@podosoft/podokit 1.4.1 → 1.5.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-page.svelte

@@ -11,6 +11,8 @@
   import { deviceLabel } from "#lib/device-label.js";
   import { toast } from "svelte-sonner";
   import { api } from "#lib/api.js";
+  import { listAccountSessions, revokeAccountSession, type AccountSession } from "#lib/account-sessions.js";
+  import { KeysetPages } from "#lib/admin/sessions.js";
   import { getI18n, fmt, formatDateTime } from "#lib/i18n/index.js";
   import { untrack } from "svelte";
   import type { SessionUser } from "../../app.d.ts";
@@ -392,28 +394,34 @@
     await goto("/login", { invalidateAll: true });
   }
 
-  // Sessions — this user's own devices
-  /** better-auth's code for "this session is older than `session.freshAge`". */
+  // Sessions — this user's own devices. The API pages them, because Better Auth's
+  // /list-sessions returns at most 100 and could leave out the current one.
+  /** Better Auth's code for "this session is older than `session.freshAge`". */
   const SESSION_NOT_FRESH = "SESSION_NOT_FRESH";
-  type Session = { id: string; token: string; userAgent?: string | null; ipAddress?: string | null; createdAt: string | Date };
+  type Session = AccountSession & { current: boolean };
   const PAGE_SIZE = DEFAULT_PAGE_SIZE;
+  // The API pages newest first by keyset, so the order is fixed rather than sortable.
+  const sessionsSort: SortState = { key: "createdAt", dir: "desc" };
+  const sessionPages = new KeysetPages();
   let sessions = $state<Session[]>([]);
+  let sessionsTotal = $state(0);
+  let sessionsPagerTotal = $state(0);
   let sessionsPage = $state(1);
-  let sessionsSort = $state<SortState | null>(null);
   let busy = $state(false);
+  let latestSessionsRequest = 0;
   const sessionsColumns: DataTableColumn<Session>[] = [
-    { key: "userAgent", label: i18n.t.sessions.device, sortable: true, value: (s) => deviceLabel(s.userAgent) ?? s.userAgent ?? "" },
-    { key: "ipAddress", label: i18n.t.sessions.ip, sortable: true, value: (s) => s.ipAddress ?? "" },
-    { key: "createdAt", label: i18n.t.sessions.since, sortable: true, value: (s) => new Date(s.createdAt).getTime() },
+    { key: "userAgent", label: i18n.t.sessions.device },
+    { key: "ipAddress", label: i18n.t.sessions.ip },
+    { key: "createdAt", label: i18n.t.sessions.since },
     { key: "status", label: i18n.t.sessions.status },
     { key: "actions", label: "", class: "w-10" },
   ];
   /**
    * True when the session is too old to list sessions.
    *
-   * better-auth guards `/list-sessions` (and `/unlink-account`) with its freshness
-   * middleware, and `session.freshAge` defaults to 24 hours. So for anyone who signed
-   * in yesterday — which is most people, most of the time — this call returns 403
+   * The API keeps better-auth's freshness rule for listing sessions, and
+   * `session.freshAge` defaults to 24 hours. So for anyone who signed in yesterday —
+   * which is most people, most of the time — the list answers 403
    * `SESSION_NOT_FRESH`. It is not a failure to report as one: the tab has to say what
    * happened and what to do, or it is a blank table under an untranslated toast.
    */
@@ -423,32 +431,45 @@
     await api.auth.signOut();
     await goto("/login", { invalidateAll: true });
   }
-  async function loadSessions(): Promise<void> {
-    const { data: res, error } = await api.auth.listSessions();
-    if (error?.code === SESSION_NOT_FRESH) {
-      // Explained in the panel below, not thrown at the corner of the screen.
-      sessionsStale = true;
-      sessions = [];
-      return;
+  /** Loads one page; the current session leads the first. A newer request supersedes any in flight. */
+  async function loadSessions(target = 1): Promise<void> {
+    if (target === 1) sessionPages.reset();
+    const cursor = sessionPages.cursorFor(target);
+    if (cursor === undefined) return;
+    const request = ++latestSessionsRequest;
+    try {
+      const result = await listAccountSessions(api, { limit: PAGE_SIZE, cursor });
+      if (request !== latestSessionsRequest) return;
+      // A revoke can empty the last page; show the one before it instead.
+      if (result.items.length === 0 && target > 1) return loadSessions(target - 1);
+      sessionsStale = false;
