@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/break-glass.test.js

@@ -453,6 +453,55 @@ async function testGrantExhaustion() {
   }
 }
 
+// ---- Concurrent unsealRow — a 1-row grant must not double-claim ----
+
+async function testConcurrentUnsealRowDoubleClaim() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+    // Two distinct rows in the glass-locked table.
+    var j1 = await b.queue.enqueue("bg-dc-q", { secret: "row-one-secret" });
+    var j2 = await b.queue.enqueue("bg-dc-q", { secret: "row-two-secret" });
+
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns:         ["payload"],
+      factors:         ["totp"],
+      maxRowsPerGrant: 1,   // row-by-row auth: ONE PHI read per grant
+    });
+    var totp = _validTotp();
+    var grant = await b.breakGlass.grant({
+      req:    _fakeReq(),
+      table:  "_blamejs_jobs",
+      reason: "concurrent double-claim regression on a 1-row grant",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+
+    // Two concurrent redemptions of the SAME 1-row grant against DIFFERENT
+    // rows. The claim is an atomic compare-and-increment; exactly ONE caller
+    // may win the single row slot. The loser must be refused as exhausted —
+    // inferring the claim from a re-read of rowsConsumed (a concurrent
+    // winner's increment is visible to the loser) let BOTH pass, unsealing two
+    // rows under a maxRowsPerGrant:1 grant and defeating row-by-row auth.
+    var results = await Promise.allSettled([
+      b.breakGlass.unsealRow(grant, "_blamejs_jobs", j1.jobId, { req: _fakeReq() }),
+      b.breakGlass.unsealRow(grant, "_blamejs_jobs", j2.jobId, { req: _fakeReq() }),
+    ]);
+    var ok  = results.filter(function (r) { return r.status === "fulfilled"; });
+    var bad = results.filter(function (r) { return r.status === "rejected"; });
+    check("concurrent unsealRow: exactly one row unsealed under a 1-row grant",
+          ok.length === 1);
+    check("concurrent unsealRow: the losing read is refused as exhausted",
+          bad.length === 1 &&
+          /breakglass\/grant-exhausted/.test((bad[0].reason && bad[0].reason.code) || ""));
+
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 // ---- Revoke ----
 
 async function testGrantRevoke() {
@@ -1167,9 +1216,636 @@ async function testListActiveAllAndRevokeAll() {
   }
 }
 
+// ---- Not-initialized guard — every primitive fails closed before init() ----
+
+async function testRequireInitGuards() {
+  // Every public entry point calls _requireInit() first. After a reset
+  // (no init), each must throw breakglass/not-initialized — the fail-closed
+  // guard that keeps an un-wired framework from minting grants or unsealing
+  // PHI. No DB needed: the guard is the first statement in each function.
+  b.breakGlass._resetForTest();
+  var re = /breakglass\/not-initialized/;
+  async function guard(label, fn) {
+    var threw = null;
+    try { await fn(); } catch (e) { threw = e; }
+    check("require-init: " + label + " throws not-initialized",
+          threw && re.test(threw.code || ""));
+  }
+  await guard("policy.get",     function () { return b.breakGlass.policy.get("t"); });
+  await guard("policy.set",     function () { return b.breakGlass.policy.set("t", { columns: ["c"], factors: ["totp"] }); });
+  await guard("policy.list",    function () { return b.breakGlass.policy.list(); });
+  await guard("policy.delete",  function () { return b.breakGlass.policy.delete("t"); });
+  await guard("grant",          function () { return b.breakGlass.grant({ req: _fakeReq(), table: "t", reason: "x", factor: {} }); });
+  await guard("unsealRow",      function () { return b.breakGlass.unsealRow({ id: "bg-x" }, "t", "1"); });
+  await guard("revoke",         function () { return b.breakGlass.revoke("bg-x"); });
+  await guard("listActive",     function () { return b.breakGlass.listActive({ req: _fakeReq() }); });
+  await guard("listActiveAll",  function () { return b.breakGlass.listActiveAll(); });
+  await guard("revokeAll",      function () { return b.breakGlass.revokeAll({ table: "t" }); });
+  await guard("encryptCell",    function () { return b.breakGlass.encryptCell("x", { table: "t", rowId: "1", column: "c" }); });
+  await guard("decryptCell",    function () { return b.breakGlass.decryptCell("bgcell:1:AAAA", { table: "t", rowId: "1", column: "c" }); });
+  await guard("migrate",        function () { return b.breakGlass.migrate("t"); });
+  await guard("unsealRowAsService", function () { return b.breakGlass.unsealRowAsService(_fakeReq(), "t", "1"); });
+}
+
+// ---- Adversarial policy.set validation (identifier shape / opts shape) ----
+
+async function testPolicyValidationAdversarial() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    function reject(label, table, opts, codeRe) {
+      return b.breakGlass.policy.set(table, opts).then(
+        function () { check("policy.validate.adv: " + label + " (should throw)", false); },
+        function (e) { check("policy.validate.adv: " + label, codeRe.test(e.code || "")); }
+      );
+    }
+    // opts entirely absent → "opts is required" (distinct from the missing-field
+    // branches the happy-path validation test already covers).
