@podosoft/podokit 1.5.0 → 1.6.0

package/dist/templates/modules/admin-dashboard/files/tests/api/site-settings.api.spec.ts

@@ -1,7 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN } from "../helpers/accounts";
 import { expectObjectLength } from "../helpers/object-response";
-import { exclusive } from "../helpers/exclusive";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -18,36 +17,30 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
   return ctx;
 }
 
-test("theme settings: valid preset/radius/accent round-trip", async ({ playwright }) => {
-  test.slow();
-  await exclusive("site-theme", async () => {
-    const admin = await adminCtx(playwright);
-    const put = await admin.put("/api/site/settings", {
-      data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
-    });
-    expect(put.ok()).toBeTruthy();
+test("theme settings: valid preset/radius/accent round-trip", { tag: "@exclusive" }, async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const put = await admin.put("/api/site/settings", {
+    data: { themePreset: "slate", themeRadius: "0.75", brandColor: "#2563eb" },
+  });
+  expect(put.ok()).toBeTruthy();
 
-    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    const settings = await (await anon.get("/api/site/settings")).json();
-    expect(settings.themePreset).toBe("slate");
-    expect(settings.themeRadius).toBe("0.75");
-    expect(settings.brandColor).toBe("#2563eb");
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const settings = await (await anon.get("/api/site/settings")).json();
+  expect(settings.themePreset).toBe("slate");
+  expect(settings.themeRadius).toBe("0.75");
+  expect(settings.brandColor).toBe("#2563eb");
 
-    // restore
-    await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
-    await anon.dispose();
-  });
+  // restore
+  await admin.put("/api/site/settings", { data: { themePreset: "", themeRadius: "", brandColor: "" } });
+  await anon.dispose();
 });
 
-test("theme settings: valid per-token overrides accepted", async ({ playwright }) => {
-  test.slow();
-  await exclusive("site-theme", async () => {
-    const admin = await adminCtx(playwright);
-    const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
-    const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
-    expect(put.ok()).toBeTruthy();
-    await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
-  });
+test("theme settings: valid per-token overrides accepted", { tag: "@exclusive" }, async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const overrides = JSON.stringify({ light: { primary: "#123456" }, dark: { background: "#0a0a0a" } });
+  const put = await admin.put("/api/site/settings", { data: { themeOverrides: overrides } });
+  expect(put.ok()).toBeTruthy();
+  await admin.put("/api/site/settings", { data: { themeOverrides: "" } }); // restore
 });
 
 test("theme settings: invalid values are rejected (no CSS injection)", async ({ playwright }) => {
@@ -68,36 +61,33 @@ test("theme settings: invalid values are rejected (no CSS injection)", async ({
   }
 });
 
-test("site settings: one response shape and immediate reads after each write", async ({ playwright }) => {
-  test.slow();
-  await exclusive("site-general", async () => {
-    const admin = await adminCtx(playwright);
-    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
-    expect(Object.keys(before)).toEqual([
-      "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
-      "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
-      "hasFavicon", "faviconVersion",
-    ]);
-    expect(typeof before.hasFavicon).toBe("boolean");
-    expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
+test("site settings: one response shape and immediate reads after each write", { tag: "@exclusive" }, async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const before = await (await anon.get("/api/site/settings")).json() as Record<string, unknown>;
+  expect(Object.keys(before)).toEqual([
+    "name", "description", "supportEmail", "footerText", "brandColor", "themePreset", "themeRadius",
+    "themeOverrides", "termsUrl", "privacyUrl", "locale", "timezone", "maintenanceMode", "allowSignup",
+    "hasFavicon", "faviconVersion",
+  ]);
+  expect(typeof before.hasFavicon).toBe("boolean");
+  expect(before.faviconVersion === null || typeof before.faviconVersion === "string").toBe(true);
 
-    try {
-      // The second write lands while the first read is still cached; it must not be hidden.
-      for (const footerText of ["first footer", "second footer"]) {
-        expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
-        expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
-      }
-    } finally {
-      const footerText = typeof before.footerText === "string" ? before.footerText : "";
-      await admin.put("/api/site/settings", { data: { footerText } });
-      await anon.dispose();
-      await admin.dispose();
+  try {
+    // The second write lands while the first read is still cached; it must not be hidden.
+    for (const footerText of ["first footer", "second footer"]) {
+      expect((await admin.put("/api/site/settings", { data: { footerText } })).ok()).toBeTruthy();
+      expect((await (await anon.get("/api/site/settings")).json()).footerText).toBe(footerText);
     }
-  });
+  } finally {
+    const footerText = typeof before.footerText === "string" ? before.footerText : "";
+    await admin.put("/api/site/settings", { data: { footerText } });
+    await anon.dispose();
+    await admin.dispose();
+  }
 });
 
