@podosoft/podokit 0.4.0 → 0.5.0

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -5,17 +5,84 @@ import { ready } from "../helpers/hydration";
 test("account opens on the profile section @smoke", async ({ page }) => {
   await ready(page, "/admin/account");
   await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
-  await expect(page.getByLabel("Name")).toBeVisible();
+  await expect(page.getByLabel("Name", { exact: true })).toBeVisible();
   await expect(page.getByLabel("Email")).toHaveValue("admin@example.com");
   // save is enabled only once the name changes
   await expect(page.getByRole("button", { name: "Save changes" })).toBeDisabled();
-  await page.getByLabel("Name").fill("Admin Renamed");
+  await page.getByLabel("Name", { exact: true }).fill("Admin Renamed");
   await expect(page.getByRole("button", { name: "Save changes" })).toBeEnabled();
 });
 
+test("account exposes a change-email action when the address is edited @smoke", async ({ page }) => {
+  await ready(page, "/admin/account");
+  const email = page.getByLabel("Email");
+  await expect(email).toHaveValue("admin@example.com");
+  // no action until the address actually changes
+  await expect(page.getByRole("button", { name: "Change email" })).toHaveCount(0);
+  await email.fill("admin+changed@example.com");
+  await expect(page.getByRole("button", { name: "Change email" })).toBeVisible();
+  // revert without submitting — don't mutate the shared admin session
+  await email.fill("admin@example.com");
+  await expect(page.getByRole("button", { name: "Change email" })).toHaveCount(0);
+});
+
+test("account shows a username field when enabled @smoke", async ({ page }) => {
+  await ready(page, "/admin/account");
+  const username = page.getByLabel("Username", { exact: true });
+  test.skip((await username.count()) === 0, "username not enabled");
+  await expect(username).toBeVisible();
+});
+
+test("account can create and revoke an API key when enabled @smoke", async ({ page }) => {
+  await ready(page, "/admin/account");
+  const nav = page.getByRole("button", { name: "API keys" });
+  test.skip((await nav.count()) === 0, "api keys not enabled");
+  await nav.click();
+  const name = `ui-${Date.now()}`;
+  await page.getByLabel("Name", { exact: true }).fill(name);
+  await page.getByRole("button", { name: "Create key" }).click();
+  // the full key is shown once in a dialog
+  await expect(page.getByText("API key created")).toBeVisible();
+  await page.getByRole("button", { name: "Done" }).click();
+  // it now appears in the list; revoke it to clean up
+  const row = page.getByRole("row", { name: new RegExp(name) });
+  await expect(row).toBeVisible();
+  await row.getByRole("button", { name: "Revoke" }).click();
+  await expect(page.getByText("Key revoked")).toBeVisible();
+});
+
+test("account can register and remove a passkey when enabled @smoke", async ({ page }) => {
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Security" }).click();
+  const addBtn = page.getByRole("button", { name: "Add passkey" });
+  test.skip((await addBtn.count()) === 0, "passkeys not enabled");
+  // A virtual authenticator lets the WebAuthn ceremony resolve without hardware.
+  const client = await page.context().newCDPSession(page);
+  await client.send("WebAuthn.enable");
+  await client.send("WebAuthn.addVirtualAuthenticator", {
+    options: { protocol: "ctap2", transport: "internal", hasResidentKey: true, hasUserVerification: true, isUserVerified: true, automaticPresenceSimulation: true },
+  });
+  const pkName = `pk-${Date.now()}`;
+  await page.getByLabel("Name", { exact: true }).fill(pkName);
+  await addBtn.click();
+  await expect(page.getByText("Passkey added")).toBeVisible();
+  const row = page.getByRole("row", { name: new RegExp(pkName) });
+  await expect(row).toBeVisible();
+  // remove it so the shared admin account keeps no leftover credential
+  await row.getByRole("button", { name: "Remove" }).click();
+  await expect(page.getByText("Passkey removed")).toBeVisible();
+});
+
+test("account shows a phone field when enabled @smoke", async ({ page }) => {
+  await ready(page, "/admin/account");
+  const phone = page.getByLabel("Phone number", { exact: true });
+  test.skip((await phone.count()) === 0, "phone number not enabled");
+  await expect(phone).toBeVisible();
+});
+
 test("admin can update their profile name", async ({ page }) => {
   await ready(page, "/admin/account");
-  await page.getByLabel("Name").fill("Admin Renamed");
+  await page.getByLabel("Name", { exact: true }).fill("Admin Renamed");
   await page.getByRole("button", { name: "Save changes" }).click();
   await expect(page.getByText("Profile updated")).toBeVisible();
 });
@@ -37,13 +104,17 @@ test("account nav shows the core sections", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Sessions" })).toBeVisible();
 });
 
