chore(deps): update dependency phpunit/phpunit to v12.5.33

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

.github/workflows/build-test.yml

@@ -0,0 +1,42 @@
+name: Build Test
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Retrieve Server Install Action
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: Nodarx/action-server-install
+          ref: main
+          path: action-server-install
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install Server
+        uses: ./action-server-install
+        with:
+          install-php: 'false'
+          install-node: 'true'
+          php-version: '8.5'
+          node-version: '24'
+          server-path: './server'
+
+      - name: Checkout Pull Request
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: server/modules/authentication_provider_password
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: server/modules/authentication_provider_password
+
+      - name: Build
+        run: npm run build
+        working-directory: server/modules/authentication_provider_password

.github/workflows/js-unit-tests.yml

@@ -0,0 +1,42 @@
+name: JS Unit Tests
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Retrieve Server Install Action
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: Nodarx/action-server-install
+          ref: main
+          path: action-server-install
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install Server
+        uses: ./action-server-install
+        with:
+          install-php: 'false'
+          install-node: 'true'
+          php-version: '8.5'
+          node-version: '24'
+          server-path: './server'
+
+      - name: Checkout Pull Request
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: server/modules/authentication_provider_password
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: server/modules/authentication_provider_password
+
+      - name: Run tests
+        run: npm run test:unit
+        working-directory: server/modules/authentication_provider_password

.github/workflows/php-integration-tests.yml

@@ -0,0 +1,59 @@
+name: PHP Integration Tests
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    services:
+      mongo:
+        image: mongo:8
+        options: >-
+          --health-cmd "mongosh --quiet --eval \"db.adminCommand('ping')\""
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+
+    steps:
+      - name: Retrieve Server Install Action
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: Nodarx/action-server-install
+          ref: main
+          path: action-server-install
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install server
+        uses: ./action-server-install
+        with:
+          install-php: 'true'
+          php-version: '8.5'
+          server-path: './server'
+          database-uri: 'mongodb://mongo:27017/?tls=false'
+          database-name: 'ktrix_ci'
+          app-environment: 'test'
+
+      - name: Checkout module under test
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          path: server/modules/authentication_provider_password
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install module dependencies
+        run: composer install --prefer-dist --no-progress
+        working-directory: server/modules/authentication_provider_password
+
+      - name: Install and enable module
+        working-directory: server
+        run: |
+          php bin/console module:install authentication_provider_password
+          php bin/console module:enable authentication_provider_password
+
+      - name: Run integration tests
+        working-directory: server/modules/authentication_provider_password
+        run: composer test:integration

.github/workflows/php-unit-tests.yml

@@ -0,0 +1,42 @@
+name: PHP Unit Tests
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Retrieve Server Install Action
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: Nodarx/action-server-install
+          ref: main
+          path: action-server-install
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install Server
+        uses: ./action-server-install
+        with:
+          install-php: 'true'
+          install-node: 'false'
+          php-version: '8.5'
+          node-version: '24'
+          server-path: './server'
+
+      - name: Checkout Pull Request
+        uses: actions/checkout@v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: server/modules/authentication_provider_password
+          github-server-url: https://git.ktrix.dev
+
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-progress
+        working-directory: server/modules/authentication_provider_password
+
+      - name: Run tests
+        run: composer test:unit
+        working-directory: server/modules/authentication_provider_password

.github/workflows/renovate.yml

@@ -25,11 +25,17 @@ jobs:
           tools: composer:v2
 
       - name: Install Renovate
-        run: npm install -g renovate
+        run: |
+          npm install --global --no-audit --fund=false \
+            --prefix "${{ runner.temp }}/renovate-npm" \
+            --cache "${{ runner.temp }}/renovate-npm-cache" \
+            renovate
+          "${{ runner.temp }}/renovate-npm/bin/renovate" --version
 
       - name: Run Renovate
         env:
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           RENOVATE_PLATFORM: gitea
           RENOVATE_ENDPOINT: https://git.ktrix.dev/api/v1
-        run: renovate ${{ gitea.repository }}
+        run: |
+          "${{ runner.temp }}/renovate-npm/bin/renovate" ${{ gitea.repository }}

.gitignore

@@ -12,12 +12,10 @@ node_modules/
 /static/
 
 # Backend development
+/vendor/
 /lib/vendor/
 coverage/
-phpunit.xml.cache
-.phpunit.result.cache
-.php-cs-fixer.cache
-.phpstan.cache
+*.cache
 .phpactor/
 
 # Editors

composer.json

@@ -8,6 +8,18 @@
     }
   },
   "require": {
-    "php": ">=8.2"
+    "php": ">=8.3"
+  },
+  "require-dev": {
+    "phpunit/phpunit": "^12.0"
+  },
+  "autoload-dev": {
+    "psr-4": {
+      "KTXT\\AuthenticationProviderPassword\\Tests\\": "tests/php/"
+    }
+  },
+  "scripts": {
+    "test:unit": "phpunit --configuration tests/php/phpunit.xml --testsuite \"Unit Tests\" --colors=always --testdox",
+    "test:integration": "phpunit --configuration tests/php/phpunit.xml --testsuite \"Integration Tests\" --colors=always --testdox"
   }
 }