-test("site favicon: the versioned URL is cached for good and other URLs revalidate", async ({ playwright }) => {
+test("site favicon: the versioned URL is cached for good and other URLs revalidate", { tag: "@exclusive" }, async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   try {

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -42,11 +42,13 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
   await admin.dispose();
 });
 
-test("a normal user cannot create users (403)", async ({ playwright }) => {
+test("a normal user cannot create users (403)", async ({ playwright, disposableUsers }) => {
   const user = await signedIn(playwright, USER);
   const res = await user.post("/api/auth/admin/create-user", {
     data: { email: `nope-${Date.now()}@example.com`, password: "Podokit3e-Str0ng!pw", name: "Nope", role: "user" },
   });
+  // Remove the account if the request wrongly succeeded, before failing on it.
+  if (res.ok()) await disposableUsers.trackResponse(res);
   expect(res.status()).toBe(403);
   await user.dispose();
 });

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -1,7 +1,18 @@
+import { appAccounts } from "./app-accounts";
+
 export type Account = { name: string; email: string; password: string };
 
+const DEFAULT_PASSWORD = "Podokit3e-Str0ng!pw";
+
+function fromEnv(name: string): string | undefined {
+  const value = process.env[name];
+  return value !== undefined && value.length > 0 ? value : undefined;
+}
+
 /**
- * The password the suite signs in with, per account.
+ * The seeded accounts the suite signs in as. Each value comes from, in order,
+ * an `E2E_*` environment variable, the application-owned `app-accounts.ts`, and
+ * the generated default.
  *
  * A test must never change an existing account's credentials. `seed.setup.ts` signs up
  * idempotently and then signs in with these values, which is right on a stack the suite
@@ -19,13 +30,20 @@ export type Account = { name: string; email: string; password: string };
  * Without the override the run fails with `INVALID_EMAIL_OR_PASSWORD`, which is the correct
  * outcome — a refusal, not a silent overwrite. Do not commit a real value here.
  */
-function seedPassword(envVar: "E2E_ADMIN_PASSWORD" | "E2E_USER_PASSWORD"): string {
-  const value = process.env[envVar];
-  return value !== undefined && value.length > 0 ? value : "Podokit3e-Str0ng!pw";
+function seededAccount(
+  role: "ADMIN" | "USER",
+  configured: Partial<Account> | undefined,
+  defaults: Pick<Account, "name" | "email">,
+): Account {
+  return {
+    name: configured?.name ?? defaults.name,
+    email: fromEnv(`E2E_${role}_EMAIL`) ?? configured?.email ?? defaults.email,
+    password: fromEnv(`E2E_${role}_PASSWORD`) ?? configured?.password ?? DEFAULT_PASSWORD,
+  };
 }
 
-export const ADMIN = { name: "Admin", email: "admin@example.com", password: seedPassword("E2E_ADMIN_PASSWORD") };
-export const USER = { name: "Normal User", email: "user@example.com", password: seedPassword("E2E_USER_PASSWORD") };
+export const ADMIN = seededAccount("ADMIN", appAccounts.admin, { name: "Admin", email: "admin@example.com" });
+export const USER = seededAccount("USER", appAccounts.user, { name: "Normal User", email: "user@example.com" });
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
 export const userBaselineState = "playwright/.auth/user-baseline.json";

package/dist/templates/modules/admin-dashboard/files/tests/helpers/app-accounts.ts