-test("two-factor setup is available when enabled", async ({ page }) => {
+test("two-factor setup shows a scannable QR code when enabled @smoke", async ({ page }) => {
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();
   const heading = page.getByText("Two-factor authentication");
   test.skip((await heading.count()) === 0, "two-factor not enabled");
-  await expect(heading).toBeVisible();
-  await expect(page.getByRole("button", { name: "Enable" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Enable", exact: true })).toBeVisible();
+  // Start setup (password + Enable) and confirm the QR renders. Stop before
+  // verifying so 2FA stays inactive and the shared admin session keeps working.
+  await page.locator("#tf-on-pw").fill("Podokit3e-Str0ng!pw");
+  await page.getByRole("button", { name: "Enable", exact: true }).click();
+  await expect(page.getByRole("img", { name: "TOTP QR code" })).toBeVisible();
 });
 
 test("danger zone offers account deletion when enabled", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/dashboard.ui.spec.ts

@@ -21,5 +21,5 @@ test("sidebar navigates to sessions and account", async ({ page }) => {
   await page.getByRole("menuitem", { name: "Account" }).click();
   await expect(page).toHaveURL(/\/admin\/account/);
   await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
-  await expect(page.getByLabel("Name")).toBeVisible(); // profile section
+  await expect(page.getByLabel("Name", { exact: true })).toBeVisible(); // profile section (exact: "Username" also contains "Name")
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/data-table.ui.spec.ts

@@ -0,0 +1,32 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// Sorting via the shared DataTable. Users is server-sorted (manual), audit is
+// client-sorted — both drive the same clickable headers + aria-sort.
+test("users table sorts by a column header (server) @smoke", async ({ page }) => {
+  await ready(page, "/admin/users");
+  const header = page.getByRole("columnheader", { name: /Name/ });
+  // Click the sort button *inside* the header — a bare name match collides with
+  // the sidebar user button (a "Renamed" account contains "name").
+  const sortByName = header.getByRole("button");
+  const firstName = () => page.getByRole("row").nth(1).getByRole("cell").first().innerText();
+
+  await sortByName.click();
+  await expect(header).toHaveAttribute("aria-sort", "ascending");
+  await page.waitForTimeout(400); // server refetch
+  const asc = await firstName();
+
+  await sortByName.click();
+  await expect(header).toHaveAttribute("aria-sort", "descending");
+  await page.waitForTimeout(400);
+  const desc = await firstName();
+
+  expect(asc).not.toBe(desc); // order flipped
+});
+
+test("audit table sorts client-side", async ({ page }) => {
+  await ready(page, "/admin/audit");
+  test.skip((await page.getByRole("row").count()) < 3, "not enough audit entries");
+  await page.getByRole("button", { name: "When" }).click(); // default desc -> asc
+  await expect(page.getByRole("columnheader", { name: /When/ })).toHaveAttribute("aria-sort", "ascending");
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/email-admin.ui.spec.ts

