@aurorajs.dev/catalyst-cli 1.0.1 → 1.1.3

package/dist/templates/frontend/application/src/@aurora/modules/authentication/shared/adapters/anonymous-current-account.adapter.spec.ts

@@ -39,4 +39,96 @@ describe('AnonymousCurrentAccountAdapter', () => {
       expect(adapter.email()).toBe('');
     });
   });
+
+  // ── Permission surface (design D1 / D2) ──────────────────────────────────────
+
+  describe('permissions signal', () => {
+    it('returns an empty array (anonymous session holds no permissions)', () => {
+      expect(adapter.permissions()).toEqual([]);
+    });
+
+    it('permissions array is readonly (length is 0, not mutable from the outside)', () => {
+      // The signal returns a readonly reference — calling .length is the observable proof
+      // without trying to mutate (which TypeScript already blocks at the type level).
+      const perms = adapter.permissions();
+      expect(perms.length).toBe(0);
+    });
+  });
+
+  describe('permissionsLoaded signal', () => {
+    it('is TRUE immediately — anonymous adapter has no async load to await', () => {
+      // Without the permissionsLoaded signal being true immediately, consumers (sidebar,
+      // guard) would stall forever waiting for a no-IAM scaffold to "load".
+      expect(adapter.permissionsLoaded()).toBe(true);
+    });
+
+    it('stays TRUE after calling load()', () => {
+      adapter.load();
+      expect(adapter.permissionsLoaded()).toBe(true);
+    });
+
+    // Non-tautological guard: if the implementation left permissionsLoaded as `false`,
+    // this test FAILS — which is the exact regression we need to catch.
+    it('would fail if permissionsLoaded were left false (non-tautological check)', () => {
+      // We directly assert the value: if it were `false` the assertion below fails.
+      const loaded = adapter.permissionsLoaded();
+      expect(loaded).not.toBe(false);
+    });
+  });
+
+  describe('hasPermission()', () => {
+    it('returns false for any permission string (anonymous session has none)', () => {
+      expect(adapter.hasPermission('hub.access')).toBe(false);
+    });
+
+    it('returns false for an empty permission string', () => {
+      expect(adapter.hasPermission('')).toBe(false);
+    });
+
+    it('returns false even after load() — no permissions are ever populated', () => {
+      adapter.load();
+      expect(adapter.hasPermission('hub.launchpad.access')).toBe(false);
+    });
+  });
+
+  // ── Role UI preference surface (MODIFIED requirement, frontend-current-user-display) ────────
+
+  describe('defaultRedirection signal', () => {
+    it('is null (no role, no session)', () => {
+      expect(adapter.defaultRedirection()).toBeNull();
+    });
+
+    it('stays null after load()', () => {
+      adapter.load();
+      expect(adapter.defaultRedirection()).toBeNull();
+    });
+  });
+
+  describe('hasHiddenVerticalNavigation signal', () => {
+    it('is false (no role, no session)', () => {
+      expect(adapter.hasHiddenVerticalNavigation()).toBe(false);
+    });
+
+    it('stays false after load()', () => {
+      adapter.load();
+      expect(adapter.hasHiddenVerticalNavigation()).toBe(false);
+    });
+  });
+
+  describe('loaded signal', () => {
+    it('is TRUE immediately — no async load to await, so a materialization must not stall', () => {
+      expect(adapter.loaded()).toBe(true);
+    });
+
+    it('stays TRUE after calling load() (no-op adapter, no query is ever issued)', () => {
+      adapter.load();
+      expect(adapter.loaded()).toBe(true);
+    });
+
+    // Non-tautological guard, mirroring the existing permissionsLoaded test above.
+    it('would fail if loaded were left false (non-tautological check)', () => {
+      const loaded = adapter.loaded();
+      expect(loaded).not.toBe(false);
+    });
+  });
 });

package/dist/templates/frontend/application/src/@aurora/modules/authentication/shared/adapters/anonymous-current-account.adapter.ts

@@ -10,8 +10,17 @@ import { CurrentAccountService } from '../current-account.service';
  * and the shell boots with a neutral anonymous identity. The catalyst SOURCE `aurora.provider.ts`
  * does NOT register this provider — the two placements never coexist.
  *
- * The port contract (`displayName`, `email`, `load()`) is satisfied with blank signals and a
- * no-op `load()`. The sidebar renders a neutral placeholder rather than a fabricated identity.
