@podosoft/podokit 0.2.0 → 0.4.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.svelte

@@ -0,0 +1,20 @@
+<script lang="ts">
+  import "../app.css";
+  import { ModeWatcher } from "mode-watcher";
+  import { setI18nContext } from "$lib/i18n";
+  import { messages, resolveLocale } from "$lib/i18n/messages";
+
+  let { children, data } = $props();
+  const locale = $derived(resolveLocale(data.locale));
+  setI18nContext({
+    get t() {
+      return messages[locale];
+    },
+    get locale() {
+      return locale;
+    },
+  });
+</script>
+
+<ModeWatcher />
+{@render children()}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+page.svelte

@@ -0,0 +1,22 @@
+<script lang="ts">
+  import { Button } from "$lib/components/ui/button";
+  import LanguageSwitch from "$lib/components/language-switch.svelte";
+  import ThemeToggle from "$lib/components/theme-toggle.svelte";
+  import { getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+</script>
+
+<div class="flex min-h-svh flex-col">
+  <header class="flex items-center justify-end gap-2 p-4">
+    <LanguageSwitch />
+    <ThemeToggle />
+  </header>
+  <main class="flex flex-1 flex-col items-center justify-center gap-6 px-4 text-center">
+    <div class="flex flex-col gap-3">
+      <h1 class="text-3xl font-semibold">{i18n.t.landing.title}</h1>
+      <p class="text-muted-foreground max-w-md">{i18n.t.landing.subtitle}</p>
+    </div>
+    <Button href="/admin">{i18n.t.landing.openAdmin}</Button>
+  </main>
+</div>

