@podosoft/podokit 1.4.1 → 1.4.2

package/dist/templates/modules/admin-dashboard/files/tests/ui/i18n.ui.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN, adminState, anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 test.use({ storageState: anonState });
 
@@ -23,23 +24,26 @@ test("language switch updates messages and <html lang>", async ({ page }) => {
 });
 
 test("explicit English overrides a Korean site fallback", async ({ page, playwright }) => {
-  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  await admin.post("/api/auth/sign-in/email", {
-    data: { email: ADMIN.email, password: ADMIN.password },
-  });
-  const previous = await (await admin.get("/api/site/settings")).json() as { locale?: string };
+  test.slow();
+  await exclusive("site-general", async () => {
+    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    await admin.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    const previous = await (await admin.get("/api/site/settings")).json() as { locale?: string };
 
-  try {
-    expect((await admin.put("/api/site/settings", { data: { locale: "ko" } })).ok()).toBeTruthy();
-    await page.context().addCookies([{ name: "locale", value: "en", url: base }]);
-    await ready(page, "/login");
+    try {
+      expect((await admin.put("/api/site/settings", { data: { locale: "ko" } })).ok()).toBeTruthy();
+      await page.context().addCookies([{ name: "locale", value: "en", url: base }]);
+      await ready(page, "/login");
 
-    await expect(page.locator("html")).toHaveAttribute("lang", "en");
-    await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
-  } finally {
-    await admin.put("/api/site/settings", { data: { locale: previous.locale ?? "en" } });
-    await admin.dispose();
-  }
+      await expect(page.locator("html")).toHaveAttribute("lang", "en");
+      await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
+    } finally {
+      await admin.put("/api/site/settings", { data: { locale: previous.locale ?? "en" } });
+      await admin.dispose();
+    }
+  });
 });
 
 test("managed admin labels react to locale changes", async ({ browser }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -1,5 +1,6 @@
-import { expect, test } from "@playwright/test";
+import { expect, test, type Page } from "@playwright/test";
 import { createHash, randomBytes } from "node:crypto";
+import { exclusive } from "../helpers/exclusive";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — the admin is the resource owner.
@@ -14,6 +15,12 @@ const REDIRECT = "https://example.com/callback";
 // back-channel token exchange is driven by an OIDC client SDK / real RP — see
 // docs/modules.md for the manual round-trip checklist.
 test("OIDC provider: discovery, JWKS, client registration, authorize handoff", async ({ page, baseURL }) => {
+  // tests/api/auth.api.spec.ts also toggles the provider; the lock keeps the two apart.
+  test.slow();
+  await exclusive("oidc-provider", () => frontChannel(page, baseURL));
+});
+
+async function frontChannel(page: Page, baseURL: string | undefined): Promise<void> {
   const headers = { origin: baseURL ?? "" };
   const enabled = await page.request.put("/api/account/settings", {
     data: { oidcProvider: true },
@@ -30,7 +37,14 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
       expect(typeof disc[field]).toBe("string");
     }
     // JWKS exposes at least one signing key (the OAuth provider needs it for id_tokens).
-    const jwks = await (await page.request.get(disc.jwks_uri)).json();
+    // Discovery names BETTER_AUTH_URL's origin, which can be a public tunnel
+    // (publicUrl in .podokit/dev.json) that this runner cannot reach, so read the
+    // key set's path from the app under test.
+    const jwksUri = new URL(disc.jwks_uri);
+    expect(jwksUri.origin).toBe(new URL(disc.issuer).origin);
+    const jwksResponse = await page.request.get(`${jwksUri.pathname}${jwksUri.search}`);
+    expect(jwksResponse.ok(), await jwksResponse.text()).toBeTruthy();
+    const jwks = await jwksResponse.json();
     expect(Array.isArray(jwks.keys) && jwks.keys.length).toBeTruthy();
 
     // Dynamic client registration returns usable credentials. Retry: right after
@@ -82,4 +96,4 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
     });
     expect(disabled.ok(), await disabled.text()).toBeTruthy();
   }
-});
+}

package/dist/templates/modules/admin-dashboard/files/tests/ui/request-budget.ui.spec.ts

