From 10c33b6131d75fe296134590ff27a678e77e0b98 Mon Sep 17 00:00:00 2001
From: lovasoa <contact@ophir.dev>
Date: Wed, 7 Oct 2026 00:57:41 +0200
Subject: [PATCH 1/5] test(suite) :: share helpers, close pools
 deterministically, slim OIDC harness

Integration tests leaked every request's AppState: actix-web recycles
test-built HttpRequestInner allocations into a per-request pool that the
test path never drains, pinning database pools until process exit. Pooled
ODBC connections keep cached prepared statements alive, which deadlocks
Oracle's client at process exit. Close every test pool (clearing statement
caches first, since close() alone leaves checked-out connections behind)
while the test runtime is still alive, including after panics.

Consolidate the suite around shared helpers (read_body_string,
supports_database, request builders, OIDC login/config builders,
multipart/webhook request builders) and share one AppState per test
where possible, cutting duplication across oidc/uploads/requests/
data_formats/errors/server_timing/cookies/core. Net negative LOC.
---
 .github/workflows/ci.yml       |   3 +-
 CONTRIBUTING.md                |   8 +
 scripts/run-test-binaries.sh   |   2 +-
 tests/basic/mod.rs             |  16 +-
 tests/common/mod.rs            | 119 ++++++++-
 tests/core/mod.rs              | 152 ++++++------
 tests/core/path_aliases.rs     |  10 +-
 tests/data_formats/mod.rs      | 135 +++++-----
 tests/errors/basic_auth.rs     |  12 +-
 tests/errors/invalid_header.rs |   7 +-
 tests/errors/mod.rs            |  96 ++------
 tests/exec/mod.rs              |   2 +-
 tests/oidc/mod.rs              | 435 ++++++++++++++-------------------
 tests/parameter_binding/mod.rs |   6 +-
 tests/requests/mod.rs          |  57 +++--
 tests/requests/webhook_hmac.rs |  70 ++----
 tests/server_timing/mod.rs     |  73 ++----
 tests/sql_test_files/mod.rs    |   4 +-
 tests/transactions/mod.rs      |  22 +-
 tests/uploads/mod.rs           | 202 +++++++--------
 20 files changed, 696 insertions(+), 735 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd1535976..b3f973967 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,6 +99,7 @@ jobs:
             container: mssql
             db_url: "mssql://root:Password123!@127.0.0.1/sqlpage"
           - database: oracle
+            test_args: --test-threads=2
             container: oracle
             db_url: "Driver=Oracle 21 ODBC driver;Dbq=//127.0.0.1:1521/FREEPDB1;Uid=root;Pwd=Password123!"
           - database: duckdb
@@ -142,7 +143,7 @@ jobs:
         run: docker compose logs ${{ matrix.container }}
       - name: Run tests against ${{ matrix.database }}
         timeout-minutes: 5
-        run: scripts/run-test-binaries.sh
+        run: scripts/run-test-binaries.sh ${{ matrix.test_args }}
         env:
           DATABASE_URL: ${{ matrix.db_url }}
           MALLOC_CHECK_: 3
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 43487637c..e5318b28b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -96,6 +96,14 @@ export DATABASE_URL=mssql://root:Password123!@localhost/sqlpage
 cargo test
 ```
 
+Integration tests that create application state should use `common::make_app_state_from_config` or
+`common::make_app_data_from_config` and `#[actix_web::rt::test(system = "crate::common::TestSystem")]`.
+The shared test runtime clears prepared statements and closes database pools before shutdown,
+including after a panic. This is required because actix-web's test request utilities pin each
+request's application state until process exit, which would otherwise leave native database
+handles open and hang Oracle's ODBC driver at process exit.
+When testing Oracle locally, use `cargo test -- --test-threads=2` to avoid overwhelming the listener.
+
 ### End-to-End Tests
 
 We use Playwright for end-to-end testing of dynamic frontend features.
diff --git a/scripts/run-test-binaries.sh b/scripts/run-test-binaries.sh
index 6a02b2a77..4d0038a4d 100755
--- a/scripts/run-test-binaries.sh
+++ b/scripts/run-test-binaries.sh
@@ -13,6 +13,6 @@ fi
 
 for test_binary in "${test_binaries[@]}"; do
   echo "::group::$(basename "$test_binary")"
-  "$test_binary" --quiet
+  "$test_binary" --quiet "$@"
   echo "::endgroup::"
 done
diff --git a/tests/basic/mod.rs b/tests/basic/mod.rs
index 1db6cce64..bfb80c34d 100644
--- a/tests/basic/mod.rs
+++ b/tests/basic/mod.rs
@@ -6,18 +6,17 @@ use actix_web::{
 
 use crate::common::req_path;
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_index_ok() {
     let resp = req_path("/").await.unwrap();
     assert_eq!(resp.status(), http::StatusCode::OK);
-    let body = test::read_body(resp).await;
-    assert!(body.starts_with(b"<!DOCTYPE html>"));
-    let body = String::from_utf8(body.to_vec()).unwrap();
+    let body = crate::common::read_body_string(resp).await;
+    assert!(body.starts_with("<!DOCTYPE html>"));
     assert!(body.contains("It works !"));
     assert!(!body.contains("error"));
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_access_config_forbidden() {
     let resp_result = req_path("/sqlpage/sqlpage.json").await;
     assert!(
@@ -33,7 +32,7 @@ async fn test_access_config_forbidden() {
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_static_files() {
     let resp = req_path("/tests/it_works.txt").await.unwrap();
     assert_eq!(resp.status(), http::StatusCode::OK);
@@ -41,13 +40,12 @@ async fn test_static_files() {
     assert_eq!(&body, &b"It works !"[..]);
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_spaces_in_file_names() {
     let resp = req_path("/tests/core/spaces%20in%20file%20name.sql")
         .await
         .unwrap();
     assert_eq!(resp.status(), http::StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(body_str.contains("It works !"), "{body_str}");
 }
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index da2b689f0..93d7bfb5b 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -38,16 +38,127 @@ pub(crate) async fn get_request_to(path: &str) -> actix_web::Result<TestRequest>
 }
 
 pub(crate) async fn make_app_data_from_config(config: AppConfig) -> Data<AppState> {
-    let state = AppState::init(&config).await.unwrap();
+    let state = make_app_state_from_config(&config).await.unwrap();
     Data::new(state)
 }
 
+// Pools must be emptied while the test runtime is still running.
+//
+// Each request built with `TestRequest::to_srv_request()` leaks its
+// `Data<AppState>`: actix-web recycles the `HttpRequestInner` allocation into
+// a per-request pool on drop, and that pool is only drained by a real server,
+// never on the test path. The leaked `AppState` pins its database pool (and
+// its pooled connections) until process exit. The ODBC backend prepares and
+// caches a native statement for every distinct parameterized query, and
+// Oracle's ODBC driver deadlocks in its process destructor when connections
+// still hold native statements at exit.
+//
+// Note that `pool.close()` alone is not sufficient: it only closes idle
+// connections, so one still checked out (e.g. by a return-to-pool task
+// finishing the test's last request) would keep its cached statements alive.
+// Acquire every connection and clear its cache first to free those handles.
+thread_local! {
+    static TEST_POOLS: std::cell::RefCell<Vec<sqlx::any::AnyPool>> = const { std::cell::RefCell::new(Vec::new()) };
+}
+
+pub(crate) struct TestSystem(actix_web::rt::SystemRunner);
+
+impl TestSystem {
+    pub(crate) fn new() -> Self {
+        Self(actix_web::rt::System::new())
+    }
+
+    pub(crate) fn block_on<F: Future>(&self, future: F) -> F::Output {
+        use futures_util::FutureExt as _;
+
+        self.0.block_on(async {
+            let result = std::panic::AssertUnwindSafe(future).catch_unwind().await;
+            // Empty every pool created by the test while the runtime is still
+            // alive, even if the test panicked. Clearing first releases cached
+            // prepared statements on connections that may still be checked out
+            // (which `close()` alone would leave behind); closing then
+            // disconnects each pooled connection. The pool objects themselves
+            // may stay alive (see above), but they are left empty.
+            let pools = TEST_POOLS.with(std::cell::RefCell::take);
+            for pool in pools {
+                use sqlx::connection::Connection as _;
+
+                let mut connections = Vec::new();
+                for _ in 0..pool.size() {
+                    let mut connection = pool.acquire().await.unwrap();
+                    connection.clear_cached_statements().await.unwrap();
+                    connections.push(connection);
+                }
+                drop(connections);
+                pool.close().await;
+            }
+            match result {
+                Ok(output) => output,
+                Err(panic) => std::panic::resume_unwind(panic),
+            }
+        })
+    }
+}
+
+pub(crate) async fn make_app_state_from_config(config: &AppConfig) -> anyhow::Result<AppState> {
+    let state = AppState::init(config).await?;
+    TEST_POOLS.with(|pools| pools.borrow_mut().push(state.db.connection.clone()));
+    Ok(state)
+}
+
+#[test]
+fn test_system_closes_pools_on_success_and_panic() {
+    for panic_in_test in [false, true] {
+        let system = TestSystem::new();
+        let mut pool = None;
+        let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            system.block_on(async {
+                let mut config = test_config();
+                config.database_url = "sqlite::memory:".to_owned();
+                let state = make_app_state_from_config(&config).await.unwrap();
+                pool = Some(state.db.connection.clone());
+                assert!(!panic_in_test, "intentional test panic");
+            });
+        }));
+        assert_eq!(result.is_err(), panic_in_test);
+        assert!(pool.unwrap().is_closed());
+    }
+}
+
+/// Reads a whole response body as a UTF-8 string, failing the test otherwise.
+pub(crate) async fn read_body_string<B>(resp: actix_web::dev::ServiceResponse<B>) -> String
+where
+    B: actix_web::body::MessageBody,
+{
+    String::from_utf8(actix_web::test::read_body(resp).await.to_vec()).unwrap()
+}
+
+/// Whether the database engine is one of `kinds`.
+/// Tests that only run on some engines return early otherwise.
+pub(crate) fn supports_database(
+    db: &sqlpage::webserver::database::Database,
+    kinds: &[sqlpage::webserver::database::SupportedDatabase],
+) -> bool {
+    kinds.contains(&db.info.database_type)
+}
+
 pub(crate) async fn make_app_data() -> Data<AppState> {
     init_log();
     let config = test_config();
     make_app_data_from_config(config).await
 }
 
+/// Creates test application state running in the given environment
+/// (development enables debug helpers like `Server-Timing`).
+pub(crate) async fn make_app_data_with_env(
+    environment: sqlpage::app_config::DevOrProd,
+) -> Data<AppState> {
+    init_log();
+    let mut config = test_config();
+    config.environment = environment;
+    make_app_data_from_config(config).await
+}
+
 pub(crate) async fn req_path(
     path: impl AsRef<str>,
 ) -> Result<actix_web::dev::ServiceResponse, actix_web::Error> {
@@ -76,9 +187,9 @@ async fn req_path_with_app_data_and_accept(
     accept: header::Accept,
 ) -> anyhow::Result<actix_web::dev::ServiceResponse> {
     let path = path.as_ref();
-    let req = TestRequest::get()
-        .uri(path)
-        .app_data(app_data)
+    let req = get_request_to_with_data(path, app_data)
+        .await
+        .map_err(|e| anyhow::anyhow!("Failed to build request for {path}: {e}"))?
         .insert_header(("cookie", "test_cook=123"))
         .insert_header(("authorization", "Basic dGVzdDp0ZXN0"))
         .insert_header(accept)
diff --git a/tests/core/mod.rs b/tests/core/mod.rs
index 6062d877c..036429e88 100644
--- a/tests/core/mod.rs
+++ b/tests/core/mod.rs
@@ -3,13 +3,48 @@ use sqlpage::{
     AppState,
     webserver::{self, make_placeholder},
 };
-use sqlx::executor::Executor as _;
 
 use crate::common::{make_app_data_from_config, req_path, req_path_with_app_data, test_config};
 
 mod path_aliases;
 
-#[actix_web::test]
+/// Creates the `sqlpage_files` table if needed and stores `contents` at `path`.
+/// Other tests share this database, so the table is never dropped.
+async fn store_file_in_db(state: &AppState, path: &str, contents: &[u8]) {
+    use sqlx::executor::Executor as _;
+
+    let create_table_sql =
+        sqlpage::filesystem::DbFsQueries::get_create_table_sql(state.db.info.database_type);
+    if state
+        .db
+        .connection
+        .execute("SELECT 1 FROM sqlpage_files WHERE 1 = 0")
+        .await
+        .is_err()
+    {
+        state.db.connection.execute(create_table_sql).await.unwrap();
+    }
+    let delete_sql = format!("DELETE FROM sqlpage_files WHERE path = '{path}'");
+    state
+        .db
+        .connection
+        .execute(delete_sql.as_str())
+        .await
+        .unwrap();
+    let insert_sql = format!(
+        "INSERT INTO sqlpage_files(path, contents) VALUES ({}, {})",
+        make_placeholder(state.db.info.kind, 1),
+        make_placeholder(state.db.info.kind, 2)
+    );
+    sqlx::query::query(&insert_sql)
+        .bind(path)
+        .bind(contents)
+        .execute(&state.db.connection)
+        .await
+        .unwrap();
+}
+
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_concurrent_requests() {
     let components = [
         "table", "form", "card", "datagrid", "hero", "list", "timeline",
@@ -28,12 +63,8 @@ async fn test_concurrent_requests() {
     for result in results {
         let resp = result.unwrap();
         assert_eq!(resp.status(), StatusCode::OK);
-        let body = test::read_body(resp).await;
-        assert!(
-            body.starts_with(b"<!DOCTYPE html>"),
-            "Expected html doctype"
-        );
-        let body = String::from_utf8(body.to_vec()).unwrap();
+        let body = crate::common::read_body_string(resp).await;
+        assert!(body.starts_with("<!DOCTYPE html>"), "Expected html doctype");
         assert!(
             body.contains("It works !"),
             "Expected to contain: It works !, but got: {body}"
@@ -42,13 +73,13 @@ async fn test_concurrent_requests() {
     }
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_datagrid_description_presence_controls_placeholder() {
     let resp = req_path("/tests/components/datagrid_icon_only.sql")
         .await
         .unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = String::from_utf8(test::read_body(resp).await.to_vec()).unwrap();
+    let body = crate::common::read_body_string(resp).await;
     assert!(body.contains("Facebook"), "{body}");
     assert!(body.contains("Empty"), "{body}");
     assert!(body.contains("Missing"), "{body}");
@@ -56,7 +87,7 @@ async fn test_datagrid_description_presence_controls_placeholder() {
     assert_eq!(body.matches('–').count(), 1, "{body}");
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_routing_with_db_fs() {
     let mut config = test_config();
     if config.database_url.contains("memory") {
@@ -64,52 +95,34 @@ async fn test_routing_with_db_fs() {
     }
 
     config.site_prefix = "/prefix/".to_string();
-    let state = AppState::init(&config).await.unwrap();
+    let state = crate::common::make_app_state_from_config(&config)
+        .await
+        .unwrap();
 
-    if matches!(
-        state.db.info.database_type,
-        webserver::database::SupportedDatabase::Oracle
+    if crate::common::supports_database(
+        &state.db,
+        &[webserver::database::SupportedDatabase::Oracle],
     ) {
         return;
     }
 
-    let create_table_sql =
-        sqlpage::filesystem::DbFsQueries::get_create_table_sql(state.db.info.database_type);
-    // Other tests share this database, so never drop a table their initialized state may use.
-    if state
-        .db
-        .connection
-        .execute("SELECT 1 FROM sqlpage_files WHERE 1 = 0")
-        .await
-        .is_err()
-    {
-        state.db.connection.execute(create_table_sql).await.unwrap();
-    }
-    state
-        .db
-        .connection
-        .execute("DELETE FROM sqlpage_files WHERE path = 'on_db.sql'")
-        .await
-        .unwrap();
-    let insert_sql = format!(
-        "INSERT INTO sqlpage_files(path, contents) VALUES ('on_db.sql', {})",
-        make_placeholder(state.db.info.kind, 1)
-    );
-    sqlx::query::query(&insert_sql)
-        .bind("select ''text'' as component, ''Hi from db !'' AS contents;".as_bytes())
-        .execute(&state.db.connection)
+    store_file_in_db(
+        &state,
+        "on_db.sql",
+        b"select ''text'' as component, ''Hi from db !'' AS contents;",
+    )
+    .await;
+
+    let state = crate::common::make_app_state_from_config(&config)
         .await
         .unwrap();
-
-    let state = AppState::init(&config).await.unwrap();
     let app_data = actix_web::web::Data::new(state);
 
     let resp = req_path_with_app_data("/prefix/on_db.sql", app_data.clone())
         .await
         .unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Hi from db !"),
         "{body_str}\nexpected to contain: Hi from db !"
@@ -117,7 +130,7 @@ async fn test_routing_with_db_fs() {
 }
 
 #[cfg(unix)]
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_non_unicode_static_path_returns_bad_request_with_db_fs() {
     let mut config = test_config();
     if !config.database_url.starts_with("sqlite") {
@@ -126,30 +139,15 @@ async fn test_non_unicode_static_path_returns_bad_request_with_db_fs() {
     config.database_url =
         "sqlite://file:test_non_unicode_static_path?mode=memory&cache=shared".to_string();
 
-    let state = AppState::init(&config).await.unwrap();
-    let expected_db_path = "\u{FFFD}.txt";
-    let mut conn = state.db.connection.acquire().await.unwrap();
-
-    (&mut *conn)
-        .execute(sqlpage::filesystem::DbFsQueries::get_create_table_sql(
-            webserver::database::SupportedDatabase::Sqlite,
-        ))
+    let state = crate::common::make_app_state_from_config(&config)
         .await
         .unwrap();
-    let insert_sql = format!(
-        "INSERT INTO sqlpage_files(path, contents) VALUES ({}, {})",
-        make_placeholder(state.db.info.kind, 1),
-        make_placeholder(state.db.info.kind, 2)
-    );
-    sqlx::query::query(&insert_sql)
-        .bind(expected_db_path)
-        .bind("file from db fs".as_bytes())
-        .execute(&mut *conn)
+    let expected_db_path = "\u{FFFD}.txt";
+    store_file_in_db(&state, expected_db_path, b"file from db fs").await;
+
+    let state = crate::common::make_app_state_from_config(&config)
         .await
         .unwrap();
-    drop(conn);
-
-    let state = AppState::init(&config).await.unwrap();
     let app_data = actix_web::web::Data::new(state);
     let req = test::TestRequest::get()
         .uri("/%FF.txt")
@@ -165,11 +163,13 @@ async fn test_non_unicode_static_path_returns_bad_request_with_db_fs() {
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_routing_with_prefix() {
     let mut config = test_config();
     config.site_prefix = "/prefix/".to_string();
-    let state = AppState::init(&config).await.unwrap();
+    let state = crate::common::make_app_state_from_config(&config)
+        .await
+        .unwrap();
 
     let app_data = actix_web::web::Data::new(state);
     let resp = req_path_with_app_data(
@@ -179,8 +179,7 @@ async fn test_routing_with_prefix() {
     .await
     .unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("It works !"),
         "{body_str}\nexpected to contain: It works !"
@@ -193,8 +192,7 @@ async fn test_routing_with_prefix() {
     let resp = req_path_with_app_data("/prefix/nonexistent.sql", app_data.clone())
         .await
         .expect("should handle 404");
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("404"),
         "Response should contain \"404\", but got:\n{body_str}"
@@ -220,7 +218,7 @@ async fn test_routing_with_prefix() {
     assert_eq!(location.to_str().unwrap(), "/prefix/");
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_hidden_files() {
     let resp_result = req_path("/tests/core/.hidden.sql").await;
     assert!(
@@ -238,7 +236,7 @@ async fn test_hidden_files() {
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_official_website_documentation() {
     let app_data = make_app_data_for_official_website().await;
     let resp = req_path_with_app_data("/component.sql?component=button", app_data)
@@ -247,15 +245,14 @@ async fn test_official_website_documentation() {
             panic!("Failed to get response for /component.sql?component=button: {e}")
         });
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains(r#"<button type="submit" form="poem" formaction="?action"#),
         "{body_str}\nexpected to contain a button with formaction"
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_official_website_basic_auth_example() {
     let resp = req_path_with_app_data(
         "/examples/authentication/basic_auth.sql",
@@ -264,8 +261,7 @@ async fn test_official_website_basic_auth_example() {
     .await
     .unwrap();
     assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Unauthorized"),
         "{body_str}\nexpected to contain Unauthorized"
diff --git a/tests/core/path_aliases.rs b/tests/core/path_aliases.rs
index a83b3f68a..36bb6ad13 100644
--- a/tests/core/path_aliases.rs
+++ b/tests/core/path_aliases.rs
@@ -19,12 +19,12 @@ async fn assert_sql_response(path: &str, expected_status: StatusCode) {
     }
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn mixed_case_sql_file_is_executed() {
     assert_sql_response("/tests/core/mixed_case.%53ql", StatusCode::OK).await;
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn trailing_space_sql_path_is_forbidden() {
     assert_sql_response("/tests/core/sql_source.sql%20", StatusCode::FORBIDDEN).await;
 }
@@ -38,19 +38,19 @@ async fn assert_windows_alias_response(path: &str, expected_status: StatusCode)
 }
 
 #[cfg(windows)]
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn windows_mixed_case_sql_alias_is_executed() {
     assert_windows_alias_response("/tests/core/sql_source.SQL", StatusCode::OK).await;
 }
 
 #[cfg(windows)]
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn windows_trailing_dot_sql_alias_is_forbidden() {
     assert_windows_alias_response("/tests/core/sql_source.sql.", StatusCode::FORBIDDEN).await;
 }
 
 #[cfg(windows)]
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn windows_ntfs_stream_sql_alias_is_forbidden() {
     assert_windows_alias_response("/tests/core/sql_source.sql::$DATA", StatusCode::FORBIDDEN).await;
 }
diff --git a/tests/data_formats/mod.rs b/tests/data_formats/mod.rs
index 7c6c3d2f1..84868d7fc 100644
--- a/tests/data_formats/mod.rs
+++ b/tests/data_formats/mod.rs
@@ -10,7 +10,14 @@ async fn req_with_accept(
     path: &str,
     accept: &str,
 ) -> actix_web::Result<actix_web::dev::ServiceResponse> {
-    let app_data = make_app_data().await;
+    req_with_accept_and_data(path, accept, make_app_data().await).await
+}
+
+async fn req_with_accept_and_data(
+    path: &str,
+    accept: &str,
+    app_data: actix_web::web::Data<sqlpage::AppState>,
+) -> actix_web::Result<actix_web::dev::ServiceResponse> {
     let req = TestRequest::get()
         .uri(path)
         .insert_header((header::ACCEPT, accept))
@@ -19,7 +26,7 @@ async fn req_with_accept(
     main_handler(req).await
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_json_body() -> actix_web::Result<()> {
     let req = get_request_to("/tests/data_formats/json_data.sql")
         .await?
@@ -39,12 +46,12 @@ async fn test_json_body() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_csv_body() -> actix_web::Result<()> {
     let app_data = make_app_data().await;
-    if matches!(
-        app_data.db.info.database_type,
-        sqlpage::webserver::database::SupportedDatabase::Oracle
+    if crate::common::supports_database(
+        &app_data.db,
+        &[sqlpage::webserver::database::SupportedDatabase::Oracle],
     ) {
         return Ok(());
     }
@@ -59,8 +66,7 @@ async fn test_csv_body() -> actix_web::Result<()> {
         resp.headers().get(header::CONTENT_TYPE).unwrap(),
         "text/csv; charset=utf-8"
     );
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert_eq!(
         body_str,
         "id;msg\n0;Hello World !\n1;\"Tu gères ';' et '\"\"' ?\"\n"
@@ -68,7 +74,7 @@ async fn test_csv_body() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_csv_filename_header_injection() -> actix_web::Result<()> {
     use actix_web::http::header::ContentDisposition;
 
@@ -107,22 +113,26 @@ async fn test_csv_filename_header_injection() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_json_columns() {
     let app_data = make_app_data().await;
-    if !matches!(
-        app_data.db.to_string().to_lowercase().as_str(),
-        "postgres" | "sqlite"
+    if !crate::common::supports_database(
+        &app_data.db,
+        &[
+            sqlpage::webserver::database::SupportedDatabase::Postgres,
+            sqlpage::webserver::database::SupportedDatabase::Sqlite,
+        ],
     ) {
         log::info!("Skipping test_json_columns on database {}", app_data.db);
         return;
     }
 
-    let resp_result = crate::common::req_path("/tests/data_formats/json_columns.sql").await;
-    let resp = resp_result.expect("Failed to request /tests/data_formats/json_columns.sql");
+    let resp =
+        crate::common::req_path_with_app_data("/tests/data_formats/json_columns.sql", app_data)
+            .await
+            .expect("Failed to request /tests/data_formats/json_columns.sql");
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     let body_html_escaped = body_str.replace("&quot;", "\"");
     assert!(
         !body_html_escaped.contains("error"),
@@ -140,7 +150,7 @@ async fn test_json_columns() {
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_accept_json_returns_json_array() -> actix_web::Result<()> {
     let resp = req_with_accept(
         "/tests/sql_test_files/component_rendering/simple.sql",
@@ -161,7 +171,7 @@ async fn test_accept_json_returns_json_array() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_accept_ndjson_returns_jsonlines() -> actix_web::Result<()> {
     let resp = req_with_accept(
         "/tests/sql_test_files/component_rendering/simple.sql",
@@ -173,8 +183,7 @@ async fn test_accept_ndjson_returns_jsonlines() -> actix_web::Result<()> {
         resp.headers().get(header::CONTENT_TYPE).unwrap(),
         "application/x-ndjson"
     );
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     let lines: Vec<&str> = body_str.trim().lines().collect();
     assert!(lines.len() >= 2);
     assert_eq!(
@@ -188,7 +197,7 @@ async fn test_accept_ndjson_returns_jsonlines() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_accept_html_returns_html() -> actix_web::Result<()> {
     let resp = req_with_accept(
         "/tests/sql_test_files/component_rendering/simple.sql",
@@ -205,7 +214,7 @@ async fn test_accept_html_returns_html() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_accept_wildcard_returns_html() -> actix_web::Result<()> {
     let resp = req_with_accept(
         "/tests/sql_test_files/component_rendering/simple.sql",
@@ -220,7 +229,7 @@ async fn test_accept_wildcard_returns_html() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_accept_json_redirect_still_works() -> actix_web::Result<()> {
     let resp =
         req_with_accept("/tests/server_timing/redirect_test.sql", "application/json").await?;
@@ -234,24 +243,22 @@ async fn test_accept_json_redirect_still_works() -> actix_web::Result<()> {
 
 /// Builds an `AppState` running in production mode.
 async fn make_prod_app_data() -> actix_web::web::Data<sqlpage::AppState> {
-    crate::common::init_log();
-    let mut config = crate::common::test_config();
-    config.environment = sqlpage::app_config::DevOrProd::Production;
-    crate::common::make_app_data_from_config(config).await
+    crate::common::make_app_data_with_env(sqlpage::app_config::DevOrProd::Production).await
 }
 
-async fn req_prod_with_accept(path: &str, accept: &str) -> String {
-    let app_data = make_prod_app_data().await;
-    let req = TestRequest::get()
-        .uri(path)
-        .insert_header((header::ACCEPT, accept))
-        .app_data(app_data)
-        .to_srv_request();
-    let resp = main_handler(req)
+async fn response_body_with_accept(
+    path: &str,
+    accept: &str,
+    app_data: actix_web::web::Data<sqlpage::AppState>,
+) -> String {
+    let resp = req_with_accept_and_data(path, accept, app_data)
         .await
         .expect("request should not fail at the handler level");
-    let body = test::read_body(resp).await;
-    String::from_utf8(body.to_vec()).unwrap()
+    crate::common::read_body_string(resp).await
+}
+
+async fn req_prod_body(path: &str, accept: &str) -> String {
+    response_body_with_accept(path, accept, make_prod_app_data().await).await
 }
 
 /// In production, a SQL error that happens mid-stream must not leak the SQL
@@ -274,9 +281,9 @@ fn assert_no_sql_leak(body: &str, context: &str) {
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_prod_json_error_does_not_leak_sql() {
-    let body = req_prod_with_accept(
+    let body = req_prod_body(
         "/tests/data_formats/json_error_leak.sql",
         "application/json",
     )
@@ -288,23 +295,21 @@ async fn test_prod_json_error_does_not_leak_sql() {
     assert_no_sql_leak(&body, "json error");
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_prod_csv_error_does_not_leak_sql() {
     let app_data = make_prod_app_data().await;
-    if matches!(
-        app_data.db.info.database_type,
-        sqlpage::webserver::database::SupportedDatabase::Oracle
+    if crate::common::supports_database(
+        &app_data.db,
+        &[sqlpage::webserver::database::SupportedDatabase::Oracle],
     ) {
         return;
     }
-    let req = TestRequest::get()
-        .uri("/tests/data_formats/csv_error_leak.sql")
-        .insert_header((header::ACCEPT, "text/csv"))
-        .app_data(app_data)
-        .to_srv_request();
-    let resp = main_handler(req).await.expect("handler should not fail");
-    let body = test::read_body(resp).await;
-    let body = String::from_utf8(body.to_vec()).unwrap();
+    let body = response_body_with_accept(
+        "/tests/data_formats/csv_error_leak.sql",
+        "text/csv",
+        app_data,
+    )
+    .await;
     assert!(
         body.contains("before the error"),
         "the good row should still be streamed: {body}"
@@ -315,23 +320,21 @@ async fn test_prod_csv_error_does_not_leak_sql() {
 /// A CSV page can hit an error before its first data row (so no header has been
 /// written and `columns` is empty). The generic error message must still be
 /// emitted instead of an empty record.
