@bevel-software/platform-core-backend 0.15.1 → 0.20.0

package/src/modules/auth/__tests__/oidc-auth-provider.test.ts

@@ -1,8 +1,15 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import express from 'express';
 import type { Server } from 'node:http';
-import { OidcAuthProvider } from '../oidc-auth-provider.js';
+import { randomBytes } from 'node:crypto';
+import { OidcAuthProvider, oidcRedirectUri, oidcSettingsFrom, type OidcSettings } from '../oidc-auth-provider.js';
+import { createAuthRoutes, type AuthProviderPlugin } from '../auth.routes.js';
 import type { AuthService } from '../auth.service.js';
+import {
+  CORE_SETTINGS,
+  DeploymentSettingsService,
+} from '../../settings/deployment-settings.service.js';
+import type { Database } from '../../database/connection.js';
 
 const ISSUER = 'https://idp.example.com';
 const DISCOVERY = {
@@ -11,17 +18,27 @@ const DISCOVERY = {
   userinfo_endpoint: `${ISSUER}/userinfo`,
 };
 
-function makeProvider(fetchImpl: typeof fetch, authService: AuthService) {
+const CONFIGURED: OidcSettings = {
+  issuerUrl: ISSUER,
+  clientId: 'client-1',
+  clientSecret: 'secret-1',
+  scopes: 'openid profile email',
+  label: 'Sign in with Example',
+};
+
+function makeProvider(
+  fetchImpl: typeof fetch,
+  authService: AuthService,
+  settings: () => OidcSettings | null = () => CONFIGURED,
+  onSignedIn?: (used: OidcSettings) => void | Promise<void>,
+) {
   const provider = new OidcAuthProvider({
-    issuerUrl: ISSUER,
-    clientId: 'client-1',
-    clientSecret: 'secret-1',
-    scopes: 'openid profile email',
-    label: 'Sign in with Example',
+    settings,
     publicBackendUrl: 'http://localhost:3001',
     publicFrontendUrl: 'http://localhost:5173',
     cookieSecure: false,
     fetchImpl,
+    onSignedIn,
   });
   const router = express.Router();
   provider.mountRoutes(router, authService);
@@ -81,11 +98,7 @@ beforeEach(() => {
 describe('OidcAuthProvider', () => {
   it('advertises key/label/startPath for the login screen', () => {
     const provider = new OidcAuthProvider({
-      issuerUrl: ISSUER,
-      clientId: 'c',
-      clientSecret: 's',
-      scopes: 'openid',
-      label: 'Sign in with Example',
+      settings: () => CONFIGURED,
       publicBackendUrl: 'http://localhost:3001',
       publicFrontendUrl: 'http://localhost:5173',
       cookieSecure: false,
@@ -171,4 +184,331 @@ describe('OidcAuthProvider', () => {
     expect(cb.headers.get('location')).toBe('http://localhost:5173/auth/oidc/callback#error=auth');
     expect(authService.loginWithSso).not.toHaveBeenCalled();
   });
+
+  /** Walk the round-trip once; returns the callback's redirect target. */
+  async function signIn(base: string): Promise<string> {
+    const start = await fetch(`${base}/api/auth/oidc/login`, { redirect: 'manual' });
+    const state = new URL(start.headers.get('location')!).searchParams.get('state')!;
+    const cookie = start.headers.get('set-cookie')!.split(';')[0];
+    const cb = await fetch(`${base}/api/auth/oidc/callback?code=c&state=${state}`, {
+      redirect: 'manual',
+      headers: { cookie },
+    });
+    return cb.headers.get('location')!;
+  }
+
+  it('reports a successful sign-in, which is what marks the configuration verified', async () => {
+    const onSignedIn = vi.fn();
+    const base = await listen(makeProvider(makeIdpFetch().impl, authService, undefined, onSignedIn));
+    expect(await signIn(base)).toContain('#token=');
+    expect(onSignedIn).toHaveBeenCalledTimes(1);
+    // With the values that sign-in used, so the record is about exactly those.
+    expect(onSignedIn).toHaveBeenCalledWith(CONFIGURED);
+  });
+
+  it('reports nothing for a sign-in that failed', async () => {
+    const onSignedIn = vi.fn();
+    const base = await listen(
+      makeProvider(makeIdpFetch({ userinfo: { name: 'No Email' } }).impl, authService, undefined, onSignedIn),
+    );
+    expect(await signIn(base)).toContain('#error=auth');
+    expect(onSignedIn).not.toHaveBeenCalled();
+  });
+
+  it('a failure to record the sign-in never fails the sign-in', async () => {
+    const onSignedIn = vi.fn(async () => {
+      throw new Error('database down');
+    });