@@ -0,0 +1,60 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Verification badges/actions are gated by the emailVerification capability. The
+// seeded suite runs with verification off, so assert the gating here (nothing
+// leaks in); the enabled state is covered manually / under a verification run.
+test("verification badges stay hidden when the feature is off", async ({ page }) => {
+  await ready(page, "/admin/users");
+  const caps = await (await page.request.get("/api/account/capabilities")).json();
+  test.skip(caps.emailVerification === true, "email verification enabled");
+  await expect(page.getByText("Verified", { exact: true })).toHaveCount(0);
+  await expect(page.getByText("Unverified", { exact: true })).toHaveCount(0);
+});
+
+// Admin can trigger a password-reset email for a user (not verification-gated).
+test("admin sends a password reset email to a user", async ({ page }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  await ready(page, "/admin/users");
+  const email = `admin-reset-${Date.now()}@example.com`;
+  await page.request.post("/api/auth/admin/create-user", {
+    headers: { origin: base },
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "AR", role: "user" },
+  });
+  await clearMailpit();
+  await page.locator("#toolbar-search").fill(email);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+  await page.getByRole("row", { name: new RegExp(email) }).getByRole("button").click();
+  await page.getByRole("menuitem", { name: "Manage" }).click();
+  const dialog = page.getByRole("dialog");
+  await dialog.getByRole("button", { name: "Security" }).click();
+  await dialog.getByRole("button", { name: "Send password reset email" }).click();
+  await expect(page.getByText("Password reset email sent")).toBeVisible();
+  await waitForLink(email); // a reset email actually arrived for this user
+});
+
+test("login shows a verification hint for unverified users", async ({ page, browser }) => {
+  const caps = await (await page.request.get("/api/account/capabilities")).json();
+  test.skip(caps.emailVerification !== true, "email verification disabled");
+  const email = `login-unv-${Date.now()}@example.com`;
+  await page.request.post("/api/auth/sign-up/email", { headers: { origin: base }, data: { email, password: "Podokit3e-Str0ng!pw", name: "LU" } });
+  const anon = await browser.newContext();
+  const p2 = await anon.newPage();
+  await p2.goto(`${base}/login`);
+  await p2.getByLabel("Email").fill(email);
+  await p2.getByLabel("Password").fill("Podokit3e-Str0ng!pw");
+  await p2.getByRole("button", { name: "Sign in" }).click();
+  await expect(p2.getByRole("link", { name: /resend verification/i })).toBeVisible();
+  await anon.close();
+});
+
+test("overview omits the unverified-users card when the feature is off", async ({ page }) => {
+  await ready(page, "/admin");
+  const caps = await (await page.request.get("/api/account/capabilities")).json();
+  test.skip(caps.emailVerification === true, "email verification enabled");
+  await expect(page.getByText("Unverified users")).toHaveCount(0);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -0,0 +1,42 @@
+import { expect, test } from "@playwright/test";
+import { anonState } from "../helpers/accounts";
+import { ready } from "../helpers/hydration";
+import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// The reset flow is for signed-out users — run without the seeded session.
+test.use({ storageState: anonState });
+
+test("forgot password: request, open the emailed link, set a new password, sign in @smoke", async ({ page, playwright }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  const email = `ui-reset-${Date.now()}@example.com`;
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const signup = await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "UIReset" } });
+  expect(signup.ok()).toBeTruthy();
+  const verificationOn = !(await signup.json())?.token;
+  await ctx.dispose();
+  // The happy path ends by signing in; when verification is required that would be
+  // blocked, so this UI walkthrough only applies with verification off.
+  test.skip(verificationOn, "email verification enabled");
+  await clearMailpit();
+
+  await ready(page, "/forgot-password");
+  await page.getByLabel("Email").fill(email);
+  await page.getByRole("button", { name: "Send reset link" }).click();
+  await expect(page.getByText(/reset link is on its way/i)).toBeVisible();
+
+  // Open the emailed link: the API validates it and redirects to the reset page.
+  await page.goto(await waitForLink(email));
+  await page.waitForLoadState("load");
+  await page.waitForTimeout(400);
+  await page.getByLabel("New password").fill("Podokit3e-N3wStr0ng!pw");
+  await page.getByRole("button", { name: "Update password" }).click();
+  await expect(page).toHaveURL(/\/login/);
+
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Password").fill("Podokit3e-N3wStr0ng!pw");
+  await page.getByRole("button", { name: "Sign in" }).click();
+  await expect(page).toHaveURL(/\/admin/);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/guards.ui.spec.ts