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_prod_csv_error_before_any_row_still_reports() {
     let app_data = make_prod_app_data().await;
-    if matches!(
-        app_data.db.info.database_type,
-        sqlpage::webserver::database::SupportedDatabase::Oracle
+    if crate::common::supports_database(
+        &app_data.db,
+        &[sqlpage::webserver::database::SupportedDatabase::Oracle],
     ) {
         return;
     }
-    let req = TestRequest::get()
-        .uri("/tests/data_formats/csv_error_no_rows.sql")
-        .insert_header((header::ACCEPT, "text/csv"))
-        .app_data(app_data)
-        .to_srv_request();
-    let resp = main_handler(req).await.expect("handler should not fail");
-    let body = test::read_body(resp).await;
-    let body = String::from_utf8(body.to_vec()).unwrap();
+    let body = response_body_with_accept(
+        "/tests/data_formats/csv_error_no_rows.sql",
+        "text/csv",
+        app_data,
+    )
+    .await;
     assert!(
         body.to_lowercase().contains("administrator"),
         "csv error before the first row must still emit the generic error message: {body:?}"
@@ -342,9 +345,9 @@ async fn test_prod_csv_error_before_any_row_still_reports() {
 /// An author may only intend a page to be served as HTML, but a client can
 /// request it with `Accept: application/json` and pick the JSON renderer.
 /// In production that path must not leak SQL text either.
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_prod_html_page_requested_as_json_does_not_leak_sql() {
-    let body = req_prod_with_accept(
+    let body = req_prod_body(
         "/tests/data_formats/text_error_leak.sql",
         "application/json",
     )
diff --git a/tests/errors/basic_auth.rs b/tests/errors/basic_auth.rs
index 69330691a..337676b92 100644
--- a/tests/errors/basic_auth.rs
+++ b/tests/errors/basic_auth.rs
@@ -1,8 +1,8 @@
 use crate::common::{get_request_to, req_path};
-use actix_web::{http::StatusCode, test};
+use actix_web::http::StatusCode;
 use sqlpage::webserver::http::main_handler;
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_basic_auth_not_provided() {
     let resp_result = req_path("/tests/errors/basic_auth.sql").await;
     let resp = resp_result.unwrap();
@@ -11,8 +11,7 @@ async fn test_basic_auth_not_provided() {
         resp.headers().get("www-authenticate").unwrap(),
         "Basic realm=\"Authentication required\", charset=\"UTF-8\""
     );
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Unauthorized"),
         "{body_str}\nexpected to contain Unauthorized"
@@ -23,7 +22,7 @@ async fn test_basic_auth_not_provided() {
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_basic_auth_with_credentials() {
     let req = get_request_to("/tests/errors/basic_auth.sql")
         .await
@@ -34,8 +33,7 @@ async fn test_basic_auth_with_credentials() {
         .await
         .expect("req with credentials should succeed");
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Success!"),
         "{body_str}\nexpected to contain Success"
diff --git a/tests/errors/invalid_header.rs b/tests/errors/invalid_header.rs
index 73bf8dc46..76902accb 100644
--- a/tests/errors/invalid_header.rs
+++ b/tests/errors/invalid_header.rs
@@ -1,5 +1,5 @@
 use crate::common::req_path;
-use actix_web::{http::StatusCode, test};
+use actix_web::http::StatusCode;
 use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode};
 use serde_json::{Value, json};
 
@@ -27,8 +27,7 @@ async fn assert_invalid_header_response(case: &InvalidHeaderCase) {
         case.name
     );
 
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.to_lowercase().contains("error"),
         "{} should render an error response body, got:\n{body_str}",
@@ -36,7 +35,7 @@ async fn assert_invalid_header_response(case: &InvalidHeaderCase) {
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_invalid_header_components_return_an_error_response() {
     let cases = vec![
         InvalidHeaderCase {
diff --git a/tests/errors/mod.rs b/tests/errors/mod.rs
index a6bfe55a6..a528f3182 100644
--- a/tests/errors/mod.rs
+++ b/tests/errors/mod.rs
@@ -30,7 +30,7 @@ async fn direct_request_status(path: &str, app_data: actix_web::web::Data<AppSta
 /// that same reserved path must still be rejected with 403, even while the cache
 /// entry is fresh. Before the fix, the fresh cache hit short-circuited the
 /// unprivileged path guard and the private SQL was executed and served.
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_private_path_not_accessible_after_privileged_cache_priming() {
     // Keep cache entries "fresh" so the bug (skipping the path guard on fresh hits) is exercised.
     let mut config = test_config();
@@ -42,7 +42,7 @@ async fn test_private_path_not_accessible_after_privileged_cache_priming() {
         .await
         .expect("priming page should render");
     assert_eq!(prime.status(), StatusCode::OK);
-    let prime_body = String::from_utf8(test::read_body(prime).await.to_vec()).unwrap();
+    let prime_body = crate::common::read_body_string(prime).await;
     assert!(
         prime_body.contains("private cache bypass secret"),
         "priming page should have executed the private file via run_sql, got: {prime_body}"
@@ -63,7 +63,7 @@ async fn test_private_path_not_accessible_after_privileged_cache_priming() {
     }
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_privileged_paths_are_not_accessible() {
     let resp_result = req_path("/sqlpage/migrations/0001_init.sql").await;
     assert!(
@@ -81,100 +81,50 @@ async fn test_privileged_paths_are_not_accessible() {
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_404_fallback() {
+    let app_data = crate::common::make_app_data().await;
     for f in [
         "/tests/errors/does_not_exist.sql",
         "/tests/errors/does_not_exist.html",
         "/tests/errors/does_not_exist/",
     ] {
-        let resp_result = req_path(f).await;
-        let resp = resp_result.unwrap();
+        let resp = req_path_with_app_data(f, app_data.clone()).await.unwrap();
         assert_eq!(resp.status(), StatusCode::OK, "{f} isnt 200");
-
-        let body = test::read_body(resp).await;
-        assert!(body.starts_with(b"<!DOCTYPE html>"));
-        let body = String::from_utf8(body.to_vec()).unwrap();
-        assert!(body.contains("But the "));
-        assert!(body.contains("404.sql"));
-        assert!(body.contains("file saved the day!"));
-        assert!(!body.contains("error"));
+        let body = crate::common::read_body_string(resp).await;
+        assert!(body.starts_with("<!DOCTYPE html>"));
+        for marker in ["But the ", "404.sql", "file saved the day!"] {
+            assert!(body.contains(marker), "{f} should contain {marker:?}");
+        }
+        assert!(!body.contains("error"), "{f} should not contain an error");
     }
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_default_404() {
+    let app_data = crate::common::make_app_data().await;
+    let msg = "The page you were looking for does not exist";
     for f in [
         "/i-do-not-exist.html",
         "/i-do-not-exist.sql",
         "/i-do-not-exist/",
+        "/i-do-not-exist",
+        "/tests/it_works.txt/site/wp-includes/wlwmanifest.xml",
     ] {
-        let resp_result = req_path(f).await;
-        let resp = resp_result.unwrap();
+        let resp = req_path_with_app_data(f, app_data.clone()).await.unwrap();
         assert_eq!(
             resp.status(),
             StatusCode::NOT_FOUND,
             "{f} should return 404"
         );
-
-        let body = test::read_body(resp).await;
-        assert!(body.starts_with(b"<!DOCTYPE html>"));
-        let body = String::from_utf8(body.to_vec()).unwrap();
-        let msg = "The page you were looking for does not exist";
-        assert!(
-            body.contains(msg),
-            "{f} should contain '{msg}' but got:\n{body}"
-        );
-        assert!(!body.contains("error"));
+        let body = crate::common::read_body_string(resp).await;
+        assert!(body.starts_with("<!DOCTYPE html>"), "{f} is not HTML");
+        assert!(body.contains(msg), "{f} should contain {msg:?}");
+        assert!(!body.contains("error"), "{f} should not contain an error");
     }
 }
 
-#[actix_web::test]
-async fn test_default_404_with_redirect() {
-    let resp_result = req_path("/i-do-not-exist").await;
-    let resp = resp_result.unwrap();
-    assert_eq!(
-        resp.status(),
-        StatusCode::NOT_FOUND,
-        "/i-do-not-exist should return 404"
-    );
-
-    let resp_result = req_path("/i-do-not-exist/").await;
-    let resp = resp_result.unwrap();
-    assert_eq!(
-        resp.status(),
-        StatusCode::NOT_FOUND,
-        "/i-do-not-exist/ should return 404"
-    );
-
-    let body = test::read_body(resp).await;
-    assert!(body.starts_with(b"<!DOCTYPE html>"));
-    let body = String::from_utf8(body.to_vec()).unwrap();
-    let msg = "The page you were looking for does not exist";
-    assert!(
-        body.contains(msg),
-        "/i-do-not-exist/ should contain '{msg}' but got:\n{body}"
-    );
-    assert!(!body.contains("error"));
-}
-
-#[actix_web::test]
-async fn test_default_404_when_request_path_descends_into_file() {
-    let resp_result = req_path("/tests/it_works.txt/site/wp-includes/wlwmanifest.xml").await;
-    let resp = resp_result.unwrap();
-    assert_eq!(
-        resp.status(),
-        StatusCode::NOT_FOUND,
-        "descending into a file path should behave like a missing resource"
-    );
-
-    let body = test::read_body(resp).await;
-    let body = String::from_utf8(body.to_vec()).unwrap();
-    assert!(body.contains("The page you were looking for does not exist"));
-    assert!(!body.contains("error"));
-}
-
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_requesting_a_directory_is_not_found() {
     let resp_result = req_path("/tests/errors/is_a_directory.d").await;
     let status = match resp_result {
diff --git a/tests/exec/mod.rs b/tests/exec/mod.rs
index 6eb8fa865..5b4c9c13a 100644
--- a/tests/exec/mod.rs
+++ b/tests/exec/mod.rs
@@ -1,7 +1,7 @@
 use actix_web::{http::header, test::TestRequest};
 use sqlpage::webserver::http::main_handler;
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_exec() {
     let app_data = crate::common::make_app_data().await;
     let req = TestRequest::get()
diff --git a/tests/oidc/mod.rs b/tests/oidc/mod.rs
index 4eba0421c..ef31a8269 100644
--- a/tests/oidc/mod.rs
+++ b/tests/oidc/mod.rs
@@ -6,8 +6,7 @@ use actix_web::{
     web::{self, Data},
 };
 use base64::Engine;
-use openidconnect::url::Url;
-use serde::{Deserialize, Serialize};
+use openidconnect::{IssuerUrl, url::Url};
 use serde_json::json;
 use sqlpage::webserver::http::create_app;
 use std::collections::HashMap;
@@ -55,47 +54,21 @@ struct ProviderState<'a> {
     discovery_count: usize,
 }
 
-type ProviderStateWithLifetime<'a> = ProviderState<'a>;
-type SharedProviderState = Arc<Mutex<ProviderStateWithLifetime<'static>>>;
-
-#[derive(Serialize, Deserialize)]
-struct DiscoveryResponse {
-    issuer: String,
-    authorization_endpoint: String,
-    token_endpoint: String,
-    jwks_uri: String,
-    response_types_supported: Vec<String>,
-    subject_types_supported: Vec<String>,
-    id_token_signing_alg_values_supported: Vec<String>,
-    end_session_endpoint: String,
-}
-
-#[derive(Serialize)]
-struct JwksResponse {
-    keys: Vec<serde_json::Value>,
-}
-
-#[derive(Serialize)]
-struct TokenResponse {
-    access_token: String,
-    token_type: String,
-    id_token: String,
-    expires_in: i64,
-}
+type SharedProviderState = Arc<Mutex<ProviderState<'static>>>;
 
 async fn discovery_endpoint(state: Data<SharedProviderState>) -> impl Responder {
     let mut state = state.lock().unwrap();
     state.discovery_count += 1;
-    let discovery = DiscoveryResponse {
-        issuer: state.issuer_url.clone(),
-        authorization_endpoint: format!("{}/auth", state.issuer_url),
-        token_endpoint: format!("{}/token", state.issuer_url),
-        jwks_uri: format!("{}/jwks", state.issuer_url),
-        response_types_supported: vec!["code".to_string()],
-        subject_types_supported: vec!["public".to_string()],
-        id_token_signing_alg_values_supported: vec!["HS256".to_string()],
-        end_session_endpoint: format!("{}/logout", state.issuer_url),
-    };
+    let discovery = json!({
+        "issuer": state.issuer_url,
+        "authorization_endpoint": format!("{}/auth", state.issuer_url),
+        "token_endpoint": format!("{}/token", state.issuer_url),
+        "jwks_uri": format!("{}/jwks", state.issuer_url),
+        "response_types_supported": ["code"],
+        "subject_types_supported": ["public"],
+        "id_token_signing_alg_values_supported": ["HS256"],
+        "end_session_endpoint": format!("{}/logout", state.issuer_url),
+    });
     drop(state);
     HttpResponse::Ok()
         .insert_header((header::CONTENT_TYPE, "application/json"))
@@ -104,15 +77,15 @@ async fn discovery_endpoint(state: Data<SharedProviderState>) -> impl Responder
 
 async fn jwks_endpoint(state: Data<SharedProviderState>) -> impl Responder {
     let state = state.lock().unwrap();
-    let jwks = JwksResponse {
-        keys: vec![json!({
+    let jwks = json!({
+        "keys": [{
             "kty": "oct",
             "kid": "test",
             "use": "sig",
             "alg": "HS256",
             "k": base64url_encode(state.secret.as_bytes())
-        })],
-    };
+        }]
+    });
     HttpResponse::Ok()
         .insert_header((header::CONTENT_TYPE, "application/json"))
         .json(jwks)
@@ -149,12 +122,12 @@ async fn token_endpoint(
     let delay = state.token_endpoint_delay;
     drop(state);
 
-    let response = TokenResponse {
-        access_token: "test_access_token".to_string(),
-        token_type: "Bearer".to_string(),
-        id_token,
-        expires_in: 3600,
-    };
+    let response = json!({
+        "access_token": "test_access_token",
+        "token_type": "Bearer",
+        "id_token": id_token,
+        "expires_in": 3600,
+    });
 
     let json_bytes = serde_json::to_vec(&response).unwrap();
     let body = futures_util::stream::once(async move {
@@ -324,6 +297,97 @@ async fn setup_oidc_test(
     setup_oidc_test_with_paths(provider_mutator, &["/"], &[]).await
 }
 
+/// Builds an OIDC test config on top of [`crate::common::test_config`],
+/// so all tests share the base settings (pool size, timeouts, ...).
+fn oidc_test_config(
+    provider: &FakeOidcProvider,
+    protected_paths: &[&str],
+    public_paths: &[&str],
+) -> sqlpage::app_config::AppConfig {
+    let mut config = crate::common::test_config();
+    config.oidc_issuer_url = Some(IssuerUrl::new(provider.issuer_url.clone()).unwrap());
+    config.oidc_client_id.clone_from(&provider.client_id);
+    config.oidc_client_secret = Some(provider.client_secret.clone());
+    config.oidc_protected_paths = protected_paths.iter().map(ToString::to_string).collect();
+    config.oidc_public_paths = public_paths.iter().map(ToString::to_string).collect();
+    config
+}
+
+/// Result of driving a full OIDC login flow in a test.
+struct OidcLogin<B> {
+    /// The initial redirect to the identity provider.
+    initial_response: actix_web::dev::ServiceResponse<B>,
+    /// The response of following the authorization callback.
+    callback_response: actix_web::dev::ServiceResponse<B>,
+}
+
+/// Runs the first half of the login flow: GET the protected page and build
+/// the authorization callback URI for `code`, storing it at the provider.
+/// `state_override` tampers with the state sent back to the callback.
+async fn begin_login<S, B>(
+    app: &S,
+    provider: &FakeOidcProvider,
+    cookies: &mut Vec<Cookie<'static>>,
+    code: &str,
+    state_override: Option<&str>,
+) -> (actix_web::dev::ServiceResponse<B>, Url, String)
+where
+    S: actix_web::dev::Service<
+            actix_http::Request,
+            Response = actix_web::dev::ServiceResponse<B>,
+            Error = actix_web::Error,
+        >,
+    B: actix_web::body::MessageBody,
+{
+    let initial_response = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
+    assert_eq!(initial_response.status(), StatusCode::SEE_OTHER);
+    let auth_url = Url::parse(
+        initial_response
+            .headers()
+            .get("location")
+            .unwrap()
+            .to_str()
+            .unwrap(),
+    )
+    .unwrap();
+    let state = get_query_param(&auth_url, "state");
+    let nonce = get_query_param(&auth_url, "nonce");
+    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
+    provider.store_auth_code(code.to_string(), nonce);
+    let callback_state = state_override.unwrap_or(&state).to_string();
+    let callback_uri = format!(
+        "{}?code={code}&state={callback_state}",
+        Url::parse(&redirect_uri).unwrap().path(),
+    );
+    (initial_response, auth_url, callback_uri)
+}
+
+/// Performs a full OIDC login with `code` and returns every step.
+async fn complete_login<S, B>(
+    app: &S,
+    provider: &FakeOidcProvider,
+    cookies: &mut Vec<Cookie<'static>>,
+    code: &str,
+    state_override: Option<&str>,
+) -> OidcLogin<B>
+where
+    S: actix_web::dev::Service<
+            actix_http::Request,
+            Response = actix_web::dev::ServiceResponse<B>,
+            Error = actix_web::Error,
+        >,
+    B: actix_web::body::MessageBody,
+{
+    let (initial_response, _, callback_uri) =
+        begin_login(app, provider, cookies, code, state_override).await;
+    let callback_response =
+        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
+    OidcLogin {
+        initial_response,
+        callback_response,
+    }
+}
+
 async fn setup_oidc_test_with_paths(
     provider_mutator: impl FnOnce(&mut ProviderState<'_>),
     protected_paths: &[&str],
@@ -336,44 +400,20 @@ async fn setup_oidc_test_with_paths(
     >,
     FakeOidcProvider,
 ) {
-    use sqlpage::{
-        AppState,
-        app_config::{AppConfig, test_database_url},
-    };
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
     provider.with_state_mut(provider_mutator);
-
-    let db_url = test_database_url();
-    let protected_paths = serde_json::to_string(protected_paths).unwrap();
-    let public_paths = serde_json::to_string(public_paths).unwrap();
-    let config_json = format!(
-        r#"{{
-        "database_url": "{db_url}",
-        "max_database_pool_connections": 1,
-        "database_connection_retries": 3,
-        "database_connection_acquire_timeout_seconds": 15,
-        "allow_exec": true,
-        "max_uploaded_file_size": 123456,
-        "listen_on": "127.0.0.1:0",
-        "system_root_ca_certificates": false,
-        "oidc_issuer_url": "{}",
-        "oidc_client_id": "{}",
-        "oidc_client_secret": "{}",
-        "oidc_protected_paths": {protected_paths},
-        "oidc_public_paths": {public_paths},
-        "host": "localhost:1"
-    }}"#,
-        provider.issuer_url, provider.client_id, provider.client_secret
-    );
-
-    let config: AppConfig = serde_json::from_str(&config_json).unwrap();
-    let app_state = AppState::init(&config).await.unwrap();
+    let mut config = oidc_test_config(&provider, protected_paths, public_paths);
+    config.listen_on = Some("127.0.0.1:0".parse().unwrap());
+    config.host = Some("localhost:1".to_string());
+    let app_state = crate::common::make_app_state_from_config(&config)
+        .await
+        .unwrap();
     let app = test::init_service(create_app(Data::new(app_state))).await;
     (app, provider)
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_public_clean_url_cannot_execute_a_protected_sql_file() {
     let file = "/tests/sql_test_files/data/regex_match_routing.sql";
     let protected_paths = [file];
@@ -390,7 +430,7 @@ async fn test_public_clean_url_cannot_execute_a_protected_sql_file() {
     assert_ne!(public.status(), StatusCode::SEE_OTHER);
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_top_level_builtin_assets_are_accessible_without_login_when_protected() {
     let protected_paths = ["/sqlpage."];
     let (app, _provider) = setup_oidc_test_with_paths(|_| {}, &protected_paths, &[]).await;
@@ -398,7 +438,7 @@ async fn test_top_level_builtin_assets_are_accessible_without_login_when_protect
 
     let homepage = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
     assert_ne!(homepage.status(), StatusCode::SEE_OTHER);
-    let homepage = String::from_utf8(test::read_body(homepage).await.to_vec()).unwrap();
+    let homepage = crate::common::read_body_string(homepage).await;
     let script_src = homepage
         .split_once("src=\"/sqlpage.")
         .and_then(|(_, rest)| rest.split_once('"'))
@@ -413,7 +453,7 @@ async fn test_top_level_builtin_assets_are_accessible_without_login_when_protect
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_cached_authorization_redirect_cannot_replay_consumed_state() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
@@ -421,26 +461,17 @@ async fn test_oidc_cached_authorization_redirect_cannot_replay_consumed_state()
     // Reproduces https://github.com/sqlpage/SQLPage/issues/1341: Chrome's
     // private cache can replay a cached 303 without reapplying Set-Cookie
     // headers, causing the browser to retry an already-consumed OIDC state.
-    let initial_response = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    let initial_auth_url = Url::parse(
-        initial_response
-            .headers()
-            .get(header::LOCATION)
-            .unwrap()
-            .to_str()
-            .unwrap(),
-    )
-    .unwrap();
+    let (initial_response, initial_auth_url, callback_uri) =
+        begin_login(&app, &provider, &mut cookies, "first-code", None).await;
     let cached_authorization_url =
         permits_storage_after_proxy_adds_freshness(initial_response.headers())
             .then_some(initial_auth_url.clone());
 
-    let state = get_query_param(&initial_auth_url, "state");
     let nonce = get_query_param(&initial_auth_url, "nonce");
-    let redirect_uri = get_query_param(&initial_auth_url, "redirect_uri");
-    let callback_path = Url::parse(&redirect_uri).unwrap().path().to_owned();
-    provider.store_auth_code("first-code".to_string(), nonce.clone());
-    let callback_uri = format!("{callback_path}?code=first-code&state={state}");
+    let callback_path = Url::parse(&get_query_param(&initial_auth_url, "redirect_uri"))
+        .unwrap()
+        .path()
+        .to_owned();
     let callback_response =
         request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
     assert_eq!(callback_response.status(), StatusCode::SEE_OTHER);
@@ -475,32 +506,22 @@ async fn test_oidc_cached_authorization_redirect_cannot_replay_consumed_state()
     assert_eq!(final_response.status(), StatusCode::OK);
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_happy_path() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
+    let login = complete_login(&app, &provider, &mut cookies, "test_auth_code", None).await;
     assert_eq!(
-        resp.headers().get(header::CACHE_CONTROL).unwrap(),
+        login
+            .initial_response
+            .headers()
+            .get(header::CACHE_CONTROL)
+            .unwrap(),
         "no-store",
         "the authorization redirect contains a one-time state and must not be cached"
     );
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-
-    let state = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
-
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        state
-    );
-    let callback_resp =
-        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
+    let callback_resp = login.callback_response;
     assert_eq!(callback_resp.status(), StatusCode::SEE_OTHER);
     assert_eq!(
         callback_resp.headers().get(header::CACHE_CONTROL).unwrap(),
@@ -530,29 +551,20 @@ async fn test_oidc_happy_path() {
 
 async fn assert_oidc_login_fails(
     provider_mutator: impl FnOnce(&mut ProviderState<'_>),
-    state_override: Option<String>,
+    state_override: Option<&str>,
 ) {
     let (app, provider) = setup_oidc_test(provider_mutator).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-
-    let state = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
-
-    let callback_state = state_override.unwrap_or(state);
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        callback_state
-    );
-    let callback_resp =
-        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
-
+    let login = complete_login(
+        &app,
+        &provider,
+        &mut cookies,
+        "test_auth_code",
+        state_override,
+    )
+    .await;
+    let callback_resp = login.callback_response;
     assert_eq!(callback_resp.status(), StatusCode::SEE_OTHER);
     let location = callback_resp
         .headers()
@@ -588,12 +600,12 @@ async fn assert_oidc_callback_fails_with_bad_jwt(
     .await;
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_csrf_state_mismatch_is_rejected() {
-    assert_oidc_login_fails(|_| {}, Some("wrong_state".to_string())).await;
+    assert_oidc_login_fails(|_| {}, Some("wrong_state")).await;
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_nonce_mismatch_is_rejected() {
     assert_oidc_callback_fails_with_bad_jwt(|claims| {
         claims["nonce"] = json!("wrong_nonce");
@@ -601,7 +613,7 @@ async fn test_oidc_nonce_mismatch_is_rejected() {
     .await;
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_bad_signature_is_rejected() {
     assert_oidc_login_fails(
         |state| {
@@ -612,7 +624,7 @@ async fn test_oidc_bad_signature_is_rejected() {
     .await;
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_wrong_audience_is_rejected() {
     assert_oidc_callback_fails_with_bad_jwt(|claims| {
         claims["aud"] = json!("wrong_client");
@@ -620,7 +632,7 @@ async fn test_oidc_wrong_audience_is_rejected() {
     .await;
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_wrong_issuer_is_rejected() {
     assert_oidc_callback_fails_with_bad_jwt(|claims| {
         claims["iss"] = json!("https://wrong-issuer.com");
@@ -628,7 +640,7 @@ async fn test_oidc_wrong_issuer_is_rejected() {
     .await;
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_expired_token_is_rejected() {
     assert_oidc_callback_fails_with_bad_jwt(|claims| {
         let current_exp = claims["exp"].as_i64().unwrap();
@@ -637,14 +649,12 @@ async fn test_oidc_expired_token_is_rejected() {
     .await;
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_repeatedly_failing_callback_stops_redirecting_to_the_provider() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
+    let (_, auth_url, _) = begin_login(&app, &provider, &mut cookies, "unused-code", None).await;
     let redirect_uri = get_query_param(&auth_url, "redirect_uri");
     let callback_path = Url::parse(&redirect_uri).unwrap().path().to_owned();
     let failing_callback = format!("{callback_path}?code=x&state=wrong_state");
@@ -700,34 +710,19 @@ async fn setup_oidc_test_with_prefix(
     >,
     FakeOidcProvider,
 ) {
-    use sqlpage::{
-        AppState,
-        app_config::{AppConfig, test_database_url},
-    };
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
     provider.with_state_mut(provider_mutator);
-
-    let db_url = test_database_url();
-    let config_json = format!(
-        r#"{{
-        "database_url": "{db_url}",
-        "oidc_issuer_url": "{}",
-        "oidc_client_id": "{}",
-        "oidc_client_secret": "{}",
-        "oidc_protected_paths": ["/"],
-        "site_prefix": "{site_prefix}"
-    }}"#,
-        provider.issuer_url, provider.client_id, provider.client_secret
-    );
-
-    let config: AppConfig = serde_json::from_str(&config_json).unwrap();
-    let app_state = AppState::init(&config).await.unwrap();
+    let mut config = oidc_test_config(&provider, &["/"], &[]);
+    config.site_prefix = site_prefix.to_string();
+    let app_state = crate::common::make_app_state_from_config(&config)
+        .await
+        .unwrap();
     let app = test::init_service(create_app(Data::new(app_state))).await;
     (app, provider)
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_with_site_prefix() {
     let (app, _provider) = setup_oidc_test_with_prefix(|_| {}, "/my-app/").await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
@@ -745,30 +740,16 @@ async fn test_oidc_with_site_prefix() {
     );
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_logout_uses_correct_scheme() {
-    use sqlpage::{
-        AppState,
-        app_config::{AppConfig, test_database_url},
-    };
-
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
 
-    let db_url = test_database_url();
-    let config_json = format!(
-        r#"{{
-        "database_url": "{db_url}",
-        "oidc_issuer_url": "{}",
-        "oidc_client_id": "{}",
-        "oidc_client_secret": "{}",
-        "https_domain": "example.com"
-    }}"#,
-        provider.issuer_url, provider.client_id, provider.client_secret
-    );
-
-    let config: AppConfig = serde_json::from_str(&config_json).unwrap();
-    let app_state = AppState::init(&config).await.unwrap();
+    let mut config = oidc_test_config(&provider, &[], &[]);
+    config.https_domain = Some("example.com".to_string());
+    let app_state = crate::common::make_app_state_from_config(&config)
+        .await
+        .unwrap();
     let logout_path = app_state
         .oidc_state
         .as_ref()
@@ -794,27 +775,14 @@ async fn test_oidc_logout_uses_correct_scheme() {
 /// An OIDC provider metadata refresh must not block authenticated requests.
 /// The refresh should happen in the background while existing requests are
 /// served using the current (possibly stale) OIDC client.
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_slow_discovery_does_not_block_authenticated_requests() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
     // Complete a full login to get auth cookies
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-    let state_param = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        state_param
-    );
-    let callback_resp =
-        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
-    assert_eq!(callback_resp.status(), StatusCode::SEE_OTHER);
+    let login = complete_login(&app, &provider, &mut cookies, "test_auth_code", None).await;
+    assert_eq!(login.callback_response.status(), StatusCode::SEE_OTHER);
 
     settle_background_refreshes().await;
     let count_before = provider.discovery_count();
@@ -851,27 +819,16 @@ async fn test_slow_discovery_does_not_block_authenticated_requests() {
 
 /// A slow OIDC token endpoint must not freeze the server.
 /// The body-read timeout fires and the request completes with a redirect.
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_slow_token_endpoint_does_not_freeze_server() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-    let state_param = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
