@bevel-software/platform-core-backend 0.27.0 → 0.28.0

package/src/modules/auth/__tests__/account.routes.test.ts

@@ -2,8 +2,10 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import express from 'express';
 import type { Server } from 'node:http';
 import { createAccountRoutes } from '../account.routes.js';
+import type { AccountInvitedEvent } from '../account-hooks.js';
 import { AuthService } from '../auth.service.js';
 import { AccountAdmissionRefusedError, AccountChangeRefusedError } from '../account-admission.js';
+import { WorkflowDomainError } from '../../../shared/domain-errors.js';
 import { hashPassword } from '../password-hash.js';
 import type { Database } from '../../database/connection.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';
@@ -13,8 +15,18 @@ const authService = {
     { id: 'u1', email: 'a@example.com', name: 'A', hasPassword: true, createdAt: new Date() },
   ]),
   createAccount: vi.fn(async (email: string) => ({ id: 'u2', email, name: 'B' })),
+  createAccountWithoutPassword: vi.fn(async (email: string) => ({ user: { id: 'u2', email, name: 'B' }, created: true })),
+  createAccountWithStartingPassword: vi.fn(async (email: string) => ({
+    user: { id: 'u2', email, name: 'B' },
+    created: false,
+    passwordSet: false,
+    deactivated: false,
+  })),
   deactivate: vi.fn(async (userId: string) => userId !== 'missing'),
   reactivate: vi.fn(async (userId: string) => userId !== 'missing'),
+  getUserById: vi.fn(async (id: string) => (id === 'missing' ? null : { id, email: `${id}@example.com`, name: id })),
+  isOwnerEmail: vi.fn((email: string) => email.trim().toLowerCase() === 'root@example.com'),
+  assertDeletable: vi.fn(() => {}),
 } as unknown as AuthService;
 
 // Satisfies the route's narrow Pick<IAccountErasureService, 'eraseUser'>
@@ -23,6 +35,11 @@ const accountErasure = {
   eraseUser: vi.fn<(userId: string, opts?: { erasureId?: string }) => Promise<boolean>>(async () => true),
 };
 
+/** The invite listeners: nobody registered unless a test says so (see "an invite tells the listeners"). */
+const accountHooks = {
+  runAccountInvited: vi.fn<(event: AccountInvitedEvent) => Promise<string[]>>(async () => []),
+};
+
 function makeApp(opts: { admin: boolean; email?: string }) {
   const adminAccess: IAdminAccessService = {
     isAdmin: vi.fn(async () => opts.admin),
@@ -36,7 +53,7 @@ function makeApp(opts: { admin: boolean; email?: string }) {
     req.userEmail = opts.email ?? 'caller@example.com';
     next();
   });
-  app.use('/api', createAccountRoutes(authService, adminAccess, accountErasure));
+  app.use('/api', createAccountRoutes(authService, adminAccess, accountErasure, accountHooks));
   return app;
 }
 
@@ -88,6 +105,155 @@ describe('account routes — admin gate', () => {
     expect(authService.createAccount).toHaveBeenCalledWith('b@example.com', 'B', 'long-enough-pw');
   });
 
