@podosoft/podokit 1.4.2 → 1.5.0

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.revoker.ts

@@ -1,13 +1,19 @@
 import { AppException } from "@podosoft/podokit-contracts";
 import { APIError } from "better-auth/api";
+import type { OwnSessionRevoker } from "../account-sessions/account-sessions.routes";
 import type { SessionRevoker } from "./admin-sessions.routes";
 
 export const ADMIN_SESSION_REVOKE_FAILED = "ADMIN_SESSION_REVOKE_FAILED";
+export const ACCOUNT_SESSION_REVOKE_FAILED = "ACCOUNT_SESSION_REVOKE_FAILED";
 
 export interface RevokeUserSessionApi {
   revokeUserSession(input: { body: { sessionToken: string }; headers: Headers }): Promise<unknown>;
 }
 
+export interface RevokeSessionApi {
+  revokeSession(input: { body: { token: string }; headers: Headers }): Promise<unknown>;
+}
+
 /**
  * Revokes through the Better Auth admin endpoint rather than deleting the row, so
  * its permission check and after-hooks (including the audit log) still run.
@@ -24,3 +30,21 @@ export function createSessionRevoker(api: () => RevokeUserSessionApi): SessionRe
     }
   };
 }
+
+/**
+ * Revokes one of the caller's own sessions through Better Auth's
+ * `/revoke-session`, so its ownership check and after-hooks (including the
+ * audit log's `session.revoke`) still run.
+ */
+export function createOwnSessionRevoker(api: () => RevokeSessionApi): OwnSessionRevoker {
+  return async (token, headers) => {
+    try {
+      await api().revokeSession({ body: { token }, headers });
+    } catch (error) {
+      if (error instanceof APIError) {
+        throw new AppException(ACCOUNT_SESSION_REVOKE_FAILED, error.message, error.statusCode);
+      }
+      throw error;
+    }
+  };
+}

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.service.spec.ts

@@ -183,5 +183,23 @@ describe("AdminSessionsService", () => {
 
     expect(await service.tokenOf("a")).toBe("token-a");
     expect(await service.tokenOf("missing")).toBeNull();
+    // With a user, only that user's session.
+    expect(await service.tokenOf("a", "alice")).toBe("token-a");
+    expect(await service.tokenOf("a", "bob")).toBeNull();
+  });
+
+  test("leaves one session out and finds an active session by id", async () => {
+    await seed(db, [
+      { id: "a", userId: "alice", createdAt: "2026-01-01T00:00:01.000Z" },
+      { id: "b", userId: "alice", createdAt: "2026-01-01T00:00:02.000Z" },
+      { id: "old", userId: "alice", createdAt: "2026-01-01T00:00:03.000Z", expiresAt: "2020-01-01T00:00:00.000Z" },
+    ]);
+
+    const page = await service.list({ userId: "alice", excludeId: "b" });
+    expect(page.items.map((item) => item.id)).toEqual(["a"]);
+    expect(page.total).toBe(1);
+    expect(await service.find("b")).toMatchObject({ id: "b", userId: "alice", ipAddress: "203.0.113.7" });
+    expect(await service.find("old")).toBeNull();
+    expect(await service.find("missing")).toBeNull();
   });
 });

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.service.ts

@@ -30,6 +30,8 @@ export interface AdminSessionQuery {
   cursor?: string;
   search?: string;
   userId?: string;
+  /** A session to leave out, such as the caller's own. */
+  excludeId?: string;
 }
 
 interface SessionRow {
@@ -76,6 +78,20 @@ function decodeCursor(value: string): Cursor {
   throw new AppException(ADMIN_SESSION_CURSOR_INVALID, "The sessions cursor is invalid.", 400);
 }
 
