fix: stop browser from filling password fields

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

.github/workflows/build-test.yml

@@ -0,0 +1,42 @@
+name: Build Test
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Retrieve Server Install Action
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: Nodarx/action-server-install
+          ref: main
+          path: action-server-install
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install Server
+        uses: ./action-server-install
+        with:
+          install-php: 'false'
+          install-node: 'true'
+          php-version: '8.5'
+          node-version: '24'
+          server-path: './server'
+
+      - name: Checkout Pull Request
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: server/modules/authentication_provider_password
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: server/modules/authentication_provider_password
+
+      - name: Build
+        run: npm run build
+        working-directory: server/modules/authentication_provider_password

.github/workflows/js-unit-tests.yml

@@ -0,0 +1,42 @@
+name: JS Unit Tests
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Retrieve Server Install Action
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: Nodarx/action-server-install
+          ref: main
+          path: action-server-install
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install Server
+        uses: ./action-server-install
+        with:
+          install-php: 'false'
+          install-node: 'true'
+          php-version: '8.5'
+          node-version: '24'
+          server-path: './server'
+
+      - name: Checkout Pull Request
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: server/modules/authentication_provider_password
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: server/modules/authentication_provider_password
+
+      - name: Run tests
+        run: npm run test:unit
+        working-directory: server/modules/authentication_provider_password

.github/workflows/php-integration-tests.yml

@@ -1,4 +1,4 @@
-name: Integration Tests
+name: PHP Integration Tests
 
 on:
   pull_request:
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     services:
       mongo:
-        image: mongo:7
+        image: mongo:8
         options: >-
           --health-cmd "mongosh --quiet --eval \"db.adminCommand('ping')\""
           --health-interval 5s
@@ -44,6 +44,10 @@ jobs:
           path: server/modules/authentication_provider_password
           github-server-url: https://git.ktrix.dev
 
+      - name: Install module dependencies
+        run: composer install --prefer-dist --no-progress
+        working-directory: server/modules/authentication_provider_password
+
       - name: Install and enable module
         working-directory: server
         run: |

.github/workflows/php-unit-tests.yml

@@ -0,0 +1,42 @@
+name: PHP Unit Tests
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Retrieve Server Install Action
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: Nodarx/action-server-install
+          ref: main
+          path: action-server-install
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install Server
+        uses: ./action-server-install
+        with:
+          install-php: 'true'
+          install-node: 'false'
+          php-version: '8.5'
+          node-version: '24'
+          server-path: './server'
+
+      - name: Checkout Pull Request
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: server/modules/authentication_provider_password
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-progress
+        working-directory: server/modules/authentication_provider_password
+
+      - name: Run tests
+        run: composer test:unit
+        working-directory: server/modules/authentication_provider_password

.gitignore

@@ -15,11 +15,7 @@ node_modules/
 /vendor/
 /lib/vendor/
 coverage/
-phpunit.xml.cache
+*.cache
-.phpunit.cache/
-.phpunit.result.cache
-.php-cs-fixer.cache
-.phpstan.cache
 .phpactor/
 
 # Editors

composer.json

@@ -8,9 +8,18 @@
     }
   },
   "require": {
-    "php": ">=8.2"
+    "php": ">=8.3"
+  },
+  "require-dev": {
+    "phpunit/phpunit": "^12.0"
+  },
+  "autoload-dev": {
+    "psr-4": {
+      "KTXT\\AuthenticationProviderPassword\\Tests\\": "tests/php/"
+    }
   },
   "scripts": {
-    "test:integration": "../../vendor/bin/phpunit --configuration tests/php/phpunit.integration.xml --colors=always --testdox"
+    "test:unit": "phpunit --configuration tests/php/phpunit.xml --testsuite \"Unit Tests\" --colors=always --testdox",
+    "test:integration": "phpunit --configuration tests/php/phpunit.xml --testsuite \"Integration Tests\" --colors=always --testdox"
   }
 }

lib/Controllers/PasswordController.php

@@ -4,8 +4,8 @@ namespace KTXM\AuthenticationProviderPassword\Controllers;
 
