@podosoft/podokit 0.7.0 → 0.9.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(auth)/login/+page.svelte

@@ -22,6 +22,49 @@
   let unverified = $state(false);
   let loading = $state(false);
 
+  // Second-factor step: a password/OTP sign-in with 2FA enabled returns
+  // `twoFactorRedirect` and no session; the user then verifies with an
+  // authenticator code or a backup code to complete the login.
+  let twoFaRequired = $state(false);
+  let twoFaCode = $state("");
+  let useBackupCode = $state(false);
+  let twoFaLoading = $state(false);
+  const redirectTo = (): string => page.url.searchParams.get("redirect") ?? "/admin";
+
+  // Returns true when 2FA is still owed (caller shows the step instead of leaving).
+  function needsTwoFactor(data: unknown): boolean {
+    return Boolean(data && typeof data === "object" && (data as { twoFactorRedirect?: boolean }).twoFactorRedirect);
+  }
+
+  // Map better-auth's (English) two-factor error codes to localized copy — the
+  // backend returns a stable `code`, never a translated message (see i18n policy).
+  function twoFactorError(code: string | undefined): string {
+    switch (code) {
+      case "INVALID_CODE":
+      case "INVALID_BACKUP_CODE":
+        return i18n.t.auth.twoFactorInvalidCode;
+      case "TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE":
+      case "ACCOUNT_TEMPORARILY_LOCKED":
+        return i18n.t.auth.twoFactorLocked;
+      default:
+        return i18n.t.auth.signInFailed;
+    }
+  }
+
+  async function verifyTwoFactor(): Promise<void> {
+    twoFaLoading = true;
+    error = null;
+    const { error: authError } = useBackupCode
+      ? await api.auth.twoFactor.verifyBackupCode({ code: twoFaCode.trim() })
+      : await api.auth.twoFactor.verifyTotp({ code: twoFaCode.trim() });
+    twoFaLoading = false;
+    if (authError) {
+      error = twoFactorError(authError.code);
+      return;
+    }
+    await goto(redirectTo(), { invalidateAll: true });
+  }
+
   // Passwordless sign-in, shown only when the server enabled the magic-link plugin.
   const magicLinkEnabled = $derived(data.capabilities?.magicLink ?? false);
   let magicLoading = $state(false);
@@ -69,13 +112,17 @@
   async function verifyOtp(): Promise<void> {
     otpLoading = true;
     error = null;
-    const { error: authError } = await api.auth.signIn.emailOtp({ email, otp: otpCode });
+    const { data, error: authError } = await api.auth.signIn.emailOtp({ email, otp: otpCode });
     otpLoading = false;
     if (authError) {
       error = authError.message ?? i18n.t.auth.signInFailed;
       return;
     }
-    await goto(page.url.searchParams.get("redirect") ?? "/admin", { invalidateAll: true });
+    if (needsTwoFactor(data)) {
+      twoFaRequired = true;
+      return;
+    }
+    await goto(redirectTo(), { invalidateAll: true });
   }
 
   // Passwordless sign-in with a registered passkey (WebAuthn), shown when enabled.
@@ -100,7 +147,7 @@
     unverified = false;
     // With the username plugin on, an identifier without "@" is treated as a username.
     const asUsername = usernameEnabled && !email.includes("@");
-    const { error: authError } = asUsername
+    const { data, error: authError } = asUsername
       ? await api.auth.signIn.username({ username: email, password })
       : await api.auth.signIn.email({ email, password });
     loading = false;
@@ -110,7 +157,11 @@
       error = unverified ? i18n.t.auth.emailNotVerified : (authError.message ?? i18n.t.auth.signInFailed);
       return;
     }
-    await goto(page.url.searchParams.get("redirect") ?? "/admin", { invalidateAll: true });
+    if (needsTwoFactor(data)) {
+      twoFaRequired = true;
+      return;
+    }
+    await goto(redirectTo(), { invalidateAll: true });
   }
 </script>
 
