@podosoft/podokit 1.4.0 → 1.4.2

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { createPublicKey, verify, type JsonWebKey } from "node:crypto";
 import { ADMIN, USER } from "../helpers/accounts";
+import { exclusive } from "../helpers/exclusive";
 import { clearSms, smsSinkReachable, waitForSmsOtp } from "../helpers/sms";
 import { totpCode } from "../helpers/totp";
 
@@ -144,46 +145,49 @@ test("two-factor: regenerating backup codes invalidates the old set", async ({ p
 });
 
 test("require-2fa: gates an un-enrolled user until they enrol", async ({ playwright }) => {
-  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const caps = await (await admin.get("/api/account/capabilities")).json();
-  test.skip(!caps?.twoFactor, "two-factor not enabled");
-  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
-
-  const user = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const email = `rq-${Date.now()}@example.com`;
-  const pw = "Podokit3e-Str0ng!pw";
-  await user.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RQ" } });
-
-  try {
-    // Turn the policy on (admin; the toggle endpoint is allow-listed by the guard).
-    await admin.put("/api/account/settings", { data: { require2fa: true } });
-    // Capabilities carry the same policy as the dedicated endpoint.
-    await expect(async () => {
-      expect((await (await admin.get("/api/account/capabilities")).json()).require2fa).toBe(true);
-      expect(await (await admin.get("/api/account/require-2fa")).json()).toEqual({ require2fa: true });
-    }).toPass({ timeout: 8000 });
-    // The guard caches for a few seconds — poll until the un-enrolled user is gated.
-    await expect(async () => {
-      expect((await user.get("/api/account/me")).status()).toBe(403);
-    }).toPass({ timeout: 8000 });
-
-    // Enrolling restores access.
-    const enable = await (await user.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
-    await user.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
-    expect((await user.get("/api/account/me")).status()).toBe(200);
-  } finally {
-    // Always turn it back off so the shared (un-enrolled) sessions aren't gated.
-    await admin.put("/api/account/settings", { data: { require2fa: false } });
-    await expect(async () => {
-      const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-      await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
-      const status = (await probe.get("/api/account/me")).status();
-      await probe.dispose();
-      expect(status).toBe(200);
-    }).toPass({ timeout: 8000 });
-    await admin.dispose();
-    await user.dispose();
-  }
+  test.slow();
+  await exclusive("require2fa", async () => {
+    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const caps = await (await admin.get("/api/account/capabilities")).json();
+    test.skip(!caps?.twoFactor, "two-factor not enabled");
+    await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+
+    const user = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const email = `rq-${Date.now()}@example.com`;
+    const pw = "Podokit3e-Str0ng!pw";
+    await user.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RQ" } });
+
+    try {
+      // Turn the policy on (admin; the toggle endpoint is allow-listed by the guard).
+      await admin.put("/api/account/settings", { data: { require2fa: true } });
+      // Capabilities carry the same policy as the dedicated endpoint.
+      await expect(async () => {
+        expect((await (await admin.get("/api/account/capabilities")).json()).require2fa).toBe(true);
+        expect(await (await admin.get("/api/account/require-2fa")).json()).toEqual({ require2fa: true });
+      }).toPass({ timeout: 8000 });
+      // The guard caches for a few seconds — poll until the un-enrolled user is gated.
+      await expect(async () => {
+        expect((await user.get("/api/account/me")).status()).toBe(403);
+      }).toPass({ timeout: 8000 });
+
+      // Enrolling restores access.
+      const enable = await (await user.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+      await user.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+      expect((await user.get("/api/account/me")).status()).toBe(200);
+    } finally {
+      // Always turn it back off so the shared (un-enrolled) sessions aren't gated.
+      await admin.put("/api/account/settings", { data: { require2fa: false } });
+      await expect(async () => {
+        const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+        await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
+        const status = (await probe.get("/api/account/me")).status();
+        await probe.dispose();
+        expect(status).toBe(200);
+      }).toPass({ timeout: 8000 });
+      await admin.dispose();
+      await user.dispose();
+    }
+  });
 });
 
 test("multi-session holds several accounts and switches between them", async ({ playwright }) => {
@@ -380,9 +384,39 @@ test("an organization can have a parent and manager members", async ({ playwrigh
   await ctx.dispose();
 });
 
