@podosoft/podokit 0.14.0 → 0.16.0

package/dist/templates/modules/admin-dashboard/files/tests/api/audit.api.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ADMIN, USER } from "../helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -13,7 +13,7 @@ async function signedIn(
   return ctx;
 }
 
-test("audit log records auth/admin actions", async ({ playwright }) => {
+test("audit log records auth/admin actions", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const probe = await admin.get("/api/audit-logs");
   test.skip(probe.status() === 404, "audit-log module not installed");
@@ -24,7 +24,7 @@ test("audit log records auth/admin actions", async ({ playwright }) => {
     data: { email, password: "Podokit3e-Str0ng!pw", name: "Audit", role: "user" },
   });
   expect(created.ok()).toBeTruthy();
-  const userId = (await created.json())?.user?.id as string;
+  const userId = await disposableUsers.trackResponse(created);
 
   const res = await admin.get("/api/audit-logs");
   expect(res.ok()).toBeTruthy();
@@ -34,6 +34,7 @@ test("audit log records auth/admin actions", async ({ playwright }) => {
   expect(entry?.actorEmail, "audit entry records the acting admin").toBe(ADMIN.email);
 
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  disposableUsers.forget(userId);
   await admin.dispose();
 });
 
@@ -47,11 +48,14 @@ test("the audit log is admin-only", async ({ playwright }) => {
   await user.dispose();
 });
 
-test("sending a verification email is audited", async ({ playwright }) => {
+test("sending a verification email is audited", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
   const email = `verif-audit-${Date.now()}@example.com`;
-  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "VA", role: "user" } });
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "VA", role: "user" },
+  });
+  await disposableUsers.trackResponse(created);
   await admin.post("/api/auth/send-verification-email", { data: { email, callbackURL: `${base}/admin` } });
   const entries = (await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>;
   expect(entries.some((e) => e.action === "auth.verification_sent"), "verification send should be audited").toBeTruthy();
@@ -60,7 +64,7 @@ test("sending a verification email is audited", async ({ playwright }) => {
 
 // Audit logging is a DB-backed on/off toggle (auth_config `server`, applied live).
 // Runs after the recording tests and restores the flag so nothing else is affected.
-test("audit logging honours the DB on/off toggle @smoke", async ({ playwright }) => {
+test("audit logging honours the DB on/off toggle @smoke", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
   const auditLog = async () => (await (await admin.get("/api/account/capabilities")).json()).auditLog as boolean;
@@ -68,8 +72,12 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright })
     ((await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>).some(
       (e) => e.action === "user.create" && e.targetLabel === label,
     );
-  const createUser = async (email: string) =>
-    (await (await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "T", role: "user" } })).json())?.user?.id as string;
+  const createUser = async (email: string): Promise<string> => {
+    const response = await admin.post("/api/auth/admin/create-user", {
+      data: { email, password: "Podokit3e-Str0ng!pw", name: "T", role: "user" },
+    });
+    return disposableUsers.trackResponse(response);
+  };
 
   try {
     // OFF → the action is not recorded. Wait past the config-store cache TTL so the
@@ -81,6 +89,7 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright })
     const offId = await createUser(offEmail);
     expect(await recorded(offEmail), "no audit entry while disabled").toBe(false);
     await admin.post("/api/auth/admin/remove-user", { data: { userId: offId } });
+    disposableUsers.forget(offId);
 
     // ON → recording resumes.
     await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
@@ -90,6 +99,7 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright })
     const onId = await createUser(onEmail);
     expect(await recorded(onEmail), "audit entry recorded once re-enabled").toBe(true);
     await admin.post("/api/auth/admin/remove-user", { data: { userId: onId } });
+    disposableUsers.forget(onId);
   } finally {
     await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
     await admin.dispose();

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ADMIN, USER } from "../helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -13,7 +13,7 @@ async function signedIn(
   return ctx;
 }
 
-test("admin can create a user, set its password, and remove it", async ({ playwright }) => {
+test("admin can create a user, set its password, and remove it", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-crud-${Date.now()}@example.com`;
 
