@podosoft/podokit 0.3.0 → 0.5.0

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -0,0 +1,80 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Fresh admin context (not the shared storageState) so these never rotate the
+// seeded admin session.
+async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  return ctx;
+}
+
+test("admin can enable Google OAuth from the DB and it applies without a restart @smoke", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const social = () => anon.post("/api/auth/sign-in/social", { data: { provider: "google", callbackURL: `${base}/admin` } });
+
+  // Before: provider not configured.
+  await expect.poll(async () => (await social()).status(), { timeout: 8000 }).toBe(404);
+
+  // Paste credentials via the admin API.
+  const put = await admin.put("/api/account/auth-config", {
+    data: { social: { google: { enabled: true, clientId: "dummy-google-client-id", clientSecret: "dummy-google-client-secret" } } },
+  });
+  expect(put.ok()).toBeTruthy();
+  const view = await put.json();
+  expect(view.social.google.hasSecret).toBe(true);
+  expect(view.social.google.clientId).toBe("dummy-google-client-id");
+  expect("clientSecret" in view.social.google).toBe(false); // secret is never returned
+
+  // Applied live (no restart): social sign-in now redirects to Google.
+  await expect
+    .poll(async () => {
+      const r = await social();
+      return r.ok() ? (((await r.json())?.url as string) ?? "") : "";
+    }, { timeout: 8000 })
+    .toContain("accounts.google.com");
+  const caps = await (await anon.get("/api/account/capabilities")).json();
+  expect(caps.providers).toContain("google");
+
+  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // restore
+  await anon.dispose();
+  await admin.dispose();
+});
+
+test("admin can add and remove a social provider dynamically @smoke", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  // The catalog offers providers beyond the two legacy env-backed ones.
+  const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
+  expect(catalog.map((c) => c.id)).toEqual(expect.arrayContaining(["google", "github", "apple"]));
+
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const github = () => anon.post("/api/auth/sign-in/social", { data: { provider: "github", callbackURL: `${base}/admin` } });
+
+  // Add GitHub (a provider with no env fallback) → applies live, no restart.
+  await admin.put("/api/account/auth-config", { data: { social: { github: { enabled: true, clientId: "dummy-github-client-id", clientSecret: "dummy-github-client-secret" } } } });
+  await expect
+    .poll(async () => { const r = await github(); return r.ok() ? (((await r.json())?.url as string) ?? "") : ""; }, { timeout: 8000 })
+    .toContain("github.com");
+
+  // Remove it → the row is deleted and the provider stops working (again live).
+  await admin.put("/api/account/auth-config", { data: { social: { github: { delete: true } } } });
+  expect("github" in (await (await admin.get("/api/account/auth-config")).json()).social).toBe(false);
+  await expect.poll(async () => (await github()).status(), { timeout: 8000 }).toBe(404);
+
+  await anon.dispose();
+  await admin.dispose();
+});
+
+test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwright }) => {
+  const user = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `acfg-${Date.now()}@example.com`;
+  await user.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "U" } });
+  expect((await user.get("/api/account/auth-config")).status()).toBe(403);
+  expect((await user.put("/api/account/auth-config", { data: { server: { hibp: true } } })).status()).toBe(403);
+  await user.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -0,0 +1,306 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN, USER } from "../helpers/accounts";
+import { clearSms, smsSinkReachable, waitForSmsOtp } from "../helpers/sms";
+import { totpCode } from "../helpers/totp";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Accounts are created by the `setup` project (this `api` project depends on it).
+test("account/me is 401 when unauthenticated @smoke", async ({ request }) => {
+  const res = await request.get("/api/account/me", { headers: origin });
+  expect(res.status()).toBe(401);
+});
+
+test("rejects a breached password on sign-up @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.passwordBreachCheck, "breach check not enabled");
+  // "password" is one of the most-breached passwords; Have I Been Pwned rejects it.
