support admin login page

.env.example

@@ -19,16 +19,20 @@ CZ_OPENAI_API_KEY=your-openai-api-key
 MODEL_NAME=gpt-5
 
 # ------------------------------------------------------------------------------
-# Authentication (OPTIONAL)
+# Authentication (REQUIRED)
 # ------------------------------------------------------------------------------
 # Shared password for all users (used for Basic Auth)
-# Default: cz-2025
-BASIC_AUTH_PASSWORD=cz-2025
+# REQUIRED - no default value
+BASIC_AUTH_PASSWORD=
+
+# Admin password for admin panel access
+# Users who login with this password get admin-level access
+# REQUIRED for admin access - no default value
+ADMIN_PASSWORD=
 
 # Default password shown in the UI registration form
 # Should match BASIC_AUTH_PASSWORD for convenience
-# Default: cz-2025
-NEXT_PUBLIC_DEFAULT_PASSWORD=cz-2025
+NEXT_PUBLIC_DEFAULT_PASSWORD=
 
 # ------------------------------------------------------------------------------
 # Database Configuration

src/app/admin/conversations/[conversationId]/page.tsx

@@ -3,6 +3,7 @@
 import { useState, useEffect } from 'react';
 import Link from 'next/link';
 import { useParams } from 'next/navigation';
+import { getStoredCredentials, createBasicAuthHeader } from '@/lib/auth/session';
 
 interface Conversation {
   id: string;
@@ -47,7 +48,17 @@ export default function AdminConversationDetailPage() {
   const fetchConversationDetail = async () => {
     try {
       setLoading(true);
-      const response = await fetch(`/api/admin/conversations/${conversationId}`);
+
+      const credentials = getStoredCredentials();
+      if (!credentials) {
+        throw new Error('Not authenticated');
+      }
+
+      const headers = {
+        Authorization: createBasicAuthHeader(credentials.username, credentials.password),
+      };
+
+      const response = await fetch(`/api/admin/conversations/${conversationId}`, { headers });
 
       if (!response.ok) {
         if (response.status === 404) {

src/app/admin/conversations/page.tsx

@@ -2,6 +2,7 @@
 
 import { useState, useEffect } from 'react';
 import Link from 'next/link';
+import { getStoredCredentials, createBasicAuthHeader } from '@/lib/auth/session';
 
 interface Conversation {
   id: string;
@@ -43,6 +44,16 @@ export default function AdminConversationsPage() {
   const fetchConversations = async () => {
     try {
       setLoading(true);
+
+      const credentials = getStoredCredentials();
+      if (!credentials) {
+        throw new Error('Not authenticated');
+      }
+
+      const headers = {
+        Authorization: createBasicAuthHeader(credentials.username, credentials.password),
+      };
+
       const params = new URLSearchParams({
         page: page.toString(),
         limit: '50',
@@ -53,7 +64,7 @@ export default function AdminConversationsPage() {
         ...(coachPromptFilter && { coachPromptId: coachPromptFilter }),
       });
 
-      const response = await fetch(`/api/admin/conversations?${params}`);
+      const response = await fetch(`/api/admin/conversations?${params}`, { headers });
       if (!response.ok) {
         throw new Error('Failed to fetch conversations');
       }

src/app/admin/layout.tsx

@@ -1,12 +1,54 @@
 'use client';
 
-import { useState } from 'react';
+import { useState, useEffect } from 'react';
 import Link from 'next/link';
-import { usePathname } from 'next/navigation';
+import { usePathname, useRouter } from 'next/navigation';
+import { getStoredCredentials, createBasicAuthHeader } from '@/lib/auth/session';
 
 export default function AdminLayout({ children }: { children: React.ReactNode }) {
   const [mobileMenuOpen, setMobileMenuOpen] = useState(false);
+  const [isLoading, setIsLoading] = useState(true);
+  const [isAuthorized, setIsAuthorized] = useState(false);
   const pathname = usePathname();
+  const router = useRouter();
+
+  useEffect(() => {
+    async function checkAdminAccess() {
+      const credentials = getStoredCredentials();
+      if (!credentials) {
+        router.replace('/');
+        return;
+      }
+
+      try {
+        const response = await fetch('/api/auth/me', {
+          headers: {
+            Authorization: createBasicAuthHeader(credentials.username, credentials.password),
+          },
+        });
+
+        if (!response.ok) {
+          router.replace('/dashboard');
+          return;
+        }
+
+        const data = await response.json();
+        if (data.sessionRole !== 'admin') {
+          router.replace('/dashboard');
+          return;
+        }
+
+        setIsAuthorized(true);
+      } catch (error) {
+        console.error('[Admin] Auth check failed:', error);
+        router.replace('/dashboard');
+      } finally {
+        setIsLoading(false);
+      }
+    }
+
+    checkAdminAccess();
+  }, [router]);
 
   const navigation = [
     { name: '📊 Dashboard', href: '/admin', icon: '📊' },
@@ -22,6 +64,23 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
     return pathname?.startsWith(href);
   };
 
+  // Show loading state while checking auth
+  if (isLoading) {
+    return (
+      <div className="min-h-screen bg-gray-50 flex items-center justify-center">
+        <div className="text-center">
+          <div className="animate-spin rounded-full h-12 w-12 border-b-2 border-blue-600 mx-auto"></div>
+          <p className="mt-4 text-gray-600">Checking access...</p>
+        </div>
+      </div>
+    );
+  }
+
+  // Don't render content if not authorized (will redirect)
+  if (!isAuthorized) {
+    return null;
+  }
+
   return (
     <div className="min-h-screen bg-gray-50">
       {/* Mobile Header */}

src/app/admin/page.tsx

@@ -2,6 +2,7 @@
 
 import { useState, useEffect } from 'react';
 import Link from 'next/link';
+import { getStoredCredentials, createBasicAuthHeader } from '@/lib/auth/session';
 
 interface Stats {
   users: {
@@ -44,10 +45,19 @@ export default function AdminDashboardPage() {
     try {
       setLoading(true);
 