package/dist/templates/modules/admin-dashboard/files/tests/api/audit.api.spec.ts

@@ -0,0 +1,48 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN, USER } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const origin = { origin: base };
+
+async function signedIn(
+  playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"],
+  account: { email: string; password: string },
+) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: account });
+  return ctx;
+}
+
+test("audit log records auth/admin actions", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const probe = await admin.get("/api/audit-logs");
+  test.skip(probe.status() === 404, "audit-log module not installed");
+
+  // an admin action that flows through better-auth (bypasses the interceptor)
+  const email = `audit-${Date.now()}@example.com`;
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "password123", name: "Audit", role: "user" },
+  });
+  expect(created.ok()).toBeTruthy();
+  const userId = (await created.json())?.user?.id as string;
+
+  const res = await admin.get("/api/audit-logs");
+  expect(res.ok()).toBeTruthy();
+  const entries = (await res.json()) as Array<{ action: string; actorEmail: string | null; targetLabel: string | null }>;
+  const entry = entries.find((e) => e.action === "user.create" && e.targetLabel === email);
+  expect(entry, "user.create should be audited with the target").toBeTruthy();
+  expect(entry?.actorEmail, "audit entry records the acting admin").toBe(ADMIN.email);
+
+  await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  await admin.dispose();
+});
+
+test("the audit log is admin-only", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
+  await admin.dispose();
+
+  const user = await signedIn(playwright, USER);
+  expect((await user.get("/api/audit-logs")).status()).toBe(403);
+  await user.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -0,0 +1,43 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN, USER } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const origin = { origin: base };
+
+// Accounts are created by the `setup` project (this `api` project depends on it).
+test("account/me is 401 when unauthenticated @smoke", async ({ request }) => {
+  const res = await request.get("/api/account/me", { headers: origin });
+  expect(res.status()).toBe(401);
+});
+
+test("sign-in with a wrong password is rejected", async ({ request }) => {
+  const res = await request.post("/api/auth/sign-in/email", {
+    headers: origin,
+    data: { email: ADMIN.email, password: "definitely-wrong" },
+  });
+  expect(res.ok()).toBeFalsy();
+});
+
+test("ADMIN_EMAILS account has the admin role @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const session = await ctx.get("/api/auth/get-session");
+  const body = await session.json();
+  expect(body?.user?.email).toBe(ADMIN.email);
+  expect(body?.user?.role).toBe("admin");
+  await ctx.dispose();
+});
+
+test("admin can list users, a normal user cannot (403)", async ({ playwright }) => {
+  const adminCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await adminCtx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const asAdmin = await adminCtx.get("/api/auth/admin/list-users?limit=5");
+  expect(asAdmin.ok()).toBeTruthy();
+  await adminCtx.dispose();
+
+  const userCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await userCtx.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
+  const asUser = await userCtx.get("/api/auth/admin/list-users?limit=5");
+  expect(asUser.status()).toBe(403);
+  await userCtx.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -0,0 +1,134 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN, USER } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const origin = { origin: base };
+
+async function signedIn(
+  playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"],
+  account: { email: string; password: string },
+) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: account });
+  return ctx;
+}
+
+test("admin can create a user, set its password, and remove it", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const email = `api-crud-${Date.now()}@example.com`;
+
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "password123", name: "API CRUD", role: "user" },
+  });
+  expect(created.ok()).toBeTruthy();
+  const id = (await created.json())?.user?.id as string;
+  expect(id).toBeTruthy();
+
+  const setPw = await admin.post("/api/auth/admin/set-user-password", {
+    data: { userId: id, newPassword: "newpass1234" },
+  });
+  expect(setPw.ok()).toBeTruthy();
+
+  // the new password works
+  const fresh = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const signin = await fresh.post("/api/auth/sign-in/email", { data: { email, password: "newpass1234" } });
+  expect(signin.ok()).toBeTruthy();
+  await fresh.dispose();
+
+  const removed = await admin.post("/api/auth/admin/remove-user", { data: { userId: id } });
+  expect(removed.ok()).toBeTruthy();
+  await admin.dispose();
+});
+
+test("a normal user cannot create users (403)", async ({ playwright }) => {
+  const user = await signedIn(playwright, USER);
+  const res = await user.post("/api/auth/admin/create-user", {
+    data: { email: `nope-${Date.now()}@example.com`, password: "password123", name: "Nope", role: "user" },
+  });
+  expect(res.status()).toBe(403);
+  await user.dispose();
+});
+
+test("admin can list and revoke a user's sessions", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const email = `api-sess-${Date.now()}@example.com`;
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "password123", name: "API Sess", role: "user" },
+  });
+  const userId = (await created.json())?.user?.id as string;
+
+  // the user signs in -> creates a session
+  const theirs = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await theirs.post("/api/auth/sign-in/email", { data: { email, password: "password123" } })).ok()).toBeTruthy();
+  await theirs.dispose();
+
+  const listed = await admin.post("/api/auth/admin/list-user-sessions", { data: { userId } });
+  expect(listed.ok()).toBeTruthy();
+  expect(((await listed.json())?.sessions ?? []).length).toBeGreaterThan(0);
+
+  const revoked = await admin.post("/api/auth/admin/revoke-user-sessions", { data: { userId } });
+  expect(revoked.ok()).toBeTruthy();
+  await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  await admin.dispose();
+});
+
+test("revokeOtherSessions keeps the current session valid", async ({ playwright }) => {
+  // Use a throwaway account so we don't revoke the shared USER's ui storageState.
+  const admin = await signedIn(playwright, ADMIN);
+  const email = `api-revoke-others-${Date.now()}@example.com`;
+  await admin.post("/api/auth/admin/create-user", { data: { email, password: "password123", name: "RO", role: "user" } });
+  await admin.dispose();
+
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: { email, password: "password123" } });
+  expect((await ctx.post("/api/auth/revoke-other-sessions")).ok()).toBeTruthy();
+  const after = await ctx.get("/api/auth/get-session");
+  expect((await after.json())?.user?.email).toBe(email); // still signed in
+  await ctx.dispose();
+});
+
+test("sessions record a client IP (forwarded through the proxy)", async ({ playwright }) => {
+  const ctx = await signedIn(playwright, ADMIN);
+  const res = await ctx.get("/api/auth/list-sessions");
+  const sessions = (await res.json()) as Array<{ ipAddress?: string | null }>;
+  expect(sessions.length).toBeGreaterThan(0);
+  expect(sessions[0]?.ipAddress).toBeTruthy();
+  expect(sessions[0]?.ipAddress).not.toBe("0000:0000:0000:0000:0000:0000:0000:0000");
+  await ctx.dispose();
+});
+
+test("account capabilities reports optional-feature flags", async ({ playwright }) => {
+  const ctx = await signedIn(playwright, ADMIN);
+  const res = await ctx.get("/api/account/capabilities");
+  expect(res.ok()).toBeTruthy();
+  const caps = await res.json();
+  expect(typeof caps.twoFactor).toBe("boolean");
+  expect(Array.isArray(caps.providers)).toBe(true);
+  expect(typeof caps.deleteAccount).toBe("boolean");
+  await ctx.dispose();
+});
+
+test("admin can update a user and impersonate them", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const email = `api-edit-${Date.now()}@example.com`;
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "password123", name: "Edit Me", role: "user" },
+  });
+  const userId = (await created.json())?.user?.id as string;
+
+  const updated = await admin.post("/api/auth/admin/update-user", { data: { userId, data: { name: "Updated" } } });
+  expect(updated.ok()).toBeTruthy();
+
+  // impersonate on a fresh context so shared sessions are untouched
+  const imp = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await imp.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  expect((await imp.post("/api/auth/admin/impersonate-user", { data: { userId } })).ok()).toBeTruthy();
+  const session = await (await imp.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(email);
+  expect(session?.session?.impersonatedBy).toBeTruthy();
+  await imp.post("/api/auth/admin/stop-impersonating");
+  await imp.dispose();
+
+  await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  await admin.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -0,0 +1,6 @@
+export type Account = { name: string; email: string; password: string };
+export const ADMIN = { name: "Admin", email: "admin@example.com", password: "password123" };
+export const USER = { name: "Normal User", email: "user@example.com", password: "password123" };
+export const adminState = "playwright/.auth/admin.json";
+export const userState = "playwright/.auth/user.json";
+export const anonState = { cookies: [], origins: [] } as const;