-// OIDC discovery + the enabled/disabled behaviour is covered by the front-channel
-// test in tests/ui/oidc.ui.spec.ts (which owns toggling the oidcProvider flag), and
-// the server-side gate is covered generically by the feature-toggle test above.
+test("the OIDC provider's discovery and endpoints follow its setting", async ({ playwright }) => {
+  // The provider's metadata is answered before endpoint hooks run, so it needs its
+  // own check that "off" hides it. The lock keeps tests/ui/oidc.ui.spec.ts, which
+  // also toggles the provider, from running at the same time.
+  test.slow();
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const status = (path: string): Promise<number> => admin.get(path).then((r) => r.status());
+  const discovery = [
+    "/api/auth/.well-known/openid-configuration",
+    "/api/auth/.well-known/oauth-authorization-server",
+  ];
+  const allStatuses = (): Promise<number[]> =>
+    Promise.all([...discovery, "/api/auth/oauth2/authorize?client_id=probe"].map(status));
+
+  await exclusive("oidc-provider", async () => {
+    try {
+      expect((await admin.put("/api/account/settings", { data: { oidcProvider: false } })).ok()).toBeTruthy();
+      await expect.poll(allStatuses, { timeout: 8000 }).toEqual([404, 404, 404]);
+      // The jwt plugin's keys and session tokens are not part of the provider.
+      expect(await status("/api/auth/jwks")).toBe(200);
+
+      expect((await admin.put("/api/account/settings", { data: { oidcProvider: true } })).ok()).toBeTruthy();
+      await expect.poll(() => Promise.all(discovery.map(status)), { timeout: 8000 }).toEqual([200, 200]);
+      const metadata = await (await admin.get(discovery[0]!)).json();
+      expect(metadata.authorization_endpoint).toContain("/api/auth/oauth2/authorize");
+    } finally {
+      expect((await admin.put("/api/account/settings", { data: { oidcProvider: false } })).ok()).toBeTruthy();
+    }
+    await expect.poll(allStatuses, { timeout: 8000 }).toEqual([404, 404, 404]);
+  });
+  await admin.dispose();
+});
 
 test("only admins can change settings @smoke", async ({ playwright }) => {
   const userCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -393,24 +427,27 @@ test("only admins can change settings @smoke", async ({ playwright }) => {
 });
 
 test("disabling a feature blocks its endpoint server-side and re-enabling restores it @smoke", async ({ playwright }) => {
-  // Uses a fresh admin context (not the shared storageState) so it never rotates
-  // the seeded session. Toggles a flag and confirms the feature gate enforces it.
-  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
-  const caps = await (await admin.get("/api/account/capabilities")).json();
-  test.skip(!caps?.magicLink, "magic link not enabled");
+  test.slow();
+  await exclusive("magic-link", async () => {
+    // Uses a fresh admin context (not the shared storageState) so it never rotates
+    // the seeded session. Toggles a flag and confirms the feature gate enforces it.
+    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+    const caps = await (await admin.get("/api/account/capabilities")).json();
+    test.skip(!caps?.magicLink, "magic link not enabled");
 
-  // A disabled feature's endpoint 404s; the gate reads the flag through a short cache.
-  const status = (): Promise<number> =>
-    admin.post("/api/auth/sign-in/magic-link", { data: { email: "probe@example.com" } }).then((r) => r.status());
+    // A disabled feature's endpoint 404s; the gate reads the flag through a short cache.
+    const status = (): Promise<number> =>
+      admin.post("/api/auth/sign-in/magic-link", { data: { email: "probe@example.com" } }).then((r) => r.status());
 
