@antasphere/chassis-server 1.0.0

package/test/integration/pagination.test.ts

@@ -0,0 +1,344 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import { randomUUID } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { apiKeys, files, invitations, user as userTable, workspaceMembers } from '@antasphere/chassis-db';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  type TestApp,
+  host
+} from './helpers.js';
+
+/**
+ * Cursor pagination across the list endpoints: exhaustive page walks (no
+ * duplicates, no gaps, strict (created_at, id) DESC), the same-timestamp
+ * tie-break (the microsecond regression the plain-id cursor exists for),
+ * cursor tolerance (malformed → page 1, unknown uuid → empty page), limit
+ * validation, the SQL-side soft-delete filter, and api-key scoping held
+ * across pages.
+ */
+
+const OWNER = { email: 'owner@pagination.test', name: 'Page Owner', password: 'page-owner-password-1' };
+const MEMBER = { email: 'member@pagination.test', name: 'Page Member', password: 'page-member-pass-123' };
+
+let container: StartedPostgreSqlContainer;
+let app: TestApp;
+let ownerCookie: string;
+let workspaceId: string;
+let ownerUserId: string;
+
+const json = (body: unknown) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json' },
+  body: JSON.stringify(body)
+});
+
+/** Deterministic, distinct timestamps (UTC, second-spaced) for seeded rows. */
+const ts = (i: number) => new Date(Date.UTC(2026, 0, 1, 0, 0, i));
+
+async function listPage(path: string, query: Record<string, string>, cookie = ownerCookie) {
+  const qs = new URLSearchParams(query).toString();
+  return app.app.request(`/api/v1/${path}${qs ? `?${qs}` : ''}`, { headers: { cookie } });
+}
+
+interface WalkRow {
+  id: string;
+  createdAt: string;
+}
+
+/** Follow nextCursor to the end; the final page must answer nextCursor null. */
+async function walk(path: string, key: string, limit: number, cookie = ownerCookie): Promise<WalkRow[]> {
+  const rows: WalkRow[] = [];
+  let cursor: string | undefined;
+  for (let guard = 0; guard < 50; guard++) {
+    const res = await listPage(path, { limit: String(limit), ...(cursor ? { cursor } : {}) }, cookie);
+    expect(res.status).toBe(200);
+    const body = await readJson(res);
+    const page = body[key] as WalkRow[];
+    expect(page.length).toBeLessThanOrEqual(limit);
+    rows.push(...page);
+    if (body.nextCursor === null) return rows;
+    expect(typeof body.nextCursor).toBe('string');
+    cursor = body.nextCursor;
+  }
+  throw new Error(`walk of /${path} did not terminate`);
+}
+
+/** No duplicates, no gaps: the walked ids are exactly the expected set. */
+function expectExactly(rows: WalkRow[], expectedIds: string[]): void {
+  const ids = rows.map((r) => r.id);
+  expect(new Set(ids).size).toBe(ids.length);
+  expect(new Set(ids)).toEqual(new Set(expectedIds));
+}
+
+/** Strict (createdAt, id) DESC across page boundaries (ISO strings compare lexicographically). */
+function expectStrictDesc(rows: WalkRow[]): void {
+  for (let i = 1; i < rows.length; i++) {
+    const prev = rows[i - 1]!;
+    const cur = rows[i]!;
+    const strictlyBefore =
+      cur.createdAt < prev.createdAt || (cur.createdAt === prev.createdAt && cur.id < prev.id);
+    expect(
+      strictlyBefore,
+      `row ${i} out of order: ${prev.createdAt}/${prev.id} then ${cur.createdAt}/${cur.id}`
+    ).toBe(true);
+  }
+}
+
+async function uploadFile(name: string, text: string): Promise<string> {
+  const res = await app.app.request(`/api/v1/files?name=${encodeURIComponent(name)}`, {
+    method: 'POST',
+    headers: { 'content-type': 'text/plain', cookie: ownerCookie },
+    body: text
+  });
+  expect(res.status).toBe(201);
+  return (await readJson(res)).file.id as string;