+    await reject("null opts rejected", "t", null, /breakglass\/bad-policy/);
+    // Table name that is not a safe SQL identifier — it flows into migrate() /
+    // unsealRowAsService() SQL, so a name with an embedded quote must be refused.
+    await reject("table with embedded quote rejected", 'pa"tients',
+      { columns: ["ssn"], factors: ["totp"] }, /breakglass\/bad-policy/);
+    await reject("table with space rejected", "pat ients",
+      { columns: ["ssn"], factors: ["totp"] }, /breakglass\/bad-policy/);
+    // Column entries: non-string / empty / bad-identifier shape.
+    await reject("non-string column rejected", "t",
+      { columns: [123], factors: ["totp"] }, /breakglass\/bad-policy/);
+    await reject("empty-string column rejected", "t",
+      { columns: [""], factors: ["totp"] }, /breakglass\/bad-policy/);
+    await reject("column with embedded quote rejected", "t",
+      { columns: ['ss"n'], factors: ["totp"] }, /breakglass\/bad-policy/);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- Adversarial encrypt/decrypt/migrate/revoke/policy-delete inputs ----
+
+async function testCellAndAdminInputValidation() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    await b.breakGlass.policy.set("patients", {
+      columns: ["ssn"], factors: ["totp"], cryptographic: true,
+    });
+
+    async function rejects(label, fn, codeRe) {
+      var threw = null;
+      try { await fn(); } catch (e) { threw = e; }
+      check("input.validate: " + label, threw && codeRe.test(threw.code || ""));
+    }
+
+    // encryptCell bad ctx (missing / wrong-typed fields)
+    await rejects("encryptCell null ctx",
+      function () { return b.breakGlass.encryptCell("x", null); }, /breakglass\/bad-cell-ctx/);
+    await rejects("encryptCell ctx missing rowId",
+      function () { return b.breakGlass.encryptCell("x", { table: "patients", column: "ssn" }); }, /breakglass\/bad-cell-ctx/);
+
+    // decryptCell — bad ciphertext format, then bad ctx
+    await rejects("decryptCell non-bgcell format",
+      function () { return b.breakGlass.decryptCell("not-a-cell", { table: "patients", rowId: "1", column: "ssn" }); },
+      /breakglass\/bad-ciphertext/);
+    await rejects("decryptCell null ctx",
+      function () { return b.breakGlass.decryptCell("bgcell:1:AAAA", null); }, /breakglass\/bad-cell-ctx/);
+
+    // migrate — no policy, then non-cryptographic policy
+    await rejects("migrate no policy",
+      function () { return b.breakGlass.migrate("no-such-glass-table"); }, /breakglass\/policy-not-set/);
+    await b.breakGlass.policy.set("plain", { columns: ["ssn"], factors: ["totp"] });   // Model A
+    await rejects("migrate on Model-A policy refused",
+      function () { return b.breakGlass.migrate("plain"); }, /breakglass\/bad-policy/);
+
+    // revoke — empty grantId
+    await rejects("revoke empty grantId",
+      function () { return b.breakGlass.revoke(""); }, /breakglass\/bad-grant-opts/);
+
+    // policy.delete — empty table
+    await rejects("policy.delete empty table",
+      function () { return b.breakGlass.policy.delete(""); }, /breakglass\/bad-policy/);
+
+    // revokeAll — non-object criteria (distinct from the empty-criteria branch)
+    await rejects("revokeAll null criteria",
+      function () { return b.breakGlass.revokeAll(null); }, /breakglass\/bad-revoke-criteria/);
+
+    // grant — no opts object
+    await rejects("grant no opts",
+      function () { return b.breakGlass.grant(); }, /breakglass\/bad-grant-opts/);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- Migrate on an empty policy'd table (paging break on first page) ----
+
+async function testMigrateEmptyTable() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    b.queue.init({ backends: { primary: { protocol: "local" } } });   // creates _blamejs_jobs, no rows
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns: ["payload"], factors: ["totp"], cryptographic: true,
+    });
+    // No jobs enqueued → the first keyset page is empty → the loop breaks
+    // immediately with zero rows and emits the completion audit.