+  const res = await ctx.post("/api/auth/sign-up/email", {
+    data: { name: "Pwned", email: `pwned-${Date.now()}@example.com`, password: "password" },
+  });
+  expect(res.ok()).toBeFalsy();
+  await ctx.dispose();
+});
+
+test("phone number: verify with the code delivered to the SMS sink @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.phoneNumber, "phone number not enabled");
+  test.skip(!(await smsSinkReachable()), "SMS sink not reachable");
+  await clearSms();
+  const email = `phone-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Phone" } });
+  // Unique number per run so the "phone already exists" guard never trips.
+  const phone = `+1555${Date.now().toString().slice(-7)}`;
+
+  const sent = await ctx.post("/api/auth/phone-number/send-otp", { data: { phoneNumber: phone } });
+  expect(sent.ok()).toBeTruthy();
+  const code = await waitForSmsOtp(phone); // read the real code back from the sink
+
+  const verified = await ctx.post("/api/auth/phone-number/verify", {
+    data: { phoneNumber: phone, code, updatePhoneNumber: true },
+  });
+  expect(verified.ok()).toBeTruthy();
+  const session = await (await ctx.get("/api/auth/get-session")).json();
+  expect(session?.user?.phoneNumber).toBe(phone);
+  expect(session?.user?.phoneNumberVerified).toBe(true);
+  await ctx.dispose();
+});
+
+test("two-factor: enable with a real TOTP code and require it at sign-in @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.twoFactor, "two-factor not enabled");
+  const email = `tf-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "TF" } });
+
+  // Enable 2FA and confirm it with a code computed from the returned otpauth URI.
+  const enable = await (await ctx.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+  expect(typeof enable.totpURI).toBe("string");
+  const verified = await ctx.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+  expect(verified.ok()).toBeTruthy();
+
+  // A fresh sign-in must now be challenged for the second factor (no full session).
+  const ctx2 = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const signin = await (await ctx2.post("/api/auth/sign-in/email", { data: { email, password: pw } })).json();
+  expect(signin.twoFactorRedirect).toBe(true);
+  const session = await (await ctx2.get("/api/auth/get-session")).json();
+  expect(session?.user).toBeFalsy();
+  await ctx.dispose();
+  await ctx2.dispose();
+});
+
+test("multi-session holds several accounts and switches between them @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.multiSession, "multi-session not enabled");
+  const pw = "Podokit3e-Str0ng!pw";
+  const a = `ms-a-${Date.now()}@example.com`;
+  const b = `ms-b-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email: a, password: pw, name: "A" } });
+  await ctx.post("/api/auth/sign-up/email", { data: { email: b, password: pw, name: "B" } });
+  type Device = { session: { token: string }; user: { email: string } };
+  const devices = (await (await ctx.get("/api/auth/multi-session/list-device-sessions")).json()) as Device[];
+  expect(devices.length).toBeGreaterThanOrEqual(2);
+  // most recent sign-up is active; switch back to the first account
+  const first = devices.find((d) => d.user?.email === a);
+  expect(first?.session?.token).toBeTruthy();
+  await ctx.post("/api/auth/multi-session/set-active", { data: { sessionToken: first!.session.token } });
+  const session = await (await ctx.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(a);
+  await ctx.dispose();
+});
+
+test("a user can sign in with a username @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.username, "username not enabled");
+  const email = `uname-${Date.now()}@example.com`;
+  const uname = `user${Date.now()}`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "Uname" } });
+  expect((await ctx.post("/api/auth/update-user", { data: { username: uname } })).ok()).toBeTruthy();
+  await ctx.dispose();
+  const ctx2 = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const signedIn = await ctx2.post("/api/auth/sign-in/username", { data: { username: uname, password: pw } });
+  expect(signedIn.ok()).toBeTruthy();
+  const session = await (await ctx2.get("/api/auth/get-session")).json();
+  expect(session?.user?.username).toBe(uname);
+  await ctx2.dispose();
+});
+
+test("bearer token authenticates API requests without a cookie @smoke", async ({ playwright }) => {
+  const email = `bearer-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  const signup = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await signup.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "Bearer" } });
+  const signIn = await signup.post("/api/auth/sign-in/email", { data: { email, password: pw } });
+  expect(signIn.ok()).toBeTruthy();
+  // The bearer plugin accepts the session token as `Authorization: Bearer`. Take it
+  // from the session cookie the sign-in set (equivalent to the set-auth-token header).