+      sessionPages.record(target, result.nextCursor);
+      const others = result.items.map((s) => ({ ...s, current: false }));
+      sessions = target === 1 && result.current ? [{ ...result.current, current: true }, ...others] : others;
+      sessionsTotal = result.total;
+      sessionsPagerTotal = sessionPages.pagerTotal(result.total - (result.current ? 1 : 0), PAGE_SIZE);
+      sessionsPage = target;
+    } catch (error) {
+      if (request !== latestSessionsRequest) return;
+      if (error instanceof ApiError && error.code === SESSION_NOT_FRESH) {
+        // Explained in the panel below, not thrown at the corner of the screen.
+        sessionsStale = true;
+        sessions = [];
+        return;
+      }
+      toast.error(i18n.t.sessions.loadFailed);
     }
-    sessionsStale = false;
-    if (error) return void toast.error(error.message ?? i18n.t.sessions.loadFailed);
-    // Current session first (users expect it on top; also keeps it on page 1),
-    // then newest to oldest.
-    sessions = ((res ?? []) as Session[]).sort((a, b) => {
-      if (a.id === data.currentSessionId) return -1;
-      if (b.id === data.currentSessionId) return 1;
-      return new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime();
-    });
   }
-  async function revoke(token: string): Promise<void> {
+  async function revoke(id: string): Promise<void> {
     busy = true;
-    const { error } = await api.auth.revokeSession({ token });
-    busy = false;
-    if (error) toast.error(error.message ?? i18n.t.sessions.revokeFailed);
-    else {
+    try {
+      await revokeAccountSession(api, id);
       toast.success(i18n.t.sessions.revoked);
-      await loadSessions();
+      await loadSessions(sessionsPage);
+    } catch {
+      toast.error(i18n.t.sessions.revokeFailed);
+    } finally {
+      busy = false;
     }
   }
   async function signOutOthers(): Promise<void> {
@@ -824,7 +845,7 @@
         <Card.Root>
           <Card.Header class="flex flex-row items-center justify-between gap-2">
             <Card.Title>{i18n.t.sessions.title}</Card.Title>
-            <Button variant="outline" size="sm" disabled={busy || sessionsStale || sessions.length <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
+            <Button variant="outline" size="sm" disabled={busy || sessionsStale || sessionsTotal <= 1} onclick={signOutOthers}>{i18n.t.sessions.signOutOthers}</Button>
           </Card.Header>
           <Card.Content>
             {#if sessionsStale}
@@ -843,20 +864,23 @@
               columns={sessionsColumns}
               rows={sessions}
               getKey={(s) => s.id}
-              bind:sort={sessionsSort}
+              sort={sessionsSort}
+              manualSort
+              manualPagination
               bind:page={sessionsPage}
               perPage={PAGE_SIZE}
-              label={fmt(i18n.t.sessions.total, { count: sessions.length })}
+              total={sessionsPagerTotal}
+              label={fmt(i18n.t.sessions.total, { count: sessionsTotal })}
               empty={i18n.t.sessions.empty}
+              onChange={(state) => void loadSessions(state.page)}
             >
               {#snippet row(s)}
-                {@const isCurrent = s.id === data.currentSessionId}
                 <Table.Cell class="max-w-xs truncate" title={s.userAgent ?? ""}>{deviceLabel(s.userAgent) ?? s.userAgent ?? i18n.t.sessions.unknown}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{s.ipAddress ?? "—"}</Table.Cell>
                 <Table.Cell class="text-muted-foreground">{formatDateTime(s.createdAt)}</Table.Cell>
-                <Table.Cell>{#if isCurrent}<Badge>{i18n.t.sessions.current}</Badge>{/if}</Table.Cell>
+                <Table.Cell>{#if s.current}<Badge>{i18n.t.sessions.current}</Badge>{/if}</Table.Cell>
                 <Table.Cell>
-                  <Button variant="ghost" size="sm" disabled={busy || isCurrent} onclick={() => revoke(s.token)}>{i18n.t.sessions.revoke}</Button>
+                  <Button variant="ghost" size="sm" disabled={busy || s.current} onclick={() => revoke(s.id)}>{i18n.t.sessions.revoke}</Button>
                 </Table.Cell>
               {/snippet}
             </DataTable>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/table-toolbar.svelte