+  it('gives an invite\'s starting password through the keep-existing path, and says whether it was set', async () => {
+    const base = await listen(makeApp({ admin: true }));
+    const create = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'b@example.com', password: 'long-enough-pw', keepExistingPassword: true }),
+    });
+    expect(create.status).toBe(201);
+    expect(await create.json()).toEqual({
+      id: 'u2',
+      email: 'b@example.com',
+      name: 'B',
+      passwordSet: false,
+      deactivated: false,
+      notified: [],
+    });
+    expect(authService.createAccountWithStartingPassword).toHaveBeenCalledWith('b@example.com', 'long-enough-pw');
+    expect(authService.createAccount).not.toHaveBeenCalled();
+    // The account was already there: nobody is told of an invitation.
+    expect(accountHooks.runAccountInvited).not.toHaveBeenCalled();
+
+    const without = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'b@example.com', keepExistingPassword: true }),
+    });
+    expect(without.status).toBe(400);
+
+    // Anything but a boolean fails closed — never the overwriting path.
+    for (const keepExistingPassword of ['true', 1, null, {}]) {
+      const odd = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'b@example.com', password: 'long-enough-pw', keepExistingPassword }),
+      });
+      expect(odd.status).toBe(400);
+      expect(await odd.json()).toEqual({ error: 'keepExistingPassword must be a boolean' });
+    }
+    expect(authService.createAccount).not.toHaveBeenCalled();
+  });
+
+  describe('an invite tells the listeners, and the answer says who was told', () => {
+    afterEach(() => {
+      vi.mocked(accountHooks.runAccountInvited).mockReset().mockResolvedValue([]);
+      vi.mocked(authService.createAccountWithStartingPassword).mockClear();
+      vi.mocked(authService.createAccountWithoutPassword).mockClear();
+    });
+
+    it('a NEW account with a starting password: once, with the account, the admin and the fact of the password, never the password', async () => {
+      vi.mocked(authService.createAccountWithStartingPassword).mockResolvedValueOnce({
+        user: { id: 'u-new', email: 'new@example.com', name: 'new' },
+        created: true,
+        passwordSet: true,
+        deactivated: false,
+      });
+      vi.mocked(accountHooks.runAccountInvited).mockResolvedValueOnce(['email']);
+      const base = await listen(makeApp({ admin: true }));
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'new@example.com', password: 'long-enough-pw', keepExistingPassword: true }),
+      });
+      expect(res.status).toBe(201);
+      expect(await res.json()).toEqual({
+        id: 'u-new',
+        email: 'new@example.com',
+        name: 'new',
+        passwordSet: true,
+        deactivated: false,
+        notified: ['email'],
+      });
+      expect(accountHooks.runAccountInvited).toHaveBeenCalledTimes(1);
+      const [event] = vi.mocked(accountHooks.runAccountInvited).mock.calls[0]!;
+      expect(event).toEqual({
+        account: { id: 'u-new', email: 'new@example.com', name: 'new' },
+        // The caller, as the route knows them: `getUserById(req.userId)`.
+        invitedBy: { id: 'u1', email: 'u1@example.com', name: 'u1' },
+        passwordSet: true,
+      });
+      expect(JSON.stringify(event)).not.toContain('long-enough-pw');
+    });
+
+    it('when the inviting admin cannot be read, the invite still goes out, naming them by address', async () => {
+      vi.mocked(authService.getUserById).mockRejectedValueOnce(new Error('users table is away'));
+      vi.mocked(accountHooks.runAccountInvited).mockResolvedValueOnce(['email']);
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      try {
+        const base = await listen(makeApp({ admin: true }));
+        const res = await fetch(`${base}/api/admin/accounts`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email: 'b@example.com' }),
+        });
+        expect(res.status).toBe(201);
+        expect(await res.json()).toEqual({ id: 'u2', email: 'b@example.com', name: 'B', notified: ['email'] });
+        expect(accountHooks.runAccountInvited).toHaveBeenCalledWith(
+          expect.objectContaining({ invitedBy: { id: 'u1', email: 'caller@example.com', name: '' } }),
+        );
+      } finally {
+        warn.mockRestore();
+      }
+    });
+
+    it('a NEW account for single sign-on (no password) goes through the same seam, with passwordSet false', async () => {
+      vi.mocked(accountHooks.runAccountInvited).mockResolvedValueOnce(['email', 'chat']);
+      const base = await listen(makeApp({ admin: true }));
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'b@example.com', name: 'B' }),
+      });
+      expect(res.status).toBe(201);
+      expect(await res.json()).toEqual({ id: 'u2', email: 'b@example.com', name: 'B', notified: ['email', 'chat'] });
+      expect(authService.createAccountWithoutPassword).toHaveBeenCalledWith('b@example.com', 'B');
+      expect(authService.createAccount).not.toHaveBeenCalled();
+      expect(accountHooks.runAccountInvited).toHaveBeenCalledWith(
+        expect.objectContaining({ account: { id: 'u2', email: 'b@example.com', name: 'B' }, passwordSet: false }),
+      );
+    });
+
+    it('an account that was already there is not an invitation: the listeners are not run', async () => {
+      vi.mocked(authService.createAccountWithoutPassword).mockResolvedValueOnce({
+        user: { id: 'u2', email: 'b@example.com', name: 'B' },
+        created: false,
+      });
+      const base = await listen(makeApp({ admin: true }));
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'b@example.com' }),
+      });
+      expect(res.status).toBe(201);
+      expect(await res.json()).toEqual({ id: 'u2', email: 'b@example.com', name: 'B', notified: [] });
+      expect(accountHooks.runAccountInvited).not.toHaveBeenCalled();
+    });
+
+    it('a set or reset password (a password without keepExistingPassword) is not an invitation either', async () => {
+      const base = await listen(makeApp({ admin: true }));
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'b@example.com', password: 'long-enough-pw' }),
+      });
+      expect(res.status).toBe(201);
+      expect(await res.json()).toEqual({ id: 'u2', email: 'b@example.com', name: 'B' });
+      expect(accountHooks.runAccountInvited).not.toHaveBeenCalled();
+    });
+  });
+
   it('list reports hasPassword + isEnvAdmin and never carries a hash or password', async () => {
     const passwordHash = await hashPassword('stored-password-1');
     const rows = [
@@ -113,7 +279,7 @@ describe('account routes — admin gate', () => {
       req.userEmail = 'caller@example.com';
       next();
     });
-    app.use('/api', createAccountRoutes(realAuth, { isAdmin: async () => true }, accountErasure));
+    app.use('/api', createAccountRoutes(realAuth, { isAdmin: async () => true }, accountErasure, accountHooks));
     const base = await listen(app);
 
