@podosoft/podokit 1.2.0 → 1.3.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/admin/users.ts

@@ -1,4 +1,6 @@
-// Builds the Better Auth `admin.listUsers` query for the server-paged users table.
+import type { ApiClient } from "@podosoft/podokit-api-client";
+
+// Builds the `GET /admin/users` query for the server-paged users table.
 
 export type UserListSort = { key: string; dir: "asc" | "desc" };
 
@@ -12,6 +14,82 @@ export type UserListState = {
   status: string;
 };
 
+export type AdminUserStatus = "active" | "pending" | "banned";
+
+/** A user from `GET /admin/users`. */
+export type AdminUser = {
+  id: string;
+  name: string;
+  email: string;
+  role: string | null;
+  emailVerified: boolean;
+  signupApproved: boolean;
+  banned: boolean;
+  banReason: string | null;
+  banExpires: string | null;
+  createdAt: string;
+};
+
+export type AdminUserPage = { items: AdminUser[]; total: number };
+
+export type AdminUserQuery = {
+  limit: number;
+  offset: number;
+  sortBy: string;
+  sortDirection: "asc" | "desc";
+  search?: string;
+  searchField?: "email" | "name";
+  role?: string;
+  status?: AdminUserStatus;
+};
+
+export const DEFAULT_USER_SORT: UserListSort = { key: "createdAt", dir: "desc" };
+
+const SORTABLE_FIELDS = new Set(["name", "email", "role", "createdAt"]);
+const STATUSES = new Set<string>(["active", "pending", "banned"]);
+
+function isStatus(value: string): value is AdminUserStatus {
+  return STATUSES.has(value);
+}
+
+export function adminUsersQuery(state: UserListState): AdminUserQuery {
+  const sort = state.sort && SORTABLE_FIELDS.has(state.sort.key) ? state.sort : DEFAULT_USER_SORT;
+  const search = state.search.trim();
+  return {
+    limit: state.perPage,
+    offset: (Math.max(state.page, 1) - 1) * state.perPage,
+    sortBy: sort.key,
+    sortDirection: sort.dir,
+    // The server matches case-insensitively, so the text is sent as typed.
+    ...(search ? { search, searchField: state.searchField === "name" ? "name" as const : "email" as const } : {}),
+    ...(state.role ? { role: state.role } : {}),
+    ...(isStatus(state.status) ? { status: state.status } : {}),
+  };
+}
+
+/** Reads one page; the role and status filters combine on the server. */
+export function listAdminUsers(client: Pick<ApiClient, "get">, query: AdminUserQuery): Promise<AdminUserPage> {
+  const params = new URLSearchParams({
+    limit: String(query.limit),
+    offset: String(query.offset),
+    sortBy: query.sortBy,
+    sortDirection: query.sortDirection,
+  });
+  if (query.search) {
+    params.set("search", query.search);
+    params.set("searchField", query.searchField ?? "email");
+  }
+  if (query.role) params.set("role", query.role);
+  if (query.status) params.set("status", query.status);
+  return client.get<AdminUserPage>(`/admin/users?${params.toString()}`);
+}
+
+// The 1.2 users page is application-owned and still imports the helpers below,
+// which build a Better Auth `admin.listUsers` query. Keep them until the next
+// major release so `podo update` does not break that page; new pages use
+// `adminUsersQuery` and `listAdminUsers`.
+
+/** @deprecated Use `AdminUserQuery` with `listAdminUsers`. */
 export type ListUsersQuery = {
   limit: number;
   offset: number;
@@ -25,10 +103,6 @@ export type ListUsersQuery = {
   filterOperator?: "eq";
 };
 
-export const DEFAULT_USER_SORT: UserListSort = { key: "createdAt", dir: "desc" };
-
-const SORTABLE_FIELDS = new Set(["name", "email", "role", "createdAt"]);
-
 function filterFor(role: string, status: string): Pick<ListUsersQuery, "filterField" | "filterValue" | "filterOperator"> {
   if (status === "pending") return { filterField: "signupApproved", filterValue: false, filterOperator: "eq" };
   if (status === "banned") return { filterField: "banned", filterValue: true, filterOperator: "eq" };
@@ -36,6 +110,7 @@ function filterFor(role: string, status: string): Pick<ListUsersQuery, "filterFi
   return {};
 }
 
