@anteros/core 0.0.40 → 0.0.41

package/tests/audit-redact.test.ts

@@ -0,0 +1,233 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { ObjectId } from "mongodb";
+import { createApp } from "../server/hono";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { useRest } from "../database/rest";
+import { AUDIT_COLLECTION } from "../database/audit";
+import { REDACTED, redactPayload } from "../lib/redact";
+
+const TENANT = "redact-test";
+const DB = "mongodb://localhost:27017/_AUDIT_REDACT_TEST";
+const SLUG = "patients";
+
+let rest: InstanceType<typeof useRest>;
+let server: any;
+let url = "";
+
+/** Latest audited entry for an action, written *after* `since` (fire-and-forget logging) */
+async function lastActivity(action: string, since?: Date) {
+    for (let i = 0; i < 40; i++) {
+        const found: any = await rest.db.collection(AUDIT_COLLECTION).findOne(
+            { "operation.action": action, ...(since ? { ts: { $gte: since } } : {}) },
+            { sort: { ts: -1 } },
+        );
+        if (found) return found;
+        await Bun.sleep(25);
+    }
+    return null;
+}
+
+const PNG = Buffer.from(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==",
+    "base64",
+);
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000, jwt: { secret: "redact-secret" } },
+        tenants: [{ id: TENANT, dir: "src", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    (cfg as any).collections = [{
+        _tenant_: TENANT,
+        slug: SLUG,
+        fields: [
+            { name: "name", type: "string" },
+            { name: "password", type: "string" },
+            { name: "ssn", type: "string" },
+            { name: "profile", type: "json" },
+            { name: "list", type: "json" },
+        ],
+        api: {
+            access: { "*": true },
+            auth: {
+                enabled: true,
+                onLogin: async ({ payload, jwt }: any) => ({
+                    // `jwt.sign` is async — must be awaited, or the token fails verification
+                    token: await jwt.sign({ sub: payload.email }),
+                    data: { email: payload.email },
+                }),
+            },
+        },
+    }];
+
+    rest = new useRest({ internal: false, tenant_id: TENANT });
+
+    const app = createApp();
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = server.url.href.replace(/\/$/, "");
+});
+
+afterAll(async () => {
+    try { await rest.db.collection(SLUG).drop(); } catch (_) {}
+    try { await rest.db.collection(AUDIT_COLLECTION).drop(); } catch (_) {}
+    try { server.stop(true); } catch {}
+    delete (cfg.server as any).audit;
+});
+
+describe("audit redaction — defaults", () => {
+    it("masks the password of a login payload (success path)", async () => {
+        const since = new Date();
+        const res = await fetch(`${url}/api/${TENANT}/${SLUG}/login`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ payload: { email: "ada@example.com", password: "SuperSecret123!" } }),
+        });
+        expect(res.status).toBe(200);
+
+        const logged = await lastActivity("login", since);
+        expect(logged.operation.status).toBe("success");
+        expect(logged.operation.input.payload.password).toBe(REDACTED);
+        expect(logged.operation.input.payload.email).toBe("ada@example.com"); // untouched
+    });
+
+    it("masks the password of a login payload (failure path)", async () => {
+        const since = new Date();
+        const res = await fetch(`${url}/api/${TENANT}/${SLUG}/login`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ payload: { email: "bad", password: "WrongOne!" } }),
+        });
+        // unknown user is not the point here — whatever the status, the payload is logged
+        expect(res.status).toBeGreaterThanOrEqual(200);
+
+        const logged = await lastActivity("login", since);
+        expect(logged.operation.input.payload.password).toBe(REDACTED);
+    });
+
+    it("masks keys at any depth, in arrays, case-insensitively — and stores no result data", async () => {
+        const since = new Date();
+        const doc: any = await rest.insertOne(SLUG, {
+            name: "John",
+            password: "p4ss",
+            profile: { apiKey: "k-123", nested: { token: "tok", ok: "keep" } },
+            list: [{ key: "secret-key", label: "visible" }],
+        });
+
+        const logged = await lastActivity("insertOne", since);
+        const input = logged.operation.input.data;
+        expect(input.name).toBe("John");
+        expect(input.password).toBe(REDACTED);
+        expect(input.profile.apiKey).toBe(REDACTED);
+        expect(input.profile.nested.token).toBe(REDACTED);
+        expect(input.profile.nested.ok).toBe("keep");
+        expect(input.list[0].key).toBe(REDACTED);
+        expect(input.list[0].label).toBe("visible");
+
+        // The result holds the generated identifier only — no document, and
+        // therefore no value to leak in the first place.
