hecks 5.0.0 → 7.0.0

data/rust/host/src/auth.rs

@@ -5,17 +5,24 @@ use crate::b64;
 use crate::crypto::{constant_time_eq, hex_encode};
 use crate::dispatch;
 use crate::host::Host;
-use crate::journal;
-use crate::journal::LineageConfig;
 use crate::lambda_client::LambdaInvoker;
+use crate::needs::{Clock, ProcessClock};
+use crate::store::journal_sql as journal;
+use crate::store::journal_sql::LineageConfig;
+use crate::store::{Store, StoreError};
 use serde_json::{json, Value};
 use std::path::Path;
 use std::time::{SystemTime, UNIX_EPOCH};
-use tokio::sync::Mutex;
-use tokio_postgres::Client;
+
+mod google_signin;
+
+pub use google_signin::GoogleSignin;
+pub use google_signin::{
+    clear_header as google_signin_clear_header, read as read_google_signin,
+    set_header as google_signin_set_header,
+};
 
 const ISSUER: &str = "https://accounts.google.com";
-const STATE_TTL_SECS: u64 = 600;
 
 /// A verified Google ID token's claims.
 pub struct Claims {
@@ -33,32 +40,33 @@ pub struct Session {
     pub role: Option<String>,
 }
 
-pub fn authorization_url(redirect_uri: &str, secret: &str) -> Result<String, String> {
+/// The caller a signed-in session dispatches as: the role it carries and the identity
+/// Governance holds assignments for. No session is an unidentified caller.
+pub fn caller(session: Option<&Session>) -> crate::dispatch::Caller<'_> {
+    session.map_or_else(crate::dispatch::Caller::default, |session| {
+        crate::dispatch::Caller {
+            role: session.role.as_deref(),
+            actor_id: Some(session.identity_id.as_str()).filter(|id| !id.is_empty()),
+        }
+    })
+}
+
+/// Google's consent page for one sign-in: `signin`'s `state` comes back on the callback and its
+/// `nonce` inside the ID token, and both must match the cookie `/auth/google` set beside them.
+pub fn authorization_url(redirect_uri: &str, signin: &GoogleSignin) -> Result<String, String> {
     let client_id = crate::secrets::var("GOOGLE_CLIENT_ID")
         .map_err(|_| "GOOGLE_CLIENT_ID not set".to_string())?;
-    let payload = now_secs().to_string();
-    let state = format!("{payload}.{}", sign(secret, &payload));
     Ok(format!(
-        "https://accounts.google.com/o/oauth2/v2/auth?client_id={}&redirect_uri={}&response_type=code&scope={}&state={}",
+        "https://accounts.google.com/o/oauth2/v2/auth?client_id={}&redirect_uri={}&response_type=code&scope={}&state={}&nonce={}",
         urlencode(&client_id),
         urlencode(redirect_uri),
         urlencode("openid email profile"),
-        urlencode(&state),
+        urlencode(&signin.state),
+        urlencode(&signin.nonce),
     ))
 }
 
-// No server-side stash to compare against — recomputing the HMAC here
-// is the whole check: a forged, mismatched, or expired state fails on it.
-pub fn verify_state(state: &str, secret: &str) -> Result<(), String> {
-    let payload = verify_sig(secret, state).ok_or_else(|| "state mismatch".to_string())?;
-    let minted: u64 = payload.parse().map_err(|_| "state mismatch".to_string())?;
-    if now_secs().saturating_sub(minted) > STATE_TTL_SECS {
-        return Err("state expired".to_string());
-    }
-    Ok(())
-}
-
-pub async fn verify(code: &str, redirect_uri: &str) -> Result<Claims, String> {
+pub async fn verify(code: &str, redirect_uri: &str, nonce: &str) -> Result<Claims, String> {
     let client_id = crate::secrets::var("GOOGLE_CLIENT_ID")
         .map_err(|_| "GOOGLE_CLIENT_ID not set".to_string())?;
     let client_secret = crate::secrets::var("GOOGLE_CLIENT_SECRET")
@@ -91,13 +99,13 @@ pub async fn verify(code: &str, redirect_uri: &str) -> Result<Claims, String> {
         .and_then(|v| v.as_str())
         .ok_or_else(|| "no id_token in the response".to_string())?;
 
-    verify_id_token(id_token, &client_id).await
+    verify_id_token(id_token, &client_id, nonce).await
 }
 
 // Fetched fresh, never cached: this is a real sign-in, not a hot path,
 // and missing Google's own key rotation would be worse than one extra
 // HTTPS round trip per login.
-async fn verify_id_token(id_token: &str, client_id: &str) -> Result<Claims, String> {
+async fn verify_id_token(id_token: &str, client_id: &str, nonce: &str) -> Result<Claims, String> {
     let header =
         jsonwebtoken::decode_header(id_token).map_err(|e| format!("bad id_token header: {e}"))?;
     let kid = header
@@ -140,6 +148,7 @@ async fn verify_id_token(id_token: &str, client_id: &str) -> Result<Claims, Stri
     let token = jsonwebtoken::decode::<Value>(id_token, &decoding_key, &validation)
         .map_err(|err| format!("id_token signature/claims invalid: {err}"))?;
     let claims = token.claims;
+    check_nonce(&claims, nonce)?;
 
     Ok(Claims {
         issuer: claims
@@ -161,6 +170,17 @@ async fn verify_id_token(id_token: &str, client_id: &str) -> Result<Claims, Stri
     })
 }
 
+// The ID token must carry the nonce this browser's sign-in cookie holds, so a token minted for
+// someone else's sign-in cannot finish this one.
+fn check_nonce(claims: &Value, expected: &str) -> Result<(), String> {
+    let carried = claims.get("nonce").and_then(Value::as_str).unwrap_or("");
+    if constant_time_eq(carried.as_bytes(), expected.as_bytes()) {
+        Ok(())
+    } else {
+        Err("id_token nonce does not match this sign-in".to_string())
+    }
+}
+
 /// The cookie name the account token travels in when a deploy names none.
 /// A deploy naming its own uses `HECKS_SESSION_COOKIE` instead.
 pub const DEFAULT_ACCOUNT_COOKIE: &str = "hecks_session";
@@ -234,6 +254,39 @@ fn purpose_key(secret: &str, purpose: &str) -> String {
     format!("{purpose}:{secret}")
 }
 
