@byline/admin 6.7.2 → 6.9.0

package/src/forms/form-renderer.tsx

@@ -10,7 +10,7 @@
 
 import { type ReactNode, useCallback, useEffect, useMemo, useRef, useState } from 'react'
 
-import type { AdminResourceConfig, Field, WorkflowStatus } from '@byline/core'
+import type { AdminResourceConfig, Field, UnavailableBlock, WorkflowStatus } from '@byline/core'
 import { getAdminConfig } from '@byline/core'
 import { useTranslation } from '@byline/i18n/react'
 import cx from 'clsx'
@@ -33,6 +33,7 @@ import {
   useScheduledPublication,
 } from './scheduled-publication-control'
 import { computeStatusTransitions } from './status-transitions'
+import { UnavailableBlocksProvider } from './unavailable-blocks'
 import { useDocumentReloadRecovery } from './use-document-reload-recovery'
 import { type SystemFieldsSubmitPayload, useFormSubmission } from './use-form-submission'
 import type { DocumentActionsLocaleOption } from './document-actions'
@@ -168,6 +169,7 @@ export interface FormRendererProps {
    * them with the new shape.
    */
   restoreWarnings?: string[]
+  unavailableBlocks?: UnavailableBlock[]
   /**
    * Default content locale used when no `initialLocale` is supplied and as the
    * fallback inside `PathWidget`. Hosts typically pass their app-wide
@@ -225,6 +227,7 @@ const FormContent = ({
   defaultLocale = 'en',
   useNavigationGuard: useNavigationGuardProp,
   restoreWarnings,
+  unavailableBlocks,
   _activeTabBySet,
   _onTabChange,
 }: FormRendererProps & {
@@ -455,6 +458,7 @@ const FormContent = ({
             onDiscardRequested={requestDiscard}
             scheduling={scheduling}
             restoreWarnings={restoreWarnings}
+            unavailableBlocks={unavailableBlocks}
           />
           <FormLayout
             fields={fields}
@@ -516,23 +520,28 @@ export const FormRenderer = (props: FormRendererProps) => {
   const savedTabsRef = useRef<Record<string, string>>({})
 
   return (
-    <FormProvider
-      key={`${initialLocale ?? 'default'}-${initialData?.versionId ?? ''}`}
-      initialData={initialData}
-      documentId={mode === 'edit' && typeof initialData?.id === 'string' ? initialData.id : null}
-      collectionPath={collectionPath ?? null}
+    <UnavailableBlocksProvider
+      issues={props.unavailableBlocks}
+      fields={initialData?.fields ?? initialData ?? {}}
     >
-      {/* Forwarded wholesale. An enumerated prop list here silently dropped
+      <FormProvider
+        key={`${initialLocale ?? 'default'}-${initialData?.versionId ?? ''}`}
+        initialData={initialData}
+        documentId={mode === 'edit' && typeof initialData?.id === 'string' ? initialData.id : null}
+        collectionPath={collectionPath ?? null}
+      >
+        {/* Forwarded wholesale. An enumerated prop list here silently dropped
           every prop added to FormRendererProps but not copied down — which is
           how the scheduled-publication handlers reached FormContent as
           `undefined` and the control never rendered. */}
-      <FormContent
-        {...props}
-        _activeTabBySet={savedTabsRef.current}
-        _onTabChange={(tabSetName, tabName) => {
-          savedTabsRef.current = { ...savedTabsRef.current, [tabSetName]: tabName }
-        }}
-      />
-    </FormProvider>
+        <FormContent
+          {...props}
+          _activeTabBySet={savedTabsRef.current}
+          _onTabChange={(tabSetName, tabName) => {
+            savedTabsRef.current = { ...savedTabsRef.current, [tabSetName]: tabName }
+          }}
+        />
+      </FormProvider>
+    </UnavailableBlocksProvider>
   )
 }