     const res = await fetch(`${base}/api/admin/accounts`);
@@ -233,7 +399,7 @@ describe('account routes — removing the erased address from access files', ()
       req.userEmail = 'caller@example.com';
       next();
     });
-    app.use('/api', createAccountRoutes(auth, { isAdmin: async () => true }, accountErasure, accessRemoval));
+    app.use('/api', createAccountRoutes(auth, { isAdmin: async () => true }, accountErasure, accountHooks, accessRemoval));
     return { app, accessRemoval };
   }
 
@@ -375,12 +541,27 @@ describe('account routes — switching an account off and on', () => {
     expect(await res.json()).toEqual({ error: 'All 3 seats are taken', kind: 'admission' });
   });
 
-  it('answers a refused deactivation (the deployment admin, say) with 400 and the reason', async () => {
-    vi.mocked(authService.deactivate).mockRejectedValueOnce(new AccountChangeRefusedError('The deployment admin cannot be switched off'));
+  it('answers a switch lock that timed out with the 409 account-busy the lock promises, not a 500', async () => {
+    vi.mocked(authService.deactivate).mockRejectedValueOnce(
+      new WorkflowDomainError('Another change to this account is still being saved; try again in a moment.', 409, {
+        kind: 'account-busy',
+      }),
+    );
+    const base = await listen(makeApp({ admin: true }));
+    const res = await post(base, 'u2/deactivate');
+    expect(res.status).toBe(409);
+    expect(await res.json()).toEqual({
+      error: 'Another change to this account is still being saved; try again in a moment.',
+      kind: 'account-busy',
+    });
+  });
+
+  it('answers a refused deactivation (the owner, say) with 400 and the reason', async () => {
+    vi.mocked(authService.deactivate).mockRejectedValueOnce(new AccountChangeRefusedError("The owner can't be switched off."));
     const base = await listen(makeApp({ admin: true }));
     const res = await post(base, 'u2/deactivate');
     expect(res.status).toBe(400);
-    expect(((await res.json()) as { error: string }).error).toContain('deployment admin');
+    expect(((await res.json()) as { error: string }).error).toBe("The owner can't be switched off.");
   });
 
