test: self-contained local test account + urlencoded login

Add a dedicated, gitignored testrunner account auto-created by the suite
(make test-account, also invoked from global-setup) so `make test` no longer
needs the real account in .env. The target uses --admin-type both so the
account has admin.login for the gpx-manager specs. test-post.sh switches its
login POST to --data-urlencode to survive special chars in credentials.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU

.env.example

@@ -26,11 +26,15 @@
 UID=1000
 GID=1000
 
-# Local Grav dev server + test login, used by `make test-post` / `make test`
+# Local Grav dev server. GRAV_BASE_URL is used by the Playwright suite and
-# (scripts/test-post.sh). Must be a valid Grav site login on the local instance.
+# scripts/test-post.sh.
 GRAV_BASE_URL=http://localhost:8081
-GRAV_TEST_USER=your-local-grav-user
+# Test login for `make test` — OPTIONAL. If unset, the suite auto-creates and
-GRAV_TEST_PASS=your-local-grav-password
+# uses a dedicated local-only account (testrunner / Testpass1234), gitignored so
+# it is never pushed to prod (see `make test-account`). Override only to test as
+# a different account; keep the password free of shell/Make/URL-special chars.
+# GRAV_TEST_USER=testrunner
+# GRAV_TEST_PASS=Testpass1234
 GRAV_USER_DIR=/absolute/path/to/travel-blog-intotheeast/user
 
 # travel-memories service (docker-compose `env_file: .env`). Fill in whatever
@@ -55,7 +59,7 @@ WEBROOT=/home/example.com/public_html
 SITE_CONFIG_DIR=/home/example.com/site-config
 
 # Grav version installed by scripts/server-install.sh (remote-install).
-GRAV_VERSION=2.0.0-rc.10
+GRAV_VERSION=2.0.4
 
 # Repos cloned/pulled on the server.
 USER_REPO=https://gitea.example.com/org/intotheeast-user.git

Makefile

@@ -36,13 +36,23 @@ $(foreach t,$(REMOTE_TARGETS),$(foreach e,$(ENVS),$(eval $(call make-env-target,
 
 # ── Tests ─────────────────────────────────────────────────────────────────────
 
+# Local test account — auto-created, never committed (see user/.gitignore).
+# Keep the password free of shell/Make/URL-special chars so every consumer agrees.
+GRAV_TEST_USER ?= testrunner
+GRAV_TEST_PASS ?= Testpass1234
+
+test-account:
+	@docker exec intotheeast_grav sh -c 'test -f /var/www/html/user/accounts/$(GRAV_TEST_USER).yaml \
+		|| php bin/plugin login new-user -u $(GRAV_TEST_USER) -p "$(GRAV_TEST_PASS)" \
+		   -e $(GRAV_TEST_USER)@example.test -N "Test Runner" -P b --admin-type both -s enabled -n'
+
 test-config:
 	@bash scripts/test-form-config.sh
 
-test-post:
+test-post: test-account
 	@bash scripts/test-post.sh
 
-test-ui:
+test-ui: test-account
 	@npx playwright test
 
 test: test-config test-post test-ui

scripts/test-post.sh

@@ -49,7 +49,10 @@ LOGIN_NONCE=$(echo "$LOGIN_HTML" | grep -o 'name="login-form-nonce" value="[^"]*
 LOGIN_STATUS=$(curl -sf -o /dev/null -w "%{http_code}" \
     -c "$COOKIE_JAR" -b "$COOKIE_JAR" \
     -L \
-    -d "username=${USER}&password=${PASS}&login-form-nonce=${LOGIN_NONCE}&task=login.login" \
+    --data-urlencode "username=${USER}" \
+    --data-urlencode "password=${PASS}" \
+    --data-urlencode "login-form-nonce=${LOGIN_NONCE}" \
+    --data-urlencode "task=login.login" \
     "$BASE_URL/login")
 
 # After login, fetch /post and verify we see the post form (not the login form)

tests/global-setup.js

@@ -13,6 +13,14 @@ module.exports = async function globalSetup() {
         });
     }
 
+    // Local test-account defaults (mirror the Makefile) so direct `npx playwright
+    // test` runs are self-contained without needing GRAV_TEST_* in .env.
+    if (!process.env.GRAV_TEST_USER) process.env.GRAV_TEST_USER = 'testrunner';
+    if (!process.env.GRAV_TEST_PASS) process.env.GRAV_TEST_PASS = 'Testpass1234';
+
+    // Ensure the local test account exists (idempotent; never committed).
+    execSync('make test-account', { cwd: path.join(__dirname, '..'), stdio: 'inherit' });
+
     // Ensure demo content is loaded (italy-2026-demo trip + stories + GPX files)
     execSync('make demo-load', { cwd: path.join(__dirname, '..'), stdio: 'inherit' });
 };