@podosoft/podokit 1.4.2 → 1.6.0

package/dist/templates/modules/admin-dashboard/files/tests/helpers/sms.ts

@@ -1,6 +1,8 @@
 // Read-back helper for the dev SMS sink (the "Mailpit for SMS"). The app posts
 // outgoing SMS to the sink via SMS_WEBHOOK_URL; tests poll it here to obtain the
 // delivered code, so the phone-number flow is verified for real (not just "sent").
+// Each test texts a number of its own; the sink is shared with tests on other
+// workers, so no test empties it.
 const SINK = process.env.SMS_SINK_URL ?? "http://localhost:8095";
 
 type SinkMessage = { to: string; body: string; receivedAt: string };
@@ -14,10 +16,6 @@ export async function smsSinkReachable(): Promise<boolean> {
   }
 }
 
-export async function clearSms(): Promise<void> {
-  await fetch(`${SINK}/messages`, { method: "DELETE" }).catch(() => undefined);
-}
-
 /** Poll the sink until an SMS to `to` arrives, then return the first 4–8 digit code. */
 export async function waitForSmsOtp(to: string, timeoutMs = 10_000): Promise<string> {
   const deadline = Date.now() + timeoutMs;

package/dist/templates/modules/admin-dashboard/files/tests/playwright.config.ts

@@ -1,10 +1,15 @@
 import { defineConfig, devices } from "@playwright/test";
-import { loadPlaywrightProjects } from "./playwright.extensions";
+import { e2eWorkers, loadPlaywrightProjects, withExclusivePhase } from "./playwright.extensions";
 
 // admin-dashboard overlay: adds a `setup` project that seeds admin/user sessions
-// (storageState) which the `ui` project reuses. Serial + single worker because
-// tests share one backend/DB. Runs against a live stack on E2E_BASE_URL.
+// (storageState) which the `ui` project reuses, and a `cleanup` project that
+// removes the users the suite created. Runs against a live stack on
+// E2E_BASE_URL. Tests share one backend and database: E2E_WORKERS sets the
+// worker count (default 1), and tests tagged @exclusive, which change state the
+// others rely on, run one at a time in `<project>-exclusive` twins after the
+// others (see playwright.extensions.ts). Each file runs on one worker in order.
 const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const workers = e2eWorkers();
 const coreProjects = [
   { name: "api", testMatch: /.*\.api\.spec\.ts/, dependencies: ["setup"] },
   { name: "setup", testMatch: /.*\.setup\.ts/, teardown: "cleanup" },
@@ -22,8 +27,9 @@ export default defineConfig({
   fullyParallel: false,
   forbidOnly: !!process.env.CI,
   retries: process.env.CI ? 2 : 0,
-  workers: 1,
+  workers,
+  globalSetup: "./playwright.extensions.ts",
   reporter: [["list"], ["html", { open: "never" }]],
   use: { baseURL, trace: "on-first-retry", screenshot: "only-on-failure" },
-  projects: [...coreProjects, ...loadPlaywrightProjects(coreProjects)],
+  projects: withExclusivePhase([...coreProjects, ...loadPlaywrightProjects(coreProjects)], workers),
 });

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -52,16 +52,9 @@ async function seedSession(
     data: { email: account.email, password: account.password },
   });
   expect(res.ok(), `sign-in ${account.email}`).toBeTruthy();
-  // Keep repeated local runs from filling better-auth's 100-session response
-  // before the newly created current session can appear in account tests. The
-  // endpoint clears at most one response page, so drain several pages when a
-  // long-lived local database has accumulated them.
-  for (let attempt = 0; attempt < 10; attempt += 1) {
-    const sessionsResponse = await ctx.get("/api/auth/list-sessions");
-    const sessions = sessionsResponse.ok() ? (await sessionsResponse.json()) as unknown : [];
-    if (!Array.isArray(sessions) || sessions.length <= 1) break;
-    expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
-  }
+  // Each run signs in again, so keep a long-lived local database from piling up
+  // this account's sessions: the seeded one is the only one left.
+  expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
   writeFileSync(path, `${JSON.stringify(withTestLocale(await ctx.storageState()), null, 2)}\n`);
   await ctx.dispose();
 }

