@podosoft/podokit 1.4.2 → 1.6.0

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -1,14 +1,12 @@
 import { expect, test, type Page } from "@playwright/test";
 import { anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
+import { paths } from "../helpers/paths";
 
 // Verifies that the General settings actually take effect (not just persist).
 // The admin storageState (project default) drives the toggles; a fresh anonymous
-// context checks the public-facing result. The site-general lock keeps other
-// specs that save these settings out while one runs, also with --workers above
-// 1; restores run in a `finally` so a mid-test failure still leaves the shared
-// site settings clean.
+// context checks the public-facing result. Restores run in a `finally` so a
+// mid-test failure still leaves the shared site settings clean.
 
 async function saveGeneral(
   page: Page,
@@ -30,110 +28,103 @@ async function saveGeneral(
   await expect(page.getByText("General settings saved.").last()).toBeVisible();
 }
 
-test("general: empty locale displays the application default", async ({ page }) => {
-  test.slow();
-  await exclusive("site-general", async () => {
-    await ready(page, "/admin/settings");
-    const origin = new URL(page.url()).origin;
-    const settingsUrl = `${origin}/api/site/settings`;
-    const previous = await (await page.request.get(settingsUrl)).json() as { locale?: string };
+test("general: empty locale displays the application default", { tag: "@exclusive" }, async ({ page }) => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  const settingsUrl = `${origin}/api/site/settings`;
+  const previous = await (await page.request.get(settingsUrl)).json() as { locale?: string };
 
-    try {
-      expect((await page.request.put(settingsUrl, { data: { locale: "" } })).ok()).toBeTruthy();
-      await ready(page, "/admin/settings");
-      await expect(page.locator("#locale")).toContainText("English");
-    } finally {
-      await page.request.put(settingsUrl, { data: { locale: previous.locale ?? "" } });
-    }
-  });
+  try {
+    expect((await page.request.put(settingsUrl, { data: { locale: "" } })).ok()).toBeTruthy();
+    await ready(page, "/admin/settings");
+    await expect(page.locator("#locale")).toContainText("English");
+  } finally {
+    await page.request.put(settingsUrl, { data: { locale: previous.locale ?? "" } });
+  }
 });
 
-test("general: footer text and links render on public pages", async ({ page, browser }) => {
+test("general: footer text and links render on public pages", { tag: "@exclusive" }, async ({ page, browser }) => {
+  test.skip(paths.footer === null, "no public page renders the site footer (tests/helpers/app-paths.ts)");
   test.slow();
-  await exclusive("site-general", async () => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  const footer = page.getByLabel("Footer text");
+  const support = page.getByLabel("Support email");
+  const origFooter = await footer.inputValue();
+  const origSupport = await support.inputValue();
+  await saveGeneral(
+    page,
+    async () => {
+      await footer.fill("© 2026 PodoKit Test");
+      await support.fill("help@example.com");
+    },
+    { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
+  );
+  try {
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}${paths.footer}`);
+    const footerBlock = anon.getByTestId("site-footer");
+    await expect(footerBlock.getByText("© 2026 PodoKit Test")).toBeVisible();
+    await expect(footerBlock.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
+    await ctx.close();
+  } finally {
     await ready(page, "/admin/settings");
-    const origin = new URL(page.url()).origin;
-    const footer = page.getByLabel("Footer text");
-    const support = page.getByLabel("Support email");
-    const origFooter = await footer.inputValue();
-    const origSupport = await support.inputValue();
     await saveGeneral(
       page,
       async () => {
-        await footer.fill("© 2026 PodoKit Test");
-        await support.fill("help@example.com");
+        await page.getByLabel("Footer text").fill(origFooter);
+        await page.getByLabel("Support email").fill(origSupport);
       },
-      { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
+      { footerText: origFooter, supportEmail: origSupport },
     );
-    try {
-      const ctx = await browser.newContext({ storageState: anonState });
-      const anon = await ctx.newPage();
-      await anon.goto(`${origin}/login`);
-      await expect(anon.getByText("© 2026 PodoKit Test")).toBeVisible();
-      await expect(anon.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
-      await ctx.close();
-    } finally {
-      await ready(page, "/admin/settings");
-      await saveGeneral(
-        page,
-        async () => {
-          await page.getByLabel("Footer text").fill(origFooter);
-          await page.getByLabel("Support email").fill(origSupport);
-        },
-        { footerText: origFooter, supportEmail: origSupport },
-      );
-    }
-  });
+  }
 });
 
