@podosoft/podokit 1.4.2 → 1.6.0

package/dist/templates/modules/admin-dashboard/files/tests/api/auth.api.spec.ts

@@ -1,8 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { createPublicKey, verify, type JsonWebKey } from "node:crypto";
 import { ADMIN, USER } from "../helpers/accounts";
-import { exclusive } from "../helpers/exclusive";
-import { clearSms, smsSinkReachable, waitForSmsOtp } from "../helpers/sms";
+import { smsSinkReachable, waitForSmsOtp } from "../helpers/sms";
 import { totpCode } from "../helpers/totp";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -32,7 +31,6 @@ test("phone number: verify with the code delivered to the SMS sink", async ({ pl
   const caps = await (await ctx.get("/api/account/capabilities")).json();
   test.skip(!caps?.phoneNumber, "phone number not enabled");
   test.skip(!(await smsSinkReachable()), "SMS sink not reachable");
-  await clearSms();
   const email = `phone-${Date.now()}@example.com`;
   await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Phone" } });
   // Unique number per run so the "phone already exists" guard never trips.
@@ -144,50 +142,48 @@ test("two-factor: regenerating backup codes invalidates the old set", async ({ p
   await ctxNew.dispose();
 });
 
-test("require-2fa: gates an un-enrolled user until they enrol", async ({ playwright }) => {
+test("require-2fa: gates an un-enrolled user until they enrol", { tag: "@exclusive" }, async ({ playwright }) => {
   test.slow();
-  await exclusive("require2fa", async () => {
-    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    const caps = await (await admin.get("/api/account/capabilities")).json();
-    test.skip(!caps?.twoFactor, "two-factor not enabled");
-    await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
-
-    const user = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    const email = `rq-${Date.now()}@example.com`;
-    const pw = "Podokit3e-Str0ng!pw";
-    await user.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RQ" } });
-
-    try {
-      // Turn the policy on (admin; the toggle endpoint is allow-listed by the guard).
-      await admin.put("/api/account/settings", { data: { require2fa: true } });
-      // Capabilities carry the same policy as the dedicated endpoint.
-      await expect(async () => {
-        expect((await (await admin.get("/api/account/capabilities")).json()).require2fa).toBe(true);
-        expect(await (await admin.get("/api/account/require-2fa")).json()).toEqual({ require2fa: true });
-      }).toPass({ timeout: 8000 });
-      // The guard caches for a few seconds — poll until the un-enrolled user is gated.
-      await expect(async () => {
-        expect((await user.get("/api/account/me")).status()).toBe(403);
-      }).toPass({ timeout: 8000 });
-
-      // Enrolling restores access.
-      const enable = await (await user.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
-      await user.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
-      expect((await user.get("/api/account/me")).status()).toBe(200);
-    } finally {
-      // Always turn it back off so the shared (un-enrolled) sessions aren't gated.
-      await admin.put("/api/account/settings", { data: { require2fa: false } });
-      await expect(async () => {
-        const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-        await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
-        const status = (await probe.get("/api/account/me")).status();
-        await probe.dispose();
-        expect(status).toBe(200);
-      }).toPass({ timeout: 8000 });
-      await admin.dispose();
-      await user.dispose();
-    }
-  });
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await admin.get("/api/account/capabilities")).json();
+  test.skip(!caps?.twoFactor, "two-factor not enabled");
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+
+  const user = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `rq-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await user.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "RQ" } });
+
+  try {
+    // Turn the policy on (admin; the toggle endpoint is allow-listed by the guard).
+    await admin.put("/api/account/settings", { data: { require2fa: true } });
+    // Capabilities carry the same policy as the dedicated endpoint.
+    await expect(async () => {
+      expect((await (await admin.get("/api/account/capabilities")).json()).require2fa).toBe(true);
+      expect(await (await admin.get("/api/account/require-2fa")).json()).toEqual({ require2fa: true });
+    }).toPass({ timeout: 8000 });
+    // The guard caches for a few seconds — poll until the un-enrolled user is gated.
+    await expect(async () => {
+      expect((await user.get("/api/account/me")).status()).toBe(403);
+    }).toPass({ timeout: 8000 });
+
+    // Enrolling restores access.
+    const enable = await (await user.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+    await user.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+    expect((await user.get("/api/account/me")).status()).toBe(200);
+  } finally {
+    // Always turn it back off so the shared (un-enrolled) sessions aren't gated.
+    await admin.put("/api/account/settings", { data: { require2fa: false } });
+    await expect(async () => {
+      const probe = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+      await probe.post("/api/auth/sign-in/email", { data: { email: USER.email, password: USER.password } });
+      const status = (await probe.get("/api/account/me")).status();
+      await probe.dispose();
+      expect(status).toBe(200);
+    }).toPass({ timeout: 8000 });
+    await admin.dispose();
+    await user.dispose();
+  }
 });
 
 test("multi-session holds several accounts and switches between them", async ({ playwright }) => {
@@ -384,10 +380,9 @@ test("an organization can have a parent and manager members", async ({ playwrigh
   await ctx.dispose();
 });
 
-test("the OIDC provider's discovery and endpoints follow its setting", async ({ playwright }) => {
+test("the OIDC provider's discovery and endpoints follow its setting", { tag: "@exclusive" }, async ({ playwright }) => {
   // The provider's metadata is answered before endpoint hooks run, so it needs its
-  // own check that "off" hides it. The lock keeps tests/ui/oidc.ui.spec.ts, which
-  // also toggles the provider, from running at the same time.
+  // own check that "off" hides it.
   test.slow();
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
@@ -399,22 +394,20 @@ test("the OIDC provider's discovery and endpoints follow its setting", async ({
   const allStatuses = (): Promise<number[]> =>
     Promise.all([...discovery, "/api/auth/oauth2/authorize?client_id=probe"].map(status));
 
-  await exclusive("oidc-provider", async () => {
-    try {
-      expect((await admin.put("/api/account/settings", { data: { oidcProvider: false } })).ok()).toBeTruthy();
-      await expect.poll(allStatuses, { timeout: 8000 }).toEqual([404, 404, 404]);
-      // The jwt plugin's keys and session tokens are not part of the provider.
-      expect(await status("/api/auth/jwks")).toBe(200);
-
-      expect((await admin.put("/api/account/settings", { data: { oidcProvider: true } })).ok()).toBeTruthy();
-      await expect.poll(() => Promise.all(discovery.map(status)), { timeout: 8000 }).toEqual([200, 200]);
-      const metadata = await (await admin.get(discovery[0]!)).json();
-      expect(metadata.authorization_endpoint).toContain("/api/auth/oauth2/authorize");
-    } finally {
-      expect((await admin.put("/api/account/settings", { data: { oidcProvider: false } })).ok()).toBeTruthy();
-    }
+  try {
+    expect((await admin.put("/api/account/settings", { data: { oidcProvider: false } })).ok()).toBeTruthy();
     await expect.poll(allStatuses, { timeout: 8000 }).toEqual([404, 404, 404]);
-  });
+    // The jwt plugin's keys and session tokens are not part of the provider.
+    expect(await status("/api/auth/jwks")).toBe(200);
+
+    expect((await admin.put("/api/account/settings", { data: { oidcProvider: true } })).ok()).toBeTruthy();
+    await expect.poll(() => Promise.all(discovery.map(status)), { timeout: 8000 }).toEqual([200, 200]);
+    const metadata = await (await admin.get(discovery[0]!)).json();
+    expect(metadata.authorization_endpoint).toContain("/api/auth/oauth2/authorize");
+  } finally {
+    expect((await admin.put("/api/account/settings", { data: { oidcProvider: false } })).ok()).toBeTruthy();
+  }
+  await expect.poll(allStatuses, { timeout: 8000 }).toEqual([404, 404, 404]);
   await admin.dispose();
 });
 
@@ -426,28 +419,26 @@ test("only admins can change settings @smoke", async ({ playwright }) => {
   await userCtx.dispose();
 });
 
-test("disabling a feature blocks its endpoint server-side and re-enabling restores it @smoke", async ({ playwright }) => {
+test("disabling a feature blocks its endpoint server-side and re-enabling restores it @smoke", { tag: "@exclusive" }, async ({ playwright }) => {
   test.slow();
-  await exclusive("magic-link", async () => {
-    // Uses a fresh admin context (not the shared storageState) so it never rotates
-    // the seeded session. Toggles a flag and confirms the feature gate enforces it.
-    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
-    const caps = await (await admin.get("/api/account/capabilities")).json();
-    test.skip(!caps?.magicLink, "magic link not enabled");
+  // Uses a fresh admin context (not the shared storageState) so it never rotates
+  // the seeded session. Toggles a flag and confirms the feature gate enforces it.
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
+  const caps = await (await admin.get("/api/account/capabilities")).json();
+  test.skip(!caps?.magicLink, "magic link not enabled");
 
-    // A disabled feature's endpoint 404s; the gate reads the flag through a short cache.
-    const status = (): Promise<number> =>
-      admin.post("/api/auth/sign-in/magic-link", { data: { email: "probe@example.com" } }).then((r) => r.status());
+  // A disabled feature's endpoint 404s; the gate reads the flag through a short cache.
+  const status = (): Promise<number> =>
+    admin.post("/api/auth/sign-in/magic-link", { data: { email: "probe@example.com" } }).then((r) => r.status());
 
-    expect((await admin.put("/api/account/settings", { data: { magicLink: false } })).ok()).toBeTruthy();
-    await expect.poll(status, { timeout: 8000 }).toBe(404);
+  expect((await admin.put("/api/account/settings", { data: { magicLink: false } })).ok()).toBeTruthy();
+  await expect.poll(status, { timeout: 8000 }).toBe(404);
 
-    expect((await admin.put("/api/account/settings", { data: { magicLink: true } })).ok()).toBeTruthy();
-    await expect.poll(status, { timeout: 8000 }).not.toBe(404);
+  expect((await admin.put("/api/account/settings", { data: { magicLink: true } })).ok()).toBeTruthy();
+  await expect.poll(status, { timeout: 8000 }).not.toBe(404);
 
-    await admin.dispose();
-  });
+  await admin.dispose();
 });
 
 test("sign-in with a wrong password is rejected", async ({ request }) => {

package/dist/templates/modules/admin-dashboard/files/tests/api/email.api.spec.ts

@@ -1,5 +1,5 @@
 import { expect, test } from "@playwright/test";
-import { clearMailpit, mailpitReachable, waitForLink, waitForOtp } from "../helpers/mailpit";
+import { mailpitReachable, waitForLink, waitForOtp } from "../helpers/mailpit";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -11,7 +11,6 @@ test("email one-time code signs a user in", async ({ playwright }) => {
   test.skip(!caps?.emailOtp, "email OTP not enabled");
   const email = `otp-${Date.now()}@example.com`;
   await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Otp" } });
-  await clearMailpit();
   const requested = await ctx.post("/api/auth/email-otp/send-verification-otp", { data: { email, type: "sign-in" } });
   expect(requested.ok()).toBeTruthy();
   const otp = await waitForOtp(email);
@@ -58,7 +57,6 @@ test("magic link signs a user in", async ({ playwright }) => {
   // rotate the account's sessions, which would invalidate the seeded storageState.
   const email = `magic-${Date.now()}@example.com`;
   await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Magic" } });
-  await clearMailpit();
   const requested = await ctx.post("/api/auth/sign-in/magic-link", { data: { email, callbackURL: `${base}/admin` } });
   expect(requested.ok()).toBeTruthy();
   const link = await waitForLink(email);
@@ -84,8 +82,6 @@ test("password reset delivers an email and updates the password @smoke", async (
   // With verification on, sign-up returns no session and the new password still
   // can't sign in until confirmed — so only assert sign-in when it's off.
   const verificationOn = !(await signup.json())?.token;
-
-  await clearMailpit();
   const requested = await ctx.post("/api/auth/request-password-reset", { data: { email, redirectTo: `${base}/reset-password` } });
   expect(requested.ok()).toBeTruthy();
 