lib/Console/UserPasswordCommand.php

@@ -0,0 +1,102 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXM\AuthenticationProviderPassword\Console;
+
+use KTXC\Service\TenantService;
+use KTXC\Stores\UserAccountsStore;
+use KTXM\AuthenticationProviderPassword\Provider;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * User Password Command
+ *
+ * Sets or updates the password credential for a user account.
+ */
+#[AsCommand(
+    name: 'user:password',
+    description: 'Set or update the password credential for a user',
+)]
+class UserPasswordCommand extends Command
+{
+    public function __construct(
+        private readonly Provider $provider,
+        private readonly TenantService $tenantService,
+        private readonly UserAccountsStore $userStore,
+        private readonly LoggerInterface $logger
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addArgument('tenant', InputArgument::REQUIRED, 'Tenant identifier')
+            ->addArgument('identity', InputArgument::REQUIRED, 'User identity (email/username)')
+            ->addArgument('password', InputArgument::OPTIONAL, 'Password (prompted for interactively when omitted)')
+            ->setHelp('This command sets or updates the password credential for a user account. Omit the password argument to be prompted securely.')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+        $tenant = $input->getArgument('tenant');
+        $identity = $input->getArgument('identity');
+        $password = $input->getArgument('password');
+
+        $io->title('Set User Password');
+
+        try {
+            if (!$this->tenantService->fetchById($tenant)) {
+                $io->error("Tenant '{$tenant}' not found.");
+                return Command::FAILURE;
+            }
+
+            if (!$this->userStore->fetchByIdentity($tenant, $identity)) {
+                $io->error("User '{$identity}' not found in tenant '{$tenant}'.");
+                return Command::FAILURE;
+            }
+
+            if ($password === null) {
+                $password = $io->askHidden('Password');
+            }
+
+            if (empty($password)) {
+                $io->error('Password cannot be empty.');
+                return Command::FAILURE;
+            }
+
+            if (!$this->provider->setCredential($tenant, $identity, $password)) {
+                $io->error("Failed to store password credential for '{$identity}'.");
+                return Command::FAILURE;
+            }
+
+            $this->logger->info('User password credential set via console', [
+                'tenant' => $tenant,
+                'identity' => $identity,
+                'command' => $this->getName(),
+            ]);
+
+            $io->success("Password credential for '{$identity}' stored successfully!");
+
+            return Command::SUCCESS;
+
+        } catch (\Throwable $e) {
+            $io->error('Failed to set password: ' . $e->getMessage());
+            $this->logger->error('User password set failed', [
+                'tenant' => $tenant,
+                'identity' => $identity,
+                'error' => $e->getMessage(),
+            ]);
+            return Command::FAILURE;
+        }
+    }
+}

lib/Controllers/PasswordController.php

@@ -3,8 +3,9 @@
 namespace KTXM\AuthenticationProviderPassword\Controllers;
 
 use KTXC\Http\Response\JsonResponse;
-use KTXC\SessionIdentity;
-use KTXC\SessionTenant;
+use KTXC\Service\UserAccountsService;
+use KTXC\Context\IdentityContextInterface;
+use KTXC\Context\TenantContextInterface;
 use KTXF\Controller\ControllerAbstract;
 use KTXF\Routing\Attributes\AuthenticatedRoute;
 use KTXF\Security\Crypto;
@@ -14,19 +15,20 @@ use KTXM\AuthenticationProviderPassword\Stores\CredentialStore;
 class PasswordController extends ControllerAbstract
 {
     public function __construct(
-        private readonly SessionIdentity $sessionIdentity,
-        private readonly SessionTenant $sessionTenant,
+        private readonly IdentityContextInterface $identityContext,
+        private readonly TenantContextInterface $tenantContext,
         private readonly CredentialStore $credentialStore,
         private readonly Provider $provider,
-        private readonly Crypto $crypto
+        private readonly Crypto $crypto,
+        private readonly UserAccountsService $userAccountsService
     ) {
     }
 
     #[AuthenticatedRoute('/password/update', name: 'password.update', methods: ['POST'])]
     public function update(string $current_password, string $new_password): JsonResponse
     {
-        $tenantId = $this->sessionTenant->identifier();
-        $identifier = $this->sessionIdentity->mailAddress();
+        $tenantId = $this->tenantContext->identifier();
+        $identifier = $this->identityContext->mailAddress();
 
         if ($tenantId === null || $identifier === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
@@ -51,18 +53,22 @@ class PasswordController extends ControllerAbstract
     /**
      * Admin endpoint: Get credential status for a user
      */
-    #[AuthenticatedRoute('/admin/status/{uid}', name: 'password.admin.status', methods: ['GET'])]
+    #[AuthenticatedRoute('/status', name: 'password.admin.status', methods: ['POST'], permissions: ['authentication_provider_password.admin.view', 'authentication_provider_password.admin.manage'])]
     public function getStatus(string $uid): JsonResponse
     {
-        $tenantId = $this->sessionTenant->identifier();
+        $tenantId = $this->tenantContext->identifier();
 
         if ($tenantId === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
         }
 
-        // TODO: Add permission check for admin operations
+        $user = $this->userAccountsService->fetchByIdentifier($uid);
+        if (!$user) {
+            return new JsonResponse(['error' => 'User not found'], 404);
+        }
 