+function view(row: SessionRow): AdminSessionView {
+  return {
+    id: row.id,
+    userId: row.userId,
+    userEmail: row.userEmail,
+    userName: row.userName ?? "",
+    ipAddress: row.ipAddress,
+    userAgent: row.userAgent,
+    impersonatedBy: row.impersonatedBy,
+    createdAt: iso(row.createdAt),
+    expiresAt: iso(row.expiresAt),
+  };
+}
+
 function likePattern(search: string): string {
   return `%${search.replace(/[\\%_]/g, (character) => `\\${character}`)}%`;
 }
@@ -100,6 +116,7 @@ export class AdminSessionsService {
     const filters = (): SQL.Query<unknown> => this.sql`
       WHERE s."expiresAt" > ${now}
       ${query.userId ? this.sql`AND s."userId" = ${query.userId}` : this.sql``}
+      ${query.excludeId ? this.sql`AND s."id" <> ${query.excludeId}` : this.sql``}
       ${search ? this.searchFilter(likePattern(search)) : this.sql``}
     `;
     const [rows, totals] = await Promise.all([
@@ -127,17 +144,7 @@ export class AdminSessionsService {
     const page = rows.slice(0, limit);
     const last = page.at(-1);
     return {
-      items: page.map((row) => ({
-        id: row.id,
-        userId: row.userId,
-        userEmail: row.userEmail,
-        userName: row.userName ?? "",
-        ipAddress: row.ipAddress,
-        userAgent: row.userAgent,
-        impersonatedBy: row.impersonatedBy,
-        createdAt: iso(row.createdAt),
-        expiresAt: iso(row.expiresAt),
-      })),
+      items: page.map(view),
       // The cursor keeps the database's own text form so sub-millisecond
       // timestamps cannot skip or repeat rows at a page boundary.
       nextCursor: rows.length > limit && last ? encodeCursor({ createdAt: last.cursorAt, id: last.id }) : null,
@@ -145,9 +152,25 @@ export class AdminSessionsService {
     };
   }
 
-  async tokenOf(sessionId: string): Promise<string | null> {
+  /** One active session, or null when it does not exist or has expired. */
+  async find(sessionId: string): Promise<AdminSessionView | null> {
+    const now = new Date().toISOString();
+    const rows = await this.sql<SessionRow[]>`
+      SELECT s."id", s."userId", u."email" AS "userEmail", u."name" AS "userName",
+             s."ipAddress", s."userAgent", s."impersonatedBy", s."createdAt", s."expiresAt",
+             CAST(s."createdAt" AS TEXT) AS "cursorAt"
+      FROM "session" s
+      JOIN "user" u ON u."id" = s."userId"
+      WHERE s."id" = ${sessionId} AND s."expiresAt" > ${now}
+    `;
+    return rows[0] ? view(rows[0]) : null;
+  }
+
+  /** The token of a session, only when `userId` is given and owns it. */
+  async tokenOf(sessionId: string, userId?: string): Promise<string | null> {
     const rows = await this.sql<Array<{ token: string }>>`
-      SELECT "token" FROM "session" WHERE "id" = ${sessionId}
+      SELECT "token" FROM "session"
+      WHERE "id" = ${sessionId} ${userId === undefined ? this.sql`` : this.sql`AND "userId" = ${userId}`}
     `;
     return rows[0]?.token ?? null;
   }

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin.module.ts

@@ -5,8 +5,14 @@ import {
 } from "@podosoft/podokit-contracts";
 import { OBJECT_STORAGE } from "@podosoft/podokit-runtime";
 import { Elysia, t } from "elysia";
+import { accountSessionRoutes } from "./account-sessions/account-sessions.routes";
 import { adminSessionRoutes } from "./admin-sessions/admin-sessions.routes";
-import { createSessionRevoker, type RevokeUserSessionApi } from "./admin-sessions/admin-sessions.revoker";
+import {
+  createOwnSessionRevoker,
+  createSessionRevoker,
+  type RevokeSessionApi,
+  type RevokeUserSessionApi,
+} from "./admin-sessions/admin-sessions.revoker";
 import { AdminSessionsService } from "./admin-sessions/admin-sessions.service";
 import { adminUserRoutes } from "./admin-users/admin-users.routes";
 import { AdminUsersService } from "./admin-users/admin-users.service";
@@ -57,6 +63,12 @@ const adminPlugin: AppPlugin = ({ services }) => {
       sessions: services.resolve(ADMIN_SESSIONS),
       revoke: createSessionRevoker(() => getAuth().api as unknown as RevokeUserSessionApi),
     }))
+    .use(accountSessionRoutes({
+      auth,
+      sessions: services.resolve(ADMIN_SESSIONS),
+      revoke: createOwnSessionRevoker(() => getAuth().api as unknown as RevokeSessionApi),
+      freshAgeSeconds: async () => (await getAuth().$context).sessionConfig.freshAge,
+    }))
     .use(adminUserRoutes({ auth, users: services.resolve(ADMIN_USERS) }))
     .use(siteAssetRoutes(site, profileImages))
     .get("/site/settings", async () => {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/account-sessions.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import { listAccountSessions, revokeAccountSession } from "./account-sessions";
+
+describe("account sessions", () => {
+  it("asks for one page with the cursor", async () => {
+    const paths: string[] = [];
+    const client = {
+      get: <T>(path: string): Promise<T> => {
+        paths.push(path);
+        return Promise.resolve({ current: null, items: [], nextCursor: null, total: 0 } as unknown as T);
+      },
+    };
+
+    await listAccountSessions(client, { limit: 20, cursor: "abc" });
+    await listAccountSessions(client, { limit: 20, cursor: null });
+
+    expect(paths).toEqual(["/account/sessions?limit=20&cursor=abc", "/account/sessions?limit=20"]);
+  });
+
+  it("revokes by id", async () => {
+    const paths: string[] = [];
+    const client = {
+      del: <T>(path: string): Promise<T> => {
+        paths.push(path);
+        return Promise.resolve(undefined as unknown as T);
+      },
+    };
+
+    await revokeAccountSession(client, "id/with slash");
+
+    expect(paths).toEqual(["/account/sessions/id%2Fwith%20slash"]);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/account-sessions.ts