@@ -21,7 +21,7 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
     data: { email, password: "Podokit3e-Str0ng!pw", name: "API CRUD", role: "user" },
   });
   expect(created.ok()).toBeTruthy();
-  const id = (await created.json())?.user?.id as string;
+  const id = await disposableUsers.trackResponse(created);
   expect(id).toBeTruthy();
 
   const setPw = await admin.post("/api/auth/admin/set-user-password", {
@@ -37,6 +37,7 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
 
   const removed = await admin.post("/api/auth/admin/remove-user", { data: { userId: id } });
   expect(removed.ok()).toBeTruthy();
+  disposableUsers.forget(id);
   await admin.dispose();
 });
 
@@ -49,13 +50,13 @@ test("a normal user cannot create users (403)", async ({ playwright }) => {
   await user.dispose();
 });
 
-test("admin can list and revoke a user's sessions", async ({ playwright }) => {
+test("admin can list and revoke a user's sessions", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-sess-${Date.now()}@example.com`;
   const created = await admin.post("/api/auth/admin/create-user", {
     data: { email, password: "Podokit3e-Str0ng!pw", name: "API Sess", role: "user" },
   });
-  const userId = (await created.json())?.user?.id as string;
+  const userId = await disposableUsers.trackResponse(created);
 
   // the user signs in -> creates a session
   const theirs = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -69,14 +70,18 @@ test("admin can list and revoke a user's sessions", async ({ playwright }) => {
   const revoked = await admin.post("/api/auth/admin/revoke-user-sessions", { data: { userId } });
   expect(revoked.ok()).toBeTruthy();
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  disposableUsers.forget(userId);
   await admin.dispose();
 });
 
-test("revokeOtherSessions keeps the current session valid", async ({ playwright }) => {
+test("revokeOtherSessions keeps the current session valid", async ({ playwright, disposableUsers }) => {
   // Use a throwaway account so we don't revoke the shared USER's ui storageState.
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-revoke-others-${Date.now()}@example.com`;
-  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "RO", role: "user" } });
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "RO", role: "user" },
+  });
+  await disposableUsers.trackResponse(created);
   await admin.dispose();
 
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -109,13 +114,13 @@ test("account capabilities reports optional-feature flags", async ({ playwright
   await ctx.dispose();
 });
 
-test("admin can update a user and impersonate them", async ({ playwright }) => {
+test("admin can update a user and impersonate them", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-edit-${Date.now()}@example.com`;
   const created = await admin.post("/api/auth/admin/create-user", {
     data: { email, password: "Podokit3e-Str0ng!pw", name: "Edit Me", role: "user" },
   });
-  const userId = (await created.json())?.user?.id as string;
+  const userId = await disposableUsers.trackResponse(created);
 
   const updated = await admin.post("/api/auth/admin/update-user", { data: { userId, data: { name: "Updated" } } });
   expect(updated.ok()).toBeTruthy();
@@ -131,5 +136,6 @@ test("admin can update a user and impersonate them", async ({ playwright }) => {
   await imp.dispose();
 
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  disposableUsers.forget(userId);
   await admin.dispose();
 });

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -3,4 +3,5 @@ export const ADMIN = { name: "Admin", email: "admin@example.com", password: "Pod
 export const USER = { name: "Normal User", email: "user@example.com", password: "Podokit3e-Str0ng!pw" };
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
+export const userBaselineState = "playwright/.auth/user-baseline.json";
 export const anonState = { cookies: [], origins: [] } as const;

package/dist/templates/modules/admin-dashboard/files/tests/helpers/disposable-users.ts