-        $hasCredentials = $this->provider->hasCredentials($tenantId, $uid);
+        // Credentials are keyed by identity (email/username), not uid
+        $hasCredentials = $this->provider->hasCredentials($tenantId, $user['identity']);
 
         return new JsonResponse([
             'enrolled' => $hasCredentials,
@@ -73,22 +79,26 @@ class PasswordController extends ControllerAbstract
     /**
      * Admin endpoint: Set/reset user password
      */
-    #[AuthenticatedRoute('/admin/reset', name: 'password.admin.reset', methods: ['POST'])]
+    #[AuthenticatedRoute('/reset', name: 'password.admin.reset', methods: ['POST'], permissions: ['authentication_provider_password.admin.manage'])]
     public function adminReset(string $uid, string $password): JsonResponse
     {
-        $tenantId = $this->sessionTenant->identifier();
+        $tenantId = $this->tenantContext->identifier();
 
         if ($tenantId === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
         }
 
-        // TODO: Add permission check for admin operations
-
         if (strlen($password) < 8) {
             return new JsonResponse(['error' => 'Password must be at least 8 characters'], 400);
         }
 
-        $success = $this->provider->setCredential($tenantId, $uid, $password);
+        $user = $this->userAccountsService->fetchByIdentifier($uid);
+        if (!$user) {
+            return new JsonResponse(['error' => 'User not found'], 404);
+        }
+
+        // Credentials are keyed by identity (email/username), not uid
+        $success = $this->provider->setCredential($tenantId, $user['identity'], $password);
 
         if (!$success) {
             return new JsonResponse(['error' => 'Failed to set password'], 500);
@@ -100,18 +110,22 @@ class PasswordController extends ControllerAbstract
     /**
      * Admin endpoint: Remove user password
      */
-    #[AuthenticatedRoute('/admin/remove/{uid}', name: 'password.admin.remove', methods: ['DELETE'])]
+    #[AuthenticatedRoute('/remove', name: 'password.admin.remove', methods: ['POST'], permissions: ['authentication_provider_password.admin.manage'])]
     public function adminRemove(string $uid): JsonResponse
     {
-        $tenantId = $this->sessionTenant->identifier();
+        $tenantId = $this->tenantContext->identifier();
 
         if ($tenantId === null) {
             return new JsonResponse(['error' => 'Invalid session state'], 400);
         }
 
-        // TODO: Add permission check for admin operations
+        $user = $this->userAccountsService->fetchByIdentifier($uid);
+        if (!$user) {
+            return new JsonResponse(['error' => 'User not found'], 404);
+        }
 
-        $this->credentialStore->delete($tenantId, $uid);
+        // Credentials are keyed by identity (email/username), not uid
+        $this->credentialStore->delete($tenantId, $user['identity']);
 
         return new JsonResponse(['success' => true]);
     }

lib/Module.php

@@ -5,13 +5,16 @@ declare(strict_types=1);
 namespace KTXM\AuthenticationProviderPassword;
 
 use KTXC\Resource\ProviderManager;
+use KTXF\Module\ModuleBrowserInterface;
+use KTXF\Module\ModuleConsoleInterface;
 use KTXF\Module\ModuleInstanceAbstract;
+use KTXM\AuthenticationProviderPassword\Console\UserPasswordCommand;
 
 /**
  * Default Identity Provider Module
  * Provides local database authentication
  */
-class Module extends ModuleInstanceAbstract
+class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, ModuleBrowserInterface
 {
     public function __construct(
         private readonly ProviderManager $providerManager,
@@ -50,6 +53,16 @@ class Module extends ModuleInstanceAbstract
                 'description' => 'View and access the password authentication provider module',
                 'group' => 'Authentication Providers'
             ],
+            'authentication_provider_password.admin.view' => [
+                'label' => 'View Password Status',
+                'description' => 'View whether another user has a password credential configured',
+                'group' => 'Authentication Providers'
+            ],
+            'authentication_provider_password.admin.manage' => [
+                'label' => 'Manage User Passwords',
+                'description' => 'Set, reset, or remove password credentials for other users',
+                'group' => 'Authentication Providers'
+            ],
         ];
     }
     
@@ -58,6 +71,13 @@ class Module extends ModuleInstanceAbstract
         $this->providerManager->register('authentication', 'password', Provider::class);
     }
     
+    public function registerCI(): array
+    {
+        return [
+            UserPasswordCommand::class,
+        ];
+    }
+
     public function registerBI(): array
     {
         return [

package.json

@@ -11,15 +11,23 @@
     "dev": "vite build --mode development --config vite.config.ts",
     "watch": "vite build --mode development --watch --config vite.config.ts",
     "typecheck": "vue-tsc --noEmit",
-    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore"
+    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore",
+    "test": "vitest run --config tests/js/vitest.config.ts",
+    "test:unit": "vitest run --config tests/js/vitest.config.ts",
+    "test:watch": "vitest watch --config tests/js/vitest.config.ts",
+    "test:coverage": "vitest run --coverage --config tests/js/vitest.config.ts"
   },
   "dependencies": {
     "vue": "^3.5.13"
   },
   "devDependencies": {
-    "@vitejs/plugin-vue": "^5.2.1",
+    "@vitejs/plugin-vue": "^6.0.0",
     "typescript": "~6.0.0",
     "vite": "^8.0.0",
-    "vue-tsc": "^3.0.0"
+    "vue-tsc": "^3.0.0",
+    "@vitest/coverage-v8": "^4.1.6",
+    "@vue/test-utils": "^2.4.10",
+    "jsdom": "^29.1.1",
+    "vitest": "^4.1.6"
   }
 }

