-  const fallback = resolveLocale(configuredFallback);
+async function mergeMessages(selected: Locale, fallback: Locale): Promise<Messages> {
   const candidates = [defaultLocale, fallback, selected];
   // A later catalog has higher priority. Keep the last occurrence so selecting
   // the built-in English fallback still overrides a non-English site default.
@@ -97,3 +92,25 @@ export async function loadMessages(
   for (const code of chain) catalog = mergeCatalog(catalog, await loadCatalog(code));
   return catalog as Messages;
 }
+
+// Catalogs are static in a build, so each locale pair is merged once and every
+// caller shares the same object. Treat it as read-only.
+const merged = new Map<string, Promise<Messages>>();
+
+export function loadMessages(
+  locale: string,
+  configuredFallback?: string | null,
+): Promise<Messages> {
+  const selected = resolveLocale(locale);
+  const fallback = resolveLocale(configuredFallback);
+  // Development re-merges so an edited catalog shows up on the next load.
+  if (import.meta.env.DEV) return mergeMessages(selected, fallback);
+  const key = `${selected}\u0000${fallback}`;
+  let messages = merged.get(key);
+  if (!messages) {
+    messages = mergeMessages(selected, fallback);
+    messages.catch(() => merged.delete(key));
+    merged.set(key, messages);
+  }
+  return messages;
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/oauth-query.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { signedOAuthQuery } from "./oauth-query";
+
+describe("signed OAuth query", () => {
+  it("keeps only the signed parameters", () => {
+    const search = "?client_id=c1&scope=openid&exp=9&ba_param=client_id&ba_param=exp&ba_param=scope&sig=abc&extra=1";
+    const query = new URLSearchParams(signedOAuthQuery(search));
+    expect(query.get("client_id")).toBe("c1");
+    expect(query.get("sig")).toBe("abc");
+    expect(query.getAll("ba_param")).toEqual(["client_id", "exp", "scope"]);
+    expect(query.has("extra")).toBe(false);
+  });
+
+  it("forwards the whole query when the server lists no signed names", () => {
+    expect(signedOAuthQuery("?client_id=c1&sig=abc")).toBe("client_id=c1&sig=abc");
+  });
+
+  it("returns nothing without a signature", () => {
+    expect(signedOAuthQuery("?client_id=c1")).toBeUndefined();
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/oauth-query.ts

@@ -0,0 +1,15 @@
+// The OAuth provider's consent endpoint verifies a signed copy of the authorization
+// request sent in the body. Like Better Auth's own client plugin, forward only the
+// parameters the server signed, so extra page parameters cannot break the signature.
+export function signedOAuthQuery(search: string): string | undefined {
+  const params = new URLSearchParams(search);
+  if (!params.has("sig")) return undefined;
+  const signedNames = params.getAll("ba_param");
+  if (signedNames.length === 0) return params.toString();
+  const allowed = new Set(signedNames);
+  const signed = new URLSearchParams();
+  for (const [key, value] of params.entries()) {
+    if (key === "sig" || key === "ba_param" || allowed.has(key)) signed.append(key, value);
+  }
+  return signed.toString();
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/capabilities.test.ts