@@ -18,6 +18,19 @@ test("the first render does not embed the message catalogs", async ({ page }) =>
 });
 
 test("client navigation keeps the server checks without resending messages", async ({ page }) => {
+  // Read each page-data body on its way to the page. Chromium reports a
+  // __data.json fetch as aborted (net::ERR_ABORTED) once SvelteKit has consumed
+  // its body, and then keeps no body for response.text() to return.
+  const pending = new Map<string, (body: string) => void>();
+  await page.route(
+    (url) => url.pathname.endsWith("/__data.json"),
+    async (route) => {
+      const response = await route.fetch();
+      const body = await response.text();
+      pending.get(new URL(route.request().url()).pathname)?.(body);
+      await route.fulfill({ response, body });
+    },
+  );
   await ready(page, "/admin");
   await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
 
@@ -29,13 +42,9 @@ test("client navigation keeps the server checks without resending messages", asy
     ["Overview", "/admin", "Dashboard"],
   ];
   for (const [link, path, heading] of stops) {
-    // Read each body before the next click: once the page navigates on, the
-    // previous response body is no longer available.
-    const data = page.waitForResponse(
-      (response) => new URL(response.url()).pathname === `${path}/__data.json`,
-    );
+    const data = new Promise<string>((resolve) => pending.set(`${path}/__data.json`, resolve));
     await sidebar.getByRole("link", { name: link, exact: true }).click();
-    const body = await (await data).text();
+    const body = await data;
     expect(body).not.toContain('"messages"');
     expect(body.length).toBeLessThan(20_000);
     await expect(page.getByRole("heading", { name: heading, exact: true })).toBeVisible();

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings-dialogs.ui.spec.ts

@@ -1,53 +1,57 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 // admin storageState (project default)
 
 test("settings: add and remove a social login provider", async ({ page }) => {
-  const dialog = page.getByRole("dialog");
-  const addBtn = dialog.getByRole("button", { name: "Add provider" });
-  const openConfigure = async (): Promise<void> => {
-    await page.waitForLoadState("networkidle");
-    await page.getByRole("tab", { name: "Authentication" }).click();
-    const socialCard = page
-      .getByText("Social login", { exact: true })
-      .locator('xpath=ancestor::div[@data-slot="card"]');
-    await socialCard.getByRole("button", { name: "Configure" }).click();
-  };
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const dialog = page.getByRole("dialog");
+    const addBtn = dialog.getByRole("button", { name: "Add provider" });
+    const openConfigure = async (): Promise<void> => {
+      await page.waitForLoadState("networkidle");
+      await page.getByRole("tab", { name: "Authentication" }).click();
+      const socialCard = page
+        .getByText("Social login", { exact: true })
+        .locator('xpath=ancestor::div[@data-slot="card"]');
+      await socialCard.getByRole("button", { name: "Configure" }).click();
+    };
 
-  await ready(page, "/admin/settings");
-  // The auth-config catalog can be momentarily unavailable right after another
-  // spec toggles auth config (the auth instance rebuilds). Reload until the
-  // catalog is loaded (Add provider becomes enabled).
-  await expect(async () => {
-    await page.reload();
-    await openConfigure();
-    await expect(addBtn).toBeEnabled({ timeout: 3000 });
-  }).toPass({ timeout: 25000 });
+    await ready(page, "/admin/settings");
+    // The auth-config catalog can be momentarily unavailable right after another
+    // spec toggles auth config (the auth instance rebuilds). Reload until the
+    // catalog is loaded (Add provider becomes enabled).
+    await expect(async () => {
+      await page.reload();
+      await openConfigure();
+      await expect(addBtn).toBeEnabled({ timeout: 3000 });
+    }).toPass({ timeout: 25000 });
 
