@podosoft/podokit 1.6.0 → 1.6.2

package/dist/templates/modules/auth/files/apps/api/src/auth/db.ts

@@ -1,11 +1,13 @@
 import { Database as SqliteDatabase } from "bun:sqlite";
 import type { SQL } from "bun";
+import { Kysely, PostgresDialect } from "kysely";
 import type { AuthConfigRow, ConfigVersions } from "@podosoft/podokit-auth";
 import type { DatabaseProviderName } from "@podosoft/podokit-runtime";
 import { validateEnv } from "../config/env.validation";
 import { PROVIDERS } from "../config/providers";
 import { databaseUrl, sqliteDatabasePath } from "../database/database";
 import { answersWithin, sharedProbe, type DatabaseProbe } from "./database-outage";
+import { EmptyListPlugin } from "./empty-lists";
 import { isMaintenanceCommand } from "./maintenance";
 import { AuthPostgresPool } from "./postgres-pool";
 
@@ -30,7 +32,17 @@ export const sqliteDatabase = provider === "sqlite"
   ? new SqliteDatabase(sqliteDatabasePath(url), { create: true, strict: true })
   : null;
 
-export const authDatabase = postgresPool ?? sqliteDatabase;
+/** The Kysely instance Better Auth queries PostgreSQL through, or null on SQLite. */
+export const postgresAuthQueries = postgresPool
+  ? new Kysely<object>({
+      dialect: new PostgresDialect({ pool: postgresPool }),
+      plugins: [new EmptyListPlugin()],
+    })
+  : null;
+
+export const authDatabase = postgresAuthQueries
+  ? { db: postgresAuthQueries, type: "postgres" as const, transaction: true }
+  : sqliteDatabase;
 if (!authDatabase) throw new Error("No authentication database is configured");
 
 /** Whether the authentication database answers `SELECT 1` within the readiness check timeout. */

package/dist/templates/modules/auth/files/apps/api/src/auth/empty-lists.spec.ts

@@ -0,0 +1,67 @@
+import { describe, expect, it } from "bun:test";
+import { DummyDriver, Kysely, PostgresAdapter, PostgresIntrospector, PostgresQueryCompiler } from "kysely";
+import type { DatabaseProviderName } from "@podosoft/podokit-runtime";
+import { PROVIDERS } from "../config/providers";
+import { postgresAuthQueries } from "./db";
+import { EmptyListPlugin } from "./empty-lists";
+
+function databaseProvider(): DatabaseProviderName {
+  return PROVIDERS.database;
+}
+
+// A type alias, not an interface: withTables() needs an index signature.
+type Tables = {
+  user: { id: string; email: string };
+};
+
+const db = new Kysely<Tables>({
+  dialect: {
+    createAdapter: () => new PostgresAdapter(),
+    createDriver: () => new DummyDriver(),
+    createIntrospector: (kysely) => new PostgresIntrospector(kysely),
+    createQueryCompiler: () => new PostgresQueryCompiler(),
+  },
+  plugins: [new EmptyListPlugin()],
+});
+
+describe("empty lists in authentication queries", () => {
+  it("sends an empty in list as a condition that never holds", () => {
+    const query = db.selectFrom("user").selectAll().where("id", "in", []).limit(0).compile();
+    expect(query.sql).toBe('select * from "user" where 1 = 0 limit $1');
+    expect(query.parameters).toEqual([0]);
+  });
+
+  it("sends an empty not in list as a condition that always holds", () => {
+    const query = db
+      .selectFrom("user")
+      .select("id")
+      .where("email", "=", "a@example.com")
+      .where("id", "not in", [])
+      .compile();
+    expect(query.sql).toBe('select "id" from "user" where "email" = $1 and 1 = 1');
+    expect(query.parameters).toEqual(["a@example.com"]);
+  });
+
+  it("leaves lists with values and other operators as they are", () => {
+    const query = db
+      .deleteFrom("user")
+      .where((eb) => eb.or([eb("id", "in", ["a", "b"]), eb("email", "=", "c@example.com")]))
+      .compile();
+    expect(query.sql).toBe('delete from "user" where ("id" in ($1, $2) or "email" = $3)');
+    expect(query.parameters).toEqual(["a", "b", "c@example.com"]);
+  });
+
+  it("applies to the queries Better Auth sends to PostgreSQL", () => {
+    if (databaseProvider() !== "postgres") {
+      expect(postgresAuthQueries).toBeNull();
+      return;
+    }
+    const query = postgresAuthQueries
+      ?.withTables<Tables>()
+      .selectFrom("user")
+      .selectAll()
+      .where("id", "in", [])
+      .compile();
+    expect(query?.sql).toBe('select * from "user" where 1 = 0');
+  });
+});

