@podosoft/podokit 0.8.0 → 0.10.0

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -16,6 +16,16 @@ async function seedSession(
     data: { email: account.email, password: account.password },
   });
   expect(res.ok(), `sign-in ${account.email}`).toBeTruthy();
+  // Keep repeated local runs from filling better-auth's 100-session response
+  // before the newly created current session can appear in account tests. The
+  // endpoint clears at most one response page, so drain several pages when a
+  // long-lived local database has accumulated them.
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    const sessionsResponse = await ctx.get("/api/auth/list-sessions");
+    const sessions = sessionsResponse.ok() ? (await sessionsResponse.json()) as unknown : [];
+    if (!Array.isArray(sessions) || sessions.length <= 1) break;
+    expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
+  }
   await ctx.storageState({ path });
   await ctx.dispose();
 }

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-flows.ui.spec.ts

@@ -0,0 +1,74 @@
+import { expect, test } from "@playwright/test";
+import { anonState } from "../helpers/accounts";
+import { ready } from "../helpers/hydration";
+import { smsSinkReachable, clearSms, waitForSmsOtp } from "../helpers/sms";
+
+// Each test drives a fresh disposable account (via a real UI login) so the shared
+// admin/user sessions are never mutated.
+test.use({ storageState: anonState });
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+const PW = "Podokit3e-Str0ng!pw";
+
+async function loginFresh(page: import("@playwright/test").Page, playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"], email: string): Promise<void> {
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await api.post("/api/auth/sign-up/email", { data: { email, password: PW, name: "Acc" } });
+  await api.dispose();
+  await ready(page, `/login?redirect=${encodeURIComponent("/admin/account")}`);
+  await page.locator("#email").fill(email);
+  await page.locator("#password").fill(PW);
+  await page.getByRole("button", { name: "Sign in", exact: true }).click();
+  await expect(page).toHaveURL(/\/admin\/account/);
+}
+
+test("account: register and verify a phone number @smoke", async ({ page, playwright }) => {
+  test.skip(!(await smsSinkReachable()), "sms sink unreachable");
+  await loginFresh(page, playwright, `acc-ph-${Date.now()}@example.com`);
+  const phoneInput = page.locator("#phone");
+  test.skip((await phoneInput.count()) === 0, "phone number feature disabled");
+
+  const phone = `+1555${String(Date.now()).slice(-7)}`;
+  await clearSms();
+  await phoneInput.fill(phone);
+  await page.getByRole("button", { name: "Send code" }).click();
+  const code = await waitForSmsOtp(phone);
+  await page.getByPlaceholder("Verification code").fill(code);
+  await page.getByRole("button", { name: "Verify", exact: true }).click();
+  await expect(page.getByText("Phone verified")).toBeVisible();
+});
+
+test("account: change email address @smoke", async ({ page, playwright }) => {
+  await loginFresh(page, playwright, `acc-em-${Date.now()}@example.com`);
+  await page.locator("#email").fill(`changed-${Date.now()}@example.com`);
+  await page.getByRole("button", { name: "Change email" }).click();
+  await expect(page.getByText(/Email address updated|approve the change/)).toBeVisible();
+});
+
+test("account: delete my own account @smoke", async ({ page, playwright }) => {
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", { data: { email: "admin@example.com", password: PW } });
+  try {
+    // Account deletion is a server toggle (off by default) — enable it, then poll
+    // until the capability is live (config store has a short TTL).
+    await admin.put("/api/account/auth-config", { data: { server: { allowDelete: true } } });
+    await expect(async () => {
+      const caps = await (await admin.get("/api/account/capabilities")).json();
+      expect(caps.deleteAccount).toBe(true);
+    }).toPass({ timeout: 8000 });
+
+    await loginFresh(page, playwright, `acc-del-${Date.now()}@example.com`);
+    await page.getByRole("button", { name: "Danger zone" }).click();
+    await page.getByRole("button", { name: "Delete account" }).first().click();
+    await page.locator("#del-pw").fill(PW);
+    // The auth instance rebuilds a few seconds after allowDelete is enabled, so
+    // the first delete can be rejected — retry the confirm until it goes through.
+    await expect(async () => {
+      await page.getByRole("dialog").getByRole("button", { name: "Delete account" }).click();
+      await expect(page).toHaveURL(/\/login/, { timeout: 3000 });
+    }).toPass({ timeout: 15000 });
+  } finally {
+    await admin.put("/api/account/auth-config", { data: { server: { allowDelete: false } } });
+    await admin.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
+import { ADMIN } from "../helpers/accounts";
 
