@feltdb/core 0.13.0 → 0.16.0

package/dist/create/server-source/crates/feltdb-server/src/console_accounts.rs

@@ -0,0 +1,1009 @@
+//! Console (Studio / www.feltdb.com) accounts.
+//!
+//! Before 0.15.0 the website signed a console session for any e-mail address
+//! with any password, and derived the user id from a prefix of the identity,
+//! so two identities could share one platform user. This store is the account
+//! authority the website now has to ask: it verifies passwords (Argon2), binds
+//! GitHub sign-in to the numeric GitHub id, and hands out random user ids.
+//!
+//! Only the website may call the account routes. Every request is signed with
+//! HMAC-SHA256 under `FELTDB_SESSION_SECRET`, the secret the website and the
+//! control plane already share for console session cookies
+//! (see [`verify_console_request`]).
+//!
+//! Persisted in its own JSON file beside the data (`<data>.console-accounts.json`),
+//! written to a temporary file and renamed, owner-only (0600).
+
+use crate::tenancy::TenancyStore;
+use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+use hmac::{Hmac, Mac};
+use password_hash::{rand_core::OsRng, SaltString};
+use rand::{distributions::Alphanumeric, Rng};
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+use std::{
+    fs,
+    io::Write,
+    path::PathBuf,
+    sync::{Arc, OnceLock, RwLock},
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+/// Minimum password length for console password accounts.
+pub const MINIMUM_PASSWORD_LENGTH: usize = 12;
+/// Maximum accepted clock skew between the website and the control plane.
+pub const MAXIMUM_SIGNATURE_SKEW_SECONDS: u64 = 300;
+pub const SIGNATURE_HEADER: &str = "x-feltdb-console-signature";
+pub const TIMESTAMP_HEADER: &str = "x-feltdb-console-timestamp";
+const DEVELOPMENT_SECRETS: &[&str] = &[
+    "feltdb-development-session-secret-change-me",
+    "change-me-in-production",
+];
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum ConsoleProvider {
+    Password,
+    Github,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ConsoleAccount {
+    /// Normalized e-mail address, or `github:<numeric id>`.
+    pub identity: String,
+    pub user_id: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub password_hash: Option<String>,
+    pub provider: ConsoleProvider,
+    pub created_at: u64,
+    /// The identity the console shows and signs into the session cookie: the
+    /// e-mail address, or `@<login>` (the most recent GitHub login seen).
+    pub display_identity: String,
+    /// How the account came to own its user id: `new`, `legacy_github_login`
+    /// (continuity binding of a pre-0.15.0 GitHub user) or `operator_claim`.
+    #[serde(default = "default_origin")]
+    pub origin: String,
+}
+fn default_origin() -> String {
+    "new".into()
+}
+
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct Records {
+    accounts: Vec<ConsoleAccount>,
+}
+
+/// A failed account operation, with the wire code the website shows.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AccountError {
+    pub status: u16,
+    pub code: &'static str,
+    pub message: String,
+}
+impl AccountError {
+    fn new(status: u16, code: &'static str, message: impl Into<String>) -> Self {
+        Self {
+            status,
+            code,
+            message: message.into(),
+        }
+    }
+    fn internal(message: impl Into<String>) -> Self {
+        Self::new(500, "EXECUTION_FAILED", message)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct ResolvedAccount {
+    pub user_id: String,
+    pub identity: String,
+    pub display_identity: String,
+}
+impl From<&ConsoleAccount> for ResolvedAccount {
+    fn from(account: &ConsoleAccount) -> Self {
+        Self {
+            user_id: account.user_id.clone(),
+            identity: account.identity.clone(),
+            display_identity: account.display_identity.clone(),
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct ConsoleAccountStore {
+    path: PathBuf,
+    records: Arc<RwLock<Records>>,
+    /// Serializes read-modify-write operations that span the Argon2 work.
+    writer: Arc<std::sync::Mutex<()>>,
+    /// Modification time of the file as last loaded or written, so a change
+    /// made by another process (the operator `console-accounts claim` CLI) is
+    /// picked up instead of being overwritten.
+    loaded: Arc<std::sync::Mutex<Option<SystemTime>>>,
+    secret: Option<Arc<[u8]>>,
+}
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+/// A new console user id: `user_` and 24 random alphanumerics (about 142 bits).
