@podosoft/podokit 1.5.0 → 1.6.0

package/dist/templates/modules/admin-dashboard/files/tests/ui/app-flags.ui.spec.ts

@@ -0,0 +1,63 @@
+import { expect, test, type Page } from "@playwright/test";
+import { APP_FLAG_SETTINGS } from "../../apps/web/src/lib/admin/app-flags";
+import { ready } from "../helpers/hydration";
+
+// admin storageState (project default). The Application tab lists the flags of
+// the app-owned apps/web/src/lib/admin/app-flags.ts; a generated app has none.
+// "only admins can change settings" covers the endpoint's refusal for other users.
+const listed = APP_FLAG_SETTINGS.map((setting) => setting.flag);
+
+async function appFlags(page: Page): Promise<Record<string, boolean>> {
+  const response = await page.request.get("/api/account/capabilities");
+  expect(response.ok()).toBeTruthy();
+  return ((await response.json()) as { appFlags?: Record<string, boolean> }).appFlags ?? {};
+}
+
+test("the Application tab shows the flags app-flags.ts lists, and only then", async ({ page }) => {
+  await ready(page, "/admin/settings");
+  await expect(page.getByRole("tab", { name: "Authentication" })).toBeVisible();
+  const tab = page.getByRole("tab", { name: "Application" });
+  if (listed.length === 0) {
+    await expect(tab).toHaveCount(0);
+    return;
+  }
+  await tab.click();
+  const cards = page.locator("[data-app-flag]");
+  await expect(cards).toHaveCount(listed.length);
+  expect(await cards.evaluateAll((elements) => elements.map((element) => element.getAttribute("data-app-flag"))))
+    .toEqual(listed);
+  const flags = await appFlags(page);
+  for (const flag of listed) {
+    expect(flags, `${flag} is in APP_FLAG_DEFAULTS`).toHaveProperty(flag);
+    await expect(page.locator(`[data-app-flag="${flag}"]`).getByRole("switch"))
+      .toHaveAttribute("aria-checked", String(flags[flag]));
+  }
+});
+
+test("an application flag switch saves through the settings endpoint", { tag: "@exclusive" }, async ({ page }) => {
+  test.skip(listed.length === 0, "app-flags.ts lists no application flags");
+  const flag = listed[0] ?? "";
+  const original = (await appFlags(page))[flag] === true;
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Application" }).click();
+  const toggle = page.locator(`[data-app-flag="${flag}"]`).getByRole("switch");
+  await expect(toggle).toHaveAttribute("aria-checked", String(original));
+
+  try {
+    const saved = page.waitForResponse(
+      (response) => response.url().endsWith("/api/account/settings") && response.request().method() === "PUT",
+    );
+    await toggle.click();
+    expect((await saved).ok()).toBeTruthy();
+    await expect(page.getByText("Setting updated").last()).toBeVisible();
+    await expect.poll(async () => (await appFlags(page))[flag]).toBe(!original);
+
+    // The stored value survives a reload.
+    await ready(page, "/admin/settings");
+    await page.getByRole("tab", { name: "Application" }).click();
+    await expect(page.locator(`[data-app-flag="${flag}"]`).getByRole("switch"))
+      .toHaveAttribute("aria-checked", String(!original));
+  } finally {
+    await page.request.put("/api/account/settings", { data: { [flag]: original } });
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -1,6 +1,5 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
 
 // admin storageState (project default). The Appearance controls live in their
 // own "Appearance" settings tab.
@@ -49,20 +48,17 @@ test("appearance: advanced reveals per-token pickers", async ({ page }) => {
   await expect(page.getByLabel("Primary dark")).toBeVisible();
 });
 
-test("appearance: pick a preset, save, apply live, then restore @smoke", async ({ page }) => {
-  test.slow();
-  await exclusive("site-theme", async () => {
-    await openAppearance(page);
-    await page.getByRole("button", { name: "Slate" }).click();
-    await page.getByRole("button", { name: "Medium" }).click();
-    await page.getByRole("button", { name: "Save changes" }).click();
-    await expect(page.getByText("General settings saved.").first()).toBeVisible();
-    // Applied globally via the scoped override stylesheet.
-    await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
+test("appearance: pick a preset, save, apply live, then restore @smoke", { tag: "@exclusive" }, async ({ page }) => {
+  await openAppearance(page);
+  await page.getByRole("button", { name: "Slate" }).click();
+  await page.getByRole("button", { name: "Medium" }).click();
+  await page.getByRole("button", { name: "Save changes" }).click();
+  await expect(page.getByText("General settings saved.").first()).toBeVisible();
+  // Applied globally via the scoped override stylesheet.
+  await expect.poll(async () => page.locator("#podokit-theme").count()).toBeGreaterThan(0);
 
