@podosoft/podokit 1.2.0 → 1.4.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/runtime-context.ts

@@ -0,0 +1,107 @@
+import { APP_ASSET_PATHS } from "./asset-paths";
+
+/** The request fields that decide whether a response can use the session and site settings. */
+export interface RuntimeContextRequest {
+  url: URL;
+  route: { id: string | null };
+  request: Request;
+  isDataRequest: boolean;
+  isRemoteRequest: boolean;
+}
+
+// Fetch destinations that SvelteKit answers with a plain-text 404, without the
+// root layout, when no route matches.
+const SUBRESOURCE_DESTINATIONS = new Set([
+  "audio",
+  "audioworklet",
+  "font",
+  "image",
+  "json",
+  "manifest",
+  "paintworklet",
+  "report",
+  "script",
+  "serviceworker",
+  "sharedworker",
+  "style",
+  "track",
+  "video",
+  "webidentity",
+  "worker",
+  "xslt",
+]);
+
+function underPrefix(pathname: string, prefix: string): boolean {
+  return pathname === prefix || (prefix !== "/" && pathname.startsWith(`${prefix}/`));
+}
+
+/**
+ * True when an Accept header ranks HTML ahead of the wildcard. This mirrors how
+ * SvelteKit chooses between a page and an endpoint on the same route.
+ */
+export function prefersHtml(accept: string | null): boolean {
+  const ranges = (accept ?? "*/*")
+    .split(",")
+    .map((part, index) => {
+      const [range = "", ...params] = part.trim().toLowerCase().split(";");
+      const quality = params.map((param) => param.trim()).find((param) => param.startsWith("q="));
+      return { range: range.trim(), q: quality ? Number(quality.slice(2)) : 1, index };
+    })
+    .filter(({ range, q }) => range.includes("/") && q > 0)
+    .sort((a, b) => b.q - a.q || specificity(b.range) - specificity(a.range) || a.index - b.index);
+  const html = ranges.findIndex(({ range }) => range === "text/html" || range === "text/*");
+  const wildcard = ranges.findIndex(({ range }) => range === "*/*");
+  return html !== -1 && (wildcard === -1 || html < wildcard);
+}
+
+function specificity(range: string): number {
+  if (range === "*/*") return 0;
+  return range.endsWith("/*") ? 1 : 2;
+}
+
+/** Which files the matched route has, from `routes` in `$app/manifest`. */
+export interface RouteFiles {
+  page: boolean;
+  endpoint: boolean;
+}
+
+/** True when SvelteKit answers the request with the route's `+page` rather than its `+server`. */
+function answeredByPage(event: RuntimeContextRequest, route: RouteFiles | undefined): boolean {
+  if (route && !route.page) return false;
+  if (route && !route.endpoint) return true;
+  if (event.isDataRequest) return true;
+  const { headers, method } = event.request;
+  if (method !== "GET" && method !== "HEAD" && method !== "POST") return false;
+  if (method === "POST" && headers.get("x-sveltekit-action") === "true") return true;
+  return prefersHtml(headers.get("accept"));
+}
+
+/**
+ * Decide whether hooks.server.ts must load the session and the site settings
+ * before SvelteKit answers the request. It skips them only when the response
+ * cannot render a layout, or when the application listed the path in
+ * APP_ASSET_PATHS and a `+server` endpoint, not a `+page`, answers it.
+ */
+export function needsRuntimeContext(
+  event: RuntimeContextRequest,
+  options: { building?: boolean; route?: RouteFiles } = {},
+): boolean {
+  // Prerendering runs at build time without the API, and the stored HTML must
+  // not depend on one visitor's session or on runtime site settings.
+  if (options.building) return false;
+  const { pathname } = event.url;
+  // The backend proxy forwards the cookies; the API resolves the session itself.
+  if (underPrefix(pathname, "/api")) return false;
+  // Remote functions run application code that may read the session.
+  if (event.isRemoteRequest) return true;
+  if (event.route.id === null) {
+    // SvelteKit renders its 404 page with the root layout, which redirects or
+    // greets the visitor, unless the browser fetched a subresource.
+    const destination = event.request.headers.get("sec-fetch-dest") ?? "";
+    return !SUBRESOURCE_DESTINATIONS.has(destination);
+  }
+  if (APP_ASSET_PATHS.some((prefix) => underPrefix(pathname, prefix))) {
+    return answeredByPage(event, options.route);
+  }
+  return true;
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(admin)/admin/users/+page.svelte

