@podosoft/podokit 1.1.6 → 1.2.0

package/dist/templates/modules/admin-dashboard/files/tests/api/audit.api.spec.ts

@@ -4,6 +4,8 @@ import { ADMIN, USER } from "../helpers/accounts";
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
+type Entry = { id: string; action: string; actorEmail: string | null; targetLabel: string | null; createdAt: string };
+
 async function signedIn(
   playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"],
   account: { email: string; password: string },
@@ -13,6 +15,10 @@ async function signedIn(
   return ctx;
 }
 
+function auditQuery(params: Record<string, string>): string {
+  return `/api/audit-logs?${new URLSearchParams(params).toString()}`;
+}
+
 test("audit log records auth/admin actions", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const probe = await admin.get("/api/audit-logs");
@@ -26,12 +32,11 @@ test("audit log records auth/admin actions", async ({ playwright, disposableUser
   expect(created.ok()).toBeTruthy();
   const userId = await disposableUsers.trackResponse(created);
 
-  const res = await admin.get("/api/audit-logs");
+  const res = await admin.get(auditQuery({ action: "user.create", target: email }));
   expect(res.ok()).toBeTruthy();
-  const entries = (await res.json()) as Array<{ action: string; actorEmail: string | null; targetLabel: string | null }>;
-  const entry = entries.find((e) => e.action === "user.create" && e.targetLabel === email);
-  expect(entry, "user.create should be audited with the target").toBeTruthy();
-  expect(entry?.actorEmail, "audit entry records the acting admin").toBe(ADMIN.email);
+  const entries = (await res.json()) as Entry[];
+  expect(entries, "user.create should be audited with the target").toHaveLength(1);
+  expect(entries[0]?.actorEmail, "audit entry records the acting admin").toBe(ADMIN.email);
 
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
   disposableUsers.forget(userId);
@@ -45,6 +50,7 @@ test("the audit log is admin-only", async ({ playwright }) => {
 
   const user = await signedIn(playwright, USER);
   expect((await user.get("/api/audit-logs")).status()).toBe(403);
+  expect((await user.get("/api/audit-logs/actions")).status()).toBe(403);
   await user.dispose();
 });
 
