@elytracms/studio 0.0.95 → 0.0.97

package/convex/depth-codec-lookalike.test.ts

@@ -0,0 +1,192 @@
+import { describe, expect, it } from 'vitest'
+import { convexTest } from 'convex-test'
+import { makeFunctionReference } from 'convex/server'
+import type { ConvexHttpClient } from 'convex/browser'
+import type { FunctionReference } from 'convex/server'
+import { fieldPath, isFoldedEnvelope, measureMaxDepth } from '@elytracms/core/cms-core'
+import type { CmsDocument, CollectionDef } from '@elytracms/core/cms-core'
+import { createOperations } from '@elytracms/core/operations'
+import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
+import schema from './schema'
+
+/**
+ * EC-666 (Codex F22) — the `convex-parity` twin of `core/src/persistence/depth-codec-lookalike.test.ts`:
+ * the operations over the production `ConvexPersistenceAdapter`, whose client is a
+ * call-through onto convex-test's REAL `cms.ts` mutations (the wiring of
+ * `contract-parity.test.ts`), plus raw `ctx.db` reads of what was stored and the REAL
+ * public `delivery:snapshot`.
+ *
+ * An authored draft shaped exactly like the codec's storage envelope must round-trip through
+ * every verb (replace, patch + the patch log, publish, snapshot, pin, restore), be stored
+ * escaped within Convex's 16 levels, and be delivered as the content it is. An envelope that
+ * failed to decode (EC-670) must stay a failed decode after a re-write and a publish. And a
+ * row stored BEFORE the change (the literal v1 envelope, inserted raw) still decodes.
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+const snapshot = makeFunctionReference<'query'>('delivery:snapshot')
+
+const P = 'site'
+const ADMIN = 'user_admin'
+const AT = '2026-10-28T12:00:00.000Z'
+const LOOKALIKE = { type: 'elytra/folded', v: 1, json: '{"title":"DECODED"}' }
+const UNDECODABLE = { type: 'elytra/folded', v: 1, json: '{' }
+
+const collections: CollectionDef[] = [
+  {
+    id: 'post',
+    kind: 'document',
+    fields: [
+      { name: 'title', type: 'text' },
+      {
+        name: 'payload',
+        type: 'object',
+        multiple: false,
+        fields: [
+          { name: 'type', type: 'select', options: [{ value: 'custom' }] },
+          { name: 'v', type: 'number' },
+          { name: 'json', type: 'text' },
+        ],
+      },
+    ],
+  },
+]
+
+interface Backend {
+  query: (ref: FunctionReference<'query'>, args: Record<string, unknown>) => Promise<unknown>
+  mutation: (ref: FunctionReference<'mutation'>, args: Record<string, unknown>) => Promise<unknown>
+}
+
+function asAdapterClient(backend: Backend): ConvexHttpClient {
+  return {
+    query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => backend.query(ref, args ?? {}),
+    mutation: (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) => backend.mutation(ref, args ?? {}),
+  } as unknown as ConvexHttpClient
+}
+
+async function harness() {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: ADMIN, role: 'admin', createdAt: AT, updatedAt: AT })
+  })
+  const asAdmin = t.withIdentity({ subject: ADMIN, issuer: 'https://convex.test' })
+  const adapter = new ConvexPersistenceAdapter(asAdapterClient(asAdmin), P)
+  const ops = createOperations({ adapter, collections: () => collections, validateDocument: () => [] })
+  const raw = async (docId: string) =>
+    t.run(async (ctx) => ({
+      draft: (await ctx.db.query('cmsDocuments').collect()).find((row) => row.docId === docId),
+      versions: (await ctx.db.query('documentVersions').collect()).filter((row) => row.docId === docId),
+      patches: (await ctx.db.query('documentPatches').collect()).filter((row) => row.docId === docId),
+    }))
+  return { t, ops, raw }
+}
+
+function ok<T>(result: { ok: true; value: T } | { ok: false; error: unknown }): T {
+  if (!result.ok) throw new Error(JSON.stringify(result.error))
+  return result.value
+}
+
+const ref = { collection: 'post', id: 'bad' }
+const draft = (payload: unknown, title = 'T'): CmsDocument => ({ ...ref, values: { title, payload } })
+/** A raw stored row's depth as Convex counts it (the row object is level 1). */
+const rowDepth = (row: unknown) => {
+  const { _id, _creationTime, ...stored } = row as Record<string, unknown>
+  void _id
+  void _creationTime
+  return measureMaxDepth(stored).depth
+}
+
+describe('EC-666 (Codex F22) on Convex — an authored envelope lookalike through the real mutations', () => {
+  it('documents.replace round-trips it; the stored row holds it escaped (was: decoded on save)', async () => {
+    const { ops, raw } = await harness()
+    // Control: the ordinary draft round-trips.