-  await addBtn.click();
-  const provider = dialog.locator("#social-provider");
-  await expect(provider).toBeVisible();
-  const callback = await dialog.locator("code").textContent();
-  const providerId = callback?.trim().split("/").pop() ?? ""; // first addable provider (not hard-coded)
-  expect(providerId).not.toBe("");
-  const expectedCallback = new URL(`/api/auth/callback/${providerId}`, page.url()).toString();
-  expect(callback?.trim()).toBe(expectedCallback);
-  try {
-    await dialog.locator("#social-id").fill("test-client-id");
-    await dialog.locator("#social-secret").fill("test-secret");
-    await dialog.getByRole("button", { name: "Save", exact: true }).click();
-    // Save returns to the list view, where the new provider row has an enable switch.
-    await expect(dialog.getByRole("switch").first()).toBeVisible();
-    const saved = await (await page.request.get("/api/account/auth-config")).json();
-    expect(saved.social[providerId].redirectURI).toBe(expectedCallback);
-  } finally {
-    if (providerId) {
-      await page.request
-        .put("/api/account/auth-config", { data: { social: { [providerId]: { delete: true } } } })
-        .catch(() => undefined);
+    await addBtn.click();
+    const provider = dialog.locator("#social-provider");
+    await expect(provider).toBeVisible();
+    const callback = await dialog.locator("code").textContent();
+    const providerId = callback?.trim().split("/").pop() ?? ""; // first addable provider (not hard-coded)
+    expect(providerId).not.toBe("");
+    const expectedCallback = new URL(`/api/auth/callback/${providerId}`, page.url()).toString();
+    expect(callback?.trim()).toBe(expectedCallback);
+    try {
+      await dialog.locator("#social-id").fill("test-client-id");
+      await dialog.locator("#social-secret").fill("test-secret");
+      await dialog.getByRole("button", { name: "Save", exact: true }).click();
+      // Save returns to the list view, where the new provider row has an enable switch.
+      await expect(dialog.getByRole("switch").first()).toBeVisible();
+      const saved = await (await page.request.get("/api/account/auth-config")).json();
+      expect(saved.social[providerId].redirectURI).toBe(expectedCallback);
+    } finally {
+      if (providerId) {
+        await page.request
+          .put("/api/account/auth-config", { data: { social: { [providerId]: { delete: true } } } })
+          .catch(() => undefined);
+      }
     }
-  }
+  });
 });
 
 test("settings: open and save the SMTP dialog", async ({ page }) => {
@@ -71,31 +75,34 @@ test("settings: open and save the SMTP dialog", async ({ page }) => {
 });
 
 test("settings: configure automatic logout", async ({ page }) => {
-  await page.request.put("/api/account/auth-config", {
-    data: { server: { sessionIdleTimeoutMinutes: null } },
-  });
-  await ready(page, "/admin/settings");
-  await page.getByRole("tab", { name: "Authentication" }).click();
+  test.slow();
+  await exclusive("session-idle-timeout", async () => {
+    await page.request.put("/api/account/auth-config", {
+      data: { server: { sessionIdleTimeoutMinutes: null } },
+    });
+    await ready(page, "/admin/settings");
+    await page.getByRole("tab", { name: "Authentication" }).click();
 
-  const toggle = page.getByRole("switch", { name: "Automatic logout" });
-  await expect(toggle).not.toBeChecked();
-  await toggle.click();
-  await expect(toggle).toBeChecked();
+    const toggle = page.getByRole("switch", { name: "Automatic logout" });
+    await expect(toggle).not.toBeChecked();
+    await toggle.click();
+    await expect(toggle).toBeChecked();
 
-  const card = page
-    .getByText("Automatic logout", { exact: true })
-    .locator('xpath=ancestor::div[@data-slot="card"]');
-  await card.getByRole("button", { name: "Configure" }).click();
-  const dialog = page.getByRole("dialog");
-  await dialog.getByLabel("Idle time (minutes)").fill("45");
-  await dialog.getByRole("button", { name: "Save", exact: true }).click();
-  await expect(page.getByText("45 min", { exact: true })).toBeVisible();
+    const card = page
+      .getByText("Automatic logout", { exact: true })
+      .locator('xpath=ancestor::div[@data-slot="card"]');
+    await card.getByRole("button", { name: "Configure" }).click();
+    const dialog = page.getByRole("dialog");
+    await dialog.getByLabel("Idle time (minutes)").fill("45");
+    await dialog.getByRole("button", { name: "Save", exact: true }).click();
+    await expect(page.getByText("45 min", { exact: true })).toBeVisible();
 
-  const saved = await (await page.request.get("/api/account/auth-config")).json();
-  expect(saved.server.sessionIdleTimeoutMinutes).toBe(45);
-  const caps = await (await page.request.get("/api/account/capabilities")).json();
-  expect(caps.sessionIdleTimeoutMinutes).toBe(45);
+    const saved = await (await page.request.get("/api/account/auth-config")).json();
+    expect(saved.server.sessionIdleTimeoutMinutes).toBe(45);
+    const caps = await (await page.request.get("/api/account/capabilities")).json();
+    expect(caps.sessionIdleTimeoutMinutes).toBe(45);
 
-  await toggle.click();
-  await expect(toggle).not.toBeChecked();
+    await toggle.click();
+    await expect(toggle).not.toBeChecked();
+  });
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test, type Page } from "@playwright/test";
 import { ready } from "../helpers/hydration";
+import { exclusive } from "../helpers/exclusive";
 
 // admin storageState (project default)
 
