release/1.0: all P0/P1 fixes + quick wins (#323-#331, #336, #339, #341, #342)

.env.example

@@ -25,5 +25,8 @@ ADMIN_BOOTSTRAP_TOKEN=
 # Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 API_KEY_HMAC_SECRET=
 
+# Self-registration toggle — set to "false" to disable /signup (optional, default: true)
+# REGISTRATION_ENABLED=true
+
 # Tenant ID — defaults to "default" if unset (optional)
 # TENANT_ID=default

app/e2e/auth.spec.ts

@@ -20,14 +20,18 @@
 });
 
 test.describe("Signup", () => {
-  test("should render signup form with all required fields", async ({ page }) => {
+  test("should render signup form with all required fields", async ({
+    page,
+  }) => {
     await page.goto("/signup");
     await expect(page.getByText("Create your account")).toBeVisible();
     await expect(page.getByLabel("Name")).toBeVisible();
     await expect(page.getByLabel("Email")).toBeVisible();
     await expect(page.getByLabel("Password", { exact: true })).toBeVisible();
     await expect(page.getByLabel("Confirm Password")).toBeVisible();
-    await expect(page.getByRole("button", { name: "Create account" })).toBeVisible();
+    await expect(
+      page.getByRole("button", { name: "Create account" }),
+    ).toBeVisible();
     await expect(page.getByRole("link", { name: "Sign in" })).toBeVisible();
   });
 
@@ -37,11 +41,16 @@
     // Signup should auto-login and redirect to the dashboard
     await expect(page).toHaveURL("/", { timeout: 15_000 });
     // Sidebar should be visible (proves we're authenticated)
-    await expect(page.getByRole("button", { name: "Dashboards" })).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByRole("button", { name: "Dashboards" })).toBeVisible({
+      timeout: 10_000,
+    });
     await expect(page.getByRole("button", { name: "Sign out" })).toBeVisible();
   });
 
-  test("should be able to login with newly created account", async ({ authPage, page }) => {
+  test("should be able to login with newly created account", async ({
+    authPage,
+    page,
+  }) => {
     const email = `relogin-${Date.now()}@example.com`;
     const password = "password123";
     // Sign up
@@ -53,7 +62,9 @@
     // Log back in with the new account
     await authPage.login(email, password);
     await expect(page).toHaveURL("/");
-    await expect(page.getByRole("button", { name: "Dashboards" })).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByRole("button", { name: "Dashboards" })).toBeVisible({
+      timeout: 10_000,
+    });
   });
 