+    ok(await ops.documents.replace({ projectId: P, document: { collection: 'post', id: 'good', values: { payload: { type: 'custom', v: 1, json: '{"title":"DECODED"}' } } }, precondition: { ifAbsent: true } }))
+    expect(ok(await ops.documents.get({ projectId: P, ref: { collection: 'post', id: 'good' } })).document.values.payload).toEqual({ type: 'custom', v: 1, json: '{"title":"DECODED"}' })
+    // F22, inverted.
+    const written = ok(await ops.documents.replace({ projectId: P, document: draft(LOOKALIKE), precondition: { ifAbsent: true } }))
+    expect(written.document.values.payload).toEqual(LOOKALIKE)
+    expect(ok(await ops.documents.get({ projectId: P, ref })).document.values.payload).toEqual(LOOKALIKE)
+    // At rest: escaped (an envelope whose payload is the lookalike), within 16 levels.
+    const { draft: row } = await raw('bad')
+    const stored = (row!.document as CmsDocument).values.payload
+    expect(isFoldedEnvelope(stored)).toBe(true)
+    expect(JSON.parse((stored as { json: string }).json)).toEqual(LOOKALIKE)
+    expect(rowDepth(row)).toBeLessThanOrEqual(16)
+  })
+
+  it('every verb returns it as written: patch + the patch log, publish, snapshot, pin, restore — and delivery serves it as content', async () => {
+    const { t, ops, raw } = await harness()
+    const created = ok(await ops.documents.replace({ projectId: P, document: draft({ type: 'custom', v: 1, json: '{}' }), precondition: { ifAbsent: true } }))
+    const patched = ok(await ops.documents.patch({ projectId: P, ref, baseRevision: created.revision, patches: [{ op: 'set', path: fieldPath('payload'), value: LOOKALIKE }] }))
+    expect(patched.document.values.payload).toEqual(LOOKALIKE)
+    const log = ok(await ops.documents.listPatches({ projectId: P, ref }))
+    expect(log.flatMap((row) => row.patches)).toContainEqual({ op: 'set', path: fieldPath('payload'), value: LOOKALIKE })
+
+    const published = ok(await ops.documents.publish({ projectId: P, ref }))
+    const versions = ok(await ops.documents.listVersions({ projectId: P, ref }))
+    expect(versions[0]?.snapshot.values.payload).toEqual(LOOKALIKE)
+    expect(ok(await ops.documents.listPublished({ projectId: P })).map((doc) => doc.values.payload)).toEqual([LOOKALIKE])
+
+    // The public snapshot delivers the lookalike AS CONTENT — never decoded, never withheld.