+const HANDOFF_PURPOSE: &str = "google-handoff";
+const HANDOFF_TTL_SECS: u64 = 60;
+
+/// A one-minute, single-use stand-in for `email`'s account token. It rides the redirect onto a
+/// site on another origin, where a URL is logged and kept in history, and the site trades it for
+/// the account token server-to-server (`redeem_handoff_token`).
+pub fn handoff_token(secret: &str, email: &str) -> String {
+    let jti = uuid::Uuid::new_v4().simple().to_string();
+    purpose_token(
+        secret,
+        HANDOFF_PURPOSE,
+        json!({ "email": email, "jti": jti }),
+        HANDOFF_TTL_SECS,
+    )
+}
+
+/// The account token a handoff token stands for, the first time it is redeemed; `None` when it is
+/// forged, expired, minted for another purpose, or already spent in `spent`.
+pub fn redeem_handoff_token(
+    secret: &str,
+    token: &str,
+    spent: &crate::platform_signin::jti::JtiStore,
+) -> Option<String> {
+    let claims = verify_purpose_token(secret, HANDOFF_PURPOSE, token)?;
+    let email = claims.get("email")?.as_str()?;
+    let jti = claims.get("jti")?.as_str()?;
+    let expires_at = i64::try_from(claims.get("exp")?.as_u64()?).ok()?;
+    let now = i64::try_from(now_secs()).ok()?;
+    spent
+        .claim(jti, expires_at + 1, now)
+        .then(|| account_token(secret, email, SESSION_TTL_SECS))
+}
+
 /// How long a session cookie, and the account token minted beside it, stays valid.
 pub const SESSION_TTL_SECS: u64 = 60 * 60 * 24 * 14;
 
@@ -302,7 +355,7 @@ fn identity_id_from_state(state: &Value) -> Option<String> {
 }
 
 /// Resolves an external identity the way the Google callback does: the PostgresEra head first,
-/// then the flat journal's `instances`. A domain whose Identity chapter keeps no head of its own
+/// then the flat journal's `instances`. A domain whose Identity bluebook keeps no head of its own
 /// (its heads cover its own aggregates and the membership aggregate) holds the link only there.
 ///
 /// # Errors
@@ -311,18 +364,18 @@ fn identity_id_from_state(state: &Value) -> Option<String> {
 /// head that cannot be read is logged and skipped, as the Google callback does, so the flat journal
 /// still gets its turn.
 pub async fn resolve_identity_anywhere(
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
     domain_ir: &Value,
     issuer: &str,
     subject: &str,
 ) -> anyhow::Result<Option<String>> {
-    match resolve_identity_from_head(client, domain_ir, issuer, subject).await {
+    match resolve_identity_from_head(store, domain_ir, issuer, subject).await {
         Ok(Some(found)) => return Ok(Some(found)),
         Ok(None) => {}
         Err(error) => eprintln!("resolve_identity: identity head: {error:#}"),
     }
-    let read = match dispatch::read(client, wasm_path).await {
+    let read = match dispatch::read(store, wasm_path).await {
         Ok(read) => read,
         Err(error) if flat_journal_is_absent(&error) => return Ok(None),
         Err(error) => return Err(error),
@@ -338,14 +391,14 @@ pub async fn resolve_identity_anywhere(
 fn flat_journal_is_absent(error: &anyhow::Error) -> bool {
     error
         .chain()
-        .filter_map(|cause| cause.downcast_ref::<tokio_postgres::Error>())
-        .any(|db| db.code() == Some(&tokio_postgres::error::SqlState::UNDEFINED_TABLE))
+        .filter_map(|cause| cause.downcast_ref::<StoreError>())
+        .any(StoreError::is_not_provisioned)
 }
 
 /// Identity lives in the PostgresEra head, not `dispatch::read`'s
 /// `instances` — tries both the domain-qualified and the bare relation name.
 pub async fn resolve_identity_from_head(
-    client: &Mutex<Client>,
+    store: &Store,
     domain_ir: &Value,
     issuer: &str,
     subject: &str,
@@ -354,36 +407,21 @@ pub async fn resolve_identity_from_head(
         return Ok(None);
     };
     let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
-    let mut names = vec![
-        journal::head_view(domain, "external_identifier"),
-        journal::head_view("Identity", "external_identifier"),
-        "external_identifier_head".to_string(),
-    ];
-    names.dedup();
-    let guard = client.lock().await;
-    for name in names {
-        let sql = format!(
-            "SELECT state FROM {} WHERE state->'issuer'->>'value' = $1 AND state->'subject'->>'value' = $2",
-            journal::quote_ident(&name)
-        );
-        match guard.query_opt(&sql, &[&issuer, &subject]).await {
-            Ok(Some(row)) => {
-                let state: Value = row.get(0);
-                return Ok(identity_id_from_state(&state));
-            }
-            Ok(None) => return Ok(None),
-            Err(e) if e.code() == Some(&tokio_postgres::error::SqlState::UNDEFINED_TABLE) => {}
-            Err(e) => return Err(e.into()),
-        }
-    }
-    Ok(None)
+    let found = store
+        .head_find(
+            &[domain, "Identity"],
+            "external_identifier",
+            &[("issuer", issuer), ("subject", subject)],
+        )
+        .await?;
+    Ok(found.and_then(|state| identity_id_from_state(&state)))
 }
 
 // Member lives in the PostgresEra head, not `dispatch::read`'s journal
 // `instances` — reading `instances` for an already-linked member misses
 // it entirely, so this queries the head view directly instead.
 async fn member_row_by_email(
-    client: &Mutex<Client>,
+    store: &Store,
     domain_ir: &Value,
     email: &str,
 ) -> anyhow::Result<Option<Value>> {
@@ -391,27 +429,22 @@ async fn member_row_by_email(
     // docs/decisions/0059: `head_view` needs the domain name too, the
     // same one `ir.rs`/`web.rs` already extract this way.
     let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
-    let guard = client.lock().await;
-    journal::read_lineage_head_by_id(&*guard, domain, &storage_name, email).await
+    Ok(store.head_by_id(domain, &storage_name, email).await?)
 }
 
-async fn member_rows(
-    client: &Mutex<Client>,
-    domain_ir: &Value,
-) -> anyhow::Result<Vec<(String, Value)>> {
+async fn member_rows(store: &Store, domain_ir: &Value) -> anyhow::Result<Vec<(String, Value)>> {
     let (_, storage_name) = membership_aggregate(domain_ir)?;
     let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
-    let guard = client.lock().await;
-    journal::read_lineage_head_all(&*guard, domain, &storage_name).await
+    Ok(store.head_all(domain, &storage_name).await?)
 }
 
 // The membership aggregate comes from `ir.json`'s declared `membership`
 // key, never an env var or a lookup against lineage_capable_aggregates —
-// the chapter declaration is the fact, same as Governance's authorization.
+// the bluebook declaration is the fact, same as Governance's authorization.
 fn membership_aggregate(domain_ir: &Value) -> anyhow::Result<(String, String)> {
     let provider = crate::ir::membership_provider(domain_ir).ok_or_else(|| {
         anyhow::anyhow!(
-            "this domain attaches no chapter that provides \"membership\" — cannot resolve who may sign in"
+            "this domain attaches no bluebook that provides \"membership\" — cannot resolve who may sign in"
         )
     })?;
     Ok(membership_names(&provider.aggregate))
@@ -423,7 +456,7 @@ fn membership_names(aggregate: &str) -> (String, String) {
         .next()
         .unwrap_or(aggregate)
         .to_string();
-    let storage_name = crate::journal::snake(&bare);
+    let storage_name = crate::store::journal_sql::snake(&bare);
     (bare, storage_name)
 }
 