@@ -106,7 +102,6 @@ test("email verification blocks sign-in until the address is confirmed", async (
   test.skip(!(await mailpitReachable()), "Mailpit not available");
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const email = `verify-${Date.now()}@example.com`;
-  await clearMailpit();
   const signup = await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "Verify", callbackURL: `${base}/admin` } });
   expect(signup.ok()).toBeTruthy();
   // When verification is off, sign-up returns a session — nothing to test here.

package/dist/templates/modules/admin-dashboard/files/tests/api/profile-image.api.spec.ts

@@ -30,7 +30,7 @@ test("profile image upload requires authentication", async ({ playwright }) => {
   await anonymous.dispose();
 });
 
-test("profile image upload, replacement, public read, and removal", async ({ playwright }) => {
+test("profile image upload, replacement, public read, and removal", { tag: "@exclusive" }, async ({ playwright }) => {
   const admin = await adminContext(playwright);
   await admin.delete("/api/account/profile-image");
 

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -1,7 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN } from "../helpers/accounts";
 import { expectObjectLength } from "../helpers/object-response";
-import { exclusive } from "../helpers/exclusive";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -18,36 +17,30 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
   return ctx;
 }
 
-test("theme settings: valid preset/radius/accent round-trip", async ({ playwright }) => {
-  test.slow();
-  await exclusive("site-theme", async () => {
-    const admin = await adminCtx(playwright);
-    const put = await admin.put("/api/site/settings", {
-      data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
-    });
-    expect(put.ok()).toBeTruthy();
+test("theme settings: valid preset/radius/accent round-trip", { tag: "@exclusive" }, async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const put = await admin.put("/api/site/settings", {
+    data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
+  });
+  expect(put.ok()).toBeTruthy();
 
-    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    const settings = await (await anon.get("/api/site/settings")).json();
-    expect(settings.themePreset).toBe("slate");
-    expect(settings.themeRadius).toBe("0.75");
-    expect(settings.brandColor).toBe("#2563eb");
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const settings = await (await anon.get("/api/site/settings")).json();
+  expect(settings.themePreset).toBe("slate");
+  expect(settings.themeRadius).toBe("0.75");
+  expect(settings.brandColor).toBe("#2563eb");
 
-    // restore
-    await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
-    await anon.dispose();
-  });
+  // restore
+  await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
+  await anon.dispose();
 });
 
-test("theme settings: valid per-token overrides accepted", async ({ playwright }) => {
-  test.slow();
-  await exclusive("site-theme", async () => {
-    const admin = await adminCtx(playwright);
-    const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
-    const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
-    expect(put.ok()).toBeTruthy();
-    await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
-  });
+test("theme settings: valid per-token overrides accepted", { tag: "@exclusive" }, async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
+  const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
+  expect(put.ok()).toBeTruthy();
+  await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
 });
 
 test("theme settings: invalid values are rejected (no CSS injection)", async ({ playwright }) => {
@@ -68,36 +61,33 @@ test("theme settings: invalid values are rejected (no CSS injection)", async ({
   }
 });
 
-test("site settings: one response shape and immediate reads after each write", async ({ playwright }) => {
-  test.slow();
-  await exclusive("site-general", async () => {
-    const admin = await adminCtx(playwright);
-    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
-    expect(Object.keys(before)).toEqual([
-      "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
-      "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
-      "hasFavicon", "faviconVersion",
-    ]);
-    expect(typeof before.hasFavicon).toBe("boolean");
-    expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
+test("site settings: one response shape and immediate reads after each write", { tag: "@exclusive" }, async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
+  expect(Object.keys(before)).toEqual([
+    "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
+    "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
+    "hasFavicon", "faviconVersion",
+  ]);
+  expect(typeof before.hasFavicon).toBe("boolean");
+  expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
 