+      const credentials = getStoredCredentials();
+      if (!credentials) {
+        throw new Error('Not authenticated');
+      }
+
+      const headers = {
+        Authorization: createBasicAuthHeader(credentials.username, credentials.password),
+      };
+
       // Fetch stats and health in parallel
       const [statsRes, healthRes] = await Promise.all([
-        fetch('/api/admin/stats'),
-        fetch('/api/admin/health'),
+        fetch('/api/admin/stats', { headers }),
+        fetch('/api/admin/health', { headers }),
       ]);
 
       if (!statsRes.ok || !healthRes.ok) {

src/app/admin/users/[userId]/page.tsx

@@ -3,6 +3,7 @@
 import { useState, useEffect } from 'react';
 import Link from 'next/link';
 import { useParams } from 'next/navigation';
+import { getStoredCredentials, createBasicAuthHeader } from '@/lib/auth/session';
 
 interface User {
   id: string;
@@ -45,7 +46,17 @@ export default function AdminUserDetailPage() {
   const fetchUserDetail = async () => {
     try {
       setLoading(true);
-      const response = await fetch(`/api/admin/users/${userId}`);
+
+      const credentials = getStoredCredentials();
+      if (!credentials) {
+        throw new Error('Not authenticated');
+      }
+
+      const headers = {
+        Authorization: createBasicAuthHeader(credentials.username, credentials.password),
+      };
+
+      const response = await fetch(`/api/admin/users/${userId}`, { headers });
 
       if (!response.ok) {
         if (response.status === 404) {

src/app/admin/users/page.tsx

@@ -2,6 +2,7 @@
 
 import { useState, useEffect } from 'react';
 import Link from 'next/link';
+import { getStoredCredentials, createBasicAuthHeader } from '@/lib/auth/session';
 
 interface User {
   id: string;
@@ -30,6 +31,16 @@ export default function AdminUsersPage() {
   const fetchUsers = async () => {
     try {
       setLoading(true);
+
+      const credentials = getStoredCredentials();
+      if (!credentials) {
+        throw new Error('Not authenticated');
+      }
+
+      const headers = {
+        Authorization: createBasicAuthHeader(credentials.username, credentials.password),
+      };
+
       const params = new URLSearchParams({
         page: page.toString(),
         limit: '50',
@@ -38,7 +49,7 @@ export default function AdminUsersPage() {
         ...(search && { search }),
       });
 
-      const response = await fetch(`/api/admin/users?${params}`);
+      const response = await fetch(`/api/admin/users?${params}`, { headers });
       if (!response.ok) {
         throw new Error('Failed to fetch users');
       }

src/app/api/admin/conversations/[conversationId]/export/tsv/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { ConversationRepository } from '@/lib/repositories/conversation-repository';
 import { MessageRepository } from '@/lib/repositories/message-repository';
 import { getDatabase } from '@/lib/db';
+import { requireAdminAuth, createUnauthorizedResponse, createForbiddenResponse } from '@/lib/auth';
 
 /**
  * Sanitizes a filename by removing or replacing invalid characters
@@ -83,12 +84,14 @@ function formatMessageWithSpeaker(
  * GET /api/admin/conversations/:conversationId/export/tsv
  *
  * Export a single conversation's messages as a TSV file
+ * Requires admin authentication
  */
 export async function GET(
   request: NextRequest,
   { params }: { params: Promise<{ conversationId: string }> }
 ) {
   try {
+    await requireAdminAuth(request);
     const { conversationId } = await params;
 
     // Fetch conversation and messages - use view to get names
@@ -181,6 +184,14 @@ export async function GET(
       },
     });
   } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Unauthorized') {
+        return createUnauthorizedResponse();
+      }
+      if (error.message === 'Forbidden') {
+        return createForbiddenResponse();
+      }
+    }
     console.error('Error exporting conversation to TSV:', error);
     return NextResponse.json(
       { error: 'Failed to export conversation' },

src/app/api/admin/conversations/[conversationId]/route.ts

@@ -1,16 +1,19 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 import { ConversationRepository } from '@/lib/repositories/conversation-repository';
 import { getPromptService } from '@/lib/services/prompt-service';
+import { requireAdminAuth, createUnauthorizedResponse, createForbiddenResponse } from '@/lib/auth';
 
 /**
  * GET /api/admin/conversations/:conversationId
  * Get full conversation with all messages
+ * Requires admin authentication
  */
 export async function GET(
-  request: Request,
+  request: NextRequest,
   { params }: { params: Promise<{ conversationId: string }> }
 ) {
   try {
+    await requireAdminAuth(request);
     const { conversationId } = await params;
 
     const repo = new ConversationRepository();
@@ -49,6 +52,14 @@ export async function GET(
       });
     }
   } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Unauthorized') {
+        return createUnauthorizedResponse();
+      }
+      if (error.message === 'Forbidden') {
+        return createForbiddenResponse();
+      }
+    }
     console.error('[GET /api/admin/conversations/:conversationId] Error:', error);
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
   }

src/app/api/admin/conversations/route.ts

@@ -1,9 +1,11 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { ConversationRepository } from '@/lib/repositories/conversation-repository';
+import { requireAdminAuth, createUnauthorizedResponse, createForbiddenResponse } from '@/lib/auth';
 