+/** @deprecated Use `adminUsersQuery`; `listUsers` accepts only one filter. */
 export function listUsersQuery(state: UserListState): ListUsersQuery {
   const sort = state.sort && SORTABLE_FIELDS.has(state.sort.key) ? state.sort : DEFAULT_USER_SORT;
   const searchField = state.searchField === "name" ? "name" : "email";
@@ -47,8 +122,6 @@ export function listUsersQuery(state: UserListState): ListUsersQuery {
     sortDirection: sort.dir,
     ...(search
       ? {
-          // Better Auth matches with a case-sensitive LIKE on PostgreSQL and stores
-          // emails in lower case, so lower-casing makes email search case-insensitive.
           searchValue: searchField === "email" ? search.toLowerCase() : search,
           searchField,
           searchOperator: "contains" as const,
@@ -58,10 +131,7 @@ export function listUsersQuery(state: UserListState): ListUsersQuery {
   };
 }
 
-/**
- * `listUsers` accepts one filter, so the role and status selects are mutually
- * exclusive: when both hold a value, the one that just changed wins.
- */
+/** @deprecated `GET /admin/users` combines the role and status filters. */
 export function keepLatestFilter(
   previous: { role: string; status: string },
   next: { role: string; status: string },

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/guards.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it, vi } from "vitest";
+
+// Stands in for the application's own list in the app-owned public-paths.ts.
+vi.mock("./public-paths", () => ({ APP_PUBLIC_PATHS: ["/pricing", "/robots.txt"] }));
+
+const { isPublicPath } = await import("./guards");
+
+describe("isPublicPath", () => {
+  it("keeps the sign-in flow and the landing page public", () => {
+    expect(isPublicPath("/")).toBe(true);
+    expect(isPublicPath("/login")).toBe(true);
+    expect(isPublicPath("/reset-password/token")).toBe(true);
+    expect(isPublicPath("/admin")).toBe(false);
+    expect(isPublicPath("/account")).toBe(false);
+  });
+
+  it("adds the application's public prefixes and their subpaths", () => {
+    expect(isPublicPath("/pricing")).toBe(true);
+    expect(isPublicPath("/pricing/teams")).toBe(true);
+    expect(isPublicPath("/robots.txt")).toBe(true);
+    expect(isPublicPath("/pricingx")).toBe(false);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/guards.ts

@@ -1,4 +1,5 @@
 import { error } from "@sveltejs/kit";
+import { APP_PUBLIC_PATHS } from "./public-paths";
 
 /** Roles that may reach the admin console. Kept as a set so custom roles can be
  *  added here (and, later, replaced by a permission check) without touching every
@@ -13,6 +14,7 @@ const PUBLIC_PATHS = [
   "/verify-email",
   "/pending-approval",
   "/maintenance",
+  ...APP_PUBLIC_PATHS,
   // Modules add their public (no-session) page prefixes here.
   // podokit:begin:public-paths
   // podokit:end:public-paths

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/public-paths.ts

@@ -0,0 +1,9 @@
+/**
+ * Application-owned public page prefixes. A listed path also covers its
+ * subpaths ("/pricing" covers "/pricing/teams"). These pages render for
+ * anonymous visitors and keep rendering when the API or site settings are
+ * unavailable; every other page requires a session and fails closed with 503
+ * during an outage. Modules add their own prefixes in guards.ts, so do not
+ * repeat them here. PodoKit creates this file once and never overwrites it.
+ */
+export const APP_PUBLIC_PATHS: readonly string[] = [];

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(admin)/admin/users/+page.svelte