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-flows.ui.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
-import { anonState } from "../helpers/accounts";
+import { ADMIN, anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { smsSinkReachable, clearSms, waitForSmsOtp } from "../helpers/sms";
+import { smsSinkReachable, waitForSmsOtp } from "../helpers/sms";
 
 // Each test drives a fresh disposable account (via a real UI login) so the shared
 // admin/user sessions are never mutated.
@@ -31,7 +31,6 @@ test("account: register and verify a phone number", async ({ page, playwright })
   test.skip((await phoneInput.count()) === 0, "phone number feature disabled");
 
   const phone = `+1555${String(Date.now()).slice(-7)}`;
-  await clearSms();
   await phoneInput.fill(phone);
   await page.getByRole("button", { name: "Send code" }).click();
   const code = await waitForSmsOtp(phone);
@@ -47,9 +46,9 @@ test("account: change email address", async ({ page, playwright }) => {
   await expect(page.getByText(/Email address updated|approve the change/)).toBeVisible();
 });
 
-test("account: delete my own account", async ({ page, playwright }) => {
+test("account: delete my own account", { tag: "@exclusive" }, async ({ page, playwright }) => {
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  await admin.post("/api/auth/sign-in/email", { data: { email: "admin@example.com", password: PW } });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
   try {
     // Account deletion is a server toggle (off by default) — enable it, then poll
     // until the capability is live (config store has a short TTL).

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-sessions.ui.spec.ts

@@ -0,0 +1,46 @@
+import { signInOnSeparateDevices } from "../helpers/devices";
+import { expect, test } from "../helpers/disposable-users";
+import { ready } from "../helpers/hydration";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Better Auth's /list-sessions returns at most 100 sessions, the first ones the
+// database finds, so a browser that signed in after 105 others used to see no
+// "Current" row, and "Sign out other sessions" left sessions behind.
+test("sessions tab shows the current session and signs out every other one past 100", async ({
+  browser,
+  playwright,
+  disposableUsers,
+}) => {
+  test.slow();
+  const email = `ui-many-sessions-${Date.now()}@example.com`;
+  const password = "Podokit3e-Str0ng!pw";
+  await disposableUsers.create({ email, password, name: "Many sessions" });
+  const statuses = await signInOnSeparateDevices(email, password, 105);
+  test.skip(statuses.includes(429), "needs an authentication rate limit above 105 sign-ins per window");
+  expect(statuses.every((status) => status === 200)).toBe(true);
+
+  // Sign the browser in last, so its session is the 106th.
+  const signIn = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await signIn.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  const context = await browser.newContext({ storageState: await signIn.storageState() });
+  await context.addCookies([{ name: "locale", value: "en", url: base }]);
+  const page = await context.newPage();
+  try {
+    await ready(page, "/account");
+    await page.getByRole("button", { name: "Sessions" }).click();
+    await expect(page.getByText("106 sessions", { exact: true })).toBeVisible();
+    await expect(page.getByText("Current", { exact: true })).toBeVisible();
+
+    await page.getByRole("button", { name: "Sign out other sessions" }).click();
+    await expect(page.getByText("Signed out other sessions")).toBeVisible();
+    await expect(page.getByText("1 sessions", { exact: true })).toBeVisible();
+    await expect(page.getByText("Current", { exact: true })).toBeVisible();
+    const left = (await (await signIn.get("/api/account/sessions?limit=100")).json()) as { total: number };
+    expect(left.total).toBe(1);
+  } finally {
+    await context.close();
+    await signIn.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 import { ADMIN } from "../helpers/accounts";
-import { exclusive } from "../helpers/exclusive";
+import { paths } from "../helpers/paths";
 