+    const live = (await t.query(snapshot, { projectId: P })) as { documents: CmsDocument[]; documentIssues: unknown[] }
+    expect(live.documents.map((doc) => doc.values.payload)).toEqual([LOOKALIKE])
+    expect(live.documentIssues).toEqual([])
+
+    ok(await ops.documents.replace({ projectId: P, document: draft({ type: 'custom', v: 2, json: '{}' }, 'moved'), precondition: { revision: published.revision } }))
+    ok(await ops.documents.snapshot({ projectId: P, ref, label: 'manual' }))
+    const firstVersion = versions[0]!.version
+    ok(await ops.documents.pinVersion({ projectId: P, ref, version: firstVersion }))
+    expect(ok(await ops.documents.listPublished({ projectId: P })).map((doc) => doc.values.payload)).toEqual([LOOKALIKE])
+    const restored = ok(await ops.documents.restore({ projectId: P, ref, version: firstVersion }))
+    expect(restored.document.values).toEqual({ title: 'T', payload: LOOKALIKE })
+
+    // Every stored row of the document is within Convex's 16 levels.
+    const rows = await raw('bad')
+    for (const row of [rows.draft, ...rows.versions, ...rows.patches]) expect(rowDepth(row)).toBeLessThanOrEqual(16)
+  })
+
+  it('an envelope that failed to decode stays a failed decode after a re-write and a publish — never laundered', async () => {
+    const { t, ops, raw } = await harness()
+    // Drift stored raw (a dashboard edit, a truncated import): a published document whose
+    // body is an envelope that does not decode.
+    const broken = { ...ref, values: { title: 'T', payload: UNDECODABLE } }
+    await t.run(async (ctx) => {
+      await ctx.db.insert('cmsDocuments', { collection: 'post', docId: 'bad', variant: 'draft', revision: 1, document: broken, publishedVersion: 1, createdAt: AT, updatedAt: AT })
+      await ctx.db.insert('documentVersions', { collection: 'post', docId: 'bad', version: 1, snapshot: broken, kind: 'publish', createdAt: AT })
+    })
+    // The studio read keeps the opaque value (EC-670).
+    const read = ok(await ops.documents.get({ projectId: P, ref }))
+    expect(read.document.values.payload).toEqual(UNDECODABLE)
+    // The editor fixes the title and publishes: the drift is carried, not re-encoded.
+    ok(await ops.documents.patch({ projectId: P, ref, baseRevision: read.revision, patches: [{ op: 'set', path: fieldPath('title'), value: 'edited' }] }))
+    ok(await ops.documents.publish({ projectId: P, ref }))
+    const rows = await raw('bad')
+    expect((rows.draft!.document as CmsDocument).values.payload).toEqual(UNDECODABLE)
+    expect(rows.versions.map((row) => (row.snapshot as CmsDocument).values.payload)).toEqual([UNDECODABLE, UNDECODABLE])
+    // The new pin is still withheld by delivery with its located issue.
+    const live = (await t.query(snapshot, { projectId: P })) as { documents: unknown[]; documentIssues: Array<{ documentId: string; path: unknown[] }> }
+    expect(live.documents).toEqual([])
+    expect(live.documentIssues.map((issue) => [issue.documentId, issue.path])).toEqual([['bad', ['documents', 'post:bad', 'values', 'payload']]])
+  })
+
+  it('a row stored before the change (the literal v1 envelope, inserted raw) still decodes — studio, patch log and delivery', async () => {
+    const { t, ops } = await harness()
+    const v1Body = { type: 'elytra/folded', v: 1, kind: 'blocks', json: '{"version":2,"content":[{"type":"paragraph","content":[]}]}' }
+    const structured = { version: 2, content: [{ type: 'paragraph', content: [] }] }
+    const stored = { collection: 'post', id: 'old', values: { title: 'Old', body: v1Body }, localized: { de: { body: { type: 'elytra/folded', v: 1, json: '{"a":[1]}' } } } }
+    await t.run(async (ctx) => {
+      await ctx.db.insert('cmsDocuments', { collection: 'post', docId: 'old', variant: 'draft', revision: 2, document: stored, publishedVersion: 1, createdAt: AT, updatedAt: AT })