@@ -30,16 +31,19 @@ test("general settings: shows the favicon uploader", async ({ page }) => {
 });
 
 test("general settings: edit the site name, save, and apply live", async ({ page }) => {
-  await ready(page, "/admin/settings");
-  const name = page.getByLabel("Site name");
-  const original = await name.inputValue();
-  await name.fill("PodoKit Test Site");
-  await saveGeneral(page);
-  // the browser tab title reflects the new name live (no reload)
-  await expect(page).toHaveTitle("PodoKit Test Site");
-  // restore so other specs start clean
-  await name.fill(original);
-  await saveGeneral(page);
+  test.slow();
+  await exclusive("site-general", async () => {
+    await ready(page, "/admin/settings");
+    const name = page.getByLabel("Site name");
+    const original = await name.inputValue();
+    await name.fill("PodoKit Test Site");
+    await saveGeneral(page);
+    // the browser tab title reflects the new name live (no reload)
+    await expect(page).toHaveTitle("PodoKit Test Site");
+    // restore so other specs start clean
+    await name.fill(original);
+    await saveGeneral(page);
+  });
 });
 
 test("settings lists the auth features under the Authentication tab", async ({ page }) => {
@@ -69,18 +73,21 @@ test("settings is reachable from the sidebar", async ({ page }) => {
 });
 
 test("admin can toggle a feature flag and it applies live @smoke", async ({ page }) => {
-  await ready(page, "/admin/settings");
-  await page.getByRole("tab", { name: "Authentication" }).click();
-  const toggle = page.getByRole("switch", { name: "Magic link" });
-  test.skip((await toggle.count()) === 0, "magic link toggle not present");
-  // Serial workers (workers:1) make toggle-then-restore safe for other specs.
-  await expect(toggle).toBeChecked();
-  await toggle.click();
-  await expect(page.getByText("Setting updated")).toBeVisible();
-  await expect(toggle).not.toBeChecked(); // capabilities refreshed live
-  // restore so the shared magic-link/2FA specs keep their expected state
-  await toggle.click();
-  await expect(toggle).toBeChecked();
+  test.slow();
+  await exclusive("magic-link", async () => {
+    await ready(page, "/admin/settings");
+    await page.getByRole("tab", { name: "Authentication" }).click();
+    const toggle = page.getByRole("switch", { name: "Magic link" });
+    test.skip((await toggle.count()) === 0, "magic link toggle not present");
+    // The magic-link lock keeps the API spec that toggles the same flag out.
+    await expect(toggle).toBeChecked();
+    await toggle.click();
+    await expect(page.getByText("Setting updated")).toBeVisible();
+    await expect(toggle).not.toBeChecked(); // capabilities refreshed live
+    // restore so the shared magic-link/2FA specs keep their expected state
+    await toggle.click();
+    await expect(toggle).toBeChecked();
+  });
 });
 
 test("settings: the require-two-factor toggle is available", async ({ page }) => {
@@ -95,68 +102,71 @@ test("settings: the require-two-factor toggle is available", async ({ page }) =>
 });
 
 test("inactive browser sessions are signed out automatically @smoke", async ({ browser, page: adminPage }) => {
-  // Idle sign-out revokes the active server session. Use a dedicated login so
-  // this test cannot invalidate the shared admin storageState used by later specs.
-  const context = await browser.newContext({ baseURL: base });
-  const page = await context.newPage();
-  const email = `idle-admin-${Date.now()}@example.com`;
-  let signOutRequests = 0;
-  let userId = "";
-  try {
-    const created = await adminPage.request.post("/api/auth/admin/create-user", {
-      headers: { origin: base },
-      data: { email, password: "Podokit3e-Str0ng!pw", name: "Idle Admin", role: "admin" },
-    });
-    expect(created.ok()).toBeTruthy();
-    userId = ((await created.json()).user?.id ?? "") as string;
-    expect(userId).toBeTruthy();
-
-    const signIn = await context.request.post("/api/auth/sign-in/email", {
-      headers: { origin: base },
-      data: { email, password: "Podokit3e-Str0ng!pw" },
-    });
-    expect(signIn.ok()).toBeTruthy();
-
-    const configured = await context.request.put("/api/account/auth-config", {
-      data: { server: { sessionIdleTimeoutMinutes: 5 } },
-    });
-    expect(configured.ok()).toBeTruthy();
-    await page.route("**/api/auth/sign-out", async (route) => {
-      signOutRequests += 1;
-      await route.fulfill({ status: 200, contentType: "application/json", body: '{"success":true}' });
-    });
-    await page.clock.install();
-
+  test.slow();
+  await exclusive("session-idle-timeout", async () => {
+    // Idle sign-out revokes the active server session. Use a dedicated login so
+    // this test cannot invalidate the shared admin storageState used by later specs.
+    const context = await browser.newContext({ baseURL: base });
+    const page = await context.newPage();
+    const email = `idle-admin-${Date.now()}@example.com`;
+    let signOutRequests = 0;
+    let userId = "";
     try {
-      await ready(page, "/admin");
-      await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
-    } finally {
-      // Keep the loaded page policy at five minutes while restoring the shared
-      // DB policy before the isolated session is revoked.
-      const restored = await context.request.put("/api/account/auth-config", {
-        data: { server: { sessionIdleTimeoutMinutes: null } },
+      const created = await adminPage.request.post("/api/auth/admin/create-user", {
+        headers: { origin: base },
+        data: { email, password: "Podokit3e-Str0ng!pw", name: "Idle Admin", role: "admin" },
       });
-      expect(restored.ok()).toBeTruthy();
-    }
+      expect(created.ok()).toBeTruthy();
+      userId = ((await created.json()).user?.id ?? "") as string;
+      expect(userId).toBeTruthy();
 