+pub fn new_user_id() -> String {
+    let random: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(24)
+        .map(char::from)
+        .collect();
+    format!("user_{random}")
+}
+
+/// The user id the pre-0.15.0 website derived from an identity:
+/// `'user_' + base64url(lowercase(identity)).slice(0, 18)`.
+pub fn legacy_user_id(identity: &str) -> String {
+    let normalized = identity.trim().to_lowercase();
+    format!(
+        "user_{}",
+        URL_SAFE_NO_PAD
+            .encode(normalized)
+            .chars()
+            .take(18)
+            .collect::<String>()
+    )
+}
+
+pub fn normalize_email(email: &str) -> Result<String, AccountError> {
+    let email = email.trim().to_lowercase();
+    let valid = email.len() <= 254
+        && !email.chars().any(char::is_whitespace)
+        && email.split_once('@').is_some_and(|(local, domain)| {
+            !local.is_empty()
+                && !domain.contains('@')
+                && domain
+                    .split_once('.')
+                    .is_some_and(|(left, right)| !left.is_empty() && !right.is_empty())
+        });
+    if valid {
+        Ok(email)
+    } else {
+        Err(AccountError::new(
+            400,
+            "VALIDATION_ERROR",
+            "enter a valid email address",
+        ))
+    }
+}
+
+fn validate_password(password: &str) -> Result<(), AccountError> {
+    if password.chars().count() < MINIMUM_PASSWORD_LENGTH {
+        return Err(AccountError::new(
+            400,
+            "PASSWORD_TOO_SHORT",
+            format!("password must be at least {MINIMUM_PASSWORD_LENGTH} characters"),
+        ));
+    }
+    if password.len() > 1024 {
+        return Err(AccountError::new(
+            400,
+            "VALIDATION_ERROR",
+            "password must be at most 1024 bytes",
+        ));
+    }
+    Ok(())
+}
+
+fn hash_password(password: &str) -> Result<String, AccountError> {
+    Argon2::default()
+        .hash_password(password.as_bytes(), &SaltString::generate(&mut OsRng))
+        .map(|hash| hash.to_string())
+        .map_err(|error| AccountError::internal(error.to_string()))
+}
+
+fn verify_password(password: &str, hash: &str) -> bool {
+    PasswordHash::new(hash).is_ok_and(|parsed| {
+        Argon2::default()
+            .verify_password(password.as_bytes(), &parsed)
+            .is_ok()
+    })
+}
+
+/// A fixed hash with the same parameters as real ones, verified when the
+/// e-mail is unknown so that "no such account" costs what "wrong password" does.
+fn dummy_hash() -> &'static str {
+    static DUMMY: OnceLock<String> = OnceLock::new();
+    DUMMY.get_or_init(|| {
+        let salt = SaltString::from_b64("ZmVsdGRiY29uc29sZWR1bW15").expect("static salt");
+        Argon2::default()
+            .hash_password(b"feltdb-console-dummy-password", &salt)
+            .expect("dummy hash")
+            .to_string()
+    })
+}
+
+fn invalid_credentials() -> AccountError {
+    AccountError::new(401, "INVALID_CREDENTIALS", "invalid email or password")
+}
+
+/// The secret the account routes are keyed by, if the deployment configured
+/// one: `FELTDB_SESSION_SECRET`, at least 32 bytes, not a development value.
+pub fn configured_secret(value: Option<String>) -> Option<Vec<u8>> {
+    value
+        .filter(|secret| secret.len() >= 32 && !DEVELOPMENT_SECRETS.contains(&secret.as_str()))
+        .map(String::into_bytes)
+}
+
+/// The bytes the website signs: `METHOD\nPATH\nTIMESTAMP\nBODY`.
