@bajustone/fortress 1.0.0-rc.1

package/src/core/iam/service-account.test.ts

@@ -0,0 +1,282 @@
+import type { Fortress } from '../fortress';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { createTestAdapter } from '../../testing';
+import { createFortress } from '../fortress';
+
+const SECRET = 'service-account-test-secret-32ch';
+
+describe('iam-service: service accounts', () => {
+  let fortress: Fortress;
+
+  beforeEach(() => {
+    fortress = createFortress({
+      jwt: { key: SECRET },
+      database: createTestAdapter(),
+    });
+  });
+
+  it('creates a service account with all metadata', async () => {
+    const sa = await fortress.iam.createServiceAccount({
+      name: 'ci-deploy',
+      displayName: 'CI Deploy',
+      description: 'Runs production deploys from CI',
+    });
+
+    expect(sa.id).toBeDefined();
+    expect(sa.name).toBe('ci-deploy');
+    expect(sa.displayName).toBe('CI Deploy');
+    expect(sa.description).toBe('Runs production deploys from CI');
+    expect(sa.isActive).toBe(true);
+    expect(sa.createdAt).toBeInstanceOf(Date);
+    expect(sa.updatedAt).toBeInstanceOf(Date);
+  });
+
+  it('createServiceAccount rejects duplicate names', async () => {
+    await fortress.iam.createServiceAccount({ name: 'ci-deploy' });
+    await expect(
+      fortress.iam.createServiceAccount({ name: 'ci-deploy' }),
+    ).rejects.toThrow(/already exists/);
+  });
+
+  it('getServiceAccount throws notFound for missing id', async () => {
+    await expect(fortress.iam.getServiceAccount('9999')).rejects.toThrow(/not found/i);
+  });
+
+  it('listServiceAccounts paginates and returns total', async () => {
+    for (let i = 0; i < 5; i++) {
+      await fortress.iam.createServiceAccount({ name: `sa-${i}` });
+    }
+
+    const page1 = await fortress.iam.listServiceAccounts({ limit: 3, offset: 0 });
+    expect(page1.serviceAccounts).toHaveLength(3);
+    expect(page1.total).toBe(5);
+
+    const page2 = await fortress.iam.listServiceAccounts({ limit: 3, offset: 3 });
+    expect(page2.serviceAccounts).toHaveLength(2);
+    expect(page2.total).toBe(5);
+  });
+
+  it('updateServiceAccount changes displayName/description/isActive but not name', async () => {
+    const sa = await fortress.iam.createServiceAccount({ name: 'ci-deploy' });
+    const updated = await fortress.iam.updateServiceAccount(sa.id, {
+      displayName: 'New Display',
+      description: 'New desc',
+      isActive: false,
+    });
+
+    expect(updated.name).toBe('ci-deploy'); // immutable
+    expect(updated.displayName).toBe('New Display');
+    expect(updated.description).toBe('New desc');
+    expect(updated.isActive).toBe(false);
+  });
+
+  it('deleteServiceAccount removes the account, role bindings, and direct bindings', async () => {
+    const sa = await fortress.iam.createServiceAccount({ name: 'to-delete' });
+    const role = await fortress.iam.createRole('rolex', [
+      { resource: 'deploy', action: 'run' },
+    ]);
+    await fortress.iam.bindRoleToServiceAccount(sa.id, role.id);
+    await fortress.iam.bindPermissionToServiceAccount(sa.id, {
+      resource: 'deploy',
+      action: 'promote',
+    });
+
+    await fortress.iam.deleteServiceAccount(sa.id);
+
+    // Account is gone
+    await expect(fortress.iam.getServiceAccount(sa.id)).rejects.toThrow(/not found/i);
+
+    // Role bindings are cleaned up
+    const roleBindings = await fortress.config.database.findMany({
+      model: 'role_binding',
+      where: [
+        { field: 'subjectType', operator: '=', value: 'SERVICE_ACCOUNT' },
+        { field: 'subjectId', operator: '=', value: sa.id },
+      ],
+    });
+    expect(roleBindings).toHaveLength(0);
+
+    // Direct permission bindings are cleaned up
+    const directBindings = await fortress.config.database.findMany({
+      model: 'direct_permission_binding',
+      where: [
+        { field: 'subjectType', operator: '=', value: 'SERVICE_ACCOUNT' },
+        { field: 'subjectId', operator: '=', value: sa.id },
+      ],
+    });
+    expect(directBindings).toHaveLength(0);
+  });
+});
+
+describe('iam-service: service account permissions (regression)', () => {
+  let fortress: Fortress;
+
+  beforeEach(() => {
+    fortress = createFortress({
+      jwt: { key: SECRET },
+      database: createTestAdapter(),
+    });
+  });
+
+  // Pins the core bug fix: SERVICE_ACCOUNT role bindings were silently dropped
+  // by the old getUserPermissions path. With getSubjectPermissions they must
+  // resolve end-to-end through checkPermission.
