@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/apps/fullstack/e2e/fullstack.spec.ts.hbs

@@ -0,0 +1,988 @@
+import type { Page } from '@playwright/test'
+import { Buffer } from 'node:buffer'
+{{#if features.feedback}}
+import { execFileSync } from 'node:child_process'
+{{/if}}
+import { randomUUID } from 'node:crypto'
+import { mkdir{{#if features.feedback}}, readFile{{/if}} } from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+import { apiContract } from '@h-ai/api-contract'
+{{#if features.feedback}}
+import { readFeedbackBundle } from '@h-ai/feedback/bundle'
+{{/if}}
+import { expect, test } from '@playwright/test'
+import { {{fullstack.contractExportName}} } from '{{fullstack.contractPackageName}}'
+
+const apiBaseUrl = process.env.SERVICE_BASE_URL || 'http://127.0.0.1:3000'
+const apiPrefix = '/api/v1'
+const adminPassword = process.env.E2E_ADMIN_PASSWORD || 'Scaffold-test-Admin123!'
+const auditAdminPassword = process.env.E2E_AUDIT_ADMIN_PASSWORD || 'Scaffold-test-Audit123!'
+const configAdminPassword = process.env.E2E_CONFIG_ADMIN_PASSWORD || 'Scaffold-test-Config123!'
+{{#if features.feedback}}
+const businessOperatorPassword = process.env.E2E_BUSINESS_OPERATOR_PASSWORD || 'Scaffold-test-Operator123!'
+{{/if}}
+const configuredName = process.env.HAI_CORE_NAME || 'Configured scaffold'
+const configuredVersion = process.env.HAI_CORE_VERSION || '9.8.7'
+const configuredEnv = 'test'
+
+// 测试专用的一像素 PNG；上传仍使用完整前后端加密链路。
+const avatar = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aSxkAAAAASUVORK5CYII=', 'base64')
+
+async function capture(page: Page, name: string, fallback: string) {
+  const evidence = process.env.HAI_AUTH_EVIDENCE_DIR
+  if (evidence)
+    await mkdir(evidence, { recursive: true })
+  await expect(page.getByTestId('guide-loading')).toHaveCount(0)
+  await page.evaluate(() => document.fonts.ready)
+  await page.screenshot({ path: evidence ? path.join(evidence, name) : fallback, fullPage: true, animations: 'disabled' })
+}
+
+async function dismissToasts(page: Page) {
+  const dismiss = page.locator('.hai-toast-layer').getByRole('button', { name: /^(关闭|Dismiss|閉じる)$/ })
+  for (let count = 0; count < 10 && await dismiss.count(); count++)
+    await dismiss.click()
+}
+
+async function submitLogin(page: Page, username: string, password: string) {
+  await dismissToasts(page)
+  await expect(page.getByTestId('login-form')).toBeVisible()
+  await page.locator('#login-username').fill(username)
+  await page.getByTestId('login-form').locator('input[type="password"]').fill(password)
+  await page.getByTestId('login-form').getByRole('button', { name: /登录|Sign in|Login|Log in/i }).click()
+}
+
+async function login(page: Page, username: string, password: string, keepGuide = false) {
+  await submitLogin(page, username, password)
+  await expect(page.getByTestId('logout')).toBeVisible()
+  if (!keepGuide && await page.getByTestId('guide-later').isVisible())
+    await page.getByTestId('guide-later').click()
+}
+
+async function userEditor(page: Page, username: string) {
+  await page.getByTestId('users-search').locator('input').fill(username)
+  await page.getByTestId('users-page').getByRole('button', { name: /查询|Search/ }).click()
+  const row = page.getByRole('row').filter({ has: page.getByText(`@${username}`, { exact: true }) })
+  await expect(row).toBeVisible()
+  await row.getByRole('button', { name: /编辑|Edit/, exact: true }).click()
+  return row
+}
+
+for (const scenario of [{ offset: -600_000, width: 1440 }, { offset: 600_000, width: 390 }]) {
+  test(`clock offset ${scenario.offset} displays synchronization advice and recovers after correction`, async ({ page }, testInfo) => {
+    await page.setViewportSize({ width: scenario.width, height: 900 })
+    await page.addInitScript((offset) => {
+      const now = Date.now.bind(Date)
+      Date.now = () => now() + offset
+    }, scenario.offset)
+    await page.goto('./')
+    const advice = page.getByRole('alert').filter({ hasText: /同步|synchron|時刻/i })
+    await expect(advice).toBeVisible()
+    await expect(advice).toContainText(/刷新|refresh|再読み込み/i)
+    await capture(page, `clock-skew-${scenario.width}.png`, testInfo.outputPath(`clock-skew-${scenario.width}.png`))
+    // 校时后由用户明确刷新；不能自动重放之前失败的业务请求。
+    await page.evaluate((offset) => {
+      const now = Date.now.bind(Date)
+      Date.now = () => now() - offset
+    }, scenario.offset)
+    await page.getByRole('button', { name: /刷新|Refresh|再読み込み/i }).click()
+    await expect(page.getByTestId('login-form')).toBeVisible()
+    await expect(advice).toHaveCount(0)
+  })
+}
+
+test('service health endpoint is ready', async ({ request }) => {
+  const response = await request.get(`${apiBaseUrl}/health`)
+  await expect(response).toBeOK()
+})
+
+test('service rejects plaintext business requests', async ({ request }) => {
+  const response = await request.post(`${apiBaseUrl}${apiPrefix}${apiContract.pathOf({{fullstack.contractExportName}}.app.echo)}`, { data: { message: 'hello e2e' } })
+  expect(response.status()).toBe(400)
+})
+
+{{#if fullstack.e2eFrontend}}
+test('hash routing and responsive workspace preserve usable content width', async ({ page }, testInfo) => {
+  await page.goto('./#/roles?source=direct')
+  await login(page, 'admin', adminPassword)
+  await expect(page.getByTestId('roles-page')).toBeVisible()
+  await expect(page).toHaveURL(/#\/roles\?source=direct$/)
+  await page.reload()
+  await expect(page.getByTestId('roles-page')).toBeVisible()
+  await expect(page.locator('header')).toBeVisible()
+  await expect(page.locator('footer')).toBeVisible()
+  for (const width of [1440, 1920, 2560, 3840, 390]) {
+    await page.setViewportSize({ width, height: 960 })
+    expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+    const main = await page.locator('main').boundingBox()
+    const content = await page.getByTestId('roles-page').boundingBox()
+    expect(content!.width).toBeGreaterThan(main!.width - 80)
+    if (width === 1920)
+      await capture(page, '{{projectName}}-wide.png', testInfo.outputPath('wide-1920.png'))
+  }
+  await page.setViewportSize({ width: 1440, height: 960 })
+  await page.getByTestId('nav-settings').click()
+  await expect(page).toHaveURL(/#\/settings$/)
+  await page.goBack()
+  await expect(page.getByTestId('roles-page')).toBeVisible()
+  await page.goForward()
+  await expect(page.getByTestId('profile-form')).toBeVisible()
+  await page.goto('./#/unknown-page')
+  await expect(page).toHaveURL(/#\/users$/)
+  await expect(page.getByTestId('users-page')).toBeVisible()
+  const usersPage = page.getByTestId('users-page')
+  const accountHeader = usersPage.locator('th').first()
+  await accountHeader.getByRole('button').click()
+  await expect(accountHeader).toHaveAttribute('aria-sort', 'ascending')
+  const search = usersPage.getByTestId('users-search').locator('input')
+  await search.fill('unsubmitted-query-draft')
+  const sorted = page.waitForResponse(response => new URL(response.url()).pathname.endsWith('/admin/users/list'))
+  await accountHeader.getByRole('button').click()
+  await sorted
+  await expect(usersPage.locator('tbody')).toContainText('admin')
+  await search.press('Enter')
+  await expect(usersPage.locator('tbody')).not.toContainText('admin')
+  const reset = page.waitForResponse(response => new URL(response.url()).pathname.endsWith('/admin/users/list'))
+  await usersPage.getByTestId('users-filters').getByRole('button', { name: /^(重置|Reset|リセット)$/ }).click()
+  await reset
+  await expect(search).toHaveValue('')
+  await expect(usersPage.locator('tbody')).toContainText('admin')
+  for (const width of [390, 1440, 1920, 2560, 3840]) {
+    await page.setViewportSize({ width, height: 900 })
+    expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+    await expect(usersPage.locator('.hai-pagination__navigation')).toBeVisible()