-  expect((await admin.put("/api/account/settings", { data: { magicLink: false } })).ok()).toBeTruthy();
-  await expect.poll(status, { timeout: 8000 }).toBe(404);
+    expect((await admin.put("/api/account/settings", { data: { magicLink: false } })).ok()).toBeTruthy();
+    await expect.poll(status, { timeout: 8000 }).toBe(404);
 
-  expect((await admin.put("/api/account/settings", { data: { magicLink: true } })).ok()).toBeTruthy();
-  await expect.poll(status, { timeout: 8000 }).not.toBe(404);
+    expect((await admin.put("/api/account/settings", { data: { magicLink: true } })).ok()).toBeTruthy();
+    await expect.poll(status, { timeout: 8000 }).not.toBe(404);
 
-  await admin.dispose();
+    await admin.dispose();
+  });
 });
 
 test("sign-in with a wrong password is rejected", async ({ request }) => {

package/dist/templates/modules/admin-dashboard/files/tests/api/exclusive.api.spec.ts

@@ -0,0 +1,75 @@
+import { expect, test } from "@playwright/test";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, utimesSync, writeFileSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+import { exclusive, lockPath } from "../helpers/exclusive";
+
+// Checks the lock that specs changing shared settings hold. Names are unique per
+// run so these never wait on, or release, a lock a real spec holds.
+const unique = (label: string): string => `self-test-${label}-${process.pid}-${Date.now()}`;
+
+test("exclusive releases its locks when the body fails", async () => {
+  const first = unique("first");
+  const second = unique("second");
+  await expect(
+    exclusive([second, first], async () => {
+      expect(existsSync(lockPath(first))).toBe(true);
+      expect(existsSync(lockPath(second))).toBe(true);
+      throw new Error("body failed");
+    }),
+  ).rejects.toThrow("body failed");
+  expect(existsSync(lockPath(first))).toBe(false);
+  expect(existsSync(lockPath(second))).toBe(false);
+
+  // The next holder gets the lock without waiting.
+  const started = Date.now();
+  await exclusive(first, async () => undefined);
+  expect(Date.now() - started).toBeLessThan(1_000);
+});
+
+test("exclusive runs holders of one lock one at a time", async () => {
+  const name = unique("serial");
+  const events: string[] = [];
+  const hold = (id: string): Promise<void> =>
+    exclusive(name, async () => {
+      events.push(`${id} start`);
+      await new Promise((resolve) => setTimeout(resolve, 100));
+      events.push(`${id} end`);
+    });
+  await Promise.all([hold("a"), hold("b")]);
+  expect(events.map((event) => event.split(" ")[1])).toEqual(["start", "end", "start", "end"]);
+  expect(existsSync(lockPath(name))).toBe(false);
+});
+
+test("exclusive takes over a lock left by a run that was killed", async () => {
+  const name = unique("stale");
+  mkdirSync(lockPath(name));
+  const longAgo = new Date(Date.now() - 10 * 60_000);
+  utimesSync(lockPath(name), longAgo, longAgo);
+  await expect(exclusive(name, async () => "acquired")).resolves.toBe("acquired");
+  expect(existsSync(lockPath(name))).toBe(false);
+});
+
+test("exclusive takes over a lock whose holder exited, such as after Ctrl-C", async () => {
+  const name = unique("exited");
+  const exited = spawnSync(process.execPath, ["-e", ""]).pid;
+  mkdirSync(lockPath(name));
+  writeFileSync(join(lockPath(name), "owner"), String(exited));
+  const started = Date.now();
+  await expect(exclusive(name, async () => "acquired")).resolves.toBe("acquired");
+  expect(Date.now() - started).toBeLessThan(1_000);
+  expect(existsSync(lockPath(name))).toBe(false);
+});
+
+test("exclusive waits for a lock whose holder is still running", async () => {
+  const name = unique("alive");
+  mkdirSync(lockPath(name));
+  writeFileSync(join(lockPath(name), "owner"), String(process.pid));
+  const waiting = exclusive(name, async () => "acquired");
+  await new Promise((resolve) => setTimeout(resolve, 500));
+  expect(existsSync(lockPath(name))).toBe(true);
+  // The holder finishes; the waiter then gets the lock.
+  await rm(lockPath(name), { recursive: true, force: true });
+  await expect(waiting).resolves.toBe("acquired");
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN } from "../helpers/accounts";
 import { expectObjectLength } from "../helpers/object-response";
+import { exclusive } from "../helpers/exclusive";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -18,29 +19,35 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
 }
 