   it('answers an unexpected failure with a 500 that names nothing of it', async () => {
@@ -409,3 +590,198 @@ describe('account routes — switching an account off and on', () => {
     expect(authService.createAccount).not.toHaveBeenCalled();
   });
 });
+
+/**
+ * The owner (`ADMIN_EMAIL`) through the accounts API, against a real
+ * AuthService, on a deployment with a server-held owner password
+ * (self-hosted) and one without (the cloud's configuration). The refusals
+ * live on the server, so they hold for every caller, not only the page.
+ */
+describe('account routes — the owner cannot be locked out', () => {
+  const OWNER_ROW = {
+    id: 'owner',
+    email: 'root@example.com',
+    name: 'Root',
+    avatarUrl: null,
+    onboardingDone: true,
+    passwordHash: null,
+    deactivatedAt: null,
+    createdAt: new Date(),
+  };
+  const OTHER_ROW = { ...OWNER_ROW, id: 'u2', email: 'lee@example.com', name: 'Lee' };
+
+  /**
+   * Every read answers with `row`; every write is recorded. A switch-off runs
+   * in a transaction that first takes the address's switch lock (see
+   * account-switch-lock), so the handle a transaction hands out reads, locks
+   * and writes like the plain one.
+   */
+  function fakeDb(row: typeof OWNER_ROW) {
+    const updates: unknown[] = [];
+    const chain = (result: unknown): Record<string, unknown> => {
+      const c: Record<string, unknown> = {};
+      for (const k of ['from', 'where', 'limit', 'set', 'values', 'returning', 'onConflictDoUpdate']) c[k] = () => c;
+      c.then = (ok: (v: unknown) => unknown, ko: (e: unknown) => unknown) => Promise.resolve(result).then(ok, ko);
+      return c;
+    };
+    const handle = {
+      select: () => chain([row]),
+      update: () => {
+        updates.push(row.id);
+        return chain([]);
+      },
+      execute: async () => [],
+    };
+    const db = {
+      ...handle,
+      transaction: async <T,>(cb: (tx: typeof handle) => Promise<T>) => cb(handle),
+    } as unknown as Database;
+    return { db, updates };
+  }
+
+  function makeOwnerApp(adminPassword: string, row: typeof OWNER_ROW, opts: { loginPasswordEnabled?: boolean } = {}) {
+    const { db, updates } = fakeDb(row);
+    const realAuth = new AuthService(db, {
+      jwtSecret: 'test-jwt-secret',
+      adminEmail: 'root@example.com',
+      adminPassword,
+      allowedEmailDomains: [],
+      loginPasswordEnabled: opts.loginPasswordEnabled,
+    });
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+      req.userId = 'second-admin';
+      req.userEmail = 'second-admin@example.com';
+      next();
+    });
+    app.use('/api', createAccountRoutes(realAuth, { isAdmin: async () => true }, accountErasure, accountHooks));
+    return { app, updates };
+  }
+
+  const CONFIGS = [
+    ['with a server-held owner password', 'sup3r-secret'],
+    ['without one (the cloud)', ''],
+  ] as const;
+
+  for (const [label, adminPassword] of CONFIGS) {
+    it(`refuses to switch the owner off, ${label}, and says why`, async () => {
+      const { app, updates } = makeOwnerApp(adminPassword, OWNER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts/owner/deactivate`, { method: 'POST' });
+      expect(res.status).toBe(400);
+      expect(await res.json()).toEqual({ error: "The owner can't be switched off." });
+      expect(updates).toEqual([]);
+    });
+
+    it(`switches off an account that is not the owner as today, ${label}`, async () => {
+      const { app, updates } = makeOwnerApp(adminPassword, OTHER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts/u2/deactivate`, { method: 'POST' });
+      expect(res.status).toBe(204);
+      expect(updates).toEqual(['u2']);
+    });
+
+    it(`deletes an account that is not the owner as today, ${label}`, async () => {
+      const { app } = makeOwnerApp(adminPassword, OTHER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts/u2`, { method: 'DELETE' });
+      expect(res.status).toBe(204);
+      expect(accountErasure.eraseUser).toHaveBeenLastCalledWith('u2');
+    });
+
+    it(`lists the owner as one, ${label}`, async () => {