@@ -0,0 +1,34 @@
+import type { ApiClient } from "@podosoft/podokit-api-client";
+
+/** One of the signed-in user's sessions from `GET /account/sessions`. The API never returns the token. */
+export type AccountSession = {
+  id: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  createdAt: string;
+  expiresAt: string;
+};
+
+export type AccountSessionPage = {
+  /** The session making the request, on every page. */
+  current: AccountSession | null;
+  /** The other sessions, newest first. */
+  items: AccountSession[];
+  nextCursor: string | null;
+  /** Every active session, the current one included. */
+  total: number;
+};
+
+export function listAccountSessions(
+  client: Pick<ApiClient, "get">,
+  query: { limit: number; cursor?: string | null },
+): Promise<AccountSessionPage> {
+  const params = new URLSearchParams({ limit: String(query.limit) });
+  if (query.cursor) params.set("cursor", query.cursor);
+  return client.get<AccountSessionPage>(`/account/sessions?${params.toString()}`);
+}
+
+/** Revokes one of the user's own sessions by id; the server looks up the token. */
+export function revokeAccountSession(client: Pick<ApiClient, "del">, id: string): Promise<void> {
+  return client.del<void>(`/account/sessions/${encodeURIComponent(id)}`);
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -11,6 +11,8 @@
   import { deviceLabel } from "#lib/device-label.js";
   import { toast } from "svelte-sonner";
   import { api } from "#lib/api.js";
+  import { listAccountSessions, revokeAccountSession, type AccountSession } from "#lib/account-sessions.js";
+  import { KeysetPages } from "#lib/admin/sessions.js";
   import { getI18n, fmt, formatDateTime } from "#lib/i18n/index.js";
   import { untrack } from "svelte";
   import type { SessionUser } from "../../app.d.ts";
@@ -392,28 +394,34 @@
     await goto("/login", { invalidateAll: true });
   }
 