-    const removed = await adminPage.request.post("/api/auth/admin/remove-user", {
-      headers: { origin: base },
-      data: { userId },
-    });
-    expect(removed.ok()).toBeTruthy();
-    userId = "";
-
-    await page.clock.fastForward(5 * 60_000 + 1_000);
-    await expect.poll(() => signOutRequests).toBe(1);
-    await expect(page).toHaveURL(/\/login\?reason=idle$/);
-    await expect(page.getByTestId("session-timeout-message")).toBeVisible();
-  } finally {
-    if (userId) {
-      await adminPage.request.post("/api/auth/admin/remove-user", {
+      const signIn = await context.request.post("/api/auth/sign-in/email", {
+        headers: { origin: base },
+        data: { email, password: "Podokit3e-Str0ng!pw" },
+      });
+      expect(signIn.ok()).toBeTruthy();
+
+      const configured = await context.request.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: 5 } },
+      });
+      expect(configured.ok()).toBeTruthy();
+      await page.route("**/api/auth/sign-out", async (route) => {
+        signOutRequests += 1;
+        await route.fulfill({ status: 200, contentType: "application/json", body: '{"success":true}' });
+      });
+      await page.clock.install();
+
+      try {
+        await ready(page, "/admin");
+        await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
+      } finally {
+        // Keep the loaded page policy at five minutes while restoring the shared
+        // DB policy before the isolated session is revoked.
+        const restored = await context.request.put("/api/account/auth-config", {
+          data: { server: { sessionIdleTimeoutMinutes: null } },
+        });
+        expect(restored.ok()).toBeTruthy();
+      }
+
+      const removed = await adminPage.request.post("/api/auth/admin/remove-user", {
         headers: { origin: base },
         data: { userId },
       });
+      expect(removed.ok()).toBeTruthy();
+      userId = "";
+
+      await page.clock.fastForward(5 * 60_000 + 1_000);
+      await expect.poll(() => signOutRequests).toBe(1);
+      await expect(page).toHaveURL(/\/login\?reason=idle$/);
+      await expect(page.getByTestId("session-timeout-message")).toBeVisible();
+    } finally {
+      if (userId) {
+        await adminPage.request.post("/api/auth/admin/remove-user", {
+          headers: { origin: base },
+          data: { userId },
+        });
+      }
+      await context.close();
     }
-    await context.close();
-  }
+  });
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/two-factor.ui.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test, type Page } from "@playwright/test";
 import { ADMIN, USER, anonState } from "../helpers/accounts";
 import { totpCode } from "../helpers/totp";
+import { exclusive } from "../helpers/exclusive";
 
 test.use({ storageState: anonState });
 