 // admin storageState (project default)
 test("account opens on the profile section @smoke", async ({ page }) => {
@@ -9,7 +10,7 @@ test("account opens on the profile section @smoke", async ({ page }) => {
   await expect(page.getByLabel("Email")).toHaveValue("admin@example.com");
   // save is enabled only once the name changes
   await expect(page.getByRole("button", { name: "Save changes" })).toBeDisabled();
-  await page.getByLabel("Name", { exact: true }).fill("Admin Renamed");
+  await page.getByLabel("Name", { exact: true }).fill(`Admin Preview ${Date.now()}`);
   await expect(page.getByRole("button", { name: "Save changes" })).toBeEnabled();
 });
 
@@ -82,7 +83,13 @@ test("account shows a phone field when enabled @smoke", async ({ page }) => {
 
 test("admin can update their profile name", async ({ page }) => {
   await ready(page, "/admin/account");
-  await page.getByLabel("Name", { exact: true }).fill("Admin Renamed");
+  const name = page.getByLabel("Name", { exact: true });
+  await name.fill(`Admin Updated ${Date.now()}`);
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("Profile updated")).toBeVisible();
+  await ready(page, "/admin/account");
+  const refreshedName = page.getByLabel("Name", { exact: true });
+  await refreshedName.fill(ADMIN.name);
   await page.getByRole("button", { name: "Save changes" }).click();
   await expect(page.getByText("Profile updated")).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -0,0 +1,63 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default). The Appearance controls live in their
+// own "Appearance" settings tab.
+async function openAppearance(page: import("@playwright/test").Page): Promise<void> {
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Appearance" }).click();
+}
+
+test("appearance: has its own tab with theme controls @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  await expect(page.getByRole("tab", { name: "Appearance" })).toBeVisible();
+  await page.getByRole("tab", { name: "Appearance" }).click();
+  await expect(page.getByRole("heading", { name: "Appearance" })).toBeVisible();
+  await expect(page.getByRole("heading", { name: "Featured themes" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Default", exact: true })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Violet" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Zinc" })).toBeHidden();
+  await expect(page.getByLabel("Brand color").first()).toBeVisible();
+  await expect(page.getByText("Corner style", { exact: true })).toBeVisible();
+  await expect(page.getByText("Preview", { exact: true })).toBeVisible();
+});
+
+test("appearance: keeps the full preset catalog behind a disclosure", async ({ page }) => {
+  await openAppearance(page);
+  await page.getByRole("button", { name: "Show more themes" }).click();
+  await expect(page.getByRole("button", { name: "Zinc" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "GitHub" })).toBeVisible();
+  await page.getByRole("button", { name: "Show fewer themes" }).click();
+  await expect(page.getByRole("button", { name: "Zinc" })).toBeHidden();
+});
+
+test("appearance: preview light/dark toggle switches modes", async ({ page }) => {
+  await openAppearance(page);
+  await expect(page.getByRole("button", { name: "Light" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Dark" })).toBeVisible();
+  await page.getByRole("button", { name: "Dark" }).click();
+});
+
+test("appearance: advanced reveals per-token pickers", async ({ page }) => {
+  await openAppearance(page);
+  await page.getByRole("button", { name: "Fine-tune colors" }).click();
+  await expect(page.getByRole("button", { name: "Clear color adjustments" })).toBeVisible();
+  await expect(page.getByLabel("Primary light")).toBeVisible();
+  await page.getByRole("button", { name: "Dark", exact: true }).last().click();
+  await expect(page.getByLabel("Primary dark")).toBeVisible();
+});
+
+test("appearance: pick a preset, save, apply live, then restore @smoke", async ({ page }) => {
+  await openAppearance(page);
+  await page.getByRole("button", { name: "Slate" }).click();
+  await page.getByRole("button", { name: "Medium" }).click();
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("General settings saved.").first()).toBeVisible();
+  // Applied globally via the scoped override stylesheet.
+  await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
+
+  // "Restore defaults" reverts everything in one click and persists.
+  await page.getByRole("button", { name: "Restore defaults" }).click();
+  await expect(page.getByText("General settings saved.").first()).toBeVisible();
+  await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -43,3 +43,14 @@ test("reset-password without a token is disabled", async ({ page }) => {
   await expect(page.getByRole("alert")).toBeVisible();
   await expect(page.getByRole("button", { name: "Update password" })).toBeDisabled();
 });
+
+test("signup creates an account and enters the app @smoke", async ({ page }) => {
+  await ready(page, "/signup");
+  const email = `signup-${Date.now()}@example.com`;
+  await page.getByLabel("Name").fill("New User");
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Password").fill("Podokit3e-Str0ng!pw");
+  await page.getByRole("button", { name: "Create account" }).click();
+  // Verification off → straight into the app; on → the verify-email page.
+  await expect(page).toHaveURL(/\/admin|\/verify-email/);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -9,12 +9,17 @@ import { ready } from "../helpers/hydration";
 // `finally` so a mid-test failure still leaves the shared site settings clean.
 