+        expect(logged.operation.result).toEqual({ _id: doc._id });
+
+        // …while the caller still received the real values
+        expect(doc.password).toBe("p4ss");
+    });
+
+    it("never alters non-plain values (Date, ObjectId) or the payload reference when nothing matches", async () => {
+        // Direct check on the redactor: non-plain objects pass through untouched
+        const when = new Date();
+        const id = new ObjectId();
+        const clean = { name: "x", when, id, list: [when] };
+        expect(redactPayload(clean)).toBe(clean); // same reference — no allocation
+
+        const dirty = redactPayload({ when, id, password: "p" });
+        expect(dirty.when).toBe(when);
+        expect(dirty.id).toBe(id);
+        expect(dirty.password).toBe(REDACTED);
+
+        // …and on a real entry: only the generated id comes back
+        const since = new Date();
+        await rest.insertOne(SLUG, { name: "dates" });
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.result._id).toBeString();
+        expect(typeof logged.operation.duration).toBe("number");
+    });
+
+    it("redacts the request headers and query string", async () => {
+        const since = new Date();
+        const res = await fetch(`${url}/api/${TENANT}/${SLUG}/find?token=query-secret&page=2`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: "Bearer fake.jwt",
+                "X-API-Key": "api-key-secret",
+                "X-Trace": "keep-me",
+            },
+            body: JSON.stringify({ $limit: 1 }),
+        });
+        expect(res.status).toBe(200);
+
+        const logged = await lastActivity("find", since);
+        // `authorization` and `cookie` are dropped by the request middleware
+        expect(logged.request.headers.authorization).toBeUndefined();
+        // …the rest goes through the redactor: `x-api-key` → `api_key`, `token` → `token`
+        expect(logged.request.headers["x-api-key"]).toBe(REDACTED);
+        expect(logged.request.query.token).toBe(REDACTED);
+        // innocuous values are kept
+        expect(logged.request.headers["x-trace"]).toBe("keep-me");
+        expect(logged.request.query.page).toBe("2");
+    });
+
+    it("masks the headers-like `authorization` key of a custom activity", async () => {
+        await rest.audit.addActivities([{
+            internal: true,
+            trace: { id: crypto.randomUUID() },
+            meta: { authorization: "Bearer abc" },
+            operation: {
+                tenant: TENANT, action: "manual", collection: SLUG,
+                status: "success", input: { authorization: "Bearer xyz", token: "t" },
+                result: null, error: null, duration: 0, transaction: false,
+            },
+            ts: new Date(),
+        } as any]);
+
+        const logged: any = await rest.db.collection(AUDIT_COLLECTION).findOne({ "operation.action": "manual" });
+        expect(logged.operation.input.authorization).toBe(REDACTED);
+        expect(logged.operation.input.token).toBe(REDACTED);
+        expect(logged.meta.authorization).toBe(REDACTED);
+    });
+});
+
+describe("audit redaction — configuration", () => {
+    it("uses a custom key list instead of the defaults", async () => {
+        (cfg.server as any).audit = { redact: ["ssn"] };
+
+        const since = new Date();
+        await rest.insertOne(SLUG, { name: "custom", password: "keep-me", ssn: "123-45-6789" });
+
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.input.data.ssn).toBe(REDACTED);
+        expect(logged.operation.input.data.password).toBe("keep-me");
+    });
+
+    it("can be disabled with `redact: false`", async () => {
+        (cfg.server as any).audit = { redact: false };
+
+        const since = new Date();
+        await rest.insertOne(SLUG, { name: "off", password: "clear" });
+
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.input.data.password).toBe("clear");
+    });
+
+    it("falls back to the defaults when unset", async () => {
