@podosoft/podokit 0.4.0 → 0.5.1

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -1,7 +1,9 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN, USER } from "../helpers/accounts";
+import { clearSms, smsSinkReachable, waitForSmsOtp } from "../helpers/sms";
+import { totpCode } from "../helpers/totp";
 
-const base = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
 // Accounts are created by the `setup` project (this `api` project depends on it).
@@ -10,6 +12,267 @@ test("account/me is 401 when unauthenticated @smoke", async ({ request }) => {
   expect(res.status()).toBe(401);
 });
 
+test("rejects a breached password on sign-up @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.passwordBreachCheck, "breach check not enabled");
+  // "password" is one of the most-breached passwords; Have I Been Pwned rejects it.
+  const res = await ctx.post("/api/auth/sign-up/email", {
+    data: { name: "Pwned", email: `pwned-${Date.now()}@example.com`, password: "password" },
+  });
+  expect(res.ok()).toBeFalsy();
+  await ctx.dispose();
+});
+
+test("phone number: verify with the code delivered to the SMS sink @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.phoneNumber, "phone number not enabled");
+  test.skip(!(await smsSinkReachable()), "SMS sink not reachable");
+  await clearSms();
+  const email = `phone-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Phone" } });
+  // Unique number per run so the "phone already exists" guard never trips.
+  const phone = `+1555${Date.now().toString().slice(-7)}`;
+
+  const sent = await ctx.post("/api/auth/phone-number/send-otp", { data: { phoneNumber: phone } });
+  expect(sent.ok()).toBeTruthy();
+  const code = await waitForSmsOtp(phone); // read the real code back from the sink
+
+  const verified = await ctx.post("/api/auth/phone-number/verify", {
+    data: { phoneNumber: phone, code, updatePhoneNumber: true },
+  });
+  expect(verified.ok()).toBeTruthy();
+  const session = await (await ctx.get("/api/auth/get-session")).json();
+  expect(session?.user?.phoneNumber).toBe(phone);
+  expect(session?.user?.phoneNumberVerified).toBe(true);
+  await ctx.dispose();
+});
+
+test("two-factor: enable with a real TOTP code and require it at sign-in @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.twoFactor, "two-factor not enabled");
+  const email = `tf-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "TF" } });
+
+  // Enable 2FA and confirm it with a code computed from the returned otpauth URI.
+  const enable = await (await ctx.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+  expect(typeof enable.totpURI).toBe("string");
+  const verified = await ctx.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+  expect(verified.ok()).toBeTruthy();
+
+  // A fresh sign-in must now be challenged for the second factor (no full session).
+  const ctx2 = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const signin = await (await ctx2.post("/api/auth/sign-in/email", { data: { email, password: pw } })).json();
+  expect(signin.twoFactorRedirect).toBe(true);
+  const session = await (await ctx2.get("/api/auth/get-session")).json();
+  expect(session?.user).toBeFalsy();
+  await ctx.dispose();
+  await ctx2.dispose();
+});
+
+test("multi-session holds several accounts and switches between them @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.multiSession, "multi-session not enabled");
+  const pw = "Podokit3e-Str0ng!pw";
+  const a = `ms-a-${Date.now()}@example.com`;
+  const b = `ms-b-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email: a, password: pw, name: "A" } });
+  await ctx.post("/api/auth/sign-up/email", { data: { email: b, password: pw, name: "B" } });
+  type Device = { session: { token: string }; user: { email: string } };
+  const devices = (await (await ctx.get("/api/auth/multi-session/list-device-sessions")).json()) as Device[];
+  expect(devices.length).toBeGreaterThanOrEqual(2);
+  // most recent sign-up is active; switch back to the first account
+  const first = devices.find((d) => d.user?.email === a);
+  expect(first?.session?.token).toBeTruthy();
+  await ctx.post("/api/auth/multi-session/set-active", { data: { sessionToken: first!.session.token } });
+  const session = await (await ctx.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(a);
+  await ctx.dispose();
+});
+
+test("a user can sign in with a username @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.username, "username not enabled");