@@ -57,8 +63,66 @@ test("sending a verification email is audited", async ({ playwright, disposableU
   });
   await disposableUsers.trackResponse(created);
   await admin.post("/api/auth/send-verification-email", { data: { email, callbackURL: `${base}/admin` } });
-  const entries = (await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>;
-  expect(entries.some((e) => e.action === "auth.verification_sent"), "verification send should be audited").toBeTruthy();
+  const entries = (await (await admin.get(auditQuery({ action: "auth.verification_sent", target: email }))).json()) as Entry[];
+  expect(entries, "verification send should be audited").toHaveLength(1);
+  await admin.dispose();
+});
+
+test("the audit log pages with a cursor header through the web proxy", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
+  // Every sign-in is audited; one more guarantees at least two pages of one entry.
+  await (await signedIn(playwright, ADMIN)).dispose();
+
+  const query = { action: "auth.login", actor: ADMIN.email, limit: "1" };
+  const first = await admin.get(auditQuery(query));
+  expect(first.ok()).toBeTruthy();
+  const firstPage = (await first.json()) as Entry[];
+  expect(Array.isArray(firstPage)).toBe(true);
+  expect(firstPage).toHaveLength(1);
+  const cursor = first.headers()["x-next-cursor"];
+  expect(cursor, "the proxy relays the next-page cursor").toBeTruthy();
+
+  const second = await admin.get(auditQuery({ ...query, cursor: cursor ?? "" }));
+  const secondPage = (await second.json()) as Entry[];
+  expect(secondPage).toHaveLength(1);
+  expect(secondPage[0]?.id).not.toBe(firstPage[0]?.id);
+  expect(Date.parse(secondPage[0]?.createdAt ?? "")).toBeLessThanOrEqual(Date.parse(firstPage[0]?.createdAt ?? ""));
+
+  const ascending = (await (await admin.get(auditQuery({ ...query, limit: "2", order: "asc" }))).json()) as Entry[];
+  expect(Date.parse(ascending[0]?.createdAt ?? "")).toBeLessThanOrEqual(Date.parse(ascending[1]?.createdAt ?? ""));
+  await admin.dispose();
+});
+
+test("the audit log filters on the server and lists its action codes", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
+
+  const logins = (await (await admin.get(auditQuery({ action: "auth.login", limit: "100" }))).json()) as Entry[];
+  expect(logins.length).toBeGreaterThan(0);
+  expect(logins.every((entry) => entry.action === "auth.login")).toBe(true);
+
+  const mine = (await (await admin.get(auditQuery({ actor: ADMIN.email, limit: "100" }))).json()) as Entry[];
+  expect(mine.length).toBeGreaterThan(0);
+  expect(mine.every((entry) => entry.actorEmail === ADMIN.email)).toBe(true);
+
+  const nobody = await admin.get(auditQuery({ actor: `nobody-${Date.now()}@example.com` }));
+  expect(await nobody.json()).toEqual([]);
+  expect(nobody.headers()["x-next-cursor"]).toBeUndefined();
+
+  const actions = (await (await admin.get("/api/audit-logs/actions")).json()) as string[];
+  expect(actions).toContain("auth.login");
+  expect([...actions].sort()).toEqual(actions);
+  await admin.dispose();
+});
+
+test("the audit log rejects bad paging parameters", async ({ playwright }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
+  expect((await admin.get(auditQuery({ limit: "101" }))).status()).toBe(400);
+  const badCursor = await admin.get(auditQuery({ cursor: "not-a-cursor" }));
+  expect(badCursor.status()).toBe(400);
+  expect(((await badCursor.json()) as { error: { code: string } }).error.code).toBe("INVALID_CURSOR");
   await admin.dispose();
 });
 
@@ -69,9 +133,7 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright, d
   test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
   const auditLog = async () => (await (await admin.get("/api/account/capabilities")).json()).auditLog as boolean;
   const recorded = async (label: string) =>
-    ((await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>).some(
-      (e) => e.action === "user.create" && e.targetLabel === label,
-    );
+    ((await (await admin.get(auditQuery({ action: "user.create", target: label }))).json()) as Entry[]).length > 0;
   const createUser = async (email: string): Promise<string> => {
     const response = await admin.post("/api/auth/admin/create-user", {
       data: { email, password: "Podokit3e-Str0ng!pw", name: "T", role: "user" },
@@ -80,8 +142,9 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright, d
   };
 
   try {
-    // OFF → the action is not recorded. Wait past the config-store cache TTL so the
-    // audit gate sees the new value (its cache is independent of the capabilities one).
+    // OFF → the action is not recorded. The write refreshes this process's config
+    // store, but other API replicas keep their snapshot for the store's cache TTL,
+    // so wait it out before relying on the new value.
     await admin.put("/api/account/auth-config", { data: { server: { auditLog: false } } });
     await expect.poll(auditLog, { timeout: 8000 }).toBe(false);
     await new Promise((r) => setTimeout(r, 4000));