@@ -431,60 +464,40 @@ fn membership_names(aggregate: &str) -> (String, String) {
 // + snapshot-upsert transaction every Member write uses. The advisory
 // lock guards a concurrent domain rename, not ordinal uniqueness.
 async fn append_member_state(
-    client: &Mutex<Client>,
+    store: &Store,
     config: &LineageConfig,
     domain_ir: &Value,
     id: &str,
     state: &Value,
 ) -> anyhow::Result<()> {
     let (aggregate_name, _) = membership_aggregate(domain_ir)?;
-    let mut guard = client.lock().await;
-    let txn = guard.transaction().await?;
-
-    txn.execute(
-        "SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))",
-        &[&config.domain],
-    )
-    .await?;
-
-    journal::append_lineage_mutation(
-        &txn,
-        config,
-        &journal::Mutation {
-            aggregate: &aggregate_name,
-            id,
-            operation: "save",
-            state,
-        },
-    )
-    .await?;
-
-    txn.commit().await?;
+    store
+        .put_head(
+            config,
+            &journal::Mutation {
+                aggregate: &aggregate_name,
+                id,
+                operation: "save",
+                state,
+            },
+        )
+        .await?;
     Ok(())
 }
 
 pub async fn session_for_member_by_identity(
-    client: &Mutex<Client>,
+    store: &Store,
     domain_ir: &Value,
     identity_id: &str,
 ) -> anyhow::Result<Option<Session>> {
     let (_, storage_name) = membership_aggregate(domain_ir)?;
     // docs/decisions/0059 — same domain-qualification as above.
     let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
-    let guard = client.lock().await;
-    let row = guard
-        .query_opt(
-            &format!(
-                "SELECT state FROM {} WHERE state->'identity_id'->>'value' = $1",
-                journal::quote_ident(&journal::head_view(domain, &storage_name))
-            ),
-            &[&identity_id],
-        )
+    let row = store
+        .head_find(&[domain], &storage_name, &[("identity_id", identity_id)])
         .await?;
-    drop(guard);
-    Ok(row.and_then(|r| {
-        let state: Value = r.get(0);
-        if is_disabled(&state) {
+    Ok(row.and_then(|state| {
+        if is_lapsed(&state) {
             return None;
         }
         Some(Session {
@@ -504,7 +517,7 @@ pub async fn session_for_member_by_identity(
 /// never creates one; Admit is a separate, real cap-table event.
 #[allow(clippy::too_many_arguments)]
 pub async fn provision(
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
     config: &LineageConfig,
     domain_ir: &Value,
@@ -513,10 +526,10 @@ pub async fn provision(
     subject: &str,
     invoker: &dyn LambdaInvoker,
 ) -> anyhow::Result<Option<Session>> {
-    let Some(member) = member_row_by_email(client, domain_ir, email).await? else {
+    let Some(member) = member_row_by_email(store, domain_ir, email).await? else {
         return Ok(None);
     };
-    if is_disabled(&member) {
+    if is_lapsed(&member) {
         return Ok(None);
     }
     let role = member
@@ -532,10 +545,10 @@ pub async fn provision(
     };
 
     // Uses this domain's declared identity provider (`ir::identity_provider`),
-    // never a hard-coded chapter. Link's reference field is `identity`, not
+    // never a hard-coded bluebook. Link's reference field is `identity`, not
     // `identity_id` -- changing this silently breaks linking.
     let Some(identity) = crate::ir::identity_provider(domain_ir) else {
-        anyhow::bail!("this domain attaches no chapter that provides \"identity\" — cannot register or link an identity");
+        anyhow::bail!("this domain attaches no bluebook that provides \"identity\" — cannot register or link an identity");
     };
 
     // Reuse an Identity already registered+linked for this (issuer, subject)
@@ -551,7 +564,7 @@ pub async fn provision(
     // first makes a retry converge onto the earlier attempt's identity
     // instead of accumulating another orphan.
     let identity_id = if let Some(existing) =
-        resolve_identity_from_head(client, domain_ir, issuer, subject).await?
+        resolve_identity_from_head(store, domain_ir, issuer, subject).await?
     {
         existing
     } else {
@@ -561,7 +574,7 @@ pub async fn provision(
         // provisioning, not a caller-submitted command, so there is no
         // caller role to assert.
         let register = dispatch::handle(
-            Host::new(client, wasm_path, config, invoker),
+            Host::new(store, wasm_path, config, invoker),
             &identity.register,
             json!({"identity_id": {"value": identity_id}}),
             None,
@@ -572,7 +585,7 @@ pub async fn provision(
         }
 
         let link_external = dispatch::handle(
-            Host::new(client, wasm_path, config, invoker),
+            Host::new(store, wasm_path, config, invoker),
             &identity.link,
             json!({
                 "identity": identity_id, "key": {"value": format!("{issuer}:{subject}")},
@@ -589,15 +602,15 @@ pub async fn provision(
     };
 
     // The grant verb this domain's declared authorization provider names
-    // (`ir::authorization_provider`), never a hard-coded chapter.
+    // (`ir::authorization_provider`), never a hard-coded bluebook.
     let Some(provider) = crate::ir::authorization_provider(domain_ir) else {
         anyhow::bail!(
-            "this domain attaches no chapter that provides \"authorization\" — cannot grant a role"
+            "this domain attaches no bluebook that provides \"authorization\" — cannot grant a role"
         );
     };
-    let assign_role = dispatch::handle(Host::new(client, wasm_path, config, invoker), &provider.grant, json!({
+    let assign_role = dispatch::handle(Host::new(store, wasm_path, config, invoker), &provider.grant, json!({
             "actor_id": {"value": identity_id}, "role_name": {"value": role}, "scope": {"value": config.domain.clone()},
-            "starts_at": {"value": httpdate_now()},
+            "starts_at": {"value": crate::clock::iso8601_now()},
         }), None).await?;
     if !assign_role.accepted {
         anyhow::bail!("{} refused: {}", provider.grant, assign_role.result);
@@ -608,7 +621,7 @@ pub async fn provision(
     // refuse. Writes through the same journal+snapshot append instead.
     let mut new_state = member.clone();
     new_state["identity_id"] = json!({"value": identity_id});
-    append_member_state(client, config, domain_ir, email, &new_state).await?;
+    append_member_state(store, config, domain_ir, email, &new_state).await?;
 
     let name = member
         .get("name")
@@ -625,37 +638,87 @@ pub async fn provision(
 }
 
 pub async fn grant_access(
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
     config: &LineageConfig,
     domain_ir: &Value,
     email: &str,
     role: &str,
 ) -> anyhow::Result<bool> {
-    let _ = wasm_path;
-    let Some(member) = member_row_by_email(client, domain_ir, email).await? else {
-        return Ok(false);
-    };
+    let outcome =
+        grant_access_until(store, wasm_path, config, domain_ir, email, role, None).await?;
+    Ok(outcome == GrantOutcome::Done)
+}
 