 async function saveGeneral(page: Page): Promise<void> {
+  const saved = page.waitForResponse(
+    (response) => response.url().endsWith("/api/site/settings") && response.request().method() === "PUT",
+  );
   await page.getByRole("button", { name: "Save changes" }).click();
-  await expect(page.getByText("General settings saved.")).toBeVisible();
+  expect((await saved).ok()).toBeTruthy();
+  await expect(page.getByText("General settings saved.").last()).toBeVisible();
 }
 
-test("general: footer text and links render on public pages @smoke", async ({ page }) => {
+test("general: footer text and links render on public pages @smoke", async ({ page, browser }) => {
   await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
   const footer = page.getByLabel("Footer text");
   const support = page.getByLabel("Support email");
   const origFooter = await footer.inputValue();
@@ -23,9 +28,12 @@ test("general: footer text and links render on public pages @smoke", async ({ pa
   await support.fill("help@example.com");
   await saveGeneral(page);
   try {
-    await page.goto("/");
-    await expect(page.getByText("© 2026 PodoKit Test")).toBeVisible();
-    await expect(page.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}/login`);
+    await expect(anon.getByText("© 2026 PodoKit Test")).toBeVisible();
+    await expect(anon.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
+    await ctx.close();
   } finally {
     await ready(page, "/admin/settings");
     await page.getByLabel("Footer text").fill(origFooter);

package/dist/templates/modules/admin-dashboard/files/tests/ui/guards.ui.spec.ts

@@ -4,8 +4,20 @@ import { anonState, userState } from "../helpers/accounts";
 test.describe("unauthenticated", () => {
   test.use({ storageState: anonState });
   test("protected route redirects to login @smoke", async ({ page }) => {
-    await page.goto("/admin");
-    await expect(page).toHaveURL(/\/login\?redirect=/);
+    for (const route of ["/admin", "/account"]) {
+      await page.goto(route);
+      await expect(page).toHaveURL(/\/login\?redirect=/);
+    }
+  });
+
+  test("private and authentication routes prevent search indexing @smoke", async ({ request }) => {
+    for (const route of ["/admin", "/account", "/login", "/api/account/me"]) {
+      const response = await request.get(route, { maxRedirects: 0 });
+      expect(response.headers()["x-robots-tag"]).toBe("noindex, nofollow");
+    }
+
+    const landing = await request.get("/");
+    expect(landing.headers()["x-robots-tag"]).toBeUndefined();
   });
 });
 