@@ -0,0 +1,83 @@
+import {
+  expect,
+  test as base,
+  type APIResponse,
+} from "@playwright/test";
+
+const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: baseURL };
+
+type CreateUserInput = {
+  email: string;
+  password?: string;
+  name?: string;
+  role?: string;
+};
+
+export type DisposableUsers = {
+  create(input: CreateUserInput): Promise<string>;
+  trackResponse(response: APIResponse): Promise<string>;
+  track(userId: string): void;
+  forget(userId: string): void;
+};
+
+async function readCreatedUserId(response: APIResponse): Promise<string> {
+  expect(response.ok()).toBeTruthy();
+  const body = (await response.json()) as { user?: { id?: unknown } };
+  expect(typeof body.user?.id).toBe("string");
+  return body.user?.id as string;
+}
+
+export const test = base.extend<{ disposableUsers: DisposableUsers }>({
+  disposableUsers: async ({ context }, use) => {
+    // Reuse the browser context's storageState-backed request client. Creating
+    // a second admin login here can revoke the browser session in applications
+    // that enforce a single concurrent session.
+    const request = context.request;
+    const userIds = new Set<string>();
+
+    const disposableUsers: DisposableUsers = {
+      async create(input): Promise<string> {
+        const response = await request.post("/api/auth/admin/create-user", {
+          headers: origin,
+          data: {
+            password: "Podokit3e-Str0ng!pw",
+            name: "Throwaway",
+            role: "user",
+            ...input,
+          },
+        });
+        const userId = await readCreatedUserId(response);
+        userIds.add(userId);
+        return userId;
+      },
+      async trackResponse(response): Promise<string> {
+        const userId = await readCreatedUserId(response);
+        userIds.add(userId);
+        return userId;
+      },
+      track(userId): void {
+        userIds.add(userId);
+      },
+      forget(userId): void {
+        userIds.delete(userId);
+      },
+    };
+
+    try {
+      await use(disposableUsers);
+    } finally {
+      for (const userId of userIds) {
+        const response = await request.post("/api/auth/admin/remove-user", {
+          headers: origin,
+          data: { userId },
+        });
+        if (!response.ok() && response.status() !== 404) {
+          throw new Error(`Failed to remove disposable user ${userId}: HTTP ${response.status()}`);
+        }
+      }
+    }
+  },
+});
+
+export { expect };

package/dist/templates/modules/admin-dashboard/files/tests/playwright.config.ts

@@ -1,9 +1,21 @@
 import { defineConfig, devices } from "@playwright/test";
+import { loadPlaywrightProjects } from "./playwright.extensions";
 
 // admin-dashboard overlay: adds a `setup` project that seeds admin/user sessions
 // (storageState) which the `ui` project reuses. Serial + single worker because
 // tests share one backend/DB. Runs against a live stack on E2E_BASE_URL.
 const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const coreProjects = [
+  { name: "api", testMatch: /.*\.api\.spec\.ts/, dependencies: ["setup"] },
+  { name: "setup", testMatch: /.*\.setup\.ts/, teardown: "cleanup" },
+  { name: "cleanup", testMatch: /.*\.teardown\.ts/ },
+  {
+    name: "ui",
+    testMatch: /.*\.ui\.spec\.ts/,
+    dependencies: ["setup"],
+    use: { ...devices["Desktop Chrome"], storageState: "playwright/.auth/admin.json" },
+  },
+];
 
 export default defineConfig({
   testDir: ".",
@@ -13,14 +25,5 @@ export default defineConfig({
   workers: 1,
   reporter: [["list"], ["html", { open: "never" }]],
   use: { baseURL, trace: "on-first-retry", screenshot: "only-on-failure" },
-  projects: [
-    { name: "api", testMatch: /.*\.api\.spec\.ts/, dependencies: ["setup"] },
-    { name: "setup", testMatch: /.*\.setup\.ts/ },
-    {
-      name: "ui",
-      testMatch: /.*\.ui\.spec\.ts/,
-      dependencies: ["setup"],
-      use: { ...devices["Desktop Chrome"], storageState: "playwright/.auth/admin.json" },
-    },
-  ],
+  projects: [...coreProjects, ...loadPlaywrightProjects(coreProjects)],
 });