package/dist/templates/modules/auth/files/apps/api/src/auth/empty-lists.ts

@@ -0,0 +1,54 @@
+import {
+  BinaryOperationNode,
+  OperationNodeTransformer,
+  OperatorNode,
+  PrimitiveValueListNode,
+  ValueListNode,
+  ValueNode,
+  type KyselyPlugin,
+  type PluginTransformQueryArgs,
+  type PluginTransformResultArgs,
+  type QueryId,
+  type QueryResult,
+  type RootOperationNode,
+  type UnknownRow,
+} from "kysely";
+
+function constantComparison(holds: boolean): BinaryOperationNode {
+  return BinaryOperationNode.create(
+    ValueNode.createImmediate(1),
+    OperatorNode.create("="),
+    ValueNode.createImmediate(holds ? 1 : 0),
+  );
+}
+
+class EmptyListTransformer extends OperationNodeTransformer {
+  protected override transformBinaryOperation(node: BinaryOperationNode, queryId?: QueryId): BinaryOperationNode {
+    const list = node.rightOperand;
+    const empty = (PrimitiveValueListNode.is(list) || ValueListNode.is(list)) && list.values.length === 0;
+    if (empty && OperatorNode.is(node.operator)) {
+      if (node.operator.operator === "in") return constantComparison(false);
+      if (node.operator.operator === "not in") return constantComparison(true);
+    }
+    return super.transformBinaryOperation(node, queryId);
+  }
+}
+
+/**
+ * Better Auth's Kysely adapter sends an `in` filter on an empty array as
+ * `IN ()`, which PostgreSQL rejects as a syntax error. The organization
+ * plugin's list-members endpoint looks the members' users up that way, so a
+ * filter or page that matched no member answered 500. This plugin sends an
+ * empty `in` list as `1 = 0` and an empty `not in` list as `1 = 1`.
+ */
+export class EmptyListPlugin implements KyselyPlugin {
+  private readonly transformer = new EmptyListTransformer();
+
+  transformQuery(args: PluginTransformQueryArgs): RootOperationNode {
+    return this.transformer.transformNode(args.node, args.queryId);
+  }
+
+  transformResult(args: PluginTransformResultArgs): Promise<QueryResult<UnknownRow>> {
+    return Promise.resolve(args.result);
+  }
+}

package/dist/templates/modules/auth/module.manifest.json

@@ -13,6 +13,7 @@
     "@podosoft/podokit-auth": "^0.6.0",
     "@podosoft/podokit-contracts": "^0.6.0",
     "better-auth": "^1.7.7",
+    "kysely": "^0.29.0",
     "pg": "^8.12.0",
     "@better-auth/api-key": "^1.7.7",
     "@better-auth/passkey": "^1.7.7",

package/dist/templates/modules/bullmq/files/apps/api/src/jobs/bullmq-job.queue.spec.ts