+    await capture(page, `users-unified-${width}.png`, testInfo.outputPath(`users-unified-${width}.png`))
+  }
+})
+
+test('branded authentication, profile layout and blur validation work across screen sizes', async ({ page }, testInfo) => {
+  test.setTimeout(60_000)
+  await page.setViewportSize({ width: 1440, height: 960 })
+  await page.goto('./')
+  await expect(page.getByRole('heading', { name: configuredName, exact: true })).toBeVisible()
+  await expect(page.locator('header')).toBeVisible()
+  await expect(page.locator('footer')).toBeVisible()
+  await capture(page, '{{projectName}}-login-desktop.png', testInfo.outputPath('login-desktop.png'))
+  await page.getByRole('button', { name: /立即注册|Register now/, exact: true }).click()
+  await expect(page.locator('.register-form')).toBeVisible()
+  await capture(page, '{{projectName}}-register-desktop.png', testInfo.outputPath('register-desktop.png'))
+  await page.setViewportSize({ width: 390, height: 844 })
+  await capture(page, '{{projectName}}-register-mobile.png', testInfo.outputPath('register-mobile.png'))
+  expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+  await page.reload()
+  await expect(page.getByTestId('login-form')).toBeVisible()
+  await capture(page, '{{projectName}}-login-mobile.png', testInfo.outputPath('login-mobile.png'))
+  await page.setViewportSize({ width: 1440, height: 960 })
+  await login(page, 'admin', adminPassword)
+  await page.getByTestId('nav-settings').click()
+  const profile = page.getByTestId('profile-form')
+  await expect(profile).toBeVisible()
+  const email = profile.locator('input[name="email"]')
+  await email.fill('invalid-email')
+  await email.press('Tab')
+  await expect(email).toHaveAttribute('aria-invalid', 'true')
+  await capture(page, '{{projectName}}-profile-blur-error.png', testInfo.outputPath('profile-blur-error.png'))
+  await email.fill('')
+  await expect(email).not.toHaveAttribute('aria-invalid')
+  await capture(page, '{{projectName}}-settings-desktop.png', testInfo.outputPath('settings-desktop.png'))
+  for (const width of [768, 390]) {
+    await page.setViewportSize({ width, height: 960 })
+    const fields = await profile.locator('.hai-form-field').evaluateAll(elements => elements.map((field) => {
+      const label = field.querySelector('label')!.getBoundingClientRect()
+      const control = field.querySelector('input')!.getBoundingClientRect()
+      return { labelBottom: label.bottom, controlTop: control.top, controlRight: control.right }
+    }))
+    for (const field of fields) {
+      expect(field.labelBottom).toBeLessThanOrEqual(field.controlTop)
+      expect(field.controlRight).toBeLessThanOrEqual(width)
+    }
+    expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+    await capture(page, `{{projectName}}-settings-${width}.png`, testInfo.outputPath(`settings-${width}.png`))
+  }
+  await page.getByTestId('password-form').scrollIntoViewIfNeeded()
+  await capture(page, '{{projectName}}-password-mobile.png', testInfo.outputPath('password-mobile.png'))
+  await page.setViewportSize({ width: 1440, height: 960 })
+  await page.getByTestId('nav-users').click()
+  await page.getByTestId('create-user').click()
+  const username = page.getByTestId('user-username').locator('input')
+  await username.focus()
+  await username.press('Tab')
+  await expect(username).not.toHaveAttribute('aria-invalid')
+  await username.fill('draft')
+  await username.fill('')
+  await username.press('Tab')
+  await expect(username).toHaveAttribute('aria-invalid', 'true')
+  await username.fill('a')
+  await expect(username).toHaveAttribute('aria-invalid', 'true')
+  await page.getByTestId('user-password').locator('input').fill('short')
+  await page.getByTestId('user-password').locator('input').press('Tab')
+  await expect(page.getByTestId('user-password').locator('input')).toHaveAttribute('aria-invalid', 'true')
+  await capture(page, '{{projectName}}-create-blur-error.png', testInfo.outputPath('create-blur-error.png'))
+  await page.getByTestId('user-editor').getByRole('button', { name: /取消|Cancel/, exact: true }).click()
+  await page.getByTestId('create-user').click()
+  await expect(page.getByTestId('user-editor').locator('[aria-invalid="true"]')).toHaveCount(0)
+  await page.getByTestId('user-editor').getByRole('button', { name: /取消|Cancel/, exact: true }).click()
+  await userEditor(page, 'admin')
+  const editEmail = page.getByTestId('user-email').locator('input')
+  await editEmail.fill('invalid-email')
+  await editEmail.press('Tab')
+  await expect(editEmail).toHaveAttribute('aria-invalid', 'true')
+  await capture(page, '{{projectName}}-edit-blur-error.png', testInfo.outputPath('edit-blur-error.png'))
+  await editEmail.fill('admin@example.com')
+  await expect(editEmail).not.toHaveAttribute('aria-invalid')
+})
+
+test('first-use tour, help search and settings navigation work on desktop and mobile', async ({ page }, testInfo) => {
+  await page.goto('./')
+  await login(page, 'admin', adminPassword, true)
+  await expect(page.getByTestId('guide-offer')).toBeVisible()
+  await page.getByTestId('guide-start').click()
+  const popover = page.locator('.hai-guide-popover')
+  await expect(popover).toBeVisible()
+  await capture(page, '{{projectName}}-guide-desktop.png', testInfo.outputPath('guide-desktop.png'))
+  for (let step = 1; step < 3; step++) {
+    await popover.locator('.driver-popover-next-btn').click()
+    await expect(popover.locator('.driver-popover-progress-text')).toContainText(String(step + 1))
+  }
+  await popover.locator('.driver-popover-next-btn').click()
+  await expect(popover).toHaveCount(0)
+  await page.reload()
+  await expect(page.getByTestId('admin-help')).toBeVisible()
+  await expect(page.getByTestId('guide-offer')).toHaveCount(0)
+  await page.getByTestId('admin-help').click()
+  const profileTitle = (await page.getByTestId('guide-article-profile').textContent())!.trim()
+  await page.getByTestId('guide-search').locator('input').fill(profileTitle)
+  await expect(page.getByTestId('guide-article-profile')).toBeVisible()
+  await expect(page.getByTestId('guide-article-overview')).toHaveCount(0)
+  await page.getByTestId('guide-article-start').click()
+  await expect(page.getByTestId('settings-page')).toBeVisible()
+  await expect(popover).toBeVisible()
+  await page.keyboard.press('Escape')
+  await expect(popover).toHaveCount(0)
+  await page.setViewportSize({ width: 390, height: 844 })
+  await page.getByTestId('admin-help').click()
+  await expect(page.getByTestId('help-center')).toBeVisible()
+  expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+  await capture(page, '{{projectName}}-guide-help-mobile.png', testInfo.outputPath('guide-help-mobile.png'))
+  await page.getByTestId('guide-tour-overview').click()
+  await expect(popover.locator('.driver-popover-next-btn')).toBeEnabled()
+  // 下一步未渲染时仍能通过宿主提示取消，不能被引擎遮罩阻止。
+  await page.locator('[data-guide="admin-profile"]').evaluate(element => element.removeAttribute('data-guide'))
+  await popover.locator('.driver-popover-next-btn').click()
+  await expect(page.getByTestId('guide-loading')).toBeVisible()
+  await page.getByTestId('guide-cancel').click()
+  await expect(popover).toHaveCount(0)
+  await expect(page.getByTestId('guide-error')).toHaveCount(0)
+})
+
+// 所有已生成的浏览器前端都验证共享引导，不能用 Web 的成功代替 App/Desktop 预览。
+const additionalFrontends = [
+{{#each fullstack.frontendApps}}
+  {
+    target: '{{target}}',
+    url: process.env['HAI_E2E_{{target}}_URL'.toUpperCase()] || 'http://127.0.0.1:{{port}}',
+  },
+{{/each}}
+].filter(frontend => frontend.target !== '{{fullstack.e2eFrontend.target}}')
+
+for (const frontend of additionalFrontends) {
+  test(`${frontend.target} preview supports login, tour, help and profile navigation`, async ({ browser }, testInfo) => {