package/src/forms/unavailable-blocks.test.tsx

@@ -0,0 +1,152 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { act } from 'react'
+
+import { type BlocksField as BlocksFieldType, defineAdminConfig } from '@byline/core'
+import { adminTranslations } from '@byline/i18n/admin'
+import { I18nProvider } from '@byline/i18n/react'
+import { createRoot } from 'react-dom/client'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+import { BlocksField } from '../fields/blocks/blocks-field'
+import { FormProvider, useFormContext } from './form-context'
+import { FormConcurrencyNotices } from './form-page-chrome'
+import { UnavailableBlocksProvider, useUnavailableBlocks } from './unavailable-blocks'
+
+vi.mock('../fields/group/group-field', () => ({
+  GroupField: ({ path }: { path: string }) => {
+    const form = useFormContext()
+    return (
+      <button
+        type="button"
+        data-live={path}
+        onClick={() =>
+          form.appendPatch({ kind: 'field.set', path: `${path}.text`, value: 'edited' })
+        }
+      >
+        Edit live
+      </button>
+    )
+  },
+}))
+vi.mock('../fields/sortable-item', () => ({
+  SortableItem: ({ children }: any) => <div>{children}</div>,
+  StaticItem: ({ children }: any) => <div>{children}</div>,
+}))
+
+const field: BlocksFieldType = {
+  name: 'content',
+  type: 'blocks',
+  blocks: [{ blockType: 'live', fields: [{ name: 'text', type: 'text' }] }],
+}
+const fields = {
+  content: [
+    { _id: 'a', _type: 'live', text: 'A' },
+    { _id: 'b', _type: 'live', text: 'B' },
+  ],
+}
+const issues = [0, 2, 4].map((storedIndex) => ({
+  fieldPath: 'content',
+  storedIndex,
+  blockType: `removed-${storedIndex}`,
+}))
+let container: HTMLDivElement
+let root: ReturnType<typeof createRoot>
+let form: ReturnType<typeof useFormContext>
+function Probe() {
+  form = useFormContext()
+  return null
+}
+function render(reports = issues) {
+  act(() =>
+    root.render(
+      <I18nProvider
+        bundle={adminTranslations({ locales: ['en'] })}
+        activeLocale="en"
+        defaultLocale="en"
+        localeDefinitions={[{ code: 'en', nativeName: 'English' }]}
+      >
+        <UnavailableBlocksProvider issues={reports} fields={fields}>
+          <FormProvider initialData={{ fields }}>
+            <Probe />
+            <FormConcurrencyNotices
+              disabled={false}
+              warningRef={{ current: null }}
+              discarding={false}
+              reloadFailed={false}
+              onDiscardRequested={() => {}}
+              scheduling={{ modal: null, state: { isExceptional: false }, timeZone: 'UTC' } as any}
+              unavailableBlocks={reports}
+            />
+            <BlocksField field={field} path="content" defaultValue={fields.content} />
+          </FormProvider>
+        </UnavailableBlocksProvider>
+      </I18nProvider>
+    )
+  )
+}
+beforeEach(() => {
+  vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
+  defineAdminConfig({
+    collections: [],
+    i18n: {
+      admin: { defaultLocale: 'en', locales: ['en'] },
+      content: { defaultLocale: 'en', locales: ['en'] },
+    },
+  })
+  container = document.createElement('div')
+  document.body.append(container)
+  root = createRoot(container)
+})
+afterEach(() => {
+  act(() => root.unmount())
+  container.remove()
+  vi.unstubAllGlobals()
+})
+it('interleaves display-only cards, keeps live patch addressing, and clears notices after reload', async () => {
+  render()
+  expect(container.textContent).toContain('This document contains 3 blocks')
+  const entries = [...container.querySelectorAll('[role="note"], [data-live]')]
+  expect(
+    entries.map(
+      (entry) => entry.getAttribute('data-live') ?? entry.querySelector('strong')?.textContent
+    )
+  ).toEqual([
+    'Unavailable block: removed-0',
+    'content[id=a]',
+    'Unavailable block: removed-2',
+    'content[id=b]',
+    'Unavailable block: removed-4',
+  ])
+  expect(form.getFieldValues()).toEqual(fields)
+  await act(async () => (container.querySelectorAll('[data-live]')[1] as HTMLButtonElement).click())
+  expect(form.getPatches()).toEqual([
+    { kind: 'field.set', path: 'content[id=b].text', value: 'edited' },
+  ])
+  render([])
+  expect(container.querySelector('[role="note"]')).toBeNull()
+  expect(container.textContent).not.toContain('This document contains')
+})
+it('binds nested paths to surviving parent identities', () => {
+  function NestedProbe() {
+    const issues = useUnavailableBlocks('outer[id=parent].body[id=second].content')
+    return <span>{issues.map((issue) => issue.blockType).join(',')}</span>
+  }
+  act(() =>
+    root.render(
+      <UnavailableBlocksProvider
+        issues={[{ fieldPath: 'outer[0].body[1].content', storedIndex: 0, blockType: 'removed' }]}
+        fields={{ outer: [{ _id: 'parent', body: [{ _id: 'first' }, { _id: 'second' }] }] }}
+      >
+        <NestedProbe />
+      </UnavailableBlocksProvider>
+    )
+  )
+  expect(container.textContent).toBe('removed')
+})

