@podosoft/podokit 1.4.0 → 1.4.2

package/dist/templates/fullstack/infra/k3s/web-deployment.yaml

@@ -21,10 +21,13 @@ spec:
           envFrom:
             - configMapRef: { name: app-config }
           # Without these a rolling update sends traffic to a process that has not
-          # bound its port yet.
+          # bound its port yet. /healthz never calls the API, so an API outage does
+          # not take the web pods out of service.
           readinessProbe:
-            httpGet: { path: /, port: 3000 }
+            httpGet: { path: /healthz, port: 3000 }
             initialDelaySeconds: 5
+            timeoutSeconds: 2
           livenessProbe:
-            httpGet: { path: /, port: 3000 }
+            httpGet: { path: /healthz, port: 3000 }
             initialDelaySeconds: 15
+            timeoutSeconds: 2

package/dist/templates/fullstack/tests/api/health.api.spec.ts

@@ -12,3 +12,11 @@ test("GET /health/ready reports the database", async ({ request }) => {
   expect(res.status()).toBe(200);
   expect((await res.json()).status).toBe("ready");
 });
+
+test("GET /healthz answers from the web server without caching or indexing @smoke", async ({ request }) => {
+  const res = await request.get("/healthz");
+  expect(res.status()).toBe(200);
+  expect(await res.text()).toBe("ok\n");
+  expect(res.headers()["cache-control"]).toBe("no-store");
+  expect(res.headers()["x-robots-tag"]).toBe("noindex, nofollow");
+});

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin-sessions/admin-sessions.migration.spec.ts

@@ -4,11 +4,16 @@ import type { QueryRunner } from "typeorm";
 import { revertLatestSqliteMigration, runSqliteMigrations } from "../database/sqlite-migrator";
 import { IndexSessionCreatedAt1792060000000 } from "../migrations/1792060000000-IndexSessionCreatedAt";
 
-function runner(type: "postgres" | "better-sqlite3", queries: string[], invalid = false): QueryRunner {
+function runner(
+  type: "postgres" | "better-sqlite3",
+  queries: string[],
+  { invalid = false, session = true }: { invalid?: boolean; session?: boolean } = {},
+): QueryRunner {
   return {
     connection: { options: { type } },
     query: (sql: string): Promise<unknown[]> => {
       queries.push(sql);
+      if (sql.includes("IS NOT NULL")) return Promise.resolve([{ exists: session }]);
       return Promise.resolve(invalid && sql.includes("indisvalid") ? [{ invalid: 1 }] : []);
     },
   } as unknown as QueryRunner;
@@ -25,6 +30,7 @@ function rows<Row>(database: Database, sql: string): Row[] {
 }
 
 const CREATE = 'CREATE INDEX CONCURRENTLY IF NOT EXISTS "IDX_session_createdAt_id" ON "session" ("createdAt", "id")';
+const SESSION_EXISTS = 'SELECT to_regclass($1) IS NOT NULL AS "exists"';
 
 describe("admin session list index migration", () => {
   it("builds the PostgreSQL index concurrently outside a transaction", async () => {
@@ -33,6 +39,7 @@ describe("admin session list index migration", () => {
     const up: string[] = [];
     await migration.up(runner("postgres", up));
     expect(up).toEqual([
+      SESSION_EXISTS,
       "SELECT 1 AS \"invalid\" FROM pg_index WHERE indexrelid = to_regclass($1) AND NOT indisvalid",
       CREATE,
     ]);
@@ -44,8 +51,30 @@ describe("admin session list index migration", () => {
 
   it("rebuilds an invalid index left by an interrupted build", async () => {
     const up: string[] = [];
-    await new IndexSessionCreatedAt1792060000000().up(runner("postgres", up, true));
-    expect(up.slice(1)).toEqual(['DROP INDEX CONCURRENTLY IF EXISTS "IDX_session_createdAt_id"', CREATE]);
+    await new IndexSessionCreatedAt1792060000000().up(runner("postgres", up, { invalid: true }));
+    expect(up.slice(2)).toEqual(['DROP INDEX CONCURRENTLY IF EXISTS "IDX_session_createdAt_id"', CREATE]);
+  });
+
+  // `migration:run` runs only the application migrations, so on a new database
+  // Better Auth has not created its tables yet.
+  it("fails with the command that creates the Better Auth tables on PostgreSQL", async () => {
+    const up: string[] = [];
+    await expect(new IndexSessionCreatedAt1792060000000().up(runner("postgres", up, { session: false })))
+      .rejects.toThrow('Better Auth has not created the "session" table yet. Run "bun run --cwd apps/api migrate:all"');
+    expect(up).toEqual([SESSION_EXISTS]);
+  });
+
+  it("fails with the command that creates the Better Auth tables on SQLite and records nothing", async () => {
+    const database = new Database(":memory:");
+    try {
+      const migrations = [{ timestamp: 1792060000000, migration: new IndexSessionCreatedAt1792060000000() }];
+      await expect(runSqliteMigrations(database, migrations)).rejects.toThrow(
+        'Better Auth has not created the "session" table yet. Run "bun run --cwd apps/api migrate:all"',
+      );
+      expect(rows(database, 'SELECT "name" FROM "migrations"')).toEqual([]);
+    } finally {
+      database.close();
+    }
   });
 