@@ -86,7 +86,9 @@
       {:else}
         <Label class="text-sm" for="toolbar-search">{searchFields[0].label}</Label>
       {/if}
-      <Input id="toolbar-search" bind:value={search} placeholder={searchPlaceholder} class="max-w-xs flex-1" />
+      <!-- The minimum width makes a narrow row wrap the input to its own line
+           instead of squeezing it next to the field select. -->
+      <Input id="toolbar-search" bind:value={search} placeholder={searchPlaceholder} class="min-w-48 max-w-xs flex-1" />
       <Button type="submit">{searchButton}</Button>
     </form>
   {/if}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/runtime-context.test.ts

@@ -61,6 +61,12 @@ describe("needsRuntimeContext", () => {
     expect(needsRuntimeContext(request("/apiary", { headers: { accept: NAVIGATION } }))).toBe(true);
   });
 
+  it("skips them for the web server's health route, which must answer while the API is down", () => {
+    expect(needsRuntimeContext(request("/healthz", { headers: { accept: "*/*" } }))).toBe(false);
+    expect(needsRuntimeContext(request("/healthz", { headers: { accept: NAVIGATION } }))).toBe(false);
+    expect(needsRuntimeContext(request("/healthz/extra", { routeId: null, headers: { accept: NAVIGATION } }))).toBe(true);
+  });
+
   it("skips them while prerendering", () => {
     expect(needsRuntimeContext(request("/pricing", { headers: { accept: NAVIGATION } }), { building: true })).toBe(false);
   });

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/server/runtime-context.ts

@@ -1,5 +1,8 @@
 import { APP_ASSET_PATHS } from "./asset-paths";
 
+/** The web server's own health route (`routes/healthz/+server.ts`), which never calls the API. */
+const WEB_HEALTH_PATH = "/healthz";
+
 /** The request fields that decide whether a response can use the session and site settings. */
 export interface RuntimeContextRequest {
   url: URL;
@@ -92,6 +95,8 @@ export function needsRuntimeContext(
   const { pathname } = event.url;
   // The backend proxy forwards the cookies; the API resolves the session itself.
   if (underPrefix(pathname, "/api")) return false;
+  // The web server's health route answers the probes even while the API is down.
+  if (pathname === WEB_HEALTH_PATH) return false;
   // Remote functions run application code that may read the session.
   if (event.isRemoteRequest) return true;
   if (event.route.id === null) {

package/dist/templates/modules/admin-dashboard/files/tests/api/account-sessions.api.spec.ts