-    // "Restore defaults" reverts everything in one click and persists.
-    await page.getByRole("button", { name: "Restore defaults" }).click();
-    await expect(page.getByText("General settings saved.").first()).toBeVisible();
-    await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
-  });
+  // "Restore defaults" reverts everything in one click and persists.
+  await page.getByRole("button", { name: "Restore defaults" }).click();
+  await expect(page.getByText("General settings saved.").first()).toBeVisible();
+  await expect.poll(async () => page.locator("#podokit-theme").count()).toBe(0);
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/audit.ui.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "@playwright/test";
+import { ADMIN } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default). The Audit log page is gated by the
@@ -23,7 +24,7 @@ test("admin filters the audit log on the server", async ({ page }) => {
 
   await page.locator('button[data-slot="select-trigger"]').first().click(); // Action filter
   await page.getByRole("option", { name: "auth.login", exact: true }).click();
-  await page.locator("#toolbar-search").fill("admin@example.com");
+  await page.locator("#toolbar-search").fill(ADMIN.email);
   const filtered = page.waitForResponse((response) =>
     response.url().includes("/api/audit-logs?") &&
     response.url().includes("action=auth.login") &&
@@ -35,7 +36,7 @@ test("admin filters the audit log on the server", async ({ page }) => {
   const actions = table.locator("tbody tr td:nth-child(3)");
   await expect(actions.first()).toHaveText("auth.login");
   for (const text of await actions.allInnerTexts()) expect(text).toBe("auth.login");
-  await expect(table.getByText("admin@example.com").first()).toBeVisible();
+  await expect(table.getByText(ADMIN.email).first()).toBeVisible();
 });
 
 test("admin pages through the audit log", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -2,7 +2,6 @@ import { expect, test } from "@playwright/test";
 import { safeAuthRedirect, withAuthRedirect } from "../../apps/web/src/lib/auth-redirect";
 import { anonState, ADMIN } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
 
 test.use({ storageState: anonState });
 
@@ -66,43 +65,41 @@ test("closed social registration errors explain that existing users may sign in"
   );
 });
 
-test("configured social providers appear on the login page", async ({ page, playwright }) => {
+test("configured social providers appear on the login page", { tag: "@exclusive" }, async ({ page, playwright }) => {
   test.slow();
-  await exclusive("social-providers", async () => {
-    const admin = await playwright.request.newContext({
-      baseURL: base,
-      extraHTTPHeaders: { origin: base },
-    });
-    await admin.post("/api/auth/sign-in/email", {
-      data: { email: ADMIN.email, password: ADMIN.password },
-    });
-    try {
-      expect(
-        (await admin.put("/api/account/auth-config", {
-          data: {
-            social: {
-              google: {
-                enabled: true,
-                clientId: "dummy-google-client-id",
-                clientSecret: "dummy-google-client-secret",
-              },
+  const admin = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin: base },
+  });
+  await admin.post("/api/auth/sign-in/email", {
+    data: { email: ADMIN.email, password: ADMIN.password },
+  });
+  try {
+    expect(
+      (await admin.put("/api/account/auth-config", {
+        data: {
+          social: {
+            google: {
+              enabled: true,
+              clientId: "dummy-google-client-id",
+              clientSecret: "dummy-google-client-secret",
             },
           },
-        })).ok(),
-      ).toBeTruthy();
-      await expect
-        .poll(async () => {
-          await page.goto("/login");
-          return page.getByRole("button", { name: "Continue with Google" }).count();
-        }, { timeout: 8_000 })
-        .toBe(1);
-    } finally {
-      await admin.put("/api/account/auth-config", {
-        data: { social: { google: { enabled: false } } },
-      });
-      await admin.dispose();
-    }
-  });
+        },
+      })).ok(),
+    ).toBeTruthy();
+    await expect
+      .poll(async () => {
+        await page.goto("/login");
+        return page.getByRole("button", { name: "Continue with Google" }).count();
+      }, { timeout: 8_000 })
+      .toBe(1);
+  } finally {
+    await admin.put("/api/account/auth-config", {
+      data: { social: { google: { enabled: false } } },
+    });
+    await admin.dispose();
+  }
 });
 
 test("forgot-password shows a sent confirmation", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/dashboard.ui.spec.ts

