Generated: 2026-06-19 (spec count refreshed 2026-10-23) Total routes: 10 (matrix scope below) | Total E2E specs: 66 on disk | CI projects: 5 (wizard · firstuser · oauth · auth-setup · chromium)

1. /setup — Setup Wizard (24 components, 6 tested)

Feature	Component	Tested?	Test File
DB type selection (sqlite/mongo/maria/postgres)	database-config.svelte	✅	setup-wizard.spec.ts
DB connection test (success)	connection-status.svelte	✅	setup-wizard
DB connection test (bad host)	connection-status.svelte	✅	setup-wizard
Admin account creation (valid)	admin-config.svelte	✅	setup-wizard (full flow)
Admin password mismatch	admin-config.svelte	✅	setup-wizard
SMTP invalid host error	email-config.svelte	✅	setup-wizard
Preset/template selection	preset-selector.svelte	❌	—
System config (site name, media folder)	system-config.svelte	❌	—

Feature	Component	Tested?	Test File
SMTP test email (valid config)	email-config.svelte	❌	—
Review step verification	review-config.svelte	❌	—
Back navigation (return to previous)	setup-navigation.svelte	❌	—
OAuth config during setup	setup server	❌	—
Demo mode detection	+page.svelte	❌	—
Multi-DB provisioning (Mongo/Maria/PG)	full flow	❌	Commented out
Config write permissions error	write-private-config.ts	❌	—
Cookie consent during setup	CookieConsent plugin	⚠️	Flaky

Coverage: 6/16 features (37%)

---

2. /login — Authentication (4 components, 6 specs)

Feature	Test File	Status
Login with valid credentials	login.spec.ts	✅
Logout	login.spec.ts	✅
Sign Up (first user)	login/signup.spec.ts	⚠️ Broken
Forgot password flow	login/signup.spec.ts	⚠️ Broken
OAuth button visibility	login/oauth.spec.ts	⚠️ Skips
OAuth redirect mock	login/oauth.spec.ts	✅
OAuth error handling	login/oauth.spec.ts	✅
Axe accessibility audit	accessibility.spec.ts	⚠️ 1 violation
Keyboard focus trap	accessibility.spec.ts	✅ Fixed
RTL layout audit	accessibility.spec.ts	⚠️ 1 violation
Login branding (public theme API)	branding.spec.ts	✅
Expired reset-token toast	extended-auth.spec.ts	✅
2FA/TOTP flow	—	❌
SAML SSO login	—	❌
Rate limiting (5 failed attempts)	—	❌
Account lockout (15 min)	—	❌
Session timeout warning	—	❌
“Remember me” persistent session	—	❌

Coverage: 10/16 features (62%)

---

3. /user — User Profile & Management (7 specs + control map)

Full 1:1 control map: routes/user.mdx (updated 2026-07-18). Product fixes: batch self-delete, CSRF on remotes/GDPR, permissions display, sessions UI.

Feature	Test File	Status
View profile	user/account-smoke.spec.ts	✅
Edit avatar	user/profile.spec.ts	✅ (fixture testthumb.png committed + hard-required)
Delete avatar	user/profile.spec.ts	✅ serial (button hard-asserted; no soft-skip)
Edit user details	user/profile.spec.ts	✅
Appearance settings link	user/profile.spec.ts	✅
Registration token workflow	user/profile.spec.ts	⚠️
Toggle token/list visibility	user/profile.spec.ts	✅
Read/edit user (admin)	user/management.spec.ts	✅
Delete/block/unblock (admin)	user/management.spec.ts	✅
Invite user via email	user/management-invite.spec.ts	✅
Auth preference toggles	user/complete-coverage.spec.ts	✅
Admin table search/sort	user/complete-coverage.spec.ts	✅
Privacy modal open/close	user/complete-coverage.spec.ts	✅ (privacy-data-btn)
Active sessions refresh	user/complete-coverage.spec.ts	✅
Password change (full)	user/p0-journeys.spec.ts	✅ editor verify→set→re-login
Non-admin profile	user/p0-journeys.spec.ts	✅ AdminArea hidden
Token edit/delete (seeded)	user/p0-journeys.spec.ts	✅ no soft-skip
2FA setup / enroll	user/coverage-100.spec.ts	✅ USE_2FA + TOTP
GDPR export / anonymize	user/coverage-100.spec.ts	✅ download + secondary wipe
RTC prefs persistence	user/coverage-100.spec.ts	✅ toggle + reload
Permissions badges	user/coverage-100.spec.ts	✅ admin list
Pagination (11+ users)	user/coverage-100.spec.ts	✅ bulk-create-users
Identity email/role/id	user/coverage-100.spec.ts	✅

Coverage: 100% of /user control map — see routes/user.mdx

---

3b. /dashboard — Shell (widget catalog varies per install)

Full control map: routes/dashboard.mdx.
Never assert a fixed widget list — core + plugins differ by install.