@@ -17,7 +17,7 @@
   import { toast } from "svelte-sonner";
   import { api } from "#lib/api.js";
   import { listAdminSessions, revokeAdminSession, type AdminSession } from "#lib/admin/sessions.js";
-  import { DEFAULT_USER_SORT, keepLatestFilter, listUsersQuery } from "#lib/admin/users.js";
+  import { DEFAULT_USER_SORT, adminUsersQuery, listAdminUsers } from "#lib/admin/users.js";
   import { getI18n, fmt, formatDateTime } from "#lib/i18n/index.js";
   import { cn } from "#lib/utils.js";
   import { deviceLabel } from "#lib/device-label.js";
@@ -64,19 +64,6 @@
   let appliedSearchField = $state("email");
   let filterValues = $state<Record<string, string>>({ role: "", status: "" });
   let appliedFilters = $state<Record<string, string>>({ role: "", status: "" });
-  let stagedFilters = { role: "", status: "" };
-
-  // The list endpoint takes a single filter, so picking a role clears the status
-  // and vice versa (see keepLatestFilter).
-  $effect(() => {
-    const next = keepLatestFilter(stagedFilters, {
-      role: filterValues.role ?? "",
-      status: filterValues.status ?? "",
-    });
-    stagedFilters = next;
-    if (filterValues.role !== next.role) filterValues.role = next.role;
-    if (filterValues.status !== next.status) filterValues.status = next.status;
-  });
 
   const columns = $derived<DataTableColumn<Row>[]>([
     { key: "name", label: i18n.t.users.name, sortable: true },
@@ -103,6 +90,7 @@
       label: i18n.t.users.status,
       options: [
         { value: "", label: i18n.t.toolbar.all },
+        { value: "active", label: i18n.t.users.active },
         { value: "pending", label: i18n.t.users.pendingApproval },
         { value: "banned", label: i18n.t.users.banned },
       ],
@@ -118,7 +106,7 @@
     const request = ++latestRequest;
     const sortKey = sort ? `${sort.key}:${sort.dir}` : "";
     if (sortKey !== loadedSortKey) page = 1;
-    const query = listUsersQuery({
+    const query = adminUsersQuery({
       page,
       perPage: PAGE_SIZE,
       sort,
@@ -128,12 +116,18 @@
       status: appliedFilters.status ?? "",
     });
     loading = true;
-    const { data: res, error } = await api.auth.admin.listUsers({ query });
+    let result: { items: Row[]; total: number };
+    try {
+      result = await listAdminUsers(api, query);
+    } catch {
+      if (request !== latestRequest) return;
+      loading = false;
+      return void toast.error(i18n.t.users.loadFailed);
+    }
     if (request !== latestRequest) return;
     loading = false;
-    if (error) return void toast.error(i18n.t.users.loadFailed);
-    const rows = (res?.users ?? []) as Row[];
-    const count = res?.total ?? rows.length;
+    const rows = result.items;
+    const count = result.total;
     // An action can empty the last page; show the one before it instead.
     const lastPage = Math.max(Math.ceil(count / PAGE_SIZE), 1);
     if (rows.length === 0 && page > lastPage) {

package/dist/templates/modules/admin-dashboard/files/tests/api/admin-users.api.spec.ts