src/components/AdminSecurityPanel.vue

@@ -30,8 +30,15 @@ const confirmPassword = ref('');
 const loadStatus = async () => {
   statusLoading.value = true;
   try {
-    const response = await fetch(`/m/authentication_provider_password/admin/status/${props.user.uid}`, {
+    const response = await fetch('/m/authentication_provider_password/status', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
       credentials: 'include',
+      body: JSON.stringify({
+        uid: props.user.uid,
+      }),
     });
     
     if (response.ok) {
@@ -60,7 +67,7 @@ const resetPassword = async () => {
   error.value = null;
 
   try {
-    const response = await fetch('/m/authentication_provider_password/admin/reset', {
+    const response = await fetch('/m/authentication_provider_password/reset', {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
@@ -95,9 +102,15 @@ const removePassword = async () => {
   error.value = null;
 
   try {
-    const response = await fetch(`/m/authentication_provider_password/admin/remove/${props.user.uid}`, {
-      method: 'DELETE',
+    const response = await fetch('/m/authentication_provider_password/remove', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
       credentials: 'include',
+      body: JSON.stringify({
+        uid: props.user.uid,
+      }),
     });
 
     if (response.ok) {
@@ -202,19 +215,23 @@ onMounted(() => {
           <VForm @submit.prevent="resetPassword">
             <VTextField
               v-model="newPassword"
+              name="new-password"
               label="New Password"
               type="password"
               variant="outlined"
               class="mb-4"
               required
               hint="Minimum 8 characters"
+              autocomplete="suppress"
             />
             <VTextField
               v-model="confirmPassword"
+              name="confirm-password"
               label="Confirm Password"
               type="password"
               variant="outlined"
               required
+              autocomplete="suppress"
               :error="confirmPassword.length > 0 && confirmPassword !== newPassword"
               :error-messages="confirmPassword.length > 0 && confirmPassword !== newPassword ? ['Passwords do not match'] : []"
             />

src/components/CredentialSetupPanel.vue

@@ -34,7 +34,7 @@ const setPassword = async () => {
   error.value = null;
 
   try {
-    const response = await fetch('/m/authentication_provider_password/admin/reset', {
+    const response = await fetch('/m/authentication_provider_password/reset', {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
@@ -110,6 +110,7 @@ const setPassword = async () => {
         <VForm @submit.prevent="setPassword">
           <VTextField
             v-model="password"
+            name="new-password"
             label="Password"
             type="password"
             variant="outlined"
@@ -117,13 +118,16 @@ const setPassword = async () => {
             required
             hint="Minimum 8 characters"
             persistent-hint
+            autocomplete="suppress"
           />
           <VTextField
             v-model="confirmPassword"
+            name="confirm-password"
             label="Confirm Password"
             type="password"
             variant="outlined"
             required
+            autocomplete="suppress"
             :error="confirmPassword.length > 0 && confirmPassword !== password"
             :error-messages="confirmPassword.length > 0 && confirmPassword !== password ? ['Passwords do not match'] : []"
           />

src/views/UserSettingsSecurityPanel.vue

@@ -144,12 +144,13 @@ const saveChanges = async () => {
           <VCol cols="12">
             <VTextField
               v-model="newPassword"
+              name="new-password"
               :type="isNewPasswordVisible ? 'text' : 'password'"
               :append-inner-icon="isNewPasswordVisible ? 'mdi-eye-off' : 'mdi-eye'"
               label="New Password"
               placeholder="············"
               variant="outlined"
-              autocomplete="new-password"
+              autocomplete="suppress"
               @click:append-inner="isNewPasswordVisible = !isNewPasswordVisible"
             />
           </VCol>
@@ -157,12 +158,13 @@ const saveChanges = async () => {
           <VCol cols="12">
             <VTextField
               v-model="confirmPassword"
+              name="confirm-password"
               :type="isConfirmPasswordVisible ? 'text' : 'password'"
               :append-inner-icon="isConfirmPasswordVisible ? 'mdi-eye-off' : 'mdi-eye'"
               label="Confirm New Password"
               placeholder="············"
               variant="outlined"
-              autocomplete="new-password"
+              autocomplete="suppress"
               :error="confirmPassword.length > 0 && confirmPassword !== newPassword"
               :error-messages="confirmPassword.length > 0 && confirmPassword !== newPassword ? ['Passwords do not match'] : []"
               @click:append-inner="isConfirmPasswordVisible = !isConfirmPasswordVisible"

tests/js/unit/base.test.ts

@@ -0,0 +1,30 @@
+import { describe, it, expect } from 'vitest'
+
+describe('Basic Tests', () => {
+  it('should perform basic assertion', () => {
+    expect(true).toBe(true)
+  })
+
+  it('should test array operations', () => {
+    const array = ['foo', 'bar', 'baz']
+
+    expect(array).toHaveLength(3)
+    expect(array).toContain('bar')
+    expect(array[0]).toBe('foo')
+  })
+
+  it('should test string operations', () => {
+    const string = 'Hello, World!'
+
+    expect(string).toContain('World')
+    expect(string.length).toBe(13)
+  })
+
+  it('should test object operations', () => {
+    const obj = { foo: 'bar', count: 42 }
+
+    expect(obj).toHaveProperty('foo')
+    expect(obj.foo).toBe('bar')
+    expect(obj.count).toBeGreaterThan(40)
+  })
+})