+pub fn signing_input(method: &str, path: &str, timestamp: &str, body: &[u8]) -> Vec<u8> {
+    let mut input = format!("{}\n{path}\n{timestamp}\n", method.to_uppercase()).into_bytes();
+    input.extend_from_slice(body);
+    input
+}
+
+pub fn sign_console_request(
+    secret: &[u8],
+    method: &str,
+    path: &str,
+    timestamp: &str,
+    body: &[u8],
+) -> String {
+    let mut mac = Hmac::<Sha256>::new_from_slice(secret).expect("HMAC accepts any key length");
+    mac.update(&signing_input(method, path, timestamp, body));
+    mac.finalize()
+        .into_bytes()
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect()
+}
+
+fn decode_hex(value: &str) -> Option<Vec<u8>> {
+    if value.len() % 2 != 0 {
+        return None;
+    }
+    (0..value.len())
+        .step_by(2)
+        .map(|index| u8::from_str_radix(value.get(index..index + 2)?, 16).ok())
+        .collect()
+}
+
+/// Verify a website request to the account routes. `timestamp` is Unix
+/// seconds; requests more than five minutes away from `now` are refused so a
+/// captured request cannot be replayed indefinitely.
+pub fn verify_console_request(
+    secret: &[u8],
+    method: &str,
+    path: &str,
+    timestamp: Option<&str>,
+    signature: Option<&str>,
+    body: &[u8],
+    now: u64,
+) -> Result<(), AccountError> {
+    let refused = |message: &str| AccountError::new(401, "CONSOLE_SIGNATURE_INVALID", message);
+    let timestamp = timestamp.ok_or_else(|| refused("console request timestamp required"))?;
+    let signature = signature.ok_or_else(|| refused("console request signature required"))?;
+    let seconds: u64 = timestamp
+        .trim()
+        .parse()
+        .map_err(|_| refused("console request timestamp is not Unix seconds"))?;
+    if seconds.abs_diff(now) > MAXIMUM_SIGNATURE_SKEW_SECONDS {
+        return Err(refused(
+            "console request timestamp is outside the allowed skew",
+        ));
+    }
+    let supplied = decode_hex(signature.trim().to_lowercase().as_str())
+        .ok_or_else(|| refused("console request signature is not hex"))?;
+    let mut mac = Hmac::<Sha256>::new_from_slice(secret).expect("HMAC accepts any key length");
+    mac.update(&signing_input(method, path, timestamp, body));
+    mac.verify_slice(&supplied)
+        .map_err(|_| refused("console request signature does not verify"))
+}
+
+impl ConsoleAccountStore {
+    pub fn load(path: impl Into<PathBuf>, secret: Option<Vec<u8>>) -> Result<Self, String> {
+        let path = path.into();
+        let records = if path.exists() {
+            serde_json::from_slice(&fs::read(&path).map_err(|error| error.to_string())?)
+                .map_err(|error| format!("{}: {error}", path.display()))?
+        } else {
+            Records::default()
+        };
+        let loaded = fs::metadata(&path).and_then(|meta| meta.modified()).ok();
+        Ok(Self {
+            path,
+            records: Arc::new(RwLock::new(records)),
+            writer: Arc::new(std::sync::Mutex::new(())),
+            loaded: Arc::new(std::sync::Mutex::new(loaded)),
+            secret: secret.map(Into::into),
+        })
+    }
+
+    /// Re-read the file if another process changed it since we last saw it.
+    fn refresh(&self) -> Result<(), AccountError> {
+        let poisoned = || AccountError::internal("console account lock poisoned");
+        let modified = fs::metadata(&self.path)
+            .and_then(|meta| meta.modified())
+            .ok();
+        if modified.is_none() || modified == *self.loaded.lock().map_err(|_| poisoned())? {
+            return Ok(());
+        }
+        let bytes = fs::read(&self.path)
+            .map_err(|error| AccountError::internal(format!("console account store: {error}")))?;
+        let records: Records = serde_json::from_slice(&bytes)
+            .map_err(|error| AccountError::internal(format!("console account store: {error}")))?;
+        // Lock order everywhere: records, then loaded (as in `persist`).
+        let mut current = self.records.write().map_err(|_| poisoned())?;
+        *current = records;
+        *self.loaded.lock().map_err(|_| poisoned())? = modified;
+        Ok(())
+    }
+
+    fn find(&self, matches: impl Fn(&ConsoleAccount) -> bool) -> Option<ConsoleAccount> {
+        let lookup = |matches: &dyn Fn(&ConsoleAccount) -> bool| {
+            self.read()
+                .ok()?
+                .accounts
+                .iter()
+                .find(|account| matches(account))
+                .cloned()
+        };
+        lookup(&matches).or_else(|| {
+            self.refresh().ok()?;
+            lookup(&matches)
+        })
+    }
+
+    /// The signing secret, or `None` when the routes must answer 503.