 /**
  * GET /api/admin/conversations
  * List all conversations with filtering, pagination, and sorting
+ * Requires admin authentication
  *
  * Query parameters:
  * - userId: Partial search on user ID and username (e.g., "te" matches "test-user", "teresa", "user-test-123")
@@ -16,6 +18,7 @@ import { ConversationRepository } from '@/lib/repositories/conversation-reposito
  */
 export async function GET(request: NextRequest) {
   try {
+    await requireAdminAuth(request);
     const searchParams = request.nextUrl.searchParams;
     const userId = searchParams.get('userId') || undefined;
     const studentPromptId = searchParams.get('studentPromptId') || undefined;
@@ -74,6 +77,14 @@ export async function GET(request: NextRequest) {
       },
     });
   } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Unauthorized') {
+        return createUnauthorizedResponse();
+      }
+      if (error.message === 'Forbidden') {
+        return createForbiddenResponse();
+      }
+    }
     console.error('[GET /api/admin/conversations] Error:', error);
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
   }

src/app/api/admin/health/route.ts

@@ -1,5 +1,6 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 import { getDatabase } from '@/lib/db';
+import { requireAdminAuth, createUnauthorizedResponse, createForbiddenResponse } from '@/lib/auth';
 
 /**
  * Cache for health metrics
@@ -16,9 +17,11 @@ const CACHE_TTL_MS = 30 * 1000; // 30 seconds
 /**
  * GET /api/admin/health
  * Get database health metrics with caching
+ * Requires admin authentication
  */
-export async function GET() {
+export async function GET(request: NextRequest) {
   try {
+    await requireAdminAuth(request);
     // Check cache first
     if (healthCache && Date.now() < healthCache.expiresAt) {
       return NextResponse.json({
@@ -84,6 +87,14 @@ export async function GET() {
 
     return NextResponse.json(responseData);
   } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Unauthorized') {
+        return createUnauthorizedResponse();
+      }
+      if (error.message === 'Forbidden') {
+        return createForbiddenResponse();
+      }
+    }
     console.error('[GET /api/admin/health] Error:', error);
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
   }

src/app/api/admin/indexes/route.ts

@@ -1,12 +1,15 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 import { getDatabase } from '@/lib/db';
+import { requireAdminAuth, createUnauthorizedResponse, createForbiddenResponse } from '@/lib/auth';
 
 /**
  * GET /api/admin/indexes
  * List all custom indexes in the database
+ * Requires admin authentication
  */
-export async function GET() {
+export async function GET(request: NextRequest) {
   try {
+    await requireAdminAuth(request);
     const db = getDatabase();
 
     // Query PostgreSQL system catalog for indexes
@@ -32,6 +35,14 @@ export async function GET() {
       })),
     });
   } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Unauthorized') {
+        return createUnauthorizedResponse();
+      }
+      if (error.message === 'Forbidden') {
+        return createForbiddenResponse();
+      }
+    }
     console.error('[GET /api/admin/indexes] Error:', error);
     return NextResponse.json(
       { error: 'Internal server error', details: error instanceof Error ? error.message : 'Unknown' },

src/app/api/admin/stats/route.ts

@@ -1,12 +1,15 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 import { getDatabase } from '@/lib/db';
+import { requireAdminAuth, createUnauthorizedResponse, createForbiddenResponse } from '@/lib/auth';
 
 /**
  * GET /api/admin/stats
  * Get overall system statistics
+ * Requires admin authentication
  */
-export async function GET() {
+export async function GET(request: NextRequest) {
   try {
+    await requireAdminAuth(request);
     const db = getDatabase();
 
     // Calculate time ranges
@@ -90,6 +93,14 @@ export async function GET() {
       },
     });
   } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Unauthorized') {
+        return createUnauthorizedResponse();
+      }
+      if (error.message === 'Forbidden') {
+        return createForbiddenResponse();
+      }
+    }
     console.error('[GET /api/admin/stats] Error:', error);
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
   }

src/app/api/admin/users/[userId]/route.ts

@@ -1,15 +1,18 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 import { UserRepository } from '@/lib/repositories/user-repository';
+import { requireAdminAuth, createUnauthorizedResponse, createForbiddenResponse } from '@/lib/auth';
 
 /**
  * GET /api/admin/users/:userId
  * Get detailed user information with recent conversations
+ * Requires admin authentication
  */
 export async function GET(
-  request: Request,
+  request: NextRequest,
   { params }: { params: Promise<{ userId: string }> }
 ) {
   try {
+    await requireAdminAuth(request);
     const { userId } = await params;
 
     const repo = new UserRepository();
@@ -26,6 +29,14 @@ export async function GET(
       recentConversations: result.recentConversations,
     });
   } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Unauthorized') {
+        return createUnauthorizedResponse();
+      }
+      if (error.message === 'Forbidden') {
+        return createForbiddenResponse();
+      }
+    }
     console.error('[GET /api/admin/users/:userId] Error:', error);
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
   }

src/app/api/admin/users/route.ts

@@ -1,12 +1,15 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { UserRepository } from '@/lib/repositories/user-repository';
+import { requireAdminAuth, createUnauthorizedResponse, createForbiddenResponse } from '@/lib/auth';
 
 /**
  * GET /api/admin/users
  * List all users with pagination, search, and sorting
+ * Requires admin authentication
  */
 export async function GET(request: NextRequest) {
   try {
+    await requireAdminAuth(request);
     const searchParams = request.nextUrl.searchParams;
     const search = searchParams.get('search') || undefined;
     const page = parseInt(searchParams.get('page') || '1');
@@ -41,6 +44,14 @@ export async function GET(request: NextRequest) {
       },
     });
   } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Unauthorized') {
+        return createUnauthorizedResponse();
+      }
+      if (error.message === 'Forbidden') {
+        return createForbiddenResponse();
+      }
+    }
     console.error('[GET /api/admin/users] Error:', error);
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
   }

src/app/api/auth/me/route.ts

@@ -0,0 +1,25 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireBasicAuth, createUnauthorizedResponse } from '@/lib/auth';
+
+/**
+ * GET /api/auth/me
+ * Returns current user info including session role
+ * Used by admin UI to check access permissions
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const auth = await requireBasicAuth(request);
+
+    return NextResponse.json({
+      userId: auth.userId,
+      username: auth.username,
+      sessionRole: auth.sessionRole,
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message === 'Unauthorized') {
+      return createUnauthorizedResponse();
+    }
+    console.error('[GET /api/auth/me] Error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

src/lib/auth/index.ts

@@ -10,14 +10,32 @@ import { parseBasicAuthHeader, getDefaultPassword } from './session';
 // Re-export session utilities
 export * from './session';
 
