@actuate-media/cms-admin 0.68.0 → 0.69.1

package/src/AdminRoot.tsx

@@ -5,7 +5,7 @@ import * as Dialog from '@radix-ui/react-dialog'
 import { toast } from 'sonner'
 import { Layout } from './layout/Layout.js'
 import { adminPortalContainer } from './lib/portal-container.js'
-import { useAdminRouter } from './router/index.js'
+import { useAdminRouter, parseRouteQuery } from './router/index.js'
 import { cmsApi, ensureCsrfToken } from './lib/api.js'
 import { setDocumentFavicon, BRAND_UPDATED_EVENT } from './lib/favicon.js'
 import {
@@ -208,10 +208,26 @@ function AdminShell({
     }
   }, [session])
 
-  useIdleLogout({
+  const { stayActive } = useIdleLogout({
     enabled: Boolean(session && sessionPolicy?.idleLogoutEnabled),
     timeoutMs: (sessionPolicy?.timeoutHours ?? 0) * 3_600_000,
     onIdle: handleLogout,
+    // One-minute heads-up so the sign-out is never a surprise. Any activity
+    // (or the toast action) resets the clock and dismisses the warning.
+    warningMs: 60_000,
+    onWarn: () => {
+      toast.warning('You will be signed out in about a minute due to inactivity.', {
+        id: 'idle-logout-warning',
+        duration: 60_000,
+        action: {
+          label: 'Stay signed in',
+          onClick: () => stayActive(),
+        },
+      })
+    },
+    onWarnCancelled: () => {
+      toast.dismiss('idle-logout-warning')
+    },
   })
 
   useBranding(config)
@@ -327,10 +343,11 @@ function AdminShell({
 
     const resetMatch = matchRoute('/reset-password')
     if (resetMatch) {
-      const params = new URLSearchParams(
-        typeof window !== 'undefined' ? window.location.search : '',
+      // currentPath carries the query string (router syncs it from the URL on
+      // mount/popstate), so the emailed `?token=` deep link survives reloads.
+      return (
+        <ResetPassword onNavigate={navigate} token={parseRouteQuery(currentPath).get('token')} />
       )
-      return <ResetPassword onNavigate={navigate} token={params.get('token')} />
     }
 
     if (onLogin) {
@@ -367,7 +384,7 @@ function AdminShell({
     // a collection slugged `media`, `users`, or `settings`).
 
     if (matchRoute('/media')) {
-      return <MediaBrowser onNavigate={navigate} />
+      return <MediaBrowser onNavigate={navigate} currentPath={currentPath} />
     }
 
     // ─── Posts area ────────────────────────────────────────────────
@@ -463,7 +480,7 @@ function AdminShell({
       // "Add sub-page" in the Pages tree view arrives with the parent id
       // in the query string (`/pages/new?parent=<id>`); matchRoute ignores
       // the query so it's parsed here and preselected in the editor.
-      const newPageQuery = new URLSearchParams(currentPath.split('?')[1] ?? '')
+      const newPageQuery = parseRouteQuery(currentPath)
       return (
         <PageSectionEditor
           initialParentId={newPageQuery.get('parent')}
@@ -567,17 +584,38 @@ function AdminShell({
     // Users + API Keys moved into the Settings view as tabs. The legacy
     // top-level routes still resolve — they just land on the matching tab.
     if (matchRoute('/users')) {
-      return <Settings onNavigate={navigate} config={config} session={session} initialTab="users" />
+      return (
+        <Settings
+          onNavigate={navigate}
+          config={config}
+          session={session}
+          initialTab="users"
+          currentPath={currentPath}
+        />
+      )
     }
 
     if (matchRoute('/api-keys')) {
       return (
-        <Settings onNavigate={navigate} config={config} session={session} initialTab="api-keys" />
+        <Settings
+          onNavigate={navigate}
+          config={config}
+          session={session}
+          initialTab="api-keys"
+          currentPath={currentPath}
+        />
       )
     }
 
     if (matchRoute('/settings')) {
-      return <Settings onNavigate={navigate} config={config} session={session} />
+      return (
+        <Settings
+          onNavigate={navigate}
+          config={config}
+          session={session}
+          currentPath={currentPath}
+        />
+      )
     }
 
