@podosoft/podokit 0.13.0 → 0.15.0

package/dist/templates/modules/admin-dashboard/files/tests/api/audit.api.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ADMIN, USER } from "../helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -13,7 +13,7 @@ async function signedIn(
   return ctx;
 }
 
-test("audit log records auth/admin actions", async ({ playwright }) => {
+test("audit log records auth/admin actions", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const probe = await admin.get("/api/audit-logs");
   test.skip(probe.status() === 404, "audit-log module not installed");
@@ -24,7 +24,7 @@ test("audit log records auth/admin actions", async ({ playwright }) => {
     data: { email, password: "Podokit3e-Str0ng!pw", name: "Audit", role: "user" },
   });
   expect(created.ok()).toBeTruthy();
-  const userId = (await created.json())?.user?.id as string;
+  const userId = await disposableUsers.trackResponse(created);
 
   const res = await admin.get("/api/audit-logs");
   expect(res.ok()).toBeTruthy();
@@ -34,6 +34,7 @@ test("audit log records auth/admin actions", async ({ playwright }) => {
   expect(entry?.actorEmail, "audit entry records the acting admin").toBe(ADMIN.email);
 
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  disposableUsers.forget(userId);
   await admin.dispose();
 });
 
@@ -47,11 +48,14 @@ test("the audit log is admin-only", async ({ playwright }) => {
   await user.dispose();
 });
 
-test("sending a verification email is audited", async ({ playwright }) => {
+test("sending a verification email is audited", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
   const email = `verif-audit-${Date.now()}@example.com`;
-  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "VA", role: "user" } });
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "VA", role: "user" },
+  });
+  await disposableUsers.trackResponse(created);
   await admin.post("/api/auth/send-verification-email", { data: { email, callbackURL: `${base}/admin` } });
   const entries = (await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>;
   expect(entries.some((e) => e.action === "auth.verification_sent"), "verification send should be audited").toBeTruthy();
@@ -60,7 +64,7 @@ test("sending a verification email is audited", async ({ playwright }) => {
 
 // Audit logging is a DB-backed on/off toggle (auth_config `server`, applied live).
 // Runs after the recording tests and restores the flag so nothing else is affected.
-test("audit logging honours the DB on/off toggle @smoke", async ({ playwright }) => {
+test("audit logging honours the DB on/off toggle @smoke", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
   const auditLog = async () => (await (await admin.get("/api/account/capabilities")).json()).auditLog as boolean;
@@ -68,8 +72,12 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright })
     ((await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>).some(
       (e) => e.action === "user.create" && e.targetLabel === label,
     );
-  const createUser = async (email: string) =>
-    (await (await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "T", role: "user" } })).json())?.user?.id as string;
+  const createUser = async (email: string): Promise<string> => {
+    const response = await admin.post("/api/auth/admin/create-user", {
+      data: { email, password: "Podokit3e-Str0ng!pw", name: "T", role: "user" },
+    });
+    return disposableUsers.trackResponse(response);
+  };
 
   try {
     // OFF → the action is not recorded. Wait past the config-store cache TTL so the
@@ -81,6 +89,7 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright })
     const offId = await createUser(offEmail);
     expect(await recorded(offEmail), "no audit entry while disabled").toBe(false);
     await admin.post("/api/auth/admin/remove-user", { data: { userId: offId } });
+    disposableUsers.forget(offId);
 
     // ON → recording resumes.
     await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
@@ -90,6 +99,7 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright })
     const onId = await createUser(onEmail);
     expect(await recorded(onEmail), "audit entry recorded once re-enabled").toBe(true);
     await admin.post("/api/auth/admin/remove-user", { data: { userId: onId } });
+    disposableUsers.forget(onId);
   } finally {
     await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
     await admin.dispose();

package/dist/templates/modules/admin-dashboard/files/tests/api/profile-image.api.spec.ts