@@ -0,0 +1,86 @@
+import type { APIRequestContext, PlaywrightWorkerArgs } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
+import { ADMIN, USER } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+type UserItem = {
+  id: string;
+  email: string;
+  role: string | null;
+  banned: boolean;
+  signupApproved: boolean;
+  [key: string]: unknown;
+};
+type UserPage = { items: UserItem[]; total: number };
+
+async function signedIn(
+  playwright: PlaywrightWorkerArgs["playwright"],
+  account: { email: string; password: string },
+): Promise<APIRequestContext> {
+  const context = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await context.post("/api/auth/sign-in/email", { data: account })).ok()).toBeTruthy();
+  return context;
+}
+
+async function list(admin: APIRequestContext, query: Record<string, string>): Promise<UserPage> {
+  const response = await admin.get(`/api/admin/users?${new URLSearchParams(query).toString()}`);
+  expect(response.status(), await response.text()).toBe(200);
+  return (await response.json()) as UserPage;
+}
+
+test("the admin user list combines role and status filters with a search", async ({
+  playwright,
+  disposableUsers,
+}) => {
+  const prefix = `users-filter-${Date.now()}`;
+  const ids = {
+    activeAdmin: await disposableUsers.create({ email: `${prefix}-a@example.com`, role: "admin" }),
+    bannedAdmin: await disposableUsers.create({ email: `${prefix}-b@example.com`, role: "admin" }),
+    activeUser: await disposableUsers.create({ email: `${prefix}-c@example.com` }),
+    pendingUser: await disposableUsers.create({ email: `${prefix}-d@example.com` }),
+  };
+  const admin = await signedIn(playwright, ADMIN);
+  try {
+    expect((await admin.post("/api/auth/admin/ban-user", { data: { userId: ids.bannedAdmin } })).ok())
+      .toBeTruthy();
+    expect((await admin.post("/api/auth/admin/update-user", {
+      data: { userId: ids.pendingUser, data: { signupApproved: false } },
+    })).ok()).toBeTruthy();
+
+    const matching = async (role: string, status: string): Promise<string[]> =>
+      (await list(admin, { search: prefix.toUpperCase(), role, status })).items.map((user) => user.id);
+    expect(await matching("admin", "active")).toEqual([ids.activeAdmin]);
+    expect(await matching("admin", "banned")).toEqual([ids.bannedAdmin]);
+    expect(await matching("user", "pending")).toEqual([ids.pendingUser]);
+    expect(await matching("user", "active")).toEqual([ids.activeUser]);
+
+    const all = await list(admin, { search: prefix, limit: "2", sortBy: "email", sortDirection: "asc" });
+    expect(all.total).toBe(4);
+    expect(all.items.map((user) => user.id)).toEqual([ids.activeAdmin, ids.bannedAdmin]);
+    const banned = all.items[1];
+    expect(banned?.banned).toBe(true);
+    expect(banned?.signupApproved).toBe(true);
+    expect(banned).not.toHaveProperty("password");
+  } finally {
+    await admin.dispose();
+  }
+});
+
+test("the admin user list is for administrators and validates its query", async ({ playwright }) => {
+  const anonymous = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const user = await signedIn(playwright, USER);
+  const admin = await signedIn(playwright, ADMIN);
+  try {
+    expect((await anonymous.get("/api/admin/users")).status()).toBe(401);
+    expect((await user.get("/api/admin/users")).status()).toBe(403);
+    for (const query of ["status=deleted", "sortBy=password", "limit=101"]) {
+      expect((await admin.get(`/api/admin/users?${query}`)).status(), query).toBe(400);
+    }
+  } finally {
+    await anonymous.dispose();
+    await user.dispose();
+    await admin.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -31,6 +31,7 @@ test("admin can enable Google OAuth from the DB and it applies without a restart
   });
   expect(put.ok()).toBeTruthy();
   const view = await put.json();
+  expect(view.social.google.enabled).toBe(true);
   expect(view.social.google.hasSecret).toBe(true);
   expect(view.social.google.clientId).toBe("dummy-google-client-id");
   expect("clientSecret" in view.social.google).toBe(false); // secret is never returned

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -291,7 +291,7 @@ test("a user can create, list and revoke a personal API key", async ({ playwrigh
   const body = (await (await ctx.get("/api/auth/api-key/list")).json()) as { apiKeys: Array<{ id: string; name: string | null }> };
   expect(body.apiKeys.some((k) => k.name === "ci")).toBeTruthy();
 
-  const del = await ctx.post("/api/auth/api-key/delete", { data: { keyId: body.apiKeys[0].id } });
+  const del = await ctx.post("/api/auth/api-key/delete", { data: { keyId: body.apiKeys[0]?.id } });
   expect(del.ok()).toBeTruthy();
   await ctx.dispose();
 });

package/dist/templates/modules/admin-dashboard/files/tests/helpers/disposable-users.ts

@@ -15,14 +15,17 @@ type CreateUserInput = {
   role?: string;
 };
 