@@ -17,7 +17,7 @@
   import { toast } from "svelte-sonner";
   import { api } from "#lib/api.js";
   import { listAdminSessions, revokeAdminSession, type AdminSession } from "#lib/admin/sessions.js";
-  import { DEFAULT_USER_SORT, keepLatestFilter, listUsersQuery } from "#lib/admin/users.js";
+  import { DEFAULT_USER_SORT, adminUsersQuery, listAdminUsers } from "#lib/admin/users.js";
   import { getI18n, fmt, formatDateTime } from "#lib/i18n/index.js";
   import { cn } from "#lib/utils.js";
   import { deviceLabel } from "#lib/device-label.js";
@@ -64,19 +64,6 @@
   let appliedSearchField = $state("email");
   let filterValues = $state<Record<string, string>>({ role: "", status: "" });
   let appliedFilters = $state<Record<string, string>>({ role: "", status: "" });
-  let stagedFilters = { role: "", status: "" };
-
-  // The list endpoint takes a single filter, so picking a role clears the status
-  // and vice versa (see keepLatestFilter).
-  $effect(() => {
-    const next = keepLatestFilter(stagedFilters, {
-      role: filterValues.role ?? "",
-      status: filterValues.status ?? "",
-    });
-    stagedFilters = next;
-    if (filterValues.role !== next.role) filterValues.role = next.role;
-    if (filterValues.status !== next.status) filterValues.status = next.status;
-  });
 
   const columns = $derived<DataTableColumn<Row>[]>([
     { key: "name", label: i18n.t.users.name, sortable: true },
@@ -103,6 +90,7 @@
       label: i18n.t.users.status,
       options: [
         { value: "", label: i18n.t.toolbar.all },
+        { value: "active", label: i18n.t.users.active },
         { value: "pending", label: i18n.t.users.pendingApproval },
         { value: "banned", label: i18n.t.users.banned },
       ],
@@ -118,7 +106,7 @@
     const request = ++latestRequest;
     const sortKey = sort ? `${sort.key}:${sort.dir}` : "";
     if (sortKey !== loadedSortKey) page = 1;
-    const query = listUsersQuery({
+    const query = adminUsersQuery({
       page,
       perPage: PAGE_SIZE,
       sort,
@@ -128,12 +116,18 @@
       status: appliedFilters.status ?? "",
     });
     loading = true;
-    const { data: res, error } = await api.auth.admin.listUsers({ query });
+    let result: { items: Row[]; total: number };
+    try {
+      result = await listAdminUsers(api, query);
+    } catch {
+      if (request !== latestRequest) return;
+      loading = false;
+      return void toast.error(i18n.t.users.loadFailed);
+    }
     if (request !== latestRequest) return;
     loading = false;
-    if (error) return void toast.error(i18n.t.users.loadFailed);
-    const rows = (res?.users ?? []) as Row[];
-    const count = res?.total ?? rows.length;
+    const rows = result.items;
+    const count = result.total;
     // An action can empty the last page; show the one before it instead.
     const lastPage = Math.max(Math.ceil(count / PAGE_SIZE), 1);
     if (rows.length === 0 && page > lastPage) {

package/dist/templates/modules/admin-dashboard/files/tests/api/admin-users.api.spec.ts