-  // Sessions — this user's own devices
-  /** better-auth's code for "this session is older than `session.freshAge`". */
+  // Sessions — this user's own devices. The API pages them, because Better Auth's
+  // /list-sessions returns at most 100 and could leave out the current one.
+  /** Better Auth's code for "this session is older than `session.freshAge`". */
   const SESSION_NOT_FRESH = "SESSION_NOT_FRESH";
-  type Session = { id: string; token: string; userAgent?: string | null; ipAddress?: string | null; createdAt: string | Date };
+  type Session = AccountSession & { current: boolean };
   const PAGE_SIZE = DEFAULT_PAGE_SIZE;
+  // The API pages newest first by keyset, so the order is fixed rather than sortable.
+  const sessionsSort: SortState = { key: "createdAt", dir: "desc" };
+  const sessionPages = new KeysetPages();
   let sessions = $state<Session[]>([]);
+  let sessionsTotal = $state(0);
+  let sessionsPagerTotal = $state(0);
   let sessionsPage = $state(1);
-  let sessionsSort = $state<SortState | null>(null);
   let busy = $state(false);
+  let latestSessionsRequest = 0;
   const sessionsColumns: DataTableColumn<Session>[] = [
-    { key: "userAgent", label: i18n.t.sessions.device, sortable: true, value: (s) => deviceLabel(s.userAgent) ?? s.userAgent ?? "" },
-    { key: "ipAddress", label: i18n.t.sessions.ip, sortable: true, value: (s) => s.ipAddress ?? "" },
-    { key: "createdAt", label: i18n.t.sessions.since, sortable: true, value: (s) => new Date(s.createdAt).getTime() },
+    { key: "userAgent", label: i18n.t.sessions.device },
+    { key: "ipAddress", label: i18n.t.sessions.ip },
+    { key: "createdAt", label: i18n.t.sessions.since },
     { key: "status", label: i18n.t.sessions.status },
     { key: "actions", label: "", class: "w-10" },
   ];
   /**
    * True when the session is too old to list sessions.
    *
-   * better-auth guards `/list-sessions` (and `/unlink-account`) with its freshness
-   * middleware, and `session.freshAge` defaults to 24 hours. So for anyone who signed
-   * in yesterday — which is most people, most of the time — this call returns 403
+   * The API keeps better-auth's freshness rule for listing sessions, and
+   * `session.freshAge` defaults to 24 hours. So for anyone who signed in yesterday —
+   * which is most people, most of the time — the list answers 403
    * `SESSION_NOT_FRESH`. It is not a failure to report as one: the tab has to say what
    * happened and what to do, or it is a blank table under an untranslated toast.
    */
@@ -423,32 +431,45 @@
     await api.auth.signOut();
     await goto("/login", { invalidateAll: true });
   }
-  async function loadSessions(): Promise<void> {
-    const { data: res, error } = await api.auth.listSessions();
-    if (error?.code === SESSION_NOT_FRESH) {
-      // Explained in the panel below, not thrown at the corner of the screen.
-      sessionsStale = true;
-      sessions = [];
-      return;
+  /** Loads one page; the current session leads the first. A newer request supersedes any in flight. */
+  async function loadSessions(target = 1): Promise<void> {
+    if (target === 1) sessionPages.reset();
+    const cursor = sessionPages.cursorFor(target);
+    if (cursor === undefined) return;
+    const request = ++latestSessionsRequest;
+    try {
+      const result = await listAccountSessions(api, { limit: PAGE_SIZE, cursor });
+      if (request !== latestSessionsRequest) return;
+      // A revoke can empty the last page; show the one before it instead.
+      if (result.items.length === 0 && target > 1) return loadSessions(target - 1);
+      sessionsStale = false;
+      sessionPages.record(target, result.nextCursor);
+      const others = result.items.map((s) => ({ ...s, current: false }));
+      sessions = target === 1 && result.current ? [{ ...result.current, current: true }, ...others] : others;
+      sessionsTotal = result.total;
+      sessionsPagerTotal = sessionPages.pagerTotal(result.total - (result.current ? 1 : 0), PAGE_SIZE);
+      sessionsPage = target;
+    } catch (error) {
+      if (request !== latestSessionsRequest) return;
+      if (error instanceof ApiError && error.code === SESSION_NOT_FRESH) {
+        // Explained in the panel below, not thrown at the corner of the screen.
+        sessionsStale = true;
+        sessions = [];
+        return;
+      }
+      toast.error(i18n.t.sessions.loadFailed);
     }
-    sessionsStale = false;
-    if (error) return void toast.error(error.message ?? i18n.t.sessions.loadFailed);
-    // Current session first (users expect it on top; also keeps it on page 1),
-    // then newest to oldest.
-    sessions = ((res ?? []) as Session[]).sort((a, b) => {
-      if (a.id === data.currentSessionId) return -1;
-      if (b.id === data.currentSessionId) return 1;
-      return new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime();
-    });
   }
-  async function revoke(token: string): Promise<void> {
+  async function revoke(id: string): Promise<void> {
     busy = true;
-    const { error } = await api.auth.revokeSession({ token });
-    busy = false;
-    if (error) toast.error(error.message ?? i18n.t.sessions.revokeFailed);
-    else {
+    try {
+      await revokeAccountSession(api, id);
       toast.success(i18n.t.sessions.revoked);
-      await loadSessions();
+      await loadSessions(sessionsPage);
+    } catch {
+      toast.error(i18n.t.sessions.revokeFailed);
+    } finally {
+      busy = false;
     }
   }
   async function signOutOthers(): Promise<void> {
@@ -824,7 +845,7 @@
         <Card.Root>
           <Card.Header class="flex flex-row items-center justify-between gap-2">
             <Card.Title>{i18n.t.sessions.title}</Card.Title>
-            <Button variant="outline" size="sm" disabled={busy || sessionsStale || sessions.length <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
+            <Button variant="outline" size="sm" disabled={busy || sessionsStale || sessionsTotal <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
           </Card.Header>
           <Card.Content>
             {#if sessionsStale}
@@ -843,20 +864,23 @@
               columns={sessionsColumns}
               rows={sessions}
               getKey={(s) => s.id}
-              bind:sort={sessionsSort}
+              sort={sessionsSort}
+              manualSort
+              manualPagination
               bind:page={sessionsPage}
               perPage={PAGE_SIZE}
-              label={fmt(i18n.t.sessions.total, { count: sessions.length })}
+              total={sessionsPagerTotal}
+              label={fmt(i18n.t.sessions.total, { count: sessionsTotal })}
               empty={i18n.t.sessions.empty}
+              onChange={(state) => void loadSessions(state.page)}
             >
               {#snippet row(s)}
-                {@const isCurrent = s.id === data.currentSessionId}
                 <Table.Cell class="max-w-xs truncate" title={s.userAgent ?? ""}>{deviceLabel(s.userAgent) ?? s.userAgent ?? i18n.t.sessions.unknown}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{s.ipAddress ?? "—"}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{formatDateTime(s.createdAt)}</Table.Cell>
-                <Table.Cell>{#if isCurrent}<Badge>{i18n.t.sessions.current}</Badge>{/if}</Table.Cell>
+                <Table.Cell>{#if s.current}<Badge>{i18n.t.sessions.current}</Badge>{/if}</Table.Cell>
                 <Table.Cell>
-                  <Button variant="ghost" size="sm" disabled={busy || isCurrent} onclick={() => revoke(s.token)}>{i18n.t.sessions.revoke}</Button>
+                  <Button variant="ghost" size="sm" disabled={busy || s.current} onclick={() => revoke(s.id)}>{i18n.t.sessions.revoke}</Button>
                 </Table.Cell>
               {/snippet}
             </DataTable>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/table-toolbar.svelte