+}
+
+beforeAll(async () => {
+  container = await startPostgres();
+  app = await createTestApp(await createDatabase(container, 'pagination'));
+
+  await app.app.request(
+    '/api/v1/setup',
+    json({ setupToken: 'integration-test-setup-token', instanceName: 'Pagination', owner: OWNER })
+  );
+  const signIn = await app.app.request(
+    '/api/v1/auth/sign-in/email',
+    json({ email: OWNER.email, password: OWNER.password })
+  );
+  ownerCookie = extractCookie(signIn);
+  const me = await readJson(await app.app.request('/api/v1/me', { headers: { cookie: ownerCookie } }));
+  workspaceId = me.workspace.id;
+  ownerUserId = me.user.id;
+});
+
+afterAll(async () => {
+  await app?.stop();
+  await container?.stop();
+});
+
+describe('page walks (no dups, no gaps, strict order)', () => {
+  const walkFileIds: string[] = [];
+
+  it('files: uploads walk back newest-first through ?limit=2 pages', async () => {
+    for (let i = 0; i < 5; i++) {
+      const id = await uploadFile(`walk-${i}.txt`, `walk file ${i}`);
+      walkFileIds.push(id);
+      // Pin distinct timestamps so the expected order is exact; the
+      // identical-timestamp case gets its own test below.
+      await app.db.db
+        .update(files)
+        .set({ createdAt: ts(i) })
+        .where(eq(files.id, id));
+    }
+    const rows = await walk('files', 'files', 2);
+    expectExactly(rows, walkFileIds);
+    expectStrictDesc(rows);
+  });
+
+  it('members: seeded memberships walk cleanly (join included)', async () => {
+    const memberIds: string[] = [];
+    for (let i = 0; i < 5; i++) {
+      const userId = `pagination-user-${i}`;
+      await app.db.db.insert(userTable).values({
+        id: userId,
+        name: `Walk User ${i}`,
+        email: `walk-user-${i}@pagination.test`,
+        emailVerified: true
+      });
+      const [row] = await app.db.db
+        .insert(workspaceMembers)
+        .values({ workspaceId, userId, role: 'member', createdAt: ts(i) })
+        .returning({ id: workspaceMembers.id });
+      memberIds.push(row!.id);
+    }
+    const [ownerRow] = await app.db.db
+      .select({ id: workspaceMembers.id })
+      .from(workspaceMembers)
+      .where(eq(workspaceMembers.userId, ownerUserId));
+    const rows = await walk('members', 'members', 2);
+    expectExactly(rows, [...memberIds, ownerRow!.id]);
+    expectStrictDesc(rows);
+  });
+
+  it('invitations: seeded invitations walk cleanly', async () => {
+    const invitationIds: string[] = [];
+    for (let i = 0; i < 5; i++) {
+      const [row] = await app.db.db
+        .insert(invitations)
+        .values({
+          workspaceId,
+          email: `walk-invitee-${i}@pagination.test`,
+          role: 'member',
+          tokenHash: randomUUID(),
+          invitedBy: ownerUserId,
+          expiresAt: new Date(Date.now() + 86_400_000),
+          createdAt: ts(i)
+        })
+        .returning({ id: invitations.id });
+      invitationIds.push(row!.id);
+    }
+    const rows = await walk('invitations', 'invitations', 2);
+    expectExactly(rows, invitationIds);
+    expectStrictDesc(rows);
+  });
+});
+
+describe('same-timestamp tie-break (the microsecond regression test)', () => {
+  it('walks limit=1 through rows sharing one createdAt without dup or gap', async () => {
+    const tied = new Date(Date.UTC(2025, 5, 1, 12, 0, 0, 123));
+    const tiedIds: string[] = [];
+    for (let i = 0; i < 3; i++) {
+      const id = await uploadFile(`tied-${i}.txt`, `tied file ${i}`);
+      await app.db.db.update(files).set({ createdAt: tied }).where(eq(files.id, id));
+      tiedIds.push(id);
+    }
+    const rows = await walk('files', 'files', 1);
+    // Each tied row exactly once (id DESC breaks the tie), everything ordered.