-    try {
-      // The second write lands while the first read is still cached; it must not be hidden.
-      for (const footerText of ["first footer", "second footer"]) {
-        expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
-        expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
-      }
-    } finally {
-      const footerText = typeof before.footerText === "string" ? before.footerText : "";
-      await admin.put("/api/site/settings", { data: { footerText } });
-      await anon.dispose();
-      await admin.dispose();
+  try {
+    // The second write lands while the first read is still cached; it must not be hidden.
+    for (const footerText of ["first footer", "second footer"]) {
+      expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
+      expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
     }
-  });
+  } finally {
+    const footerText = typeof before.footerText === "string" ? before.footerText : "";
+    await admin.put("/api/site/settings", { data: { footerText } });
+    await anon.dispose();
+    await admin.dispose();
+  }
 });
 
-test("site favicon: the versioned URL is cached for good and other URLs revalidate", async ({ playwright }) => {
+test("site favicon: the versioned URL is cached for good and other URLs revalidate", { tag: "@exclusive" }, async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   try {

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "../helpers/disposable-users";
 import { ADMIN, USER } from "../helpers/accounts";
+import { signInOnSeparateDevices } from "../helpers/devices";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -41,11 +42,13 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
   await admin.dispose();
 });
 
-test("a normal user cannot create users (403)", async ({ playwright }) => {
+test("a normal user cannot create users (403)", async ({ playwright, disposableUsers }) => {
   const user = await signedIn(playwright, USER);
   const res = await user.post("/api/auth/admin/create-user", {
     data: { email: `nope-${Date.now()}@example.com`, password: "Podokit3e-Str0ng!pw", name: "Nope", role: "user" },
   });
+  // Remove the account if the request wrongly succeeded, before failing on it.
+  if (res.ok()) await disposableUsers.trackResponse(res);
   expect(res.status()).toBe(403);
   await user.dispose();
 });
@@ -125,6 +128,31 @@ test("revokeOtherSessions keeps the current session valid", async ({ playwright,
   await ctx.dispose();
 });
 
+test("revokeOtherSessions removes every other session, past Better Auth's page of 100", async ({
+  playwright,
+  disposableUsers,
+}) => {
+  test.slow();
+  const email = `api-revoke-many-${Date.now()}@example.com`;
+  const password = "Podokit3e-Str0ng!pw";
+  await disposableUsers.create({ email, password, name: "Many sessions" });
+
+  const statuses = await signInOnSeparateDevices(email, password, 105);
+  test.skip(statuses.includes(429), "needs an authentication rate limit above 105 sign-ins per window");
+  expect(statuses.every((status) => status === 200)).toBe(true);
+
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  // Better Auth lists at most 100 sessions, so a full page shows the backlog.
+  expect(((await (await ctx.get("/api/auth/list-sessions")).json()) as unknown[]).length).toBe(100);
+
+  expect((await ctx.post("/api/auth/revoke-other-sessions")).ok()).toBeTruthy();
+  const left = (await (await ctx.get("/api/auth/list-sessions")).json()) as Array<{ token?: string }>;
+  expect(left).toHaveLength(1);
+  expect((await (await ctx.get("/api/auth/get-session")).json())?.user?.email).toBe(email);
+  await ctx.dispose();
+});
+
 test("sessions record a client IP (forwarded through the proxy)", async ({ playwright }) => {
   const ctx = await signedIn(playwright, ADMIN);
   const res = await ctx.get("/api/auth/list-sessions");

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -1,7 +1,18 @@
+import { appAccounts } from "./app-accounts";
+
 export type Account = { name: string; email: string; password: string };
 