 test("theme settings: valid preset/radius/accent round-trip", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const put = await admin.put("/api/site/settings", {
-    data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
-  });
-  expect(put.ok()).toBeTruthy();
+  test.slow();
+  await exclusive("site-theme", async () => {
+    const admin = await adminCtx(playwright);
+    const put = await admin.put("/api/site/settings", {
+      data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
+    });
+    expect(put.ok()).toBeTruthy();
 
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const settings = await (await anon.get("/api/site/settings")).json();
-  expect(settings.themePreset).toBe("slate");
-  expect(settings.themeRadius).toBe("0.75");
-  expect(settings.brandColor).toBe("#2563eb");
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const settings = await (await anon.get("/api/site/settings")).json();
+    expect(settings.themePreset).toBe("slate");
+    expect(settings.themeRadius).toBe("0.75");
+    expect(settings.brandColor).toBe("#2563eb");
 
-  // restore
-  await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
-  await anon.dispose();
+    // restore
+    await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
+    await anon.dispose();
+  });
 });
 
 test("theme settings: valid per-token overrides accepted", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
-  const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
-  expect(put.ok()).toBeTruthy();
-  await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
+  test.slow();
+  await exclusive("site-theme", async () => {
+    const admin = await adminCtx(playwright);
+    const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
+    const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
+    expect(put.ok()).toBeTruthy();
+    await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
+  });
 });
 
 test("theme settings: invalid values are rejected (no CSS injection)", async ({ playwright }) => {
@@ -62,29 +69,32 @@ test("theme settings: invalid values are rejected (no CSS injection)", async ({
 });
 
 test("site settings: one response shape and immediate reads after each write", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
-  expect(Object.keys(before)).toEqual([
-    "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
-    "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
-    "hasFavicon", "faviconVersion",
-  ]);
-  expect(typeof before.hasFavicon).toBe("boolean");
-  expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
+  test.slow();
+  await exclusive("site-general", async () => {
+    const admin = await adminCtx(playwright);
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
+    expect(Object.keys(before)).toEqual([
+      "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
+      "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
+      "hasFavicon", "faviconVersion",
+    ]);
+    expect(typeof before.hasFavicon).toBe("boolean");
+    expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
 
-  try {
-    // The second write lands while the first read is still cached; it must not be hidden.
-    for (const footerText of ["first footer", "second footer"]) {
-      expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
-      expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
+    try {
+      // The second write lands while the first read is still cached; it must not be hidden.
+      for (const footerText of ["first footer", "second footer"]) {
+        expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
+        expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
+      }
+    } finally {
+      const footerText = typeof before.footerText === "string" ? before.footerText : "";
+      await admin.put("/api/site/settings", { data: { footerText } });
+      await anon.dispose();
+      await admin.dispose();
     }
-  } finally {
-    const footerText = typeof before.footerText === "string" ? before.footerText : "";
-    await admin.put("/api/site/settings", { data: { footerText } });
-    await anon.dispose();
-    await admin.dispose();
-  }
+  });
 });
 
 test("site favicon: the versioned URL is cached for good and other URLs revalidate", async ({ playwright }) => {