@@ -0,0 +1,55 @@
+import { signInOnSeparateDevices } from "../helpers/devices";
+import { expect, test } from "../helpers/disposable-users";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+type Page = {
+  current: { id: string } | null;
+  items: Array<{ id: string }>;
+  nextCursor: string | null;
+  total: number;
+};
+
+test("account sessions page the user's own sessions and revoke one by id", async ({ playwright, disposableUsers }) => {
+  const email = `api-account-sessions-${Date.now()}@example.com`;
+  const password = "Podokit3e-Str0ng!pw";
+  await disposableUsers.create({ email, password, name: "Account sessions" });
+  expect(await signInOnSeparateDevices(email, password, 4)).toEqual([200, 200, 200, 200]);
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  const current = (await (await ctx.get("/api/auth/get-session")).json()) as { session: { id: string } };
+
+  const first = await ctx.get("/api/account/sessions?limit=2");
+  expect(first.ok()).toBeTruthy();
+  const firstText = await first.text();
+  expect(firstText).not.toContain("token");
+  const page1 = JSON.parse(firstText) as Page;
+  expect(page1.current?.id).toBe(current.session.id);
+  expect(page1.total).toBe(5);
+  expect(page1.items).toHaveLength(2);
+  expect(page1.nextCursor).toBeTruthy();
+  const page2 = (await (await ctx.get(`/api/account/sessions?limit=2&cursor=${encodeURIComponent(page1.nextCursor ?? "")}`)).json()) as Page;
+  expect(page2.current?.id).toBe(current.session.id);
+  expect(page2.nextCursor).toBeNull();
+  const ids = [...page1.items, ...page2.items].map((item) => item.id);
+  expect(new Set(ids).size).toBe(4);
+  expect(ids).not.toContain(current.session.id);
+
+  // Another user's session cannot be revoked through this endpoint.
+  const otherEmail = `api-account-sessions-other-${Date.now()}@example.com`;
+  await disposableUsers.create({ email: otherEmail, password, name: "Other user" });
+  const otherUser = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await otherUser.post("/api/auth/sign-in/email", { data: { email: otherEmail, password } })).ok()).toBeTruthy();
+  const otherSession = (await (await otherUser.get("/api/auth/get-session")).json()) as { session: { id: string } };
+  const foreign = await ctx.delete(`/api/account/sessions/${encodeURIComponent(otherSession.session.id)}`);
+  expect(foreign.status()).toBe(404);
+  expect(await foreign.json()).toMatchObject({ error: { code: "ACCOUNT_SESSION_NOT_FOUND" } });
+  expect((await otherUser.get("/api/auth/get-session")).ok()).toBeTruthy();
+  await otherUser.dispose();
+
+  const revoked = await ctx.delete(`/api/account/sessions/${encodeURIComponent(ids[0] ?? "")}`);
+  expect(revoked.status()).toBe(204);
+  expect(((await (await ctx.get("/api/account/sessions?limit=2")).json()) as Page).total).toBe(4);
+  await ctx.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -4,6 +4,7 @@ import {
   isUserCreationAllowed,
 } from "../../apps/api/src/auth/feature-gate";
 import { ADMIN } from "../helpers/accounts";
+import { exclusive } from "../helpers/exclusive";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -17,62 +18,68 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
 }
 
 test("admin can enable Google OAuth from the DB and it applies without a restart", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const social = () => anon.post("/api/auth/sign-in/social", { data: { provider: "google", callbackURL: `${base}/admin` } });
-
-  // Before: provider not configured.
-  await expect.poll(async () => (await social()).status(), { timeout: 8000 }).toBe(404);
-
-  // Paste credentials via the admin API.
-  const put = await admin.put("/api/account/auth-config", {
-    data: { social: { google: { enabled: true, clientId: "dummy-google-client-id", clientSecret: "dummy-google-client-secret" } } },
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const admin = await adminCtx(playwright);
+    await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const social = () => anon.post("/api/auth/sign-in/social", { data: { provider: "google", callbackURL: `${base}/admin` } });
+
+    // Before: provider not configured.
+    await expect.poll(async () => (await social()).status(), { timeout: 8000 }).toBe(404);
+
+    // Paste credentials via the admin API.
+    const put = await admin.put("/api/account/auth-config", {
+      data: { social: { google: { enabled: true, clientId: "dummy-google-client-id", clientSecret: "dummy-google-client-secret" } } },
+    });
+    expect(put.ok()).toBeTruthy();
+    const view = await put.json();
+    expect(view.social.google.enabled).toBe(true);
+    expect(view.social.google.hasSecret).toBe(true);
+    expect(view.social.google.clientId).toBe("dummy-google-client-id");
+    expect("clientSecret" in view.social.google).toBe(false); // secret is never returned
+
+    // Applied live (no restart): social sign-in now redirects to Google.
+    await expect
+      .poll(async () => {
+        const r = await social();
+        return r.ok() ? (((await r.json())?.url as string) ?? "") : "";
+      }, { timeout: 8000 })
+      .toContain("accounts.google.com");
+    const caps = await (await anon.get("/api/account/capabilities")).json();
+    expect(caps.providers).toContain("google");
+
+    await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // restore
+    await anon.dispose();
+    await admin.dispose();
   });
-  expect(put.ok()).toBeTruthy();
-  const view = await put.json();
-  expect(view.social.google.enabled).toBe(true);
-  expect(view.social.google.hasSecret).toBe(true);
-  expect(view.social.google.clientId).toBe("dummy-google-client-id");
-  expect("clientSecret" in view.social.google).toBe(false); // secret is never returned
-
-  // Applied live (no restart): social sign-in now redirects to Google.
-  await expect
-    .poll(async () => {
-      const r = await social();
-      return r.ok() ? (((await r.json())?.url as string) ?? "") : "";
-    }, { timeout: 8000 })
-    .toContain("accounts.google.com");
-  const caps = await (await anon.get("/api/account/capabilities")).json();
-  expect(caps.providers).toContain("google");
-
-  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // restore
-  await anon.dispose();
-  await admin.dispose();
 });
 