+  const state = await signup.storageState();
+  const token = state.cookies.find((c) => c.name.endsWith("session_token"))?.value;
+  expect(token, "sign-in set a session token").toBeTruthy();
+  await signup.dispose();
+  // Fresh context = no session cookie; authenticate purely via the bearer header.
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await api.get("/api/account/me")).status()).toBe(401);
+  const authed = await api.get("/api/account/me", { headers: { Authorization: `Bearer ${token}` } });
+  expect(authed.ok()).toBeTruthy();
+  expect((await authed.json())?.email).toBe(email);
+  await api.dispose();
+});
+
+test("a user can create, list and revoke a personal API key @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.apiKey, "api keys not enabled");
+  const email = `apikey-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Key" } });
+
+  const created = await ctx.post("/api/auth/api-key/create", { data: { name: "ci" } });
+  expect(created.ok()).toBeTruthy();
+  const key = (await created.json())?.key as string;
+  expect(typeof key).toBe("string");
+  expect(key.length).toBeGreaterThan(0);
+
+  const body = (await (await ctx.get("/api/auth/api-key/list")).json()) as { apiKeys: Array<{ id: string; name: string | null }> };
+  expect(body.apiKeys.some((k) => k.name === "ci")).toBeTruthy();
+
+  const del = await ctx.post("/api/auth/api-key/delete", { data: { keyId: body.apiKeys[0].id } });
+  expect(del.ok()).toBeTruthy();
+  await ctx.dispose();
+});
+
+test("access control enforces custom role permissions @smoke", async ({ playwright }) => {
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const caps = await (await admin.get("/api/account/capabilities")).json();
+  expect(caps.roles).toEqual(expect.arrayContaining(["admin", "moderator", "user"]));
+
+  // A default user lacks the content:create permission.
+  const email = `ac-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  const u = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await u.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "AC" } });
+  const before = await (await u.post("/api/auth/admin/has-permission", { data: { permissions: { content: ["create"] } } })).json();
+  expect(before.success).toBeFalsy();
+  const me = await (await u.get("/api/auth/get-session")).json();
+  await u.dispose();
+
+  // Promote to moderator; a fresh session now passes the same check.
+  const set = await admin.post("/api/auth/admin/set-role", { data: { userId: me.user.id, role: "moderator" } });
+  expect(set.ok()).toBeTruthy();
+  const u2 = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await u2.post("/api/auth/sign-in/email", { data: { email, password: pw } });
+  const after = await (await u2.post("/api/auth/admin/has-permission", { data: { permissions: { content: ["create"] } } })).json();
+  expect(after.success).toBeTruthy();
+  await u2.dispose();
+  await admin.dispose();
+});
+
+test("a user can create, list and delete an organization @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.organization, "organizations not enabled");
+  const email = `org-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Org" } });
+
+  const slug = `acme-${Date.now()}`;
+  const created = await ctx.post("/api/auth/organization/create", { data: { name: "Acme", slug } });
+  expect(created.ok()).toBeTruthy();
+  const orgId = (await created.json())?.id as string;
+  expect(typeof orgId).toBe("string");
+
+  const list = (await (await ctx.get("/api/auth/organization/list")).json()) as Array<{ id: string; slug: string }>;
+  expect(list.some((o) => o.slug === slug)).toBeTruthy();
+
+  const del = await ctx.post("/api/auth/organization/delete", { data: { organizationId: orgId } });
+  expect(del.ok()).toBeTruthy();
+  await ctx.dispose();
+});
+
+test("an organization can have a parent and manager members @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.organization, "organizations not enabled");
+  const pw = "Podokit3e-Str0ng!pw";
+  await ctx.post("/api/auth/sign-up/email", { data: { email: `orgp-${Date.now()}@example.com`, password: pw, name: "Owner" } });
+
+  // A parent org, then a child that points at it.