@@ -0,0 +1,96 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+const PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAIAAAADAQMAAACDJEzCAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCSUTzXBDTwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozNzoxOSswMDowMOuehLIAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzc6MTkrMDA6MDCawzwOAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM3OjE5KzAwOjAwzdYd0QAAAAtJREFUCNdjYAABAAAGAAFm9MlsAAAAAElFTkSuQmCC",
+  "base64",
+);
+const TOO_WIDE_PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAACAEAAAABAQMAAACfGLePAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCScoTk3I6QAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozOTo0MCswMDowMCgv/7YAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzk6NDArMDA6MDBZckcKAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM5OjQwKzAwOjAwDmdm1QAAAAxJREFUGNNjYBjpAAABAgABRf+HpwAAAABJRU5ErkJggg==",
+  "base64",
+);
+
+async function adminContext(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const context = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await context.post("/api/auth/sign-in/email", {
+    data: { email: ADMIN.email, password: ADMIN.password },
+  });
+  return context;
+}
+
+test("profile image upload requires authentication", async ({ playwright }) => {
+  const anonymous = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const response = await anonymous.post("/api/account/profile-image", {
+    multipart: { file: { name: "avatar.png", mimeType: "image/png", buffer: PNG } },
+  });
+  expect(response.status()).toBe(401);
+  await anonymous.dispose();
+});
+
+test("profile image upload, replacement, public read, and removal", async ({ playwright }) => {
+  const admin = await adminContext(playwright);
+  await admin.delete("/api/account/profile-image");
+
+  const first = await admin.post("/api/account/profile-image", {
+    multipart: { file: { name: "avatar.png", mimeType: "image/png", buffer: PNG } },
+  });
+  expect(first.status()).toBe(201);
+  const firstBody = await first.json() as { image: string };
+  expect(firstBody.image).toMatch(/^\/api\/profile-images\/[0-9a-f-]+\.png$/);
+
+  const sessionAfterUpload = await (await admin.get("/api/auth/get-session")).json() as {
+    user: { image?: string | null };
+  };
+  expect(sessionAfterUpload.user.image).toBe(firstBody.image);
+  const firstImage = await admin.get(firstBody.image);
+  expect(firstImage.ok()).toBeTruthy();
+  expect(firstImage.headers()["content-type"]).toContain("image/png");
+  expect(firstImage.headers()["cache-control"]).toBe("public, max-age=31536000, immutable");
+
+  const replacement = await admin.post("/api/account/profile-image", {
+    multipart: { file: { name: "replacement.png", mimeType: "image/png", buffer: PNG } },
+  });
+  expect(replacement.status()).toBe(201);
+  const replacementBody = await replacement.json() as { image: string };
+  expect(replacementBody.image).not.toBe(firstBody.image);
+  expect((await admin.get(firstBody.image)).status()).toBe(404);
+
+  const removed = await admin.delete("/api/account/profile-image");
+  expect(await removed.json()).toEqual({ image: null });
+  expect((await admin.get(replacementBody.image)).status()).toBe(404);
+  const sessionAfterRemoval = await (await admin.get("/api/auth/get-session")).json() as {
+    user: { image?: string | null };
+  };
+  expect(sessionAfterRemoval.user.image).toBeNull();
+  await admin.dispose();
+});
+
+test("profile image upload returns stable validation errors", async ({ playwright }) => {
+  const admin = await adminContext(playwright);
+  const invalidType = await admin.post("/api/account/profile-image", {
+    multipart: { file: { name: "avatar.png", mimeType: "image/png", buffer: Buffer.from("not an image") } },
+  });
+  expect(invalidType.status()).toBe(400);
+  expect((await invalidType.json()).error.code).toBe("PROFILE_IMAGE_TYPE_INVALID");
+
+  const tooWide = await admin.post("/api/account/profile-image", {
+    multipart: { file: { name: "wide.png", mimeType: "image/png", buffer: TOO_WIDE_PNG } },
+  });
+  expect(tooWide.status()).toBe(400);
+  expect((await tooWide.json()).error.code).toBe("PROFILE_IMAGE_DIMENSIONS_INVALID");
+
+  const tooLarge = await admin.post("/api/account/profile-image", {
+    multipart: {
+      file: {
+        name: "large.png",
+        mimeType: "image/png",
+        buffer: Buffer.alloc(2 * 1024 * 1024 + 1),
+      },
+    },
+  });
+  expect(tooLarge.status()).toBe(413);
+  expect((await tooLarge.json()).error.code).toBe("PROFILE_IMAGE_TOO_LARGE");
+  await admin.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ADMIN, USER } from "../helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -13,7 +13,7 @@ async function signedIn(
   return ctx;
 }
 
-test("admin can create a user, set its password, and remove it", async ({ playwright }) => {
+test("admin can create a user, set its password, and remove it", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-crud-${Date.now()}@example.com`;
 