+    var summary = await b.breakGlass.migrate("_blamejs_jobs", { batchSize: 25 });
+    check("migrate empty: totalRows 0",    summary.totalRows === 0);
+    check("migrate empty: migratedRows 0", summary.migratedRows === 0);
+    check("migrate empty: table echoed",   summary.table === "_blamejs_jobs");
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- DEK survives an in-memory cache reset (re-unseal from the policy row) ----
+
+async function testDekReUnsealFromPolicyRow() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    await b.breakGlass.policy.set("patients", {
+      columns: ["ssn"], factors: ["totp"], cryptographic: true,
+    });
+    // First use generates + vault-seals the DEK into the policy row and
+    // caches it in-process.
+    var ct = await b.breakGlass.encryptCell("123-45-6789",
+      { table: "patients", rowId: "p-1", column: "ssn" });
+    // Reset drops the in-memory DEK cache but leaves the sealed DEK in the DB.
+    // Re-init, then decrypt: _ensureDek must re-unseal the stored DEK (the
+    // `sealed` branch) rather than mint a fresh one, or the round-trip breaks.
+    b.breakGlass._resetForTest();
+    b.breakGlass.init();
+    var pt = await b.breakGlass.decryptCell(ct,
+      { table: "patients", rowId: "p-1", column: "ssn" });
+    check("dek-reuse: sealed DEK re-unseals after cache reset", pt === "123-45-6789");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- unsealRow argument-shape guards + not-found grant ----
+
+async function testUnsealRowArgGuards() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    async function rejects(label, fn, codeRe) {
+      var threw = null;
+      try { await fn(); } catch (e) { threw = e; }
+      check("unsealRow.guard: " + label, threw && codeRe.test(threw.code || ""));
+    }
+    await rejects("null grant handle",
+      function () { return b.breakGlass.unsealRow(null, "t", "1"); }, /breakglass\/bad-grant-opts/);
+    await rejects("handle without id",
+      function () { return b.breakGlass.unsealRow({}, "t", "1"); }, /breakglass\/bad-grant-opts/);
+    await rejects("empty table",
+      function () { return b.breakGlass.unsealRow({ id: "bg-x" }, "", "1"); }, /breakglass\/bad-grant-opts/);
+    await rejects("missing rowId",
+      function () { return b.breakGlass.unsealRow({ id: "bg-x" }, "t", null); }, /breakglass\/bad-grant-opts/);
+    await rejects("empty rowId",
+      function () { return b.breakGlass.unsealRow({ id: "bg-x" }, "t", ""); }, /breakglass\/bad-grant-opts/);
+    // A well-shaped handle whose id doesn't exist in the grants table reads
+    // as revoked/never-issued (fail-closed).
+    await rejects("unknown grant id reads as revoked",
+      function () { return b.breakGlass.unsealRow({ id: "bg-does-not-exist" }, "t", "1"); },
+      /breakglass\/grant-revoked/);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- unsealRow: expired grant + row-not-found ----
+
+async function testUnsealRowExpiredAndRowNotFound() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+    var jid = await b.queue.enqueue("bg-exp-q", { secret: "row-exp" });
+
+    // Expired-grant path: a short-TTL grant whose expiry check trips before
+    // any row read.