tests/js/vitest.config.ts

@@ -0,0 +1,33 @@
+import { fileURLToPath } from 'node:url'
+import { defineConfig, configDefaults } from 'vitest/config'
+import vue from '@vitejs/plugin-vue'
+import path from 'path'
+
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = path.dirname(__filename)
+
+export default defineConfig({
+  plugins: [vue()],
+  resolve: {
+    alias: {
+      '@': path.resolve(__dirname, '../../src'),
+      '@KTXC': path.resolve(__dirname, '../../../../core/src'),
+    },
+  },
+  test: {
+    environment: 'jsdom',
+    exclude: [...configDefaults.exclude, 'e2e/**'],
+    root: fileURLToPath(new URL('../../', import.meta.url)),
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'html'],
+      exclude: [
+        'node_modules/',
+        'tests/',
+        '**/*.d.ts',
+        '**/*.config.*',
+        '**/dist/**',
+      ],
+    },
+  },
+})

tests/php/Integration/IntegrationTestCase.php

@@ -0,0 +1,244 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\AuthenticationProviderPassword\Tests\Integration;
+
+use KTXC\Http\Request\Request;
+use KTXC\Http\Response\Response;
+use KTXC\Application;
+use KTXC\Stores\UserRolesStore;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Base class for the password provider's integration tests.
+ *
+ * Boots the real application (Kernel, DI container, live database) and
+ * drives it exactly like a deployed server would be driven: tenants and
+ * users are provisioned through `bin/console`, and requests are dispatched
+ * through the real HTTP kernel (routing, tenant resolution, auth middleware,
+ * controller), not by calling controllers directly.
+ *
+ * A fresh Application (and DI container) is built for every request() call,
+ * mirroring the one-process-per-request model this app is actually
+ * deployed under. Session identity is a container-lifetime singleton that
+ * AuthenticationMiddleware only ever sets, never clears, so reusing one
+ * Application across requests would leak an authenticated identity from one
+ * "request" into the next — a problem that can't occur in production,
+ * where each request gets its own process, but very much can here.
+ *
+ * Each test class gets its own tenant, created in setUpBeforeClass() and
+ * torn down in tearDownAfterClass(), so test classes never share state.
+ */
+abstract class IntegrationTestCase extends TestCase
+{
+    protected static string $tenantIdentifier;
+    protected static string $tenantDomain;
+
+    public static function setUpBeforeClass(): void
+    {
+        if (static::buildApplication()->environment() === 'prod') {
+            self::fail('Refusing to run integration tests against a server configured for the "prod" environment.');
+        }
+
+        static::$tenantDomain = 'ci-' . bin2hex(random_bytes(4)) . '.test';
+        static::$tenantIdentifier = 'ci_' . bin2hex(random_bytes(4));
+
+        static::runConsole([
+            'tenant:create', static::$tenantDomain,
+            '--identifier', static::$tenantIdentifier,
+        ]);
+        static::runConsole(['tenant:auth:enable', static::$tenantIdentifier, 'password']);
+    }
+
+    public static function tearDownAfterClass(): void
+    {
+        if (isset(static::$tenantIdentifier)) {
+            static::runConsole(['tenant:delete', static::$tenantIdentifier, '--force']);
+        }
+    }
+
+    protected static function buildApplication(): Application
+    {
+        return Application::create(SERVER_ROOT);
+    }
+
+    // =========================================================================
+    // Provisioning helpers (run through bin/console, same as CI/ops would)
+    // =========================================================================
+
+    /**
+     * Provision a user (optionally with a password credential and roles) and
+     * return its uid, so tests can exercise admin endpoints that operate by uid.
+     *
+     * @param string[] $roles Role IDs to assign (see createRoleWithPermissions())
+     */
+    protected static function createUser(string $identity, ?string $password = null, array $roles = []): string
+    {
+        $uid = bin2hex(random_bytes(8));
+
+        $args = ['user:create', static::$tenantIdentifier, $identity, '--uid', $uid];
+        foreach ($roles as $role) {
+            $args[] = '--role';
+            $args[] = $role;
+        }
+        static::runConsole($args);
+
+        if ($password !== null) {
+            static::runConsole(['user:password', static::$tenantIdentifier, $identity, $password]);
+        }
+
+        return $uid;
+    }
+
+    /**
+     * Create a role granting the given permissions and return its role id.
+     *
+     * There's no `bin/console` command for role management, so this goes
+     * straight through the DI container to UserRolesStore — the same store
+     * the real UserRolesController uses — rather than calling controllers
+     * directly.
+     *
+     * @param string[] $permissions
+     */
+    protected static function createRoleWithPermissions(array $permissions, string $label = 'Test Role'): string
+    {
+        $application = static::buildApplication();
+        try {
+            $application->kernel()->boot();
+            $store = $application->container()->get(UserRolesStore::class);
+            $role = $store->createRole(static::$tenantIdentifier, [
+                'label' => $label,
+                'permissions' => $permissions,
+            ]);
+        } finally {
+            $application->shutdown();
+        }
+
+        return $role['rid'];
+    }
+
+    /**
+     * Run a bin/console command as a real subprocess and fail the test on
+     * a non-zero exit code.
+     *
+     * @param string[] $args Command name followed by its arguments/options
+     */
+    protected static function runConsole(array $args): string
+    {
+        $command = escapeshellcmd(PHP_BINARY) . ' ' . escapeshellarg(SERVER_ROOT . '/bin/console');
+        foreach ($args as $arg) {
+            $command .= ' ' . escapeshellarg((string) $arg);
+        }
+        $command .= ' --no-interaction 2>&1';
+
+        exec($command, $outputLines, $exitCode);
+        $output = implode("\n", $outputLines);
+
+        if ($exitCode !== 0) {
+            static::fail("Console command failed (exit {$exitCode}): {$command}\n{$output}");
+        }
+
+        return $output;
+    }
+
+    // =========================================================================
+    // HTTP helpers (dispatched in-process through the real kernel)
+    // =========================================================================
+
+    /**
+     * Dispatch a request through the real application and return the
+     * decoded JSON body alongside the status code.
+     *
+     * @return array{status: int, body: mixed, response: Response}
+     */
+    protected static function request(string $method, string $path, array $data = [], array $headers = []): array
+    {
+        $server = [
+            'HTTP_HOST' => static::$tenantDomain,
+            'SERVER_NAME' => static::$tenantDomain,
+            'REMOTE_ADDR' => '127.0.0.1',
+        ];
+
+        foreach ($headers as $name => $value) {
+            $server['HTTP_' . strtoupper(str_replace('-', '_', $name))] = $value;
+        }
+
+        $content = null;
+        if (!empty($data) && $method !== 'GET') {
+            $content = json_encode($data, JSON_THROW_ON_ERROR);
+            $server['CONTENT_TYPE'] = 'application/json';
+        }
+
+        $uri = 'http://' . static::$tenantDomain . $path;
+        $request = Request::create($uri, $method, [], [], [], $server, $content);
+
+        // A fresh application mirrors production while shutdown restores its
+        // process-level error handler after the in-process request.
+        $application = static::buildApplication();
+        try {
+            $response = $application->handleHttp($request);
+        } finally {
+            $application->shutdown();
+        }
+
+        $body = $response->getContent();
+        $decoded = null;
+        if (is_string($body) && $body !== '') {
+            $decoded = json_decode($body, true);
+        }
+
+        return ['status' => $response->getStatusCode(), 'body' => $decoded, 'response' => $response];
+    }
+
+    protected static function authorizedRequest(string $token, string $method, string $path, array $data = []): array
+    {
+        return static::request($method, $path, $data, ['Authorization' => 'Bearer ' . $token]);
+    }
+
+    /**
+     * Read a cookie's value off a Response. Authentication issues its
+     * access/refresh JWTs exclusively as Set-Cookie headers (accessToken,
+     * refreshToken) — AuthenticationResponse::toArray() never puts them in
+     * the JSON body — so tests read the token straight off the Response
+     * object we already have in-process, the equivalent of a browser
+     * reading Set-Cookie.
+     */
+    protected static function cookieValue(Response $response, string $name): ?string
+    {
+        foreach ($response->headers->getCookies() as $cookie) {
+            if ($cookie->getName() === $name) {
+                return $cookie->getValue();
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Drive the real /auth/start -> /auth/identify -> /auth/verify flow for
+     * the password method.
+     *
+     * @return array{status: int, body: mixed, response: Response, accessToken: ?string, refreshToken: ?string}
+     *         The /auth/verify response, with tokens (if any) pulled from Set-Cookie.
+     */
+    protected static function loginWithPassword(string $identity, string $password): array
+    {
+        $start = static::request('GET', '/auth/start');
+        $session = $start['body']['session'] ?? null;
+        static::assertNotNull($session, 'auth/start did not return a session id: ' . json_encode($start));
+
+        static::request('POST', '/auth/identify', ['session' => $session, 'identity' => $identity]);
+
+        $verify = static::request('POST', '/auth/verify', [
+            'session' => $session,
+            'method' => 'password',
+            'response' => $password,
+        ]);
+
+        $verify['accessToken'] = static::cookieValue($verify['response'], 'accessToken');
+        $verify['refreshToken'] = static::cookieValue($verify['response'], 'refreshToken');
+
+        return $verify;
+    }
+}

