@bevel-software/platform-core-backend 0.26.0 → 0.28.0

package/src/modules/auth/__tests__/account-switch-lock.pg.test.ts

@@ -0,0 +1,78 @@
+import { afterAll, describe, expect, it } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import pg from 'pg';
+import { closeDb, createDb, type Database } from '../../database/connection.js';
+import { runCoreMigrations } from '../../database/migrate.js';
+import { coreMigrationsDir } from '../../../assets.js';
+import { PG_ADMIN_URL, PG_TEST_TIMEOUT, dropScratchDatabases, scratchDatabaseUrl } from '../../../__tests__/pg-scratch.js';
+import { WorkflowDomainError } from '../../../shared/domain-errors.js';
+import { AuthService } from '../auth.service.js';
+import { ACCOUNT_BUSY_MESSAGE, takeAccountSwitchLock } from '../account-switch-lock.js';
+
+/**
+ * The account switch lock's promise, against a real Postgres (see
+ * `pg-scratch.ts`): a wait that runs out is a 409 `account-busy`, never the
+ * driver's error. Drizzle wraps that error (the SQLSTATE `55P03` is on its
+ * cause), which no stub of the driver shows, so the contention is real here:
+ * another connection holds the address's lock while the lock is asked for.
+ */
+const KEY = randomBytes(32).toString('base64');
+const open: Database[] = [];
+const holders: pg.Client[] = [];
+
+async function migratedDatabase(): Promise<{ db: Database; url: string }> {
+  const url = await scratchDatabaseUrl('hexis_switch');
+  const db = createDb(url, { piiKey: KEY });
+  open.push(db);
+  await runCoreMigrations(db, coreMigrationsDir());
+  return { db, url };
+}
+
+/** Another connection holding `email`'s switch lock in an open transaction, as a promotion mid-write does. */
+async function holdLock(url: string, email: string): Promise<pg.Client> {
+  const holder = new pg.Client({ connectionString: url });
+  await holder.connect();
+  holders.push(holder);
+  await holder.query('begin');
+  await holder.query('select pg_advisory_xact_lock(hashtext($1))', [`account-switch:${email}`]);
+  return holder;
+}
+
+describe.skipIf(!PG_ADMIN_URL)('the account switch lock under contention, on a real Postgres', () => {
+  afterAll(async () => {
+    for (const holder of holders) await holder.end().catch(() => undefined);
+    for (const db of open) await closeDb(db);
+    await dropScratchDatabases();
+  }, PG_TEST_TIMEOUT);
+
+  it(
+    "answers a wait that runs out as the 409 account-busy, through Drizzle's wrapping",
+    async () => {
+      const { db, url } = await migratedDatabase();
+      const holder = await holdLock(url, 'alice@acme.test');
+      const refusal = db.transaction((tx) => takeAccountSwitchLock(tx, 'Alice@Acme.test', 200));
+      await expect(refusal).rejects.toBeInstanceOf(WorkflowDomainError);
+      await expect(refusal).rejects.toMatchObject({ status: 409, message: ACCOUNT_BUSY_MESSAGE, payload: { kind: 'account-busy' } });
+      // Released, the lock is taken at once.
+      await holder.query('commit');
+      await expect(db.transaction((tx) => takeAccountSwitchLock(tx, 'alice@acme.test', 200))).resolves.toBeUndefined();
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'switching an account off while a promotion holds its lock is refused as account-busy, and changes nothing',
+    async () => {
+      const { db, url } = await migratedDatabase();
+      const auth = new AuthService(db, { jwtSecret: 'test-jwt-secret', adminEmail: '', adminPassword: '', allowedEmailDomains: [] });
+      const { user } = await auth.createAccountWithoutPassword('lee@acme.test', 'Lee');
+      const holder = await holdLock(url, 'lee@acme.test');
+      // The real wait (15 s): what an admin's switch-off meets.
+      await expect(auth.deactivate(user.id)).rejects.toMatchObject({ status: 409, payload: { kind: 'account-busy' } });
+      await holder.query('commit');
+      const [lee] = (await auth.listAccounts()).filter((a) => a.email === 'lee@acme.test');
+      expect(lee?.deactivatedAt).toBeNull();
+    },
+    PG_TEST_TIMEOUT,
+  );
+});