-test("general: maintenance mode holds non-admins on the maintenance page", async ({ page, browser }) => {
+test("general: maintenance mode holds non-admins on the maintenance page", { tag: "@exclusive" }, async ({ page, browser }) => {
   test.slow();
-  await exclusive("site-general", async () => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  await page.getByRole("switch", { name: "Maintenance mode" }).click();
+  await saveGeneral(page);
+  try {
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}${paths.home}`);
+    await expect(anon).toHaveURL(/\/maintenance$/);
+    await expect(anon.getByRole("heading", { name: "Under maintenance" })).toBeVisible();
+    await ctx.close();
+    // the admin is not held back
+    await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
+  } finally {
     await ready(page, "/admin/settings");
-    const origin = new URL(page.url()).origin;
-    await page.getByRole("switch", { name: "Maintenance mode" }).click();
-    await saveGeneral(page);
-    try {
-      const ctx = await browser.newContext({ storageState: anonState });
-      const anon = await ctx.newPage();
-      await anon.goto(`${origin}/`);
-      await expect(anon).toHaveURL(/\/maintenance$/);
-      await expect(anon.getByRole("heading", { name: "Under maintenance" })).toBeVisible();
-      await ctx.close();
-      // the admin is not held back
-      await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
-    } finally {
-      await ready(page, "/admin/settings");
-      const t = page.getByRole("switch", { name: "Maintenance mode" });
-      if (await t.isChecked()) {
-        await t.click();
-        await saveGeneral(page);
-      }
+    const t = page.getByRole("switch", { name: "Maintenance mode" });
+    if (await t.isChecked()) {
+      await t.click();
+      await saveGeneral(page);
     }
-  });
+  }
 });
 
-test("general: closing sign-up redirects /signup and hides the link", async ({ page, browser }) => {
+test("general: closing sign-up redirects /signup and hides the link", { tag: "@exclusive" }, async ({ page, browser }) => {
   test.slow();
-  await exclusive("site-general", async () => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  await page.getByRole("switch", { name: "Allow public sign-up" }).click();
+  await saveGeneral(page);
+  try {
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}/signup`);
+    await expect(anon).toHaveURL(/\/login/);
+    await expect(anon.getByRole("link", { name: "Sign up" })).toHaveCount(0);
+    await ctx.close();
+  } finally {
     await ready(page, "/admin/settings");
-    const origin = new URL(page.url()).origin;
-    await page.getByRole("switch", { name: "Allow public sign-up" }).click();
-    await saveGeneral(page);
-    try {
-      const ctx = await browser.newContext({ storageState: anonState });
-      const anon = await ctx.newPage();
-      await anon.goto(`${origin}/signup`);
-      await expect(anon).toHaveURL(/\/login/);
-      await expect(anon.getByRole("link", { name: "Sign up" })).toHaveCount(0);
-      await ctx.close();
-    } finally {
-      await ready(page, "/admin/settings");
-      const t = page.getByRole("switch", { name: "Allow public sign-up" });
-      if (!(await t.isChecked())) {
-        await t.click();
-        await saveGeneral(page);
-      }
+    const t = page.getByRole("switch", { name: "Allow public sign-up" });
+    if (!(await t.isChecked())) {
+      await t.click();
+      await saveGeneral(page);
     }
-  });
+  }
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/guards.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { anonState, userState } from "../helpers/accounts";
+import { paths } from "../helpers/paths";
 
 test.describe("unauthenticated", () => {
   test.use({ storageState: anonState });
@@ -16,8 +17,11 @@ test.describe("unauthenticated", () => {
       expect(response.headers()["x-robots-tag"]).toBe("noindex, nofollow");
     }
 
-    const landing = await request.get("/");
-    expect(landing.headers()["x-robots-tag"]).toBeUndefined();
+    // Public pages come from tests/helpers/app-paths.ts.
+    for (const route of paths.indexable) {
+      const response = await request.get(route);
+      expect(response.headers()["x-robots-tag"], route).toBeUndefined();
+    }
   });
 });
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/i18n.ui.spec.ts

