@podosoft/podokit 1.4.1 → 1.4.2

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN } from "../helpers/accounts";
 import { expectObjectLength } from "../helpers/object-response";
+import { exclusive } from "../helpers/exclusive";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -18,29 +19,35 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
 }
 
 test("theme settings: valid preset/radius/accent round-trip", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const put = await admin.put("/api/site/settings", {
-    data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
-  });
-  expect(put.ok()).toBeTruthy();
+  test.slow();
+  await exclusive("site-theme", async () => {
+    const admin = await adminCtx(playwright);
+    const put = await admin.put("/api/site/settings", {
+      data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
+    });
+    expect(put.ok()).toBeTruthy();
 
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const settings = await (await anon.get("/api/site/settings")).json();
-  expect(settings.themePreset).toBe("slate");
-  expect(settings.themeRadius).toBe("0.75");
-  expect(settings.brandColor).toBe("#2563eb");
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const settings = await (await anon.get("/api/site/settings")).json();
+    expect(settings.themePreset).toBe("slate");
+    expect(settings.themeRadius).toBe("0.75");
+    expect(settings.brandColor).toBe("#2563eb");
 
-  // restore
-  await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
-  await anon.dispose();
+    // restore
+    await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
+    await anon.dispose();
+  });
 });
 
 test("theme settings: valid per-token overrides accepted", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
-  const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
-  expect(put.ok()).toBeTruthy();
-  await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
+  test.slow();
+  await exclusive("site-theme", async () => {
+    const admin = await adminCtx(playwright);
+    const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
+    const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
+    expect(put.ok()).toBeTruthy();
+    await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
+  });
 });
 
 test("theme settings: invalid values are rejected (no CSS injection)", async ({ playwright }) => {
@@ -62,29 +69,32 @@ test("theme settings: invalid values are rejected (no CSS injection)", async ({
 });
 
 test("site settings: one response shape and immediate reads after each write", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
-  expect(Object.keys(before)).toEqual([
-    "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
-    "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
-    "hasFavicon", "faviconVersion",
-  ]);
-  expect(typeof before.hasFavicon).toBe("boolean");
-  expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
+  test.slow();
+  await exclusive("site-general", async () => {
+    const admin = await adminCtx(playwright);
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
+    expect(Object.keys(before)).toEqual([
+      "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
+      "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
+      "hasFavicon", "faviconVersion",
+    ]);
+    expect(typeof before.hasFavicon).toBe("boolean");
+    expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
 
-  try {
-    // The second write lands while the first read is still cached; it must not be hidden.
-    for (const footerText of ["first footer", "second footer"]) {
-      expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
-      expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
+    try {
+      // The second write lands while the first read is still cached; it must not be hidden.
+      for (const footerText of ["first footer", "second footer"]) {
+        expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
+        expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
+      }
+    } finally {
+      const footerText = typeof before.footerText === "string" ? before.footerText : "";
+      await admin.put("/api/site/settings", { data: { footerText } });
+      await anon.dispose();
+      await admin.dispose();
     }
-  } finally {
-    const footerText = typeof before.footerText === "string" ? before.footerText : "";
-    await admin.put("/api/site/settings", { data: { footerText } });
-    await anon.dispose();
-    await admin.dispose();
-  }
+  });
 });
 
 test("site favicon: the versioned URL is cached for good and other URLs revalidate", async ({ playwright }) => {