+    pub fn secret(&self) -> Option<&[u8]> {
+        self.secret.as_deref()
+    }
+
+    fn persist(&self, records: &Records) -> Result<(), AccountError> {
+        let write = || -> std::io::Result<()> {
+            if let Some(parent) = self.path.parent() {
+                fs::create_dir_all(parent)?;
+            }
+            let temporary = self.path.with_extension("json.tmp");
+            let _ = fs::remove_file(&temporary);
+            let mut options = fs::OpenOptions::new();
+            options.write(true).create_new(true);
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::OpenOptionsExt;
+                options.mode(0o600);
+            }
+            let mut file = options.open(&temporary)?;
+            file.write_all(&serde_json::to_vec_pretty(records)?)?;
+            file.sync_all()?;
+            fs::rename(&temporary, &self.path)?;
+            if let Ok(mut loaded) = self.loaded.lock() {
+                *loaded = fs::metadata(&self.path)
+                    .and_then(|meta| meta.modified())
+                    .ok();
+            }
+            Ok(())
+        };
+        write().map_err(|error| AccountError::internal(format!("console account store: {error}")))
+    }
+
+    fn read(&self) -> Result<std::sync::RwLockReadGuard<'_, Records>, AccountError> {
+        self.records
+            .read()
+            .map_err(|_| AccountError::internal("console account lock poisoned"))
+    }
+
+    fn insert(&self, account: ConsoleAccount) -> Result<ConsoleAccount, AccountError> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| AccountError::internal("console account lock poisoned"))?;
+        records.accounts.push(account.clone());
+        if let Err(error) = self.persist(&records) {
+            records.accounts.pop();
+            return Err(error);
+        }
+        Ok(account)
+    }
+
+    pub fn account_for_user(&self, user_id: &str) -> Option<ConsoleAccount> {
+        self.find(|account| account.user_id == user_id)
+    }
+
+    pub fn account_for_identity(&self, identity: &str) -> Option<ConsoleAccount> {
+        self.find(|account| account.identity == identity)
+    }
+
+    pub fn list(&self) -> Vec<ConsoleAccount> {
+        let _ = self.refresh();
+        self.read()
+            .map(|records| records.accounts.clone())
+            .unwrap_or_default()
+    }
+
+    fn register_platform_user(
+        tenancy: &TenancyStore,
+        account: &ConsoleAccount,
+    ) -> Result<(), AccountError> {
+        tenancy
+            .register_platform_user(&account.user_id, &account.display_identity)
+            .map_err(AccountError::internal)
+    }
+
+    /// Create a password account. A pre-0.15.0 platform user registered under
+    /// this e-mail (unverified, but possibly owning tenants) is never handed
+    /// to whoever signs up first: it has to be claimed by an operator.
+    pub fn password_signup(
+        &self,
+        tenancy: &TenancyStore,
+        email: &str,
+        password: &str,
+    ) -> Result<ResolvedAccount, AccountError> {
+        let email = normalize_email(email)?;
+        validate_password(password)?;
+        let _writer = self
+            .writer
+            .lock()
+            .map_err(|_| AccountError::internal("console account writer poisoned"))?;
+        self.refresh()?;
+        if self.account_for_identity(&email).is_some() {
+            return Err(AccountError::new(
+                409,
+                "ACCOUNT_EXISTS",
+                "an account already exists for this email; sign in instead",
+            ));
+        }
+        if !self.unclaimed_legacy_users(tenancy, &email).is_empty() {
+            return Err(AccountError::new(
+                409,
+                "ACCOUNT_CLAIM_REQUIRED",
+                "this email has a console account created before password verification; \
+                 an operator must claim it",
+            ));
+        }
+        let mut user_id = new_user_id();
+        while self.account_for_user(&user_id).is_some() || tenancy.platform_user_exists(&user_id) {
+            user_id = new_user_id();
+        }
+        let account = self.insert(ConsoleAccount {
+            identity: email.clone(),
+            user_id,
+            password_hash: Some(hash_password(password)?),
+            provider: ConsoleProvider::Password,
+            created_at: now(),
+            display_identity: email,
+            origin: default_origin(),
+        })?;
+        Self::register_platform_user(tenancy, &account)?;
+        Ok((&account).into())
+    }
+
+    pub fn password_signin(
+        &self,
+        email: &str,
+        password: &str,
+    ) -> Result<ResolvedAccount, AccountError> {
+        let account = normalize_email(email)
+            .ok()
+            .and_then(|email| self.account_for_identity(&email))
+            .filter(|account| account.provider == ConsoleProvider::Password);
+        let hash = account
+            .as_ref()
+            .and_then(|account| account.password_hash.as_deref())
+            .unwrap_or_else(|| dummy_hash());
+        let verified = verify_password(password, hash);
+        match account {
+            Some(account) if verified => Ok((&account).into()),
+            _ => Err(invalid_credentials()),
+        }
+    }
+
+    /// Platform users the old website could have created for `email` that no
+    /// console account owns yet.