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "@playwright/test";
+import { createPublicKey, verify, type JsonWebKey } from "node:crypto";
 import { ADMIN, USER } from "../helpers/accounts";
 import { clearSms, smsSinkReachable, waitForSmsOtp } from "../helpers/sms";
 import { totpCode } from "../helpers/totp";
@@ -156,6 +157,11 @@ test("require-2fa: gates an un-enrolled user until they enrol", async ({ playwri
   try {
     // Turn the policy on (admin; the toggle endpoint is allow-listed by the guard).
     await admin.put("/api/account/settings", { data: { require2fa: true } });
+    // Capabilities carry the same policy as the dedicated endpoint.
+    await expect(async () => {
+      expect((await (await admin.get("/api/account/capabilities")).json()).require2fa).toBe(true);
+      expect(await (await admin.get("/api/account/require-2fa")).json()).toEqual({ require2fa: true });
+    }).toPass({ timeout: 8000 });
     // The guard caches for a few seconds — poll until the un-enrolled user is gated.
     await expect(async () => {
       expect((await user.get("/api/account/me")).status()).toBe(403);
@@ -238,9 +244,37 @@ test("bearer token authenticates API requests without a cookie", async ({ playwr
   const authed = await api.get("/api/account/me", { headers: { Authorization: `Bearer ${token}` } });
   expect(authed.ok()).toBeTruthy();
   expect((await authed.json())?.email).toBe(email);
+  // Only the signed value authenticates; the bare token before the signature does not.
+  const unsigned = decodeURIComponent(token ?? "").split(".")[0];
+  const rejected = await api.get("/api/account/me", { headers: { Authorization: `Bearer ${unsigned}` } });
+  expect(rejected.status()).toBe(401);
   await api.dispose();
 });
 
+test("a session JWT is issued on request and verifies against the JWKS", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `jwt-${Date.now()}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "JWT" } });
+  // Session reads do not sign a JWT; a client that needs one requests it here.
+  const issued = await ctx.get("/api/auth/token");
+  expect(issued.ok(), await issued.text()).toBeTruthy();
+  const token = String((await issued.json())?.token ?? "");
+  const [header = "", payload = "", signature = ""] = token.split(".");
+  const { kid } = JSON.parse(Buffer.from(header, "base64url").toString("utf8")) as { kid?: string };
+  const jwks = (await (await ctx.get("/api/auth/jwks")).json()) as { keys: Array<JsonWebKey & { kid?: string }> };
+  const key = jwks.keys.find((candidate) => candidate.kid === kid);
+  expect(key, "the token's signing key is published").toBeTruthy();
+  const valid = verify(
+    null,
+    Buffer.from(`${header}.${payload}`),
+    createPublicKey({ key: key ?? {}, format: "jwk" }),
+    Buffer.from(signature, "base64url"),
+  );
+  expect(valid).toBe(true);
+  expect(JSON.parse(Buffer.from(payload, "base64url").toString("utf8"))?.email).toBe(email);
+  await ctx.dispose();
+});
+
 test("a user can create, list and revoke a personal API key", async ({ playwright }) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const caps = await (await ctx.get("/api/account/capabilities")).json();

package/dist/templates/modules/admin-dashboard/files/tests/api/profile-image.api.spec.ts

@@ -48,6 +48,13 @@ test("profile image upload, replacement, public read, and removal", async ({ pla
   expect(firstImage.ok()).toBeTruthy();
   expect(firstImage.headers()["content-type"]).toContain("image/png");
   expect(firstImage.headers()["cache-control"]).toBe("public, max-age=31536000, immutable");
+  expect(firstImage.headers()["content-length"]).toBe(String(PNG.byteLength));
+  expect((await firstImage.body()).equals(PNG)).toBe(true);
+  const etag = firstImage.headers()["etag"];
+  expect(etag).toMatch(/^"[^"]+"$/);
+  const revalidated = await admin.get(firstBody.image, { headers: { "if-none-match": etag ?? "" } });
+  expect(revalidated.status()).toBe(304);
+  expect(revalidated.headers()["cache-control"]).toBe("public, max-age=31536000, immutable");
 
   const replacement = await admin.post("/api/account/profile-image", {
     multipart: { file: { name: "replacement.png", mimeType: "image/png", buffer: PNG } },

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -3,6 +3,11 @@ import { ADMIN } from "../helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
+const IMMUTABLE = "public, max-age=31536000, immutable";
+const ICON = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=",
+  "base64",
+);
 