+const DEFAULT_PASSWORD = "Podokit3e-Str0ng!pw";
+
+function fromEnv(name: string): string | undefined {
+  const value = process.env[name];
+  return value !== undefined && value.length > 0 ? value : undefined;
+}
+
 /**
- * The password the suite signs in with, per account.
+ * The seeded accounts the suite signs in as. Each value comes from, in order,
+ * an `E2E_*` environment variable, the application-owned `app-accounts.ts`, and
+ * the generated default.
  *
  * A test must never change an existing account's credentials. `seed.setup.ts` signs up
  * idempotently and then signs in with these values, which is right on a stack the suite
@@ -19,13 +30,20 @@ export type Account = { name: string; email: string; password: string };
  * Without the override the run fails with `INVALID_EMAIL_OR_PASSWORD`, which is the correct
  * outcome — a refusal, not a silent overwrite. Do not commit a real value here.
  */
-function seedPassword(envVar: "E2E_ADMIN_PASSWORD" | "E2E_USER_PASSWORD"): string {
-  const value = process.env[envVar];
-  return value !== undefined && value.length > 0 ? value : "Podokit3e-Str0ng!pw";
+function seededAccount(
+  role: "ADMIN" | "USER",
+  configured: Partial<Account> | undefined,
+  defaults: Pick<Account, "name" | "email">,
+): Account {
+  return {
+    name: configured?.name ?? defaults.name,
+    email: fromEnv(`E2E_${role}_EMAIL`) ?? configured?.email ?? defaults.email,
+    password: fromEnv(`E2E_${role}_PASSWORD`) ?? configured?.password ?? DEFAULT_PASSWORD,
+  };
 }
 
-export const ADMIN = { name: "Admin", email: "admin@example.com", password: seedPassword("E2E_ADMIN_PASSWORD") };
-export const USER = { name: "Normal User", email: "user@example.com", password: seedPassword("E2E_USER_PASSWORD") };
+export const ADMIN = seededAccount("ADMIN", appAccounts.admin, { name: "Admin", email: "admin@example.com" });
+export const USER = seededAccount("USER", appAccounts.user, { name: "Normal User", email: "user@example.com" });
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
 export const userBaselineState = "playwright/.auth/user-baseline.json";

package/dist/templates/modules/admin-dashboard/files/tests/helpers/app-accounts.ts

@@ -0,0 +1,24 @@
+import type { Account } from "./accounts";
+
+/**
+ * The seeded accounts' names, addresses, or password sources when this
+ * application's differ from the generated `admin@example.com` and
+ * `user@example.com`. PodoKit creates this file once and never overwrites it.
+ * `E2E_ADMIN_EMAIL`, `E2E_USER_EMAIL`, `E2E_ADMIN_PASSWORD`, and
+ * `E2E_USER_PASSWORD` still win over what is set here.
+ *
+ * The seed signs the accounts up, so the API must promote the administrator:
+ * list its address in `ADMIN_EMAILS`. For example, accounts named by the
+ * application's own variables:
+ *
+ * ```ts
+ * export const appAccounts: AppAccounts = {
+ *   admin: { email: process.env.MYAPP_ADMIN_EMAIL, password: process.env.MYAPP_ADMIN_PASSWORD },
+ * };
+ * ```
+ *
+ * Never commit a real password here.
+ */
+export type AppAccounts = { admin?: Partial<Account>; user?: Partial<Account> };
+
+export const appAccounts: AppAccounts = {};