@@ -136,6 +136,9 @@ describe("BullMqJobQueue schedules", () => {
       await expect(queue.schedule("bad", "report", {}, { cron: "61 * * * *" })).rejects.toThrow();
       await expect(queue.schedule("bad", "report", {}, { cron: "0 3 * * *", timezone: "Mars/Olympus" })).rejects.toThrow();
       await expect(queue.schedule("bad", "report", {}, { everyMs: 10 })).rejects.toThrow("at least 1000");
+      await expect(queue.schedule("bad", "report", {}, { everyMs: 1_000 }, { keepFailed: 1.5 })).rejects.toThrow(
+        "keepFailed must be a whole number of at least 0",
+      );
     } finally {
       await queue.close();
     }
@@ -183,4 +186,51 @@ describe.skipIf(!process.env.REDIS_URL && !process.env.REDIS_HOST)("BullMqJobQue
       await inspect.close();
     }
   });
+
+  it("limits the finished jobs a schedule's runs leave, 100 completed and 1000 failed by default", async () => {
+    const name = `schedule-test-${crypto.randomUUID()}`;
+    const queue = new BullMqJobQueue(producerConnection(REDIS));
+    const inspect = new Queue(name, { connection: redisConnection(REDIS) });
+    try {
+      await queue.connect();
+      await queue.schedule("default", name, {}, { cron: "0 3 * * *" });
+      await queue.schedule("custom", name, {}, { everyMs: 3_600_000 }, { keepCompleted: 0, keepFailed: 20 });
+      expect((await inspect.getJobScheduler("default"))?.template?.opts).toMatchObject({
+        removeOnComplete: { count: 100 },
+        removeOnFail: { count: 1_000 },
+      });
+      expect((await inspect.getJobScheduler("custom"))?.template?.opts).toMatchObject({
+        removeOnComplete: { count: 0 },
+        removeOnFail: { count: 20 },
+      });
+    } finally {
+      await queue.close();
+      await inspect.obliterate({ force: true });
+      await inspect.close();
+    }
+  });
+
+  it("removes finished runs beyond the schedule's limits", async () => {
+    const name = `schedule-test-${crypto.randomUUID()}`;
+    const queue = new BullMqJobQueue(producerConnection(REDIS));
+    const inspect = new Queue(name, { connection: redisConnection(REDIS) });
+    let runs = 0;
+    try {
+      await queue.connect();
+      await queue.process(name, () => {
+        runs += 1;
+        if (runs % 2 === 0) throw new Error("expected failure");
+      });
+      await queue.schedule("tick", name, {}, { everyMs: 1_000 }, { keepCompleted: 1, keepFailed: 1 });
+      for (let waited = 0; runs < 4 && waited < 10_000; waited += 100) await Bun.sleep(100);
+      expect(runs).toBeGreaterThanOrEqual(4);
+      // The last run's job moves to its finished set just after the handler returns.
+      await Bun.sleep(200);
+      expect(await inspect.getJobCounts("completed", "failed")).toEqual({ completed: 1, failed: 1 });
+    } finally {
+      await queue.close();
+      await inspect.obliterate({ force: true });
+      await inspect.close();
+    }
+  }, 15_000);
 });

package/dist/templates/modules/bullmq/files/apps/api/src/jobs/bullmq-job.queue.ts

@@ -10,6 +10,9 @@ import {
   type JobSnapshot,
   type JobStatus,
   type RepeatOptions,
+  type ScheduleOptions,
+  type ScheduleRetention,
+  scheduleRetention,
   type Unsubscribe,
 } from "@podosoft/podokit-runtime";
 import type { SupervisedConnection } from "../core/services";
@@ -56,6 +59,7 @@ interface Schedule {
   name: string;
   payload: unknown;
   repeat: RepeatOptions;
+  retention: ScheduleRetention;
 }
 
 /** Rejects a schedule BullMQ could not run, before it is kept. */
@@ -141,13 +145,20 @@ export class BullMqJobQueue implements JobQueue, SupervisedConnection {
     };
   }
 
-  async schedule(id: string, name: string, payload: unknown, repeat: RepeatOptions): Promise<void> {
+  async schedule(
+    id: string,
+    name: string,
+    payload: unknown,
+    repeat: RepeatOptions,
+    options?: ScheduleOptions,
+  ): Promise<void> {
     assertSchedule(repeat);
+    const retention = scheduleRetention(options);
     const previous = this.schedules.get(id);
     // A scheduler lives in its queue, so a schedule that moves leaves the old one.
     if (previous && previous.name !== name) this.removals.set(id, previous.name);
     if (this.removals.get(id) === name) this.removals.delete(id);
-    this.schedules.set(id, { name, payload, repeat });
+    this.schedules.set(id, { name, payload, repeat, retention });
     await this.whenConnected(async (client) => {
       if (this.removals.has(id)) await this.removeSchedule(client, id);
       await this.applySchedule(client, id);
@@ -196,10 +207,19 @@ export class BullMqJobQueue implements JobQueue, SupervisedConnection {
     const schedule = this.schedules.get(id);
     if (!schedule) return;
     const { cron, everyMs, timezone } = schedule.repeat;
+    // A count above 0 trims the queue's whole completed or failed set to that
+    // many jobs; 0 removes only the finished run.
     await this.queue(schedule.name, client).upsertJobScheduler(
       id,
       cron !== undefined ? { pattern: cron, tz: timezone ?? "UTC" } : { every: everyMs },
-      { name: schedule.name, data: schedule.payload },
+      {
+        name: schedule.name,
+        data: schedule.payload,
+        opts: {
+          removeOnComplete: { count: schedule.retention.keepCompleted },
+          removeOnFail: { count: schedule.retention.keepFailed },
+        },
+      },
     );
   }
 

package/dist/templates/modules/jobs-local/files/apps/api/src/jobs-local/local-job.queue.spec.ts