 // Fresh admin context so these never rotate the seeded admin session.
 async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
@@ -54,3 +59,70 @@ test("theme settings: invalid values are rejected (no CSS injection)", async ({
     expect((await admin.put("/api/site/settings", { data })).status(), JSON.stringify(data)).toBe(400);
   }
 });
+
+test("site settings: one response shape and immediate reads after each write", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
+  expect(Object.keys(before)).toEqual([
+    "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
+    "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
+    "hasFavicon", "faviconVersion",
+  ]);
+  expect(typeof before.hasFavicon).toBe("boolean");
+  expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
+
+  try {
+    // The second write lands while the first read is still cached; it must not be hidden.
+    for (const footerText of ["first footer", "second footer"]) {
+      expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
+      expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
+    }
+  } finally {
+    const footerText = typeof before.footerText === "string" ? before.footerText : "";
+    await admin.put("/api/site/settings", { data: { footerText } });
+    await anon.dispose();
+    await admin.dispose();
+  }
+});
+
+test("site favicon: the versioned URL is cached for good and other URLs revalidate", async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  try {
+    const upload = await admin.post("/api/site/favicon", {
+      multipart: { file: { name: "favicon.png", mimeType: "image/png", buffer: ICON } },
+    });
+    expect(upload.status()).toBe(201);
+    const { version } = await upload.json() as { version: string };
+    expect((await (await anon.get("/api/site/settings")).json()).faviconVersion).toBe(version);
+
+    const current = await anon.get(`/api/site/favicon?v=${encodeURIComponent(version)}`);
+    expect(current.status()).toBe(200);
+    expect(current.headers()["cache-control"]).toBe(IMMUTABLE);
+    expect(current.headers()["content-type"]).toContain("image/png");
+    expect(current.headers()["content-length"]).toBe(String(ICON.byteLength));
+    expect((await current.body()).equals(ICON)).toBe(true);
+    const etag = current.headers()["etag"] ?? "";
+    expect(etag).toMatch(/^"[^"]+"$/);
+
+    for (const path of ["/api/site/favicon?v=stale", "/api/site/favicon"]) {
+      const response = await anon.get(path);
+      expect(response.status(), path).toBe(200);
+      expect(response.headers()["cache-control"], path).toBe("no-cache");
+      expect(response.headers()["etag"], path).toBe(etag);
+    }
+
+    const revalidated = await anon.get("/api/site/favicon?v=stale", { headers: { "if-none-match": etag } });
+    expect(revalidated.status()).toBe(304);
+    expect(revalidated.headers()["cache-control"]).toBe("no-cache");
+    const versioned = await anon.get(`/api/site/favicon?v=${encodeURIComponent(version)}`, {
+      headers: { "if-none-match": etag },
+    });
+    expect(versioned.status()).toBe(304);
+    expect(versioned.headers()["cache-control"]).toBe(IMMUTABLE);
+  } finally {
+    await anon.dispose();
+    await admin.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -63,9 +63,13 @@ test("admin can list and revoke a user's sessions", async ({ playwright, disposa
   expect((await theirs.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).ok()).toBeTruthy();
   await theirs.dispose();
 
-  const listed = await admin.post("/api/auth/admin/list-user-sessions", { data: { userId } });
+  // The admin console lists sessions through the app API, which never returns tokens.
+  const listed = await admin.get(`/api/admin/sessions?userId=${encodeURIComponent(userId)}`);
   expect(listed.ok()).toBeTruthy();
-  expect(((await listed.json())?.sessions ?? []).length).toBeGreaterThan(0);
+  const { items } = (await listed.json()) as { items: Array<Record<string, unknown>> };
+  expect(items.length).toBeGreaterThan(0);
+  expect(items[0]).toMatchObject({ userId, userEmail: email });
+  expect(items[0]).not.toHaveProperty("token");
 
   const revoked = await admin.post("/api/auth/admin/revoke-user-sessions", { data: { userId } });
   expect(revoked.ok()).toBeTruthy();
@@ -74,6 +78,35 @@ test("admin can list and revoke a user's sessions", async ({ playwright, disposa
   await admin.dispose();
 });
 