+    const page = await browser.newPage({ viewport: frontend.target === 'app' ? { width: 390, height: 844 } : { width: 1440, height: 960 } })
+    const pageErrors: string[] = []
+    page.on('pageerror', error => pageErrors.push(error.message))
+    try {
+      await page.goto(frontend.url)
+      await expect(page.getByTestId('login-form')).toBeVisible()
+      await capture(page, `{{projectName}}-${frontend.target}-login.png`, testInfo.outputPath(`${frontend.target}-login.png`))
+      await login(page, 'admin', adminPassword, true)
+      await expect(page.getByTestId('guide-offer')).toBeVisible()
+      await page.getByTestId('guide-start').click()
+      const popover = page.locator('.hai-guide-popover')
+      await expect(popover).toBeVisible()
+      await capture(page, `{{projectName}}-${frontend.target}-guide.png`, testInfo.outputPath(`${frontend.target}-guide.png`))
+      await page.keyboard.press('Escape')
+      await expect(popover).toHaveCount(0)
+      await page.getByTestId('admin-help').click()
+      await expect(page.getByTestId('help-center')).toBeVisible()
+      expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+      await capture(page, `{{projectName}}-${frontend.target}-help.png`, testInfo.outputPath(`${frontend.target}-help.png`))
+      await page.getByTestId('guide-article-profile').click()
+      await page.getByTestId('guide-article-start').click()
+      await expect(page.getByTestId('settings-page')).toBeVisible()
+      await expect(popover).toBeVisible()
+      await page.keyboard.press('Escape')
+      await expect(popover).toHaveCount(0)
+      await capture(page, `{{projectName}}-${frontend.target}-profile.png`, testInfo.outputPath(`${frontend.target}-profile.png`))
+      expect(pageErrors).toEqual([])
+    }
+    finally {
+      await page.close()
+    }
+  })
+}
+
+test('shared authentication supports public registration with configuration', async ({ page }) => {
+  test.setTimeout(90_000)
+  const evidence = process.env.HAI_AUTH_EVIDENCE_DIR || path.resolve('test-results/auth-screenshots')
+  await mkdir(evidence, { recursive: true })
+  await page.goto('./')
+  await expect(page.getByTestId('login-form')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-login.png'), fullPage: true })
+  await page.getByRole('button', { name: /立即注册|Register now/i }).click()
+  const registerForm = page.locator('.register-form')
+  await expect(registerForm.locator('#register-username')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-register.png'), fullPage: true })
+  const username = `signup${randomUUID().replaceAll('-', '').slice(0, 12)}`
+  await registerForm.locator('#register-username').fill(username)
+  await registerForm.locator('#register-email').fill(`${username}@example.com`)
+  await registerForm.locator('#register-password').fill('SignupPassword123')
+  await registerForm.locator('#register-confirm-password').fill('SignupPassword123')
+  await registerForm.locator('button[type="submit"]').click()
+  await expect(page.getByTestId('settings-page')).toBeVisible()
+  expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+  if (!process.env.IAM_NOTIFICATION_URL)
+    return
+  const email = `${username}@example.com`
+  await page.getByTestId('logout').click()
+  await page.getByRole('button', { name: /邮件验证码|Email code/i, exact: true }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-email.png'), fullPage: true })
+  await page.locator('#login-username').fill(email)
+  await page.getByRole('button', { name: /发送验证码|Send code/i, exact: true }).click()
+  await expect(page.getByRole('button', { name: /秒后重发|Resend in/ })).toBeDisabled()
+  async function received(template: string) {
+    const response = await page.request.get(`${process.env.IAM_NOTIFICATION_URL}/messages?to=${encodeURIComponent(email)}`)
+    const messages = await response.json() as { template: string, vars: Record<string, string> }[]
+    return messages.findLast(item => item.template === template)?.vars
+  }
+  const otp = await received('otp_email')
+  expect(Boolean(otp?.code)).toBe(true)
+  await page.locator('#login-code').fill(otp?.code ?? '')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.getByTestId('settings-page')).toBeVisible()
+  await page.getByTestId('logout').click()
+  await page.getByRole('button', { name: /忘记密码|Forgot password/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-forgot.png'), fullPage: true })
+  await page.locator('input[type="email"]').fill(email)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.hai-toast-item[data-variant="success"]')).toBeVisible()
+  const reset = await received('password_reset')
+  expect(Boolean(reset?.token)).toBe(true)
+  await page.getByRole('button', { name: /已有重置令牌|I have a reset token/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-reset.png'), fullPage: true })
+  await page.goto(`./?token=${encodeURIComponent(reset?.token ?? '')}`)
+  await expect(page.locator('input[type="password"]').nth(0)).toBeVisible()
+  await page.locator('input[type="password"]').nth(0).fill('FullstackReset456')
+  await page.locator('input[type="password"]').nth(1).fill('FullstackReset456')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.hai-toast-item[data-variant="success"]')).toBeVisible()
+  await page.getByRole('button', { name: /^(登录|Sign in|Login)$/i }).click()
+  await login(page, username, 'FullstackReset456')
+  await expect(page.getByTestId('settings-page')).toBeVisible()
+  expect(new URL(page.url()).searchParams.has('token')).toBe(false)
+  await page.reload()
+  await expect(page.getByTestId('settings-page')).toBeVisible()
+})
+
+test('frontend displays configured core metadata and restores the administrator session', async ({ page }, testInfo) => {
+  await page.goto('./')
+  await expect(page.getByTestId('app-name')).toHaveText(configuredName)
+  await expect(page).toHaveTitle(configuredName)
+  await expect(page.getByTestId('app-version')).toHaveText(`v${configuredVersion}`)
+  await expect(page.getByTestId('app-environment')).toHaveText(configuredEnv)
+  await login(page, 'admin', adminPassword)
+  await expect(page.getByTestId('users-page')).toBeVisible()
+  await page.reload()
+  await expect(page.getByTestId('users-page')).toBeVisible()
+  await expect(page.getByTestId('nav-roles')).toBeVisible()
+  await expect(page.getByTestId('nav-audit')).toHaveCount(0)
+  await expect(page.getByTestId('nav-configuration')).toHaveCount(0)
+  const evidence = process.env.HAI_AUTH_EVIDENCE_DIR
+  if (evidence)
+    await mkdir(evidence, { recursive: true })
+  await page.screenshot({ path: evidence ? path.join(evidence, '{{projectName}}-users.png') : testInfo.outputPath('users.png'), fullPage: true })
+  await page.getByTestId('logout').click()
+  await expect(page.getByTestId('login-form')).toBeVisible()
+})
+
+test('auditor reauthentication produces a verifiable private archive', async ({ page }, testInfo) => {
+  await page.goto('./')
+  await login(page, 'audit_admin', auditAdminPassword)
+  await expect(page.getByTestId('nav-users')).toHaveCount(0)
+  await expect(page.getByTestId('nav-configuration')).toHaveCount(0)
+  await page.getByTestId('nav-audit').click()
+  await page.getByTestId('audit-backup').click()
+  const confirmation = page.getByTestId('reauthentication-form')
+  await expect(confirmation).toBeVisible()
+  await capture(page, '{{projectName}}-reauthentication-dialog.png', testInfo.outputPath('reauthentication-dialog.png'))
+  await confirmation.getByRole('button', { name: /取消|Cancel|キャンセル/ }).click()
+  await expect(confirmation).not.toBeVisible()
+  await expect(page.getByTestId('audit-backup-receipt')).not.toBeVisible()
+  await dismissToasts(page)
+  await page.getByTestId('audit-backup').click()
+  await page.getByTestId('reauthentication-password').locator('input').fill('Incorrect-test-password!')
