@podosoft/podokit 1.5.0 → 1.6.0

package/dist/templates/modules/admin-dashboard/files/tests/ui/organizations.ui.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "@playwright/test";
+import { USER } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
 
 // admin storageState (project default) — organizations is an admin-only view
@@ -38,7 +39,9 @@ test("create an org with a non-ascii name, a parent, and a manager", async ({ pa
   await page.getByLabel("Name", { exact: true }).fill(child);
   await page.locator("#o-parent").click();
   await page.getByRole("option", { name: parent }).click();
-  await page.getByRole("checkbox").first().click(); // first existing user as a manager
+  // The seeded user, not the first listed one: tests on other workers add and
+  // remove users while this one runs.
+  await page.locator("label", { hasText: USER.email }).getByRole("checkbox").click();
   await page.getByRole("dialog").getByRole("button", { name: "Create", exact: true }).click();
   await expect(page.getByText("Organization created").first()).toBeVisible();
   // child row shows the parent org name
@@ -64,7 +67,7 @@ test("organization manage: remove a member, invite one, and cancel the invite",
   await page.getByLabel("Name", { exact: true }).fill(name);
   // Seed a specific non-owner member (the admin is always the owner, so pick the
   // seeded user — .first() is order-dependent and could hit the owner).
-  await page.locator("label", { hasText: "user@example.com" }).getByRole("checkbox").click();
+  await page.locator("label", { hasText: USER.email }).getByRole("checkbox").click();
   await page.getByRole("dialog").getByRole("button", { name: "Create", exact: true }).click();
   await expect(page.getByText("Organization created").first()).toBeVisible();
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/passkey.ui.spec.ts

@@ -29,9 +29,14 @@ test("register a passkey and sign in with it", async ({ page, baseURL }) => {
   await addBtn.click();
   await expect(page.getByText("Passkey added")).toBeVisible();
 
-  // Sign out, then sign back in using only the passkey.
-  await page.context().request.post("/api/auth/sign-out", { headers: origin });
+  // Sign out, then sign back in using only the passkey. Check the sign-out: a
+  // session left behind would pass the URL check below without the passkey.
+  const signOut = await page.context().request.post("/api/auth/sign-out", { headers: origin, data: {} });
+  expect(signOut.ok(), await signOut.text()).toBeTruthy();
+  expect(await (await page.context().request.get("/api/auth/get-session")).json()).toBeNull();
   await ready(page, "/login");
   await page.getByRole("button", { name: "Use a passkey" }).click();
   await expect(page).toHaveURL(new URL("/", baseURL).toString());
+  const session = await (await page.context().request.get("/api/auth/get-session")).json();
+  expect(session?.user?.email).toBe(email);
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/same-origin-requests.ui.spec.ts