@@ -86,7 +86,9 @@
       {:else}
         <Label class="text-sm" for="toolbar-search">{searchFields[0].label}</Label>
       {/if}
-      <Input id="toolbar-search" bind:value={search} placeholder={searchPlaceholder} class="max-w-xs flex-1" />
+      <!-- The minimum width makes a narrow row wrap the input to its own line
+           instead of squeezing it next to the field select. -->
+      <Input id="toolbar-search" bind:value={search} placeholder={searchPlaceholder} class="min-w-48 max-w-xs flex-1" />
       <Button type="submit">{searchButton}</Button>
     </form>
   {/if}

package/dist/templates/modules/admin-dashboard/files/tests/api/account-sessions.api.spec.ts

@@ -0,0 +1,55 @@
+import { signInOnSeparateDevices } from "../helpers/devices";
+import { expect, test } from "../helpers/disposable-users";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+type Page = {
+  current: { id: string } | null;
+  items: Array<{ id: string }>;
+  nextCursor: string | null;
+  total: number;
+};
+
+test("account sessions page the user's own sessions and revoke one by id", async ({ playwright, disposableUsers }) => {
+  const email = `api-account-sessions-${Date.now()}@example.com`;
+  const password = "Podokit3e-Str0ng!pw";
+  await disposableUsers.create({ email, password, name: "Account sessions" });
+  expect(await signInOnSeparateDevices(email, password, 4)).toEqual([200, 200, 200, 200]);
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  const current = (await (await ctx.get("/api/auth/get-session")).json()) as { session: { id: string } };
+
+  const first = await ctx.get("/api/account/sessions?limit=2");
+  expect(first.ok()).toBeTruthy();
+  const firstText = await first.text();
+  expect(firstText).not.toContain("token");
+  const page1 = JSON.parse(firstText) as Page;
+  expect(page1.current?.id).toBe(current.session.id);
+  expect(page1.total).toBe(5);
+  expect(page1.items).toHaveLength(2);
+  expect(page1.nextCursor).toBeTruthy();
+  const page2 = (await (await ctx.get(`/api/account/sessions?limit=2&cursor=${encodeURIComponent(page1.nextCursor ?? "")}`)).json()) as Page;
+  expect(page2.current?.id).toBe(current.session.id);
+  expect(page2.nextCursor).toBeNull();
+  const ids = [...page1.items, ...page2.items].map((item) => item.id);
+  expect(new Set(ids).size).toBe(4);
+  expect(ids).not.toContain(current.session.id);
+
+  // Another user's session cannot be revoked through this endpoint.
+  const otherEmail = `api-account-sessions-other-${Date.now()}@example.com`;
+  await disposableUsers.create({ email: otherEmail, password, name: "Other user" });
+  const otherUser = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await otherUser.post("/api/auth/sign-in/email", { data: { email: otherEmail, password } })).ok()).toBeTruthy();
+  const otherSession = (await (await otherUser.get("/api/auth/get-session")).json()) as { session: { id: string } };
+  const foreign = await ctx.delete(`/api/account/sessions/${encodeURIComponent(otherSession.session.id)}`);
+  expect(foreign.status()).toBe(404);
+  expect(await foreign.json()).toMatchObject({ error: { code: "ACCOUNT_SESSION_NOT_FOUND" } });
+  expect((await otherUser.get("/api/auth/get-session")).ok()).toBeTruthy();
+  await otherUser.dispose();
+
+  const revoked = await ctx.delete(`/api/account/sessions/${encodeURIComponent(ids[0] ?? "")}`);
+  expect(revoked.status()).toBe(204);
+  expect(((await (await ctx.get("/api/account/sessions?limit=2")).json()) as Page).total).toBe(4);
+  await ctx.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "../helpers/disposable-users";
 import { ADMIN, USER } from "../helpers/accounts";
+import { signInOnSeparateDevices } from "../helpers/devices";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -125,6 +126,31 @@ test("revokeOtherSessions keeps the current session valid", async ({ playwright,
   await ctx.dispose();
 });
 