+ * The port contract (`displayName`, `email`, `permissions`, `permissionsLoaded`, `hasPermission()`,
+ * `load()`) is satisfied with blank/empty signals and a no-op `load()`. The sidebar renders a
+ * neutral placeholder rather than a fabricated identity.
+ *
+ * ## Permission surface
+ *
+ * `permissions` is always empty and `permissionsLoaded` is always `true` — there is no async load
+ * to await, so the readiness gate resolves immediately. This prevents the sidebar and the permission
+ * guard from stalling forever when no IAM adapter is wired. Every `hasPermission()` call returns
+ * `false` (the anonymous session holds no permissions).
+ *
  * This mirrors the backend `AnonymousAccountLoaderAdapter` pattern.
  *
  * HR-PORTS-001 compliance: imports only `@angular/core` and the port; zero `@app`/`@api`/
@@ -21,9 +30,34 @@ import { CurrentAccountService } from '../current-account.service';
 export class AnonymousCurrentAccountAdapter extends CurrentAccountService {
   readonly displayName = signal('');
   readonly email = signal('');
+  /** Anonymous session has no permissions. Readonly empty array for the lifetime of the session. */
+  readonly permissions = signal<readonly string[]>([]);
+  /**
+   * Resolves `true` immediately — the anonymous adapter has no async load to await, so consumers
+   * must not stall waiting for a readiness signal that would never flip.
+   */
+  readonly permissionsLoaded = signal(true);
+  /** No role, no preference: the landing resolution falls back to the application root. */
+  readonly defaultRedirection = signal<string | null>(null);
+  /** No role hides the navigation: the sidebar state is left untouched by the anonymous adapter. */
+  readonly hasHiddenVerticalNavigation = signal(false);
+  /**
+   * Resolves `true` immediately, mirroring `permissionsLoaded` — no async load to await, so the
+   * landing resolution must not stall waiting for a readiness signal that would never flip.
+   */
+  readonly loaded = signal(true);
+
+  /**
+   * Always returns `false`. The anonymous session holds no permissions and no query is ever
+   * issued to populate them.
+   */
+  hasPermission(_permission: string): boolean {
+    return false;
+  }
 
   load(): void {
     // No-op: no IAM bounded context is available, so no account can be loaded.
     // The signals stay blank (anonymous identity) throughout the session.
+    // permissionsLoaded stays true (no async work to wait for).
   }
 }

package/dist/templates/frontend/application/src/@aurora/modules/authentication/shared/adapters/authentication-aurora-adapter.service.spec.ts

@@ -0,0 +1,494 @@
+/**
+ * Tests for `AuthenticationAuroraAdapterService.impersonate` / `.stopImpersonation` (design D8,
+ * `frontend-account-impersonation` delta spec). Focus:
+ *   - `impersonate(accountId)` runs the mutation, stacks the credential via `TokenStore`, and
+ *     delegates the landing to `LandingResolverService.apply(null)` — which owns re-materializing
+ *     the session-scoped state (`CurrentAccountService.load()`) itself.
+ *   - `stopImpersonation()` unwinds the stack and delegates the same way, with NO network
+ *     call (an impersonation token cannot be revoked server-side — design D4).
+ *   - A failed mutation leaves the operator's session completely untouched.
+ */
+import '@angular/compiler';
+import { Injector, runInInjectionContext } from '@angular/core';
+import { Router } from '@angular/router';
+import { TranslocoService } from '@jsverse/transloco';
+import { toast } from '@spartan-ng/brain/sonner';
+import { Apollo } from 'apollo-angular';
+import { firstValueFrom, of, throwError } from 'rxjs';
+import { CREDENTIALS_KEY, ORIGIN_CREDENTIALS_KEY } from '../authentication';
+import { CurrentAccountService } from '../current-account.service';
+import { LandingResolverService } from '../landing-resolver.service';
+import { SessionRecoveryCoordinatorService } from '../session-recovery-coordinator.service';
+import { TokenStore } from '../token-store.service';
+import { AuthenticationAuroraAdapterService } from './authentication-aurora-adapter.service';
+
+// The unit-test builder runs vitest with isolate:false, so spec files share the module
+// registry — spy on the shared toast instance (per the established convention in
+// aurora-graphql-error.handler.spec.ts) rather than vi.mock(), which races against earlier
+// real imports of the handler under isolate:false.
