naibaandcloudcode 7057aa3098 test(e2e): fix revoke empty-list crash and password-restore CSRF cascade ...

Two CI-only failures surfaced against a fresh backend DB:

- The revoke test read after.data.find(), but the list endpoint omits data
  entirely when the admin has zero tokens, throwing on undefined. Default to [].
- The password-change test's restore POST hit a 403: changing the password
  triggers a refresh-token that re-mints the nz-csrf cookie, so the X-CSRF-Token
  read just before the request can be stale. A failed restore left the admin on
  the rotated password and cascaded into cron/fm/visibility login failures.
  Add csrfRequest(), which retries once on 403 after re-reading the cookie, and
  use it for both profile mutations.

Verified 8/8 passing across repeated fresh-DB CI-mode runs.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-31 08:45:19 +00:00

..

e2e

test(e2e): fix revoke empty-list crash and password-restore CSRF cascade

2026-05-31 08:45:19 +00:00