+    fn unclaimed_legacy_users(&self, tenancy: &TenancyStore, email: &str) -> Vec<String> {
+        tenancy
+            .platform_users_with_identity(email)
+            .into_iter()
+            .filter(|user_id| user_id.starts_with("user_"))
+            .filter(|user_id| self.account_for_user(user_id).is_none())
+            .collect()
+    }
+
+    /// Resolve the console user id for a GitHub sign-in.
+    ///
+    /// An account bound to `github:<id>` wins. Otherwise a pre-0.15.0 user
+    /// whose derived id came from `@<login>` and whose recorded identity is
+    /// exactly `@<login>` keeps its data (continuity), unless another console
+    /// account already owns that id. Everything else gets a new random id.
+    /// The binding is by numeric GitHub id, so a later login rename (or a new
+    /// GitHub user taking an old login) never moves it.
+    pub fn github_resolve(
+        &self,
+        tenancy: &TenancyStore,
+        github_id: &str,
+        login: &str,
+    ) -> Result<ResolvedAccount, AccountError> {
+        let github_id = github_id.trim();
+        if github_id.is_empty()
+            || github_id.len() > 20
+            || !github_id
+                .chars()
+                .all(|character| character.is_ascii_digit())
+        {
+            return Err(AccountError::new(
+                400,
+                "VALIDATION_ERROR",
+                "github_id must be the numeric GitHub user id",
+            ));
+        }
+        let login = login.trim().to_lowercase();
+        if login.is_empty()
+            || login.len() > 39
+            || !login
+                .chars()
+                .all(|character| character.is_ascii_alphanumeric() || character == '-')
+        {
+            return Err(AccountError::new(
+                400,
+                "VALIDATION_ERROR",
+                "login must be a GitHub login",
+            ));
+        }
+        let identity = format!("github:{github_id}");
+        let display_identity = format!("@{login}");
+        let _writer = self
+            .writer
+            .lock()
+            .map_err(|_| AccountError::internal("console account writer poisoned"))?;
+        self.refresh()?;
+        {
+            let mut records = self
+                .records
+                .write()
+                .map_err(|_| AccountError::internal("console account lock poisoned"))?;
+            if let Some(index) = records
+                .accounts
+                .iter()
+                .position(|account| account.identity == identity)
+            {
+                if records.accounts[index].display_identity != display_identity {
+                    records.accounts[index].display_identity = display_identity.clone();
+                    self.persist(&records)?;
+                }
+                return Ok((&records.accounts[index]).into());
+            }
+        }
+        let legacy = legacy_user_id(&display_identity);
+        let continuity = tenancy.platform_user_identity(&legacy).as_deref()
+            == Some(display_identity.as_str())
+            && self.account_for_user(&legacy).is_none();
+        let (user_id, origin) = if continuity {
+            (legacy, "legacy_github_login".to_string())
+        } else {
+            let mut user_id = new_user_id();
+            while self.account_for_user(&user_id).is_some()
+                || tenancy.platform_user_exists(&user_id)
+            {
+                user_id = new_user_id();
+            }
+            (user_id, default_origin())
+        };
+        let account = self.insert(ConsoleAccount {
+            identity,
+            user_id,
+            password_hash: None,
+            provider: ConsoleProvider::Github,
+            created_at: now(),
+            display_identity,
+            origin,
+        })?;
+        if !continuity {
+            Self::register_platform_user(tenancy, &account)?;
+        }
+        Ok((&account).into())
+    }
+
+    /// Operator claim: bind a password account for `email` to the existing
+    /// pre-0.15.0 platform user registered under that e-mail.
