User already exists message is red. Modals to the viewport center. Fixed Quit option: it deletes the session.

tests/login-first-time-password-change.spec.ts

@@ -0,0 +1,48 @@
+// spec: specs/gymflow-test-plan.md
+// seed: tests/core-auth.spec.ts
+
+import { test, expect } from '@playwright/test';
+
+test.describe('I. Core & Authentication', () => {
+  test('A. Login - First-Time Password Change', async ({ page }) => {
+    // 1. Navigate to the login page.
+    await page.goto('http://localhost:3000/');
+
+    // Log in as admin to create a new user for testing first-time login
+    await page.getByRole('textbox', { name: 'user@gymflow.ai' }).fill('admin@gymflow.ai');
+    await page.locator('input[type="password"]').fill('admin1234');
+    await page.getByRole('button', { name: 'Login' }).click();
+
+    // Navigate to profile and create a new user
+    await page.getByRole('button', { name: 'Profile' }).click();
+    await page.getByRole('textbox', { name: 'Email' }).fill('test@gymflow.ai');
+    await page.getByRole('textbox', { name: 'Password', exact: true }).fill('test1234');
+    await page.getByRole('button', { name: 'Create' }).click();
+
+    // Log out as admin
+    await page.getByRole('button', { name: 'Logout' }).click();
+
+    // 2. Log in with a first-time user's temporary credentials.
+    await page.getByRole('textbox', { name: 'user@gymflow.ai' }).fill('test@gymflow.ai');
+    await page.locator('input[type="password"]').fill('test1234');
+    await page.getByRole('button', { name: 'Login' }).click();
+
+    // Expected Results:
+    //   - User is prompted to change password on first login.
+    await expect(page.getByRole('heading', { name: 'Change Password' })).toBeVisible();
+
+    // 3. Enter a new password (at least 4 characters).
+    await page.getByRole('textbox').fill('newtestpass');
+
+    // 4. Click 'Save' or 'Change Password' button.
+    await page.getByRole('button', { name: 'Save & Login' }).click();
+
+    // Expected Results:
+    //   - New password is set successfully.
+    //   - User is logged into the application.
+    await page.waitForLoadState('networkidle');
+    await expect(page.getByRole('button', { name: 'Tracker' })).toBeVisible();
+    //   - No error messages are displayed.
+    await expect(page.locator('text=Invalid credentials')).not.toBeVisible();
+  });
+});