 use KTXC\Http\Response\JsonResponse;
 use KTXC\Service\UserAccountsService;
-use KTXC\SessionIdentity;
+use KTXC\Context\IdentityContextInterface;
-use KTXC\SessionTenant;
+use KTXC\Context\TenantContextInterface;
 use KTXF\Controller\ControllerAbstract;
 use KTXF\Routing\Attributes\AuthenticatedRoute;
 use KTXF\Security\Crypto;
@@ -15,8 +15,8 @@ use KTXM\AuthenticationProviderPassword\Stores\CredentialStore;
 class PasswordController extends ControllerAbstract
 {
     public function __construct(
-        private readonly SessionIdentity $sessionIdentity,
+        private readonly IdentityContextInterface $identityContext,
-        private readonly SessionTenant $sessionTenant,
+        private readonly TenantContextInterface $tenantContext,
         private readonly CredentialStore $credentialStore,
         private readonly Provider $provider,
         private readonly Crypto $crypto,
@@ -27,8 +27,8 @@ class PasswordController extends ControllerAbstract
     #[AuthenticatedRoute('/password/update', name: 'password.update', methods: ['POST'])]
     public function update(string $current_password, string $new_password): JsonResponse
     {
-        $tenantId = $this->sessionTenant->identifier();
+        $tenantId = $this->tenantContext->identifier();
-        $identifier = $this->sessionIdentity->mailAddress();
+        $identifier = $this->identityContext->mailAddress();
 
         if ($tenantId === null || $identifier === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
@@ -53,17 +53,15 @@ class PasswordController extends ControllerAbstract
     /**
      * Admin endpoint: Get credential status for a user
      */
-    #[AuthenticatedRoute('/admin/status/{uid}', name: 'password.admin.status', methods: ['GET'])]
+    #[AuthenticatedRoute('/status', name: 'password.admin.status', methods: ['POST'], permissions: ['authentication_provider_password.admin.view', 'authentication_provider_password.admin.manage'])]
     public function getStatus(string $uid): JsonResponse
     {
-        $tenantId = $this->sessionTenant->identifier();
+        $tenantId = $this->tenantContext->identifier();
 
         if ($tenantId === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
         }
 
-        // TODO: Add permission check for admin operations
-
         $user = $this->userAccountsService->fetchByIdentifier($uid);
         if (!$user) {
             return new JsonResponse(['error' => 'User not found'], 404);
@@ -81,17 +79,15 @@ class PasswordController extends ControllerAbstract
     /**
      * Admin endpoint: Set/reset user password
      */
-    #[AuthenticatedRoute('/admin/reset', name: 'password.admin.reset', methods: ['POST'])]
+    #[AuthenticatedRoute('/reset', name: 'password.admin.reset', methods: ['POST'], permissions: ['authentication_provider_password.admin.manage'])]
     public function adminReset(string $uid, string $password): JsonResponse
     {
-        $tenantId = $this->sessionTenant->identifier();
+        $tenantId = $this->tenantContext->identifier();
 
         if ($tenantId === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
         }
 
-        // TODO: Add permission check for admin operations
-
         if (strlen($password) < 8) {
             return new JsonResponse(['error' => 'Password must be at least 8 characters'], 400);
         }
@@ -114,17 +110,15 @@ class PasswordController extends ControllerAbstract
     /**
      * Admin endpoint: Remove user password
      */
-    #[AuthenticatedRoute('/admin/remove/{uid}', name: 'password.admin.remove', methods: ['DELETE'])]
+    #[AuthenticatedRoute('/remove', name: 'password.admin.remove', methods: ['POST'], permissions: ['authentication_provider_password.admin.manage'])]
     public function adminRemove(string $uid): JsonResponse
     {
-        $tenantId = $this->sessionTenant->identifier();
+        $tenantId = $this->tenantContext->identifier();
 
         if ($tenantId === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
         }
 