@@ -149,6 +149,93 @@ describe("local job schedules", () => {
     await expect(queue.schedule("bad", "report", {}, { cron: "61 * * * *" })).rejects.toThrow();
     await expect(queue.schedule("bad", "report", {}, { cron: "0 3 * * *", timezone: "Mars/Olympus" })).rejects.toThrow();
     await expect(queue.schedule("bad", "report", {}, { everyMs: 10 })).rejects.toThrow("at least 1000");
+    await expect(queue.schedule("bad", "report", {}, { everyMs: 1_000 }, { keepCompleted: -1 })).rejects.toThrow(
+      "keepCompleted must be a whole number of at least 0",
+    );
+    queue.close();
+  });
+});
+
+/** Moves the clock to each time and runs the job the schedule added then. */
+async function runScheduled(queue: LocalJobQueue, time: ReturnType<typeof manualTime>, times: number[]): Promise<void> {
+  for (const at of times) {
+    time.advance(at);
+    // The schedule adds its job without waiting; let the insert finish.
+    await Bun.sleep(1);
+    expect(await queue.runOnce()).toBe(true);
+  }
+}
+
+async function finishedJobs(database: SQL): Promise<string[]> {
+  const rows = await database<Array<{ id: string; status: string }>>`
+    SELECT "id", "status" FROM "podokit_job" ORDER BY "updatedAt", "id"
+  `;
+  return rows.map((row) => `${row.id} ${row.status}`);
+}
+
+describe("local job schedule cleanup", () => {
+  it("keeps the newest finished jobs of a scheduled run's name up to the schedule's limits", async () => {
+    sql = new SQL(":memory:");
+    const time = manualTime(0);
+    const queue = new LocalJobQueue(sql, { pollIntervalMs: 60_000, now: time.now, timer: time.timer });
+    await queue.process("report", (_payload, job) => {
+      if (job.id.endsWith(":3000") || job.id.endsWith(":5000")) throw new Error("expected failure");
+    });
+    await queue.process("other", () => undefined);
+    const other = await queue.enqueue("other", {});
+    const adHoc = await queue.enqueue("report", {});
+    while (await queue.runOnce());
+    await queue.schedule("tick", "report", {}, { everyMs: 1_000 }, { keepCompleted: 2, keepFailed: 1 });
+    await queue.start();
+    await Bun.sleep(5);
+
+    await runScheduled(queue, time, [1_000, 2_000, 3_000, 4_000, 5_000, 6_000]);
+
+    // As BullMQ trims a queue: the job enqueue() added goes too, another name's stays.
+    expect(await finishedJobs(sql)).toEqual([
+      `${other.id} completed`,
+      "report:schedule:tick:4000 completed",
+      "report:schedule:tick:5000 failed",
+      "report:schedule:tick:6000 completed",
+    ]);
+    expect(await queue.get(adHoc.id)).toBeNull();
+    queue.close();
+  });
+
+  it("removes only the run itself when a limit is 0", async () => {
+    sql = new SQL(":memory:");
+    const time = manualTime(0);
+    const queue = new LocalJobQueue(sql, { pollIntervalMs: 60_000, now: time.now, timer: time.timer });
+    await queue.process("report", (_payload, job) => {
+      if (job.id.endsWith(":2000")) throw new Error("expected failure");
+    });
+    const adHoc = await queue.enqueue("report", {});
+    while (await queue.runOnce());
+    await queue.schedule("tick", "report", {}, { everyMs: 1_000 }, { keepCompleted: 0, keepFailed: 0 });
+    await queue.start();
+    await Bun.sleep(5);
+
+    await runScheduled(queue, time, [1_000, 2_000, 3_000]);
+
+    expect(await finishedJobs(sql)).toEqual([`${adHoc.id} completed`]);
+    queue.close();
+  });
+
+  it("keeps 100 completed runs of a schedule by default", async () => {
+    sql = new SQL(":memory:");
+    const time = manualTime(0);
+    const queue = new LocalJobQueue(sql, { pollIntervalMs: 60_000, now: time.now, timer: time.timer });
+    await queue.process("report", () => undefined);
+    await queue.schedule("tick", "report", {}, { everyMs: 1_000 });
+    await queue.start();
+    await Bun.sleep(5);
+
+    await runScheduled(queue, time, Array.from({ length: 105 }, (_, index) => (index + 1) * 1_000));
+
+    const kept = await finishedJobs(sql);
+    expect(kept).toHaveLength(100);
+    expect(kept[0]).toBe("report:schedule:tick:6000 completed");
+    expect(kept.at(-1)).toBe("report:schedule:tick:105000 completed");
     queue.close();
   });
 });