@@ -0,0 +1,98 @@
+import type { Capabilities } from "@podosoft/podokit-api-client";
+import { describe, expect, it, vi, type Mock } from "vitest";
+import { DEFAULT_CAPABILITIES, getCapabilities } from "./capabilities";
+import { loadProtectedLayout } from "./protected-layout";
+
+type TestUser = NonNullable<App.Locals["user"]>;
+type FetchMock = Mock<(input: RequestInfo | URL, init?: RequestInit) => Promise<Response>>;
+
+function fetchMock(respond: () => Promise<Response>): FetchMock {
+  return vi.fn<(input: RequestInfo | URL, init?: RequestInit) => Promise<Response>>(respond);
+}
+
+function locals(user: TestUser | null = null): App.Locals {
+  return {
+    user,
+    session: user ? { id: "session-1", impersonatedBy: null } : null,
+    authUnavailable: false,
+    locale: "en",
+    site: null,
+    siteUnavailable: false,
+  };
+}
+
+function capabilitiesFetch(capabilities: Partial<Capabilities>): FetchMock {
+  return fetchMock(async () => Response.json({ ...DEFAULT_CAPABILITIES, twoFactor: true, ...capabilities }));
+}
+
+const member: TestUser = { id: "user-1", email: "user@example.com", name: "User", twoFactorEnabled: false };
+
+describe("getCapabilities", () => {
+  it("fetches once for every load in the same request", async () => {
+    const fetch = capabilitiesFetch({ auditLog: true });
+    const request = locals(member);
+
+    const [first, second] = await Promise.all([
+      getCapabilities({ locals: request, fetch }),
+      getCapabilities({ locals: request, fetch }),
+    ]);
+    const third = await getCapabilities({ locals: request, fetch });
+
+    expect(fetch).toHaveBeenCalledTimes(1);
+    expect(fetch).toHaveBeenCalledWith("/api/account/capabilities");
+    expect(first.auditLog).toBe(true);
+    expect(second).toBe(first);
+    expect(third).toBe(first);
+  });
+
+  it("fetches again for a new request", async () => {
+    const fetch = capabilitiesFetch({});
+
+    await getCapabilities({ locals: locals(member), fetch });
+    await getCapabilities({ locals: locals(member), fetch });
+
+    expect(fetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("resolves to safe defaults when the endpoint fails", async () => {
+    const rejected = fetchMock(async () => {
+      throw new TypeError("fetch failed");
+    });
+    const unavailable = fetchMock(async () => new Response("", { status: 503 }));
+
+    await expect(getCapabilities({ locals: locals(), fetch: rejected })).resolves.toEqual(DEFAULT_CAPABILITIES);
+    await expect(getCapabilities({ locals: locals(), fetch: unavailable })).resolves.toEqual(DEFAULT_CAPABILITIES);
+  });
+});
+
+describe("loadProtectedLayout", () => {
+  it("sends an un-enrolled user to setup when the policy requires two-factor", async () => {
+    const fetch = capabilitiesFetch({ require2fa: true });
+
+    await expect(loadProtectedLayout({ locals: locals(member), fetch })).rejects.toMatchObject({
+      status: 302,
+      location: "/setup-2fa",
+    });
+    expect(fetch).toHaveBeenCalledTimes(1);
+    expect(fetch).not.toHaveBeenCalledWith("/api/account/require-2fa");
+  });
+
+  it("lets enrolled users through and shares the capabilities response", async () => {
+    const fetch = capabilitiesFetch({ require2fa: true });
+    const request = locals({ ...member, twoFactorEnabled: true });
+
+    const data = await loadProtectedLayout({ locals: request, fetch });
+
+    expect(data.capabilities.require2fa).toBe(true);
+    expect(data.capabilities).toBe(await getCapabilities({ locals: request, fetch }));
+    expect(fetch).toHaveBeenCalledTimes(1);
+  });
+
+  it("fails closed before fetching when the backend could not be checked", async () => {
+    const fetch = capabilitiesFetch({});
+    const request = { ...locals(member), authUnavailable: true };
+
+    await expect(loadProtectedLayout({ locals: request, fetch })).rejects.toMatchObject({ status: 503 });
+    expect(fetch).not.toHaveBeenCalled();
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/capabilities.ts

@@ -0,0 +1,54 @@
+import type { Capabilities } from "@podosoft/podokit-api-client";
+
+type ServerFetch = (
+  input: RequestInfo | URL,
+  init?: RequestInit,
+) => Promise<Response>;
+
+export interface CapabilitiesEvent {
+  locals: App.Locals;
+  fetch: ServerFetch;
+}
+
+/** Safe values used when the capability endpoint cannot be reached. */
+export const DEFAULT_CAPABILITIES: Capabilities = {
+  twoFactor: false,
+  providers: [],
+  deleteAccount: false,
+  auditLog: false,
+  emailVerification: false,
+  signupApprovalRequired: false,
+  passwordBreachCheck: false,
+  magicLink: false,
+  emailOtp: false,
+  username: false,
+  multiSession: false,
+  phoneNumber: false,
+  apiKey: false,
+  passkey: false,
+  organization: false,
+  oidcProvider: false,
+  require2fa: false,
+  roles: ["admin", "user"],
+};
+
+async function fetchCapabilities(fetch: ServerFetch): Promise<Capabilities> {
+  try {
+    const response = await fetch("/api/account/capabilities");
+    if (response.ok) return (await response.json()) as Capabilities;
+  } catch {
+    /* Keep safe defaults if the capability endpoint is unavailable. */
+  }
+  return DEFAULT_CAPABILITIES;
+}
+
+/**
+ * Load `/account/capabilities` at most once per request. Every server load of
+ * one page render or `__data.json` request shares `locals`, so layouts and
+ * pages can call this freely. The promise never rejects; failures resolve to
+ * {@link DEFAULT_CAPABILITIES}.
+ */
+export function getCapabilities({ locals, fetch }: CapabilitiesEvent): Promise<Capabilities> {
+  locals.capabilities ??= fetchCapabilities(fetch);
+  return locals.capabilities;
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/guards.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it, vi } from "vitest";
+
+// Stands in for the application's own list in the app-owned public-paths.ts.
+vi.mock("./public-paths", () => ({ APP_PUBLIC_PATHS: ["/pricing", "/robots.txt"] }));
+
+const { isPublicPath } = await import("./guards");
+
+describe("isPublicPath", () => {
+  it("keeps the sign-in flow and the landing page public", () => {
+    expect(isPublicPath("/")).toBe(true);
+    expect(isPublicPath("/login")).toBe(true);
+    expect(isPublicPath("/reset-password/token")).toBe(true);
+    expect(isPublicPath("/admin")).toBe(false);
+    expect(isPublicPath("/account")).toBe(false);
+  });
+
+  it("adds the application's public prefixes and their subpaths", () => {
+    expect(isPublicPath("/pricing")).toBe(true);
+    expect(isPublicPath("/pricing/teams")).toBe(true);
+    expect(isPublicPath("/robots.txt")).toBe(true);
+    expect(isPublicPath("/pricingx")).toBe(false);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/guards.ts