+    const errors = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const base = await listen(makeProvider(makeIdpFetch().impl, authService, undefined, onSignedIn));
+    expect(await signIn(base)).toContain('#token=');
+    expect(onSignedIn).toHaveBeenCalledTimes(1);
+    expect(errors).toHaveBeenCalledWith(
+      expect.stringContaining('OIDC sign-in record failed'),
+      expect.objectContaining({ message: 'database down' }),
+    );
+    errors.mockRestore();
+  });
+
+  it('exchanges the code with the same redirect URI the configuration check sends', () => {
+    expect(oidcRedirectUri('https://hexis.example.com')).toBe(
+      'https://hexis.example.com/api/auth/oidc/callback',
+    );
+  });
+
+  it('keeps the configured address byte for byte, so a registered redirect URI still matches', () => {
+    // Providers compare redirect URIs as exact strings: no port dropped, no case changed.
+    expect(oidcRedirectUri('https://Hexis.Example.com:443/base')).toBe(
+      'https://Hexis.Example.com:443/base/api/auth/oidc/callback',
+    );
+  });
+});
+
+/**
+ * The provider is registered once at boot and reads its configuration on every
+ * use, so SSO saved on a running deployment — or changed on one — applies to
+ * the next sign-in without a restart.
+ */
+describe('OidcAuthProvider — live configuration', () => {
+  /** Same in-memory stand-in for `deployment_settings` the settings tests use. */
+  function makeDb() {
+    const rows: { key: string; value: string; encrypted: boolean }[] = [];
+    return {
+      select: () => ({ from: () => Promise.resolve(rows.map((r) => ({ ...r }))) }),
+      insert: () => ({
+        values: (v: { key: string; value: string; encrypted: boolean }) => ({
+          onConflictDoUpdate: () => {
+            const existing = rows.find((r) => r.key === v.key);
+            if (existing) Object.assign(existing, v);
+            else rows.push({ key: v.key, value: v.value, encrypted: v.encrypted });
+            return Promise.resolve();
+          },
+        }),
+      }),
+      delete: () => ({ where: () => Promise.resolve() }),
+    } as unknown as Database;
+  }
+
+  let savedEnv: NodeJS.ProcessEnv;
+  beforeEach(() => {
+    savedEnv = { ...process.env };
+    for (const def of CORE_SETTINGS) delete process.env[def.envVar];
+  });
+  afterEach(() => {
+    process.env = savedEnv;
+  });
+
+  /** The real auth router over real settings, with an overlay plugin beside OIDC. */
+  async function boot(fetchImpl: typeof fetch = makeIdpFetch().impl) {
+    const settings = new DeploymentSettingsService(makeDb(), randomBytes(32).toString('base64'));
+    const overlay: AuthProviderPlugin = {
+      key: 'microsoft',
+      label: 'Sign in with Microsoft',
+      startPath: '/api/auth/microsoft/login',
+      mountRoutes: () => {},
+    };
+    const oidc = new OidcAuthProvider({
+      settings: () => oidcSettingsFrom(settings),
+      publicBackendUrl: 'http://localhost:3001',
+      publicFrontendUrl: 'http://localhost:5173',
+      cookieSecure: false,
+      fetchImpl,
+    });
+    const app = express();
+    app.use(express.json());
+    app.use(
+      '/api',
+      createAuthRoutes(authService, (_req, _res, next) => next(), [overlay, oidc]),
+    );
+    const base = await listen(app);
+    const probe = async () =>
+      ((await (await fetch(`${base}/api/auth/providers`)).json()) as {
+        sso: { key: string; label: string; startPath: string }[];
+      }).sso;
+    return { base, settings, probe };
+  }
+
+  it('is advertised only once issuer, client id and secret are all configured', async () => {
+    const { settings, probe } = await boot();
+    expect((await probe()).map((p) => p.key)).toEqual(['microsoft']);
+
+    await settings.save({ oidcIssuerUrl: ISSUER, oidcClientId: 'client-1' }, null);
+    expect((await probe()).map((p) => p.key)).toEqual(['microsoft']);
+
+    await settings.save({ oidcClientSecret: 'secret-1' }, null);
+    expect(await probe()).toEqual([
+      { key: 'microsoft', label: 'Sign in with Microsoft', startPath: '/api/auth/microsoft/login' },
+      { key: 'oidc', label: 'Single sign-on', startPath: '/api/auth/oidc/login' },
+    ]);
+  });
+
+  it('login while unconfigured sends the browser back to sign-in with an error, not a 500', async () => {
+    const idp = makeIdpFetch();