@@ -120,17 +171,47 @@
     <Card.Description>{i18n.t.auth.signInDesc}</Card.Description>
   </Card.Header>
   <Card.Content>
+    {#if error}
+      <Alert.Root variant="destructive" class="mb-4">
+        <Alert.Description>
+          {error}
+          {#if unverified}
+            <a href="/verify-email?email={encodeURIComponent(email)}" class="font-medium underline">{i18n.t.auth.resendVerification}</a>
+          {/if}
+        </Alert.Description>
+      </Alert.Root>
+    {/if}
+    {#if twoFaRequired}
+      <div class="flex flex-col gap-4" data-testid="two-factor-step">
+        <p class="text-muted-foreground text-sm">{useBackupCode ? i18n.t.auth.twoFactorBackupPrompt : i18n.t.auth.twoFactorPrompt}</p>
+        <div class="flex flex-col gap-2">
+          <Label for="twofa">{useBackupCode ? i18n.t.auth.backupCodeLabel : i18n.t.auth.twoFactorCodeLabel}</Label>
+          <Input
+            id="twofa"
+            bind:value={twoFaCode}
+            inputmode={useBackupCode ? "text" : "numeric"}
+            autocomplete="one-time-code"
+            autofocus
+          />
+        </div>
+        <Button type="button" disabled={twoFaLoading || !twoFaCode} onclick={verifyTwoFactor}>
+          {twoFaLoading ? i18n.t.auth.signingIn : i18n.t.auth.verify}
+        </Button>
+        <Button
+          type="button"
+          variant="link"
+          class="h-auto justify-start p-0 text-xs"
+          onclick={() => {
+            useBackupCode = !useBackupCode;
+            twoFaCode = "";
+            error = null;
+          }}
+        >
+          {useBackupCode ? i18n.t.auth.twoFactorUseAuthenticator : i18n.t.auth.twoFactorUseBackup}
+        </Button>
+      </div>
+    {:else}
     <form class="flex flex-col gap-4" onsubmit={submit}>
-      {#if error}
-        <Alert.Root variant="destructive">
-          <Alert.Description>
-            {error}
-            {#if unverified}
-              <a href="/verify-email?email={encodeURIComponent(email)}" class="font-medium underline">{i18n.t.auth.resendVerification}</a>
-            {/if}
-          </Alert.Description>
-        </Alert.Root>
-      {/if}
       <div class="flex flex-col gap-2">
         <Label for="email">{usernameEnabled ? i18n.t.auth.emailOrUsername : i18n.t.auth.email}</Label>
         <Input id="email" type={usernameEnabled ? "text" : "email"} bind:value={email} required autocomplete="username" />
@@ -177,6 +258,7 @@
         {/if}
       </div>
     {/if}
+    {/if}
   </Card.Content>
   {#if signupOpen}
     <Card.Footer class="justify-center">

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/+layout.server.ts

@@ -10,6 +10,7 @@ const PUBLIC_PATHS = [
   "/signup",
   "/forgot-password",
   "/reset-password",
+  "/verify-email",
   "/maintenance",
   // Modules add their public (no-session) page prefixes here.
   // podokit:begin:public-paths

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/setup-2fa/+page.server.ts

@@ -0,0 +1,11 @@
+import { redirect } from "@sveltejs/kit";
+import type { PageServerLoad } from "./$types";
+
+// The mandatory two-factor enrolment page (reached via the require-2fa gate).
+// Must be signed in; already-enrolled users have nothing to do here.
+export const load: PageServerLoad = ({ locals }) => {
+  if (!locals.user) redirect(302, "/login");
+  const user = locals.user as App.Locals["user"] & { twoFactorEnabled?: boolean };
+  if (user.twoFactorEnabled) redirect(302, "/admin");
+  return { user: locals.user };
+};