   it("serves the newest-first session page on SQLite and reverts", async () => {

package/dist/templates/modules/admin-dashboard/files/apps/api/src/migrations/1792060000000-IndexSessionCreatedAt.ts

@@ -5,6 +5,12 @@ import type { MigrationInterface, QueryRunner } from "typeorm";
 // so without this index every page sorts the whole session table.
 const INDEX = "IDX_session_createdAt_id";
 
+// Better Auth creates "session" in its own schema step. `migrate:all` runs that
+// step before the application migrations; `migration:run` does not.
+const MISSING_SESSION_TABLE =
+  'Better Auth has not created the "session" table yet. Run "bun run --cwd apps/api migrate:all", ' +
+  "which applies the Better Auth schema before the application migrations.";
+
 export class IndexSessionCreatedAt1792060000000 implements MigrationInterface {
   name = "IndexSessionCreatedAt1792060000000";
   // CONCURRENTLY cannot run inside a transaction block. The runner therefore
@@ -13,9 +19,21 @@ export class IndexSessionCreatedAt1792060000000 implements MigrationInterface {
 
   async up(queryRunner: QueryRunner): Promise<void> {
     if (queryRunner.connection.options.type !== "postgres") {
-      await queryRunner.query(`CREATE INDEX IF NOT EXISTS "${INDEX}" ON "session" ("createdAt", "id")`);
+      try {
+        await queryRunner.query(`CREATE INDEX IF NOT EXISTS "${INDEX}" ON "session" ("createdAt", "id")`);
+      } catch (error) {
+        if (error instanceof Error && /no such table: (?:main\.)?session$/.test(error.message)) {
+          throw new Error(MISSING_SESSION_TABLE, { cause: error });
+        }
+        throw error;
+      }
       return;
     }
+    const [session] = await queryRunner.query(
+      `SELECT to_regclass($1) IS NOT NULL AS "exists"`,
+      [`"session"`],
+    ) as Array<{ exists: boolean } | undefined>;
+    if (!session?.exists) throw new Error(MISSING_SESSION_TABLE);
     // Sign-ins keep writing sessions while the index builds. An interrupted
     // build leaves an invalid index that IF NOT EXISTS would keep.
     const invalid = await queryRunner.query(

package/dist/templates/modules/admin-dashboard/files/apps/web/src/hooks.server.test.ts

@@ -1,6 +1,7 @@
 import { ApiError } from "@podosoft/podokit-api-client";
 import type { RequestEvent } from "@sveltejs/kit";
 import { beforeEach, describe, expect, it, vi } from "vitest";
+import { BackendUnavailableError } from "#lib/server/api.js";
 import { handle } from "./hooks.server";
 
 type SessionResult = {
@@ -13,7 +14,8 @@ const client = vi.hoisted(() => ({
   getSession: vi.fn<() => Promise<SessionResult>>(),
 }));
 
-vi.mock("#lib/server/api.js", () => ({
+vi.mock("#lib/server/api.js", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("#lib/server/api.js")>()),
   serverApiClient: () => ({ get: client.get, auth: { getSession: client.getSession } }),
 }));
 
@@ -98,6 +100,16 @@ describe("handle", () => {
     });
   });
 