+        delete (cfg.server as any).audit;
+
+        const since = new Date();
+        await rest.insertOne(SLUG, { name: "back", password: "masked-again" });
+
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.input.data.password).toBe(REDACTED);
+    });
+});

package/tests/audit-results.test.ts

@@ -0,0 +1,188 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { useRest } from "../database/rest";
+import { AUDIT_COLLECTION } from "../database/audit";
+import { IDS_MAX } from "../lib/auditResult";
+
+const TENANT = "results-test";
+const DB = "mongodb://localhost:27017/_AUDIT_RESULTS_TEST";
+const SLUG = "orders";
+
+let rest: InstanceType<typeof useRest>;
+
+/** Latest audited entry for an action, written *after* `since` (fire-and-forget logging) */
+async function lastActivity(action: string, since?: Date) {
+    for (let i = 0; i < 40; i++) {
+        const found: any = await rest.db.collection(AUDIT_COLLECTION).findOne(
+            { "operation.action": action, ...(since ? { ts: { $gte: since } } : {}) },
+            { sort: { ts: -1 } },
+        );
+        if (found) return found;
+        await Bun.sleep(25);
+    }
+    return null;
+}
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [{ id: TENANT, dir: "src", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    (cfg as any).collections = [{
+        _tenant_: TENANT,
+        slug: SLUG,
+        fields: [
+            { name: "ref", type: "string" },
+            { name: "total", type: "number" },
+        ],
+        api: { access: { "*": true } },
+    }];
+
+    rest = new useRest({ internal: false, tenant_id: TENANT });
+});
+
+afterAll(async () => {
+    try { await rest.db.collection(SLUG).drop(); } catch (_) {}
+    try { await rest.db.collection(AUDIT_COLLECTION).drop(); } catch (_) {}
+    delete (cfg.server as any).audit;
+});
+
+describe("audit results — default (`summary`)", () => {
+    it("keeps only the generated `_id` for an insert — no document", async () => {
+        const since = new Date();
+        const doc: any = await rest.insertOne(SLUG, { ref: "TOPSECRET-REF", total: 10 });
+
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.result).toEqual({ _id: doc._id });
+        // the payload is nowhere in the result
+        expect(JSON.stringify(logged.operation.result)).not.toContain("TOPSECRET-REF");
+        // …but the input still carries the parameters (that is the audit trail)
+        expect(logged.operation.input.data.ref).toBe("TOPSECRET-REF");
+    });
+
+    it("keeps `count` + `insertedIds` for a batch insert", async () => {
+        const since = new Date();
+        const docs: any[] = await rest.insertMany(SLUG, [
+            { ref: "B-1", total: 1 },
+            { ref: "B-2", total: 2 },
+            { ref: "B-3", total: 3 },
+        ]);
+
+        const logged = await lastActivity("insertMany", since);
+        expect(logged.operation.result.count).toBe(3);
+        expect(logged.operation.result.insertedIds).toEqual(docs.map((d) => d._id));
+        expect(logged.operation.result.truncated).toBeUndefined();
+        // the input of insertMany only holds the count — the ids are the trace
+        expect(logged.operation.input).toEqual({ count: 3 });
+    });
+
+    it("caps the identifiers of a huge batch", async () => {
+        const since = new Date();
+        const batch = Array.from({ length: IDS_MAX + 5 }, (_, i) => ({ ref: `big-${i}`, total: i }));
+        await rest.insertMany(SLUG, batch);
+
+        const logged = await lastActivity("insertMany", since);
+        expect(logged.operation.result.count).toBe(IDS_MAX + 5);
+        expect(logged.operation.result.insertedIds.length).toBe(IDS_MAX);
+        expect(logged.operation.result.truncated).toBe(true);
+    });
+
+    it("keeps the operational counters of updates, deletes and meta operations", async () => {
+        const [first] = await rest.find(SLUG, { $limit: 1 });
+
+        let since = new Date();
