{notes.length} / {NOTES_MAX}
diff --git a/tests/integration/admin-reset-password.test.ts b/tests/integration/admin-reset-password.test.ts
new file mode 100644
index 000000000..94ad34014
--- /dev/null
+++ b/tests/integration/admin-reset-password.test.ts
@@ -0,0 +1,258 @@
+/**
+ * v1.4.35 — integration coverage for
+ * `POST /api/admin/users/[id]/reset-password`.
+ *
+ * The admin reset-password path runs through the same `destroyAllSessions`
+ * helper as the self-serve change route, but acts on a different user's
+ * credentials. F-1 in the test coverage audit flagged it alongside the
+ * self-serve route as a critical-path gap. This file pins:
+ *
+ * - 403 when the caller is not an admin (and credentials stay intact)
+ * - 401 when the caller is unauthenticated
+ * - 404 when the target user does not exist
+ * - 422 when the new password is weak
+ * - happy path wipes the target user's sessions, API tokens, refresh
+ * tokens and writes an `admin.user.reset-password` audit row
+ */
+import { NextRequest } from "next/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { cookieJar, headerJar } from "./mock-next-headers";
+import { getPrismaClient, truncateAllTables } from "./setup";
+
+vi.mock("next/headers", async () => {
+ const { cookieJar, headerJar } = await import("./mock-next-headers");
+ return {
+ headers: vi.fn(async () => ({
+ get: (name: string) => headerJar.get(name.toLowerCase()) ?? null,
+ })),
+ cookies: vi.fn(async () => ({
+ get: (name: string) => {
+ const value = cookieJar.get(name);
+ return value ? { name, value } : undefined;
+ },
+ set: (name: string, value: string) => {
+ cookieJar.set(name, value);
+ },
+ delete: (name: string) => {
+ cookieJar.delete(name);
+ },
+ })),
+ };
+});
+
+vi.mock("@/lib/db-compat", () => ({
+ ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
+}));
+
+const STRONG_NEW_PW = "Adm1nReset!P@ssw0rd789";
+
+async function seedCaller(role: "ADMIN" | "USER"): Promise<{
+ callerId: string;
+ sessionId: string;
+}> {
+ const prisma = getPrismaClient();
+ const caller = await prisma.user.create({
+ data: {
+ username: role === "ADMIN" ? "admin-caller" : "regular-caller",
+ email: `${role.toLowerCase()}-caller@example.test`,
+ role,
+ },
+ });
+ const session = await prisma.session.create({
+ data: {
+ userId: caller.id,
+ expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+ },
+ });
+ cookieJar.set("healthlog_session", session.id);
+ return { callerId: caller.id, sessionId: session.id };
+}
+
+async function seedTargetUser(): Promise