@@ -0,0 +1,86 @@
+import type { APIRequestContext, PlaywrightWorkerArgs } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
+import { ADMIN, USER } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+type UserItem = {
+  id: string;
+  email: string;
+  role: string | null;
+  banned: boolean;
+  signupApproved: boolean;
+  [key: string]: unknown;
+};
+type UserPage = { items: UserItem[]; total: number };
+
+async function signedIn(
+  playwright: PlaywrightWorkerArgs["playwright"],
+  account: { email: string; password: string },
+): Promise<APIRequestContext> {
+  const context = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await context.post("/api/auth/sign-in/email", { data: account })).ok()).toBeTruthy();
+  return context;
+}
+
+async function list(admin: APIRequestContext, query: Record<string, string>): Promise<UserPage> {
+  const response = await admin.get(`/api/admin/users?${new URLSearchParams(query).toString()}`);
+  expect(response.status(), await response.text()).toBe(200);
+  return (await response.json()) as UserPage;
+}
+
+test("the admin user list combines role and status filters with a search", async ({
+  playwright,
+  disposableUsers,
+}) => {
+  const prefix = `users-filter-${Date.now()}`;
+  const ids = {
+    activeAdmin: await disposableUsers.create({ email: `${prefix}-a@example.com`, role: "admin" }),
+    bannedAdmin: await disposableUsers.create({ email: `${prefix}-b@example.com`, role: "admin" }),
+    activeUser: await disposableUsers.create({ email: `${prefix}-c@example.com` }),
+    pendingUser: await disposableUsers.create({ email: `${prefix}-d@example.com` }),
+  };
+  const admin = await signedIn(playwright, ADMIN);
+  try {
+    expect((await admin.post("/api/auth/admin/ban-user", { data: { userId: ids.bannedAdmin } })).ok())
+      .toBeTruthy();
+    expect((await admin.post("/api/auth/admin/update-user", {
+      data: { userId: ids.pendingUser, data: { signupApproved: false } },
+    })).ok()).toBeTruthy();
+
+    const matching = async (role: string, status: string): Promise<string[]> =>
+      (await list(admin, { search: prefix.toUpperCase(), role, status })).items.map((user) => user.id);
+    expect(await matching("admin", "active")).toEqual([ids.activeAdmin]);
+    expect(await matching("admin", "banned")).toEqual([ids.bannedAdmin]);
+    expect(await matching("user", "pending")).toEqual([ids.pendingUser]);
+    expect(await matching("user", "active")).toEqual([ids.activeUser]);
+
+    const all = await list(admin, { search: prefix, limit: "2", sortBy: "email", sortDirection: "asc" });
+    expect(all.total).toBe(4);
+    expect(all.items.map((user) => user.id)).toEqual([ids.activeAdmin, ids.bannedAdmin]);
+    const banned = all.items[1];
+    expect(banned?.banned).toBe(true);
+    expect(banned?.signupApproved).toBe(true);
+    expect(banned).not.toHaveProperty("password");
+  } finally {
+    await admin.dispose();
+  }
+});
+
+test("the admin user list is for administrators and validates its query", async ({ playwright }) => {
+  const anonymous = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const user = await signedIn(playwright, USER);
+  const admin = await signedIn(playwright, ADMIN);
+  try {
+    expect((await anonymous.get("/api/admin/users")).status()).toBe(401);
+    expect((await user.get("/api/admin/users")).status()).toBe(403);
+    for (const query of ["status=deleted", "sortBy=password", "limit=101"]) {
+      expect((await admin.get(`/api/admin/users?${query}`)).status(), query).toBe(400);
+    }
+  } finally {
+    await anonymous.dispose();
+    await user.dispose();
+    await admin.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -31,6 +31,7 @@ test("admin can enable Google OAuth from the DB and it applies without a restart
   });
   expect(put.ok()).toBeTruthy();
   const view = await put.json();
+  expect(view.social.google.enabled).toBe(true);
   expect(view.social.google.hasSecret).toBe(true);
   expect(view.social.google.clientId).toBe("dummy-google-client-id");
   expect("clientSecret" in view.social.google).toBe(false); // secret is never returned

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -291,7 +291,7 @@ test("a user can create, list and revoke a personal API key", async ({ playwrigh
   const body = (await (await ctx.get("/api/auth/api-key/list")).json()) as { apiKeys: Array<{ id: string; name: string | null }> };
   expect(body.apiKeys.some((k) => k.name === "ci")).toBeTruthy();
 
