@bongos/core 1.23.22 → 1.24.1

package/tests/account_logins.mjs

@@ -0,0 +1,326 @@
+// tests/account_logins.mjs — a platform account is a person, and GitHub is one
+// way in (task 1004992, ADR 0393).
+//
+// What this proves, DB-free (the real SQL is tests/account_logins_db.mjs):
+//
+//   1. A provider identity is only ever the provider's stable user id — never an
+//      email or a login — and GitHub's is a positive integer.
+//   2. A person who arrives without GitHub gets a MINTED key that is negative,
+//      so it can never be mistaken for a GitHub id, and no GitHub login is
+//      invented for them.
+//   3. A second sign-in by the same Google identity — or a racing double-click —
+//      reaches the SAME account; it never makes a second person.
+//   4. GitHub accounts are never born here (one birth path per kind).
+//   5. The person's own settings read lists which ways in they have, never the
+//      provider ids, and is keyed on the signed-in person only.
+//   6. The hub's numeric-key guard now admits a minted key, and still refuses a
+//      system:* principal.
+//
+// Run:  node --test tests/account_logins.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+// A recording pool. `script` answers each statement by the first matching
+// pattern; connect() hands out a client that records into the same log, so a
+// transaction's statements are visible in order.
+function fakePool(script) {
+  const p = { log: [], script };
+  const run = async (sql, params = []) => {
+    p.log.push({ sql, params });
+    for (const [re, answer] of p.script) {
+      if (re.test(sql)) return typeof answer === 'function' ? answer(sql, params, p.log) : answer;
+    }
+    return { rows: [], rowCount: 0 };
+  };
+  p.query = run;
+  p.connect = async () => ({ query: run, release() {} });
+  return p;
+}
+
+// Swap what the route's pool answers. The route captured the pool object at
+// require time, so the object stays and its script and log are replaced.
+function scriptRoute(script) {
+  routePool.script = script;
+  routePool.log.length = 0;
+}
+
+let ME = '4242';
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+const routePool = fakePool([]);
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool: routePool,
+  requireBuilder: (req, _res, next) => {
+    req.builder = { id: 1, github_id: ME, github_login: 'octo' };
+    next();
+  },
+};
+
+const logins = require('../modules/platform-identity/account-logins.js');
+const pi = require('../modules/platform-identity/platform-identity.js');
+const profileRoutes = require('../modules/platform-identity/routes/profile.js');
+const myProjectsRoutes = require('../modules/platform-identity/routes/my-projects.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+test('a provider identity is the provider\'s stable user id, nothing else', () => {
+  assert.deepEqual(logins.normalizeLogin({ provider: 'github', subject: 583231 }), { provider: 'github', subject: '583231' });
+  assert.deepEqual(logins.normalizeLogin({ provider: 'google', subject: '110169484474386276334' }), { provider: 'google', subject: '110169484474386276334' });
+  for (const bad of [
+    { provider: 'github', subject: 'octocat' }, // a login, not an id
+    { provider: 'github', subject: '-5' }, // a minted key is not a GitHub id
+    { provider: 'github', subject: '0' },
+    { provider: 'google', subject: '' },
+    { provider: 'google', subject: 'has space' },
+    { provider: 'google', subject: 'x'.repeat(256) },
+    { provider: 'email', subject: 'a@b.c' }, // not a provider (ADR 0393)
+    { provider: 'apple', subject: '123' },
+    {},
+  ]) assert.equal(logins.normalizeLogin(bad), null, JSON.stringify(bad));
+  assert.deepEqual([...logins.LOGIN_PROVIDERS], ['github', 'google']);
+});
+
+test('a minted person key is negative, and only a minted one is', () => {
+  assert.equal(logins.isMintedPersonKey('-17'), true);
+  assert.equal(logins.isMintedPersonKey(-17), true);
+  assert.equal(logins.isMintedPersonKey('583231'), false);
+  assert.equal(logins.isMintedPersonKey('system:bfg'), false);
+  assert.equal(logins.isMintedPersonKey(null), false);
+});
+