+test("revokeOtherSessions removes every other session, past Better Auth's page of 100", async ({
+  playwright,
+  disposableUsers,
+}) => {
+  test.slow();
+  const email = `api-revoke-many-${Date.now()}@example.com`;
+  const password = "Podokit3e-Str0ng!pw";
+  await disposableUsers.create({ email, password, name: "Many sessions" });
+
+  const statuses = await signInOnSeparateDevices(email, password, 105);
+  test.skip(statuses.includes(429), "needs an authentication rate limit above 105 sign-ins per window");
+  expect(statuses.every((status) => status === 200)).toBe(true);
+
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  // Better Auth lists at most 100 sessions, so a full page shows the backlog.
+  expect(((await (await ctx.get("/api/auth/list-sessions")).json()) as unknown[]).length).toBe(100);
+
+  expect((await ctx.post("/api/auth/revoke-other-sessions")).ok()).toBeTruthy();
+  const left = (await (await ctx.get("/api/auth/list-sessions")).json()) as Array<{ token?: string }>;
+  expect(left).toHaveLength(1);
+  expect((await (await ctx.get("/api/auth/get-session")).json())?.user?.email).toBe(email);
+  await ctx.dispose();
+});
+
 test("sessions record a client IP (forwarded through the proxy)", async ({ playwright }) => {
   const ctx = await signedIn(playwright, ADMIN);
   const res = await ctx.get("/api/auth/list-sessions");

package/dist/templates/modules/admin-dashboard/files/tests/helpers/devices.ts

@@ -0,0 +1,25 @@
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
+/**
+ * Signs in `count` times, each as a separate device, and returns the response
+ * statuses. Each request carries no cookies: a Playwright request context keeps
+ * the cookies of its earlier sign-ins, and Better Auth's multi-session plugin
+ * deletes a same-user session that a sign-in request carries, so signing in
+ * again from one context leaves one session instead of adding one.
+ */
+export async function signInOnSeparateDevices(email: string, password: string, count: number): Promise<number[]> {
+  const statuses: number[] = [];
+  for (let start = 0; start < count; start += 10) {
+    const batch = Array.from({ length: Math.min(10, count - start) }, async () => {
+      const response = await fetch(`${base}/api/auth/sign-in/email`, {
+        method: "POST",
+        headers: { origin: base, "content-type": "application/json" },
+        body: JSON.stringify({ email, password }),
+      });
+      await response.body?.cancel();
+      return response.status;
+    });
+    statuses.push(...(await Promise.all(batch)));
+  }
+  return statuses;
+}