@@ -0,0 +1,89 @@
+import { expect } from "@playwright/test";
+import { test } from "../helpers/disposable-users";
+import { ready } from "../helpers/hydration";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = new URL(base).origin;
+// A 1 by 1 pixel PNG.
+const PIXEL_PNG = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=";
+
+// SvelteKit answers 403 "Cross-site ... form submissions are forbidden" to a POST,
+// PUT, PATCH, or DELETE that has no content type or one an HTML form can send,
+// unless its Origin header names the origin the web server resolved. The browser
+// sends Origin with every same-origin request below, so FormData uploads and
+// requests without a body reach the API through the /api proxy as they are. When
+// a deployment returns that 403 anyway, the web server resolved another origin,
+// such as http:// behind a TLS proxy whose X-Forwarded-Proto the ingress replaced.
+test("same-origin uploads and requests without a body pass the origin check", async ({
+  browser,
+  playwright,
+  disposableUsers,
+}) => {
+  const email = `same-origin-${Date.now()}@example.com`;
+  const password = "Same-origin-password-1";
+  await disposableUsers.create({ email, password, name: "Same origin" });
+  // Start without the project's administrator cookies: with the multi-session
+  // plugin, signing out ends every session the browser holds.
+  const signIn = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin },
+    storageState: { cookies: [], origins: [] },
+  });
+  expect((await signIn.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  const context = await browser.newContext({ storageState: await signIn.storageState() });
+  await signIn.dispose();
+  const page = await context.newPage();
+  try {
+    await ready(page, "/account");
+    const origins: Record<string, string | undefined> = {};
+    const recorded: Promise<void>[] = [];
+    page.on("request", (request) => {
+      const { pathname } = new URL(request.url());
+      if (!pathname.startsWith("/api/")) return;
+      recorded.push(request.allHeaders().then((headers) => {
+        origins[`${request.method()} ${pathname}`] = headers.origin;
+      }));
+    });
+
+    const results = await page.evaluate(async (png) => {
+      const bytes = Uint8Array.from(atob(png), (char) => char.charCodeAt(0));
+      const form = new FormData();
+      form.set("file", new Blob([bytes], { type: "image/png" }), "pixel.png");
+      const answer = async (response: Response): Promise<{ status: number; body: string }> => ({
+        status: response.status,
+        body: await response.text(),
+      });
+      return {
+        upload: await answer(await fetch("/api/account/profile-image", { method: "POST", body: form })),
+        remove: await answer(await fetch("/api/account/profile-image", { method: "DELETE" })),
+        urlencoded: await answer(
+          await fetch("/api/account/profile-image", {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: "file=pixel",
+          }),
+        ),
+        signOut: await answer(await fetch("/api/auth/sign-out", { method: "POST" })),
+      };
+    }, PIXEL_PNG);
+
+    // The multipart upload and the DELETE without a body reached the API and succeeded.
+    expect(results.upload.status, results.upload.body).toBe(201);
+    expect(JSON.parse(results.upload.body)).toMatchObject({ image: expect.stringContaining("/api/") });
+    expect(results.remove.status, results.remove.body).toBe(200);
+    // A form-encoded body is not an image, so the API, not SvelteKit, refuses it.
+    expect(results.urlencoded.body).not.toContain("Cross-site");
+    expect(JSON.parse(results.urlencoded.body)).toMatchObject({ success: false });
+    // A POST without a body or content type signs the user out.
+    expect(results.signOut.status, results.signOut.body).toBe(200);
+
+    await Promise.all(recorded);
+    expect(origins).toMatchObject({
+      "POST /api/account/profile-image": origin,
+      "DELETE /api/account/profile-image": origin,
+      "POST /api/auth/sign-out": origin,
+    });
+  } finally {
+    await context.close();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/sessions.ui.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "../helpers/disposable-users";
+import { USER } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -36,14 +37,14 @@ test("admin sees user sessions across users", async ({ page }) => {
   // Search by exact address — robust to pagination as sessions accumulate (the
   // admin account alone can fill the first page). This is the across-users view.
   const searched = page.waitForResponse(
-    (response) => isSessionList(response.url()) && new URL(response.url()).searchParams.get("search") === "user@example.com",
+    (response) => isSessionList(response.url()) && new URL(response.url()).searchParams.get("search") === USER.email,
   );
-  await page.locator("#toolbar-search").fill("user@example.com");
+  await page.locator("#toolbar-search").fill(USER.email);
   await page.getByRole("button", { name: "Search", exact: true }).click();
   expect((await searched).ok()).toBeTruthy();
-  await expect(page.getByRole("main").getByText("user@example.com").first()).toBeVisible();
+  await expect(page.getByRole("main").getByText(USER.email).first()).toBeVisible();
   // row actions are available
-  await page.getByRole("row", { name: /user@example.com/ }).first().getByRole("button").click();
+  await page.getByRole("row", { name: USER.email }).first().getByRole("button").click();
   await expect(page.getByRole("menuitem", { name: "Revoke session" })).toBeVisible();
   await expect(page.getByRole("menuitem", { name: "Revoke all for user" })).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings-dialogs.ui.spec.ts

@@ -1,60 +1,57 @@
 import { expect, test } from "@playwright/test";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
 
 // admin storageState (project default)
 