+  it('bindRoleToServiceAccount + checkPermission resolves the role', async () => {
+    const sa = await fortress.iam.createServiceAccount({ name: 'deployer' });
+    const role = await fortress.iam.createRole('ops-deployer', [
+      { resource: 'deploy', action: 'run' },
+    ]);
+    await fortress.iam.bindRoleToServiceAccount(sa.id, role.id);
+
+    const allowed = await fortress.iam.checkPermission(
+      { type: 'SERVICE_ACCOUNT', id: sa.id },
+      'deploy',
+      'run',
+    );
+    expect(allowed).toBe(true);
+
+    const denied = await fortress.iam.checkPermission(
+      { type: 'SERVICE_ACCOUNT', id: sa.id },
+      'deploy',
+      'destroy',
+    );
+    expect(denied).toBe(false);
+  });
+
+  it('bindPermissionToServiceAccount grants the permission directly', async () => {
+    const sa = await fortress.iam.createServiceAccount({ name: 'audit-reader' });
+    await fortress.iam.bindPermissionToServiceAccount(sa.id, {
+      resource: 'audit',
+      action: 'read',
+    });
+
+    const allowed = await fortress.iam.checkPermission(
+      { type: 'SERVICE_ACCOUNT', id: sa.id },
+      'audit',
+      'read',
+    );
+    expect(allowed).toBe(true);
+  });
+
+  it('unbindRoleFromServiceAccount revokes the role permissions', async () => {
+    const sa = await fortress.iam.createServiceAccount({ name: 'temp' });
+    const role = await fortress.iam.createRole('temp-role', [
+      { resource: 'temp', action: 'use' },
+    ]);
+    await fortress.iam.bindRoleToServiceAccount(sa.id, role.id);
+    expect(await fortress.iam.checkPermission({ type: 'SERVICE_ACCOUNT', id: sa.id }, 'temp', 'use')).toBe(true);
+
+    await fortress.iam.unbindRoleFromServiceAccount(sa.id, role.id);
+    expect(await fortress.iam.checkPermission({ type: 'SERVICE_ACCOUNT', id: sa.id }, 'temp', 'use')).toBe(false);
+  });
+
+  it('inactive service account resolves to no permissions even with a bound role', async () => {
+    const sa = await fortress.iam.createServiceAccount({ name: 'disabled' });
+    const role = await fortress.iam.createRole('anything', [
+      { resource: 'secret', action: 'read' },
+    ]);
+    await fortress.iam.bindRoleToServiceAccount(sa.id, role.id);
+
+    // Flip isActive to false
+    await fortress.iam.updateServiceAccount(sa.id, { isActive: false });
+
+    const allowed = await fortress.iam.checkPermission(
+      { type: 'SERVICE_ACCOUNT', id: sa.id },
+      'secret',
+      'read',
+    );
+    expect(allowed).toBe(false);
+
+    const perms = await fortress.iam.getPermissionsForSubject({
+      type: 'SERVICE_ACCOUNT',
+      id: sa.id,
+    });
+    expect(perms).toEqual([]);
+  });
+
+  it('service accounts do not inherit permissions from groups', async () => {
+    // A group has a permission; a user in the group has it via inheritance.