+  const parent = await (await ctx.post("/api/auth/organization/create", { data: { name: "HQ", slug: `hq-${Date.now()}` } })).json();
+  const child = await ctx.post("/api/auth/organization/create", {
+    data: { name: "Sales", slug: `sales-${Date.now()}`, parentOrganizationId: parent.id },
+  });
+  expect(child.ok()).toBeTruthy();
+  const childId = (await child.json()).id as string;
+  const full = await (await ctx.get(`/api/auth/organization/get-full-organization?organizationId=${childId}`)).json();
+  expect(full.parentOrganizationId).toBe(parent.id);
+
+  // Add two existing users as managers (role-based → any number).
+  const managers: string[] = [];
+  for (let i = 0; i < 2; i++) {
+    const mCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const email = `mgr-${Date.now()}-${i}@example.com`;
+    await mCtx.post("/api/auth/sign-up/email", { data: { email, password: pw, name: `Mgr${i}` } });
+    managers.push((await (await mCtx.get("/api/auth/get-session")).json()).user.id);
+    await mCtx.dispose();
+  }
+  for (const userId of managers) {
+    const added = await ctx.post("/api/account/org-member", { data: { userId, organizationId: childId, role: "manager" } });
+    expect(added.ok()).toBeTruthy();
+  }
+  const full2 = await (await ctx.get(`/api/auth/organization/get-full-organization?organizationId=${childId}`)).json();
+  const mgrCount = (full2.members ?? []).filter((m: { role: string }) => m.role === "manager").length;
+  expect(mgrCount).toBe(2);
+  await ctx.dispose();
+});
+
+// OIDC discovery + the enabled/disabled behaviour is covered by the front-channel
+// test in tests/ui/oidc.ui.spec.ts (which owns toggling the oidcProvider flag), and
+// the server-side gate is covered generically by the feature-toggle test above.
+
+test("only admins can change settings @smoke", async ({ playwright }) => {
+  const userCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await userCtx.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
+  const asUser = await userCtx.put("/api/account/settings", { data: { magicLink: false } });
+  expect(asUser.status()).toBe(403);
+  await userCtx.dispose();
+});
+
+test("disabling a feature blocks its endpoint server-side and re-enabling restores it @smoke", async ({ playwright }) => {
+  // Uses a fresh admin context (not the shared storageState) so it never rotates
+  // the seeded session. Toggles a flag and confirms the feature gate enforces it.
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const caps = await (await admin.get("/api/account/capabilities")).json();
+  test.skip(!caps?.magicLink, "magic link not enabled");
+
+  // A disabled feature's endpoint 404s; the gate reads the flag through a short cache.