+// UI specs pass the browser's create-user response; API specs pass a request response.
+type CreatedUserResponse = Pick<APIResponse, "ok" | "json">;
+
 export type DisposableUsers = {
   create(input: CreateUserInput): Promise<string>;
-  trackResponse(response: APIResponse): Promise<string>;
+  trackResponse(response: CreatedUserResponse): Promise<string>;
   track(userId: string): void;
   forget(userId: string): void;
 };
 
-async function readCreatedUserId(response: APIResponse): Promise<string> {
+async function readCreatedUserId(response: CreatedUserResponse): Promise<string> {
   expect(response.ok()).toBeTruthy();
   const body = (await response.json()) as { user?: { id?: unknown } };
   expect(typeof body.user?.id).toBe("string");

package/dist/templates/modules/admin-dashboard/files/tests/ui/data-table.ui.spec.ts

@@ -2,7 +2,7 @@ import { expect, test, type Response } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
 // Sorting via the shared DataTable. Users sorts on the server (manual mode
-// refetches through Better Auth listUsers), and the audit log asks the server
+// refetches GET /admin/users), and the audit log asks the server
 // for the other time order — both drive the same clickable headers + aria-sort.
 test("users table sorts by a column header (server)", async ({ page }) => {
   await ready(page, "/admin/users");
@@ -13,7 +13,7 @@ test("users table sorts by a column header (server)", async ({ page }) => {
   const firstName = (): Promise<string> => page.getByRole("row").nth(1).getByRole("cell").first().innerText();
   const sortedBy = (direction: string): Promise<Response> => page.waitForResponse((response) => {
     const url = new URL(response.url());
-    return url.pathname === "/api/auth/admin/list-users" &&
+    return url.pathname === "/api/admin/users" &&
       url.searchParams.get("sortBy") === "name" &&
       url.searchParams.get("sortDirection") === direction;
   });

package/dist/templates/modules/admin-dashboard/files/tests/ui/email-admin.ui.spec.ts

@@ -3,7 +3,6 @@ import { ready } from "../helpers/hydration";
 import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
-const origin = { origin: base };
 
 // Verification badges/actions are gated by the emailVerification capability. The
 // seeded suite runs with verification off, so assert the gating here (nothing

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -28,9 +28,7 @@ test("forgot password: request, open the emailed link, set a new password, sign
   await expect(page.getByText(/reset link is on its way/i)).toBeVisible();
 
   // Open the emailed link: the API validates it and redirects to the reset page.
-  await page.goto(await waitForLink(email));
-  await page.waitForLoadState("load");
-  await page.waitForTimeout(400);
+  await ready(page, await waitForLink(email));
   // `exact` because "Confirm new password" also contains "New password".
   await page.getByLabel("New password", { exact: true }).fill("Podokit3e-N3wStr0ng!pw");
   // A mismatch is refused, and the single-use token survives it: the same page

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { createHash, randomBytes } from "node:crypto";
+import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — the admin is the resource owner.
 const b64url = (b: Buffer): string => b.toString("base64url");
@@ -64,7 +65,8 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
     // The consent page renders (reached in a real browser navigation), and allowing
     // it sends the browser back to the client with an authorization code.
     await page.route(`${REDIRECT}**`, (route) => route.fulfill({ status: 200, body: "callback" }));
-    await page.goto(consentUrl);
+    // Wait for hydration: a click on the server-rendered button sends no consent.
+    await ready(page, consentUrl);
     const allow = page.getByRole("button", { name: "Allow" });
     await expect(allow).toBeVisible();
     const callback = page.waitForURL((url) => url.href.startsWith(REDIRECT));

package/dist/templates/modules/admin-dashboard/files/tests/ui/request-budget.ui.spec.ts

@@ -21,26 +21,25 @@ test("client navigation keeps the server checks without resending messages", asy
   await ready(page, "/admin");
   await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
 