+    let (_, _, callback_uri) =
+        begin_login(&app, &provider, &mut cookies, "test_auth_code", None).await;
 
     provider.set_token_endpoint_delay(Duration::from_secs(999));
 
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        state_param
-    );
-
     let handle = tokio::task::spawn_local(async move {
         let mut req = test::TestRequest::get().uri(&callback_uri);
         for cookie in &cookies {
@@ -897,51 +854,23 @@ async fn test_slow_token_endpoint_does_not_freeze_server() {
 /// generated for one session must NOT clear a different browser's auth cookie
 /// (forced-logout CSRF), while the legitimate logout of the issuing session
 /// must keep working.
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_oidc_logout_is_session_bound() {
-    use sqlpage::{
-        AppState,
-        app_config::{AppConfig, test_database_url},
-    };
-
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
 
-    let db_url = test_database_url();
-    let config_json = format!(
-        r#"{{
-        "database_url": "{db_url}",
-        "oidc_issuer_url": "{}",
-        "oidc_client_id": "{}",
-        "oidc_client_secret": "{}",
-        "oidc_protected_paths": ["/"],
-        "host": "localhost:1"
-    }}"#,
-        provider.issuer_url, provider.client_id, provider.client_secret
-    );
-
-    let config: AppConfig = serde_json::from_str(&config_json).unwrap();
-    let app_state = AppState::init(&config).await.unwrap();
+    let mut config = oidc_test_config(&provider, &["/"], &[]);
+    config.host = Some("localhost:1".to_string());
+    let app_state = crate::common::make_app_state_from_config(&config)
+        .await
+        .unwrap();
     let oidc_state = app_state.oidc_state.clone().unwrap();
     let app = test::init_service(create_app(Data::new(app_state))).await;
 
     // Complete a full login as the victim.
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-    let state = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        state
-    );
-    let callback_resp =
-        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
-    assert_eq!(callback_resp.status(), StatusCode::SEE_OTHER);
+    let login = complete_login(&app, &provider, &mut cookies, "test_auth_code", None).await;
+    assert_eq!(login.callback_response.status(), StatusCode::SEE_OTHER);
 
     let victim_auth = cookies
         .iter()
diff --git a/tests/parameter_binding/mod.rs b/tests/parameter_binding/mod.rs
index 5fe31a4d6..89fa17cc6 100644
--- a/tests/parameter_binding/mod.rs
+++ b/tests/parameter_binding/mod.rs
@@ -1,4 +1,4 @@
-use actix_web::{http::StatusCode, test};
+use actix_web::http::StatusCode;
 use sqlx::any::AnyKind;
 use sqlx::connection::Connection as _;
 
@@ -6,7 +6,7 @@ use sqlpage::webserver::http::main_handler;
 
 use crate::common::{get_request_to_with_data, make_app_data};
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_parameterized_pages_leave_a_prepared_statement_in_the_cache() -> actix_web::Result<()>
 {
     let data = make_app_data().await;
@@ -23,7 +23,7 @@ async fn test_parameterized_pages_leave_a_prepared_statement_in_the_cache() -> a
         .to_srv_request();
         let resp = main_handler(req).await?;
         assert_eq!(resp.status(), StatusCode::OK);
-        let page = String::from_utf8(test::read_body(resp).await.to_vec()).unwrap();
+        let page = crate::common::read_body_string(resp).await;
         assert!(
             page.contains("1447"),
             "{page}\nexpected the bound parameter to reach the query"
diff --git a/tests/requests/mod.rs b/tests/requests/mod.rs
index bd308f96a..328e4e611 100644
--- a/tests/requests/mod.rs
+++ b/tests/requests/mod.rs
@@ -2,18 +2,19 @@ use actix_web::{http::StatusCode, test};
 use serde_json::json;
 use sqlpage::webserver::http::main_handler;
 
-use crate::common::get_request_to;
+use crate::common::{get_request_to, get_request_to_with_data};
 
 async fn rendered_page(req: actix_web::dev::ServiceRequest) -> actix_web::Result<String> {
     let resp = main_handler(req).await?;
     assert_eq!(resp.status(), StatusCode::OK);
-    Ok(String::from_utf8(test::read_body(resp).await.to_vec()).unwrap())
+    Ok(crate::common::read_body_string(resp).await)
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_request_body() -> actix_web::Result<()> {
+    let app_data = crate::common::make_app_data().await;
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_test.sql")
+        get_request_to_with_data("/tests/requests/request_body_test.sql", app_data.clone())
             .await?
             .insert_header(("content-type", "text/plain"))
             .set_payload("Hello, world!")
@@ -26,7 +27,7 @@ async fn test_request_body() -> actix_web::Result<()> {
     );
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_test.sql")
+        get_request_to_with_data("/tests/requests/request_body_test.sql", app_data.clone())
             .await?
             .insert_header(("content-type", "application/x-www-form-urlencoded"))
             .set_payload("key=value")
@@ -36,7 +37,7 @@ async fn test_request_body() -> actix_web::Result<()> {
     assert!(page.contains("NULL"), "{page}\nexpected NULL for form data");
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_test.sql")
+        get_request_to_with_data("/tests/requests/request_body_test.sql", app_data)
             .await?
             .to_srv_request(),
     )
@@ -48,18 +49,22 @@ async fn test_request_body() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_request_body_base64() -> actix_web::Result<()> {
     let binary_data = (0u8..=255u8).collect::<Vec<_>>();
     let expected_base64 =
         base64::Engine::encode(&base64::engine::general_purpose::STANDARD, &binary_data);
+    let app_data = crate::common::make_app_data().await;
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_base64_test.sql")
-            .await?
-            .insert_header(("content-type", "application/octet-stream"))
-            .set_payload(binary_data)
-            .to_srv_request(),
+        get_request_to_with_data(
+            "/tests/requests/request_body_base64_test.sql",
+            app_data.clone(),
+        )
+        .await?
+        .insert_header(("content-type", "application/octet-stream"))
+        .set_payload(binary_data)
+        .to_srv_request(),
     )
     .await?;
     assert!(
@@ -68,17 +73,20 @@ async fn test_request_body_base64() -> actix_web::Result<()> {
     );
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_base64_test.sql")
-            .await?
-            .insert_header(("content-type", "application/x-www-form-urlencoded"))
-            .set_payload("key=value")
-            .to_srv_request(),
+        get_request_to_with_data(
+            "/tests/requests/request_body_base64_test.sql",
+            app_data.clone(),
+        )
+        .await?
+        .insert_header(("content-type", "application/x-www-form-urlencoded"))
+        .set_payload("key=value")
+        .to_srv_request(),
     )
     .await?;
     assert!(page.contains("NULL"), "{page}\nexpected NULL for form data");
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_base64_test.sql")
+        get_request_to_with_data("/tests/requests/request_body_base64_test.sql", app_data)
             .await?
             .to_srv_request(),
     )
@@ -90,7 +98,7 @@ async fn test_request_body_base64() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_download_data_url() -> actix_web::Result<()> {
     let req = get_request_to("/tests/requests/request_download_test.sql")
         .await?
@@ -110,7 +118,7 @@ async fn test_download_data_url() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_large_form_field_roundtrip() -> actix_web::Result<()> {
     let long_string = "a".repeat(123_454);
     let req = get_request_to("/tests/components/display_form_field.sql")
@@ -120,8 +128,7 @@ async fn test_large_form_field_roundtrip() -> actix_web::Result<()> {
         .to_srv_request();
     let resp = main_handler(req).await?;
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         !body_str.contains("error"),
         "{body_str}\nshouldn't have errors"
@@ -133,7 +140,7 @@ async fn test_large_form_field_roundtrip() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_variables_function() -> actix_web::Result<()> {
     let url = "/tests/requests/variables.sql?common=get_value&get_only=get_val";
     let req_body = "common=post_value&post_only=post_val";
@@ -200,7 +207,7 @@ async fn test_variables_function() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_invalid_utf8_multipart_text_field_returns_bad_request() -> actix_web::Result<()> {
     let req = get_request_to("/tests/requests/variables.sql")
         .await?
@@ -229,7 +236,7 @@ async fn test_invalid_utf8_multipart_text_field_returns_bad_request() -> actix_w
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_missing_multipart_content_disposition_returns_bad_request() -> actix_web::Result<()> {
     let req = get_request_to("/tests/requests/variables.sql")
         .await?
diff --git a/tests/requests/webhook_hmac.rs b/tests/requests/webhook_hmac.rs
index a5af9dd87..5cd160e24 100644
--- a/tests/requests/webhook_hmac.rs
+++ b/tests/requests/webhook_hmac.rs
@@ -1,26 +1,35 @@
 use actix_web::{http::StatusCode, test};
 use sqlpage::webserver::http::main_handler;
 
-use crate::common::get_request_to;
-
-#[actix_web::test]
-async fn test_webhook_hmac_invalid_signature() -> actix_web::Result<()> {
+use crate::common::get_request_to_with_data;
+
+/// Builds a webhook validation request, optionally signed with `signature`.
+/// Sets `WEBHOOK_SECRET` so every test signs against the same secret.
+async fn webhook_request(
+    app_data: actix_web::web::Data<sqlpage::AppState>,
+    signature: Option<&str>,
+) -> actix_web::Result<actix_web::dev::ServiceResponse> {
     // Set up environment variable for webhook secret
     unsafe {
         std::env::set_var("WEBHOOK_SECRET", "test-secret-key");
     }
 
     let webhook_body = r#"{"order_id":12345,"total":"99.99"}"#;
-    let invalid_signature = "96a5f6f65c85a2d4d1f3a37813ab2c0b44041bdc17691fbb0884e3eb52b7c54b";
-
-    let req = get_request_to("/tests/webhook_hmac_validation.sql")
+    let mut req = get_request_to_with_data("/tests/webhook_hmac_validation.sql", app_data)
         .await?
-        .insert_header(("content-type", "application/json"))
-        .insert_header(("X-Webhook-Signature", invalid_signature))
-        .set_payload(webhook_body)
-        .to_srv_request();
+        .insert_header(("content-type", "application/json"));
+    if let Some(signature) = signature {
+        req = req.insert_header(("X-Webhook-Signature", signature));
+    }
+    let req = req.set_payload(webhook_body).to_srv_request();
+    main_handler(req).await
+}
 
-    let resp = main_handler(req).await?;
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
+async fn test_webhook_hmac_invalid_signature() -> actix_web::Result<()> {
+    let app_data = crate::common::make_app_data().await;
+    let invalid_signature = "96a5f6f65c85a2d4d1f3a37813ab2c0b44041bdc17691fbb0884e3eb52b7c54b";
+    let resp = webhook_request(app_data, Some(invalid_signature)).await?;
 
     // Should redirect to error page when signature is invalid
     assert!(
@@ -39,24 +48,11 @@ async fn test_webhook_hmac_invalid_signature() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_webhook_hmac_valid_signature() -> actix_web::Result<()> {
-    // Set up environment variable for webhook secret
-    unsafe {
-        std::env::set_var("WEBHOOK_SECRET", "test-secret-key");
-    }
-
-    let webhook_body = r#"{"order_id":12345,"total":"99.99"}"#;
+    let app_data = crate::common::make_app_data().await;
     let valid_signature = "260b3b5ead84843645588af82d5d2c3fe24c598a950d36c45438c3a5f5bb941c";
-
-    let req = get_request_to("/tests/webhook_hmac_validation.sql")
-        .await?
-        .insert_header(("content-type", "application/json"))
-        .insert_header(("X-Webhook-Signature", valid_signature))
-        .set_payload(webhook_body)
-        .to_srv_request();
-
-    let resp = main_handler(req).await?;
+    let resp = webhook_request(app_data, Some(valid_signature)).await?;
 
     // Should return success when signature is valid
     assert_eq!(resp.status(), StatusCode::OK, "200 resp for signed req");
@@ -69,23 +65,11 @@ async fn test_webhook_hmac_valid_signature() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_webhook_hmac_missing_signature() -> actix_web::Result<()> {
-    // Set up environment variable for webhook secret
-    unsafe {
-        std::env::set_var("WEBHOOK_SECRET", "test-secret-key");
-    }
-
-    let webhook_body = r#"{"order_id":12345,"total":"99.99"}"#;
-
+    let app_data = crate::common::make_app_data().await;
     // Don't include the X-Webhook-Signature header
-    let req = get_request_to("/tests/webhook_hmac_validation.sql")
-        .await?
-        .insert_header(("content-type", "application/json"))
-        .set_payload(webhook_body)
-        .to_srv_request();
-
-    let resp = main_handler(req).await?;
+    let resp = webhook_request(app_data, None).await?;
 
     let location = resp
         .headers()
diff --git a/tests/server_timing/mod.rs b/tests/server_timing/mod.rs
index 6d0a42faa..e58e59801 100644
--- a/tests/server_timing/mod.rs
+++ b/tests/server_timing/mod.rs
@@ -1,13 +1,21 @@
 use actix_web::http::StatusCode;
 use sqlpage::webserver::http::main_handler;
 
-use crate::common::{get_request_to, make_app_data_from_config, test_config};
+use crate::common::{get_request_to, make_app_data_with_env};
 
-#[actix_web::test]
+/// Returns the value of the `Server-Timing` response header, failing the test
+/// when the header is missing.
+fn server_timing_header(resp: &actix_web::dev::ServiceResponse) -> &str {
+    resp.headers()
+        .get("Server-Timing")
+        .expect("Server-Timing header should be present")
+        .to_str()
+        .unwrap()
+}
+
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_server_timing_disabled_in_production() -> actix_web::Result<()> {
-    let mut config = test_config();
-    config.environment = sqlpage::app_config::DevOrProd::Production;
-    let app_data = make_app_data_from_config(config).await;
+    let app_data = make_app_data_with_env(sqlpage::app_config::DevOrProd::Production).await;
 
     let req = crate::common::get_request_to_with_data(
         "/tests/sql_test_files/component_rendering/simple.sql",
@@ -25,11 +33,9 @@ async fn test_server_timing_disabled_in_production() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_server_timing_enabled_in_development() -> actix_web::Result<()> {
-    let mut config = test_config();
-    config.environment = sqlpage::app_config::DevOrProd::Development;
-    let app_data = make_app_data_from_config(config).await;
+    let app_data = make_app_data_with_env(sqlpage::app_config::DevOrProd::Development).await;
 
     let req = crate::common::get_request_to_with_data(
         "/tests/sql_test_files/data/postgres_cast_syntax.sql",
@@ -40,37 +46,19 @@ async fn test_server_timing_enabled_in_development() -> actix_web::Result<()> {
     let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let server_timing_header = resp
-        .headers()
-        .get("Server-Timing")
-        .expect("Server-Timing header should be present in development mode");
-    let header_value = server_timing_header.to_str().unwrap();
+    let header_value = server_timing_header(&resp);
 
-    assert!(
-        header_value.contains("sql_file;dur="),
-        "Should contain sql_file timing: {header_value}"
-    );
-    assert!(
-        header_value.contains("parse_req;dur="),
-        "Should contain parse_req timing: {header_value}"
-    );
-    assert!(
-        header_value.contains("bind_params;dur="),
-        "Should contain bind_params timing: {header_value}"
-    );
-    assert!(
-        header_value.contains("db_conn;dur="),
-        "Should contain db_conn timing: {header_value}"
-    );
-    assert!(
-        header_value.contains("row;dur="),
-        "Should contain row timing: {header_value}"
-    );
+    for token in ["sql_file", "parse_req", "bind_params", "db_conn", "row"] {
+        assert!(
+            header_value.contains(&format!("{token};dur=")),
+            "Should contain {token} timing: {header_value}"
+        );
+    }
 
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_server_timing_format() -> actix_web::Result<()> {
     let req = get_request_to("/tests/sql_test_files/data/postgres_cast_syntax.sql")
         .await?
@@ -78,8 +66,7 @@ async fn test_server_timing_format() -> actix_web::Result<()> {
     let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let server_timing_header = resp.headers().get("Server-Timing").unwrap();
-    let header_value = server_timing_header.to_str().unwrap();
+    let header_value = server_timing_header(&resp);
 
     let parts: Vec<&str> = header_value.split(", ").collect();
     assert!(parts.len() >= 5, "Should have at least 5 timing events");
@@ -103,11 +90,9 @@ async fn test_server_timing_format() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_server_timing_in_redirect() -> actix_web::Result<()> {
-    let mut config = test_config();
-    config.environment = sqlpage::app_config::DevOrProd::Development;
-    let app_data = make_app_data_from_config(config).await;
+    let app_data = make_app_data_with_env(sqlpage::app_config::DevOrProd::Development).await;
 
     let req =
         crate::common::get_request_to_with_data("/tests/server_timing/redirect_test.sql", app_data)
@@ -120,11 +105,7 @@ async fn test_server_timing_in_redirect() -> actix_web::Result<()> {
         StatusCode::FOUND,
         "Response should be a redirect"
     );
-    let server_timing_header = resp
-        .headers()
-        .get("Server-Timing")
-        .expect("Server-Timing header should be present in redirect responses");
-    let header_value = server_timing_header.to_str().unwrap();
+    let header_value = server_timing_header(&resp);
 
     assert!(
         !header_value.is_empty(),
diff --git a/tests/sql_test_files/mod.rs b/tests/sql_test_files/mod.rs
index c8cf53f32..2a66cbeb6 100644
--- a/tests/sql_test_files/mod.rs
+++ b/tests/sql_test_files/mod.rs
@@ -5,7 +5,7 @@ use std::time::Duration;
 use tokio::sync::oneshot;
 use tokio::task::JoinHandle;
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn run_all_sql_test_files() {
     let app_data = crate::common::make_app_data().await;
     run_sql_test_cases(&app_data, get_sql_test_cases()).await;
@@ -14,7 +14,7 @@ async fn run_all_sql_test_files() {
 /// Runs the SQL test files in `database-specific/<current database>/`.
 /// These files use syntax that only works on a single database engine, so they
 /// cannot be part of the generic `run_all_sql_test_files` test.
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn run_database_specific_sql_test_files() {
     let app_data = crate::common::make_app_data().await;
     let db_type = database_type_name(&app_data);
diff --git a/tests/transactions/mod.rs b/tests/transactions/mod.rs
index 3718f09bf..9c5a29d6c 100644
--- a/tests/transactions/mod.rs
+++ b/tests/transactions/mod.rs
@@ -1,9 +1,9 @@
-use actix_web::{http::StatusCode, test};
+use actix_web::http::StatusCode;
 use sqlpage::webserver::{database::SupportedDatabase, http::main_handler};
 
 use crate::common::{get_request_to_with_data, make_app_data};
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_transaction_error() -> actix_web::Result<()> {
     let data = make_app_data().await;
     let path = match data.db.info.database_type {
@@ -18,9 +18,8 @@ async fn test_transaction_error() -> actix_web::Result<()> {
         .await?
         .to_srv_request();
     let resp = main_handler(req).await?;
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec())
-        .unwrap()
+    let body_str = crate::common::read_body_string(resp)
+        .await
         .to_ascii_lowercase();
     assert!(
         body_str.contains("error") && body_str.contains("null"),
@@ -32,8 +31,7 @@ async fn test_transaction_error() -> actix_web::Result<()> {
         .await?
         .to_srv_request();
     let resp = main_handler(req).await?;
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("1447"),
         "{body_str}\nexpected to contain: 1447"
@@ -41,7 +39,7 @@ async fn test_transaction_error() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_failed_copy_followed_by_query() -> actix_web::Result<()> {
     let app_data = make_app_data().await;
     let big_csv = "col1,col2\nval1,val2\n".repeat(1000);
@@ -63,15 +61,14 @@ async fn test_failed_copy_followed_by_query() -> actix_web::Result<()> {
     let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("error"),
         "{body_str}\nexpected to contain error message"
     );
 
     // On postgres, the error message should contain  "The postgres COPY FROM STDIN command failed"
-    if matches!(app_data.db.to_string().to_lowercase().as_str(), "postgres") {
+    if crate::common::supports_database(&app_data.db, &[SupportedDatabase::Postgres]) {
         assert!(
             body_str.contains("The postgres COPY FROM STDIN command failed"),
             "{body_str}\nexpected to contain: The postgres COPY FROM STDIN command failed"
@@ -89,8 +86,7 @@ async fn test_failed_copy_followed_by_query() -> actix_web::Result<()> {
         let resp = main_handler(req).await?;
 
         assert_eq!(resp.status(), StatusCode::OK);
-        let body = test::read_body(resp).await;
-        let body_str = String::from_utf8(body.to_vec()).unwrap();
+        let body_str = crate::common::read_body_string(resp).await;
         assert!(
             body_str.contains("It works !"),
             "{body_str}\nexpected to contain: It works !"
diff --git a/tests/uploads/mod.rs b/tests/uploads/mod.rs
index fe30cd54e..927864ff1 100644
--- a/tests/uploads/mod.rs
+++ b/tests/uploads/mod.rs
@@ -3,24 +3,34 @@ use sqlpage::webserver::http::main_handler;
 
 use crate::common::get_request_to;
 
-async fn test_file_upload(target: &str) -> actix_web::Result<()> {
-    let req = get_request_to(target)
+/// Builds a multipart upload request with the given raw body.
+async fn multipart_request(
+    target: &str,
+    body: String,
+) -> actix_web::Result<actix_web::dev::ServiceRequest> {
+    Ok(get_request_to(target)
         .await?
         .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
+        .set_payload(body)
+        .to_srv_request())
+}
+
+async fn test_file_upload(target: &str) -> actix_web::Result<()> {
+    let req = multipart_request(
+        target,
+        "--1234567890\r\n\
             Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
             Content-Type: text/plain\r\n\
             \r\n\
             Hello, world!\r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
+            --1234567890--\r\n"
+            .to_string(),
+    )
+    .await?;
     let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Hello, world!"),
         "{body_str}\nexpected to contain: Hello, world!"
@@ -28,25 +38,25 @@ async fn test_file_upload(target: &str) -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_persist_uploaded_file_mode() -> actix_web::Result<()> {
     let app_data = crate::common::make_app_data().await;
-    let req = test::TestRequest::get()
-        .uri("/tests/uploads/persist_with_mode.sql?mode=644")
-        .app_data(app_data.clone())
-        .app_data(sqlpage::webserver::http::payload_config(&app_data))
-        .app_data(sqlpage::webserver::http::form_config(&app_data))
-        .insert_header((actix_web::http::header::ACCEPT, "application/json"))
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
+    let req = crate::common::get_request_to_with_data(
+        "/tests/uploads/persist_with_mode.sql?mode=644",
+        app_data,
+    )
+    .await?
+    .insert_header((actix_web::http::header::ACCEPT, "application/json"))
+    .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
+    .set_payload(
+        "--1234567890\r\n\
             Content-Disposition: form-data; name=\"my_file\"; filename=\"test.txt\"\r\n\
             Content-Type: text/plain\r\n\
             \r\n\
             Hello\r\n\
             --1234567890--\r\n",
-        )
-        .to_srv_request();
+    )
+    .to_srv_request();
     let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
@@ -84,35 +94,33 @@ async fn test_persist_uploaded_file_mode() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_file_upload_direct() -> actix_web::Result<()> {
     test_file_upload("/tests/uploads/upload_file_test.sql").await
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_file_upload_through_runsql() -> actix_web::Result<()> {
     test_file_upload("/tests/uploads/upload_file_runsql_test.sql").await
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_blank_file_upload_field() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/upload_file_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"my_file\"; filename=\"\"\r\n\
-            Content-Type: application/octet-stream\r\n\
-            \r\n\
-            \r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
+    let req = multipart_request(
+        "/tests/uploads/upload_file_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"my_file\"; filename=\"\"\r\n\
+        Content-Type: application/octet-stream\r\n\
+        \r\n\
+        \r\n\
+        --1234567890--\r\n"
+            .to_string(),
+    )
+    .await?;
     let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("No file uploaded"),
         "{body_str}\nexpected to contain: No file uploaded"
@@ -120,23 +128,21 @@ async fn test_blank_file_upload_field() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_file_upload_too_large() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/upload_file_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
-            Content-Type: text/plain\r\n\
-            \r\n\
-            "
-            .to_string()
-                + "a".repeat(123_457).as_str()
-                + "\r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
+    let req = multipart_request(
+        "/tests/uploads/upload_file_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
+        Content-Type: text/plain\r\n\
+        \r\n\
+        "
+        .to_string()
+            + "a".repeat(123_457).as_str()
+            + "\r\n\
+        --1234567890--\r\n",
+    )
+    .await?;
     let err_str = main_handler(req)
         .await
         .expect_err("Expected an error response")
@@ -149,71 +155,65 @@ async fn test_file_upload_too_large() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_upload_file_data_url() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/upload_file_data_url_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
-            Content-Type: image/svg+xml\r\n\
-            \r\n\
-            <svg></svg>\r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
+    let req = multipart_request(
+        "/tests/uploads/upload_file_data_url_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
+        Content-Type: image/svg+xml\r\n\
+        \r\n\
+        <svg></svg>\r\n\
+        --1234567890--\r\n"
+            .to_string(),
+    )
+    .await?;
     let resp = main_handler(req).await?;
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert_eq!(body_str, "data:image/svg+xml;base64,PHN2Zz48L3N2Zz4=");
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_uploaded_file_name() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/uploaded_file_name_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
-            Content-Type: text/plain\r\n\
-            \r\n\
-            Some plain text.\r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
+    let req = multipart_request(
+        "/tests/uploads/uploaded_file_name_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
+        Content-Type: text/plain\r\n\
+        \r\n\
+        Some plain text.\r\n\
+        --1234567890--\r\n"
+            .to_string(),
+    )
+    .await?;
     let resp = main_handler(req).await?;
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert_eq!(body_str, "testfile.txt");
     Ok(())
 }
 
-#[actix_web::test]
+#[actix_web::rt::test(system = "crate::common::TestSystem")]
 async fn test_csv_upload() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/upload_csv_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"people_file\"; filename=\"people.csv\"\r\n\
-            Content-Type: text/csv\r\n\
-            \r\n\
-            name,age\r\n\
-            Ophir,29\r\n\
-            Max,99\r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
+    let req = multipart_request(
+        "/tests/uploads/upload_csv_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"people_file\"; filename=\"people.csv\"\r\n\
+        Content-Type: text/csv\r\n\
+        \r\n\
+        name,age\r\n\
+        Ophir,29\r\n\
+        Max,99\r\n\
+        --1234567890--\r\n"
+            .to_string(),
+    )
+    .await?;
     let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Ophir is 29 years old"),
         "{body_str}\nexpected to contain: Ophir is 29 years old"

From 3674f0b5d9ff8436c56820cad40bbeaf2de006e5 Mon Sep 17 00:00:00 2001
From: Ophir Lojkine <contact@ophir.dev>
Date: Wed, 7 Oct 2026 10:02:51 +0000
Subject: [PATCH 2/5] test: replace custom runtime with service-backed response
 helpers

Give test requests an Actix service-owned pool so dropping the service releases application state. Centralize request setup with response_for, response_with, and helpers for custom requests and shared state, while keeping standard actix_web tests.

Cover state release on success, errors, and unwinding. Validate with the full Rust suite, all-feature Clippy, formatting, and the SQLite ODBC prepared-statement test.
---
 CONTRIBUTING.md                |  11 +-
 tests/basic/mod.rs             |  20 ++-
 tests/common/mod.rs            | 270 ++++++++++++++-------------------
 tests/cookies/mod.rs           |   8 +-
 tests/core/mod.rs              |  88 ++++-------
 tests/core/path_aliases.rs     |  16 +-
 tests/data_formats/mod.rs      |  85 +++++------
 tests/errors/basic_auth.rs     |  19 +--
 tests/errors/invalid_header.rs |  11 +-
 tests/errors/mod.rs            |  53 +++----
 tests/exec/mod.rs              |  18 +--
 tests/oidc/mod.rs              |  48 +++---
 tests/parameter_binding/mod.rs |  12 +-
 tests/requests/mod.rs          | 123 ++++++---------
 tests/requests/webhook_hmac.rs |  25 ++-
 tests/server_timing/mod.rs     |  58 ++++---
 tests/sql_test_files/mod.rs    |  26 ++--
 tests/transactions/mod.rs      |  37 ++---
 tests/uploads/mod.rs           | 104 +++++--------
 19 files changed, 414 insertions(+), 618 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e5318b28b..ca7aac94c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -96,12 +96,11 @@ export DATABASE_URL=mssql://root:Password123!@localhost/sqlpage
 cargo test
 ```
 