package/src/forms/unavailable-blocks.tsx

@@ -0,0 +1,58 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import type { ReactNode } from 'react'
+import { createContext, useContext, useMemo } from 'react'
+
+import { parseInstancePath, type UnavailableBlock } from '@byline/core'
+
+import { repeatingItemPath } from './repeating-items'
+
+const UnavailableBlocksContext = createContext<readonly UnavailableBlock[]>([])
+
+/** Bind numeric read paths to initial item identities, so cards follow moved parents. */
+function bindUnavailableBlocks(
+  issues: readonly UnavailableBlock[],
+  fields: Record<string, any>
+): UnavailableBlock[] {
+  return issues.map((issue) => {
+    const parsed = parseInstancePath(issue.fieldPath)
+    if (!parsed.ok) return issue
+    let value: any = fields
+    let path = ''
+    for (const segment of parsed.segments) {
+      if (segment.kind === 'field') {
+        path = path ? `${path}.${segment.name}` : segment.name
+        value = value?.[segment.name]
+      } else if (segment.kind === 'index') {
+        value = value?.[segment.index]
+        path = repeatingItemPath(path, value, segment.index)
+      }
+    }
+    return { ...issue, fieldPath: path }
+  })
+}
+
+export function UnavailableBlocksProvider({
+  issues,
+  fields,
+  children,
+}: {
+  issues?: readonly UnavailableBlock[]
+  fields: Record<string, any>
+  children: ReactNode
+}) {
+  const bound = useMemo(() => bindUnavailableBlocks(issues ?? [], fields), [issues, fields])
+  return (
+    <UnavailableBlocksContext.Provider value={bound}>{children}</UnavailableBlocksContext.Provider>
+  )
+}
+
+export function useUnavailableBlocks(path: string) {
+  return useContext(UnavailableBlocksContext).filter((issue) => issue.fieldPath === path)
+}

package/src/modules/admin-account/components/change-password.tsx

@@ -215,7 +215,7 @@ export function ChangeAccountPassword({ account, onClose, onSuccess }: ChangePas
         <div className={cx('byline-account-change-password-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-account-change-password-action', styles.action)}

package/src/modules/admin-account/components/container.module.css

@@ -13,6 +13,7 @@
  *   .byline-account-status-on
  *   .byline-account-status-off
  *   .byline-account-status-help   — italic helper line on Account Status card
+ *   .byline-account-preferences-theme — colour theme block inside Preferences
  *   .byline-account-drawer        — drawer responsive width override
  *   .byline-account-drawer-body   — drawer content container
  *   .byline-account-drawer-scroll — drawer scrollable inner viewport
@@ -92,6 +93,14 @@
   font-size: var(--font-size-xs);
 }
 
+.preferences-theme,
+:global(.byline-account-preferences-theme) {
+  display: flex;
+  flex-direction: column;
+  gap: var(--spacing-8);
+  margin-top: var(--spacing-20);
+}
+
 /*
  * Italic helper for "Not set" placeholders. Replaces the Tailwind
  * `italic` utility we used pre-lift; with the component now in a

package/src/modules/admin-account/components/container.tsx

@@ -32,6 +32,7 @@ import { useTranslation } from '@byline/i18n/react'
 import { CloseIcon, Drawer, EditIcon, IconButton } from '@byline/ui/react'
 import cx from 'clsx'
 
