@podosoft/podokit 1.4.2 → 1.6.0

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.revoker.ts

@@ -1,13 +1,19 @@
 import { AppException } from "@podosoft/podokit-contracts";
 import { APIError } from "better-auth/api";
+import type { OwnSessionRevoker } from "../account-sessions/account-sessions.routes";
 import type { SessionRevoker } from "./admin-sessions.routes";
 
 export const ADMIN_SESSION_REVOKE_FAILED = "ADMIN_SESSION_REVOKE_FAILED";
+export const ACCOUNT_SESSION_REVOKE_FAILED = "ACCOUNT_SESSION_REVOKE_FAILED";
 
 export interface RevokeUserSessionApi {
   revokeUserSession(input: { body: { sessionToken: string }; headers: Headers }): Promise<unknown>;
 }
 
+export interface RevokeSessionApi {
+  revokeSession(input: { body: { token: string }; headers: Headers }): Promise<unknown>;
+}
+
 /**
  * Revokes through the Better Auth admin endpoint rather than deleting the row, so
  * its permission check and after-hooks (including the audit log) still run.
@@ -24,3 +30,21 @@ export function createSessionRevoker(api: () => RevokeUserSessionApi): SessionRe
     }
   };
 }
+
+/**
+ * Revokes one of the caller's own sessions through Better Auth's
+ * `/revoke-session`, so its ownership check and after-hooks (including the
+ * audit log's `session.revoke`) still run.
+ */
+export function createOwnSessionRevoker(api: () => RevokeSessionApi): OwnSessionRevoker {
+  return async (token, headers) => {
+    try {
+      await api().revokeSession({ body: { token }, headers });
+    } catch (error) {
+      if (error instanceof APIError) {
+        throw new AppException(ACCOUNT_SESSION_REVOKE_FAILED, error.message, error.statusCode);
+      }
+      throw error;
+    }
+  };
+}

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.service.spec.ts

@@ -183,5 +183,23 @@ describe("AdminSessionsService", () => {
 
     expect(await service.tokenOf("a")).toBe("token-a");
     expect(await service.tokenOf("missing")).toBeNull();
+    // With a user, only that user's session.
+    expect(await service.tokenOf("a", "alice")).toBe("token-a");
+    expect(await service.tokenOf("a", "bob")).toBeNull();
+  });
+
+  test("leaves one session out and finds an active session by id", async () => {
+    await seed(db, [
+      { id: "a", userId: "alice", createdAt: "2026-01-01T00:00:01.000Z" },
+      { id: "b", userId: "alice", createdAt: "2026-01-01T00:00:02.000Z" },
+      { id: "old", userId: "alice", createdAt: "2026-01-01T00:00:03.000Z", expiresAt: "2020-01-01T00:00:00.000Z" },
+    ]);
+
+    const page = await service.list({ userId: "alice", excludeId: "b" });
+    expect(page.items.map((item) => item.id)).toEqual(["a"]);
+    expect(page.total).toBe(1);
+    expect(await service.find("b")).toMatchObject({ id: "b", userId: "alice", ipAddress: "203.0.113.7" });
+    expect(await service.find("old")).toBeNull();
+    expect(await service.find("missing")).toBeNull();
   });
 });

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.service.ts

@@ -30,6 +30,8 @@ export interface AdminSessionQuery {
   cursor?: string;
   search?: string;
   userId?: string;
+  /** A session to leave out, such as the caller's own. */
+  excludeId?: string;
 }
 
 interface SessionRow {
@@ -76,6 +78,20 @@ function decodeCursor(value: string): Cursor {
   throw new AppException(ADMIN_SESSION_CURSOR_INVALID, "The sessions cursor is invalid.", 400);
 }
 