+  const email = `uname-${Date.now()}@example.com`;
+  const uname = `user${Date.now()}`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "Uname" } });
+  expect((await ctx.post("/api/auth/update-user", { data: { username: uname } })).ok()).toBeTruthy();
+  await ctx.dispose();
+  const ctx2 = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const signedIn = await ctx2.post("/api/auth/sign-in/username", { data: { username: uname, password: pw } });
+  expect(signedIn.ok()).toBeTruthy();
+  const session = await (await ctx2.get("/api/auth/get-session")).json();
+  expect(session?.user?.username).toBe(uname);
+  await ctx2.dispose();
+});
+
+test("bearer token authenticates API requests without a cookie @smoke", async ({ playwright }) => {
+  const email = `bearer-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  const signup = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await signup.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "Bearer" } });
+  const signIn = await signup.post("/api/auth/sign-in/email", { data: { email, password: pw } });
+  expect(signIn.ok()).toBeTruthy();
+  // The bearer plugin accepts the session token as `Authorization: Bearer`. Take it
+  // from the session cookie the sign-in set (equivalent to the set-auth-token header).
+  const state = await signup.storageState();
+  const token = state.cookies.find((c) => c.name.endsWith("session_token"))?.value;
+  expect(token, "sign-in set a session token").toBeTruthy();
+  await signup.dispose();
+  // Fresh context = no session cookie; authenticate purely via the bearer header.
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await api.get("/api/account/me")).status()).toBe(401);
+  const authed = await api.get("/api/account/me", { headers: { Authorization: `Bearer ${token}` } });
+  expect(authed.ok()).toBeTruthy();
+  expect((await authed.json())?.email).toBe(email);
+  await api.dispose();
+});
+
+test("a user can create, list and revoke a personal API key @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.apiKey, "api keys not enabled");
+  const email = `apikey-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Key" } });
+
+  const created = await ctx.post("/api/auth/api-key/create", { data: { name: "ci" } });
+  expect(created.ok()).toBeTruthy();
+  const key = (await created.json())?.key as string;
+  expect(typeof key).toBe("string");
+  expect(key.length).toBeGreaterThan(0);
+
+  const body = (await (await ctx.get("/api/auth/api-key/list")).json()) as { apiKeys: Array<{ id: string; name: string | null }> };
+  expect(body.apiKeys.some((k) => k.name === "ci")).toBeTruthy();
+
+  const del = await ctx.post("/api/auth/api-key/delete", { data: { keyId: body.apiKeys[0].id } });
+  expect(del.ok()).toBeTruthy();
+  await ctx.dispose();
+});
+
+test("access control enforces custom role permissions @smoke", async ({ playwright }) => {
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const caps = await (await admin.get("/api/account/capabilities")).json();
+  expect(caps.roles).toEqual(expect.arrayContaining(["admin", "moderator", "user"]));
+
+  // A default user lacks the content:create permission.
+  const email = `ac-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  const u = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await u.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "AC" } });
+  const before = await (await u.post("/api/auth/admin/has-permission", { data: { permissions: { content: ["create"] } } })).json();
+  expect(before.success).toBeFalsy();
+  const me = await (await u.get("/api/auth/get-session")).json();
+  await u.dispose();
+
+  // Promote to moderator; a fresh session now passes the same check.
+  const set = await admin.post("/api/auth/admin/set-role", { data: { userId: me.user.id, role: "moderator" } });
+  expect(set.ok()).toBeTruthy();
+  const u2 = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await u2.post("/api/auth/sign-in/email", { data: { email, password: pw } });
+  const after = await (await u2.post("/api/auth/admin/has-permission", { data: { permissions: { content: ["create"] } } })).json();
+  expect(after.success).toBeTruthy();
+  await u2.dispose();
+  await admin.dispose();
+});
+
+test("a user can create, list and delete an organization @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.organization, "organizations not enabled");
+  const email = `org-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Org" } });