@@ -85,58 +86,61 @@ test("two-factor: sign in with an authenticator code from the login page", async
 });
 
 test("require-2fa: a new sign-up is forced through the enrolment page", async ({ page, playwright }) => {
-  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const caps = await (await admin.get("/api/account/capabilities")).json();
-  test.skip(!caps?.twoFactor, "two-factor not enabled");
-  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
-
-  const email = `rq-ui-${Date.now()}@example.com`;
-  const pw = "Podokit3e-Str0ng!pw";
-  try {
-    await admin.put("/api/account/settings", { data: { require2fa: true } });
-    // A fresh un-enrolled user; poll (via API) until the guard cache picks up the policy.
-    const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    await probe.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RQUI" } });
-    await expect(async () => {
-      expect((await probe.get("/api/account/me")).status()).toBe(403);
-    }).toPass({ timeout: 8000 });
-    await probe.dispose();
-
-    // Signing in toward a protected route lands on the mandatory enrolment page.
-    await openHydratedLogin(page, "/account");
-    await page.getByLabel("Email").fill(email);
-    await page.getByLabel("Password").fill(pw);
-    await page.getByRole("button", { name: "Sign in", exact: true }).click();
-    await expect(page).toHaveURL(/\/setup-2fa/);
-
-    // Complete enrolment entirely through the UI: password → QR + backup codes →
-    // authenticator code → activate. The code is computed from the on-page URI.
-    await page.getByLabel("Confirm your password").fill(pw);
-    await page.getByRole("button", { name: "Continue" }).click();
-    await expect(page.getByTestId("backup-codes")).toBeVisible();
-    await expect(page.getByRole("button", { name: "Download" })).toBeVisible();
-    const uri = (await page.locator("code").first().innerText()).trim();
-    await page.getByRole("checkbox").click();
-    await page.getByLabel("3. Enter the 6-digit code").fill(totpCode(uri));
-    await page.getByRole("button", { name: "Activate and continue" }).click();
-
-    // Enrolled → the gate lets the regular user into their account page.
-    await expectAccountPage(page);
-
-    // An enrolled user who revisits setup is returned to the same non-admin page.
-    await page.goto("/setup-2fa");
-    await expectAccountPage(page);
-  } finally {
-    await admin.put("/api/account/settings", { data: { require2fa: false } });
-    await expect(async () => {
+  test.slow();
+  await exclusive("require2fa", async () => {
+    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const caps = await (await admin.get("/api/account/capabilities")).json();
+    test.skip(!caps?.twoFactor, "two-factor not enabled");
+    await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+
+    const email = `rq-ui-${Date.now()}@example.com`;
+    const pw = "Podokit3e-Str0ng!pw";
+    try {
+      await admin.put("/api/account/settings", { data: { require2fa: true } });
+      // A fresh un-enrolled user; poll (via API) until the guard cache picks up the policy.
       const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-      await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
-      const status = (await probe.get("/api/account/me")).status();
+      await probe.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RQUI" } });
+      await expect(async () => {
+        expect((await probe.get("/api/account/me")).status()).toBe(403);
+      }).toPass({ timeout: 8000 });
       await probe.dispose();
-      expect(status).toBe(200);
-    }).toPass({ timeout: 8000 });
-    await admin.dispose();
-  }
+
+      // Signing in toward a protected route lands on the mandatory enrolment page.
+      await openHydratedLogin(page, "/account");
+      await page.getByLabel("Email").fill(email);
+      await page.getByLabel("Password").fill(pw);
+      await page.getByRole("button", { name: "Sign in", exact: true }).click();
+      await expect(page).toHaveURL(/\/setup-2fa/);
+
+      // Complete enrolment entirely through the UI: password → QR + backup codes →
+      // authenticator code → activate. The code is computed from the on-page URI.
+      await page.getByLabel("Confirm your password").fill(pw);
+      await page.getByRole("button", { name: "Continue" }).click();
+      await expect(page.getByTestId("backup-codes")).toBeVisible();
+      await expect(page.getByRole("button", { name: "Download" })).toBeVisible();
+      const uri = (await page.locator("code").first().innerText()).trim();
+      await page.getByRole("checkbox").click();
+      await page.getByLabel("3. Enter the 6-digit code").fill(totpCode(uri));
+      await page.getByRole("button", { name: "Activate and continue" }).click();
+
+      // Enrolled → the gate lets the regular user into their account page.
+      await expectAccountPage(page);
+
+      // An enrolled user who revisits setup is returned to the same non-admin page.
+      await page.goto("/setup-2fa");
+      await expectAccountPage(page);
+    } finally {
+      await admin.put("/api/account/settings", { data: { require2fa: false } });
+      await expect(async () => {
+        const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+        await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
+        const status = (await probe.get("/api/account/me")).status();
+        await probe.dispose();
+        expect(status).toBe(200);
+      }).toPass({ timeout: 8000 });
+      await admin.dispose();
+    }
+  });
 });
 
 test("account: regenerate backup codes shows a fresh set", async ({ page, playwright }) => {