@podosoft/podokit 0.12.4 → 0.14.0

package/dist/templates/modules/admin-dashboard/files/tests/api/email.api.spec.ts

@@ -4,7 +4,7 @@ import { clearMailpit, mailpitReachable, waitForLink, waitForOtp } from "../help
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
-test("email one-time code signs a user in @smoke", async ({ playwright }) => {
+test("email one-time code signs a user in", async ({ playwright }) => {
   test.skip(!(await mailpitReachable()), "Mailpit not available");
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();
@@ -22,7 +22,7 @@ test("email one-time code signs a user in @smoke", async ({ playwright }) => {
   await ctx.dispose();
 });
 
-test("organization invitation can be sent and accepted @smoke", async ({ playwright }) => {
+test("organization invitation can be sent and accepted", async ({ playwright }) => {
   const owner = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await owner.get("/api/account/capabilities")).json();
   test.skip(!caps?.organization, "organizations not enabled");
@@ -49,7 +49,7 @@ test("organization invitation can be sent and accepted @smoke", async ({ playwri
   await owner.dispose();
 });
 
-test("magic link signs a user in @smoke", async ({ playwright }) => {
+test("magic link signs a user in", async ({ playwright }) => {
   test.skip(!(await mailpitReachable()), "Mailpit not available");
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();

package/dist/templates/modules/admin-dashboard/files/tests/api/profile-image.api.spec.ts

@@ -0,0 +1,96 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+const PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAIAAAADAQMAAACDJEzCAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCSUTzXBDTwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozNzoxOSswMDowMOuehLIAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzc6MTkrMDA6MDCawzwOAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM3OjE5KzAwOjAwzdYd0QAAAAtJREFUCNdjYAABAAAGAAFm9MlsAAAAAElFTkSuQmCC",
+  "base64",
+);
+const TOO_WIDE_PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAACAEAAAABAQMAAACfGLePAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCScoTk3I6QAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozOTo0MCswMDowMCgv/7YAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzk6NDArMDA6MDBZckcKAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM5OjQwKzAwOjAwDmdm1QAAAAxJREFUGNNjYBjpAAABAgABRf+HpwAAAABJRU5ErkJggg==",
+  "base64",
+);
+
+async function adminContext(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const context = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await context.post("/api/auth/sign-in/email", {
+    data: { email: ADMIN.email, password: ADMIN.password },
+  });
+  return context;
+}
+
+test("profile image upload requires authentication", async ({ playwright }) => {
+  const anonymous = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const response = await anonymous.post("/api/account/profile-image", {
+    multipart: { file: { name: "avatar.png", mimeType: "image/png", buffer: PNG } },
+  });
+  expect(response.status()).toBe(401);
+  await anonymous.dispose();
+});
+
+test("profile image upload, replacement, public read, and removal", async ({ playwright }) => {
+  const admin = await adminContext(playwright);
+  await admin.delete("/api/account/profile-image");
+
+  const first = await admin.post("/api/account/profile-image", {
+    multipart: { file: { name: "avatar.png", mimeType: "image/png", buffer: PNG } },
+  });
+  expect(first.status()).toBe(201);
+  const firstBody = await first.json() as { image: string };
+  expect(firstBody.image).toMatch(/^\/api\/profile-images\/[0-9a-f-]+\.png$/);
+
+  const sessionAfterUpload = await (await admin.get("/api/auth/get-session")).json() as {
+    user: { image?: string | null };
+  };
+  expect(sessionAfterUpload.user.image).toBe(firstBody.image);
+  const firstImage = await admin.get(firstBody.image);
+  expect(firstImage.ok()).toBeTruthy();
+  expect(firstImage.headers()["content-type"]).toContain("image/png");
+  expect(firstImage.headers()["cache-control"]).toBe("public, max-age=31536000, immutable");
+
+  const replacement = await admin.post("/api/account/profile-image", {
+    multipart: { file: { name: "replacement.png", mimeType: "image/png", buffer: PNG } },
+  });
+  expect(replacement.status()).toBe(201);
+  const replacementBody = await replacement.json() as { image: string };
+  expect(replacementBody.image).not.toBe(firstBody.image);
+  expect((await admin.get(firstBody.image)).status()).toBe(404);
+
+  const removed = await admin.delete("/api/account/profile-image");
+  expect(await removed.json()).toEqual({ image: null });
+  expect((await admin.get(replacementBody.image)).status()).toBe(404);
+  const sessionAfterRemoval = await (await admin.get("/api/auth/get-session")).json() as {
+    user: { image?: string | null };
+  };
+  expect(sessionAfterRemoval.user.image).toBeNull();
+  await admin.dispose();
+});
+
+test("profile image upload returns stable validation errors", async ({ playwright }) => {
+  const admin = await adminContext(playwright);
+  const invalidType = await admin.post("/api/account/profile-image", {
+    multipart: { file: { name: "avatar.png", mimeType: "image/png", buffer: Buffer.from("not an image") } },
+  });
+  expect(invalidType.status()).toBe(400);
+  expect((await invalidType.json()).error.code).toBe("PROFILE_IMAGE_TYPE_INVALID");
+
+  const tooWide = await admin.post("/api/account/profile-image", {
+    multipart: { file: { name: "wide.png", mimeType: "image/png", buffer: TOO_WIDE_PNG } },
+  });
+  expect(tooWide.status()).toBe(400);
+  expect((await tooWide.json()).error.code).toBe("PROFILE_IMAGE_DIMENSIONS_INVALID");
+
+  const tooLarge = await admin.post("/api/account/profile-image", {
+    multipart: {
+      file: {
+        name: "large.png",
+        mimeType: "image/png",
+        buffer: Buffer.alloc(2 * 1024 * 1024 + 1),
+      },
+    },
+  });
+  expect(tooLarge.status()).toBe(413);
+  expect((await tooLarge.json()).error.code).toBe("PROFILE_IMAGE_TOO_LARGE");
+  await admin.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -11,7 +11,7 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
   return ctx;
 }
 