+    const user = await fortress.auth.createUser({
+      email: 'in-group@test.com',
+      name: 'In Group',
+      password: 'password-123456',
+    });
+    const group = await fortress.iam.createGroup('editors-sa-test');
+    await fortress.iam.addUserToGroup(group.id, user.id);
+    const role = await fortress.iam.createRole('group-editor', [
+      { resource: 'article', action: 'edit' },
+    ]);
+    await fortress.iam.bindRoleToGroup(group.id, role.id);
+    expect(await fortress.iam.checkPermission({ type: 'USER', id: user.id }, 'article', 'edit')).toBe(true);
+
+    // A service account with the same numeric id as the group must NOT
+    // pick up the group's permissions.
+    const sa = await fortress.iam.createServiceAccount({ name: 'isolated-sa-group' });
+    const allowed = await fortress.iam.checkPermission(
+      { type: 'SERVICE_ACCOUNT', id: sa.id },
+      'article',
+      'edit',
+    );
+    expect(allowed).toBe(false);
+  });
+});
+
+describe('iam-service: service accounts + tenancy', () => {
+  let fortress: Fortress;
+
+  beforeEach(() => {
+    fortress = createFortress({
+      jwt: { key: SECRET },
+      database: createTestAdapter(),
+    });
+  });
+
+  it('tenant-scoped role binding only applies in its tenant', async () => {
+    const sa = await fortress.iam.createServiceAccount({ name: 'tenant-bound' });
+    const role = await fortress.iam.createRole('tenant-writer', [
+      { resource: 'docs', action: 'write' },
+    ]);
+    await fortress.iam.bindRoleToServiceAccount(sa.id, role.id, 'tenant-a');
+
+    const inA = await fortress.iam.checkPermission(
+      { type: 'SERVICE_ACCOUNT', id: sa.id },
+      'docs',
+      'write',
+      { tenantId: 'tenant-a' },
+    );
+    expect(inA).toBe(true);
+
+    const inB = await fortress.iam.checkPermission(
+      { type: 'SERVICE_ACCOUNT', id: sa.id },
+      'docs',
+      'write',
+      { tenantId: 'tenant-b' },
+    );
+    expect(inB).toBe(false);
+  });
+
+  it('global role binding applies in any tenant', async () => {
+    const sa = await fortress.iam.createServiceAccount({ name: 'global-bound' });
+    const role = await fortress.iam.createRole('global-reader', [
+      { resource: 'audit', action: 'read' },
+    ]);
+    await fortress.iam.bindRoleToServiceAccount(sa.id, role.id); // no tenantId
+
+    expect(
+      await fortress.iam.checkPermission(
+        { type: 'SERVICE_ACCOUNT', id: sa.id },
+        'audit',
+        'read',
+        { tenantId: 'tenant-a' },
+      ),
+    ).toBe(true);
+    expect(
+      await fortress.iam.checkPermission(
+        { type: 'SERVICE_ACCOUNT', id: sa.id },
+        'audit',
+        'read',
+        { tenantId: 'tenant-b' },
+      ),
+    ).toBe(true);
+  });
+});

package/src/core/internal-adapter.test.ts

@@ -0,0 +1,389 @@
+import type { DatabaseAdapter } from '../adapters/database';
+import type { InternalAdapter } from './internal-adapter';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { createTestAdapter } from '../testing';
+import { createInternalAdapter } from './internal-adapter';
+
+let db: DatabaseAdapter;
+let adapter: InternalAdapter;
+
+beforeEach(() => {
+  db = createTestAdapter();
+  adapter = createInternalAdapter(db);
+});
+
+describe('findUserByIdentifier', () => {
+  it('finds user via login_identifier', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'alice@example.com', name: 'Alice', passwordHash: 'hashed', isActive: true },
+    });
+
+    await db.create({
+      model: 'login_identifier',
+      data: { userId: user.id, type: 'email', value: 'alice@example.com' },
+    });
+
+    const found = await adapter.findUserByIdentifier('alice@example.com');
+    expect(found).not.toBeNull();
+    expect(found!.email).toBe('alice@example.com');
+    expect(found!.name).toBe('Alice');