+test('the hub key guard admits a minted key and still refuses a system principal', () => {
+  assert.equal(pi.isNumericGithubId('-17'), true);
+  assert.equal(pi.isNumericGithubId('583231'), true);
+  assert.equal(pi.isNumericGithubId('system:bfg'), false);
+  assert.equal(pi.isNumericGithubId('--1'), false);
+  assert.equal(pi.isNumericGithubId(''), false);
+});
+
+test('a person arriving through Google gets a new account with a minted key and no GitHub login', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [] }],
+    [/INSERT INTO platform_identity_accounts/, { rows: [{ id: 77, person_key: '-3' }] }],
+    [/INSERT INTO platform_identity_account_logins/, { rows: [], rowCount: 1 }],
+    [/UPDATE platform_identity_accounts\s+SET handle/, { rows: [{ handle: 'janedoe' }], rowCount: 1 }],
+  ]);
+  const out = await logins.createAccountForLogin({
+    provider: 'google', subject: 'g-sub-1', email: ' jane@example.com ', displayName: 'Jane Doe',
+    avatarUrl: 'https://lh3.googleusercontent.com/a/x',
+  }, { pool });
+  assert.deepEqual(out, { accountId: 77, personKey: '-3', created: true });
+
+  const sqls = pool.log.map((q) => q.sql);
+  const insAcct = pool.log.find((q) => /INSERT INTO platform_identity_accounts/.test(q.sql));
+  assert.match(insAcct.sql, /-nextval\('platform_identity_person_key_seq'\)/, 'the key is minted negative from the sequence');
+  assert.match(insAcct.sql, /VALUES \(-nextval\('platform_identity_person_key_seq'\), NULL,/, 'no GitHub login is invented');
+  assert.match(insAcct.sql, /'provisional'/, 'not activated here — the sign-in route decides, as for GitHub');
+  assert.deepEqual(insAcct.params, ['Jane Doe', 'https://lh3.googleusercontent.com/a/x']);
+
+  const insLogin = pool.log.find((q) => /INSERT INTO platform_identity_account_logins/.test(q.sql));
+  assert.deepEqual(insLogin.params, [77, 'google', 'g-sub-1', 'jane@example.com']);
+
+  // Both inserts sit inside ONE transaction: an account never exists without its way in.
+  const b = sqls.indexOf('BEGIN');
+  const c = sqls.indexOf('COMMIT');
+  assert.ok(b >= 0 && c > b, 'a transaction ran');
+  assert.ok(sqls.indexOf(insAcct.sql) > b && sqls.indexOf(insLogin.sql) > sqls.indexOf(insAcct.sql) && c > sqls.indexOf(insLogin.sql),
+    'account then login, both between BEGIN and COMMIT');
+
+  const handle = pool.log.find((q) => /SET handle/.test(q.sql));
+  assert.deepEqual(handle.params, ['-3', 'janedoe'], 'the handle is seeded from the name, keyed on the minted key');
+});
+
+test('the same Google identity signing in again reaches the same person', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [{ account_id: 77, person_key: '-3' }] }],
+  ]);
+  const out = await logins.createAccountForLogin({ provider: 'google', subject: 'g-sub-1' }, { pool });
+  assert.deepEqual(out, { accountId: 77, personKey: '-3', created: false });
+  assert.ok(!pool.log.some((q) => /INSERT/.test(q.sql)), 'nothing written');
+});
+
+test('a racing double sign-up rolls back and returns the account the other request made', async () => {
+  let lookups = 0;
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, () => (++lookups === 1 ? { rows: [] } : { rows: [{ account_id: 78, person_key: '-4' }] })],
+    [/INSERT INTO platform_identity_accounts/, { rows: [{ id: 79, person_key: '-5' }] }],
+    [/INSERT INTO platform_identity_account_logins/, () => { const e = new Error('duplicate key'); e.code = '23505'; throw e; }],
+  ]);
+  const out = await logins.createAccountForLogin({ provider: 'google', subject: 'g-sub-2' }, { pool });
+  assert.deepEqual(out, { accountId: 78, personKey: '-4', created: false });
+  const sqls = pool.log.map((q) => q.sql);
+  assert.ok(sqls.includes('ROLLBACK'), 'our half-made account rolled back with its failed login');
+  assert.ok(!sqls.includes('COMMIT'));
+  assert.ok(!pool.log.some((q) => /SET handle/.test(q.sql)), 'no handle seeded for a rolled-back account');
+});
+
+test('any other failure is not swallowed', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [] }],
+    [/INSERT INTO platform_identity_accounts/, () => { const e = new Error('boom'); e.code = '57014'; throw e; }],
+  ]);
+  await assert.rejects(logins.createAccountForLogin({ provider: 'google', subject: 'g-sub-3' }, { pool }), /boom/);