@@ -1,7 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN, adminState, anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
 
 test.use({ storageState: anonState });
 
@@ -23,27 +22,24 @@ test("language switch updates messages and <html lang>", async ({ page }) => {
   }
 });
 
-test("explicit English overrides a Korean site fallback", async ({ page, playwright }) => {
-  test.slow();
-  await exclusive("site-general", async () => {
-    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    await admin.post("/api/auth/sign-in/email", {
-      data: { email: ADMIN.email, password: ADMIN.password },
-    });
-    const previous = await (await admin.get("/api/site/settings")).json() as { locale?: string };
+test("explicit English overrides a Korean site fallback", { tag: "@exclusive" }, async ({ page, playwright }) => {
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", {
+    data: { email: ADMIN.email, password: ADMIN.password },
+  });
+  const previous = await (await admin.get("/api/site/settings")).json() as { locale?: string };
 
-    try {
-      expect((await admin.put("/api/site/settings", { data: { locale: "ko" } })).ok()).toBeTruthy();
-      await page.context().addCookies([{ name: "locale", value: "en", url: base }]);
-      await ready(page, "/login");
+  try {
+    expect((await admin.put("/api/site/settings", { data: { locale: "ko" } })).ok()).toBeTruthy();
+    await page.context().addCookies([{ name: "locale", value: "en", url: base }]);
+    await ready(page, "/login");
 
-      await expect(page.locator("html")).toHaveAttribute("lang", "en");
-      await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
-    } finally {
-      await admin.put("/api/site/settings", { data: { locale: previous.locale ?? "en" } });
-      await admin.dispose();
-    }
-  });
+    await expect(page.locator("html")).toHaveAttribute("lang", "en");
+    await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
+  } finally {
+    await admin.put("/api/site/settings", { data: { locale: previous.locale ?? "en" } });
+    await admin.dispose();
+  }
 });
 
 test("managed admin labels react to locale changes", async ({ browser }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/impersonation.ui.spec.ts

@@ -13,9 +13,12 @@ test("admin can impersonate a user and stop", async ({ page }) => {
   await row.getByRole("button").click();
   await page.getByRole("menuitem", { name: "Impersonate" }).click();
 
-  // Impersonating a normal user leaves the admin-only route group and keeps a
-  // visible route back to the original administrator session.
-  await expect(page).toHaveURL(/\/account(\/|$)/);
+  // Impersonating a normal user leaves the admin-only route group. Where the
+  // application-owned users page lands is the application's choice; the managed
+  // account page always offers the route back to the administrator session.
+  await expect(page).not.toHaveURL(/\/admin\/users/);
+  await ready(page, "/account");
+  await expect(page.getByText(`Impersonating ${USER.email}`)).toBeVisible();
   const stop = page.getByRole("button", { name: "Stop impersonating" });
   await expect(stop).toBeVisible();
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/login-methods.ui.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { mailpitReachable, clearMailpit, waitForOtp } from "../helpers/mailpit";
+import { mailpitReachable, waitForOtp } from "../helpers/mailpit";
 
 test.use({ storageState: anonState });
 
@@ -26,10 +26,9 @@ test("login: an emailed one-time code signs a user in", async ({ page, playwrigh
   test.skip(!caps?.emailOtp, "email otp disabled");
   test.skip(!(await mailpitReachable()), "mailpit unreachable");
 
-  const email = `otp-${Date.now()}@example.com`;
+  const email = `ui-otp-${Date.now()}@example.com`;
   await api.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "OTP" } });
   await api.dispose();
-  await clearMailpit();
 
   await ready(page, "/login");
   await page.locator("#email").fill(email);

