@podosoft/podokit 1.6.3 → 1.6.4

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.ts

@@ -17,18 +17,14 @@ import { authBaseUrl, authSecret } from "./auth-environment";
 import { isMaintenanceCommand } from "./maintenance";
 import { CLIENT_ADDRESS_HEADER } from "../core/client-address";
 import { revokeEveryOtherSession } from "./revoke-other-sessions";
+import { adminEmailsFrom, becomesAdministrator } from "./admin-emails";
 // podokit:begin:auth-imports
 // podokit:end:auth-imports
 
 // Web origin(s) where the browser runs (WebAuthn ceremonies must match these).
 const webOrigins = (process.env.CORS_ORIGIN ?? "http://localhost:5001").split(",").map((o) => o.trim());
 
-const adminEmails = new Set(
-  (process.env.ADMIN_EMAILS ?? "")
-    .split(",")
-    .map((email) => email.trim().toLowerCase())
-    .filter(Boolean),
-);
+const adminEmails = adminEmailsFrom(process.env.ADMIN_EMAILS);
 
 // Enabled social providers, from the resolved config (DB-first, env fallback).
 // Admins add/edit/remove providers dynamically (Settings page), so this maps the
@@ -45,6 +41,56 @@ function buildSocial(config: AuthConfig): NonNullable<BetterAuthOptions["socialP
   return providers as NonNullable<BetterAuthOptions["socialProviders"]>;
 }
 
+// The account and session rules of buildAuth: who may be created, who starts as
+// an administrator or approved, and who may hold a session.
+export function databaseHooksFor(
+  config: Pick<AuthConfig, "requireSignupApproval">,
+  administrators: ReadonlySet<string>,
+  signupOpen: () => Promise<boolean>,
+): NonNullable<BetterAuthOptions["databaseHooks"]> {
+  return {
+    user: {
+      create: {
+        before: async (user, context) => {
+          const createdByAdmin = context?.path === "/admin/create-user";
+          assertUserCreationAllowed(await readSignupOpen(signupOpen), context?.path);
+          const adminEmail = becomesAdministrator(user, createdByAdmin, administrators);
+          return {
+            data: {
+              ...user,
+              // The admin plugin contributes `role` before this hook. Preserve an
+              // explicitly requested admin-created role, while ADMIN_EMAILS
+              // addresses always become administrators.
+              ...(Object.prototype.hasOwnProperty.call(user, "role")
+                ? { role: adminEmail ? "admin" : user.role }
+                : {}),
+              // Existing rows are treated as approved through the field default.
+              // Only self-registration while the policy is enabled starts pending.
+              signupApproved: adminEmail || createdByAdmin || !config.requireSignupApproval,
+            },
+          };
+        },
+      },
+    },
+    session: {
+      create: {
+        before: async (session, context) => {
+          if (!context) return;
+          const user = (await context.context.internalAdapter.findUserById(session.userId)) as {
+            signupApproved?: boolean | null;
+          } | null;
+          if (user?.signupApproved === false) {
+            throw APIError.from("FORBIDDEN", {
+              code: SIGNUP_APPROVAL_REQUIRED,
+              message: "Your account is waiting for administrator approval.",
+            });
+          }
+        },
+      },
+    },
+  };
+}
+
 // Build a better-auth instance from resolved config. Called at boot and rebuilt by
 // auth-provider.ts when the DB config changes, so admin edits (OAuth credentials,
 // server-enforced toggles) apply without a restart. Everything below the injection
@@ -147,47 +193,7 @@ export function buildAuth(config: AuthConfig) {
   // podokit:begin:auth-plugins
   // podokit:end:auth-plugins
 
-  const databaseHooks: NonNullable<BetterAuthOptions["databaseHooks"]> = {
-    user: {
-      create: {
-        before: async (user, context) => {
-          const adminEmail = adminEmails.has(user.email.toLowerCase());
-          const createdByAdmin = context?.path === "/admin/create-user";
-          assertUserCreationAllowed(await readSignupOpen(isSignupOpen), context?.path);
-          return {
-            data: {
-              ...user,
-              // The admin plugin contributes `role` before this hook. Preserve an
-              // explicitly requested admin-created role, while bootstrap emails
-              // always become administrators.
-              ...(Object.prototype.hasOwnProperty.call(user, "role")
-                ? { role: adminEmail ? "admin" : user.role }
-                : {}),
-              // Existing rows are treated as approved through the field default.
-              // Only self-registration while the policy is enabled starts pending.
-              signupApproved: adminEmail || createdByAdmin || !config.requireSignupApproval,
-            },
-          };
-        },
-      },
-    },
-    session: {
-      create: {
-        before: async (session, context) => {
-          if (!context) return;
-          const user = (await context.context.internalAdapter.findUserById(session.userId)) as {
-            signupApproved?: boolean | null;
-          } | null;
-          if (user?.signupApproved === false) {
-            throw APIError.from("FORBIDDEN", {
-              code: SIGNUP_APPROVAL_REQUIRED,
-              message: "Your account is waiting for administrator approval.",
-            });
-          }
-        },
-      },
-    },
-  };
+  const databaseHooks = databaseHooksFor(config, adminEmails, isSignupOpen);
 
   // Request-time hooks. The feature gate turns the admin Settings toggles into a
   // real server boundary (disabled features 404) for endpoint calls, including

package/dist/templates/modules/auth/files/dot-claude/skills/podokit-configure-auth/SKILL.md

@@ -98,7 +98,7 @@ export MAIL_FROM="Example <noreply@example.com>"
 2. Open `/login` and confirm the provider button appears.
 3. With sign-up approval enabled, register a disposable account and confirm it reaches `/pending-approval` without a session.
 4. Open `/admin/users`, filter by **Pending approval**, approve the account, and confirm sign-in succeeds.
-5. Confirm administrator-created users and emails in `ADMIN_EMAILS` do not enter the approval queue.
+5. Confirm administrator-created users and administrators made from `ADMIN_EMAILS` do not enter the approval queue, and that an email and password sign-up with an `ADMIN_EMAILS` address is refused.
 6. Send a real verification or password-reset email and inspect SPF, DKIM, and DMARC results in the receiving mailbox.
 
 ## Preserve provider independence

package/dist/templates/modules/auth/files/dot-claude/skills/podokit-configure-auth/references/bootstrap-admin.md

@@ -9,8 +9,15 @@ Do not create the first administrator through the public sign-up page.
 
 Set `ADMIN_EMAILS` in the same deployment environment used by the API. Include
 the exact lowercase-normalized address selected for the initial administrator.
-Keep this value after bootstrap so future matching sign-ups retain the same role
-policy.
+Use the administrators' real addresses: with `NODE_ENV=production` the API
+refuses to start when an entry is not an address or is on a reserved
+documentation name such as `example.com`, and `podo deploy doctor` fails on it.
+
+Keep this value after bootstrap. A later account with a listed address becomes
+an administrator only when its address is proven as the account is created: by
+`admin:bootstrap`, an administrator, a social provider that reports the email
+verified, a magic link, or an email code. An email and password sign-up with a
+listed address is refused, so nobody can claim it before its owner.
 
 ## Inject credentials for one command
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "description": "An opinionated Bun and Elysia full-stack TypeScript starter toolkit and CLI with SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {