@podosoft/podokit 1.4.1 → 1.5.0

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { createPublicKey, verify, type JsonWebKey } from "node:crypto";
 import { ADMIN, USER } from "../helpers/accounts";
+import { exclusive } from "../helpers/exclusive";
 import { clearSms, smsSinkReachable, waitForSmsOtp } from "../helpers/sms";
 import { totpCode } from "../helpers/totp";
 
@@ -144,46 +145,49 @@ test("two-factor: regenerating backup codes invalidates the old set", async ({ p
 });
 
 test("require-2fa: gates an un-enrolled user until they enrol", async ({ playwright }) => {
-  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const caps = await (await admin.get("/api/account/capabilities")).json();
-  test.skip(!caps?.twoFactor, "two-factor not enabled");
-  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
-
-  const user = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const email = `rq-${Date.now()}@example.com`;
-  const pw = "Podokit3e-Str0ng!pw";
-  await user.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RQ" } });
-
-  try {
-    // Turn the policy on (admin; the toggle endpoint is allow-listed by the guard).
-    await admin.put("/api/account/settings", { data: { require2fa: true } });
-    // Capabilities carry the same policy as the dedicated endpoint.
-    await expect(async () => {
-      expect((await (await admin.get("/api/account/capabilities")).json()).require2fa).toBe(true);
-      expect(await (await admin.get("/api/account/require-2fa")).json()).toEqual({ require2fa: true });
-    }).toPass({ timeout: 8000 });
-    // The guard caches for a few seconds — poll until the un-enrolled user is gated.
-    await expect(async () => {
-      expect((await user.get("/api/account/me")).status()).toBe(403);
-    }).toPass({ timeout: 8000 });
-
-    // Enrolling restores access.
-    const enable = await (await user.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
-    await user.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
-    expect((await user.get("/api/account/me")).status()).toBe(200);
-  } finally {
-    // Always turn it back off so the shared (un-enrolled) sessions aren't gated.
-    await admin.put("/api/account/settings", { data: { require2fa: false } });
-    await expect(async () => {
-      const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-      await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
-      const status = (await probe.get("/api/account/me")).status();
-      await probe.dispose();
-      expect(status).toBe(200);
-    }).toPass({ timeout: 8000 });
-    await admin.dispose();
-    await user.dispose();
-  }
+  test.slow();
+  await exclusive("require2fa", async () => {
+    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const caps = await (await admin.get("/api/account/capabilities")).json();
+    test.skip(!caps?.twoFactor, "two-factor not enabled");
+    await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+
+    const user = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const email = `rq-${Date.now()}@example.com`;
+    const pw = "Podokit3e-Str0ng!pw";
+    await user.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RQ" } });
+
+    try {
+      // Turn the policy on (admin; the toggle endpoint is allow-listed by the guard).
+      await admin.put("/api/account/settings", { data: { require2fa: true } });
+      // Capabilities carry the same policy as the dedicated endpoint.
+      await expect(async () => {
+        expect((await (await admin.get("/api/account/capabilities")).json()).require2fa).toBe(true);
+        expect(await (await admin.get("/api/account/require-2fa")).json()).toEqual({ require2fa: true });
+      }).toPass({ timeout: 8000 });
+      // The guard caches for a few seconds — poll until the un-enrolled user is gated.
+      await expect(async () => {
+        expect((await user.get("/api/account/me")).status()).toBe(403);
+      }).toPass({ timeout: 8000 });
+
+      // Enrolling restores access.
+      const enable = await (await user.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+      await user.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+      expect((await user.get("/api/account/me")).status()).toBe(200);
+    } finally {
+      // Always turn it back off so the shared (un-enrolled) sessions aren't gated.
+      await admin.put("/api/account/settings", { data: { require2fa: false } });
+      await expect(async () => {
+        const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+        await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
+        const status = (await probe.get("/api/account/me")).status();
+        await probe.dispose();
+        expect(status).toBe(200);
+      }).toPass({ timeout: 8000 });
+      await admin.dispose();
+      await user.dispose();
+    }
+  });
 });
 
 test("multi-session holds several accounts and switches between them", async ({ playwright }) => {
@@ -380,9 +384,39 @@ test("an organization can have a parent and manager members", async ({ playwrigh
   await ctx.dispose();
 });
 
-// OIDC discovery + the enabled/disabled behaviour is covered by the front-channel
-// test in tests/ui/oidc.ui.spec.ts (which owns toggling the oidcProvider flag), and
-// the server-side gate is covered generically by the feature-toggle test above.
+test("the OIDC provider's discovery and endpoints follow its setting", async ({ playwright }) => {
+  // The provider's metadata is answered before endpoint hooks run, so it needs its
+  // own check that "off" hides it. The lock keeps tests/ui/oidc.ui.spec.ts, which
+  // also toggles the provider, from running at the same time.
+  test.slow();
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const status = (path: string): Promise<number> => admin.get(path).then((r) => r.status());
+  const discovery = [
+    "/api/auth/.well-known/openid-configuration",
+    "/api/auth/.well-known/oauth-authorization-server",
+  ];
+  const allStatuses = (): Promise<number[]> =>
+    Promise.all([...discovery, "/api/auth/oauth2/authorize?client_id=probe"].map(status));
+
+  await exclusive("oidc-provider", async () => {
+    try {
+      expect((await admin.put("/api/account/settings", { data: { oidcProvider: false } })).ok()).toBeTruthy();
+      await expect.poll(allStatuses, { timeout: 8000 }).toEqual([404, 404, 404]);
+      // The jwt plugin's keys and session tokens are not part of the provider.
+      expect(await status("/api/auth/jwks")).toBe(200);
+
+      expect((await admin.put("/api/account/settings", { data: { oidcProvider: true } })).ok()).toBeTruthy();
+      await expect.poll(() => Promise.all(discovery.map(status)), { timeout: 8000 }).toEqual([200, 200]);
+      const metadata = await (await admin.get(discovery[0]!)).json();
+      expect(metadata.authorization_endpoint).toContain("/api/auth/oauth2/authorize");
+    } finally {
+      expect((await admin.put("/api/account/settings", { data: { oidcProvider: false } })).ok()).toBeTruthy();
+    }
+    await expect.poll(allStatuses, { timeout: 8000 }).toEqual([404, 404, 404]);
+  });
+  await admin.dispose();
+});
 
 test("only admins can change settings @smoke", async ({ playwright }) => {
   const userCtx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -393,24 +427,27 @@ test("only admins can change settings @smoke", async ({ playwright }) => {
 });
 
 test("disabling a feature blocks its endpoint server-side and re-enabling restores it @smoke", async ({ playwright }) => {
-  // Uses a fresh admin context (not the shared storageState) so it never rotates
-  // the seeded session. Toggles a flag and confirms the feature gate enforces it.
-  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
-  const caps = await (await admin.get("/api/account/capabilities")).json();
-  test.skip(!caps?.magicLink, "magic link not enabled");
+  test.slow();
+  await exclusive("magic-link", async () => {
+    // Uses a fresh admin context (not the shared storageState) so it never rotates
+    // the seeded session. Toggles a flag and confirms the feature gate enforces it.
+    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+    const caps = await (await admin.get("/api/account/capabilities")).json();
+    test.skip(!caps?.magicLink, "magic link not enabled");
 
-  // A disabled feature's endpoint 404s; the gate reads the flag through a short cache.
-  const status = (): Promise<number> =>
-    admin.post("/api/auth/sign-in/magic-link", { data: { email: "probe@example.com" } }).then((r) => r.status());
+    // A disabled feature's endpoint 404s; the gate reads the flag through a short cache.
+    const status = (): Promise<number> =>
+      admin.post("/api/auth/sign-in/magic-link", { data: { email: "probe@example.com" } }).then((r) => r.status());
 
-  expect((await admin.put("/api/account/settings", { data: { magicLink: false } })).ok()).toBeTruthy();
-  await expect.poll(status, { timeout: 8000 }).toBe(404);
+    expect((await admin.put("/api/account/settings", { data: { magicLink: false } })).ok()).toBeTruthy();
+    await expect.poll(status, { timeout: 8000 }).toBe(404);
 
-  expect((await admin.put("/api/account/settings", { data: { magicLink: true } })).ok()).toBeTruthy();
-  await expect.poll(status, { timeout: 8000 }).not.toBe(404);
+    expect((await admin.put("/api/account/settings", { data: { magicLink: true } })).ok()).toBeTruthy();
+    await expect.poll(status, { timeout: 8000 }).not.toBe(404);
 
-  await admin.dispose();
+    await admin.dispose();
+  });
 });
 
 test("sign-in with a wrong password is rejected", async ({ request }) => {

package/dist/templates/modules/admin-dashboard/files/tests/api/exclusive.api.spec.ts

@@ -0,0 +1,75 @@
+import { expect, test } from "@playwright/test";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, utimesSync, writeFileSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+import { exclusive, lockPath } from "../helpers/exclusive";
+
+// Checks the lock that specs changing shared settings hold. Names are unique per
+// run so these never wait on, or release, a lock a real spec holds.
+const unique = (label: string): string => `self-test-${label}-${process.pid}-${Date.now()}`;
+
+test("exclusive releases its locks when the body fails", async () => {
+  const first = unique("first");
+  const second = unique("second");
+  await expect(
+    exclusive([second, first], async () => {
+      expect(existsSync(lockPath(first))).toBe(true);
+      expect(existsSync(lockPath(second))).toBe(true);
+      throw new Error("body failed");
+    }),
+  ).rejects.toThrow("body failed");
+  expect(existsSync(lockPath(first))).toBe(false);
+  expect(existsSync(lockPath(second))).toBe(false);
+
+  // The next holder gets the lock without waiting.
+  const started = Date.now();
+  await exclusive(first, async () => undefined);
+  expect(Date.now() - started).toBeLessThan(1_000);
+});
+
+test("exclusive runs holders of one lock one at a time", async () => {
+  const name = unique("serial");
+  const events: string[] = [];
+  const hold = (id: string): Promise<void> =>
+    exclusive(name, async () => {
+      events.push(`${id} start`);
+      await new Promise((resolve) => setTimeout(resolve, 100));
+      events.push(`${id} end`);
+    });
+  await Promise.all([hold("a"), hold("b")]);
+  expect(events.map((event) => event.split(" ")[1])).toEqual(["start", "end", "start", "end"]);
+  expect(existsSync(lockPath(name))).toBe(false);
+});
+
+test("exclusive takes over a lock left by a run that was killed", async () => {
+  const name = unique("stale");
+  mkdirSync(lockPath(name));
+  const longAgo = new Date(Date.now() - 10 * 60_000);
+  utimesSync(lockPath(name), longAgo, longAgo);
+  await expect(exclusive(name, async () => "acquired")).resolves.toBe("acquired");
+  expect(existsSync(lockPath(name))).toBe(false);
+});
+
+test("exclusive takes over a lock whose holder exited, such as after Ctrl-C", async () => {
+  const name = unique("exited");
+  const exited = spawnSync(process.execPath, ["-e", ""]).pid;
+  mkdirSync(lockPath(name));
+  writeFileSync(join(lockPath(name), "owner"), String(exited));
+  const started = Date.now();
+  await expect(exclusive(name, async () => "acquired")).resolves.toBe("acquired");
+  expect(Date.now() - started).toBeLessThan(1_000);
+  expect(existsSync(lockPath(name))).toBe(false);
+});
+
+test("exclusive waits for a lock whose holder is still running", async () => {
+  const name = unique("alive");
+  mkdirSync(lockPath(name));
+  writeFileSync(join(lockPath(name), "owner"), String(process.pid));
+  const waiting = exclusive(name, async () => "acquired");
+  await new Promise((resolve) => setTimeout(resolve, 500));
+  expect(existsSync(lockPath(name))).toBe(true);
+  // The holder finishes; the waiter then gets the lock.
+  await rm(lockPath(name), { recursive: true, force: true });
+  await expect(waiting).resolves.toBe("acquired");
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN } from "../helpers/accounts";
 import { expectObjectLength } from "../helpers/object-response";
+import { exclusive } from "../helpers/exclusive";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -18,29 +19,35 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
 }
 
 test("theme settings: valid preset/radius/accent round-trip", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const put = await admin.put("/api/site/settings", {
-    data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
-  });
-  expect(put.ok()).toBeTruthy();
+  test.slow();
+  await exclusive("site-theme", async () => {
+    const admin = await adminCtx(playwright);
+    const put = await admin.put("/api/site/settings", {
+      data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
+    });
+    expect(put.ok()).toBeTruthy();
 
