@bevel-software/platform-core-backend 0.35.0 → 0.36.1

package/src/modules/auth/account-erasure.service.ts

@@ -5,7 +5,7 @@ const log = logger('account-erasure');
 import { and, eq, notExists } from 'drizzle-orm';
 import { isEncryptedBlob } from '../../shared/column-crypto.js';
 import type { Database } from '../database/index.js';
-import type { IReviewWorkflowService } from '../workflow/index.js';
+import type { IChangeRequestReviewService } from '../version-control/index.js';
 import {
   changeRequests,
   externalApiKeys,
@@ -114,14 +114,32 @@ export class AccountErasureService implements IAccountErasureService {
   constructor(
     private readonly db: Database,
     /**
-     * The review workflow owns the approvals and the lock their writers take,
-     * so it does the rewrite (see `IReviewWorkflowService.eraseApprover`);
+     * The change-request review owns the approvals and the lock their writers take,
+     * so it does the rewrite (see `IChangeRequestReviewService.eraseApprover`);
      * this module only decides WHEN, inside its own transaction.
      */
-    private readonly reviewWorkflow: Pick<IReviewWorkflowService, 'eraseApprover'>,
+    private readonly changeRequestReview: Pick<IChangeRequestReviewService, 'eraseApprover'>,
+    /**
+     * The distribution's slices (`CorePorts.erasureParticipants`): held by
+     * reference, read at erasure time, so a root may fill the array after
+     * construction.
+     */
     private readonly participants: IErasureParticipant[] = [],
+    /**
+     * Core's own module slices (the vault's managed sign-ins, say), run
+     * BEFORE the distribution's. Kept apart from the port's array so core
+     * never writes into an array it does not own: a root that builds a graph
+     * over the same array more than once would otherwise accumulate every
+     * past graph's slices, each still pointing at that graph's closed pool.
+     */
+    private readonly coreParticipants: IErasureParticipant[] = [],
   ) {}
 
+  /** Every slice, core's first, as it is at erasure time. */
+  private allParticipants(): IErasureParticipant[] {
+    return [...this.coreParticipants, ...this.participants];
+  }
+
   async listUsers(): Promise<AdminUserView[]> {
     // Sorted in-process: `email` is ciphertext in the database, so ORDER BY
     // would sort by IV noise. One row per team member.
@@ -162,7 +180,7 @@ export class AccountErasureService implements IAccountErasureService {
     // outside the transaction on purpose: external stores are separate
     // systems, and the pre-passes are idempotent, so a failure here leaves a
     // retryable state rather than a half-committed one.
-    for (const p of this.participants) {
+    for (const p of this.allParticipants()) {
       if (p.before) await p.before(target);
     }
 
@@ -209,14 +227,14 @@ export class AccountErasureService implements IAccountErasureService {
 
       // Audit rows: anonymize in place (no user FK on these; they key by email).
       //
-      // The approvals belong to the review workflow, and so does the lock
+      // The approvals belong to the change-request review, and so does the lock
       // their writers take — one of those writers COPIES rows (a change request
       // bringing itself up to date re-pins the approvals its merge did not
       // disturb onto the new head), and a copy that read this person's row a
       // moment before the rewrite would insert their real address back
-      // afterwards. The workflow takes that lock exclusively and rewrites the
+      // afterwards. The version-control service takes that lock exclusively and rewrites the
       // rows, in THIS transaction, so it stays held until the erasure commits.
-      await this.reviewWorkflow.eraseApprover(tx, target.email, {
+      await this.changeRequestReview.eraseApprover(tx, target.email, {
         email: target.erasedEmail,
         name: target.erasedName,
       });
@@ -251,7 +269,7 @@ export class AccountErasureService implements IAccountErasureService {
       // still satisfiable — and so a participant that MISSES rows makes the
       // users delete below fail on its RESTRICT FK, rolling everything back:
       // a loud retry, never a silent orphan.
-      for (const p of this.participants) {
+      for (const p of this.allParticipants()) {
         if (!p.inTransaction) continue;
         const cb = await p.inTransaction(tx, target);
         if (cb) postCommit.push(cb);

package/src/modules/auth/account-hooks.ts

@@ -41,8 +41,27 @@ export interface IAccountHooks {
   onAccountInvited(hook: AccountInvitedHook): void;
   /** Run every listener in registration order; the channels that reached the person, in that order. */
   runAccountInvited(event: AccountInvitedEvent): Promise<string[]>;
+  onAccountDeactivated(hook: AccountDeactivatedHook): void;
+  /** Run every listener in registration order; what each cleaned up, in that order. */
+  runAccountDeactivated(event: AccountDeactivatedEvent): Promise<string[]>;
 }
 