@@ -1,6 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
+import { paths } from "../helpers/paths";
 
 // admin storageState (project default)
 test("overview shows the signed-in admin @smoke", async ({ page }) => {
@@ -11,7 +12,8 @@ test("overview shows the signed-in admin @smoke", async ({ page }) => {
 });
 
 test("landing shows language, theme, and signed-in account actions", async ({ page }) => {
-  await ready(page, "/");
+  test.skip(paths.accountMenu === null, "no page renders the account menu (tests/helpers/app-paths.ts)");
+  await ready(page, paths.accountMenu ?? "/");
   const language = page.getByRole("button", { name: /^(Language|언어)$/ });
   const theme = page.getByRole("button", { name: /^(Toggle theme|테마 전환)$/ });
   await expect(language).toBeVisible();
@@ -33,7 +35,7 @@ test("sidebar navigates to sessions and account @smoke", async ({ page }) => {
   await expect(page.getByRole("heading", { name: "User sessions" })).toBeVisible();
   // Account is reached from the user menu at the bottom of the sidebar, not the nav
   await expect(page.getByRole("link", { name: "Account" })).toHaveCount(0);
-  await page.getByRole("button", { name: /admin@example.com/ }).click();
+  await page.getByTestId("sidebar-user-menu").click();
   await page.getByRole("menuitem", { name: "Account" }).click();
   await expect(page).toHaveURL((url) => url.pathname === "/account");
   await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();

package/dist/templates/modules/admin-dashboard/files/tests/ui/email-admin.ui.spec.ts

@@ -1,6 +1,6 @@
 import { expect, test } from "../helpers/disposable-users";
 import { ready } from "../helpers/hydration";
-import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
+import { mailpitReachable, waitForLink } from "../helpers/mailpit";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
@@ -21,7 +21,6 @@ test("admin sends a password reset email to a user", async ({ page, disposableUs
   await ready(page, "/admin/users");
   const email = `admin-reset-${Date.now()}@example.com`;
   await disposableUsers.create({ email, name: "AR" });
-  await clearMailpit();
   await page.locator("#toolbar-search").fill(email);
   await page.getByRole("button", { name: "Search", exact: true }).click();
   await page.getByRole("row", { name: new RegExp(email) }).getByRole("button").click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/email.ui.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
+import { mailpitReachable, waitForLink } from "../helpers/mailpit";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -20,7 +20,6 @@ test("forgot password: request, open the emailed link, set a new password, sign
   // The happy path ends by signing in; when verification is required that would be
   // blocked, so this UI walkthrough only applies with verification off.
   test.skip(verificationOn, "email verification enabled");
-  await clearMailpit();
 
   await ready(page, "/forgot-password");
   await page.getByLabel("Email").fill(email);

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -1,14 +1,12 @@
 import { expect, test, type Page } from "@playwright/test";
 import { anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
+import { paths } from "../helpers/paths";
 
 // Verifies that the General settings actually take effect (not just persist).
 // The admin storageState (project default) drives the toggles; a fresh anonymous
-// context checks the public-facing result. The site-general lock keeps other
-// specs that save these settings out while one runs, also with --workers above
-// 1; restores run in a `finally` so a mid-test failure still leaves the shared
-// site settings clean.
+// context checks the public-facing result. Restores run in a `finally` so a
+// mid-test failure still leaves the shared site settings clean.
 
 async function saveGeneral(
   page: Page,
@@ -30,110 +28,103 @@ async function saveGeneral(
   await expect(page.getByText("General settings saved.").last()).toBeVisible();
 }
 