+        const one: any = await rest.updateOne(SLUG, first!._id, { $set: { total: 99 } });
+        expect(one.total).toBe(99); // the caller gets the document…
+        const updated = await lastActivity("updateOne", since);
+        // …but the audit keeps the identifier only (`updateOne` returns a document)
+        expect(updated.operation.result).toEqual({ _id: one._id });
+        // the parameters are there too
+        expect(updated.operation.input.update.$set.total).toBe(99);
+
+        since = new Date();
+        const many: any = await rest.updateMany(SLUG, [first!._id], { $set: { total: 100 } });
+        expect((await lastActivity("updateMany", since)).operation.result.modifiedCount).toBe(many.modifiedCount);
+
+        since = new Date();
+        await rest.countDocuments(SLUG, {});
+        expect(typeof (await lastActivity("countDocuments", since)).operation.result).toBe("number");
+
+        since = new Date();
+        const removed: any = await rest.deleteOne(SLUG, first!._id);
+        expect(removed).not.toBeNull();
+        expect((await lastActivity("deleteOne", since)).operation.result).toEqual({ deleted: true });
+
+        // a delete that matched nothing reports nothing
+        since = new Date();
+        await rest.deleteOne(SLUG, first!._id);
+        expect((await lastActivity("deleteOne", since)).operation.result).toBeNull();
+
+        // a document-producing operation never leaks the document — just its id
+        const fresh: any = await rest.insertOne(SLUG, { ref: "FOU-1", total: 5 });
+        since = new Date();
+        const found: any = await rest.findOneAndUpdate(SLUG, { _id: fresh._id }, { $set: { total: 6 } });
+        expect(found.total).toBe(6); // the caller gets the document…
+        expect((await lastActivity("findOneAndUpdate", since)).operation.result).toEqual({ _id: found._id });
+    });
+
+    it("never stores a document, whatever the operation", async () => {
+        const entries: any[] = await rest.db.collection(AUDIT_COLLECTION)
+            .find({ "operation.collection": SLUG })
+            .toArray();
+
+        for (const entry of entries) {
+            // a document would carry the collection's own fields
+            expect(entry.operation.result?.total).toBeUndefined();
+            expect(entry.operation.result?.ref).toBeUndefined();
+        }
+    });
+});
+
+describe("audit results — `none`", () => {
+    it("stores no result at all, except the generated identifiers", async () => {
+        (cfg.server as any).audit = { results: "none" };
+
+        const since = new Date();
+        const doc: any = await rest.insertOne(SLUG, { ref: "N-1", total: 1 });
+        expect((await lastActivity("insertOne", since)).operation.result).toEqual({ _id: doc._id });
+
+        let since2 = new Date();
+        await rest.updateMany(SLUG, [doc._id], { $set: { total: 2 } });
+        expect((await lastActivity("updateMany", since2)).operation.result).toBeNull();
+
+        since2 = new Date();
+        await rest.countDocuments(SLUG, {});
+        expect((await lastActivity("countDocuments", since2)).operation.result).toBeNull();
+
+        since2 = new Date();
+        await rest.deleteOne(SLUG, doc._id);
+        expect((await lastActivity("deleteOne", since2)).operation.result).toBeNull();
+    });
+});
+
+describe("audit results — `full`", () => {
+    it("stores the raw result, documents included", async () => {
+        (cfg.server as any).audit = { results: "full" };
+
+        const since = new Date();
+        const doc: any = await rest.insertOne(SLUG, { ref: "F-1", total: 1 });
+        const inserted = await lastActivity("insertOne", since);
+        expect(inserted.operation.result.ref).toBe("F-1");
+
+        const since2 = new Date();
+        await rest.deleteOne(SLUG, doc._id);
+        const deleted = await lastActivity("deleteOne", since2);
+        expect(deleted.operation.result.ref).toBe("F-1"); // the deleted document is kept