+
+  const slug = `acme-${Date.now()}`;
+  const created = await ctx.post("/api/auth/organization/create", { data: { name: "Acme", slug } });
+  expect(created.ok()).toBeTruthy();
+  const orgId = (await created.json())?.id as string;
+  expect(typeof orgId).toBe("string");
+
+  const list = (await (await ctx.get("/api/auth/organization/list")).json()) as Array<{ id: string; slug: string }>;
+  expect(list.some((o) => o.slug === slug)).toBeTruthy();
+
+  const del = await ctx.post("/api/auth/organization/delete", { data: { organizationId: orgId } });
+  expect(del.ok()).toBeTruthy();
+  await ctx.dispose();
+});
+
+test("an organization can have a parent and manager members @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.organization, "organizations not enabled");
+  const pw = "Podokit3e-Str0ng!pw";
+  await ctx.post("/api/auth/sign-up/email", { data: { email: `orgp-${Date.now()}@example.com`, password: pw, name: "Owner" } });
+
+  // A parent org, then a child that points at it.
+  const parent = await (await ctx.post("/api/auth/organization/create", { data: { name: "HQ", slug: `hq-${Date.now()}` } })).json();
+  const child = await ctx.post("/api/auth/organization/create", {
+    data: { name: "Sales", slug: `sales-${Date.now()}`, parentOrganizationId: parent.id },
+  });
+  expect(child.ok()).toBeTruthy();
+  const childId = (await child.json()).id as string;
+  const full = await (await ctx.get(`/api/auth/organization/get-full-organization?organizationId=${childId}`)).json();
+  expect(full.parentOrganizationId).toBe(parent.id);
+
+  // Add two existing users as managers (role-based → any number).
+  const managers: string[] = [];
+  for (let i = 0; i < 2; i++) {
+    const mCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const email = `mgr-${Date.now()}-${i}@example.com`;
+    await mCtx.post("/api/auth/sign-up/email", { data: { email, password: pw, name: `Mgr${i}` } });
+    managers.push((await (await mCtx.get("/api/auth/get-session")).json()).user.id);
+    await mCtx.dispose();
+  }
+  for (const userId of managers) {
+    const added = await ctx.post("/api/account/org-member", { data: { userId, organizationId: childId, role: "manager" } });
+    expect(added.ok()).toBeTruthy();
+  }
+  const full2 = await (await ctx.get(`/api/auth/organization/get-full-organization?organizationId=${childId}`)).json();
+  const mgrCount = (full2.members ?? []).filter((m: { role: string }) => m.role === "manager").length;
+  expect(mgrCount).toBe(2);
+  await ctx.dispose();
+});
+
+// OIDC discovery + the enabled/disabled behaviour is covered by the front-channel
+// test in tests/ui/oidc.ui.spec.ts (which owns toggling the oidcProvider flag), and
+// the server-side gate is covered generically by the feature-toggle test above.
+
+test("only admins can change settings @smoke", async ({ playwright }) => {
+  const userCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await userCtx.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
+  const asUser = await userCtx.put("/api/account/settings", { data: { magicLink: false } });
+  expect(asUser.status()).toBe(403);
+  await userCtx.dispose();
+});
+
+test("disabling a feature blocks its endpoint server-side and re-enabling restores it @smoke", async ({ playwright }) => {
+  // Uses a fresh admin context (not the shared storageState) so it never rotates
+  // the seeded session. Toggles a flag and confirms the feature gate enforces it.
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const caps = await (await admin.get("/api/account/capabilities")).json();
+  test.skip(!caps?.magicLink, "magic link not enabled");
+
+  // A disabled feature's endpoint 404s; the gate reads the flag through a short cache.
+  const status = (): Promise<number> =>
+    admin.post("/api/auth/sign-in/magic-link", { data: { email: "probe@example.com" } }).then((r) => r.status());
+
+  expect((await admin.put("/api/account/settings", { data: { magicLink: false } })).ok()).toBeTruthy();
+  await expect.poll(status, { timeout: 8000 }).toBe(404);
+
+  expect((await admin.put("/api/account/settings", { data: { magicLink: true } })).ok()).toBeTruthy();
+  await expect.poll(status, { timeout: 8000 }).not.toBe(404);
+
+  await admin.dispose();
+});
+
 test("sign-in with a wrong password is rejected", async ({ request }) => {
   const res = await request.post("/api/auth/sign-in/email", {
     headers: origin,