+  await confirmation.locator('button[type=submit]').click()
+  await expect(page.locator('.hai-toast-item[data-variant=error]')).toBeVisible()
+  await expect(page.locator('.hai-toast-item[data-variant=error]')).toContainText(/用户名或密码不正确|Username or password is incorrect|ユーザー名またはパスワード/)
+  await expect(confirmation.locator('.alert-error')).toHaveCount(0)
+  await expect(page.locator('.hai-toast-item[data-variant=error]')).toBeInViewport({ ratio: 1 })
+  await expect(page.getByTestId('audit-backup-receipt')).not.toBeVisible()
+  await capture(page, '{{projectName}}-reauthentication-error.png', testInfo.outputPath('reauthentication-error.png'))
+  await page.setViewportSize({ width: 390, height: 960 })
+  await expect(page.locator('.hai-toast-item[data-variant=error]')).toBeInViewport({ ratio: 1 })
+  await capture(page, '{{projectName}}-reauthentication-error-390.png', testInfo.outputPath('reauthentication-error-390.png'))
+  await dismissToasts(page)
+  await page.setViewportSize({ width: 1440, height: 960 })
+  await page.getByTestId('reauthentication-password').locator('input').fill(auditAdminPassword)
+  await confirmation.locator('button[type=submit]').click()
+  const receipt = page.getByTestId('audit-backup-receipt')
+  await expect(receipt).toBeVisible()
+  await expect(receipt).toContainText(/SHA-256: [a-f0-9]{64}/)
+  await capture(page, '{{projectName}}-audit-backup-receipt.png', testInfo.outputPath('audit-backup-receipt.png'))
+  const key = (await receipt.textContent())?.match(/hai-private\/audit-backups\/[\w-]+\.jsonl/)?.[0]
+  expect(key).toBeTruthy()
+  const exposed = await page.request.get(`${apiBaseUrl}${apiPrefix}/assets/${key}`)
+  expect(exposed.status()).toBe(404)
+})
+
+test('one-time invitation completes password setup through the configured notification', async ({ page, browser }) => {
+  test.skip(!process.env.IAM_NOTIFICATION_URL, 'Requires the owned notification fixture')
+  test.setTimeout(90000)
+  const username = `invited-${randomUUID().slice(0, 8)}`
+  const email = `${username}@example.test`
+  await page.goto('./')
+  await login(page, 'admin', adminPassword)
+  await page.getByTestId('invite-user').click()
+  await page.getByTestId('user-username').locator('input').fill(username)
+  await page.getByTestId('user-email').locator('input').fill(email)
+  await page.getByTestId('user-save').click()
+  const confirmation = page.getByTestId('reauthentication-form')
+  await expect(confirmation).toBeVisible()
+  await page.getByTestId('reauthentication-password').locator('input').fill(adminPassword)
+  await confirmation.locator('button[type=submit]').click()
+  await expect(page.getByTestId('user-editor')).not.toBeVisible()
+  const notified = await page.request.get(`${process.env.IAM_NOTIFICATION_URL}/messages?to=${encodeURIComponent(email)}`)
+  const messages = await notified.json() as { template: string, vars: Record<string, string> }[]
+  const token = messages.findLast(item => item.template === 'password_reset')?.vars.token
+  expect(token).toBeTruthy()
+  const context = await browser.newContext()
+  try {
+    const receiver = await context.newPage()
+    await receiver.goto(`./?token=${encodeURIComponent(token ?? '')}`)
+    const passwords = receiver.locator('input[type=password]')
+    await passwords.nth(0).fill('Invited-Setup-123!')
+    await passwords.nth(1).fill('Invited-Setup-123!')
+    await receiver.locator('button[type=submit]').click()
+    await expect(receiver.locator('.hai-toast-item[data-variant="success"]')).toBeVisible()
+    await receiver.getByRole('button', { name: /^(登录|Sign in|Login)$/i }).click()
+    await login(receiver, username, 'Invited-Setup-123!')
+    await expect(receiver.getByTestId('settings-page')).toBeVisible()
+    await expect(receiver.getByTestId('nav-users')).toHaveCount(0)
+  }
+  finally { await context.close() }
+})
+
+test('business configuration is isolated and the public notice reaches other duties', async ({ page }) => {
+  await page.goto('./')
+  await login(page, 'config_admin', configAdminPassword)
+  await expect(page.getByTestId('nav-users')).toHaveCount(0)
+  await expect(page.getByTestId('nav-audit')).toHaveCount(0)
+  await page.getByTestId('nav-configuration').click()
+  await expect(page.getByTestId('configuration-page')).toBeVisible()
+  await page.getByTestId('business-notice-input').locator('textarea').fill('Configured business notice')
+  await page.getByTestId('configuration-page').getByRole('button', { name: /保存|Save/, exact: true }).click()
+  await expect(page.getByTestId('business-notice')).toHaveText('Configured business notice')
+  await page.getByTestId('logout').click()
+  await login(page, 'admin', adminPassword)
+  await expect(page.getByTestId('nav-configuration')).toHaveCount(0)
+  await expect(page.getByTestId('business-notice')).toHaveText('Configured business notice')
+})
+
+test('audit filters collapse without losing values and fit compact workspaces', async ({ page }, testInfo) => {
+  await page.goto('./')
+  await login(page, 'audit_admin', auditAdminPassword)
+  await page.getByTestId('nav-audit').click()
+  await expect(page.getByTestId('audit-page')).toBeVisible()
+  const timeHeader = page.getByTestId('audit-page').locator('th').first()
+  await timeHeader.getByRole('button').click()
+  await expect(timeHeader).toHaveAttribute('aria-sort', 'ascending')
+  const filters = page.getByTestId('audit-filters')
+  const toggle = filters.locator('button[aria-controls]')
+  await expect(toggle).toHaveAttribute('aria-expanded', 'false')
+  await expect(page.getByTestId('audit-resource')).toBeHidden()
+  await toggle.click()
+  const resource = page.getByTestId('audit-resource').locator('input')
+  await resource.fill('retained-filter')
+  await toggle.click()
+  await expect(resource).toBeHidden()
+  await toggle.press('Space')
+  await expect(resource).toHaveValue('retained-filter')
+  await expect(page.locator('header h1')).toHaveCount(1)
+  await expect(page.getByTestId('audit-page').locator('h1')).toHaveCount(0)
+  for (const width of [1440, 1920, 2560, 3840, 960, 390, 320]) {
+    await page.setViewportSize({ width, height: 900 })
+    if (width < 1024)
+      await expect.poll(() => page.locator('aside').evaluate(sidebar => sidebar.getBoundingClientRect().right)).toBeLessThanOrEqual(1)
+    const controls = await page.getByTestId('audit-advanced').evaluate(panel => [...panel.querySelectorAll('input')].map((element) => {
+      // 复合控件的点击框包含边框和留白，内部文字输入区不等于完整控件高度。
+      const control = element.closest('.fieldset') ? element.parentElement! : element
+      const rect = control.getBoundingClientRect()
+      return { left: rect.left, right: rect.right, height: rect.height }
+    }))
+    expect(controls.length).toBeGreaterThan(2)
+    for (const control of controls) {
+      expect(control.height).toBeGreaterThanOrEqual(28)
+      expect(control.left).toBeGreaterThanOrEqual(0)
+      expect(control.right).toBeLessThanOrEqual(width)
+    }