@@ -0,0 +1,24 @@
+import type { Account } from "./accounts";
+
+/**
+ * The seeded accounts' names, addresses, or password sources when this
+ * application's differ from the generated `admin@example.com` and
+ * `user@example.com`. PodoKit creates this file once and never overwrites it.
+ * `E2E_ADMIN_EMAIL`, `E2E_USER_EMAIL`, `E2E_ADMIN_PASSWORD`, and
+ * `E2E_USER_PASSWORD` still win over what is set here.
+ *
+ * The seed signs the accounts up, so the API must promote the administrator:
+ * list its address in `ADMIN_EMAILS`. For example, accounts named by the
+ * application's own variables:
+ *
+ * ```ts
+ * export const appAccounts: AppAccounts = {
+ *   admin: { email: process.env.MYAPP_ADMIN_EMAIL, password: process.env.MYAPP_ADMIN_PASSWORD },
+ * };
+ * ```
+ *
+ * Never commit a real password here.
+ */
+export type AppAccounts = { admin?: Partial<Account>; user?: Partial<Account> };
+
+export const appAccounts: AppAccounts = {};

package/dist/templates/modules/admin-dashboard/files/tests/helpers/devices.ts

@@ -1,21 +1,51 @@
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
+/** The `name=value` of the session cookie a sign-in response sets. */
+function sessionCookie(response: Response): string | undefined {
+  for (const header of response.headers.getSetCookie()) {
+    const [pair = ""] = header.split(";");
+    const name = pair.slice(0, pair.indexOf("="));
+    // Better Auth names it `better-auth.session_token`, with a `__Secure-`
+    // prefix on HTTPS; the multi-session plugin's cookies end in the token.
+    if (name.endsWith("session_token")) return pair;
+  }
+  return undefined;
+}
+
+async function signIn(email: string, password: string, cookie?: string): Promise<Response> {
+  return fetch(`${base}/api/auth/sign-in/email`, {
+    method: "POST",
+    headers: { origin: base, "content-type": "application/json", ...(cookie ? { cookie } : {}) },
+    body: JSON.stringify({ email, password }),
+  });
+}
+
 /**
  * Signs in `count` times, each as a separate device, and returns the response
- * statuses. Each request carries no cookies: a Playwright request context keeps
- * the cookies of its earlier sign-ins, and Better Auth's multi-session plugin
- * deletes a same-user session that a sign-in request carries, so signing in
- * again from one context leaves one session instead of adding one.
+ * statuses.
+ *
+ * Sign-ins are authentication writes. From an anonymous client the rate
+ * limiter counts them against the per-address budget that every other spec's
+ * sign-ins share, so a hundred of them refused unrelated sign-ins elsewhere in
+ * the run. Only the first one is anonymous here; every later one carries the
+ * first sign-in's session cookie, so the limiter counts it against that
+ * session instead.
+ *
+ * A request carries that one cookie and nothing else: Better Auth's
+ * multi-session plugin deletes a same-user session that a sign-in carries in
+ * its multi-session cookies, so a client that kept every cookie would end with
+ * one session instead of `count`.
  */
 export async function signInOnSeparateDevices(email: string, password: string, count: number): Promise<number[]> {
-  const statuses: number[] = [];
-  for (let start = 0; start < count; start += 10) {
+  if (count < 1) return [];
+  const first = await signIn(email, password);
+  await first.body?.cancel();
+  const statuses = [first.status];
+  const cookie = sessionCookie(first);
+  if (first.status !== 200 || !cookie) return statuses;
+  for (let start = 1; start < count; start += 10) {
     const batch = Array.from({ length: Math.min(10, count - start) }, async () => {
-      const response = await fetch(`${base}/api/auth/sign-in/email`, {
-        method: "POST",
-        headers: { origin: base, "content-type": "application/json" },
-        body: JSON.stringify({ email, password }),
-      });
+      const response = await signIn(email, password, cookie);
       await response.body?.cancel();
       return response.status;
     });

package/dist/templates/modules/admin-dashboard/files/tests/helpers/disposable-users.ts

@@ -34,17 +34,19 @@ async function readCreatedUserId(response: CreatedUserResponse): Promise<string>
 
 export const test = base.extend<{ disposableUsers: DisposableUsers }>({
   disposableUsers: async ({ context, playwright }, use, testInfo) => {
-    // API projects do not inherit the UI project's admin storageState, while a
+    // API projects (`api` and its `api-exclusive` twin) do not inherit the UI
+    // project's admin storageState, while a
     // second admin sign-in can invalidate the shared UI session. API tests sign in
     // an isolated request context. UI tests copy the browser's admin cookies into
     // their own context once, so a test that later signs its page in as another
     // user does not turn cleanup into that user's (forbidden) requests.
+    const requestOnly = testInfo.project.name.replace(/-exclusive$/, "") === "api";
     const request = await playwright.request.newContext({
       baseURL,
       extraHTTPHeaders: origin,
-      ...(testInfo.project.name === "api" ? {} : { storageState: await context.storageState() }),
+      ...(requestOnly ? {} : { storageState: await context.storageState() }),
     });
-    if (testInfo.project.name === "api") {
+    if (requestOnly) {
       const signIn = await request.post("/api/auth/sign-in/email", {
         data: { email: ADMIN.email, password: ADMIN.password },
       });