-test("general: empty locale displays the application default", async ({ page }) => {
-  test.slow();
-  await exclusive("site-general", async () => {
-    await ready(page, "/admin/settings");
-    const origin = new URL(page.url()).origin;
-    const settingsUrl = `${origin}/api/site/settings`;
-    const previous = await (await page.request.get(settingsUrl)).json() as { locale?: string };
+test("general: empty locale displays the application default", { tag: "@exclusive" }, async ({ page }) => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  const settingsUrl = `${origin}/api/site/settings`;
+  const previous = await (await page.request.get(settingsUrl)).json() as { locale?: string };
 
-    try {
-      expect((await page.request.put(settingsUrl, { data: { locale: "" } })).ok()).toBeTruthy();
-      await ready(page, "/admin/settings");
-      await expect(page.locator("#locale")).toContainText("English");
-    } finally {
-      await page.request.put(settingsUrl, { data: { locale: previous.locale ?? "" } });
-    }
-  });
+  try {
+    expect((await page.request.put(settingsUrl, { data: { locale: "" } })).ok()).toBeTruthy();
+    await ready(page, "/admin/settings");
+    await expect(page.locator("#locale")).toContainText("English");
+  } finally {
+    await page.request.put(settingsUrl, { data: { locale: previous.locale ?? "" } });
+  }
 });
 
-test("general: footer text and links render on public pages", async ({ page, browser }) => {
+test("general: footer text and links render on public pages", { tag: "@exclusive" }, async ({ page, browser }) => {
+  test.skip(paths.footer === null, "no public page renders the site footer (tests/helpers/app-paths.ts)");
   test.slow();
-  await exclusive("site-general", async () => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  const footer = page.getByLabel("Footer text");
+  const support = page.getByLabel("Support email");
+  const origFooter = await footer.inputValue();
+  const origSupport = await support.inputValue();
+  await saveGeneral(
+    page,
+    async () => {
+      await footer.fill("© 2026 PodoKit Test");
+      await support.fill("help@example.com");
+    },
+    { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
+  );
+  try {
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}${paths.footer}`);
+    const footerBlock = anon.getByTestId("site-footer");
+    await expect(footerBlock.getByText("© 2026 PodoKit Test")).toBeVisible();
+    await expect(footerBlock.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
+    await ctx.close();
+  } finally {
     await ready(page, "/admin/settings");
-    const origin = new URL(page.url()).origin;
-    const footer = page.getByLabel("Footer text");
-    const support = page.getByLabel("Support email");
-    const origFooter = await footer.inputValue();
-    const origSupport = await support.inputValue();
     await saveGeneral(
       page,
       async () => {
-        await footer.fill("© 2026 PodoKit Test");
-        await support.fill("help@example.com");
+        await page.getByLabel("Footer text").fill(origFooter);
+        await page.getByLabel("Support email").fill(origSupport);
       },
-      { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
+      { footerText: origFooter, supportEmail: origSupport },
     );
-    try {
-      const ctx = await browser.newContext({ storageState: anonState });
-      const anon = await ctx.newPage();
-      await anon.goto(`${origin}/login`);
-      await expect(anon.getByText("© 2026 PodoKit Test")).toBeVisible();
-      await expect(anon.getByRole("link", { name: "Support" })).toHaveAttribute("href", "mailto:help@example.com");
-      await ctx.close();
-    } finally {
-      await ready(page, "/admin/settings");
-      await saveGeneral(
-        page,
-        async () => {
-          await page.getByLabel("Footer text").fill(origFooter);
-          await page.getByLabel("Support email").fill(origSupport);
-        },
-        { footerText: origFooter, supportEmail: origSupport },
-      );
-    }
-  });
+  }
 });
 