+      await ctx.db.insert('documentVersions', { collection: 'post', docId: 'old', version: 1, snapshot: stored, kind: 'publish', createdAt: AT })
+      await ctx.db.insert('documentPatches', { collection: 'post', docId: 'old', variant: 'draft', revision: 2, kind: 'patch', actor: ADMIN, at: AT, patches: [{ op: 'set', path: fieldPath('body'), value: v1Body }] })
+    })
+    const expected = { collection: 'post', id: 'old', values: { title: 'Old', body: structured }, localized: { de: { body: { a: [1] } } } }
+    expect(ok(await ops.documents.get({ projectId: P, ref: { collection: 'post', id: 'old' } })).document).toEqual(expected)
+    const log = ok(await ops.documents.listPatches({ projectId: P, ref: { collection: 'post', id: 'old' } }))
+    expect(log.flatMap((row) => row.patches)).toEqual([{ op: 'set', path: fieldPath('body'), value: structured }])
+    const live = (await t.query(snapshot, { projectId: P })) as { documents: unknown[] }
+    expect(live.documents).toEqual([expected])
+  })
+})

package/convex/fixture-accounts.test.ts

@@ -0,0 +1,305 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { convexTest } from 'convex-test'
+import { createAccount } from '@convex-dev/auth/server'
+import { internalActionGeneric, makeFunctionReference } from 'convex/server'
+import { DEV_USERS, DEV_USER_ROLES, NOT_INVITED_REASON } from '@elytracms/core/persistence'
+import { defineStudioAuth } from './auth'
+import {
+  FIXTURE_ACCOUNTS_FLAG,
+  FIXTURE_PASSWORD_ENV,
+  FIXTURE_PASSWORD_MIN_LENGTH,
+  fixtureAccountList,
+} from './fixtureAccounts'
+import schema from './schema'
+
+/**
+ * EC-672 — `fixtureAccounts:provision` on convex-test, through the REAL Convex Auth store
+ * (`defineStudioAuth()` — the demo's `convex/auth.ts` one-liner — mounted as `auth.ts`, so
+ * `createAccount`'s `auth:store` sub-call runs the library's own account creation and the
+ * engine's account-creation gate inside it), the REAL invite purge and the REAL sign-in gate.
+ *
+ * The password is a per-deployment secret; the tests use throwaway values built here, and
+ * every assertion about it is a boolean (the account verifies it, or it does not).
+ */
+
+/**
+ * The engine's convex modules, plus the two a deployment adds: the demo's `auth.ts`
+ * (`defineStudioAuth()` exports `store`, which `createAccount` calls by name) and a probe
+ * action that calls `createAccount` WITHOUT the fixture's invite step (the gate control).
+ */
+const probeCreate = internalActionGeneric({
+  handler: async (ctx, args: { email: string; secret: string }) => {
+    await createAccount(ctx, {
+      provider: 'password',
+      account: { id: args.email, secret: args.secret },
+      profile: { email: args.email },
+    })
+    return null
+  },
+})
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**', '!./auth.ts']),
+  './auth.ts': async () => defineStudioAuth(),
+  './probe.ts': async () => ({ create: probeCreate }),
+  './_generated/api.ts': async () => ({}),
+}
+
+const provision = makeFunctionReference<'action'>('fixtureAccounts:provision')
+const prepare = makeFunctionReference<'mutation'>('fixtureAccounts:prepare')
+const settle = makeFunctionReference<'mutation'>('fixtureAccounts:settle')
+const probe = makeFunctionReference<'action'>('probe:create')
+
+const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+const SECRET_A = 'fixture-secret-a-0123456789abcdef'
+const SECRET_B = 'fixture-secret-b-fedcba9876543210'
+const STAMP = '2026-10-28T00:00:00.000Z'
+
+type Provisioned = {
+  accounts: Array<{
+    email: string
+    role: string
+    account: string
+    membership: string
+    invite: string
+    purgedOrphans: number
+  }>
+}
+
+// Unset by assignment: `delete` does not take on the edge-runtime env's `process.env`
+// (measured — a deleted secret was still read), and the module reads '' as unset.