+    expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+    if (width === 1440 || width === 390) {
+      const evidence = process.env.HAI_AUTH_EVIDENCE_DIR
+      if (evidence)
+        await mkdir(evidence, { recursive: true })
+      const file = `{{projectName}}-audit-${width}.png`
+      await page.screenshot({ path: evidence ? path.join(evidence, file) : testInfo.outputPath(file), fullPage: true, animations: 'disabled' })
+    }
+  }
+  const reset = page.waitForResponse(response => new URL(response.url()).pathname.endsWith('/admin/audit/list'))
+  await filters.getByRole('button', { name: /重置|Reset|リセット/, exact: true }).click()
+  await reset
+  await expect(resource).toHaveValue('')
+  await page.getByTestId('audit-category').getByRole('combobox').click()
+  await page.getByRole('option', { name: /系统|System|システム/ }).click()
+  const filtered = page.waitForResponse(response => new URL(response.url()).pathname.endsWith('/admin/audit/list')).then(async (response) => {
+    expect(response.status()).toBe(200)
+    await response.body()
+  })
+  await page.getByTestId('audit-action').locator('input').press('Enter')
+  await filtered
+  await expect(page.getByTestId('audit-page').getByRole('cell', { name: 'system', exact: true }).first()).toBeVisible()
+  const categories = await page.getByTestId('audit-page').locator('tbody tr').evaluateAll(rows => rows.map(row => row.querySelectorAll('td')[3]?.textContent?.trim()))
+  expect(new Set(categories)).toEqual(new Set(['system']))
+  await toggle.click()
+  await page.getByTestId('audit-page').getByRole('button', { name: /详情|Details/ }).first().click()
+  await expect(page.getByRole('dialog')).toBeVisible()
+  await page.screenshot({ path: testInfo.outputPath('audit-short-table-details.png'), fullPage: true, animations: 'disabled' })
+})
+
+test('administrator manages every duty through one lifecycle and the shared password reset form', async ({ page, browser }, testInfo) => {
+  test.setTimeout(120_000)
+  const username = `duty-${randomUUID().slice(0, 8)}`
+  const password = 'Duty-test-Pass123!'
+  const newPassword = 'Reset-test-Pass456!'
+  await page.goto('./')
+  await login(page, 'admin', adminPassword)
+  await page.getByTestId('create-user').click()
+  await page.getByTestId('user-role').click()
+  const roleOptions = page.getByRole('option')
+  await expect(roleOptions).toHaveCount(5)
+  await expect(roleOptions.filter({ hasText: /系统管理员|System administrator/ })).toHaveCount(1)
+  await expect(roleOptions.filter({ hasText: /审计管理员|Audit administrator/ })).toHaveCount(1)
+  await expect(roleOptions.filter({ hasText: /配置管理员|Configuration administrator/ })).toHaveCount(1)
+  await capture(page, 'account-role-choices.png', testInfo.outputPath('account-role-choices.png'))
+  await roleOptions.filter({ hasText: /审计管理员|Audit administrator/ }).click()
+  await page.getByTestId('user-username').locator('input').fill(username)
+  await page.getByTestId('user-display-name').locator('input').fill('Account policy example')
+  await page.getByTestId('user-password').locator('input').fill(password)
+  await page.getByTestId('user-save').click()
+  await expect(page.getByTestId('user-editor')).not.toBeVisible()
+  await userEditor(page, username)
+  await page.getByTestId('user-role').click()
+  await page.getByRole('option', { name: /配置管理员|Configuration administrator/ }).click()
+  await page.getByTestId('account-state').click()
+  await expect(page.getByRole('option')).toHaveCount(3)
+  await capture(page, 'account-lifecycle-options.png', testInfo.outputPath('account-lifecycle-options.png'))
+  await page.getByRole('option', { name: /^(休眠|Dormant|休止)$/ }).click()
+  await page.getByTestId('user-save').click()
+  await expect(page.getByTestId('user-editor')).not.toBeVisible()
+  const row = page.getByRole('row').filter({ hasText: username })
+  await expect(row).toContainText(/休眠|Dormant/)
+  await dismissToasts(page)
+  await row.getByTestId('reset-user-password').click()
+  const dialog = page.getByTestId('password-reset-dialog')
+  await expect(dialog).toBeVisible()
+  await expect(dialog.locator('#old-password')).toHaveCount(0)
+  await capture(page, 'account-password-reset.png', testInfo.outputPath('account-password-reset.png'))
+  await dialog.locator('#new-password').fill(newPassword)
+  await dialog.locator('#confirm-password').fill(`${newPassword}different`)
+  await expect(page.locator('.hai-toast-item[data-variant=error]')).toContainText(/不一致|match|一致/)
+  await expect(dialog.locator('button[type=submit]')).toBeDisabled()
+  await dialog.locator('#confirm-password').fill(newPassword)
+  await dismissToasts(page)
+  await dialog.locator('button[type=submit]').click()
+  await expect(dialog).not.toBeVisible()
+  await expect(row).toContainText(/休眠|Dormant/)
+  await expect(page.getByTestId('notice')).toContainText(/密码已重置|Password reset/)
+  await capture(page, 'account-password-reset-success.png', testInfo.outputPath('account-password-reset-success.png'))
+
+  const context = await browser.newContext()
+  const target = await context.newPage()
+  try {
+    await target.goto('./')
+    await submitLogin(target, username, newPassword)
+    const accountError = target.locator('.hai-toast-item[data-variant=error]')
+    // 公开登录不透露休眠状态；管理员在账号列表查看具体状态。
+    await expect(accountError).toContainText(/用户名或密码不正确|Username or password is incorrect|ユーザー名またはパスワード/i)
+    await expect(target.getByTestId('login-form')).toBeVisible()
+    await userEditor(page, username)
+    await page.getByTestId('account-state').click()
+    await page.getByRole('option', { name: /^(激活|Active|有効)$/ }).click()
+    await page.getByTestId('user-save').click()
+    await expect(page.getByTestId('user-editor')).not.toBeVisible()
+    await submitLogin(target, username, password)
+    await expect(target.locator('.hai-toast-item[data-variant=error]')).toContainText(/不正确|incorrect/i)
+    await login(target, username, newPassword)
+    await expect(target.getByTestId('nav-configuration')).toBeVisible()
+    await expect(target.getByTestId('nav-users')).toHaveCount(0)
+    await expect(target.getByTestId('nav-audit')).toHaveCount(0)
+  }
+  finally { await context.close() }
+
+  await page.setViewportSize({ width: 390, height: 844 })
+  await expect(page.getByTestId('user-cards')).toBeVisible()
+  await expect.poll(() => page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+  await capture(page, 'account-lifecycle-mobile.png', testInfo.outputPath('account-lifecycle-mobile.png'))
+  await page.setViewportSize({ width: 1440, height: 960 })
+  await row.getByRole('button', { name: /删除|Delete/, exact: true }).click()
+  await page.getByTestId('confirm-delete-user').click()
+  await expect(row).toHaveCount(0)
+})
+
+test('administrator and user complete account, avatar, preference, password and audit workflows', async ({ page, browser }) => {
+  test.setTimeout(120_000)
+  const username = `member-${randomUUID().slice(0, 8)}`
+  const password = 'User-test-Pass123!'
+  const newPassword = 'Changed-test-Pass123!'