+test("admin lists users one server page at a time", async ({ playwright, disposableUsers }) => {
+  const admin = await signedIn(playwright, ADMIN);
+  const prefix = `api-page-${Date.now()}`;
+  for (let i = 0; i < 3; i += 1) {
+    await disposableUsers.create({ email: `${prefix}-${i}@example.com`, name: `Page ${i}` });
+  }
+  const pendingId = await disposableUsers.create({ email: `${prefix}-pending@example.com`, name: "Page pending" });
+  expect((await admin.post("/api/auth/admin/update-user", {
+    data: { userId: pendingId, data: { signupApproved: false } },
+  })).ok()).toBeTruthy();
+
+  type UserPage = { users: Array<{ email: string }>; total: number };
+  const list = async (query: Record<string, string>): Promise<UserPage> => {
+    const params = new URLSearchParams({ searchValue: prefix, searchField: "email", searchOperator: "contains", ...query });
+    const response = await admin.get(`/api/auth/admin/list-users?${params.toString()}`);
+    expect(response.ok()).toBeTruthy();
+    return (await response.json()) as UserPage;
+  };
+
+  const first = await list({ limit: "2", offset: "0", sortBy: "email", sortDirection: "asc" });
+  expect(first.total).toBe(4);
+  expect(first.users.map((u) => u.email)).toEqual([`${prefix}-0@example.com`, `${prefix}-1@example.com`]);
+  const second = await list({ limit: "2", offset: "2", sortBy: "email", sortDirection: "asc" });
+  expect(second.users.map((u) => u.email)).toEqual([`${prefix}-2@example.com`, `${prefix}-pending@example.com`]);
+  const pending = await list({ filterField: "signupApproved", filterValue: "false", filterOperator: "eq" });
+  expect(pending.users.map((u) => u.email)).toEqual([`${prefix}-pending@example.com`]);
+  await admin.dispose();
+});
+
 test("revokeOtherSessions keeps the current session valid", async ({ playwright, disposableUsers }) => {
   // Use a throwaway account so we don't revoke the shared USER's ui storageState.
   const admin = await signedIn(playwright, ADMIN);
@@ -111,6 +144,7 @@ test("account capabilities reports optional-feature flags", async ({ playwright
   expect(Array.isArray(caps.providers)).toBe(true);
   expect(typeof caps.deleteAccount).toBe("boolean");
   expect(typeof caps.signupApprovalRequired).toBe("boolean");
+  expect(typeof caps.require2fa).toBe("boolean");
   await ctx.dispose();
 });
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/audit.ui.spec.ts

@@ -14,3 +14,44 @@ test("admin can view audit entries when the module is installed", async ({ page
   // seed sign-ins are audited via the better-auth hook, so an action row is present
   await expect(page.getByText("auth.login").first()).toBeVisible();
 });
+
+test("admin filters the audit log on the server", async ({ page }) => {
+  await ready(page, "/admin/audit");
+  const table = page.getByRole("table", { name: "Audit log" });
+  test.skip((await page.getByRole("link", { name: "Audit log" }).count()) === 0, "audit-log module not installed");
+  await expect(table.getByText("auth.login").first()).toBeVisible();
+
+  await page.locator('button[data-slot="select-trigger"]').first().click(); // Action filter
+  await page.getByRole("option", { name: "auth.login", exact: true }).click();
+  await page.locator("#toolbar-search").fill("admin@example.com");
+  const filtered = page.waitForResponse((response) =>
+    response.url().includes("/api/audit-logs?") &&
+    response.url().includes("action=auth.login") &&
+    response.url().includes("actor=admin%40example.com"),
+  );
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+  expect((await filtered).ok()).toBeTruthy();
+
+  const actions = table.locator("tbody tr td:nth-child(3)");
+  await expect(actions.first()).toHaveText("auth.login");
+  for (const text of await actions.allInnerTexts()) expect(text).toBe("auth.login");
+  await expect(table.getByText("admin@example.com").first()).toBeVisible();
+});
+
+test("admin pages through the audit log", async ({ page }) => {
+  await ready(page, "/admin/audit");
+  const table = page.getByRole("table", { name: "Audit log" });
+  test.skip((await page.getByRole("link", { name: "Audit log" }).count()) === 0, "audit-log module not installed");
+  await expect(table.getByRole("row").nth(1)).toBeVisible();
+  const next = table.getByRole("button", { name: /next/i });
+  test.skip(await next.isDisabled(), "a single page of audit entries");
+
+  const firstPage = await table.locator("tbody tr").first().innerText();
+  const pageTwo = page.waitForResponse((response) =>
+    response.url().includes("/api/audit-logs?") && response.url().includes("cursor="),
+  );
+  await next.click();
+  expect((await pageTwo).ok()).toBeTruthy();
+  await expect(table.locator('[aria-current="page"]')).toHaveText("2");
+  expect(await table.locator("tbody tr").first().innerText()).not.toBe(firstPage);
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/data-table.ui.spec.ts