-test("general: maintenance mode holds non-admins on the maintenance page", async ({ page, browser }) => {
+test("general: maintenance mode holds non-admins on the maintenance page", { tag: "@exclusive" }, async ({ page, browser }) => {
   test.slow();
-  await exclusive("site-general", async () => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  await page.getByRole("switch", { name: "Maintenance mode" }).click();
+  await saveGeneral(page);
+  try {
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}${paths.home}`);
+    await expect(anon).toHaveURL(/\/maintenance$/);
+    await expect(anon.getByRole("heading", { name: "Under maintenance" })).toBeVisible();
+    await ctx.close();
+    // the admin is not held back
+    await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
+  } finally {
     await ready(page, "/admin/settings");
-    const origin = new URL(page.url()).origin;
-    await page.getByRole("switch", { name: "Maintenance mode" }).click();
-    await saveGeneral(page);
-    try {
-      const ctx = await browser.newContext({ storageState: anonState });
-      const anon = await ctx.newPage();
-      await anon.goto(`${origin}/`);
-      await expect(anon).toHaveURL(/\/maintenance$/);
-      await expect(anon.getByRole("heading", { name: "Under maintenance" })).toBeVisible();
-      await ctx.close();
-      // the admin is not held back
-      await expect(page.getByRole("heading", { name: "Settings" })).toBeVisible();
-    } finally {
-      await ready(page, "/admin/settings");
-      const t = page.getByRole("switch", { name: "Maintenance mode" });
-      if (await t.isChecked()) {
-        await t.click();
-        await saveGeneral(page);
-      }
+    const t = page.getByRole("switch", { name: "Maintenance mode" });
+    if (await t.isChecked()) {
+      await t.click();
+      await saveGeneral(page);
     }
-  });
+  }
 });
 
-test("general: closing sign-up redirects /signup and hides the link", async ({ page, browser }) => {
+test("general: closing sign-up redirects /signup and hides the link", { tag: "@exclusive" }, async ({ page, browser }) => {
   test.slow();
-  await exclusive("site-general", async () => {
+  await ready(page, "/admin/settings");
+  const origin = new URL(page.url()).origin;
+  await page.getByRole("switch", { name: "Allow public sign-up" }).click();
+  await saveGeneral(page);
+  try {
+    const ctx = await browser.newContext({ storageState: anonState });
+    const anon = await ctx.newPage();
+    await anon.goto(`${origin}/signup`);
+    await expect(anon).toHaveURL(/\/login/);
+    await expect(anon.getByRole("link", { name: "Sign up" })).toHaveCount(0);
+    await ctx.close();
+  } finally {
     await ready(page, "/admin/settings");
-    const origin = new URL(page.url()).origin;
-    await page.getByRole("switch", { name: "Allow public sign-up" }).click();
-    await saveGeneral(page);
-    try {
-      const ctx = await browser.newContext({ storageState: anonState });
-      const anon = await ctx.newPage();
-      await anon.goto(`${origin}/signup`);
-      await expect(anon).toHaveURL(/\/login/);
-      await expect(anon.getByRole("link", { name: "Sign up" })).toHaveCount(0);
-      await ctx.close();
-    } finally {
-      await ready(page, "/admin/settings");
-      const t = page.getByRole("switch", { name: "Allow public sign-up" });
-      if (!(await t.isChecked())) {
-        await t.click();
-        await saveGeneral(page);
-      }
+    const t = page.getByRole("switch", { name: "Allow public sign-up" });
+    if (!(await t.isChecked())) {
+      await t.click();
+      await saveGeneral(page);
     }
-  });
+  }
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/guards.ui.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { anonState, userState } from "../helpers/accounts";
+import { paths } from "../helpers/paths";
 
 test.describe("unauthenticated", () => {
   test.use({ storageState: anonState });
@@ -16,8 +17,11 @@ test.describe("unauthenticated", () => {
       expect(response.headers()["x-robots-tag"]).toBe("noindex, nofollow");
     }
 
-    const landing = await request.get("/");
-    expect(landing.headers()["x-robots-tag"]).toBeUndefined();
+    // Public pages come from tests/helpers/app-paths.ts.
+    for (const route of paths.indexable) {
+      const response = await request.get(route);
+      expect(response.headers()["x-robots-tag"], route).toBeUndefined();
+    }
   });
 });
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/i18n.ui.spec.ts

@@ -1,7 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { ADMIN, adminState, anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
 
 test.use({ storageState: anonState });
 
@@ -23,27 +22,24 @@ test("language switch updates messages and <html lang>", async ({ page }) => {
   }
 });
 
-test("explicit English overrides a Korean site fallback", async ({ page, playwright }) => {
-  test.slow();
-  await exclusive("site-general", async () => {
-    const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    await admin.post("/api/auth/sign-in/email", {
-      data: { email: ADMIN.email, password: ADMIN.password },
-    });
-    const previous = await (await admin.get("/api/site/settings")).json() as { locale?: string };
+test("explicit English overrides a Korean site fallback", { tag: "@exclusive" }, async ({ page, playwright }) => {
+  const admin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  await admin.post("/api/auth/sign-in/email", {
+    data: { email: ADMIN.email, password: ADMIN.password },
+  });
+  const previous = await (await admin.get("/api/site/settings")).json() as { locale?: string };
 