 test("admin can add and remove a social provider dynamically", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  // The catalog offers providers beyond the two legacy env-backed ones.
-  const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
-  expect(catalog.map((c) => c.id)).toEqual(expect.arrayContaining(["google", "github", "apple"]));
+  test.slow();
+  await exclusive("social-providers", async () => {
+    const admin = await adminCtx(playwright);
+    // The catalog offers providers beyond the two legacy env-backed ones.
+    const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
+    expect(catalog.map((c) => c.id)).toEqual(expect.arrayContaining(["google", "github", "apple"]));
+
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const github = () => anon.post("/api/auth/sign-in/social", { data: { provider: "github", callbackURL: `${base}/admin` } });
+
+    // Add GitHub (a provider with no env fallback) → applies live, no restart.
+    await admin.put("/api/account/auth-config", { data: { social: { github: { enabled: true, clientId: "dummy-github-client-id", clientSecret: "dummy-github-client-secret" } } } });
+    await expect
+      .poll(async () => { const r = await github(); return r.ok() ? (((await r.json())?.url as string) ?? "") : ""; }, { timeout: 8000 })
+      .toContain("github.com");
+
+    // Remove it → the row is deleted and the provider stops working (again live).
+    await admin.put("/api/account/auth-config", { data: { social: { github: { delete: true } } } });
+    expect("github" in (await (await admin.get("/api/account/auth-config")).json()).social).toBe(false);
+    await expect.poll(async () => (await github()).status(), { timeout: 8000 }).toBe(404);
 
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const github = () => anon.post("/api/auth/sign-in/social", { data: { provider: "github", callbackURL: `${base}/admin` } });
-
-  // Add GitHub (a provider with no env fallback) → applies live, no restart.
-  await admin.put("/api/account/auth-config", { data: { social: { github: { enabled: true, clientId: "dummy-github-client-id", clientSecret: "dummy-github-client-secret" } } } });
-  await expect
-    .poll(async () => { const r = await github(); return r.ok() ? (((await r.json())?.url as string) ?? "") : ""; }, { timeout: 8000 })
-    .toContain("github.com");
-
-  // Remove it → the row is deleted and the provider stops working (again live).
-  await admin.put("/api/account/auth-config", { data: { social: { github: { delete: true } } } });
-  expect("github" in (await (await admin.get("/api/account/auth-config")).json()).social).toBe(false);
-  await expect.poll(async () => (await github()).status(), { timeout: 8000 }).toBe(404);
-
-  await anon.dispose();
-  await admin.dispose();
+    await anon.dispose();
+    await admin.dispose();
+  });
 });
 
 test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwright }) => {
@@ -85,43 +92,46 @@ test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwr
 });
 