+  const status = (): Promise<number> =>
+    admin.post("/api/auth/sign-in/magic-link", { data: { email: "probe@example.com" } }).then((r) => r.status());
+
+  expect((await admin.put("/api/account/settings", { data: { magicLink: false } })).ok()).toBeTruthy();
+  await expect.poll(status, { timeout: 8000 }).toBe(404);
+
+  expect((await admin.put("/api/account/settings", { data: { magicLink: true } })).ok()).toBeTruthy();
+  await expect.poll(status, { timeout: 8000 }).not.toBe(404);
+
+  await admin.dispose();
+});
+
+test("sign-in with a wrong password is rejected", async ({ request }) => {
+  const res = await request.post("/api/auth/sign-in/email", {
+    headers: origin,
+    data: { email: ADMIN.email, password: "definitely-wrong" },
+  });
+  expect(res.ok()).toBeFalsy();
+});
+
+test("ADMIN_EMAILS account has the admin role @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const session = await ctx.get("/api/auth/get-session");
+  const body = await session.json();
+  expect(body?.user?.email).toBe(ADMIN.email);
+  expect(body?.user?.role).toBe("admin");
+  await ctx.dispose();
+});
+
+test("admin can list users, a normal user cannot (403)", async ({ playwright }) => {
+  const adminCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await adminCtx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const asAdmin = await adminCtx.get("/api/auth/admin/list-users?limit=5");
+  expect(asAdmin.ok()).toBeTruthy();
+  await adminCtx.dispose();
+
+  const userCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await userCtx.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
+  const asUser = await userCtx.get("/api/auth/admin/list-users?limit=5");
+  expect(asUser.status()).toBe(403);
+  await userCtx.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/email.api.spec.ts

@@ -0,0 +1,120 @@
+import { expect, test } from "@playwright/test";
+import { clearMailpit, mailpitReachable, waitForLink, waitForOtp } from "../helpers/mailpit";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+test("email one-time code signs a user in @smoke", async ({ playwright }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.emailOtp, "email OTP not enabled");
+  const email = `otp-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Otp" } });
+  await clearMailpit();
+  const requested = await ctx.post("/api/auth/email-otp/send-verification-otp", { data: { email, type: "sign-in" } });
+  expect(requested.ok()).toBeTruthy();
+  const otp = await waitForOtp(email);
+  const signedIn = await ctx.post("/api/auth/sign-in/email-otp", { data: { email, otp } });
+  expect(signedIn.ok()).toBeTruthy();
+  const session = await (await ctx.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(email);
+  await ctx.dispose();
+});
+
+test("organization invitation can be sent and accepted @smoke", async ({ playwright }) => {
+  const owner = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await owner.get("/api/account/capabilities")).json();
+  test.skip(!caps?.organization, "organizations not enabled");
+  const pw = "Podokit3e-Str0ng!pw";
+  await owner.post("/api/auth/sign-up/email", { data: { email: `owner-${Date.now()}@example.com`, password: pw, name: "Owner" } });
+  const orgId = (await (await owner.post("/api/auth/organization/create", { data: { name: "Invco", slug: `invco-${Date.now()}` } })).json())?.id as string;
+
+  // invite a fresh user
+  const inviteeEmail = `invitee-${Date.now()}@example.com`;
+  const inv = await owner.post("/api/auth/organization/invite-member", { data: { email: inviteeEmail, role: "member", organizationId: orgId } });
+  expect(inv.ok()).toBeTruthy();
+  const invitationId = (await inv.json())?.id as string;
+
+  // the invitee signs up and accepts
+  const invitee = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await invitee.post("/api/auth/sign-up/email", { data: { email: inviteeEmail, password: pw, name: "Invitee" } });
+  const accepted = await invitee.post("/api/auth/organization/accept-invitation", { data: { invitationId } });
+  expect(accepted.ok()).toBeTruthy();
+  await invitee.dispose();
+
+  // the owner now sees two members
+  const full = await (await owner.get(`/api/auth/organization/get-full-organization?organizationId=${orgId}`)).json();
+  expect((full?.members ?? []).length).toBeGreaterThanOrEqual(2);
+  await owner.dispose();
+});
+
+test("magic link signs a user in @smoke", async ({ playwright }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.magicLink, "magic link not enabled");
+  // Use a throwaway account, not the shared ADMIN — a magic-link sign-in can
+  // rotate the account's sessions, which would invalidate the seeded storageState.
+  const email = `magic-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Magic" } });
+  await clearMailpit();
+  const requested = await ctx.post("/api/auth/sign-in/magic-link", { data: { email, callbackURL: `${base}/admin` } });
+  expect(requested.ok()).toBeTruthy();
+  const link = await waitForLink(email);
+  // Following the emailed link validates the token and sets the session cookie.