+/**
+ * Session role type - determines access level
+ */
+export type SessionRole = 'user' | 'admin';
+
+/**
+ * Get admin password from environment variable
+ * Returns undefined if not set (admin access disabled)
+ */
+export function getAdminPassword(): string | undefined {
+  return process.env.ADMIN_PASSWORD;
+}
+
 /**
  * Basic HTTP Authentication middleware for API routes
  * Checks for Basic Auth credentials against registered users
+ * Returns session role based on which password was used
  *
  * @throws Error with message 'Unauthorized' if authentication fails
- * @returns User info {userId, username} if authenticated
+ * @returns User info {userId, username, sessionRole} if authenticated
  */
-export async function requireBasicAuth(request: NextRequest): Promise<{ userId: string; username: string }> {
+export async function requireBasicAuth(request: NextRequest): Promise<{
+  userId: string;
+  username: string;
+  sessionRole: SessionRole;
+}> {
   const authHeader = request.headers.get('authorization');
 
   if (!authHeader || !authHeader.startsWith('Basic ')) {
@@ -32,13 +50,6 @@ export async function requireBasicAuth(request: NextRequest): Promise<{ userId:
 
   const { username, password } = credentials;
 
-  // Validate password against environment variable (same for all users)
-  const validPassword = getDefaultPassword();
-
-  if (password !== validPassword) {
-    throw new Error('Unauthorized');
-  }
-
   // Check if user exists in database
   const userRepo = new UserRepository();
   const user = await userRepo.findByUsername(username);
@@ -47,11 +58,47 @@ export async function requireBasicAuth(request: NextRequest): Promise<{ userId:
     throw new Error('Unauthorized');
   }
 
-  // Authentication successful - return user info
-  return {
-    userId: user.id,
-    username: user.username,
-  };
+  // Get passwords from environment
+  const adminPassword = getAdminPassword();
+  const userPassword = getDefaultPassword();
+
+  // Check admin password first (if configured)
+  if (adminPassword && password === adminPassword) {
+    return {
+      userId: user.id,
+      username: user.username,
+      sessionRole: 'admin',
+    };
+  } else if (userPassword && password === userPassword) {
+    return {
+      userId: user.id,
+      username: user.username,
+      sessionRole: 'user',
+    };
+  } else {
+    throw new Error('Unauthorized');
+  }
+}
+
+/**
+ * Admin authentication middleware for API routes
+ * Requires admin session role (must login with ADMIN_PASSWORD)
+ *
+ * @throws Error with message 'Forbidden' if not admin
+ * @returns User info with admin session role
+ */
+export async function requireAdminAuth(request: NextRequest): Promise<{
+  userId: string;
+  username: string;
+  sessionRole: 'admin';
+}> {
+  const auth = await requireBasicAuth(request);
+
+  if (auth.sessionRole !== 'admin') {
+    throw new Error('Forbidden');
+  }
+
+  return auth as { userId: string; username: string; sessionRole: 'admin' };
 }
 
 /**
@@ -65,3 +112,15 @@ export function createUnauthorizedResponse(message = 'Unauthorized'): Response {
     },
   });
 }
+
+/**
+ * Helper to create 403 Forbidden response
+ */
+export function createForbiddenResponse(message = 'Forbidden'): Response {
+  return new Response(JSON.stringify({ error: message }), {
+    status: 403,
+    headers: {
+      'Content-Type': 'application/json',
+    },
+  });
+}

src/lib/auth/session.ts

@@ -81,8 +81,9 @@ export function parseBasicAuthHeader(authHeader: string): { username: string; pa
 }
 
 /**
- * Get the default/expected password from environment
+ * Get the user password from environment
+ * Returns undefined if not set
  */
-export function getDefaultPassword(): string {
-  return process.env.BASIC_AUTH_PASSWORD || process.env.NEXT_PUBLIC_DEFAULT_PASSWORD || 'cz-2025';
+export function getDefaultPassword(): string | undefined {
+  return process.env.BASIC_AUTH_PASSWORD || process.env.NEXT_PUBLIC_DEFAULT_PASSWORD;
 }

tests/e2e/admin-conversation-export-concurrent.api.spec.ts

@@ -1,12 +1,14 @@
 import { test, expect } from '@playwright/test';
 
 const BASE_URL = 'http://localhost:3000';
+const adminPassword = process.env.ADMIN_PASSWORD || 'cz-2025-admin';
 
 test.describe('Admin Conversation TSV Export - Concurrent Requests', () => {
   let testUserId: string;
   let testUsername: string;
   let conversation1Id: string;
   let conversation2Id: string;
+  let adminAuthHeader: string;
   const testPassword = process.env.BASIC_AUTH_PASSWORD || 'cz-2025';
 
   test.beforeAll(async ({ request }) => {
@@ -24,6 +26,9 @@ test.describe('Admin Conversation TSV Export - Concurrent Requests', () => {
     const userData = await registerResponse.json();
     testUserId = userData.user.id;
 
+    // Create Admin Auth header (required for admin endpoints)
+    adminAuthHeader = `Basic ${Buffer.from(`${testUsername}:${adminPassword}`).toString('base64')}`;
+
     // Create Basic Auth header
     const authHeader = `Basic ${Buffer.from(`${testUsername}:${testPassword}`).toString('base64')}`;
 