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/setup-2fa/+page.svelte

@@ -0,0 +1,122 @@
+<script lang="ts">
+  import { goto } from "$app/navigation";
+  import QRCode from "qrcode";
+  import { Button } from "$lib/components/ui/button";
+  import { Input } from "$lib/components/ui/input";
+  import { Label } from "$lib/components/ui/label";
+  import { Checkbox } from "$lib/components/ui/checkbox";
+  import * as Card from "$lib/components/ui/card";
+  import * as Alert from "$lib/components/ui/alert";
+  import { api } from "$lib/api";
+  import { getI18n } from "$lib/i18n";
+
+  const i18n = getI18n();
+  let password = $state("");
+  let code = $state("");
+  let busy = $state(false);
+  let error = $state<string | null>(null);
+  let saved = $state(false);
+  let setup = $state<{ totpURI: string; backupCodes: string[] } | null>(null);
+  let qrDataUrl = $state("");
+
+  $effect(() => {
+    const uri = setup?.totpURI;
+    if (!uri) {
+      qrDataUrl = "";
+      return;
+    }
+    QRCode.toDataURL(uri, { margin: 1, width: 176 })
+      .then((url) => (qrDataUrl = url))
+      .catch(() => (qrDataUrl = ""));
+  });
+
+  async function begin(): Promise<void> {
+    busy = true;
+    error = null;
+    const { data, error: e } = await api.auth.twoFactor.enable({ password });
+    busy = false;
+    if (e) {
+      error = e.code === "INVALID_PASSWORD" ? i18n.t.setup2fa.wrongPassword : i18n.t.setup2fa.enableFailed;
+      return;
+    }
+    setup = { totpURI: data?.totpURI ?? "", backupCodes: (data?.backupCodes ?? []) as string[] };
+  }
+
+  async function activate(): Promise<void> {
+    busy = true;
+    error = null;
+    const { error: e } = await api.auth.twoFactor.verifyTotp({ code: code.trim() });
+    busy = false;
+    if (e) {
+      error = i18n.t.auth.twoFactorInvalidCode;
+      return;
+    }
+    await goto("/admin", { invalidateAll: true });
+  }
+
+  function downloadCodes(): void {
+    if (!setup) return;
+    const blob = new Blob([setup.backupCodes.join("\n") + "\n"], { type: "text/plain" });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = "backup-codes.txt";
+    a.click();
+    URL.revokeObjectURL(url);
+  }
+
+  async function signOut(): Promise<void> {
+    await api.auth.signOut();
+    await goto("/login", { invalidateAll: true });
+  }
+</script>
+
+<div class="flex min-h-svh items-center justify-center p-4">
+  <Card.Root class="w-full max-w-md">
+    <Card.Header>
+      <Card.Title>{i18n.t.setup2fa.title}</Card.Title>
+      <Card.Description>{i18n.t.setup2fa.subtitle}</Card.Description>
+    </Card.Header>
+    <Card.Content class="flex flex-col gap-4">
+      {#if error}
+        <Alert.Root variant="destructive"><Alert.Description>{error}</Alert.Description></Alert.Root>
+      {/if}
+
+      {#if !setup}
+        <div class="flex flex-col gap-2">
+          <Label for="pw">{i18n.t.setup2fa.passwordLabel}</Label>
+          <Input id="pw" type="password" bind:value={password} autocomplete="current-password" />
+        </div>
+        <Button disabled={busy || !password} onclick={begin}>{i18n.t.setup2fa.begin}</Button>
+      {:else}
+        <div class="flex flex-col gap-1">
+          <Label>{i18n.t.setup2fa.step1}</Label>
+          {#if qrDataUrl}
+            <img src={qrDataUrl} alt="TOTP QR code" width="176" height="176" class="rounded border bg-white p-2" />
+          {/if}
+          <code class="bg-muted overflow-x-auto rounded px-2 py-1 text-xs">{setup.totpURI}</code>
+        </div>
+
+        <div class="flex flex-col gap-1">
+          <Label>{i18n.t.setup2fa.step2}</Label>
+          <p class="text-muted-foreground text-xs">{i18n.t.account.backupCodesHint}</p>
+          <div class="bg-muted grid grid-cols-2 gap-1 rounded p-2 font-mono text-xs" data-testid="backup-codes">
+            {#each setup.backupCodes as c (c)}<span>{c}</span>{/each}
+          </div>
+          <Button variant="outline" size="sm" class="w-fit" onclick={downloadCodes}>{i18n.t.account.downloadBackupCodes}</Button>
+          <label class="mt-1 flex items-center gap-2 text-sm">
+            <Checkbox bind:checked={saved} /> {i18n.t.setup2fa.savedConfirm}
+          </label>
+        </div>
+
+        <div class="flex flex-col gap-2">
+          <Label for="code">{i18n.t.setup2fa.step3}</Label>
+          <Input id="code" bind:value={code} inputmode="numeric" autocomplete="one-time-code" />
+        </div>
+        <Button disabled={busy || !saved || !code} onclick={activate}>{i18n.t.setup2fa.activate}</Button>
+      {/if}
+
+      <Button variant="link" class="h-auto justify-start p-0 text-xs" onclick={signOut}>{i18n.t.setup2fa.signOut}</Button>
+    </Card.Content>
+  </Card.Root>
+</div>

