@bevel-software/platform-core-backend 0.22.0 → 0.23.0

package/src/modules/access/access-control.service.ts

@@ -5,7 +5,7 @@ import { logger } from '../../shared/logging.js';
 const log = logger('access');
 
 import { isAbsence, type ITreeWalker, type WalkListener } from '../../shared/fs.contract.js';
-import { isGitTimeout, type IGitRunner } from '../../shared/git.contract.js';
+import { assertOneSpecPerLine, isGitTimeout, type IGitRunner } from '../../shared/git.contract.js';
 import { hashEmail } from '../../shared/email-identity.js';
 import { NodeGitRunner } from '../workflow/git/node-git-runner.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
@@ -19,6 +19,7 @@ import type {
   GrantSource,
   GrantSources,
   PathHolders,
+  PathVerbs,
   ProspectiveHolders,
   ResolvedPrincipal,
 } from './access-control.interface.js';
@@ -31,7 +32,6 @@ import {
 } from '@bevel-software/platform-shared';
 import type { KbContext } from '../../shared/kb-context.js';
 import { AccessConfigError, AccessUnreadableError } from '../access-model/access-errors.js';
-import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { synthesizePluginPrincipals } from '../access-model/plugin-principals.js';
 import {
   GROUPS_YAML,
@@ -81,6 +81,12 @@ async function catFileBatch(
 ): Promise<(string | null)[]> {
   // Bytes, not text: every `<size>` in the header counts bytes, and the walk
   // below has to step by that count through content that is not all ASCII.
+  // One spec per LINE is the protocol, and this walk depends on getting back
+  // exactly as many answers as it sent: a spec carrying a line break would
+  // insert an extra answer and shift every result after it, so each directory
+  // would be handed the NEXT one's `access.md`. Paths are refused a control
+  // character at the normaliser; this is the fence at the protocol.
+  assertOneSpecPerLine(specs);
   const { stdout: out } = await runner.run(repoDir, ['cat-file', '--batch'], {
     input: `${specs.join('\n')}\n`,
     encoding: 'buffer',
@@ -951,6 +957,95 @@ function resolveDenialSourcesForVerb(
   return out;
 }
 
+/**
+ * The model as it will be once `fromPath` has been moved or copied to
+ * `toPath`: every `access.md` the operation carries, keyed at the directory
+ * it lands in, since the rules a folder carries travel with its bytes.
+ *
+ * What travels is BYTES, and the name they land under decides what they
+ * govern — `landing` is the caller's answer to that (see
+ * `relocationSubject`), already parsed as the destination path:
+ *
+ * - a FOLDER takes every `access.md` at or under it, each re-keyed to the
+ *   directory it lands in, and `landing` plays no part;
+ * - a FILE governs a directory exactly when it lands as that directory's
+ *   `access.md`, whatever it was called before — a copy `copy_file` allows,
+ *   and one that governs the destination folder the moment it lands. Its key
+ *   is a PARENT directory, never a path under `fromPath`, which is why the
+ *   prefix walk above cannot see it.
+ *
+ * The emptied side is the mirror: an `access.md` that MOVES stops governing
+ * the directory it left, whether or not it governs anything where it lands.
+ *
+ * PREVIEW ONLY. Nothing here reads disk and nothing here decides whether an
+ * operation may run — the gates resolve against the model as it IS. This
+ * answers the other question, the one a dry run asks: what will be true
+ * afterwards. Judging the destination as it stands today is what made a
+ * rename warn about losing the owner access the folder's own `access.md` was
+ * about to hand straight back.
+ *
+ * `sourceRemains` is the difference between a copy and a move: a copy leaves
+ * the rules where they were, a move takes them away. It changes the answer
+ * only when the destination resolves through a directory the source
+ * occupied; nothing else consults those keys.