-test("theme settings: valid preset/radius/accent round-trip @smoke", async ({ playwright }) => {
+test("theme settings: valid preset/radius/accent round-trip", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const put = await admin.put("/api/site/settings", {
     data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
@@ -29,7 +29,7 @@ test("theme settings: valid preset/radius/accent round-trip @smoke", async ({ pl
   await anon.dispose();
 });
 
-test("theme settings: valid per-token overrides accepted @smoke", async ({ playwright }) => {
+test("theme settings: valid per-token overrides accepted", async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
   const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-flows.ui.spec.ts

@@ -22,7 +22,7 @@ async function loginFresh(page: import("@playwright/test").Page, playwright: imp
   await expect(page).toHaveURL(/\/admin\/account/);
 }
 
-test("account: register and verify a phone number @smoke", async ({ page, playwright }) => {
+test("account: register and verify a phone number", async ({ page, playwright }) => {
   test.skip(!(await smsSinkReachable()), "sms sink unreachable");
   await loginFresh(page, playwright, `acc-ph-${Date.now()}@example.com`);
   const phoneInput = page.locator("#phone");
@@ -38,14 +38,14 @@ test("account: register and verify a phone number @smoke", async ({ page, playwr
   await expect(page.getByText("Phone verified")).toBeVisible();
 });
 
-test("account: change email address @smoke", async ({ page, playwright }) => {
+test("account: change email address", async ({ page, playwright }) => {
   await loginFresh(page, playwright, `acc-em-${Date.now()}@example.com`);
   await page.locator("#email").fill(`changed-${Date.now()}@example.com`);
   await page.getByRole("button", { name: "Change email" }).click();
   await expect(page.getByText(/Email address updated|approve the change/)).toBeVisible();
 });
 
-test("account: delete my own account @smoke", async ({ page, playwright }) => {
+test("account: delete my own account", async ({ page, playwright }) => {
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   await admin.post("/api/auth/sign-in/email", { data: { email: "admin@example.com", password: PW } });
   try {

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -2,6 +2,15 @@ import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 import { ADMIN } from "../helpers/accounts";
 