+    await b.breakGlass.policy.set("patients", {
+      columns: ["ssn"], factors: ["totp"], grantTtl: 20,
+    });
+    var totpA = _validTotp();
+    var expiring = await b.breakGlass.grant({
+      req:    _fakeReq(),
+      table:  "patients",
+      reason: "expired-grant coverage: short ttl grant",
+      factor: { type: "totp", code: totpA.code, secret: totpA.secret },
+    });
+    await helpers.waitUntil(function () { return Date.now() > expiring.expiresAt; },
+      { label: "break-glass.unsealRow: 20ms grant reaches expiry" });
+    var threwExpired = null;
+    try { await b.breakGlass.unsealRow(expiring, "patients", "any-row", { req: _fakeReq() }); }
+    catch (e) { threwExpired = e; }
+    check("unsealRow: expired grant refused",
+          threwExpired && /breakglass\/grant-expired/.test(threwExpired.code));
+
+    // Row-not-found path: a valid, live grant against a real table but a
+    // rowId that isn't present. The grant is NOT consumed (SELECT-before-
+    // increment ordering), so the error is row-not-found, not exhausted.
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns: ["payload"], factors: ["totp"], maxRowsPerGrant: 3,
+    });
+    var totpB = _validTotp();
+    var liveGrant = await b.breakGlass.grant({
+      req:    _fakeReq(),
+      table:  "_blamejs_jobs",
+      reason: "row-not-found coverage: live grant on real table",
+      factor: { type: "totp", code: totpB.code, secret: totpB.secret },
+    });
+    var threwMissing = null;
+    try { await b.breakGlass.unsealRow(liveGrant, "_blamejs_jobs", "no-such-row-id", { req: _fakeReq() }); }
+    catch (e) { threwMissing = e; }
+    check("unsealRow: missing row refused with row-not-found",
+          threwMissing && /breakglass\/row-not-found/.test(threwMissing.code));
+    // The failed lookup did not consume the grant — a real row still reads.
+    var ok = await b.breakGlass.unsealRow(liveGrant, "_blamejs_jobs", jid.jobId, { req: _fakeReq() });
+    check("unsealRow: row-not-found did not consume the grant",
+          ok && ok.payload && ok.payload.indexOf("row-exp") !== -1);
+
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- unsealRow Model B: a corrupt / wrong-context cell fails closed ----
+
+async function testUnsealRowCellDecryptFailed() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+    var jid = await b.queue.enqueue("bg-cd-q", { secret: "outer" });
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns: ["payload"], factors: ["totp"], cryptographic: true, maxRowsPerGrant: 3,
+    });
+    // Write a ciphertext encrypted for a DIFFERENT rowId into this row. The
+    // AAD is bound to (table, rowId, column), so decrypting under the real
+    // rowId fails the AEAD verify — unsealRow must surface cell-decrypt-failed
+    // rather than return garbage or leak the wrong row's value.
+    var wrongCtx = await b.breakGlass.encryptCell("someone-elses-ssn",
+      { table: "_blamejs_jobs", rowId: "a-different-row", column: "payload" });
+    await b.clusterStorage.execute(
+      "UPDATE _blamejs_jobs SET payload = ? WHERE _id = ?", [wrongCtx, jid.jobId]);
+
+    var totp = _validTotp();
+    var grant = await b.breakGlass.grant({
+      req:    _fakeReq(),
+      table:  "_blamejs_jobs",
+      reason: "cell-decrypt-failed coverage: swapped ciphertext",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+    var threw = null;
+    try { await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId, { req: _fakeReq() }); }
+    catch (e) { threw = e; }
+    check("unsealRow Model B: wrong-context cell fails closed",
+          threw && /breakglass\/cell-decrypt-failed/.test(threw.code));
+
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- _enforceGrantPins: session pin with a null binding fails closed ----
+
+async function testSessionPinFailClosedOnNullBinding() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+    var jid = await b.queue.enqueue("bg-sess-fc-q", { secret: "row-sess-fc" });
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns: ["payload"], factors: ["totp"], maxRowsPerGrant: 5,
+      pinIp: false, sessionPin: true,
+    });
+    // Mint from a request carrying NO session id → grantRow.sessionId is null.
+    // With sessionPin on, redemption must refuse rather than skip the pin.