+function view(row: SessionRow): AdminSessionView {
+  return {
+    id: row.id,
+    userId: row.userId,
+    userEmail: row.userEmail,
+    userName: row.userName ?? "",
+    ipAddress: row.ipAddress,
+    userAgent: row.userAgent,
+    impersonatedBy: row.impersonatedBy,
+    createdAt: iso(row.createdAt),
+    expiresAt: iso(row.expiresAt),
+  };
+}
+
 function likePattern(search: string): string {
   return `%${search.replace(/[\\%_]/g, (character) => `\\${character}`)}%`;
 }
@@ -100,6 +116,7 @@ export class AdminSessionsService {
     const filters = (): SQL.Query<unknown> => this.sql`
       WHERE s."expiresAt" > ${now}
       ${query.userId ? this.sql`AND s."userId" = ${query.userId}` : this.sql``}
+      ${query.excludeId ? this.sql`AND s."id" <> ${query.excludeId}` : this.sql``}
       ${search ? this.searchFilter(likePattern(search)) : this.sql``}
     `;
     const [rows, totals] = await Promise.all([
@@ -127,17 +144,7 @@ export class AdminSessionsService {
     const page = rows.slice(0, limit);
     const last = page.at(-1);
     return {
-      items: page.map((row) => ({
-        id: row.id,
-        userId: row.userId,
-        userEmail: row.userEmail,
-        userName: row.userName ?? "",
-        ipAddress: row.ipAddress,
-        userAgent: row.userAgent,
-        impersonatedBy: row.impersonatedBy,
-        createdAt: iso(row.createdAt),
-        expiresAt: iso(row.expiresAt),
-      })),
+      items: page.map(view),
       // The cursor keeps the database's own text form so sub-millisecond
       // timestamps cannot skip or repeat rows at a page boundary.
       nextCursor: rows.length > limit && last ? encodeCursor({ createdAt: last.cursorAt, id: last.id }) : null,
@@ -145,9 +152,25 @@ export class AdminSessionsService {
     };
   }
 
-  async tokenOf(sessionId: string): Promise<string | null> {
+  /** One active session, or null when it does not exist or has expired. */
+  async find(sessionId: string): Promise<AdminSessionView | null> {
+    const now = new Date().toISOString();
+    const rows = await this.sql<SessionRow[]>`
+      SELECT s."id", s."userId", u."email" AS "userEmail", u."name" AS "userName",
+             s."ipAddress", s."userAgent", s."impersonatedBy", s."createdAt", s."expiresAt",
+             CAST(s."createdAt" AS TEXT) AS "cursorAt"
+      FROM "session" s
+      JOIN "user" u ON u."id" = s."userId"
+      WHERE s."id" = ${sessionId} AND s."expiresAt" > ${now}
+    `;
+    return rows[0] ? view(rows[0]) : null;
+  }
+
+  /** The token of a session, only when `userId` is given and owns it. */
+  async tokenOf(sessionId: string, userId?: string): Promise<string | null> {
     const rows = await this.sql<Array<{ token: string }>>`
-      SELECT "token" FROM "session" WHERE "id" = ${sessionId}
+      SELECT "token" FROM "session"
+      WHERE "id" = ${sessionId} ${userId === undefined ? this.sql`` : this.sql`AND "userId" = ${userId}`}
     `;
     return rows[0]?.token ?? null;
   }

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin.module.ts

@@ -5,8 +5,14 @@ import {
 } from "@podosoft/podokit-contracts";
 import { OBJECT_STORAGE } from "@podosoft/podokit-runtime";
 import { Elysia, t } from "elysia";
+import { accountSessionRoutes } from "./account-sessions/account-sessions.routes";
 import { adminSessionRoutes } from "./admin-sessions/admin-sessions.routes";
-import { createSessionRevoker, type RevokeUserSessionApi } from "./admin-sessions/admin-sessions.revoker";
+import {
+  createOwnSessionRevoker,
+  createSessionRevoker,
+  type RevokeSessionApi,
+  type RevokeUserSessionApi,
+} from "./admin-sessions/admin-sessions.revoker";
 import { AdminSessionsService } from "./admin-sessions/admin-sessions.service";
 import { adminUserRoutes } from "./admin-users/admin-users.routes";
 import { AdminUsersService } from "./admin-users/admin-users.service";
@@ -57,6 +63,12 @@ const adminPlugin: AppPlugin = ({ services }) => {
       sessions: services.resolve(ADMIN_SESSIONS),
       revoke: createSessionRevoker(() => getAuth().api as unknown as RevokeUserSessionApi),
     }))
+    .use(accountSessionRoutes({
+      auth,
+      sessions: services.resolve(ADMIN_SESSIONS),
+      revoke: createOwnSessionRevoker(() => getAuth().api as unknown as RevokeSessionApi),
+      freshAgeSeconds: async () => (await getAuth().$context).sessionConfig.freshAge,
+    }))
     .use(adminUserRoutes({ auth, users: services.resolve(ADMIN_USERS) }))
     .use(siteAssetRoutes(site, profileImages))
     .get("/site/settings", async () => {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/hooks.server.test.ts