+/**
+ * An admin switched an account off (or a directory told the deployment the
+ * person left). The account keeps its row; what it HOLDS elsewhere — the
+ * sign-ins it made to outside systems — is what listeners let go of.
+ */
+export interface AccountDeactivatedEvent {
+  userId: string;
+  email: string;
+}
+
+/**
+ * A listener answers what it cleaned up — `'managed-connections'`, say — or
+ * null when there was nothing; same rule as {@link AccountInvitedHook}.
+ */
+export type AccountDeactivatedHook = NotifyingListener<AccountDeactivatedEvent>;
+
 export class AccountHooks implements IAccountHooks {
   // The account exists whether or not the person was told: the admin's
   // answer says they were not, and the admin sends the link themselves.
@@ -50,6 +69,13 @@ export class AccountHooks implements IAccountHooks {
     log,
     'an account-invited listener failed; the person was not notified by it:',
   );
+  // The account is off whether or not a listener cleaned up after it: a
+  // failure here is logged, and the sign-ins it left are refused on use
+  // like everything else a deactivated account holds.
+  private readonly deactivated = new ListenerSeam<AccountDeactivatedEvent>(
+    log,
+    'an account-deactivated listener failed; what it cleans up is still there:',
+  );
 
   onAccountInvited(hook: AccountInvitedHook): void {
     this.invited.add(hook);
@@ -58,4 +84,12 @@ export class AccountHooks implements IAccountHooks {
   runAccountInvited(event: AccountInvitedEvent): Promise<string[]> {
     return this.invited.run(event);
   }
+
+  onAccountDeactivated(hook: AccountDeactivatedHook): void {
+    this.deactivated.add(hook);
+  }
+
+  runAccountDeactivated(event: AccountDeactivatedEvent): Promise<string[]> {
+    return this.deactivated.run(event);
+  }
 }

package/src/modules/auth/account-switch-lock.ts

@@ -1,7 +1,7 @@
 import { sql } from 'drizzle-orm';
 import type { Database } from '../database/index.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
-import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { VersionControlDomainError } from '../../shared/domain-errors.js';
 import { pgErrorCode } from '../database/index.js';
 
 /** The handle `db.transaction` hands its callback. */
@@ -51,7 +51,7 @@ export async function takeAccountSwitchLock(
   } catch (err) {
     // Drizzle wraps the driver's error, so the SQLSTATE is on its cause.
     if (pgErrorCode(err) === LOCK_NOT_AVAILABLE) {
-      throw new WorkflowDomainError(ACCOUNT_BUSY_MESSAGE, 409, { kind: 'account-busy' });
+      throw new VersionControlDomainError(ACCOUNT_BUSY_MESSAGE, 409, { kind: 'account-busy' });
     }
     throw err;
   }

package/src/modules/auth/account.routes.ts

@@ -12,7 +12,7 @@ import { erasedAccountId, type IAccountErasureService } from './account-erasure.
 import type { IAdminAccessService } from '../admin/index.js';
 import type { UserAccessRemovalService } from '../access/index.js';
 import { sendError } from '../access/index.js';
-import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { VersionControlDomainError } from '../../shared/domain-errors.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
 import './auth.middleware.js'; // Express Request augmentation
 