package/dist/templates/modules/admin-dashboard/files/tests/helpers/exclusive.ts

@@ -0,0 +1,80 @@
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// Locks for server-wide settings that specs in more than one file change. The
+// suite runs on one worker by default; with --workers above 1, specs of the api
+// and ui projects run at the same time, and two that flip the same setting
+// would undo each other mid-test:
+//
+// - `require2fa`, `magic-link`, `oidc-provider`: feature flags
+// - `session-idle-timeout`: automatic logout in the auth configuration
+// - `social-providers`: any social sign-in provider in the auth configuration
+// - `site-general`: the General settings form, which saves all of its fields
+//   (name, footer, locale, maintenance mode, public sign-up, ...) at once
+// - `site-theme`: the Appearance settings
+//
+// A spec that holds a lock calls `test.slow()`, since waiting for another
+// holder counts against its timeout.
+
+// Longer than any spec holds a lock. A lock whose holder process has exited is
+// taken over at once; this bounds the wait when the holder cannot be checked.
+const STALE_MS = 120_000;
+const OWNER_FILE = "owner";
+
+/** The lock directory for `name`, shared by every worker on this machine. */
+export function lockPath(name: string): string {
+  return join(tmpdir(), `podokit-e2e-${name}.lock`);
+}
+
+/** Whether the worker that holds `lock` has exited, such as after Ctrl-C. */
+async function holderExited(lock: string): Promise<boolean> {
+  const pid = Number(await readFile(join(lock, OWNER_FILE), "utf8").catch(() => ""));
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ESRCH";
+  }
+}
+
+async function acquire(lock: string): Promise<void> {
+  for (;;) {
+    const created = await mkdir(lock).then(
+      () => true,
+      (error: NodeJS.ErrnoException) => {
+        if (error.code === "EEXIST") return false;
+        throw error;
+      },
+    );
+    if (created) {
+      await writeFile(join(lock, OWNER_FILE), String(process.pid)).catch(async (error: unknown) => {
+        await rm(lock, { recursive: true, force: true });
+        throw error;
+      });
+      return;
+    }
+    const age = await stat(lock).then((info) => Date.now() - info.mtimeMs, () => 0);
+    if (age > STALE_MS || (await holderExited(lock))) await rm(lock, { recursive: true, force: true });
+    else await new Promise((resolve) => setTimeout(resolve, 200));
+  }
+}
+
+/** Runs `body` while no other Playwright worker on this machine holds any of
+ *  the named locks, and releases them however `body` ends. */
+export async function exclusive<T>(names: string | string[], body: () => Promise<T>): Promise<T> {
+  // One acquisition order for every caller, so two specs that each need
+  // several locks cannot wait on each other.
+  const locks = [...new Set([names].flat())].sort().map(lockPath);
+  const held: string[] = [];
+  try {
+    for (const lock of locks) {
+      await acquire(lock);
+      held.push(lock);
+    }
+    return await body();
+  } finally {
+    for (const lock of held.reverse()) await rm(lock, { recursive: true, force: true });
+  }
+}

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 import { ADMIN } from "../helpers/accounts";
+import { exclusive } from "../helpers/exclusive";
 
 const PNG = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAIAAAADAQMAAACDJEzCAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCSUTzXBDTwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozNzoxOSswMDowMOuehLIAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzc6MTkrMDA6MDCawzwOAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM3OjE5KzAwOjAwzdYd0QAAAAtJREFUCNdjYAABAAAGAAFm9MlsAAAAAElFTkSuQmCC",
@@ -227,54 +228,57 @@ test("account nav shows the core sections", async ({ page }) => {
 });
 
 test("connected account unlink uses the local account row id @smoke", async ({ page }) => {
-  const provider = "google";
-  let unlinkBody: unknown;
-  await page.route("**/api/auth/list-accounts", (route) =>
-    route.fulfill({
-      status: 200,
-      contentType: "application/json",
-      body: JSON.stringify([
-        { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
-      ]),
-    }),
-  );
-  await page.route("**/api/auth/unlink-account", async (route) => {
-    unlinkBody = route.request().postDataJSON();
-    await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
-  });
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const provider = "google";
+    let unlinkBody: unknown;
+    await page.route("**/api/auth/list-accounts", (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify([
+          { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
+        ]),
+      }),
+    );
+    await page.route("**/api/auth/unlink-account", async (route) => {
+      unlinkBody = route.request().postDataJSON();
+      await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
+    });
 