Feature	Test File	Status
Page shell + title	dashboard/dashboard.spec.ts	✅
Empty state or widget grid	same	✅ install-dependent
Add widget menu	same	✅ if catalog has free widgets
Widget search filter	same	✅ nonsense → no results
Reset layout	same	✅
AI toggle present	same	✅ no live MCP required
Plugin slot	same	✅ attached
Dashboard APIs (health/metrics/…)	integration dashboard.test.ts	✅
Drag-reorder E2E	—	🟢 Low (keyboard reorder exists; pointer DnD optional)

Coverage: shell 100% (per-widget UI content = opt-in, not part of shell contract)

---

4. /config/collectionbuilder (2 E2E specs: shell + structure + golden + migration)

Feature	Test File	Status
Shell: open builder + new editor	builder.spec.ts shell	✅
Golden: schema → entry → API	builder.spec.ts golden	✅
Migration cancel → reload → confirm → reload	confirm-migration.spec.ts	✅
Collections list auth	integration collection-structure	✅
Structure persistence	integration collectionbuilder/*	✅
Pure tree/slug utils	unit collectionbuilder-utils	✅
Empty state / multi-spec sprawl	demoted (ADR: one golden)	—
Field reordering / relation / templates	not P0	❌

The migration contract polls a fresh page load after the confirm round-trip: a single reload can beat the registry refresh, so the spec re-loads (bounded) until the hydrated inspector shows the persisted required flag. That keeps a real persistence failure red while removing the hydration race that consumed the Builder shard’s flake budget.

---

5. /config/* — System Configuration (13 specs)

Route	Feature	Test File	CI Project	Status
/config/system-settings	Cache repair	system/settings.spec.ts	chromium	✅
/config/access-management	Roles, permissions, save gating	config/access-management.spec.ts	chromium	✅
/config/access-management	Permission matrix (system)	system/permissions.spec.ts	chromium	✅
/config/access-management	RBAC (admin/dev/editor)	system/rbac.spec.ts	chromium	✅
/config/access-management	Permission removal blocks API+UI	system/permission-enforcement.spec.ts	chromium	✅
/config/webhooks	List, create form, delivery logs	config/webhooks.spec.ts	chromium	✅
/config/automations	Workflow builder smoke	config/automations.spec.ts	chromium	✅
/config/migration	Smart migration smoke (WXR + generic CSV)	config/data-management.spec.ts	chromium	✅

Route	Feature	Test File	CI Project	Status
/config/sync	Sync settings smoke	config/data-management.spec.ts	chromium	✅
/config/redirects	Create / search / delete	config/redirects.spec.ts	chromium	✅
/config/monitor	Stats + service health	config/operations.spec.ts	chromium	✅
/config/queue	Stats + status filter URL	config/operations.spec.ts	chromium	✅
/config/webhooks	Modal + logs shell	config/webhooks.spec.ts	chromium	✅
/config/extensions	Tabs + plugins grid	config/extensions.spec.ts	chromium	✅
/config/automations	List + new builder link	config/automations.spec.ts	chromium	✅
/config/sync	Tabs + status shell	config/data-ops.spec.ts	chromium	✅
/config/trash	Empty or restore table	config/data-ops.spec.ts	chromium	✅
/config/extensions	Extension list	config/operations.spec.ts	chromium	✅
/config/design-system	Sole Design System / Appearance workspace	config/design-system.spec.ts, appearance.spec.ts, appearance-golden.spec.ts	chromium	✅
/config/workflows	Shell + golden (seed→GET by collectionId)	config/workflows.spec.ts	chromium	✅
/config/unified-hub	Unified Data Hub (always-on + PG fixture)	config/unified-hub.spec.ts	chromium	✅
(dashboard / health)	Lane-router smoke: admin session + health	system/hooks-lane-smoke.spec.ts	chromium	✅

---

6. /admin/tenants — Multi-Tenant Management (1 spec)

Feature	Test File	CI Project	Status
Tenant list load	admin/tenants.spec.ts	chromium	✅
Quota headers/empty	admin/tenants.spec.ts	chromium	✅
Create tenant	—	—	❌
Edit tenant	—	—	❌
Cross-tenant isolation	multi-tenancy/isolation.spec.ts	chromium	⚠️ env-gated (MULTI_TENANT=true)

---

7. /dashboard — Shell 100% (widget catalog install-specific)

Feature	Test File	CI Project	Status
Page shell + toolbar	dashboard/dashboard.spec.ts	chromium	✅
Empty state or grid	same		✅ never fixed widget list
Add / search / reset	same		✅
AI toggle present	same		✅
Dashboard APIs	integration dashboard.test.ts		✅
Pointer drag-reorder E2E	dashboard/dashboard.spec.ts		✅ ≥2 widgets, header band drag
Keyboard Ctrl+Arrow reorder	same		✅
Per-widget visual content	—		⚪ out of shell scope (varies per install)