+const PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAIAAAADAQMAAACDJEzCAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCSUTzXBDTwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozNzoxOSswMDowMOuehLIAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzc6MTkrMDA6MDCawzwOAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM3OjE5KzAwOjAwzdYd0QAAAAtJREFUCNdjYAABAAAGAAFm9MlsAAAAAElFTkSuQmCC",
+  "base64",
+);
+const TOO_WIDE_PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAACAEAAAABAQMAAACfGLePAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCScoTk3I6QAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozOTo0MCswMDowMCgv/7YAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzk6NDArMDA6MDBZckcKAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM5OjQwKzAwOjAwDmdm1QAAAAxJREFUGNNjYBjpAAABAgABRf+HpwAAAABJRU5ErkJggg==",
+  "base64",
+);
+
 // admin storageState (project default)
 test("account opens on the profile section @smoke", async ({ page }) => {
   await ready(page, "/admin/account");
@@ -14,7 +23,61 @@ test("account opens on the profile section @smoke", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Save changes" })).toBeEnabled();
 });
 
-test("account exposes a change-email action when the address is edited @smoke", async ({ page }) => {
+test("protected app routes do not inherit the admin shell @smoke", async ({ page }) => {
+  await ready(page, "/accept-invitation/not-a-real-invitation");
+  await expect(page.getByText("Organization invitation", { exact: true })).toBeVisible();
+  await expect(page.getByTestId("sidebar-brand")).toHaveCount(0);
+
+  await ready(page, "/admin");
+  await expect(page.getByTestId("sidebar-brand")).toBeVisible();
+});
+
+test("account displays profile image limits and updates every avatar", async ({ page }) => {
+  await ready(page, "/account");
+  await page.request.delete("/api/account/profile-image");
+  await ready(page, "/account");
+  await expect(page.getByTestId("profile-image-hint")).toContainText(/PNG, JPEG, (?:or )?WebP/);
+  await expect(page.getByTestId("profile-image-hint")).toContainText(/2 ?MB/);
+  await expect(page.getByTestId("profile-image-hint")).toContainText(/2048 × 2048 ?px/);
+
+  await page.locator("#profile-image").setInputFiles({
+    name: "avatar.png",
+    mimeType: "image/png",
+    buffer: PNG,
+  });
+  await expect(page.getByText(/Profile image updated|프로필 이미지를 변경했습니다/)).toBeVisible();
+  await expect(page.getByTestId("profile-image-preview").locator("img")).toBeVisible();
+
+  await ready(page, "/");
+  await expect(page.getByTestId("account-menu").locator("img")).toBeVisible();
+  await ready(page, "/admin");
+  await expect(page.getByTestId("sidebar-user-menu").locator("img")).toBeVisible();
+
+  await ready(page, "/account");
+  await page.getByRole("button", { name: /Remove image|이미지 제거/ }).click();
+  await expect(page.getByText(/Profile image removed|프로필 이미지를 제거했습니다/)).toBeVisible();
+  await expect(page.getByTestId("profile-image-preview").locator("img")).toHaveCount(0);
+  await expect(page.getByRole("button", { name: /Upload image|이미지 업로드/ })).toBeVisible();
+});
+
+test("account rejects invalid profile images before upload", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await page.locator("#profile-image").setInputFiles({
+    name: "avatar.txt",
+    mimeType: "text/plain",
+    buffer: Buffer.from("not an image"),
+  });
+  await expect(page.getByText(/Choose a valid PNG, JPEG, or WebP image|올바른 PNG, JPEG 또는 WebP 이미지를 선택해 주세요/)).toBeVisible();
+
+  await page.locator("#profile-image").setInputFiles({
+    name: "wide.png",
+    mimeType: "image/png",
+    buffer: TOO_WIDE_PNG,
+  });
+  await expect(page.getByText(/The image must not exceed 2048 × 2048 px|이미지는 2048 × 2048px를 초과할 수 없습니다/)).toBeVisible();
+});
+
+test("account exposes a change-email action when the address is edited", async ({ page }) => {
   await ready(page, "/admin/account");
   const email = page.getByLabel("Email");
   await expect(email).toHaveValue("admin@example.com");
@@ -27,14 +90,14 @@ test("account exposes a change-email action when the address is edited @smoke",
   await expect(page.getByRole("button", { name: "Change email" })).toHaveCount(0);
 });
 