-test("settings: add and remove a social login provider", async ({ page }) => {
+test("settings: add and remove a social login provider", { tag: "@exclusive" }, async ({ page }) => {
   test.slow();
-  await exclusive("social-providers", async () => {
-    const dialog = page.getByRole("dialog");
-    const addBtn = dialog.getByRole("button", { name: "Add provider" });
-    const openConfigure = async (): Promise<void> => {
-      await page.waitForLoadState("networkidle");
-      await page.getByRole("tab", { name: "Authentication" }).click();
-      const socialCard = page
-        .getByText("Social login", { exact: true })
-        .locator('xpath=ancestor::div[@data-slot="card"]');
-      await socialCard.getByRole("button", { name: "Configure" }).click();
-    };
+  const dialog = page.getByRole("dialog");
+  const addBtn = dialog.getByRole("button", { name: "Add provider" });
+  const openConfigure = async (): Promise<void> => {
+    await page.waitForLoadState("networkidle");
+    await page.getByRole("tab", { name: "Authentication" }).click();
+    const socialCard = page
+      .getByText("Social login", { exact: true })
+      .locator('xpath=ancestor::div[@data-slot="card"]');
+    await socialCard.getByRole("button", { name: "Configure" }).click();
+  };
 
-    await ready(page, "/admin/settings");
-    // The auth-config catalog can be momentarily unavailable right after another
-    // spec toggles auth config (the auth instance rebuilds). Reload until the
-    // catalog is loaded (Add provider becomes enabled).
-    await expect(async () => {
-      await page.reload();
-      await openConfigure();
-      await expect(addBtn).toBeEnabled({ timeout: 3000 });
-    }).toPass({ timeout: 25000 });
+  await ready(page, "/admin/settings");
+  // The auth-config catalog can be momentarily unavailable right after another
+  // spec toggles auth config (the auth instance rebuilds). Reload until the
+  // catalog is loaded (Add provider becomes enabled).
+  await expect(async () => {
+    await page.reload();
+    await openConfigure();
+    await expect(addBtn).toBeEnabled({ timeout: 3000 });
+  }).toPass({ timeout: 25000 });
 
-    await addBtn.click();
-    const provider = dialog.locator("#social-provider");
-    await expect(provider).toBeVisible();
-    const callback = await dialog.locator("code").textContent();
-    const providerId = callback?.trim().split("/").pop() ?? ""; // first addable provider (not hard-coded)
-    expect(providerId).not.toBe("");
-    const expectedCallback = new URL(`/api/auth/callback/${providerId}`, page.url()).toString();
-    expect(callback?.trim()).toBe(expectedCallback);
-    try {
-      await dialog.locator("#social-id").fill("test-client-id");
-      await dialog.locator("#social-secret").fill("test-secret");
-      await dialog.getByRole("button", { name: "Save", exact: true }).click();
-      // Save returns to the list view, where the new provider row has an enable switch.
-      await expect(dialog.getByRole("switch").first()).toBeVisible();
-      const saved = await (await page.request.get("/api/account/auth-config")).json();
-      expect(saved.social[providerId].redirectURI).toBe(expectedCallback);
-    } finally {
-      if (providerId) {
-        await page.request
-          .put("/api/account/auth-config", { data: { social: { [providerId]: { delete: true } } } })
-          .catch(() => undefined);
-      }
+  await addBtn.click();
+  const provider = dialog.locator("#social-provider");
+  await expect(provider).toBeVisible();
+  const callback = await dialog.locator("code").textContent();
+  const providerId = callback?.trim().split("/").pop() ?? ""; // first addable provider (not hard-coded)
+  expect(providerId).not.toBe("");
+  const expectedCallback = new URL(`/api/auth/callback/${providerId}`, page.url()).toString();
+  expect(callback?.trim()).toBe(expectedCallback);
+  try {
+    await dialog.locator("#social-id").fill("test-client-id");
+    await dialog.locator("#social-secret").fill("test-secret");
+    await dialog.getByRole("button", { name: "Save", exact: true }).click();
+    // Save returns to the list view, where the new provider row has an enable switch.
+    await expect(dialog.getByRole("switch").first()).toBeVisible();
+    const saved = await (await page.request.get("/api/account/auth-config")).json();
+    expect(saved.social[providerId].redirectURI).toBe(expectedCallback);
+  } finally {
+    if (providerId) {
+      await page.request
+        .put("/api/account/auth-config", { data: { social: { [providerId]: { delete: true } } } })
+        .catch(() => undefined);
     }
-  });
+  }
 });
 