tests/php/Integration/PasswordAuthenticationTest.php

@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\AuthenticationProviderPassword\Tests\Integration;
+
+/**
+ * Exercises the real /auth/start -> /auth/identify -> /auth/verify flow for
+ * the password provider, through the HTTP kernel end to end.
+ */
+class PasswordAuthenticationTest extends IntegrationTestCase
+{
+    public function testAuthStartOffersPasswordMethod(): void
+    {
+        $start = static::request('GET', '/auth/start');
+
+        $this->assertSame(200, $start['status']);
+        $methodIds = array_column($start['body']['methods'] ?? [], 'id');
+        $this->assertContains('password', $methodIds);
+    }
+
+    public function testSuccessfulLoginReturnsTokens(): void
+    {
+        static::createUser('alice@example.test', 'Correct-Horse-1!');
+
+        $result = static::loginWithPassword('alice@example.test', 'Correct-Horse-1!');
+
+        $this->assertSame('success', $result['body']['status'] ?? null, json_encode($result['body']));
+        $this->assertNotNull($result['accessToken']);
+        $this->assertNotNull($result['refreshToken']);
+        $this->assertSame('alice@example.test', $result['body']['user']['identity'] ?? null);
+    }
+
+    public function testAccessTokenAuthorizesSubsequentRequests(): void
+    {
+        static::createUser('bob@example.test', 'Correct-Horse-2!');
+        $login = static::loginWithPassword('bob@example.test', 'Correct-Horse-2!');
+
+        $ping = static::authorizedRequest($login['accessToken'], 'GET', '/auth/ping');
+
+        $this->assertSame(200, $ping['status']);
+        $this->assertSame('ok', $ping['body']['status'] ?? null);
+    }
+
+    public function testWrongPasswordIsRejected(): void
+    {
+        static::createUser('carol@example.test', 'Correct-Horse-3!');
+
+        $result = static::loginWithPassword('carol@example.test', 'wrong-password');
+
+        $this->assertSame('failed', $result['body']['status'] ?? null);
+        $this->assertSame(401, $result['status']);
+        $this->assertNull($result['accessToken']);
+    }
+
+    public function testLoginFailsForUserWithoutAPasswordSet(): void
+    {
+        static::createUser('dave@example.test');
+
+        $result = static::loginWithPassword('dave@example.test', 'anything');
+
+        $this->assertSame('failed', $result['body']['status'] ?? null);
+        $this->assertSame(401, $result['status']);
+    }
+
+    public function testLoginFailsForUnknownIdentity(): void
+    {
+        $result = static::loginWithPassword('nobody@example.test', 'anything');
+
+        $this->assertSame('failed', $result['body']['status'] ?? null);
+        $this->assertSame(401, $result['status']);
+    }
+
+    public function testUnauthenticatedRequestToProtectedRouteIsRejected(): void
+    {
+        $ping = static::request('GET', '/auth/ping');
+
+        $this->assertSame(401, $ping['status']);
+    }
+}

tests/php/Integration/PasswordControllerTest.php

@@ -0,0 +1,153 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\AuthenticationProviderPassword\Tests\Integration;
+
+/**
+ * Exercises PasswordController's own routes, dispatched through the real
+ * HTTP kernel. Module routes are served under the "/m/{module_handle}"
+ * prefix applied by the router for every controller a module registers.
+ */
+class PasswordControllerTest extends IntegrationTestCase
+{
+    private const BASE = '/m/authentication_provider_password';
+
+    public function testUpdateOwnPassword(): void
+    {
+        static::createUser('erin@example.test', 'Original-Pass-1!');
+        $accessToken = static::loginWithPassword('erin@example.test', 'Original-Pass-1!')['accessToken'];
+
+        $update = static::authorizedRequest($accessToken, 'POST', self::BASE . '/password/update', [
+            'current_password' => 'Original-Pass-1!',
+            'new_password' => 'Updated-Pass-1!',
+        ]);
+
+        $this->assertSame(200, $update['status'], json_encode($update['body']));
+        $this->assertTrue($update['body']['success'] ?? false);
+
+        // Old password no longer works, new one does
+        $oldLogin = static::loginWithPassword('erin@example.test', 'Original-Pass-1!');
+        $this->assertSame('failed', $oldLogin['body']['status'] ?? null);
+
+        $newLogin = static::loginWithPassword('erin@example.test', 'Updated-Pass-1!');
+        $this->assertSame('success', $newLogin['body']['status'] ?? null);
+    }
+
+    public function testUpdatePasswordRejectsWrongCurrentPassword(): void
+    {
+        static::createUser('frank@example.test', 'Original-Pass-2!');
+        $accessToken = static::loginWithPassword('frank@example.test', 'Original-Pass-2!')['accessToken'];
+
+        $update = static::authorizedRequest($accessToken, 'POST', self::BASE . '/password/update', [
+            'current_password' => 'not-the-current-password',
+            'new_password' => 'Updated-Pass-2!',