package/dist/templates/modules/admin-dashboard/files/tests/helpers/mailpit.ts

@@ -1,5 +1,7 @@
 // Helpers for the local Mailpit catcher (docker-compose / CI service). Tests that
-// exercise email flows skip when it isn't reachable (see MAILPIT_URL).
+// exercise email flows skip when it isn't reachable (see MAILPIT_URL). Each test
+// mails an address of its own and reads the newest message to it; the inbox is
+// shared with tests on other workers, so no test empties it.
 const MAILPIT = process.env.MAILPIT_URL ?? "http://localhost:8025";
 
 export async function mailpitReachable(): Promise<boolean> {
@@ -10,14 +12,6 @@ export async function mailpitReachable(): Promise<boolean> {
   }
 }
 
-export async function clearMailpit(): Promise<void> {
-  try {
-    await fetch(`${MAILPIT}/api/v1/messages`, { method: "DELETE" });
-  } catch {
-    /* ignore */
-  }
-}
-
 type MailpitList = { messages: Array<{ ID: string; To: Array<{ Address: string }> }> };
 type MailpitMessage = { Text?: string; HTML?: string };
 

package/dist/templates/modules/admin-dashboard/files/tests/helpers/sms.ts

@@ -1,6 +1,8 @@
 // Read-back helper for the dev SMS sink (the "Mailpit for SMS"). The app posts
 // outgoing SMS to the sink via SMS_WEBHOOK_URL; tests poll it here to obtain the
 // delivered code, so the phone-number flow is verified for real (not just "sent").
+// Each test texts a number of its own; the sink is shared with tests on other
+// workers, so no test empties it.
 const SINK = process.env.SMS_SINK_URL ?? "http://localhost:8095";
 
 type SinkMessage = { to: string; body: string; receivedAt: string };
@@ -14,10 +16,6 @@ export async function smsSinkReachable(): Promise<boolean> {
   }
 }
 
-export async function clearSms(): Promise<void> {
-  await fetch(`${SINK}/messages`, { method: "DELETE" }).catch(() => undefined);
-}
-
 /** Poll the sink until an SMS to `to` arrives, then return the first 4–8 digit code. */
 export async function waitForSmsOtp(to: string, timeoutMs = 10_000): Promise<string> {
   const deadline = Date.now() + timeoutMs;

package/dist/templates/modules/admin-dashboard/files/tests/playwright.config.ts

@@ -1,10 +1,15 @@
 import { defineConfig, devices } from "@playwright/test";
-import { loadPlaywrightProjects } from "./playwright.extensions";
+import { e2eWorkers, loadPlaywrightProjects, withExclusivePhase } from "./playwright.extensions";
 
 // admin-dashboard overlay: adds a `setup` project that seeds admin/user sessions
-// (storageState) which the `ui` project reuses. Serial + single worker because
-// tests share one backend/DB. Runs against a live stack on E2E_BASE_URL.
+// (storageState) which the `ui` project reuses, and a `cleanup` project that
+// removes the users the suite created. Runs against a live stack on
+// E2E_BASE_URL. Tests share one backend and database: E2E_WORKERS sets the
+// worker count (default 1), and tests tagged @exclusive, which change state the
+// others rely on, run one at a time in `<project>-exclusive` twins after the
+// others (see playwright.extensions.ts). Each file runs on one worker in order.
 const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const workers = e2eWorkers();
 const coreProjects = [
   { name: "api", testMatch: /.*\.api\.spec\.ts/, dependencies: ["setup"] },
   { name: "setup", testMatch: /.*\.setup\.ts/, teardown: "cleanup" },
@@ -22,8 +27,9 @@ export default defineConfig({
   fullyParallel: false,
   forbidOnly: !!process.env.CI,
   retries: process.env.CI ? 2 : 0,
-  workers: 1,
+  workers,
+  globalSetup: "./playwright.extensions.ts",
   reporter: [["list"], ["html", { open: "never" }]],
   use: { baseURL, trace: "on-first-retry", screenshot: "only-on-failure" },
-  projects: [...coreProjects, ...loadPlaywrightProjects(coreProjects)],
+  projects: withExclusivePhase([...coreProjects, ...loadPlaywrightProjects(coreProjects)], workers),
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-flows.ui.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
-import { anonState } from "../helpers/accounts";
+import { ADMIN, anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { smsSinkReachable, clearSms, waitForSmsOtp } from "../helpers/sms";
+import { smsSinkReachable, waitForSmsOtp } from "../helpers/sms";
 