@@ -1,4 +1,5 @@
 import { error } from "@sveltejs/kit";
+import { APP_PUBLIC_PATHS } from "./public-paths";
 
 /** Roles that may reach the admin console. Kept as a set so custom roles can be
  *  added here (and, later, replaced by a permission check) without touching every
@@ -13,6 +14,7 @@ const PUBLIC_PATHS = [
   "/verify-email",
   "/pending-approval",
   "/maintenance",
+  ...APP_PUBLIC_PATHS,
   // Modules add their public (no-session) page prefixes here.
   // podokit:begin:public-paths
   // podokit:end:public-paths

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/protected-layout.ts

@@ -1,16 +1,9 @@
 import { redirect } from "@sveltejs/kit";
 import type { Capabilities } from "@podosoft/podokit-api-client";
+import { getCapabilities, type CapabilitiesEvent } from "./capabilities";
 import { requireBackendAvailable } from "./guards";
 
-type ServerFetch = (
-  input: RequestInfo | URL,
-  init?: RequestInit,
-) => Promise<Response>;
-
-export interface ProtectedLayoutInput {
-  locals: App.Locals;
-  fetch: ServerFetch;
-}
+export type ProtectedLayoutInput = CapabilitiesEvent;
 
 export interface ProtectedLayoutData {
   user: App.Locals["user"];
@@ -22,53 +15,17 @@ export interface ProtectedLayoutData {
  * Load the shared signed-in route context without imposing an application shell.
  * The `(app)` group stays available for product UI, while `(admin)` adds admin chrome.
  */
-export async function loadProtectedLayout({
-  locals,
-  fetch,
-}: ProtectedLayoutInput): Promise<ProtectedLayoutData> {
+export async function loadProtectedLayout(event: ProtectedLayoutInput): Promise<ProtectedLayoutData> {
+  const { locals } = event;
   requireBackendAvailable(locals);
 
-  let capabilities: Capabilities = {
-    twoFactor: false,
-    providers: [],
-    deleteAccount: false,
-    auditLog: false,
-    emailVerification: false,
-    signupApprovalRequired: false,
-    passwordBreachCheck: false,
-    magicLink: false,
-    emailOtp: false,
-    username: false,
-    multiSession: false,
-    phoneNumber: false,
-    apiKey: false,
-    passkey: false,
-    organization: false,
-    oidcProvider: false,
-    roles: ["admin", "user"],
-  };
-  try {
-    const response = await fetch("/api/account/capabilities");
-    if (response.ok) capabilities = (await response.json()) as Capabilities;
-  } catch {
-    /* keep defaults */
-  }
+  const capabilities = await getCapabilities(event);
 
   // Require-two-factor policy: a signed-in user who has not enrolled is sent to
   // setup. The API guard remains authoritative; this redirect provides the UX.
-  const user = locals.user as (App.Locals["user"] & { twoFactorEnabled?: boolean }) | null;
-  let mustEnrol = false;
-  if (user && !user.twoFactorEnabled) {
-    try {
-      const response = await fetch("/api/account/require-2fa");
-      mustEnrol =
-        response.ok &&
-        ((await response.json()) as { require2fa?: boolean }).require2fa === true;
-    } catch {
-      /* do not block the app if the policy check fails */
-    }
+  if (locals.user && !locals.user.twoFactorEnabled && capabilities.require2fa) {
+    redirect(302, "/setup-2fa");
   }
-  if (mustEnrol) redirect(302, "/setup-2fa");
 
   return {
     user: locals.user,

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/public-paths.ts

@@ -0,0 +1,9 @@
+/**
+ * Application-owned public page prefixes. A listed path also covers its
+ * subpaths ("/pricing" covers "/pricing/teams"). These pages render for
+ * anonymous visitors and keep rendering when the API or site settings are
+ * unavailable; every other page requires a session and fails closed with 503
+ * during an outage. Modules add their own prefixes in guards.ts, so do not
+ * repeat them here. PodoKit creates this file once and never overwrites it.
+ */
+export const APP_PUBLIC_PATHS: readonly string[] = [];