+ */
+function withRelocatedAccessFiles(
+  model: AccessModel,
+  fromPath: string,
+  toPath: string,
+  opts: { sourceRemains: boolean; sourceIsFolder: boolean; landing?: AccessFile | null },
+): AccessModel {
+  /** Directories the operation takes an `access.md` AWAY from. */
+  const emptied: string[] = [];
+  /** Directories it leaves one IN, with the file as it will be read there. */
+  const landing: { toDir: string; file: AccessFile }[] = [];
+  if (opts.sourceIsFolder) {
+    for (const [dir, file] of model.accessFilesByDir) {
+      if (dir !== fromPath && !dir.startsWith(`${fromPath}/`)) continue;
+      emptied.push(dir);
+      landing.push({ toDir: `${toPath}${dir.slice(fromPath.length)}`, file });
+    }
+  } else {
+    const fromDir = parentDirOf(fromPath);
+    if (isAccessMdPath(fromPath) && model.accessFilesByDir.has(fromDir)) emptied.push(fromDir);
+    if (opts.landing) landing.push({ toDir: parentDirOf(toPath), file: opts.landing });
+  }
+  if (emptied.length === 0 && landing.length === 0) return model;
+  const accessFilesByDir = new Map(model.accessFilesByDir);
+  if (!opts.sourceRemains) for (const dir of emptied) accessFilesByDir.delete(dir);
+  for (const { toDir, file } of landing) {
+    // A directory that already has an `access.md` keeps it. The operation
+    // would be refused for landing on something that exists long before the
+    // two files could meet, so the model must not invent a merge either.
+    if (accessFilesByDir.has(toDir)) continue;
+    accessFilesByDir.set(toDir, {
+      ...file,
+      dir: toDir,
+      path: toDir ? `${toDir}/access.md` : 'access.md',
+    });
+  }
+  return { ...model, accessFilesByDir };
+}
+
+/** The directory a repo-relative file path sits in; `''` for the repo root. */
+function parentDirOf(relativePath: string): string {
+  const cut = relativePath.lastIndexOf('/');
+  return cut === -1 ? '' : relativePath.slice(0, cut);
+}
+
+/**
+ * One file's own-entries, parsed as the path `asName` would be read.
+ *
+ * The same frontmatter means two different things by name: in an `access.md`
+ * it is the FOLDER's rules (and the file governs itself only through the
+ * body format — see {@link accessMdSelfEntries}), and anywhere else it is the
+ * file's own. Which is why a preview must read the bytes as the name they
+ * LAND under, not the one they are leaving.
+ */
+function ownEntriesFromText(text: string, asName: string): OwnEntries | null {
+  return isAccessMdPath(asName) ? accessMdSelfEntries(text) : parseOwnAccessEntries(text);
+}
+
 /**
  * Build the repo-root → path chain of directory scopes that govern
  * `relativePath`, e.g. `Knowledge/Sales/Foo.md` →
@@ -1586,16 +1681,25 @@ export class AccessControlService implements IAccessControl {
   }
 
   /**
-   * The read and write holders of one file at its current path and at a path
-   * it has not moved to yet (see the interface).
+   * The read and write holders of one file or folder at its current path and
+   * at a path it has not moved to yet (see the interface).
+   *
+   * A move changes nothing about what the thing itself carries — a file's
+   * frontmatter and a folder's `access.md` files travel with the bytes — and
+   * everything about the folder chain above it. So the hypothetical side is
+   * the ordinary resolution at the destination path, over what travels:
    *
-   * A move changes nothing about the file's own frontmatter — that travels
-   * with the bytes — and everything about the folder chain above it. So the
-   * hypothetical side is the ordinary resolution with the destination path
-   * substituted: the same model, the same own-entries (read from the SOURCE,
-   * since nothing sits at the destination to read), resolved against the
-   * destination's ancestors. One model load and one file read serve all four
-   * lookups.
+   * - a FILE's own-entries, read from the SOURCE (nothing sits at the
+   *   destination to read) and parsed as the name they LAND under, layered
+   *   over the destination's ancestors — the two sides can differ, because
+   *   the same frontmatter is a folder's rules in an `access.md` and the
+   *   file's own anywhere else;
+   * - a FOLDER's `access.md` files, keyed at the directories they land in,
+   *   and a file landing as a directory's `access.md` at the directory it
+   *   lands in (`withRelocatedAccessFiles`). A folder has no frontmatter of
+   *   its own, so it passes none.