-test("settings: open and save the SMTP dialog", async ({ page }) => {
+test("settings: open and save the SMTP dialog", { tag: "@exclusive" }, async ({ page }) => {
   await ready(page, "/admin/settings");
   await page.getByRole("tab", { name: "Authentication" }).click();
   await page.getByRole("button", { name: "SMTP settings" }).click();
@@ -74,35 +71,32 @@ test("settings: open and save the SMTP dialog", async ({ page }) => {
   }
 });
 
-test("settings: configure automatic logout", async ({ page }) => {
-  test.slow();
-  await exclusive("session-idle-timeout", async () => {
-    await page.request.put("/api/account/auth-config", {
-      data: { server: { sessionIdleTimeoutMinutes: null } },
-    });
-    await ready(page, "/admin/settings");
-    await page.getByRole("tab", { name: "Authentication" }).click();
+test("settings: configure automatic logout", { tag: "@exclusive" }, async ({ page }) => {
+  await page.request.put("/api/account/auth-config", {
+    data: { server: { sessionIdleTimeoutMinutes: null } },
+  });
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Authentication" }).click();
 
-    const toggle = page.getByRole("switch", { name: "Automatic logout" });
-    await expect(toggle).not.toBeChecked();
-    await toggle.click();
-    await expect(toggle).toBeChecked();
+  const toggle = page.getByRole("switch", { name: "Automatic logout" });
+  await expect(toggle).not.toBeChecked();
+  await toggle.click();
+  await expect(toggle).toBeChecked();
 
-    const card = page
-      .getByText("Automatic logout", { exact: true })
-      .locator('xpath=ancestor::div[@data-slot="card"]');
-    await card.getByRole("button", { name: "Configure" }).click();
-    const dialog = page.getByRole("dialog");
-    await dialog.getByLabel("Idle time (minutes)").fill("45");
-    await dialog.getByRole("button", { name: "Save", exact: true }).click();
-    await expect(page.getByText("45 min", { exact: true })).toBeVisible();
+  const card = page
+    .getByText("Automatic logout", { exact: true })
+    .locator('xpath=ancestor::div[@data-slot="card"]');
+  await card.getByRole("button", { name: "Configure" }).click();
+  const dialog = page.getByRole("dialog");
+  await dialog.getByLabel("Idle time (minutes)").fill("45");
+  await dialog.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(page.getByText("45 min", { exact: true })).toBeVisible();
 
-    const saved = await (await page.request.get("/api/account/auth-config")).json();
-    expect(saved.server.sessionIdleTimeoutMinutes).toBe(45);
-    const caps = await (await page.request.get("/api/account/capabilities")).json();
-    expect(caps.sessionIdleTimeoutMinutes).toBe(45);
+  const saved = await (await page.request.get("/api/account/auth-config")).json();
+  expect(saved.server.sessionIdleTimeoutMinutes).toBe(45);
+  const caps = await (await page.request.get("/api/account/capabilities")).json();
+  expect(caps.sessionIdleTimeoutMinutes).toBe(45);
 
-    await toggle.click();
-    await expect(toggle).not.toBeChecked();
-  });
+  await toggle.click();
+  await expect(toggle).not.toBeChecked();
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings.ui.spec.ts

@@ -1,6 +1,6 @@
 import { expect, test, type Page } from "@playwright/test";
 import { ready } from "../helpers/hydration";
-import { exclusive } from "../helpers/exclusive";
+import { paths } from "../helpers/paths";
 
 // admin storageState (project default)
 
@@ -30,20 +30,17 @@ test("general settings: shows the favicon uploader", async ({ page }) => {
   await expect(page.locator('input[type="file"]')).toBeVisible();
 });
 