@@ -42,8 +42,13 @@ export function createAccountRoutes(
   >,
   adminAccess: IAdminAccessService,
   accountErasure: Pick<IAccountErasureService, 'eraseUser'>,
-  /** Who tells an invited person (see {@link IAccountHooks}); core registers nobody. */
-  accountHooks: Pick<IAccountHooks, 'runAccountInvited'>,
+  /**
+   * Who tells an invited person, and who cleans up after an account is
+   * switched off (see {@link IAccountHooks}); core registers nobody for
+   * either. A distribution registers what it holds for a person elsewhere
+   * (its managed-connector sign-ins, say) where it builds that.
+   */
+  accountHooks: Pick<IAccountHooks, 'runAccountInvited' | 'runAccountDeactivated'>,
   accessRemoval?: Pick<UserAccessRemovalService, 'report' | 'assertRemovable' | 'remove' | 'filesNaming'>,
 ): express.Router {
   const router = express.Router();
@@ -176,11 +181,24 @@ export function createAccountRoutes(
       return;
     }
     try {
+      // Read before the switch, so the listeners get the address the account
+      // had; the row keeps it either way, so a failed read is tried once more
+      // after the switch, and never costs the switch-off itself.
+      let target = await authService.getUserById(userId).catch(() => undefined);
       if (!(await authService.deactivate(userId))) {
         res.status(404).json({ error: 'No such user' });
         return;
       }
       log.info('account audit:', { action: 'deactivate', actorUserId: req.userId, targetUserId: userId });
+      if (!target) target = await authService.getUserById(userId).catch(() => undefined);
+      if (!target) {
+        log.warn('account deactivated, but its address could not be read for the listeners', { targetUserId: userId });
+      }
+      // What the account HELD elsewhere — the sign-ins it made to outside
+      // systems — is let go of now rather than left to lapse. Awaited, so
+      // the admin's answer means it: a listener that fails is logged by the
+      // seam and never fails the switch-off that already happened.
+      await accountHooks.runAccountDeactivated({ userId, email: target?.email ?? '' });
       res.status(204).end();
     } catch (error) {
       if (error instanceof AccountChangeRefusedError) {
@@ -191,7 +209,7 @@ export function createAccountRoutes(
       // invite's promotion committing roles.yaml, say): the 409 the lock
       // promises, with its words, so the admin tries again rather than
       // reading an outage.
-      if (error instanceof WorkflowDomainError) {
+      if (error instanceof VersionControlDomainError) {
         res.status(error.status).json({ error: error.message, ...(error.payload ?? {}) });
         return;
       }
@@ -343,7 +361,7 @@ export function createAccountRoutes(
         log.warn(`could not list the files still naming erased account ${accountId}: ${errorText(scanErr)}`);
       }
       const message =
-        err instanceof WorkflowDomainError && err.status < 500
+        err instanceof VersionControlDomainError && err.status < 500
           ? err.message
           : 'The change to roles, groups and access rules could not be committed.';
       res.json({ erased: true, accessRemoval: { ok: false, error: message, removedFrom: [], stillNamedIn } });

package/src/modules/auth/auth.service.ts

@@ -20,11 +20,11 @@ import {
   timingSafeStringEqual,
   MIN_PASSWORD_LENGTH,
 } from './password-hash.js';
-import { RECOVERY_BOT_EMAIL } from '../workflow/index.js';
+import { RECOVERY_BOT_EMAIL } from '../version-control/index.js';
 import { DIRECTORY_SYNC_BOT_EMAIL } from '../access/index.js';
 import { takeAccountSwitchLock } from './account-switch-lock.js';
 import type { IAccountSwitchGuard } from './account-switch-guard.js';
-import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { VersionControlDomainError } from '../../shared/domain-errors.js';
 
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
@@ -895,7 +895,7 @@ export class AuthService implements IAccountSwitchGuard {
         .from(users)
         .where(eq(users.emailBidx, canonicalEmail(email)));
       if (account?.deactivatedAt) {
-        throw new WorkflowDomainError('This account is switched off', 409, { kind: 'deactivated' });
+        throw new VersionControlDomainError('This account is switched off', 409, { kind: 'deactivated' });
       }
       await write();
     });
@@ -965,7 +965,7 @@ export class AuthService implements IAccountSwitchGuard {
 
   /**
    * The live accounts behind a set of addresses — the approvers of a change
-   * request just opened, which the workflow module hands to the deployment's
+   * request just opened, which the version-control module hands to the deployment's
    * notification listeners as people with accounts (`ApproverAccounts`).
    *
    * One indexed read through the email's blind index, never a scan of every

package/src/modules/auth/index.ts

@@ -32,3 +32,4 @@ import './auth.middleware.js';
 // Reached by other modules; exported here so they stop importing the files.
 export type { IAccountSwitchGuard } from './account-switch-guard.js';
 export type { AuthService } from './auth.service.js';
+export type { IAccountErasureService } from './account-erasure.service.js';