@@ -1,34 +1,53 @@
-import { expect, test } from "@playwright/test";
+import { expect, test, type Response } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 
-// Sorting via the shared DataTable. Users is server-sorted (manual), audit is
-// client-sorted — both drive the same clickable headers + aria-sort.
+// Sorting via the shared DataTable. Users sorts on the server (manual mode
+// refetches through Better Auth listUsers), and the audit log asks the server
+// for the other time order — both drive the same clickable headers + aria-sort.
 test("users table sorts by a column header (server)", async ({ page }) => {
   await ready(page, "/admin/users");
   const header = page.getByRole("columnheader", { name: /Name/ });
   // Click the sort button *inside* the header — a bare name match collides with
   // the sidebar user button (a "Renamed" account contains "name").
   const sortByName = header.getByRole("button");
-  const firstName = () => page.getByRole("row").nth(1).getByRole("cell").first().innerText();
+  const firstName = (): Promise<string> => page.getByRole("row").nth(1).getByRole("cell").first().innerText();
+  const sortedBy = (direction: string): Promise<Response> => page.waitForResponse((response) => {
+    const url = new URL(response.url());
+    return url.pathname === "/api/auth/admin/list-users" &&
+      url.searchParams.get("sortBy") === "name" &&
+      url.searchParams.get("sortDirection") === direction;
+  });
 
+  const ascending = sortedBy("asc");
   await sortByName.click();
   await expect(header).toHaveAttribute("aria-sort", "ascending");
-  await page.waitForTimeout(400); // server refetch
+  await (await ascending).finished();
+  await page.evaluate(() => new Promise<void>((resolve) => requestAnimationFrame(() => resolve())));
   const asc = await firstName();
 
+  const descending = sortedBy("desc");
   await sortByName.click();
   await expect(header).toHaveAttribute("aria-sort", "descending");
-  await page.waitForTimeout(400);
-  const desc = await firstName();
-
-  expect(asc).not.toBe(desc); // order flipped
+  await (await descending).finished();
+  // order flipped
+  await expect(page.getByRole("row").nth(1).getByRole("cell").first()).not.toHaveText(asc);
 });
 
-test("audit table sorts client-side", async ({ page }) => {
+test("audit table sorts by time on the server", async ({ page }) => {
   await ready(page, "/admin/audit");
-  test.skip((await page.getByRole("row").count()) < 3, "not enough audit entries");
-  await page.getByRole("button", { name: "When" }).click(); // default desc -> asc
-  await expect(page.getByRole("columnheader", { name: /When/ })).toHaveAttribute("aria-sort", "ascending");
+  const table = page.getByRole("table", { name: "Audit log" });
+  await expect(table.getByRole("row").nth(1)).toBeVisible();
+  test.skip((await table.getByRole("row").count()) < 4, "not enough audit entries");
+  const ascending = page.waitForResponse((response) =>
+    response.url().includes("/api/audit-logs?") && response.url().includes("order=asc"),
+  );
+  await table.getByRole("button", { name: "When" }).click(); // default desc -> asc
+  await expect(table.getByRole("columnheader", { name: /When/ })).toHaveAttribute("aria-sort", "ascending");
+  const entries = (await (await ascending).json()) as Array<{ createdAt: string }>;
+  const times = entries.map((entry) => Date.parse(entry.createdAt));
+  expect(times).toEqual([...times].sort((left, right) => left - right));
+  // Only time can be sorted: the other headers are plain labels.
+  await expect(table.getByRole("columnheader", { name: "Action" }).getByRole("button")).toHaveCount(0);
 });
 
 test("users table keeps responsive headers and cells aligned", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -3,8 +3,8 @@ import { createHash, randomBytes } from "node:crypto";
 