-  const bodies: Promise<string>[] = [];
-  page.on("response", (response) => {
-    if (new URL(response.url()).pathname.endsWith("/__data.json")) bodies.push(response.text());
-  });
   const sidebar = page.locator('[data-sidebar="sidebar"]');
-  const stops: Array<[link: string, heading: string]> = [
-    ["Users", "Users"],
-    ["Sessions", "User sessions"],
-    ["Settings", "Settings"],
-    ["Overview", "Dashboard"],
+  const stops: Array<[link: string, path: string, heading: string]> = [
+    ["Users", "/admin/users", "Users"],
+    ["Sessions", "/admin/sessions", "User sessions"],
+    ["Settings", "/admin/settings", "Settings"],
+    ["Overview", "/admin", "Dashboard"],
   ];
-  for (const [link, heading] of stops) {
+  for (const [link, path, heading] of stops) {
+    // Read each body before the next click: once the page navigates on, the
+    // previous response body is no longer available.
+    const data = page.waitForResponse(
+      (response) => new URL(response.url()).pathname === `${path}/__data.json`,
+    );
     await sidebar.getByRole("link", { name: link, exact: true }).click();
-    await expect(page.getByRole("heading", { name: heading, exact: true })).toBeVisible();
-  }
-
-  expect(bodies.length).toBeGreaterThanOrEqual(stops.length);
-  for (const body of await Promise.all(bodies)) {
+    const body = await (await data).text();
     expect(body).not.toContain('"messages"');
     expect(body.length).toBeLessThan(20_000);
+    await expect(page.getByRole("heading", { name: heading, exact: true })).toBeVisible();
   }
+
   await expect(sidebar.getByRole("link", { name: "Back to home" })).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/table-toolbar.ui.spec.ts

@@ -20,31 +20,36 @@ test("users toolbar applies filter + search together on Search", async ({ page }
   // Selecting a filter stages it; nothing applies until Search is pressed.
   const filtered = page.waitForResponse((response) => {
     const url = new URL(response.url());
-    return url.pathname === "/api/auth/admin/list-users" && url.searchParams.get("filterField") === "role";
+    return url.pathname === "/api/admin/users" && url.searchParams.get("role") === "admin";
   });
   await page.getByRole("button", { name: "Search", exact: true }).click();
-  expect(new URL((await filtered).url()).searchParams.get("filterValue")).toBe("admin");
+  expect((await filtered).ok()).toBeTruthy();
   await expect(main.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
   await expect(main.getByRole("cell", { name: "user@example.com" })).toHaveCount(0);
 });
 
-test("users toolbar keeps one filter because the server accepts one", async ({ page }) => {
+test("users toolbar combines the role and status filters", async ({ page }) => {
   await ready(page, "/admin/users");
+  const main = page.getByRole("main");
   const roleSelect = page.locator('button[data-slot="select-trigger"]').first();
   const statusSelect = page.locator('button[data-slot="select-trigger"]').nth(1);
   await roleSelect.click();
   await page.getByRole("option", { name: "Admin", exact: true }).click();
   await statusSelect.click();
-  await page.getByRole("option", { name: "Banned", exact: true }).click();
-  await expect(roleSelect).toContainText("All");
-  await expect(statusSelect).toContainText("Banned");
+  await page.getByRole("option", { name: "Active", exact: true }).click();
+  await expect(roleSelect).toContainText("Admin");
+  await expect(statusSelect).toContainText("Active");
 
   const filtered = page.waitForResponse((response) => {
     const url = new URL(response.url());
-    return url.pathname === "/api/auth/admin/list-users" && url.searchParams.get("filterField") === "banned";
+    return url.pathname === "/api/admin/users" &&
+      url.searchParams.get("role") === "admin" &&
+      url.searchParams.get("status") === "active";
   });
   await page.getByRole("button", { name: "Search", exact: true }).click();
-  expect(new URL((await filtered).url()).searchParams.get("filterValue")).toBe("true");
+  expect((await filtered).ok()).toBeTruthy();
+  await expect(main.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
+  await expect(main.getByRole("cell", { name: "user@example.com" })).toHaveCount(0);
 });
 
 test("users toolbar can pick the search field", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/users-crud.ui.spec.ts