+let toastError: ReturnType<typeof vi.spyOn>;
+let toastInfo: ReturnType<typeof vi.spyOn>;
+
+beforeEach(() => {
+  toastError = vi.spyOn(toast, 'error').mockImplementation(() => undefined as never);
+  toastInfo = vi.spyOn(toast, 'info').mockImplementation(() => undefined as never);
+});
+
+afterEach(() => {
+  toastError.mockRestore();
+  toastInfo.mockRestore();
+});
+
+function makeInjector(deps: {
+  mutate: ReturnType<typeof vi.fn>;
+  beginImpersonation: ReturnType<typeof vi.fn>;
+  endImpersonation: ReturnType<typeof vi.fn>;
+  load: ReturnType<typeof vi.fn>;
+  navigate: ReturnType<typeof vi.fn>;
+  apply?: ReturnType<typeof vi.fn>;
+}): Injector {
+  return Injector.create({
+    providers: [
+      { provide: Apollo, useValue: { mutate: deps.mutate } },
+      { provide: Router, useValue: { navigate: deps.navigate } },
+      {
+        provide: TokenStore,
+        useValue: {
+          authenticated: () => true,
+          accessToken: () => 'access',
+          refreshToken: () => 'refresh',
+          beginImpersonation: deps.beginImpersonation,
+          endImpersonation: deps.endImpersonation,
+        },
+      },
+      { provide: CurrentAccountService, useValue: { load: deps.load } },
+      { provide: LandingResolverService, useValue: { apply: deps.apply ?? vi.fn() } },
+      { provide: TranslocoService, useValue: { translate: (key: string) => key } },
+      SessionRecoveryCoordinatorService,
+    ],
+  });
+}
+
+function makeService(injector: Injector): AuthenticationAuroraAdapterService {
+  return runInInjectionContext(injector, () => new AuthenticationAuroraAdapterService());
+}
+
+describe('AuthenticationAuroraAdapterService — impersonate', () => {
+  it('runs the mutation, stacks the credential via the token store, and delegates the landing to the resolver — no explicit redirect', async () => {
+    const mutate = vi.fn().mockReturnValue(
+      of({
+        data: {
+          oAuthCreateImpersonateToken: {
+            accessToken: 'impersonation-access-token',
+            tokenType: 'Bearer',
+            expiresIn: 900,
+          },
+        },
+      }),
+    );
+    const beginImpersonation = vi.fn().mockReturnValue(true);
+    const endImpersonation = vi.fn();
+    const load = vi.fn();
+    const apply = vi.fn();
+    const navigate = vi.fn();
+    const injector = makeInjector({
+      mutate,
+      beginImpersonation,
+      endImpersonation,
+      load,
+      navigate,
+      apply,
+    });
+    const service = makeService(injector);
+
+    const result = await firstValueFrom(service.impersonate('target-account-id'));
+
+    expect(result).toBe(true);
+    expect(mutate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        variables: { payload: { targetAccountId: 'target-account-id' } },
+      }),
+    );
+    // Exact shape, not objectContaining: the stacked credential is access-token-only (design D4).
+    // A stray refreshToken here would be a fiction the rest of the session then relies on.
+    expect(beginImpersonation).toHaveBeenCalledWith({ accessToken: 'impersonation-access-token' });
+    // The landing resolver — not a hardcoded navigate(['/']) — decides where the operator lands;
+    // no explicit redirect exists for an impersonation transition (design.md Decision 1).
+    expect(apply).toHaveBeenCalledWith(null);
+    // The resolver OWNS the re-arm (it calls `load()` itself, inside `apply()`) — the adapter
+    // must NOT also call `load()` directly, or a second, uncoordinated `load()` could race the
+    // resolver's own re-arm.
+    expect(load).not.toHaveBeenCalled();
+  });
+
+  it('does NOT re-materialize, resolve the landing, or navigate, and reports failure, when the token-store swap is refused (security finding F7 — a stale stash must never look like a successful switch)', async () => {
+    const mutate = vi.fn().mockReturnValue(
+      of({
+        data: {
+          oAuthCreateImpersonateToken: {
+            accessToken: 'impersonation-access-token',
+            tokenType: 'Bearer',
+            expiresIn: 900,
+          },
+        },
+      }),
+    );
+    // The mutation SUCCEEDS, but the local swap is refused — e.g. a stale stash from a crashed
+    // tab or a second concurrent impersonation attempt.