+    const { base, settings } = await boot(idp.impl);
+    await settings.save({ oidcIssuerUrl: ISSUER, oidcClientId: 'client-1' }, null);
+    const res = await fetch(`${base}/api/auth/oidc/login`, { redirect: 'manual' });
+    expect(res.status).toBe(302);
+    expect(res.headers.get('location')).toBe(
+      'http://localhost:5173/auth/oidc/callback#error=not_configured',
+    );
+    expect(idp.calls).toEqual([]);
+  });
+
+  it('reads the label and scopes live, and a saved configuration starts a working sign-in', async () => {
+    const { base, settings, probe } = await boot();
+    await settings.save(
+      { oidcIssuerUrl: ISSUER, oidcClientId: 'client-1', oidcClientSecret: 'secret-1' },
+      null,
+    );
+    await settings.save({ oidcProviderLabel: 'Company SSO', oidcScopes: 'openid email' }, null);
+    expect((await probe()).find((p) => p.key === 'oidc')?.label).toBe('Company SSO');
+
+    const start = await fetch(`${base}/api/auth/oidc/login`, { redirect: 'manual' });
+    const location = new URL(start.headers.get('location')!);
+    expect(location.origin + location.pathname).toBe(DISCOVERY.authorization_endpoint);
+    expect(location.searchParams.get('scope')).toBe('openid email');
+    expect(location.searchParams.get('client_id')).toBe('client-1');
+
+    await settings.save({ oidcProviderLabel: 'Acme login', oidcClientId: 'client-2' }, null);
+    expect((await probe()).find((p) => p.key === 'oidc')?.label).toBe('Acme login');
+    const again = await fetch(`${base}/api/auth/oidc/login`, { redirect: 'manual' });
+    expect(new URL(again.headers.get('location')!).searchParams.get('client_id')).toBe('client-2');
+  });
+
+  it('re-discovers a changed issuer instead of reusing the old document', async () => {
+    const OTHER = 'https://other-idp.example.com';
+    const discovered: string[] = [];
+    const fetchImpl = vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      discovered.push(url);
+      const issuer = url.replace('/.well-known/openid-configuration', '');
+      return new Response(
+        JSON.stringify({
+          authorization_endpoint: `${issuer}/authorize`,
+          token_endpoint: `${issuer}/token`,
+          userinfo_endpoint: `${issuer}/userinfo`,
+        }),
+        { status: 200 },
+      );
+    }) as unknown as typeof fetch;
+    const { base, settings } = await boot(fetchImpl);
+    await settings.save(
+      { oidcIssuerUrl: ISSUER, oidcClientId: 'client-1', oidcClientSecret: 'secret-1' },
+      null,
+    );
+    const login = async () =>
+      new URL(
+        (await fetch(`${base}/api/auth/oidc/login`, { redirect: 'manual' })).headers.get(
+          'location',
+        )!,
+      ).origin;
+
+    expect(await login()).toBe(ISSUER);
+    expect(await login()).toBe(ISSUER);
+    expect(discovered).toHaveLength(1); // cached while the issuer is unchanged
+
+    await settings.save({ oidcIssuerUrl: `${OTHER}/` }, null);
+    expect(await login()).toBe(OTHER);
+    expect(discovered).toEqual([
+      `${ISSUER}/.well-known/openid-configuration`,
+      `${OTHER}/.well-known/openid-configuration`,
+    ]);
+  });
+
+  it('exchanges the code with a rotated client secret on the next sign-in', async () => {
+    const idp = makeIdpFetch();
+    const { base, settings } = await boot(idp.impl);
+    await settings.save(
+      { oidcIssuerUrl: ISSUER, oidcClientId: 'client-1', oidcClientSecret: 'secret-1' },
+      null,
+    );
+    const signIn = async () => {
+      const start = await fetch(`${base}/api/auth/oidc/login`, { redirect: 'manual' });
+      const state = new URL(start.headers.get('location')!).searchParams.get('state')!;
+      const cookie = start.headers.get('set-cookie')!.split(';')[0];
+      const cb = await fetch(`${base}/api/auth/oidc/callback?code=code-1&state=${state}`, {
+        redirect: 'manual',
+        headers: { cookie },
+      });
+      expect(cb.headers.get('location')).toContain('#token=');
+      const exchange = idp.calls.filter((c) => c.url === DISCOVERY.token_endpoint).at(-1)!;
+      return (exchange.init!.headers as Record<string, string>).Authorization;
+    };
+    const basic = (secret: string) =>
+      `Basic ${Buffer.from(`client-1:${secret}`).toString('base64')}`;
+
+    expect(await signIn()).toBe(basic('secret-1'));