+  await ctx.get(link, { maxRedirects: 0 });
+  const session = await (await ctx.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(email);
+  await ctx.dispose();
+});
+
+// Follow an emailed auth link (which hits the API to validate) and read the
+// token the API hands back on its redirect.
+function tokenFromRedirect(location: string): string | null {
+  return new URL(location, base).searchParams.get("token");
+}
+
+test("password reset delivers an email and updates the password @smoke", async ({ playwright }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `reset-${Date.now()}@example.com`;
+  const signup = await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Reset" } });
+  expect(signup.ok()).toBeTruthy();
+  // With verification on, sign-up returns no session and the new password still
+  // can't sign in until confirmed — so only assert sign-in when it's off.
+  const verificationOn = !(await signup.json())?.token;
+
+  await clearMailpit();
+  const requested = await ctx.post("/api/auth/request-password-reset", { data: { email, redirectTo: `${base}/reset-password` } });
+  expect(requested.ok()).toBeTruthy();
+
+  const link = await waitForLink(email);
+  const redirected = await ctx.get(link, { maxRedirects: 0 });
+  const token = tokenFromRedirect(redirected.headers()["location"] ?? "");
+  expect(token, "the reset link resolves to a valid token").toBeTruthy();
+
+  expect((await ctx.post("/api/auth/reset-password", { data: { newPassword: "Podokit3e-N3wStr0ng!pw", token } })).ok()).toBeTruthy();
+  if (!verificationOn) {
+    expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-N3wStr0ng!pw" } })).ok()).toBeTruthy();
+    expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).status()).toBe(401);
+  }
+  await ctx.dispose();
+});
+
+test("email verification blocks sign-in until the address is confirmed", async ({ playwright }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `verify-${Date.now()}@example.com`;
+  await clearMailpit();
+  const signup = await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Verify", callbackURL: `${base}/admin` } });
+  expect(signup.ok()).toBeTruthy();
+  // When verification is off, sign-up returns a session — nothing to test here.
+  test.skip(Boolean((await signup.json())?.token), "email verification not enabled");
+
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).status()).toBe(403);
+  const link = await waitForLink(email);
+  await ctx.get(link, { maxRedirects: 0 });
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).ok()).toBeTruthy();
+  await ctx.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -0,0 +1,134 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN, USER } from "../helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+async function signedIn(
+  playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"],
+  account: { email: string; password: string },
+) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: account });
+  return ctx;
+}
+
+test("admin can create a user, set its password, and remove it", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const email = `api-crud-${Date.now()}@example.com`;
+
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "API CRUD", role: "user" },
+  });
+  expect(created.ok()).toBeTruthy();
+  const id = (await created.json())?.user?.id as string;
+  expect(id).toBeTruthy();
+
+  const setPw = await admin.post("/api/auth/admin/set-user-password", {
+    data: { userId: id, newPassword: "Podokit3e-N3wStr0ng!pw" },
+  });
+  expect(setPw.ok()).toBeTruthy();
+
+  // the new password works
+  const fresh = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const signin = await fresh.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-N3wStr0ng!pw" } });
+  expect(signin.ok()).toBeTruthy();
+  await fresh.dispose();
+
+  const removed = await admin.post("/api/auth/admin/remove-user", { data: { userId: id } });
+  expect(removed.ok()).toBeTruthy();
+  await admin.dispose();
+});
+
+test("a normal user cannot create users (403)", async ({ playwright }) => {
+  const user = await signedIn(playwright, USER);
+  const res = await user.post("/api/auth/admin/create-user", {
+    data: { email: `nope-${Date.now()}@example.com`, password: "Podokit3e-Str0ng!pw", name: "Nope", role: "user" },
+  });
+  expect(res.status()).toBe(403);
+  await user.dispose();
+});
+
+test("admin can list and revoke a user's sessions", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const email = `api-sess-${Date.now()}@example.com`;
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "API Sess", role: "user" },
+  });
+  const userId = (await created.json())?.user?.id as string;
+
+  // the user signs in -> creates a session
+  const theirs = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await theirs.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).ok()).toBeTruthy();
+  await theirs.dispose();
+
+  const listed = await admin.post("/api/auth/admin/list-user-sessions", { data: { userId } });
+  expect(listed.ok()).toBeTruthy();
+  expect(((await listed.json())?.sessions ?? []).length).toBeGreaterThan(0);
+
+  const revoked = await admin.post("/api/auth/admin/revoke-user-sessions", { data: { userId } });
+  expect(revoked.ok()).toBeTruthy();
+  await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  await admin.dispose();
+});
+
+test("revokeOtherSessions keeps the current session valid", async ({ playwright }) => {
+  // Use a throwaway account so we don't revoke the shared USER's ui storageState.
