feat(#454, #430): an is_admin E2E fixture, and the two AAA violations it found

[TortoiseWolfe]

Closes #454. Closes #430. Supersedes draft PR #503.

No E2E run had ever rendered an admin page. AdminGate.tsx:81 bounces an authenticated non-admin to /, so three separate things were measuring the wrong page or nothing at all:

• The AAA contrast sweep reports six /admin routes as swept while measuring the home page — the gap is admin PRIVILEGE, not auth #454 — the AAA contrast sweep enumerated all six /admin* routes and measured the home page under their names, because color-contrast.spec.ts never asserted it landed. Not an absent measurement; a wrong one that read as coverage.
• Reskin the admin console: 6 routes via organisms/Admin* #430 / wip(#430): wrap the two admin tables in a padded sh-well — rescued from a local-only branch #503 — the sh-well work sat 17/17 green and unmergeable: the suite never reached the pages it changed.
• landmarks.spec.ts — had to exclude those six outright, with a comment saying to delete the block once a fixture existed.

The fixture

seedIsolatedAdmin() promotes a throwaway user through user_profiles.is_admin — the single authority since #240, read live by the is_admin() SECURITY DEFINER RPC. One service-role UPDATE: no token refresh, no auth-hook registration, because no live RLS policy reads the JWT claim (every app_metadata mention in the migration is a comment or inside custom_access_token_hook).

It verifies itself through the user's own session and throws otherwise. A silently-unpromoted user still renders — it renders the redirect — so every assertion downstream would measure the home page and pass. That is #454's defect exactly, and without the check the fixture built to fix it would have reproduced it. The service-role client cannot answer the question; it bypasses RLS and would say "true" regardless.

Not the shared storage-state user, deliberately. is_admin() gates 25 policies across 9 tables — payments, messages, conversations, profiles, connections, subscriptions, audit logs, rate limits. Promoting the shared user is one line and would have given every existing spec cross-user reads, with row-count assertions still passing while measuring something else.

What unblinding found — two real AAA violations

Both on /admin/email, both invisible until now:

.stat-title           #484f58 on #ebe5dd   6.62:1   ×3   ("Remaining", "Status", "Window resets")
text-base-content/70  #5f656d on #f5f0eb   5.19:1   ×2   ("Priority 1", "Priority 2")

The first is the one worth reading. globals.css had already corrected .stat-title, raising alpha to 80% and documenting "~7.1:1 on light". Measured: 6.62. That 7.1 was computed against base-100; a .stats block sits on base-200 — precisely the trap #462 records, where /80 measures 7.08 on base-100 and 6.4–6.5 on base-200. A correction that was right for the surface it was checked on and wrong for the one it renders on, undetected because nothing could reach the page. Now solid, like #411, #425 and #495 before it.

Coverage moved

gate	before	after
landmark sweep	36 paths, 9 exclusions	42 paths, 3 exclusions
contrast sweep	36 paths × 2 themes	42 × 2 — 85 passing

Verification

Mutation-tested against the original defect. Revert the sh-well wrapper and admin-depth reports 0/1 scrollers welled and fails by name — not a vacuous pass, it measured one scroller and found zero welled.

The spec asserts the invariant (every scroller is wrapped) rather than the element, because /admin/messaging's well is behind top_senders.length > 0 — asserting it unconditionally would be a data-dependent element, which is how #495 looked like a flake. A minScrollers floor stops the invariant passing vacuously, and welled/total prints every run so "0/0" can never be mistaken for coverage.

All numbers above measured against a real root build (DISABLE_BASE_PATH=true, serve out), as CI runs these specs.

Three of my own errors, caught by running rather than reasoning

1. Deleting the landmarks exclusion alone would have re-created The AAA contrast sweep reports six /admin routes as swept while measuring the home page — the gap is admin PRIVILEGE, not auth #454's defect there — those six routes redirect to /, which has a <main> and a skip link, so they would have passed while measuring the home page.
2. The first admin navigation double-navigated, hitting the basePath trap (an absolute path replaces the basePath rather than appending) and 404'ing all six routes.
3. The first two .stat-title fixes lost the cascade to a later theme-scoped rule — which is how the existing block with the wrong arithmetic turned up.

Also

auth.setup.ts gains an orphan sweep: an is_admin throwaway can read every message and payment in the shared project, so a failed teardown must not be silent. It pages through listUsers — #197 truncates at 50, and a sweep that reads page one and reports "0 orphans" is the same shape as everything else this repo keeps finding.

Draft PR #503 can be closed — its commit is cherry-picked here and now has the verification it never had.

🤖 Generated with Claude Code