 const PNG = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAIAAAADAQMAAACDJEzCAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCSUTzXBDTwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozNzoxOSswMDowMOuehLIAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzc6MTkrMDA6MDCawzwOAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM3OjE5KzAwOjAwzdYd0QAAAAtJREFUCNdjYAABAAAGAAFm9MlsAAAAAElFTkSuQmCC",
@@ -17,7 +17,7 @@ test("account opens on the profile section @smoke", async ({ page }) => {
   await ready(page, "/admin/account");
   await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
   await expect(page.getByLabel("Name", { exact: true })).toBeVisible();
-  await expect(page.getByLabel("Email")).toHaveValue("admin@example.com");
+  await expect(page.getByLabel("Email")).toHaveValue(ADMIN.email);
   // save is enabled only once the name changes
   await expect(page.getByRole("button", { name: "Save changes" })).toBeDisabled();
   await page.getByLabel("Name", { exact: true }).fill(`Admin Preview ${Date.now()}`);
@@ -33,7 +33,7 @@ test("protected app routes do not inherit the admin shell @smoke", async ({ page
   await expect(page.getByTestId("sidebar-brand")).toBeVisible();
 });
 
-test("account displays profile image limits and updates every avatar", async ({ page }) => {
+test("account displays profile image limits and updates every avatar", { tag: "@exclusive" }, async ({ page }) => {
   await ready(page, "/account");
   await page.request.delete("/api/account/profile-image");
   await ready(page, "/account");
@@ -49,8 +49,10 @@ test("account displays profile image limits and updates every avatar", async ({
   await expect(page.getByText(/Profile image updated|프로필 이미지를 변경했습니다/)).toBeVisible();
   await expect(page.getByTestId("profile-image-preview").locator("img")).toBeVisible();
 
-  await ready(page, "/");
-  await expect(page.getByTestId("account-menu").locator("img")).toBeVisible();
+  if (paths.accountMenu !== null) {
+    await ready(page, paths.accountMenu);
+    await expect(page.getByTestId("account-menu").locator("img")).toBeVisible();
+  }
   await ready(page, "/admin");
   await expect(page.getByTestId("sidebar-user-menu").locator("img")).toBeVisible();
 
@@ -81,13 +83,13 @@ test("account rejects invalid profile images before upload", async ({ page }) =>
 test("account exposes a change-email action when the address is edited", async ({ page }) => {
   await ready(page, "/admin/account");
   const email = page.getByLabel("Email");
-  await expect(email).toHaveValue("admin@example.com");
+  await expect(email).toHaveValue(ADMIN.email);
   // no action until the address actually changes
   await expect(page.getByRole("button", { name: "Change email" })).toHaveCount(0);
-  await email.fill("admin+changed@example.com");
+  await email.fill(`changed.${ADMIN.email}`);
   await expect(page.getByRole("button", { name: "Change email" })).toBeVisible();
   // revert without submitting — don't mutate the shared admin session
-  await email.fill("admin@example.com");
+  await email.fill(ADMIN.email);
   await expect(page.getByRole("button", { name: "Change email" })).toHaveCount(0);
 });
 
@@ -145,7 +147,7 @@ test("account shows a phone field when enabled", async ({ page }) => {
   await expect(phone).toBeVisible();
 });
 