+function enable(password: string = SECRET_A) {
+  env[FIXTURE_ACCOUNTS_FLAG] = '1'
+  env[FIXTURE_PASSWORD_ENV] = password
+}
+function reset() {
+  env[FIXTURE_ACCOUNTS_FLAG] = ''
+  env[FIXTURE_PASSWORD_ENV] = ''
+}
+
+beforeEach(reset)
+afterEach(reset)
+
+/** Every row of the tables provisioning can touch, ordered — for "changed nothing" checks. */
+async function dump(t: ReturnType<typeof convexTest>) {
+  return t.run(async (ctx) => {
+    const tables = ['users', 'authAccounts', 'authSessions', 'members', 'invites', 'authorityAudit'] as const
+    const out = {} as Record<(typeof tables)[number], unknown[]>
+    for (const table of tables) out[table] = await ctx.db.query(table).collect()
+    return out
+  })
+}
+
+/** The members table as `{ email → role }`, joined through the users table. */
+async function roles(t: ReturnType<typeof convexTest>) {
+  return t.run(async (ctx) => {
+    const out: Record<string, string> = {}
+    for (const member of await ctx.db.query('members').collect()) {
+      const user = await ctx.db.get(member.userId as never)
+      out[(user as { email?: string } | null)?.email ?? member.userId] = member.role
+    }
+    return out
+  })
+}
+
+const SEEDED = Object.fromEntries(
+  DEV_USER_ROLES.map(({ userId, role }) => [Object.values(DEV_USERS).find((u) => u.id === userId)!.email, role]),
+)
+
+describe('fixtureAccountList — the seed’s own dev users, one declaration', () => {
+  it('is DEV_USER_ROLES joined to DEV_USERS, admin first (the bootstrap principal on an empty deployment)', () => {
+    const list = fixtureAccountList()
+    expect(list).toEqual(Object.entries(SEEDED).map(([email, role]) => ({ email, role })))
+    expect(list[0]).toEqual({ email: DEV_USERS.admin.email, role: 'admin' })
+    expect(list.map((entry) => entry.role)).toEqual(['admin', 'editor', 'viewer'])
+  })
+})
+
+describe('the flag and the secret — refused before anything is written', () => {
+  it('refuses every entry point without ELYTRA_FIXTURE_ACCOUNTS=1, writing nothing', async () => {
+    const t = convexTest(schema, modules)
+    const before = await dump(t)
+    env[FIXTURE_PASSWORD_ENV] = SECRET_A // the secret alone is not enough
+    await expect(t.action(provision, {})).rejects.toThrow(/ELYTRA_FIXTURE_ACCOUNTS=1/)
+    await expect(t.mutation(prepare, { email: DEV_USERS.admin.email, role: 'admin' })).rejects.toThrow(
+      /ELYTRA_FIXTURE_ACCOUNTS=1/,
+    )
+    await expect(t.mutation(settle, { email: DEV_USERS.admin.email, role: 'admin' })).rejects.toThrow(
+      /ELYTRA_FIXTURE_ACCOUNTS=1/,
+    )
+    env[FIXTURE_ACCOUNTS_FLAG] = 'true' // exactly '1'
+    await expect(t.action(provision, {})).rejects.toThrow(/ELYTRA_FIXTURE_ACCOUNTS=1/)
+    expect(await dump(t)).toEqual(before)
+  })
+
+  it('refuses a missing or short secret, naming the variable and never a value', async () => {
+    const t = convexTest(schema, modules)
+    const before = await dump(t)
+    enable('')
+    await expect(t.action(provision, {})).rejects.toThrow(/ELYTRA_FIXTURE_PASSWORD is not set/)