+    expect(new Set(rows.map((r) => r.id)).size).toBe(rows.length);
+    for (const id of tiedIds) expect(rows.map((r) => r.id)).toContain(id);
+    expectStrictDesc(rows);
+  });
+});
+
+describe('cursor tolerance', () => {
+  const endpoints: Array<[path: string, key: string]> = [
+    ['members', 'members'],
+    ['api-keys', 'apiKeys'],
+    ['invitations', 'invitations'],
+    ['files', 'files'],
+    ['audit', 'entries']
+  ];
+
+  it('a malformed cursor is ignored: ?cursor=banana equals the uncursored first page', async () => {
+    for (const [path] of endpoints) {
+      const withBanana = await listPage(path, { cursor: 'banana' });
+      expect(withBanana.status).toBe(200);
+      const plain = await listPage(path, {});
+      expect(await readJson(withBanana)).toEqual(await readJson(plain));
+    }
+  });
+
+  it('an unknown well-formed uuid cursor yields an empty page + nextCursor null', async () => {
+    const ghost = randomUUID();
+    for (const [path, key] of endpoints) {
+      if (path === 'audit') continue; // numeric ids — a uuid is just malformed there
+      const res = await listPage(path, { cursor: ghost });
+      expect(res.status).toBe(200);
+      expect(await readJson(res)).toEqual({ [key]: [], nextCursor: null });
+    }
+  });
+
+  it('rejects out-of-range limits with validation_error on every list', async () => {
+    for (const [path] of endpoints) {
+      for (const limit of ['0', '101']) {
+        const res = await listPage(path, { limit });
+        expect(res.status).toBe(400);
+        const body = await readJson(res);
+        expect(body.error.code).toBe('validation_error');
+      }
+    }
+  });
+});
+
+describe('soft-deleted files stay out of every page', () => {
+  it('a deleted file appears on no page of the walk', async () => {
+    const doomedId = await uploadFile('doomed.txt', 'delete me before the walk');
+    const del = await app.app.request(`/api/v1/files/${doomedId}`, {
+      method: 'DELETE',
+      headers: { cookie: ownerCookie }
+    });
+    expect(del.status).toBe(200);
+    const rows = await walk('files', 'files', 1);
+    expect(rows.map((r) => r.id)).not.toContain(doomedId);
+  });
+
+  it('re-uploading identical bytes revives the soft-deleted row back into the list', async () => {
+    const body = 'phoenix bytes — deleted then re-uploaded';
+    const phoenixId = await uploadFile('phoenix.txt', body);
+
+    const del = await app.app.request(`/api/v1/files/${phoenixId}`, {
+      method: 'DELETE',
+      headers: { cookie: ownerCookie }
+    });
+    expect(del.status).toBe(200);
+    const gone = await readJson(await listPage('files', {}));
+    expect(gone.files.map((f: WalkRow) => f.id)).not.toContain(phoenixId);
+
+    // Same bytes → the dedupe path revives the existing row (deletedAt back
+    // to null), which the SQL-side isNull filter must show again.
+    const reupload = await app.app.request(`/api/v1/files?name=${encodeURIComponent('phoenix.txt')}`, {
+      method: 'POST',
+      headers: { 'content-type': 'text/plain', cookie: ownerCookie },
+      body
+    });
+    expect(reupload.status).toBe(201);
+    const reuploaded = await readJson(reupload);
+    expect(reuploaded.deduplicated).toBe(true);
+    expect(reuploaded.file.id).toBe(phoenixId);
+
+    const back = await readJson(await listPage('files', {}));
+    expect(back.files.map((f: WalkRow) => f.id)).toContain(phoenixId);
+  });
+});
+
+describe('api-key scoping holds on every page', () => {
+  let memberCookie: string;
+  const memberKeyIds: string[] = [];
+  const ownerKeyIds: string[] = [];
+
+  it('each user sees exactly THEIR OWN keys across a walk (keys are user credentials)', async () => {
+    // Bring in a real member via the invitation-accept flow.