 // Each test drives a fresh disposable account (via a real UI login) so the shared
 // admin/user sessions are never mutated.
@@ -31,7 +31,6 @@ test("account: register and verify a phone number", async ({ page, playwright })
   test.skip((await phoneInput.count()) === 0, "phone number feature disabled");
 
   const phone = `+1555${String(Date.now()).slice(-7)}`;
-  await clearSms();
   await phoneInput.fill(phone);
   await page.getByRole("button", { name: "Send code" }).click();
   const code = await waitForSmsOtp(phone);
@@ -47,9 +46,9 @@ test("account: change email address", async ({ page, playwright }) => {
   await expect(page.getByText(/Email address updated|approve the change/)).toBeVisible();
 });
 
-test("account: delete my own account", async ({ page, playwright }) => {
+test("account: delete my own account", { tag: "@exclusive" }, async ({ page, playwright }) => {
   const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  await admin.post("/api/auth/sign-in/email", { data: { email: "admin@example.com", password: PW } });
+  await admin.post("/api/auth/sign-in/email", { data: { email: ADMIN.email, password: ADMIN.password } });
   try {
     // Account deletion is a server toggle (off by default) — enable it, then poll
     // until the capability is live (config store has a short TTL).

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
 import { ADMIN } from "../helpers/accounts";
-import { exclusive } from "../helpers/exclusive";
+import { paths } from "../helpers/paths";
 
 const PNG = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAIAAAADAQMAAACDJEzCAAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURWYzmf///129H+IAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gcVCSUTzXBDTwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wNy0yMVQwOTozNzoxOSswMDowMOuehLIAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDctMjFUMDk6Mzc6MTkrMDA6MDCawzwOAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTA3LTIxVDA5OjM3OjE5KzAwOjAwzdYd0QAAAAtJREFUCNdjYAABAAAGAAFm9MlsAAAAAElFTkSuQmCC",
@@ -17,7 +17,7 @@ test("account opens on the profile section @smoke", async ({ page }) => {
   await ready(page, "/admin/account");
   await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
   await expect(page.getByLabel("Name", { exact: true })).toBeVisible();
-  await expect(page.getByLabel("Email")).toHaveValue("admin@example.com");
+  await expect(page.getByLabel("Email")).toHaveValue(ADMIN.email);
   // save is enabled only once the name changes
   await expect(page.getByRole("button", { name: "Save changes" })).toBeDisabled();
   await page.getByLabel("Name", { exact: true }).fill(`Admin Preview ${Date.now()}`);
@@ -33,7 +33,7 @@ test("protected app routes do not inherit the admin shell @smoke", async ({ page
   await expect(page.getByTestId("sidebar-brand")).toBeVisible();
 });
 
-test("account displays profile image limits and updates every avatar", async ({ page }) => {
+test("account displays profile image limits and updates every avatar", { tag: "@exclusive" }, async ({ page }) => {
   await ready(page, "/account");
   await page.request.delete("/api/account/profile-image");
   await ready(page, "/account");
@@ -49,8 +49,10 @@ test("account displays profile image limits and updates every avatar", async ({
   await expect(page.getByText(/Profile image updated|프로필 이미지를 변경했습니다/)).toBeVisible();
   await expect(page.getByTestId("profile-image-preview").locator("img")).toBeVisible();
 
-  await ready(page, "/");
-  await expect(page.getByTestId("account-menu").locator("img")).toBeVisible();
+  if (paths.accountMenu !== null) {
+    await ready(page, paths.accountMenu);
+    await expect(page.getByTestId("account-menu").locator("img")).toBeVisible();
+  }
   await ready(page, "/admin");
   await expect(page.getByTestId("sidebar-user-menu").locator("img")).toBeVisible();
 