+    var noSessReq = {
+      user:    { id: "user-test-1" },
+      socket:  { remoteAddress: "127.0.0.1" },
+      headers: { "user-agent": "test-agent" },
+      method:  "POST",
+      url:     "/admin/break-glass",
+    };
+    var totp = _validTotp();
+    var grant = await b.breakGlass.grant({
+      req:    noSessReq,
+      table:  "_blamejs_jobs",
+      reason: "session-pin fail-closed: minting with no session id",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+    var threw = null;
+    try {
+      await b.breakGlass.unsealRow(grant, "_blamejs_jobs", jid.jobId,
+        { req: _fakeReq({ session: { id: "sess-anything" } }) });
+    } catch (e) { threw = e; }
+    check("session-pin fail-closed: null binding refuses redemption",
+          threw && /breakglass\/grant-session-mismatch/.test(threw.code));
+
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- grant: factor lockout after repeated failures ----
+
+async function testGrantFactorLockout() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    await b.breakGlass.policy.set("patients", { columns: ["ssn"], factors: ["totp"] });
+    var totp = _validTotp();
+    var badCode = totp.code === "000000" ? "000001" : "000000";
+    function attempt(reason) {
+      return b.breakGlass.grant({
+        req:    _fakeReq(),
+        table:  "patients",
+        reason: reason,
+        factor: { type: "totp", secret: totp.secret, code: badCode },
+      });
+    }
+    // Five failing factor verifications trip the lockout primitive
+    // (maxAttempts 5). Each of the five is a plain bad-factor rejection.
+    for (var i = 0; i < 5; i++) {
+      var threw = null;
+      try { await attempt("lockout coverage: failing attempt " + (i + 1)); }
+      catch (e) { threw = e; }
+      check("lockout: attempt " + (i + 1) + " rejected",
+            threw && /breakglass\/(bad-factor|factor-rate-limited)/.test(threw.code || ""));
+    }
+    // The sixth attempt is refused at the lockout gate BEFORE factor
+    // verification — a brute-forcer is shut out.
+    var locked = null;
+    try { await attempt("lockout coverage: should be rate-limited"); }
+    catch (e) { locked = e; }
+    check("lockout: sixth attempt refused as factor-rate-limited",
+          locked && /breakglass\/factor-rate-limited/.test(locked.code || ""));
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- grant: requireScope satisfied via req.apiKey.scopes fallback ----
+
+async function testGrantScopeViaApiKey() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    await b.breakGlass.policy.set("patients", {
+      columns: ["ssn"], factors: ["totp"], requireScope: "phi:admin",
+    });
+    // No req.user — the actor is an apiKey. Both the actorId resolution and
+    // the requireScope check must fall back to req.apiKey (id + scopes).
+    var totp = _validTotp();
+    var apiKeyReq = {
+      apiKey:  { id: "ak-phi-admin", scopes: ["phi:admin"] },
+      session: { id: "sess-svc-1" },
+      socket:  { remoteAddress: "127.0.0.1" },
+      headers: { "user-agent": "svc-agent" },
+      method:  "POST",
+      url:     "/admin/break-glass",
+    };
+    var grant = await b.breakGlass.grant({
+      req:    apiKeyReq,
+      table:  "patients",
+      reason: "apikey-scope coverage: service actor with phi:admin scope",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+    check("apikey-scope: grant minted for apiKey actor carrying required scope",
+          grant && typeof grant.id === "string");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- grant: TOTP factor missing secret / missing code ----
+
+async function testGrantTotpFactorShapeRejections() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    await b.breakGlass.policy.set("patients", { columns: ["ssn"], factors: ["totp"] });
+    async function rejects(label, factor) {
+      var threw = null;
+      try {
+        await b.breakGlass.grant({
+          req:    _fakeReq(),
+          table:  "patients",
+          reason: "totp factor-shape coverage: " + label,
+          factor: factor,
+        });
+      } catch (e) { threw = e; }
+      check("totp-shape: " + label, threw && /breakglass\/bad-factor/.test(threw.code || ""));
+    }
+    // factor.type is "totp" (accepted), but the credential material is
+    // incomplete — _verifyTotpFactor returns ok:false and grant refuses.
+    await rejects("missing secret", { type: "totp", code: "123456" });
+    await rejects("missing code",   { type: "totp", secret: "AAAAAAAAAAAAAAAA" });
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- grant: audit reason stored as HMAC (not cleartext) ----
+
+async function testGrantAuditReasonHmac() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    await b.breakGlass.policy.set("patients", {
+      columns: ["ssn"], factors: ["totp"], auditReasonStorage: "hmac",
+    });
+    var totp = _validTotp();
+    var grant = await b.breakGlass.grant({
+      req:    _fakeReq(),
+      table:  "patients",
+      reason: "hmac-audit coverage: reason should hash, not store cleartext",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+    // The grant still mints; the branch under test is the audit-reason
+    // derivation (hmac mode → cleartext suppressed, hmac digest emitted).