+    const invite = await app.app.request('/api/v1/invitations', {
+      ...json({ email: MEMBER.email, role: 'member' }),
+      headers: { 'content-type': 'application/json', cookie: ownerCookie }
+    });
+    const { acceptUrl } = await readJson(invite);
+    const token = acceptUrl.split('/invite/')[1]!;
+    const accepted = await app.app.request(
+      '/api/v1/invitations/accept',
+      json({ token, name: MEMBER.name, password: MEMBER.password })
+    );
+    expect(accepted.status).toBe(200);
+    const signIn = await app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: MEMBER.email, password: MEMBER.password })
+    );
+    memberCookie = extractCookie(signIn);
+
+    const mint = async (cookie: string, name: string) => {
+      const res = await app.app.request('/api/v1/api-keys', {
+        ...json({ name, scopes: [host.scopes.read] }),
+        headers: { 'content-type': 'application/json', cookie }
+      });
+      expect(res.status).toBe(201);
+      return (await readJson(res)).apiKey.id as string;
+    };
+    for (let i = 0; i < 2; i++) memberKeyIds.push(await mint(memberCookie, `member-key-${i}`));
+    for (let i = 0; i < 3; i++) ownerKeyIds.push(await mint(ownerCookie, `owner-key-${i}`));
+    // Pin distinct timestamps (rapid mints can share a millisecond) so the
+    // strict-order assertion is exact.
+    const allKeyIds = [...memberKeyIds, ...ownerKeyIds];
+    for (let i = 0; i < allKeyIds.length; i++) {
+      await app.db.db
+        .update(apiKeys)
+        .set({ createdAt: ts(10 + i) })
+        .where(eq(apiKeys.id, allKeyIds[i]!));
+    }
+
+    const memberRows = await walk('api-keys', 'apiKeys', 1, memberCookie);
+    expectExactly(memberRows, memberKeyIds);
+    expectStrictDesc(memberRows);
+
+    // The owner's walk is creator-scoped too (user-scoped credential model):
+    // no role sees anyone else's keys through this listing.
+    const ownerRows = await walk('api-keys', 'apiKeys', 2);
+    expectExactly(ownerRows, ownerKeyIds);
+    expectStrictDesc(ownerRows);
+  });
+});

package/test/integration/platform-core.test.ts

@@ -0,0 +1,305 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import { desc, eq } from 'drizzle-orm';
+import { auditLog } from '@antasphere/chassis-db';
+import {
+  createDatabase,
+  createTestApp,
+  extractCookie,
+  readJson,
+  startPostgres,
+  type TestApp,
+  host
+} from './helpers.js';
+
+/**
+ * M2 platform core: API keys, members, invitations, audit, rate limits.
+ * Isolated database (per-suite isolation, decision 15); the flow inside is
+ * deliberately ordered — it is the exit-criteria #3/#4 story.