@@ -140,7 +140,7 @@ test("users list shows pagination beyond one page", async ({ page, disposableUse
   await expect(nav).toBeVisible();
   const secondPage = page.waitForResponse((response) => {
     const url = new URL(response.url());
-    return url.pathname === "/api/auth/admin/list-users" && url.searchParams.get("offset") === "15";
+    return url.pathname === "/api/admin/users" && url.searchParams.get("offset") === "15";
   });
   await nav.getByRole("button", { name: "Page 2", exact: true }).first().click();
   expect((await secondPage).ok()).toBeTruthy();

package/dist/templates/modules/admin-dashboard/files/tests/ui/users.ui.spec.ts

@@ -44,7 +44,9 @@ test("admin sees the user list and can search", async ({ page }) => {
 });
 
 test("the user list asks the server for one page at a time", async ({ page }) => {
-  const isListUsers = (url: string): boolean => new URL(url).pathname === "/api/auth/admin/list-users";
+  const isListUsers = (url: string): boolean => new URL(url).pathname === "/api/admin/users";
+  const requested: string[] = [];
+  page.on("request", (request) => requested.push(request.url()));
   const first = page.waitForResponse((response) => isListUsers(response.url()));
   await ready(page, "/admin/users");
   const initial = new URL((await first).url()).searchParams;
@@ -53,14 +55,16 @@ test("the user list asks the server for one page at a time", async ({ page }) =>
   expect(initial.get("sortDirection")).toBe("desc");
   await expect(page.getByRole("columnheader", { name: "Joined" })).toHaveAttribute("aria-sort", "descending");
 
+  // The server matches case-insensitively, so the search goes as typed.
   const searched = page.waitForResponse((response) => isListUsers(response.url()));
   await page.locator("#toolbar-search").fill("Admin@Example.com");
   await page.getByRole("button", { name: "Search", exact: true }).click();
   const query = new URL((await searched).url()).searchParams;
-  expect(query.get("searchValue")).toBe("admin@example.com");
+  expect(query.get("search")).toBe("Admin@Example.com");
   expect(query.get("searchField")).toBe("email");
   expect(query.get("offset")).toBe("0");
   await expect(page.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
+  expect(requested.filter((url) => url.includes("/api/auth/admin/list-users"))).toEqual([]);
 });
 
 test("user list shows the joined column", async ({ page }) => {
@@ -69,9 +73,16 @@ test("user list shows the joined column", async ({ page }) => {
 });
 
 test("row menu exposes admin actions", async ({ page }) => {
-  await page.goto("/admin/users");
+  // The list shows one server page, so the search must run before the row exists.
+  await ready(page, "/admin/users");
+  const searched = page.waitForResponse((response) => {
+    const url = new URL(response.url());
+    return url.pathname === "/api/admin/users" &&
+      url.searchParams.get("search") === "user@example.com";
+  });
   await page.locator("#toolbar-search").fill("user@example.com");
   await page.getByRole("button", { name: "Search", exact: true }).click();
+  expect((await searched).ok()).toBeTruthy();
   const row = page.getByRole("row", { name: /user@example.com/ });
   await row.getByRole("button").click();
   await expect(page.getByRole("menuitem", { name: "Manage" })).toBeVisible();