     if (matchRoute('/profile')) {
@@ -716,7 +754,8 @@ function AdminShell({
   // Preview routes render as standalone pages (no sidebar/header) so a
   // new-tab preview looks like the real published page rather than an
   // embedded admin view. Everything else gets the full admin chrome.
-  if (currentPath.endsWith('/preview')) {
+  // Query string is stripped — currentPath carries it after reloads.
+  if (currentPath.split('?')[0]!.endsWith('/preview')) {
     return (
       <div className="bg-background h-full min-h-screen">
         <ErrorBoundary>{renderView()}</ErrorBoundary>
@@ -867,7 +906,9 @@ function useAdminPageTitle(config: any, currentPath: string) {
     const baseName = branding?.title ?? (branding?.name ? `${branding.name} Admin` : null)
     if (!baseName) return
 
-    const segment = currentPath === '/' ? 'Dashboard' : currentPath.split('/').filter(Boolean)[0]
+    // Strip the query so `/settings?tab=users` titles as "Settings".
+    const pathname = currentPath.split('?')[0]!.split('#')[0]!
+    const segment = pathname === '/' ? 'Dashboard' : pathname.split('/').filter(Boolean)[0]
     const pageName = segment ? segment.charAt(0).toUpperCase() + segment.slice(1) : 'Dashboard'
     document.title = `${pageName} — ${baseName}`
   }, [config, currentPath])

package/src/__tests__/hooks/useIdleLogout.test.tsx

@@ -8,12 +8,28 @@ function Harness({
   enabled,
   timeoutMs,
   onIdle,
+  warningMs,
+  onWarn,
+  onWarnCancelled,
+  stayActiveRef,
 }: {
   enabled: boolean
   timeoutMs: number
   onIdle: () => void
+  warningMs?: number
+  onWarn?: () => void
+  onWarnCancelled?: () => void
+  stayActiveRef?: { current: (() => void) | null }
 }) {
-  useIdleLogout({ enabled, timeoutMs, onIdle })
+  const { stayActive } = useIdleLogout({
+    enabled,
+    timeoutMs,
+    onIdle,
+    warningMs,
+    onWarn,
+    onWarnCancelled,
+  })
+  if (stayActiveRef) stayActiveRef.current = stayActive
   return null
 }
 
@@ -83,4 +99,90 @@ describe('useIdleLogout', () => {
     document.dispatchEvent(new Event('visibilitychange'))
     expect(onIdle).toHaveBeenCalledTimes(1)
   })
+
+  describe('warning window', () => {
+    const WARNING_MS = 20_000
+
+    it('fires onWarn once inside the warning window, then onIdle at the deadline', () => {
+      const onIdle = vi.fn()
+      const onWarn = vi.fn()
+      render(
+        <Harness
+          enabled
+          timeoutMs={TIMEOUT_MS}
+          warningMs={WARNING_MS}
+          onIdle={onIdle}
+          onWarn={onWarn}
+        />,
+      )
+
+      // Before the warning window: nothing.
+      vi.advanceTimersByTime(TIMEOUT_MS - WARNING_MS - 5_000)
+      expect(onWarn).not.toHaveBeenCalled()
+
+      // Inside the window: warn exactly once, no logout yet.
+      vi.advanceTimersByTime(10_000)
+      expect(onWarn).toHaveBeenCalledTimes(1)
+      expect(onIdle).not.toHaveBeenCalled()
+
+      // Deadline: logout, and the warning doesn't re-fire.
+      vi.advanceTimersByTime(TIMEOUT_MS)
+      expect(onIdle).toHaveBeenCalledTimes(1)
+      expect(onWarn).toHaveBeenCalledTimes(1)
+    })
+
+    it('activity after the warning cancels it and resets the clock', () => {
+      const onIdle = vi.fn()
+      const onWarn = vi.fn()
+      const onWarnCancelled = vi.fn()
+      render(
+        <Harness
+          enabled
+          timeoutMs={TIMEOUT_MS}
+          warningMs={WARNING_MS}
+          onIdle={onIdle}
+          onWarn={onWarn}
+          onWarnCancelled={onWarnCancelled}
+        />,
+      )
+
+      vi.advanceTimersByTime(TIMEOUT_MS - 10_000)
+      expect(onWarn).toHaveBeenCalledTimes(1)
+
+      window.dispatchEvent(new Event('keydown'))
+      expect(onWarnCancelled).toHaveBeenCalledTimes(1)
+
+      // The clock restarted: warn again on the next quiet cycle, no logout yet.
+      vi.advanceTimersByTime(TIMEOUT_MS - 10_000)
+      expect(onWarn).toHaveBeenCalledTimes(2)
+      expect(onIdle).not.toHaveBeenCalled()
+    })
+
+    it('stayActive resets the clock like real activity', () => {
+      const onIdle = vi.fn()
+      const onWarn = vi.fn()
+      const onWarnCancelled = vi.fn()
+      const stayActiveRef: { current: (() => void) | null } = { current: null }
+      render(
+        <Harness
+          enabled
+          timeoutMs={TIMEOUT_MS}
+          warningMs={WARNING_MS}
+          onIdle={onIdle}
+          onWarn={onWarn}
+          onWarnCancelled={onWarnCancelled}
+          stayActiveRef={stayActiveRef}
+        />,
+      )
+
+      vi.advanceTimersByTime(TIMEOUT_MS - 10_000)
+      expect(onWarn).toHaveBeenCalledTimes(1)
+
+      stayActiveRef.current?.()
+      expect(onWarnCancelled).toHaveBeenCalledTimes(1)
+
+      vi.advanceTimersByTime(TIMEOUT_MS - 15_000)
+      expect(onIdle).not.toHaveBeenCalled()
+    })
+  })
 })