package/src/modules/auth/__tests__/account-switch-lock.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it, vi } from 'vitest';
+import { PgDialect } from 'drizzle-orm/pg-core';
+import type { SQL } from 'drizzle-orm';
+import { WorkflowDomainError } from '../../../shared/domain-errors.js';
+import { ACCOUNT_BUSY_MESSAGE, ACCOUNT_SWITCH_LOCK_WAIT_MS, takeAccountSwitchLock } from '../account-switch-lock.js';
+
+/** A transaction handle that records what it ran, and fails the lock statement when told to. */
+function fakeTx(failLockWith?: { code: string; message: string }) {
+  const dialect = new PgDialect();
+  const ran: string[] = [];
+  const execute = vi.fn(async (query: SQL) => {
+    const { sql, params } = dialect.sqlToQuery(query);
+    ran.push(`${sql} ${JSON.stringify(params)}`);
+    if (failLockWith && sql.includes('pg_advisory_xact_lock')) {
+      throw Object.assign(new Error(failLockWith.message), { code: failLockWith.code });
+    }
+    return [];
+  });
+  return { tx: { execute }, ran };
+}
+
+describe('takeAccountSwitchLock', () => {
+  it('bounds the wait with a transaction-local lock_timeout, set before the lock is asked for', async () => {
+    const { tx, ran } = fakeTx();
+    await takeAccountSwitchLock(tx, 'Alice@Example.com');
+    expect(ran).toEqual([
+      `select set_config('lock_timeout', $1, true) ["${ACCOUNT_SWITCH_LOCK_WAIT_MS}"]`,
+      'select pg_advisory_xact_lock(hashtext($1)) ["account-switch:alice@example.com"]',
+    ]);
+  });
+
+  it('answers a wait that ran out as a 409 account-busy, in the words the admin is told', async () => {
+    const { tx } = fakeTx({ code: '55P03', message: 'canceling statement due to lock timeout' });
+    const refusal = takeAccountSwitchLock(tx, 'alice@example.com');
+    await expect(refusal).rejects.toBeInstanceOf(WorkflowDomainError);
+    await expect(refusal).rejects.toMatchObject({ status: 409, message: ACCOUNT_BUSY_MESSAGE, payload: { kind: 'account-busy' } });
+  });
+
+  it('lets any other failure of the lock through unchanged', async () => {
+    const { tx } = fakeTx({ code: '57P01', message: 'terminating connection due to administrator command' });
+    await expect(takeAccountSwitchLock(tx, 'alice@example.com')).rejects.toThrow('terminating connection');
+  });
+});

package/src/modules/auth/__tests__/account.routes.test.ts

@@ -2,8 +2,10 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import express from 'express';
 import type { Server } from 'node:http';
 import { createAccountRoutes } from '../account.routes.js';
+import type { AccountInvitedEvent } from '../account-hooks.js';
 import { AuthService } from '../auth.service.js';
 import { AccountAdmissionRefusedError, AccountChangeRefusedError } from '../account-admission.js';
+import { WorkflowDomainError } from '../../../shared/domain-errors.js';
 import { hashPassword } from '../password-hash.js';
 import type { Database } from '../../database/connection.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';
@@ -13,8 +15,18 @@ const authService = {
     { id: 'u1', email: 'a@example.com', name: 'A', hasPassword: true, createdAt: new Date() },
   ]),
   createAccount: vi.fn(async (email: string) => ({ id: 'u2', email, name: 'B' })),
+  createAccountWithoutPassword: vi.fn(async (email: string) => ({ user: { id: 'u2', email, name: 'B' }, created: true })),
+  createAccountWithStartingPassword: vi.fn(async (email: string) => ({
+    user: { id: 'u2', email, name: 'B' },
+    created: false,
+    passwordSet: false,
+    deactivated: false,
+  })),
   deactivate: vi.fn(async (userId: string) => userId !== 'missing'),
   reactivate: vi.fn(async (userId: string) => userId !== 'missing'),
+  getUserById: vi.fn(async (id: string) => (id === 'missing' ? null : { id, email: `${id}@example.com`, name: id })),
+  isOwnerEmail: vi.fn((email: string) => email.trim().toLowerCase() === 'root@example.com'),
+  assertDeletable: vi.fn(() => {}),
 } as unknown as AuthService;
 