package/dist/templates/modules/jobs-local/files/apps/api/src/jobs-local/local-job.queue.ts

@@ -9,6 +9,9 @@ import {
   type JobSnapshot,
   type JobStatus,
   type RepeatOptions,
+  type ScheduleOptions,
+  type ScheduleRetention,
+  scheduleRetention,
   type Unsubscribe,
 } from "@podosoft/podokit-runtime";
 
@@ -42,9 +45,15 @@ interface Schedule {
   name: string;
   payload: unknown;
   repeat: RepeatOptions;
+  retention: ScheduleRetention;
   cancel?: () => void;
 }
 
+type FinishedStatus = "completed" | "failed";
+
+// A scheduled job's deduplication key: this prefix, the schedule id, ":", and the time.
+const SCHEDULE_KEY = "schedule:";
+
 // setTimeout fires at once for a delay above 2^31 - 1 ms, so longer waits are split.
 const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
 
@@ -160,13 +169,20 @@ export class LocalJobQueue implements JobQueue {
     });
   }
 
-  async schedule(id: string, name: string, payload: unknown, repeat: RepeatOptions): Promise<void> {
+  async schedule(
+    id: string,
+    name: string,
+    payload: unknown,
+    repeat: RepeatOptions,
+    options?: ScheduleOptions,
+  ): Promise<void> {
     assertRepeatOptions(repeat);
+    const retention = scheduleRetention(options);
     // Rejects an invalid cron expression or time zone now rather than at the first run.
     nextScheduledTime(repeat, this.now());
     if (JSON.stringify(payload) === undefined) throw new Error("Job payload must be JSON serializable");
     this.schedules.get(id)?.cancel?.();
-    const schedule: Schedule = { id, name, payload, repeat };
+    const schedule: Schedule = { id, name, payload, repeat, retention };
     this.schedules.set(id, schedule);
     if (this.started) this.arm(schedule);
   }
@@ -205,6 +221,7 @@ export class LocalJobQueue implements JobQueue {
         SET "status" = 'completed', "updatedAt" = ${completedAt}, "error" = NULL
         WHERE "id" = ${row.id}
       `;
+      await this.removeFinished(row, "completed");
     } catch (error) {
       await this.fail(row, error);
     }
@@ -227,7 +244,7 @@ export class LocalJobQueue implements JobQueue {
     const at = nextScheduledTime(schedule.repeat, after);
     schedule.cancel = this.waitUntil(at, () => {
       if (!this.started || this.schedules.get(schedule.id) !== schedule) return;
-      void this.enqueue(schedule.name, schedule.payload, { deduplicationKey: `schedule:${schedule.id}:${at}` })
+      void this.enqueue(schedule.name, schedule.payload, { deduplicationKey: `${SCHEDULE_KEY}${schedule.id}:${at}` })
         .catch((error: unknown) => {
           const message = error instanceof Error ? error.message : String(error);
           process.stderr.write(`Add scheduled job failed: ${schedule.id} ${message}\n`);
@@ -269,6 +286,45 @@ export class LocalJobQueue implements JobQueue {
       CREATE INDEX IF NOT EXISTS "podokit_job_pending"
       ON "podokit_job" ("status", "availableAt", "createdAt")
     `;
+    await this.sql`
+      CREATE INDEX IF NOT EXISTS "podokit_job_finished"
+      ON "podokit_job" ("name", "status", "updatedAt")
+    `;
+  }
+
+  /** The schedule whose job id `row` has, while that schedule is kept. */
+  private scheduleOf(row: JobRow): Schedule | undefined {
+    for (const schedule of this.schedules.values()) {
+      const prefix = `${schedule.name}:${SCHEDULE_KEY}${schedule.id}:`;
+      if (schedule.name === row.name && row.id.startsWith(prefix) && /^\d+$/.test(row.id.slice(prefix.length))) {
+        return schedule;
+      }
+    }
+    return undefined;
+  }
+
+  /**
+   * After a scheduled run finishes, keeps the newest finished jobs of its name
+   * up to the schedule's limit, as BullMQ trims a queue, or removes only the
+   * run when the limit is 0.
+   */
+  private async removeFinished(row: JobRow, status: FinishedStatus): Promise<void> {
+    const schedule = this.scheduleOf(row);
+    if (!schedule) return;
+    const keep = status === "completed" ? schedule.retention.keepCompleted : schedule.retention.keepFailed;
+    if (keep === 0) {
+      await this.sql`DELETE FROM "podokit_job" WHERE "id" = ${row.id}`;
+      return;
+    }
+    await this.sql`
+      DELETE FROM "podokit_job"
+      WHERE "name" = ${row.name} AND "status" = ${status} AND "id" NOT IN (
+        SELECT "id" FROM "podokit_job"
+        WHERE "name" = ${row.name} AND "status" = ${status}
+        ORDER BY "updatedAt" DESC, "id" DESC
+        LIMIT ${keep}
+      )
+    `;
   }
 