-test("account shows a username field when enabled @smoke", async ({ page }) => {
+test("account shows a username field when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   const username = page.getByLabel("Username", { exact: true });
   test.skip((await username.count()) === 0, "username not enabled");
   await expect(username).toBeVisible();
 });
 
-test("account can create and revoke an API key when enabled @smoke", async ({ page }) => {
+test("account can create and revoke an API key when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   const nav = page.getByRole("button", { name: "API keys" });
   test.skip((await nav.count()) === 0, "api keys not enabled");
@@ -52,7 +115,7 @@ test("account can create and revoke an API key when enabled @smoke", async ({ pa
   await expect(page.getByText("Key revoked")).toBeVisible();
 });
 
-test("account can register and remove a passkey when enabled @smoke", async ({ page }) => {
+test("account can register and remove a passkey when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();
   const addBtn = page.getByRole("button", { name: "Add passkey" });
@@ -74,7 +137,7 @@ test("account can register and remove a passkey when enabled @smoke", async ({ p
   await expect(page.getByText("Passkey removed")).toBeVisible();
 });
 
-test("account shows a phone field when enabled @smoke", async ({ page }) => {
+test("account shows a phone field when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   const phone = page.getByLabel("Phone number", { exact: true });
   test.skip((await phone.count()) === 0, "phone number not enabled");
@@ -106,12 +169,12 @@ test("account security and sessions sub-navigation", async ({ page }) => {
 
 test("account nav shows the core sections", async ({ page }) => {
   await ready(page, "/admin/account");
-  await expect(page.getByRole("button", { name: "Profile" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Profile", exact: true })).toBeVisible();
   await expect(page.getByRole("button", { name: "Security" })).toBeVisible();
   await expect(page.getByRole("button", { name: "Sessions" })).toBeVisible();
 });
 
-test("two-factor setup shows a scannable QR code when enabled @smoke", async ({ page }) => {
+test("two-factor setup shows a scannable QR code when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();
   const heading = page.getByText("Two-factor authentication");

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -12,7 +12,7 @@ async function openAppearance(page: import("@playwright/test").Page): Promise<vo
   }).toPass();
 }
 
-test("appearance: has its own tab with theme controls @smoke", async ({ page }) => {
+test("appearance: has its own tab with theme controls", async ({ page }) => {
   await openAppearance(page);
   await expect(page.getByRole("heading", { name: "Featured themes" })).toBeVisible();
   await expect(page.getByRole("button", { name: "Default", exact: true })).toBeVisible();

package/dist/templates/modules/admin-dashboard/files/tests/ui/dashboard.ui.spec.ts

@@ -10,7 +10,23 @@ test("overview shows the signed-in admin @smoke", async ({ page }) => {
   await expect(page.getByRole("main").getByText(ADMIN.email)).toBeVisible();
 });
 
-test("sidebar navigates to sessions and account", async ({ page }) => {
+test("landing shows language, theme, and signed-in account actions", async ({ page }) => {
+  await ready(page, "/");
+  const language = page.getByRole("button", { name: /^(Language|언어)$/ });
+  const theme = page.getByRole("button", { name: /^(Toggle theme|테마 전환)$/ });
+  await expect(language).toBeVisible();
+  await expect(language.locator("svg")).toBeVisible();
+  await expect(theme).toBeVisible();
+  await expect(theme.locator("svg:visible")).toBeVisible();
+  await page.getByTestId("account-menu").click();
+  const label = page.getByRole("menu").locator('[data-slot="dropdown-menu-label"]');
+  await expect(label.getByText(ADMIN.name, { exact: true })).toBeVisible();
+  await expect(label.getByText(ADMIN.email, { exact: true })).toBeVisible();
+  await expect(page.getByRole("menuitem", { name: "Account" })).toBeVisible();
+  await expect(page.getByRole("menuitem", { name: "Sign out" })).toBeVisible();
+});
+
+test("sidebar navigates to sessions and account @smoke", async ({ page }) => {
   await ready(page, "/admin");
   await page.getByRole("link", { name: "Sessions" }).click();
   await expect(page).toHaveURL(/\/admin\/sessions/);
@@ -19,7 +35,7 @@ test("sidebar navigates to sessions and account", async ({ page }) => {
   await expect(page.getByRole("link", { name: "Account" })).toHaveCount(0);
   await page.getByRole("button", { name: /admin@example.com/ }).click();
   await page.getByRole("menuitem", { name: "Account" }).click();
-  await expect(page).toHaveURL(/\/admin\/account/);
+  await expect(page).toHaveURL((url) => url.pathname === "/account");
   await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
   await expect(page.getByLabel("Name", { exact: true })).toBeVisible(); // profile section (exact: "Username" also contains "Name")
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/data-table.ui.spec.ts