+    await settings.save({ oidcClientSecret: 'secret-2' }, null);
+    expect(await signIn()).toBe(basic('secret-2'));
+  });
+
+  it('shares one discovery fetch between concurrent sign-ins', async () => {
+    const idp = makeIdpFetch();
+    // A slow issuer, so every sign-in arrives while discovery is still in flight.
+    const slow = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      return idp.impl(input, init);
+    }) as typeof fetch;
+    const { base, settings } = await boot(slow);
+    await settings.save(
+      { oidcIssuerUrl: ISSUER, oidcClientId: 'client-1', oidcClientSecret: 'secret-1' },
+      null,
+    );
+    const starts = await Promise.all(
+      Array.from({ length: 5 }, () => fetch(`${base}/api/auth/oidc/login`, { redirect: 'manual' })),
+    );
+    for (const res of starts) {
+      expect(new URL(res.headers.get('location')!).origin).toBe(ISSUER);
+    }
+    expect(idp.calls.filter((c) => c.url.endsWith('/openid-configuration'))).toHaveLength(1);
+  });
+
+  it('re-discovers the original issuer when switched back after a failed change', async () => {
+    const BROKEN = 'https://broken-idp.example.com';
+    const discovered: string[] = [];
+    const fetchImpl = vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      discovered.push(url);
+      if (url.startsWith(BROKEN)) return new Response('down', { status: 503 });
+      return new Response(JSON.stringify(DISCOVERY), { status: 200 });
+    }) as unknown as typeof fetch;
+    const { base, settings } = await boot(fetchImpl);
+    await settings.save(
+      { oidcIssuerUrl: ISSUER, oidcClientId: 'client-1', oidcClientSecret: 'secret-1' },
+      null,
+    );
+    const login = async () =>
+      (await fetch(`${base}/api/auth/oidc/login`, { redirect: 'manual' })).headers.get('location')!;
+
+    expect(await login()).toContain(DISCOVERY.authorization_endpoint);
+    await settings.save({ oidcIssuerUrl: BROKEN }, null);
+    expect(await login()).toBe('http://localhost:5173/auth/oidc/callback#error=start');
+    await settings.save({ oidcIssuerUrl: ISSUER }, null);
+    expect(await login()).toContain(DISCOVERY.authorization_endpoint);
+    expect(discovered).toEqual([
+      `${ISSUER}/.well-known/openid-configuration`,
+      `${BROKEN}/.well-known/openid-configuration`,
+      `${ISSUER}/.well-known/openid-configuration`,
+    ]);
+  });
+
+  it('keeps an environment-configured provider exactly as the environment says', async () => {
+    process.env.OIDC_ISSUER_URL = ISSUER;
+    process.env.OIDC_CLIENT_ID = 'env-client';
+    process.env.OIDC_CLIENT_SECRET = 'env-secret';
+    process.env.OIDC_PROVIDER_LABEL = 'Env SSO';
+    const { base, settings, probe } = await boot();
+    expect((await probe()).find((p) => p.key === 'oidc')?.label).toBe('Env SSO');
+
+    // A UI save cannot override an environment value — it is refused outright.
+    await expect(settings.save({ oidcClientId: 'ui-client' }, null)).rejects.toThrow();
+    // …while a setting the environment left unset is still a fallback.
+    await settings.save({ oidcScopes: 'openid email profile offline_access' }, null);
+
+    const start = await fetch(`${base}/api/auth/oidc/login`, { redirect: 'manual' });
+    const location = new URL(start.headers.get('location')!);
+    expect(location.searchParams.get('client_id')).toBe('env-client');
+    expect(location.searchParams.get('scope')).toBe('openid email profile offline_access');
+  });
+});
+
+describe('oidcSettingsFrom', () => {
+  const from = (values: Record<string, string>) =>
+    oidcSettingsFrom({ resolve: (key) => values[key] ?? '' });
+
+  it('is null until issuer, client id and secret are all set', () => {
+    expect(from({})).toBeNull();
+    expect(from({ oidcIssuerUrl: ISSUER, oidcClientId: 'c' })).toBeNull();
+    expect(from({ oidcClientId: 'c', oidcClientSecret: 's' })).toBeNull();
+  });
+
+  it('fills the scope and label defaults and strips a trailing slash from the issuer', () => {
+    expect(from({ oidcIssuerUrl: `${ISSUER}//`, oidcClientId: 'c', oidcClientSecret: 's' })).toEqual({
+      issuerUrl: ISSUER,
+      clientId: 'c',
+      clientSecret: 's',
+      scopes: 'openid profile email',
+      label: 'Single sign-on',
+    });
+  });
 });