package/dist/templates/modules/admin-dashboard/files/tests/helpers/hydration.ts

@@ -0,0 +1,9 @@
+import type { Page } from "@playwright/test";
+
+// SvelteKit dev hydration can attach event handlers slightly after load;
+// wait for the page to settle before driving client-only interactions.
+export async function ready(page: Page, path: string): Promise<void> {
+  await page.goto(path);
+  await page.waitForLoadState("load");
+  await page.waitForTimeout(400);
+}

package/dist/templates/modules/admin-dashboard/files/tests/playwright.config.ts

@@ -0,0 +1,26 @@
+import { defineConfig, devices } from "@playwright/test";
+
+// admin-dashboard overlay: adds a `setup` project that seeds admin/user sessions
+// (storageState) which the `ui` project reuses. Serial + single worker because
+// tests share one backend/DB. Runs against a live stack on E2E_BASE_URL.
+const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+
+export default defineConfig({
+  testDir: ".",
+  fullyParallel: false,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: 1,
+  reporter: [["list"], ["html", { open: "never" }]],
+  use: { baseURL, trace: "on-first-retry", screenshot: "only-on-failure" },
+  projects: [
+    { name: "api", testMatch: /.*\.api\.spec\.ts/, dependencies: ["setup"] },
+    { name: "setup", testMatch: /.*\.setup\.ts/ },
+    {
+      name: "ui",
+      testMatch: /.*\.ui\.spec\.ts/,
+      dependencies: ["setup"],
+      use: { ...devices["Desktop Chrome"], storageState: "playwright/.auth/admin.json" },
+    },
+  ],
+});