-test("admin can update their profile name", async ({ page }) => {
+test("admin can update their profile name", { tag: "@exclusive" }, async ({ page }) => {
   await ready(page, "/admin/account");
   const name = page.getByLabel("Name", { exact: true });
   await name.fill(`Admin Updated ${Date.now()}`);
@@ -174,8 +176,8 @@ test("account security and sessions sub-navigation", async ({ page }) => {
 /**
  * ⚠ THE SUITE ALWAYS SIGNS IN FIRST, WHICH IS WHY THIS NEEDED A MOCK.
  *
- * better-auth guards `/list-sessions` with its freshness middleware and
- * `session.freshAge` defaults to 24 hours, so the endpoint returns 403
+ * The sessions list keeps better-auth's freshness rule, and `session.freshAge`
+ * defaults to 24 hours, so `GET /api/account/sessions` returns 403
  * `SESSION_NOT_FRESH` to anyone who signed in yesterday. The seeded session is
  * minutes old, so the test above passes for every run while the screen is broken for
  * real users — the tab showed an empty table under an untranslated "Session is not
@@ -183,11 +185,14 @@ test("account security and sessions sub-navigation", async ({ page }) => {
  * own setup prevents.
  */
 test("sessions tab explains a session that is too old to list them", async ({ page }) => {
-  await page.route("**/api/auth/list-sessions", (route) =>
+  await page.route("**/api/account/sessions?*", (route) =>
     route.fulfill({
       status: 403,
       contentType: "application/json",
-      body: JSON.stringify({ message: "Session is not fresh", code: "SESSION_NOT_FRESH" }),
+      body: JSON.stringify({
+        success: false,
+        error: { code: "SESSION_NOT_FRESH", message: "Session is not fresh", statusCode: 403 },
+      }),
     }),
   );
 
@@ -227,58 +232,56 @@ test("account nav shows the core sections", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Sessions" })).toBeVisible();
 });
 
-test("connected account unlink uses the local account row id @smoke", async ({ page }) => {
+test("connected account unlink uses the local account row id @smoke", { tag: "@exclusive" }, async ({ page }) => {
   test.slow();
-  await exclusive("social-providers", async () => {
-    const provider = "google";
-    let unlinkBody: unknown;
-    await page.route("**/api/auth/list-accounts", (route) =>
-      route.fulfill({
-        status: 200,
-        contentType: "application/json",
-        body: JSON.stringify([
-          { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
-        ]),
-      }),
-    );
-    await page.route("**/api/auth/unlink-account", async (route) => {
-      unlinkBody = route.request().postDataJSON();
-      await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
-    });
+  const provider = "google";
+  let unlinkBody: unknown;
+  await page.route("**/api/auth/list-accounts", (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: "application/json",
+      body: JSON.stringify([
+        { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
+      ]),
+    }),
+  );
+  await page.route("**/api/auth/unlink-account", async (route) => {
+    unlinkBody = route.request().postDataJSON();
+    await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
+  });
 
-    try {
-      const enabled = await page.request.put("/api/account/auth-config", {
-        data: {
-          social: {
-            [provider]: {
-              enabled: true,
-              clientId: "podokit",
-              clientSecret: "podokit",
-            },
+  try {
+    const enabled = await page.request.put("/api/account/auth-config", {
+      data: {
+        social: {
+          [provider]: {
+            enabled: true,
+            clientId: "podokit",
+            clientSecret: "podokit",
           },
         },
-      });
-      expect(enabled.ok()).toBeTruthy();
-      await expect
-        .poll(async () => {
-          const response = await page.request.get("/api/account/capabilities");
-          const body = (await response.json()) as { providers?: string[] };
-          return body.providers ?? [];
-        }, { timeout: 8_000 })
-        .toContain(provider);
+      },
+    });
+    expect(enabled.ok()).toBeTruthy();
+    await expect
+      .poll(async () => {
+        const response = await page.request.get("/api/account/capabilities");
+        const body = (await response.json()) as { providers?: string[] };
+        return body.providers ?? [];
+      }, { timeout: 8_000 })
+      .toContain(provider);
 
-      await ready(page, "/admin/account");
-      await page.getByRole("button", { name: "Connected", exact: true }).click();
-      await page.getByRole("button", { name: "Disconnect", exact: true }).click();
+    await ready(page, "/admin/account");
+    await page.getByRole("button", { name: "Connected", exact: true }).click();
+    await page.getByRole("button", { name: "Disconnect", exact: true }).click();
 