@@ -1,5 +1,6 @@
 import { ApiError } from "@podosoft/podokit-api-client";
 import type { RequestEvent } from "@sveltejs/kit";
+import type { Handle } from "@sveltejs/kit/hooks";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { BackendUnavailableError } from "#lib/server/api.js";
 import { handle } from "./hooks.server";
@@ -14,12 +15,18 @@ const client = vi.hoisted(() => ({
   getSession: vi.fn<() => Promise<SessionResult>>(),
 }));
 
+// Stands in for the application's own hook in the app-owned app-hooks.ts.
+const appHook = vi.hoisted(() => ({
+  handle: vi.fn<Handle>(({ event, resolve }) => resolve(event)),
+}));
+vi.mock("#lib/server/app-hooks.js", () => ({ appHandle: appHook.handle }));
+
 vi.mock("#lib/server/api.js", async (importOriginal) => ({
   ...(await importOriginal<typeof import("#lib/server/api.js")>()),
   serverApiClient: () => ({ get: client.get, auth: { getSession: client.getSession } }),
 }));
 
-const resolve = vi.fn(async (): Promise<Response> => new Response("ok"));
+const resolve = vi.fn(async (_event: RequestEvent): Promise<Response> => new Response("ok"));
 
 function requestEvent(pathname: string, cookies: Record<string, string> = {}): RequestEvent {
   return {
@@ -40,6 +47,7 @@ describe("handle", () => {
     client.get.mockReset();
     client.getSession.mockReset();
     resolve.mockClear();
+    appHook.handle.mockClear();
   });
 
   it("requests the session without waiting for site settings", async () => {
@@ -144,4 +152,32 @@ describe("handle", () => {
     expect(client.getSession).not.toHaveBeenCalled();
     expect(resolve).toHaveBeenCalledTimes(1);
   });
+
+  it("runs the application hook with the loaded runtime context", async () => {
+    client.get.mockResolvedValue({ locale: null });
+    client.getSession.mockResolvedValue(signedIn);
+    let seenUser: unknown;
+    appHook.handle.mockImplementationOnce(({ event, resolve: next }) => {
+      seenUser = event.locals.user;
+      event.locals.user = { id: "local", email: "local@localhost", name: "Local", role: "admin" };
+      return next(event);
+    });
+    const event = requestEvent("/account");
+
+    const response = await handle({ event, resolve });
+
+    expect(seenUser).toEqual({ id: "user-1" });
+    expect(resolve).toHaveBeenCalledTimes(1);
+    expect(resolve.mock.calls[0]?.[0].locals.user).toMatchObject({ id: "local", role: "admin" });
+    expect(response.headers.get("x-robots-tag")).toBe("noindex, nofollow");
+  });
+
+  it("lets the application hook answer a request itself", async () => {
+    appHook.handle.mockImplementationOnce(() => new Response("teapot", { status: 418 }));
+
+    const response = await handle({ event: requestEvent("/api/site/settings"), resolve });
+
+    expect(response.status).toBe(418);
+    expect(resolve).not.toHaveBeenCalled();
+  });
 });

package/dist/templates/modules/admin-dashboard/files/apps/web/src/hooks.server.ts

