Fix Playwright race condition in admin-gate test

The admin check test registered waitForResponse after page.goto(), so the
403 from API.users() (fired at SPA init) could arrive before the listener
was active — causing a 10 s timeout. Fix: inject the session cookie and
register the response listener before navigation, then await the promise
after goto(). Also corrects the URL filter: the SPA calls /api/admin/users
(not /api/v1/admin/users) so the pattern now matches the actual request.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 10 insertions, 8 deletions

diff --git a/player-server/test/e2e-web/tests/smoke.test.ts b/player-server/test/e2e-web/tests/smoke.test.ts
index 50a4ef2..d998b86 100644
--- a/player-server/test/e2e-web/tests/smoke.test.ts
+++ b/player-server/test/e2e-web/tests/smoke.test.ts
@@ -358,17 +358,19 @@ test('admin gear button is visible and opens admin panel for admin user', async
 
 test('admin panel is not accessible to regular user', async ({ page }) => {
   const cookie = await login(REGULAR_USER, REGULAR_PASS);
-  await openAuthenticatedPage(page, cookie, '/');
-  await waitForAppReady(page);
 
-  // For a non-admin the admin toggle stays hidden because API.users() returns
-  // 403, so showAdmin() is never called. Wait for the 403 response to arrive
-  // before checking the DOM — this avoids a fixed sleep and surfaces failures
-  // cleanly if the request never fires.
-  await page.waitForResponse(
-    resp => resp.url().includes('/api/v1/admin/users') && resp.status() === 403,
+  // Register the response listener BEFORE navigating so it cannot miss the
+  // API.users() call that fires at SPA init. waitForResponse only catches
+  // future responses — setting it up after goto() creates a race condition
+  // where the 403 may already be received by the time the listener is active.
+  await injectSessionCookie(page.context(), cookie);
+  const adminCheck = page.waitForResponse(
+    resp => resp.url().includes('/api/admin/users') && resp.status() === 403,
     { timeout: 10_000 },
   );
+  await page.goto('/');
+  await adminCheck;
+
   const adminToggle = page.locator('#admin-toggle');
   const classes = (await adminToggle.getAttribute('class')) ?? '';
   expect(classes).toContain('hidden');