package/src/modules/auth/__tests__/onboarding-done.route.test.ts

@@ -142,6 +142,8 @@ describe('POST /auth/onboarding-done', () => {
     const body = (await res.json()) as { error: string };
     expect(body.error).toBe('Could not save that');
     expect(body.error).not.toContain(detail);
-    expect(logged).toHaveBeenCalledWith('Onboarding-done error:', detail);
+    // Logged through the port: the console sink prefixes the module tag and
+    // carries the detail as a field, still server-side only.
+    expect(logged).toHaveBeenCalledWith('[auth] Onboarding-done error:', { detail });
   });
 });

package/src/modules/auth/account-erasure.service.ts

@@ -1,6 +1,10 @@
 import { randomUUID } from 'node:crypto';
-import { eq } from 'drizzle-orm';
+import { logger } from '../../shared/logging.js';
+
+const log = logger('account-erasure');
+import { and, eq, notExists } from 'drizzle-orm';
 import type { Database } from '../database/connection.js';
+import type { IReviewWorkflowService } from '../workflow/review-workflow/review-workflow.interface.js';
 import {
   changeRequests,
   externalApiKeys,
@@ -8,12 +12,23 @@ import {
   oauthAuthCodes,
   oauthTokens,
   pendingCommits,
+  pluginJoinRequests,
   prComments,
   prFileApprovals,
   prMergeLog,
   users,
 } from '../database/schema.js';
 