@@ -21,7 +21,7 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
     data: { email, password: "Podokit3e-Str0ng!pw", name: "API CRUD", role: "user" },
   });
   expect(created.ok()).toBeTruthy();
-  const id = (await created.json())?.user?.id as string;
+  const id = await disposableUsers.trackResponse(created);
   expect(id).toBeTruthy();
 
   const setPw = await admin.post("/api/auth/admin/set-user-password", {
@@ -37,6 +37,7 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
 
   const removed = await admin.post("/api/auth/admin/remove-user", { data: { userId: id } });
   expect(removed.ok()).toBeTruthy();
+  disposableUsers.forget(id);
   await admin.dispose();
 });
 
@@ -49,13 +50,13 @@ test("a normal user cannot create users (403)", async ({ playwright }) => {
   await user.dispose();
 });
 
-test("admin can list and revoke a user's sessions", async ({ playwright }) => {
+test("admin can list and revoke a user's sessions", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-sess-${Date.now()}@example.com`;
   const created = await admin.post("/api/auth/admin/create-user", {
     data: { email, password: "Podokit3e-Str0ng!pw", name: "API Sess", role: "user" },
   });
-  const userId = (await created.json())?.user?.id as string;
+  const userId = await disposableUsers.trackResponse(created);
 
   // the user signs in -> creates a session
   const theirs = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -69,14 +70,18 @@ test("admin can list and revoke a user's sessions", async ({ playwright }) => {
   const revoked = await admin.post("/api/auth/admin/revoke-user-sessions", { data: { userId } });
   expect(revoked.ok()).toBeTruthy();
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  disposableUsers.forget(userId);
   await admin.dispose();
 });
 
-test("revokeOtherSessions keeps the current session valid", async ({ playwright }) => {
+test("revokeOtherSessions keeps the current session valid", async ({ playwright, disposableUsers }) => {
   // Use a throwaway account so we don't revoke the shared USER's ui storageState.
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-revoke-others-${Date.now()}@example.com`;
-  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "RO", role: "user" } });
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "RO", role: "user" },
+  });
+  await disposableUsers.trackResponse(created);
   await admin.dispose();
 
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -109,13 +114,13 @@ test("account capabilities reports optional-feature flags", async ({ playwright
   await ctx.dispose();
 });
 
-test("admin can update a user and impersonate them", async ({ playwright }) => {
+test("admin can update a user and impersonate them", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-edit-${Date.now()}@example.com`;
   const created = await admin.post("/api/auth/admin/create-user", {
     data: { email, password: "Podokit3e-Str0ng!pw", name: "Edit Me", role: "user" },
   });
-  const userId = (await created.json())?.user?.id as string;
+  const userId = await disposableUsers.trackResponse(created);
 
   const updated = await admin.post("/api/auth/admin/update-user", { data: { userId, data: { name: "Updated" } } });
   expect(updated.ok()).toBeTruthy();
@@ -131,5 +136,6 @@ test("admin can update a user and impersonate them", async ({ playwright }) => {
   await imp.dispose();
 
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  disposableUsers.forget(userId);
   await admin.dispose();
 });

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -3,4 +3,5 @@ export const ADMIN = { name: "Admin", email: "admin@example.com", password: "Pod
 export const USER = { name: "Normal User", email: "user@example.com", password: "Podokit3e-Str0ng!pw" };
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
+export const userBaselineState = "playwright/.auth/user-baseline.json";
 export const anonState = { cookies: [], origins: [] } as const;

package/dist/templates/modules/admin-dashboard/files/tests/helpers/disposable-users.ts