+    const beginImpersonation = vi.fn().mockReturnValue(false);
+    const endImpersonation = vi.fn();
+    const load = vi.fn();
+    const apply = vi.fn();
+    const navigate = vi.fn();
+    const injector = makeInjector({
+      mutate,
+      beginImpersonation,
+      endImpersonation,
+      load,
+      navigate,
+      apply,
+    });
+    const service = makeService(injector);
+
+    const result = await firstValueFrom(service.impersonate('target-account-id'));
+
+    // The caller MUST be told the switch did not actually happen.
+    expect(result).toBe(false);
+    // Non-tautological: if the implementation re-materialized/resolved the landing regardless of
+    // the refusal, these assertions fail — the exact bug F7 describes (silent false success).
+    expect(load).not.toHaveBeenCalled();
+    expect(apply).not.toHaveBeenCalled();
+    expect(navigate).not.toHaveBeenCalled();
+    // This refusal never touches the GraphQL error link (the mutation itself succeeded), so
+    // nothing else would tell the operator — the adapter must report it itself.
+    expect(toastError).toHaveBeenCalledOnce();
+  });
+
+  it('leaves the operator session untouched when the mutation fails', async () => {
+    const mutate = vi.fn().mockReturnValue(throwError(() => new Error('forbidden')));
+    const beginImpersonation = vi.fn();
+    const endImpersonation = vi.fn();
+    const load = vi.fn();
+    const apply = vi.fn();
+    const navigate = vi.fn();
+    const injector = makeInjector({
+      mutate,
+      beginImpersonation,
+      endImpersonation,
+      load,
+      navigate,
+      apply,
+    });
+    const service = makeService(injector);
+
+    const result = await firstValueFrom(service.impersonate('target-account-id'));
+
+    expect(result).toBe(false);
+    // Non-tautological: if the implementation stacked the credential regardless of the error,
+    // this assertion fails.
+    expect(beginImpersonation).not.toHaveBeenCalled();
+    expect(load).not.toHaveBeenCalled();
+    expect(apply).not.toHaveBeenCalled();
+    expect(navigate).not.toHaveBeenCalled();
+  });
+
+  it('leaves the operator session untouched when the mutation resolves with no data', async () => {
+    const mutate = vi.fn().mockReturnValue(of({ data: null }));
+    const beginImpersonation = vi.fn();
+    const endImpersonation = vi.fn();
+    const load = vi.fn();
+    const navigate = vi.fn();
+    const injector = makeInjector({ mutate, beginImpersonation, endImpersonation, load, navigate });
+    const service = makeService(injector);
+
+    const result = await firstValueFrom(service.impersonate('target-account-id'));
+
+    expect(result).toBe(false);
+    expect(beginImpersonation).not.toHaveBeenCalled();
+  });
+});
+
+/**
+ * These use the REAL `TokenStore` (see `makeServiceWithStore` below) so the "nothing to unwind"
+ * case is the state production actually reaches, not a stub's constant. `stopImpersonation()` MUST
+ * report whether it really unwound (finding C10) — a caller that always hears `true` announces a
+ * success that did not happen.
+ */
+describe('AuthenticationAuroraAdapterService — stopImpersonation', () => {
+  beforeEach(() => localStorage.clear());
+  afterEach(() => localStorage.clear());
+
+  it('unwinds the stack via the token store and delegates the landing to the resolver — no explicit redirect, with NO network call', async () => {
+    const store = new TokenStore();
+    const operator = { accessToken: normalToken(), refreshToken: 'operator-refresh' };
+    store.setCredentials(operator);
+    store.beginImpersonation({ accessToken: impersonationToken() });
+    const { service, mutate, navigate, load, apply } = makeServiceWithStore(store);
+
+    const result = await firstValueFrom(service.stopImpersonation());
+
+    expect(result).toBe(true);
+    expect(store.accessToken()).toBe(operator.accessToken);
+    expect(store.isImpersonating()).toBe(false);
+    // The landing resolver — not a hardcoded navigate(['/']) — decides where the operator lands.