-  const del = await ctx.post("/api/auth/api-key/delete", { data: { keyId: body.apiKeys[0].id } });
+  const del = await ctx.post("/api/auth/api-key/delete", { data: { keyId: body.apiKeys[0]?.id } });
   expect(del.ok()).toBeTruthy();
   await ctx.dispose();
 });

package/dist/templates/modules/admin-dashboard/files/tests/api/profile-image.api.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN } from "../helpers/accounts";
+import { expectObjectLength } from "../helpers/object-response";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -48,7 +49,7 @@ test("profile image upload, replacement, public read, and removal", async ({ pla
   expect(firstImage.ok()).toBeTruthy();
   expect(firstImage.headers()["content-type"]).toContain("image/png");
   expect(firstImage.headers()["cache-control"]).toBe("public, max-age=31536000, immutable");
-  expect(firstImage.headers()["content-length"]).toBe(String(PNG.byteLength));
+  expectObjectLength(firstImage.headers(), PNG.byteLength);
   expect((await firstImage.body()).equals(PNG)).toBe(true);
   const etag = firstImage.headers()["etag"];
   expect(etag).toMatch(/^"[^"]+"$/);

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN } from "../helpers/accounts";
+import { expectObjectLength } from "../helpers/object-response";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -101,7 +102,7 @@ test("site favicon: the versioned URL is cached for good and other URLs revalida
     expect(current.status()).toBe(200);
     expect(current.headers()["cache-control"]).toBe(IMMUTABLE);
     expect(current.headers()["content-type"]).toContain("image/png");
-    expect(current.headers()["content-length"]).toBe(String(ICON.byteLength));
+    expectObjectLength(current.headers(), ICON.byteLength);
     expect((await current.body()).equals(ICON)).toBe(true);
     const etag = current.headers()["etag"] ?? "";
     expect(etag).toMatch(/^"[^"]+"$/);

package/dist/templates/modules/admin-dashboard/files/tests/helpers/disposable-users.ts

@@ -15,14 +15,17 @@ type CreateUserInput = {
   role?: string;
 };
 
+// UI specs pass the browser's create-user response; API specs pass a request response.
+type CreatedUserResponse = Pick<APIResponse, "ok" | "json">;
+
 export type DisposableUsers = {
   create(input: CreateUserInput): Promise<string>;
-  trackResponse(response: APIResponse): Promise<string>;
+  trackResponse(response: CreatedUserResponse): Promise<string>;
   track(userId: string): void;
   forget(userId: string): void;
 };
 
-async function readCreatedUserId(response: APIResponse): Promise<string> {
+async function readCreatedUserId(response: CreatedUserResponse): Promise<string> {
   expect(response.ok()).toBeTruthy();
   const body = (await response.json()) as { user?: { id?: unknown } };
   expect(typeof body.user?.id).toBe("string");
@@ -32,16 +35,16 @@ async function readCreatedUserId(response: APIResponse): Promise<string> {
 export const test = base.extend<{ disposableUsers: DisposableUsers }>({
   disposableUsers: async ({ context, playwright }, use, testInfo) => {
     // API projects do not inherit the UI project's admin storageState, while a
-    // second admin sign-in can invalidate the shared UI session. Authenticate an
-    // isolated request context only for API tests and reuse browser cookies for UI.
-    let request = context.request;
-    let ownsRequest = false;
+    // second admin sign-in can invalidate the shared UI session. API tests sign in
+    // an isolated request context. UI tests copy the browser's admin cookies into
+    // their own context once, so a test that later signs its page in as another
+    // user does not turn cleanup into that user's (forbidden) requests.
+    const request = await playwright.request.newContext({
+      baseURL,
+      extraHTTPHeaders: origin,
+      ...(testInfo.project.name === "api" ? {} : { storageState: await context.storageState() }),
+    });
     if (testInfo.project.name === "api") {
-      request = await playwright.request.newContext({
-        baseURL,
-        extraHTTPHeaders: origin,
-      });
-      ownsRequest = true;
       const signIn = await request.post("/api/auth/sign-in/email", {
         data: { email: ADMIN.email, password: ADMIN.password },
       });
@@ -91,7 +94,7 @@ export const test = base.extend<{ disposableUsers: DisposableUsers }>({
           }
         }
       } finally {
-        if (ownsRequest) await request.dispose();
+        await request.dispose();
       }
     }
   },

package/dist/templates/modules/admin-dashboard/files/tests/helpers/object-response.ts