-Integration tests that create application state should use `common::make_app_state_from_config` or
-`common::make_app_data_from_config` and `#[actix_web::rt::test(system = "crate::common::TestSystem")]`.
-The shared test runtime clears prepared statements and closes database pools before shutdown,
-including after a panic. This is required because actix-web's test request utilities pin each
-request's application state until process exit, which would otherwise leave native database
-handles open and hang Oracle's ODBC driver at process exit.
+Use `common::response_for(path)` for ordinary integration requests and
+`common::response_with(path, config)` for custom configuration. Custom requests use
+`common::response_from(request)`; tests sharing database or cache state use `common::send_request`.
+These helpers dispatch through an Actix test service whose destructor drains its request pool.
+Keep `#[actix_web::test]`; standalone `TestRequest::to_srv_request()` retains application state.
 When testing Oracle locally, use `cargo test -- --test-threads=2` to avoid overwhelming the listener.
 
 ### End-to-End Tests
diff --git a/tests/basic/mod.rs b/tests/basic/mod.rs
index bfb80c34d..ae1623584 100644
--- a/tests/basic/mod.rs
+++ b/tests/basic/mod.rs
@@ -4,11 +4,11 @@ use actix_web::{
     test,
 };
 
-use crate::common::req_path;
+use crate::common::{response_for, response_with, test_config};
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_index_ok() {
-    let resp = req_path("/").await.unwrap();
+    let resp = response_for("/").await;
     assert_eq!(resp.status(), http::StatusCode::OK);
     let body = crate::common::read_body_string(resp).await;
     assert!(body.starts_with("<!DOCTYPE html>"));
@@ -16,9 +16,9 @@ async fn test_index_ok() {
     assert!(!body.contains("error"));
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_access_config_forbidden() {
-    let resp_result = req_path("/sqlpage/sqlpage.json").await;
+    let resp_result = response_with("/sqlpage/sqlpage.json", test_config()).await;
     assert!(
         resp_result.is_err(),
         "Accessing the config file should be forbidden, but we received a response: {resp_result:?}"
@@ -32,19 +32,17 @@ async fn test_access_config_forbidden() {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_static_files() {
-    let resp = req_path("/tests/it_works.txt").await.unwrap();
+    let resp = response_for("/tests/it_works.txt").await;
     assert_eq!(resp.status(), http::StatusCode::OK);
     let body = test::read_body(resp).await;
     assert_eq!(&body, &b"It works !"[..]);
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_spaces_in_file_names() {
-    let resp = req_path("/tests/core/spaces%20in%20file%20name.sql")
-        .await
-        .unwrap();
+    let resp = response_for("/tests/core/spaces%20in%20file%20name.sql").await;
     assert_eq!(resp.status(), http::StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
     assert!(body_str.contains("It works !"), "{body_str}");
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index 93d7bfb5b..60f536b5f 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -3,10 +3,10 @@ use std::time::Duration;
 
 use actix_web::{
     App, HttpResponse, HttpServer,
-    dev::{ServiceRequest, fn_service},
+    dev::{ServiceRequest, ServiceResponse, fn_service},
     http::header,
     http::header::ContentType,
-    test::TestRequest,
+    test::{self, TestRequest},
     web,
     web::Data,
 };
@@ -19,118 +19,131 @@ use sqlpage::{
 use tokio::sync::oneshot;
 use tokio::task::JoinHandle;
 
-pub(crate) async fn get_request_to_with_data(
-    path: &str,
-    data: Data<AppState>,
-) -> actix_web::Result<TestRequest> {
-    Ok(TestRequest::get()
-        .uri(path)
+/// Builds a GET request with the defaults used by the SQL fixtures.
+pub(crate) fn request_for(path: impl AsRef<str>) -> TestRequest {
+    TestRequest::get()
+        .uri(path.as_ref())
         .insert_header(ContentType::plaintext())
         .insert_header(header::Accept::html())
-        .app_data(payload_config(&data))
-        .app_data(form_config(&data))
-        .app_data(data))
 }
 
-pub(crate) async fn get_request_to(path: &str) -> actix_web::Result<TestRequest> {
-    let data = make_app_data().await;
-    get_request_to_with_data(path, data).await
+pub(crate) fn multipart_request(path: &str, body: impl Into<web::Bytes>) -> TestRequest {
+    request_for(path)
+        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
+        .set_payload(body)
 }
 
-pub(crate) async fn make_app_data_from_config(config: AppConfig) -> Data<AppState> {
-    let state = make_app_state_from_config(&config).await.unwrap();
-    Data::new(state)
+pub(crate) async fn make_app_data_from_config(
+    config: AppConfig,
+) -> actix_web::Result<Data<AppState>> {
+    init_log();
+    AppState::init(&config)
+        .await
+        .map(Data::new)
+        .map_err(actix_web::error::ErrorInternalServerError)
 }
 
-// Pools must be emptied while the test runtime is still running.
-//
-// Each request built with `TestRequest::to_srv_request()` leaks its
-// `Data<AppState>`: actix-web recycles the `HttpRequestInner` allocation into
-// a per-request pool on drop, and that pool is only drained by a real server,
-// never on the test path. The leaked `AppState` pins its database pool (and
-// its pooled connections) until process exit. The ODBC backend prepares and
-// caches a native statement for every distinct parameterized query, and
-// Oracle's ODBC driver deadlocks in its process destructor when connections
-// still hold native statements at exit.
-//
-// Note that `pool.close()` alone is not sufficient: it only closes idle
-// connections, so one still checked out (e.g. by a return-to-pool task
-// finishing the test's last request) would keep its cached statements alive.
-// Acquire every connection and clear its cache first to free those handles.
-thread_local! {
-    static TEST_POOLS: std::cell::RefCell<Vec<sqlx::any::AnyPool>> = const { std::cell::RefCell::new(Vec::new()) };
+/// Sends a GET request with the default test configuration, failing the test on error.
+pub(crate) async fn response_for(path: impl AsRef<str>) -> ServiceResponse {
+    response_with(path.as_ref(), test_config())
+        .await
+        .unwrap_or_else(|err| panic!("Request to {} failed: {err:#}", path.as_ref()))
 }
 