+   *
+   * One model load and one file read serve all four lookups.
    */
   async prospectiveHolders(
     workspaceId: string,
@@ -1604,31 +1708,64 @@ export class AccessControlService implements IAccessControl {
   ): Promise<ProspectiveHolders> {
     const model = await this.loadModel(workspaceId);
     const repoDir = await this.repoDir(workspaceId);
-    // A FILE question only. A folder carries its own `access.md` — which moves
-    // with it and governs everything under it — so resolving it as a file
-    // would read frontmatter it does not have and omit the rules it does,
-    // naming principals that are not the ones a folder move changes. Refuse
-    // rather than answer the wrong question convincingly.
-    //
-    // Only absence is an answer here (see `isAbsence`): a probe that failed on
-    // permissions or I/O does not say "this is a file", and folding it into
-    // one would let the very case above through on an unreadable source.
-    const fromStat = await fs.stat(path.join(repoDir, fromPath)).catch((err: unknown) => {
-      if (isAbsence(err)) return null;
-      throw err;
+    const { isFolder, ownHere, ownThere, landing } =
+      await this.relocationSubject(repoDir, fromPath, toPath);
+    const after = withRelocatedAccessFiles(model, fromPath, toPath, {
+      sourceRemains: false,
+      sourceIsFolder: isFolder,
+      landing,
     });
-    if (fromStat?.isDirectory()) {
-      throw new WorkflowDomainError(
-        'prospective access answers for a file, not a folder',
-        400,
-      );
-    }
-    const own = await this.readOwnEntries(repoDir, fromPath);
-    const holdersAt = (relativePath: string): PathHolders => ({
-      read: eligibleHoldersResolved(model, 'read', relativePath, own),
-      write: eligibleHoldersResolved(model, 'write', relativePath, own),
+    const holdersAt = (m: AccessModel, relativePath: string, own: OwnEntries | null): PathHolders => ({
+      read: eligibleHoldersResolved(m, 'read', relativePath, own),
+      write: eligibleHoldersResolved(m, 'write', relativePath, own),
     });
-    return { before: holdersAt(fromPath), after: holdersAt(toPath) };
+    return {
+      before: holdersAt(model, fromPath, ownHere),
+      after: holdersAt(after, toPath, ownThere),
+    };
+  }
+
+  /**
+   * The caller's own verbs at `toPath` as they will be once `fromPath` has
+   * been moved or copied there (see the interface).
+   *
+   * Identical to asking `canRead`/`canWrite`/`canDownload`/`canOwner` at
+   * `toPath` whenever nothing travels — an ordinary file with no rules of its
+   * own, or a folder with no `access.md` of its own — so the cases this was
+   * not written for answer exactly as they always did.
+   *
+   * What travels is what `prospectiveHolders` says travels, and for the same
+   * reason: the preview and the dialog's holder lists must not disagree about
+   * one move. A file's own-entries come from the SOURCE, where the bytes
+   * carrying them still are — asking the destination, which does not exist
+   * yet, always answered null and so dropped the frontmatter a rename hands
+   * straight back (requirement 6: what the caller has afterwards equals what
+   * the preview said) — and they are parsed as the name they LAND under,
+   * because that is the parse the gates will use a moment later.