@@ -19,4 +31,11 @@ test.describe("normal user (non-admin)", () => {
     expect((await page.goto("/admin/sessions"))?.status()).toBe(403);
     expect((await page.goto("/admin/settings"))?.status()).toBe(403);
   });
+
+  test("account is available without the admin shell @smoke", async ({ page }) => {
+    await page.goto("/account");
+    await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
+    await expect(page.getByLabel("Name", { exact: true })).toBeVisible();
+    await expect(page.getByRole("link", { name: "Overview" })).toHaveCount(0);
+  });
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/impersonation.ui.spec.ts

@@ -0,0 +1,23 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+import { USER } from "../helpers/accounts";
+
+// admin storageState (project default)
+
+test("admin can impersonate a user and stop @smoke", async ({ page }) => {
+  await ready(page, "/admin/users");
+  await page.locator("#toolbar-search").fill(USER.email);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+
+  const row = page.getByRole("row", { name: new RegExp(USER.email) });
+  await row.getByRole("button").click();
+  await page.getByRole("menuitem", { name: "Impersonate" }).click();
+
+  // Impersonating drops us into the app with a banner offering to stop.
+  await expect(page).toHaveURL(/\/admin(\/|$)/);
+  const stop = page.getByRole("button", { name: "Stop impersonating" });
+  await expect(stop).toBeVisible();
+
+  await stop.click();
+  await expect(page.getByRole("button", { name: "Stop impersonating" })).toHaveCount(0);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/login-methods.ui.spec.ts

@@ -0,0 +1,41 @@
+import { expect, test } from "@playwright/test";
+import { anonState } from "../helpers/accounts";
+import { ready } from "../helpers/hydration";
+import { mailpitReachable, clearMailpit, waitForOtp } from "../helpers/mailpit";
+
+test.use({ storageState: anonState });
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+test("login: magic link shows a sent confirmation @smoke", async ({ page, playwright }) => {
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await api.get("/api/account/capabilities")).json();
+  await api.dispose();
+  test.skip(!caps?.magicLink, "magic link disabled");
+
+  await ready(page, "/login");
+  await page.locator("#email").fill(`ml-${Date.now()}@example.com`);
+  await page.getByRole("button", { name: /sign-in link/i }).click();
+  await expect(page.getByTestId("magic-link-sent")).toBeVisible();
+});
+
+test("login: an emailed one-time code signs a user in @smoke", async ({ page, playwright }) => {
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await api.get("/api/account/capabilities")).json();
+  test.skip(!caps?.emailOtp, "email otp disabled");
+  test.skip(!(await mailpitReachable()), "mailpit unreachable");
+
+  const email = `otp-${Date.now()}@example.com`;
+  await api.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "OTP" } });
+  await api.dispose();
+  await clearMailpit();
+
+  await ready(page, "/login");
+  await page.locator("#email").fill(email);
+  await page.getByRole("button", { name: "Email me a code" }).click();
+  const otp = await waitForOtp(email);
+  await page.getByLabel("One-time code").fill(otp);
+  await page.getByRole("button", { name: "Verify code" }).click();
+  await expect(page).toHaveURL(/\/admin/);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -26,14 +26,18 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff @sm
     const jwks = await (await page.request.get(disc.jwks_uri)).json();
     expect(Array.isArray(jwks.keys) && jwks.keys.length).toBeTruthy();
 
-    // Dynamic client registration returns usable credentials.
-    const reg = await (
-      await page.request.post("/api/auth/oauth2/create-client", {
-        data: { client_name: "E2E RP", redirect_uris: [REDIRECT] },
-        headers,
-      })
-    ).json();
-    expect(reg.client_id).toBeTruthy();
+    // Dynamic client registration returns usable credentials. Retry: right after
+    // the provider is enabled the auth instance may still be rebuilding.
+    let reg: { client_id?: string; client_secret?: string } = {};
+    await expect(async () => {
+      reg = await (
+        await page.request.post("/api/auth/oauth2/create-client", {
+          data: { client_name: "E2E RP", redirect_uris: [REDIRECT] },
+          headers,
+        })
+      ).json();
+      expect(reg.client_id).toBeTruthy();
+    }).toPass({ timeout: 8000 });
     expect(reg.client_secret).toBeTruthy();
 