-test("general settings: edit the site name, save, and apply live", async ({ page }) => {
-  test.slow();
-  await exclusive("site-general", async () => {
-    await ready(page, "/admin/settings");
-    const name = page.getByLabel("Site name");
-    const original = await name.inputValue();
-    await name.fill("PodoKit Test Site");
-    await saveGeneral(page);
-    // the browser tab title reflects the new name live (no reload)
-    await expect(page).toHaveTitle("PodoKit Test Site");
-    // restore so other specs start clean
-    await name.fill(original);
-    await saveGeneral(page);
-  });
+test("general settings: edit the site name, save, and apply live", { tag: "@exclusive" }, async ({ page }) => {
+  await ready(page, "/admin/settings");
+  const name = page.getByLabel("Site name");
+  const original = await name.inputValue();
+  await name.fill("PodoKit Test Site");
+  await saveGeneral(page);
+  // the browser tab title reflects the new name live (no reload)
+  await expect(page).toHaveTitle("PodoKit Test Site");
+  // restore so other specs start clean
+  await name.fill(original);
+  await saveGeneral(page);
 });
 
 test("settings lists the auth features under the Authentication tab", async ({ page }) => {
@@ -62,8 +59,8 @@ test("sidebar: back-to-home link returns to the landing page", async ({ page })
   // the home link lives in the sidebar footer, above the user menu
   await page.getByRole("link", { name: "Back to home" }).click();
   await expect(page).toHaveURL(/\/$/);
-  // Landing routes are app-owned, so only verify the shared page shell.
-  await expect(page.locator("main").first()).toBeVisible();
+  // The landing page is app-owned; tests/helpers/app-paths.ts says what shows it rendered.
+  await expect(paths.homeReady(page)).toBeVisible();
 });
 
 test("settings is reachable from the sidebar", async ({ page }) => {
@@ -72,22 +69,18 @@ test("settings is reachable from the sidebar", async ({ page }) => {
   await expect(page).toHaveURL(/\/admin\/settings/);
 });
 
-test("admin can toggle a feature flag and it applies live @smoke", async ({ page }) => {
-  test.slow();
-  await exclusive("magic-link", async () => {
-    await ready(page, "/admin/settings");
-    await page.getByRole("tab", { name: "Authentication" }).click();
-    const toggle = page.getByRole("switch", { name: "Magic link" });
-    test.skip((await toggle.count()) === 0, "magic link toggle not present");
-    // The magic-link lock keeps the API spec that toggles the same flag out.
-    await expect(toggle).toBeChecked();
-    await toggle.click();
-    await expect(page.getByText("Setting updated")).toBeVisible();
-    await expect(toggle).not.toBeChecked(); // capabilities refreshed live
-    // restore so the shared magic-link/2FA specs keep their expected state
-    await toggle.click();
-    await expect(toggle).toBeChecked();
-  });
+test("admin can toggle a feature flag and it applies live @smoke", { tag: "@exclusive" }, async ({ page }) => {
+  await ready(page, "/admin/settings");
+  await page.getByRole("tab", { name: "Authentication" }).click();
+  const toggle = page.getByRole("switch", { name: "Magic link" });
+  test.skip((await toggle.count()) === 0, "magic link toggle not present");
+  await expect(toggle).toBeChecked();
+  await toggle.click();
+  await expect(page.getByText("Setting updated")).toBeVisible();
+  await expect(toggle).not.toBeChecked(); // capabilities refreshed live
+  // restore so the shared magic-link/2FA specs keep their expected state
+  await toggle.click();
+  await expect(toggle).toBeChecked();
 });
 
 test("settings: the require-two-factor toggle is available", async ({ page }) => {
@@ -101,72 +94,70 @@ test("settings: the require-two-factor toggle is available", async ({ page }) =>
   await expect(page.getByRole("switch", { name: "Automatic logout" })).toBeVisible();
 });
 