---

8. /mediagallery — Shell strong (see routes/mediagallery.mdx)

Feature	Test File	CI Project	Status
Page shell + toolbar	mediagallery/mediagallery.spec.ts	chromium	✅
Search + type filter	mediagallery/mediagallery.spec.ts	chromium	✅
Grid/table view toggle	mediagallery/mediagallery.spec.ts	chromium	✅
Local file upload	mediagallery/mediagallery.spec.ts	chromium	✅
Delete media	mediagallery/mediagallery.spec.ts	chromium	✅
Image editor tools, compare, zoom	mediagallery/image-editor.spec.ts	chromium	✅
Image editor save	mediagallery/image-editor.spec.ts	chromium	✅ manipulate API
Create / open folder	mediagallery/folders-bulk.spec.ts	chromium	✅
Bulk select / download / Del	mediagallery/folders-bulk.spec.ts	chromium	✅
media:read gate	unit mediagallery-page-server	—	✅
Selection + breadcrumb move	mediagallery/move-remote.spec.ts	chromium	✅
Sidebar-folder pointer drag	mediagallery/move-remote.spec.ts	chromium	✅ move + reload
Remote URL upload page	mediagallery/move-remote.spec.ts	chromium	✅

---

9. /language — Partially tested

Feature	Status
Language switching dropdown	⚠️ data-testid missing
RTL layout (Arabic/Hebrew)	⚠️ Axe violation
Translation coverage	❌

---

10. Additional covered routes (current suite)

Route	Feature	Test File	CI Project	Status
/ (site starter)	Seed-backed starter page smoke	site/site-starter.spec.ts	chromium	✅
/admin-theme	Visual regression screenshots	admin-theme/visual-regression.spec.ts	chromium	⚠️ env-gated (RUN_VISUAL / UPDATE_SNAPSHOTS)
/login	Keyboard-focus smoke (root spec)	accessibility.spec.ts	chromium	✅

---

Summary

Route	Features	Tested	Coverage
/setup	16	6	37%
/login	16	10	62%
/user	15	9	60%
/config/collectionbuilder	15	10	66%
/config/* (other)	15	11	73%
/admin/tenants	5	2	40%
/dashboard	8	7	88% shell (widget content N/A)
/mediagallery	8	4	50%
/language	3	1	33%
TOTAL	105	63	60%

Critical gaps: Setup presets, 2FA, SAML, rate limiting.

See Next Steps for prioritized action items.

CI Playwright Projects (5)

Source of truth: playwright.config.ts — 5 projects; chromium carries all route specs.

Project	Runs (testMatch)	Depends on
wizard	routes/setup/setup-wizard.spec.ts (serial, 1 worker)	—
firstuser	routes/login/signup.spec.ts (serial, 1 worker)	—
oauth	routes/login/oauth.spec.ts (CI only when OAUTH_ENABLED=true)	—
auth-setup	auth.setup.ts + routes/login/login.spec.ts (serial, 1 worker)	firstuser
chromium	all remaining route specs — fully parallel, CI-sharded via named --grep groups	auth-setup

CI (e2e-prep) runs wizard → auth-setup (which pulls in firstuser) sequentially; the e2e job then shards chromium into 8 disjoint groups via .github/workflows/e2e-matrix.ts: Config & System · Builder & Content · Users & Profile · RBAC & Enforcement · User Journeys · Media & Dashboard · Auth & Branding · Admin & Catch-All.

Every chromium spec must match exactly one --grep group — a spec that matches none never runs, and a spec that matches two runs twice. New journeys are registered in tests/route-test-coverage.ts and tests/critical-test-paths.ts at the same time.

Editorial & RBAC journeys (2026-10-23)

Journey	Spec	What it proves
Composite entry flow	routes/collection-builder/kitchen-sink.spec.ts	Multi-field create → API write → reload hydration → edit → delete with Input/Number/Checkbox/Email
Editor boundary	routes/admin/editor-boundary.spec.ts	Non-admin editor sees the profile surface, gets no admin nav, and a direct /config/access-management visit fails closed
Real-browser vitality	browser-vitality.spec.ts	Navigation Timing (TTFB/domInteractive), input latency, and SPA heap stability in Chromium
Widget interaction	tests/unit/components/dom/widget-inputs-interaction.test.ts	Native input/change events drive Svelte 5 widget state and validationStore errors

All four journeys attach tests/e2e/helpers/zero-error-guard.ts: an uncaught pageerror, a non-allowlisted console.error, or a failed same-origin request fails the test. The allowlist is limited to favicon/icon-CDN noise, aborted navigations, and expected 401/403/404 resource loads.

Next Steps

• E2E Testing Guide
• Testing Overview & Strategy
• Accessibility Audit