+  const encryptedRequests: string[] = []
+  const encryptedResponses: string[] = []
+  page.on('request', (request) => {
+    if (request.url().includes(`${apiPrefix}/`) && !request.url().includes('/_hai/') && request.postData()) {
+      expect(request.headers()['x-encrypted']).toBe('true')
+      expect(request.postData()).not.toContain('"password"')
+      expect(request.postData()).not.toContain(adminPassword)
+      encryptedRequests.push(request.url())
+    }
+  })
+  page.on('response', (response) => {
+    if (response.request().method() !== 'OPTIONS' && response.url().includes(`${apiPrefix}/`) && !response.url().includes('/_hai/') && !response.url().includes('/assets/')) {
+      expect(response.headers()['x-encrypted']).toBe('true')
+      encryptedResponses.push(response.url())
+    }
+  })
+  await page.goto('./')
+  await login(page, 'admin', adminPassword)
+  await expect(page.getByTestId('users-page')).toBeVisible()
+  await page.getByTestId('create-user').click()
+  await expect(page.getByRole('dialog', { name: /新增用户|New user|Create user|Add user/ })).toBeVisible()
+  await expect(page.getByTestId('user-username').locator('input')).toBeFocused()
+  await page.getByTestId('user-username').locator('input').fill(username)
+  await page.getByTestId('user-display-name').locator('input').fill('Test member')
+  await page.getByTestId('user-email').locator('input').fill(`${username}@example.com`)
+  await page.getByTestId('user-password').locator('input').fill(password)
+  await page.getByTestId('user-save').click()
+  await expect(page.getByTestId('user-editor')).not.toBeVisible()
+  const userRow = page.getByRole('row').filter({ hasText: username })
+  await expect(userRow).toBeVisible()
+  await userRow.getByTestId('user-avatar-input').setInputFiles({ name: 'avatar.png', mimeType: 'image/png', buffer: avatar })
+  await expect(userRow.locator('img')).toHaveAttribute('src', /\/assets\/avatars\//)
+  await expect.poll(() => userRow.locator('img').evaluate((image: HTMLImageElement) => image.complete && image.naturalWidth > 0)).toBe(true)
+  await page.getByTestId('nav-roles').click()
+  await expect(page.getByTestId('roles-page')).toBeVisible()
+  await page.getByTestId('roles-page').getByRole('button', { name: /编辑说明|Edit description/ }).first().click()
+  await page.getByTestId('role-description').locator('textarea').fill('Workspace administration')
+  await page.getByRole('dialog').getByRole('button', { name: /保存|Save/, exact: true }).focus()
+  await page.keyboard.press('Tab')
+  await expect(page.getByRole('dialog').getByRole('button', { name: /关闭|Close/, exact: true })).toBeFocused()
+  await page.keyboard.press('Shift+Tab')
+  await expect(page.getByRole('dialog').getByRole('button', { name: /保存|Save/, exact: true })).toBeFocused()
+  await page.getByRole('dialog').getByRole('button', { name: /保存|Save/, exact: true }).click()
+  await expect(page.getByTestId('roles-page')).toContainText('Workspace administration')
+
+  const userContext = await browser.newContext()
+  const userPage = await userContext.newPage()
+  try {
+    await userPage.goto('./')
+    await login(userPage, username, password)
+    await expect(userPage.getByTestId('settings-page')).toBeVisible()
+    await expect(userPage.getByTestId('nav-users')).toHaveCount(0)
+    await expect(userPage.getByTestId('nav-roles')).toHaveCount(0)
+    await expect(userPage.getByTestId('nav-audit')).toHaveCount(0)
+    await userPage.getByTestId('profile-form').locator('input[name="displayName"]').fill('Updated member')
+    await userPage.getByTestId('profile-form').locator('input[name="email"]').fill('')
+    await userPage.getByTestId('profile-form').getByRole('button', { name: /保存|Save/, exact: true }).click()
+    await expect(userPage.getByTestId('notice')).toBeVisible()
+    await userPage.getByTestId('profile-form').locator('input[type="file"]').setInputFiles({ name: 'personal.png', mimeType: 'image/png', buffer: avatar })
+    await expect(userPage.getByTestId('notice')).toHaveText(/头像已更新|Avatar updated/)
+    await userPage.getByTestId('profile-language').click()
+    await userPage.getByRole('option', { name: 'English', exact: true }).click()
+    await expect(userPage.getByTestId('nav-settings')).toHaveText('Personal settings')
+    await expect(userPage.locator('html')).toHaveAttribute('lang', 'en-US')
+    const themes = [{{#each fullstack.theme.themes}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}]
+    const selectedTheme = themes.includes('formal') ? 'formal' : themes.includes('high-contrast') ? 'high-contrast' : themes.find(theme => theme !== '{{fullstack.theme.defaultTheme}}') ?? themes[0]
+    await userPage.getByTestId('profile-theme').click()
+    await userPage.getByRole('option').nth(themes.indexOf(selectedTheme)).click()
+    await expect(userPage.locator('html')).toHaveAttribute('data-theme', selectedTheme)
+    if (selectedTheme === 'high-contrast')
+      await expect.poll(() => userPage.evaluate(() => getComputedStyle(document.documentElement).colorScheme)).toBe('dark')
+    await userPage.reload()
+    await expect(userPage.getByTestId('settings-page')).toBeVisible()
+    await expect(userPage.getByTestId('nav-settings')).toHaveText('Personal settings')
+    await expect(userPage.locator('html')).toHaveAttribute('data-theme', selectedTheme)
+    await expect(userPage.getByTestId('profile-form').locator('input[name="displayName"]')).toHaveValue('Updated member')
+    await expect(userPage.getByTestId('profile-form').locator('input[name="email"]')).toHaveValue('')
+    await expect.poll(() => userPage.getByTestId('profile-form').locator('img').evaluate((image: HTMLImageElement) => image.complete && image.naturalWidth > 0)).toBe(true)
+    await userPage.getByTestId('profile-language').click()
+    await userPage.getByRole('option', { name: '日本語', exact: true }).click()
+    await expect(userPage.getByTestId('nav-settings')).toHaveText('個人設定')
+    await expect(userPage.locator('html')).toHaveAttribute('lang', 'ja-JP')
+    await userPage.reload()
+    await expect(userPage.getByTestId('nav-settings')).toHaveText('個人設定')
+    await expect(userPage.locator('html')).toHaveAttribute('lang', 'ja-JP')
+    await userPage.getByTestId('profile-language').click()
+    await userPage.getByRole('option', { name: 'English', exact: true }).click()
+    await expect(userPage.getByTestId('nav-settings')).toHaveText('Personal settings')
+    await userPage.setViewportSize({ width: 390, height: 844 })
+    await expect.poll(() => userPage.evaluate(() => document.documentElement.scrollWidth <= window.innerWidth)).toBe(true)
+    await userPage.getByTestId('mobile-menu').click()
+    await expect(userPage.getByTestId('nav-settings')).toBeVisible()
+    await userPage.getByTestId('nav-settings').click()
+    const passwordInputs = userPage.getByTestId('password-form').locator('input[type="password"]')
+    await passwordInputs.nth(0).fill(password)
+    await passwordInputs.nth(1).fill(password)
+    await passwordInputs.nth(2).fill(password)
+    await dismissToasts(userPage)
+    await userPage.getByTestId('password-form').getByRole('button', { name: /Change password/i }).click()