+    const short = 'x'.repeat(FIXTURE_PASSWORD_MIN_LENGTH - 1)
+    enable(short)
+    let caught: unknown
+    try {
+      await t.action(provision, {})
+    } catch (error) {
+      caught = error
+    }
+    const message = String((caught as Error | undefined)?.message)
+    expect(message).toMatch(/shorter than 16/)
+    expect(message.includes(short)).toBe(false)
+    expect(await dump(t)).toEqual(before)
+  })
+})
+
+describe('provision — through the provider and the gates, idempotent', () => {
+  it('on an EMPTY deployment: the admin bootstraps, the others are invited and granted; no session, no invite left', async () => {
+    const t = convexTest(schema, modules)
+    enable()
+    const report = (await t.action(provision, {})) as Provisioned
+    expect(report.accounts).toEqual([
+      {
+        email: 'admin@example.com',
+        role: 'admin',
+        account: 'created',
+        membership: 'bootstrapped',
+        invite: 'not-needed',
+        purgedOrphans: 0,
+      },
+      {
+        email: 'editor@example.com',
+        role: 'editor',
+        account: 'created',
+        membership: 'granted',
+        invite: 'written',
+        purgedOrphans: 0,
+      },
+      {
+        email: 'viewer@example.com',
+        role: 'viewer',
+        account: 'created',
+        membership: 'granted',
+        invite: 'written',
+        purgedOrphans: 0,
+      },
+    ])
+    expect(await roles(t)).toEqual(SEEDED)
+    const rows = await dump(t)
+    expect(rows.authAccounts).toHaveLength(3)
+    expect(rows.authSessions).toEqual([]) // provisioning signs nobody in
+    expect(rows.invites).toEqual([]) // every invite was consumed by the sign-in gate
+    // The stored secret is a hash, never the value.
+    expect(rows.authAccounts.every((row) => (row as { secret?: string }).secret !== SECRET_A)).toBe(true)
+  })
+
+  it('a second run changes nothing: every account unchanged, every table byte-equal', async () => {
+    const t = convexTest(schema, modules)
+    enable()
+    await t.action(provision, {})
+    const before = await dump(t)
+    const again = (await t.action(provision, {})) as Provisioned
+    expect(again.accounts.map((a) => [a.account, a.membership, a.invite])).toEqual([
+      ['unchanged', 'unchanged', 'not-needed'],
+      ['unchanged', 'unchanged', 'not-needed'],
+      ['unchanged', 'unchanged', 'not-needed'],
+    ])
+    expect(await dump(t)).toEqual(before)
+  })
+
+  it('follows a rotated secret (password-rotated), after which the new secret is the one that verifies', async () => {
+    const t = convexTest(schema, modules)
+    enable(SECRET_A)
+    await t.action(provision, {})
+    enable(SECRET_B)
+    const rotated = (await t.action(provision, {})) as Provisioned
+    expect(rotated.accounts.map((a) => a.account)).toEqual(['password-rotated', 'password-rotated', 'password-rotated'])
+    // `createAccount` returns an existing account only when the secret verifies, so a third
+    // run under SECRET_B reading `unchanged` proves the stored hash is SECRET_B's.