+});
+
+test('GitHub accounts and malformed identities are never born here', async () => {
+  const pool = fakePool([]);
+  await assert.rejects(logins.createAccountForLogin({ provider: 'github', subject: '583231' }, { pool }), /GitHub account is born/);
+  await assert.rejects(logins.createAccountForLogin({ provider: 'google', subject: '' }, { pool }), /not a valid provider identity/);
+  await assert.rejects(logins.createAccountForLogin({ provider: 'email', subject: 'a@b.c' }, { pool }), /not a valid provider identity/);
+  assert.equal(pool.log.length, 0, 'nothing touched the database');
+});
+
+test('a lookup never runs for an identity that cannot be one', async () => {
+  const pool = fakePool([]);
+  assert.equal(await logins.findPersonByLogin({ provider: 'github', subject: 'octocat' }, { pool }), null);
+  assert.equal(pool.log.length, 0);
+});
+
+test('the lookup keys on provider and the provider\'s id only — never an email', async () => {
+  const pool = fakePool([]);
+  await logins.findPersonByLogin({ provider: 'google', subject: 'g-sub-9' }, { pool });
+  assert.equal(pool.log.length, 1);
+  assert.match(pool.log[0].sql, /WHERE l\.provider = \$1 AND l\.subject = \$2/);
+  assert.doesNotMatch(pool.log[0].sql, /email/);
+  assert.deepEqual(pool.log[0].params, ['google', 'g-sub-9']);
+});
+
+// --- signing in with Google (task 1004993, ADR 0396) -------------------------
+
+test('a returning Google sign-in finds the person, stamps the way in and answers their handle', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [{ account_id: 77, person_key: '-3' }] }],
+    [/UPDATE platform_identity_account_logins SET last_used_at/, { rows: [], rowCount: 1 }],
+    [/SELECT handle, github_login FROM platform_identity_accounts/, { rows: [{ handle: 'janedoe', github_login: null }] }],
+  ]);
+  const out = await logins.signInWithLogin({ provider: 'google', subject: 'g-sub-1', email: 'new@example.com' }, { pool });
+  assert.deepEqual(out, { personKey: '-3', handle: 'janedoe', githubLogin: null, created: false });
+  const stamp = pool.log.find((q) => /SET last_used_at/.test(q.sql));
+  assert.deepEqual(stamp.params, ['google', 'g-sub-1', 'new@example.com'], 'keyed on Google\'s id; the email is only stored');
+  assert.ok(!pool.log.some((q) => /INSERT/.test(q.sql)), 'no second person');
+  assert.ok(!pool.log.some((q) => /WHERE[^;]*email/.test(q.sql)), 'no statement looks a person up by email');
+});
+
+test('a first Google sign-in creates the person and says so', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [] }],
+    [/INSERT INTO platform_identity_accounts/, { rows: [{ id: 80, person_key: '-6' }] }],
+    [/INSERT INTO platform_identity_account_logins/, { rows: [], rowCount: 1 }],
+    [/UPDATE platform_identity_accounts\s+SET handle/, { rows: [{ handle: 'ana' }], rowCount: 1 }],
+    [/SELECT handle, github_login FROM platform_identity_accounts/, { rows: [{ handle: 'ana', github_login: null }] }],
+  ]);
+  const out = await logins.signInWithLogin({ provider: 'google', subject: 'g-new', displayName: 'Ana' }, { pool });
+  assert.deepEqual(out, { personKey: '-6', handle: 'ana', githubLogin: null, created: true });
+  assert.ok(!pool.log.some((q) => /SET last_used_at/.test(q.sql)), 'a new way in was written with last_used_at already');
+});
+
+test('a person who links GitHub later answers their real GitHub login', async () => {
+  const pool = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, { rows: [{ account_id: 9, person_key: '583231' }] }],
+    [/SELECT handle, github_login FROM platform_identity_accounts/, { rows: [{ handle: 'octo', github_login: 'octocat' }] }],
+  ]);
+  const out = await logins.signInWithLogin({ provider: 'google', subject: 'g-linked' }, { pool });
+  assert.equal(out.githubLogin, 'octocat');
+});
+
+test('a minted key never takes a GitHub login from a caller, on insert or update', async () => {
+  const pool = fakePool([[/INSERT INTO platform_identity_accounts/, { rows: [{ github_id: '-3', handle: 'ana' }] }]]);
+  await pi.upsertAccount({ githubId: '-3', githubLogin: '~ana', displayName: 'Ana', activate: true }, { pool });