package/dist/templates/modules/admin-dashboard/files/tests/api/email.api.spec.ts

@@ -0,0 +1,120 @@
+import { expect, test } from "@playwright/test";
+import { clearMailpit, mailpitReachable, waitForLink, waitForOtp } from "../helpers/mailpit";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+test("email one-time code signs a user in @smoke", async ({ playwright }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.emailOtp, "email OTP not enabled");
+  const email = `otp-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Otp" } });
+  await clearMailpit();
+  const requested = await ctx.post("/api/auth/email-otp/send-verification-otp", { data: { email, type: "sign-in" } });
+  expect(requested.ok()).toBeTruthy();
+  const otp = await waitForOtp(email);
+  const signedIn = await ctx.post("/api/auth/sign-in/email-otp", { data: { email, otp } });
+  expect(signedIn.ok()).toBeTruthy();
+  const session = await (await ctx.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(email);
+  await ctx.dispose();
+});
+
+test("organization invitation can be sent and accepted @smoke", async ({ playwright }) => {
+  const owner = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await owner.get("/api/account/capabilities")).json();
+  test.skip(!caps?.organization, "organizations not enabled");
+  const pw = "Podokit3e-Str0ng!pw";
+  await owner.post("/api/auth/sign-up/email", { data: { email: `owner-${Date.now()}@example.com`, password: pw, name: "Owner" } });
+  const orgId = (await (await owner.post("/api/auth/organization/create", { data: { name: "Invco", slug: `invco-${Date.now()}` } })).json())?.id as string;
+
+  // invite a fresh user
+  const inviteeEmail = `invitee-${Date.now()}@example.com`;
+  const inv = await owner.post("/api/auth/organization/invite-member", { data: { email: inviteeEmail, role: "member", organizationId: orgId } });
+  expect(inv.ok()).toBeTruthy();
+  const invitationId = (await inv.json())?.id as string;
+
+  // the invitee signs up and accepts
+  const invitee = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await invitee.post("/api/auth/sign-up/email", { data: { email: inviteeEmail, password: pw, name: "Invitee" } });
+  const accepted = await invitee.post("/api/auth/organization/accept-invitation", { data: { invitationId } });
+  expect(accepted.ok()).toBeTruthy();
+  await invitee.dispose();
+
+  // the owner now sees two members
+  const full = await (await owner.get(`/api/auth/organization/get-full-organization?organizationId=${orgId}`)).json();
+  expect((full?.members ?? []).length).toBeGreaterThanOrEqual(2);
+  await owner.dispose();
+});
+
+test("magic link signs a user in @smoke", async ({ playwright }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.magicLink, "magic link not enabled");
+  // Use a throwaway account, not the shared ADMIN — a magic-link sign-in can
+  // rotate the account's sessions, which would invalidate the seeded storageState.
+  const email = `magic-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Magic" } });
+  await clearMailpit();
+  const requested = await ctx.post("/api/auth/sign-in/magic-link", { data: { email, callbackURL: `${base}/admin` } });
+  expect(requested.ok()).toBeTruthy();
+  const link = await waitForLink(email);
+  // Following the emailed link validates the token and sets the session cookie.
+  await ctx.get(link, { maxRedirects: 0 });
+  const session = await (await ctx.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(email);
+  await ctx.dispose();
+});
+
+// Follow an emailed auth link (which hits the API to validate) and read the
+// token the API hands back on its redirect.
+function tokenFromRedirect(location: string): string | null {
+  return new URL(location, base).searchParams.get("token");
+}
+
+test("password reset delivers an email and updates the password @smoke", async ({ playwright }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `reset-${Date.now()}@example.com`;
+  const signup = await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Reset" } });
+  expect(signup.ok()).toBeTruthy();
+  // With verification on, sign-up returns no session and the new password still
+  // can't sign in until confirmed — so only assert sign-in when it's off.
+  const verificationOn = !(await signup.json())?.token;
+
+  await clearMailpit();
+  const requested = await ctx.post("/api/auth/request-password-reset", { data: { email, redirectTo: `${base}/reset-password` } });
+  expect(requested.ok()).toBeTruthy();
+
+  const link = await waitForLink(email);
+  const redirected = await ctx.get(link, { maxRedirects: 0 });
+  const token = tokenFromRedirect(redirected.headers()["location"] ?? "");
+  expect(token, "the reset link resolves to a valid token").toBeTruthy();
+
+  expect((await ctx.post("/api/auth/reset-password", { data: { newPassword: "Podokit3e-N3wStr0ng!pw", token } })).ok()).toBeTruthy();
+  if (!verificationOn) {
+    expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-N3wStr0ng!pw" } })).ok()).toBeTruthy();
+    expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).status()).toBe(401);
+  }
+  await ctx.dispose();
+});
+
+test("email verification blocks sign-in until the address is confirmed", async ({ playwright }) => {
+  test.skip(!(await mailpitReachable()), "Mailpit not available");
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `verify-${Date.now()}@example.com`;
+  await clearMailpit();
+  const signup = await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Verify", callbackURL: `${base}/admin` } });
+  expect(signup.ok()).toBeTruthy();
+  // When verification is off, sign-up returns a session — nothing to test here.
+  test.skip(Boolean((await signup.json())?.token), "email verification not enabled");
+
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).status()).toBe(403);
+  const link = await waitForLink(email);
+  await ctx.get(link, { maxRedirects: 0 });
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).ok()).toBeTruthy();
+  await ctx.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN, USER } from "../helpers/accounts";
 