 test("automatic logout validates and applies a sliding session lifetime", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const freshAdmin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-
-  try {
-    expect(
-      (await admin.put("/api/account/auth-config", {
-        data: { server: { sessionIdleTimeoutMinutes: 4 } },
-      })).status(),
-    ).toBe(400);
-
-    const enabled = await admin.put("/api/account/auth-config", {
-      data: { server: { sessionIdleTimeoutMinutes: 30 } },
-    });
-    expect(enabled.ok()).toBeTruthy();
-    expect((await enabled.json()).server.sessionIdleTimeoutMinutes).toBe(30);
-
-    const caps = await (await admin.get("/api/account/capabilities")).json();
-    expect(caps.sessionIdleTimeoutMinutes).toBe(30);
-
-    const signIn = await freshAdmin.post("/api/auth/sign-in/email", {
-      data: { email: ADMIN.email, password: ADMIN.password },
-    });
-    expect(signIn.ok()).toBeTruthy();
-    expect(signIn.headers()["set-cookie"]).toMatch(/Max-Age=1800(?:;|,)/i);
-
-    const sessions = (await (await admin.get("/api/auth/list-sessions")).json()) as Array<{
-      expiresAt: string;
-    }>;
-    const latestExpiry = Math.max(...sessions.map((session) => new Date(session.expiresAt).getTime()));
-    expect(latestExpiry).toBeLessThanOrEqual(Date.now() + 30 * 60_000 + 10_000);
-  } finally {
-    await admin.put("/api/account/auth-config", {
-      data: { server: { sessionIdleTimeoutMinutes: null } },
-    });
-    await freshAdmin.dispose();
-    await admin.dispose();
-  }
+  test.slow();
+  await exclusive("session-idle-timeout", async () => {
+    const admin = await adminCtx(playwright);
+    const freshAdmin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+
+    try {
+      expect(
+        (await admin.put("/api/account/auth-config", {
+          data: { server: { sessionIdleTimeoutMinutes: 4 } },
+        })).status(),
+      ).toBe(400);
+
+      const enabled = await admin.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: 30 } },
+      });
+      expect(enabled.ok()).toBeTruthy();
+      expect((await enabled.json()).server.sessionIdleTimeoutMinutes).toBe(30);
+
+      const caps = await (await admin.get("/api/account/capabilities")).json();
+      expect(caps.sessionIdleTimeoutMinutes).toBe(30);
+
+      const signIn = await freshAdmin.post("/api/auth/sign-in/email", {
+        data: { email: ADMIN.email, password: ADMIN.password },
+      });
+      expect(signIn.ok()).toBeTruthy();
+      expect(signIn.headers()["set-cookie"]).toMatch(/Max-Age=1800(?:;|,)/i);
+
+      const sessions = (await (await admin.get("/api/auth/list-sessions")).json()) as Array<{
+        expiresAt: string;
+      }>;
+      const latestExpiry = Math.max(...sessions.map((session) => new Date(session.expiresAt).getTime()));
+      expect(latestExpiry).toBeLessThanOrEqual(Date.now() + 30 * 60_000 + 10_000);
+    } finally {
+      await admin.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: null } },
+      });
+      await freshAdmin.dispose();
+      await admin.dispose();
+    }
+  });
 });
 
 test("new registrations require approval when the policy is enabled", async ({ playwright }) => {
@@ -204,75 +214,78 @@ test("new registrations require approval when the policy is enabled", async ({ p
 });
 
 test("closed public sign-up blocks new OAuth users but preserves existing sign-in", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const password = "Podokit3e-Str0ng!pw";
-  const adminCreatedEmail = `closed-admin-${Date.now()}@example.com`;
-  const initialSite = (await (await anon.get("/api/site/settings")).json()) as {
-    allowSignup?: string | null;
-  };
-  const initialAllowSignup = initialSite.allowSignup === "false" ? "false" : "true";
-  let adminCreatedId = "";
-
-  try {
-    expect(
-      (await admin.put("/api/account/auth-config", {
-        data: {
-          social: {
-            google: {
-              enabled: true,
-              clientId: "dummy-google-client-id",
-              clientSecret: "dummy-google-client-secret",
+  test.slow();
+  await exclusive(["site-general", "social-providers"], async () => {
+    const admin = await adminCtx(playwright);
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const password = "Podokit3e-Str0ng!pw";
+    const adminCreatedEmail = `closed-admin-${Date.now()}@example.com`;
+    const initialSite = (await (await anon.get("/api/site/settings")).json()) as {
+      allowSignup?: string | null;
+    };
+    const initialAllowSignup = initialSite.allowSignup === "false" ? "false" : "true";
+    let adminCreatedId = "";
+
+    try {
+      expect(
+        (await admin.put("/api/account/auth-config", {
+          data: {
+            social: {
+              google: {
+                enabled: true,
+                clientId: "dummy-google-client-id",
+                clientSecret: "dummy-google-client-secret",
+              },
             },
           },
-        },
-      })).ok(),
-    ).toBeTruthy();
-    expect((await admin.put("/api/site/settings", { data: { allowSignup: "false" } })).ok()).toBeTruthy();
+        })).ok(),
+      ).toBeTruthy();
+      expect((await admin.put("/api/site/settings", { data: { allowSignup: "false" } })).ok()).toBeTruthy();
 