+   */
+  async previewAccessAfterRelocation(
+    workspaceId: string,
+    userEmail: string,
+    fromPath: string,
+    toPath: string,
+    opts?: { sourceRemains?: boolean },
+  ): Promise<PathVerbs> {
+    const repoDir = await this.repoDir(workspaceId);
+    const { isFolder, ownThere: own, landing } =
+      await this.relocationSubject(repoDir, fromPath, toPath);
+    const model = withRelocatedAccessFiles(
+      await this.loadModel(workspaceId),
+      fromPath,
+      toPath,
+      { sourceRemains: opts?.sourceRemains === true, sourceIsFolder: isFolder, landing },
+    );
+    const machineOwned = this.machineOwnedWriteRule(userEmail, toPath);
+    return {
+      read: canReadResolved(model, userEmail, toPath, own),
+      write: machineOwned ?? hasPermissionResolved(model, 'write', userEmail, toPath, own),
+      download: hasPermissionResolved(model, 'download', userEmail, toPath, own),
+      owner: hasPermissionResolved(model, 'owner', userEmail, toPath, own),
+    };
   }
 
   async eligibleWriterEmails(
@@ -2219,8 +2356,69 @@ export class AccessControlService implements IAccessControl {
     } catch {
       return null;
     }
-    if (isAccessMdPath(relativePath)) return accessMdSelfEntries(text);
-    return parseOwnAccessEntries(text);
+    return ownEntriesFromText(text, relativePath);
+  }
+
+  /**
+   * What a move or a copy of `fromPath` to `toPath` CARRIES — the one disk
+   * read both preview surfaces need:
+   *
+   * - `isFolder`: the source is a folder, so the `access.md` files under it
+   *   travel, keyed at the directories they land in;
+   * - `ownHere` / `ownThere`: a file's own-entries as the SOURCE's name reads
+   *   them and as the DESTINATION's name will. They differ because the same
+   *   frontmatter means two things by name (see `ownEntriesFromText`), so
+   *   `Sales/access.md` copied to `Legal/rules-copy.md` arrives as an
+   *   ordinary file whose frontmatter is its own — reading it as the source's
+   *   name had the preview contradict the copy it was previewing;
+   * - `landing`: the folder rules the bytes WILL be, when they land under the
+   *   name `access.md`. Parsed as the destination path, so the directory it
+   *   governs is already the right one. An `access.md` that will not parse
+   *   travels as nothing, as the loader treats it.
+   *
+   * `lstat`, not `stat`: a SYMLINK is none of this. `move_file` refuses a
+   * symlink source outright, so a link to a directory must not be previewed
+   * as a folder taking access files along, and nothing is read THROUGH the
+   * link either — the link's target is not what would move.
+   *
+   * Only absence is an answer (see `isAbsence`): a probe that failed on
+   * permissions or I/O does not say "this is a file", and reading a folder as
+   * one would resolve it through frontmatter it does not have.
+   */
+  private async relocationSubject(
+    repoDir: string,
+    fromPath: string,
+    toPath: string,
+  ): Promise<{
+    isFolder: boolean;
+    ownHere: OwnEntries | null;
+    ownThere: OwnEntries | null;
+    landing: AccessFile | null;
+  }> {
+    const nothing = { isFolder: false, ownHere: null, ownThere: null, landing: null };
+    const fromStat = await fs.lstat(path.join(repoDir, fromPath)).catch((err: unknown) => {
+      if (isAbsence(err)) return null;
+      throw err;
+    });
+    if (fromStat?.isSymbolicLink() === true) return nothing;
+    if (fromStat?.isDirectory() === true) return { ...nothing, isFolder: true };
+    // `roles.yaml` carries no own-entries wherever it sits, exactly as
+    // `readOwnEntries` has it; a read that fails for any reason is no rules,
+    // which is what the gates would say about the same file.
+    if (fromPath === 'roles.yaml' || toPath === 'roles.yaml') return nothing;
+    let text: string;
+    try {
+      text = await fs.readFile(path.join(repoDir, fromPath), 'utf-8');
+    } catch {
+      return nothing;
+    }
+    const parsed = isAccessMdPath(toPath) ? parseAccessFile(text, toPath) : null;
+    return {
+      isFolder: false,
+      ownHere: ownEntriesFromText(text, fromPath),
+      ownThere: ownEntriesFromText(text, toPath),
+      landing: parsed?.ok === true ? parsed.file : null,
+    };
   }
 
   /**

package/src/modules/access/access.routes.ts

@@ -368,27 +368,25 @@ export function createAccessRoutes(
   });
 
   /**
-   * GET /api/workspace/:id/access/prospective?from=<file>&toDir=<folder>
+   * GET /api/workspace/:id/access/prospective?from=<file|folder>&toDir=<folder>
    *
-   * Who can open and who can edit one file where it is, and where a move
-   * would put it — `{ before, after }`, each `{ read, write }` lists of
-   * principals named as their grants name them. `toDir` is the destination
-   * FOLDER (`''` is the repo root); the file keeps its name, so the route
-   * derives the destination path itself rather than trusting a second one.