-  try {
-    const enabled = await page.request.put("/api/account/auth-config", {
-      data: {
-        social: {
-          [provider]: {
-            enabled: true,
-            clientId: "podokit",
-            clientSecret: "podokit",
+    try {
+      const enabled = await page.request.put("/api/account/auth-config", {
+        data: {
+          social: {
+            [provider]: {
+              enabled: true,
+              clientId: "podokit",
+              clientSecret: "podokit",
+            },
           },
         },
-      },
-    });
-    expect(enabled.ok()).toBeTruthy();
-    await expect
-      .poll(async () => {
-        const response = await page.request.get("/api/account/capabilities");
-        const body = (await response.json()) as { providers?: string[] };
-        return body.providers ?? [];
-      }, { timeout: 8_000 })
-      .toContain(provider);
+      });
+      expect(enabled.ok()).toBeTruthy();
+      await expect
+        .poll(async () => {
+          const response = await page.request.get("/api/account/capabilities");
+          const body = (await response.json()) as { providers?: string[] };
+          return body.providers ?? [];
+        }, { timeout: 8_000 })
+        .toContain(provider);
 
-    await ready(page, "/admin/account");
-    await page.getByRole("button", { name: "Connected", exact: true }).click();
-    await page.getByRole("button", { name: "Disconnect", exact: true }).click();
+      await ready(page, "/admin/account");
+      await page.getByRole("button", { name: "Connected", exact: true }).click();
+      await page.getByRole("button", { name: "Disconnect", exact: true }).click();
 
-    await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
-    await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
-  } finally {
-    await page.request.put("/api/account/auth-config", {
-      data: { social: { [provider]: { enabled: false } } },
-    });
-  }
+      await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
+      await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
+    } finally {
+      await page.request.put("/api/account/auth-config", {
+        data: { social: { [provider]: { enabled: false } } },
+      });
+    }
+  });
 });
 
 test("two-factor setup shows a scannable QR code when enabled", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 // admin storageState (project default). The Appearance controls live in their
 // own "Appearance" settings tab.
@@ -49,16 +50,19 @@ test("appearance: advanced reveals per-token pickers", async ({ page }) => {
 });
 
 test("appearance: pick a preset, save, apply live, then restore @smoke", async ({ page }) => {
-  await openAppearance(page);
-  await page.getByRole("button", { name: "Slate" }).click();
-  await page.getByRole("button", { name: "Medium" }).click();
-  await page.getByRole("button", { name: "Save changes" }).click();
-  await expect(page.getByText("General settings saved.").first()).toBeVisible();
-  // Applied globally via the scoped override stylesheet.
-  await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
+  test.slow();
+  await exclusive("site-theme", async () => {
+    await openAppearance(page);
+    await page.getByRole("button", { name: "Slate" }).click();
+    await page.getByRole("button", { name: "Medium" }).click();
+    await page.getByRole("button", { name: "Save changes" }).click();
+    await expect(page.getByText("General settings saved.").first()).toBeVisible();
+    // Applied globally via the scoped override stylesheet.
+    await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
 
-  // "Restore defaults" reverts everything in one click and persists.
-  await page.getByRole("button", { name: "Restore defaults" }).click();
-  await expect(page.getByText("General settings saved.").first()).toBeVisible();
-  await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
+    // "Restore defaults" reverts everything in one click and persists.
+    await page.getByRole("button", { name: "Restore defaults" }).click();
+    await expect(page.getByText("General settings saved.").first()).toBeVisible();
+    await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
+  });
 });