+  it("treats an API known to be unreachable as an outage", async () => {
+    client.get.mockRejectedValue(new BackendUnavailableError());
+    client.getSession.mockRejectedValue(new BackendUnavailableError());
+
+    await expect(handle({ event: requestEvent("/account"), resolve })).rejects.toMatchObject({ status: 503 });
+    const event = requestEvent("/");
+    await handle({ event, resolve });
+    expect(event.locals).toMatchObject({ site: null, siteUnavailable: true, authUnavailable: true, user: null });
+  });
+
   it("confirms an anonymous visitor on a 401 session response", async () => {
     client.get.mockResolvedValue({ locale: null });
     client.getSession.mockResolvedValue({ data: null, error: { status: 401 } });
@@ -121,4 +133,15 @@ describe("handle", () => {
     expect(client.get).not.toHaveBeenCalled();
     expect(client.getSession).not.toHaveBeenCalled();
   });
+
+  it("answers the health route without runtime lookups", async () => {
+    client.get.mockRejectedValue(new BackendUnavailableError());
+    client.getSession.mockRejectedValue(new BackendUnavailableError());
+
+    await handle({ event: requestEvent("/healthz"), resolve });
+
+    expect(client.get).not.toHaveBeenCalled();
+    expect(client.getSession).not.toHaveBeenCalled();
+    expect(resolve).toHaveBeenCalledTimes(1);
+  });
 });

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/runtime-context.test.ts

@@ -61,6 +61,12 @@ describe("needsRuntimeContext", () => {
     expect(needsRuntimeContext(request("/apiary", { headers: { accept: NAVIGATION } }))).toBe(true);
   });
 
+  it("skips them for the web server's health route, which must answer while the API is down", () => {
+    expect(needsRuntimeContext(request("/healthz", { headers: { accept: "*/*" } }))).toBe(false);
+    expect(needsRuntimeContext(request("/healthz", { headers: { accept: NAVIGATION } }))).toBe(false);
+    expect(needsRuntimeContext(request("/healthz/extra", { routeId: null, headers: { accept: NAVIGATION } }))).toBe(true);
+  });
+
   it("skips them while prerendering", () => {
     expect(needsRuntimeContext(request("/pricing", { headers: { accept: NAVIGATION } }), { building: true })).toBe(false);
   });

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/runtime-context.ts

@@ -1,5 +1,8 @@
 import { APP_ASSET_PATHS } from "./asset-paths";
 
+/** The web server's own health route (`routes/healthz/+server.ts`), which never calls the API. */
+const WEB_HEALTH_PATH = "/healthz";
+
 /** The request fields that decide whether a response can use the session and site settings. */
 export interface RuntimeContextRequest {
   url: URL;
@@ -92,6 +95,8 @@ export function needsRuntimeContext(
   const { pathname } = event.url;
   // The backend proxy forwards the cookies; the API resolves the session itself.
   if (underPrefix(pathname, "/api")) return false;
+  // The web server's health route answers the probes even while the API is down.
+  if (pathname === WEB_HEALTH_PATH) return false;
   // Remote functions run application code that may read the session.
   if (event.isRemoteRequest) return true;
   if (event.route.id === null) {

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -4,6 +4,7 @@ import {
   isUserCreationAllowed,
 } from "../../apps/api/src/auth/feature-gate";
 import { ADMIN } from "../helpers/accounts";
+import { exclusive } from "../helpers/exclusive";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -17,62 +18,68 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
 }
 
 test("admin can enable Google OAuth from the DB and it applies without a restart", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const social = () => anon.post("/api/auth/sign-in/social", { data: { provider: "google", callbackURL: `${base}/admin` } });
-
-  // Before: provider not configured.
-  await expect.poll(async () => (await social()).status(), { timeout: 8000 }).toBe(404);
-
-  // Paste credentials via the admin API.
-  const put = await admin.put("/api/account/auth-config", {
-    data: { social: { google: { enabled: true, clientId: "dummy-google-client-id", clientSecret: "dummy-google-client-secret" } } },
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const admin = await adminCtx(playwright);
+    await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const social = () => anon.post("/api/auth/sign-in/social", { data: { provider: "google", callbackURL: `${base}/admin` } });
+
+    // Before: provider not configured.
+    await expect.poll(async () => (await social()).status(), { timeout: 8000 }).toBe(404);
+
+    // Paste credentials via the admin API.
+    const put = await admin.put("/api/account/auth-config", {
+      data: { social: { google: { enabled: true, clientId: "dummy-google-client-id", clientSecret: "dummy-google-client-secret" } } },
+    });
+    expect(put.ok()).toBeTruthy();
+    const view = await put.json();
+    expect(view.social.google.enabled).toBe(true);
+    expect(view.social.google.hasSecret).toBe(true);
+    expect(view.social.google.clientId).toBe("dummy-google-client-id");
+    expect("clientSecret" in view.social.google).toBe(false); // secret is never returned
+
+    // Applied live (no restart): social sign-in now redirects to Google.
+    await expect
+      .poll(async () => {
+        const r = await social();
+        return r.ok() ? (((await r.json())?.url as string) ?? "") : "";
+      }, { timeout: 8000 })
+      .toContain("accounts.google.com");
+    const caps = await (await anon.get("/api/account/capabilities")).json();
+    expect(caps.providers).toContain("google");
+
+    await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // restore
+    await anon.dispose();
+    await admin.dispose();
   });
-  expect(put.ok()).toBeTruthy();
-  const view = await put.json();
-  expect(view.social.google.enabled).toBe(true);
-  expect(view.social.google.hasSecret).toBe(true);
-  expect(view.social.google.clientId).toBe("dummy-google-client-id");
-  expect("clientSecret" in view.social.google).toBe(false); // secret is never returned
-
-  // Applied live (no restart): social sign-in now redirects to Google.
-  await expect
-    .poll(async () => {
-      const r = await social();
-      return r.ok() ? (((await r.json())?.url as string) ?? "") : "";
-    }, { timeout: 8000 })
-    .toContain("accounts.google.com");
-  const caps = await (await anon.get("/api/account/capabilities")).json();
-  expect(caps.providers).toContain("google");
-
-  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // restore
-  await anon.dispose();
-  await admin.dispose();
 });
 