-    // Same append protocol `provision` uses. GrantAccess's own bluebook
-    // command sets only `:role`, no other invariant to preserve here.
-    let mut new_state = member;
-    new_state["role"] = json!({"value": role});
-    append_member_state(client, config, domain_ir, email, &new_state).await?;
-    Ok(true)
+/// What `grant_access_until` decided.
+#[derive(Debug, PartialEq, Eq)]
+pub enum GrantOutcome {
+    /// The role (and window, if any) is now on the person's row.
+    Done,
+    /// No person with that email exists.
+    UnknownPerson,
+    /// The change would leave no active admin without an end date.
+    LastOpenAdmin,
+}
+
+/// Grants `role` like `grant_access`, for a window ending at `expires_at`
+/// (an ISO 8601 UTC instant) when one is given. Granting again renews: the
+/// new window replaces the old, and `None` clears it, so a plain grant makes
+/// the access open-ended. Refused when it would take the site's last
+/// open-ended admin off that footing, locked with other membership writes.
+pub async fn grant_access_until(
+    store: &Store,
+    wasm_path: &Path,
+    config: &LineageConfig,
+    domain_ir: &Value,
+    email: &str,
+    role: &str,
+    expires_at: Option<&str>,
+) -> anyhow::Result<GrantOutcome> {
+    let _ = wasm_path;
+    let (aggregate_name, storage_name) = membership_aggregate(domain_ir)?;
+    let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
+    let target = email.trim().to_lowercase();
+
+    let outcome = store
+        .amend_head(config, domain, &aggregate_name, &storage_name, |rows| {
+            let Some((id, member)) = rows.iter().find(|(id, _)| id.to_lowercase() == target) else {
+                return (GrantOutcome::UnknownPerson, None);
+            };
+
+            // Same append protocol `provision` uses. GrantAccess's own bluebook
+            // command sets only `:role`; the window is a host-side field beside it,
+            // like `disabled`, so it needs no bluebook attribute.
+            let mut new_state = member.clone();
+            new_state["role"] = json!({"value": role});
+            match expires_at {
+                Some(instant) => new_state[EXPIRY_FIELD] = json!(instant),
+                None => {
+                    if let Some(fields) = new_state.as_object_mut() {
+                        fields.remove(EXPIRY_FIELD);
+                    }
+                }
+            }
+            if strands_open_admin(rows, id, &new_state) {
+                return (GrantOutcome::LastOpenAdmin, None);
+            }
+            (GrantOutcome::Done, Some((id.clone(), new_state)))
+        })
+        .await?;
+    Ok(outcome)
 }
 
 /// Admits a new person (name + email), the same state `Admit` sets.
 /// Returns `false` without writing when that email already exists.
 pub async fn admit_person(
-    client: &Mutex<Client>,
+    store: &Store,
     config: &LineageConfig,
     domain_ir: &Value,
     email: &str,
     name: &str,
 ) -> anyhow::Result<bool> {
     let email = email.to_lowercase();
-    let exists = member_rows(client, domain_ir)
+    let exists = member_rows(store, domain_ir)
         .await?
         .into_iter()
         .any(|(id, _)| id.to_lowercase() == email);
@@ -663,7 +726,7 @@ pub async fn admit_person(
         return Ok(false);
     }
     let state = json!({"name": {"value": name}, "email": {"value": email}});
-    append_member_state(client, config, domain_ir, &email, &state).await?;
+    append_member_state(store, config, domain_ir, &email, &state).await?;
     Ok(true)
 }
 
@@ -676,6 +739,77 @@ fn is_disabled(state: &Value) -> bool {
         .unwrap_or(false)
 }
 
+// The row field holding the end of a time-boxed access window, an ISO 8601
+// UTC instant. It sits beside `disabled` in the row state, so a grant that
+// carries no window leaves the person with open-ended access as before.
+const EXPIRY_FIELD: &str = "access_expires_at";
+
+// The window's end as written on the row: a bare string, or a `{"value": ..}`
+// wrapper as other timestamp attributes carry.
+enum Window {
+    // No window is set (absent or null).
+    Open,
+    // A window ending at this many epoch seconds.
+    Ends(i64),
+    // A window is set but is not a readable instant; it counts as ended.
+    Unreadable,
+}
+
+fn window_of(state: &Value) -> Window {
+    let Some(raw) = state.get(EXPIRY_FIELD).filter(|v| !v.is_null()) else {
+        return Window::Open;
+    };
+    let text = raw.get("value").unwrap_or(raw).as_str();
+    text.and_then(crate::clock::parse_iso_utc)
+        .map_or(Window::Unreadable, Window::Ends)
+}
+
+// The window's end for display: the stored text, exactly as written.
+fn expiry_text(state: &Value) -> Option<String> {
+    let raw = state.get(EXPIRY_FIELD).filter(|v| !v.is_null())?;
+    let text = raw.get("value").unwrap_or(raw);
+    Some(
+        text.as_str()
+            .map_or_else(|| text.to_string(), str::to_string),
+    )
+}
+
+// Whether the row's access window has ended at `now` (epoch seconds). An
+// unreadable value counts as ended: access fails closed.
+fn is_expired_at(state: &Value, now: i64) -> bool {
+    match window_of(state) {
+        Window::Open => false,
+        Window::Unreadable => true,
+        Window::Ends(ends) => ends <= now,
+    }
+}
+
+// Whether the row grants no access right now: disabled, or its window ended.
+// Every check that lets a person in or counts an admin asks this, never
+// `is_disabled` alone; disabling and enabling keep the raw flag.
+fn is_lapsed(state: &Value) -> bool {
+    is_lapsed_at(state, ProcessClock.now_secs())
+}
+
+fn is_lapsed_at(state: &Value, now: i64) -> bool {
+    is_disabled(state) || is_expired_at(state, now)
+}
+
+/// The ISO 8601 UTC instant `days` days after `now` (epoch seconds), the
+/// value `grant_access_until` stores as the end of a window.
+pub fn expiry_after_days_from(days: u32, now: i64) -> String {
+    crate::clock::iso_utc((now + i64::from(days) * 86_400).max(0) as u64)
+}
+
+/// `expiry_after_days_from` counted from the process clock, which a spec
+/// can fix (`needs::set_fixed_clock`).
+pub fn expiry_after_days(days: u32) -> String {
+    expiry_after_days_from(days, ProcessClock.now_secs())
+}
+
+/// The longest window a grant may carry, in days.
+pub const MAX_EXPIRY_DAYS: u32 = 365;
+
 // A deleted person's row is never erased (this is an append-only journal,
 // same as every other aggregate here) — "deleted" only means all_people
 // stops listing it. There is deliberately no undelete route: re-admitting
@@ -708,9 +842,10 @@ pub fn is_admin_role(role: &str) -> bool {
     ADMIN_ROLES.contains(&role)
 }
 
-// Whether the row holds an admin role ("Admin" or "Owner") and is not disabled.
+// Whether the row holds an admin role ("Admin" or "Owner") and is not disabled
+// or past its access window.
 fn is_active_admin(state: &Value) -> bool {
-    role_of(state).is_some_and(is_admin_role) && !is_disabled(state)
+    role_of(state).is_some_and(is_admin_role) && !is_lapsed(state)
 }
 
 // Whether `state` is the only active admin (Admin or Owner) among `rows`.
@@ -718,60 +853,82 @@ fn is_last_active_admin(rows: &[(String, Value)], state: &Value) -> bool {
     is_active_admin(state) && rows.iter().filter(|(_, s)| is_active_admin(s)).count() <= 1
 }
 