+  });
+
+  it('normalizes case and Unicode only for email identifier lookup', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'é@example.com', name: 'Unicode', passwordHash: 'hashed', isActive: true },
+    });
+    await db.create({
+      model: 'login_identifier',
+      data: { userId: user.id, type: 'email', value: 'é@example.com' },
+    });
+
+    expect((await adapter.findUserByIdentifier('E\u0301@EXAMPLE.COM'))?.id).toBe(user.id);
+  });
+
+  it('preserves exact case for non-email identifiers', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'case@example.com', name: 'Case', passwordHash: 'hashed', isActive: true },
+    });
+    await db.create({
+      model: 'login_identifier',
+      data: { userId: user.id, type: 'username', value: 'CaseUser' },
+    });
+
+    expect((await adapter.findUserByIdentifier('CaseUser'))?.id).toBe(user.id);
+    expect(await adapter.findUserByIdentifier('caseuser')).toBeNull();
+  });
+
+  it('falls back to email lookup when no login_identifier exists', async () => {
+    await db.create({
+      model: 'user',
+      data: { email: 'bob@example.com', name: 'Bob', passwordHash: 'hashed', isActive: true },
+    });
+
+    const found = await adapter.findUserByIdentifier('bob@example.com');
+    expect(found).not.toBeNull();
+    expect(found!.email).toBe('bob@example.com');
+  });
+
+  it('returns null for unknown identifier', async () => {
+    const found = await adapter.findUserByIdentifier('nobody@example.com');
+    expect(found).toBeNull();
+  });
+});
+
+describe('getUserGroups', () => {
+  it('returns group names for a user', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'alice@example.com', name: 'Alice', passwordHash: 'hashed', isActive: true },
+    });
+
+    const g1 = await db.create<{ id: string }>({ model: 'group', data: { name: 'admins' } });
+    const g2 = await db.create<{ id: string }>({ model: 'group', data: { name: 'editors' } });
+
+    await db.create({ model: 'group_user', data: { groupId: g1.id, userId: user.id } });
+    await db.create({ model: 'group_user', data: { groupId: g2.id, userId: user.id } });
+
+    const groups = await adapter.getUserGroups(user.id);
+    expect(groups).toHaveLength(2);
+    expect(groups).toContain('admins');
+    expect(groups).toContain('editors');
+  });
+
+  it('returns empty array for user with no groups', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'loner@example.com', name: 'Loner', passwordHash: 'hashed', isActive: true },
+    });
+
+    const groups = await adapter.getUserGroups(user.id);
+    expect(groups).toEqual([]);
+  });
+});
+
+describe('findRefreshTokenByHash', () => {
+  it('finds a refresh token by hash', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'alice@example.com', name: 'Alice', passwordHash: 'hashed', isActive: true },
+    });
+
+    await db.create({
+      model: 'refresh_token',
+      data: {
+        userId: user.id,
+        tokenHash: 'abc123hash',
+        tokenFamily: 'family-1',
+        isRevoked: false,
+        expiresAt: new Date(Date.now() + 86400000),
+        ipAddress: '127.0.0.1',
+        userAgent: 'test',
+      },
+    });
+
+    const token = await adapter.findRefreshTokenByHash('abc123hash');
+    expect(token).not.toBeNull();
+    expect(token!.userId).toBe(user.id);
+    expect(token!.tokenFamily).toBe('family-1');
+    expect(token!.isRevoked).toBe(false);
+  });
+
+  it('returns null for unknown hash', async () => {
+    const token = await adapter.findRefreshTokenByHash('nonexistent');
+    expect(token).toBeNull();
+  });
+});
+
+describe('getSubjectPermissions', () => {
+  it('resolves permissions through direct role binding', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'alice@example.com', name: 'Alice', passwordHash: 'hashed', isActive: true },