@@ -81,13 +83,13 @@ test("account rejects invalid profile images before upload", async ({ page }) =>
 test("account exposes a change-email action when the address is edited", async ({ page }) => {
   await ready(page, "/admin/account");
   const email = page.getByLabel("Email");
-  await expect(email).toHaveValue("admin@example.com");
+  await expect(email).toHaveValue(ADMIN.email);
   // no action until the address actually changes
   await expect(page.getByRole("button", { name: "Change email" })).toHaveCount(0);
-  await email.fill("admin+changed@example.com");
+  await email.fill(`changed.${ADMIN.email}`);
   await expect(page.getByRole("button", { name: "Change email" })).toBeVisible();
   // revert without submitting — don't mutate the shared admin session
-  await email.fill("admin@example.com");
+  await email.fill(ADMIN.email);
   await expect(page.getByRole("button", { name: "Change email" })).toHaveCount(0);
 });
 
@@ -145,7 +147,7 @@ test("account shows a phone field when enabled", async ({ page }) => {
   await expect(phone).toBeVisible();
 });
 
-test("admin can update their profile name", async ({ page }) => {
+test("admin can update their profile name", { tag: "@exclusive" }, async ({ page }) => {
   await ready(page, "/admin/account");
   const name = page.getByLabel("Name", { exact: true });
   await name.fill(`Admin Updated ${Date.now()}`);
@@ -230,58 +232,56 @@ test("account nav shows the core sections", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Sessions" })).toBeVisible();
 });
 
-test("connected account unlink uses the local account row id @smoke", async ({ page }) => {
+test("connected account unlink uses the local account row id @smoke", { tag: "@exclusive" }, async ({ page }) => {
   test.slow();
-  await exclusive("social-providers", async () => {
-    const provider = "google";
-    let unlinkBody: unknown;
-    await page.route("**/api/auth/list-accounts", (route) =>
-      route.fulfill({
-        status: 200,
-        contentType: "application/json",
-        body: JSON.stringify([
-          { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
-        ]),
-      }),
-    );
-    await page.route("**/api/auth/unlink-account", async (route) => {
-      unlinkBody = route.request().postDataJSON();
-      await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
-    });
+  const provider = "google";
+  let unlinkBody: unknown;
+  await page.route("**/api/auth/list-accounts", (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: "application/json",
+      body: JSON.stringify([
+        { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
+      ]),
+    }),
+  );
+  await page.route("**/api/auth/unlink-account", async (route) => {
+    unlinkBody = route.request().postDataJSON();
+    await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
+  });
 
-    try {
-      const enabled = await page.request.put("/api/account/auth-config", {
-        data: {
-          social: {
-            [provider]: {
-              enabled: true,
-              clientId: "podokit",
-              clientSecret: "podokit",
-            },
+  try {
+    const enabled = await page.request.put("/api/account/auth-config", {
+      data: {
+        social: {
+          [provider]: {
+            enabled: true,
+            clientId: "podokit",
+            clientSecret: "podokit",
           },
         },
-      });
-      expect(enabled.ok()).toBeTruthy();
-      await expect
-        .poll(async () => {
-          const response = await page.request.get("/api/account/capabilities");
-          const body = (await response.json()) as { providers?: string[] };
-          return body.providers ?? [];
-        }, { timeout: 8_000 })
-        .toContain(provider);
+      },
+    });
+    expect(enabled.ok()).toBeTruthy();
+    await expect
+      .poll(async () => {
+        const response = await page.request.get("/api/account/capabilities");
+        const body = (await response.json()) as { providers?: string[] };
+        return body.providers ?? [];
+      }, { timeout: 8_000 })
+      .toContain(provider);
 
-      await ready(page, "/admin/account");
-      await page.getByRole("button", { name: "Connected", exact: true }).click();
-      await page.getByRole("button", { name: "Disconnect", exact: true }).click();
+    await ready(page, "/admin/account");
+    await page.getByRole("button", { name: "Connected", exact: true }).click();
+    await page.getByRole("button", { name: "Disconnect", exact: true }).click();
 
-      await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
-      await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
-    } finally {
-      await page.request.put("/api/account/auth-config", {
-        data: { social: { [provider]: { enabled: false } } },
-      });
-    }
-  });
+    await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
+    await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
+  } finally {
+    await page.request.put("/api/account/auth-config", {
+      data: { social: { [provider]: { enabled: false } } },
+    });
+  }
 });
 
 test("two-factor setup shows a scannable QR code when enabled", async ({ page }) => {