@@ -117,14 +122,16 @@ test.describe('Admin Conversation TSV Export - Concurrent Requests', () => {
   test('Sequential exports should not mix conversations', async ({ request }) => {
     // Export first conversation
     const response1 = await request.get(
-      `${BASE_URL}/api/admin/conversations/${conversation1Id}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${conversation1Id}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response1.ok()).toBeTruthy();
     const tsv1 = await response1.text();
 
     // Export second conversation
     const response2 = await request.get(
-      `${BASE_URL}/api/admin/conversations/${conversation2Id}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${conversation2Id}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response2.ok()).toBeTruthy();
     const tsv2 = await response2.text();
@@ -145,8 +152,8 @@ test.describe('Admin Conversation TSV Export - Concurrent Requests', () => {
   test('Concurrent exports should not mix conversations', async ({ request }) => {
     // Trigger both exports simultaneously
     const [response1, response2] = await Promise.all([
-      request.get(`${BASE_URL}/api/admin/conversations/${conversation1Id}/export/tsv`),
-      request.get(`${BASE_URL}/api/admin/conversations/${conversation2Id}/export/tsv`),
+      request.get(`${BASE_URL}/api/admin/conversations/${conversation1Id}/export/tsv`, { headers: { Authorization: adminAuthHeader } }),
+      request.get(`${BASE_URL}/api/admin/conversations/${conversation2Id}/export/tsv`, { headers: { Authorization: adminAuthHeader } }),
     ]);
 
     expect(response1.ok()).toBeTruthy();
@@ -173,10 +180,10 @@ test.describe('Admin Conversation TSV Export - Concurrent Requests', () => {
     const exports = [];
     for (let i = 0; i < 5; i++) {
       exports.push(
-        request.get(`${BASE_URL}/api/admin/conversations/${conversation1Id}/export/tsv`)
+        request.get(`${BASE_URL}/api/admin/conversations/${conversation1Id}/export/tsv`, { headers: { Authorization: adminAuthHeader } })
       );
       exports.push(
-        request.get(`${BASE_URL}/api/admin/conversations/${conversation2Id}/export/tsv`)
+        request.get(`${BASE_URL}/api/admin/conversations/${conversation2Id}/export/tsv`, { headers: { Authorization: adminAuthHeader } })
       );
     }
 
@@ -212,7 +219,8 @@ test.describe('Admin Conversation TSV Export - Concurrent Requests', () => {
 
   test('Exported TSV should include conversation ID in every row', async ({ request }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${conversation1Id}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${conversation1Id}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
     const tsv = await response.text();

tests/e2e/admin-conversation-export.api.spec.ts

@@ -1,11 +1,13 @@
 import { test, expect } from '@playwright/test';
 
 const BASE_URL = 'http://localhost:3000';
+const adminPassword = process.env.ADMIN_PASSWORD || 'cz-2025-admin';
 
 test.describe('Admin Conversation TSV Export API', () => {
   let testUserId: string;
   let testConversationId: string;
   let testUsername: string;
+  let adminAuthHeader: string;
   const testPassword = process.env.BASIC_AUTH_PASSWORD || 'cz-2025';
 
   test.beforeAll(async ({ request }) => {
@@ -23,6 +25,9 @@ test.describe('Admin Conversation TSV Export API', () => {
     const userData = await registerResponse.json();
     testUserId = userData.user.id;
 
+    // Create Admin Auth header (required for admin endpoints)
+    adminAuthHeader = `Basic ${Buffer.from(`${testUsername}:${adminPassword}`).toString('base64')}`;
+
     // Create Basic Auth header
     const authHeader = `Basic ${Buffer.from(`${testUsername}:${testPassword}`).toString('base64')}`;
 
@@ -100,7 +105,8 @@ test.describe('Admin Conversation TSV Export API', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     expect(response.ok()).toBeTruthy();
@@ -121,7 +127,8 @@ test.describe('Admin Conversation TSV Export API', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     const tsvContent = await response.text();
@@ -148,7 +155,8 @@ test.describe('Admin Conversation TSV Export API', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     const tsvContent = await response.text();
@@ -161,7 +169,8 @@ test.describe('Admin Conversation TSV Export API', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     const tsvContent = await response.text();
@@ -174,7 +183,8 @@ test.describe('Admin Conversation TSV Export API', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     const tsvContent = await response.text();
@@ -188,14 +198,16 @@ test.describe('Admin Conversation TSV Export API', () => {
   }) => {
     // First, get the conversation to see how many messages it has
     const detailResponse = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     const detailData = await detailResponse.json();
     const messageCount = detailData.messages.length;
 
     // Now get the TSV
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     const tsvContent = await response.text();
@@ -210,7 +222,8 @@ test.describe('Admin Conversation TSV Export API', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     const tsvContent = await response.text();
@@ -264,7 +277,8 @@ test.describe('Admin Conversation TSV Export API', () => {
 
     // Export the FIRST conversation
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     const tsvContent = await response.text();
@@ -284,7 +298,8 @@ test.describe('Admin Conversation TSV Export API', () => {
   }) => {
     const fakeConvId = '00000000-0000-0000-0000-000000000000';
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${fakeConvId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${fakeConvId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     expect(response.status()).toBe(404);
@@ -298,7 +313,8 @@ test.describe('Admin Conversation TSV Export API', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     const contentDisposition = response.headers()['content-disposition'];
@@ -360,7 +376,8 @@ test.describe('Admin Conversation TSV Export API', () => {
 
     // Export should work
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${specialConvId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${specialConvId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     expect(response.ok()).toBeTruthy();
@@ -387,7 +404,8 @@ test.describe('Admin Conversation TSV Export API', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     const tsvContent = await response.text();
@@ -439,7 +457,10 @@ test.describe('Admin Conversation TSV Export API', () => {
     });
 