+    expect(apply).toHaveBeenCalledWith(null);
+    expect(navigate).not.toHaveBeenCalled();
+    // The resolver re-arms via its OWN `load()` call inside `apply()` — the adapter must not
+    // also call `load()` directly.
+    expect(load).not.toHaveBeenCalled();
+    // An impersonation token cannot be revoked server-side (design D4) — rollback is purely local.
+    expect(mutate).not.toHaveBeenCalled();
+  });
+
+  it('reports FALSE and changes nothing when there is no stashed session to restore', async () => {
+    const store = new TokenStore();
+    // A live impersonation credential with nothing behind it (another tab signed out, or the
+    // stash entry was removed by hand).
+    const impersonation = { accessToken: impersonationToken() };
+    store.setCredentials(impersonation);
+    const { service, navigate, load, apply } = makeServiceWithStore(store);
+
+    const result = await firstValueFrom(service.stopImpersonation());
+
+    // Non-tautological: `endImpersonation()` is a silent no-op with an empty stash, so returning
+    // `true` here makes every caller announce a rollback that never happened — the active
+    // credential is still the impersonation token and the indicator is still visible.
+    expect(result).toBe(false);
+    expect(store.accessToken()).toBe(impersonation.accessToken);
+    expect(store.isImpersonating()).toBe(true);
+    expect(load).not.toHaveBeenCalled();
+    expect(apply).not.toHaveBeenCalled();
+    expect(navigate).not.toHaveBeenCalled();
+  });
+});
+
+/**
+ * `check()` is what every route guard calls (`authenticationPasswordGuard` → `check()` → redirect
+ * to `/auth/sign-in` when false). These tests use the REAL `TokenStore` on purpose: a stub that
+ * answers `refreshToken: () => 'refresh'` invents a shape production never creates for an
+ * impersonation credential (access-token-only, design D4) and would hide the whole class of bugs
+ * where `check()` treats a missing refresh token as "no session".
+ */
+function makeJwt(payload: Record<string, unknown>): string {
+  return `${btoa(JSON.stringify({ alg: 'RS256', typ: 'JWT' }))}.${btoa(JSON.stringify(payload))}.fake-signature`;
+}
+
+function normalToken(aci = 'actor-1', expOffsetSeconds = 3600): string {
+  return makeJwt({ aci, exp: Math.floor(Date.now() / 1000) + expOffsetSeconds });
+}
+
+function impersonationToken(expOffsetSeconds = 900): string {
+  return makeJwt({
+    aci: 'target-1',
+    act: { aci: 'actor-1' },
+    exp: Math.floor(Date.now() / 1000) + expOffsetSeconds,
+  });
+}
+
+/** Wires the service around a REAL `TokenStore`, so the credential stack behaves as in production. */
+function makeServiceWithStore(
+  store: TokenStore,
+  mutate: ReturnType<typeof vi.fn> = vi.fn(),
+): {
+  service: AuthenticationAuroraAdapterService;
+  mutate: ReturnType<typeof vi.fn>;
+  navigate: ReturnType<typeof vi.fn>;
+  load: ReturnType<typeof vi.fn>;
+  apply: ReturnType<typeof vi.fn>;
+} {
+  const navigate = vi.fn();
+  const load = vi.fn();
+  const apply = vi.fn();
+  const injector = Injector.create({
+    providers: [
+      { provide: Apollo, useValue: { mutate } },
+      { provide: Router, useValue: { navigate } },
+      { provide: TokenStore, useValue: store },
+      { provide: CurrentAccountService, useValue: { load } },
+      { provide: LandingResolverService, useValue: { apply } },
+      { provide: TranslocoService, useValue: { translate: (key: string) => key } },
+      SessionRecoveryCoordinatorService,
+    ],
+  });
+
+  return { service: makeService(injector), mutate, navigate, load, apply };
+}
+
+describe('AuthenticationAuroraAdapterService — check() during an impersonated session', () => {
+  beforeEach(() => localStorage.clear());
+  afterEach(() => localStorage.clear());
+
+  it('keeps an impersonated session authenticated and its stash intact, even though the impersonation credential has no refresh token', async () => {
+    const store = new TokenStore();
+    const operator = { accessToken: normalToken(), refreshToken: 'operator-refresh' };
+    store.setCredentials(operator);
+    // Exactly what `impersonate()` stacks in production: access token only, no refresh token.