+      const { app } = makeOwnerApp(adminPassword, OWNER_ROW);
+      const base = await listen(app);
+      const body = (await (await fetch(`${base}/api/admin/accounts`)).json()) as {
+        accounts: Array<{ isOwner: boolean; ownerCanBeDeleted: boolean }>;
+      };
+      expect(body.accounts[0]).toMatchObject({ isOwner: true, ownerCanBeDeleted: adminPassword !== '' });
+    });
+
+    it(`refuses another admin setting the owner's password, ${label}`, async () => {
+      const { app } = makeOwnerApp(adminPassword, OWNER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'Root@Example.com', password: 'long-enough-pw' }),
+      });
+      expect(res.status).toBe(400);
+      expect(((await res.json()) as { error: string }).error).toMatch(/^The owner's password can't be set by another admin/);
+    });
+
+    it(`answers an email that is not text with a 400, not a crash, ${label}`, async () => {
+      const { app } = makeOwnerApp(adminPassword, OWNER_ROW);
+      const base = await listen(app);
+      const res = await fetch(`${base}/api/admin/accounts`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: { evil: true }, password: 'long-enough-pw' }),
+      });
+      expect(res.status).toBe(400);
+    });
+  }
+
+  it("lets another admin create the owner's account with an empty password, which means none", async () => {
+    const base = await listen(makeApp({ admin: true }));
+    const res = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'root@example.com', password: '' }),
+    });
+    expect(res.status).toBe(201);
+    expect(authService.createAccountWithoutPassword).toHaveBeenCalledWith('root@example.com', undefined);
+  });
+
+  it("refuses to delete the owner's account where they could not sign back in (the cloud): nothing is erased", async () => {
+    const { app } = makeOwnerApp('', OWNER_ROW);
+    const base = await listen(app);
+    for (const query of ['', '?removeFromAccess=1']) {
+      const res = await fetch(`${base}/api/admin/accounts/owner${query}`, { method: 'DELETE' });
+      expect(res.status).toBe(400);
+      expect(await res.json()).toEqual({ error: "The owner's account can't be deleted: they would have no way to sign in." });
+    }
+    expect(accountErasure.eraseUser).not.toHaveBeenCalled();
+  });
+
+  it('refuses it too where the server holds a password but password sign-in is off', async () => {
+    const { app } = makeOwnerApp('sup3r-secret', OWNER_ROW, { loginPasswordEnabled: false });
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/owner`, { method: 'DELETE' });
+    expect(res.status).toBe(400);
+    expect(accountErasure.eraseUser).not.toHaveBeenCalled();
+  });
+
+  it("deletes the owner's account as today where they can sign back in with the server's password", async () => {
+    const { app } = makeOwnerApp('sup3r-secret', OWNER_ROW);
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/owner`, { method: 'DELETE' });
+    expect(res.status).toBe(204);
+    expect(accountErasure.eraseUser).toHaveBeenLastCalledWith('owner');
+  });
+
+  it("still lets the owner's account be (re)created without a password, so an admin can restore it", async () => {
+    vi.mocked(authService.createAccountWithoutPassword).mockClear();
+    const base = await listen(makeApp({ admin: true }));
+    const res = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'root@example.com', name: 'Root' }),
+    });
+    expect(res.status).toBe(201);
+    expect(authService.createAccountWithoutPassword).toHaveBeenCalledWith('root@example.com', 'Root');
+  });
+
+  it('leaves the owner setting their own password through the same call to the service', async () => {
+    vi.mocked(authService.createAccount).mockClear();
+    const base = await listen(makeApp({ admin: true, email: 'root@example.com' }));
+    const res = await fetch(`${base}/api/admin/accounts`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: 'root@example.com', password: 'long-enough-pw' }),
+    });
+    expect(res.status).toBe(201);
+    expect(authService.createAccount).toHaveBeenCalledWith('root@example.com', undefined, 'long-enough-pw');
+  });
+});