 test("admin can add and remove a social provider dynamically", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  // The catalog offers providers beyond the two legacy env-backed ones.
-  const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
-  expect(catalog.map((c) => c.id)).toEqual(expect.arrayContaining(["google", "github", "apple"]));
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const admin = await adminCtx(playwright);
+    // The catalog offers providers beyond the two legacy env-backed ones.
+    const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
+    expect(catalog.map((c) => c.id)).toEqual(expect.arrayContaining(["google", "github", "apple"]));
+
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const github = () => anon.post("/api/auth/sign-in/social", { data: { provider: "github", callbackURL: `${base}/admin` } });
+
+    // Add GitHub (a provider with no env fallback) → applies live, no restart.
+    await admin.put("/api/account/auth-config", { data: { social: { github: { enabled: true, clientId: "dummy-github-client-id", clientSecret: "dummy-github-client-secret" } } } });
+    await expect
+      .poll(async () => { const r = await github(); return r.ok() ? (((await r.json())?.url as string) ?? "") : ""; }, { timeout: 8000 })
+      .toContain("github.com");
+
+    // Remove it → the row is deleted and the provider stops working (again live).
+    await admin.put("/api/account/auth-config", { data: { social: { github: { delete: true } } } });
+    expect("github" in (await (await admin.get("/api/account/auth-config")).json()).social).toBe(false);
+    await expect.poll(async () => (await github()).status(), { timeout: 8000 }).toBe(404);
 
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const github = () => anon.post("/api/auth/sign-in/social", { data: { provider: "github", callbackURL: `${base}/admin` } });
-
-  // Add GitHub (a provider with no env fallback) → applies live, no restart.
-  await admin.put("/api/account/auth-config", { data: { social: { github: { enabled: true, clientId: "dummy-github-client-id", clientSecret: "dummy-github-client-secret" } } } });
-  await expect
-    .poll(async () => { const r = await github(); return r.ok() ? (((await r.json())?.url as string) ?? "") : ""; }, { timeout: 8000 })
-    .toContain("github.com");
-
-  // Remove it → the row is deleted and the provider stops working (again live).
-  await admin.put("/api/account/auth-config", { data: { social: { github: { delete: true } } } });
-  expect("github" in (await (await admin.get("/api/account/auth-config")).json()).social).toBe(false);
-  await expect.poll(async () => (await github()).status(), { timeout: 8000 }).toBe(404);
-
-  await anon.dispose();
-  await admin.dispose();
+    await anon.dispose();
+    await admin.dispose();
+  });
 });
 
 test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwright }) => {
@@ -85,43 +92,46 @@ test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwr
 });
 