-      await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
-      await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
-    } finally {
-      await page.request.put("/api/account/auth-config", {
-        data: { social: { [provider]: { enabled: false } } },
-      });
-    }
-  });
+    await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
+    await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
+  } finally {
+    await page.request.put("/api/account/auth-config", {
+      data: { social: { [provider]: { enabled: false } } },
+    });
+  }
 });
 
 test("two-factor setup shows a scannable QR code when enabled", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/app-flags.ui.spec.ts

@@ -0,0 +1,63 @@
+import { expect, test, type Page } from "@playwright/test";
+import { APP_FLAG_SETTINGS } from "../../apps/web/src/lib/admin/app-flags";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default). The Application tab lists the flags of
+// the app-owned apps/web/src/lib/admin/app-flags.ts; a generated app has none.
+// "only admins can change settings" covers the endpoint's refusal for other users.
+const listed = APP_FLAG_SETTINGS.map((setting) => setting.flag);
+
+async function appFlags(page: Page): Promise<Record<string, boolean>> {
+  const response = await page.request.get("/api/account/capabilities");
+  expect(response.ok()).toBeTruthy();
+  return ((await response.json()) as { appFlags?: Record<string, boolean> }).appFlags ?? {};
+}
+
+test("the Application tab shows the flags app-flags.ts lists, and only then", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  await expect(page.getByRole("tab", { name: "Authentication" })).toBeVisible();
+  const tab = page.getByRole("tab", { name: "Application" });
+  if (listed.length === 0) {
+    await expect(tab).toHaveCount(0);
+    return;
+  }
+  await tab.click();
+  const cards = page.locator("[data-app-flag]");
+  await expect(cards).toHaveCount(listed.length);
+  expect(await cards.evaluateAll((elements) => elements.map((element) => element.getAttribute("data-app-flag"))))
+    .toEqual(listed);
+  const flags = await appFlags(page);
+  for (const flag of listed) {
+    expect(flags, `${flag} is in APP_FLAG_DEFAULTS`).toHaveProperty(flag);
+    await expect(page.locator(`[data-app-flag="${flag}"]`).getByRole("switch"))
+      .toHaveAttribute("aria-checked", String(flags[flag]));
+  }
+});
+
+test("an application flag switch saves through the settings endpoint", { tag: "@exclusive" }, async ({ page }) => {
+  test.skip(listed.length === 0, "app-flags.ts lists no application flags");
+  const flag = listed[0] ?? "";
+  const original = (await appFlags(page))[flag] === true;
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Application" }).click();
+  const toggle = page.locator(`[data-app-flag="${flag}"]`).getByRole("switch");
+  await expect(toggle).toHaveAttribute("aria-checked", String(original));
+
+  try {
+    const saved = page.waitForResponse(
+      (response) => response.url().endsWith("/api/account/settings") && response.request().method() === "PUT",
+    );
+    await toggle.click();
+    expect((await saved).ok()).toBeTruthy();
+    await expect(page.getByText("Setting updated").last()).toBeVisible();
+    await expect.poll(async () => (await appFlags(page))[flag]).toBe(!original);
+
+    // The stored value survives a reload.
+    await ready(page, "/admin/settings");
+    await page.getByRole("tab", { name: "Application" }).click();
+    await expect(page.locator(`[data-app-flag="${flag}"]`).getByRole("switch"))
+      .toHaveAttribute("aria-checked", String(!original));
+  } finally {
+    await page.request.put("/api/account/settings", { data: { [flag]: original } });
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -1,6 +1,5 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
 
 // admin storageState (project default). The Appearance controls live in their
 // own "Appearance" settings tab.
@@ -49,20 +48,17 @@ test("appearance: advanced reveals per-token pickers", async ({ page }) => {
   await expect(page.getByLabel("Primary dark")).toBeVisible();
 });
 