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -1,10 +1,46 @@
 import { test as setup, expect } from "@playwright/test";
-import { ADMIN, USER, adminState, userState, type Account } from "./helpers/accounts";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import {
+  ADMIN,
+  USER,
+  adminState,
+  userState,
+  userBaselineState,
+  type Account,
+} from "./helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+mkdirSync(dirname(adminState), { recursive: true });
+
+type StorageState = Awaited<
+  ReturnType<import("@playwright/test").APIRequestContext["storageState"]>
+>;
+
+function withTestLocale(state: StorageState): StorageState {
+  const url = new URL(base);
+  return {
+    ...state,
+    cookies: [
+      ...state.cookies.filter((cookie) => cookie.name !== "locale"),
+      {
+        name: "locale",
+        value: "en",
+        domain: url.hostname,
+        path: "/",
+        expires: -1,
+        httpOnly: false,
+        secure: url.protocol === "https:",
+        sameSite: "Lax",
+      },
+    ],
+  };
+}
 
 // Seed a session via the API (reliable, no UI hydration races) and save its
-// cookies as storageState for the browser `ui` project to reuse.
+// cookies as storageState for the browser `ui` project to reuse. Pin the suite
+// locale because UI locators use the generated English catalog and must not
+// inherit an application's configured default language.
 async function seedSession(
   playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"],
   account: Account,
@@ -26,7 +62,7 @@ async function seedSession(
     if (!Array.isArray(sessions) || sessions.length <= 1) break;
     expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
   }
-  await ctx.storageState({ path });
+  writeFileSync(path, `${JSON.stringify(withTestLocale(await ctx.storageState()), null, 2)}\n`);
   await ctx.dispose();
 }
 
@@ -48,3 +84,33 @@ setup("enable optional features", async ({ playwright }) => {
 setup("seed user session", async ({ playwright }) => {
   await seedSession(playwright, USER, userState);
 });
+
+setup("capture the user cleanup baseline", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin: base },
+  });
+  try {
+    const signIn = await ctx.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    expect(signIn.ok(), "sign in before capturing the user baseline").toBeTruthy();
+    const ids: string[] = [];
+    const limit = 100;
+    for (let offset = 0; ; offset += limit) {
+      const response = await ctx.get(`/api/auth/admin/list-users?limit=${limit}&offset=${offset}`);
+      expect(response.ok(), "list users before the suite").toBeTruthy();
+      const body = (await response.json()) as { users?: Array<{ id?: unknown }> };
+      const page = body.users ?? [];
+      ids.push(
+        ...page
+          .map((user) => user.id)
+          .filter((id): id is string => typeof id === "string"),
+      );
+      if (page.length < limit) break;
+    }
+    writeFileSync(userBaselineState, `${JSON.stringify(ids, null, 2)}\n`);
+  } finally {
+    await ctx.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/seed.teardown.ts

@@ -0,0 +1,46 @@
+import { existsSync, readFileSync } from "node:fs";
+import { expect, test as cleanup } from "@playwright/test";
+import { ADMIN, userBaselineState } from "./helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
+type ListedUser = {
+  id: string;
+};
+
+cleanup("remove users created by the suite", async ({ playwright }) => {
+  if (!existsSync(userBaselineState)) return;
+  const baseline = new Set(JSON.parse(readFileSync(userBaselineState, "utf8")) as string[]);
+  const ctx = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin: base },
+  });
+
+  try {
+    const signIn = await ctx.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    expect(signIn.ok(), "sign in before cleaning users").toBeTruthy();
+
+    const users: ListedUser[] = [];
+    const limit = 100;
+    for (let offset = 0; ; offset += limit) {
+      const response = await ctx.get(`/api/auth/admin/list-users?limit=${limit}&offset=${offset}`);
+      expect(response.ok(), "list users during cleanup").toBeTruthy();
+      const body = (await response.json()) as { users?: ListedUser[] };
+      const page = body.users ?? [];
+      users.push(...page);
+      if (page.length < limit) break;
+    }
+
+    for (const user of users) {
+      if (baseline.has(user.id)) continue;
+      const response = await ctx.post("/api/auth/admin/remove-user", {
+        data: { userId: user.id },
+      });
+      expect(response.ok(), `remove disposable user ${user.id}`).toBeTruthy();
+    }
+  } finally {
+    await ctx.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/data-table.ui.spec.ts