 // Satisfies the route's narrow Pick<IAccountErasureService, 'eraseUser'>
@@ -23,6 +35,11 @@ const accountErasure = {
   eraseUser: vi.fn<(userId: string, opts?: { erasureId?: string }) => Promise<boolean>>(async () => true),
 };
 
+/** The invite listeners: nobody registered unless a test says so (see "an invite tells the listeners"). */
+const accountHooks = {
+  runAccountInvited: vi.fn<(event: AccountInvitedEvent) => Promise<string[]>>(async () => []),
+};
+
 function makeApp(opts: { admin: boolean; email?: string }) {
   const adminAccess: IAdminAccessService = {
     isAdmin: vi.fn(async () => opts.admin),
@@ -36,7 +53,7 @@ function makeApp(opts: { admin: boolean; email?: string }) {
     req.userEmail = opts.email ?? 'caller@example.com';
     next();
   });
-  app.use('/api', createAccountRoutes(authService, adminAccess, accountErasure));
+  app.use('/api', createAccountRoutes(authService, adminAccess, accountErasure, accountHooks));
   return app;
 }
 
@@ -67,6 +84,8 @@ describe('account routes — admin gate', () => {
       body: JSON.stringify({ email: 'x@example.com', password: 'long-enough-pw' }),
     });
     expect(create.status).toBe(403);
+    // Not an admission refusal: nothing here may read as "no seat left".
+    expect(await create.json()).toEqual({ error: 'Admins only' });
     expect(authService.createAccount).not.toHaveBeenCalled();
   });
 
@@ -86,6 +105,155 @@ describe('account routes — admin gate', () => {
     expect(authService.createAccount).toHaveBeenCalledWith('b@example.com', 'B', 'long-enough-pw');
   });
 