@@ -17,5 +17,6 @@ test.describe("normal user (non-admin)", () => {
     await expect(page.getByRole("link", { name: "Sessions" })).toHaveCount(0);
     expect((await page.goto("/admin/users"))?.status()).toBe(403);
     expect((await page.goto("/admin/sessions"))?.status()).toBe(403);
+    expect((await page.goto("/admin/settings"))?.status()).toBe(403);
   });
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -0,0 +1,57 @@
+import { expect, test } from "@playwright/test";
+import { createHash, randomBytes } from "node:crypto";
+
+// admin storageState (project default) — the admin is the resource owner.
+const b64url = (b: Buffer): string => b.toString("base64url");
+const REDIRECT = "http://localhost:9999/callback";
+
+// Verifies the provider is correctly configured end to end on the front channel:
+// signed discovery + JWKS, dynamic client registration, and an authorize request
+// (with PKCE) that validates the client and hands off to the consent page. The
+// back-channel token exchange is driven by an OIDC client SDK / real RP — see
+// docs/modules.md for the manual round-trip checklist.
+test("OIDC provider: discovery, JWKS, client registration, authorize handoff @smoke", async ({ page, baseURL }) => {
+  const headers = { origin: baseURL ?? "" };
+  await page.request.put("/api/account/settings", { data: { oidcProvider: true }, headers });
+  await expect
+    .poll(async () => (await page.request.get("/api/auth/.well-known/openid-configuration")).status(), { timeout: 8000 })
+    .toBe(200);
+
+  try {
+    const disc = await (await page.request.get("/api/auth/.well-known/openid-configuration")).json();
+    for (const field of ["issuer", "authorization_endpoint", "token_endpoint", "userinfo_endpoint", "jwks_uri"]) {
+      expect(typeof disc[field]).toBe("string");
+    }
+    // JWKS exposes at least one signing key (the OAuth provider needs it for id_tokens).
+    const jwks = await (await page.request.get(disc.jwks_uri)).json();
+    expect(Array.isArray(jwks.keys) && jwks.keys.length).toBeTruthy();
+
+    // Dynamic client registration returns usable credentials.
+    const reg = await (
+      await page.request.post("/api/auth/oauth2/create-client", {
+        data: { client_name: "E2E RP", redirect_uris: [REDIRECT] },
+        headers,
+      })
+    ).json();
+    expect(reg.client_id).toBeTruthy();
+    expect(reg.client_secret).toBeTruthy();
+
+    // Authorize validates the client + PKCE and hands off to the consent page with
+    // the signed authorization request.
+    const verifier = b64url(randomBytes(40));
+    const challenge = b64url(createHash("sha256").update(verifier).digest());
+    const authorizeUrl =
+      `/api/auth/oauth2/authorize?client_id=${reg.client_id}&redirect_uri=${encodeURIComponent(REDIRECT)}` +
+      `&response_type=code&scope=${encodeURIComponent("openid profile email")}&state=st` +
+      `&code_challenge=${challenge}&code_challenge_method=S256`;
+    const authz = await (await page.request.get(authorizeUrl, { headers })).json();
+    expect(String(authz.url)).toContain("/oauth2/consent");
+    expect(String(authz.url)).toContain("client_id=");
+
+    // The consent page renders (reached in a real browser navigation).
+    await page.goto(authz.url);
+    await expect(page.getByRole("button", { name: "Allow" })).toBeVisible();
+  } finally {
+    await page.request.put("/api/account/settings", { data: { oidcProvider: false }, headers });
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/organizations.ui.spec.ts

@@ -0,0 +1,52 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default) — organizations is an admin-only view
+test("admin can create an organization @smoke", async ({ page }) => {
+  await ready(page, "/admin");
+  const nav = page.getByRole("link", { name: "Organizations" });
+  test.skip((await nav.count()) === 0, "organizations not enabled");
+  await nav.click();
+  await expect(page).toHaveURL(/\/admin\/organizations/);
+  await page.getByRole("button", { name: "New organization" }).click();
+  const name = `Acme ${Date.now()}`;
+  await page.getByLabel("Name", { exact: true }).fill(name);
+  await page.getByRole("dialog").getByRole("button", { name: "Create", exact: true }).click();
+  await expect(page.getByText("Organization created").first()).toBeVisible();
+  await expect(page.getByRole("cell", { name })).toBeVisible();
+  // clean up so the shared admin account keeps no leftover org
+  await page.getByRole("row", { name: new RegExp(name) }).getByRole("button", { name: "Delete" }).click();
+  await expect(page.getByText("Organization deleted").first()).toBeVisible();
+});
+
+test("create an org with a non-ascii name, a parent, and a manager @smoke", async ({ page }) => {
+  await ready(page, "/admin/organizations");
+  const newBtn = page.getByRole("button", { name: "New organization" });
+  test.skip((await newBtn.count()) === 0, "organizations not enabled");
+
+  // Parent org first (Korean name → slug falls back, so it still saves).
+  const parent = `본사 ${Date.now()}`;
+  await newBtn.click();
+  await page.getByLabel("Name", { exact: true }).fill(parent);
+  await page.getByRole("dialog").getByRole("button", { name: "Create", exact: true }).click();
+  await expect(page.getByText("Organization created").first()).toBeVisible();
+  await expect(page.getByRole("cell", { name: parent })).toBeVisible();
+
+  // Child org: pick the parent + a manager (an existing user).
+  const child = `영업 ${Date.now()}`;
+  await page.getByRole("button", { name: "New organization" }).click();
+  await page.getByLabel("Name", { exact: true }).fill(child);
+  await page.locator("#o-parent").click();
+  await page.getByRole("option", { name: parent }).click();
+  await page.getByRole("checkbox").first().click(); // first existing user as a manager
+  await page.getByRole("dialog").getByRole("button", { name: "Create", exact: true }).click();
+  await expect(page.getByText("Organization created").first()).toBeVisible();
+  // child row shows the parent org name
+  await expect(page.getByRole("row", { name: new RegExp(child) })).toContainText(parent);
+
+  // clean up both
+  for (const n of [child, parent]) {
+    await page.getByRole("row", { name: new RegExp(n) }).getByRole("button", { name: "Delete" }).click();
+    await expect(page.getByText("Organization deleted").first()).toBeVisible();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/passkey.ui.spec.ts