package/src/__tests__/router/query-string.test.ts

@@ -0,0 +1,54 @@
+// @vitest-environment happy-dom
+import { describe, expect, it } from 'vitest'
+import { act, renderHook } from '@testing-library/react'
+
+import { parseRouteQuery, useAdminRouter } from '../../router/index.js'
+
+// The admin router must carry the query string in `currentPath` so deep links
+// like `/pages/new?parent=<id>` survive hard reloads and back/forward — not
+// just in-app `navigate()` calls (which always carried it).
+describe('useAdminRouter query strings', () => {
+  it('includes the query string when syncing from the browser URL on mount', () => {
+    window.history.pushState({}, '', '/admin/pages/new?parent=abc')
+
+    const { result } = renderHook(() => useAdminRouter('/admin', '/pages/new'))
+
+    expect(result.current.currentPath).toBe('/pages/new?parent=abc')
+    expect(result.current.search).toBe('?parent=abc')
+    // matchRoute strips the query, so route patterns still match.
+    expect(result.current.matchRoute('/pages/new')).toEqual({})
+    expect(parseRouteQuery(result.current.currentPath).get('parent')).toBe('abc')
+  })
+
+  it('carries the query string through popstate (back/forward)', () => {
+    window.history.pushState({}, '', '/admin/settings?tab=users')
+    const { result } = renderHook(() => useAdminRouter('/admin', '/'))
+
+    act(() => {
+      window.history.pushState({}, '', '/admin/seo?tab=audit&issueId=i1')
+      window.dispatchEvent(new PopStateEvent('popstate'))
+    })
+
+    expect(result.current.currentPath).toBe('/seo?tab=audit&issueId=i1')
+    expect(result.current.search).toBe('?tab=audit&issueId=i1')
+    expect(result.current.matchRoute('/seo')).toEqual({})
+    expect(result.current.matchRoute('/seo/:id')).toBeNull()
+  })
+
+  it('handles a query on the admin root path', () => {
+    window.history.pushState({}, '', '/admin?foo=1')
+
+    const { result } = renderHook(() => useAdminRouter('/admin', '/'))
+
+    expect(result.current.currentPath).toBe('/?foo=1')
+    expect(result.current.matchRoute('/')).toEqual({})
+  })
+
+  it('parseRouteQuery accepts full paths, raw search strings, and hashes', () => {
+    expect(parseRouteQuery('/pages/new?parent=abc').get('parent')).toBe('abc')
+    expect(parseRouteQuery('?tab=users&selected=u1').get('selected')).toBe('u1')
+    expect(parseRouteQuery('/pages').get('parent')).toBeNull()
+    expect(parseRouteQuery('').get('parent')).toBeNull()
+    expect(parseRouteQuery('/seo?tab=audit#section').get('tab')).toBe('audit')
+  })
+})