+    pub fn claim_password(
+        &self,
+        tenancy: &TenancyStore,
+        email: &str,
+        password: &str,
+    ) -> Result<ResolvedAccount, AccountError> {
+        let email = normalize_email(email)?;
+        validate_password(password)?;
+        let _writer = self
+            .writer
+            .lock()
+            .map_err(|_| AccountError::internal("console account writer poisoned"))?;
+        self.refresh()?;
+        if self.account_for_identity(&email).is_some() {
+            return Err(AccountError::new(
+                409,
+                "ACCOUNT_EXISTS",
+                "a console account already exists for this email",
+            ));
+        }
+        let candidates = self.unclaimed_legacy_users(tenancy, &email);
+        let user_id = match candidates.as_slice() {
+            [user_id] => user_id.clone(),
+            [] => {
+                return Err(AccountError::new(
+                    404,
+                    "NOT_FOUND",
+                    "no unclaimed legacy platform user is registered under this email",
+                ))
+            }
+            _ => {
+                return Err(AccountError::new(
+                    409,
+                    "CONFLICT",
+                    format!(
+                        "several unclaimed platform users are registered under this email: {}",
+                        candidates.join(", ")
+                    ),
+                ))
+            }
+        };
+        let account = self.insert(ConsoleAccount {
+            identity: email.clone(),
+            user_id,
+            password_hash: Some(hash_password(password)?),
+            provider: ConsoleProvider::Password,
+            created_at: now(),
+            display_identity: email,
+            origin: "operator_claim".into(),
+        })?;
+        Ok((&account).into())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn stores() -> (ConsoleAccountStore, TenancyStore, PathBuf) {
+        let dir = std::env::temp_dir().join(format!("feltdb-console-accounts-{}", new_user_id()));
+        fs::create_dir_all(&dir).unwrap();
+        let accounts =
+            ConsoleAccountStore::load(dir.join("state.console-accounts.json"), None).unwrap();
+        let tenancy = TenancyStore::load(dir.join("state.platform.json")).unwrap();
+        (accounts, tenancy, dir)
+    }
+
+    #[test]
+    fn signup_then_signin_verifies_the_password() {
+        let (accounts, tenancy, dir) = stores();
+        let created = accounts
+            .password_signup(&tenancy, " Alice@Example.com ", "correct horse battery")
+            .unwrap();
+        assert_eq!(created.identity, "alice@example.com");
+        assert!(created.user_id.starts_with("user_") && created.user_id.len() >= 27);
+        assert_eq!(
+            tenancy.platform_user_identity(&created.user_id).as_deref(),
+            Some("alice@example.com")
+        );
+        let signed_in = accounts
+            .password_signin("alice@example.com", "correct horse battery")
+            .unwrap();
+        assert_eq!(signed_in.user_id, created.user_id);
+        assert_eq!(
+            accounts
+                .password_signin("alice@example.com", "wrong horse battery")
+                .unwrap_err()
+                .code,
+            "INVALID_CREDENTIALS"
+        );
+        assert_eq!(
+            accounts
+                .password_signin("nobody@example.com", "correct horse battery")
+                .unwrap_err()
+                .code,
+            "INVALID_CREDENTIALS"
+        );
+        assert_eq!(
+            accounts
+                .password_signup(&tenancy, "alice@example.com", "another long password")
+                .unwrap_err()
+                .code,
+            "ACCOUNT_EXISTS"
+        );
+        // Persisted, owner-only, and reloadable.