-    try {
-      expect((await admin.put("/api/site/settings", { data: { locale: "ko" } })).ok()).toBeTruthy();
-      await page.context().addCookies([{ name: "locale", value: "en", url: base }]);
-      await ready(page, "/login");
+  try {
+    expect((await admin.put("/api/site/settings", { data: { locale: "ko" } })).ok()).toBeTruthy();
+    await page.context().addCookies([{ name: "locale", value: "en", url: base }]);
+    await ready(page, "/login");
 
-      await expect(page.locator("html")).toHaveAttribute("lang", "en");
-      await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
-    } finally {
-      await admin.put("/api/site/settings", { data: { locale: previous.locale ?? "en" } });
-      await admin.dispose();
-    }
-  });
+    await expect(page.locator("html")).toHaveAttribute("lang", "en");
+    await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
+  } finally {
+    await admin.put("/api/site/settings", { data: { locale: previous.locale ?? "en" } });
+    await admin.dispose();
+  }
 });
 
 test("managed admin labels react to locale changes", async ({ browser }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/impersonation.ui.spec.ts

@@ -13,9 +13,12 @@ test("admin can impersonate a user and stop", async ({ page }) => {
   await row.getByRole("button").click();
   await page.getByRole("menuitem", { name: "Impersonate" }).click();
 
-  // Impersonating a normal user leaves the admin-only route group and keeps a
-  // visible route back to the original administrator session.
-  await expect(page).toHaveURL(/\/account(\/|$)/);
+  // Impersonating a normal user leaves the admin-only route group. Where the
+  // application-owned users page lands is the application's choice; the managed
+  // account page always offers the route back to the administrator session.
+  await expect(page).not.toHaveURL(/\/admin\/users/);
+  await ready(page, "/account");
+  await expect(page.getByText(`Impersonating ${USER.email}`)).toBeVisible();
   const stop = page.getByRole("button", { name: "Stop impersonating" });
   await expect(stop).toBeVisible();
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/login-methods.ui.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "@playwright/test";
 import { anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
-import { mailpitReachable, clearMailpit, waitForOtp } from "../helpers/mailpit";
+import { mailpitReachable, waitForOtp } from "../helpers/mailpit";
 
 test.use({ storageState: anonState });
 
@@ -26,10 +26,9 @@ test("login: an emailed one-time code signs a user in", async ({ page, playwrigh
   test.skip(!caps?.emailOtp, "email otp disabled");
   test.skip(!(await mailpitReachable()), "mailpit unreachable");
 
-  const email = `otp-${Date.now()}@example.com`;
+  const email = `ui-otp-${Date.now()}@example.com`;
   await api.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "OTP" } });
   await api.dispose();
-  await clearMailpit();
 
   await ready(page, "/login");
   await page.locator("#email").fill(email);

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -1,6 +1,5 @@
 import { expect, test, type Page } from "@playwright/test";
 import { createHash, randomBytes } from "node:crypto";
-import { exclusive } from "../helpers/exclusive";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — the admin is the resource owner.
@@ -14,10 +13,9 @@ const REDIRECT = "https://example.com/callback";
 // (with PKCE) that validates the client and hands off to the consent page. The
 // back-channel token exchange is driven by an OIDC client SDK / real RP — see
 // docs/modules.md for the manual round-trip checklist.
-test("OIDC provider: discovery, JWKS, client registration, authorize handoff", async ({ page, baseURL }) => {
-  // tests/api/auth.api.spec.ts also toggles the provider; the lock keeps the two apart.
+test("OIDC provider: discovery, JWKS, client registration, authorize handoff", { tag: "@exclusive" }, async ({ page, baseURL }) => {
   test.slow();
-  await exclusive("oidc-provider", () => frontChannel(page, baseURL));
+  await frontChannel(page, baseURL);
 });
 
 async function frontChannel(page: Page, baseURL: string | undefined): Promise<void> {