diff --git a/src/Yavsc.Org.Tests/Controllers/ClientControllerCollectionTests.cs b/src/Yavsc.Org.Tests/Controllers/ClientControllerCollectionTests.cs
index 352f25f9..59f4747e 100644
--- a/src/Yavsc.Org.Tests/Controllers/ClientControllerCollectionTests.cs
+++ b/src/Yavsc.Org.Tests/Controllers/ClientControllerCollectionTests.cs
@@ -76,10 +76,12 @@ public class ClientControllerCollectionTests : IClassFixture<TestWebApplicationF
     {
         // WebApplicationFactory.CreateClient() returns an HttpClient wired
         // directly to the in-memory test server — no Kestrel socket, no
-        // self-signed cert, no IServerAddressesFeature lookup.
+        // self-signed cert, no IServerAddressesFeature lookup. Keep
+        // cookies enabled so the antiforgery cookie set on the GET that
+        // fetches the form is replayed on the POST that submits it.
         var http = _factory.CreateClient(new WebApplicationFactoryClientOptions
         {
-            HandleCookies = false,
+            HandleCookies = true,
         });
         http.DefaultRequestHeaders.Add(TestAuthPolicyProvider.HeaderName, TestAuthPolicyProvider.AdminRole);
         return http;
@@ -127,7 +129,10 @@ public class ClientControllerCollectionTests : IClassFixture<TestWebApplicationF
             { new StringContent(newUri), "redirectUri" },
             { new StringContent(token!), "__RequestVerificationToken" },
         };
-        var postResp = await http.PostAsync($"/Client/AddRedirectUri", form, TestContext.Current.CancellationToken);
+        var postResp = await http.PostAsync($"/Client/AddRedirectUri/{id}", form, TestContext.Current.CancellationToken);
+        var postBody = await postResp.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+        Assert.True(postResp.StatusCode == HttpStatusCode.Redirect,
+            $"Expected 302 Redirect, got {(int)postResp.StatusCode}. Body[0..500]: {postBody.Substring(0, Math.Min(500, postBody.Length))}");
         Assert.Equal(HttpStatusCode.Redirect, postResp.StatusCode);
 
         // Verify in DB.
diff --git a/src/Yavsc.Org.Tests/TestWebApplicationFactory.cs b/src/Yavsc.Org.Tests/TestWebApplicationFactory.cs
index a061e0d2..c62f7f8a 100644
--- a/src/Yavsc.Org.Tests/TestWebApplicationFactory.cs
+++ b/src/Yavsc.Org.Tests/TestWebApplicationFactory.cs
@@ -1,8 +1,11 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.AspNetCore.TestHost;
 using Microsoft.Extensions.DependencyInjection;
+using System.Security.Claims;
+using System.Threading.Tasks;
 
 namespace Yavsc.Org.Tests;
 
@@ -16,6 +19,10 @@ namespace Yavsc.Org.Tests;
 /// <c>[Authorize("AdministratorOnly")]</c> (and any other policy
 /// requiring a role) is satisfied by sending an
 /// <c>X-Test-Role: Administrator</c> header, without a real login.
+/// Also injects a middleware that promotes the same header into a
+/// real <see cref="ClaimsPrincipal"/> on <c>HttpContext.User</c> so
+/// that user code reading <c>User.GetUserId()</c> sees a logged-in
+/// identity.
 /// </summary>
 public class TestWebApplicationFactory : WebApplicationFactory<Program>
 {
@@ -33,5 +40,38 @@ public class TestWebApplicationFactory : WebApplicationFactory<Program>
             // becomes irrelevant: any GetPolicyAsync call is routed here.
             services.AddSingleton<IAuthorizationPolicyProvider, TestAuthPolicyProvider>();
         });
+
+        // Promote the X-Test-Role header to an authenticated identity
+        // on the request, so anything that reads User.GetUserId() (or
+        // any other claim-based helper) downstream sees a logged-in
+        // user. The policy provider above only short-circuits
+        // [Authorize(...)] checks; it does not touch HttpContext.User.
+        builder.Configure(app =>
+        {
+            app.Use(InjectTestUser);
+        });
+    }
+
+    private static RequestDelegate InjectTestUser(RequestDelegate next)
+    {
+        return async ctx =>
+        {
+            var role = ctx.Request.Headers[TestAuthPolicyProvider.HeaderName].ToString();
+            if (!string.IsNullOrEmpty(role) &&
+                (ctx.User.Identity is null || !ctx.User.Identity.IsAuthenticated))
+            {
+                var identity = new ClaimsIdentity(
+                    new[]
+                    {
+                        new Claim(
+                            "http://schemas.microsoft.com/ws/2008/06/identity/claims/role",
+                            role),
+                        new Claim(ClaimTypes.NameIdentifier, "test-user"),
+                    },
+                    authenticationType: "TestAuth");
+                ctx.User = new ClaimsPrincipal(identity);
+            }
+            await next(ctx);
+        };
     }
 }
diff --git a/src/Yavsc.Org.Tests/Yavsc.Org.Tests.csproj b/src/Yavsc.Org.Tests/Yavsc.Org.Tests.csproj
index f2106a88..c1d7faf1 100644
--- a/src/Yavsc.Org.Tests/Yavsc.Org.Tests.csproj
+++ b/src/Yavsc.Org.Tests/Yavsc.Org.Tests.csproj
@@ -64,10 +64,25 @@
       <_YavscOrgStaticAssetsDir>$(MSBuildProjectDirectory)\..\Yavsc.Org\bin\$(Configuration)\$(TargetFramework)</_YavscOrgStaticAssetsDir>
     </PropertyGroup>
     <ItemGroup>
+      <!--
+        Match the SDK-generated manifest files. Each file is then
+        copied into the test bin with the test assembly's name as
+        the prefix so that the default MapStaticAssets() lookup at
+        {AssemblyName}.staticwebassets.endpoints.json finds them.
+
+        Example:
+          src :  Yavsc.Org.staticwebassets.endpoints.json
+          dst :  Yavsc.Org.Tests.staticwebassets.endpoints.json
+
+        The transform is a string replace of the source filename's
+        "Yavsc.Org." prefix with "Yavsc.Org.Tests." — done by the
+        -> '$(OutDir)Yavsc.Org.Tests.%(Filename)' transformation
+        with a RegexReplace on the source path.
+      -->
       <_YavscOrgStaticAssetsFiles Include="$(_YavscOrgStaticAssetsDir)\Yavsc.Org.staticwebassets.*.json" />
     </ItemGroup>
     <Copy SourceFiles="@(_YavscOrgStaticAssetsFiles)"
-          DestinationFolder="$(OutDir)"
+          DestinationFiles="@(_YavscOrgStaticAssetsFiles->'$(OutDir)Yavsc.Org.Tests.' + System.IO.Path.GetFileNameWithoutExtension('%(Filename)').Replace('Yavsc.Org.', '') + System.IO.Path.GetExtension('%(Filename)'))"
           SkipUnchangedFiles="true"
           Condition="'@(_YavscOrgStaticAssetsFiles)' != ''" />
   </Target>