+/** The anonymised id of one erasure — how a commit or log may name the account. */
+export function erasedAccountId(erasureId: string): string {
+  return `deleted-${erasureId}`;
+}
+
+/** The placeholder email anonymised audit rows carry for one erasure. */
+export function erasedEmailFor(erasureId: string): string {
+  return `${erasedAccountId(erasureId)}@erased.invalid`;
+}
+
 /** A user row as the admin surface needs it (no avatar, no timestamps churn). */
 export interface AdminUserView {
   id: string;
@@ -86,13 +101,24 @@ export interface IErasureParticipant {
  */
 export interface IAccountErasureService {
   listUsers(): Promise<AdminUserView[]>;
-  /** Erase `userId`. Returns false when no such user exists. */
-  eraseUser(userId: string): Promise<boolean>;
+  /**
+   * Erase `userId`. Returns false when no such user exists. `erasureId` fixes
+   * the anonymised identity (`deleted-<erasureId>@erased.invalid`) so a caller
+   * can name the erased account elsewhere — e.g. a commit message — without
+   * the email; random when omitted.
+   */
+  eraseUser(userId: string, opts?: { erasureId?: string }): Promise<boolean>;
 }
 
 export class AccountErasureService implements IAccountErasureService {
   constructor(
     private readonly db: Database,
+    /**
+     * The review workflow owns the approvals and the lock their writers take,
+     * so it does the rewrite (see `IReviewWorkflowService.eraseApprover`);
+     * this module only decides WHEN, inside its own transaction.
+     */
+    private readonly reviewWorkflow: Pick<IReviewWorkflowService, 'eraseApprover'>,
     private readonly participants: IErasureParticipant[] = [],
   ) {}
 
@@ -104,14 +130,14 @@ export class AccountErasureService implements IAccountErasureService {
     return rows.map((r) => ({ ...r, createdAt: r.createdAt.getTime() }));
   }
 
-  async eraseUser(userId: string): Promise<boolean> {
+  async eraseUser(userId: string, opts: { erasureId?: string } = {}): Promise<boolean> {
     const [user] = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
     if (!user) return false;
 
     const target: ErasureTarget = {
       userId,
       email: user.email.toLowerCase(),
-      erasedEmail: `deleted-${randomUUID()}@erased.invalid`,
+      erasedEmail: erasedEmailFor(opts.erasureId ?? randomUUID()),
       erasedName: 'Deleted user',
     };
 
@@ -133,12 +159,42 @@ export class AccountErasureService implements IAccountErasureService {
 
       // Personal-data rows the core owns.
       await tx.delete(fileLocks).where(eq(fileLocks.holderUserId, userId));
+      // Recorded plugin join requests. DELETED, not anonymised like the audit
+      // rows below: the row carries the person's address and name, it is not
+      // part of the review trail (the change request it opened is, and that
+      // is anonymised with the rest), and the table is unique on
+      // `(requester_email, plugin_key)` — so a row left behind would be
+      // INHERITED by a later account signing in with the same address, which
+      // would see a stranger's request as its own and be unable to make a new
+      // one. Sign-in is get-or-create by email, so that is not hypothetical.
+      //
+      // A JOB MAY BE MID-FLIGHT against one of these rows, and this statement
+      // says nothing to it — it is a background clone and push in another
+      // stack, possibly in another process, with no transaction to join. What
+      // stops it opening a change request in an erased person's name is the
+      // other side of the same delete: the job holds a fencing token from
+      // `plugin_join_requests.claim_token`, it re-beats that claim before the
+      // change request (see `PluginJoinRequestJobs.attempt`), and a beat
+      // against a row that no longer exists matches nothing. The job reads
+      // that as its claim being gone and stops without opening anything or
+      // writing anything back — so no row is resurrected here either.
+      await tx
+        .delete(pluginJoinRequests)
+        .where(eq(pluginJoinRequests.requesterEmail, target.email));
 