@@ -30,3 +30,16 @@ test("audit table sorts client-side", async ({ page }) => {
   await page.getByRole("button", { name: "When" }).click(); // default desc -> asc
   await expect(page.getByRole("columnheader", { name: /When/ })).toHaveAttribute("aria-sort", "ascending");
 });
+
+test("users table keeps responsive headers and cells aligned", async ({ page }) => {
+  await page.setViewportSize({ width: 390, height: 844 });
+  await ready(page, "/admin/users");
+  const table = page.getByRole("table", { name: "Users" });
+  const visibleHeaders = table.locator("thead th:visible");
+  const visibleCells = table.locator("tbody tr").first().locator("td:visible");
+
+  await expect(table.getByRole("columnheader", { name: "Role" })).toBeHidden();
+  await expect(table.getByRole("columnheader", { name: "Status" })).toBeHidden();
+  await expect(table.getByRole("columnheader", { name: "Joined" })).toBeHidden();
+  expect(await visibleHeaders.count()).toBe(await visibleCells.count());
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/email-admin.ui.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ready } from "../helpers/hydration";
 import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
 
@@ -17,14 +17,11 @@ test("verification badges stay hidden when the feature is off", async ({ page })
 });
 
 // Admin can trigger a password-reset email for a user (not verification-gated).
-test("admin sends a password reset email to a user", async ({ page }) => {
+test("admin sends a password reset email to a user", async ({ page, disposableUsers }) => {
   test.skip(!(await mailpitReachable()), "Mailpit not available");
   await ready(page, "/admin/users");
   const email = `admin-reset-${Date.now()}@example.com`;
-  await page.request.post("/api/auth/admin/create-user", {
-    headers: { origin: base },
-    data: { email, password: "Podokit3e-Str0ng!pw", name: "AR", role: "user" },
-  });
+  await disposableUsers.create({ email, name: "AR" });
   await clearMailpit();
   await page.locator("#toolbar-search").fill(email);
   await page.getByRole("button", { name: "Search", exact: true }).click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/users-crud.ui.spec.ts

@@ -1,16 +1,13 @@
-import { expect, test, type Page } from "@playwright/test";
+import { type Page } from "@playwright/test";
+import { expect, test, type DisposableUsers } from "../helpers/disposable-users";
 import { ready } from "../helpers/hydration";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
 // Seed a throwaway user via the API (admin cookies come from storageState) so
 // the mutating UI tests don't touch the shared admin/user seed accounts.
-async function seedUser(page: Page, email: string): Promise<void> {
-  const res = await page.request.post("/api/auth/admin/create-user", {
-    headers: { origin: base },
-    data: { email, password: "Podokit3e-Str0ng!pw", name: "Throwaway", role: "user" },
-  });
-  expect(res.ok()).toBeTruthy();
+async function seedUser(disposableUsers: DisposableUsers, email: string): Promise<string> {
+  return disposableUsers.create({ email });
 }
 
 // Open the Manage two-pane modal for a seeded user.
@@ -21,7 +18,7 @@ async function openManage(page: Page, email: string): Promise<void> {
   await page.getByRole("menuitem", { name: "Manage" }).click();
 }
 
-test("admin can create a user via the dialog @smoke", async ({ page }) => {
+test("admin can create a user via the dialog @smoke", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-create-${Date.now()}@example.com`;
   await page.getByRole("button", { name: "Add user" }).click();
@@ -30,7 +27,13 @@ test("admin can create a user via the dialog @smoke", async ({ page }) => {
   await dialog.getByLabel("Email").fill(email);
   await dialog.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
   await dialog.getByLabel("Confirm password").fill("Podokit3e-Str0ng!pw");
+  const created = page.waitForResponse(
+    (response) =>
+      response.url().endsWith("/api/auth/admin/create-user") &&
+      response.request().method() === "POST",
+  );
   await dialog.getByRole("button", { name: "Create" }).click();
+  await disposableUsers.trackResponse(await created);
   // Wait for the create to settle (dialog closes + list reloads) before searching,
   // otherwise the search input can be refilled by the post-create reload.
   await expect(page.getByRole("dialog")).toBeHidden();
@@ -51,10 +54,10 @@ test("create rejects mismatched passwords", async ({ page }) => {
   await expect(dialog.getByText("Passwords do not match")).toBeVisible();
 });
 