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const settings = await (await anon.get("/api/site/settings")).json();
-  expect(settings.themePreset).toBe("slate");
-  expect(settings.themeRadius).toBe("0.75");
-  expect(settings.brandColor).toBe("#2563eb");
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const settings = await (await anon.get("/api/site/settings")).json();
+    expect(settings.themePreset).toBe("slate");
+    expect(settings.themeRadius).toBe("0.75");
+    expect(settings.brandColor).toBe("#2563eb");
 
-  // restore
-  await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
-  await anon.dispose();
+    // restore
+    await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
+    await anon.dispose();
+  });
 });
 
 test("theme settings: valid per-token overrides accepted", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
-  const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
-  expect(put.ok()).toBeTruthy();
-  await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
+  test.slow();
+  await exclusive("site-theme", async () => {
+    const admin = await adminCtx(playwright);
+    const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
+    const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
+    expect(put.ok()).toBeTruthy();
+    await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
+  });
 });
 
 test("theme settings: invalid values are rejected (no CSS injection)", async ({ playwright }) => {
@@ -62,29 +69,32 @@ test("theme settings: invalid values are rejected (no CSS injection)", async ({
 });
 
 test("site settings: one response shape and immediate reads after each write", async ({ playwright }) => {
-  const admin = await adminCtx(playwright);
-  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
-  expect(Object.keys(before)).toEqual([
-    "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
-    "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
-    "hasFavicon", "faviconVersion",
-  ]);
-  expect(typeof before.hasFavicon).toBe("boolean");
-  expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
+  test.slow();
+  await exclusive("site-general", async () => {
+    const admin = await adminCtx(playwright);
+    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+    const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
+    expect(Object.keys(before)).toEqual([
+      "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
+      "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
+      "hasFavicon", "faviconVersion",
+    ]);
+    expect(typeof before.hasFavicon).toBe("boolean");
+    expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
 
-  try {
-    // The second write lands while the first read is still cached; it must not be hidden.
-    for (const footerText of ["first footer", "second footer"]) {
-      expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
-      expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
+    try {
+      // The second write lands while the first read is still cached; it must not be hidden.
+      for (const footerText of ["first footer", "second footer"]) {
+        expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
+        expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
+      }
+    } finally {
+      const footerText = typeof before.footerText === "string" ? before.footerText : "";
+      await admin.put("/api/site/settings", { data: { footerText } });
+      await anon.dispose();
+      await admin.dispose();
     }
-  } finally {
-    const footerText = typeof before.footerText === "string" ? before.footerText : "";
-    await admin.put("/api/site/settings", { data: { footerText } });
-    await anon.dispose();
-    await admin.dispose();
-  }
+  });
 });
 
 test("site favicon: the versioned URL is cached for good and other URLs revalidate", async ({ playwright }) => {

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "../helpers/disposable-users";
 import { ADMIN, USER } from "../helpers/accounts";
+import { signInOnSeparateDevices } from "../helpers/devices";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -125,6 +126,31 @@ test("revokeOtherSessions keeps the current session valid", async ({ playwright,
   await ctx.dispose();
 });
 