+   * Who can open and who can edit one file OR FOLDER where it is, and where
+   * a move would put it — `{ before, after }`, each `{ read, write }` lists
+   * of principals named as their grants name them. `toDir` is the
+   * destination FOLDER (`''` is the repo root); the thing keeps its name, so
+   * the route derives the destination path itself rather than trusting a
+   * second one.
    *
    * The destination path does not exist yet, which is why this cannot be two
-   * calls to `GET /access`: the resolver is asked for a hypothetical, with
-   * the file's own frontmatter (read where the file actually is) layered over
-   * the destination's folder chain. Nothing is written and nothing is moved.
+   * calls to `GET /access`: the resolver is asked for a hypothetical, over
+   * what the move carries — a file's own frontmatter, or the `access.md`
+   * files inside a folder, at the paths they land on. Nothing is written and
+   * nothing is moved.
    *
    * Gated like the sibling `overrides` route rather than the permissive
-   * `GET /access`: the caller must resolve read on the file being moved. The
-   * lists name people, and someone who cannot see the file has no business
+   * `GET /access`: the caller must resolve read on the thing being moved. The
+   * lists name people, and someone who cannot see it has no business
    * learning who can.
-   *
-   * `from` must be a FILE. A folder carries its own `access.md` and governs
-   * everything under it, which is a different question; the resolver refuses
-   * one with a 400 rather than answering it as if it were a file.
    */
   router.get('/workspace/:id/access/prospective', async (req, res) => {
     const user = await requireUser(req, res);

package/src/modules/agent-instructions/__tests__/agent-instructions.route.test.ts

@@ -31,11 +31,13 @@ async function serve(readPreamble: () => Promise<string | null>): Promise<string
     looksLikeInternalToken: (t: string) => t.startsWith('bit_'),
     verify: (t: string) => (t === INTERNAL_TOKEN ? { userId: 'u-internal' } : null),
   } as unknown as InternalTokenService;
+  // Sessions and internal tokens are accepted only for an account that is on; these are.
   const authService = {
-    verifyToken: (t: string) => {
+    resolveSession: async (t: string) => {
       if (t !== BROWSER_JWT) throw new Error('bad jwt');
       return { userId: 'u-browser' };
     },
+    isActive: async () => true,
   } as unknown as AuthService;
   const app = express();
   app.use('/api', createAgentInstructionsRoutes(createManualAuthMiddleware(externalKeys, internalTokens, authService), readPreamble));

package/src/modules/auth/__tests__/account-deactivation.test.ts

@@ -0,0 +1,252 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { Database } from '../../database/connection.js';
+import type { CoreConfig } from '../../../core-config.js';
+import { AuthService } from '../auth.service.js';
+import {
+  AccountAdmissionRefusedError,
+  AccountChangeRefusedError,
+  AccountDeactivatedError,
+  AuthBackendError,
+  type AccountProvisionReason,
+  type IAccountAdmission,
+} from '../account-admission.js';
+import { hashPassword } from '../password-hash.js';
+import { RECOVERY_BOT_EMAIL } from '../../workflow/recovery-bot.js';
+
+/**
+ * Drizzle chain stub, as in `auth.service.test.ts`: each db.select() /
+ * insert() / update() consumes the next queued result; awaiting any point of
+ * the chain resolves it. Records what was inserted and set.