     // Authorize validates the client + PKCE and hands off to the consent page with

package/dist/templates/modules/admin-dashboard/files/tests/ui/organizations.ui.spec.ts

@@ -53,3 +53,38 @@ test("create an org with a non-ascii name, a parent, and a manager @smoke", asyn
   await page.getByRole("row", { name: new RegExp(parent) }).getByRole("button", { name: "Delete" }).first().click();
   await expect(page.getByText("Organization deleted").first()).toBeVisible();
 });
+
+test("organization manage: remove a member, invite one, and cancel the invite @smoke", async ({ page }) => {
+  await ready(page, "/admin/organizations");
+  const newBtn = page.getByRole("button", { name: "New organization" });
+  test.skip((await newBtn.count()) === 0, "organizations not enabled");
+
+  const name = `Mng ${Date.now()}`;
+  await newBtn.click();
+  await page.getByLabel("Name", { exact: true }).fill(name);
+  // Seed a specific non-owner member (the admin is always the owner, so pick the
+  // seeded user — .first() is order-dependent and could hit the owner).
+  await page.locator("label", { hasText: "user@example.com" }).getByRole("checkbox").click();
+  await page.getByRole("dialog").getByRole("button", { name: "Create", exact: true }).click();
+  await expect(page.getByText("Organization created").first()).toBeVisible();
+
+  try {
+    await page.getByRole("row", { name: new RegExp(name) }).getByRole("button", { name: "Manage" }).click();
+    const dialog = page.getByRole("dialog");
+
+    // The seeded non-owner member is removable.
+    const remove = dialog.getByRole("button", { name: "Remove" }).first();
+    await expect(remove).toBeVisible();
+    await remove.click();
+
+    // Invite a member by email → pending invitation appears → cancel it.
+    await dialog.locator("#invite-email").fill(`invitee-${Date.now()}@example.com`);
+    await dialog.getByRole("button", { name: "Invite", exact: true }).click();
+    await expect(page.getByText("Invitation sent").first()).toBeVisible();
+    await dialog.getByRole("button", { name: "Cancel", exact: true }).first().click();
+  } finally {
+    await page.keyboard.press("Escape").catch(() => undefined);
+    await page.getByRole("row", { name: new RegExp(name) }).getByRole("button", { name: "Delete" }).first().click();
+    await expect(page.getByText("Organization deleted").first()).toBeVisible();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/passkey.ui.spec.ts

@@ -18,7 +18,7 @@ test("register a passkey and sign in with it @smoke", async ({ page, baseURL })
   const email = `pk-${Date.now()}@example.com`;
   const pw = "Podokit3e-Str0ng!pw";
   const signup = await page.context().request.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "PK" }, headers: origin });
-  expect(signup.ok()).toBeTruthy();
+  expect(signup.ok(), await signup.text()).toBeTruthy();
 