-test("appearance: pick a preset, save, apply live, then restore @smoke", async ({ page }) => {
-  test.slow();
-  await exclusive("site-theme", async () => {
-    await openAppearance(page);
-    await page.getByRole("button", { name: "Slate" }).click();
-    await page.getByRole("button", { name: "Medium" }).click();
-    await page.getByRole("button", { name: "Save changes" }).click();
-    await expect(page.getByText("General settings saved.").first()).toBeVisible();
-    // Applied globally via the scoped override stylesheet.
-    await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
+test("appearance: pick a preset, save, apply live, then restore @smoke", { tag: "@exclusive" }, async ({ page }) => {
+  await openAppearance(page);
+  await page.getByRole("button", { name: "Slate" }).click();
+  await page.getByRole("button", { name: "Medium" }).click();
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("General settings saved.").first()).toBeVisible();
+  // Applied globally via the scoped override stylesheet.
+  await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
 
-    // "Restore defaults" reverts everything in one click and persists.
-    await page.getByRole("button", { name: "Restore defaults" }).click();
-    await expect(page.getByText("General settings saved.").first()).toBeVisible();
-    await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
-  });
+  // "Restore defaults" reverts everything in one click and persists.
+  await page.getByRole("button", { name: "Restore defaults" }).click();
+  await expect(page.getByText("General settings saved.").first()).toBeVisible();
+  await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/audit.ui.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "@playwright/test";
+import { ADMIN } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default). The Audit log page is gated by the
@@ -23,7 +24,7 @@ test("admin filters the audit log on the server", async ({ page }) => {
 
   await page.locator('button[data-slot="select-trigger"]').first().click(); // Action filter
   await page.getByRole("option", { name: "auth.login", exact: true }).click();
-  await page.locator("#toolbar-search").fill("admin@example.com");
+  await page.locator("#toolbar-search").fill(ADMIN.email);
   const filtered = page.waitForResponse((response) =>
     response.url().includes("/api/audit-logs?") &&
     response.url().includes("action=auth.login") &&
@@ -35,7 +36,7 @@ test("admin filters the audit log on the server", async ({ page }) => {
   const actions = table.locator("tbody tr td:nth-child(3)");
   await expect(actions.first()).toHaveText("auth.login");
   for (const text of await actions.allInnerTexts()) expect(text).toBe("auth.login");
-  await expect(table.getByText("admin@example.com").first()).toBeVisible();
+  await expect(table.getByText(ADMIN.email).first()).toBeVisible();
 });
 
 test("admin pages through the audit log", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -2,7 +2,6 @@ import { expect, test } from "@playwright/test";
 import { safeAuthRedirect, withAuthRedirect } from "../../apps/web/src/lib/auth-redirect";
 import { anonState, ADMIN } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
 
 test.use({ storageState: anonState });
 
@@ -66,43 +65,41 @@ test("closed social registration errors explain that existing users may sign in"
   );
 });
 