-test("inactive browser sessions are signed out automatically @smoke", async ({ browser, page: adminPage }) => {
+test("inactive browser sessions are signed out automatically @smoke", { tag: "@exclusive" }, async ({ browser, page: adminPage }) => {
   test.slow();
-  await exclusive("session-idle-timeout", async () => {
-    // Idle sign-out revokes the active server session. Use a dedicated login so
-    // this test cannot invalidate the shared admin storageState used by later specs.
-    const context = await browser.newContext({ baseURL: base });
-    const page = await context.newPage();
-    const email = `idle-admin-${Date.now()}@example.com`;
-    let signOutRequests = 0;
-    let userId = "";
-    try {
-      const created = await adminPage.request.post("/api/auth/admin/create-user", {
-        headers: { origin: base },
-        data: { email, password: "Podokit3e-Str0ng!pw", name: "Idle Admin", role: "admin" },
-      });
-      expect(created.ok()).toBeTruthy();
-      userId = ((await created.json()).user?.id ?? "") as string;
-      expect(userId).toBeTruthy();
+  // Idle sign-out revokes the active server session. Use a dedicated login so
+  // this test cannot invalidate the shared admin storageState used by later specs.
+  const context = await browser.newContext({ baseURL: base });
+  const page = await context.newPage();
+  const email = `idle-admin-${Date.now()}@example.com`;
+  let signOutRequests = 0;
+  let userId = "";
+  try {
+    const created = await adminPage.request.post("/api/auth/admin/create-user", {
+      headers: { origin: base },
+      data: { email, password: "Podokit3e-Str0ng!pw", name: "Idle Admin", role: "admin" },
+    });
+    expect(created.ok()).toBeTruthy();
+    userId = ((await created.json()).user?.id ?? "") as string;
+    expect(userId).toBeTruthy();
+
+    const signIn = await context.request.post("/api/auth/sign-in/email", {
+      headers: { origin: base },
+      data: { email, password: "Podokit3e-Str0ng!pw" },
+    });
+    expect(signIn.ok()).toBeTruthy();
+
+    const configured = await context.request.put("/api/account/auth-config", {
+      data: { server: { sessionIdleTimeoutMinutes: 5 } },
+    });
+    expect(configured.ok()).toBeTruthy();
+    await page.route("**/api/auth/sign-out", async (route) => {
+      signOutRequests += 1;
+      await route.fulfill({ status: 200, contentType: "application/json", body: '{"success":true}' });
+    });
+    await page.clock.install();
 
-      const signIn = await context.request.post("/api/auth/sign-in/email", {
-        headers: { origin: base },
-        data: { email, password: "Podokit3e-Str0ng!pw" },
+    try {
+      await ready(page, "/admin");
+      await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
+    } finally {
+      // Keep the loaded page policy at five minutes while restoring the shared
+      // DB policy before the isolated session is revoked.
+      const restored = await context.request.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: null } },
       });
-      expect(signIn.ok()).toBeTruthy();
+      expect(restored.ok()).toBeTruthy();
+    }
 
-      const configured = await context.request.put("/api/account/auth-config", {
-        data: { server: { sessionIdleTimeoutMinutes: 5 } },
-      });
-      expect(configured.ok()).toBeTruthy();
-      await page.route("**/api/auth/sign-out", async (route) => {
-        signOutRequests += 1;
-        await route.fulfill({ status: 200, contentType: "application/json", body: '{"success":true}' });
-      });
-      await page.clock.install();
-
-      try {
-        await ready(page, "/admin");
-        await expect(page.getByRole("heading", { name: "Dashboard" })).toBeVisible();
-      } finally {
-        // Keep the loaded page policy at five minutes while restoring the shared
-        // DB policy before the isolated session is revoked.
-        const restored = await context.request.put("/api/account/auth-config", {
-          data: { server: { sessionIdleTimeoutMinutes: null } },
-        });
-        expect(restored.ok()).toBeTruthy();
-      }
-
-      const removed = await adminPage.request.post("/api/auth/admin/remove-user", {
+    const removed = await adminPage.request.post("/api/auth/admin/remove-user", {
+      headers: { origin: base },
+      data: { userId },
+    });
+    expect(removed.ok()).toBeTruthy();
+    userId = "";
+
+    await page.clock.fastForward(5 * 60_000 + 1_000);
+    await expect.poll(() => signOutRequests).toBe(1);
+    await expect(page).toHaveURL(/\/login\?reason=idle$/);
+    await expect(page.getByTestId("session-timeout-message")).toBeVisible();
+  } finally {
+    if (userId) {
+      await adminPage.request.post("/api/auth/admin/remove-user", {
         headers: { origin: base },
         data: { userId },
       });
-      expect(removed.ok()).toBeTruthy();
-      userId = "";
-
-      await page.clock.fastForward(5 * 60_000 + 1_000);
-      await expect.poll(() => signOutRequests).toBe(1);
-      await expect(page).toHaveURL(/\/login\?reason=idle$/);
-      await expect(page.getByTestId("session-timeout-message")).toBeVisible();
-    } finally {
-      if (userId) {
-        await adminPage.request.post("/api/auth/admin/remove-user", {
-          headers: { origin: base },
-          data: { userId },
-        });
-      }
-      await context.close();
     }
-  });
+    await context.close();
+  }
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/table-toolbar.ui.spec.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "@playwright/test";
+import { ADMIN, USER } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
 