@@ -3,6 +3,7 @@ import type { Handle } from "@sveltejs/kit/hooks";
 import { building } from "$app/env";
 import { routes } from "$app/manifest";
 import { serverApiClient } from "#lib/server/api.js";
+import { appHandle } from "#lib/server/app-hooks.js";
 import { resolveLocale } from "#lib/i18n/messages.js";
 import { applySearchIndexingHeaders } from "#lib/server/search-indexing.js";
 import { isPublicPath } from "#lib/server/guards.js";
@@ -91,12 +92,20 @@ export const handle: Handle = async ({ event, resolve }) => {
   } else {
     setEmptyRuntimeContext(event);
   }
-  const response = await resolve(event, {
-    transformPageChunk: ({ html }) =>
-      html.replace(
-        /(<html\b[^>]*?\slang=)(["'])[^"']*\2/i,
-        `$1"${event.locals.locale}"`,
-      ),
+  // The application's own hook from the app-owned app-hooks.ts runs next, with
+  // the runtime context loaded. Its page transform runs before the language one.
+  const response = await appHandle({
+    event,
+    resolve: (appEvent, options) =>
+      resolve(appEvent, {
+        ...options,
+        transformPageChunk: async ({ html, done }) => {
+          const transformed = options?.transformPageChunk
+            ? ((await options.transformPageChunk({ html, done })) ?? "")
+            : html;
+          return transformed.replace(/(<html\b[^>]*?\slang=)(["'])[^"']*\2/i, `$1"${event.locals.locale}"`);
+        },
+      }),
   });
   return applySearchIndexingHeaders(response, event.url.pathname);
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/account-sessions.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import { listAccountSessions, revokeAccountSession } from "./account-sessions";
+
+describe("account sessions", () => {
+  it("asks for one page with the cursor", async () => {
+    const paths: string[] = [];
+    const client = {
+      get: <T>(path: string): Promise<T> => {
+        paths.push(path);
+        return Promise.resolve({ current: null, items: [], nextCursor: null, total: 0 } as unknown as T);
+      },
+    };
+
+    await listAccountSessions(client, { limit: 20, cursor: "abc" });
+    await listAccountSessions(client, { limit: 20, cursor: null });
+
+    expect(paths).toEqual(["/account/sessions?limit=20&cursor=abc", "/account/sessions?limit=20"]);
+  });
+
+  it("revokes by id", async () => {
+    const paths: string[] = [];
+    const client = {
+      del: <T>(path: string): Promise<T> => {
+        paths.push(path);
+        return Promise.resolve(undefined as unknown as T);
+      },
+    };
+
+    await revokeAccountSession(client, "id/with slash");
+
+    expect(paths).toEqual(["/account/sessions/id%2Fwith%20slash"]);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/account-sessions.ts

@@ -0,0 +1,34 @@
+import type { ApiClient } from "@podosoft/podokit-api-client";
+
+/** One of the signed-in user's sessions from `GET /account/sessions`. The API never returns the token. */
+export type AccountSession = {
+  id: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  createdAt: string;
+  expiresAt: string;
+};
+
+export type AccountSessionPage = {
+  /** The session making the request, on every page. */
+  current: AccountSession | null;
+  /** The other sessions, newest first. */
+  items: AccountSession[];
+  nextCursor: string | null;
+  /** Every active session, the current one included. */
+  total: number;
+};
+
+export function listAccountSessions(
+  client: Pick<ApiClient, "get">,
+  query: { limit: number; cursor?: string | null },
+): Promise<AccountSessionPage> {
+  const params = new URLSearchParams({ limit: String(query.limit) });
+  if (query.cursor) params.set("cursor", query.cursor);
+  return client.get<AccountSessionPage>(`/account/sessions?${params.toString()}`);
+}
+
+/** Revokes one of the user's own sessions by id; the server looks up the token. */
+export function revokeAccountSession(client: Pick<ApiClient, "del">, id: string): Promise<void> {
+  return client.del<void>(`/account/sessions/${encodeURIComponent(id)}`);
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/admin/app-flag-settings.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, it, vi } from "vitest";
+import type { Messages } from "#lib/i18n/messages.js";
+import { appFlagCards } from "./app-flag-settings";
+
+// Stands in for the application's own list in the app-owned app-flags.ts.
+vi.mock("./app-flags", () => ({
+  APP_FLAG_SETTINGS: [
+    { flag: "reportsEnabled", label: () => "Reports", description: () => "Show the reports page." },
+    { flag: "betaSearch", label: () => "Beta search" },
+  ],
+}));
+
+const t = {} as Messages;
+
+describe("application flag settings", () => {
+  it("shows each listed flag with the value the API reports", () => {
+    expect(appFlagCards(t, { appFlags: { reportsEnabled: true, betaSearch: false, hidden: true } })).toEqual([
+      { flag: "reportsEnabled", name: "Reports", description: "Show the reports page.", available: true, on: true },
+      { flag: "betaSearch", name: "Beta search", description: "", available: true, on: false },
+    ]);
+  });
+
+  it("marks a flag the API does not report as unavailable", () => {
+    expect(appFlagCards(t, { appFlags: { reportsEnabled: false } })[1]).toMatchObject({
+      flag: "betaSearch",
+      available: false,
+      on: false,
+    });
+    expect(appFlagCards(t, undefined).every((card) => !card.available)).toBe(true);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/admin/app-flag-settings.ts