   private poll(delay: number): void {
@@ -296,6 +352,7 @@ export class LocalJobQueue implements JobQueue {
           "error" = ${message.slice(0, 2_000)}
       WHERE "id" = ${row.id}
     `;
+    if (!retry) await this.removeFinished(row, "failed");
   }
 
   private snapshot(row: JobRow): JobSnapshot {

package/dist/templates/modules/object-storage-local/files/tests/api/storage-local.api.spec.ts

@@ -1,13 +1,8 @@
 import { expect, test, type APIRequestContext, type PlaywrightWorkerArgs } from "@playwright/test";
+import { seededAdmin } from "../helpers/seeded-admin";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
-// The administrator seeded by the admin-dashboard Playwright setup. Inlined so this
-// spec also compiles in apps that do not install that module.
-const admin = {
-  email: process.env.E2E_ADMIN_EMAIL || "admin@example.com",
-  password: process.env.E2E_ADMIN_PASSWORD || "Podokit3e-Str0ng!pw",
-};
 
 type Playwright = PlaywrightWorkerArgs["playwright"];
 
@@ -36,6 +31,8 @@ async function signUp(ctx: APIRequestContext): Promise<boolean> {
 
 /** Resolves false when no administrator session is available. */
 async function signInAdmin(ctx: APIRequestContext): Promise<boolean> {
+  const admin = await seededAdmin();
+  if (!admin) return false;
   const response = await ctx.post("/api/auth/sign-in/email", { data: admin });
   return response.ok() && ((await sessionRoles(ctx)) ?? []).includes("admin");
 }

package/dist/templates/modules/object-storage-s3/files/tests/api/storage.api.spec.ts

@@ -1,13 +1,8 @@
 import { expect, test, type APIRequestContext, type PlaywrightWorkerArgs } from "@playwright/test";
+import { seededAdmin } from "../helpers/seeded-admin";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
-// The administrator seeded by the admin-dashboard Playwright setup. Inlined so this
-// spec also compiles in apps that do not install that module.
-const admin = {
-  email: process.env.E2E_ADMIN_EMAIL || "admin@example.com",
-  password: process.env.E2E_ADMIN_PASSWORD || "Podokit3e-Str0ng!pw",
-};
 
 type Playwright = PlaywrightWorkerArgs["playwright"];
 
@@ -36,6 +31,8 @@ async function signUp(ctx: APIRequestContext): Promise<boolean> {
 
 /** Resolves false when no administrator session is available. */
 async function signInAdmin(ctx: APIRequestContext): Promise<boolean> {
+  const admin = await seededAdmin();
+  if (!admin) return false;
   const response = await ctx.post("/api/auth/sign-in/email", { data: admin });
   return response.ok() && ((await sessionRoles(ctx)) ?? []).includes("admin");
 }