+    store.beginImpersonation({ accessToken: impersonationToken() });
+    const { service } = makeServiceWithStore(store);
+
+    const authenticated = await firstValueFrom(service.check());
+
+    // Non-tautological: with the "no refresh token ⇒ no session" rule applied to impersonated
+    // sessions, this is `false` AND the assertions below fail — the guard would bounce the
+    // operator to /auth/sign-in on the very first navigation after starting an impersonation.
+    expect(authenticated).toBe(true);
+    expect(store.isImpersonating()).toBe(true);
+    // The stash is the ONLY way back to the operator's own session: it must survive `check()`.
+    expect(localStorage.getItem(ORIGIN_CREDENTIALS_KEY)).toBe(btoa(JSON.stringify(operator)));
+  });
+
+  it('rolls the operator back into their own session — never signs them out — when the impersonation credential has expired', async () => {
+    const store = new TokenStore();
+    const operator = { accessToken: normalToken(), refreshToken: 'operator-refresh' };
+    store.setCredentials(operator);
+    store.beginImpersonation({ accessToken: impersonationToken(-60) });
+    const { service, load, navigate } = makeServiceWithStore(store);
+
+    const authenticated = await firstValueFrom(service.check());
+
+    // The operator stays authenticated AS THEMSELVES; an expired impersonation credential must
+    // never strand them at the sign-in screen with a live stash in localStorage.
+    expect(authenticated).toBe(true);
+    expect(store.accessToken()).toBe(operator.accessToken);
+    expect(store.isImpersonating()).toBe(false);
+    expect(localStorage.getItem(ORIGIN_CREDENTIALS_KEY)).toBeNull();
+    expect(toastInfo).toHaveBeenCalledOnce();
+    // Session-scoped state MUST be re-materialized on this path too (C9). Without it the
+    // credential is the operator's while `CurrentAccountService` still holds the TARGET's
+    // displayName/email/permissions and the header badge is gone (`isImpersonating()` is now
+    // false): the operator browses with the target's identity rendered in the shell and a sidebar
+    // filtered by the target's permission set, with no warning, until a full reload.
+    expect(load).toHaveBeenCalledTimes(1);
+    // …but NOT the redirect: `check()` runs inside a route guard, and navigating here would cancel
+    // the navigation the guard is resolving. The delta spec requires that navigation to proceed.
+    expect(navigate).not.toHaveBeenCalled();
+  });
+
+  it('still clears and reports false for a NON-impersonated session with no refresh token', async () => {
+    const store = new TokenStore();
+    store.setCredentials({ accessToken: normalToken() });
+    const { service } = makeServiceWithStore(store);
+
+    const authenticated = await firstValueFrom(service.check());
+
+    // The relaxation is scoped to impersonation: a normal session without a refresh token is
+    // unrecoverable and must still be cleared.
+    expect(authenticated).toBe(false);
+    expect(store.authenticated()).toBe(false);
+  });
+
+  /**
+   * Task 5.1: check() DELEGATES rather than decides. With an expired access token and a refresh
+   * token present, the recovery runs through the coordinator's shared flight — the adapter itself
+   * issues no grant. Non-tautological: `signInUsingRefreshToken()` no longer exists on the class at
+   * all (removed in task 2.6), so the ONLY way this can succeed is via the coordinator's own
+   * `apollo.mutate()` call — asserting it fires exactly once, through the SAME `Apollo` instance
+   * the adapter itself was given, proves the recovery is not decided locally.
+   */
+  it('delegates an expired-access/refresh-present recovery to the coordinator, issuing exactly one grant', async () => {
+    const store = new TokenStore();
+    store.setCredentials({
+      accessToken: normalToken('actor-1', -60),
+      refreshToken: 'operator-refresh',
+    });
+    const ROTATED = `${btoa(JSON.stringify({ alg: 'RS256', typ: 'JWT' }))}.${btoa(
+      JSON.stringify({ aci: 'actor-1', jti: 'rotated', exp: Math.floor(Date.now() / 1000) + 3600 }),
+    )}.fake-signature`;
+    const mutate = vi.fn().mockReturnValue(
+      of({
+        data: { oAuthCreateToken: { accessToken: ROTATED, refreshToken: 'operator-refresh-2' } },
+      }),
+    );
+    const { service } = makeServiceWithStore(store, mutate);
+
+    const authenticated = await firstValueFrom(service.check());
+
+    expect(authenticated).toBe(true);
+    expect(mutate).toHaveBeenCalledTimes(1);
+    expect(store.accessToken()).toBe(ROTATED);
+  });
+
+  /**
+   * Task 5.2: a terminal outcome on the GUARD path emits `false` and performs NO navigation,
+   * because `check()` runs inside `canActivate` and navigating would cancel the navigation the
+   * guard is resolving — the ROUTER (not `check()`) must be the one that redirects.