package/src/modules/database/__tests__/advisory-lock.test.ts

@@ -1,169 +1,169 @@
-import { describe, it, expect } from 'vitest';
-import { AdvisoryLock, advisoryLockKey, withAdvisoryLock } from '../advisory-lock.js';
-import type { Database } from '../connection.js';
-
-/**
- * A pool whose connections record what was asked of them. The SQL a lock
- * issues IS its observable behaviour — there is nothing else to see from
- * outside — so these suites drive `withAdvisoryLock` with a crafted pool and
- * read back the statements and the release.
- */
-interface RecordedClient {
-  queries: string[];
-  released: boolean;
-  releasedWith: Error | undefined;
-}
-
-function fakePool(opts: { failOn?: (sql: string) => Error; hangOn?: (sql: string) => boolean } = {}) {
-  const clients: RecordedClient[] = [];
-  const pool = {
-    async connect() {
-      const record: RecordedClient = { queries: [], released: false, releasedWith: undefined };
-      clients.push(record);
-      return {
-        async query(sql: string) {
-          record.queries.push(sql);
-          // A statement the database never answers: the promise stays pending.
-          if (opts.hangOn?.(sql)) return new Promise<never>(() => undefined);
-          const failure = opts.failOn?.(sql);
-          if (failure) throw failure;
-          return { rows: [] };
-        },
-        release(err?: Error) {
-          record.released = true;
-          record.releasedWith = err;
-        },
-      };
-    },
-  };
-  return { clients, db: { $client: pool } as unknown as Database };
-}
-
-/** The error shape `pg` raises when `lock_timeout` expires. */
-function lockTimeoutError(): Error {
-  return Object.assign(new Error('canceling statement due to lock timeout'), { code: '55P03' });
-}
-
-describe('withAdvisoryLock', () => {
-  it('holds the lock across the callback and releases it by ending the transaction', async () => {
-    const { clients, db } = fakePool();
-    let queriesWhenBodyRan: string[] = [];
-
-    const result = await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-      queriesWhenBodyRan = [...clients[0].queries];
-      return 'migrated';
-    });
-
-    expect(result).toBe('migrated');
-    // The lock is taken before the body starts...
-    expect(queriesWhenBodyRan.some((q) => q.includes('pg_advisory_xact_lock'))).toBe(true);
-    expect(queriesWhenBodyRan).not.toContain('rollback');
-    // ...and the transaction that holds it ends after the body, which is what
-    // releases both the lock and the transaction-local lock_timeout.
-    expect(clients[0].queries.at(-1)).toBe('rollback');
-    expect(clients[0].released).toBe(true);
-    expect(clients[0].releasedWith).toBeUndefined();
-  });
-
-  it('bounds the wait rather than blocking the boot forever', async () => {
-    const { clients, db } = fakePool();
-
-    await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => undefined, { waitMs: 1234 });
-
-    // Transaction-local, so the setting leaves with the transaction and the
-    // connection goes back to the pool as it arrived.
-    const setTimeoutCall = clients[0].queries.find((q) => q.includes('set_config'));
-    expect(setTimeoutCall).toContain('lock_timeout');
-    expect(setTimeoutCall).toContain('true');
-  });
-
-  it('releases the lock when the callback throws, and propagates the failure', async () => {
-    const { clients, db } = fakePool();
-    const boom = new Error('migration 0004 failed');
-
-    await expect(
-      withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-        throw boom;
-      }),
-    ).rejects.toBe(boom);
-
-    expect(clients[0].queries.at(-1)).toBe('rollback');
-    expect(clients[0].released).toBe(true);
-  });
-
-  it('never runs the callback when the lock cannot be taken in time', async () => {
-    const { clients, db } = fakePool({
-      failOn: (sql) => (sql.includes('pg_advisory_xact_lock') ? lockTimeoutError() : undefined!),
-    });
-    let ran = false;
-
-    await expect(
-      withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-        ran = true;
-      }),
-    ).rejects.toThrow(/Migrations advisory lock/);
-
-    expect(ran).toBe(false);
-    // Still cleaned up: a failed acquire leaves an open transaction behind
-    // otherwise, and the connection would carry it back into the pool.
-    expect(clients[0].queries.at(-1)).toBe('rollback');
-    expect(clients[0].released).toBe(true);
-  });
-
-  it('fails the boot, and destroys the connection without rolling back, when the database stops answering', async () => {
-    // The socket is up, the server is gone: `begin` never returns. Waiting on