-    // The site policy uses a short cache shared by sign-up requests and user
-    // creation hooks, so wait for the setting to become live.
-    await new Promise((resolve) => setTimeout(resolve, 3_200));
-
-    const signup = await anon.post("/api/auth/sign-up/email", {
-      data: {
-        email: `closed-${Date.now()}@example.com`,
-        password,
-        name: "Closed Registration",
-      },
-    });
-    expect(signup.status()).toBe(403);
-    expect((await signup.json()).code).toBe(PUBLIC_SIGNUP_DISABLED);
+      // The site policy uses a short cache shared by sign-up requests and user
+      // creation hooks, so wait for the setting to become live.
+      await new Promise((resolve) => setTimeout(resolve, 3_200));
 
-    // OAuth initiation must stay available for existing social users. Only a
-    // callback that attempts to create a new user is rejected by the DB hook.
-    const social = await anon.post("/api/auth/sign-in/social", {
-      data: { provider: "google", callbackURL: `${base}/` },
-    });
-    expect(social.ok()).toBeTruthy();
-    expect(((await social.json()).url as string)).toContain("accounts.google.com");
-    expect(isUserCreationAllowed(false, "/callback/google")).toBe(false);
-    expect(isUserCreationAllowed(false, undefined)).toBe(false);
-
-    // Deliberate administrator provisioning remains available while the public
-    // site is closed.
-    expect(isUserCreationAllowed(false, "/admin/create-user")).toBe(true);
-    const adminCreated = await admin.post("/api/auth/admin/create-user", {
-      data: { email: adminCreatedEmail, password, name: "Admin Created", role: "user" },
-    });
-    expect(adminCreated.ok()).toBeTruthy();
-    adminCreatedId = ((await adminCreated.json()).user as { id: string }).id;
-  } finally {
-    if (adminCreatedId) {
-      await admin.post("/api/auth/admin/remove-user", { data: { userId: adminCreatedId } });
+      const signup = await anon.post("/api/auth/sign-up/email", {
+        data: {
+          email: `closed-${Date.now()}@example.com`,
+          password,
+          name: "Closed Registration",
+        },
+      });
+      expect(signup.status()).toBe(403);
+      expect((await signup.json()).code).toBe(PUBLIC_SIGNUP_DISABLED);
+
+      // OAuth initiation must stay available for existing social users. Only a
+      // callback that attempts to create a new user is rejected by the DB hook.
+      const social = await anon.post("/api/auth/sign-in/social", {
+        data: { provider: "google", callbackURL: `${base}/` },
+      });
+      expect(social.ok()).toBeTruthy();
+      expect(((await social.json()).url as string)).toContain("accounts.google.com");
+      expect(isUserCreationAllowed(false, "/callback/google")).toBe(false);
+      expect(isUserCreationAllowed(false, undefined)).toBe(false);
+
+      // Deliberate administrator provisioning remains available while the public
+      // site is closed.
+      expect(isUserCreationAllowed(false, "/admin/create-user")).toBe(true);
+      const adminCreated = await admin.post("/api/auth/admin/create-user", {
+        data: { email: adminCreatedEmail, password, name: "Admin Created", role: "user" },
+      });
+      expect(adminCreated.ok()).toBeTruthy();
+      adminCreatedId = ((await adminCreated.json()).user as { id: string }).id;
+    } finally {
+      if (adminCreatedId) {
+        await admin.post("/api/auth/admin/remove-user", { data: { userId: adminCreatedId } });
+      }
+      await admin.put("/api/site/settings", { data: { allowSignup: initialAllowSignup } });
+      await admin.put("/api/account/auth-config", {
+        data: { social: { google: { enabled: false } } },
+      });
+      await new Promise((resolve) => setTimeout(resolve, 3_200));
+      await anon.get("/api/auth/get-session");
+      await anon.dispose();
+      await admin.dispose();
     }
-    await admin.put("/api/site/settings", { data: { allowSignup: initialAllowSignup } });
-    await admin.put("/api/account/auth-config", {
-      data: { social: { google: { enabled: false } } },
-    });
-    await new Promise((resolve) => setTimeout(resolve, 3_200));
-    await anon.get("/api/auth/get-session");
-    await anon.dispose();
-    await admin.dispose();
-  }
+  });
 });