-        // TODO: Add permission check for admin operations
-
         $user = $this->userAccountsService->fetchByIdentifier($uid);
         if (!$user) {
             return new JsonResponse(['error' => 'User not found'], 404);

lib/Module.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace KTXM\AuthenticationProviderPassword;
 
 use KTXC\Resource\ProviderManager;
+use KTXF\Module\ModuleBrowserInterface;
 use KTXF\Module\ModuleConsoleInterface;
 use KTXF\Module\ModuleInstanceAbstract;
 use KTXM\AuthenticationProviderPassword\Console\UserPasswordCommand;
@@ -13,7 +14,7 @@ use KTXM\AuthenticationProviderPassword\Console\UserPasswordCommand;
  * Default Identity Provider Module
  * Provides local database authentication
  */
-class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface
+class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, ModuleBrowserInterface
 {
     public function __construct(
         private readonly ProviderManager $providerManager,
@@ -52,6 +53,16 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface
                 'description' => 'View and access the password authentication provider module',
                 'group' => 'Authentication Providers'
             ],
+            'authentication_provider_password.admin.view' => [
+                'label' => 'View Password Status',
+                'description' => 'View whether another user has a password credential configured',
+                'group' => 'Authentication Providers'
+            ],
+            'authentication_provider_password.admin.manage' => [
+                'label' => 'Manage User Passwords',
+                'description' => 'Set, reset, or remove password credentials for other users',
+                'group' => 'Authentication Providers'
+            ],
         ];
     }
     

package.json

@@ -11,15 +11,23 @@
     "dev": "vite build --mode development --config vite.config.ts",
     "watch": "vite build --mode development --watch --config vite.config.ts",
     "typecheck": "vue-tsc --noEmit",
-    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore"
+    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore",
+    "test": "vitest run --config tests/js/vitest.config.ts",
+    "test:unit": "vitest run --config tests/js/vitest.config.ts",
+    "test:watch": "vitest watch --config tests/js/vitest.config.ts",
+    "test:coverage": "vitest run --coverage --config tests/js/vitest.config.ts"
   },
   "dependencies": {
     "vue": "^3.5.13"
   },
   "devDependencies": {
     "@vitejs/plugin-vue": "^6.0.0",
-    "typescript": "~7.0.0",
+    "typescript": "~6.0.0",
     "vite": "^8.0.0",
-    "vue-tsc": "^3.0.0"
+    "vue-tsc": "^3.0.0",
+    "@vitest/coverage-v8": "^4.1.6",
+    "@vue/test-utils": "^2.4.10",
+    "jsdom": "^29.1.1",
+    "vitest": "^4.1.6"
   }
 }

src/components/AdminSecurityPanel.vue

@@ -30,8 +30,15 @@ const confirmPassword = ref('');
 const loadStatus = async () => {
   statusLoading.value = true;
   try {
-    const response = await fetch(`/m/authentication_provider_password/admin/status/${props.user.uid}`, {
+    const response = await fetch('/m/authentication_provider_password/status', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
       credentials: 'include',
+      body: JSON.stringify({
+        uid: props.user.uid,
+      }),
     });
     
     if (response.ok) {
@@ -60,7 +67,7 @@ const resetPassword = async () => {
   error.value = null;
 
   try {
-    const response = await fetch('/m/authentication_provider_password/admin/reset', {
+    const response = await fetch('/m/authentication_provider_password/reset', {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
@@ -95,9 +102,15 @@ const removePassword = async () => {
   error.value = null;
 
   try {
-    const response = await fetch(`/m/authentication_provider_password/admin/remove/${props.user.uid}`, {
+    const response = await fetch('/m/authentication_provider_password/remove', {
-      method: 'DELETE',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
       credentials: 'include',
+      body: JSON.stringify({
+        uid: props.user.uid,
+      }),
     });
 
     if (response.ok) {
@@ -202,19 +215,23 @@ onMounted(() => {
           <VForm @submit.prevent="resetPassword">
             <VTextField
               v-model="newPassword"
+              name="new-password"
               label="New Password"
               type="password"
               variant="outlined"
               class="mb-4"
               required
               hint="Minimum 8 characters"
+              autocomplete="suppress"
             />
             <VTextField
               v-model="confirmPassword"
+              name="confirm-password"
               label="Confirm Password"
               type="password"
               variant="outlined"
               required
+              autocomplete="suppress"
               :error="confirmPassword.length > 0 && confirmPassword !== newPassword"
               :error-messages="confirmPassword.length > 0 && confirmPassword !== newPassword ? ['Passwords do not match'] : []"
             />