@@ -3,7 +3,7 @@ import { ready } from "../helpers/hydration";
 
 // Sorting via the shared DataTable. Users is server-sorted (manual), audit is
 // client-sorted — both drive the same clickable headers + aria-sort.
-test("users table sorts by a column header (server) @smoke", async ({ page }) => {
+test("users table sorts by a column header (server)", async ({ page }) => {
   await ready(page, "/admin/users");
   const header = page.getByRole("columnheader", { name: /Name/ });
   // Click the sort button *inside* the header — a bare name match collides with

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -9,7 +9,7 @@ const origin = { origin: base };
 // The reset flow is for signed-out users — run without the seeded session.
 test.use({ storageState: anonState });
 
-test("forgot password: request, open the emailed link, set a new password, sign in @smoke", async ({ page, playwright }) => {
+test("forgot password: request, open the emailed link, set a new password, sign in", async ({ page, playwright }) => {
   test.skip(!(await mailpitReachable()), "Mailpit not available");
   const email = `ui-reset-${Date.now()}@example.com`;
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -43,7 +43,7 @@ test("general: empty locale displays the application default", async ({ page })
   }
 });
 
-test("general: footer text and links render on public pages @smoke", async ({ page, browser }) => {
+test("general: footer text and links render on public pages", async ({ page, browser }) => {
   await ready(page, "/admin/settings");
   const origin = new URL(page.url()).origin;
   const footer = page.getByLabel("Footer text");
@@ -78,7 +78,7 @@ test("general: footer text and links render on public pages @smoke", async ({ pa
   }
 });
 
-test("general: maintenance mode holds non-admins on the maintenance page @smoke", async ({ page, browser }) => {
+test("general: maintenance mode holds non-admins on the maintenance page", async ({ page, browser }) => {
   await ready(page, "/admin/settings");
   const origin = new URL(page.url()).origin;
   await page.getByRole("switch", { name: "Maintenance mode" }).click();
@@ -102,7 +102,7 @@ test("general: maintenance mode holds non-admins on the maintenance page @smoke"
   }
 });
 
-test("general: closing sign-up redirects /signup and hides the link @smoke", async ({ page, browser }) => {
+test("general: closing sign-up redirects /signup and hides the link", async ({ page, browser }) => {
   await ready(page, "/admin/settings");
   const origin = new URL(page.url()).origin;
   await page.getByRole("switch", { name: "Allow public sign-up" }).click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/guards.ui.spec.ts

@@ -10,7 +10,7 @@ test.describe("unauthenticated", () => {
     }
   });
 
-  test("private and authentication routes prevent search indexing @smoke", async ({ request }) => {
+  test("private and authentication routes prevent search indexing", async ({ request }) => {
     for (const route of ["/admin", "/account", "/login", "/api/account/me"]) {
       const response = await request.get(route, { maxRedirects: 0 });
       expect(response.headers()["x-robots-tag"]).toBe("noindex, nofollow");
@@ -23,16 +23,13 @@ test.describe("unauthenticated", () => {
 
 test.describe("normal user (non-admin)", () => {
   test.use({ storageState: userState });
-  test("admin-only nav is hidden and admin routes are forbidden", async ({ page }) => {
-    await page.goto("/admin");
-    await expect(page.getByRole("link", { name: "Users" })).toHaveCount(0);
-    await expect(page.getByRole("link", { name: "Sessions" })).toHaveCount(0);
-    expect((await page.goto("/admin/users"))?.status()).toBe(403);
-    expect((await page.goto("/admin/sessions"))?.status()).toBe(403);
-    expect((await page.goto("/admin/settings"))?.status()).toBe(403);
+  test("admin route group is forbidden to non-admin users @smoke", async ({ page }) => {
+    for (const route of ["/admin", "/admin/users", "/admin/sessions", "/admin/settings"]) {
+      expect((await page.goto(route))?.status()).toBe(403);
+    }
   });
 