+    });
+
+    await db.create({ model: 'resource', data: { name: 'document' } });
+
+    const permission = await db.create<{ id: string }>({
+      model: 'permission',
+      data: { resource: 'document', action: 'read', effect: 'ALLOW', description: 'read document' },
+    });
+
+    const role = await db.create<{ id: string }>({
+      model: 'role',
+      data: { name: 'viewer' },
+    });
+
+    await db.create({ model: 'role_permission', data: { roleId: role.id, permissionId: permission.id } });
+    await db.create({ model: 'role_binding', data: { roleId: role.id, subjectType: 'USER', subjectId: user.id } });
+
+    const permissions = await adapter.getSubjectPermissions({ type: 'USER', id: user.id });
+    expect(permissions).toHaveLength(1);
+    expect(permissions[0].resource).toBe('document');
+    expect(permissions[0].action).toBe('read');
+  });
+
+  it('resolves permissions through group role binding', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'bob@example.com', name: 'Bob', passwordHash: 'hashed', isActive: true },
+    });
+
+    const group = await db.create<{ id: string }>({ model: 'group', data: { name: 'editors' } });
+    await db.create({ model: 'group_user', data: { groupId: group.id, userId: user.id } });
+
+    await db.create({ model: 'resource', data: { name: 'article' } });
+
+    const permission = await db.create<{ id: string }>({
+      model: 'permission',
+      data: { resource: 'article', action: 'write', effect: 'ALLOW', description: 'write article' },
+    });
+
+    const role = await db.create<{ id: string }>({
+      model: 'role',
+      data: { name: 'editor' },
+    });
+
+    await db.create({ model: 'role_permission', data: { roleId: role.id, permissionId: permission.id } });
+    await db.create({ model: 'role_binding', data: { roleId: role.id, subjectType: 'GROUP', subjectId: group.id } });
+
+    const permissions = await adapter.getSubjectPermissions({ type: 'USER', id: user.id });
+    expect(permissions).toHaveLength(1);
+    expect(permissions[0].resource).toBe('article');
+    expect(permissions[0].action).toBe('write');
+  });
+
+  it('does not let tenant-scoped role bindings satisfy tenant-less permission resolution', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'tenant@example.com', name: 'Tenant User', passwordHash: 'hashed', isActive: true },
+    });
+    await db.create({ model: 'resource', data: { name: 'invoice' } });
+    const permission = await db.create<{ id: string }>({
+      model: 'permission',
+      data: { resource: 'invoice', action: 'read', effect: 'ALLOW', description: 'read invoice' },
+    });
+    const role = await db.create<{ id: string }>({ model: 'role', data: { name: 'tenant-reader' } });
+    await db.create({ model: 'role_permission', data: { roleId: role.id, permissionId: permission.id } });
+    await db.create({ model: 'role_binding', data: { roleId: role.id, subjectType: 'USER', subjectId: user.id, tenantId: 'tenant-a' } });
+
+    expect(await adapter.getSubjectPermissions({ type: 'USER', id: user.id })).toEqual([]);
+    const tenantPermissions = await adapter.getSubjectPermissions({ type: 'USER', id: user.id }, 'tenant-a');
+    expect(tenantPermissions).toHaveLength(1);
+    expect(tenantPermissions[0].resource).toBe('invoice');
+  });
+
+  it('returns empty array for user with no roles', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'nobody@example.com', name: 'Nobody', passwordHash: 'hashed', isActive: true },
+    });
+
+    const permissions = await adapter.getSubjectPermissions({ type: 'USER', id: user.id });
+    expect(permissions).toEqual([]);
+  });
+
+  it('returns empty for an inactive USER even with a bound role', async () => {
+    const user = await db.create<{ id: string }>({