src/components/CredentialSetupPanel.vue

@@ -34,7 +34,7 @@ const setPassword = async () => {
   error.value = null;
 
   try {
-    const response = await fetch('/m/authentication_provider_password/admin/reset', {
+    const response = await fetch('/m/authentication_provider_password/reset', {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
@@ -110,6 +110,7 @@ const setPassword = async () => {
         <VForm @submit.prevent="setPassword">
           <VTextField
             v-model="password"
+            name="new-password"
             label="Password"
             type="password"
             variant="outlined"
@@ -117,13 +118,16 @@ const setPassword = async () => {
             required
             hint="Minimum 8 characters"
             persistent-hint
+            autocomplete="suppress"
           />
           <VTextField
             v-model="confirmPassword"
+            name="confirm-password"
             label="Confirm Password"
             type="password"
             variant="outlined"
             required
+            autocomplete="suppress"
             :error="confirmPassword.length > 0 && confirmPassword !== password"
             :error-messages="confirmPassword.length > 0 && confirmPassword !== password ? ['Passwords do not match'] : []"
           />

src/views/UserSettingsSecurityPanel.vue

@@ -133,7 +133,7 @@ const saveChanges = async () => {
               label="Current Password"
               placeholder="············"
               variant="outlined"
-              autocomplete="off"
+              autocomplete="new-password"
               @click:append-inner="isCurrentPasswordVisible = !isCurrentPasswordVisible"
             />
           </VCol>
@@ -144,6 +144,7 @@ const saveChanges = async () => {
           <VCol cols="12">
             <VTextField
               v-model="newPassword"
+              name="new-password"
               :type="isNewPasswordVisible ? 'text' : 'password'"
               :append-inner-icon="isNewPasswordVisible ? 'mdi-eye-off' : 'mdi-eye'"
               label="New Password"
@@ -157,6 +158,7 @@ const saveChanges = async () => {
           <VCol cols="12">
             <VTextField
               v-model="confirmPassword"
+              name="confirm-password"
               :type="isConfirmPasswordVisible ? 'text' : 'password'"
               :append-inner-icon="isConfirmPasswordVisible ? 'mdi-eye-off' : 'mdi-eye'"
               label="Confirm New Password"

tests/js/unit/base.test.ts

@@ -0,0 +1,30 @@
+import { describe, it, expect } from 'vitest'
+
+describe('Basic Tests', () => {
+  it('should perform basic assertion', () => {
+    expect(true).toBe(true)
+  })
+
+  it('should test array operations', () => {
+    const array = ['foo', 'bar', 'baz']
+
+    expect(array).toHaveLength(3)
+    expect(array).toContain('bar')
+    expect(array[0]).toBe('foo')
+  })
+
+  it('should test string operations', () => {
+    const string = 'Hello, World!'
+
+    expect(string).toContain('World')
+    expect(string.length).toBe(13)
+  })
+
+  it('should test object operations', () => {
+    const obj = { foo: 'bar', count: 42 }
+
+    expect(obj).toHaveProperty('foo')
+    expect(obj.foo).toBe('bar')
+    expect(obj.count).toBeGreaterThan(40)
+  })
+})

tests/js/vitest.config.ts

@@ -0,0 +1,33 @@
+import { fileURLToPath } from 'node:url'
+import { defineConfig, configDefaults } from 'vitest/config'
+import vue from '@vitejs/plugin-vue'
+import path from 'path'
+
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = path.dirname(__filename)
+
+export default defineConfig({
+  plugins: [vue()],
+  resolve: {
+    alias: {
+      '@': path.resolve(__dirname, '../../src'),
+      '@KTXC': path.resolve(__dirname, '../../../../core/src'),
+    },
+  },
+  test: {
+    environment: 'jsdom',
+    exclude: [...configDefaults.exclude, 'e2e/**'],
+    root: fileURLToPath(new URL('../../', import.meta.url)),
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'html'],
+      exclude: [
+        'node_modules/',
+        'tests/',
+        '**/*.d.ts',
+        '**/*.config.*',
+        '**/dist/**',
+      ],
+    },
+  },
+})

tests/php/Integration/IntegrationTestCase.php

@@ -6,7 +6,8 @@ namespace KTXT\AuthenticationProviderPassword\Tests\Integration;
 
 use KTXC\Http\Request\Request;
 use KTXC\Http\Response\Response;
-use KTXC\Server;
+use KTXC\Application;
+use KTXC\Stores\UserRolesStore;
 use PHPUnit\Framework\TestCase;
 