 // admin storageState (project default) — the admin is the resource owner.
 const b64url = (b: Buffer): string => b.toString("base64url");
-// This front-channel test stops at consent, so use the HTTPS callback required
-// for a web client without depending on a live relying-party callback server.
+// The test intercepts the callback, so an HTTPS URL that a web client requires can
+// be used without a live relying-party server.
 const REDIRECT = "https://example.com/callback";
 
 // Verifies the provider is correctly configured end to end on the front channel:
@@ -61,9 +61,18 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
     expect(consentUrl).toContain("/oauth2/consent");
     expect(consentUrl).toContain("client_id=");
 
-    // The consent page renders (reached in a real browser navigation).
+    // The consent page renders (reached in a real browser navigation), and allowing
+    // it sends the browser back to the client with an authorization code.
+    await page.route(`${REDIRECT}**`, (route) => route.fulfill({ status: 200, body: "callback" }));
     await page.goto(consentUrl);
-    await expect(page.getByRole("button", { name: "Allow" })).toBeVisible();
+    const allow = page.getByRole("button", { name: "Allow" });
+    await expect(allow).toBeVisible();
+    const callback = page.waitForURL((url) => url.href.startsWith(REDIRECT));
+    await allow.click();
+    await callback;
+    const returned = new URL(page.url());
+    expect(returned.searchParams.get("code")).toBeTruthy();
+    expect(returned.searchParams.get("state")).toBe("st");
   } finally {
     const disabled = await page.request.put("/api/account/settings", {
       data: { oidcProvider: false },

package/dist/templates/modules/admin-dashboard/files/tests/ui/request-budget.ui.spec.ts

@@ -0,0 +1,46 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
+// admin storageState (project default)
+test.beforeEach(async ({ page }) => {
+  await page.context().addCookies([{ name: "locale", value: "en", url: base }]);
+});
+
+test("the first render does not embed the message catalogs", async ({ page }) => {
+  const response = await page.request.get("/admin");
+  expect(response.ok()).toBeTruthy();
+  const html = await response.text();
+  expect(html).toContain("Dashboard");
+  // A catalog key name only appears in serialized catalog data, never in markup.
+  expect(html).not.toContain("namePlaceholder");
+});
+
+test("client navigation keeps the server checks without resending messages", async ({ page }) => {
+  await ready(page, "/admin");
+  await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
+
+  const bodies: Promise<string>[] = [];
+  page.on("response", (response) => {
+    if (new URL(response.url()).pathname.endsWith("/__data.json")) bodies.push(response.text());
+  });
+  const sidebar = page.locator('[data-sidebar="sidebar"]');
+  const stops: Array<[link: string, heading: string]> = [
+    ["Users", "Users"],
+    ["Sessions", "User sessions"],
+    ["Settings", "Settings"],
+    ["Overview", "Dashboard"],
+  ];
+  for (const [link, heading] of stops) {
+    await sidebar.getByRole("link", { name: link, exact: true }).click();
+    await expect(page.getByRole("heading", { name: heading, exact: true })).toBeVisible();
+  }
+
+  expect(bodies.length).toBeGreaterThanOrEqual(stops.length);
+  for (const body of await Promise.all(bodies)) {
+    expect(body).not.toContain('"messages"');
+    expect(body.length).toBeLessThan(20_000);
+  }
+  await expect(sidebar.getByRole("link", { name: "Back to home" })).toBeVisible();
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/sessions.ui.spec.ts

@@ -1,22 +1,85 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ready } from "../helpers/hydration";
 