@@ -0,0 +1,12 @@
+import { expect } from "@playwright/test";
+
+// IN_MEMORY_READ_BYTES of @podosoft/podokit-runtime. Both object storage
+// providers and the web proxy keep the Content-Length of objects up to this
+// size; Bun may send larger ones chunked.
+const IN_MEMORY_READ_BYTES = 2 * 1024 * 1024;
+
+export function expectObjectLength(headers: Record<string, string>, size: number): void {
+  const length = headers["content-length"];
+  if (length === undefined && size > IN_MEMORY_READ_BYTES) return;
+  expect(length).toBe(String(size));
+}

package/dist/templates/modules/admin-dashboard/files/tests/ui/data-table.ui.spec.ts

@@ -2,7 +2,7 @@ import { expect, test, type Response } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
 // Sorting via the shared DataTable. Users sorts on the server (manual mode
-// refetches through Better Auth listUsers), and the audit log asks the server
+// refetches GET /admin/users), and the audit log asks the server
 // for the other time order — both drive the same clickable headers + aria-sort.
 test("users table sorts by a column header (server)", async ({ page }) => {
   await ready(page, "/admin/users");
@@ -13,7 +13,7 @@ test("users table sorts by a column header (server)", async ({ page }) => {
   const firstName = (): Promise<string> => page.getByRole("row").nth(1).getByRole("cell").first().innerText();
   const sortedBy = (direction: string): Promise<Response> => page.waitForResponse((response) => {
     const url = new URL(response.url());
-    return url.pathname === "/api/auth/admin/list-users" &&
+    return url.pathname === "/api/admin/users" &&
       url.searchParams.get("sortBy") === "name" &&
       url.searchParams.get("sortDirection") === direction;
   });

package/dist/templates/modules/admin-dashboard/files/tests/ui/email-admin.ui.spec.ts

@@ -3,7 +3,6 @@ import { ready } from "../helpers/hydration";
 import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
-const origin = { origin: base };
 
 // Verification badges/actions are gated by the emailVerification capability. The
 // seeded suite runs with verification off, so assert the gating here (nothing

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -28,9 +28,7 @@ test("forgot password: request, open the emailed link, set a new password, sign
   await expect(page.getByText(/reset link is on its way/i)).toBeVisible();
 
   // Open the emailed link: the API validates it and redirects to the reset page.
-  await page.goto(await waitForLink(email));
-  await page.waitForLoadState("load");
-  await page.waitForTimeout(400);
+  await ready(page, await waitForLink(email));
   // `exact` because "Confirm new password" also contains "New password".
   await page.getByLabel("New password", { exact: true }).fill("Podokit3e-N3wStr0ng!pw");
   // A mismatch is refused, and the single-use token survives it: the same page

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { createHash, randomBytes } from "node:crypto";
+import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — the admin is the resource owner.
 const b64url = (b: Buffer): string => b.toString("base64url");
@@ -64,7 +65,8 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
     // The consent page renders (reached in a real browser navigation), and allowing
     // it sends the browser back to the client with an authorization code.
     await page.route(`${REDIRECT}**`, (route) => route.fulfill({ status: 200, body: "callback" }));
-    await page.goto(consentUrl);
+    // Wait for hydration: a click on the server-rendered button sends no consent.
+    await ready(page, consentUrl);
     const allow = page.getByRole("button", { name: "Allow" });
     await expect(allow).toBeVisible();
     const callback = page.waitForURL((url) => url.href.startsWith(REDIRECT));

package/dist/templates/modules/admin-dashboard/files/tests/ui/request-budget.ui.spec.ts

@@ -21,26 +21,25 @@ test("client navigation keeps the server checks without resending messages", asy
   await ready(page, "/admin");
   await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
 