 /**
@@ -18,11 +19,11 @@ use PHPUnit\Framework\TestCase;
  * through the real HTTP kernel (routing, tenant resolution, auth middleware,
  * controller), not by calling controllers directly.
  *
- * A fresh Server (and DI container) is built for every request() call,
+ * A fresh Application (and DI container) is built for every request() call,
  * mirroring the one-process-per-request model this app is actually
  * deployed under. Session identity is a container-lifetime singleton that
  * AuthenticationMiddleware only ever sets, never clears, so reusing one
- * Server across requests would leak an authenticated identity from one
+ * Application across requests would leak an authenticated identity from one
  * "request" into the next — a problem that can't occur in production,
  * where each request gets its own process, but very much can here.
  *
@@ -36,7 +37,7 @@ abstract class IntegrationTestCase extends TestCase
 
     public static function setUpBeforeClass(): void
     {
-        if (static::buildServer()->environment() === 'prod') {
+        if (static::buildApplication()->environment() === 'prod') {
             self::fail('Refusing to run integration tests against a server configured for the "prod" environment.');
         }
 
@@ -57,9 +58,9 @@ abstract class IntegrationTestCase extends TestCase
         }
     }
 
-    protected static function buildServer(): Server
+    protected static function buildApplication(): Application
     {
-        return new Server(KTRIX_SERVER_ROOT);
+        return Application::create(SERVER_ROOT);
     }
 
     // =========================================================================
@@ -67,14 +68,21 @@ abstract class IntegrationTestCase extends TestCase
     // =========================================================================
 
     /**
-     * Provision a user (optionally with a password credential) and return
+     * Provision a user (optionally with a password credential and roles) and
-     * its uid, so tests can exercise admin endpoints that operate by uid.
+     * return its uid, so tests can exercise admin endpoints that operate by uid.
+     *
+     * @param string[] $roles Role IDs to assign (see createRoleWithPermissions())
      */
-    protected static function createUser(string $identity, ?string $password = null): string
+    protected static function createUser(string $identity, ?string $password = null, array $roles = []): string
     {
         $uid = bin2hex(random_bytes(8));
 
-        static::runConsole(['user:create', static::$tenantIdentifier, $identity, '--uid', $uid]);
+        $args = ['user:create', static::$tenantIdentifier, $identity, '--uid', $uid];
+        foreach ($roles as $role) {
+            $args[] = '--role';
+            $args[] = $role;
+        }
+        static::runConsole($args);
 
         if ($password !== null) {
             static::runConsole(['user:password', static::$tenantIdentifier, $identity, $password]);
@@ -83,6 +91,33 @@ abstract class IntegrationTestCase extends TestCase
         return $uid;
     }
 
+    /**
+     * Create a role granting the given permissions and return its role id.
+     *
+     * There's no `bin/console` command for role management, so this goes
+     * straight through the DI container to UserRolesStore — the same store
+     * the real UserRolesController uses — rather than calling controllers
+     * directly.
+     *
+     * @param string[] $permissions
+     */
+    protected static function createRoleWithPermissions(array $permissions, string $label = 'Test Role'): string
+    {
+        $application = static::buildApplication();
+        try {
+            $application->kernel()->boot();
+            $store = $application->container()->get(UserRolesStore::class);
+            $role = $store->createRole(static::$tenantIdentifier, [
+                'label' => $label,
+                'permissions' => $permissions,
+            ]);
+        } finally {
+            $application->shutdown();
+        }
+
+        return $role['rid'];
+    }
+
     /**
      * Run a bin/console command as a real subprocess and fail the test on
      * a non-zero exit code.
@@ -91,7 +126,7 @@ abstract class IntegrationTestCase extends TestCase
      */
     protected static function runConsole(array $args): string
     {
-        $command = escapeshellcmd(PHP_BINARY) . ' ' . escapeshellarg(KTRIX_SERVER_ROOT . '/bin/console');
+        $command = escapeshellcmd(PHP_BINARY) . ' ' . escapeshellarg(SERVER_ROOT . '/bin/console');
         foreach ($args as $arg) {
             $command .= ' ' . escapeshellarg((string) $arg);
         }
@@ -138,15 +173,13 @@ abstract class IntegrationTestCase extends TestCase
         $uri = 'http://' . static::$tenantDomain . $path;
         $request = Request::create($uri, $method, [], [], [], $server, $content);
 