-    // a rollback would queue behind it and hang the boot after all.
-    const { clients, db } = fakePool({ hangOn: (sql) => sql === 'begin' });
-    let ran = false;
-    await expect(
-      withAdvisoryLock(
-        db,
-        AdvisoryLock.Migrations,
-        async () => {
-          ran = true;
-        },
-        { waitMs: 20 },
-      ),
-    ).rejects.toThrow(/did not answer/);
-    expect(ran).toBe(false);
-    expect(clients[0].queries).not.toContain('rollback');
-    expect(clients[0].released).toBe(true);
-    expect(clients[0].releasedWith).toBeInstanceOf(Error);
-  });
-
-  it('destroys a connection it could not roll back instead of pooling it', async () => {
-    const { clients, db } = fakePool({
-      failOn: (sql) => (sql === 'rollback' ? new Error('connection terminated') : undefined!),
-    });
-
-    await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => undefined);
-
-    // Releasing with an error is how `pg` is told to discard the connection.
-    // Ending its session is also what actually releases a lock we may still
-    // be holding, so this path is the fallback for the rollback itself failing.
-    expect(clients[0].released).toBe(true);
-    expect(clients[0].releasedWith).toBeInstanceOf(Error);
-  });
-});
-
-describe('advisoryLockKey', () => {
-  it('keeps the ids a single-tenant deployment always used when no tenant is named', () => {
-    expect(advisoryLockKey(AdvisoryLock.Migrations)).toBe(AdvisoryLock.Migrations);
-    expect(advisoryLockKey(AdvisoryLock.CommitWorker, '')).toBe(AdvisoryLock.CommitWorker);
-  });
-
-  it('gives each tenant its own key for each lock, stable across calls and inside int4', () => {
-    const a = advisoryLockKey(AdvisoryLock.CommitWorker, 't_acme');
-    const b = advisoryLockKey(AdvisoryLock.CommitWorker, 't_globex');
-    expect(a).toBe(advisoryLockKey(AdvisoryLock.CommitWorker, 't_acme'));
-    expect(a).not.toBe(b);
-    expect(a).not.toBe(AdvisoryLock.CommitWorker);
-    // The two locks of one tenant stay two locks.
-    expect(advisoryLockKey(AdvisoryLock.Migrations, 't_acme')).not.toBe(a);
-    for (const key of [a, b]) {
-      expect(Number.isInteger(key)).toBe(true);
-      expect(key).toBeGreaterThanOrEqual(-(2 ** 31));
-      expect(key).toBeLessThanOrEqual(2 ** 31 - 1);
-    }
-  });
-});
+import { describe, it, expect } from 'vitest';
+import { AdvisoryLock, advisoryLockKey, withAdvisoryLock } from '../advisory-lock.js';
+import type { Database } from '../connection.js';
+
+/**
+ * A pool whose connections record what was asked of them. The SQL a lock
+ * issues IS its observable behaviour — there is nothing else to see from
+ * outside — so these suites drive `withAdvisoryLock` with a crafted pool and
+ * read back the statements and the release.
+ */
+interface RecordedClient {
+  queries: string[];
+  released: boolean;
+  releasedWith: Error | undefined;
+}
+
+function fakePool(opts: { failOn?: (sql: string) => Error; hangOn?: (sql: string) => boolean } = {}) {
+  const clients: RecordedClient[] = [];
+  const pool = {
+    async connect() {
+      const record: RecordedClient = { queries: [], released: false, releasedWith: undefined };
+      clients.push(record);
+      return {
+        async query(sql: string) {
+          record.queries.push(sql);
+          // A statement the database never answers: the promise stays pending.
+          if (opts.hangOn?.(sql)) return new Promise<never>(() => undefined);
+          const failure = opts.failOn?.(sql);
+          if (failure) throw failure;
+          return { rows: [] };
+        },
+        release(err?: Error) {
+          record.released = true;
+          record.releasedWith = err;
+        },
+      };
+    },
+  };
+  return { clients, db: { $client: pool } as unknown as Database };
+}
+
+/** The error shape `pg` raises when `lock_timeout` expires. */
+function lockTimeoutError(): Error {
+  return Object.assign(new Error('canceling statement due to lock timeout'), { code: '55P03' });
+}
+
+describe('withAdvisoryLock', () => {
+  it('holds the lock across the callback and releases it by ending the transaction', async () => {
+    const { clients, db } = fakePool();
+    let queriesWhenBodyRan: string[] = [];
+
+    const result = await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
+      queriesWhenBodyRan = [...clients[0].queries];
+      return 'migrated';
+    });
+
+    expect(result).toBe('migrated');
+    // The lock is taken before the body starts...
+    expect(queriesWhenBodyRan.some((q) => q.includes('pg_advisory_xact_lock'))).toBe(true);