+    });
+
+    it("still never stores a result for reads and custom actions", async () => {
+        (cfg.server as any).audit = { results: "full" };
+
+        const since = new Date();
+        await rest.find(SLUG, { $limit: 1 });
+        expect((await lastActivity("find", since)).operation.result).toBeNull();
+    });
+});

package/tests/audit-retention-config.test.ts

@@ -0,0 +1,76 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants, getTenant } from "../database/tenant";
+import { AUDIT_COLLECTION, AUDIT_TTL_INDEX, resolveAuditRetention } from "../database/audit";
+
+const SERVER_RETENTION = "30d";
+
+const INHERIT = "ret-inherit";
+const OVERRIDE = "ret-override";
+const OFF = "ret-off";
+
+const DBS = {
+    [INHERIT]: "mongodb://localhost:27017/_AUDIT_RET_INHERIT",
+    [OVERRIDE]: "mongodb://localhost:27017/_AUDIT_RET_OVERRIDE",
+    [OFF]: "mongodb://localhost:27017/_AUDIT_RET_OFF",
+} as const;
+
+/** TTL index of a tenant's `_audit_` collection, or undefined. */
+async function ttlIndex(tenantId: string): Promise<any> {
+    const db = getTenant(tenantId)!.database!.db!;
+    return (await db.collection(AUDIT_COLLECTION).listIndexes().toArray())
+        .find((i: any) => i.name === AUDIT_TTL_INDEX);
+}
+
+beforeAll(async () => {
+    formatConfig({
+        server: {
+            port: 4000,
+            // Server-wide default — every tenant inherits it unless it declares its own
+            audit: { retention: SERVER_RETENTION },
+        },
+        tenants: [
+            { id: INHERIT, dir: "src", database: { uri: DBS[INHERIT] } },
+            { id: OVERRIDE, dir: "src", database: { uri: DBS[OVERRIDE] }, audit: { retention: "1h" } },
+            { id: OFF, dir: "src", database: { uri: DBS[OFF] }, audit: { retention: false } },
+        ],
+    });
+
+    await syncTenants();
+});
+
+afterAll(async () => {
+    for (const id of Object.keys(DBS)) {
+        try { await getTenant(id)?.database?.db?.collection(AUDIT_COLLECTION).drop(); } catch (_) {}
+    }
+    // `cfg.server` is shared by every test file in the same process: the server-wide
+    // retention would otherwise leak into the other suites
+    delete (cfg.server as any).audit;
+});
+
+describe("audit retention precedence", () => {
+    it("resolves: the tenant wins, the server default is the fallback", () => {
+        const base = { dir: "src", database: { uri: "" } };
+
+        expect(resolveAuditRetention({ id: INHERIT, ...base } as any)).toBe(SERVER_RETENTION);
+        expect(resolveAuditRetention({ id: OVERRIDE, ...base, audit: { retention: "1h" } } as any)).toBe("1h");
+        // `false` is a value, not an absence — it must override the server default
+        expect(resolveAuditRetention({ id: OFF, ...base, audit: { retention: false } } as any)).toBe(false);
+    });
+
+    it("applies the server default to a tenant without its own config", async () => {
+        const ttl = await ttlIndex(INHERIT);
+        expect(ttl).toBeDefined();
+        expect(ttl.expireAfterSeconds).toBe(30 * 86400);
+    });
+
+    it("lets the tenant override the server default", async () => {
+        const ttl = await ttlIndex(OVERRIDE);
+        expect(ttl).toBeDefined();
+        expect(ttl.expireAfterSeconds).toBe(3600);
+    });
+
+    it("lets the tenant opt out of the server default with `false`", async () => {
+        expect(await ttlIndex(OFF)).toBeUndefined();
+    });
+});

package/tests/audit-run-action.test.ts

@@ -0,0 +1,120 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { createApp } from "../server/hono";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { useRest } from "../database/rest";
+import { AUDIT_COLLECTION } from "../database/audit";
+
+const TENANT = "act-test";
+const DB = "mongodb://localhost:27017/_AUDIT_ACTION_TEST";
+const SLUG = "invoices";
+
+let internalRest: InstanceType<typeof useRest>;
+let server: any;
+let url = "";
+
+/**
+ * Latest audited `runAction` entry.