package/src/__tests__/views/form-entries.render.test.tsx

@@ -4,7 +4,7 @@ import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 
 // Drive the global All Entries inbox through a mocked forms-service so the test
 // owns the data and can assert the cross-form table (Form column + form
-// filter), status-pill refetches, and opening the detail drawer.
+// filter), status-pill refetches, and opening the inline detail pane.
 function makeEntry(over: Record<string, unknown> = {}) {
   return {
     id: 'e1',
@@ -122,12 +122,24 @@ describe('FormEntries (All Entries)', () => {
     )
   })
 
-  it('opens the detail drawer when a row is clicked', async () => {
+  it('opens the detail pane inline when a row is clicked', async () => {
     render(<FormEntries onNavigate={() => {}} />)
-    const row = await screen.findByText('Jordan Avery')
+    const rowButton = await screen.findByRole('button', { name: 'Jordan Avery' })
+    expect(rowButton.getAttribute('aria-expanded')).toBe('false')
 
-    fireEvent.click(row)
+    fireEvent.click(rowButton)
 
+    expect(screen.getByRole('region', { name: 'Entry details' })).toBeTruthy()
+    expect(rowButton.getAttribute('aria-expanded')).toBe('true')
     await waitFor(() => expect(fetchEntry).toHaveBeenCalledWith('e1'))
   })
+
+  it('collapses the pane via its close button', async () => {
+    render(<FormEntries onNavigate={() => {}} />)
+    fireEvent.click(await screen.findByRole('button', { name: 'Jordan Avery' }))
+    expect(screen.getByRole('region', { name: 'Entry details' })).toBeTruthy()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Close entry details' }))
+    expect(screen.queryByRole('region', { name: 'Entry details' })).toBeNull()
+  })
 })

package/src/__tests__/views/form-submissions.render.test.tsx

@@ -4,7 +4,7 @@ import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 
 // Drive the per-form submissions table through a mocked forms-service so the
 // test owns the data and can assert rendering, status-pill refetches, bulk
-// selection, and opening the detail drawer without a real backend.
+// selection, and opening the inline detail pane without a real backend.
 function makeEntry(over: Record<string, unknown> = {}) {
   return {
     id: 'e1',
@@ -118,12 +118,24 @@ describe('FormSubmissions table', () => {
     expect(screen.getByRole('button', { name: 'Mark read' })).toBeTruthy()
   })
 
-  it('opens the detail drawer when a row is clicked', async () => {
+  it('opens the detail pane inline when a row is clicked', async () => {
     render(<FormSubmissions formId="f1" onNavigate={() => {}} />)
-    const row = await screen.findByText('Jordan Avery')
+    const rowButton = await screen.findByRole('button', { name: 'Jordan Avery' })
+    expect(rowButton.getAttribute('aria-expanded')).toBe('false')
 
-    fireEvent.click(row)
+    fireEvent.click(rowButton)
 
+    expect(screen.getByRole('region', { name: 'Entry details' })).toBeTruthy()
+    expect(rowButton.getAttribute('aria-expanded')).toBe('true')
     await waitFor(() => expect(fetchEntry).toHaveBeenCalledWith('e1'))
   })
+
+  it('collapses the pane via its close button', async () => {
+    render(<FormSubmissions formId="f1" onNavigate={() => {}} />)
+    fireEvent.click(await screen.findByRole('button', { name: 'Jordan Avery' }))
+    expect(screen.getByRole('region', { name: 'Entry details' })).toBeTruthy()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Close entry details' }))
+    expect(screen.queryByRole('region', { name: 'Entry details' })).toBeNull()
+  })
 })