+ */
+function makeFakeDb(queue: unknown[]) {
+  const captured: { values: Record<string, unknown>[]; set: Record<string, unknown>[] } = { values: [], set: [] };
+  function nextChain(): unknown {
+    const result = queue.shift();
+    const chain: Record<string, unknown> = {};
+    const passthrough = (recorder?: (arg: Record<string, unknown>) => void) =>
+      vi.fn((arg?: unknown) => {
+        recorder?.(arg as Record<string, unknown>);
+        return chain;
+      });
+    Object.assign(chain, {
+      values: passthrough((a) => captured.values.push(a)),
+      set: passthrough((a) => captured.set.push(a)),
+      where: passthrough(),
+      limit: passthrough(),
+      from: passthrough(),
+      orderBy: passthrough(),
+      returning: passthrough(),
+      onConflictDoUpdate: passthrough(),
+      onConflictDoNothing: passthrough(),
+      then: (ok: (v: unknown) => unknown, ko: (e: unknown) => unknown) => Promise.resolve(result).then(ok, ko),
+    });
+    return chain;
+  }
+  const db = {
+    insert: vi.fn(() => nextChain()),
+    select: vi.fn(() => nextChain()),
+    update: vi.fn(() => nextChain()),
+  } as unknown as Database;
+  return { db, captured };
+}
+
+function makeConfig(over: Partial<CoreConfig> = {}): CoreConfig {
+  return { jwtSecret: 'test-jwt-secret', adminEmail: '', adminPassword: '', allowedEmailDomains: [], ...over } as CoreConfig;
+}
+
+const ROW = { id: 'user-1', email: 'alice@example.com', name: 'Alice', avatarUrl: null, onboardingDone: false, deactivatedAt: null };
+const OFF = { ...ROW, deactivatedAt: new Date('2026-09-01') };
+
+function recordingPort(verdict: Awaited<ReturnType<IAccountAdmission['canProvision']>>) {
+  const asked: Array<[string, AccountProvisionReason]> = [];
+  const port: IAccountAdmission = {
+    canProvision: async (email, reason) => {
+      asked.push([email, reason]);
+      return verdict;
+    },
+  };
+  return { port, asked };
+}
+
+describe('signing in with a switched-off account', () => {
+  it('refuses a password sign-in once the password is proven, and says why', async () => {
+    const passwordHash = await hashPassword('a-long-enough-password');
+    const { db } = makeFakeDb([[{ ...OFF, passwordHash }]]);
+    const svc = new AuthService(db, makeConfig());
+    await expect(svc.loginWithPassword('alice@example.com', 'a-long-enough-password')).rejects.toBeInstanceOf(
+      AccountDeactivatedError,
+    );
+  });
+
+  it('gives a wrong password the same answer as for any account, so it reveals nothing', async () => {
+    const passwordHash = await hashPassword('a-long-enough-password');
+    const { db } = makeFakeDb([[{ ...OFF, passwordHash }]]);
+    const svc = new AuthService(db, makeConfig());
+    await expect(svc.loginWithPassword('alice@example.com', 'the-wrong-password')).rejects.toThrow('Invalid credentials');
+  });
+
+  it('refuses a single sign-on sign-in, without issuing a session', async () => {
+    const { db } = makeFakeDb([[OFF]]);
+    const svc = new AuthService(db, makeConfig());
+    await expect(svc.loginWithSso('alice@example.com', 'Alice')).rejects.toBeInstanceOf(AccountDeactivatedError);
+  });
+
+  it('refuses an embed identity', async () => {
+    const { db } = makeFakeDb([[OFF]]);
+    const svc = new AuthService(db, makeConfig());
+    await expect(svc.getOrCreateByEmail('alice@example.com')).rejects.toBeInstanceOf(AccountDeactivatedError);
+  });
+});
+
+describe('a session that outlives a deactivation', () => {
+  it('stops being accepted once the account is switched off', async () => {
+    const { db } = makeFakeDb([[ROW], [{ deactivatedAt: new Date() }]]);
+    const svc = new AuthService(db, makeConfig());
+    const { token } = await svc.loginWithSso('alice@example.com', 'Alice');
+    // The signature alone is still good…
+    expect(svc.verifyToken(token).userId).toBe(ROW.id);
+    // …but the session is not.