+  it('gives an invite\'s starting password through the keep-existing path, and says whether it was set', async () => {
+    const base = await listen(makeApp({ admin: true }));
+    const create = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'b@example.com', password: 'long-enough-pw', keepExistingPassword: true }),
+    });
+    expect(create.status).toBe(201);
+    expect(await create.json()).toEqual({
+      id: 'u2',
+      email: 'b@example.com',
+      name: 'B',
+      passwordSet: false,
+      deactivated: false,
+      notified: [],
+    });
+    expect(authService.createAccountWithStartingPassword).toHaveBeenCalledWith('b@example.com', 'long-enough-pw');
+    expect(authService.createAccount).not.toHaveBeenCalled();
+    // The account was already there: nobody is told of an invitation.
+    expect(accountHooks.runAccountInvited).not.toHaveBeenCalled();
+
+    const without = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'b@example.com', keepExistingPassword: true }),
+    });
+    expect(without.status).toBe(400);
+
+    // Anything but a boolean fails closed — never the overwriting path.
+    for (const keepExistingPassword of ['true', 1, null, {}]) {
+      const odd = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'b@example.com', password: 'long-enough-pw', keepExistingPassword }),
+      });
+      expect(odd.status).toBe(400);
+      expect(await odd.json()).toEqual({ error: 'keepExistingPassword must be a boolean' });
+    }
+    expect(authService.createAccount).not.toHaveBeenCalled();
+  });
+
+  describe('an invite tells the listeners, and the answer says who was told', () => {
+    afterEach(() => {
+      vi.mocked(accountHooks.runAccountInvited).mockReset().mockResolvedValue([]);
+      vi.mocked(authService.createAccountWithStartingPassword).mockClear();
+      vi.mocked(authService.createAccountWithoutPassword).mockClear();
+    });
+
+    it('a NEW account with a starting password: once, with the account, the admin and the fact of the password, never the password', async () => {
+      vi.mocked(authService.createAccountWithStartingPassword).mockResolvedValueOnce({
+        user: { id: 'u-new', email: 'new@example.com', name: 'new' },
+        created: true,
+        passwordSet: true,
+        deactivated: false,
+      });
+      vi.mocked(accountHooks.runAccountInvited).mockResolvedValueOnce(['email']);
+      const base = await listen(makeApp({ admin: true }));
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'new@example.com', password: 'long-enough-pw', keepExistingPassword: true }),
+      });
+      expect(res.status).toBe(201);
+      expect(await res.json()).toEqual({
+        id: 'u-new',
+        email: 'new@example.com',
+        name: 'new',
+        passwordSet: true,
+        deactivated: false,
+        notified: ['email'],
+      });
+      expect(accountHooks.runAccountInvited).toHaveBeenCalledTimes(1);
+      const [event] = vi.mocked(accountHooks.runAccountInvited).mock.calls[0]!;
+      expect(event).toEqual({
+        account: { id: 'u-new', email: 'new@example.com', name: 'new' },
+        // The caller, as the route knows them: `getUserById(req.userId)`.
+        invitedBy: { id: 'u1', email: 'u1@example.com', name: 'u1' },
+        passwordSet: true,
+      });
+      expect(JSON.stringify(event)).not.toContain('long-enough-pw');
+    });
+
+    it('when the inviting admin cannot be read, the invite still goes out, naming them by address', async () => {
+      vi.mocked(authService.getUserById).mockRejectedValueOnce(new Error('users table is away'));
+      vi.mocked(accountHooks.runAccountInvited).mockResolvedValueOnce(['email']);
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      try {
+        const base = await listen(makeApp({ admin: true }));
+        const res = await fetch(`${base}/api/admin/accounts`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email: 'b@example.com' }),
+        });
+        expect(res.status).toBe(201);
+        expect(await res.json()).toEqual({ id: 'u2', email: 'b@example.com', name: 'B', notified: ['email'] });
+        expect(accountHooks.runAccountInvited).toHaveBeenCalledWith(
+          expect.objectContaining({ invitedBy: { id: 'u1', email: 'caller@example.com', name: '' } }),
+        );
+      } finally {
+        warn.mockRestore();
+      }
+    });
+
+    it('a NEW account for single sign-on (no password) goes through the same seam, with passwordSet false', async () => {
+      vi.mocked(accountHooks.runAccountInvited).mockResolvedValueOnce(['email', 'chat']);
+      const base = await listen(makeApp({ admin: true }));
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'b@example.com', name: 'B' }),
+      });
+      expect(res.status).toBe(201);
+      expect(await res.json()).toEqual({ id: 'u2', email: 'b@example.com', name: 'B', notified: ['email', 'chat'] });
+      expect(authService.createAccountWithoutPassword).toHaveBeenCalledWith('b@example.com', 'B');
+      expect(authService.createAccount).not.toHaveBeenCalled();
+      expect(accountHooks.runAccountInvited).toHaveBeenCalledWith(
+        expect.objectContaining({ account: { id: 'u2', email: 'b@example.com', name: 'B' }, passwordSet: false }),
+      );
+    });
+
+    it('an account that was already there is not an invitation: the listeners are not run', async () => {
+      vi.mocked(authService.createAccountWithoutPassword).mockResolvedValueOnce({
+        user: { id: 'u2', email: 'b@example.com', name: 'B' },
+        created: false,
+      });
+      const base = await listen(makeApp({ admin: true }));
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'b@example.com' }),
+      });
+      expect(res.status).toBe(201);
+      expect(await res.json()).toEqual({ id: 'u2', email: 'b@example.com', name: 'B', notified: [] });
+      expect(accountHooks.runAccountInvited).not.toHaveBeenCalled();
+    });
+
+    it('a set or reset password (a password without keepExistingPassword) is not an invitation either', async () => {
+      const base = await listen(makeApp({ admin: true }));
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'b@example.com', password: 'long-enough-pw' }),
+      });
+      expect(res.status).toBe(201);
+      expect(await res.json()).toEqual({ id: 'u2', email: 'b@example.com', name: 'B' });
+      expect(accountHooks.runAccountInvited).not.toHaveBeenCalled();
+    });
+  });
+
   it('list reports hasPassword + isEnvAdmin and never carries a hash or password', async () => {
     const passwordHash = await hashPassword('stored-password-1');
     const rows = [
@@ -111,7 +279,7 @@ describe('account routes — admin gate', () => {
       req.userEmail = 'caller@example.com';
       next();
     });
-    app.use('/api', createAccountRoutes(realAuth, { isAdmin: async () => true }, accountErasure));
+    app.use('/api', createAccountRoutes(realAuth, { isAdmin: async () => true }, accountErasure, accountHooks));
     const base = await listen(app);
 