+    check("audit-reason hmac: grant minted with hmac reason storage",
+          grant && typeof grant.id === "string");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- unsealRowAsService: input guards + Model B decrypt + roles fallback ----
+
+async function testUnsealRowAsServiceGuardsAndModelB() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    b.queue.init({ backends: { primary: { protocol: "local" } } });
+    var jid = await b.queue.enqueue("bg-svc-b-q", { secret: "outer" });
+
+    async function rejects(label, fn, codeRe) {
+      var threw = null;
+      try { await fn(); } catch (e) { threw = e; }
+      check("svc.guard: " + label, threw && codeRe.test(threw.code || ""));
+    }
+    // Argument-shape + no-policy guards (before any bypass check).
+    await rejects("null req",
+      function () { return b.breakGlass.unsealRowAsService(null, "_blamejs_jobs", "1"); },
+      /breakglass\/bad-grant-opts/);
+    await rejects("empty table",
+      function () { return b.breakGlass.unsealRowAsService({ apiKey: { id: "ak" } }, "", "1"); },
+      /breakglass\/bad-grant-opts/);
+    await rejects("no policy for table",
+      function () { return b.breakGlass.unsealRowAsService({ apiKey: { id: "ak" } }, "no-policy-table", "1"); },
+      /breakglass\/policy-not-set/);
+
+    // Cryptographic-mode service bypass whose apiKey authorizes via `roles`
+    // (not `scopes`) — the role-check fallback. The Model B cell decrypts
+    // through the same encryption-context binding as the operator path.
+    await b.breakGlass.policy.set("_blamejs_jobs", {
+      columns: ["payload"], factors: ["totp"], cryptographic: true,
+      serviceAccountBypass: {
+        enabled: true, apiKeyIds: ["ak-svc-b"], requireRole: "service:phi-reader",
+      },
+    });
+    var cell = await b.breakGlass.encryptCell("alice's diagnosis (svc Model B)",
+      { table: "_blamejs_jobs", rowId: jid.jobId, column: "payload" });
+    await b.clusterStorage.execute(
+      "UPDATE _blamejs_jobs SET payload = ? WHERE _id = ?", [cell, jid.jobId]);
+
+    var serviceReq = {
+      apiKey:  { id: "ak-svc-b", roles: ["service:phi-reader"] },   // roles, not scopes
+      socket:  { remoteAddress: "10.0.0.5" },
+      headers: { "user-agent": "blamejs-svc" },
+      method:  "GET",
+      url:     "/cron/deid",
+    };
+    var row = await b.breakGlass.unsealRowAsService(serviceReq, "_blamejs_jobs", jid.jobId,
+      { reason: "svc Model B coverage: nightly de-identification" });
+    check("svc Model B: roles-fallback authorized bypass decrypts the cell",
+          row && row.payload === "alice's diagnosis (svc Model B)");
+
+    // Authorized bypass but a rowId that doesn't exist → row-not-found.
+    await rejects("authorized bypass, missing row",
+      function () {
+        return b.breakGlass.unsealRowAsService(serviceReq, "_blamejs_jobs", "no-such-svc-row",
+          { reason: "svc row-not-found coverage" });
+      }, /breakglass\/row-not-found/);
+
+    try { await b.queue.shutdown({ timeoutMs: 200 }); } catch (_e) {}
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- Passkey factor: full-field assertion drives the verify path ----
+
+async function testPasskeyFullFieldFactorPath() {
+  // The existing passkey test omits every field, so _verifyPasskeyFactor
+  // short-circuits at the presence check. Supplying all five fields drives
+  // the real WebAuthn verify call — a well-shaped but bogus assertion fails
+  // verification (returns/raises), and grant refuses as bad-factor.