 // The shared toolbar: filters + search both commit on the Search button; the
@@ -6,10 +7,10 @@ import { ready } from "../helpers/hydration";
 test("users toolbar searches only when Search is pressed", async ({ page }) => {
   await ready(page, "/admin/users");
   const main = page.getByRole("main");
-  await page.locator("#toolbar-search").fill("admin@example.com");
+  await page.locator("#toolbar-search").fill(ADMIN.email);
   await page.getByRole("button", { name: "Search", exact: true }).click();
-  await expect(main.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
-  await expect(main.getByRole("cell", { name: "user@example.com" })).toHaveCount(0);
+  await expect(main.getByRole("cell", { name: ADMIN.email })).toBeVisible();
+  await expect(main.getByRole("cell", { name: USER.email })).toHaveCount(0);
 });
 
 test("users toolbar applies filter + search together on Search", async ({ page }) => {
@@ -24,8 +25,8 @@ test("users toolbar applies filter + search together on Search", async ({ page }
   });
   await page.getByRole("button", { name: "Search", exact: true }).click();
   expect((await filtered).ok()).toBeTruthy();
-  await expect(main.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
-  await expect(main.getByRole("cell", { name: "user@example.com" })).toHaveCount(0);
+  await expect(main.getByRole("cell", { name: ADMIN.email })).toBeVisible();
+  await expect(main.getByRole("cell", { name: USER.email })).toHaveCount(0);
 });
 
 test("users toolbar combines the role and status filters", async ({ page }) => {
@@ -48,8 +49,8 @@ test("users toolbar combines the role and status filters", async ({ page }) => {
   });
   await page.getByRole("button", { name: "Search", exact: true }).click();
   expect((await filtered).ok()).toBeTruthy();
-  await expect(main.getByRole("cell", { name: "admin@example.com" })).toBeVisible();
-  await expect(main.getByRole("cell", { name: "user@example.com" })).toHaveCount(0);
+  await expect(main.getByRole("cell", { name: ADMIN.email })).toBeVisible();
+  await expect(main.getByRole("cell", { name: USER.email })).toHaveCount(0);
 });
 
 test("users toolbar can pick the search field", async ({ page }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/theme-mode.ui.spec.ts

@@ -0,0 +1,29 @@
+import { expect, test } from "@playwright/test";
+import { ready } from "../helpers/hydration";
+
+// mode-watcher marks <html> with `.dark` or `.light`, so component libraries
+// that follow either class, and fall back to the OS setting otherwise, match the
+// theme the visitor chose rather than the system one.
+test("the chosen theme is named on <html> in both modes", async ({ page }) => {
+  await page.emulateMedia({ colorScheme: "dark" });
+  await ready(page, "/account");
+  const html = page.locator("html");
+
+  await page.getByRole("button", { name: "Toggle theme" }).click();
+  await page.getByRole("menuitem", { name: "Light" }).click();
+  await expect(html).toHaveClass(/(^|\s)light(\s|$)/);
+  await expect(html).not.toHaveClass(/(^|\s)dark(\s|$)/);
+
+  // The class is set before the page renders, not only after a choice.
+  await page.reload();
+  await expect(html).toHaveClass(/(^|\s)light(\s|$)/);
+
+  await page.getByRole("button", { name: "Toggle theme" }).click();
+  await page.getByRole("menuitem", { name: "Dark" }).click();
+  await expect(html).toHaveClass(/(^|\s)dark(\s|$)/);
+  await expect(html).not.toHaveClass(/(^|\s)light(\s|$)/);
+
+  await page.getByRole("button", { name: "Toggle theme" }).click();
+  await page.getByRole("menuitem", { name: "System" }).click();
+  await expect(html).toHaveClass(/(^|\s)dark(\s|$)/);
+});