package/dist/templates/modules/admin-dashboard/files/tests/helpers/exclusive.ts

@@ -0,0 +1,80 @@
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// Locks for server-wide settings that specs in more than one file change. The
+// suite runs on one worker by default; with --workers above 1, specs of the api
+// and ui projects run at the same time, and two that flip the same setting
+// would undo each other mid-test:
+//
+// - `require2fa`, `magic-link`, `oidc-provider`: feature flags
+// - `session-idle-timeout`: automatic logout in the auth configuration
+// - `social-providers`: any social sign-in provider in the auth configuration
+// - `site-general`: the General settings form, which saves all of its fields
+//   (name, footer, locale, maintenance mode, public sign-up, ...) at once
+// - `site-theme`: the Appearance settings
+//
+// A spec that holds a lock calls `test.slow()`, since waiting for another
+// holder counts against its timeout.
+
+// Longer than any spec holds a lock. A lock whose holder process has exited is
+// taken over at once; this bounds the wait when the holder cannot be checked.
+const STALE_MS = 120_000;
+const OWNER_FILE = "owner";
+
+/** The lock directory for `name`, shared by every worker on this machine. */
+export function lockPath(name: string): string {
+  return join(tmpdir(), `podokit-e2e-${name}.lock`);
+}
+
+/** Whether the worker that holds `lock` has exited, such as after Ctrl-C. */
+async function holderExited(lock: string): Promise<boolean> {
+  const pid = Number(await readFile(join(lock, OWNER_FILE), "utf8").catch(() => ""));
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ESRCH";
+  }
+}
+
+async function acquire(lock: string): Promise<void> {
+  for (;;) {
+    const created = await mkdir(lock).then(
+      () => true,
+      (error: NodeJS.ErrnoException) => {
+        if (error.code === "EEXIST") return false;
+        throw error;
+      },
+    );
+    if (created) {
+      await writeFile(join(lock, OWNER_FILE), String(process.pid)).catch(async (error: unknown) => {
+        await rm(lock, { recursive: true, force: true });
+        throw error;
+      });
+      return;
+    }
+    const age = await stat(lock).then((info) => Date.now() - info.mtimeMs, () => 0);
+    if (age > STALE_MS || (await holderExited(lock))) await rm(lock, { recursive: true, force: true });
+    else await new Promise((resolve) => setTimeout(resolve, 200));
+  }
+}
+
+/** Runs `body` while no other Playwright worker on this machine holds any of
+ *  the named locks, and releases them however `body` ends. */
+export async function exclusive<T>(names: string | string[], body: () => Promise<T>): Promise<T> {
+  // One acquisition order for every caller, so two specs that each need
+  // several locks cannot wait on each other.
+  const locks = [...new Set([names].flat())].sort().map(lockPath);
+  const held: string[] = [];
+  try {
+    for (const lock of locks) {
+      await acquire(lock);
+      held.push(lock);
+    }
+    return await body();
+  } finally {
+    for (const lock of held.reverse()) await rm(lock, { recursive: true, force: true });
+  }
+}

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 import { ADMIN } from "../helpers/accounts";
+import { exclusive } from "../helpers/exclusive";
 
 const PNG = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAIAAAADAQMAAACDJEzCAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCSUTzXBDTwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozNzoxOSswMDowMOuehLIAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzc6MTkrMDA6MDCawzwOAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM3OjE5KzAwOjAwzdYd0QAAAAtJREFUCNdjYAABAAAGAAFm9MlsAAAAAElFTkSuQmCC",
@@ -227,54 +228,57 @@ test("account nav shows the core sections", async ({ page }) => {
 });
 
 test("connected account unlink uses the local account row id @smoke", async ({ page }) => {
-  const provider = "google";
-  let unlinkBody: unknown;
-  await page.route("**/api/auth/list-accounts", (route) =>
-    route.fulfill({
-      status: 200,
-      contentType: "application/json",
-      body: JSON.stringify([
-        { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
-      ]),
-    }),
-  );
-  await page.route("**/api/auth/unlink-account", async (route) => {
-    unlinkBody = route.request().postDataJSON();
-    await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
-  });
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const provider = "google";
+    let unlinkBody: unknown;
+    await page.route("**/api/auth/list-accounts", (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify([
+          { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
+        ]),
+      }),
+    );
+    await page.route("**/api/auth/unlink-account", async (route) => {
+      unlinkBody = route.request().postDataJSON();
+      await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
+    });
 
-  try {
-    const enabled = await page.request.put("/api/account/auth-config", {
-      data: {
-        social: {
-          [provider]: {
-            enabled: true,
-            clientId: "podokit",
-            clientSecret: "podokit",
+    try {
+      const enabled = await page.request.put("/api/account/auth-config", {
+        data: {
+          social: {
+            [provider]: {
+              enabled: true,
+              clientId: "podokit",
+              clientSecret: "podokit",
+            },
           },
         },
-      },
-    });
-    expect(enabled.ok()).toBeTruthy();
-    await expect
-      .poll(async () => {
-        const response = await page.request.get("/api/account/capabilities");
-        const body = (await response.json()) as { providers?: string[] };
-        return body.providers ?? [];
-      }, { timeout: 8_000 })
-      .toContain(provider);
+      });
+      expect(enabled.ok()).toBeTruthy();
+      await expect
+        .poll(async () => {
+          const response = await page.request.get("/api/account/capabilities");
+          const body = (await response.json()) as { providers?: string[] };
+          return body.providers ?? [];
+        }, { timeout: 8_000 })
+        .toContain(provider);
 