+  const q = pool.log.find((x) => /INSERT INTO platform_identity_accounts/.test(x.sql));
+  assert.match(q.sql, /VALUES \(\$1, CASE WHEN \$1::bigint < 0 THEN NULL ELSE \$2 END,/, 'a minted key is inserted with no login');
+  assert.match(q.sql, /github_login = CASE WHEN platform_identity_accounts\.github_id < 0 THEN platform_identity_accounts\.github_login ELSE EXCLUDED\.github_login END/,
+    'a minted key keeps the login only linking sets');
+});
+
+// --- the route ---------------------------------------------------------------
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', profileRoutes());
+app.use('/api/bongos', myProjectsRoutes());
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function get(pathname) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: data ? JSON.parse(data) : null }));
+    }).on('error', reject);
+  });
+}
+
+test('GET /me/sign-in-methods lists the signed-in person\'s own ways in, and no provider ids', async () => {
+  ME = '-3';
+  scriptRoute([
+    [/FROM platform_identity_account_logins l\s+JOIN platform_identity_accounts a/, (_s, params) => ({
+      rows: params[0] === '-3'
+        ? [{ provider: 'github', email: null, created_at: '2026-10-29T00:00:00Z', last_used_at: null },
+          { provider: 'google', email: 'jane@example.com', created_at: '2026-10-28T00:00:00Z', last_used_at: '2026-10-29T00:00:00Z' }]
+        : [],
+    })],
+  ]);
+  const res = await get('/api/bongos/me/sign-in-methods');
+  assert.equal(res.status, 200);
+  assert.equal(res.headers['cache-control'], 'no-store');
+  assert.deepEqual(res.body.providers, ['github', 'google']);
+  assert.deepEqual(res.body.methods.map((m) => m.provider), ['github', 'google']);
+  assert.ok(!JSON.stringify(res.body).includes('subject'), 'provider ids never cross');
+  const q = routePool.log[0];
+  assert.deepEqual(q.params, ['-3', ['github', 'google']], 'keyed on the signed-in person, never a caller-named one');
+  assert.doesNotMatch(q.sql, /l\.subject/, 'the provider id is not even selected');
+});
+
+test('GET /me/sign-in-methods answers [] for a system principal without touching the database', async () => {
+  ME = 'system:bfg';
+  scriptRoute([]);
+  const res = await get('/api/bongos/me/sign-in-methods');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body.methods, []);
+  assert.equal(routePool.log.length, 0);
+});
+
+test('GET /me/sign-in-methods fails closed on a read error', async () => {
+  ME = '4242';
+  scriptRoute([[/./, () => { throw new Error('db down'); }]]);
+  const origError = console.error;
+  console.error = () => {};
+  try {
+    const res = await get('/api/bongos/me/sign-in-methods');
+    assert.equal(res.status, 500);
+    assert.ok(!('methods' in (res.body || {})));
+  } finally {
+    console.error = origError;
+  }
+});
+
+test('a Google-only person is not relayed to a project until halls can take one (task 1004994)', async () => {
+  ME = '-3';
+  scriptRoute([]);
+  try {
+    const res = await new Promise((resolve, reject) => {
+      const body = JSON.stringify({ origin: 'https://proj.example.com' });
+      const r = http.request({ host: '127.0.0.1', port, path: '/api/bongos/my-projects/join', method: 'POST',
+        headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) } }, (resp) => {
+        let data = ''; resp.on('data', (c) => { data += c; }); resp.on('end', () => resolve({ status: resp.statusCode, body: JSON.parse(data) }));
+      });
+      r.on('error', reject); r.end(body);
+    });
+    assert.equal(res.status, 409);
+    assert.equal(res.body.error.code, 'google_join_not_yet');
+    assert.equal(routePool.log.length, 0, 'nothing was read or relayed');
+  } finally { ME = '4242'; }
+});

package/tests/account_logins_db.mjs

@@ -0,0 +1,161 @@
+// tests/account_logins_db.mjs — the ways a person signs in, against real SQL
+// (task 1004992, ADR 0393). The DB-free sibling is tests/account_logins.mjs; this
+// file proves what a fake pool cannot execute: the UNIQUE constraints, the
+// sequence, the trigger, the backfill and a real race.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the INTEGRATION set
+// of scripts/bongos/run-unit-tests.js.