package/src/modules/auth/__tests__/auth.service.created.pg.test.ts

@@ -0,0 +1,69 @@
+import { afterAll, describe, expect, it } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { closeDb, createDb, type Database } from '../../database/connection.js';
+import { runCoreMigrations } from '../../database/migrate.js';
+import { coreMigrationsDir } from '../../../assets.js';
+import { PG_ADMIN_URL, PG_TEST_TIMEOUT, dropScratchDatabases, scratchDatabaseUrl } from '../../../__tests__/pg-scratch.js';
+import { AuthService } from '../auth.service.js';
+
+/**
+ * Whether an account is NEW is answered by the upsert's own returned row,
+ * through Postgres's `xmax = 0` (see `CREATED` in auth.service.ts): zero on
+ * a row the statement inserted, set on one its `ON CONFLICT DO UPDATE`
+ * touched. No stub can stand in for that, so this crosses a real Postgres
+ * (see `pg-scratch.ts`): the invite's notification hangs on the answer, and
+ * a wrong one would either tell nobody or tell the same person twice.
+ */
+const KEY = randomBytes(32).toString('base64');
+const open: Database[] = [];
+
+async function migratedDatabase(): Promise<Database> {
+  const db = createDb(await scratchDatabaseUrl('hexis_created'), { piiKey: KEY });
+  open.push(db);
+  await runCoreMigrations(db, coreMigrationsDir());
+  return db;
+}
+
+describe.skipIf(!PG_ADMIN_URL)('whether an account is new, on a real Postgres', () => {
+  afterAll(async () => {
+    for (const db of open) await closeDb(db);
+    await dropScratchDatabases();
+  }, PG_TEST_TIMEOUT);
+
+  it(
+    'says created once per address: the insert, and never the conflict-update after it',
+    async () => {
+      const db = await migratedDatabase();
+      const auth = new AuthService(db, { jwtSecret: 'test-jwt-secret', adminEmail: '', adminPassword: '', allowedEmailDomains: [] });
+
+      // Without a password: the first write inserts, the second only updates.
+      const first = await auth.createAccountWithoutPassword('Lena@Acme.test', 'Lena');
+      expect(first.created).toBe(true);
+      expect(first.user).toMatchObject({ email: 'lena@acme.test', name: 'Lena' });
+      const again = await auth.createAccountWithoutPassword('lena@acme.test', 'Lena Park');
+      expect(again.created).toBe(false);
+      expect(again.user).toMatchObject({ id: first.user.id, name: 'Lena Park' });
+
+      // With a starting password: a new address is created with it...
+      const tom = await auth.createAccountWithStartingPassword('tom@acme.test', 'welcome-to-acme');
+      expect(tom).toMatchObject({ created: true, passwordSet: true, deactivated: false });
+      // ...an account that has a password keeps it, and is not new...
+      const tomAgain = await auth.createAccountWithStartingPassword('tom@acme.test', 'another-password');
+      expect(tomAgain).toMatchObject({ created: false, passwordSet: false, deactivated: false });
+      expect(tomAgain.user.id).toBe(tom.user.id);
+      // ...and an existing account with none gets it, through the conflict
+      // update: a password was set, and the account is still not new.
+      const lenaPassword = await auth.createAccountWithStartingPassword('lena@acme.test', 'welcome-to-acme');
+      expect(lenaPassword).toMatchObject({ created: false, passwordSet: true, deactivated: false });
+      expect(lenaPassword.user.id).toBe(first.user.id);
+
+      // What the rows say agrees: two accounts, both with a password now.
+      const accounts = await auth.listAccounts();
+      expect(accounts.map((a) => [a.email, a.hasPassword]).sort()).toEqual([
+        ['lena@acme.test', true],
+        ['tom@acme.test', true],
+      ]);
+    },
+    PG_TEST_TIMEOUT,
+  );
+});