 test("automatic logout validates and applies a sliding session lifetime", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const freshAdmin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-
-  try {
-    expect(
-      (await admin.put("/api/account/auth-config", {
-        data: { server: { sessionIdleTimeoutMinutes: 4 } },
-      })).status(),
-    ).toBe(400);
-
-    const enabled = await admin.put("/api/account/auth-config", {
-      data: { server: { sessionIdleTimeoutMinutes: 30 } },
-    });
-    expect(enabled.ok()).toBeTruthy();
-    expect((await enabled.json()).server.sessionIdleTimeoutMinutes).toBe(30);
-
-    const caps = await (await admin.get("/api/account/capabilities")).json();
-    expect(caps.sessionIdleTimeoutMinutes).toBe(30);
-
-    const signIn = await freshAdmin.post("/api/auth/sign-in/email", {
-      data: { email: ADMIN.email, password: ADMIN.password },
-    });
-    expect(signIn.ok()).toBeTruthy();
-    expect(signIn.headers()["set-cookie"]).toMatch(/Max-Age=1800(?:;|,)/i);
-
-    const sessions = (await (await admin.get("/api/auth/list-sessions")).json()) as Array<{
-      expiresAt: string;
-    }>;
-    const latestExpiry = Math.max(...sessions.map((session) => new Date(session.expiresAt).getTime()));
-    expect(latestExpiry).toBeLessThanOrEqual(Date.now() + 30 * 60_000 + 10_000);
-  } finally {
-    await admin.put("/api/account/auth-config", {
-      data: { server: { sessionIdleTimeoutMinutes: null } },
-    });
-    await freshAdmin.dispose();
-    await admin.dispose();
-  }
+  test.slow();
+  await exclusive("session-idle-timeout", async () => {
+    const admin = await adminCtx(playwright);
+    const freshAdmin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+
+    try {
+      expect(
+        (await admin.put("/api/account/auth-config", {
+          data: { server: { sessionIdleTimeoutMinutes: 4 } },
+        })).status(),
+      ).toBe(400);
+
+      const enabled = await admin.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: 30 } },
+      });
+      expect(enabled.ok()).toBeTruthy();
+      expect((await enabled.json()).server.sessionIdleTimeoutMinutes).toBe(30);
+
+      const caps = await (await admin.get("/api/account/capabilities")).json();
+      expect(caps.sessionIdleTimeoutMinutes).toBe(30);
+
+      const signIn = await freshAdmin.post("/api/auth/sign-in/email", {
+        data: { email: ADMIN.email, password: ADMIN.password },
+      });
+      expect(signIn.ok()).toBeTruthy();
+      expect(signIn.headers()["set-cookie"]).toMatch(/Max-Age=1800(?:;|,)/i);
+
+      const sessions = (await (await admin.get("/api/auth/list-sessions")).json()) as Array<{
+        expiresAt: string;
+      }>;
+      const latestExpiry = Math.max(...sessions.map((session) => new Date(session.expiresAt).getTime()));
+      expect(latestExpiry).toBeLessThanOrEqual(Date.now() + 30 * 60_000 + 10_000);
+    } finally {
+      await admin.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: null } },
+      });
+      await freshAdmin.dispose();
+      await admin.dispose();
+    }
+  });
 });
 
 test("new registrations require approval when the policy is enabled", async ({ playwright }) => {
@@ -204,75 +214,78 @@ test("new registrations require approval when the policy is enabled", async ({ p
 });
 
 test("closed public sign-up blocks new OAuth users but preserves existing sign-in", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const password = "Podokit3e-Str0ng!pw";
-  const adminCreatedEmail = `closed-admin-${Date.now()}@example.com`;
-  const initialSite = (await (await anon.get("/api/site/settings")).json()) as {
-    allowSignup?: string | null;
-  };
-  const initialAllowSignup = initialSite.allowSignup === "false" ? "false" : "true";
-  let adminCreatedId = "";
-
-  try {
-    expect(
-      (await admin.put("/api/account/auth-config", {
-        data: {
-          social: {
-            google: {
-              enabled: true,
-              clientId: "dummy-google-client-id",
-              clientSecret: "dummy-google-client-secret",
+  test.slow();
+  await exclusive(["site-general", "social-providers"], async () => {
+    const admin = await adminCtx(playwright);
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const password = "Podokit3e-Str0ng!pw";
+    const adminCreatedEmail = `closed-admin-${Date.now()}@example.com`;
+    const initialSite = (await (await anon.get("/api/site/settings")).json()) as {
+      allowSignup?: string | null;
+    };
+    const initialAllowSignup = initialSite.allowSignup === "false" ? "false" : "true";
+    let adminCreatedId = "";
+
+    try {
+      expect(
+        (await admin.put("/api/account/auth-config", {
+          data: {
+            social: {
+              google: {
+                enabled: true,
+                clientId: "dummy-google-client-id",
+                clientSecret: "dummy-google-client-secret",
+              },
             },
           },
-        },
-      })).ok(),
-    ).toBeTruthy();
-    expect((await admin.put("/api/site/settings", { data: { allowSignup: "false" } })).ok()).toBeTruthy();
+        })).ok(),
+      ).toBeTruthy();
+      expect((await admin.put("/api/site/settings", { data: { allowSignup: "false" } })).ok()).toBeTruthy();
 
