Merge branch 'dev' into search-auto-complete

client/tests/helpers/factories.ts

@@ -283,6 +283,12 @@ export function buildAppConfig(overrides: Partial<AppConfig> = {}): AppConfig {
     allow_registration: true,
     demo_mode: false,
     oidc_configured: false,
+    oidc_only_mode: false,
+    password_login: true,
+    password_registration: true,
+    oidc_login: true,
+    oidc_registration: true,
+    env_override_oidc_only: false,
     ...overrides,
   };
 }

client/tests/helpers/msw/handlers/admin.ts

@@ -92,6 +92,18 @@ export const adminHandlers = [
     return HttpResponse.json({ tokens: [] });
   }),
 
+  http.get('/api/admin/oauth-sessions', () => {
+    return HttpResponse.json({ sessions: [] });
+  }),
+
+  http.delete('/api/admin/oauth-sessions/:id', () => {
+    return HttpResponse.json({ success: true });
+  }),
+
+  http.delete('/api/admin/mcp-tokens/:id', () => {
+    return HttpResponse.json({ success: true });
+  }),
+
   http.get('/api/admin/permissions', () => {
     return HttpResponse.json({ permissions: {} });
   }),

client/tests/helpers/store.ts

@@ -5,6 +5,7 @@ import { useVacayStore } from '../../src/store/vacayStore';
 import { useAddonStore } from '../../src/store/addonStore';
 import { useInAppNotificationStore } from '../../src/store/inAppNotificationStore';
 import { usePermissionsStore } from '../../src/store/permissionsStore';
+// Journey store is reset individually in journey tests to avoid circular import issues
 
 // Capture initial states at import time (before any test modifies them)
 const initialAuthState = useAuthStore.getState();
@@ -14,7 +15,6 @@ const initialVacayState = useVacayStore.getState();
 const initialAddonState = useAddonStore.getState();
 const initialNotifState = useInAppNotificationStore.getState();
 const initialPermsState = usePermissionsStore.getState();
-
 export function resetAllStores(): void {
   useAuthStore.setState(initialAuthState, true);
   useTripStore.setState(initialTripState, true);

client/tests/integration/api/client.test.ts

@@ -21,6 +21,7 @@ const wsMock = await import('../../../src/api/websocket');
 
 // Import the API client AFTER the mock is set up so it picks up our getSocketId mock
 const {
+  apiClient,
   authApi,
   tripsApi,
   placesApi,
@@ -465,19 +466,17 @@ describe('API client interceptors', () => {
   });
 
   it('FE-API-022: authApi.uploadAvatar sends multipart/form-data', async () => {
-    let contentType = '';
-    server.use(
-      http.post('/api/auth/avatar', ({ request }) => {
-        contentType = request.headers.get('Content-Type') ?? '';
-        return HttpResponse.json({ avatar_url: '/uploads/avatar.jpg' });
-      })
-    );
+    // jsdom's FormData ≠ undici's FormData — MSW body serialisation of FormData
+    // hangs under CI resource constraints. Spy + mock at the axios level to verify
+    // the correct args are passed without going through the network stack.
+    const postSpy = vi.spyOn(apiClient, 'post').mockResolvedValueOnce({ data: { avatar_url: '/uploads/avatar.jpg' } } as any);
 
     const formData = new FormData();
     formData.append('avatar', new Blob(['img'], { type: 'image/jpeg' }), 'avatar.jpg');
 
     await authApi.uploadAvatar(formData);
-    expect(contentType).toMatch(/multipart\/form-data/);
+    expect(postSpy).toHaveBeenCalledWith('/auth/avatar', expect.any(FormData), expect.anything());
+    postSpy.mockRestore();
   });
 
   it('FE-API-023: authApi.mcpTokens.create posts name to /api/auth/mcp-tokens', async () => {
@@ -887,9 +886,11 @@ describe('API namespace smoke tests', () => {
   });
 
   it('backupApi.uploadRestore uploads and restores a backup', async () => {
-    server.use(http.post('/api/backup/upload-restore', () => HttpResponse.json({ ok: true })));
+    // FormData POST hangs on CI — mock at the axios level (see FE-API-022 comment).
+    const postSpy = vi.spyOn(apiClient, 'post').mockResolvedValueOnce({ data: { ok: true } } as any);
     const file = new File(['data'], 'backup.zip', { type: 'application/zip' });
     await expect(backupApi.uploadRestore(file)).resolves.toMatchObject({ ok: true });
+    postSpy.mockRestore();
   });
 
   it('backupApi.restore restores a named backup', async () => {

client/tests/unit/slices/filesSlice.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { http, HttpResponse } from 'msw';
 import { useTripStore } from '../../../src/store/tripStore';
+import { filesApi } from '../../../src/api/client';
 import { resetAllStores, seedStore } from '../../helpers/store';
 import { buildTripFile } from '../../helpers/factories';
 import { server } from '../../helpers/msw/server';
@@ -56,14 +57,14 @@ describe('filesSlice', () => {
       seedStore(useTripStore, { files: [existing] });
 
       const uploaded = buildTripFile({ trip_id: 1, filename: 'new-upload.pdf' });
-      server.use(
-        http.post('/api/trips/1/files', () => HttpResponse.json({ file: uploaded })),
-      );
+      // FormData POST hangs on CI — mock at the API boundary instead of MSW.
+      const uploadSpy = vi.spyOn(filesApi, 'upload').mockResolvedValueOnce({ file: uploaded });
 
       const formData = new FormData();
       formData.append('file', new Blob(['content'], { type: 'application/pdf' }), 'new-upload.pdf');
 
       const result = await useTripStore.getState().addFile(1, formData);
+      uploadSpy.mockRestore();
 
       expect(result.filename).toBe('new-upload.pdf');
       const files = useTripStore.getState().files;

client/tests/unit/stores/authStore.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { http, HttpResponse } from 'msw';
 import { server } from '../../helpers/msw/server';
 import { useAuthStore } from '../../../src/store/authStore';
+import { authApi } from '../../../src/api/client';
 import { resetAllStores } from '../../helpers/store';
 import { buildUser } from '../../helpers/factories';
 
@@ -425,11 +426,8 @@ describe('authStore', () => {
 
   describe('FE-STORE-AUTH-UPLOAD: uploadAvatar', () => {
     it('updates avatar_url from response', async () => {
-      server.use(
-        http.post('/api/auth/avatar', () =>
-          HttpResponse.json({ avatar_url: '/uploads/avatar-new.png' })
-        )
-      );
+      // FormData POST hangs on CI — mock at the API boundary instead of MSW.
+      const uploadSpy = vi.spyOn(authApi, 'uploadAvatar').mockResolvedValueOnce({ avatar_url: '/uploads/avatar-new.png' });
 
       useAuthStore.setState({ user: buildUser() });
 
@@ -438,6 +436,7 @@ describe('authStore', () => {
 
       expect(result.avatar_url).toBe('/uploads/avatar-new.png');
       expect(useAuthStore.getState().user?.avatar_url).toBe('/uploads/avatar-new.png');
+      uploadSpy.mockRestore();
     });
   });
 });