@@ -0,0 +1,83 @@
+import {
+  expect,
+  test as base,
+  type APIResponse,
+} from "@playwright/test";
+
+const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: baseURL };
+
+type CreateUserInput = {
+  email: string;
+  password?: string;
+  name?: string;
+  role?: string;
+};
+
+export type DisposableUsers = {
+  create(input: CreateUserInput): Promise<string>;
+  trackResponse(response: APIResponse): Promise<string>;
+  track(userId: string): void;
+  forget(userId: string): void;
+};
+
+async function readCreatedUserId(response: APIResponse): Promise<string> {
+  expect(response.ok()).toBeTruthy();
+  const body = (await response.json()) as { user?: { id?: unknown } };
+  expect(typeof body.user?.id).toBe("string");
+  return body.user?.id as string;
+}
+
+export const test = base.extend<{ disposableUsers: DisposableUsers }>({
+  disposableUsers: async ({ context }, use) => {
+    // Reuse the browser context's storageState-backed request client. Creating
+    // a second admin login here can revoke the browser session in applications
+    // that enforce a single concurrent session.
+    const request = context.request;
+    const userIds = new Set<string>();
+
+    const disposableUsers: DisposableUsers = {
+      async create(input): Promise<string> {
+        const response = await request.post("/api/auth/admin/create-user", {
+          headers: origin,
+          data: {
+            password: "Podokit3e-Str0ng!pw",
+            name: "Throwaway",
+            role: "user",
+            ...input,
+          },
+        });
+        const userId = await readCreatedUserId(response);
+        userIds.add(userId);
+        return userId;
+      },
+      async trackResponse(response): Promise<string> {
+        const userId = await readCreatedUserId(response);
+        userIds.add(userId);
+        return userId;
+      },
+      track(userId): void {
+        userIds.add(userId);
+      },
+      forget(userId): void {
+        userIds.delete(userId);
+      },
+    };
+
+    try {
+      await use(disposableUsers);
+    } finally {
+      for (const userId of userIds) {
+        const response = await request.post("/api/auth/admin/remove-user", {
+          headers: origin,
+          data: { userId },
+        });
+        if (!response.ok() && response.status() !== 404) {
+          throw new Error(`Failed to remove disposable user ${userId}: HTTP ${response.status()}`);
+        }
+      }
+    }
+  },
+});
+
+export { expect };

package/dist/templates/modules/admin-dashboard/files/tests/playwright.config.ts

@@ -1,9 +1,21 @@
 import { defineConfig, devices } from "@playwright/test";
+import { loadPlaywrightProjects } from "./playwright.extensions";
 
 // admin-dashboard overlay: adds a `setup` project that seeds admin/user sessions
 // (storageState) which the `ui` project reuses. Serial + single worker because
 // tests share one backend/DB. Runs against a live stack on E2E_BASE_URL.
 const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const coreProjects = [
+  { name: "api", testMatch: /.*\.api\.spec\.ts/, dependencies: ["setup"] },
+  { name: "setup", testMatch: /.*\.setup\.ts/, teardown: "cleanup" },
+  { name: "cleanup", testMatch: /.*\.teardown\.ts/ },
+  {
+    name: "ui",
+    testMatch: /.*\.ui\.spec\.ts/,
+    dependencies: ["setup"],
+    use: { ...devices["Desktop Chrome"], storageState: "playwright/.auth/admin.json" },
+  },
+];
 
 export default defineConfig({
   testDir: ".",
@@ -13,14 +25,5 @@ export default defineConfig({
   workers: 1,
   reporter: [["list"], ["html", { open: "never" }]],
   use: { baseURL, trace: "on-first-retry", screenshot: "only-on-failure" },
-  projects: [
-    { name: "api", testMatch: /.*\.api\.spec\.ts/, dependencies: ["setup"] },
-    { name: "setup", testMatch: /.*\.setup\.ts/ },
-    {
-      name: "ui",
-      testMatch: /.*\.ui\.spec\.ts/,
-      dependencies: ["setup"],
-      use: { ...devices["Desktop Chrome"], storageState: "playwright/.auth/admin.json" },
-    },
-  ],
+  projects: [...coreProjects, ...loadPlaywrightProjects(coreProjects)],
 });

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -1,10 +1,46 @@
 import { test as setup, expect } from "@playwright/test";
-import { ADMIN, USER, adminState, userState, type Account } from "./helpers/accounts";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import {
+  ADMIN,
+  USER,
+  adminState,
+  userState,
+  userBaselineState,
+  type Account,
+} from "./helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+mkdirSync(dirname(adminState), { recursive: true });
+
+type StorageState = Awaited<
+  ReturnType<import("@playwright/test").APIRequestContext["storageState"]>
+>;
+
+function withTestLocale(state: StorageState): StorageState {
+  const url = new URL(base);
+  return {
+    ...state,
+    cookies: [
+      ...state.cookies.filter((cookie) => cookie.name !== "locale"),
+      {
+        name: "locale",
+        value: "en",
+        domain: url.hostname,
+        path: "/",
+        expires: -1,
+        httpOnly: false,
+        secure: url.protocol === "https:",
+        sameSite: "Lax",
+      },
+    ],
+  };
+}
 
 // Seed a session via the API (reliable, no UI hydration races) and save its
-// cookies as storageState for the browser `ui` project to reuse.
+// cookies as storageState for the browser `ui` project to reuse. Pin the suite
+// locale because UI locators use the generated English catalog and must not
+// inherit an application's configured default language.
 async function seedSession(
   playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"],
   account: Account,
@@ -26,7 +62,7 @@ async function seedSession(
     if (!Array.isArray(sessions) || sessions.length <= 1) break;
     expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
   }
-  await ctx.storageState({ path });
+  writeFileSync(path, `${JSON.stringify(withTestLocale(await ctx.storageState()), null, 2)}\n`);
   await ctx.dispose();
 }
 