-  test("account is available without the admin shell @smoke", async ({ page }) => {
+  test("account is available without the admin shell", async ({ page }) => {
     await page.goto("/account");
     await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
     await expect(page.getByLabel("Name", { exact: true })).toBeVisible();

package/dist/templates/modules/admin-dashboard/files/tests/ui/impersonation.ui.spec.ts

@@ -4,7 +4,7 @@ import { USER } from "../helpers/accounts";
 
 // admin storageState (project default)
 
-test("admin can impersonate a user and stop @smoke", async ({ page }) => {
+test("admin can impersonate a user and stop", async ({ page }) => {
   await ready(page, "/admin/users");
   await page.locator("#toolbar-search").fill(USER.email);
   await page.getByRole("button", { name: "Search", exact: true }).click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/login-methods.ui.spec.ts

@@ -8,7 +8,7 @@ test.use({ storageState: anonState });
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
-test("login: magic link shows a sent confirmation @smoke", async ({ page, playwright }) => {
+test("login: magic link shows a sent confirmation", async ({ page, playwright }) => {
   const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await api.get("/api/account/capabilities")).json();
   await api.dispose();
@@ -20,7 +20,7 @@ test("login: magic link shows a sent confirmation @smoke", async ({ page, playwr
   await expect(page.getByTestId("magic-link-sent")).toBeVisible();
 });
 
-test("login: an emailed one-time code signs a user in @smoke", async ({ page, playwright }) => {
+test("login: an emailed one-time code signs a user in", async ({ page, playwright }) => {
   const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await api.get("/api/account/capabilities")).json();
   test.skip(!caps?.emailOtp, "email otp disabled");

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -10,7 +10,7 @@ const REDIRECT = "http://localhost:9999/callback";
 // (with PKCE) that validates the client and hands off to the consent page. The
 // back-channel token exchange is driven by an OIDC client SDK / real RP — see
 // docs/modules.md for the manual round-trip checklist.
-test("OIDC provider: discovery, JWKS, client registration, authorize handoff @smoke", async ({ page, baseURL }) => {
+test("OIDC provider: discovery, JWKS, client registration, authorize handoff", async ({ page, baseURL }) => {
   const headers = { origin: baseURL ?? "" };
   await page.request.put("/api/account/settings", { data: { oidcProvider: true }, headers });
   await expect

package/dist/templates/modules/admin-dashboard/files/tests/ui/organizations.ui.spec.ts

@@ -19,7 +19,7 @@ test("admin can create an organization @smoke", async ({ page }) => {
   await expect(page.getByText("Organization deleted").first()).toBeVisible();
 });
 
-test("create an org with a non-ascii name, a parent, and a manager @smoke", async ({ page }) => {
+test("create an org with a non-ascii name, a parent, and a manager", async ({ page }) => {
   await ready(page, "/admin/organizations");
   const newBtn = page.getByRole("button", { name: "New organization" });
   test.skip((await newBtn.count()) === 0, "organizations not enabled");
@@ -54,7 +54,7 @@ test("create an org with a non-ascii name, a parent, and a manager @smoke", asyn
   await expect(page.getByText("Organization deleted").first()).toBeVisible();
 });
 
-test("organization manage: remove a member, invite one, and cancel the invite @smoke", async ({ page }) => {
+test("organization manage: remove a member, invite one, and cancel the invite", async ({ page }) => {
   await ready(page, "/admin/organizations");
   const newBtn = page.getByRole("button", { name: "New organization" });
   test.skip((await newBtn.count()) === 0, "organizations not enabled");

package/dist/templates/modules/admin-dashboard/files/tests/ui/passkey.ui.spec.ts

@@ -4,7 +4,7 @@ import { ready } from "../helpers/hydration";
 // Full passkey round trip on a throwaway account — never touches the shared admin.
 test.use({ storageState: { cookies: [], origins: [] } });
 