+import { PasskeyManager } from '../../auth/components/passkey-manager.js'
 import { ChangeAccountPassword } from './change-password.js'
 import styles from './container.module.css'
 import { Preferences } from './preferences.js'
@@ -180,6 +181,12 @@ export function AccountSelfContainer({ account }: AccountSelfContainerProps) {
             <p className={cx('muted', 'byline-account-status-help', styles['status-help'])}>
               {t('account.preferences.help')}
             </p>
+            <div className={cx('byline-account-preferences-theme', styles['preferences-theme'])}>
+              <p className={cx('byline-account-line', styles.line)}>
+                <span className="muted">{t('account.appearance.colorTheme')}</span>
+              </p>
+              <ThemeSwitch />
+            </div>
           </ContainerSection>
         </div>
 
@@ -192,9 +199,11 @@ export function AccountSelfContainer({ account }: AccountSelfContainerProps) {
             <p className={cx('byline-account-line', styles.line)}>{t('account.password.intro')}</p>
           </ContainerSection>
 
-          <ContainerSection title={t('account.sections.appearance')}>
-            <ThemeSwitch />
-          </ContainerSection>
+          <PasskeyManager
+            targetUserId={currentAccount.id}
+            targetIsSuperAdmin={currentAccount.is_super_admin}
+            section={ContainerSection}
+          />
 
           <ContainerSection title={t('account.sections.status')}>
             <p className={cx('byline-account-line', styles.line)}>

package/src/modules/admin-account/components/preferences.tsx

@@ -172,7 +172,7 @@ export function Preferences({ account, onClose, onSuccess }: PreferencesProps) {
         <div className={cx('byline-account-preferences-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-account-preferences-action', styles.action)}

package/src/modules/admin-account/components/update.tsx

@@ -240,7 +240,7 @@ export function UpdateAccount({ account, onClose, onSuccess }: UpdateAccountProp
         <div className={cx('byline-account-update-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-account-update-action', styles.action)}

package/src/modules/admin-roles/components/create.tsx

@@ -192,7 +192,7 @@ export function CreateAdminRole({ onClose, onSuccess }: CreateAdminRoleProps) {
         <div className={cx('byline-role-create-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-role-create-action', styles.action)}

package/src/modules/admin-roles/components/permissions.tsx

@@ -288,7 +288,7 @@ export function RolePermissions({
           <div className={cx('byline-role-permissions-actions', styles.actions)}>
             <Button
               type="button"
-              intent="secondary"
+              intent="noeffect"
               size="xs"
               onClick={handleCancel}
               disabled={saving}

package/src/modules/admin-roles/components/update.tsx

@@ -188,7 +188,7 @@ export function UpdateRole({ role, onClose, onSuccess }: UpdateRoleProps) {
         <div className={cx('byline-role-update-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-role-update-action', styles.action)}

package/src/modules/admin-users/abilities.ts

@@ -32,6 +32,7 @@ export const ADMIN_USERS_ABILITIES = {
   update: 'admin.users.update',
   delete: 'admin.users.delete',
   changePassword: 'admin.users.changePassword',
+  managePasskeys: 'admin.users.managePasskeys',
 } as const
 
 export type AdminUsersAbilityKey =
@@ -43,6 +44,12 @@ export type AdminUsersAbilityKey =
  * the webapp wires into `initBylineCore()`.
  */
 export function registerAdminUsersAbilities(registry: AbilityRegistry): void {
+  registry.register({
+    key: ADMIN_USERS_ABILITIES.managePasskeys,
+    label: 'Manage admin user passkeys',
+    group: 'admin.users',
+    source: 'admin',
+  })
   registry.register({
     key: ADMIN_USERS_ABILITIES.read,
     label: 'Read admin users',

package/src/modules/admin-users/components/create.tsx

@@ -299,7 +299,7 @@ export function CreateAdminUser({ onClose, onSuccess }: CreateAdminUserProps) {
         <div className={cx('byline-user-create-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-user-create-action', styles.action)}