+    await expect(svc.resolveSession(token)).rejects.toBeInstanceOf(AccountDeactivatedError);
+  });
+
+  it('is told apart from a refusal when the account cannot be looked up', async () => {
+    const { db } = makeFakeDb([[ROW]]);
+    const svc = new AuthService(db, makeConfig());
+    const { token } = await svc.loginWithSso('alice@example.com', 'Alice');
+    vi.mocked(db.select).mockImplementationOnce(() => {
+      throw new Error('db down');
+    });
+    await expect(svc.resolveSession(token)).rejects.toBeInstanceOf(AuthBackendError);
+  });
+
+  it('is accepted while the account is on', async () => {
+    const { db } = makeFakeDb([[ROW], [{ deactivatedAt: null }]]);
+    const svc = new AuthService(db, makeConfig());
+    const { token } = await svc.loginWithSso('alice@example.com', 'Alice');
+    await expect(svc.resolveSession(token)).resolves.toEqual({ userId: ROW.id, email: ROW.email });
+  });
+});
+
+describe('AuthService.isActive', () => {
+  it('reads once and keeps the answer briefly', async () => {
+    const { db } = makeFakeDb([[{ deactivatedAt: null }]]);
+    const svc = new AuthService(db, makeConfig());
+    expect(await svc.isActive('user-1')).toBe(true);
+    expect(await svc.isActive('user-1')).toBe(true);
+    expect(vi.mocked(db.select)).toHaveBeenCalledTimes(1);
+  });
+
+  it('treats the deployment admin as on whatever its row says, so its rescue session works', async () => {
+    const config = makeConfig({ adminEmail: 'root@example.com', adminPassword: 'sup3r-secret' });
+    const { db } = makeFakeDb([[{ email: 'root@example.com', deactivatedAt: new Date() }]]);
+    expect(await new AuthService(db, config).isActive('root-id')).toBe(true);
+  });
+
+  it('treats an account that no longer exists as off', async () => {
+    const { db } = makeFakeDb([[]]);
+    expect(await new AuthService(db, makeConfig()).isActive('gone')).toBe(false);
+  });
+
+  it('forgets the cached answer when this process switches the account off', async () => {
+    const { db } = makeFakeDb([[{ deactivatedAt: null }], [ROW], [], [{ deactivatedAt: new Date() }]]);
+    const svc = new AuthService(db, makeConfig());
+    expect(await svc.isActive(ROW.id)).toBe(true);
+    expect(await svc.deactivate(ROW.id)).toBe(true);
+    expect(await svc.isActive(ROW.id)).toBe(false);
+  });
+});
+
+describe('AuthService.deactivate', () => {
+  it('records when the account was switched off', async () => {
+    const { db, captured } = makeFakeDb([[ROW], []]);
+    expect(await new AuthService(db, makeConfig()).deactivate(ROW.id)).toBe(true);
+    expect(captured.set[0].deactivatedAt).toBeInstanceOf(Date);
+  });
+
+  it('answers false for an account that does not exist', async () => {
+    const { db } = makeFakeDb([[]]);
+    expect(await new AuthService(db, makeConfig()).deactivate('nobody')).toBe(false);
+  });
+
+  it('refuses the deployment admin, whose environment password is the way back in', async () => {
+    const config = makeConfig({ adminEmail: 'root@example.com', adminPassword: 'sup3r-secret' });
+    const { db } = makeFakeDb([[{ ...ROW, email: 'root@example.com' }]]);
+    await expect(new AuthService(db, config).deactivate(ROW.id)).rejects.toBeInstanceOf(AccountChangeRefusedError);
+    expect(vi.mocked(db.update)).not.toHaveBeenCalled();
+  });
+
+  it('refuses the accounts the platform runs its own work as', async () => {
+    const { db } = makeFakeDb([[{ ...ROW, email: RECOVERY_BOT_EMAIL }]]);
+    await expect(new AuthService(db, makeConfig()).deactivate(ROW.id)).rejects.toThrow('platform itself');