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -0,0 +1,29 @@
+import { test as setup, expect } from "@playwright/test";
+import { ADMIN, USER, adminState, userState, type Account } from "./helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+
+// Seed a session via the API (reliable, no UI hydration races) and save its
+// cookies as storageState for the browser `ui` project to reuse.
+async function seedSession(
+  playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"],
+  account: Account,
+  path: string,
+): Promise<void> {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: { origin: base } });
+  await ctx.post("/api/auth/sign-up/email", { data: account }).catch(() => undefined); // idempotent
+  const res = await ctx.post("/api/auth/sign-in/email", {
+    data: { email: account.email, password: account.password },
+  });
+  expect(res.ok(), `sign-in ${account.email}`).toBeTruthy();
+  await ctx.storageState({ path });
+  await ctx.dispose();
+}
+
+setup("seed admin session", async ({ playwright }) => {
+  await seedSession(playwright, ADMIN, adminState);
+});
+
+setup("seed user session", async ({ playwright }) => {
+  await seedSession(playwright, USER, userState);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -0,0 +1,55 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default)
+test("account opens on the profile section @smoke", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
+  await expect(page.getByLabel("Name")).toBeVisible();
+  await expect(page.getByLabel("Email")).toHaveValue("admin@example.com");
+  // save is enabled only once the name changes
+  await expect(page.getByRole("button", { name: "Save changes" })).toBeDisabled();
+  await page.getByLabel("Name").fill("Admin Renamed");
+  await expect(page.getByRole("button", { name: "Save changes" })).toBeEnabled();
+});
+
+test("admin can update their profile name", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await page.getByLabel("Name").fill("Admin Renamed");
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("Profile updated")).toBeVisible();
+});
+
+test("account security and sessions sub-navigation", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Security" }).click();
+  await expect(page.getByLabel("Current password")).toBeVisible();
+  await page.getByRole("button", { name: "Sessions" }).click();
+  await expect(page.getByText("Active sessions")).toBeVisible();
+  await expect(page.getByText("Current", { exact: true })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Sign out other sessions" })).toBeVisible();
+});
+
+test("account nav shows the core sections", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await expect(page.getByRole("button", { name: "Profile" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Security" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Sessions" })).toBeVisible();
+});
+
+test("two-factor setup is available when enabled", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Security" }).click();
+  const heading = page.getByText("Two-factor authentication");
+  test.skip((await heading.count()) === 0, "two-factor not enabled");
+  await expect(heading).toBeVisible();
+  await expect(page.getByRole("button", { name: "Enable" })).toBeVisible();
+});
+
+test("danger zone offers account deletion when enabled", async ({ page }) => {
+  await ready(page, "/admin/account");
+  const danger = page.getByRole("button", { name: "Danger zone" });
+  test.skip((await danger.count()) === 0, "account deletion not enabled");
+  await danger.click();
+  await expect(page.getByRole("button", { name: "Delete account" })).toBeVisible();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/audit.ui.spec.ts

@@ -0,0 +1,16 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default). The Audit log page is gated by the
+// audit-log module; skip when it isn't installed in the generated app.
+test("admin can view audit entries when the module is installed", async ({ page }) => {
+  await ready(page, "/admin");
+  const auditNav = page.getByRole("link", { name: "Audit log" });
+  test.skip((await auditNav.count()) === 0, "audit-log module not installed");
+
+  await auditNav.click();
+  await expect(page).toHaveURL(/\/admin\/audit/);
+  await expect(page.getByRole("heading", { name: "Audit log" })).toBeVisible();
+  // seed sign-ins are audited via the better-auth hook, so an action row is present
+  await expect(page.getByText("auth.login").first()).toBeVisible();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -0,0 +1,45 @@
+import { expect, test } from "@playwright/test";
+import { anonState, ADMIN } from "../helpers/accounts";
+import { ready } from "../helpers/hydration";
+
+test.use({ storageState: anonState });
+
+test("login page renders @smoke", async ({ page }) => {
+  await page.goto("/login");
+  await expect(page.getByLabel("Email")).toBeVisible();
+  await expect(page.getByLabel("Password")).toBeVisible();
+  await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
+  await expect(page.getByRole("link", { name: "Sign up" })).toBeVisible();
+  await expect(page.getByRole("link", { name: "Forgot?" })).toBeVisible();
+});
+
+test("invalid credentials show an error", async ({ page }) => {
+  await ready(page, "/login");
+  await page.getByLabel("Email").fill("nobody@example.com");
+  await page.getByLabel("Password").fill("wrong-password");
+  await page.getByRole("button", { name: "Sign in", exact: true }).click();
+  await expect(page.getByRole("alert")).toBeVisible();
+  await expect(page).toHaveURL(/\/login/);
+});
+
+test("signup page renders", async ({ page }) => {
+  await page.goto("/signup");
+  await expect(page.getByLabel("Name")).toBeVisible();
+  await expect(page.getByRole("button", { name: "Create account" })).toBeVisible();
+});
+
+test("forgot-password shows a sent confirmation", async ({ page }) => {
+  await ready(page, "/forgot-password");
+  // Retry the submit to absorb any first-load hydration timing.
+  await expect(async () => {
+    await page.getByLabel("Email").fill(ADMIN.email);
+    await page.getByRole("button", { name: "Send reset link" }).click();
+    await expect(page.getByRole("alert")).toBeVisible({ timeout: 2000 });
+  }).toPass({ timeout: 15000 });
+});
+
+test("reset-password without a token is disabled", async ({ page }) => {
+  await page.goto("/reset-password");
+  await expect(page.getByRole("alert")).toBeVisible();
+  await expect(page.getByRole("button", { name: "Update password" })).toBeDisabled();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/dashboard.ui.spec.ts