-test("manage: edit profile name", async ({ page }) => {
+test("manage: edit profile name", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-edit-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
   await dialog.getByLabel("Name").fill("Edited Name");
@@ -62,10 +65,10 @@ test("manage: edit profile name", async ({ page }) => {
   await expect(page.getByText("User updated")).toBeVisible();
 });
 
-test("manage: set a password (and reject mismatch)", async ({ page }) => {
+test("manage: set a password (and reject mismatch)", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-setpw-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
   await dialog.getByRole("button", { name: "Security" }).click();
@@ -78,10 +81,10 @@ test("manage: set a password (and reject mismatch)", async ({ page }) => {
   await expect(page.getByText("Password updated")).toBeVisible();
 });
 
-test("manage: ban a user with a reason", async ({ page }) => {
+test("manage: ban a user with a reason", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-ban-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
   await dialog.getByRole("button", { name: "Security" }).click();
@@ -90,10 +93,10 @@ test("manage: ban a user with a reason", async ({ page }) => {
   await expect(page.getByText("User banned", { exact: true })).toBeVisible();
 });
 
-test("manage: revoke a user's session", async ({ page, playwright }) => {
+test("manage: revoke a user's session", async ({ page, playwright, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-sess-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   // create a session for the user in an isolated context (don't touch the admin cookie)
   const uctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: { origin: base } });
   expect((await uctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).ok()).toBeTruthy();
@@ -105,39 +108,42 @@ test("manage: revoke a user's session", async ({ page, playwright }) => {
   await expect(page.getByText("Session revoked")).toBeVisible();
 });
 
-test("manage: delete a user from the danger zone", async ({ page }) => {
+test("manage: delete a user from the danger zone", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-delete-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  const userId = await seedUser(disposableUsers, email);
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
   await dialog.getByRole("button", { name: "Danger zone" }).click();
   await dialog.getByRole("button", { name: "Delete" }).click(); // arm
   await dialog.getByRole("button", { name: "Delete" }).click(); // confirm
   await expect(page.getByText("User deleted")).toBeVisible();
+  disposableUsers.forget(userId);
   await page.locator("#toolbar-search").fill(email);
   await page.getByRole("button", { name: "Search", exact: true }).click();
   await expect(page.getByRole("cell", { name: email })).toHaveCount(0);
 });
 
-test("users list shows pagination beyond one page", async ({ page }) => {
+test("users list shows pagination beyond one page", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
-  for (let i = 0; i < 6; i += 1) {
-    await page.request.post("/api/auth/admin/create-user", {
-      headers: { origin: base },
-      data: { email: `pg-${Date.now()}-${i}@example.com`, password: "Podokit3e-Str0ng!pw", name: `Pg${i}`, role: "user" },
+  const prefix = `pg-${Date.now()}`;
+  for (let i = 0; i < 16; i += 1) {
+    await disposableUsers.create({
+      email: `${prefix}-${i}@example.com`,
+      name: `Page user ${i}`,
     });
   }
-  await page.reload();
-  const nav = page.getByRole("navigation", { name: "pagination" });
+  await page.locator("#toolbar-search").fill(prefix);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+  const nav = page.getByRole("navigation", { name: "pagination" }).first();
   await expect(nav).toBeVisible();
-  await expect(nav.getByRole("button", { name: "Page 2" })).toBeVisible();
+  await expect(nav.getByRole("button", { name: "Page 2", exact: true }).first()).toBeVisible();
 });
 
-test("manage modal closes from its footer", async ({ page }) => {
+test("manage modal closes from its footer", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-close-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   await openManage(page, email);
   // footer Close (a visible button, distinct from the header X) dismisses the modal
   await page.getByRole("dialog").getByRole("button", { name: "Close", exact: true }).last().click();