+// Whether the row is an active admin with no end date: the kind of access a
+// site keeps at least one of, because a window's lapse cannot be prevented.
+fn is_open_admin(state: &Value) -> bool {
+    is_active_admin(state) && matches!(window_of(state), Window::Open)
+}
+
+// Whether replacing the row `id` with `after` would leave the site with no
+// open-ended admin where it had one, or would make the site's first admin one
+// with an end date. A site that has admins but none open-ended (it was never
+// given one) is not made worse by a change, so this stays false there.
+fn strands_open_admin(rows: &[(String, Value)], id: &str, after: &Value) -> bool {
+    let had = rows.iter().any(|(_, s)| is_open_admin(s));
+    let keeps = is_open_admin(after)
+        || rows
+            .iter()
+            .any(|(other, s)| other.to_lowercase() != id.to_lowercase() && is_open_admin(s));
+    let first_admin = !rows
+        .iter()
+        .any(|(_, s)| role_of(s).is_some_and(is_admin_role));
+    let windowed_first = first_admin && role_of(after).is_some_and(is_admin_role) && !keeps;
+    (had && !keeps) || windowed_first
+}
+
 /// Whether the person with `email` (compared case-insensitively) is an
-/// active admin: granted the "Admin" or "Owner" role and not disabled.
+/// active admin: granted the "Admin" or "Owner" role, not disabled, and not
+/// past its access window.
 pub async fn caller_is_admin(
-    client: &Mutex<Client>,
+    store: &Store,
     domain_ir: &Value,
     email: &str,
 ) -> anyhow::Result<bool> {
     let email = email.to_lowercase();
-    Ok(member_rows(client, domain_ir)
+    Ok(member_rows(store, domain_ir)
         .await?
         .iter()
         .any(|(id, state)| id.to_lowercase() == email && is_active_admin(state)))
 }
 
 /// Whether `email` may hold a session right now: admitted, granted a role,
-/// and not disabled — a signature alone can't tell, since a cookie outlives a later disable.
-pub async fn has_access(
-    client: &Mutex<Client>,
-    domain_ir: &Value,
-    email: &str,
-) -> anyhow::Result<bool> {
+/// and neither disabled nor past its access window — a signature alone can't
+/// tell, since a cookie outlives a later disable or the end of the window.
+pub async fn has_access(store: &Store, domain_ir: &Value, email: &str) -> anyhow::Result<bool> {
     let email = email.to_lowercase();
-    Ok(member_rows(client, domain_ir)
+    Ok(member_rows(store, domain_ir)
         .await?
         .iter()
         .any(|(id, state)| {
-            id.to_lowercase() == email && role_of(state).is_some() && !is_disabled(state)
+            id.to_lowercase() == email && role_of(state).is_some() && !is_lapsed(state)
         }))
 }
 
 /// The role `email` holds right now, or `None` if unknown, roleless, or
-/// disabled — reads the live membership head, never the session cookie.
+/// disabled or past its window — reads the live membership head, never the
+/// session cookie.
 pub async fn active_role(
-    client: &Mutex<Client>,
+    store: &Store,
     domain_ir: &Value,
     email: &str,
 ) -> anyhow::Result<Option<String>> {
     let email = email.to_lowercase();
-    Ok(member_rows(client, domain_ir)
+    Ok(member_rows(store, domain_ir)
         .await?
         .iter()
-        .find(|(id, state)| id.to_lowercase() == email && !is_disabled(state))
+        .find(|(id, state)| id.to_lowercase() == email && !is_lapsed(state))
         .and_then(|(_, state)| role_of(state).map(String::from)))
 }
 
 /// The Governance identity id linked to the member with `email`, read from
 /// the live membership head. `None` when the member has not signed in yet.
 pub async fn member_identity_id(
-    client: &Mutex<Client>,
+    store: &Store,
     domain_ir: &Value,
     email: &str,
 ) -> anyhow::Result<Option<String>> {
     let email = email.to_lowercase();
-    Ok(member_rows(client, domain_ir)
+    Ok(member_rows(store, domain_ir)
         .await?
         .iter()
         .find(|(id, state)| id.to_lowercase() == email && !is_deleted(state))
@@ -788,10 +945,13 @@ fn linked_identity_id(state: &Value) -> Option<String> {
 }
 
 /// Every admitted person as a JSON row: name, email, role, `linked`
-/// (signed in), `granted` (has access), `disabled`, and `identity_id`
+/// (signed in), `granted` (has access right now), `disabled` (the raw flag),
+/// `access_expires_at` (the end of a time-boxed window, `null` when open-ended),
+/// `expired` (the window has ended or is unreadable), and `identity_id`
 /// (the Governance identity id, `null` until the person has signed in).
-pub async fn all_people(client: &Mutex<Client>, domain_ir: &Value) -> anyhow::Result<Vec<Value>> {
-    Ok(member_rows(client, domain_ir)
+pub async fn all_people(store: &Store, domain_ir: &Value) -> anyhow::Result<Vec<Value>> {
+    let now = ProcessClock.now_secs();
+    Ok(member_rows(store, domain_ir)
         .await?
         .into_iter()
         .filter(|(_, state)| !is_deleted(state))
@@ -802,13 +962,16 @@ pub async fn all_people(client: &Mutex<Client>, domain_ir: &Value) -> anyhow::Re
                 .and_then(|v| v.get("value"))
                 .is_some();
             let disabled = is_disabled(&state);
+            let expired = is_expired_at(&state, now);
             json!({
                 "name": state.get("name").and_then(|v| v.get("value")),
                 "email": state.get("email").and_then(|v| v.get("value")),
                 "role": role,
                 "linked": linked,
-                "granted": role.is_some() && !disabled,
+                "granted": role.is_some() && !disabled && !expired,
                 "disabled": disabled,
+                "access_expires_at": expiry_text(&state),
+                "expired": expired,
                 "identity_id": linked_identity_id(&state),
             })
         })
@@ -828,12 +991,14 @@ pub enum DisableOutcome {
     UnknownPerson,
     /// Disabling would leave no active Admin.
     LastAdmin,
+    /// Disabling would leave no active Admin without an end date.
+    LastOpenAdmin,
 }
 
 /// Disables or enables `target` for `caller`, keeping role and identity
 /// link — locked with other membership writes so concurrent disables can't both win.
 pub async fn set_person_disabled(
-    client: &Mutex<Client>,
+    store: &Store,
     config: &LineageConfig,
     domain_ir: &Value,
     caller: &str,
@@ -844,53 +1009,40 @@ pub async fn set_person_disabled(
     let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
     let (caller, target) = (caller.trim().to_lowercase(), target.trim().to_lowercase());
 