-  const bodies: Promise<string>[] = [];
-  page.on("response", (response) => {
-    if (new URL(response.url()).pathname.endsWith("/__data.json")) bodies.push(response.text());
-  });
   const sidebar = page.locator('[data-sidebar="sidebar"]');
-  const stops: Array<[link: string, heading: string]> = [
-    ["Users", "Users"],
-    ["Sessions", "User sessions"],
-    ["Settings", "Settings"],
-    ["Overview", "Dashboard"],
+  const stops: Array<[link: string, path: string, heading: string]> = [
+    ["Users", "/admin/users", "Users"],
+    ["Sessions", "/admin/sessions", "User sessions"],
+    ["Settings", "/admin/settings", "Settings"],
+    ["Overview", "/admin", "Dashboard"],
   ];
-  for (const [link, heading] of stops) {
+  for (const [link, path, heading] of stops) {
+    // Read each body before the next click: once the page navigates on, the
+    // previous response body is no longer available.
+    const data = page.waitForResponse(
+      (response) => new URL(response.url()).pathname === `${path}/__data.json`,
+    );
     await sidebar.getByRole("link", { name: link, exact: true }).click();
-    await expect(page.getByRole("heading", { name: heading, exact: true })).toBeVisible();
-  }
-
-  expect(bodies.length).toBeGreaterThanOrEqual(stops.length);
-  for (const body of await Promise.all(bodies)) {
+    const body = await (await data).text();
     expect(body).not.toContain('"messages"');
     expect(body.length).toBeLessThan(20_000);
+    await expect(page.getByRole("heading", { name: heading, exact: true })).toBeVisible();
   }
+
   await expect(sidebar.getByRole("link", { name: "Back to home" })).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/table-toolbar.ui.spec.ts

@@ -20,31 +20,36 @@ test("users toolbar applies filter + search together on Search", async ({ page }
   // Selecting a filter stages it; nothing applies until Search is pressed.
   const filtered = page.waitForResponse((response) => {
     const url = new URL(response.url());
-    return url.pathname === "/api/auth/admin/list-users" && url.searchParams.get("filterField") === "role";
+    return url.pathname === "/api/admin/users" && url.searchParams.get("role") === "admin";
   });
   await page.getByRole("button", { name: "Search", exact: true }).click();
-  expect(new URL((await filtered).url()).searchParams.get("filterValue")).toBe("admin");
+  expect((await filtered).ok()).toBeTruthy();
   await expect(main.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
   await expect(main.getByRole("cell", { name: "user@example.com" })).toHaveCount(0);
 });
 
-test("users toolbar keeps one filter because the server accepts one", async ({ page }) => {
+test("users toolbar combines the role and status filters", async ({ page }) => {
   await ready(page, "/admin/users");
+  const main = page.getByRole("main");
   const roleSelect = page.locator('button[data-slot="select-trigger"]').first();
   const statusSelect = page.locator('button[data-slot="select-trigger"]').nth(1);
   await roleSelect.click();
   await page.getByRole("option", { name: "Admin", exact: true }).click();
   await statusSelect.click();
-  await page.getByRole("option", { name: "Banned", exact: true }).click();
-  await expect(roleSelect).toContainText("All");
-  await expect(statusSelect).toContainText("Banned");
+  await page.getByRole("option", { name: "Active", exact: true }).click();
+  await expect(roleSelect).toContainText("Admin");
+  await expect(statusSelect).toContainText("Active");
 
   const filtered = page.waitForResponse((response) => {
     const url = new URL(response.url());
-    return url.pathname === "/api/auth/admin/list-users" && url.searchParams.get("filterField") === "banned";
+    return url.pathname === "/api/admin/users" &&
+      url.searchParams.get("role") === "admin" &&
+      url.searchParams.get("status") === "active";
   });
   await page.getByRole("button", { name: "Search", exact: true }).click();
-  expect(new URL((await filtered).url()).searchParams.get("filterValue")).toBe("true");
+  expect((await filtered).ok()).toBeTruthy();
+  await expect(main.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
+  await expect(main.getByRole("cell", { name: "user@example.com" })).toHaveCount(0);
 });
 
 test("users toolbar can pick the search field", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/users-crud.ui.spec.ts