-    await ready(page, "/admin/account");
-    await page.getByRole("button", { name: "Connected", exact: true }).click();
-    await page.getByRole("button", { name: "Disconnect", exact: true }).click();
+      await ready(page, "/admin/account");
+      await page.getByRole("button", { name: "Connected", exact: true }).click();
+      await page.getByRole("button", { name: "Disconnect", exact: true }).click();
 
-    await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
-    await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
-  } finally {
-    await page.request.put("/api/account/auth-config", {
-      data: { social: { [provider]: { enabled: false } } },
-    });
-  }
+      await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
+      await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
+    } finally {
+      await page.request.put("/api/account/auth-config", {
+        data: { social: { [provider]: { enabled: false } } },
+      });
+    }
+  });
 });
 
 test("two-factor setup shows a scannable QR code when enabled", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 // admin storageState (project default). The Appearance controls live in their
 // own "Appearance" settings tab.
@@ -49,16 +50,19 @@ test("appearance: advanced reveals per-token pickers", async ({ page }) => {
 });
 
 test("appearance: pick a preset, save, apply live, then restore @smoke", async ({ page }) => {
-  await openAppearance(page);
-  await page.getByRole("button", { name: "Slate" }).click();
-  await page.getByRole("button", { name: "Medium" }).click();
-  await page.getByRole("button", { name: "Save changes" }).click();
-  await expect(page.getByText("General settings saved.").first()).toBeVisible();
-  // Applied globally via the scoped override stylesheet.
-  await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
+  test.slow();
+  await exclusive("site-theme", async () => {
+    await openAppearance(page);
+    await page.getByRole("button", { name: "Slate" }).click();
+    await page.getByRole("button", { name: "Medium" }).click();
+    await page.getByRole("button", { name: "Save changes" }).click();
+    await expect(page.getByText("General settings saved.").first()).toBeVisible();
+    // Applied globally via the scoped override stylesheet.
+    await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
 
-  // "Restore defaults" reverts everything in one click and persists.
-  await page.getByRole("button", { name: "Restore defaults" }).click();
-  await expect(page.getByText("General settings saved.").first()).toBeVisible();
-  await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
+    // "Restore defaults" reverts everything in one click and persists.
+    await page.getByRole("button", { name: "Restore defaults" }).click();
+    await expect(page.getByText("General settings saved.").first()).toBeVisible();
+    await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
+  });
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -2,6 +2,7 @@ import { expect, test } from "@playwright/test";
 import { safeAuthRedirect, withAuthRedirect } from "../../apps/web/src/lib/auth-redirect";
 import { anonState, ADMIN } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 test.use({ storageState: anonState });
 
@@ -66,39 +67,42 @@ test("closed social registration errors explain that existing users may sign in"
 });
 
 test("configured social providers appear on the login page", async ({ page, playwright }) => {
-  const admin = await playwright.request.newContext({
-    baseURL: base,
-    extraHTTPHeaders: { origin: base },
-  });
-  await admin.post("/api/auth/sign-in/email", {
-    data: { email: ADMIN.email, password: ADMIN.password },
-  });
-  try {
-    expect(
-      (await admin.put("/api/account/auth-config", {
-        data: {
-          social: {
-            google: {
-              enabled: true,
-              clientId: "dummy-google-client-id",
-              clientSecret: "dummy-google-client-secret",
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const admin = await playwright.request.newContext({
+      baseURL: base,
+      extraHTTPHeaders: { origin: base },
+    });
+    await admin.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    try {
+      expect(
+        (await admin.put("/api/account/auth-config", {
+          data: {
+            social: {
+              google: {
+                enabled: true,
+                clientId: "dummy-google-client-id",
+                clientSecret: "dummy-google-client-secret",
+              },
             },
           },
-        },
-      })).ok(),
-    ).toBeTruthy();
-    await expect
-      .poll(async () => {
-        await page.goto("/login");
-        return page.getByRole("button", { name: "Continue with Google" }).count();
-      }, { timeout: 8_000 })
-      .toBe(1);
-  } finally {
-    await admin.put("/api/account/auth-config", {
-      data: { social: { google: { enabled: false } } },
-    });
-    await admin.dispose();
-  }
+        })).ok(),
+      ).toBeTruthy();
+      await expect
+        .poll(async () => {
+          await page.goto("/login");
+          return page.getByRole("button", { name: "Continue with Google" }).count();
+        }, { timeout: 8_000 })
+        .toBe(1);
+    } finally {
+      await admin.put("/api/account/auth-config", {
+        data: { social: { google: { enabled: false } } },
+      });
+      await admin.dispose();
+    }
+  });
 });
 