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -74,6 +74,112 @@ test("two-factor: enable with a real TOTP code and require it at sign-in @smoke"
   await ctx2.dispose();
 });
 
+test("two-factor: a backup code completes sign-in and is single-use @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.twoFactor, "two-factor not enabled");
+  const email = `tf-bc-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "BC" } });
+
+  // Enable 2FA; the enable response includes the one-time backup codes.
+  const enable = await (await ctx.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+  await ctx.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+  const backupCodes = enable.backupCodes as string[];
+  expect(Array.isArray(backupCodes)).toBe(true);
+  expect(backupCodes.length).toBeGreaterThan(0);
+  const code = backupCodes[0]!;
+
+  // A backup code completes a challenged sign-in (no authenticator needed).
+  const ctx2 = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const signin = await (await ctx2.post("/api/auth/sign-in/email", { data: { email, password: pw } })).json();
+  expect(signin.twoFactorRedirect).toBe(true);
+  const used = await ctx2.post("/api/auth/two-factor/verify-backup-code", { data: { code } });
+  expect(used.ok()).toBeTruthy();
+  const session = await (await ctx2.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(email);
+
+  // The same code is single-use: a new challenge cannot reuse it.
+  const ctx3 = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctx3.post("/api/auth/sign-in/email", { data: { email, password: pw } });
+  const reuse = await ctx3.post("/api/auth/two-factor/verify-backup-code", { data: { code } });
+  expect(reuse.ok()).toBeFalsy();
+
+  await ctx.dispose();
+  await ctx2.dispose();
+  await ctx3.dispose();
+});
+
+test("two-factor: regenerating backup codes invalidates the old set @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await ctx.get("/api/account/capabilities")).json();
+  test.skip(!caps?.twoFactor, "two-factor not enabled");
+  const email = `tf-rg-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RG" } });
+  const enable = await (await ctx.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+  await ctx.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+  const oldCode = (enable.backupCodes as string[])[0]!;
+
+  // Regenerating returns a fresh set; the previous codes are replaced.
+  const regen = await (await ctx.post("/api/auth/two-factor/generate-backup-codes", { data: { password: pw } })).json();
+  const newCodes = regen.backupCodes as string[];
+  expect(Array.isArray(newCodes)).toBe(true);
+  expect(newCodes.length).toBeGreaterThan(0);
+  expect(newCodes).not.toContain(oldCode);
+
+  // An old code no longer completes a challenge; a new one does.
+  const ctxOld = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctxOld.post("/api/auth/sign-in/email", { data: { email, password: pw } });
+  expect((await ctxOld.post("/api/auth/two-factor/verify-backup-code", { data: { code: oldCode } })).ok()).toBeFalsy();
+
+  const ctxNew = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await ctxNew.post("/api/auth/sign-in/email", { data: { email, password: pw } });
+  expect((await ctxNew.post("/api/auth/two-factor/verify-backup-code", { data: { code: newCodes[0]! } })).ok()).toBeTruthy();
+
+  await ctx.dispose();
+  await ctxOld.dispose();
+  await ctxNew.dispose();
+});
+
+test("require-2fa: gates an un-enrolled user until they enrol @smoke", async ({ playwright }) => {
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await admin.get("/api/account/capabilities")).json();
+  test.skip(!caps?.twoFactor, "two-factor not enabled");
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+
+  const user = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `rq-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await user.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RQ" } });
+
+  try {
+    // Turn the policy on (admin; the toggle endpoint is allow-listed by the guard).
+    await admin.put("/api/account/settings", { data: { require2fa: true } });
+    // The guard caches for a few seconds — poll until the un-enrolled user is gated.
+    await expect(async () => {
+      expect((await user.get("/api/account/me")).status()).toBe(403);
+    }).toPass({ timeout: 8000 });
+
+    // Enrolling restores access.
+    const enable = await (await user.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+    await user.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+    expect((await user.get("/api/account/me")).status()).toBe(200);
+  } finally {
+    // Always turn it back off so the shared (un-enrolled) sessions aren't gated.
+    await admin.put("/api/account/settings", { data: { require2fa: false } });
+    await expect(async () => {
+      const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+      await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
+      const status = (await probe.get("/api/account/me")).status();
+      await probe.dispose();
+      expect(status).toBe(200);
+    }).toPass({ timeout: 8000 });
+    await admin.dispose();
+    await user.dispose();
+  }
+});
+
 test("multi-session holds several accounts and switches between them @smoke", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-flows.ui.spec.ts