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -1,6 +1,5 @@
 import { expect, test, type Page } from "@playwright/test";
 import { createHash, randomBytes } from "node:crypto";
-import { exclusive } from "../helpers/exclusive";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — the admin is the resource owner.
@@ -14,10 +13,9 @@ const REDIRECT = "https://example.com/callback";
 // (with PKCE) that validates the client and hands off to the consent page. The
 // back-channel token exchange is driven by an OIDC client SDK / real RP — see
 // docs/modules.md for the manual round-trip checklist.
-test("OIDC provider: discovery, JWKS, client registration, authorize handoff", async ({ page, baseURL }) => {
-  // tests/api/auth.api.spec.ts also toggles the provider; the lock keeps the two apart.
+test("OIDC provider: discovery, JWKS, client registration, authorize handoff", { tag: "@exclusive" }, async ({ page, baseURL }) => {
   test.slow();
-  await exclusive("oidc-provider", () => frontChannel(page, baseURL));
+  await frontChannel(page, baseURL);
 });
 
 async function frontChannel(page: Page, baseURL: string | undefined): Promise<void> {

package/dist/templates/modules/admin-dashboard/files/tests/ui/organizations.ui.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "@playwright/test";
+import { USER } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — organizations is an admin-only view
@@ -38,7 +39,9 @@ test("create an org with a non-ascii name, a parent, and a manager", async ({ pa
   await page.getByLabel("Name", { exact: true }).fill(child);
   await page.locator("#o-parent").click();
   await page.getByRole("option", { name: parent }).click();
-  await page.getByRole("checkbox").first().click(); // first existing user as a manager
+  // The seeded user, not the first listed one: tests on other workers add and
+  // remove users while this one runs.
+  await page.locator("label", { hasText: USER.email }).getByRole("checkbox").click();
   await page.getByRole("dialog").getByRole("button", { name: "Create", exact: true }).click();
   await expect(page.getByText("Organization created").first()).toBeVisible();
   // child row shows the parent org name
@@ -64,7 +67,7 @@ test("organization manage: remove a member, invite one, and cancel the invite",
   await page.getByLabel("Name", { exact: true }).fill(name);
   // Seed a specific non-owner member (the admin is always the owner, so pick the
   // seeded user — .first() is order-dependent and could hit the owner).
-  await page.locator("label", { hasText: "user@example.com" }).getByRole("checkbox").click();
+  await page.locator("label", { hasText: USER.email }).getByRole("checkbox").click();
   await page.getByRole("dialog").getByRole("button", { name: "Create", exact: true }).click();
   await expect(page.getByText("Organization created").first()).toBeVisible();
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/passkey.ui.spec.ts

@@ -29,9 +29,14 @@ test("register a passkey and sign in with it", async ({ page, baseURL }) => {
   await addBtn.click();
   await expect(page.getByText("Passkey added")).toBeVisible();
 
-  // Sign out, then sign back in using only the passkey.
-  await page.context().request.post("/api/auth/sign-out", { headers: origin });
+  // Sign out, then sign back in using only the passkey. Check the sign-out: a
+  // session left behind would pass the URL check below without the passkey.
+  const signOut = await page.context().request.post("/api/auth/sign-out", { headers: origin, data: {} });
+  expect(signOut.ok(), await signOut.text()).toBeTruthy();
+  expect(await (await page.context().request.get("/api/auth/get-session")).json()).toBeNull();
   await ready(page, "/login");
   await page.getByRole("button", { name: "Use a passkey" }).click();
   await expect(page).toHaveURL(new URL("/", baseURL).toString());
+  const session = await (await page.context().request.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(email);
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/same-origin-requests.ui.spec.ts