+ */
+
+const OWNER = { email: 'owner@core.test', name: 'Core Owner', password: 'core-owner-password-12' };
+const INVITEE = { email: 'teammate@core.test', name: 'Team Mate', password: 'teammate-password-123' };
+
+let container: StartedPostgreSqlContainer;
+let app: TestApp;
+let ownerCookie: string;
+
+const json = (body: unknown) => ({
+  method: 'POST',
+  headers: { 'content-type': 'application/json' },
+  body: JSON.stringify(body)
+});
+
+beforeAll(async () => {
+  container = await startPostgres();
+  const url = await createDatabase(container, 'platform_core');
+  app = await createTestApp(url);
+
+  await app.app.request(
+    '/api/v1/setup',
+    json({ setupToken: 'integration-test-setup-token', instanceName: 'Core', owner: OWNER })
+  );
+  const signIn = await app.app.request(
+    '/api/v1/auth/sign-in/email',
+    json({ email: OWNER.email, password: OWNER.password })
+  );
+  ownerCookie = extractCookie(signIn);
+});
+
+afterAll(async () => {
+  await app?.stop();
+  await container?.stop();
+});
+
+describe('API keys (exit criterion 4, API half)', () => {
+  let mintedKey: string;
+  let keyRecordId: string;
+  let keyId: string;
+
+  it('mints a key from a session; the secret appears exactly once', async () => {
+    const res = await app.app.request('/api/v1/api-keys', {
+      ...json({ name: 'ci key', scopes: [host.scopes.read] }),
+      headers: { 'content-type': 'application/json', cookie: ownerCookie }
+    });
+    expect(res.status).toBe(201);
+    const body = await readJson(res);
+    // The HOST's prefix, read literally (no pattern built from it), then the fixed shape.
+    const prefix = `${host.identity.apiKeyPrefix}_`;
+    expect(body.key.startsWith(prefix)).toBe(true);
+    expect(body.key.slice(prefix.length)).toMatch(/^[A-Za-z0-9_-]{8}_[A-Za-z0-9_-]{20,}$/);
+    expect(body.apiKey.scopes).toEqual([host.scopes.read]);
+    mintedKey = body.key;
+    keyRecordId = body.apiKey.id;
+    keyId = body.apiKey.keyId; // authoritative — never derive it by splitting on '_'
+
+    const list = await app.app.request('/api/v1/api-keys', { headers: { cookie: ownerCookie } });
+    const listBody = await readJson(list);
+    expect(listBody.apiKeys.map((k: { id: string }) => k.id)).toContain(keyRecordId);
+    // The full key never reappears, and no secret material (hash) leaks. Do
+    // NOT split on '_' to isolate the secret — base64url secrets contain '_',
+    // so a fragment can spuriously collide with a UUID/timestamp in the list.
+    const serialized = JSON.stringify(listBody);
+    expect(serialized).not.toContain(mintedKey);
+    expect(serialized).not.toContain('secretHash');
+  });
+
+  it('authenticates a curl-style Bearer request and lands it in the audit log with the key identity', async () => {
+    const me = await app.app.request('/api/v1/me', {
+      headers: { authorization: `Bearer ${mintedKey}` }
+    });
+    expect(me.status).toBe(200);
+    const body = await readJson(me);
+    expect(body.via).toBe('api_key');
+    expect(body.scopes).toEqual([host.scopes.read]);
+
+    // Exit criterion 4: the key-authenticated request itself appears in the
+    // audit log with the KEY identity (machine reads are audited).
+    const [keyAudit] = await app.db.db
+      .select()
+      .from(auditLog)
+      .where(eq(auditLog.actorVia, 'api_key'))
+      .orderBy(desc(auditLog.id))
+      .limit(1);
+    expect(keyAudit).toBeTruthy();
+    expect(keyAudit!.apiKeyId).toBe(keyRecordId);
+    expect(keyAudit!.action).toBe('get /api/v1/me');
+
+    // The mint was audited with the SESSION identity + the key as resource.