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings-dialogs.ui.spec.ts

@@ -0,0 +1,63 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default)
+
+test("settings: add and remove a social login provider @smoke", async ({ page }) => {
+  const dialog = page.getByRole("dialog");
+  const addBtn = dialog.getByRole("button", { name: "Add provider" });
+  const openConfigure = async (): Promise<void> => {
+    await page.getByRole("tab", { name: "Authentication" }).click();
+    await page.getByRole("button", { name: "Configure" }).click();
+  };
+
+  await ready(page, "/admin/settings");
+  // The auth-config catalog can be momentarily unavailable right after another
+  // spec toggles auth config (the auth instance rebuilds). Reload until the
+  // catalog is loaded (Add provider becomes enabled).
+  await expect(async () => {
+    await page.reload();
+    await openConfigure();
+    await expect(addBtn).toBeEnabled({ timeout: 3000 });
+  }).toPass({ timeout: 25000 });
+
+  await addBtn.click();
+  const provider = dialog.locator("#social-provider");
+  await expect(provider).toBeVisible();
+  const callback = await dialog.locator("code").textContent();
+  const providerId = callback?.trim().split("/").pop() ?? ""; // first addable provider (not hard-coded)
+  expect(providerId).not.toBe("");
+  try {
+    await dialog.locator("#social-id").fill("test-client-id");
+    await dialog.locator("#social-secret").fill("test-secret");
+    await dialog.getByRole("button", { name: "Save", exact: true }).click();
+    // Save returns to the list view, where the new provider row has an enable switch.
+    await expect(dialog.getByRole("switch").first()).toBeVisible();
+  } finally {
+    if (providerId) {
+      await page.request
+        .put("/api/account/auth-config", { data: { social: { [providerId]: { delete: true } } } })
+        .catch(() => undefined);
+    }
+  }
+});
+
+test("settings: open and save the SMTP dialog @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Authentication" }).click();
+  await page.getByRole("button", { name: "SMTP settings" }).click();
+  const dialog = page.getByRole("dialog");
+  try {
+    // Point at the same Mailpit the env already uses, so saving can't re-route mail
+    // for the other email specs.
+    await dialog.locator("#smtp-host").fill("localhost");
+    await dialog.locator("#smtp-port").fill("1125");
+    await dialog.getByRole("button", { name: "Save", exact: true }).click();
+    await expect(page.getByText("Setting updated").first()).toBeVisible();
+  } finally {
+    // Reset SMTP so the config store falls back to environment for later specs.
+    await page.request
+      .put("/api/account/auth-config", { data: { smtp: { enabled: false, host: "", port: 587, user: "", from: "", secure: false } } })
+      .catch(() => undefined);
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings.ui.spec.ts

@@ -1,8 +1,17 @@
-import { expect, test } from "@playwright/test";
+import { expect, test, type Page } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default)
 
+async function saveGeneral(page: Page): Promise<void> {
+  const saved = page.waitForResponse(
+    (response) => response.url().endsWith("/api/site/settings") && response.request().method() === "PUT",
+  );
+  await page.getByRole("button", { name: "Save changes" }).click();
+  expect((await saved).ok()).toBeTruthy();
+  await expect(page.getByText("General settings saved.").last()).toBeVisible();
+}
+
 test("settings has General and Authentication tabs @smoke", async ({ page }) => {
   await ready(page, "/admin/settings");
   await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
@@ -23,14 +32,12 @@ test("general settings: edit the site name, save, and apply live @smoke", async
   const name = page.getByLabel("Site name");
   const original = await name.inputValue();
   await name.fill("PodoKit Test Site");
-  await page.getByRole("button", { name: "Save changes" }).click();
-  await expect(page.getByText("General settings saved.")).toBeVisible();
+  await saveGeneral(page);
   // the browser tab title reflects the new name live (no reload)
   await expect(page).toHaveTitle("PodoKit Test Site");
   // restore so other specs start clean
   await name.fill(original);
-  await page.getByRole("button", { name: "Save changes" }).click();
-  await expect(page.getByText("General settings saved.")).toBeVisible();
+  await saveGeneral(page);
 });
 
 test("settings lists the auth features under the Authentication tab @smoke", async ({ page }) => {
@@ -49,8 +56,8 @@ test("sidebar: back-to-home link returns to the landing page @smoke", async ({ p
   // the home link lives in the sidebar footer, above the user menu
   await page.getByRole("link", { name: "Back to home" }).click();
   await expect(page).toHaveURL(/\/$/);
-  // the landing page shows the "Open admin" entry point
-  await expect(page.getByRole("link", { name: "Open admin" })).toBeVisible();
+  // The starter landing route is app-owned and remains intact when the module is added.
+  await expect(page.getByRole("heading", { name: "app" })).toBeVisible();
 });
 
 test("settings is reachable from the sidebar @smoke", async ({ page }) => {
@@ -73,3 +80,12 @@ test("admin can toggle a feature flag and it applies live @smoke", async ({ page
   await toggle.click();
   await expect(toggle).toBeChecked();
 });
+
+test("settings: the require-two-factor toggle is available @smoke", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Authentication" }).click();
+  // The policy toggle renders under Authentication; its enforcement is covered by
+  // the require-2fa api/ui specs. Not toggled here — turning it on would gate this
+  // admin session.
+  await expect(page.getByRole("switch", { name: "Require two-factor" })).toBeVisible();
+});