 test("forgot-password shows a sent confirmation", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -1,12 +1,14 @@
 import { expect, test, type Page } from "@playwright/test";
 import { anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 // Verifies that the General settings actually take effect (not just persist).
 // The admin storageState (project default) drives the toggles; a fresh anonymous
-// context checks the public-facing result. Serial workers (workers:1) make the
-// toggle-then-restore pattern safe for the rest of the suite; restores run in a
-// `finally` so a mid-test failure still leaves the shared site settings clean.
+// context checks the public-facing result. The site-general lock keeps other
+// specs that save these settings out while one runs, also with --workers above
+// 1; restores run in a `finally` so a mid-test failure still leaves the shared
+// site settings clean.
 
 async function saveGeneral(
   page: Page,
@@ -29,97 +31,109 @@ async function saveGeneral(
 }
 
 test("general: empty locale displays the application default", async ({ page }) => {
-  await ready(page, "/admin/settings");
-  const origin = new URL(page.url()).origin;
-  const settingsUrl = `${origin}/api/site/settings`;
-  const previous = await (await page.request.get(settingsUrl)).json() as { locale?: string };
-
-  try {
-    expect((await page.request.put(settingsUrl, { data: { locale: "" } })).ok()).toBeTruthy();
+  test.slow();
+  await exclusive("site-general", async () => {
     await ready(page, "/admin/settings");
-    await expect(page.locator("#locale")).toContainText("English");
-  } finally {
-    await page.request.put(settingsUrl, { data: { locale: previous.locale ?? "" } });
-  }
+    const origin = new URL(page.url()).origin;
+    const settingsUrl = `${origin}/api/site/settings`;
+    const previous = await (await page.request.get(settingsUrl)).json() as { locale?: string };
+
+    try {
+      expect((await page.request.put(settingsUrl, { data: { locale: "" } })).ok()).toBeTruthy();
+      await ready(page, "/admin/settings");
+      await expect(page.locator("#locale")).toContainText("English");
+    } finally {
+      await page.request.put(settingsUrl, { data: { locale: previous.locale ?? "" } });
+    }
+  });
 });
 
 test("general: footer text and links render on public pages", async ({ page, browser }) => {
-  await ready(page, "/admin/settings");
-  const origin = new URL(page.url()).origin;
-  const footer = page.getByLabel("Footer text");
-  const support = page.getByLabel("Support email");
-  const origFooter = await footer.inputValue();
-  const origSupport = await support.inputValue();
-  await saveGeneral(
-    page,
-    async () => {
-      await footer.fill("© 2026 PodoKit Test");
-      await support.fill("help@example.com");
-    },
-    { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
-  );
-  try {
-    const ctx = await browser.newContext({ storageState: anonState });
-    const anon = await ctx.newPage();
-    await anon.goto(`${origin}/login`);
-    await expect(anon.getByText("© 2026 PodoKit Test")).toBeVisible();
-    await expect(anon.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
-    await ctx.close();
-  } finally {
+  test.slow();
+  await exclusive("site-general", async () => {
     await ready(page, "/admin/settings");
+    const origin = new URL(page.url()).origin;
+    const footer = page.getByLabel("Footer text");
+    const support = page.getByLabel("Support email");
+    const origFooter = await footer.inputValue();
+    const origSupport = await support.inputValue();
     await saveGeneral(
       page,
       async () => {
-        await page.getByLabel("Footer text").fill(origFooter);
-        await page.getByLabel("Support email").fill(origSupport);
+        await footer.fill("© 2026 PodoKit Test");
+        await support.fill("help@example.com");
       },
-      { footerText: origFooter, supportEmail: origSupport },
+      { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
     );
-  }
+    try {
+      const ctx = await browser.newContext({ storageState: anonState });
+      const anon = await ctx.newPage();
+      await anon.goto(`${origin}/login`);
+      await expect(anon.getByText("© 2026 PodoKit Test")).toBeVisible();
+      await expect(anon.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
+      await ctx.close();
+    } finally {
+      await ready(page, "/admin/settings");
+      await saveGeneral(
+        page,
+        async () => {
+          await page.getByLabel("Footer text").fill(origFooter);
+          await page.getByLabel("Support email").fill(origSupport);
+        },
+        { footerText: origFooter, supportEmail: origSupport },
+      );
+    }
+  });
 });
 