-    // The site policy uses a short cache shared by sign-up requests and user
-    // creation hooks, so wait for the setting to become live.
-    await new Promise((resolve) => setTimeout(resolve, 3_200));
-
-    const signup = await anon.post("/api/auth/sign-up/email", {
-      data: {
-        email: `closed-${Date.now()}@example.com`,
-        password,
-        name: "Closed Registration",
-      },
-    });
-    expect(signup.status()).toBe(403);
-    expect((await signup.json()).code).toBe(PUBLIC_SIGNUP_DISABLED);
+      // The site policy uses a short cache shared by sign-up requests and user
+      // creation hooks, so wait for the setting to become live.
+      await new Promise((resolve) => setTimeout(resolve, 3_200));
 
-    // OAuth initiation must stay available for existing social users. Only a
-    // callback that attempts to create a new user is rejected by the DB hook.
-    const social = await anon.post("/api/auth/sign-in/social", {
-      data: { provider: "google", callbackURL: `${base}/` },
-    });
-    expect(social.ok()).toBeTruthy();
-    expect(((await social.json()).url as string)).toContain("accounts.google.com");
-    expect(isUserCreationAllowed(false, "/callback/google")).toBe(false);
-    expect(isUserCreationAllowed(false, undefined)).toBe(false);
-
-    // Deliberate administrator provisioning remains available while the public
-    // site is closed.
-    expect(isUserCreationAllowed(false, "/admin/create-user")).toBe(true);
-    const adminCreated = await admin.post("/api/auth/admin/create-user", {
-      data: { email: adminCreatedEmail, password, name: "Admin Created", role: "user" },
-    });
-    expect(adminCreated.ok()).toBeTruthy();
-    adminCreatedId = ((await adminCreated.json()).user as { id: string }).id;
-  } finally {
-    if (adminCreatedId) {
-      await admin.post("/api/auth/admin/remove-user", { data: { userId: adminCreatedId } });
+      const signup = await anon.post("/api/auth/sign-up/email", {
+        data: {
+          email: `closed-${Date.now()}@example.com`,
+          password,
+          name: "Closed Registration",
+        },
+      });
+      expect(signup.status()).toBe(403);
+      expect((await signup.json()).code).toBe(PUBLIC_SIGNUP_DISABLED);
+
+      // OAuth initiation must stay available for existing social users. Only a
+      // callback that attempts to create a new user is rejected by the DB hook.
+      const social = await anon.post("/api/auth/sign-in/social", {
+        data: { provider: "google", callbackURL: `${base}/` },
+      });
+      expect(social.ok()).toBeTruthy();
+      expect(((await social.json()).url as string)).toContain("accounts.google.com");
+      expect(isUserCreationAllowed(false, "/callback/google")).toBe(false);
+      expect(isUserCreationAllowed(false, undefined)).toBe(false);
+
+      // Deliberate administrator provisioning remains available while the public
+      // site is closed.
+      expect(isUserCreationAllowed(false, "/admin/create-user")).toBe(true);
+      const adminCreated = await admin.post("/api/auth/admin/create-user", {
+        data: { email: adminCreatedEmail, password, name: "Admin Created", role: "user" },
+      });
+      expect(adminCreated.ok()).toBeTruthy();
+      adminCreatedId = ((await adminCreated.json()).user as { id: string }).id;
+    } finally {
+      if (adminCreatedId) {
+        await admin.post("/api/auth/admin/remove-user", { data: { userId: adminCreatedId } });
+      }
+      await admin.put("/api/site/settings", { data: { allowSignup: initialAllowSignup } });
+      await admin.put("/api/account/auth-config", {
+        data: { social: { google: { enabled: false } } },
+      });
+      await new Promise((resolve) => setTimeout(resolve, 3_200));
+      await anon.get("/api/auth/get-session");
+      await anon.dispose();
+      await admin.dispose();
     }
-    await admin.put("/api/site/settings", { data: { allowSignup: initialAllowSignup } });
-    await admin.put("/api/account/auth-config", {
-      data: { social: { google: { enabled: false } } },
-    });
-    await new Promise((resolve) => setTimeout(resolve, 3_200));
-    await anon.get("/api/auth/get-session");
-    await anon.dispose();
-    await admin.dispose();
-  }
+  });
 });