+        ]);
+
+        $this->assertSame(400, $update['status']);
+
+        // Original password still works
+        $login = static::loginWithPassword('frank@example.test', 'Original-Pass-2!');
+        $this->assertSame('success', $login['body']['status'] ?? null);
+    }
+
+    public function testUpdatePasswordRequiresAuthentication(): void
+    {
+        $update = static::request('POST', self::BASE . '/password/update', [
+            'current_password' => 'irrelevant',
+            'new_password' => 'irrelevant',
+        ]);
+
+        $this->assertSame(401, $update['status']);
+    }
+
+    public function testAdminStatusReflectsEnrollment(): void
+    {
+        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.view']);
+        $enrolledUid = static::createUser('grace@example.test', 'Grace-Pass-1!', [$roleId]);
+        $unenrolledUid = static::createUser('heidi@example.test');
+        $accessToken = static::loginWithPassword('grace@example.test', 'Grace-Pass-1!')['accessToken'];
+
+        $enrolledStatus = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $enrolledUid]);
+        $unenrolledStatus = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $unenrolledUid]);
+
+        $this->assertTrue($enrolledStatus['body']['enrolled'] ?? null);
+        $this->assertFalse($unenrolledStatus['body']['enrolled'] ?? null);
+    }
+
+    public function testAdminResetSetsAPasswordThatCanLogIn(): void
+    {
+        $uid = static::createUser('ivan@example.test');
+        // Bootstrap an authenticated actor with permission to call the admin endpoint
+        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
+        static::createUser('actor1@example.test', 'Actor-Pass-1!', [$roleId]);
+        $accessToken = static::loginWithPassword('actor1@example.test', 'Actor-Pass-1!')['accessToken'];
+
+        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
+            'uid' => $uid,
+            'password' => 'Reset-By-Admin-1!',
+        ]);
+
+        $this->assertSame(200, $reset['status'], json_encode($reset['body']));
+        $this->assertTrue($reset['body']['success'] ?? false);
+
+        $login = static::loginWithPassword('ivan@example.test', 'Reset-By-Admin-1!');
+        $this->assertSame('success', $login['body']['status'] ?? null);
+    }
+
+    public function testAdminResetRejectsShortPasswords(): void
+    {
+        $uid = static::createUser('judy@example.test');
+        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
+        static::createUser('actor2@example.test', 'Actor-Pass-2!', [$roleId]);
+        $accessToken = static::loginWithPassword('actor2@example.test', 'Actor-Pass-2!')['accessToken'];
+
+        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
+            'uid' => $uid,
+            'password' => 'short',
+        ]);
+
+        $this->assertSame(400, $reset['status']);
+    }
+
+    public function testAdminRemoveRevokesLogin(): void
+    {
+        $uid = static::createUser('kevin@example.test', 'Kevin-Pass-1!');
+        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
+        static::createUser('actor3@example.test', 'Actor-Pass-3!', [$roleId]);
+        $accessToken = static::loginWithPassword('actor3@example.test', 'Actor-Pass-3!')['accessToken'];
+
+        $remove = static::authorizedRequest($accessToken, 'POST', self::BASE . '/remove', ['uid' => $uid]);
+        $this->assertSame(200, $remove['status']);
+        $this->assertTrue($remove['body']['success'] ?? false);
+
+        $status = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $uid]);
+        $this->assertFalse($status['body']['enrolled'] ?? null);
+
+        $login = static::loginWithPassword('kevin@example.test', 'Kevin-Pass-1!');
+        $this->assertSame('failed', $login['body']['status'] ?? null);
+    }
+
+    public function testAdminEndpointsRejectActorsWithoutPermission(): void
+    {
+        $targetUid = static::createUser('mallory-target@example.test', 'Mallory-Target-1!');
+        static::createUser('mallory@example.test', 'Mallory-Pass-1!');
+        $accessToken = static::loginWithPassword('mallory@example.test', 'Mallory-Pass-1!')['accessToken'];
+
+        $status = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $targetUid]);
+        $this->assertSame(403, $status['status']);
+
+        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
+            'uid' => $targetUid,
+            'password' => 'Should-Not-Apply-1!',
+        ]);
+        $this->assertSame(403, $reset['status']);
+
+        $remove = static::authorizedRequest($accessToken, 'POST', self::BASE . '/remove', ['uid' => $targetUid]);
+        $this->assertSame(403, $remove['status']);
+
+        // None of the rejected calls should have taken effect
+        $login = static::loginWithPassword('mallory-target@example.test', 'Mallory-Target-1!');
+        $this->assertSame('success', $login['body']['status'] ?? null);
+    }
+}