@@ -0,0 +1,31 @@
+import type { Capabilities } from "@podosoft/podokit-api-client";
+import type { Messages } from "#lib/i18n/messages.js";
+import { APP_FLAG_SETTINGS } from "./app-flags";
+import type { AppFlagSetting } from "./registry.svelte.js";
+
+export type AppFlagCard = {
+  flag: string;
+  name: string;
+  description: string;
+  /** False when the API does not report the flag, for example a name missing from APP_FLAG_DEFAULTS. */
+  available: boolean;
+  on: boolean;
+};
+
+/** One card per listed flag, with the value `GET /account/capabilities` reports in `appFlags`. */
+export function appFlagCards(
+  t: Messages,
+  capabilities: Pick<Capabilities, "appFlags"> | undefined,
+  settings: readonly AppFlagSetting[] = APP_FLAG_SETTINGS,
+): AppFlagCard[] {
+  return settings.map(({ flag, label, description }) => {
+    const value = capabilities?.appFlags?.[flag];
+    return {
+      flag,
+      name: label(t),
+      description: description?.(t) ?? "",
+      available: typeof value === "boolean",
+      on: value === true,
+    };
+  });
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/admin/app-flags.ts

@@ -0,0 +1,12 @@
+import type { AppFlagSetting } from "./registry.svelte.js";
+
+/**
+ * Application flags the admin Settings page shows, one switch each, on an
+ * Application tab after PodoKit's tabs. `flag` is a key of `APP_FLAG_DEFAULTS`
+ * in the API's owned `apps/api/src/settings/app-flags.ts`; the label and
+ * description come from the app-owned `i18n/catalogs/app/*.json`, for example
+ * `{ flag: "reportsEnabled", label: (t) => t.reports.flag, description: (t) => t.reports.flagDescription }`.
+ * The tab is hidden while the list is empty. PodoKit creates this file once and
+ * never overwrites it.
+ */
+export const APP_FLAG_SETTINGS: readonly AppFlagSetting[] = [];

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/admin/app-nav.ts

@@ -0,0 +1,11 @@
+import type { AdminNavEntry } from "./registry.svelte.js";
+
+/**
+ * Application-owned admin sidebar entries. The sidebar shows them after PodoKit's
+ * own pages and before module entries and Settings, for example
+ * `{ href: "/admin/reports", label: (t) => t.reports.nav, icon: ChartColumnIcon, adminOnly: true }`
+ * with the label in the app-owned `i18n/catalogs/app/*.json` and the icon from
+ * `@lucide/svelte/icons/*`. `adminOnly` hides an entry from other roles.
+ * PodoKit creates this file once and never overwrites it.
+ */
+export const APP_ADMIN_NAV: readonly AdminNavEntry[] = [];

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/admin/nav.test.ts

@@ -0,0 +1,39 @@
+import FileTextIcon from "@lucide/svelte/icons/file-text";
+import { describe, expect, it, vi } from "vitest";
+import { adminNavEntries } from "./nav";
+
+// Stands in for the application's own entries in the app-owned app-nav.ts.
+vi.mock("./app-nav", async () => {
+  const { default: icon } = await import("@lucide/svelte/icons/file-text");
+  return {
+    APP_ADMIN_NAV: [
+      { href: "/admin/specs", label: () => "Specs", icon, adminOnly: true },
+      { href: "/admin/help", label: () => "Help", icon },
+    ],
+  };
+});
+
+describe("admin navigation", () => {
+  it("places the application's entries before Settings", () => {
+    const hrefs = adminNavEntries({ auditLog: true }, "admin").map((entry) => entry.href);
+
+    expect(hrefs).toEqual([
+      "/admin",
+      "/admin/users",
+      "/admin/sessions",
+      "/admin/audit",
+      "/admin/specs",
+      "/admin/help",
+      "/admin/settings",
+    ]);
+    expect(adminNavEntries(undefined, "admin").find((entry) => entry.href === "/admin/specs")?.icon).toBe(
+      FileTextIcon,
+    );
+  });
+
+  it("hides admin-only application entries from other roles", () => {
+    const hrefs = adminNavEntries(undefined, "moderator").map((entry) => entry.href);
+
+    expect(hrefs).toEqual(["/admin", "/admin/help"]);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/admin/nav.ts