+   */
+  it('performs no navigation when the guard path resolves to a terminal sign-out', async () => {
+    const store = new TokenStore();
+    // No refresh token at all: an immediate, unrecoverable terminal outcome.
+    store.setCredentials({ accessToken: normalToken('actor-1', -60) });
+    const { service, navigate } = makeServiceWithStore(store);
+
+    const authenticated = await firstValueFrom(service.check());
+
+    expect(authenticated).toBe(false);
+    expect(navigate).not.toHaveBeenCalled();
+  });
+});
+
+/**
+ * `signOut()` must revoke server-side (RFC 7009) whatever refresh token the session actually owns.
+ * During an impersonated session the ACTIVE credential has none (design D4) and the operator's real
+ * refresh token is reachable only through the stash — which `clear()` then deletes. These tests use
+ * the REAL `TokenStore` so that asymmetry is visible.
+ */
+describe('AuthenticationAuroraAdapterService — signOut() during an impersonated session', () => {
+  function revokeOk(): ReturnType<typeof vi.fn> {
+    return vi.fn().mockReturnValue(of({ data: { oAuthRevokeToken: true } }));
+  }
+
+  beforeEach(() => localStorage.clear());
+  afterEach(() => localStorage.clear());
+
+  it("revokes the OPERATOR's refresh token, not the impersonation credential's missing one", async () => {
+    const store = new TokenStore();
+    store.setCredentials({ accessToken: normalToken(), refreshToken: 'operator-refresh' });
+    store.beginImpersonation({ accessToken: impersonationToken() });
+    const mutate = revokeOk();
+    const { service } = makeServiceWithStore(store, mutate);
+
+    const result = await firstValueFrom(service.signOut());
+
+    expect(result).toBe(true);
+    // Non-tautological: reading `refreshToken()` off the ACTIVE (impersonation) credential yields
+    // '', which either skips the revocation entirely or sends an empty token — the operator would
+    // believe they revoked a session that stays valid server-side until it expires.
+    expect(mutate).toHaveBeenCalledWith(
+      expect.objectContaining({ variables: { payload: { token: 'operator-refresh' } } }),
+    );
+    // Signing out is still a full sign-out: no session left behind in either slot.
+    expect(store.authenticated()).toBe(false);
+    expect(localStorage.getItem(CREDENTIALS_KEY)).toBeNull();
+    expect(localStorage.getItem(ORIGIN_CREDENTIALS_KEY)).toBeNull();
+  });
+
+  it('clears locally without a bogus revocation when the impersonated session has no stash', async () => {
+    const store = new TokenStore();
+    // No stash: the operator's session is gone (another tab signed out, or a hand-edited entry).
+    store.setCredentials({ accessToken: impersonationToken() });
+    const mutate = revokeOk();
+    const { service } = makeServiceWithStore(store, mutate);
+
+    const result = await firstValueFrom(service.signOut());
+
+    expect(result).toBe(true);
+    // There is no refresh token anywhere to revoke — calling the mutation with '' would be noise.
+    expect(mutate).not.toHaveBeenCalled();
+    expect(store.authenticated()).toBe(false);
+  });
+
+  it('is unchanged for a normal session: revokes the active refresh token and clears', async () => {
+    const store = new TokenStore();
+    store.setCredentials({ accessToken: normalToken(), refreshToken: 'own-refresh' });
+    const mutate = revokeOk();
+    const { service } = makeServiceWithStore(store, mutate);
+
+    const result = await firstValueFrom(service.signOut());
+
+    expect(result).toBe(true);
+    expect(mutate).toHaveBeenCalledWith(
+      expect.objectContaining({ variables: { payload: { token: 'own-refresh' } } }),
+    );
+    expect(store.authenticated()).toBe(false);
+  });
+});