@@ -48,3 +84,33 @@ setup("enable optional features", async ({ playwright }) => {
 setup("seed user session", async ({ playwright }) => {
   await seedSession(playwright, USER, userState);
 });
+
+setup("capture the user cleanup baseline", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin: base },
+  });
+  try {
+    const signIn = await ctx.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    expect(signIn.ok(), "sign in before capturing the user baseline").toBeTruthy();
+    const ids: string[] = [];
+    const limit = 100;
+    for (let offset = 0; ; offset += limit) {
+      const response = await ctx.get(`/api/auth/admin/list-users?limit=${limit}&offset=${offset}`);
+      expect(response.ok(), "list users before the suite").toBeTruthy();
+      const body = (await response.json()) as { users?: Array<{ id?: unknown }> };
+      const page = body.users ?? [];
+      ids.push(
+        ...page
+          .map((user) => user.id)
+          .filter((id): id is string => typeof id === "string"),
+      );
+      if (page.length < limit) break;
+    }
+    writeFileSync(userBaselineState, `${JSON.stringify(ids, null, 2)}\n`);
+  } finally {
+    await ctx.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/seed.teardown.ts

@@ -0,0 +1,46 @@
+import { existsSync, readFileSync } from "node:fs";
+import { expect, test as cleanup } from "@playwright/test";
+import { ADMIN, userBaselineState } from "./helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
+type ListedUser = {
+  id: string;
+};
+
+cleanup("remove users created by the suite", async ({ playwright }) => {
+  if (!existsSync(userBaselineState)) return;
+  const baseline = new Set(JSON.parse(readFileSync(userBaselineState, "utf8")) as string[]);
+  const ctx = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin: base },
+  });
+
+  try {
+    const signIn = await ctx.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    expect(signIn.ok(), "sign in before cleaning users").toBeTruthy();
+
+    const users: ListedUser[] = [];
+    const limit = 100;
+    for (let offset = 0; ; offset += limit) {
+      const response = await ctx.get(`/api/auth/admin/list-users?limit=${limit}&offset=${offset}`);
+      expect(response.ok(), "list users during cleanup").toBeTruthy();
+      const body = (await response.json()) as { users?: ListedUser[] };
+      const page = body.users ?? [];
+      users.push(...page);
+      if (page.length < limit) break;
+    }
+
+    for (const user of users) {
+      if (baseline.has(user.id)) continue;
+      const response = await ctx.post("/api/auth/admin/remove-user", {
+        data: { userId: user.id },
+      });
+      expect(response.ok(), `remove disposable user ${user.id}`).toBeTruthy();
+    }
+  } finally {
+    await ctx.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -2,6 +2,15 @@ import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 import { ADMIN } from "../helpers/accounts";
 
+const PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAIAAAADAQMAAACDJEzCAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCSUTzXBDTwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozNzoxOSswMDowMOuehLIAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzc6MTkrMDA6MDCawzwOAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM3OjE5KzAwOjAwzdYd0QAAAAtJREFUCNdjYAABAAAGAAFm9MlsAAAAAElFTkSuQmCC",
+  "base64",
+);
+const TOO_WIDE_PNG = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAACAEAAAABAQMAAACfGLePAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCScoTk3I6QAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozOTo0MCswMDowMCgv/7YAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzk6NDArMDA6MDBZckcKAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM5OjQwKzAwOjAwDmdm1QAAAAxJREFUGNNjYBjpAAABAgABRf+HpwAAAABJRU5ErkJggg==",
+  "base64",
+);
+
 // admin storageState (project default)
 test("account opens on the profile section @smoke", async ({ page }) => {
   await ready(page, "/admin/account");
@@ -14,6 +23,60 @@ test("account opens on the profile section @smoke", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Save changes" })).toBeEnabled();
 });
 