+        let path = dir.join("state.console-accounts.json");
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            assert_eq!(
+                fs::metadata(&path).unwrap().permissions().mode() & 0o777,
+                0o600
+            );
+        }
+        let reloaded = ConsoleAccountStore::load(&path, None).unwrap();
+        assert_eq!(
+            reloaded
+                .password_signin("alice@example.com", "correct horse battery")
+                .unwrap()
+                .user_id,
+            created.user_id
+        );
+        fs::remove_dir_all(dir).ok();
+    }
+
+    #[test]
+    fn prefix_sharing_emails_get_distinct_user_ids() {
+        let (accounts, tenancy, dir) = stores();
+        let one = accounts
+            .password_signup(
+                &tenancy,
+                "abcdefghijklm-one@example.com",
+                "password-one-long",
+            )
+            .unwrap();
+        let two = accounts
+            .password_signup(
+                &tenancy,
+                "abcdefghijklm-two@example.com",
+                "password-two-long",
+            )
+            .unwrap();
+        assert_eq!(
+            legacy_user_id("abcdefghijklm-one@example.com"),
+            legacy_user_id("abcdefghijklm-two@example.com")
+        );
+        assert_ne!(one.user_id, two.user_id);
+        fs::remove_dir_all(dir).ok();
+    }
+
+    #[test]
+    fn password_policy_and_email_shape_are_enforced() {
+        let (accounts, tenancy, dir) = stores();
+        assert_eq!(
+            accounts
+                .password_signup(&tenancy, "short@example.com", "elevenchars")
+                .unwrap_err()
+                .code,
+            "PASSWORD_TOO_SHORT"
+        );
+        assert_eq!(
+            accounts
+                .password_signup(&tenancy, "not-an-email", "a long enough password")
+                .unwrap_err()
+                .code,
+            "VALIDATION_ERROR"
+        );
+        fs::remove_dir_all(dir).ok();
+    }
+
+    #[test]
+    fn a_legacy_password_user_must_be_claimed_by_an_operator() {
+        let (accounts, tenancy, dir) = stores();
+        let legacy = legacy_user_id("owner@example.com");
+        tenancy
+            .register_platform_user(&legacy, "owner@example.com")
+            .unwrap();
+        assert_eq!(
+            accounts
+                .password_signup(&tenancy, "owner@example.com", "attacker password")
+                .unwrap_err()
+                .code,
+            "ACCOUNT_CLAIM_REQUIRED"
+        );
+        let claimed = accounts
+            .claim_password(&tenancy, "owner@example.com", "the owner's password")
+            .unwrap();
+        assert_eq!(claimed.user_id, legacy);
+        assert_eq!(
+            accounts
+                .password_signin("owner@example.com", "the owner's password")
+                .unwrap()
+                .user_id,
+            legacy
+        );
+        assert_eq!(
+            accounts
+                .claim_password(&tenancy, "owner@example.com", "the owner's password")
+                .unwrap_err()
+                .code,
+            "ACCOUNT_EXISTS"
+        );
+        assert_eq!(
+            accounts
+                .claim_password(&tenancy, "stranger@example.com", "a long enough password")
+                .unwrap_err()
+                .status,
+            404
+        );
+        fs::remove_dir_all(dir).ok();
+    }
+
+    #[test]
+    fn github_resolve_keeps_the_genuine_legacy_owner_and_isolates_colliders() {
+        let (accounts, tenancy, dir) = stores();
+        // Two logins whose legacy ids collide (shared 13-character prefix).
+        let victim = "averylongname-victim";
+        let attacker = "averylongname-attack";
+        let legacy = legacy_user_id(&format!("@{victim}"));
+        assert_eq!(legacy, legacy_user_id(&format!("@{attacker}")));
+        tenancy
+            .register_platform_user(&legacy, &format!("@{victim}"))
+            .unwrap();
+
+        let colliding = accounts.github_resolve(&tenancy, "999", attacker).unwrap();
+        assert_ne!(colliding.user_id, legacy);
+        let genuine = accounts.github_resolve(&tenancy, "123", victim).unwrap();
+        assert_eq!(genuine.user_id, legacy);
+        assert_eq!(genuine.identity, "github:123");
+        // Stable across sign-ins and a login rename.
+        assert_eq!(
+            accounts
+                .github_resolve(&tenancy, "123", "renamed-victim")
+                .unwrap()
+                .user_id,
+            legacy
+        );
+        // A new GitHub user taking the old login cannot re-bind the legacy id.