-    let mut guard = client.lock().await;
-    let txn = guard.transaction().await?;
-    txn.execute(
-        "SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))",
-        &[&config.domain],
-    )
-    .await?;
-    let rows = journal::read_lineage_head_all(&txn, domain, &storage_name).await?;
-
-    if !rows
-        .iter()
-        .any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state))
-    {
-        return Ok(DisableOutcome::CallerNotAdmin);
-    }
-    if disable && caller == target {
-        return Ok(DisableOutcome::SelfDisable);
-    }
-    let Some((id, state)) = rows.iter().find(|(id, _)| id.to_lowercase() == target) else {
-        return Ok(DisableOutcome::UnknownPerson);
-    };
-    if is_disabled(state) == disable {
-        return Ok(DisableOutcome::Done);
-    }
-    if disable && is_last_active_admin(&rows, state) {
-        return Ok(DisableOutcome::LastAdmin);
-    }
+    let outcome = store
+        .amend_head(config, domain, &aggregate_name, &storage_name, |rows| {
+            if !rows
+                .iter()
+                .any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state))
+            {
+                return (DisableOutcome::CallerNotAdmin, None);
+            }
+            if disable && caller == target {
+                return (DisableOutcome::SelfDisable, None);
+            }
+            let Some((id, state)) = rows.iter().find(|(id, _)| id.to_lowercase() == target) else {
+                return (DisableOutcome::UnknownPerson, None);
+            };
+            if is_disabled(state) == disable {
+                return (DisableOutcome::Done, None);
+            }
+            if disable && is_last_active_admin(rows, state) {
+                return (DisableOutcome::LastAdmin, None);
+            }
 
-    let mut new_state = state.clone();
-    if disable {
-        new_state["disabled"] = json!(true);
-    } else if let Some(fields) = new_state.as_object_mut() {
-        fields.remove("disabled");
-    }
-    journal::append_lineage_mutation(
-        &txn,
-        config,
-        &journal::Mutation {
-            aggregate: &aggregate_name,
-            id,
-            operation: "save",
-            state: &new_state,
-        },
-    )
-    .await?;
-    txn.commit().await?;
-    Ok(DisableOutcome::Done)
+            let mut new_state = state.clone();
+            if disable {
+                new_state["disabled"] = json!(true);
+            } else if let Some(fields) = new_state.as_object_mut() {
+                fields.remove("disabled");
+            }
+            if strands_open_admin(rows, id, &new_state) {
+                return (DisableOutcome::LastOpenAdmin, None);
+            }
+            (DisableOutcome::Done, Some((id.clone(), new_state)))
+        })
+        .await?;
+    Ok(outcome)
 }
 
 /// What `set_person_deleted` decided.
@@ -911,7 +1063,7 @@ pub enum DeleteOutcome {
 /// stays in the journal (nothing here is ever erased) but `all_people` stops
 /// listing it. Locked with other membership writes the same as disable/role.
 pub async fn set_person_deleted(
-    client: &Mutex<Client>,
+    store: &Store,
     config: &LineageConfig,
     domain_ir: &Value,
     caller: &str,
@@ -921,46 +1073,30 @@ pub async fn set_person_deleted(
     let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
     let (caller, target) = (caller.trim().to_lowercase(), target.trim().to_lowercase());
 
-    let mut guard = client.lock().await;
-    let txn = guard.transaction().await?;
-    txn.execute(
-        "SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))",
-        &[&config.domain],
-    )
-    .await?;
-    let rows = journal::read_lineage_head_all(&txn, domain, &storage_name).await?;
-
-    if !rows
-        .iter()
-        .any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state))
-    {
-        return Ok(DeleteOutcome::CallerNotAdmin);
-    }
-    let Some((id, state)) = rows.iter().find(|(id, _)| id.to_lowercase() == target) else {
-        return Ok(DeleteOutcome::UnknownPerson);
-    };
-    if is_deleted(state) {
-        return Ok(DeleteOutcome::Done);
-    }
-    if !is_disabled(state) {
-        return Ok(DeleteOutcome::NotDisabled);
-    }
+    let outcome = store
+        .amend_head(config, domain, &aggregate_name, &storage_name, |rows| {
+            if !rows
+                .iter()
+                .any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state))
+            {
+                return (DeleteOutcome::CallerNotAdmin, None);
+            }
+            let Some((id, state)) = rows.iter().find(|(id, _)| id.to_lowercase() == target) else {
+                return (DeleteOutcome::UnknownPerson, None);
+            };
+            if is_deleted(state) {
+                return (DeleteOutcome::Done, None);
+            }
+            if !is_disabled(state) {
+                return (DeleteOutcome::NotDisabled, None);
+            }
 
-    let mut new_state = state.clone();
-    new_state["deleted"] = json!(true);
-    journal::append_lineage_mutation(
-        &txn,
-        config,
-        &journal::Mutation {
-            aggregate: &aggregate_name,
-            id,
-            operation: "save",
-            state: &new_state,
-        },
-    )
-    .await?;
-    txn.commit().await?;
-    Ok(DeleteOutcome::Done)
+            let mut new_state = state.clone();
+            new_state["deleted"] = json!(true);
+            (DeleteOutcome::Done, Some((id.clone(), new_state)))
+        })
+        .await?;
+    Ok(outcome)
 }
 
 /// What `set_person_role` decided.
@@ -974,12 +1110,14 @@ pub enum RoleOutcome {
     UnknownPerson,
     /// The change would leave no active Admin or Owner.
     LastAdmin,
+    /// The change would leave no active Admin or Owner without an end date.
+    LastOpenAdmin,
 }
 
 /// Sets `target`'s role on `caller`'s behalf; any active admin may
 /// grant any role, Owner included, locked against concurrent demotions.
 pub async fn set_person_role(
-    client: &Mutex<Client>,
+    store: &Store,
     config: &LineageConfig,
     domain_ir: &Value,
     caller: &str,
@@ -990,77 +1128,59 @@ pub async fn set_person_role(
     let domain = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
     let (caller, target) = (caller.trim().to_lowercase(), target.trim().to_lowercase());
 
-    let mut guard = client.lock().await;
-    let txn = guard.transaction().await?;
-    txn.execute(
-        "SELECT pg_advisory_xact_lock(hashtext('hecks_ordinal:' || $1))",
-        &[&config.domain],
-    )
-    .await?;
-    let rows = journal::read_lineage_head_all(&txn, domain, &storage_name).await?;
-
-    if !rows
-        .iter()
-        .any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state))
-    {
-        return Ok(RoleOutcome::CallerNotAdmin);
-    }
-    let Some((id, state)) = rows.iter().find(|(id, _)| id.to_lowercase() == target) else {
-        return Ok(RoleOutcome::UnknownPerson);
-    };
-    if role_of(state) == Some(role) {
-        return Ok(RoleOutcome::Done);
-    }
-    if !is_admin_role(role) && is_last_active_admin(&rows, state) {
-        return Ok(RoleOutcome::LastAdmin);
-    }
+    let outcome = store
+        .amend_head(config, domain, &aggregate_name, &storage_name, |rows| {
+            if !rows
+                .iter()
+                .any(|(id, state)| id.to_lowercase() == caller && is_active_admin(state))
+            {
+                return (RoleOutcome::CallerNotAdmin, None);
+            }
+            let Some((id, state)) = rows.iter().find(|(id, _)| id.to_lowercase() == target) else {
+                return (RoleOutcome::UnknownPerson, None);
+            };
+            if role_of(state) == Some(role) {
+                return (RoleOutcome::Done, None);
+            }
+            if !is_admin_role(role) && is_last_active_admin(rows, state) {
+                return (RoleOutcome::LastAdmin, None);
+            }
 