   test("should show error for mismatched passwords", async ({ page }) => {
@@ -76,7 +87,9 @@
     await page.getByLabel("Password", { exact: true }).fill("password123");
     await page.getByLabel("Confirm Password").fill("password123");
     await page.getByRole("button", { name: "Create account" }).click();
-    await expect(page.getByText("An account with this email already exists")).toBeVisible({ timeout: 10_000 });
+    await expect(
+      page.getByText("An account with this email already exists"),
+    ).toBeVisible({ timeout: 10_000 });
     // Should stay on signup page
     await expect(page).toHaveURL(/\/signup/);
   });
@@ -87,3 +100,113 @@
     await expect(page).toHaveURL(/\/login/);
   });
 });
+
+test.describe.serial("Force password change", () => {
+  /**
+   * Helper: login as ALICE, create a user with forcePasswordChange=true via API,
+   * log out, then return the new user's credentials.
+   */
+  async function createForcePasswordUser(
+    page: import("@playwright/test").Page,
+    authPage: import("./pages/auth").AuthPage,
+  ) {
+    // Login as admin to access the API
+    await authPage.login(ALICE.email, ALICE.password);
+    await page.waitForLoadState("networkidle");
+
+    const timestamp = Date.now();
+    const email = `force-pw-${timestamp}@test.com`;
+    const password = "oldpass123";
+
+    // Create user with forcePasswordChange via API
+    const res = await page.request.post("/api/users", {
+      data: {
+        name: "Force PW",
+        email,
+        password,
+        forcePasswordChange: true,
+      },
+    });
+    expect(res.ok()).toBeTruthy();
+
+    // Logout admin
+    await authPage.logout();
+    await expect(page).toHaveURL(/\/login/, { timeout: 15_000 });
+
+    return { email, password };
+  }
+
+  /**
+   * Helper: login as a force-password-change user without waiting for "/" redirect.
+   * The AuthPage.login() waits for toHaveURL("/") which won't happen for these users.
+   */
+  async function loginWithoutDashboardRedirect(
+    page: import("@playwright/test").Page,
+    email: string,
+    password: string,
+  ) {
+    await page.goto("/login");
+    await page.getByLabel("Email").waitFor({ state: "visible" });
+    await page.getByLabel("Email").fill(email);
+    await page.getByLabel("Password").fill(password);
+    await page.getByRole("button", { name: "Sign in" }).click();
+    await page.waitForLoadState("networkidle");
+  }
+
+  test("user with forcePasswordChange is redirected to /change-password on login", async ({
+    authPage,
+    page,
+  }) => {
+    const { email, password } = await createForcePasswordUser(page, authPage);
+
+    await loginWithoutDashboardRedirect(page, email, password);
+
+    // The proxy reads forcePasswordChange from the JWT. After signIn, the
+    // initial page load may land on "/" before the token refresh propagates
+    // the flag. Navigating to any protected page triggers the proxy check.
+    await page.goto("/");
+    await page.waitForLoadState("networkidle");
+
+    await expect(page).toHaveURL(/\/change-password/, { timeout: 15_000 });
+    await expect(
+      page.getByRole("heading", { name: "Change Password" }),
+    ).toBeVisible({ timeout: 10_000 });
+  });
+
+  test("user cannot navigate away from /change-password", async ({
+    authPage,
+    page,
+  }) => {
+    const { email, password } = await createForcePasswordUser(page, authPage);
+
+    await loginWithoutDashboardRedirect(page, email, password);
+    await expect(page).toHaveURL(/\/change-password/, { timeout: 15_000 });
+
+    // Try navigating to the dashboard
+    await page.goto("/");
+    await page.waitForLoadState("networkidle");
+
+    // Proxy should redirect back to /change-password
+    await expect(page).toHaveURL(/\/change-password/, { timeout: 15_000 });
+  });
+
+  test("after changing password, user is redirected to dashboard", async ({
+    authPage,
+    page,
+  }) => {
+    const { email, password } = await createForcePasswordUser(page, authPage);
+
+    await loginWithoutDashboardRedirect(page, email, password);
+    await expect(page).toHaveURL(/\/change-password/, { timeout: 15_000 });
+
+    // Fill the change password form
+    const newPassword = "newSecurePass123";
+    await page.getByLabel("Current Password").fill(password);
+    await page.getByLabel("New Password").fill(newPassword);
+    await page.getByLabel("Confirm New Password").fill(newPassword);
+    await page.getByRole("button", { name: "Change Password" }).click();
+
+    // After password change, user should be redirected to dashboard
+    await expect(page).toHaveURL("/", { timeout: 30_000 });
+  });
+});

app/e2e/charts.spec.ts

@@ -575,7 +575,7 @@
     const preview = getPreview(dialog);
     await expect(preview).toBeVisible({ timeout: 15_000 });
     await dialog.getByRole("button", { name: "Add Widget" }).click();
     await expect(dialog).not.toBeVisible({ timeout: 5_000 });
 
     // The graph widget should now be on the dashboard grid
     // It should have the toolbar controls visible (not "No graph data")
@@ -1224,21 +1224,15 @@
       timeout: 10_000,
     });
 
-    // The column mapping overlay should be visible on the grid in edit mode
+    // Column mapping overlay should NOT appear on dashboard cards (#331)
     await expect(
       page.locator("[data-testid='column-mapping-overlay']").first(),
-    ).toBeVisible({ timeout: 15_000 });
-
-    // X and Y triggers should be present
-    await expect(
-      page.locator("[data-testid='column-mapping-x-trigger']").first(),
-    ).toBeVisible();
-    await expect(
-      page.locator("[data-testid='column-mapping-y-trigger']").first(),
-    ).toBeVisible();
+    ).not.toBeVisible({ timeout: 5_000 });
   });
 
-  test("changing axis mapping updates chart", async ({ page }) => {
+  // Column mapping overlay removed from dashboard cards (#331) — axis mapping
+  // is now only available inside the widget editor modal.
+  test.skip("changing axis mapping updates chart", async ({ page }) => {
     test.setTimeout(60_000);
     await page.getByRole("button", { name: "Add Widget" }).first().click();
     const dialog = page.getByRole("dialog", { name: "Add Widget" });

app/e2e/connections.spec.ts

@@ -184,6 +184,34 @@ test.describe("Connections", () => {
     await expect(wrapper.locator('[role="alert"]')).not.toBeVisible();
   });
 