+test("protected app routes do not inherit the admin shell @smoke", async ({ page }) => {
+  await ready(page, "/accept-invitation/not-a-real-invitation");
+  await expect(page.getByText("Organization invitation", { exact: true })).toBeVisible();
+  await expect(page.getByTestId("sidebar-brand")).toHaveCount(0);
+
+  await ready(page, "/admin");
+  await expect(page.getByTestId("sidebar-brand")).toBeVisible();
+});
+
+test("account displays profile image limits and updates every avatar", async ({ page }) => {
+  await ready(page, "/account");
+  await page.request.delete("/api/account/profile-image");
+  await ready(page, "/account");
+  await expect(page.getByTestId("profile-image-hint")).toContainText(/PNG, JPEG, (?:or )?WebP/);
+  await expect(page.getByTestId("profile-image-hint")).toContainText(/2 ?MB/);
+  await expect(page.getByTestId("profile-image-hint")).toContainText(/2048 × 2048 ?px/);
+
+  await page.locator("#profile-image").setInputFiles({
+    name: "avatar.png",
+    mimeType: "image/png",
+    buffer: PNG,
+  });
+  await expect(page.getByText(/Profile image updated|프로필 이미지를 변경했습니다/)).toBeVisible();
+  await expect(page.getByTestId("profile-image-preview").locator("img")).toBeVisible();
+
+  await ready(page, "/");
+  await expect(page.getByTestId("account-menu").locator("img")).toBeVisible();
+  await ready(page, "/admin");
+  await expect(page.getByTestId("sidebar-user-menu").locator("img")).toBeVisible();
+
+  await ready(page, "/account");
+  await page.getByRole("button", { name: /Remove image|이미지 제거/ }).click();
+  await expect(page.getByText(/Profile image removed|프로필 이미지를 제거했습니다/)).toBeVisible();
+  await expect(page.getByTestId("profile-image-preview").locator("img")).toHaveCount(0);
+  await expect(page.getByRole("button", { name: /Upload image|이미지 업로드/ })).toBeVisible();
+});
+
+test("account rejects invalid profile images before upload", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await page.locator("#profile-image").setInputFiles({
+    name: "avatar.txt",
+    mimeType: "text/plain",
+    buffer: Buffer.from("not an image"),
+  });
+  await expect(page.getByText(/Choose a valid PNG, JPEG, or WebP image|올바른 PNG, JPEG 또는 WebP 이미지를 선택해 주세요/)).toBeVisible();
+
+  await page.locator("#profile-image").setInputFiles({
+    name: "wide.png",
+    mimeType: "image/png",
+    buffer: TOO_WIDE_PNG,
+  });
+  await expect(page.getByText(/The image must not exceed 2048 × 2048 px|이미지는 2048 × 2048px를 초과할 수 없습니다/)).toBeVisible();
+});
+
 test("account exposes a change-email action when the address is edited", async ({ page }) => {
   await ready(page, "/admin/account");
   const email = page.getByLabel("Email");
@@ -106,7 +169,7 @@ test("account security and sessions sub-navigation", async ({ page }) => {
 
 test("account nav shows the core sections", async ({ page }) => {
   await ready(page, "/admin/account");
-  await expect(page.getByRole("button", { name: "Profile" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Profile", exact: true })).toBeVisible();
   await expect(page.getByRole("button", { name: "Security" })).toBeVisible();
   await expect(page.getByRole("button", { name: "Sessions" })).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/dashboard.ui.spec.ts

@@ -10,6 +10,22 @@ test("overview shows the signed-in admin @smoke", async ({ page }) => {
   await expect(page.getByRole("main").getByText(ADMIN.email)).toBeVisible();
 });
 
+test("landing shows language, theme, and signed-in account actions", async ({ page }) => {
+  await ready(page, "/");
+  const language = page.getByRole("button", { name: /^(Language|언어)$/ });
+  const theme = page.getByRole("button", { name: /^(Toggle theme|테마 전환)$/ });
+  await expect(language).toBeVisible();
+  await expect(language.locator("svg")).toBeVisible();
+  await expect(theme).toBeVisible();
+  await expect(theme.locator("svg:visible")).toBeVisible();
+  await page.getByTestId("account-menu").click();
+  const label = page.getByRole("menu").locator('[data-slot="dropdown-menu-label"]');
+  await expect(label.getByText(ADMIN.name, { exact: true })).toBeVisible();
+  await expect(label.getByText(ADMIN.email, { exact: true })).toBeVisible();
+  await expect(page.getByRole("menuitem", { name: "Account" })).toBeVisible();
+  await expect(page.getByRole("menuitem", { name: "Sign out" })).toBeVisible();
+});
+
 test("sidebar navigates to sessions and account @smoke", async ({ page }) => {
   await ready(page, "/admin");
   await page.getByRole("link", { name: "Sessions" }).click();