+//
+// Run:  DATABASE_URL=... node tests/account_logins_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const logins = require('../modules/platform-identity/account-logins.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`account_logins_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const GH = 90499201; // a GitHub-born account
+const GH_OLD = 90499202; // an account from before migration 034
+const SUB = (s) => `t1004992-${s}`;
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(
+    `DELETE FROM platform_identity_accounts
+      WHERE github_id = ANY($1::bigint[])
+         OR id IN (SELECT account_id FROM platform_identity_account_logins WHERE subject LIKE 't1004992-%')`,
+    [[GH, GH_OLD]],
+  ).catch(() => {});
+}
+const loginRows = async (accountId) => (await q(
+  `SELECT provider, subject, email FROM platform_identity_account_logins WHERE account_id = $1 ORDER BY provider`,
+  [accountId],
+)).rows;
+const accountRow = async (key) => (await q(
+  `SELECT id, github_id::text AS key, github_login, handle, profile_state FROM platform_identity_accounts WHERE github_id = $1`,
+  [key],
+)).rows[0];
+const code = async (p) => { try { await p; return null; } catch (e) { return e.code; } };
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_007_profile_consent.sql',
+    'platform_identity_008_handle.sql', 'platform_identity_009_profile_fields.sql',
+    'platform_identity_012_account_privacy.sql', 'platform_identity_019_terms_acceptance.sql',
+    'platform_identity_024_terms_grandfathered.sql',
+  ]) await q(migrationSql(f));
+  await cleanup();
+
+  // An account from before this change: created, then its login row removed, as
+  // if 034 had not run yet. Re-running 034 must backfill it — and re-running is safe.
+  await q(`INSERT INTO platform_identity_accounts (github_id, github_login) VALUES ($1, 'old-octo')`, [GH_OLD]).catch(() => {});
+  await q(migrationSql('platform_identity_034_account_logins.sql'));
+  const old = await accountRow(GH_OLD);
+  await q(`DELETE FROM platform_identity_account_logins WHERE account_id = $1`, [old.id]);
+  await q(migrationSql('platform_identity_034_account_logins.sql'));
+  same(await loginRows(old.id), [{ provider: 'github', subject: String(GH_OLD), email: null }],
+    'every existing account gets its GitHub way in, and the migration re-runs safely');
+
+  // 1 — a GitHub-born account gets its login row from the trigger, with no writer change.
+  await q(`INSERT INTO platform_identity_accounts (github_id, github_login) VALUES ($1, 'octo')`, [GH]);
+  const gh = await accountRow(GH);
+  same(await loginRows(gh.id), [{ provider: 'github', subject: String(GH), email: null }],
+    'an account born through GitHub has its GitHub way in, written by the trigger');
+
+  // 2 — a person arriving through Google: a minted negative key, no GitHub login.
+  const jane = await logins.createAccountForLogin(
+    { provider: 'google', subject: SUB('jane'), email: 'jane@example.com', displayName: 'Jane Doe' }, { pool });
+  ok(jane.created && logins.isMintedPersonKey(jane.personKey), `a Google arrival gets a minted negative key (${jane.personKey})`);
+  const janeRow = await accountRow(jane.personKey);
+  same([janeRow.github_login, janeRow.profile_state], [null, 'provisional'], 'no GitHub login is invented, and the account is provisional');
+  ok(/^janedoe(-\d+)?$/.test(janeRow.handle), `the handle grows from the name (${janeRow.handle})`);
+  same(await loginRows(janeRow.id), [{ provider: 'google', subject: SUB('jane'), email: 'jane@example.com' }],
+    'only the Google way in — the trigger writes no GitHub row for a minted key');
+
+  // 3 — the same Google identity again reaches the same person.
+  const again = await logins.createAccountForLogin({ provider: 'google', subject: SUB('jane') }, { pool });
+  same([again.personKey, again.created], [jane.personKey, false], 'signing up twice with one Google account is one person');
+  same(await logins.findPersonByLogin({ provider: 'google', subject: SUB('jane') }, { pool }),
+    { accountId: janeRow.id, personKey: jane.personKey }, 'the sign-in lookup finds them');
+
+  // 4 — a real race: two sign-ups for one new identity at once make one person.