@@ -140,7 +140,7 @@ test("users list shows pagination beyond one page", async ({ page, disposableUse
   await expect(nav).toBeVisible();
   const secondPage = page.waitForResponse((response) => {
     const url = new URL(response.url());
-    return url.pathname === "/api/auth/admin/list-users" && url.searchParams.get("offset") === "15";
+    return url.pathname === "/api/admin/users" && url.searchParams.get("offset") === "15";
   });
   await nav.getByRole("button", { name: "Page 2", exact: true }).first().click();
   expect((await secondPage).ok()).toBeTruthy();

package/dist/templates/modules/admin-dashboard/files/tests/ui/users.ui.spec.ts

@@ -44,7 +44,9 @@ test("admin sees the user list and can search", async ({ page }) => {
 });
 
 test("the user list asks the server for one page at a time", async ({ page }) => {
-  const isListUsers = (url: string): boolean => new URL(url).pathname === "/api/auth/admin/list-users";
+  const isListUsers = (url: string): boolean => new URL(url).pathname === "/api/admin/users";
+  const requested: string[] = [];
+  page.on("request", (request) => requested.push(request.url()));
   const first = page.waitForResponse((response) => isListUsers(response.url()));
   await ready(page, "/admin/users");
   const initial = new URL((await first).url()).searchParams;
@@ -53,14 +55,16 @@ test("the user list asks the server for one page at a time", async ({ page }) =>
   expect(initial.get("sortDirection")).toBe("desc");
   await expect(page.getByRole("columnheader", { name: "Joined" })).toHaveAttribute("aria-sort", "descending");
 
+  // The server matches case-insensitively, so the search goes as typed.
   const searched = page.waitForResponse((response) => isListUsers(response.url()));
   await page.locator("#toolbar-search").fill("Admin@Example.com");
   await page.getByRole("button", { name: "Search", exact: true }).click();
   const query = new URL((await searched).url()).searchParams;
-  expect(query.get("searchValue")).toBe("admin@example.com");
+  expect(query.get("search")).toBe("Admin@Example.com");
   expect(query.get("searchField")).toBe("email");
   expect(query.get("offset")).toBe("0");
   await expect(page.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
+  expect(requested.filter((url) => url.includes("/api/auth/admin/list-users"))).toEqual([]);
 });
 
 test("user list shows the joined column", async ({ page }) => {
@@ -69,9 +73,16 @@ test("user list shows the joined column", async ({ page }) => {
 });
 
 test("row menu exposes admin actions", async ({ page }) => {
-  await page.goto("/admin/users");
+  // The list shows one server page, so the search must run before the row exists.
+  await ready(page, "/admin/users");
+  const searched = page.waitForResponse((response) => {
+    const url = new URL(response.url());
+    return url.pathname === "/api/admin/users" &&
+      url.searchParams.get("search") === "user@example.com";
+  });
   await page.locator("#toolbar-search").fill("user@example.com");
   await page.getByRole("button", { name: "Search", exact: true }).click();
+  expect((await searched).ok()).toBeTruthy();
   const row = page.getByRole("row", { name: /user@example.com/ });
   await row.getByRole("button").click();
   await expect(page.getByRole("menuitem", { name: "Manage" })).toBeVisible();