-test("register a passkey and sign in with it @smoke", async ({ page, baseURL }) => {
+test("register a passkey and sign in with it", async ({ page, baseURL }) => {
   const origin = { origin: baseURL ?? "" };
   // A virtual authenticator answers both the register (create) and sign-in (get)
   // WebAuthn ceremonies without hardware.

package/dist/templates/modules/admin-dashboard/files/tests/ui/sessions.ui.spec.ts

@@ -2,12 +2,12 @@ import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — sessions is an admin-only view
-test("sessions table shows the expires column @smoke", async ({ page }) => {
+test("sessions table shows the expires column", async ({ page }) => {
   await ready(page, "/admin/sessions");
   await expect(page.getByRole("columnheader", { name: "Expires" })).toBeVisible();
 });
 
-test("admin sees user sessions across users @smoke", async ({ page }) => {
+test("admin sees user sessions across users", async ({ page }) => {
   await ready(page, "/admin/sessions");
   await expect(page.getByRole("heading", { name: "User sessions" })).toBeVisible();
   // Search by exact address — robust to pagination as sessions accumulate (the

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings-dialogs.ui.spec.ts

@@ -3,13 +3,16 @@ import { ready } from "../helpers/hydration";
 
 // admin storageState (project default)
 
-test("settings: add and remove a social login provider @smoke", async ({ page }) => {
+test("settings: add and remove a social login provider", async ({ page }) => {
   const dialog = page.getByRole("dialog");
   const addBtn = dialog.getByRole("button", { name: "Add provider" });
   const openConfigure = async (): Promise<void> => {
     await page.waitForLoadState("networkidle");
     await page.getByRole("tab", { name: "Authentication" }).click();
-    await page.getByRole("button", { name: "Configure" }).click();
+    const socialCard = page
+      .getByText("Social login", { exact: true })
+      .locator('xpath=ancestor::div[@data-slot="card"]');
+    await socialCard.getByRole("button", { name: "Configure" }).click();
   };
 
   await ready(page, "/admin/settings");
@@ -47,7 +50,7 @@ test("settings: add and remove a social login provider @smoke", async ({ page })
   }
 });
 
-test("settings: open and save the SMTP dialog @smoke", async ({ page }) => {
+test("settings: open and save the SMTP dialog", async ({ page }) => {
   await ready(page, "/admin/settings");
   await page.getByRole("tab", { name: "Authentication" }).click();
   await page.getByRole("button", { name: "SMTP settings" }).click();
@@ -66,3 +69,33 @@ test("settings: open and save the SMTP dialog @smoke", async ({ page }) => {
       .catch(() => undefined);
   }
 });
+
+test("settings: configure automatic logout", async ({ page }) => {
+  await page.request.put("/api/account/auth-config", {
+    data: { server: { sessionIdleTimeoutMinutes: null } },
+  });
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Authentication" }).click();
+
+  const toggle = page.getByRole("switch", { name: "Automatic logout" });
+  await expect(toggle).not.toBeChecked();
+  await toggle.click();
+  await expect(toggle).toBeChecked();
+
+  const card = page
+    .getByText("Automatic logout", { exact: true })
+    .locator('xpath=ancestor::div[@data-slot="card"]');
+  await card.getByRole("button", { name: "Configure" }).click();
+  const dialog = page.getByRole("dialog");
+  await dialog.getByLabel("Idle time (minutes)").fill("45");
+  await dialog.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(page.getByText("45 min", { exact: true })).toBeVisible();
+
+  const saved = await (await page.request.get("/api/account/auth-config")).json();
+  expect(saved.server.sessionIdleTimeoutMinutes).toBe(45);
+  const caps = await (await page.request.get("/api/account/capabilities")).json();
+  expect(caps.sessionIdleTimeoutMinutes).toBe(45);
+
+  await toggle.click();
+  await expect(toggle).not.toBeChecked();
+});