       // Audit rows: anonymize in place (no user FK on these; they key by email).
-      await tx
-        .update(prFileApprovals)
-        .set({ approverEmail: target.erasedEmail, approverName: target.erasedName })
-        .where(eq(prFileApprovals.approverEmail, target.email));
+      //
+      // The approvals belong to the review workflow, and so does the lock
+      // their writers take — one of those writers COPIES rows (a change request
+      // bringing itself up to date re-pins the approvals its merge did not
+      // disturb onto the new head), and a copy that read this person's row a
+      // moment before the rewrite would insert their real address back
+      // afterwards. The workflow takes that lock exclusively and rewrites the
+      // rows, in THIS transaction, so it stays held until the erasure commits.
+      await this.reviewWorkflow.eraseApprover(tx, target.email, {
+        email: target.erasedEmail,
+        name: target.erasedName,
+      });
       await tx
         .update(prMergeLog)
         .set({ triggeredByEmail: target.erasedEmail, triggeredByName: target.erasedName })
@@ -173,11 +229,62 @@ export class AccountErasureService implements IAccountErasureService {
       await tx.delete(users).where(eq(users.id, userId));
     });
 
+    // The two second passes below run BEFORE the callbacks, not after them: a
+    // callback talks to an external store and can reject, and the erasure it
+    // would abandon is already committed — `eraseUser` cannot be retried into
+    // it, so a pass sequenced behind a failing callback is a pass that may
+    // never run at all. Nothing here depends on a callback having succeeded.
+
+    // The second pass for the approvals, for the same kind of reason as the one
+    // the change requests already had.
+    //
+    // The lock above orders this erasure against every writer that takes it,
+    // and `approveFile` re-reads the account under that lock before it writes
+    // — so an approval in flight when this commits is refused rather than
+    // landing in the erased name. This is the belt to that pair of braces: it
+    // costs one statement, it is idempotent, and it means the guarantee does
+    // not rest on every future writer of this table remembering the lock. A
+    // row that got in anyway is rewritten here.
+    //
+    // Only while NO account answers to the address, exactly as below: someone
+    // who signs in again at it since the commit is a new person, and the
+    // approvals they make are their own.
+    await this.db
+      .update(prFileApprovals)
+      .set({ approverEmail: target.erasedEmail, approverName: target.erasedName })
+      .where(
+        and(
+          eq(prFileApprovals.approverEmail, target.email),
+          notExists(this.db.select({ id: users.id }).from(users).where(eq(users.email, target.email))),
+        ),
+      );
+
+    // Once more, after the commit, for the one writer that can still be
+    // holding the person's name: a join-request job that confirmed its claim
+    // just before the delete above landed and opened its change request just
+    // after. The delete is what stops it — the next confirmation finds no
+    // row — but the open it was already inside lands in the real name. The
+    // update is idempotent, so a second pass costs one statement and closes
+    // that window for a request that landed by now; the job's own re-check
+    // of the requester right before it opens (see `PluginJoinRequestJobs`)
+    // narrows what can land after. Only while NO account answers to the
+    // address: one made again with the same email since the commit is a new
+    // person, and their requests are their own.
+    await this.db
+      .update(changeRequests)
+      .set({ authorEmail: target.erasedEmail, authorName: target.erasedName })
+      .where(
+        and(
+          eq(changeRequests.authorEmail, target.email),
+          notExists(this.db.select({ id: users.id }).from(users).where(eq(users.email, target.email))),
+        ),
+      );
+
     // Post-commit callbacks (e.g. Mastra memory cleanup for chat threads
     // captured inside the transaction).
     for (const cb of postCommit) await cb();
 
-    console.log(`[account-erasure] erased user id=${userId}`);
+    log.info(`erased user id=${userId}`);
     return true;
   }
 }