package/src/modules/admin-users/components/roles.tsx

@@ -143,7 +143,7 @@ export function UserRoles({ user, allRoles, initialRoleIds, onClose, onSaved }:
       <div className={cx('byline-user-roles-actions', styles.actions)}>
         <Button
           type="button"
-          intent="secondary"
+          intent="noeffect"
           size="xs"
           onClick={onClose}
           disabled={saving}

package/src/modules/admin-users/components/set-password.tsx

@@ -160,7 +160,7 @@ export function SetPassword({ user, onClose, onSuccess }: SetPasswordProps) {
         <div className={cx('byline-user-set-password-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-user-set-password-action', styles.action)}

package/src/modules/admin-users/components/update.tsx

@@ -295,7 +295,7 @@ export function UpdateUser({ user, onClose, onSuccess }: UpdateUserProps) {
         <div className={cx('byline-user-update-actions', styles.actions)}>
           <Button
             type="button"
-            intent="secondary"
+            intent="noeffect"
             size="sm"
             onClick={onClose}
             className={cx('byline-user-update-action', styles.action)}

package/src/modules/auth/auth-maintenance-repository.ts

@@ -0,0 +1,26 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/** Bounded housekeeping; expiry and revocation remain independent authorization checks. */
+export interface AuthMaintenanceRepository {
+  /** Remove at most 100 attempts expired or consumed on/before the supplied grace cutoff. */
+  purgeAttempts(before: Date): Promise<number>
+  /** Candidate only: eligibility must be checked again under its owning account lock. */
+  findTerminalLogin(before: Date): Promise<{ id: string; adminUserId: string } | null>
+  /**
+   * Requires the owning account lock. Re-read eligibility, delete at most 100 refresh
+   * children, then delete the terminal parent only if no children remain. Never cascade.
+   */
+  pruneTerminalLogin(input: {
+    id: string
+    adminUserId: string
+    before: Date
+  }): Promise<{ refreshDeleted: number; loginDeleted: boolean }>
+  /** Remove at most 100 legacy null-sid rows expired on/before the retention cutoff. */
+  purgeLegacyRefreshTokens(before: Date): Promise<number>
+}