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
+function isSessionList(url: string): boolean {
+  return new URL(url).pathname === "/api/admin/sessions";
+}
+
 // admin storageState (project default) — sessions is an admin-only view
 test("sessions table shows the expires column", async ({ page }) => {
   await ready(page, "/admin/sessions");
   await expect(page.getByRole("columnheader", { name: "Expires" })).toBeVisible();
 });
 
+test("sessions page loads one server page without per-user requests or tokens", async ({ page }) => {
+  const requested: string[] = [];
+  page.on("request", (request) => requested.push(request.url()));
+  const listed = page.waitForResponse((response) => isSessionList(response.url()));
+  await ready(page, "/admin/sessions");
+  const response = await listed;
+
+  expect(response.status()).toBe(200);
+  const body = (await response.json()) as { items: Array<Record<string, unknown>>; total: number };
+  expect(body.items.length).toBeLessThanOrEqual(15);
+  for (const item of body.items) expect(item).not.toHaveProperty("token");
+  await expect(page.getByRole("table", { name: "User sessions" }).getByRole("row").nth(1)).toBeVisible();
+  expect(requested.filter(isSessionList)).toHaveLength(1);
+  expect(requested.filter((url) => url.includes("/api/auth/admin/list-user-sessions"))).toEqual([]);
+  expect(requested.filter((url) => url.includes("/api/auth/admin/list-users"))).toEqual([]);
+});
+
 test("admin sees user sessions across users", async ({ page }) => {
   await ready(page, "/admin/sessions");
   await expect(page.getByRole("heading", { name: "User sessions" })).toBeVisible();
   // Search by exact address — robust to pagination as sessions accumulate (the
   // admin account alone can fill the first page). This is the across-users view.
+  const searched = page.waitForResponse(
+    (response) => isSessionList(response.url()) && new URL(response.url()).searchParams.get("search") === "user@example.com",
+  );
   await page.locator("#toolbar-search").fill("user@example.com");
   await page.getByRole("button", { name: "Search", exact: true }).click();
+  expect((await searched).ok()).toBeTruthy();
   await expect(page.getByRole("main").getByText("user@example.com").first()).toBeVisible();
   // row actions are available
   await page.getByRole("row", { name: /user@example.com/ }).first().getByRole("button").click();
   await expect(page.getByRole("menuitem", { name: "Revoke session" })).toBeVisible();
   await expect(page.getByRole("menuitem", { name: "Revoke all for user" })).toBeVisible();
 });
+
+test("admin revokes a session by id and only the current page reloads", async ({
+  page,
+  playwright,
+  disposableUsers,
+}) => {
+  const email = `ui-sess-revoke-${Date.now()}@example.com`;
+  await disposableUsers.create({ email, name: "Session Revoke" });
+  // Sign the user in on an isolated context so the shared admin cookie is untouched.
+  const theirs = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: { origin: base } });
+  expect((await theirs.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).ok())
+    .toBeTruthy();
+
+  await ready(page, "/admin/sessions");
+  await page.locator("#toolbar-search").fill(email);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+  const row = page.getByRole("row", { name: new RegExp(email) });
+  await expect(row).toHaveCount(1);
+
+  const revoked = page.waitForResponse(
+    (response) => response.request().method() === "DELETE" &&
+      new URL(response.url()).pathname.startsWith("/api/admin/sessions/"),
+  );
+  const reloaded = page.waitForResponse(
+    (response) => isSessionList(response.url()) && new URL(response.url()).searchParams.get("search") === email,
+  );
+  await row.getByRole("button").click();
+  await page.getByRole("menuitem", { name: "Revoke session" }).click();
+  expect((await revoked).status()).toBe(204);
+  const reload = await reloaded;
+  expect(new URL(reload.url()).searchParams.get("cursor")).toBeNull();
+  await expect(page.getByText("Session revoked")).toBeVisible();
+  await expect(row).toHaveCount(0);
+  expect(await (await theirs.get("/api/auth/get-session")).json()).toBeNull();
+  await theirs.dispose();
+});