+    const [mintAudit] = await app.db.db
+      .select()
+      .from(auditLog)
+      .where(eq(auditLog.action, 'apikey.create'))
+      .orderBy(desc(auditLog.id))
+      .limit(1);
+    expect(mintAudit).toBeTruthy();
+    expect(mintAudit!.resourceId).toBe(keyRecordId);
+    expect(mintAudit!.actorVia).toBe('session');
+  });
+
+  it('walls machine principals off unlisted endpoints (fail-closed allowlist)', async () => {
+    const res = await app.app.request('/api/v1/members', {
+      headers: { authorization: `Bearer ${mintedKey}` }
+    });
+    expect(res.status).toBe(403);
+    const body = await readJson(res);
+    expect(body.error.code).toBe('endpoint_not_allowed');
+  });
+
+  it('refuses to mint a key with a key (sessions only)', async () => {
+    const res = await app.app.request('/api/v1/api-keys', {
+      ...json({ name: 'evil', scopes: [host.scopes.read] }),
+      headers: { 'content-type': 'application/json', authorization: `Bearer ${mintedKey}` }
+    });
+    expect(res.status).toBe(403);
+  });
+
+  it('rejects a tampered key and rate-limits repeated failures per IP', async () => {
+    // Use the real keyId (a base64url string that may contain '_') so the
+    // tampered key still passes the format check and reaches the wall.
+    const bad = `${host.identity.apiKeyPrefix}_${keyId}_${'A'.repeat(43)}`;
+    // Own bucket via spoofed client IP: the wall must not bleed into the
+    // other tests' default bucket.
+    const attacker = { authorization: `Bearer ${bad}`, 'x-forwarded-for': '203.0.113.9' };
+    const first = await app.app.request('/api/v1/me', { headers: attacker });
+    expect(first.status).toBe(401);
+
+    // The wall trips within the window; the exact iteration is ±1 (the
+    // limiter checks state before consuming), so hammer past the threshold
+    // and assert a 429 appears — not on a specific iteration.
+    let sawRateLimit = false;
+    for (let i = 0; i < 30 && !sawRateLimit; i++) {
+      const r = await app.app.request('/api/v1/me', { headers: attacker });
+      if (r.status === 429) sawRateLimit = true;
+      else expect(r.status).toBe(401);
+    }
+    expect(sawRateLimit).toBe(true);
+
+    // The wall is per-IP: the valid key from ANOTHER address still works.
+    const stillFine = await app.app.request('/api/v1/me', {
+      headers: { authorization: `Bearer ${mintedKey}`, 'x-forwarded-for': '198.51.100.7' }
+    });
+    expect(stillFine.status).toBe(200);
+  });
+
+  it('revoking the key kills it immediately', async () => {
+    const res = await app.app.request(`/api/v1/api-keys/${keyRecordId}`, {
+      method: 'DELETE',
+      headers: { cookie: ownerCookie }
+    });
+    expect(res.status).toBe(200);
+    const after = await app.app.request('/api/v1/me', {
+      headers: { authorization: `Bearer ${mintedKey}` }
+    });
+    expect(after.status).toBe(401);
+  });
+});
+
+describe('invitations without SMTP (exit criterion 3, API half)', () => {
+  let acceptUrl: string;
+
+  it('creates an invitation and always returns a copyable link (no SMTP configured)', async () => {
+    const res = await app.app.request('/api/v1/invitations', {
+      ...json({ email: INVITEE.email, role: 'member' }),
+      headers: { 'content-type': 'application/json', cookie: ownerCookie }
+    });
+    expect(res.status).toBe(201);
+    const body = await readJson(res);
+    expect(body.emailSent).toBe(false);
+    expect(body.acceptUrl).toContain('/invite/');
+    acceptUrl = body.acceptUrl;
+  });
+
+  it('rejects a duplicate open invitation', async () => {
+    const res = await app.app.request('/api/v1/invitations', {
+      ...json({ email: INVITEE.email, role: 'member' }),
+      headers: { 'content-type': 'application/json', cookie: ownerCookie }
+    });
+    expect(res.status).toBe(409);
+  });
+
+  it('resolves the token publicly (accept-page data)', async () => {
+    const token = acceptUrl.split('/invite/')[1]!;
+    const res = await app.app.request(`/api/v1/invitations/lookup?token=${token}`);
+    expect(res.status).toBe(200);
+    const body = await readJson(res);
+    expect(body.email).toBe(INVITEE.email);
+    // No account-existence signal on the public lookup (PRDCT-1437): the
+    // admin holds the accept URL, so the field was an instance-global oracle.