+    await expect(userPage.getByTestId('settings-page')).toBeVisible()
+    await expect(userPage.locator('.hai-toast-item[data-variant=error]')).toContainText(/相同|different from|異なる/i)
+    await dismissToasts(userPage)
+    await passwordInputs.nth(1).fill(newPassword)
+    await passwordInputs.nth(2).fill(newPassword)
+    await userPage.getByTestId('password-form').getByRole('button', { name: /Change password/i }).click()
+    await expect(userPage.getByTestId('login-form')).toBeVisible()
+    await submitLogin(userPage, username, password)
+    await expect(userPage.locator('.hai-toast-item[data-variant=error]')).toContainText(/不正确|incorrect/i)
+    await login(userPage, username, newPassword)
+    await expect(userPage.getByTestId('settings-page')).toBeVisible()
+
+    await page.getByTestId('nav-users').click()
+    await userEditor(page, username)
+    await page.getByTestId('account-state').click()
+    await page.getByRole('option', { name: /^(休眠|Dormant|休止)$/ }).click()
+    await page.getByTestId('user-save').click()
+    await expect(page.getByTestId('user-editor')).not.toBeVisible()
+    await userPage.getByTestId('profile-form').getByRole('button', { name: 'Save', exact: true }).click()
+    const recovery = userPage.getByTestId('session-recovery-dialog')
+    await expect(recovery).toBeVisible()
+    // 休眠账号不能以正确密码恢复旧操作；原地登录不放松账号状态控制。
+    const recoveryLogin = recovery.locator('form.login-form')
+    await dismissToasts(userPage)
+    await recoveryLogin.locator('input[type=password]').fill(newPassword)
+    await recoveryLogin.locator('button[type=submit]').click()
+    await expect(userPage.locator('.hai-toast-item[data-variant=error]')).toBeVisible()
+    await expect(recovery).toBeVisible()
+    await recovery.getByRole('button', { name: /Sign in later|稍后登录/ }).click()
+  }
+  finally {
+    await userContext.close()
+  }
+
+  await page.getByRole('row').filter({ hasText: username }).getByRole('button', { name: /删除|Delete/, exact: true }).click()
+  await page.getByTestId('confirm-delete-user').click()
+  await expect(page.getByRole('row').filter({ hasText: username })).toHaveCount(0)
+  await page.getByTestId('logout').click()
+  await login(page, 'audit_admin', auditAdminPassword)
+  await page.getByTestId('nav-audit').click()
+  await page.getByTestId('audit-filters').locator('button[aria-controls]').click()
+  await page.getByTestId('audit-resource').locator('input').fill('users')
+  await page.getByTestId('audit-page').locator('form').getByRole('button', { name: /查询|Search/ }).click()
+  await expect(page.getByTestId('audit-page')).toContainText('delete')
+  await page.getByTestId('audit-page').getByRole('button', { name: /详情|Details/ }).first().click()
+  await expect(page.getByRole('dialog')).toContainText(/users/)
+  expect(encryptedRequests.length).toBeGreaterThan(5)
+  expect(encryptedResponses.length).toBeGreaterThan(5)
+})
+{{/if}}
+{{#if features.feedback}}
+{{#if fullstack.e2eFrontend}}
+
+test('feedback submits an empty description and business operator can process and reopen it', async ({ page }, testInfo) => {
+  await page.goto('./')
+  await login(page, 'business_operator', businessOperatorPassword)
+  const feedbackImage = Buffer.from(await page.evaluate(() => {
+    const canvas = document.createElement('canvas')
+    canvas.width = canvas.height = 64
+    const context = canvas.getContext('2d')!
+    context.fillStyle = '#ef4444'
+    context.fillRect(0, 0, 64, 64)
+    return canvas.toDataURL('image/png').split(',')[1]!
+  }), 'base64')
+  // 大于框架默认 1 MiB 的真实日志必须经加密 HTTP 上传，并从服务端问题包逐字节取回。
+  const feedbackLog = Buffer.from('INFO feedback diagnostic: operation completed successfully\n'.repeat(36 * 1024))
+  expect(feedbackLog.byteLength).toBeGreaterThan(1024 * 1024)
+  expect(feedbackLog.byteLength).toBeLessThan(5 * 1024 * 1024)
+  await page.getByTestId('feedback-open').click()
+  const dialog = page.getByRole('dialog')
+  const desktopViewport = page.viewportSize()
+  if (!desktopViewport)
+    throw new Error('Feedback browser viewport is missing')
+  async function expectUncovered(target: typeof dialog, fractions = [0.1, 0.5, 0.9]) {
+    await expect.poll(() => target.evaluate((element, samples) => {
+      const rect = element.getBoundingClientRect()
+      return samples.every(x => samples.every((y) => {
+        const top = document.elementFromPoint(rect.left + rect.width * x, rect.top + rect.height * y)
+        return top !== null && (top === element || element.contains(top))
+      }))
+    }, fractions), { message: 'Feedback content must not be covered by the background header or table' }).toBe(true)
+  }
+  async function expectDialogViewport() {
+    await expect.poll(() => dialog.evaluate((element) => {
+      const rect = element.getBoundingClientRect()
+      return rect.left >= 0 && rect.top >= 0 && rect.right <= innerWidth && rect.bottom <= innerHeight
+    }), { message: 'The entire feedback dialog must stay inside the viewport' }).toBe(true)
+    await expectUncovered(dialog.getByRole('heading').first())
+    // 关闭按钮为圆形，采样点须位于圆内；标题与图片仍检查原有九点范围。
+    await expectUncovered(dialog.getByRole('button', { name: /关闭|Close|閉じる/ }).first(), [0.25, 0.5, 0.75])
+  }
+  await expectDialogViewport()
+  await capture(page, 'feedback-collect-desktop.png', testInfo.outputPath('feedback-collect-desktop.png'))
+  await page.setViewportSize({ width: 390, height: 844 })
+  await expectDialogViewport()
+  await capture(page, 'feedback-collect-mobile.png', testInfo.outputPath('feedback-collect-mobile.png'))
+  await page.setViewportSize(desktopViewport)
+  await expectDialogViewport()
+  await dialog.locator('summary').filter({ hasText: /更多选项|More options|その他のオプション/ }).click()
+  await dialog.locator('input[type=file]').setInputFiles([
+    { name: 'attached-preview.png', mimeType: 'image/png', buffer: feedbackImage },
+    { name: 'attached-large-log.txt', mimeType: 'text/plain', buffer: feedbackLog },
+    { name: 'discarded.txt', mimeType: 'text/plain', buffer: Buffer.from('discarded local material') },
+  ])
+  const uploaded = dialog.locator('img[alt="attached-preview.png"]')
+  await expect(uploaded).toBeVisible()
+  await uploaded.scrollIntoViewIfNeeded()
+  await expectDialogViewport()
+  await expectUncovered(uploaded)
+  await capture(page, 'feedback-image-before-mask.png', testInfo.outputPath('feedback-image-before-mask.png'))
+  await uploaded.screenshot({ path: testInfo.outputPath('feedback-image-before-mask-detail.png'), animations: 'disabled' })
+  const originalPreview = await uploaded.getAttribute('src')
+  await dialog.getByRole('button', { name: /遮挡敏感区域|Mask sensitive area|機密情報を隠す/ }).last().click()
+  await dialog.getByRole('button', { name: /应用标注|Apply annotation|注釈を適用/ }).last().click()
+  await expect(uploaded).not.toHaveAttribute('src', originalPreview ?? '')
+  // 读取烧录后的实际像素与字节，后续核对服务端 ZIP 携带的是同一张脱敏图片。
+  const maskedPreview = await uploaded.evaluate(async (image: HTMLImageElement) => {
+    await image.decode()
+    const canvas = document.createElement('canvas')
+    canvas.width = image.naturalWidth
+    canvas.height = image.naturalHeight
+    const context = canvas.getContext('2d')!