package/src/modules/auth/auth-maintenance.test.node.ts

@@ -0,0 +1,110 @@
+import type { RecurringTaskContext } from '@byline/core'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { createAuthMaintenanceTasks } from './auth-maintenance.js'
+import type { AdminStore } from '../../store.js'
+
+let store: AdminStore
+let context: RecurringTaskContext
+const now = new Date('2026-10-16T12:00:00Z')
+beforeEach(() => {
+  store = {
+    authMaintenance: {
+      purgeAttempts: vi.fn().mockResolvedValue(0),
+      findTerminalLogin: vi.fn().mockResolvedValue(null),
+      pruneTerminalLogin: vi.fn(),
+      purgeLegacyRefreshTokens: vi.fn().mockResolvedValue(0),
+    },
+  } as unknown as AdminStore
+  store.withSessionLock = vi.fn(async (_id, work) => work(store, null))
+  context = {
+    taskName: 'test',
+    scheduledFor: now,
+    signal: new AbortController().signal,
+    heartbeat: vi.fn().mockResolvedValue(undefined),
+    logger: {},
+  } as unknown as RecurringTaskContext
+})
+afterEach(() => vi.restoreAllMocks())
+describe('bounded auth maintenance tasks', () => {
+  it('registers three one-minute leased tasks without doing any work', () => {
+    const tasks = createAuthMaintenanceTasks(store)
+    expect(tasks.map((t) => t.name)).toEqual([
+      'auth.maintenance.attempts',
+      'auth.maintenance.logins',
+      'auth.maintenance.legacy-refresh',
+    ])
+    expect(tasks.every((t) => t.intervalMs === 60_000 && t.leaseMs === 60_000)).toBe(true)
+    expect(store.authMaintenance.purgeAttempts).not.toHaveBeenCalled()
+  })
+  it('uses separate five-minute and 30-day cutoffs', async () => {
+    const tasks = createAuthMaintenanceTasks(store, () => now)
+    for (const task of tasks) expect(await task.run(context)).toEqual({ workRemaining: false })
+    expect(store.authMaintenance.purgeAttempts).toHaveBeenCalledWith(
+      new Date(now.getTime() - 300_000)
+    )
+    expect(store.authMaintenance.findTerminalLogin).toHaveBeenCalledWith(
+      new Date(now.getTime() - 30 * 86_400_000)
+    )
+    expect(store.authMaintenance.purgeLegacyRefreshTokens).toHaveBeenCalledWith(
+      new Date(now.getTime() - 30 * 86_400_000)
+    )
+  })
+  it('stops at 32 full batches and heartbeats before each', async () => {
+    vi.mocked(store.authMaintenance.purgeAttempts).mockResolvedValue(100)
+    const [task] = createAuthMaintenanceTasks(store)
+    expect(await task!.run(context)).toEqual({ workRemaining: true })
+    expect(store.authMaintenance.purgeAttempts).toHaveBeenCalledTimes(32)
+    expect(context.heartbeat).toHaveBeenCalledTimes(32)
+  })
+  it('stops when the elapsed-time budget is reached', async () => {
+    vi.spyOn(performance, 'now')
+      .mockReturnValueOnce(0)
+      .mockReturnValueOnce(0)
+      .mockReturnValue(30_000)
+    vi.mocked(store.authMaintenance.purgeAttempts).mockResolvedValue(100)
+    expect(await createAuthMaintenanceTasks(store)[0]!.run(context)).toEqual({
+      workRemaining: true,
+    })
+    expect(store.authMaintenance.purgeAttempts).toHaveBeenCalledOnce()
+  })
+  it.each(['before', 'heartbeat'])('honours abort %s batch admission', async (phase) => {
+    const abort = new AbortController()
+    context.signal = abort.signal
+    if (phase === 'before') abort.abort(new Error('stopped'))
+    else
+      vi.mocked(context.heartbeat).mockImplementation(async () => {
+        abort.abort(new Error('stopped'))
+      })
+    await expect(createAuthMaintenanceTasks(store)[0]!.run(context)).rejects.toThrow('stopped')
+    expect(store.authMaintenance.purgeAttempts).not.toHaveBeenCalled()
+  })
+  it('propagates lease loss before cleanup and repository errors to the runner', async () => {
+    vi.mocked(context.heartbeat).mockRejectedValueOnce(new Error('lease lost'))
+    await expect(createAuthMaintenanceTasks(store)[0]!.run(context)).rejects.toThrow('lease lost')
+    expect(store.authMaintenance.purgeAttempts).not.toHaveBeenCalled()
+    vi.mocked(store.authMaintenance.purgeAttempts).mockRejectedValue(
+      new Error('storage unavailable')
+    )
+    await expect(createAuthMaintenanceTasks(store)[0]!.run(context)).rejects.toThrow(
+      'storage unavailable'
+    )
+  })
+  it('uses the scoped store under the candidate account lock and rescans between batches', async () => {
+    const scoped = { authMaintenance: { pruneTerminalLogin: vi.fn() } } as unknown as AdminStore
+    vi.mocked(store.withSessionLock).mockImplementation(async (_id, work) => work(scoped, null))
+    vi.mocked(store.authMaintenance.findTerminalLogin)
+      .mockResolvedValueOnce({ id: 'login', adminUserId: 'actor' })
+      .mockResolvedValue(null)
+    expect(await createAuthMaintenanceTasks(store, () => now)[1]!.run(context)).toEqual({
+      workRemaining: false,
+    })
+    expect(store.withSessionLock).toHaveBeenCalledWith('actor', expect.any(Function))
+    expect(scoped.authMaintenance.pruneTerminalLogin).toHaveBeenCalledWith({
+      id: 'login',
+      adminUserId: 'actor',
+      before: new Date(now.getTime() - 30 * 86_400_000),
+    })
+    expect(store.authMaintenance.pruneTerminalLogin).not.toHaveBeenCalled()
+  })
+})