test(users): cover non-owner lifecycle validation

CoreBunch · DavidBabinec · Jun 26, 2026 · Jun 23, 2026 · Jun 23, 2026 · Jun 23, 2026
commit 10eb2e8e7b4fe4c4e4b532d3c7edea9c2645e568
diff --git a/docs/e2e/feature-matrix.md b/docs/e2e/feature-matrix.md
@@ -52,7 +52,7 @@ PUBLISH-002 note: `page-management.e2e.ts` schedules a newly-created active page
 | ACCOUNT-004 | P2 | partial | Security | Enable MFA, sign in with TOTP, regenerate recovery codes, and disable MFA | Logged in | Account security plus login | MFA gates login and recovery-code controls work without leaving account locked down | clock skew, invalid-code copy, recovery-code burn/reuse |
 | ACCOUNT-005 | P2 | partial | Security | Configure step-up prompt window | Logged in | Account security | Step-up window change requires confirmation, persists after reload, and can be restored | disabled-mode side effects, stale window status, mobile controls |
 | AUTH-006 | P2 | partial | Auth | Review recent failed, locked, rate-limited, and successful sign-in activity | Failed, locked, rate-limited, and successful account attempts | Account sign-in history | Activity table shows the attempts, a recent failed-count badge, and suspicious activity banner | stale audit rows, proxy/IP variance, table overflow |
-| USERS-001 | P2 | ✅ | Users | Create a non-owner user | Owner logged in | Users page | New user appears with intended role | role confusion, unsafe defaults |
+| USERS-001 | P2 | ✅ | Users | Manage a non-owner user lifecycle | Owner logged in | Users page | User can be created, edited, suspended, reactivated/reset, deleted, and login access follows status/deletion | role confusion, unsafe defaults, stale sessions |
 | USERS-002 | P2 | partial | Users | Create, edit, and delete a custom role | Owner logged in | Users Roles tab | Custom role appears with selected capabilities, updates after edit, and is removed after delete | built-in role protection, duplicate/zero-cap roles, role-in-use semantics |
 | USERS-003 | P2 | partial | Users | Review the admin audit log | User-management event exists | Users Audit tab | Audit feed renders readable event titles, actor attribution, details, and timestamps | stale labels, hidden audit data, table overflow |
 
@@ -62,7 +62,7 @@ ADMIN-003 note: workspace navigation and account-menu logout/login are covered b
 
 ADMIN-004 note: `admin-navigation.e2e.ts` opens Settings from the Dashboard non-editor route, verifies General, Shortcuts, Publishing, and Preferences sections, writes Auto-save, Auto-save delay, and UI density through real controls, verifies reload persistence, verifies corrupt localStorage fallback, and checks 390px containment. DEF-20260623-ADMIN004-01 fixed a phone-width overflow where Preferences controls extended beyond the viewport; `SettingsModal.module.css` now switches to a single-column mobile shell with stacked preference rows.
 
-USERS-001 note: non-owner user creation and step-up protection are automated in `users.e2e.ts`; broader user edit, suspend, and delete coverage is tracked in the canonical spreadsheet.
+USERS-001 note: non-owner user creation, step-up protection, edit, suspend, activate, password reset, delete, suspended-login denial, post-delete session invalidation, and deleted-login denial are automated in `users.e2e.ts`.
 
 AUTH-003 note: account-menu logout/login is covered in the core owner lifecycle, and `auth.e2e.ts` automates stale-tab session invalidation by cloning a live session into a second browser context, signing out in the first, then verifying the stale context is forced back to Admin Login on the next authenticated admin route without the stale Site route logging the module-inserter Unauthorized preference-load error. The same spec covers 390px mobile account-menu containment and sign-out reachability. `authSessionEdgeCases.test.ts` covers a repeated stale `POST /logout` returning `{ ok: true }`, clearing the cookie again, and leaving `/me` unauthorized.