@@ -0,0 +1,74 @@
+import { expect, test } from "@playwright/test";
+import { anonState } from "../helpers/accounts";
+import { ready } from "../helpers/hydration";
+import { smsSinkReachable, clearSms, waitForSmsOtp } from "../helpers/sms";
+
+// Each test drives a fresh disposable account (via a real UI login) so the shared
+// admin/user sessions are never mutated.
+test.use({ storageState: anonState });
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+const PW = "Podokit3e-Str0ng!pw";
+
+async function loginFresh(page: import("@playwright/test").Page, playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"], email: string): Promise<void> {
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await api.post("/api/auth/sign-up/email", { data: { email, password: PW, name: "Acc" } });
+  await api.dispose();
+  await ready(page, `/login?redirect=${encodeURIComponent("/admin/account")}`);
+  await page.locator("#email").fill(email);
+  await page.locator("#password").fill(PW);
+  await page.getByRole("button", { name: "Sign in", exact: true }).click();
+  await expect(page).toHaveURL(/\/admin\/account/);
+}
+
+test("account: register and verify a phone number @smoke", async ({ page, playwright }) => {
+  test.skip(!(await smsSinkReachable()), "sms sink unreachable");
+  await loginFresh(page, playwright, `acc-ph-${Date.now()}@example.com`);
+  const phoneInput = page.locator("#phone");
+  test.skip((await phoneInput.count()) === 0, "phone number feature disabled");
+
+  const phone = `+1555${String(Date.now()).slice(-7)}`;
+  await clearSms();
+  await phoneInput.fill(phone);
+  await page.getByRole("button", { name: "Send code" }).click();
+  const code = await waitForSmsOtp(phone);
+  await page.getByPlaceholder("Verification code").fill(code);
+  await page.getByRole("button", { name: "Verify", exact: true }).click();
+  await expect(page.getByText("Phone verified")).toBeVisible();
+});
+
+test("account: change email address @smoke", async ({ page, playwright }) => {
+  await loginFresh(page, playwright, `acc-em-${Date.now()}@example.com`);
+  await page.locator("#email").fill(`changed-${Date.now()}@example.com`);
+  await page.getByRole("button", { name: "Change email" }).click();
+  await expect(page.getByText(/Email address updated|approve the change/)).toBeVisible();
+});
+
+test("account: delete my own account @smoke", async ({ page, playwright }) => {
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", { data: { email: "admin@example.com", password: PW } });
+  try {
+    // Account deletion is a server toggle (off by default) — enable it, then poll
+    // until the capability is live (config store has a short TTL).
+    await admin.put("/api/account/auth-config", { data: { server: { allowDelete: true } } });
+    await expect(async () => {
+      const caps = await (await admin.get("/api/account/capabilities")).json();
+      expect(caps.deleteAccount).toBe(true);
+    }).toPass({ timeout: 8000 });
+
+    await loginFresh(page, playwright, `acc-del-${Date.now()}@example.com`);
+    await page.getByRole("button", { name: "Danger zone" }).click();
+    await page.getByRole("button", { name: "Delete account" }).first().click();
+    await page.locator("#del-pw").fill(PW);
+    // The auth instance rebuilds a few seconds after allowDelete is enabled, so
+    // the first delete can be rejected — retry the confirm until it goes through.
+    await expect(async () => {
+      await page.getByRole("dialog").getByRole("button", { name: "Delete account" }).click();
+      await expect(page).toHaveURL(/\/login/, { timeout: 3000 });
+    }).toPass({ timeout: 15000 });
+  } finally {
+    await admin.put("/api/account/auth-config", { data: { server: { allowDelete: false } } });
+    await admin.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -43,3 +43,14 @@ test("reset-password without a token is disabled", async ({ page }) => {
   await expect(page.getByRole("alert")).toBeVisible();
   await expect(page.getByRole("button", { name: "Update password" })).toBeDisabled();
 });
+
+test("signup creates an account and enters the app @smoke", async ({ page }) => {
+  await ready(page, "/signup");
+  const email = `signup-${Date.now()}@example.com`;
+  await page.getByLabel("Name").fill("New User");
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Password").fill("Podokit3e-Str0ng!pw");
+  await page.getByRole("button", { name: "Create account" }).click();
+  // Verification off → straight into the app; on → the verify-email page.
+  await expect(page).toHaveURL(/\/admin|\/verify-email/);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/impersonation.ui.spec.ts