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    await b.breakGlass.policy.set("patients", { columns: ["ssn"], factors: ["passkey"] });
+    var threw = null;
+    try {
+      await b.breakGlass.grant({
+        req:    _fakeReq(),
+        table:  "patients",
+        reason: "passkey verify-path coverage: bogus but well-shaped assertion",
+        factor: {
+          type:              "passkey",
+          response: {
+            id:    "cred-id",
+            rawId: "Y3JlZC1pZA",
+            type:  "public-key",
+            response: {
+              clientDataJSON:    "e30",
+              authenticatorData: "AAAA",
+              signature:         "AAAA",
+            },
+          },
+          expectedChallenge: "Y2hhbGxlbmdl",
+          expectedOrigin:    "https://example.com",
+          expectedRPID:      "example.com",
+          credential: { id: "cred-id", publicKey: "AAAA", counter: 0 },
+        },
+      });
+    } catch (e) { threw = e; }
+    check("passkey full-field: bogus assertion refused as bad-factor",
+          threw && /breakglass\/bad-factor/.test(threw.code || ""));
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
+// ---- listActive / listActiveAll / revokeAll edge branches ----
+
+async function testListAndRevokeEdgeBranches() {
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    b.breakGlass.init();
+    // Unauthenticated listActive (no actor on req) → empty array, no leak.
+    var none = await b.breakGlass.listActive({ req: { socket: { remoteAddress: "127.0.0.1" }, headers: {} } });
+    check("listActive: unauthenticated caller gets []", Array.isArray(none) && none.length === 0);
+    // No opts at all → still []
+    var noneBare = await b.breakGlass.listActive();
+    check("listActive: no-opts caller gets []", Array.isArray(noneBare) && noneBare.length === 0);
+
+    await b.breakGlass.policy.set("t_edge", { columns: ["c"], factors: ["totp"], maxRowsPerGrant: 3 });
+    var totp = _validTotp();
+    var g = await b.breakGlass.grant({
+      req:    _fakeReq(),
+      table:  "t_edge",
+      reason: "list/revoke edge-branch coverage grant",
+      factor: { type: "totp", code: totp.code, secret: totp.secret },
+    });
+    void g;
+
+    // listActiveAll `since` filter branch (existing tests only exercise the
+    // table filter). A floor in the past keeps the grant; a floor in the
+    // future filters it out.
+    var sincePast = await b.breakGlass.listActiveAll({ since: Date.now() - C.TIME.minutes(5) });
+    check("listActiveAll: since=past keeps the grant", sincePast.length === 1);
+    var sinceFuture = await b.breakGlass.listActiveAll({ since: Date.now() + C.TIME.minutes(5) });
+    check("listActiveAll: since=future filters it out", sinceFuture.length === 0);
+
+    // revokeAll by actorId (the computeDerived predicate branch; existing
+    // tests only revoke by table).
+    var result = await b.breakGlass.revokeAll({ actorId: "user-test-1", reason: "ir-actor-scope" });
+    check("revokeAll: by actorId revokes the actor's grant", result && result.revokedCount === 1);
+    var after = await b.breakGlass.listActiveAll();
+    check("revokeAll: actor's grant gone after revoke", after.length === 0);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function run() {
   testSurface();
   testInitOptsValidation();
+  await testRequireInitGuards();
   await testPolicyCRUD();
   await testPolicyValidation();
   await testGrantHappyPath();
@@ -1178,6 +1854,7 @@ async function run() {
   await testConcurrentTotpGrantReplay();
   await testUnsealRowLifecycle();
   await testGrantExhaustion();
+  await testConcurrentUnsealRowDoubleClaim();
   await testGrantRevoke();
   await testTableMismatch();
   await testSweepExpiredGrants();
@@ -1202,6 +1879,22 @@ async function run() {
   await testServiceAccountBypassHappyPath();
   await testServiceAccountBypassRefusalPaths();
   await testListActiveAllAndRevokeAll();
+  // Uncovered error / adversarial / defensive branch coverage
+  await testPolicyValidationAdversarial();
+  await testCellAndAdminInputValidation();
+  await testMigrateEmptyTable();
+  await testDekReUnsealFromPolicyRow();
+  await testUnsealRowArgGuards();
+  await testUnsealRowExpiredAndRowNotFound();
+  await testUnsealRowCellDecryptFailed();
+  await testSessionPinFailClosedOnNullBinding();
+  await testGrantFactorLockout();
+  await testGrantScopeViaApiKey();
+  await testGrantTotpFactorShapeRejections();
+  await testGrantAuditReasonHmac();
+  await testUnsealRowAsServiceGuardsAndModelB();
+  await testPasskeyFullFieldFactorPath();
+  await testListAndRevokeEdgeBranches();
 }
 
 module.exports = { run: run };