-    let mut new_state = state.clone();
-    new_state["role"] = json!({"value": role});
-    journal::append_lineage_mutation(
-        &txn,
-        config,
-        &journal::Mutation {
-            aggregate: &aggregate_name,
-            id,
-            operation: "save",
-            state: &new_state,
-        },
-    )
-    .await?;
-    txn.commit().await?;
-    Ok(RoleOutcome::Done)
+            let mut new_state = state.clone();
+            new_state["role"] = json!({"value": role});
+            if strands_open_admin(rows, id, &new_state) {
+                return (RoleOutcome::LastOpenAdmin, None);
+            }
+            (RoleOutcome::Done, Some((id.clone(), new_state)))
+        })
+        .await?;
+    Ok(outcome)
 }
 
-/// Whether `identity_id` holds a live Admin/Owner assignment in this
-/// domain's authorization provider; `None` provider means never admin.
-pub fn holds_admin(
-    instances: &Value,
-    identity_id: &str,
-    provider: Option<&crate::ir::AuthorizationProvider>,
-) -> bool {
-    let Some(provider) = provider else {
-        return false;
-    };
-    let prefix = format!("{}#", provider.assignment_aggregate);
-    instances.as_object().is_some_and(|obj| {
-        obj.iter().any(|(key, state)| {
-            key.starts_with(&prefix)
-                && state
-                    .get("actor_id")
-                    .and_then(|v| v.get("value"))
-                    .and_then(|v| v.as_str())
-                    == Some(identity_id)
-                && state
-                    .get("role_name")
-                    .and_then(|v| v.get("value"))
-                    .and_then(|v| v.as_str())
-                    .is_some_and(is_admin_role)
-                && state.get("ends_at").is_none_or(serde_json::Value::is_null)
-        })
+/// Whether any of `rows` — the provider's `live_assignments` answer for one actor — grants an
+/// Admin or Owner role. The bluebook's query decides which assignments are live, so this reads
+/// no `ends_at`.
+pub fn holds_admin(rows: &[Value]) -> bool {
+    rows.iter().any(|row| {
+        row.get("role_name")
+            .and_then(|v| v.get("value"))
+            .and_then(|v| v.as_str())
+            .is_some_and(is_admin_role)
     })
 }
 
+/// The rows of a kernel query answer (`{"queries":[{"rows":[...]}]}`).
+pub fn answer_rows(answer: &Value) -> Vec<Value> {
+    answer
+        .get("queries")
+        .and_then(|q| q.as_array())
+        .and_then(|q| q.first())
+        .and_then(|q| q.get("rows"))
+        .and_then(|r| r.as_array())
+        .cloned()
+        .unwrap_or_default()
+}
+
 fn now_secs() -> u64 {
     SystemTime::now()
         .duration_since(UNIX_EPOCH)
@@ -1068,36 +1188,6 @@ fn now_secs() -> u64 {
         .as_secs()
 }
 
-// `dispatch.rs`'s `occurred_at` stamping reuses this exact rendering
-// rather than re-deriving it — see the body comment for the format
-// guarantee both call sites depend on.
-pub(crate) fn httpdate_now() -> String {
-    // ISO 8601 UTC, matching Ruby's Time.now.utc.iso8601 -- Governance::
-    // RoleAssignment.starts_at only needs to parse as a real instant,
-    // never re-derived from or compared against wall-clock time here.
-    let secs = now_secs();
-    let days = secs / 86_400;
-    let rem = secs % 86_400;
-    let (h, m, s) = (rem / 3600, (rem % 3600) / 60, rem % 60);
-    let (y, mo, d) = civil_from_days(days as i64);
-    format!("{y:04}-{mo:02}-{d:02}T{h:02}:{m:02}:{s:02}Z")
-}
-
-// Howard Hinnant's days-from-civil algorithm, inverted -- avoids
-// pulling in a full date/time crate for one timestamp format.
-const fn civil_from_days(z: i64) -> (i64, u32, u32) {
-    let z = z + 719_468;
-    let era = if z >= 0 { z } else { z - 146_096 } / 146_097;
-    let doe = (z - era * 146_097) as u64;
-    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146_096) / 365;
-    let y = yoe as i64 + era * 400;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = (doy - (153 * mp + 2) / 5 + 1) as u32;
-    let m = if mp < 10 { mp + 3 } else { mp - 9 } as u32;
-    (if m <= 2 { y + 1 } else { y }, m, d)
-}
-
 #[allow(clippy::expect_used)] // reason: HMAC accepts a key of any length, so construction cannot fail
 fn sign(secret: &str, payload: &str) -> String {
     use hmac::{Hmac, Mac};
@@ -1136,6 +1226,8 @@ pub(crate) fn urlencode(s: &str) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
+    #[allow(unused_imports)]
+    use crate::store::StoreFixtures;
 
     #[test]
     fn signed_token_verifies_with_the_right_secret_and_rejects_tampering() {
@@ -1287,15 +1379,42 @@ mod tests {
     }
 
     #[test]
-    fn oauth_state_verifies_fresh_and_rejects_forged_or_expired() {
-        let fresh = now_secs().to_string();
-        let state = format!("{fresh}.{}", sign("s3cret", &fresh));
-        assert!(verify_state(&state, "s3cret").is_ok());
-        assert!(verify_state(&state, "wrong-secret").is_err());
-
-        let stale = (now_secs() - STATE_TTL_SECS - 1).to_string();
-        let expired = format!("{stale}.{}", sign("s3cret", &stale));
-        assert!(verify_state(&expired, "s3cret").is_err());
+    fn an_id_token_is_accepted_only_with_the_sign_ins_own_nonce() {
+        assert!(check_nonce(&json!({"nonce": "n-123"}), "n-123").is_ok());
+        assert!(check_nonce(&json!({"nonce": "n-456"}), "n-123").is_err());
+        assert!(check_nonce(&json!({}), "n-123").is_err());
+        assert!(check_nonce(&json!({"nonce": 5}), "n-123").is_err());
+    }
+
+    #[test]
+    fn a_handoff_token_is_redeemed_once_for_the_account_token() {
+        let spent = crate::platform_signin::jti::JtiStore::new();
+        let handoff = handoff_token("s3cret", "zed@example.com");
+        assert_eq!(verify_account_token("s3cret", &handoff), None);
+        let account = redeem_handoff_token("s3cret", &handoff, &spent).unwrap();
+        assert_eq!(
+            verify_account_token("s3cret", &account).as_deref(),
+            Some("zed@example.com")
+        );
+        assert_eq!(redeem_handoff_token("s3cret", &handoff, &spent), None);
+    }
+
+    #[test]
+    fn an_account_or_foreign_token_is_not_a_handoff_token() {
+        let spent = crate::platform_signin::jti::JtiStore::new();
+        let account = account_token("s3cret", "zed@example.com", 60);
+        assert_eq!(redeem_handoff_token("s3cret", &account, &spent), None);
+        let handoff = handoff_token("other-secret", "zed@example.com");
+        assert_eq!(redeem_handoff_token("s3cret", &handoff, &spent), None);
+    }
+
+    #[test]
+    fn the_consent_url_carries_the_sign_ins_state_and_nonce() {
+        crate::secrets::provide("GOOGLE_CLIENT_ID", "client-1".to_string());
+        let signin = GoogleSignin::fresh();
+        let url = authorization_url("https://host.example/auth/google/callback", &signin).unwrap();
+        assert!(url.contains(&format!("&state={}", signin.state)), "{url}");
+        assert!(url.contains(&format!("&nonce={}", signin.nonce)), "{url}");
     }
 