-pub(crate) struct TestSystem(actix_web::rt::SystemRunner);
-
-impl TestSystem {
-    pub(crate) fn new() -> Self {
-        Self(actix_web::rt::System::new())
-    }
+/// Sends a GET request with custom application configuration.
+pub(crate) async fn response_with(
+    path: impl AsRef<str>,
+    config: AppConfig,
+) -> actix_web::Result<ServiceResponse> {
+    send_request(request_for(path), make_app_data_from_config(config).await?).await
+}
 
-    pub(crate) fn block_on<F: Future>(&self, future: F) -> F::Output {
-        use futures_util::FutureExt as _;
+/// Sends a custom request with the default test configuration.
+pub(crate) async fn response_from(request: TestRequest) -> actix_web::Result<ServiceResponse> {
+    send_request(request, make_app_data_from_config(test_config()).await?).await
+}
 
-        self.0.block_on(async {
-            let result = std::panic::AssertUnwindSafe(future).catch_unwind().await;
-            // Empty every pool created by the test while the runtime is still
-            // alive, even if the test panicked. Clearing first releases cached
-            // prepared statements on connections that may still be checked out
-            // (which `close()` alone would leave behind); closing then
-            // disconnects each pooled connection. The pool objects themselves
-            // may stay alive (see above), but they are left empty.
-            let pools = TEST_POOLS.with(std::cell::RefCell::take);
-            for pool in pools {
-                use sqlx::connection::Connection as _;
+/// Sends a GET request using existing state, for tests that share a database or cache.
+pub(crate) async fn response_with_data(
+    path: impl AsRef<str>,
+    data: Data<AppState>,
+) -> actix_web::Result<ServiceResponse> {
+    send_request(request_for(path), data).await
+}
 
-                let mut connections = Vec::new();
-                for _ in 0..pool.size() {
-                    let mut connection = pool.acquire().await.unwrap();
-                    connection.clear_cached_statements().await.unwrap();
-                    connections.push(connection);
-                }
-                drop(connections);
-                pool.close().await;
+/// Runs a request through an Actix service so its request pool has an owner.
+/// Dropping the service disables and drains the pool, including on error or panic.
+/// Standalone `TestRequest::to_srv_request()` would instead leak the application state.
+pub(crate) async fn send_request(
+    request: TestRequest,
+    data: Data<AppState>,
+) -> actix_web::Result<ServiceResponse> {
+    let app = test::init_service(
+        App::new()
+            .app_data(payload_config(&data))
+            .app_data(form_config(&data))
+            .app_data(data)
+            .default_service(fn_service(main_handler)),
+    )
+    .await;
+    tokio::time::timeout(
+        Duration::from_secs(8),
+        test::try_call_service(&app, request.to_request()),
+    )
+    .await
+    .map_err(actix_web::error::ErrorGatewayTimeout)?
+}
+
+#[actix_web::test]
+async fn requests_release_application_state_on_success_error_and_panic() {
+    use futures_util::FutureExt as _;
+
+    for (path, panic_after_response) in [
+        ("/tests/parameter_binding/echo_parameter.sql?x=1447", false),
+        ("/sqlpage/sqlpage.json", false),
+        ("/tests/parameter_binding/echo_parameter.sql?x=1447", true),
+    ] {
+        let data = make_app_data_from_config(AppConfig {
+            database_url: "sqlite::memory:".into(),
+            ..test_config()
+        })
+        .await
+        .unwrap();
+        let weak = std::sync::Arc::downgrade(&data.clone().into_inner());
+        let result = std::panic::AssertUnwindSafe(async move {
+            let response = send_request(request_for(path), data).await;
+            if path == "/sqlpage/sqlpage.json" {
+                assert_eq!(
+                    response.unwrap_err().as_response_error().status_code(),
+                    actix_web::http::StatusCode::FORBIDDEN
+                );
+            } else {
+                let response = response.unwrap();
+                assert_eq!(response.status(), actix_web::http::StatusCode::OK);
+                assert!(!panic_after_response, "intentional test panic");
+                test::read_body(response).await;
             }
-            match result {
-                Ok(output) => output,
-                Err(panic) => std::panic::resume_unwind(panic),
+        })
+        .catch_unwind()
+        .await;
+        assert_eq!(result.is_err(), panic_after_response);
+        // Query tasks may finish returning their connection after the body is read.
+        tokio::time::timeout(Duration::from_secs(1), async {
+            while weak.upgrade().is_some() {
+                tokio::task::yield_now().await;
             }
         })
-    }
-}
-
-pub(crate) async fn make_app_state_from_config(config: &AppConfig) -> anyhow::Result<AppState> {
-    let state = AppState::init(config).await?;
-    TEST_POOLS.with(|pools| pools.borrow_mut().push(state.db.connection.clone()));
-    Ok(state)
-}
-
-#[test]
-fn test_system_closes_pools_on_success_and_panic() {
-    for panic_in_test in [false, true] {
-        let system = TestSystem::new();
-        let mut pool = None;
-        let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
-            system.block_on(async {
-                let mut config = test_config();
-                config.database_url = "sqlite::memory:".to_owned();
-                let state = make_app_state_from_config(&config).await.unwrap();
-                pool = Some(state.db.connection.clone());
-                assert!(!panic_in_test, "intentional test panic");
-            });
-        }));
-        assert_eq!(result.is_err(), panic_in_test);
-        assert!(pool.unwrap().is_closed());
+        .await
+        .expect("request retained application state");
     }
 }
 
 /// Reads a whole response body as a UTF-8 string, failing the test otherwise.
-pub(crate) async fn read_body_string<B>(resp: actix_web::dev::ServiceResponse<B>) -> String
+pub(crate) async fn read_body_string<B>(resp: ServiceResponse<B>) -> String
 where
     B: actix_web::body::MessageBody,
 {
-    String::from_utf8(actix_web::test::read_body(resp).await.to_vec()).unwrap()
+    String::from_utf8(test::read_body(resp).await.to_vec()).unwrap()
 }
 
 /// Whether the database engine is one of `kinds`.
@@ -143,83 +156,20 @@ pub(crate) fn supports_database(
 }
 
 pub(crate) async fn make_app_data() -> Data<AppState> {
-    init_log();
-    let config = test_config();
-    make_app_data_from_config(config).await
-}
-
-/// Creates test application state running in the given environment
-/// (development enables debug helpers like `Server-Timing`).
-pub(crate) async fn make_app_data_with_env(
-    environment: sqlpage::app_config::DevOrProd,
-) -> Data<AppState> {
-    init_log();
-    let mut config = test_config();
-    config.environment = environment;
-    make_app_data_from_config(config).await
-}
-
-pub(crate) async fn req_path(
-    path: impl AsRef<str>,
-) -> Result<actix_web::dev::ServiceResponse, actix_web::Error> {
-    let req = get_request_to(path.as_ref()).await?.to_srv_request();
-    main_handler(req).await
-}
-
-const REQ_TIMEOUT: Duration = Duration::from_secs(8);
-pub(crate) async fn req_path_with_app_data(
-    path: impl AsRef<str>,
-    app_data: Data<AppState>,
-) -> anyhow::Result<actix_web::dev::ServiceResponse> {
-    req_path_with_app_data_and_accept(path, app_data, header::Accept::html()).await
-}
-
-pub(crate) async fn req_path_with_app_data_json(
-    path: impl AsRef<str>,
-    app_data: Data<AppState>,
-) -> anyhow::Result<actix_web::dev::ServiceResponse> {
-    req_path_with_app_data_and_accept(path, app_data, header::Accept::json()).await
-}
-
-async fn req_path_with_app_data_and_accept(
-    path: impl AsRef<str>,
-    app_data: Data<AppState>,
-    accept: header::Accept,
-) -> anyhow::Result<actix_web::dev::ServiceResponse> {
-    let path = path.as_ref();
-    let req = get_request_to_with_data(path, app_data)
-        .await
-        .map_err(|e| anyhow::anyhow!("Failed to build request for {path}: {e}"))?
-        .insert_header(("cookie", "test_cook=123"))
-        .insert_header(("authorization", "Basic dGVzdDp0ZXN0"))
-        .insert_header(accept)
-        .to_srv_request();
-    let resp = tokio::time::timeout(REQ_TIMEOUT, main_handler(req))
-        .await
-        .map_err(|e| anyhow::anyhow!("Request to {path} timed out: {e}"))?
-        .map_err(|e| {
-            anyhow::anyhow!(
-                "Request to {path} failed with status {}: {e:#}",
-                e.as_response_error().status_code()
-            )
-        })?;
-    Ok(resp)
+    make_app_data_from_config(test_config()).await.unwrap()
 }
 
 pub(crate) fn test_config() -> AppConfig {
-    let db_url = test_database_url();
-    serde_json::from_str::<AppConfig>(&format!(
-        r#"{{
-        "database_url": "{db_url}",
+    serde_json::from_value(serde_json::json!({
+        "database_url": test_database_url(),
         "max_database_pool_connections": 1,
         "database_connection_retries": 3,
         "database_connection_acquire_timeout_seconds": 15,
         "allow_exec": true,
-        "max_uploaded_file_size": 123456,
+        "max_uploaded_file_size": 123_456,
         "listen_on": "111.111.111.111:1",
-        "system_root_ca_certificates" : false
-    }}"#
-    ))
+        "system_root_ca_certificates": false
+    }))
     .unwrap()
 }
 
diff --git a/tests/cookies/mod.rs b/tests/cookies/mod.rs
index 1fa2b1db8..ed254d056 100644
--- a/tests/cookies/mod.rs
+++ b/tests/cookies/mod.rs
@@ -1,9 +1,9 @@
-use crate::common::req_path;
+use crate::common::response_for;
 use actix_web::http::StatusCode;
 use actix_web::http::header::SET_COOKIE;
 
 async fn set_cookie_header(path: &str) -> String {
-    let resp = req_path(path).await.unwrap();
+    let resp = response_for(path).await;
     resp.headers()
         .get(SET_COOKIE)
         .unwrap_or_else(|| panic!("{path} should have sent a Set-Cookie header"))
@@ -33,9 +33,7 @@ async fn zero_turns_off_a_cookie_protection() {
 
 #[actix_web::test]
 async fn a_page_made_only_of_header_components_still_sends_them() {
-    let resp = req_path("/tests/cookies/header_only_response.sql")
-        .await
-        .unwrap();
+    let resp = response_for("/tests/cookies/header_only_response.sql").await;
     assert_eq!(resp.status(), StatusCode::NO_CONTENT);
     assert!(resp.headers().contains_key(SET_COOKIE));
 }
diff --git a/tests/core/mod.rs b/tests/core/mod.rs
index 036429e88..4eb77417e 100644
--- a/tests/core/mod.rs
+++ b/tests/core/mod.rs
@@ -1,10 +1,12 @@
-use actix_web::{http::StatusCode, test};
+use actix_web::http::StatusCode;
 use sqlpage::{
     AppState,
     webserver::{self, make_placeholder},
 };
 
-use crate::common::{make_app_data_from_config, req_path, req_path_with_app_data, test_config};
+use crate::common::{
+    make_app_data_from_config, response_for, response_with, response_with_data, test_config,
+};
 
 mod path_aliases;
 
@@ -44,16 +46,16 @@ async fn store_file_in_db(state: &AppState, path: &str, contents: &[u8]) {
         .unwrap();
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_concurrent_requests() {
     let components = [
         "table", "form", "card", "datagrid", "hero", "list", "timeline",
     ];
-    let app_data = make_app_data_from_config(test_config()).await;
+    let app_data = crate::common::make_app_data().await;
     let reqs = (0..64)
         .map(|i| {
             let component = components[i % components.len()];
-            req_path_with_app_data(
+            response_with_data(
                 format!("/tests/components/any_component.sql?component={component}"),
                 app_data.clone(),
             )
@@ -73,11 +75,9 @@ async fn test_concurrent_requests() {
     }
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_datagrid_description_presence_controls_placeholder() {
-    let resp = req_path("/tests/components/datagrid_icon_only.sql")
-        .await
-        .unwrap();
+    let resp = response_for("/tests/components/datagrid_icon_only.sql").await;
     assert_eq!(resp.status(), StatusCode::OK);
     let body = crate::common::read_body_string(resp).await;
     assert!(body.contains("Facebook"), "{body}");
@@ -87,7 +87,7 @@ async fn test_datagrid_description_presence_controls_placeholder() {
     assert_eq!(body.matches('–').count(), 1, "{body}");
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_routing_with_db_fs() {
     let mut config = test_config();
     if config.database_url.contains("memory") {
@@ -95,9 +95,7 @@ async fn test_routing_with_db_fs() {
     }
 
     config.site_prefix = "/prefix/".to_string();
-    let state = crate::common::make_app_state_from_config(&config)
-        .await
-        .unwrap();
+    let state = AppState::init(&config).await.unwrap();
 
     if crate::common::supports_database(
         &state.db,
@@ -113,14 +111,7 @@ async fn test_routing_with_db_fs() {
     )
     .await;
 
-    let state = crate::common::make_app_state_from_config(&config)
-        .await
-        .unwrap();
-    let app_data = actix_web::web::Data::new(state);
-
-    let resp = req_path_with_app_data("/prefix/on_db.sql", app_data.clone())
-        .await
-        .unwrap();
+    let resp = response_with("/prefix/on_db.sql", config).await.unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
     assert!(
@@ -130,7 +121,7 @@ async fn test_routing_with_db_fs() {
 }
 
 #[cfg(unix)]
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_non_unicode_static_path_returns_bad_request_with_db_fs() {
     let mut config = test_config();
     if !config.database_url.starts_with("sqlite") {
@@ -139,22 +130,11 @@ async fn test_non_unicode_static_path_returns_bad_request_with_db_fs() {
     config.database_url =
         "sqlite://file:test_non_unicode_static_path?mode=memory&cache=shared".to_string();
 
-    let state = crate::common::make_app_state_from_config(&config)
-        .await
-        .unwrap();
+    let state = AppState::init(&config).await.unwrap();
     let expected_db_path = "\u{FFFD}.txt";
     store_file_in_db(&state, expected_db_path, b"file from db fs").await;
 
-    let state = crate::common::make_app_state_from_config(&config)
-        .await
-        .unwrap();
-    let app_data = actix_web::web::Data::new(state);
-    let req = test::TestRequest::get()
-        .uri("/%FF.txt")
-        .app_data(app_data)
-        .to_srv_request();
-
-    let err = webserver::http::main_handler(req)
+    let err = response_with("/%FF.txt", config)
         .await
         .expect_err("non-unicode path should not panic and must return bad request");
     assert_eq!(
@@ -163,16 +143,12 @@ async fn test_non_unicode_static_path_returns_bad_request_with_db_fs() {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_routing_with_prefix() {
     let mut config = test_config();
     config.site_prefix = "/prefix/".to_string();
-    let state = crate::common::make_app_state_from_config(&config)
-        .await
-        .unwrap();
-
-    let app_data = actix_web::web::Data::new(state);
-    let resp = req_path_with_app_data(
+    let app_data = make_app_data_from_config(config).await.unwrap();
+    let resp = response_with_data(
         "/prefix/tests/sql_test_files/component_rendering/simple.sql",
         app_data.clone(),
     )
@@ -189,7 +165,7 @@ async fn test_routing_with_prefix() {
         "{body_str}\nexpected to contain links with site prefix"
     );
 
-    let resp = req_path_with_app_data("/prefix/nonexistent.sql", app_data.clone())
+    let resp = response_with_data("/prefix/nonexistent.sql", app_data.clone())
         .await
         .expect("should handle 404");
     let body_str = crate::common::read_body_string(resp).await;
@@ -198,13 +174,14 @@ async fn test_routing_with_prefix() {
         "Response should contain \"404\", but got:\n{body_str}"
     );
 
-    let resp = req_path_with_app_data("/prefix/sqlpage/migrations/0001_init.sql", app_data.clone())
+    let resp = response_with_data("/prefix/sqlpage/migrations/0001_init.sql", app_data.clone())
         .await
         .expect_err("Expected forbidden error")
-        .to_string();
-    assert!(resp.to_lowercase().contains("forbidden"), "{resp}");
+        .as_response_error()
+        .status_code();
+    assert_eq!(resp, StatusCode::FORBIDDEN);
 
-    let resp = req_path_with_app_data(
+    let resp = response_with_data(
         "/tests/sql_test_files/component_rendering/simple.sql",
         app_data,
     )
@@ -218,17 +195,16 @@ async fn test_routing_with_prefix() {
     assert_eq!(location.to_str().unwrap(), "/prefix/");
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_hidden_files() {
-    let resp_result = req_path("/tests/core/.hidden.sql").await;
+    let resp_result = response_with("/tests/core/.hidden.sql", test_config()).await;
     assert!(
         resp_result.is_err(),
         "Accessing a hidden file should be forbidden, but received success: {resp_result:?}"
     );
     let resp = resp_result.unwrap_err().error_response();
     assert_eq!(resp.status(), StatusCode::FORBIDDEN);
-    let srv_resp = test::TestRequest::default().to_srv_response(resp);
-    let body = test::read_body(srv_resp).await;
+    let body = actix_web::body::to_bytes(resp.into_body()).await.unwrap();
     assert!(
         String::from_utf8_lossy(&body)
             .to_lowercase()
@@ -236,10 +212,10 @@ async fn test_hidden_files() {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_official_website_documentation() {
     let app_data = make_app_data_for_official_website().await;
-    let resp = req_path_with_app_data("/component.sql?component=button", app_data)
+    let resp = response_with_data("/component.sql?component=button", app_data)
         .await
         .unwrap_or_else(|e| {
             panic!("Failed to get response for /component.sql?component=button: {e}")
@@ -252,9 +228,9 @@ async fn test_official_website_documentation() {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_official_website_basic_auth_example() {
-    let resp = req_path_with_app_data(
+    let resp = response_with_data(
         "/examples/authentication/basic_auth.sql",
         make_app_data_for_official_website().await,
     )
@@ -274,7 +250,7 @@ async fn make_app_data_for_official_website() -> actix_web::web::Data<AppState>
     let mut app_config = sqlpage::app_config::load_from_directory(config_path).unwrap();
     app_config.web_root = std::path::PathBuf::from("examples/official-site");
     app_config.database_url = "sqlite::memory:".to_string();
-    let app_state = make_app_data_from_config(app_config.clone()).await;
+    let app_state = make_app_data_from_config(app_config.clone()).await.unwrap();
     webserver::database::migrations::apply(&app_config, &app_state.db)
         .await
         .unwrap();
diff --git a/tests/core/path_aliases.rs b/tests/core/path_aliases.rs
index 36bb6ad13..b1b1516bc 100644
--- a/tests/core/path_aliases.rs
+++ b/tests/core/path_aliases.rs
@@ -1,11 +1,9 @@
 use actix_web::{body::to_bytes, http::StatusCode};
-use sqlpage::webserver::http::main_handler;
 
-use crate::common::get_request_to;
+use crate::common::{response_with, test_config};
 
 async fn assert_sql_response(path: &str, expected_status: StatusCode) {
-    let request = get_request_to(path).await.unwrap().to_srv_request();
-    let response = match main_handler(request).await {
+    let response = match response_with(path, test_config()).await {
         Ok(response) => response.into_parts().1,
         Err(error) => error.error_response(),
     };
@@ -19,12 +17,12 @@ async fn assert_sql_response(path: &str, expected_status: StatusCode) {
     }
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn mixed_case_sql_file_is_executed() {
     assert_sql_response("/tests/core/mixed_case.%53ql", StatusCode::OK).await;
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn trailing_space_sql_path_is_forbidden() {
     assert_sql_response("/tests/core/sql_source.sql%20", StatusCode::FORBIDDEN).await;
 }
@@ -38,19 +36,19 @@ async fn assert_windows_alias_response(path: &str, expected_status: StatusCode)
 }
 
 #[cfg(windows)]
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn windows_mixed_case_sql_alias_is_executed() {
     assert_windows_alias_response("/tests/core/sql_source.SQL", StatusCode::OK).await;
 }
 
 #[cfg(windows)]
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn windows_trailing_dot_sql_alias_is_forbidden() {
     assert_windows_alias_response("/tests/core/sql_source.sql.", StatusCode::FORBIDDEN).await;
 }
 
 #[cfg(windows)]
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn windows_ntfs_stream_sql_alias_is_forbidden() {
     assert_windows_alias_response("/tests/core/sql_source.sql::$DATA", StatusCode::FORBIDDEN).await;
 }
diff --git a/tests/data_formats/mod.rs b/tests/data_formats/mod.rs
index 84868d7fc..49929c9c3 100644
--- a/tests/data_formats/mod.rs
+++ b/tests/data_formats/mod.rs
@@ -1,37 +1,22 @@
 use actix_web::{
     http::{StatusCode, header},
-    test::{self, TestRequest},
+    test,
 };
-use sqlpage::webserver::http::main_handler;
 
-use crate::common::{get_request_to, make_app_data};
+use crate::common::{
+    make_app_data, request_for, response_for, response_from, response_with_data, send_request,
+};
 
 async fn req_with_accept(
     path: &str,
     accept: &str,
 ) -> actix_web::Result<actix_web::dev::ServiceResponse> {
-    req_with_accept_and_data(path, accept, make_app_data().await).await
-}
-
-async fn req_with_accept_and_data(
-    path: &str,
-    accept: &str,
-    app_data: actix_web::web::Data<sqlpage::AppState>,
-) -> actix_web::Result<actix_web::dev::ServiceResponse> {
-    let req = TestRequest::get()
-        .uri(path)
-        .insert_header((header::ACCEPT, accept))
-        .app_data(app_data)
-        .to_srv_request();
-    main_handler(req).await
+    response_from(request_for(path).insert_header((header::ACCEPT, accept))).await
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_json_body() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/data_formats/json_data.sql")
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_for("/tests/data_formats/json_data.sql").await;
 
     assert_eq!(resp.status(), StatusCode::OK);
     assert_eq!(
@@ -46,7 +31,7 @@ async fn test_json_body() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_csv_body() -> actix_web::Result<()> {
     let app_data = make_app_data().await;
     if crate::common::supports_database(
@@ -56,10 +41,7 @@ async fn test_csv_body() -> actix_web::Result<()> {
         return Ok(());
     }
 
-    let req = crate::common::get_request_to_with_data("/tests/data_formats/csv_data.sql", app_data)
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_with_data("/tests/data_formats/csv_data.sql", app_data).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     assert_eq!(
@@ -74,7 +56,7 @@ async fn test_csv_body() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_csv_filename_header_injection() -> actix_web::Result<()> {
     use actix_web::http::header::ContentDisposition;
 