+      model: 'user',
+      data: { email: 'disabled@example.com', name: 'Disabled', passwordHash: 'hashed', isActive: false },
+    });
+    await db.create({ model: 'resource', data: { name: 'document-disabled' } });
+    const permission = await db.create<{ id: string }>({
+      model: 'permission',
+      data: { resource: 'document-disabled', action: 'read', effect: 'ALLOW', description: null },
+    });
+    const role = await db.create<{ id: string }>({ model: 'role', data: { name: 'disabled-reader' } });
+    await db.create({ model: 'role_permission', data: { roleId: role.id, permissionId: permission.id } });
+    await db.create({ model: 'role_binding', data: { roleId: role.id, subjectType: 'USER', subjectId: user.id } });
+
+    await expect(adapter.getSubjectPermissions({ type: 'USER', id: user.id })).resolves.toEqual([]);
+  });
+
+  it('returns empty for a missing USER even when stale bindings remain', async () => {
+    await db.create({ model: 'resource', data: { name: 'stale-document' } });
+    const permission = await db.create<{ id: string }>({
+      model: 'permission',
+      data: { resource: 'stale-document', action: 'read', effect: 'ALLOW', description: null },
+    });
+    const role = await db.create<{ id: string }>({ model: 'role', data: { name: 'stale-reader' } });
+    await db.create({ model: 'role_permission', data: { roleId: role.id, permissionId: permission.id } });
+    await db.create({ model: 'role_binding', data: { roleId: role.id, subjectType: 'USER', subjectId: '99999' } });
+
+    await expect(adapter.getSubjectPermissions({ type: 'USER', id: '99999' })).resolves.toEqual([]);
+  });
+
+  it('resolves permissions through a SERVICE_ACCOUNT role binding', async () => {
+    const sa = await db.create<{ id: string }>({
+      model: 'service_account',
+      data: { name: 'ci-deploy', displayName: 'CI Deploy', description: null, isActive: true },
+    });
+
+    await db.create({ model: 'resource', data: { name: 'deploy' } });
+
+    const permission = await db.create<{ id: string }>({
+      model: 'permission',
+      data: { resource: 'deploy', action: 'run', effect: 'ALLOW', description: 'run deploy' },
+    });
+
+    const role = await db.create<{ id: string }>({
+      model: 'role',
+      data: { name: 'deployer' },
+    });
+
+    await db.create({ model: 'role_permission', data: { roleId: role.id, permissionId: permission.id } });
+    await db.create({ model: 'role_binding', data: { roleId: role.id, subjectType: 'SERVICE_ACCOUNT', subjectId: sa.id } });
+
+    const permissions = await adapter.getSubjectPermissions({ type: 'SERVICE_ACCOUNT', id: sa.id });
+    expect(permissions).toHaveLength(1);
+    expect(permissions[0].resource).toBe('deploy');
+    expect(permissions[0].action).toBe('run');
+  });
+
+  it('resolves direct permission bindings for a SERVICE_ACCOUNT', async () => {
+    const sa = await db.create<{ id: string }>({
+      model: 'service_account',
+      data: { name: 'audit-reader', displayName: null, description: null, isActive: true },
+    });
+
+    await db.create({ model: 'resource', data: { name: 'audit' } });
+    const permission = await db.create<{ id: string }>({
+      model: 'permission',
+      data: { resource: 'audit', action: 'read', effect: 'ALLOW', description: null },
+    });
+
+    await db.create({
+      model: 'direct_permission_binding',
+      data: { permissionId: permission.id, subjectType: 'SERVICE_ACCOUNT', subjectId: sa.id },
+    });
+
+    const permissions = await adapter.getSubjectPermissions({ type: 'SERVICE_ACCOUNT', id: sa.id });
+    expect(permissions).toHaveLength(1);
+    expect(permissions[0].resource).toBe('audit');
+  });
+
+  it('returns empty for an inactive SERVICE_ACCOUNT even with a bound role', async () => {