-        // Kernel::boot() registers a global error/exception handler per
+        // A fresh application mirrors production while shutdown restores its
-        // instance and never removes it (fine under one-process-per-request
+        // process-level error handler after the in-process request.
-        // in production; here it would otherwise stack a handler per test).
+        $application = static::buildApplication();
-        // Pop back to whatever was in place before this request.
         try {
-            $response = static::buildServer()->handle($request);
+            $response = $application->runHttpRequest($request);
         } finally {
-            restore_error_handler();
+            $application->shutdown();
-            restore_exception_handler();
         }
 
         $body = $response->getContent();

tests/php/Integration/PasswordControllerTest.php

@@ -63,12 +63,13 @@ class PasswordControllerTest extends IntegrationTestCase
 
     public function testAdminStatusReflectsEnrollment(): void
     {
-        $enrolledUid = static::createUser('grace@example.test', 'Grace-Pass-1!');
+        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.view']);
+        $enrolledUid = static::createUser('grace@example.test', 'Grace-Pass-1!', [$roleId]);
         $unenrolledUid = static::createUser('heidi@example.test');
         $accessToken = static::loginWithPassword('grace@example.test', 'Grace-Pass-1!')['accessToken'];
 
-        $enrolledStatus = static::authorizedRequest($accessToken, 'GET', self::BASE . "/admin/status/{$enrolledUid}");
+        $enrolledStatus = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $enrolledUid]);
-        $unenrolledStatus = static::authorizedRequest($accessToken, 'GET', self::BASE . "/admin/status/{$unenrolledUid}");
+        $unenrolledStatus = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $unenrolledUid]);
 
         $this->assertTrue($enrolledStatus['body']['enrolled'] ?? null);
         $this->assertFalse($unenrolledStatus['body']['enrolled'] ?? null);
@@ -77,11 +78,12 @@ class PasswordControllerTest extends IntegrationTestCase
     public function testAdminResetSetsAPasswordThatCanLogIn(): void
     {
         $uid = static::createUser('ivan@example.test');
-        // Bootstrap an authenticated actor to call the admin endpoint
+        // Bootstrap an authenticated actor with permission to call the admin endpoint
-        static::createUser('actor1@example.test', 'Actor-Pass-1!');
+        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
+        static::createUser('actor1@example.test', 'Actor-Pass-1!', [$roleId]);
         $accessToken = static::loginWithPassword('actor1@example.test', 'Actor-Pass-1!')['accessToken'];
 
-        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/admin/reset', [
+        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
             'uid' => $uid,
             'password' => 'Reset-By-Admin-1!',
         ]);
@@ -96,10 +98,11 @@ class PasswordControllerTest extends IntegrationTestCase
     public function testAdminResetRejectsShortPasswords(): void
     {
         $uid = static::createUser('judy@example.test');
-        static::createUser('actor2@example.test', 'Actor-Pass-2!');
+        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
+        static::createUser('actor2@example.test', 'Actor-Pass-2!', [$roleId]);
         $accessToken = static::loginWithPassword('actor2@example.test', 'Actor-Pass-2!')['accessToken'];
 
-        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/admin/reset', [
+        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
             'uid' => $uid,
             'password' => 'short',
         ]);
@@ -110,17 +113,41 @@ class PasswordControllerTest extends IntegrationTestCase
     public function testAdminRemoveRevokesLogin(): void
     {
         $uid = static::createUser('kevin@example.test', 'Kevin-Pass-1!');
-        static::createUser('actor3@example.test', 'Actor-Pass-3!');
+        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
+        static::createUser('actor3@example.test', 'Actor-Pass-3!', [$roleId]);
         $accessToken = static::loginWithPassword('actor3@example.test', 'Actor-Pass-3!')['accessToken'];
 