@@ -83,9 +65,7 @@ async fn test_csv_filename_header_injection() -> actix_web::Result<()> {
     // Content-Disposition header. The attacker-supplied value must NOT create a
     // second, agent-preferred parameter; it has to stay inside a single,
     // properly quoted `filename` value.
-    let resp = crate::common::req_path("/tests/data_formats/csv_filename_injection.sql")
-        .await
-        .expect("request failed");
+    let resp = response_for("/tests/data_formats/csv_filename_injection.sql").await;
     assert_eq!(resp.status(), StatusCode::OK);
     let raw = resp
         .headers()
@@ -113,7 +93,7 @@ async fn test_csv_filename_header_injection() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_json_columns() {
     let app_data = make_app_data().await;
     if !crate::common::supports_database(
@@ -127,10 +107,9 @@ async fn test_json_columns() {
         return;
     }
 
-    let resp =
-        crate::common::req_path_with_app_data("/tests/data_formats/json_columns.sql", app_data)
-            .await
-            .expect("Failed to request /tests/data_formats/json_columns.sql");
+    let resp = response_with_data("/tests/data_formats/json_columns.sql", app_data)
+        .await
+        .expect("Failed to request /tests/data_formats/json_columns.sql");
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
     let body_html_escaped = body_str.replace("&quot;", "\"");
@@ -150,7 +129,7 @@ async fn test_json_columns() {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_accept_json_returns_json_array() -> actix_web::Result<()> {
     let resp = req_with_accept(
         "/tests/sql_test_files/component_rendering/simple.sql",
@@ -171,7 +150,7 @@ async fn test_accept_json_returns_json_array() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_accept_ndjson_returns_jsonlines() -> actix_web::Result<()> {
     let resp = req_with_accept(
         "/tests/sql_test_files/component_rendering/simple.sql",
@@ -197,7 +176,7 @@ async fn test_accept_ndjson_returns_jsonlines() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_accept_html_returns_html() -> actix_web::Result<()> {
     let resp = req_with_accept(
         "/tests/sql_test_files/component_rendering/simple.sql",
@@ -214,7 +193,7 @@ async fn test_accept_html_returns_html() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_accept_wildcard_returns_html() -> actix_web::Result<()> {
     let resp = req_with_accept(
         "/tests/sql_test_files/component_rendering/simple.sql",
@@ -229,7 +208,7 @@ async fn test_accept_wildcard_returns_html() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_accept_json_redirect_still_works() -> actix_web::Result<()> {
     let resp =
         req_with_accept("/tests/server_timing/redirect_test.sql", "application/json").await?;
@@ -243,7 +222,12 @@ async fn test_accept_json_redirect_still_works() -> actix_web::Result<()> {
 
 /// Builds an `AppState` running in production mode.
 async fn make_prod_app_data() -> actix_web::web::Data<sqlpage::AppState> {
-    crate::common::make_app_data_with_env(sqlpage::app_config::DevOrProd::Production).await
+    crate::common::make_app_data_from_config(sqlpage::app_config::AppConfig {
+        environment: sqlpage::app_config::DevOrProd::Production,
+        ..crate::common::test_config()
+    })
+    .await
+    .unwrap()
 }
 
 async fn response_body_with_accept(
@@ -251,9 +235,12 @@ async fn response_body_with_accept(
     accept: &str,
     app_data: actix_web::web::Data<sqlpage::AppState>,
 ) -> String {
-    let resp = req_with_accept_and_data(path, accept, app_data)
-        .await
-        .expect("request should not fail at the handler level");
+    let resp = send_request(
+        request_for(path).insert_header((header::ACCEPT, accept)),
+        app_data,
+    )
+    .await
+    .expect("request should not fail at the handler level");
     crate::common::read_body_string(resp).await
 }
 
@@ -281,7 +268,7 @@ fn assert_no_sql_leak(body: &str, context: &str) {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_prod_json_error_does_not_leak_sql() {
     let body = req_prod_body(
         "/tests/data_formats/json_error_leak.sql",
@@ -295,7 +282,7 @@ async fn test_prod_json_error_does_not_leak_sql() {
     assert_no_sql_leak(&body, "json error");
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_prod_csv_error_does_not_leak_sql() {
     let app_data = make_prod_app_data().await;
     if crate::common::supports_database(
@@ -320,7 +307,7 @@ async fn test_prod_csv_error_does_not_leak_sql() {
 /// A CSV page can hit an error before its first data row (so no header has been
 /// written and `columns` is empty). The generic error message must still be
 /// emitted instead of an empty record.
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_prod_csv_error_before_any_row_still_reports() {
     let app_data = make_prod_app_data().await;
     if crate::common::supports_database(
@@ -345,7 +332,7 @@ async fn test_prod_csv_error_before_any_row_still_reports() {
 /// An author may only intend a page to be served as HTML, but a client can
 /// request it with `Accept: application/json` and pick the JSON renderer.
 /// In production that path must not leak SQL text either.
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_prod_html_page_requested_as_json_does_not_leak_sql() {
     let body = req_prod_body(
         "/tests/data_formats/text_error_leak.sql",
diff --git a/tests/errors/basic_auth.rs b/tests/errors/basic_auth.rs
index 337676b92..e6de1b613 100644
--- a/tests/errors/basic_auth.rs
+++ b/tests/errors/basic_auth.rs
@@ -1,11 +1,9 @@
-use crate::common::{get_request_to, req_path};
+use crate::common::{request_for, response_for, response_from};
 use actix_web::http::StatusCode;
-use sqlpage::webserver::http::main_handler;
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_basic_auth_not_provided() {
-    let resp_result = req_path("/tests/errors/basic_auth.sql").await;
-    let resp = resp_result.unwrap();
+    let resp = response_for("/tests/errors/basic_auth.sql").await;
     assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
     assert_eq!(
         resp.headers().get("www-authenticate").unwrap(),
@@ -22,14 +20,11 @@ async fn test_basic_auth_not_provided() {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_basic_auth_with_credentials() {
-    let req = get_request_to("/tests/errors/basic_auth.sql")
-        .await
-        .unwrap() // log in with credentials "user:password"
-        .append_header(("Authorization", "Basic dXNlcjpwYXNzd29yZA=="))
-        .to_srv_request();
-    let resp = main_handler(req)
+    let req = request_for("/tests/errors/basic_auth.sql") // log in with credentials "user:password"
+        .append_header(("Authorization", "Basic dXNlcjpwYXNzd29yZA=="));
+    let resp = response_from(req)
         .await
         .expect("req with credentials should succeed");
     assert_eq!(resp.status(), StatusCode::OK);
diff --git a/tests/errors/invalid_header.rs b/tests/errors/invalid_header.rs
index 76902accb..fd8b7e7ef 100644
--- a/tests/errors/invalid_header.rs
+++ b/tests/errors/invalid_header.rs
@@ -1,4 +1,4 @@
-use crate::common::req_path;
+use crate::common::response_for;
 use actix_web::http::StatusCode;
 use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode};
 use serde_json::{Value, json};
@@ -13,12 +13,7 @@ async fn assert_invalid_header_response(case: &InvalidHeaderCase) {
     let properties = utf8_percent_encode(&properties, NON_ALPHANUMERIC).to_string();
     let path = format!("/tests/errors/invalid_header.sql?properties={properties}");
 
-    let resp = req_path(&path).await.unwrap_or_else(|err| {
-        panic!(
-            "{} should return an error response instead of failing the request: {err:#}",
-            case.name
-        )
-    });
+    let resp = response_for(&path).await;
 
     assert_eq!(
         resp.status(),
@@ -35,7 +30,7 @@ async fn assert_invalid_header_response(case: &InvalidHeaderCase) {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_invalid_header_components_return_an_error_response() {
     let cases = vec![
         InvalidHeaderCase {
diff --git a/tests/errors/mod.rs b/tests/errors/mod.rs
index a528f3182..4005c99c9 100644
--- a/tests/errors/mod.rs
+++ b/tests/errors/mod.rs
@@ -1,27 +1,9 @@
-use actix_web::{
-    http::{self, StatusCode},
-    test,
-};
-use sqlpage::{AppState, webserver::http::main_handler};
+use actix_web::http::StatusCode;
 
-use crate::common::{make_app_data_from_config, req_path, req_path_with_app_data, test_config};
+use crate::common::{make_app_data_from_config, response_with, response_with_data, test_config};
 mod basic_auth;
 mod invalid_header;
 
-/// Sends a direct unprivileged GET request through the main handler and returns the
-/// resulting HTTP status, whether the handler returned an `Ok` response or an `Err`.
-async fn direct_request_status(path: &str, app_data: actix_web::web::Data<AppState>) -> StatusCode {
-    let req = test::TestRequest::get()
-        .uri(path)
-        .app_data(app_data)
-        .insert_header(http::header::Accept::html())
-        .to_srv_request();
-    match main_handler(req).await {
-        Ok(resp) => resp.status(),
-        Err(e) => e.error_response().status(),
-    }
-}
-
 /// Regression test for a cache privilege-escalation bug.
 ///
 /// `sqlpage.run_sql(...)` loads include files with privilege, so it is allowed to
@@ -30,15 +12,15 @@ async fn direct_request_status(path: &str, app_data: actix_web::web::Data<AppSta
 /// that same reserved path must still be rejected with 403, even while the cache
 /// entry is fresh. Before the fix, the fresh cache hit short-circuited the
 /// unprivileged path guard and the private SQL was executed and served.
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_private_path_not_accessible_after_privileged_cache_priming() {
     // Keep cache entries "fresh" so the bug (skipping the path guard on fresh hits) is exercised.
     let mut config = test_config();
     config.cache_stale_duration_ms = Some(60_000);
-    let app_data = make_app_data_from_config(config).await;
+    let app_data = make_app_data_from_config(config).await.unwrap();
 
     // 1. A trusted page primes the cache by loading the reserved file with privilege.
-    let prime = req_path_with_app_data("/tests/errors/prime_private_cache.sql", app_data.clone())
+    let prime = response_with_data("/tests/errors/prime_private_cache.sql", app_data.clone())
         .await
         .expect("priming page should render");
     assert_eq!(prime.status(), StatusCode::OK);
@@ -54,7 +36,11 @@ async fn test_private_path_not_accessible_after_privileged_cache_priming() {
         // Extensionless alias: routing appends .sql and finds the fresh cache entry.
         "/sqlpage/private_cache_bypass_test",
     ] {
-        let status = direct_request_status(path, app_data.clone()).await;
+        let status = response_with_data(path, app_data.clone())
+            .await
+            .unwrap_err()
+            .as_response_error()
+            .status_code();
         assert_eq!(
             status,
             StatusCode::FORBIDDEN,
@@ -63,17 +49,16 @@ async fn test_private_path_not_accessible_after_privileged_cache_priming() {
     }
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_privileged_paths_are_not_accessible() {
-    let resp_result = req_path("/sqlpage/migrations/0001_init.sql").await;
+    let resp_result = response_with("/sqlpage/migrations/0001_init.sql", test_config()).await;
     assert!(
         resp_result.is_err(),
         "Accessing a migration file should be forbidden, but received success: {resp_result:?}"
     );
     let resp = resp_result.unwrap_err().error_response();
     assert_eq!(resp.status(), StatusCode::FORBIDDEN);
-    let srv_resp = test::TestRequest::default().to_srv_response(resp);
-    let body = test::read_body(srv_resp).await;
+    let body = actix_web::body::to_bytes(resp.into_body()).await.unwrap();
     assert!(
         String::from_utf8_lossy(&body)
             .to_lowercase()
@@ -81,7 +66,7 @@ async fn test_privileged_paths_are_not_accessible() {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_404_fallback() {
     let app_data = crate::common::make_app_data().await;
     for f in [
@@ -89,7 +74,7 @@ async fn test_404_fallback() {
         "/tests/errors/does_not_exist.html",
         "/tests/errors/does_not_exist/",
     ] {
-        let resp = req_path_with_app_data(f, app_data.clone()).await.unwrap();
+        let resp = response_with_data(f, app_data.clone()).await.unwrap();
         assert_eq!(resp.status(), StatusCode::OK, "{f} isnt 200");
         let body = crate::common::read_body_string(resp).await;
         assert!(body.starts_with("<!DOCTYPE html>"));
@@ -100,7 +85,7 @@ async fn test_404_fallback() {
     }
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_default_404() {
     let app_data = crate::common::make_app_data().await;
     let msg = "The page you were looking for does not exist";
@@ -111,7 +96,7 @@ async fn test_default_404() {
         "/i-do-not-exist",
         "/tests/it_works.txt/site/wp-includes/wlwmanifest.xml",
     ] {
-        let resp = req_path_with_app_data(f, app_data.clone()).await.unwrap();
+        let resp = response_with_data(f, app_data.clone()).await.unwrap();
         assert_eq!(
             resp.status(),
             StatusCode::NOT_FOUND,
@@ -124,9 +109,9 @@ async fn test_default_404() {
     }
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_requesting_a_directory_is_not_found() {
-    let resp_result = req_path("/tests/errors/is_a_directory.d").await;
+    let resp_result = response_with("/tests/errors/is_a_directory.d", test_config()).await;
     let status = match resp_result {
         Ok(resp) => resp.status(),
         Err(e) => e.as_response_error().status_code(),
diff --git a/tests/exec/mod.rs b/tests/exec/mod.rs
index 5b4c9c13a..e7b4a9ca7 100644
--- a/tests/exec/mod.rs
+++ b/tests/exec/mod.rs
@@ -1,16 +1,12 @@
-use actix_web::{http::header, test::TestRequest};
-use sqlpage::webserver::http::main_handler;
+use actix_web::http::header;
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_exec() {
-    let app_data = crate::common::make_app_data().await;
-    let req = TestRequest::get()
-        .uri(exec_test_uri())
-        .app_data(app_data)
-        .insert_header(header::Accept::json())
-        .to_srv_request();
-
-    let resp = main_handler(req).await.unwrap();
+    let resp = crate::common::response_from(
+        crate::common::request_for(exec_test_uri()).insert_header(header::Accept::json()),
+    )
+    .await
+    .unwrap();
     let body = actix_web::test::read_body(resp).await;
     let rows: Vec<serde_json::Value> = serde_json::from_slice(&body).unwrap();
     let actual = rows[0]["actual"].as_str().unwrap();
diff --git a/tests/oidc/mod.rs b/tests/oidc/mod.rs
index ef31a8269..41cd935cf 100644
--- a/tests/oidc/mod.rs
+++ b/tests/oidc/mod.rs
@@ -406,14 +406,12 @@ async fn setup_oidc_test_with_paths(
     let mut config = oidc_test_config(&provider, protected_paths, public_paths);
     config.listen_on = Some("127.0.0.1:0".parse().unwrap());
     config.host = Some("localhost:1".to_string());
-    let app_state = crate::common::make_app_state_from_config(&config)
-        .await
-        .unwrap();
+    let app_state = sqlpage::AppState::init(&config).await.unwrap();
     let app = test::init_service(create_app(Data::new(app_state))).await;
     (app, provider)
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_public_clean_url_cannot_execute_a_protected_sql_file() {
     let file = "/tests/sql_test_files/data/regex_match_routing.sql";
     let protected_paths = [file];
@@ -430,7 +428,7 @@ async fn test_public_clean_url_cannot_execute_a_protected_sql_file() {
     assert_ne!(public.status(), StatusCode::SEE_OTHER);
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_top_level_builtin_assets_are_accessible_without_login_when_protected() {
     let protected_paths = ["/sqlpage."];
     let (app, _provider) = setup_oidc_test_with_paths(|_| {}, &protected_paths, &[]).await;
@@ -453,7 +451,7 @@ async fn test_top_level_builtin_assets_are_accessible_without_login_when_protect
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_cached_authorization_redirect_cannot_replay_consumed_state() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
@@ -506,7 +504,7 @@ async fn test_oidc_cached_authorization_redirect_cannot_replay_consumed_state()
     assert_eq!(final_response.status(), StatusCode::OK);
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_happy_path() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
@@ -600,12 +598,12 @@ async fn assert_oidc_callback_fails_with_bad_jwt(
     .await;
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_csrf_state_mismatch_is_rejected() {
     assert_oidc_login_fails(|_| {}, Some("wrong_state")).await;
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_nonce_mismatch_is_rejected() {
     assert_oidc_callback_fails_with_bad_jwt(|claims| {
         claims["nonce"] = json!("wrong_nonce");
@@ -613,7 +611,7 @@ async fn test_oidc_nonce_mismatch_is_rejected() {
     .await;
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_bad_signature_is_rejected() {
     assert_oidc_login_fails(
         |state| {
@@ -624,7 +622,7 @@ async fn test_oidc_bad_signature_is_rejected() {
     .await;
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_wrong_audience_is_rejected() {
     assert_oidc_callback_fails_with_bad_jwt(|claims| {
         claims["aud"] = json!("wrong_client");
@@ -632,7 +630,7 @@ async fn test_oidc_wrong_audience_is_rejected() {
     .await;
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_wrong_issuer_is_rejected() {
     assert_oidc_callback_fails_with_bad_jwt(|claims| {
         claims["iss"] = json!("https://wrong-issuer.com");
@@ -640,7 +638,7 @@ async fn test_oidc_wrong_issuer_is_rejected() {
     .await;
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_expired_token_is_rejected() {
     assert_oidc_callback_fails_with_bad_jwt(|claims| {
         let current_exp = claims["exp"].as_i64().unwrap();
@@ -649,7 +647,7 @@ async fn test_oidc_expired_token_is_rejected() {
     .await;
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_repeatedly_failing_callback_stops_redirecting_to_the_provider() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
@@ -715,14 +713,12 @@ async fn setup_oidc_test_with_prefix(
     provider.with_state_mut(provider_mutator);
     let mut config = oidc_test_config(&provider, &["/"], &[]);
     config.site_prefix = site_prefix.to_string();
-    let app_state = crate::common::make_app_state_from_config(&config)
-        .await
-        .unwrap();
+    let app_state = sqlpage::AppState::init(&config).await.unwrap();
     let app = test::init_service(create_app(Data::new(app_state))).await;
     (app, provider)
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_with_site_prefix() {
     let (app, _provider) = setup_oidc_test_with_prefix(|_| {}, "/my-app/").await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
@@ -740,16 +736,14 @@ async fn test_oidc_with_site_prefix() {
     );
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_logout_uses_correct_scheme() {
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
 
     let mut config = oidc_test_config(&provider, &[], &[]);
     config.https_domain = Some("example.com".to_string());
-    let app_state = crate::common::make_app_state_from_config(&config)
-        .await
-        .unwrap();
+    let app_state = sqlpage::AppState::init(&config).await.unwrap();
     let logout_path = app_state
         .oidc_state
         .as_ref()
@@ -775,7 +769,7 @@ async fn test_oidc_logout_uses_correct_scheme() {
 /// An OIDC provider metadata refresh must not block authenticated requests.
 /// The refresh should happen in the background while existing requests are
 /// served using the current (possibly stale) OIDC client.
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_slow_discovery_does_not_block_authenticated_requests() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
@@ -819,7 +813,7 @@ async fn test_slow_discovery_does_not_block_authenticated_requests() {
 
 /// A slow OIDC token endpoint must not freeze the server.
 /// The body-read timeout fires and the request completes with a redirect.
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_slow_token_endpoint_does_not_freeze_server() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
@@ -854,16 +848,14 @@ async fn test_slow_token_endpoint_does_not_freeze_server() {
 /// generated for one session must NOT clear a different browser's auth cookie
 /// (forced-logout CSRF), while the legitimate logout of the issuing session
 /// must keep working.
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_oidc_logout_is_session_bound() {
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
 
     let mut config = oidc_test_config(&provider, &["/"], &[]);
     config.host = Some("localhost:1".to_string());
-    let app_state = crate::common::make_app_state_from_config(&config)
-        .await
-        .unwrap();
+    let app_state = sqlpage::AppState::init(&config).await.unwrap();
     let oidc_state = app_state.oidc_state.clone().unwrap();
     let app = test::init_service(create_app(Data::new(app_state))).await;
 
diff --git a/tests/parameter_binding/mod.rs b/tests/parameter_binding/mod.rs
index 89fa17cc6..bee65962c 100644
--- a/tests/parameter_binding/mod.rs
+++ b/tests/parameter_binding/mod.rs
@@ -2,11 +2,9 @@ use actix_web::http::StatusCode;
 use sqlx::any::AnyKind;
 use sqlx::connection::Connection as _;
 
-use sqlpage::webserver::http::main_handler;
+use crate::common::{make_app_data, response_with_data};
 
-use crate::common::{get_request_to_with_data, make_app_data};
-
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_parameterized_pages_leave_a_prepared_statement_in_the_cache() -> actix_web::Result<()>
 {
     let data = make_app_data().await;
@@ -15,13 +13,11 @@ async fn test_parameterized_pages_leave_a_prepared_statement_in_the_cache() -> a
     }
 
     for _ in 0..3 {
-        let req = get_request_to_with_data(
+        let resp = response_with_data(
             "/tests/parameter_binding/echo_parameter.sql?x=1447",
             data.clone(),
         )
-        .await?
-        .to_srv_request();
-        let resp = main_handler(req).await?;
+        .await?;
         assert_eq!(resp.status(), StatusCode::OK);
         let page = crate::common::read_body_string(resp).await;
         assert!(
diff --git a/tests/requests/mod.rs b/tests/requests/mod.rs
index 328e4e611..71973424d 100644
--- a/tests/requests/mod.rs
+++ b/tests/requests/mod.rs
@@ -1,24 +1,25 @@
 use actix_web::{http::StatusCode, test};
 use serde_json::json;
-use sqlpage::webserver::http::main_handler;
 
-use crate::common::{get_request_to, get_request_to_with_data};
+use crate::common::{multipart_request, request_for, response_for, response_from, send_request};
 