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -52,16 +52,9 @@ async function seedSession(
     data: { email: account.email, password: account.password },
   });
   expect(res.ok(), `sign-in ${account.email}`).toBeTruthy();
-  // Keep repeated local runs from filling better-auth's 100-session response
-  // before the newly created current session can appear in account tests. The
-  // endpoint clears at most one response page, so drain several pages when a
-  // long-lived local database has accumulated them.
-  for (let attempt = 0; attempt < 10; attempt += 1) {
-    const sessionsResponse = await ctx.get("/api/auth/list-sessions");
-    const sessions = sessionsResponse.ok() ? (await sessionsResponse.json()) as unknown : [];
-    if (!Array.isArray(sessions) || sessions.length <= 1) break;
-    expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
-  }
+  // Each run signs in again, so keep a long-lived local database from piling up
+  // this account's sessions: the seeded one is the only one left.
+  expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
   writeFileSync(path, `${JSON.stringify(withTestLocale(await ctx.storageState()), null, 2)}\n`);
   await ctx.dispose();
 }

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-sessions.ui.spec.ts

@@ -0,0 +1,46 @@
+import { signInOnSeparateDevices } from "../helpers/devices";
+import { expect, test } from "../helpers/disposable-users";
+import { ready } from "../helpers/hydration";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Better Auth's /list-sessions returns at most 100 sessions, the first ones the
+// database finds, so a browser that signed in after 105 others used to see no
+// "Current" row, and "Sign out other sessions" left sessions behind.
+test("sessions tab shows the current session and signs out every other one past 100", async ({
+  browser,
+  playwright,
+  disposableUsers,
+}) => {
+  test.slow();
+  const email = `ui-many-sessions-${Date.now()}@example.com`;
+  const password = "Podokit3e-Str0ng!pw";
+  await disposableUsers.create({ email, password, name: "Many sessions" });
+  const statuses = await signInOnSeparateDevices(email, password, 105);
+  test.skip(statuses.includes(429), "needs an authentication rate limit above 105 sign-ins per window");
+  expect(statuses.every((status) => status === 200)).toBe(true);
+
+  // Sign the browser in last, so its session is the 106th.
+  const signIn = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await signIn.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  const context = await browser.newContext({ storageState: await signIn.storageState() });
+  await context.addCookies([{ name: "locale", value: "en", url: base }]);
+  const page = await context.newPage();
+  try {
+    await ready(page, "/account");
+    await page.getByRole("button", { name: "Sessions" }).click();
+    await expect(page.getByText("106 sessions", { exact: true })).toBeVisible();
+    await expect(page.getByText("Current", { exact: true })).toBeVisible();
+
+    await page.getByRole("button", { name: "Sign out other sessions" }).click();
+    await expect(page.getByText("Signed out other sessions")).toBeVisible();
+    await expect(page.getByText("1 sessions", { exact: true })).toBeVisible();
+    await expect(page.getByText("Current", { exact: true })).toBeVisible();
+    const left = (await (await signIn.get("/api/account/sessions?limit=100")).json()) as { total: number };
+    expect(left.total).toBe(1);
+  } finally {
+    await context.close();
+    await signIn.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -174,8 +174,8 @@ test("account security and sessions sub-navigation", async ({ page }) => {
 /**
  * ⚠ THE SUITE ALWAYS SIGNS IN FIRST, WHICH IS WHY THIS NEEDED A MOCK.
  *
- * better-auth guards `/list-sessions` with its freshness middleware and
- * `session.freshAge` defaults to 24 hours, so the endpoint returns 403
+ * The sessions list keeps better-auth's freshness rule, and `session.freshAge`
+ * defaults to 24 hours, so `GET /api/account/sessions` returns 403
  * `SESSION_NOT_FRESH` to anyone who signed in yesterday. The seeded session is
  * minutes old, so the test above passes for every run while the screen is broken for
  * real users — the tab showed an empty table under an untranslated "Session is not
@@ -183,11 +183,14 @@ test("account security and sessions sub-navigation", async ({ page }) => {
  * own setup prevents.
  */
 test("sessions tab explains a session that is too old to list them", async ({ page }) => {
-  await page.route("**/api/auth/list-sessions", (route) =>
+  await page.route("**/api/account/sessions?*", (route) =>
     route.fulfill({
       status: 403,
       contentType: "application/json",
-      body: JSON.stringify({ message: "Session is not fresh", code: "SESSION_NOT_FRESH" }),
+      body: JSON.stringify({
+        success: false,
+        error: { code: "SESSION_NOT_FRESH", message: "Session is not fresh", statusCode: 403 },
+      }),
     }),
   );