+    expect(queriesWhenBodyRan).not.toContain('rollback');
+    // ...and the transaction that holds it ends after the body, which is what
+    // releases both the lock and the transaction-local lock_timeout.
+    expect(clients[0].queries.at(-1)).toBe('rollback');
+    expect(clients[0].released).toBe(true);
+    expect(clients[0].releasedWith).toBeUndefined();
+  });
+
+  it('bounds the wait rather than blocking the boot forever', async () => {
+    const { clients, db } = fakePool();
+
+    await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => undefined, { waitMs: 1234 });
+
+    // Transaction-local, so the setting leaves with the transaction and the
+    // connection goes back to the pool as it arrived.
+    const setTimeoutCall = clients[0].queries.find((q) => q.includes('set_config'));
+    expect(setTimeoutCall).toContain('lock_timeout');
+    expect(setTimeoutCall).toContain('true');
+  });
+
+  it('releases the lock when the callback throws, and propagates the failure', async () => {
+    const { clients, db } = fakePool();
+    const boom = new Error('migration 0004 failed');
+
+    await expect(
+      withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
+        throw boom;
+      }),
+    ).rejects.toBe(boom);
+
+    expect(clients[0].queries.at(-1)).toBe('rollback');
+    expect(clients[0].released).toBe(true);
+  });
+
+  it('never runs the callback when the lock cannot be taken in time', async () => {
+    const { clients, db } = fakePool({
+      failOn: (sql) => (sql.includes('pg_advisory_xact_lock') ? lockTimeoutError() : undefined!),
+    });
+    let ran = false;
+
+    await expect(
+      withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
+        ran = true;
+      }),
+    ).rejects.toThrow(/Migrations advisory lock/);
+
+    expect(ran).toBe(false);
+    // Still cleaned up: a failed acquire leaves an open transaction behind
+    // otherwise, and the connection would carry it back into the pool.
+    expect(clients[0].queries.at(-1)).toBe('rollback');
+    expect(clients[0].released).toBe(true);
+  });
+
+  it('fails the boot, and destroys the connection without rolling back, when the database stops answering', async () => {
+    // The socket is up, the server is gone: `begin` never returns. Waiting on
+    // a rollback would queue behind it and hang the boot after all.
+    const { clients, db } = fakePool({ hangOn: (sql) => sql === 'begin' });
+    let ran = false;
+    await expect(
+      withAdvisoryLock(
+        db,
+        AdvisoryLock.Migrations,
+        async () => {
+          ran = true;
+        },
+        { waitMs: 20 },
+      ),
+    ).rejects.toThrow(/did not answer/);
+    expect(ran).toBe(false);
+    expect(clients[0].queries).not.toContain('rollback');
+    expect(clients[0].released).toBe(true);
+    expect(clients[0].releasedWith).toBeInstanceOf(Error);
+  });
+
+  it('destroys a connection it could not roll back instead of pooling it', async () => {
+    const { clients, db } = fakePool({
+      failOn: (sql) => (sql === 'rollback' ? new Error('connection terminated') : undefined!),
+    });
+
+    await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => undefined);
+
+    // Releasing with an error is how `pg` is told to discard the connection.
+    // Ending its session is also what actually releases a lock we may still
+    // be holding, so this path is the fallback for the rollback itself failing.
+    expect(clients[0].released).toBe(true);
+    expect(clients[0].releasedWith).toBeInstanceOf(Error);
+  });
+});
+
+describe('advisoryLockKey', () => {
+  it('keeps the ids a single-tenant deployment always used when no tenant is named', () => {
+    expect(advisoryLockKey(AdvisoryLock.Migrations)).toBe(AdvisoryLock.Migrations);
+    expect(advisoryLockKey(AdvisoryLock.CommitWorker, '')).toBe(AdvisoryLock.CommitWorker);
+  });
+
+  it('gives each tenant its own key for each lock, stable across calls and inside int4', () => {
+    const a = advisoryLockKey(AdvisoryLock.CommitWorker, 't_acme');
+    const b = advisoryLockKey(AdvisoryLock.CommitWorker, 't_globex');
+    expect(a).toBe(advisoryLockKey(AdvisoryLock.CommitWorker, 't_acme'));
+    expect(a).not.toBe(b);
+    expect(a).not.toBe(AdvisoryLock.CommitWorker);
+    // The two locks of one tenant stay two locks.
+    expect(advisoryLockKey(AdvisoryLock.Migrations, 't_acme')).not.toBe(a);
+    for (const key of [a, b]) {
+      expect(Number.isInteger(key)).toBe(true);
+      expect(key).toBeGreaterThanOrEqual(-(2 ** 31));
+      expect(key).toBeLessThanOrEqual(2 ** 31 - 1);
+    }
+  });
+});