@@ -0,0 +1,23 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+import { USER } from "../helpers/accounts";
+
+// admin storageState (project default)
+
+test("admin can impersonate a user and stop @smoke", async ({ page }) => {
+  await ready(page, "/admin/users");
+  await page.locator("#toolbar-search").fill(USER.email);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+
+  const row = page.getByRole("row", { name: new RegExp(USER.email) });
+  await row.getByRole("button").click();
+  await page.getByRole("menuitem", { name: "Impersonate" }).click();
+
+  // Impersonating drops us into the app with a banner offering to stop.
+  await expect(page).toHaveURL(/\/admin(\/|$)/);
+  const stop = page.getByRole("button", { name: "Stop impersonating" });
+  await expect(stop).toBeVisible();
+
+  await stop.click();
+  await expect(page.getByRole("button", { name: "Stop impersonating" })).toHaveCount(0);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/login-methods.ui.spec.ts

@@ -0,0 +1,41 @@
+import { expect, test } from "@playwright/test";
+import { anonState } from "../helpers/accounts";
+import { ready } from "../helpers/hydration";
+import { mailpitReachable, clearMailpit, waitForOtp } from "../helpers/mailpit";
+
+test.use({ storageState: anonState });
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+test("login: magic link shows a sent confirmation @smoke", async ({ page, playwright }) => {
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await api.get("/api/account/capabilities")).json();
+  await api.dispose();
+  test.skip(!caps?.magicLink, "magic link disabled");
+
+  await ready(page, "/login");
+  await page.locator("#email").fill(`ml-${Date.now()}@example.com`);
+  await page.getByRole("button", { name: /sign-in link/i }).click();
+  await expect(page.getByTestId("magic-link-sent")).toBeVisible();
+});
+
+test("login: an emailed one-time code signs a user in @smoke", async ({ page, playwright }) => {
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await api.get("/api/account/capabilities")).json();
+  test.skip(!caps?.emailOtp, "email otp disabled");
+  test.skip(!(await mailpitReachable()), "mailpit unreachable");
+
+  const email = `otp-${Date.now()}@example.com`;
+  await api.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "OTP" } });
+  await api.dispose();
+  await clearMailpit();
+
+  await ready(page, "/login");
+  await page.locator("#email").fill(email);
+  await page.getByRole("button", { name: "Email me a code" }).click();
+  const otp = await waitForOtp(email);
+  await page.getByLabel("One-time code").fill(otp);
+  await page.getByRole("button", { name: "Verify code" }).click();
+  await expect(page).toHaveURL(/\/admin/);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -26,14 +26,18 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff @sm
     const jwks = await (await page.request.get(disc.jwks_uri)).json();
     expect(Array.isArray(jwks.keys) && jwks.keys.length).toBeTruthy();
 