package/dist/templates/modules/admin-dashboard/files/tests/helpers/devices.ts

@@ -0,0 +1,55 @@
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
+/** The `name=value` of the session cookie a sign-in response sets. */
+function sessionCookie(response: Response): string | undefined {
+  for (const header of response.headers.getSetCookie()) {
+    const [pair = ""] = header.split(";");
+    const name = pair.slice(0, pair.indexOf("="));
+    // Better Auth names it `better-auth.session_token`, with a `__Secure-`
+    // prefix on HTTPS; the multi-session plugin's cookies end in the token.
+    if (name.endsWith("session_token")) return pair;
+  }
+  return undefined;
+}
+
+async function signIn(email: string, password: string, cookie?: string): Promise<Response> {
+  return fetch(`${base}/api/auth/sign-in/email`, {
+    method: "POST",
+    headers: { origin: base, "content-type": "application/json", ...(cookie ? { cookie } : {}) },
+    body: JSON.stringify({ email, password }),
+  });
+}
+
+/**
+ * Signs in `count` times, each as a separate device, and returns the response
+ * statuses.
+ *
+ * Sign-ins are authentication writes. From an anonymous client the rate
+ * limiter counts them against the per-address budget that every other spec's
+ * sign-ins share, so a hundred of them refused unrelated sign-ins elsewhere in
+ * the run. Only the first one is anonymous here; every later one carries the
+ * first sign-in's session cookie, so the limiter counts it against that
+ * session instead.
+ *
+ * A request carries that one cookie and nothing else: Better Auth's
+ * multi-session plugin deletes a same-user session that a sign-in carries in
+ * its multi-session cookies, so a client that kept every cookie would end with
+ * one session instead of `count`.
+ */
+export async function signInOnSeparateDevices(email: string, password: string, count: number): Promise<number[]> {
+  if (count < 1) return [];
+  const first = await signIn(email, password);
+  await first.body?.cancel();
+  const statuses = [first.status];
+  const cookie = sessionCookie(first);
+  if (first.status !== 200 || !cookie) return statuses;
+  for (let start = 1; start < count; start += 10) {
+    const batch = Array.from({ length: Math.min(10, count - start) }, async () => {
+      const response = await signIn(email, password, cookie);
+      await response.body?.cancel();
+      return response.status;
+    });
+    statuses.push(...(await Promise.all(batch)));
+  }
+  return statuses;
+}

package/dist/templates/modules/admin-dashboard/files/tests/helpers/disposable-users.ts

@@ -34,17 +34,19 @@ async function readCreatedUserId(response: CreatedUserResponse): Promise<string>
 
 export const test = base.extend<{ disposableUsers: DisposableUsers }>({
   disposableUsers: async ({ context, playwright }, use, testInfo) => {
-    // API projects do not inherit the UI project's admin storageState, while a
+    // API projects (`api` and its `api-exclusive` twin) do not inherit the UI
+    // project's admin storageState, while a
     // second admin sign-in can invalidate the shared UI session. API tests sign in
     // an isolated request context. UI tests copy the browser's admin cookies into
     // their own context once, so a test that later signs its page in as another
     // user does not turn cleanup into that user's (forbidden) requests.
+    const requestOnly = testInfo.project.name.replace(/-exclusive$/, "") === "api";
     const request = await playwright.request.newContext({
       baseURL,
       extraHTTPHeaders: origin,
-      ...(testInfo.project.name === "api" ? {} : { storageState: await context.storageState() }),
+      ...(requestOnly ? {} : { storageState: await context.storageState() }),
     });
-    if (testInfo.project.name === "api") {
+    if (requestOnly) {
       const signIn = await request.post("/api/auth/sign-in/email", {
         data: { email: ADMIN.email, password: ADMIN.password },
       });

package/dist/templates/modules/admin-dashboard/files/tests/helpers/mailpit.ts

@@ -1,5 +1,7 @@
 // Helpers for the local Mailpit catcher (docker-compose / CI service). Tests that
-// exercise email flows skip when it isn't reachable (see MAILPIT_URL).
+// exercise email flows skip when it isn't reachable (see MAILPIT_URL). Each test
+// mails an address of its own and reads the newest message to it; the inbox is
+// shared with tests on other workers, so no test empties it.
 const MAILPIT = process.env.MAILPIT_URL ?? "http://localhost:8025";
 
 export async function mailpitReachable(): Promise<boolean> {
@@ -10,14 +12,6 @@ export async function mailpitReachable(): Promise<boolean> {
   }
 }
 
-export async function clearMailpit(): Promise<void> {
-  try {
-    await fetch(`${MAILPIT}/api/v1/messages`, { method: "DELETE" });
-  } catch {
-    /* ignore */
-  }
-}
-
 type MailpitList = { messages: Array<{ ID: string; To: Array<{ Address: string }> }> };
 type MailpitMessage = { Text?: string; HTML?: string };