+  const [r1, r2] = await Promise.all([
+    logins.createAccountForLogin({ provider: 'google', subject: SUB('race') }, { pool }),
+    logins.createAccountForLogin({ provider: 'google', subject: SUB('race') }, { pool }),
+  ]);
+  same(r1.personKey, r2.personKey, 'racing sign-ups land on one key');
+  const raced = (await q(
+    `SELECT count(*)::int AS n FROM platform_identity_account_logins WHERE provider = 'google' AND subject = $1`, [SUB('race')],
+  )).rows[0].n;
+  same(raced, 1, 'and one way in');
+  const orphans = (await q(
+    `SELECT count(*)::int AS n FROM platform_identity_accounts a
+      WHERE a.github_id < 0 AND NOT EXISTS (SELECT 1 FROM platform_identity_account_logins l WHERE l.account_id = a.id)`,
+  )).rows[0].n;
+  same(orphans, 0, 'the losing request left no account without a way in');
+
+  // 5 — the database refuses a second owner, and a second way in of one kind.
+  same(await code(q(
+    `INSERT INTO platform_identity_account_logins (account_id, provider, subject) VALUES ($1, 'google', $2)`, [gh.id, SUB('jane')],
+  )), '23505', 'a Google identity can belong to only one person');
+  await q(`INSERT INTO platform_identity_account_logins (account_id, provider, subject, email) VALUES ($1, 'google', $2, 'octo@example.com')`,
+    [gh.id, SUB('octo')]);
+  same(await code(q(
+    `INSERT INTO platform_identity_account_logins (account_id, provider, subject) VALUES ($1, 'google', $2)`, [gh.id, SUB('octo2')],
+  )), '23505', 'a person holds at most one Google way in');
+  same(await code(q(
+    `INSERT INTO platform_identity_account_logins (account_id, provider, subject) VALUES ($1, 'email', 'a@b.c')`, [gh.id],
+  )), '23514', 'an unknown provider is refused by the database');
+
+  // 6 — the own-scope read lists the person's ways in, GitHub first, and no ids.
+  const listed = await logins.listLoginsForPerson(String(GH), { pool });
+  same(listed.map((m) => [m.provider, m.email]), [['github', null], ['google', 'octo@example.com']],
+    'a person with both ways in sees both, GitHub first');
+  ok(listed.every((m) => !('subject' in m)), 'provider ids never leave the read');
+  same((await logins.listLoginsForPerson(jane.personKey, { pool })).map((m) => m.provider), ['google'],
+    'a minted key reads its own ways in');
+
+  // 7 — a minted key stays the key: the sequence never hands out a GitHub-shaped id.
+  const keys = (await q(`SELECT github_id FROM platform_identity_accounts WHERE id IN (
+    SELECT account_id FROM platform_identity_account_logins WHERE subject LIKE 't1004992-%' AND provider = 'google')
+    AND github_id < 0`)).rows;
+  ok(keys.length >= 2, 'every Google-born fixture holds a negative key');
+
+  // 8 — signing in with Google (task 1004993, ADR 0396): the same person every time,
+  // found by Google's id; and the hub's own sign-in never writes the core stand-in
+  // (or any login) onto a minted key.
+  const pi = require('../modules/platform-identity/platform-identity.js');
+  const first = await logins.signInWithLogin({ provider: 'google', subject: SUB('signin'), email: 'one@example.com', displayName: 'Sign In' }, { pool });
+  ok(first.created && /^-\d+$/.test(first.personKey), 'a first Google sign-in creates a person with a minted key');
+  const second = await logins.signInWithLogin({ provider: 'google', subject: SUB('signin'), email: 'two@example.com' }, { pool });
+  same([second.personKey, second.created], [first.personKey, false], 'signing in again reaches the same person');
+  same((await logins.listLoginsForPerson(first.personKey, { pool }))[0].email, 'two@example.com', 'the shown email follows the latest sign-in');
+  await pi.upsertAccount({ githubId: first.personKey, githubLogin: '~signin', displayName: 'Sign In', activate: true }, { pool });
+  const after = await accountRow(first.personKey);
+  same([after.github_login, after.profile_state], [null, 'active'], 'the hub sign-in activates the person and writes no login');
+
+  console.log(`\naccount_logins_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}