-const base = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
 async function signedIn(
@@ -18,20 +18,20 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
   const email = `api-crud-${Date.now()}@example.com`;
 
   const created = await admin.post("/api/auth/admin/create-user", {
-    data: { email, password: "password123", name: "API CRUD", role: "user" },
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "API CRUD", role: "user" },
   });
   expect(created.ok()).toBeTruthy();
   const id = (await created.json())?.user?.id as string;
   expect(id).toBeTruthy();
 
   const setPw = await admin.post("/api/auth/admin/set-user-password", {
-    data: { userId: id, newPassword: "newpass1234" },
+    data: { userId: id, newPassword: "Podokit3e-N3wStr0ng!pw" },
   });
   expect(setPw.ok()).toBeTruthy();
 
   // the new password works
   const fresh = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const signin = await fresh.post("/api/auth/sign-in/email", { data: { email, password: "newpass1234" } });
+  const signin = await fresh.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-N3wStr0ng!pw" } });
   expect(signin.ok()).toBeTruthy();
   await fresh.dispose();
 
@@ -43,7 +43,7 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
 test("a normal user cannot create users (403)", async ({ playwright }) => {
   const user = await signedIn(playwright, USER);
   const res = await user.post("/api/auth/admin/create-user", {
-    data: { email: `nope-${Date.now()}@example.com`, password: "password123", name: "Nope", role: "user" },
+    data: { email: `nope-${Date.now()}@example.com`, password: "Podokit3e-Str0ng!pw", name: "Nope", role: "user" },
   });
   expect(res.status()).toBe(403);
   await user.dispose();
@@ -53,13 +53,13 @@ test("admin can list and revoke a user's sessions", async ({ playwright }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-sess-${Date.now()}@example.com`;
   const created = await admin.post("/api/auth/admin/create-user", {
-    data: { email, password: "password123", name: "API Sess", role: "user" },
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "API Sess", role: "user" },
   });
   const userId = (await created.json())?.user?.id as string;
 