-async fn rendered_page(req: actix_web::dev::ServiceRequest) -> actix_web::Result<String> {
-    let resp = main_handler(req).await?;
+async fn rendered_page(
+    req: test::TestRequest,
+    data: actix_web::web::Data<sqlpage::AppState>,
+) -> actix_web::Result<String> {
+    let resp = send_request(req, data).await?;
     assert_eq!(resp.status(), StatusCode::OK);
     Ok(crate::common::read_body_string(resp).await)
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_request_body() -> actix_web::Result<()> {
     let app_data = crate::common::make_app_data().await;
     let page = rendered_page(
-        get_request_to_with_data("/tests/requests/request_body_test.sql", app_data.clone())
-            .await?
+        request_for("/tests/requests/request_body_test.sql")
             .insert_header(("content-type", "text/plain"))
-            .set_payload("Hello, world!")
-            .to_srv_request(),
+            .set_payload("Hello, world!"),
+        app_data.clone(),
     )
     .await?;
     assert!(
@@ -27,19 +28,17 @@ async fn test_request_body() -> actix_web::Result<()> {
     );
 
     let page = rendered_page(
-        get_request_to_with_data("/tests/requests/request_body_test.sql", app_data.clone())
-            .await?
+        request_for("/tests/requests/request_body_test.sql")
             .insert_header(("content-type", "application/x-www-form-urlencoded"))
-            .set_payload("key=value")
-            .to_srv_request(),
+            .set_payload("key=value"),
+        app_data.clone(),
     )
     .await?;
     assert!(page.contains("NULL"), "{page}\nexpected NULL for form data");
 
     let page = rendered_page(
-        get_request_to_with_data("/tests/requests/request_body_test.sql", app_data)
-            .await?
-            .to_srv_request(),
+        request_for("/tests/requests/request_body_test.sql"),
+        app_data,
     )
     .await?;
     assert!(
@@ -49,7 +48,7 @@ async fn test_request_body() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_request_body_base64() -> actix_web::Result<()> {
     let binary_data = (0u8..=255u8).collect::<Vec<_>>();
     let expected_base64 =
@@ -57,14 +56,10 @@ async fn test_request_body_base64() -> actix_web::Result<()> {
     let app_data = crate::common::make_app_data().await;
 
     let page = rendered_page(
-        get_request_to_with_data(
-            "/tests/requests/request_body_base64_test.sql",
-            app_data.clone(),
-        )
-        .await?
-        .insert_header(("content-type", "application/octet-stream"))
-        .set_payload(binary_data)
-        .to_srv_request(),
+        request_for("/tests/requests/request_body_base64_test.sql")
+            .insert_header(("content-type", "application/octet-stream"))
+            .set_payload(binary_data),
+        app_data.clone(),
     )
     .await?;
     assert!(
@@ -73,22 +68,17 @@ async fn test_request_body_base64() -> actix_web::Result<()> {
     );
 
     let page = rendered_page(
-        get_request_to_with_data(
-            "/tests/requests/request_body_base64_test.sql",
-            app_data.clone(),
-        )
-        .await?
-        .insert_header(("content-type", "application/x-www-form-urlencoded"))
-        .set_payload("key=value")
-        .to_srv_request(),
+        request_for("/tests/requests/request_body_base64_test.sql")
+            .insert_header(("content-type", "application/x-www-form-urlencoded"))
+            .set_payload("key=value"),
+        app_data.clone(),
     )
     .await?;
     assert!(page.contains("NULL"), "{page}\nexpected NULL for form data");
 
     let page = rendered_page(
-        get_request_to_with_data("/tests/requests/request_body_base64_test.sql", app_data)
-            .await?
-            .to_srv_request(),
+        request_for("/tests/requests/request_body_base64_test.sql"),
+        app_data,
     )
     .await?;
     assert!(
@@ -98,12 +88,9 @@ async fn test_request_body_base64() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_download_data_url() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/requests/request_download_test.sql")
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_for("/tests/requests/request_download_test.sql").await;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let ct = resp.headers().get("content-type").unwrap();
@@ -118,15 +105,13 @@ async fn test_download_data_url() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_large_form_field_roundtrip() -> actix_web::Result<()> {
     let long_string = "a".repeat(123_454);
-    let req = get_request_to("/tests/components/display_form_field.sql")
-        .await?
+    let req = request_for("/tests/components/display_form_field.sql")
         .insert_header(("content-type", "application/x-www-form-urlencoded"))
-        .set_payload(["x=", &long_string].concat()) // total size is 123454 + 2 = 123456 bytes
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+        .set_payload(["x=", &long_string].concat()); // total size is 123454 + 2 = 123456 bytes
+    let resp = response_from(req).await?;
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
     assert!(
@@ -140,17 +125,15 @@ async fn test_large_form_field_roundtrip() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_variables_function() -> actix_web::Result<()> {
     let url = "/tests/requests/variables.sql?common=get_value&get_only=get_val";
     let req_body = "common=post_value&post_only=post_val";
-    let req = get_request_to(url)
-        .await?
+    let req = request_for(url)
         .insert_header(("content-type", "application/x-www-form-urlencoded"))
         .insert_header(("accept", "application/json"))
-        .set_payload(req_body)
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+        .set_payload(req_body);
+    let resp = response_from(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let body_json: serde_json::Value = test::read_body_json(resp).await;
@@ -207,22 +190,19 @@ async fn test_variables_function() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_invalid_utf8_multipart_text_field_returns_bad_request() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/requests/variables.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            b"--1234567890\r\n\
+    let req = multipart_request(
+        "/tests/requests/variables.sql",
+        b"--1234567890\r\n\
             Content-Disposition: form-data; name=\"x\"\r\n\
             Content-Type: text/plain\r\n\
             \r\n\
             \xff\r\n\
             --1234567890--\r\n"
-                .as_slice(),
-        )
-        .to_srv_request();
-    let status = match main_handler(req).await {
+            .as_slice(),
+    );
+    let status = match response_from(req).await {
         Ok(resp) => resp.status(),
         Err(err) => err.as_response_error().status_code(),
     };
@@ -236,21 +216,18 @@ async fn test_invalid_utf8_multipart_text_field_returns_bad_request() -> actix_w
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_missing_multipart_content_disposition_returns_bad_request() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/requests/variables.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            b"--1234567890\r\n\
+    let req = multipart_request(
+        "/tests/requests/variables.sql",
+        b"--1234567890\r\n\
             Content-Type: text/plain\r\n\
             \r\n\
             hello\r\n\
             --1234567890--\r\n"
-                .as_slice(),
-        )
-        .to_srv_request();
-    let status = match main_handler(req).await {
+            .as_slice(),
+    );
+    let status = match response_from(req).await {
         Ok(resp) => resp.status(),
         Err(err) => err.as_response_error().status_code(),
     };
diff --git a/tests/requests/webhook_hmac.rs b/tests/requests/webhook_hmac.rs
index 5cd160e24..02c0432c1 100644
--- a/tests/requests/webhook_hmac.rs
+++ b/tests/requests/webhook_hmac.rs
@@ -1,12 +1,10 @@
 use actix_web::{http::StatusCode, test};
-use sqlpage::webserver::http::main_handler;
 
-use crate::common::get_request_to_with_data;
+use crate::common::{request_for, response_from};
 
 /// Builds a webhook validation request, optionally signed with `signature`.
 /// Sets `WEBHOOK_SECRET` so every test signs against the same secret.
 async fn webhook_request(
-    app_data: actix_web::web::Data<sqlpage::AppState>,
     signature: Option<&str>,
 ) -> actix_web::Result<actix_web::dev::ServiceResponse> {
     // Set up environment variable for webhook secret
@@ -15,21 +13,18 @@ async fn webhook_request(
     }
 
     let webhook_body = r#"{"order_id":12345,"total":"99.99"}"#;
-    let mut req = get_request_to_with_data("/tests/webhook_hmac_validation.sql", app_data)
-        .await?
+    let mut req = request_for("/tests/webhook_hmac_validation.sql")
         .insert_header(("content-type", "application/json"));
     if let Some(signature) = signature {
         req = req.insert_header(("X-Webhook-Signature", signature));
     }
-    let req = req.set_payload(webhook_body).to_srv_request();
-    main_handler(req).await
+    response_from(req.set_payload(webhook_body)).await
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_webhook_hmac_invalid_signature() -> actix_web::Result<()> {
-    let app_data = crate::common::make_app_data().await;
     let invalid_signature = "96a5f6f65c85a2d4d1f3a37813ab2c0b44041bdc17691fbb0884e3eb52b7c54b";
-    let resp = webhook_request(app_data, Some(invalid_signature)).await?;
+    let resp = webhook_request(Some(invalid_signature)).await?;
 
     // Should redirect to error page when signature is invalid
     assert!(
@@ -48,11 +43,10 @@ async fn test_webhook_hmac_invalid_signature() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_webhook_hmac_valid_signature() -> actix_web::Result<()> {
-    let app_data = crate::common::make_app_data().await;
     let valid_signature = "260b3b5ead84843645588af82d5d2c3fe24c598a950d36c45438c3a5f5bb941c";
-    let resp = webhook_request(app_data, Some(valid_signature)).await?;
+    let resp = webhook_request(Some(valid_signature)).await?;
 
     // Should return success when signature is valid
     assert_eq!(resp.status(), StatusCode::OK, "200 resp for signed req");
@@ -65,11 +59,10 @@ async fn test_webhook_hmac_valid_signature() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_webhook_hmac_missing_signature() -> actix_web::Result<()> {
-    let app_data = crate::common::make_app_data().await;
     // Don't include the X-Webhook-Signature header
-    let resp = webhook_request(app_data, None).await?;
+    let resp = webhook_request(None).await?;
 
     let location = resp
         .headers()
diff --git a/tests/server_timing/mod.rs b/tests/server_timing/mod.rs
index e58e59801..6630c4d10 100644
--- a/tests/server_timing/mod.rs
+++ b/tests/server_timing/mod.rs
@@ -1,7 +1,7 @@
 use actix_web::http::StatusCode;
-use sqlpage::webserver::http::main_handler;
+use sqlpage::app_config::{AppConfig, DevOrProd};
 
-use crate::common::{get_request_to, make_app_data_with_env};
+use crate::common::{response_for, response_with, test_config};
 
 /// Returns the value of the `Server-Timing` response header, failing the test
 /// when the header is missing.
@@ -13,17 +13,16 @@ fn server_timing_header(resp: &actix_web::dev::ServiceResponse) -> &str {
         .unwrap()
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_server_timing_disabled_in_production() -> actix_web::Result<()> {
-    let app_data = make_app_data_with_env(sqlpage::app_config::DevOrProd::Production).await;
-
-    let req = crate::common::get_request_to_with_data(
+    let resp = response_with(
         "/tests/sql_test_files/component_rendering/simple.sql",
-        app_data,
+        AppConfig {
+            environment: DevOrProd::Production,
+            ..test_config()
+        },
     )
-    .await?
-    .to_srv_request();
-    let resp = main_handler(req).await?;
+    .await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     assert!(
@@ -33,17 +32,16 @@ async fn test_server_timing_disabled_in_production() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_server_timing_enabled_in_development() -> actix_web::Result<()> {
-    let app_data = make_app_data_with_env(sqlpage::app_config::DevOrProd::Development).await;
-
-    let req = crate::common::get_request_to_with_data(
+    let resp = response_with(
         "/tests/sql_test_files/data/postgres_cast_syntax.sql",
-        app_data,
+        AppConfig {
+            environment: DevOrProd::Development,
+            ..test_config()
+        },
     )
-    .await?
-    .to_srv_request();
-    let resp = main_handler(req).await?;
+    .await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let header_value = server_timing_header(&resp);
@@ -58,12 +56,9 @@ async fn test_server_timing_enabled_in_development() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_server_timing_format() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/sql_test_files/data/postgres_cast_syntax.sql")
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_for("/tests/sql_test_files/data/postgres_cast_syntax.sql").await;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let header_value = server_timing_header(&resp);
@@ -90,15 +85,16 @@ async fn test_server_timing_format() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_server_timing_in_redirect() -> actix_web::Result<()> {
-    let app_data = make_app_data_with_env(sqlpage::app_config::DevOrProd::Development).await;
-
-    let req =
-        crate::common::get_request_to_with_data("/tests/server_timing/redirect_test.sql", app_data)
-            .await?
-            .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_with(
+        "/tests/server_timing/redirect_test.sql",
+        AppConfig {
+            environment: DevOrProd::Development,
+            ..test_config()
+        },
+    )
+    .await?;
 
     assert_eq!(
         resp.status(),
diff --git a/tests/sql_test_files/mod.rs b/tests/sql_test_files/mod.rs
index 2a66cbeb6..be7eb7b76 100644
--- a/tests/sql_test_files/mod.rs
+++ b/tests/sql_test_files/mod.rs
@@ -5,7 +5,7 @@ use std::time::Duration;
 use tokio::sync::oneshot;
 use tokio::task::JoinHandle;
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn run_all_sql_test_files() {
     let app_data = crate::common::make_app_data().await;
     run_sql_test_cases(&app_data, get_sql_test_cases()).await;
@@ -14,7 +14,7 @@ async fn run_all_sql_test_files() {
 /// Runs the SQL test files in `database-specific/<current database>/`.
 /// These files use syntax that only works on a single database engine, so they
 /// cannot be part of the generic `run_all_sql_test_files` test.
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn run_database_specific_sql_test_files() {
     let app_data = crate::common::make_app_data().await;
     let db_type = database_type_name(&app_data);
@@ -131,13 +131,21 @@ async fn run_sql_test(
 
     let use_json = matches!(test_case.format, SqlTestFormat::Json);
 
-    let resp = tokio::time::timeout(Duration::from_secs(5), async {
-        if use_json {
-            crate::common::req_path_with_app_data_json(&req_str, app_data.clone()).await
-        } else {
-            crate::common::req_path_with_app_data(&req_str, app_data.clone()).await
-        }
-    })
+    let request = crate::common::request_for(&req_str)
+        .insert_header(("cookie", "test_cook=123"))
+        .insert_header(("authorization", "Basic dGVzdDp0ZXN0"))
+        .insert_header((
+            "accept",
+            if use_json {
+                "application/json"
+            } else {
+                "text/html"
+            },
+        ));
+    let resp = tokio::time::timeout(
+        Duration::from_secs(5),
+        crate::common::send_request(request, app_data.clone()),
+    )
     .await
     .unwrap_or_else(|_| panic!("Test timeout: {}", test_file.display()))
     .unwrap_or_else(|e| panic!("Request failed: {}: {}", test_file.display(), e));
diff --git a/tests/transactions/mod.rs b/tests/transactions/mod.rs
index 9c5a29d6c..e0e3cf324 100644
--- a/tests/transactions/mod.rs
+++ b/tests/transactions/mod.rs
@@ -1,9 +1,9 @@
 use actix_web::http::StatusCode;
-use sqlpage::webserver::{database::SupportedDatabase, http::main_handler};
+use sqlpage::webserver::database::SupportedDatabase;
 
-use crate::common::{get_request_to_with_data, make_app_data};
+use crate::common::{make_app_data, multipart_request, response_with_data, send_request};
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_transaction_error() -> actix_web::Result<()> {
     let data = make_app_data().await;
     let path = match data.db.info.database_type {
@@ -14,10 +14,7 @@ async fn test_transaction_error() -> actix_web::Result<()> {
         }
         _ => "/tests/transactions/failed_transaction.sql",
     };
-    let req = get_request_to_with_data(path, data.clone())
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_with_data(path, data.clone()).await?;
     let body_str = crate::common::read_body_string(resp)
         .await
         .to_ascii_lowercase();
@@ -27,10 +24,7 @@ async fn test_transaction_error() -> actix_web::Result<()> {
     );
     // Now query again, with ?x=1447
     let path_with_param = path.to_string() + "?x=1447";
-    let req = get_request_to_with_data(&path_with_param, data.clone())
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_with_data(&path_with_param, data.clone()).await?;
     let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("1447"),
@@ -39,26 +33,22 @@ async fn test_transaction_error() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_failed_copy_followed_by_query() -> actix_web::Result<()> {
     let app_data = make_app_data().await;
     let big_csv = "col1,col2\nval1,val2\n".repeat(1000);
-    let req = get_request_to_with_data(
+    let req = multipart_request(
         "/tests/sql_test_files/component_rendering/error_failed_to_import_the_csv.sql",
-        app_data.clone(),
-    )
-    .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(format!(
+        format!(
             "--1234567890\r\n\
             Content-Disposition: form-data; name=\"recon_csv_file_input\"; filename=\"data.csv\"\r\n\
             Content-Type: text/csv\r\n\
             \r\n\
             {big_csv}\r\n\
             --1234567890--\r\n"
-        ))
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+        ),
+    );
+    let resp = send_request(req, app_data.clone()).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
@@ -80,10 +70,7 @@ async fn test_failed_copy_followed_by_query() -> actix_web::Result<()> {
         "/tests/sql_test_files/component_rendering/text_markdown.sql",
         "/tests/sql_test_files/component_rendering/text_unsafe_markdown.sql",
     ] {
-        let req = get_request_to_with_data(path, app_data.clone())
-            .await?
-            .to_srv_request();
-        let resp = main_handler(req).await?;
+        let resp = response_with_data(path, app_data.clone()).await?;
 
         assert_eq!(resp.status(), StatusCode::OK);
         let body_str = crate::common::read_body_string(resp).await;
diff --git a/tests/uploads/mod.rs b/tests/uploads/mod.rs
index 927864ff1..9975d6acf 100644
--- a/tests/uploads/mod.rs
+++ b/tests/uploads/mod.rs
@@ -1,33 +1,18 @@
 use actix_web::{http::StatusCode, test};
-use sqlpage::webserver::http::main_handler;
-
-use crate::common::get_request_to;
-
-/// Builds a multipart upload request with the given raw body.
-async fn multipart_request(
-    target: &str,
-    body: String,
-) -> actix_web::Result<actix_web::dev::ServiceRequest> {
-    Ok(get_request_to(target)
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(body)
-        .to_srv_request())
-}
+
+use crate::common::{multipart_request, response_from};
 
 async fn test_file_upload(target: &str) -> actix_web::Result<()> {
-    let req = multipart_request(
+    let resp = response_from(multipart_request(
         target,
         "--1234567890\r\n\
             Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
             Content-Type: text/plain\r\n\
             \r\n\
             Hello, world!\r\n\
-            --1234567890--\r\n"
-            .to_string(),
-    )
+            --1234567890--\r\n",
+    ))
     .await?;
-    let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
@@ -38,26 +23,21 @@ async fn test_file_upload(target: &str) -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_persist_uploaded_file_mode() -> actix_web::Result<()> {
-    let app_data = crate::common::make_app_data().await;
-    let req = crate::common::get_request_to_with_data(
-        "/tests/uploads/persist_with_mode.sql?mode=644",
-        app_data,
-    )
-    .await?
-    .insert_header((actix_web::http::header::ACCEPT, "application/json"))
-    .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-    .set_payload(
-        "--1234567890\r\n\
+    let resp = response_from(
+        multipart_request(
+            "/tests/uploads/persist_with_mode.sql?mode=644",
+            "--1234567890\r\n\
             Content-Disposition: form-data; name=\"my_file\"; filename=\"test.txt\"\r\n\
             Content-Type: text/plain\r\n\
             \r\n\
             Hello\r\n\
             --1234567890--\r\n",
+        )
+        .insert_header(("accept", "application/json")),
     )
-    .to_srv_request();
-    let resp = main_handler(req).await?;
+    .await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let body_json: serde_json::Value = test::read_body_json(resp).await;
@@ -94,30 +74,28 @@ async fn test_persist_uploaded_file_mode() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_file_upload_direct() -> actix_web::Result<()> {
     test_file_upload("/tests/uploads/upload_file_test.sql").await
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_file_upload_through_runsql() -> actix_web::Result<()> {
     test_file_upload("/tests/uploads/upload_file_runsql_test.sql").await
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_blank_file_upload_field() -> actix_web::Result<()> {
-    let req = multipart_request(
+    let resp = response_from(multipart_request(
         "/tests/uploads/upload_file_test.sql",
         "--1234567890\r\n\
         Content-Disposition: form-data; name=\"my_file\"; filename=\"\"\r\n\
         Content-Type: application/octet-stream\r\n\
         \r\n\
         \r\n\
-        --1234567890--\r\n"
-            .to_string(),
-    )
+        --1234567890--\r\n",
+    ))
     .await?;
-    let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
@@ -128,9 +106,9 @@ async fn test_blank_file_upload_field() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_file_upload_too_large() -> actix_web::Result<()> {
-    let req = multipart_request(
+    let err_str = response_from(multipart_request(
         "/tests/uploads/upload_file_test.sql",
         "--1234567890\r\n\
         Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
@@ -141,12 +119,10 @@ async fn test_file_upload_too_large() -> actix_web::Result<()> {
             + "a".repeat(123_457).as_str()
             + "\r\n\
         --1234567890--\r\n",
-    )
-    .await?;
-    let err_str = main_handler(req)
-        .await
-        .expect_err("Expected an error response")
-        .to_string();
+    ))
+    .await
+    .expect_err("Expected an error response")
+    .to_string();
     let msg = "max file size";
     assert!(
         err_str.to_ascii_lowercase().contains(msg),
@@ -155,49 +131,45 @@ async fn test_file_upload_too_large() -> actix_web::Result<()> {
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_upload_file_data_url() -> actix_web::Result<()> {
-    let req = multipart_request(
+    let resp = response_from(multipart_request(
         "/tests/uploads/upload_file_data_url_test.sql",
         "--1234567890\r\n\
         Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
         Content-Type: image/svg+xml\r\n\
         \r\n\
         <svg></svg>\r\n\
-        --1234567890--\r\n"
-            .to_string(),
-    )
+        --1234567890--\r\n",
+    ))
     .await?;
-    let resp = main_handler(req).await?;
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
     assert_eq!(body_str, "data:image/svg+xml;base64,PHN2Zz48L3N2Zz4=");
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_uploaded_file_name() -> actix_web::Result<()> {
-    let req = multipart_request(
+    let resp = response_from(multipart_request(
         "/tests/uploads/uploaded_file_name_test.sql",
         "--1234567890\r\n\
         Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
         Content-Type: text/plain\r\n\
         \r\n\
         Some plain text.\r\n\
-        --1234567890--\r\n"
-            .to_string(),
-    )
+        --1234567890--\r\n",
+    ))
     .await?;
-    let resp = main_handler(req).await?;
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
     assert_eq!(body_str, "testfile.txt");
     Ok(())
 }
 
-#[actix_web::rt::test(system = "crate::common::TestSystem")]
+#[actix_web::test]
 async fn test_csv_upload() -> actix_web::Result<()> {
-    let req = multipart_request(
+    let resp = response_from(multipart_request(
         "/tests/uploads/upload_csv_test.sql",
         "--1234567890\r\n\
         Content-Disposition: form-data; name=\"people_file\"; filename=\"people.csv\"\r\n\
@@ -206,11 +178,9 @@ async fn test_csv_upload() -> actix_web::Result<()> {
         name,age\r\n\
         Ophir,29\r\n\
         Max,99\r\n\
-        --1234567890--\r\n"
-            .to_string(),
-    )
+        --1234567890--\r\n",
+    ))
     .await?;
-    let resp = main_handler(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;

From 49be0a0e019c843fad63ccd91d8995dc89c1ac0c Mon Sep 17 00:00:00 2001
From: Ophir Lojkine <contact@ophir.dev>
Date: Wed, 7 Oct 2026 10:11:46 +0000
Subject: [PATCH 3/5] test: remove test-harness metatest

---
 tests/common/mod.rs | 44 --------------------------------------------
 1 file changed, 44 deletions(-)

diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index 60f536b5f..b43aca573 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -94,50 +94,6 @@ pub(crate) async fn send_request(
     .map_err(actix_web::error::ErrorGatewayTimeout)?
 }
 
-#[actix_web::test]
-async fn requests_release_application_state_on_success_error_and_panic() {
-    use futures_util::FutureExt as _;
-
-    for (path, panic_after_response) in [
-        ("/tests/parameter_binding/echo_parameter.sql?x=1447", false),
-        ("/sqlpage/sqlpage.json", false),
-        ("/tests/parameter_binding/echo_parameter.sql?x=1447", true),
-    ] {
-        let data = make_app_data_from_config(AppConfig {
-            database_url: "sqlite::memory:".into(),
-            ..test_config()
-        })
-        .await
-        .unwrap();
-        let weak = std::sync::Arc::downgrade(&data.clone().into_inner());
-        let result = std::panic::AssertUnwindSafe(async move {
-            let response = send_request(request_for(path), data).await;
-            if path == "/sqlpage/sqlpage.json" {
-                assert_eq!(
-                    response.unwrap_err().as_response_error().status_code(),
-                    actix_web::http::StatusCode::FORBIDDEN
-                );
-            } else {
-                let response = response.unwrap();
-                assert_eq!(response.status(), actix_web::http::StatusCode::OK);
-                assert!(!panic_after_response, "intentional test panic");
-                test::read_body(response).await;
-            }
-        })
-        .catch_unwind()
-        .await;
-        assert_eq!(result.is_err(), panic_after_response);
-        // Query tasks may finish returning their connection after the body is read.
-        tokio::time::timeout(Duration::from_secs(1), async {
-            while weak.upgrade().is_some() {
-                tokio::task::yield_now().await;
-            }
-        })
-        .await
-        .expect("request retained application state");
-    }
-}
-
 /// Reads a whole response body as a UTF-8 string, failing the test otherwise.
 pub(crate) async fn read_body_string<B>(resp: ServiceResponse<B>) -> String
 where

From a59f23ec9a936bbec45fec59d9dd07bf591eb541 Mon Sep 17 00:00:00 2001
From: Ophir Lojkine <contact@ophir.dev>
Date: Wed, 7 Oct 2026 10:23:09 +0000
Subject: [PATCH 4/5] test: dispatch integration helpers through the production
 app

Use create_app inside the shared request helper so existing concise test calls exercise production routes and middleware. Update the prefix redirect assertion to check the actual 308 response and preserved request path.
---
 CONTRIBUTING.md     |  3 ++-
 tests/common/mod.rs | 14 ++++----------
 tests/core/mod.rs   | 21 +++++++--------------
 3 files changed, 13 insertions(+), 25 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index ca7aac94c..252c86e9d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -99,7 +99,8 @@ cargo test
 Use `common::response_for(path)` for ordinary integration requests and
 `common::response_with(path, config)` for custom configuration. Custom requests use
 `common::response_from(request)`; tests sharing database or cache state use `common::send_request`.
-These helpers dispatch through an Actix test service whose destructor drains its request pool.
+These helpers use the production `create_app` routes and middleware through an Actix test service,
+whose destructor drains its request pool.
 Keep `#[actix_web::test]`; standalone `TestRequest::to_srv_request()` retains application state.
 When testing Oracle locally, use `cargo test -- --test-threads=2` to avoid overwhelming the listener.
 