package/dist/templates/modules/admin-dashboard/module.manifest.json

@@ -13,7 +13,9 @@
   },
   "ownedGlobs": [
     "apps/web/src/lib/i18n/locales/**",
-    "apps/web/src/lib/i18n/catalogs/app/**"
+    "apps/web/src/lib/i18n/catalogs/app/**",
+    "apps/web/src/lib/server/public-paths.ts",
+    "apps/web/src/lib/server/asset-paths.ts"
   ],
   "managedOverrides": [
     "apps/web/src/lib/components/ui/input/input.svelte",
@@ -117,7 +119,7 @@
       "file": "AGENTS.md",
       "marker": "<!-- podokit:end:agents-modules -->",
       "optional": true,
-      "text": "### admin-dashboard\n- The `(admin)` route group and `admin-sidebar.svelte` are the admin-console shell for `/admin/*` only. Put signed-in product pages in `(app)` or in a separate route group with its own layout; do not place them under `(admin)`.\n- Admin console lives at `/admin/*` (users, sessions, organizations, audit, settings, account). Set `ADMIN_EMAILS`, then create or verify the initial account with `{{apiRun}} admin:bootstrap{{apiWorkspaceArg}}`; never commit or persist `ADMIN_BOOTSTRAP_PASSWORD`. When sign-up approval is enabled, self-registered users stay pending until an administrator approves them on `/admin/users`; administrator-created users bypass the queue.\n- Signed-in users can upload, replace, or remove their profile image from `/account` or `/admin/account`. Keep the shared policy visible in custom account UI: PNG, JPEG, or WebP; at most 2 MB and 2048 by 2048 pixels. Use the managed `/api/account/profile-image` endpoints instead of writing directly to storage or `user.image`.\n- `sidebar-user-menu.svelte` is specific to the admin sidebar. For a product shell outside `Sidebar.Provider`, use the managed `<AccountMenu {user} variant=\"identity\" side=\"top\" />` component.\n- Custom protected server layouts must call `requireBackendAvailable(locals)` from `#lib/server/guards.js` before redirecting anonymous users. This preserves sessions and returns 503 when authentication or maintenance policy cannot be checked.\n- **Every list/table MUST use the shared `#lib/components/data-table.svelte` (`DataTable`)** \u2014 it gives sortable headers + a footer pagination. Add search/filters with `#lib/components/table-toolbar.svelte`. Never assemble `Table.Root`/`Table.Header`/`Table.Body` by hand. For responsive columns, use `hideBelow` and apply the row context's `cellClass(columnKey)` to the matching cell.\n"
+      "text": "### admin-dashboard\n- The `(admin)` route group and `admin-sidebar.svelte` are the admin-console shell for `/admin/*` only. Put signed-in product pages in `(app)` or in a separate route group with its own layout; do not place them under `(admin)`.\n- Admin console lives at `/admin/*` (users, sessions, organizations, audit, settings, account). Set `ADMIN_EMAILS`, then create or verify the initial account with `{{apiRun}} admin:bootstrap{{apiWorkspaceArg}}`; never commit or persist `ADMIN_BOOTSTRAP_PASSWORD`. When sign-up approval is enabled, self-registered users stay pending until an administrator approves them on `/admin/users`; administrator-created users bypass the queue.\n- Signed-in users can upload, replace, or remove their profile image from `/account` or `/admin/account`. Keep the shared policy visible in custom account UI: PNG, JPEG, or WebP; at most 2 MB and 2048 by 2048 pixels. Use the managed `/api/account/profile-image` endpoints instead of writing directly to storage or `user.image`.\n- `sidebar-user-menu.svelte` is specific to the admin sidebar. For a product shell outside `Sidebar.Provider`, use the managed `<AccountMenu {user} variant=\"identity\" side=\"top\" />` component.\n- Custom protected server layouts must call `requireBackendAvailable(locals)` from `#lib/server/guards.js` before redirecting anonymous users. This preserves sessions and returns 503 when authentication or maintenance policy cannot be checked.\n- Every page except the sign-in flow, `/`, and module pages requires a session, and fails closed with 503 when the API or site settings are unavailable. List the application's public pages (marketing, pricing, legal, `robots.txt`) in `APP_PUBLIC_PATHS` in the app-owned `apps/web/src/lib/server/public-paths.ts`; a prefix covers its subpaths. Do not edit the `PUBLIC_PATHS` list in the managed `guards.ts`.\n- `hooks.server.ts` loads the site settings and the session for pages, page data, form actions, remote functions, and the 404 page. When a `+server.ts` endpoint serves files or feeds that need neither, list its prefix in `APP_ASSET_PATHS` in the app-owned `apps/web/src/lib/server/asset-paths.ts` to skip both API calls; such endpoints see an anonymous `locals.user`, and page requests under the prefix still get the full context.\n- **Every list/table MUST use the shared `#lib/components/data-table.svelte` (`DataTable`)** \u2014 it gives sortable headers + a footer pagination. Add search/filters with `#lib/components/table-toolbar.svelte`. Never assemble `Table.Root`/`Table.Header`/`Table.Body` by hand. For responsive columns, use `hideBelow` and apply the row context's `cellClass(columnKey)` to the matching cell.\n"
     },
     {
       "file": "apps/api/src/app.ts",