   // the user signs in -> creates a session
   const theirs = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  expect((await theirs.post("/api/auth/sign-in/email", { data: { email, password: "password123" } })).ok()).toBeTruthy();
+  expect((await theirs.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).ok()).toBeTruthy();
   await theirs.dispose();
 
   const listed = await admin.post("/api/auth/admin/list-user-sessions", { data: { userId } });
@@ -76,11 +76,11 @@ test("revokeOtherSessions keeps the current session valid", async ({ playwright
   // Use a throwaway account so we don't revoke the shared USER's ui storageState.
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-revoke-others-${Date.now()}@example.com`;
-  await admin.post("/api/auth/admin/create-user", { data: { email, password: "password123", name: "RO", role: "user" } });
+  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "RO", role: "user" } });
   await admin.dispose();
 
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  await ctx.post("/api/auth/sign-in/email", { data: { email, password: "password123" } });
+  await ctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } });
   expect((await ctx.post("/api/auth/revoke-other-sessions")).ok()).toBeTruthy();
   const after = await ctx.get("/api/auth/get-session");
   expect((await after.json())?.user?.email).toBe(email); // still signed in
@@ -112,7 +112,7 @@ test("admin can update a user and impersonate them", async ({ playwright }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-edit-${Date.now()}@example.com`;
   const created = await admin.post("/api/auth/admin/create-user", {
-    data: { email, password: "password123", name: "Edit Me", role: "user" },
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "Edit Me", role: "user" },
   });
   const userId = (await created.json())?.user?.id as string;
 

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -1,6 +1,6 @@
 export type Account = { name: string; email: string; password: string };
-export const ADMIN = { name: "Admin", email: "admin@example.com", password: "password123" };
-export const USER = { name: "Normal User", email: "user@example.com", password: "password123" };
+export const ADMIN = { name: "Admin", email: "admin@example.com", password: "Podokit3e-Str0ng!pw" };
+export const USER = { name: "Normal User", email: "user@example.com", password: "Podokit3e-Str0ng!pw" };
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
 export const anonState = { cookies: [], origins: [] } as const;

package/dist/templates/modules/admin-dashboard/files/tests/helpers/mailpit.ts

@@ -0,0 +1,49 @@
+// Helpers for the local Mailpit catcher (docker-compose / CI service). Tests that
+// exercise email flows skip when it isn't reachable (see MAILPIT_URL).
+const MAILPIT = process.env.MAILPIT_URL ?? "http://localhost:8025";
+
+export async function mailpitReachable(): Promise<boolean> {
+  try {
+    return (await fetch(`${MAILPIT}/readyz`)).ok;
+  } catch {
+    return false;
+  }
+}
+
+export async function clearMailpit(): Promise<void> {
+  try {
+    await fetch(`${MAILPIT}/api/v1/messages`, { method: "DELETE" });
+  } catch {
+    /* ignore */
+  }
+}
+
+type MailpitList = { messages: Array<{ ID: string; To: Array<{ Address: string }> }> };
+type MailpitMessage = { Text?: string; HTML?: string };
+
+// Poll for the newest message addressed to `to` and return the first match of
+// `pattern` in its text/HTML body.
+async function waitForMatch(to: string, pattern: RegExp, label: string, timeoutMs: number): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const list = (await (await fetch(`${MAILPIT}/api/v1/messages`)).json()) as MailpitList;
+    const msg = list.messages?.find((m) => m.To?.some((t) => t.Address === to));
+    if (msg) {
+      const full = (await (await fetch(`${MAILPIT}/api/v1/message/${msg.ID}`)).json()) as MailpitMessage;
+      const match = `${full.Text ?? ""} ${full.HTML ?? ""}`.match(pattern);
+      if (match) return match[0];
+    }
+    await new Promise((r) => setTimeout(r, 300));
+  }
+  throw new Error(`no email with ${label} to ${to} within ${timeoutMs}ms`);
+}
+
+/** The first link in the newest email addressed to `to`. */
+export function waitForLink(to: string, timeoutMs = 10000): Promise<string> {
+  return waitForMatch(to, /https?:\/\/[^\s"<>]+/, "a link", timeoutMs);
+}
+
+/** The one-time numeric code in the newest email addressed to `to`. */
+export function waitForOtp(to: string, timeoutMs = 10000): Promise<string> {
+  return waitForMatch(to, /\b\d{4,8}\b/, "a one-time code", timeoutMs);
+}