+  const admin = await signedIn(playwright, ADMIN);
+  const email = `api-revoke-others-${Date.now()}@example.com`;
+  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "RO", role: "user" } });
+  await admin.dispose();
+
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } });
+  expect((await ctx.post("/api/auth/revoke-other-sessions")).ok()).toBeTruthy();
+  const after = await ctx.get("/api/auth/get-session");
+  expect((await after.json())?.user?.email).toBe(email); // still signed in
+  await ctx.dispose();
+});
+
+test("sessions record a client IP (forwarded through the proxy)", async ({ playwright }) => {
+  const ctx = await signedIn(playwright, ADMIN);
+  const res = await ctx.get("/api/auth/list-sessions");
+  const sessions = (await res.json()) as Array<{ ipAddress?: string | null }>;
+  expect(sessions.length).toBeGreaterThan(0);
+  expect(sessions[0]?.ipAddress).toBeTruthy();
+  expect(sessions[0]?.ipAddress).not.toBe("0000:0000:0000:0000:0000:0000:0000:0000");
+  await ctx.dispose();
+});
+
+test("account capabilities reports optional-feature flags", async ({ playwright }) => {
+  const ctx = await signedIn(playwright, ADMIN);
+  const res = await ctx.get("/api/account/capabilities");
+  expect(res.ok()).toBeTruthy();
+  const caps = await res.json();
+  expect(typeof caps.twoFactor).toBe("boolean");
+  expect(Array.isArray(caps.providers)).toBe(true);
+  expect(typeof caps.deleteAccount).toBe("boolean");
+  await ctx.dispose();
+});
+
+test("admin can update a user and impersonate them", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const email = `api-edit-${Date.now()}@example.com`;
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "Edit Me", role: "user" },
+  });
+  const userId = (await created.json())?.user?.id as string;
+
+  const updated = await admin.post("/api/auth/admin/update-user", { data: { userId, data: { name: "Updated" } } });
+  expect(updated.ok()).toBeTruthy();
+
+  // impersonate on a fresh context so shared sessions are untouched
+  const imp = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await imp.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  expect((await imp.post("/api/auth/admin/impersonate-user", { data: { userId } })).ok()).toBeTruthy();
+  const session = await (await imp.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(email);
+  expect(session?.session?.impersonatedBy).toBeTruthy();
+  await imp.post("/api/auth/admin/stop-impersonating");
+  await imp.dispose();
+
+  await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  await admin.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -0,0 +1,6 @@
+export type Account = { name: string; email: string; password: string };
+export const ADMIN = { name: "Admin", email: "admin@example.com", password: "Podokit3e-Str0ng!pw" };
+export const USER = { name: "Normal User", email: "user@example.com", password: "Podokit3e-Str0ng!pw" };
+export const adminState = "playwright/.auth/admin.json";
+export const userState = "playwright/.auth/user.json";
+export const anonState = { cookies: [], origins: [] } as const;