     #[test]
@@ -1312,7 +1431,7 @@ mod tests {
     #[test]
     fn resolve_identity_finds_a_link_that_only_the_flat_journal_holds() {
         // The shape `ExternalIdentifier.Link` leaves in the flat snapshot of a domain whose Identity
-        // chapter has no head of its own; the key carries the issuer URL and the subject.
+        // bluebook has no head of its own; the key carries the issuer URL and the subject.
         let instances = json!({
             "Identity::ExternalIdentifier#https://accounts.google.com:111": {
                 "identity": "471ef402-8609-4fa4-9288-6372fc74650d",
@@ -1356,21 +1475,61 @@ mod tests {
     }
 
     #[test]
-    fn holds_admin_reads_straight_off_instances() {
-        let instances = json!({
-            "Governance::RoleAssignment#id-1:Admin": {
-                "actor_id": {"value": "id-1"}, "role_name": {"value": "Admin"}, "ends_at": null,
-            },
-        });
+    fn holds_admin_reads_the_live_assignment_rows() {
+        let live = [json!({"actor_id": {"value": "id-1"}, "role_name": {"value": "Admin"}})];
+        assert!(holds_admin(&live));
+        // No live assignment answered: no role is held, whatever was granted before.
+        assert!(!holds_admin(&[]));
+    }
+
+    #[test]
+    fn answer_rows_reads_the_first_query_of_a_kernel_answer() {
+        let answer = json!({"queries": [{"query": "G.Live", "rows": [{"id": "a"}]}]});
+        assert_eq!(answer_rows(&answer), vec![json!({"id": "a"})]);
+        assert!(answer_rows(&json!({"queries": []})).is_empty());
+    }
+
+    #[test]
+    fn a_window_lapses_exactly_at_its_end_and_a_missing_one_never_does() {
+        let ends = crate::clock::parse_iso_utc("2026-10-22T12:00:00Z").unwrap();
+        let row = json!({"role": {"value": "Member"}, "access_expires_at": "2026-10-22T12:00:00Z"});
+        assert!(!is_lapsed_at(&row, ends - 1), "one second before the end");
+        assert!(is_lapsed_at(&row, ends), "the end instant itself is over");
+        assert!(is_lapsed_at(&row, ends + 1));
+        let open = json!({"role": {"value": "Member"}});
+        assert!(!is_lapsed_at(&open, i64::MAX));
+        let unreadable = json!({"access_expires_at": "next week"});
+        assert!(is_lapsed_at(&unreadable, 0), "unreadable fails closed");
+        let disabled = json!({"disabled": true, "access_expires_at": "2099-01-01T00:00:00Z"});
+        assert!(
+            is_lapsed_at(&disabled, 0),
+            "an open window does not undo a disable"
+        );
+    }
+
+    #[test]
+    fn expiry_after_days_counts_whole_days_from_the_given_instant() {
+        let start = crate::clock::parse_iso_utc("2026-10-22T08:30:15Z").unwrap();
+        assert_eq!(expiry_after_days_from(1, start), "2026-10-23T08:30:15Z");
+        assert_eq!(
+            expiry_after_days_from(MAX_EXPIRY_DAYS, start),
+            "2027-10-22T08:30:15Z"
+        );
+    }
 
-        let provider = crate::ir::AuthorizationProvider {
-            grant: "Governance::RoleAssignment.Assign".to_string(),
-            assignment_aggregate: "Governance::RoleAssignment".to_string(),
+    #[test]
+    fn is_last_active_admin_ignores_an_admin_whose_window_ended() {
+        let admin = json!({"role": {"value": "Admin"}});
+        let expired =
+            json!({"role": {"value": "Admin"}, "access_expires_at": "2020-01-01T00:00:00Z"});
+        let rows = |states: &[&Value]| -> Vec<(String, Value)> {
+            states
+                .iter()
+                .map(|s| (String::new(), (*s).clone()))
+                .collect()
         };
-        assert!(holds_admin(&instances, "id-1", Some(&provider)));
-        assert!(!holds_admin(&instances, "id-2", Some(&provider)));
-        // No declared provider: no assignment can exist, so never admin.
-        assert!(!holds_admin(&instances, "id-1", None));
+        assert!(is_last_active_admin(&rows(&[&admin, &expired]), &admin));
+        assert!(!is_last_active_admin(&rows(&[&admin, &expired]), &expired));
     }
 
     #[test]
@@ -1417,15 +1576,12 @@ mod tests {
 
     #[test]
     fn holds_admin_accepts_an_owner_assignment_and_refuses_other_roles() {
-        let provider = crate::ir::AuthorizationProvider {
-            grant: "G".to_string(),
-            assignment_aggregate: "Governance::RoleAssignment".to_string(),
-        };
-        let assignment = |role: &str| json!({"Governance::RoleAssignment#a": {"actor_id": {"value": "id-1"}, "role_name": {"value": role}, "ends_at": null}});
-        assert!(holds_admin(&assignment("Admin"), "id-1", Some(&provider)));
-        assert!(holds_admin(&assignment("Owner"), "id-1", Some(&provider)));
-        assert!(!holds_admin(&assignment("Member"), "id-1", Some(&provider)));
-        assert!(!holds_admin(&assignment("owner"), "id-1", Some(&provider)));
+        let rows =
+            |role: &str| [json!({"actor_id": {"value": "id-1"}, "role_name": {"value": role}})];
+        assert!(holds_admin(&rows("Admin")));
+        assert!(holds_admin(&rows("Owner")));
+        assert!(!holds_admin(&rows("Member")));
+        assert!(!holds_admin(&rows("owner")));
     }
 
     #[test]
@@ -1456,7 +1612,7 @@ mod tests {
     // A throwaway Postgres database per test, matching the real
     // `head_view` naming (`qualified_name(domain, "#{storage_name}_head")`,
     // docs/decisions/0059) that the functions under test query directly.
-    async fn scratch_member_db(name: &str) -> Mutex<tokio_postgres::Client> {
+    async fn scratch_member_db(name: &str) -> Store {
         use tokio_postgres::NoTls;
         let (admin, conn) = tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
             .await
@@ -1493,7 +1649,7 @@ mod tests {
             )
             .await
             .unwrap();
-        Mutex::new(client)
+        crate::store::postgres_store(client)
     }
 
     // A minimal `ir.json`-shaped fixture: one lineage-capable aggregate
@@ -1592,6 +1748,7 @@ mod tests {
             domain: "Acme".to_string(),
             era: Some(1),
             mirrored: None,
+            seal_every: None,
         };
         {
             let guard = db.lock().await;