-    // Dynamic client registration returns usable credentials.
-    const reg = await (
-      await page.request.post("/api/auth/oauth2/create-client", {
-        data: { client_name: "E2E RP", redirect_uris: [REDIRECT] },
-        headers,
-      })
-    ).json();
-    expect(reg.client_id).toBeTruthy();
+    // Dynamic client registration returns usable credentials. Retry: right after
+    // the provider is enabled the auth instance may still be rebuilding.
+    let reg: { client_id?: string; client_secret?: string } = {};
+    await expect(async () => {
+      reg = await (
+        await page.request.post("/api/auth/oauth2/create-client", {
+          data: { client_name: "E2E RP", redirect_uris: [REDIRECT] },
+          headers,
+        })
+      ).json();
+      expect(reg.client_id).toBeTruthy();
+    }).toPass({ timeout: 8000 });
     expect(reg.client_secret).toBeTruthy();
 
     // Authorize validates the client + PKCE and hands off to the consent page with

package/dist/templates/modules/admin-dashboard/files/tests/ui/organizations.ui.spec.ts

@@ -53,3 +53,38 @@ test("create an org with a non-ascii name, a parent, and a manager @smoke", asyn
   await page.getByRole("row", { name: new RegExp(parent) }).getByRole("button", { name: "Delete" }).first().click();
   await expect(page.getByText("Organization deleted").first()).toBeVisible();
 });
+
+test("organization manage: remove a member, invite one, and cancel the invite @smoke", async ({ page }) => {
+  await ready(page, "/admin/organizations");
+  const newBtn = page.getByRole("button", { name: "New organization" });
+  test.skip((await newBtn.count()) === 0, "organizations not enabled");
+
+  const name = `Mng ${Date.now()}`;
+  await newBtn.click();
+  await page.getByLabel("Name", { exact: true }).fill(name);
+  // Seed a specific non-owner member (the admin is always the owner, so pick the
+  // seeded user — .first() is order-dependent and could hit the owner).
+  await page.locator("label", { hasText: "user@example.com" }).getByRole("checkbox").click();
+  await page.getByRole("dialog").getByRole("button", { name: "Create", exact: true }).click();
+  await expect(page.getByText("Organization created").first()).toBeVisible();
+
+  try {
+    await page.getByRole("row", { name: new RegExp(name) }).getByRole("button", { name: "Manage" }).click();
+    const dialog = page.getByRole("dialog");
+
+    // The seeded non-owner member is removable.
+    const remove = dialog.getByRole("button", { name: "Remove" }).first();
+    await expect(remove).toBeVisible();
+    await remove.click();
+
+    // Invite a member by email → pending invitation appears → cancel it.
+    await dialog.locator("#invite-email").fill(`invitee-${Date.now()}@example.com`);
+    await dialog.getByRole("button", { name: "Invite", exact: true }).click();
+    await expect(page.getByText("Invitation sent").first()).toBeVisible();
+    await dialog.getByRole("button", { name: "Cancel", exact: true }).first().click();
+  } finally {
+    await page.keyboard.press("Escape").catch(() => undefined);
+    await page.getByRole("row", { name: new RegExp(name) }).getByRole("button", { name: "Delete" }).first().click();
+    await expect(page.getByText("Organization deleted").first()).toBeVisible();
+  }
+});