+test("revokeOtherSessions removes every other session, past Better Auth's page of 100", async ({
+  playwright,
+  disposableUsers,
+}) => {
+  test.slow();
+  const email = `api-revoke-many-${Date.now()}@example.com`;
+  const password = "Podokit3e-Str0ng!pw";
+  await disposableUsers.create({ email, password, name: "Many sessions" });
+
+  const statuses = await signInOnSeparateDevices(email, password, 105);
+  test.skip(statuses.includes(429), "needs an authentication rate limit above 105 sign-ins per window");
+  expect(statuses.every((status) => status === 200)).toBe(true);
+
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  // Better Auth lists at most 100 sessions, so a full page shows the backlog.
+  expect(((await (await ctx.get("/api/auth/list-sessions")).json()) as unknown[]).length).toBe(100);
+
+  expect((await ctx.post("/api/auth/revoke-other-sessions")).ok()).toBeTruthy();
+  const left = (await (await ctx.get("/api/auth/list-sessions")).json()) as Array<{ token?: string }>;
+  expect(left).toHaveLength(1);
+  expect((await (await ctx.get("/api/auth/get-session")).json())?.user?.email).toBe(email);
+  await ctx.dispose();
+});
+
 test("sessions record a client IP (forwarded through the proxy)", async ({ playwright }) => {
   const ctx = await signedIn(playwright, ADMIN);
   const res = await ctx.get("/api/auth/list-sessions");

package/dist/templates/modules/admin-dashboard/files/tests/helpers/devices.ts

@@ -0,0 +1,25 @@
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
+/**
+ * Signs in `count` times, each as a separate device, and returns the response
+ * statuses. Each request carries no cookies: a Playwright request context keeps
+ * the cookies of its earlier sign-ins, and Better Auth's multi-session plugin
+ * deletes a same-user session that a sign-in request carries, so signing in
+ * again from one context leaves one session instead of adding one.
+ */
+export async function signInOnSeparateDevices(email: string, password: string, count: number): Promise<number[]> {
+  const statuses: number[] = [];
+  for (let start = 0; start < count; start += 10) {
+    const batch = Array.from({ length: Math.min(10, count - start) }, async () => {
+      const response = await fetch(`${base}/api/auth/sign-in/email`, {
+        method: "POST",
+        headers: { origin: base, "content-type": "application/json" },
+        body: JSON.stringify({ email, password }),
+      });
+      await response.body?.cancel();
+      return response.status;
+    });
+    statuses.push(...(await Promise.all(batch)));
+  }
+  return statuses;
+}

package/dist/templates/modules/admin-dashboard/files/tests/helpers/exclusive.ts

@@ -0,0 +1,80 @@
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// Locks for server-wide settings that specs in more than one file change. The
+// suite runs on one worker by default; with --workers above 1, specs of the api
+// and ui projects run at the same time, and two that flip the same setting
+// would undo each other mid-test:
+//
+// - `require2fa`, `magic-link`, `oidc-provider`: feature flags
+// - `session-idle-timeout`: automatic logout in the auth configuration
+// - `social-providers`: any social sign-in provider in the auth configuration
+// - `site-general`: the General settings form, which saves all of its fields
+//   (name, footer, locale, maintenance mode, public sign-up, ...) at once
+// - `site-theme`: the Appearance settings
+//
+// A spec that holds a lock calls `test.slow()`, since waiting for another
+// holder counts against its timeout.
+
+// Longer than any spec holds a lock. A lock whose holder process has exited is
+// taken over at once; this bounds the wait when the holder cannot be checked.
+const STALE_MS = 120_000;
+const OWNER_FILE = "owner";
+
+/** The lock directory for `name`, shared by every worker on this machine. */
+export function lockPath(name: string): string {
+  return join(tmpdir(), `podokit-e2e-${name}.lock`);
+}
+
+/** Whether the worker that holds `lock` has exited, such as after Ctrl-C. */
+async function holderExited(lock: string): Promise<boolean> {
+  const pid = Number(await readFile(join(lock, OWNER_FILE), "utf8").catch(() => ""));
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ESRCH";
+  }
+}
+
+async function acquire(lock: string): Promise<void> {
+  for (;;) {
+    const created = await mkdir(lock).then(
+      () => true,
+      (error: NodeJS.ErrnoException) => {
+        if (error.code === "EEXIST") return false;
+        throw error;
+      },
+    );
+    if (created) {
+      await writeFile(join(lock, OWNER_FILE), String(process.pid)).catch(async (error: unknown) => {
+        await rm(lock, { recursive: true, force: true });
+        throw error;
+      });
+      return;
+    }
+    const age = await stat(lock).then((info) => Date.now() - info.mtimeMs, () => 0);
+    if (age > STALE_MS || (await holderExited(lock))) await rm(lock, { recursive: true, force: true });
+    else await new Promise((resolve) => setTimeout(resolve, 200));
+  }
+}
+
+/** Runs `body` while no other Playwright worker on this machine holds any of
+ *  the named locks, and releases them however `body` ends. */
+export async function exclusive<T>(names: string | string[], body: () => Promise<T>): Promise<T> {
+  // One acquisition order for every caller, so two specs that each need
+  // several locks cannot wait on each other.
+  const locks = [...new Set([names].flat())].sort().map(lockPath);
+  const held: string[] = [];
+  try {
+    for (const lock of locks) {
+      await acquire(lock);
+      held.push(lock);
+    }
+    return await body();
+  } finally {
+    for (const lock of held.reverse()) await rm(lock, { recursive: true, force: true });
+  }
+}