@@ -0,0 +1,36 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// Full passkey round trip on a throwaway account — never touches the shared admin.
+test.use({ storageState: { cookies: [], origins: [] } });
+
+test("register a passkey and sign in with it @smoke", async ({ page, baseURL }) => {
+  const origin = { origin: baseURL ?? "" };
+  // A virtual authenticator answers both the register (create) and sign-in (get)
+  // WebAuthn ceremonies without hardware.
+  const client = await page.context().newCDPSession(page);
+  await client.send("WebAuthn.enable");
+  await client.send("WebAuthn.addVirtualAuthenticator", {
+    options: { protocol: "ctap2", transport: "internal", hasResidentKey: true, hasUserVerification: true, isUserVerified: true, automaticPresenceSimulation: true },
+  });
+
+  // Sign up a throwaway user (shares the page's cookie jar) and register a passkey.
+  const email = `pk-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  const signup = await page.context().request.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "PK" }, headers: origin });
+  expect(signup.ok()).toBeTruthy();
+
+  await ready(page, "/admin/account");
+  await page.getByRole("button", { name: "Security" }).click();
+  const addBtn = page.getByRole("button", { name: "Add passkey" });
+  test.skip((await addBtn.count()) === 0, "passkeys not enabled");
+  await page.getByLabel("Name", { exact: true }).fill("My device");
+  await addBtn.click();
+  await expect(page.getByText("Passkey added")).toBeVisible();
+
+  // Sign out, then sign back in using only the passkey.
+  await page.context().request.post("/api/auth/sign-out", { headers: origin });
+  await ready(page, "/login");
+  await page.getByRole("button", { name: "Use a passkey" }).click();
+  await expect(page).toHaveURL(/\/admin(\/|$)/);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/sessions.ui.spec.ts

@@ -2,11 +2,18 @@ import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — sessions is an admin-only view
+test("sessions table shows the expires column @smoke", async ({ page }) => {
+  await ready(page, "/admin/sessions");
+  await expect(page.getByRole("columnheader", { name: "Expires" })).toBeVisible();
+});
+
 test("admin sees user sessions across users @smoke", async ({ page }) => {
   await ready(page, "/admin/sessions");
   await expect(page.getByRole("heading", { name: "User sessions" })).toBeVisible();
-  // another user's session is listed here (the across-users admin view); scope to
-  // the table, not the sidebar, and match the first row.
+  // Search by exact address — robust to pagination as sessions accumulate (the
+  // admin account alone can fill the first page). This is the across-users view.
+  await page.locator("#toolbar-search").fill("user@example.com");
+  await page.getByRole("button", { name: "Search", exact: true }).click();
   await expect(page.getByRole("main").getByText("user@example.com").first()).toBeVisible();
   // row actions are available
   await page.getByRole("row", { name: /user@example.com/ }).first().getByRole("button").click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings.ui.spec.ts