@@ -0,0 +1,35 @@
+import LayoutDashboardIcon from "@lucide/svelte/icons/layout-dashboard";
+import UsersIcon from "@lucide/svelte/icons/users";
+import MonitorSmartphoneIcon from "@lucide/svelte/icons/monitor-smartphone";
+import ScrollTextIcon from "@lucide/svelte/icons/scroll-text";
+import Building2Icon from "@lucide/svelte/icons/building-2";
+import SettingsIcon from "@lucide/svelte/icons/settings";
+import { APP_ADMIN_NAV } from "./app-nav";
+import { moduleNavEntries, type AdminNavEntry } from "./registry.svelte.js";
+
+export type AdminNavCapabilities = { auditLog?: boolean; organization?: boolean };
+
+/**
+ * The admin sidebar entries a user may open: PodoKit's pages, the application's
+ * entries from the app-owned app-nav.ts, module entries, then Settings.
+ */
+export function adminNavEntries(
+  capabilities: AdminNavCapabilities | undefined,
+  role: string | null | undefined,
+): AdminNavEntry[] {
+  const entries: AdminNavEntry[] = [
+    { href: "/admin", label: (t) => t.nav.overview, icon: LayoutDashboardIcon },
+    { href: "/admin/users", label: (t) => t.nav.users, icon: UsersIcon, adminOnly: true },
+    { href: "/admin/sessions", label: (t) => t.nav.sessions, icon: MonitorSmartphoneIcon, adminOnly: true },
+    ...(capabilities?.organization
+      ? [{ href: "/admin/organizations", label: (t) => t.nav.organizations, icon: Building2Icon, adminOnly: true } satisfies AdminNavEntry]
+      : []),
+    ...(capabilities?.auditLog
+      ? [{ href: "/admin/audit", label: (t) => t.nav.audit, icon: ScrollTextIcon, adminOnly: true } satisfies AdminNavEntry]
+      : []),
+    ...APP_ADMIN_NAV,
+    ...moduleNavEntries,
+    { href: "/admin/settings", label: (t) => t.nav.settings, icon: SettingsIcon, adminOnly: true },
+  ];
+  return entries.filter((entry) => !entry.adminOnly || role === "admin");
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/admin/registry.svelte.ts

@@ -1,5 +1,7 @@
 import type { Component } from "svelte";
+import AppFlagsSettings from "#lib/components/settings/app-flags-settings.svelte";
 import type { Messages } from "#lib/i18n/messages.js";
+import { APP_FLAG_SETTINGS } from "./app-flags";
 // Modules import their nav-entry icons here.
 // podokit:begin:admin-nav-imports
 // podokit:end:admin-nav-imports
@@ -26,6 +28,15 @@ export type AdminSettingsSection = {
   component: Component;
 };
 
+/** A switch on the Settings page's Application tab for one of the API's
+ *  application flags; see the app-owned app-flags.ts. */
+export type AppFlagSetting = {
+  /** The key in APP_FLAG_DEFAULTS (apps/api/src/settings/app-flags.ts). */
+  flag: string;
+  label: (t: Messages) => string;
+  description?: (t: Messages) => string;
+};
+
 export const moduleNavEntries: AdminNavEntry[] = [
   // podokit:begin:admin-nav-entries
   // podokit:end:admin-nav-entries
@@ -34,4 +45,8 @@ export const moduleNavEntries: AdminNavEntry[] = [
 export const moduleSettingsSections: AdminSettingsSection[] = [
   // podokit:begin:admin-settings
   // podokit:end:admin-settings
+  // The application's flags, after every module tab, when app-flags.ts lists any.
+  ...(APP_FLAG_SETTINGS.length > 0
+    ? [{ value: "application", label: (t: Messages) => t.settings.appFlags.tab, component: AppFlagsSettings }]
+    : []),
 ];