+    expect(body).not.toHaveProperty('accountExists');
+    expect(body.workspaceName).toBe('Core');
+  });
+
+  it('accepts with new-account credentials, then the invitee logs in with member role', async () => {
+    // `user.created` fires from the identity layer's database hook — every
+    // entrance, by construction. Subscribe before accept.
+    const created: Array<{ userId: string; email: string }> = [];
+    const unsubscribe = app.registry.events.on('user.created', (payload) => {
+      created.push(payload);
+    });
+
+    const token = acceptUrl.split('/invite/')[1]!;
+    const res = await app.app.request(
+      '/api/v1/invitations/accept',
+      json({ token, name: INVITEE.name, password: INVITEE.password })
+    );
+    expect(res.status).toBe(200);
+    const body = await readJson(res);
+    expect(body.role).toBe('member');
+
+    unsubscribe();
+    expect(created).toHaveLength(1);
+    expect(created[0]!.email).toBe(INVITEE.email);
+    expect(created[0]!.userId).toBeTruthy();
+
+    const signIn = await app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: INVITEE.email, password: INVITEE.password })
+    );
+    expect(signIn.status).toBe(200);
+    const cookie = extractCookie(signIn);
+    const me = await app.app.request('/api/v1/me', { headers: { cookie } });
+    const meBody = await readJson(me);
+    expect(meBody.role).toBe('member');
+  });
+
+  it('a used token is dead (single redemption)', async () => {
+    const token = acceptUrl.split('/invite/')[1]!;
+    const res = await app.app.request(
+      '/api/v1/invitations/accept',
+      json({ token, name: 'X', password: 'x'.repeat(16) })
+    );
+    expect(res.status).toBe(404); // no longer live
+  });
+
+  it('enforces roles: the member cannot invite, list audit, or update members', async () => {
+    const signIn = await app.app.request(
+      '/api/v1/auth/sign-in/email',
+      json({ email: INVITEE.email, password: INVITEE.password })
+    );
+    const cookie = extractCookie(signIn);
+
+    const invite = await app.app.request('/api/v1/invitations', {
+      ...json({ email: 'x@y.test', role: 'member' }),
+      headers: { 'content-type': 'application/json', cookie }
+    });
+    expect(invite.status).toBe(403);
+
+    const audit = await app.app.request('/api/v1/audit', { headers: { cookie } });
+    expect(audit.status).toBe(403);
+  });
+});
+
+describe('audit trail (exit criterion 4 wrap-up)', () => {
+  it('exposes the trail to admins with actor identities and request ids', async () => {
+    const res = await app.app.request('/api/v1/audit', { headers: { cookie: ownerCookie } });
+    expect(res.status).toBe(200);
+    const body = await readJson(res);
+    const actions = body.entries.map((e: { action: string }) => e.action);
+    expect(actions).toEqual(
+      expect.arrayContaining(['apikey.create', 'apikey.revoke', 'invitation.create', 'invitation.accept'])
+    );
+    const withRequestId = body.entries.filter((e: { requestId: string | null }) => e.requestId);
+    expect(withRequestId.length).toBeGreaterThan(0);
+  });
+});
+
+describe('jobs runtime', () => {
+  it('pg-boss started and accepts a send (usage sink path)', async () => {
+    await app.registry.usage.emit({
+      id: '01JZZZZZZZZZZZZZZZZZZZZZZZ',
+      meter: 'test.meter',
+      actionKey: 'test.meter',
+      quantity: 1,
+      unit: 'count',
+      occurredAt: new Date().toISOString(),
+      workspaceId: '00000000-0000-0000-0000-000000000000',
+      userId: null,
+      via: 'session',
+      source: { instanceId: 'test', edition: 'oss', version: 'dev' }
+    });
+    // send() throwing would have been logged + swallowed; assert the queue exists.
+    const size = await app.jobs.boss.getQueueSize('usage-events');
+    expect(size).toBeGreaterThanOrEqual(0);
+  });
+});