     // Export TSV
-    const response = await request.get(`${BASE_URL}/api/admin/conversations/${speakerTestConvId}/export/tsv`);
+    const response = await request.get(
+      `${BASE_URL}/api/admin/conversations/${speakerTestConvId}/export/tsv`,
+      { headers: { Authorization: adminAuthHeader } }
+    );
 
     // Should return 200 (verifies UTF-8 encoding works, not ByteString error)
     expect(response.ok()).toBeTruthy();

tests/e2e/admin-conversations.api.spec.ts

@@ -1,11 +1,13 @@
 import { test, expect } from '@playwright/test';
 
 const BASE_URL = 'http://localhost:3000';
+const adminPassword = process.env.ADMIN_PASSWORD || 'cz-2025-admin';
 
 test.describe('Admin Conversations APIs', () => {
   let testUserId: string;
   let testConversationId: string;
   let testUsername: string;
+  let adminAuthHeader: string;
   const testPassword = process.env.BASIC_AUTH_PASSWORD || 'cz-2025';
 
   test.beforeAll(async ({ request }) => {
@@ -23,6 +25,9 @@ test.describe('Admin Conversations APIs', () => {
     const userData = await registerResponse.json();
     testUserId = userData.user.id;
 
+    // Create Admin Auth header (required for admin endpoints)
+    adminAuthHeader = `Basic ${Buffer.from(`${testUsername}:${adminPassword}`).toString('base64')}`;
+
     // Create Basic Auth header
     const authHeader = `Basic ${Buffer.from(`${testUsername}:${testPassword}`).toString('base64')}`;
 
@@ -56,7 +61,9 @@ test.describe('Admin Conversations APIs', () => {
   test('GET /api/admin/conversations - should return conversations list with default params', async ({
     request,
   }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/conversations`);
+    const response = await request.get(`${BASE_URL}/api/admin/conversations`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     expect(response.ok()).toBeTruthy();
     expect(response.status()).toBe(200);
 
@@ -81,7 +88,9 @@ test.describe('Admin Conversations APIs', () => {
   test('GET /api/admin/conversations - should validate conversation object structure', async ({
     request,
   }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/conversations?limit=1`);
+    const response = await request.get(`${BASE_URL}/api/admin/conversations?limit=1`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     const data = await response.json();
 
     if (data.conversations.length > 0) {
@@ -120,7 +129,8 @@ test.describe('Admin Conversations APIs', () => {
 
   test('GET /api/admin/conversations - should filter by userId', async ({ request }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations?userId=${testUserId}`
+      `${BASE_URL}/api/admin/conversations?userId=${testUserId}`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
 
@@ -140,7 +150,8 @@ test.describe('Admin Conversations APIs', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations?studentPromptId=ruirui`
+      `${BASE_URL}/api/admin/conversations?studentPromptId=ruirui`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
 
@@ -154,7 +165,8 @@ test.describe('Admin Conversations APIs', () => {
 
   test('GET /api/admin/conversations - should filter by coachPromptId', async ({ request }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations?coachPromptId=empathetic`
+      `${BASE_URL}/api/admin/conversations?coachPromptId=empathetic`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
 
@@ -168,7 +180,8 @@ test.describe('Admin Conversations APIs', () => {
 
   test('GET /api/admin/conversations - should support multiple filters', async ({ request }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations?userId=${testUserId}&studentPromptId=ruirui&coachPromptId=empathetic`
+      `${BASE_URL}/api/admin/conversations?userId=${testUserId}&studentPromptId=ruirui&coachPromptId=empathetic`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
 
@@ -184,12 +197,14 @@ test.describe('Admin Conversations APIs', () => {
 
   test('GET /api/admin/conversations - should sort by createdAt', async ({ request }) => {
     const ascResponse = await request.get(
-      `${BASE_URL}/api/admin/conversations?sortBy=createdAt&sortOrder=asc&limit=10`
+      `${BASE_URL}/api/admin/conversations?sortBy=createdAt&sortOrder=asc&limit=10`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(ascResponse.ok()).toBeTruthy();
 
     const descResponse = await request.get(
-      `${BASE_URL}/api/admin/conversations?sortBy=createdAt&sortOrder=desc&limit=10`
+      `${BASE_URL}/api/admin/conversations?sortBy=createdAt&sortOrder=desc&limit=10`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(descResponse.ok()).toBeTruthy();
 
@@ -213,7 +228,8 @@ test.describe('Admin Conversations APIs', () => {
 
   test('GET /api/admin/conversations - should sort by lastActiveAt', async ({ request }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations?sortBy=lastActiveAt&sortOrder=desc&limit=10`
+      `${BASE_URL}/api/admin/conversations?sortBy=lastActiveAt&sortOrder=desc&limit=10`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
 
@@ -229,7 +245,8 @@ test.describe('Admin Conversations APIs', () => {
 
   test('GET /api/admin/conversations - should sort by messageCount', async ({ request }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations?sortBy=messageCount&sortOrder=desc&limit=10`
+      `${BASE_URL}/api/admin/conversations?sortBy=messageCount&sortOrder=desc&limit=10`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
 
@@ -247,7 +264,8 @@ test.describe('Admin Conversations APIs', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations?sortBy=invalidField`
+      `${BASE_URL}/api/admin/conversations?sortBy=invalidField`,
+      { headers: { Authorization: adminAuthHeader } }
     );
 
     expect(response.status()).toBe(400);
@@ -258,13 +276,16 @@ test.describe('Admin Conversations APIs', () => {
   });
 
   test('GET /api/admin/conversations - should support pagination', async ({ request }) => {
-    const page1Response = await request.get(`${BASE_URL}/api/admin/conversations?page=1&limit=5`);
+    const page1Response = await request.get(`${BASE_URL}/api/admin/conversations?page=1&limit=5`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     expect(page1Response.ok()).toBeTruthy();
     const page1Data = await page1Response.json();
 
     if (page1Data.pagination.totalPages > 1) {
       const page2Response = await request.get(
-        `${BASE_URL}/api/admin/conversations?page=2&limit=5`
+        `${BASE_URL}/api/admin/conversations?page=2&limit=5`,
+        { headers: { Authorization: adminAuthHeader } }
       );
       expect(page2Response.ok()).toBeTruthy();
       const page2Data = await page2Response.json();
@@ -280,7 +301,9 @@ test.describe('Admin Conversations APIs', () => {
   });
 
   test('GET /api/admin/conversations - should enforce max limit of 100', async ({ request }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/conversations?limit=200`);
+    const response = await request.get(`${BASE_URL}/api/admin/conversations?limit=200`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     const data = await response.json();
 