-        $remove = static::authorizedRequest($accessToken, 'DELETE', self::BASE . "/admin/remove/{$uid}");
+        $remove = static::authorizedRequest($accessToken, 'POST', self::BASE . '/remove', ['uid' => $uid]);
         $this->assertSame(200, $remove['status']);
         $this->assertTrue($remove['body']['success'] ?? false);
 
-        $status = static::authorizedRequest($accessToken, 'GET', self::BASE . "/admin/status/{$uid}");
+        $status = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $uid]);
         $this->assertFalse($status['body']['enrolled'] ?? null);
 
         $login = static::loginWithPassword('kevin@example.test', 'Kevin-Pass-1!');
         $this->assertSame('failed', $login['body']['status'] ?? null);
     }
+
+    public function testAdminEndpointsRejectActorsWithoutPermission(): void
+    {
+        $targetUid = static::createUser('mallory-target@example.test', 'Mallory-Target-1!');
+        static::createUser('mallory@example.test', 'Mallory-Pass-1!');
+        $accessToken = static::loginWithPassword('mallory@example.test', 'Mallory-Pass-1!')['accessToken'];
+
+        $status = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $targetUid]);
+        $this->assertSame(403, $status['status']);
+
+        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
+            'uid' => $targetUid,
+            'password' => 'Should-Not-Apply-1!',
+        ]);
+        $this->assertSame(403, $reset['status']);
+
+        $remove = static::authorizedRequest($accessToken, 'POST', self::BASE . '/remove', ['uid' => $targetUid]);
+        $this->assertSame(403, $remove['status']);
+
+        // None of the rejected calls should have taken effect
+        $login = static::loginWithPassword('mallory-target@example.test', 'Mallory-Target-1!');
+        $this->assertSame('success', $login['body']['status'] ?? null);
+    }
 }

tests/php/Unit/BaseTest.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace KTXT\AuthenticationProviderPassword\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+class BaseTest extends TestCase
+{
+    public function testBasicAssertion(): void
+    {
+        $this->assertTrue(true);
+    }
+
+    public function testArrayOperations(): void
+    {
+        $array = ['foo' => 'bar'];
+
+        $this->assertArrayHasKey('foo', $array);
+        $this->assertEquals('bar', $array['foo']);
+    }
+
+    public function testStringOperations(): void
+    {
+        $string = 'Hello, World!';
+
+        $this->assertStringContainsString('World', $string);
+        $this->assertEquals(13, strlen($string));
+    }
+}

tests/php/bootstrap.php

@@ -6,9 +6,9 @@ declare(strict_types=1);
 // server's own vendor/autoload.php (core + shared + framework deps) is a
 // fixed number of levels above this file. Every other test file resolves
 // the server root through this constant rather than repeating the math.
-define('KTRIX_SERVER_ROOT', dirname(__DIR__, 4));
+define('SERVER_ROOT', dirname(__DIR__, 4));
 
-require KTRIX_SERVER_ROOT . '/vendor/autoload.php';
+require SERVER_ROOT . '/vendor/autoload.php';
 require __DIR__ . '/Integration/IntegrationTestCase.php';
 
 if (isset($_SERVER['APP_DEBUG']) && $_SERVER['APP_DEBUG']) {

tests/php/phpunit.xml

@@ -2,7 +2,7 @@
 
 <!-- https://phpunit.readthedocs.io/en/latest/configuration.html -->
 <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:noNamespaceSchemaLocation="../../../../vendor/phpunit/phpunit/phpunit.xsd"
+         xsi:noNamespaceSchemaLocation="../../vendor/phpunit/phpunit/phpunit.xsd"
          colors="true"
          failOnDeprecation="true"
          failOnNotice="true"
@@ -17,8 +17,11 @@
     </php>
 
     <testsuites>
+        <testsuite name="Unit Tests">
+            <directory>Unit</directory>
+        </testsuite>
         <testsuite name="Integration Tests">
-            <directory suffix="Test.php">Integration</directory>
+            <directory>Integration</directory>
         </testsuite>
     </testsuites>