 test("general: maintenance mode holds non-admins on the maintenance page", async ({ page, browser }) => {
-  await ready(page, "/admin/settings");
-  const origin = new URL(page.url()).origin;
-  await page.getByRole("switch", { name: "Maintenance mode" }).click();
-  await saveGeneral(page);
-  try {
-    const ctx = await browser.newContext({ storageState: anonState });
-    const anon = await ctx.newPage();
-    await anon.goto(`${origin}/`);
-    await expect(anon).toHaveURL(/\/maintenance$/);
-    await expect(anon.getByRole("heading", { name: "Under maintenance" })).toBeVisible();
-    await ctx.close();
-    // the admin is not held back
-    await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
-  } finally {
+  test.slow();
+  await exclusive("site-general", async () => {
     await ready(page, "/admin/settings");
-    const t = page.getByRole("switch", { name: "Maintenance mode" });
-    if (await t.isChecked()) {
-      await t.click();
-      await saveGeneral(page);
+    const origin = new URL(page.url()).origin;
+    await page.getByRole("switch", { name: "Maintenance mode" }).click();
+    await saveGeneral(page);
+    try {
+      const ctx = await browser.newContext({ storageState: anonState });
+      const anon = await ctx.newPage();
+      await anon.goto(`${origin}/`);
+      await expect(anon).toHaveURL(/\/maintenance$/);
+      await expect(anon.getByRole("heading", { name: "Under maintenance" })).toBeVisible();
+      await ctx.close();
+      // the admin is not held back
+      await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
+    } finally {
+      await ready(page, "/admin/settings");
+      const t = page.getByRole("switch", { name: "Maintenance mode" });
+      if (await t.isChecked()) {
+        await t.click();
+        await saveGeneral(page);
+      }
     }
-  }
+  });
 });
 
 test("general: closing sign-up redirects /signup and hides the link", async ({ page, browser }) => {
-  await ready(page, "/admin/settings");
-  const origin = new URL(page.url()).origin;
-  await page.getByRole("switch", { name: "Allow public sign-up" }).click();
-  await saveGeneral(page);
-  try {
-    const ctx = await browser.newContext({ storageState: anonState });
-    const anon = await ctx.newPage();
-    await anon.goto(`${origin}/signup`);
-    await expect(anon).toHaveURL(/\/login/);
-    await expect(anon.getByRole("link", { name: "Sign up" })).toHaveCount(0);
-    await ctx.close();
-  } finally {
+  test.slow();
+  await exclusive("site-general", async () => {
     await ready(page, "/admin/settings");
-    const t = page.getByRole("switch", { name: "Allow public sign-up" });
-    if (!(await t.isChecked())) {
-      await t.click();
-      await saveGeneral(page);
+    const origin = new URL(page.url()).origin;
+    await page.getByRole("switch", { name: "Allow public sign-up" }).click();
+    await saveGeneral(page);
+    try {
+      const ctx = await browser.newContext({ storageState: anonState });
+      const anon = await ctx.newPage();
+      await anon.goto(`${origin}/signup`);
+      await expect(anon).toHaveURL(/\/login/);
+      await expect(anon.getByRole("link", { name: "Sign up" })).toHaveCount(0);
+      await ctx.close();
+    } finally {
+      await ready(page, "/admin/settings");
+      const t = page.getByRole("switch", { name: "Allow public sign-up" });
+      if (!(await t.isChecked())) {
+        await t.click();
+        await saveGeneral(page);
+      }
     }
-  }
+  });
 });