+ * `#logActivity` is fire-and-forget, and `since` (captured *before* the call)
+ * makes sure we wait for the new entry instead of reading the previous one.
+ */
+async function lastRunAction(since?: Date) {
+    for (let i = 0; i < 40; i++) {
+        const found: any = await internalRest.db.collection(AUDIT_COLLECTION).findOne(
+            { "operation.action": "runAction", ...(since ? { ts: { $gte: since } } : {}) },
+            { sort: { ts: -1 } },
+        );
+        if (found) return found;
+        await Bun.sleep(25);
+    }
+    return null;
+}
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [{ id: TENANT, dir: "src", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    (cfg as any).collections = [{
+        _tenant_: TENANT,
+        slug: SLUG,
+        fields: [{ name: "ref", type: "string" }],
+        actions: {
+            greet: async ({ data }: any) => ({ hello: data?.name }),
+            boom: async () => { throw new Error("kaboom") },
+        },
+        api: { access: { "*": true } },
+    }];
+
+    internalRest = new useRest({ internal: true, tenant_id: TENANT });
+
+    const app = createApp();
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = server.url.href.replace(/\/$/, "");
+});
+
+afterAll(async () => {
+    try { await internalRest.db.collection(SLUG).drop(); } catch (_) {}
+    try { await internalRest.db.collection(AUDIT_COLLECTION).drop(); } catch (_) {}
+    try { server.stop(true); } catch {}
+});
+
+describe("audit — custom actions (runAction)", () => {
+    it("audits an internal call with the action name and its data, never the payload", async () => {
+        const since = new Date();
+        const result: any = await internalRest.runAction(SLUG, "greet", { name: "Ada" });
+
+        // the caller still receives the action's payload…
+        expect(result).toEqual({ hello: "Ada" });
+
+        // …but the audit only holds the parameters
+        const logged = await lastRunAction(since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.input.action).toBe("greet");
+        expect(logged.operation.input.data).toEqual({ name: "Ada" });
+        expect(logged.operation.result).toBeNull();
+        expect(logged.operation.status).toBe("success");
+        expect(logged.internal).toBe(true);
+    });
+
+    it("audits the HTTP route as well, and marks it as not internal", async () => {
+        const since = new Date();
+        const res = await fetch(`${url}/api/${TENANT}/${SLUG}/greet`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ data: { name: "Grace" } }),
+        });
+
+        expect(res.status).toBe(200);
+        expect(await res.json()).toEqual({ hello: "Grace" });
+
+        const logged = await lastRunAction(since);
+        expect(logged.operation.input.action).toBe("greet");
+        expect(logged.operation.input.data).toEqual({ name: "Grace" });
+        expect(logged.operation.result).toBeNull();
+        expect(logged.internal).toBe(false);
+    });
+
+    it("records a failing action with its error, and rethrows it unchanged", async () => {
+        const since = new Date();
+
+        // `wrapErrors: false` — a custom action's own error reaches the caller as-is
+        await expect(internalRest.runAction(SLUG, "boom")).rejects.toThrow("kaboom");
+
+        const logged = await lastRunAction(since);
+        expect(logged.operation.status).toBe("error");
+        expect(logged.operation.error.message).toBe("kaboom");
+        expect(logged.operation.result).toBeNull();
+    });
+
+    it("records an unknown action", async () => {
+        const since = new Date();
+        await expect(internalRest.runAction(SLUG, "nope")).rejects.toThrow();
+
+        const logged = await lastRunAction(since);
+        expect(logged.operation.status).toBe("error");
+        expect(logged.operation.error.code).toBe("ACTION_NOT_FOUND");
+    });
+});