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index b43aca573..088b99beb 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -14,7 +14,7 @@ use sqlpage::{
     AppState,
     app_config::{AppConfig, test_database_url},
     telemetry,
-    webserver::http::{form_config, main_handler, payload_config},
+    webserver::http::create_app,
 };
 use tokio::sync::oneshot;
 use tokio::task::JoinHandle;
@@ -71,27 +71,21 @@ pub(crate) async fn response_with_data(
     send_request(request_for(path), data).await
 }
 
-/// Runs a request through an Actix service so its request pool has an owner.
+/// Runs a request through the production app, including its routes and middleware.
 /// Dropping the service disables and drains the pool, including on error or panic.
 /// Standalone `TestRequest::to_srv_request()` would instead leak the application state.
 pub(crate) async fn send_request(
     request: TestRequest,
     data: Data<AppState>,
 ) -> actix_web::Result<ServiceResponse> {
-    let app = test::init_service(
-        App::new()
-            .app_data(payload_config(&data))
-            .app_data(form_config(&data))
-            .app_data(data)
-            .default_service(fn_service(main_handler)),
-    )
-    .await;
+    let app = test::init_service(create_app(data)).await;
     tokio::time::timeout(
         Duration::from_secs(8),
         test::try_call_service(&app, request.to_request()),
     )
     .await
     .map_err(actix_web::error::ErrorGatewayTimeout)?
+    .map(ServiceResponse::map_into_boxed_body)
 }
 
 /// Reads a whole response body as a UTF-8 string, failing the test otherwise.
diff --git a/tests/core/mod.rs b/tests/core/mod.rs
index 4eb77417e..592360646 100644
--- a/tests/core/mod.rs
+++ b/tests/core/mod.rs
@@ -148,12 +148,10 @@ async fn test_routing_with_prefix() {
     let mut config = test_config();
     config.site_prefix = "/prefix/".to_string();
     let app_data = make_app_data_from_config(config).await.unwrap();
-    let resp = response_with_data(
-        "/prefix/tests/sql_test_files/component_rendering/simple.sql",
-        app_data.clone(),
-    )
-    .await
-    .unwrap();
+    let path = "/tests/sql_test_files/component_rendering/simple.sql";
+    let resp = response_with_data(format!("/prefix{path}"), app_data.clone())
+        .await
+        .unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
     let body_str = crate::common::read_body_string(resp).await;
     assert!(
@@ -181,18 +179,13 @@ async fn test_routing_with_prefix() {
         .status_code();
     assert_eq!(resp, StatusCode::FORBIDDEN);
 
-    let resp = response_with_data(
-        "/tests/sql_test_files/component_rendering/simple.sql",
-        app_data,
-    )
-    .await
-    .unwrap();
-    assert_eq!(resp.status(), StatusCode::MOVED_PERMANENTLY);
+    let resp = response_with_data(path, app_data).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::PERMANENT_REDIRECT);
     let location = resp
         .headers()
         .get("location")
         .expect("location header should be present");
-    assert_eq!(location.to_str().unwrap(), "/prefix/");
+    assert_eq!(location.to_str().unwrap(), format!("/prefix{path}"));
 }
 
 #[actix_web::test]

From 359f2240325e0c77d6b4b3f03d84a374a6cd730c Mon Sep 17 00:00:00 2001
From: Ophir LOJKINE <contact@ophir.dev>
Date: Wed, 7 Oct 2026 10:56:28 +0000
Subject: [PATCH 5/5] Centralize variable lookup policies (#1535)

* refactor: centralize variable lookup and enumeration

* Reuse request and immutable-variable fixtures for lookup coverage
---
 src/webserver/database/sqlpage_expr.rs        |  58 ++------
 .../sqlpage_functions/functions/variables.rs  |  29 +---
 src/webserver/request_variables.rs            | 129 ++++++++++++++++++
 tests/requests/mod.rs                         |  26 ++--
 tests/requests/variables.sql                  |  14 +-
 .../data/immutable_variables.sql              |   6 +
 .../data/run_sql_variable_isolation.sql       |   8 ++
 tests/sql_test_files/variable_scope_child.sql |   3 +
 8 files changed, 195 insertions(+), 78 deletions(-)
 create mode 100644 tests/sql_test_files/data/run_sql_variable_isolation.sql
 create mode 100644 tests/sql_test_files/variable_scope_child.sql

diff --git a/src/webserver/database/sqlpage_expr.rs b/src/webserver/database/sqlpage_expr.rs
index 126a133fc..7b7ecd769 100644
--- a/src/webserver/database/sqlpage_expr.rs
+++ b/src/webserver/database/sqlpage_expr.rs
@@ -12,7 +12,6 @@ use serde_json::Value;
 use super::execute_queries::DbConn;
 use super::sqlpage_functions::functions::SqlPageFunctionName;
 use crate::webserver::http_request_info::ExecutionContext;
-use crate::webserver::single_or_vec::SingleOrVec;
 
 /// An expression evaluated by `SQLPage`.
 ///
@@ -163,50 +162,21 @@ fn value_to_sqlpage_value(value: Value) -> SqlPageValue<'static> {
 
 impl VariableRef {
     fn evaluate<'a>(&self, request: &'a ExecutionContext) -> SqlPageValue<'a> {
-        let value = match self.source {
-            VariableSource::Url => request
-                .url_params
-                .get(&self.name)
-                .map(SingleOrVec::as_json_str),
-            VariableSource::SetOrForm => {
-                if let Some(value) = request.set_variables.borrow().get(&self.name) {
-                    return value.as_ref().map_or(SqlPageValue::Null, |value| {
-                        SqlPageValue::Text(Cow::Owned(value.as_json_str().into_owned()))
-                    });
-                }
-                request
-                    .post_variables
-                    .get(&self.name)
-                    .map(SingleOrVec::as_json_str)
-            }
-            VariableSource::SetOrUrl => {
-                if let Some(value) = request.set_variables.borrow().get(&self.name) {
-                    return value.as_ref().map_or(SqlPageValue::Null, |value| {
-                        SqlPageValue::Text(Cow::Owned(value.as_json_str().into_owned()))
-                    });
-                }
-                let url_value = request.url_params.get(&self.name);
-                if request.post_variables.contains_key(&self.name) {
-                    if url_value.is_some() {
-                        log::warn!(
-                            "Deprecation warning! There is both a URL parameter named '{}' and a form field named '{}'. SQLPage is using the URL parameter for ${}. Please use :{} to reference the form field explicitly.",
-                            self.name,
-                            self.name,
-                            self.name,
-                            self.name,
-                        );
-                    } else {
-                        log::warn!(
-                            "Deprecation warning! ${} was used to reference a form field value (a POST variable). This now uses only URL parameters. Please use :{} instead.",
-                            self.name,
-                            self.name,
-                        );
-                    }
-                }
-                url_value.map(SingleOrVec::as_json_str)
-            }
+        use crate::webserver::request_variables::{LookupPolicy, VariableAccess, VariableValue};
+        let policy = match self.source {
+            VariableSource::Url => LookupPolicy::GetOnly,
+            VariableSource::SetOrForm => LookupPolicy::SetThenPost,
+            VariableSource::SetOrUrl => LookupPolicy::SetThenGet,
         };
-        value.map_or(SqlPageValue::Null, SqlPageValue::Text)
+        let variables = VariableAccess::new(
+            &request.url_params,
+            &request.post_variables,
+            &request.set_variables,
+        );
+        match variables.lookup(&self.name, policy) {
+            VariableValue::Missing | VariableValue::Null => SqlPageValue::Null,
+            VariableValue::Text(value) => SqlPageValue::Text(value),
+        }
     }
 }
 
diff --git a/src/webserver/database/sqlpage_functions/functions/variables.rs b/src/webserver/database/sqlpage_functions/functions/variables.rs
index d482b1534..8ca8aa46e 100644
--- a/src/webserver/database/sqlpage_functions/functions/variables.rs
+++ b/src/webserver/database/sqlpage_functions/functions/variables.rs
@@ -22,28 +22,11 @@ pub(super) async fn variables<'a>(
             ));
         }
     } else {
-        use serde::{Serializer, ser::SerializeMap};
-        let mut res = Vec::new();
-        let mut serializer = serde_json::Serializer::new(&mut res);
-        let set_vars = request.set_variables.borrow();
-        let len = request.url_params.len() + request.post_variables.len() + set_vars.len();
-        let mut ser = serializer.serialize_map(Some(len))?;
-        let mut seen_keys = std::collections::HashSet::new();
-        for (k, v) in &*set_vars {
-            seen_keys.insert(k);
-            ser.serialize_entry(k, v)?;
-        }
-        for (k, v) in &request.post_variables {
-            if seen_keys.insert(k) {
-                ser.serialize_entry(k, v)?;
-            }
-        }
-        for (k, v) in &request.url_params {
-            if seen_keys.insert(k) {
-                ser.serialize_entry(k, v)?;
-            }
-        }
-        ser.end()?;
-        String::from_utf8(res)?
+        let variables = crate::webserver::request_variables::VariableAccess::new(
+            &request.url_params,
+            &request.post_variables,
+            &request.set_variables,
+        );
+        serde_json::to_string(&variables)?
     })
 }
diff --git a/src/webserver/request_variables.rs b/src/webserver/request_variables.rs
index 1b73f4120..c2ca579c8 100644
--- a/src/webserver/request_variables.rs
+++ b/src/webserver/request_variables.rs
@@ -1,10 +1,95 @@
+use std::borrow::Cow;
+use std::cell::RefCell;
 use std::collections::{HashMap, hash_map::Entry};
 
+use serde::{Serialize, Serializer, ser::SerializeMap};
+
 use crate::webserver::single_or_vec::SingleOrVec;
 
 pub type ParamMap = HashMap<String, SingleOrVec>;
 pub type SetVariablesMap = HashMap<String, Option<SingleOrVec>>;
 
+/// Request values stay borrowed; mutable SET values are copied before releasing
+/// their `RefCell` borrow. A present SET NULL must suppress request fallbacks.
+pub(crate) struct VariableAccess<'a> {
+    get: &'a ParamMap,
+    post: &'a ParamMap,
+    set: &'a RefCell<SetVariablesMap>,
+}
+
+#[derive(Clone, Copy)]
+pub(crate) enum LookupPolicy {
+    GetOnly,
+    SetThenGet,
+    SetThenPost,
+}
+
+pub(crate) enum VariableValue<'a> {
+    Missing,
+    Null,
+    Text(Cow<'a, str>),
+}
+
+impl<'a> VariableAccess<'a> {
+    pub(crate) fn new(
+        get: &'a ParamMap,
+        post: &'a ParamMap,
+        set: &'a RefCell<SetVariablesMap>,
+    ) -> Self {
+        Self { get, post, set }
+    }
+
+    pub(crate) fn lookup(&self, name: &str, policy: LookupPolicy) -> VariableValue<'a> {
+        if !matches!(policy, LookupPolicy::GetOnly)
+            && let Some(value) = self.set.borrow().get(name)
+        {
+            return value.as_ref().map_or(VariableValue::Null, |value| {
+                VariableValue::Text(Cow::Owned(value.as_json_str().into_owned()))
+            });
+        }
+        let values = match policy {
+            LookupPolicy::SetThenPost => self.post,
+            LookupPolicy::GetOnly | LookupPolicy::SetThenGet => self.get,
+        };
+        if matches!(policy, LookupPolicy::SetThenGet) && self.post.contains_key(name) {
+            if values.contains_key(name) {
+                log::warn!(
+                    "Deprecation warning! There is both a URL parameter named '{name}' and a form field named '{name}'. SQLPage is using the URL parameter for ${name}. Please use :{name} to reference the form field explicitly."
+                );
+            } else {
+                log::warn!(
+                    "Deprecation warning! ${name} was used to reference a form field value (a POST variable). This now uses only URL parameters. Please use :{name} instead."
+                );
+            }
+        }
+        values.get(name).map_or(VariableValue::Missing, |value| {
+            VariableValue::Text(value.as_json_str())
+        })
+    }
+}
+
+/// Serialize the merged SET > POST > GET view without cloning its values.
+impl Serialize for VariableAccess<'_> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let set = self.set.borrow();
+        let mut map = serializer.serialize_map(None)?;
+        for (key, value) in &*set {
+            map.serialize_entry(key, value)?;
+        }
+        for (key, value) in self.post {
+            if !set.contains_key(key) {
+                map.serialize_entry(key, value)?;
+            }
+        }
+        for (key, value) in self.get {
+            if !set.contains_key(key) && !self.post.contains_key(key) {
+                map.serialize_entry(key, value)?;
+            }
+        }
+        map.end()
+    }
+}
+
 pub fn param_map<PAIRS: IntoIterator<Item = (String, String)>>(values: PAIRS) -> ParamMap {
     values
         .into_iter()
@@ -26,3 +111,47 @@ pub fn param_map<PAIRS: IntoIterator<Item = (String, String)>>(values: PAIRS) ->
             map
         })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use LookupPolicy::{GetOnly, SetThenGet, SetThenPost};
+    use VariableValue::{Missing, Null, Text};
+
+    #[test]
+    fn lookup_distinguishes_null_missing_and_releases_set_borrows() {
+        let get = param_map([("value".into(), "get".into())]);
+        let post = param_map([("value".into(), "post".into())]);
+        for (policy, fallback) in [(GetOnly, "get"), (SetThenGet, "get"), (SetThenPost, "post")] {
+            let set = RefCell::new(SetVariablesMap::from([("value".into(), None)]));
+            let view = VariableAccess::new(&get, &post, &set);
+            assert!(matches!(view.lookup("absent", policy), Missing));
+            let get_only = matches!(policy, GetOnly);
+            assert_eq!(matches!(view.lookup("value", policy), Null), !get_only);
+            for (value, expected) in [
+                (SingleOrVec::Single("set".into()), "set"),
+                (
+                    SingleOrVec::Vec(vec!["a".into(), "b".into()]),
+                    r#"["a","b"]"#,
+                ),
+            ] {
+                set.borrow_mut().insert("value".into(), Some(value));
+                let Text(actual) = view.lookup("value", policy) else {
+                    panic!("missing SET")
+                };
+                if expected.starts_with('[') {
+                    assert_eq!(
+                        serde_json::to_value(&view).unwrap()["value"],
+                        serde_json::json!(["a", "b"])
+                    );
+                }
+                set.borrow_mut().clear();
+                assert_eq!(matches!(actual, Cow::Borrowed(_)), get_only);
+                assert_eq!(actual, if get_only { "get" } else { expected });
+                assert!(
+                    matches!(view.lookup("value", policy), Text(Cow::Borrowed(value)) if value == fallback)
+                );
+            }
+        }
+    }
+}
diff --git a/tests/requests/mod.rs b/tests/requests/mod.rs
index bd308f96a..12f3a2611 100644
--- a/tests/requests/mod.rs
+++ b/tests/requests/mod.rs
@@ -135,8 +135,8 @@ async fn test_large_form_field_roundtrip() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_variables_function() -> actix_web::Result<()> {
-    let url = "/tests/requests/variables.sql?common=get_value&get_only=get_val";
-    let req_body = "common=post_value&post_only=post_val";
+    let url = "/tests/requests/variables.sql?common=get_value&get_only=get_val&array[]=get_a&array[]=get_b";
+    let req_body = "common=post_value&post_only=post_val&array[]=post_a&array[]=post_b";
     let req = get_request_to(url)
         .await?
         .insert_header(("content-type", "application/x-www-form-urlencoded"))
@@ -152,30 +152,30 @@ async fn test_variables_function() -> actix_web::Result<()> {
         [
             (
                 "all_vars",
-                json!({"get_only": "get_val", "common": "get_value", "post_only": "post_val", "common": "post_value"}),
+                json!({"get_only": "get_val", "common": "post_value", "post_only": "post_val", "array": ["post_a", "post_b"]}),
             ),
             (
                 "get_vars",
-                json!({"get_only": "get_val", "common": "get_value"}),
+                json!({"get_only": "get_val", "common": "get_value", "array": ["get_a", "get_b"]}),
             ),
             (
                 "post_vars",
-                json!({"post_only": "post_val", "common": "post_value"}),
+                json!({"post_only": "post_val", "common": "post_value", "array": ["post_a", "post_b"]}),
             ),
             ("set_vars", json!({})),
         ],
         [
             (
                 "all_vars",
-                json!({"get_only": "get_val", "common": "set_common_value", "post_only": "post_val", "my_set_var": "set_value"}),
+                json!({"get_only": "get_val", "common": "set_common_value", "post_only": "post_val", "my_set_var": "set_value", "array": ["post_a", "post_b"]}),
             ),
             (
                 "get_vars",
-                json!({"get_only": "get_val", "common": "get_value"}),
+                json!({"get_only": "get_val", "common": "get_value", "array": ["get_a", "get_b"]}),
             ),
             (
                 "post_vars",
-                json!({"post_only": "post_val", "common": "post_value"}),
+                json!({"post_only": "post_val", "common": "post_value", "array": ["post_a", "post_b"]}),
             ),
             (
                 "set_vars",
@@ -184,9 +184,17 @@ async fn test_variables_function() -> actix_web::Result<()> {
         ],
     ];
 
+    let mut null_step = expected[1].clone();
+    null_step[0].1["common"] = json!(null);
+    null_step[3].1["common"] = json!(null);
     let actual_array = body_json.as_array().expect("response is nota json array");
-    for (i, expected_step) in expected.into_iter().enumerate() {
+    assert_eq!(actual_array.len(), expected.len() + 1);
+    for (i, expected_step) in expected.into_iter().chain([null_step]).enumerate() {
         let actual = &actual_array[i];
+        assert!(actual["missing"].is_null());
+        assert!(actual["post_only_compat"].is_null());
+        assert_eq!(actual["get_array_lookup"], r#"["get_a","get_b"]"#);
+        assert_eq!(actual["post_array_lookup"], r#"["post_a","post_b"]"#);
         for (key, expected_value) in expected_step {
             let actual_decoded: serde_json::Value =
                 serde_json::from_str(actual[key].as_str().unwrap()).unwrap();
diff --git a/tests/requests/variables.sql b/tests/requests/variables.sql
index 4f9bf5ca6..ec9c9d84b 100644
--- a/tests/requests/variables.sql
+++ b/tests/requests/variables.sql
@@ -2,7 +2,9 @@ select
        sqlpage.variables() as all_vars,
        sqlpage.variables('get') as get_vars,
        sqlpage.variables('post') as post_vars,
-       sqlpage.variables('set') as set_vars;
+       sqlpage.variables('set') as set_vars,
+       $absent as missing, $post_only as post_only_compat,
+       $array as get_array_lookup, :array as post_array_lookup;
 
 set my_set_var = 'set_value';
 set common = 'set_common_value';
@@ -11,4 +13,12 @@ select
        sqlpage.variables() as all_vars,
        sqlpage.variables('get') as get_vars,
        sqlpage.variables('post') as post_vars,
-       sqlpage.variables('set') as set_vars;
+       sqlpage.variables('set') as set_vars,
+       $absent as missing, $post_only as post_only_compat,
+       $array as get_array_lookup, :array as post_array_lookup;
+
+set common = NULL;
+select sqlpage.variables() as all_vars, sqlpage.variables('get') as get_vars,
+       sqlpage.variables('post') as post_vars, sqlpage.variables('set') as set_vars,
+       $absent as missing, $post_only as post_only_compat,
+       $array as get_array_lookup, :array as post_array_lookup;
diff --git a/tests/sql_test_files/data/immutable_variables.sql b/tests/sql_test_files/data/immutable_variables.sql
index 2fe3285c1..31d82d021 100644
--- a/tests/sql_test_files/data/immutable_variables.sql
+++ b/tests/sql_test_files/data/immutable_variables.sql
@@ -8,3 +8,9 @@ select '"x":"set_value"' as expected_contains, sqlpage.variables('set') as actua
 select '"set_only":"only_in_set"' as expected_contains, sqlpage.variables('set') as actual;
 select '"x":"set_value"' as expected_contains, sqlpage.variables() as actual;
 select '"set_only":"only_in_set"' as expected_contains, sqlpage.variables() as actual;
+
+-- The fixture runner provides ?x=1. SET NULL suppresses $x but leaves GET enumeration immutable.
+set x = NULL;
+select NULL as expected, $x as actual;
+select '"x":null' as expected_contains, sqlpage.variables() as actual;
+select '"x":"1"' as expected_contains, sqlpage.variables('get') as actual;
diff --git a/tests/sql_test_files/data/run_sql_variable_isolation.sql b/tests/sql_test_files/data/run_sql_variable_isolation.sql
new file mode 100644
index 000000000..77ef2cf32
--- /dev/null
+++ b/tests/sql_test_files/data/run_sql_variable_isolation.sql
@@ -0,0 +1,8 @@
+set scope = 'parent';
+set child_rows = sqlpage.run_sql('tests/sql_test_files/variable_scope_child.sql');
+select '"inherited":"parent"' as expected_contains, $child_rows as actual;
+select '"changed":"child"' as expected_contains, $child_rows as actual;
+select 'parent' as expected, $scope as actual;
+set child_rows = sqlpage.run_sql('tests/sql_test_files/variable_scope_child.sql', '{"scope":null}');
+select '"inherited":null' as expected_contains, $child_rows as actual;
+select 'parent' as expected, $scope as actual;
diff --git a/tests/sql_test_files/variable_scope_child.sql b/tests/sql_test_files/variable_scope_child.sql
new file mode 100644
index 000000000..20689fe52
--- /dev/null
+++ b/tests/sql_test_files/variable_scope_child.sql
@@ -0,0 +1,3 @@
+select $scope as inherited;
+set scope = 'child';
+select $scope as changed;