+    const third = (await t.action(provision, {})) as Provisioned
+    expect(third.accounts.map((a) => a.account)).toEqual(['unchanged', 'unchanged', 'unchanged'])
+    expect(await roles(t)).toEqual(SEEDED)
+  })
+
+  it('on a deployment with members already: nobody bootstraps, every fixture is invited; the existing member is untouched', async () => {
+    const t = convexTest(schema, modules)
+    const ownerId = await t.run(async (ctx) => {
+      const id = await ctx.db.insert('users', { email: 'owner@elytra.invalid' })
+      await ctx.db.insert('members', { userId: String(id), role: 'admin', createdAt: STAMP, updatedAt: STAMP })
+      return String(id)
+    })
+    enable()
+    const report = (await t.action(provision, {})) as Provisioned
+    expect(report.accounts.map((a) => [a.email, a.membership, a.invite])).toEqual([
+      ['admin@example.com', 'granted', 'written'],
+      ['editor@example.com', 'granted', 'written'],
+      ['viewer@example.com', 'granted', 'written'],
+    ])
+    const members = await t.run((ctx) => ctx.db.query('members').collect())
+    expect(members.find((m) => m.userId === ownerId)).toMatchObject({ role: 'admin', updatedAt: STAMP })
+    expect(members).toHaveLength(4)
+  })
+
+  it('gate control: on that same deployment the account-creation gate REJECTS a sign-up with no invite — the invite is what passes it', async () => {
+    const t = convexTest(schema, modules)
+    await t.run(async (ctx) => {
+      const id = await ctx.db.insert('users', { email: 'owner@elytra.invalid' })
+      await ctx.db.insert('members', { userId: String(id), role: 'admin', createdAt: STAMP, updatedAt: STAMP })
+    })
+    await expect(t.action(probe, { email: 'editor@example.com', secret: SECRET_A })).rejects.toThrow(
+      NOT_INVITED_REASON.slice(0, 12),
+    )
+    // Zero rows: the gate rolled the users insert back (EC-358).
+    const rows = await dump(t)
+    expect(rows.authAccounts).toEqual([])
+    expect(rows.users).toHaveLength(1)
+  })
+
+  it('purges member-less credentials for a fixture email first (EC-358) and creates the account fresh', async () => {
+    const t = convexTest(schema, modules)
+    const orphanId = await t.run(async (ctx) => {
+      const owner = await ctx.db.insert('users', { email: 'owner@elytra.invalid' })
+      await ctx.db.insert('members', { userId: String(owner), role: 'admin', createdAt: STAMP, updatedAt: STAMP })
+      // A pre-EC-358 orphan for the editor's email, carrying someone else's password hash.
+      const orphan = await ctx.db.insert('users', { email: 'Editor@Example.com' })
+      await ctx.db.insert('authAccounts', {
+        userId: orphan,
+        provider: 'password',
+        providerAccountId: 'editor@example.com',
+        secret: 'not-a-hash-of-ours',
+      })
+      return orphan
+    })
+    enable()
+    const report = (await t.action(provision, {})) as Provisioned
+    const editor = report.accounts.find((a) => a.role === 'editor')!
+    expect(editor).toMatchObject({ purgedOrphans: 1, account: 'created', membership: 'granted' })
+    expect(await t.run((ctx) => ctx.db.get(orphanId))).toBeNull()
+    expect((await roles(t))['editor@example.com']).toBe('editor')
+  })
+
+  it('restores a drifted fixture role, audited; a second run is then unchanged', async () => {
+    const t = convexTest(schema, modules)
+    enable()
+    await t.action(provision, {})
+    await t.run(async (ctx) => {
+      const account = await ctx.db
+        .query('authAccounts')
+        .withIndex('providerAndAccountId', (q) =>
+          q.eq('provider', 'password').eq('providerAccountId', 'editor@example.com'),
+        )
+        .unique()
+      const member = await ctx.db
+        .query('members')
+        .withIndex('by_user', (q) => q.eq('userId', String(account!.userId)))
+        .first()
+      await ctx.db.patch(member!._id, { role: 'viewer' })
+    })
+    const report = (await t.action(provision, {})) as Provisioned
+    expect(report.accounts.find((a) => a.role === 'editor')!.membership).toBe('role-restored')
+    expect((await roles(t))['editor@example.com']).toBe('editor')
+    const audit = await t.run((ctx) => ctx.db.query('authorityAudit').collect())
+    expect(audit).toHaveLength(1)
+    expect(audit[0]).toMatchObject({ actorId: 'fixture-accounts', op: 'members.set', rolesGranted: ['editor'] })
+    const again = (await t.action(provision, {})) as Provisioned
+    expect(again.accounts.every((a) => a.membership === 'unchanged')).toBe(true)
+  })
+})