@@ -0,0 +1,25 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN } from "../helpers/accounts";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default)
+test("overview shows the signed-in admin @smoke", async ({ page }) => {
+  await page.goto("/admin");
+  await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
+  // email appears in the sidebar user menu too — scope to the main content.
+  await expect(page.getByRole("main").getByText(ADMIN.email)).toBeVisible();
+});
+
+test("sidebar navigates to sessions and account", async ({ page }) => {
+  await ready(page, "/admin");
+  await page.getByRole("link", { name: "Sessions" }).click();
+  await expect(page).toHaveURL(/\/admin\/sessions/);
+  await expect(page.getByRole("heading", { name: "User sessions" })).toBeVisible();
+  // Account is reached from the user menu at the bottom of the sidebar, not the nav
+  await expect(page.getByRole("link", { name: "Account" })).toHaveCount(0);
+  await page.getByRole("button", { name: /admin@example.com/ }).click();
+  await page.getByRole("menuitem", { name: "Account" }).click();
+  await expect(page).toHaveURL(/\/admin\/account/);
+  await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
+  await expect(page.getByLabel("Name")).toBeVisible(); // profile section
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/guards.ui.spec.ts

@@ -0,0 +1,21 @@
+import { expect, test } from "@playwright/test";
+import { anonState, userState } from "../helpers/accounts";
+
+test.describe("unauthenticated", () => {
+  test.use({ storageState: anonState });
+  test("protected route redirects to login @smoke", async ({ page }) => {
+    await page.goto("/admin");
+    await expect(page).toHaveURL(/\/login\?redirect=/);
+  });
+});
+
+test.describe("normal user (non-admin)", () => {
+  test.use({ storageState: userState });
+  test("admin-only nav is hidden and admin routes are forbidden", async ({ page }) => {
+    await page.goto("/admin");
+    await expect(page.getByRole("link", { name: "Users" })).toHaveCount(0);
+    await expect(page.getByRole("link", { name: "Sessions" })).toHaveCount(0);
+    expect((await page.goto("/admin/users"))?.status()).toBe(403);
+    expect((await page.goto("/admin/sessions"))?.status()).toBe(403);
+  });
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/i18n.ui.spec.ts

@@ -0,0 +1,13 @@
+import { expect, test } from "@playwright/test";
+import { anonState } from "../helpers/accounts";
+import { ready } from "../helpers/hydration";
+
+test.use({ storageState: anonState });
+
+test("language switch toggles Korean and sets <html lang>", async ({ page }) => {
+  await ready(page, "/login");
+  await page.getByRole("button", { name: "Language" }).click();
+  await page.getByRole("menuitem", { name: /한국어/ }).click();
+  await expect(page.locator("html")).toHaveAttribute("lang", "ko");
+  await expect(page.getByRole("button", { name: "로그인", exact: true })).toBeVisible();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/sessions.ui.spec.ts

@@ -0,0 +1,15 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default) — sessions is an admin-only view
+test("admin sees user sessions across users @smoke", async ({ page }) => {
+  await ready(page, "/admin/sessions");
+  await expect(page.getByRole("heading", { name: "User sessions" })).toBeVisible();
+  // another user's session is listed here (the across-users admin view); scope to
+  // the table, not the sidebar, and match the first row.
+  await expect(page.getByRole("main").getByText("user@example.com").first()).toBeVisible();
+  // row actions are available
+  await page.getByRole("row", { name: /user@example.com/ }).first().getByRole("button").click();
+  await expect(page.getByRole("menuitem", { name: "Revoke session" })).toBeVisible();
+  await expect(page.getByRole("menuitem", { name: "Revoke all for user" })).toBeVisible();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/sidebar.ui.spec.ts

@@ -0,0 +1,16 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default)
+test("collapsing the sidebar hides the brand instead of overflowing @smoke", async ({ page }) => {
+  await ready(page, "/admin");
+  const brand = page.getByTestId("sidebar-brand");
+  const toggle = page.getByRole("button", { name: "Toggle Sidebar" });
+  await expect(brand).toBeVisible();
+
+  await toggle.click();
+  await expect(brand).toBeHidden(); // icon-collapsed: label is hidden, not spilling out
+
+  await toggle.click();
+  await expect(brand).toBeVisible();
+});