@@ -0,0 +1,34 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default)
+test("settings lists the auth features and their status @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
+  await expect(page.getByText("Email & password")).toBeVisible();
+  await expect(page.getByText("Two-factor authentication")).toBeVisible();
+  await expect(page.getByText("Breached-password check")).toBeVisible();
+  await expect(page.getByText("Magic link")).toBeVisible();
+  // each feature carries an explicit status
+  await expect(page.getByText("Enabled", { exact: true }).first()).toBeVisible();
+});
+
+test("settings is reachable from the sidebar @smoke", async ({ page }) => {
+  await ready(page, "/admin");
+  await page.getByRole("link", { name: "Settings" }).click();
+  await expect(page).toHaveURL(/\/admin\/settings/);
+});
+
+test("admin can toggle a feature flag and it applies live @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  const toggle = page.getByRole("switch", { name: "Magic link" });
+  test.skip((await toggle.count()) === 0, "magic link toggle not present");
+  // Serial workers (workers:1) make toggle-then-restore safe for other specs.
+  await expect(toggle).toBeChecked();
+  await toggle.click();
+  await expect(page.getByText("Setting updated")).toBeVisible();
+  await expect(toggle).not.toBeChecked(); // capabilities refreshed live
+  // restore so the shared magic-link/2FA specs keep their expected state
+  await toggle.click();
+  await expect(toggle).toBeChecked();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/table-toolbar.ui.spec.ts

@@ -0,0 +1,32 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// The shared toolbar: filters + search both commit on the Search button; the
+// search field itself is selectable (Email, Name, ...).
+test("users toolbar searches only when Search is pressed @smoke", async ({ page }) => {
+  await ready(page, "/admin/users");
+  const main = page.getByRole("main");
+  await page.locator("#toolbar-search").fill("admin@example.com");
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+  await expect(main.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
+  await expect(main.getByRole("cell", { name: "user@example.com" })).toHaveCount(0);
+});
+
+test("users toolbar applies filter + search together on Search", async ({ page }) => {
+  await ready(page, "/admin/users");
+  const main = page.getByRole("main");
+  await page.locator('button[data-slot="select-trigger"]').first().click(); // Role select
+  await page.getByRole("option", { name: "Admin", exact: true }).click();
+  // Selecting a filter stages it; nothing applies until Search is pressed.
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+  await expect(main.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
+  await expect(main.getByRole("cell", { name: "user@example.com" })).toHaveCount(0);
+});
+
+test("users toolbar can pick the search field", async ({ page }) => {
+  await ready(page, "/admin/users");
+  const fieldSelect = page.locator('button[data-slot="select-trigger"]').last(); // after the filters
+  await fieldSelect.click();
+  await page.getByRole("option", { name: "Name", exact: true }).click();
+  await expect(fieldSelect).toContainText("Name");
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/users-crud.ui.spec.ts

@@ -1,21 +1,22 @@
 import { expect, test, type Page } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
-const base = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
 // Seed a throwaway user via the API (admin cookies come from storageState) so
 // the mutating UI tests don't touch the shared admin/user seed accounts.
 async function seedUser(page: Page, email: string): Promise<void> {
   const res = await page.request.post("/api/auth/admin/create-user", {
     headers: { origin: base },
-    data: { email, password: "password123", name: "Throwaway", role: "user" },
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "Throwaway", role: "user" },
   });
   expect(res.ok()).toBeTruthy();
 }
 
 // Open the Manage two-pane modal for a seeded user.
 async function openManage(page: Page, email: string): Promise<void> {
-  await page.getByPlaceholder("Search by email…").fill(email);
+  await page.locator("#toolbar-search").fill(email);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
   await page.getByRole("row", { name: new RegExp(email) }).getByRole("button").click();
   await page.getByRole("menuitem", { name: "Manage" }).click();
 }
@@ -27,10 +28,14 @@ test("admin can create a user via the dialog @smoke", async ({ page }) => {
   const dialog = page.getByRole("dialog");
   await dialog.getByLabel("Name").fill("Created");
   await dialog.getByLabel("Email").fill(email);
-  await dialog.getByLabel("Password", { exact: true }).fill("password123");
-  await dialog.getByLabel("Confirm password").fill("password123");
+  await dialog.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
+  await dialog.getByLabel("Confirm password").fill("Podokit3e-Str0ng!pw");
   await dialog.getByRole("button", { name: "Create" }).click();
-  await page.getByPlaceholder("Search by email…").fill(email);
+  // Wait for the create to settle (dialog closes + list reloads) before searching,
+  // otherwise the search input can be refilled by the post-create reload.
+  await expect(page.getByRole("dialog")).toBeHidden();
+  await page.locator("#toolbar-search").fill(email);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
   await expect(page.getByRole("cell", { name: email })).toBeVisible();
 });
 