     const res = await fetch(`${base}/api/admin/accounts`);
@@ -151,7 +319,7 @@ describe('account routes — admin gate', () => {
     expect(accountErasure.eraseUser).toHaveBeenLastCalledWith('u2');
   });
 
-  it('an account the admission port refuses → 403 carrying the port\'s own words', async () => {
+  it('an account the admission port refuses → 403 carrying the port\'s own words, marked as an admission refusal', async () => {
     const base = await listen(makeApp({ admin: true }));
     vi.mocked(authService.createAccount).mockRejectedValueOnce(
       new AccountAdmissionRefusedError('No seat left on this plan'),
@@ -162,7 +330,7 @@ describe('account routes — admin gate', () => {
       body: JSON.stringify({ email: 'b@example.com', password: 'long-enough-pw' }),
     });
     expect(refused.status).toBe(403);
-    expect(((await refused.json()) as { error: string }).error).toBe('No seat left on this plan');
+    expect(await refused.json()).toEqual({ error: 'No seat left on this plan', kind: 'admission' });
   });
 
   it('erasure failure → 500 with a generic body (no internal error text)', async () => {
@@ -231,7 +399,7 @@ describe('account routes — removing the erased address from access files', ()
       req.userEmail = 'caller@example.com';
       next();
     });
-    app.use('/api', createAccountRoutes(auth, { isAdmin: async () => true }, accountErasure, accessRemoval));
+    app.use('/api', createAccountRoutes(auth, { isAdmin: async () => true }, accountErasure, accountHooks, accessRemoval));
     return { app, accessRemoval };
   }
 
@@ -370,15 +538,30 @@ describe('account routes — switching an account off and on', () => {
     const base = await listen(makeApp({ admin: true }));
     const res = await post(base, 'u2/reactivate');
     expect(res.status).toBe(403);
-    expect(((await res.json()) as { error: string }).error).toBe('All 3 seats are taken');
+    expect(await res.json()).toEqual({ error: 'All 3 seats are taken', kind: 'admission' });
+  });
+
+  it('answers a switch lock that timed out with the 409 account-busy the lock promises, not a 500', async () => {
+    vi.mocked(authService.deactivate).mockRejectedValueOnce(
+      new WorkflowDomainError('Another change to this account is still being saved; try again in a moment.', 409, {
+        kind: 'account-busy',
+      }),
+    );
+    const base = await listen(makeApp({ admin: true }));
+    const res = await post(base, 'u2/deactivate');
+    expect(res.status).toBe(409);
+    expect(await res.json()).toEqual({
+      error: 'Another change to this account is still being saved; try again in a moment.',
+      kind: 'account-busy',
+    });
   });
 
-  it('answers a refused deactivation (the deployment admin, say) with 400 and the reason', async () => {
-    vi.mocked(authService.deactivate).mockRejectedValueOnce(new AccountChangeRefusedError('The deployment admin cannot be switched off'));
+  it('answers a refused deactivation (the owner, say) with 400 and the reason', async () => {
+    vi.mocked(authService.deactivate).mockRejectedValueOnce(new AccountChangeRefusedError("The owner can't be switched off."));
     const base = await listen(makeApp({ admin: true }));
     const res = await post(base, 'u2/deactivate');
     expect(res.status).toBe(400);
-    expect(((await res.json()) as { error: string }).error).toContain('deployment admin');
+    expect(((await res.json()) as { error: string }).error).toBe("The owner can't be switched off.");
   });
 