+    context.drawImage(image, 0, 0)
+    return {
+      pixel: Array.from(context.getImageData(12, 12, 1, 1).data),
+      bytes: Array.from(new Uint8Array(await (await fetch(image.src)).arrayBuffer())),
+    }
+  })
+  expect(maskedPreview.pixel).toEqual([17, 17, 17, 255])
+  await dialog.getByRole('button', { name: /^(删除|Remove|削除) discarded.txt$/ }).click()
+  await expect(dialog.getByText('discarded.txt', { exact: true })).toHaveCount(0)
+  await uploaded.scrollIntoViewIfNeeded()
+  await expectDialogViewport()
+  await expectUncovered(uploaded)
+  await capture(page, 'feedback-preview.png', testInfo.outputPath('feedback-preview.png'))
+  await uploaded.screenshot({ path: testInfo.outputPath('feedback-image-after-mask-detail.png'), animations: 'disabled' })
+  await dialog.getByRole('button', { name: /提交反馈|Submit Feedback|フィードバックを送信/ }).click()
+  await expect(dialog.getByTestId('feedback-receipt')).toContainText(/FB-/)
+  const number = (await dialog.getByTestId('feedback-receipt').textContent())?.match(/FB-[A-Za-z0-9-]+/)?.[0]
+  expect(number).toBeTruthy()
+  if (!number)
+    throw new Error('Feedback receipt number is missing')
+  await expectDialogViewport()
+  await capture(page, 'feedback-accepted.png', testInfo.outputPath('feedback-accepted.png'))
+  await dialog.getByRole('button', { name: /关闭|Close|閉じる/ }).filter({ hasText: /关闭|Close|閉じる/ }).click()
+  await page.getByTestId('nav-feedback').click()
+  await expect(page.getByTestId('feedback-page')).toBeVisible()
+  const row = page.getByRole('row').filter({ hasText: number })
+  await expect(row).toBeVisible()
+  await row.getByRole('button', { name: /标记已处理|Mark handled|処理済み/ }).click()
+  await expect(row).toContainText(/已处理|Handled|処理済み/)
+  await row.getByRole('button', { name: /撤销处理|Reopen|処理を取り消す/ }).scrollIntoViewIfNeeded()
+  await capture(page, 'feedback-handled.png', testInfo.outputPath('feedback-handled.png'))
+  await row.getByRole('button', { name: /撤销处理|Reopen|処理を取り消す/ }).click()
+  await expect(row).toContainText(/未处理|Pending|未処理/)
+  await capture(page, 'feedback-list.png', testInfo.outputPath('feedback-list.png'))
+  const feedbackList = page.locator('.feedback-list')
+  await expect(feedbackList.locator('.hai-filter-bar')).toBeVisible()
+  await expect(feedbackList.locator('button[type="submit"]')).toBeVisible()
+  const submittedHeader = feedbackList.getByRole('columnheader', { name: /提交时间|Submitted|投稿日時/ })
+  await submittedHeader.getByRole('button').click()
+  await expect(submittedHeader).toHaveAttribute('aria-sort', 'ascending')
+  await feedbackList.locator('button[aria-controls]').click()
+  for (const width of [390, 1440, 1920, 2560, 3840]) {
+    await page.setViewportSize({ width, height: 900 })
+    expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+    await expect(feedbackList.locator('.hai-pagination__navigation')).toBeVisible()
+    await feedbackList.locator('table').evaluate((table) => {
+      table.parentElement!.scrollLeft = 0
+    })
+    await capture(page, `feedback-unified-${width}.png`, testInfo.outputPath(`feedback-unified-${width}.png`))
+  }
+  await page.setViewportSize({ width: 1440, height: 1000 })
+
+  const downloadEvent = page.waitForEvent('download')
+  await row.getByRole('button', { name: /导出问题包|Export diagnostic bundle|診断パッケージをエクスポート/ }).click()
+  const download = await downloadEvent
+  expect(download.suggestedFilename()).toBe(`${number}.zip`)
+  const archivePath = testInfo.outputPath('feedback-export.zip')
+  await download.saveAs(archivePath)
+  expect(await download.failure()).toBeNull()
+  // 复用公开读取器校验路径、容量和全部文件摘要，不以下载事件代替包内容验收。
+  const opened = await readFeedbackBundle(new Uint8Array(await readFile(archivePath)))
+  expect(opened.success).toBe(true)
+  if (!opened.success)
+    throw new Error(opened.error.message)
+  const bundle = opened.data
+  // 对照各自产物旁证、各自 manifest 和本工程 Git；不能用服务端展示配置冒充浏览器版本。
+  const browserMetadata: { appVersion: string, buildId: string, commit: string } = JSON.parse(await readFile(path.resolve('apps/{{projectName}}-{{fullstack.e2eFrontend.target}}/dist/build-metadata.json'), 'utf8'))
+  const serverMetadata: { appVersion: string, buildId: string, commit: string } = JSON.parse(await readFile(path.resolve('packages/{{projectName}}-serv/dist/build-metadata.json'), 'utf8'))
+  const browserManifest: { version: string } = JSON.parse(await readFile(path.resolve('apps/{{projectName}}-{{fullstack.e2eFrontend.target}}/package.json'), 'utf8'))
+  const serverManifest: { version: string } = JSON.parse(await readFile(path.resolve('packages/{{projectName}}-serv/package.json'), 'utf8'))
+  let expectedCommit = 'unknown'
+  try {
+    execFileSync('git', ['ls-files', '--error-unmatch', '--', 'package.json'], { stdio: 'pipe', windowsHide: true })
+    expectedCommit = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8', stdio: 'pipe', windowsHide: true }).trim()
+  }
+  catch { /* 无 Git 的源码归档必须明确保留 unknown，不冒用父工程提交。 */ }
+  if (process.env.E2E_BUILD_COMMIT) {
+    expect(expectedCommit).toBe(process.env.E2E_BUILD_COMMIT)
+    expect(expectedCommit).toMatch(/^(?:[a-f\d]{40}|[a-f\d]{64})$/i)
+    expect(browserManifest.version).not.toBe(serverManifest.version)
+  }
+  for (const [metadata, version] of [[browserMetadata, browserManifest.version], [serverMetadata, serverManifest.version]] as const) {
+    expect(Object.keys(metadata).sort()).toEqual(['appVersion', 'buildId', 'commit'])
+    expect(metadata.appVersion).toBe(version)
+    expect(metadata.buildId).toMatch(/^[\w.+-]{1,160}$/)
+    expect(metadata.buildId).not.toBe('unknown')
+    expect(metadata.commit).toBe(expectedCommit)
+  }
+  const browserEnvironment = bundle.evidence.find(item => item.kind === 'environment' && item.source.startsWith('browser:'))
+  const serverEnvironment = bundle.evidence.find(item => item.kind === 'environment' && item.source.startsWith('server:'))
+  expect(browserEnvironment?.data).toMatchObject(browserMetadata)
+  expect(serverEnvironment?.data.service).toMatchObject(serverMetadata)
+  expect(bundle.report).toMatchObject(browserMetadata)
+  await testInfo.attach('feedback-build-metadata', { body: JSON.stringify({ browser: browserMetadata, server: serverMetadata }), contentType: 'application/json' })
+  expect(bundle.report.number).toBe(number)
+  expect(bundle.manifest.reportId).toBe(bundle.report.id)
+  expect(bundle.manifest.evidenceRevision).toBe(bundle.report.evidenceRevision)
+  expect(bundle.manifest.files.map(file => file.path)).toEqual(expect.arrayContaining(['report.json', 'summary.md', 'viewer/index.html']))
+  const masked = bundle.manifest.files.find(file => file.kind === 'attachment' && file.name === 'attached-preview.png')
+  expect(masked?.contentType).toBe('image/png')
+  if (!masked)
+    throw new Error('The exported masked attachment is missing')
+  expect(bundle.files[masked.path]).toEqual(new Uint8Array(maskedPreview.bytes))
+  const largeLog = bundle.manifest.files.find(file => file.kind === 'attachment' && file.name === 'attached-large-log.txt')
+  expect(largeLog?.contentType).toBe('text/plain')
+  if (!largeLog)
+    throw new Error('The exported large log attachment is missing')
+  expect(bundle.files[largeLog.path]).toEqual(new Uint8Array(feedbackLog))
+  expect(bundle.manifest.files.some(file => file.name === 'discarded.txt')).toBe(false)
+  await testInfo.attach('feedback-export-masked', { body: Buffer.from(bundle.files[masked.path]!), contentType: 'image/png' })
+})
+{{/if}}
+{{/if}}