+  test("should pre-fill edit dialog with existing connection values", async ({
+    page,
+  }) => {
+    // Wait for seeded connections to load
+    const firstActions = page
+      .getByRole("button", { name: "Connection actions" })
+      .first();
+    await expect(firstActions).toBeVisible({ timeout: 10000 });
+
+    // Open the kebab menu on the first connection and click Edit
+    await firstActions.click();
+    await page.getByRole("menuitem", { name: /Edit/ }).click();
+
+    // Assert the edit dialog opens
+    const dialog = page.getByRole("dialog");
+    await expect(dialog).toBeVisible();
+
+    // Assert URI and username fields are pre-filled (not empty)
+    const uriInput = dialog.locator("#edit-uri");
+    const usernameInput = dialog.locator("#edit-username");
+    await expect(uriInput).not.toHaveValue("", { timeout: 5000 });
+    await expect(usernameInput).not.toHaveValue("");
+
+    // Close dialog
+    await dialog.getByRole("button", { name: "Cancel" }).click();
+    await expect(dialog).not.toBeVisible();
+  });
+
   test("should delete a connection with confirmation", async ({ page }) => {
     const name = `To Delete ${Date.now()}`;
     // Create one first

app/e2e/settings-profile.spec.ts

@@ -16,9 +16,9 @@ test.describe("Settings — Profile", () => {
   });
 
   test("profile page shows account info", async ({ page }) => {
-    await expect(page.getByText("Account", { exact: true })).toBeVisible();
-    await expect(page.getByText(ALICE.email)).toBeVisible();
-    await expect(page.getByText("admin", { exact: true })).toBeVisible();
+    await expect(page.getByText(ALICE.email)).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByText("Write Access")).toBeVisible();
+    await expect(page.getByText("Member Since")).toBeVisible();
   });
 
   test("can update display name", async ({ page }) => {
@@ -105,3 +105,15 @@ test.describe("Settings — Profile", () => {
     ).toBeVisible();
   });
 });
+
+test.describe("Settings — Redirect", () => {
+  test("navigating to /settings redirects to /settings/profile", async ({
+    authPage,
+    page,
+  }) => {
+    await authPage.login(ALICE.email, ALICE.password);
+    await page.goto("/settings");
+    await page.waitForLoadState("networkidle");
+    await expect(page).toHaveURL(/\/settings\/profile/);
+  });
+});

app/e2e/users.spec.ts

@@ -30,6 +30,39 @@ test.describe("User management", () => {
     await expect(page.getByText(`test-${timestamp}@example.com`)).toBeVisible();
   });
 
+  test("should change user role via dropdown", async ({ page }) => {
+    // Wait for user data to load
+    await expect(page.getByText("alice@example.com")).toBeVisible({
+      timeout: 10000,
+    });
+    // Create a fresh user as "creator"
+    await page.getByRole("button", { name: "Create User" }).first().click();
+    const dialog = page.getByRole("dialog");
+    const timestamp = Date.now();
+    const email = `test-role-${timestamp}@example.com`;
+    await dialog.locator("#user-name").fill("Role Test User");
+    await dialog.locator("#user-email").fill(email);
+    await dialog.locator("#user-password").fill("password123");
+    // Creator is the default role — no change needed
+    await dialog.getByRole("button", { name: "Create" }).click();
+    await expect(page.getByText(email)).toBeVisible({ timeout: 10000 });
+
+    // Find the user's row and click the role Select dropdown
+    const row = page.getByRole("row").filter({ hasText: email });
+    await row.getByRole("combobox").click();
+    // Select "Reader"
+    await page.getByRole("option", { name: "Reader" }).click();
+
+    // Assert toast "Role updated" appears (use exact match to avoid strict-mode
+    // violation from the aria-live status announcement that also contains "Role updated")
+    await expect(page.getByText("Role updated", { exact: true })).toBeVisible({
+      timeout: 5000,
+    });
+
+    // Verify the role changed — Select now shows "Reader"
+    await expect(row.getByRole("combobox")).toHaveText("Reader");
+  });
+
   test("should delete a user with confirmation", async ({ page }) => {
     // Wait for user data to load
     await expect(page.getByText("alice@example.com")).toBeVisible({