package/src/__tests__/views/media-seo-audit.render.test.tsx

@@ -114,4 +114,38 @@ describe('MediaSeoAudit', () => {
     fireEvent.click(screen.getByRole('button', { name: 'Missing Alt' }))
     expect(screen.getByText('No items match this filter')).toBeTruthy()
   })
+
+  it('renders a retryable error state instead of an empty audit when the fetch failed', () => {
+    const onRetry = vi.fn()
+    render(<MediaSeoAudit items={[]} onEdit={vi.fn()} error="Network error" onRetry={onRetry} />)
+
+    expect(screen.getByRole('alert')).toBeTruthy()
+    expect(screen.getByText("Couldn't load media")).toBeTruthy()
+    expect(screen.getByText('Network error')).toBeTruthy()
+    expect(screen.queryByText('No media to audit')).toBeNull()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Retry' }))
+    expect(onRetry).toHaveBeenCalledTimes(1)
+  })
+
+  it('still renders loaded items when an error arrives after data (stale-but-usable)', () => {
+    render(<MediaSeoAudit items={ITEMS} onEdit={vi.fn()} error="Refresh failed" />)
+    expect(screen.getByRole('table', { name: 'Media SEO audit' })).toBeTruthy()
+    expect(screen.queryByRole('alert')).toBeNull()
+  })
+
+  it('activates a row with the keyboard (Enter and Space)', () => {
+    const onEdit = vi.fn()
+    render(<MediaSeoAudit items={ITEMS} onEdit={onEdit} />)
+
+    const row = screen.getByRole('row', { name: 'Edit SEO metadata for hero-banner.jpg' })
+    expect(row.getAttribute('tabindex')).toBe('0')
+
+    fireEvent.keyDown(row, { key: 'Enter' })
+    expect(onEdit).toHaveBeenCalledTimes(1)
+    expect(onEdit.mock.calls[0]![0].id).toBe('no-alt')
+
+    fireEvent.keyDown(row, { key: ' ' })
+    expect(onEdit).toHaveBeenCalledTimes(2)
+  })
 })