+    const sa = await db.create<{ id: string }>({
+      model: 'service_account',
+      data: { name: 'disabled-sa', displayName: null, description: null, isActive: false },
+    });
+
+    await db.create({ model: 'resource', data: { name: 'deploy' } });
+    const permission = await db.create<{ id: string }>({
+      model: 'permission',
+      data: { resource: 'deploy', action: 'run', effect: 'ALLOW', description: null },
+    });
+    const role = await db.create<{ id: string }>({ model: 'role', data: { name: 'deployer-disabled' } });
+    await db.create({ model: 'role_permission', data: { roleId: role.id, permissionId: permission.id } });
+    await db.create({ model: 'role_binding', data: { roleId: role.id, subjectType: 'SERVICE_ACCOUNT', subjectId: sa.id } });
+
+    const permissions = await adapter.getSubjectPermissions({ type: 'SERVICE_ACCOUNT', id: sa.id });
+    expect(permissions).toEqual([]);
+  });
+
+  it('service account subjects do not inherit permissions from groups', async () => {
+    // Set up a group with a permission, and a user in that group.
+    const group = await db.create<{ id: string }>({ model: 'group', data: { name: 'inheritance-group' } });
+    await db.create({ model: 'resource', data: { name: 'article' } });
+    const permission = await db.create<{ id: string }>({
+      model: 'permission',
+      data: { resource: 'article', action: 'read', effect: 'ALLOW', description: null },
+    });
+    const role = await db.create<{ id: string }>({ model: 'role', data: { name: 'reader-inherit' } });
+    await db.create({ model: 'role_permission', data: { roleId: role.id, permissionId: permission.id } });
+    await db.create({ model: 'role_binding', data: { roleId: role.id, subjectType: 'GROUP', subjectId: group.id } });
+
+    // Create a service account with the SAME numeric id as the group — group-walk
+    // must not accidentally match service accounts.
+    const sa = await db.create<{ id: string }>({
+      model: 'service_account',
+      data: { name: 'isolated-sa', displayName: null, description: null, isActive: true },
+    });
+
+    const permissions = await adapter.getSubjectPermissions({ type: 'SERVICE_ACCOUNT', id: sa.id });
+    expect(permissions).toEqual([]);
+  });
+});
+
+describe('ensureResource', () => {
+  it('creates a resource if it does not exist', async () => {
+    await adapter.ensureResource('invoice');
+
+    const found = await db.findOne<{ name: string }>({
+      model: 'resource',
+      where: [{ field: 'name', operator: '=', value: 'invoice' }],
+    });
+    expect(found).not.toBeNull();
+    expect(found!.name).toBe('invoice');
+  });
+
+  it('is a no-op if resource already exists', async () => {
+    await db.create({ model: 'resource', data: { name: 'invoice' } });
+    await adapter.ensureResource('invoice');
+
+    const count = await db.count({ model: 'resource', where: [{ field: 'name', operator: '=', value: 'invoice' }] });
+    expect(count).toBe(1);
+  });
+});
+
+describe('findOrCreatePermission', () => {
+  it('creates a new permission', async () => {
+    await db.create({ model: 'resource', data: { name: 'report' } });
+
+    const perm = await adapter.findOrCreatePermission({ resource: 'report', action: 'generate' });
+    expect(perm.resource).toBe('report');
+    expect(perm.action).toBe('generate');
+    expect(perm.effect).toBe('ALLOW');
+  });
+
+  it('returns existing permission on duplicate call', async () => {
+    await db.create({ model: 'resource', data: { name: 'report' } });
+
+    const first = await adapter.findOrCreatePermission({ resource: 'report', action: 'generate' });
+    const second = await adapter.findOrCreatePermission({ resource: 'report', action: 'generate' });
+
+    expect(first.id).toBe(second.id);
+  });
+});