     // Should cap at 100
@@ -291,7 +314,8 @@ test.describe('Admin Conversations APIs', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
     expect(response.status()).toBe(200);
@@ -323,7 +347,8 @@ test.describe('Admin Conversations APIs', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     const data = await response.json();
 
@@ -363,7 +388,8 @@ test.describe('Admin Conversations APIs', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     const data = await response.json();
 
@@ -376,7 +402,9 @@ test.describe('Admin Conversations APIs', () => {
     request,
   }) => {
     const fakeConvId = '00000000-0000-0000-0000-000000000000';
-    const response = await request.get(`${BASE_URL}/api/admin/conversations/${fakeConvId}`);
+    const response = await request.get(`${BASE_URL}/api/admin/conversations/${fakeConvId}`, {
+      headers: { Authorization: adminAuthHeader },
+    });
 
     expect(response.status()).toBe(404);
 
@@ -390,7 +418,8 @@ test.describe('Admin Conversations APIs', () => {
   }) => {
     const fakeUserId = '00000000-0000-0000-0000-000000000000';
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations?userId=${fakeUserId}`
+      `${BASE_URL}/api/admin/conversations?userId=${fakeUserId}`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
 
@@ -403,7 +432,8 @@ test.describe('Admin Conversations APIs', () => {
     request,
   }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/conversations/${testConversationId}`
+      `${BASE_URL}/api/admin/conversations/${testConversationId}`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     const data = await response.json();
 

tests/e2e/admin-stats-health.api.spec.ts

@@ -1,10 +1,30 @@
 import { test, expect } from '@playwright/test';
 
 const BASE_URL = 'http://localhost:3000';
+const adminPassword = process.env.ADMIN_PASSWORD || 'cz-2025-admin';
 
 test.describe('Admin Stats and Health APIs', () => {
+  let adminAuthHeader: string;
+  let testUsername: string;
+
+  test.beforeAll(async ({ request }) => {
+    // Create a test user for admin auth
+    const timestamp = Date.now();
+    testUsername = `admin_stats_test_${timestamp}`;
+
+    const registerResponse = await request.post(`${BASE_URL}/api/auth/register`, {
+      data: { username: testUsername },
+    });
+    expect(registerResponse.ok()).toBeTruthy();
+
+    // Create Admin Auth header
+    adminAuthHeader = `Basic ${Buffer.from(`${testUsername}:${adminPassword}`).toString('base64')}`;
+  });
+
   test('GET /api/admin/stats - should return system statistics', async ({ request }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/stats`);
+    const response = await request.get(`${BASE_URL}/api/admin/stats`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     expect(response.ok()).toBeTruthy();
     expect(response.status()).toBe(200);
 
@@ -50,7 +70,9 @@ test.describe('Admin Stats and Health APIs', () => {
   });
 
   test('GET /api/admin/health - should return database health metrics', async ({ request }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/health`);
+    const response = await request.get(`${BASE_URL}/api/admin/health`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     expect(response.ok()).toBeTruthy();
     expect(response.status()).toBe(200);
 
@@ -86,7 +108,9 @@ test.describe('Admin Stats and Health APIs', () => {
   });
 
   test('GET /api/admin/stats - should have consistent data', async ({ request }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/stats`);
+    const response = await request.get(`${BASE_URL}/api/admin/stats`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     const stats = await response.json();
 
     // New users in last 7 days should not exceed total users
@@ -110,7 +134,9 @@ test.describe('Admin Stats and Health APIs', () => {
   test('GET /api/admin/health - should show prompt_templates table with data', async ({
     request,
   }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/health`);
+    const response = await request.get(`${BASE_URL}/api/admin/health`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     const health = await response.json();
 
     const promptTemplatesTable = health.tables.find((t: any) => t.name === 'prompt_templates');
@@ -123,8 +149,8 @@ test.describe('Admin Stats and Health APIs', () => {
   test('Stats API totals should match Health API row counts', async ({ request }) => {
     // Fetch both endpoints
     const [statsRes, healthRes] = await Promise.all([
-      request.get(`${BASE_URL}/api/admin/stats`),
-      request.get(`${BASE_URL}/api/admin/health`),
+      request.get(`${BASE_URL}/api/admin/stats`, { headers: { Authorization: adminAuthHeader } }),
+      request.get(`${BASE_URL}/api/admin/health`, { headers: { Authorization: adminAuthHeader } }),
     ]);
 
     expect(statsRes.ok()).toBeTruthy();

tests/e2e/admin-users.api.spec.ts

@@ -1,10 +1,12 @@
 import { test, expect } from '@playwright/test';
 
 const BASE_URL = 'http://localhost:3000';
+const adminPassword = process.env.ADMIN_PASSWORD || 'cz-2025-admin';
 
 test.describe('Admin Users APIs', () => {
   let testUserId: string;
   let testUsername: string;
+  let adminAuthHeader: string;
 
   test.beforeAll(async ({ request }) => {
     // Create a test user
@@ -20,12 +22,17 @@ test.describe('Admin Users APIs', () => {
     expect(response.ok()).toBeTruthy();
     const data = await response.json();
     testUserId = data.user.id;
+
+    // Create Admin Auth header (required for admin endpoints)
+    adminAuthHeader = `Basic ${Buffer.from(`${testUsername}:${adminPassword}`).toString('base64')}`;
   });
 
   test('GET /api/admin/users - should return users list with default params', async ({
     request,
   }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/users`);
+    const response = await request.get(`${BASE_URL}/api/admin/users`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     expect(response.ok()).toBeTruthy();
     expect(response.status()).toBe(200);
 