package/dist/templates/modules/admin-dashboard/module.manifest.json

@@ -13,7 +13,8 @@
   },
   "ownedGlobs": [
     "apps/web/src/lib/i18n/locales/**",
-    "apps/web/src/lib/i18n/catalogs/app/**"
+    "apps/web/src/lib/i18n/catalogs/app/**",
+    "apps/web/src/lib/server/public-paths.ts"
   ],
   "managedOverrides": [
     "apps/web/src/lib/components/ui/input/input.svelte",
@@ -117,7 +118,7 @@
       "file": "AGENTS.md",
       "marker": "<!-- podokit:end:agents-modules -->",
       "optional": true,
-      "text": "### admin-dashboard\n- The `(admin)` route group and `admin-sidebar.svelte` are the admin-console shell for `/admin/*` only. Put signed-in product pages in `(app)` or in a separate route group with its own layout; do not place them under `(admin)`.\n- Admin console lives at `/admin/*` (users, sessions, organizations, audit, settings, account). Set `ADMIN_EMAILS`, then create or verify the initial account with `{{apiRun}} admin:bootstrap{{apiWorkspaceArg}}`; never commit or persist `ADMIN_BOOTSTRAP_PASSWORD`. When sign-up approval is enabled, self-registered users stay pending until an administrator approves them on `/admin/users`; administrator-created users bypass the queue.\n- Signed-in users can upload, replace, or remove their profile image from `/account` or `/admin/account`. Keep the shared policy visible in custom account UI: PNG, JPEG, or WebP; at most 2 MB and 2048 by 2048 pixels. Use the managed `/api/account/profile-image` endpoints instead of writing directly to storage or `user.image`.\n- `sidebar-user-menu.svelte` is specific to the admin sidebar. For a product shell outside `Sidebar.Provider`, use the managed `<AccountMenu {user} variant=\"identity\" side=\"top\" />` component.\n- Custom protected server layouts must call `requireBackendAvailable(locals)` from `#lib/server/guards.js` before redirecting anonymous users. This preserves sessions and returns 503 when authentication or maintenance policy cannot be checked.\n- **Every list/table MUST use the shared `#lib/components/data-table.svelte` (`DataTable`)** \u2014 it gives sortable headers + a footer pagination. Add search/filters with `#lib/components/table-toolbar.svelte`. Never assemble `Table.Root`/`Table.Header`/`Table.Body` by hand. For responsive columns, use `hideBelow` and apply the row context's `cellClass(columnKey)` to the matching cell.\n"
+      "text": "### admin-dashboard\n- The `(admin)` route group and `admin-sidebar.svelte` are the admin-console shell for `/admin/*` only. Put signed-in product pages in `(app)` or in a separate route group with its own layout; do not place them under `(admin)`.\n- Admin console lives at `/admin/*` (users, sessions, organizations, audit, settings, account). Set `ADMIN_EMAILS`, then create or verify the initial account with `{{apiRun}} admin:bootstrap{{apiWorkspaceArg}}`; never commit or persist `ADMIN_BOOTSTRAP_PASSWORD`. When sign-up approval is enabled, self-registered users stay pending until an administrator approves them on `/admin/users`; administrator-created users bypass the queue.\n- Signed-in users can upload, replace, or remove their profile image from `/account` or `/admin/account`. Keep the shared policy visible in custom account UI: PNG, JPEG, or WebP; at most 2 MB and 2048 by 2048 pixels. Use the managed `/api/account/profile-image` endpoints instead of writing directly to storage or `user.image`.\n- `sidebar-user-menu.svelte` is specific to the admin sidebar. For a product shell outside `Sidebar.Provider`, use the managed `<AccountMenu {user} variant=\"identity\" side=\"top\" />` component.\n- Custom protected server layouts must call `requireBackendAvailable(locals)` from `#lib/server/guards.js` before redirecting anonymous users. This preserves sessions and returns 503 when authentication or maintenance policy cannot be checked.\n- Every page except the sign-in flow, `/`, and module pages requires a session, and fails closed with 503 when the API or site settings are unavailable. List the application's public pages (marketing, pricing, legal, `robots.txt`) in `APP_PUBLIC_PATHS` in the app-owned `apps/web/src/lib/server/public-paths.ts`; a prefix covers its subpaths. Do not edit the `PUBLIC_PATHS` list in the managed `guards.ts`.\n- **Every list/table MUST use the shared `#lib/components/data-table.svelte` (`DataTable`)** \u2014 it gives sortable headers + a footer pagination. Add search/filters with `#lib/components/table-toolbar.svelte`. Never assemble `Table.Root`/`Table.Header`/`Table.Body` by hand. For responsive columns, use `hideBelow` and apply the row context's `cellClass(columnKey)` to the matching cell.\n"
     },
     {
       "file": "apps/api/src/app.ts",