   it('answers an unexpected failure with a 500 that names nothing of it', async () => {
@@ -407,3 +590,198 @@ describe('account routes — switching an account off and on', () => {
     expect(authService.createAccount).not.toHaveBeenCalled();
   });
 });
+
+/**
+ * The owner (`ADMIN_EMAIL`) through the accounts API, against a real
+ * AuthService, on a deployment with a server-held owner password
+ * (self-hosted) and one without (the cloud's configuration). The refusals
+ * live on the server, so they hold for every caller, not only the page.
+ */
+describe('account routes — the owner cannot be locked out', () => {
+  const OWNER_ROW = {
+    id: 'owner',
+    email: 'root@example.com',
+    name: 'Root',
+    avatarUrl: null,
+    onboardingDone: true,
+    passwordHash: null,
+    deactivatedAt: null,
+    createdAt: new Date(),
+  };
+  const OTHER_ROW = { ...OWNER_ROW, id: 'u2', email: 'lee@example.com', name: 'Lee' };
+
+  /**
+   * Every read answers with `row`; every write is recorded. A switch-off runs
+   * in a transaction that first takes the address's switch lock (see
+   * account-switch-lock), so the handle a transaction hands out reads, locks
+   * and writes like the plain one.
+   */
+  function fakeDb(row: typeof OWNER_ROW) {
+    const updates: unknown[] = [];
+    const chain = (result: unknown): Record<string, unknown> => {
+      const c: Record<string, unknown> = {};
+      for (const k of ['from', 'where', 'limit', 'set', 'values', 'returning', 'onConflictDoUpdate']) c[k] = () => c;
+      c.then = (ok: (v: unknown) => unknown, ko: (e: unknown) => unknown) => Promise.resolve(result).then(ok, ko);
+      return c;
+    };
+    const handle = {
+      select: () => chain([row]),
+      update: () => {
+        updates.push(row.id);
+        return chain([]);
+      },
+      execute: async () => [],
+    };
+    const db = {
+      ...handle,
+      transaction: async <T,>(cb: (tx: typeof handle) => Promise<T>) => cb(handle),
+    } as unknown as Database;
+    return { db, updates };
+  }
+
+  function makeOwnerApp(adminPassword: string, row: typeof OWNER_ROW, opts: { loginPasswordEnabled?: boolean } = {}) {
+    const { db, updates } = fakeDb(row);
+    const realAuth = new AuthService(db, {
+      jwtSecret: 'test-jwt-secret',
+      adminEmail: 'root@example.com',
+      adminPassword,
+      allowedEmailDomains: [],
+      loginPasswordEnabled: opts.loginPasswordEnabled,
+    });
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+      req.userId = 'second-admin';
+      req.userEmail = 'second-admin@example.com';
+      next();
+    });
+    app.use('/api', createAccountRoutes(realAuth, { isAdmin: async () => true }, accountErasure, accountHooks));
+    return { app, updates };
+  }
+
+  const CONFIGS = [
+    ['with a server-held owner password', 'sup3r-secret'],
+    ['without one (the cloud)', ''],
+  ] as const;
+
+  for (const [label, adminPassword] of CONFIGS) {
+    it(`refuses to switch the owner off, ${label}, and says why`, async () => {
+      const { app, updates } = makeOwnerApp(adminPassword, OWNER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts/owner/deactivate`, { method: 'POST' });
+      expect(res.status).toBe(400);
+      expect(await res.json()).toEqual({ error: "The owner can't be switched off." });
+      expect(updates).toEqual([]);
+    });
+
+    it(`switches off an account that is not the owner as today, ${label}`, async () => {
+      const { app, updates } = makeOwnerApp(adminPassword, OTHER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts/u2/deactivate`, { method: 'POST' });
+      expect(res.status).toBe(204);
+      expect(updates).toEqual(['u2']);
+    });
+
+    it(`deletes an account that is not the owner as today, ${label}`, async () => {
+      const { app } = makeOwnerApp(adminPassword, OTHER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts/u2`, { method: 'DELETE' });
+      expect(res.status).toBe(204);
+      expect(accountErasure.eraseUser).toHaveBeenLastCalledWith('u2');
+    });