package/src/__tests__/views/redirects-pane.render.test.tsx

@@ -0,0 +1,156 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+
+/**
+ * Redirects tab with the inline editor pane (design split-pane pattern —
+ * previously the `RedirectEditorDrawer` overlay). Pins: row click toggles the
+ * 420px pane, "New redirect" opens it in create mode, and save flows through
+ * the same `createRedirectRule` / `updateRedirectRule` service calls.
+ */
+
+function makeRule(over: Record<string, unknown> = {}) {
+  return {
+    id: 'r1',
+    type: 301 as const,
+    fromPath: '/old-path',
+    toPath: '/new-path',
+    enabled: true,
+    priority: 0,
+    preserveQuery: false,
+    hits: 3,
+    lastHitAt: null,
+    stale: false,
+    source: 'manual',
+    notes: null,
+    createdAt: '2026-06-01T00:00:00Z',
+    updatedAt: '2026-06-01T00:00:00Z',
+    ...over,
+  }
+}
+
+const RULES = [makeRule(), makeRule({ id: 'r2', fromPath: '/other', toPath: '/elsewhere' })]
+
+const fetchRedirectRules = vi.fn(async () => RULES)
+const createRedirectRule = vi.fn(async (_p: unknown) => ({}))
+const updateRedirectRule = vi.fn(async (_id: string, _p: unknown) => ({}))
+const deleteRedirectRule = vi.fn(async (_id: string) => ({}))
+
+vi.mock('../../lib/seo-service.js', () => ({
+  fetchRedirectOverview: vi.fn(async () => ({
+    activeRedirects: 2,
+    staleRedirects: 0,
+    notFoundCount: 0,
+    chainsAndLoops: 0,
+  })),
+  fetchRedirectRules: () => fetchRedirectRules(),
+  fetchRedirectChains: vi.fn(async () => []),
+  fetchRedirectSuggestions: vi.fn(async () => []),
+  createRedirectRule: (p: unknown) => createRedirectRule(p),
+  updateRedirectRule: (id: string, p: unknown) => updateRedirectRule(id, p),
+  deleteRedirectRule: (id: string) => deleteRedirectRule(id),
+  flattenRedirectChain: vi.fn(async () => ({})),
+  generate404RecoverySuggestions: vi.fn(async () => ({})),
+  acceptRedirectSuggestion: vi.fn(async () => ({})),
+  dismissRedirectSuggestion: vi.fn(async () => ({})),
+  exportRedirectsCsv: vi.fn(async () => ({ csv: '' })),
+  importRedirectsCsv: vi.fn(async () => ({ imported: 0 })),
+}))
+
+vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn(), loading: vi.fn() } }))
+
+const { RedirectsTab } = await import('../../views/seo/RedirectsTab.js')
+
+beforeEach(() => {
+  fetchRedirectRules.mockClear()
+  createRedirectRule.mockClear()
+  updateRedirectRule.mockClear()
+  deleteRedirectRule.mockClear()
+})
+
+describe('Redirects inline editor pane', () => {
+  it('opens the pane on row click with the rule loaded', async () => {
+    render(<RedirectsTab />)
+    const rowButton = await screen.findByRole('button', { name: '/old-path' })
+    expect(rowButton.getAttribute('aria-expanded')).toBe('false')
+
+    fireEvent.click(rowButton)
+
+    expect(screen.getByRole('region', { name: 'Redirect editor' })).toBeTruthy()
+    expect(rowButton.getAttribute('aria-expanded')).toBe('true')
+    // The form is prefilled from the selected rule.
+    expect(screen.getByLabelText('Source path')).toHaveProperty('value', '/old-path')
+    expect(screen.getByLabelText('Destination')).toHaveProperty('value', '/new-path')
+  })
+
+  it('toggles the pane closed when the same row is clicked again', async () => {
+    render(<RedirectsTab />)
+    const rowButton = await screen.findByRole('button', { name: '/old-path' })
+
+    fireEvent.click(rowButton)
+    expect(screen.getByRole('region', { name: 'Redirect editor' })).toBeTruthy()
+
+    fireEvent.click(rowButton)
+    expect(screen.queryByRole('region', { name: 'Redirect editor' })).toBeNull()
+  })
+
+  it('collapses the pane via the close button', async () => {
+    render(<RedirectsTab />)
+    fireEvent.click(await screen.findByRole('button', { name: '/old-path' }))
+    expect(screen.getByRole('region', { name: 'Redirect editor' })).toBeTruthy()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Close redirect editor' }))
+    expect(screen.queryByRole('region', { name: 'Redirect editor' })).toBeNull()
+  })
+
+  it('saves an edited rule through updateRedirectRule and refetches', async () => {
+    render(<RedirectsTab />)
+    fireEvent.click(await screen.findByRole('button', { name: '/old-path' }))
+    const before = fetchRedirectRules.mock.calls.length
+
+    fireEvent.change(screen.getByLabelText('Destination'), { target: { value: '/moved' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Save changes' }))
+
+    await waitFor(() =>
+      expect(updateRedirectRule).toHaveBeenCalledWith(
+        'r1',
+        expect.objectContaining({ fromPath: '/old-path', toPath: '/moved', type: 301 }),
+      ),
+    )
+    // Saving closes the pane and refetches the list.
+    await waitFor(() =>
+      expect(screen.queryByRole('region', { name: 'Redirect editor' })).toBeNull(),
+    )
+    await waitFor(() => expect(fetchRedirectRules.mock.calls.length).toBeGreaterThan(before))
+  })
+
+  it('creates a rule from the New redirect pane', async () => {
+    render(<RedirectsTab />)
+    await screen.findByRole('button', { name: '/old-path' })
+
+    fireEvent.click(screen.getByRole('button', { name: /New redirect/ }))
+    expect(screen.getByRole('region', { name: 'Redirect editor' })).toBeTruthy()
+
+    fireEvent.change(screen.getByLabelText('Source path'), { target: { value: 'legacy' } })
+    fireEvent.change(screen.getByLabelText('Destination'), { target: { value: '/fresh' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Create redirect' }))
+
+    // Paths are normalized to a leading slash before saving.
+    await waitFor(() =>
+      expect(createRedirectRule).toHaveBeenCalledWith(
+        expect.objectContaining({ fromPath: '/legacy', toPath: '/fresh', type: 301 }),
+      ),
+    )
+  })
+
+  it('shows a validation error instead of saving when the source is missing', async () => {
+    render(<RedirectsTab />)
+    await screen.findByRole('button', { name: '/old-path' })
+
+    fireEvent.click(screen.getByRole('button', { name: /New redirect/ }))
+    fireEvent.click(screen.getByRole('button', { name: 'Create redirect' }))
+
+    expect(await screen.findByRole('alert')).toBeTruthy()
+    expect(createRedirectRule).not.toHaveBeenCalled()
+  })
+})