-test("configured social providers appear on the login page", async ({ page, playwright }) => {
+test("configured social providers appear on the login page", { tag: "@exclusive" }, async ({ page, playwright }) => {
   test.slow();
-  await exclusive("social-providers", async () => {
-    const admin = await playwright.request.newContext({
-      baseURL: base,
-      extraHTTPHeaders: { origin: base },
-    });
-    await admin.post("/api/auth/sign-in/email", {
-      data: { email: ADMIN.email, password: ADMIN.password },
-    });
-    try {
-      expect(
-        (await admin.put("/api/account/auth-config", {
-          data: {
-            social: {
-              google: {
-                enabled: true,
-                clientId: "dummy-google-client-id",
-                clientSecret: "dummy-google-client-secret",
-              },
+  const admin = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin: base },
+  });
+  await admin.post("/api/auth/sign-in/email", {
+    data: { email: ADMIN.email, password: ADMIN.password },
+  });
+  try {
+    expect(
+      (await admin.put("/api/account/auth-config", {
+        data: {
+          social: {
+            google: {
+              enabled: true,
+              clientId: "dummy-google-client-id",
+              clientSecret: "dummy-google-client-secret",
             },
           },
-        })).ok(),
-      ).toBeTruthy();
-      await expect
-        .poll(async () => {
-          await page.goto("/login");
-          return page.getByRole("button", { name: "Continue with Google" }).count();
-        }, { timeout: 8_000 })
-        .toBe(1);
-    } finally {
-      await admin.put("/api/account/auth-config", {
-        data: { social: { google: { enabled: false } } },
-      });
-      await admin.dispose();
-    }
-  });
+        },
+      })).ok(),
+    ).toBeTruthy();
+    await expect
+      .poll(async () => {
+        await page.goto("/login");
+        return page.getByRole("button", { name: "Continue with Google" }).count();
+      }, { timeout: 8_000 })
+      .toBe(1);
+  } finally {
+    await admin.put("/api/account/auth-config", {
+      data: { social: { google: { enabled: false } } },
+    });
+    await admin.dispose();
+  }
 });
 
 test("forgot-password shows a sent confirmation", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/dashboard.ui.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
+import { paths } from "../helpers/paths";
 
 // admin storageState (project default)
 test("overview shows the signed-in admin @smoke", async ({ page }) => {
@@ -11,7 +12,8 @@ test("overview shows the signed-in admin @smoke", async ({ page }) => {
 });
 
 test("landing shows language, theme, and signed-in account actions", async ({ page }) => {
-  await ready(page, "/");
+  test.skip(paths.accountMenu === null, "no page renders the account menu (tests/helpers/app-paths.ts)");
+  await ready(page, paths.accountMenu ?? "/");
   const language = page.getByRole("button", { name: /^(Language|언어)$/ });
   const theme = page.getByRole("button", { name: /^(Toggle theme|테마 전환)$/ });
   await expect(language).toBeVisible();
@@ -33,7 +35,7 @@ test("sidebar navigates to sessions and account @smoke", async ({ page }) => {
   await expect(page.getByRole("heading", { name: "User sessions" })).toBeVisible();
   // Account is reached from the user menu at the bottom of the sidebar, not the nav
   await expect(page.getByRole("link", { name: "Account" })).toHaveCount(0);
-  await page.getByRole("button", { name: /admin@example.com/ }).click();
+  await page.getByTestId("sidebar-user-menu").click();
   await page.getByRole("menuitem", { name: "Account" }).click();
   await expect(page).toHaveURL((url) => url.pathname === "/account");
   await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();

package/dist/templates/modules/admin-dashboard/files/tests/ui/email-admin.ui.spec.ts

@@ -1,6 +1,6 @@
 import { expect, test } from "../helpers/disposable-users";
 import { ready } from "../helpers/hydration";
-import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
+import { mailpitReachable, waitForLink } from "../helpers/mailpit";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
@@ -21,7 +21,6 @@ test("admin sends a password reset email to a user", async ({ page, disposableUs
   await ready(page, "/admin/users");
   const email = `admin-reset-${Date.now()}@example.com`;
   await disposableUsers.create({ email, name: "AR" });
-  await clearMailpit();
   await page.locator("#toolbar-search").fill(email);
   await page.getByRole("button", { name: "Search", exact: true }).click();
   await page.getByRole("row", { name: new RegExp(email) }).getByRole("button").click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
+import { mailpitReachable, waitForLink } from "../helpers/mailpit";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -20,7 +20,6 @@ test("forgot password: request, open the emailed link, set a new password, sign
   // The happy path ends by signing in; when verification is required that would be
   // blocked, so this UI walkthrough only applies with verification off.
   test.skip(verificationOn, "email verification enabled");
-  await clearMailpit();
 
   await ready(page, "/forgot-password");
   await page.getByLabel("Email").fill(email);