@@ -0,0 +1,89 @@
+import { expect } from "@playwright/test";
+import { test } from "../helpers/disposable-users";
+import { ready } from "../helpers/hydration";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = new URL(base).origin;
+// A 1 by 1 pixel PNG.
+const PIXEL_PNG = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=";
+
+// SvelteKit answers 403 "Cross-site ... form submissions are forbidden" to a POST,
+// PUT, PATCH, or DELETE that has no content type or one an HTML form can send,
+// unless its Origin header names the origin the web server resolved. The browser
+// sends Origin with every same-origin request below, so FormData uploads and
+// requests without a body reach the API through the /api proxy as they are. When
+// a deployment returns that 403 anyway, the web server resolved another origin,
+// such as http:// behind a TLS proxy whose X-Forwarded-Proto the ingress replaced.
+test("same-origin uploads and requests without a body pass the origin check", async ({
+  browser,
+  playwright,
+  disposableUsers,
+}) => {
+  const email = `same-origin-${Date.now()}@example.com`;
+  const password = "Same-origin-password-1";
+  await disposableUsers.create({ email, password, name: "Same origin" });
+  // Start without the project's administrator cookies: with the multi-session
+  // plugin, signing out ends every session the browser holds.
+  const signIn = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin },
+    storageState: { cookies: [], origins: [] },
+  });
+  expect((await signIn.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  const context = await browser.newContext({ storageState: await signIn.storageState() });
+  await signIn.dispose();
+  const page = await context.newPage();
+  try {
+    await ready(page, "/account");
+    const origins: Record<string, string | undefined> = {};
+    const recorded: Promise<void>[] = [];
+    page.on("request", (request) => {
+      const { pathname } = new URL(request.url());
+      if (!pathname.startsWith("/api/")) return;
+      recorded.push(request.allHeaders().then((headers) => {
+        origins[`${request.method()} ${pathname}`] = headers.origin;
+      }));
+    });
+
+    const results = await page.evaluate(async (png) => {
+      const bytes = Uint8Array.from(atob(png), (char) => char.charCodeAt(0));
+      const form = new FormData();
+      form.set("file", new Blob([bytes], { type: "image/png" }), "pixel.png");
+      const answer = async (response: Response): Promise<{ status: number; body: string }> => ({
+        status: response.status,
+        body: await response.text(),
+      });
+      return {
+        upload: await answer(await fetch("/api/account/profile-image", { method: "POST", body: form })),
+        remove: await answer(await fetch("/api/account/profile-image", { method: "DELETE" })),
+        urlencoded: await answer(
+          await fetch("/api/account/profile-image", {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: "file=pixel",
+          }),
+        ),
+        signOut: await answer(await fetch("/api/auth/sign-out", { method: "POST" })),
+      };
+    }, PIXEL_PNG);
+
+    // The multipart upload and the DELETE without a body reached the API and succeeded.
+    expect(results.upload.status, results.upload.body).toBe(201);
+    expect(JSON.parse(results.upload.body)).toMatchObject({ image: expect.stringContaining("/api/") });
+    expect(results.remove.status, results.remove.body).toBe(200);
+    // A form-encoded body is not an image, so the API, not SvelteKit, refuses it.
+    expect(results.urlencoded.body).not.toContain("Cross-site");
+    expect(JSON.parse(results.urlencoded.body)).toMatchObject({ success: false });
+    // A POST without a body or content type signs the user out.
+    expect(results.signOut.status, results.signOut.body).toBe(200);
+
+    await Promise.all(recorded);
+    expect(origins).toMatchObject({
+      "POST /api/account/profile-image": origin,
+      "DELETE /api/account/profile-image": origin,
+      "POST /api/auth/sign-out": origin,
+    });
+  } finally {
+    await context.close();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/sessions.ui.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "../helpers/disposable-users";
+import { USER } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -36,14 +37,14 @@ test("admin sees user sessions across users", async ({ page }) => {
   // Search by exact address — robust to pagination as sessions accumulate (the
   // admin account alone can fill the first page). This is the across-users view.
   const searched = page.waitForResponse(
-    (response) => isSessionList(response.url()) && new URL(response.url()).searchParams.get("search") === "user@example.com",
+    (response) => isSessionList(response.url()) && new URL(response.url()).searchParams.get("search") === USER.email,
   );
-  await page.locator("#toolbar-search").fill("user@example.com");
+  await page.locator("#toolbar-search").fill(USER.email);
   await page.getByRole("button", { name: "Search", exact: true }).click();
   expect((await searched).ok()).toBeTruthy();
-  await expect(page.getByRole("main").getByText("user@example.com").first()).toBeVisible();
+  await expect(page.getByRole("main").getByText(USER.email).first()).toBeVisible();
   // row actions are available
-  await page.getByRole("row", { name: /user@example.com/ }).first().getByRole("button").click();
+  await page.getByRole("row", { name: USER.email }).first().getByRole("button").click();
   await expect(page.getByRole("menuitem", { name: "Revoke session" })).toBeVisible();
   await expect(page.getByRole("menuitem", { name: "Revoke all for user" })).toBeVisible();
 });