+        let squatter = accounts.github_resolve(&tenancy, "555", victim).unwrap();
+        assert_ne!(squatter.user_id, legacy);
+        assert_eq!(
+            accounts
+                .github_resolve(&tenancy, "12a", victim)
+                .unwrap_err()
+                .code,
+            "VALIDATION_ERROR"
+        );
+        fs::remove_dir_all(dir).ok();
+    }
+
+    #[test]
+    fn signed_requests_verify_and_forgeries_do_not() {
+        let secret = b"0123456789abcdef0123456789abcdef";
+        let body = br#"{"email":"a@example.com","password":"x"}"#;
+        let now = 1_800_000_000;
+        let timestamp = now.to_string();
+        let path = "/v1/console/accounts/password/signin";
+        let signature = sign_console_request(secret, "POST", path, &timestamp, body);
+        assert!(verify_console_request(
+            secret,
+            "POST",
+            path,
+            Some(&timestamp),
+            Some(&signature),
+            body,
+            now
+        )
+        .is_ok());
+        let refused = |method: &str,
+                       path: &str,
+                       timestamp: Option<&str>,
+                       signature: Option<&str>,
+                       body: &[u8],
+                       now: u64| {
+            verify_console_request(secret, method, path, timestamp, signature, body, now)
+                .unwrap_err()
+                .code
+        };
+        assert_eq!(
+            refused("POST", path, Some(&timestamp), None, body, now),
+            "CONSOLE_SIGNATURE_INVALID"
+        );
+        assert_eq!(
+            refused("POST", path, None, Some(&signature), body, now),
+            "CONSOLE_SIGNATURE_INVALID"
+        );
+        // Body, path, method and timestamp are all covered by the MAC.
+        assert!(verify_console_request(
+            secret,
+            "POST",
+            path,
+            Some(&timestamp),
+            Some(&signature),
+            b"{}",
+            now
+        )
+        .is_err());
+        assert!(verify_console_request(
+            secret,
+            "POST",
+            "/v1/console/accounts/password/signup",
+            Some(&timestamp),
+            Some(&signature),
+            body,
+            now
+        )
+        .is_err());
+        assert!(verify_console_request(
+            secret,
+            "PUT",
+            path,
+            Some(&timestamp),
+            Some(&signature),
+            body,
+            now
+        )
+        .is_err());
+        let other = (now + 1).to_string();
+        assert!(verify_console_request(
+            secret,
+            "POST",
+            path,
+            Some(&other),
+            Some(&signature),
+            body,
+            now
+        )
+        .is_err());
+        // Another key does not verify.
+        let forged = sign_console_request(
+            b"another-secret-another-secret-xx",
+            "POST",
+            path,
+            &timestamp,
+            body,
+        );
+        assert!(verify_console_request(
+            secret,
+            "POST",
+            path,
+            Some(&timestamp),
+            Some(&forged),
+            body,
+            now
+        )
+        .is_err());
+        // Stale and future timestamps are refused even when correctly signed.
+        let stale = (now - MAXIMUM_SIGNATURE_SKEW_SECONDS - 1).to_string();
+        let stale_signature = sign_console_request(secret, "POST", path, &stale, body);
+        assert!(verify_console_request(
+            secret,
+            "POST",
+            path,
+            Some(&stale),
+            Some(&stale_signature),
+            body,
+            now
+        )
+        .is_err());
+        let future = (now + MAXIMUM_SIGNATURE_SKEW_SECONDS + 1).to_string();
+        let future_signature = sign_console_request(secret, "POST", path, &future, body);
+        assert!(verify_console_request(
+            secret,
+            "POST",
+            path,
+            Some(&future),
+            Some(&future_signature),
+            body,
+            now
+        )
+        .is_err());
+        assert!(verify_console_request(
+            secret,
+            "POST",
+            path,
+            Some(&timestamp),
+            Some("zz"),
+            body,
+            now
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn only_a_real_secret_enables_the_routes() {
+        assert!(configured_secret(None).is_none());
+        assert!(configured_secret(Some("short".into())).is_none());
+        assert!(
+            configured_secret(Some("feltdb-development-session-secret-change-me".into())).is_none()
+        );
+        assert!(configured_secret(Some("x".repeat(32))).is_some());
+    }
+
+    #[test]
+    fn legacy_user_id_matches_the_old_website_formula() {
+        // 'user_' + Buffer.from('@octocat').toString('base64url').slice(0, 18)
+        assert_eq!(legacy_user_id("@OctoCat"), "user_QG9jdG9jYXQ");
+        assert_eq!(
+            legacy_user_id("alice@example.com"),
+            "user_YWxpY2VAZXhhbXBsZS"
+        );
+    }
+}