tests/php/Unit/BaseTest.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace KTXT\AuthenticationProviderPassword\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+class BaseTest extends TestCase
+{
+    public function testBasicAssertion(): void
+    {
+        $this->assertTrue(true);
+    }
+
+    public function testArrayOperations(): void
+    {
+        $array = ['foo' => 'bar'];
+
+        $this->assertArrayHasKey('foo', $array);
+        $this->assertEquals('bar', $array['foo']);
+    }
+
+    public function testStringOperations(): void
+    {
+        $string = 'Hello, World!';
+
+        $this->assertStringContainsString('World', $string);
+        $this->assertEquals(13, strlen($string));
+    }
+}

tests/php/bootstrap.php

@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+// This module is always deployed at <server-root>/modules/<handle>, so the
+// server's own vendor/autoload.php (core + shared + framework deps) is a
+// fixed number of levels above this file. Every other test file resolves
+// the server root through this constant rather than repeating the math.
+define('SERVER_ROOT', dirname(__DIR__, 4));
+
+require SERVER_ROOT . '/vendor/autoload.php';
+require __DIR__ . '/Integration/IntegrationTestCase.php';
+
+if (isset($_SERVER['APP_DEBUG']) && $_SERVER['APP_DEBUG']) {
+    umask(0000);
+}

tests/php/phpunit.xml

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- https://phpunit.readthedocs.io/en/latest/configuration.html -->
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:noNamespaceSchemaLocation="../../vendor/phpunit/phpunit/phpunit.xsd"
+         colors="true"
+         failOnDeprecation="true"
+         failOnNotice="true"
+         failOnWarning="true"
+         bootstrap="bootstrap.php"
+         cacheDirectory="../../.phpunit.cache"
+>
+    <php>
+        <ini name="display_errors" value="1" />
+        <ini name="error_reporting" value="-1" />
+        <server name="SHELL_VERBOSITY" value="-1" />
+    </php>
+
+    <testsuites>
+        <testsuite name="Unit Tests">
+            <directory>Unit</directory>
+        </testsuite>
+        <testsuite name="Integration Tests">
+            <directory>Integration</directory>
+        </testsuite>
+    </testsuites>
+
+    <extensions>
+    </extensions>
+</phpunit>

tsconfig.app.json

@@ -6,7 +6,6 @@
     "composite": true,
     "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
 
-    "baseUrl": ".",
     "paths": {
       "@/*": ["./src/*"],
       "@KTXC/*": ["../../core/src/*"]