@@ -40,7 +45,7 @@ test("create rejects mismatched passwords", async ({ page }) => {
   const dialog = page.getByRole("dialog");
   await dialog.getByLabel("Name").fill("Mismatch");
   await dialog.getByLabel("Email").fill(`ui-mismatch-${Date.now()}@example.com`);
-  await dialog.getByLabel("Password", { exact: true }).fill("password123");
+  await dialog.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
   await dialog.getByLabel("Confirm password").fill("different999");
   await dialog.getByRole("button", { name: "Create" }).click();
   await expect(dialog.getByText("Passwords do not match")).toBeVisible();
@@ -64,11 +69,11 @@ test("manage: set a password (and reject mismatch)", async ({ page }) => {
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
   await dialog.getByRole("button", { name: "Security" }).click();
-  await dialog.getByLabel("New password", { exact: true }).fill("newpass1234");
+  await dialog.getByLabel("New password", { exact: true }).fill("Podokit3e-N3wStr0ng!pw");
   await dialog.getByLabel("Confirm new password").fill("different999");
   await dialog.getByRole("button", { name: "Set password" }).click();
   await expect(dialog.getByText("Passwords do not match")).toBeVisible();
-  await dialog.getByLabel("Confirm new password").fill("newpass1234");
+  await dialog.getByLabel("Confirm new password").fill("Podokit3e-N3wStr0ng!pw");
   await dialog.getByRole("button", { name: "Set password" }).click();
   await expect(page.getByText("Password updated")).toBeVisible();
 });
@@ -91,7 +96,7 @@ test("manage: revoke a user's session", async ({ page, playwright }) => {
   await seedUser(page, email);
   // create a session for the user in an isolated context (don't touch the admin cookie)
   const uctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: { origin: base } });
-  expect((await uctx.post("/api/auth/sign-in/email", { data: { email, password: "password123" } })).ok()).toBeTruthy();
+  expect((await uctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).ok()).toBeTruthy();
   await uctx.dispose();
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
@@ -110,7 +115,8 @@ test("manage: delete a user from the danger zone", async ({ page }) => {
   await dialog.getByRole("button", { name: "Delete" }).click(); // arm
   await dialog.getByRole("button", { name: "Delete" }).click(); // confirm
   await expect(page.getByText("User deleted")).toBeVisible();
-  await page.getByPlaceholder("Search by email…").fill(email);
+  await page.locator("#toolbar-search").fill(email);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
   await expect(page.getByRole("cell", { name: email })).toHaveCount(0);
 });
 
@@ -119,7 +125,7 @@ test("users list shows pagination beyond one page", async ({ page }) => {
   for (let i = 0; i < 6; i += 1) {
     await page.request.post("/api/auth/admin/create-user", {
       headers: { origin: base },
-      data: { email: `pg-${Date.now()}-${i}@example.com`, password: "password123", name: `Pg${i}`, role: "user" },
+      data: { email: `pg-${Date.now()}-${i}@example.com`, password: "Podokit3e-Str0ng!pw", name: `Pg${i}`, role: "user" },
     });
   }
   await page.reload();
@@ -127,3 +133,13 @@ test("users list shows pagination beyond one page", async ({ page }) => {
   await expect(nav).toBeVisible();
   await expect(nav.getByRole("button", { name: "Page 2" })).toBeVisible();
 });
+
+test("manage modal closes from its footer", async ({ page }) => {
+  await ready(page, "/admin/users");
+  const email = `ui-close-${Date.now()}@example.com`;
+  await seedUser(page, email);
+  await openManage(page, email);
+  // footer Close (a visible button, distinct from the header X) dismisses the modal
+  await page.getByRole("dialog").getByRole("button", { name: "Close", exact: true }).last().click();
+  await expect(page.getByRole("dialog")).toBeHidden();
+});