@@ -53,7 +60,9 @@ test.describe('Admin Users APIs', () => {
   });
 
   test('GET /api/admin/users - should validate user object structure', async ({ request }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/users?limit=1`);
+    const response = await request.get(`${BASE_URL}/api/admin/users?limit=1`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     const data = await response.json();
 
     if (data.users.length > 0) {
@@ -86,7 +95,9 @@ test.describe('Admin Users APIs', () => {
   });
 
   test('GET /api/admin/users - should support search by username', async ({ request }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/users?search=${testUsername}`);
+    const response = await request.get(`${BASE_URL}/api/admin/users?search=${testUsername}`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     expect(response.ok()).toBeTruthy();
 
     const data = await response.json();
@@ -103,7 +114,8 @@ test.describe('Admin Users APIs', () => {
 
   test('GET /api/admin/users - should support sorting by username', async ({ request }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/users?sortBy=username&sortOrder=asc&limit=10`
+      `${BASE_URL}/api/admin/users?sortBy=username&sortOrder=asc&limit=10`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();
 
@@ -118,12 +130,14 @@ test.describe('Admin Users APIs', () => {
 
   test('GET /api/admin/users - should support sorting by createdAt', async ({ request }) => {
     const ascResponse = await request.get(
-      `${BASE_URL}/api/admin/users?sortBy=createdAt&sortOrder=asc&limit=10`
+      `${BASE_URL}/api/admin/users?sortBy=createdAt&sortOrder=asc&limit=10`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(ascResponse.ok()).toBeTruthy();
 
     const descResponse = await request.get(
-      `${BASE_URL}/api/admin/users?sortBy=createdAt&sortOrder=desc&limit=10`
+      `${BASE_URL}/api/admin/users?sortBy=createdAt&sortOrder=desc&limit=10`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(descResponse.ok()).toBeTruthy();
 
@@ -148,12 +162,16 @@ test.describe('Admin Users APIs', () => {
   });
 
   test('GET /api/admin/users - should support pagination', async ({ request }) => {
-    const page1Response = await request.get(`${BASE_URL}/api/admin/users?page=1&limit=5`);
+    const page1Response = await request.get(`${BASE_URL}/api/admin/users?page=1&limit=5`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     expect(page1Response.ok()).toBeTruthy();
     const page1Data = await page1Response.json();
 
     if (page1Data.pagination.totalPages > 1) {
-      const page2Response = await request.get(`${BASE_URL}/api/admin/users?page=2&limit=5`);
+      const page2Response = await request.get(`${BASE_URL}/api/admin/users?page=2&limit=5`, {
+        headers: { Authorization: adminAuthHeader },
+      });
       expect(page2Response.ok()).toBeTruthy();
       const page2Data = await page2Response.json();
 
@@ -169,14 +187,18 @@ test.describe('Admin Users APIs', () => {
 
   test('GET /api/admin/users - should respect limit parameter', async ({ request }) => {
     const limit = 3;
-    const response = await request.get(`${BASE_URL}/api/admin/users?limit=${limit}`);
+    const response = await request.get(`${BASE_URL}/api/admin/users?limit=${limit}`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     const data = await response.json();
 
     expect(data.users.length).toBeLessThanOrEqual(limit);
   });
 
   test('GET /api/admin/users - should enforce max limit of 100', async ({ request }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/users?limit=200`);
+    const response = await request.get(`${BASE_URL}/api/admin/users?limit=200`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     const data = await response.json();
 
     // Should cap at 100
@@ -184,7 +206,9 @@ test.describe('Admin Users APIs', () => {
   });
 
   test('GET /api/admin/users/[userId] - should return user detail', async ({ request }) => {
-    const response = await request.get(`${BASE_URL}/api/admin/users/${testUserId}`);
+    const response = await request.get(`${BASE_URL}/api/admin/users/${testUserId}`, {
+      headers: { Authorization: adminAuthHeader },
+    });
     expect(response.ok()).toBeTruthy();
     expect(response.status()).toBe(200);
 
@@ -236,7 +260,8 @@ test.describe('Admin Users APIs', () => {
 
     // Now fetch user detail
     const userDetailResponse = await request.get(
-      `${BASE_URL}/api/admin/users/${userData.user.id}`
+      `${BASE_URL}/api/admin/users/${userData.user.id}`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     const data = await userDetailResponse.json();
 
@@ -271,7 +296,9 @@ test.describe('Admin Users APIs', () => {
     request,
   }) => {
     const fakeUserId = '00000000-0000-0000-0000-000000000000';
-    const response = await request.get(`${BASE_URL}/api/admin/users/${fakeUserId}`);
+    const response = await request.get(`${BASE_URL}/api/admin/users/${fakeUserId}`, {
+      headers: { Authorization: adminAuthHeader },
+    });
 
     expect(response.status()).toBe(404);
 
@@ -282,7 +309,8 @@ test.describe('Admin Users APIs', () => {
 
   test('GET /api/admin/users - should handle empty search results', async ({ request }) => {
     const response = await request.get(
-      `${BASE_URL}/api/admin/users?search=nonexistentuser12345xyz`
+      `${BASE_URL}/api/admin/users?search=nonexistentuser12345xyz`,
+      { headers: { Authorization: adminAuthHeader } }
     );
     expect(response.ok()).toBeTruthy();