+
+    it(`lists the owner as one, ${label}`, async () => {
+      const { app } = makeOwnerApp(adminPassword, OWNER_ROW);
+      const base = await listen(app);
+      const body = (await (await fetch(`${base}/api/admin/accounts`)).json()) as {
+        accounts: Array<{ isOwner: boolean; ownerCanBeDeleted: boolean }>;
+      };
+      expect(body.accounts[0]).toMatchObject({ isOwner: true, ownerCanBeDeleted: adminPassword !== '' });
+    });
+
+    it(`refuses another admin setting the owner's password, ${label}`, async () => {
+      const { app } = makeOwnerApp(adminPassword, OWNER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'Root@Example.com', password: 'long-enough-pw' }),
+      });
+      expect(res.status).toBe(400);
+      expect(((await res.json()) as { error: string }).error).toMatch(/^The owner's password can't be set by another admin/);
+    });
+
+    it(`answers an email that is not text with a 400, not a crash, ${label}`, async () => {
+      const { app } = makeOwnerApp(adminPassword, OWNER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: { evil: true }, password: 'long-enough-pw' }),
+      });
+      expect(res.status).toBe(400);
+    });
+  }
+
+  it("lets another admin create the owner's account with an empty password, which means none", async () => {
+    const base = await listen(makeApp({ admin: true }));
+    const res = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'root@example.com', password: '' }),
+    });
+    expect(res.status).toBe(201);
+    expect(authService.createAccountWithoutPassword).toHaveBeenCalledWith('root@example.com', undefined);
+  });
+
+  it("refuses to delete the owner's account where they could not sign back in (the cloud): nothing is erased", async () => {
+    const { app } = makeOwnerApp('', OWNER_ROW);
+    const base = await listen(app);
+    for (const query of ['', '?removeFromAccess=1']) {
+      const res = await fetch(`${base}/api/admin/accounts/owner${query}`, { method: 'DELETE' });
+      expect(res.status).toBe(400);
+      expect(await res.json()).toEqual({ error: "The owner's account can't be deleted: they would have no way to sign in." });
+    }
+    expect(accountErasure.eraseUser).not.toHaveBeenCalled();
+  });
+
+  it('refuses it too where the server holds a password but password sign-in is off', async () => {
+    const { app } = makeOwnerApp('sup3r-secret', OWNER_ROW, { loginPasswordEnabled: false });
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/owner`, { method: 'DELETE' });
+    expect(res.status).toBe(400);
+    expect(accountErasure.eraseUser).not.toHaveBeenCalled();
+  });
+
+  it("deletes the owner's account as today where they can sign back in with the server's password", async () => {
+    const { app } = makeOwnerApp('sup3r-secret', OWNER_ROW);
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/owner`, { method: 'DELETE' });
+    expect(res.status).toBe(204);
+    expect(accountErasure.eraseUser).toHaveBeenLastCalledWith('owner');
+  });
+
+  it("still lets the owner's account be (re)created without a password, so an admin can restore it", async () => {
+    vi.mocked(authService.createAccountWithoutPassword).mockClear();
+    const base = await listen(makeApp({ admin: true }));
+    const res = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'root@example.com', name: 'Root' }),
+    });
+    expect(res.status).toBe(201);
+    expect(authService.createAccountWithoutPassword).toHaveBeenCalledWith('root@example.com', 'Root');
+  });
+
+  it('leaves the owner setting their own password through the same call to the service', async () => {
+    vi.mocked(authService.createAccount).mockClear();
+    const base = await listen(makeApp({ admin: true, email: 'root@example.com' }));
+    const res = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'root@example.com', password: 'long-enough-pw' }),
+    });
+    expect(res.status).toBe(201);
+    expect(authService.createAccount).toHaveBeenCalledWith('root@example.com', undefined, 'long-enough-pw');
+  });
+});