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -52,16 +52,9 @@ async function seedSession(
     data: { email: account.email, password: account.password },
   });
   expect(res.ok(), `sign-in ${account.email}`).toBeTruthy();
-  // Keep repeated local runs from filling better-auth's 100-session response
-  // before the newly created current session can appear in account tests. The
-  // endpoint clears at most one response page, so drain several pages when a
-  // long-lived local database has accumulated them.
-  for (let attempt = 0; attempt < 10; attempt += 1) {
-    const sessionsResponse = await ctx.get("/api/auth/list-sessions");
-    const sessions = sessionsResponse.ok() ? (await sessionsResponse.json()) as unknown : [];
-    if (!Array.isArray(sessions) || sessions.length <= 1) break;
-    expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
-  }
+  // Each run signs in again, so keep a long-lived local database from piling up
+  // this account's sessions: the seeded one is the only one left.
+  expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
   writeFileSync(path, `${JSON.stringify(withTestLocale(await ctx.storageState()), null, 2)}\n`);
   await ctx.dispose();
 }

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-sessions.ui.spec.ts

@@ -0,0 +1,46 @@
+import { signInOnSeparateDevices } from "../helpers/devices";
+import { expect, test } from "../helpers/disposable-users";
+import { ready } from "../helpers/hydration";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Better Auth's /list-sessions returns at most 100 sessions, the first ones the
+// database finds, so a browser that signed in after 105 others used to see no
+// "Current" row, and "Sign out other sessions" left sessions behind.
+test("sessions tab shows the current session and signs out every other one past 100", async ({
+  browser,
+  playwright,
+  disposableUsers,
+}) => {
+  test.slow();
+  const email = `ui-many-sessions-${Date.now()}@example.com`;
+  const password = "Podokit3e-Str0ng!pw";
+  await disposableUsers.create({ email, password, name: "Many sessions" });
+  const statuses = await signInOnSeparateDevices(email, password, 105);
+  test.skip(statuses.includes(429), "needs an authentication rate limit above 105 sign-ins per window");
+  expect(statuses.every((status) => status === 200)).toBe(true);
+
+  // Sign the browser in last, so its session is the 106th.
+  const signIn = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await signIn.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  const context = await browser.newContext({ storageState: await signIn.storageState() });
+  await context.addCookies([{ name: "locale", value: "en", url: base }]);
+  const page = await context.newPage();
+  try {
+    await ready(page, "/account");
+    await page.getByRole("button", { name: "Sessions" }).click();
+    await expect(page.getByText("106 sessions", { exact: true })).toBeVisible();
+    await expect(page.getByText("Current", { exact: true })).toBeVisible();
+
+    await page.getByRole("button", { name: "Sign out other sessions" }).click();
+    await expect(page.getByText("Signed out other sessions")).toBeVisible();
+    await expect(page.getByText("1 sessions", { exact: true })).toBeVisible();
+    await expect(page.getByText("Current", { exact: true })).toBeVisible();
+    const left = (await (await signIn.get("/api/account/sessions?limit=100")).json()) as { total: number };
+    expect(left.total).toBe(1);
+  } finally {
+    await context.close();
+    await signIn.dispose();
+  }
+});