+    expect(vi.mocked(db.update)).not.toHaveBeenCalled();
+  });
+});
+
+describe('AuthService.reactivate', () => {
+  it('asks the admission port, as for a new account, and switches it on when admitted', async () => {
+    const { port, asked } = recordingPort({ ok: true });
+    const { db, captured } = makeFakeDb([[OFF], []]);
+    expect(await new AuthService(db, makeConfig(), port).reactivate(ROW.id)).toBe(true);
+    expect(asked).toEqual([['alice@example.com', 'reactivate']]);
+    expect(captured.set[0].deactivatedAt).toBeNull();
+  });
+
+  it("refuses with the port's words when there is no room, and changes nothing", async () => {
+    const { port } = recordingPort({ ok: false, message: 'All 3 seats are taken' });
+    const { db } = makeFakeDb([[OFF]]);
+    const svc = new AuthService(db, makeConfig(), port);
+    await expect(svc.reactivate(ROW.id)).rejects.toThrow('All 3 seats are taken');
+    expect(vi.mocked(db.update)).not.toHaveBeenCalled();
+  });
+
+  it('does not ask about an account that is already on', async () => {
+    const { port, asked } = recordingPort({ ok: false, message: 'full' });
+    const { db } = makeFakeDb([[ROW]]);
+    expect(await new AuthService(db, makeConfig(), port).reactivate(ROW.id)).toBe(true);
+    expect(asked).toEqual([]);
+  });
+});
+
+describe('a first sign-in the port would rather keep waiting', () => {
+  const waiting = { ok: false as const, message: 'No seat left; the admin can let you in', waitForAdmin: true };
+
+  it('puts the person on file switched off, and still refuses the sign-in', async () => {
+    const { port } = recordingPort(waiting);
+    const { db, captured } = makeFakeDb([[], []]);
+    const svc = new AuthService(db, makeConfig(), port);
+    const err = await svc.loginWithSso('new@example.com', 'New').catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(AccountAdmissionRefusedError);
+    expect((err as AccountAdmissionRefusedError).waitingForAdmin).toBe(true);
+    expect((err as Error).message).toBe(waiting.message);
+    expect(captured.values).toHaveLength(1);
+    expect(captured.values[0]).toMatchObject({ email: 'new@example.com' });
+    expect(captured.values[0].deactivatedAt).toBeInstanceOf(Date);
+  });
+
+  it('is a plain refusal when an admin creates the account', async () => {
+    const { port } = recordingPort(waiting);
+    const { db } = makeFakeDb([[]]);
+    const err = await new AuthService(db, makeConfig(), port)
+      .createAccount('new@example.com', 'New')
+      .catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(AccountAdmissionRefusedError);
+    expect((err as AccountAdmissionRefusedError).waitingForAdmin).toBe(false);
+    expect(vi.mocked(db.insert)).not.toHaveBeenCalled();
+  });
+});
+
+describe('AuthService.createAccount without a password', () => {
+  it('makes an account for single sign-on, with no hash stored', async () => {
+    const { db, captured } = makeFakeDb([[{ ...ROW, passwordHash: null }]]);
+    const user = await new AuthService(db, makeConfig()).createAccount('Alice@Example.com', '');
+    expect(user.email).toBe('alice@example.com');
+    expect(captured.values[0]).toEqual({ email: 'alice@example.com', name: 'alice' });
+  });
+
+  it('asks the admission port, as any new account does', async () => {
+    const { port, asked } = recordingPort({ ok: true });
+    const { db } = makeFakeDb([[], [{ ...ROW, passwordHash: null }]]);
+    await new AuthService(db, makeConfig(), port).createAccount('alice@example.com', 'Alice');
+    expect(asked).toEqual([['alice@example.com', 'admin-create']]);
+  });
+});