package/dist/templates/modules/admin-dashboard/files/tests/helpers/sms.ts

@@ -0,0 +1,35 @@
+// Read-back helper for the dev SMS sink (the "Mailpit for SMS"). The app posts
+// outgoing SMS to the sink via SMS_WEBHOOK_URL; tests poll it here to obtain the
+// delivered code, so the phone-number flow is verified for real (not just "sent").
+const SINK = process.env.SMS_SINK_URL ?? "http://localhost:8095";
+
+type SinkMessage = { to: string; body: string; receivedAt: string };
+
+export async function smsSinkReachable(): Promise<boolean> {
+  try {
+    const res = await fetch(`${SINK}/readyz`);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+export async function clearSms(): Promise<void> {
+  await fetch(`${SINK}/messages`, { method: "DELETE" }).catch(() => undefined);
+}
+
+/** Poll the sink until an SMS to `to` arrives, then return the first 4–8 digit code. */
+export async function waitForSmsOtp(to: string, timeoutMs = 10_000): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const res = await fetch(`${SINK}/messages`).catch(() => null);
+    if (res?.ok) {
+      const messages = (await res.json()) as SinkMessage[];
+      const match = messages.find((m) => m.to === to);
+      const code = match?.body.match(/\b\d{4,8}\b/)?.[0];
+      if (code) return code;
+    }
+    await new Promise((r) => setTimeout(r, 250));
+  }
+  throw new Error(`No SMS OTP for ${to} within ${timeoutMs}ms`);
+}

package/dist/templates/modules/admin-dashboard/files/tests/helpers/totp.ts

@@ -0,0 +1,9 @@
+import { URI, type TOTP } from "otpauth";
+
+/** Compute the current 6-digit code from an otpauth:// URI (the `totpURI` that
+ *  two-factor/enable returns), the same way an authenticator app would. Lets
+ *  tests complete the real 2FA verification flow. */
+export function totpCode(otpauthUri: string): string {
+  const totp = URI.parse(otpauthUri) as TOTP;
+  return totp.generate();
+}

package/dist/templates/modules/admin-dashboard/files/tests/playwright.config.ts

@@ -3,7 +3,7 @@ import { defineConfig, devices } from "@playwright/test";
 // admin-dashboard overlay: adds a `setup` project that seeds admin/user sessions
 // (storageState) which the `ui` project reuses. Serial + single worker because
 // tests share one backend/DB. Runs against a live stack on E2E_BASE_URL.
-const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
 export default defineConfig({
   testDir: ".",

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -1,7 +1,7 @@
 import { test as setup, expect } from "@playwright/test";
 import { ADMIN, USER, adminState, userState, type Account } from "./helpers/accounts";
 
-const base = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
 // Seed a session via the API (reliable, no UI hydration races) and save its
 // cookies as storageState for the browser `ui` project to reuse.
@@ -24,6 +24,17 @@ setup("seed admin session", async ({ playwright }) => {
   await seedSession(playwright, ADMIN, adminState);
 });
 
+// Feature flags are DB-backed (seeded by the app_setting migration). phoneNumber
+// ships off (needs an SMS provider); turn it on here so its specs run — this also
+// exercises the admin settings API on every suite run.
+setup("enable optional features", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: { origin: base } });
+  await ctx.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const res = await ctx.put("/api/account/settings", { data: { phoneNumber: true } });
+  expect(res.ok(), "enable optional features via settings").toBeTruthy();
+  await ctx.dispose();
+});
+
 setup("seed user session", async ({ playwright }) => {
   await seedSession(playwright, USER, userState);
 });