package/src/__tests__/views/users-selected-deeplink.render.test.tsx

@@ -0,0 +1,102 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+
+/**
+ * Render tests for the `?selected=<userId>` deep link written by the command
+ * palette (`/users?selected=<id>`): once the member list loads, the matching
+ * member's detail drawer opens. Unknown ids are tolerated — no drawer, no crash.
+ */
+
+const MEMBER = {
+  id: 'u1',
+  name: 'Priya Nair',
+  email: 'priya@actuatemedia.com',
+  initials: 'PN',
+  role: 'EDITOR',
+  roleName: 'Editor' as const,
+  status: 'active' as const,
+  mfaEnabled: true,
+  externalDomain: false,
+  lastLoginAt: null,
+  lastActiveAt: null,
+  acceptedInviteAt: new Date('2026-01-02').toISOString(),
+  createdAt: new Date('2026-01-01').toISOString(),
+  isCurrentUser: false,
+}
+
+const DETAIL = {
+  ...MEMBER,
+  avatarUrl: null,
+  mfaRequired: false,
+  passwordSet: true,
+  forcePasswordReset: false,
+  failedLoginCount: 0,
+  lockedAt: null,
+  suspendedAt: null,
+  authProvider: null,
+  oauthProviders: [],
+  ssoOnly: false,
+  emailVerified: true,
+  invitedBy: null,
+  contentOwnedCount: 4,
+}
+
+const STATS = {
+  members: 1,
+  pendingInvites: 0,
+  admins: 0,
+  seatsUsed: 1,
+  seatLimit: null,
+  seatsAvailable: null,
+  emailConfigured: true,
+}
+
+const { cmsApi } = vi.hoisted(() => ({ cmsApi: vi.fn() }))
+vi.mock('../../lib/api.js', () => ({ cmsApi }))
+
+cmsApi.mockImplementation(async (endpoint?: string) => {
+  if (!endpoint) return { data: null, status: 200 }
+  if (endpoint === '/invites') return { data: [], status: 200 }
+  if (endpoint === '/users/stats') return { data: STATS, status: 200 }
+  if (endpoint === '/access-review') return { data: [], status: 200 }
+  if (endpoint.startsWith('/users/u1')) return { data: DETAIL, status: 200 }
+  if (endpoint === '/users' || endpoint.startsWith('/users?'))
+    return { data: [MEMBER], status: 200 }
+  return { data: null, status: 200 }
+})
+
+const { Users } = await import('../../views/Users.js')
+
+describe('Users ?selected= deep link', () => {
+  beforeEach(() => cmsApi.mockClear())
+
+  it('opens the detail drawer for the selected member once the list loads', async () => {
+    render(<Users currentPath="/users?selected=u1" />)
+
+    // "Content owned" only renders inside the detail drawer's overview tab.
+    expect(await screen.findByText('Content owned')).toBeTruthy()
+    expect(cmsApi.mock.calls.some(([endpoint]) => String(endpoint).startsWith('/users/u1'))).toBe(
+      true,
+    )
+  })
+
+  it('ignores a selected id that matches no member', async () => {
+    render(<Users currentPath="/users?selected=does-not-exist" />)
+
+    // List renders normally…
+    expect(await screen.findByText('priya@actuatemedia.com')).toBeTruthy()
+    // …but no drawer opens and no detail fetch is issued.
+    expect(screen.queryByText('Content owned')).toBeNull()
+    expect(
+      cmsApi.mock.calls.some(([endpoint]) => String(endpoint).includes('/users/does-not-exist')),
+    ).toBe(false)
+  })
+
+  it('renders without a drawer when there is no query at all', async () => {
+    render(<Users currentPath="/users" />)
+
+    expect(await screen.findByText('priya@actuatemedia.com')).toBeTruthy()
+    expect(screen.queryByText('Content owned')).toBeNull()
+  })
+})