@futdevpro/nts-dynamo 1.15.151 → 1.15.153

package/src/_modules/account-security/account-session.control-service.spec.ts

@@ -1,294 +1,294 @@
-import { createHash } from 'crypto';
-
-import { DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_AccountSession_ControlService } from './account-session.control-service';
-import { DyNTS_AccountRefreshTokenState_Type } from './_enums/account-refresh-token-state.type-enum';
-import { DyNTS_AccountSessionState_Type } from './_enums/account-session-state.type-enum';
-import { DyNTS_AccountRefreshTokenRecord_Interface } from './_models/account-refresh-token-record.interface';
-import { DyNTS_AccountSessionAdapter_Interface } from './_models/account-session-adapter.interface';
-import { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
-import { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
-import { DyNTS_AccountSessionCreate_Interface } from './_models/account-session-create.interface';
-import { DyNTS_AccountSessionRecord_Interface } from './_models/account-session-record.interface';
-import { DyNTS_AccountSessionRotate_Interface } from './_models/account-session-rotate.interface';
-import { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
-import { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
-
-class DyNTS_TestSessionAdapter implements DyNTS_AccountSessionAdapter_Interface {
-  public readonly sessions: Map<string, DyNTS_AccountSessionRecord_Interface> = new Map();
-  public readonly refreshTokens: Map<string, DyNTS_AccountRefreshTokenRecord_Interface> = new Map();
-
-  /** Stores a new session and its first refresh credential atomically in memory. */
-  public async createSession(set: DyNTS_AccountSessionCreate_Interface): Promise<void> {
-    this.sessions.set(set.session.sessionId, this.cloneSession(set.session));
-    this.refreshTokens.set(set.refreshToken.tokenHash, { ...set.refreshToken });
-  }
-
-  /** Finds a test session by its stable identifier. */
-  public async findSessionById(sessionId: string): Promise<DyNTS_AccountSessionRecord_Interface | null> {
-    const session: DyNTS_AccountSessionRecord_Interface | undefined = this.sessions.get(sessionId);
-
-    return session ? this.cloneSession(session) : null;
-  }
-
-  /** Finds a test session by its hashed access credential. */
-  public async findSessionByAccessTokenHash(
-    accessTokenHash: string
-  ): Promise<DyNTS_AccountSessionRecord_Interface | null> {
-    const session: DyNTS_AccountSessionRecord_Interface | undefined = Array.from(this.sessions.values())
-      .find((item: DyNTS_AccountSessionRecord_Interface): boolean => item.accessTokenHash === accessTokenHash);
-
-    return session ? this.cloneSession(session) : null;
-  }
-
-  /** Finds a one-time refresh ledger record by credential hash. */
-  public async findRefreshTokenByHash(
-    tokenHash: string
-  ): Promise<DyNTS_AccountRefreshTokenRecord_Interface | null> {
-    const token: DyNTS_AccountRefreshTokenRecord_Interface | undefined = this.refreshTokens.get(tokenHash);
-
-    return token ? { ...token } : null;
-  }
-
-  /** Performs an in-memory compare-and-set rotation without yielding between checks and writes. */
-  public async rotateSession(set: DyNTS_AccountSessionRotate_Interface): Promise<boolean> {
-    const session: DyNTS_AccountSessionRecord_Interface | undefined =
-      this.sessions.get(set.replacementSession.sessionId);
-    const currentToken: DyNTS_AccountRefreshTokenRecord_Interface | undefined =
-      this.refreshTokens.get(set.currentRefreshTokenHash);
-
-    if (
-      session?.revision !== set.expectedSessionRevision
-      || currentToken?.state !== DyNTS_AccountRefreshTokenState_Type.active
-    ) {
-      return false;
-    }
-
-    currentToken.state = DyNTS_AccountRefreshTokenState_Type.used;
-    currentToken.usedAt = set.usedAt;
-    this.sessions.set(set.replacementSession.sessionId, this.cloneSession(set.replacementSession));
-    this.refreshTokens.set(set.replacementRefreshToken.tokenHash, { ...set.replacementRefreshToken });
-
-    return true;
-  }
-
-  /** Revokes the family belonging to one test session. */
-  public async revokeSession(sessionId: string, revokedAt: string, reasonCode: string): Promise<void> {
-    const session: DyNTS_AccountSessionRecord_Interface | undefined = this.sessions.get(sessionId);
-
-    if (session) {
-      this.revokeMatching(session.familyId, revokedAt, reasonCode);
-    }
-  }
-
-  /** Revokes one complete test token family. */
-  public async revokeFamily(familyId: string, revokedAt: string, reasonCode: string): Promise<void> {
-    this.revokeMatching(familyId, revokedAt, reasonCode);
-  }
-
-  /** Revokes every test session belonging to one subject. */
-  public async revokeSubject(subjectId: string, revokedAt: string, reasonCode: string): Promise<void> {
-    Array.from(this.sessions.values())
-      .filter((session: DyNTS_AccountSessionRecord_Interface): boolean => session.subjectId === subjectId)
-      .forEach((session: DyNTS_AccountSessionRecord_Interface): void => {
-        this.revokeMatching(session.familyId, revokedAt, reasonCode);
-      });
-  }
-
-  /** Lists cloned test sessions belonging to one subject. */
-  public async listSubjectSessions(subjectId: string): Promise<DyNTS_AccountSessionRecord_Interface[]> {
-    return Array.from(this.sessions.values())
-      .filter((session: DyNTS_AccountSessionRecord_Interface): boolean => session.subjectId === subjectId)
-      .map((session: DyNTS_AccountSessionRecord_Interface): DyNTS_AccountSessionRecord_Interface => (
-        this.cloneSession(session)
-      ));
-  }
-
-  private revokeMatching(familyId: string, revokedAt: string, reasonCode: string): void {
-    Array.from(this.sessions.values())
-      .filter((session: DyNTS_AccountSessionRecord_Interface): boolean => session.familyId === familyId)
-      .forEach((session: DyNTS_AccountSessionRecord_Interface): void => {
-        session.state = DyNTS_AccountSessionState_Type.revoked;
-        session.revokedAt = revokedAt;
-        session.revocationReason = reasonCode;
-      });
-    Array.from(this.refreshTokens.values())
-      .filter((token: DyNTS_AccountRefreshTokenRecord_Interface): boolean => token.familyId === familyId)
-      .forEach((token: DyNTS_AccountRefreshTokenRecord_Interface): void => {
-        token.state = DyNTS_AccountRefreshTokenState_Type.revoked;
-      });
-  }
-
-  private cloneSession(
-    session: DyNTS_AccountSessionRecord_Interface
-  ): DyNTS_AccountSessionRecord_Interface {
-    return { ...session, context: { ...session.context } };
-  }
-}
-
-describe('| DyNTS_AccountSession_ControlService', (): void => {
-  const context: DyNTS_AccountSessionContext_Interface = {
-    deviceName: 'Test browser',
-    ipAddressHash: 'ip-hash',
-    userAgentHash: 'agent-hash',
-  };
-  let now: Date;
-  let adapter: DyNTS_TestSessionAdapter;
-  let service: DyNTS_AccountSession_ControlService;
-
-  beforeEach((): void => {
-    now = new Date('2026-08-18T10:00:00.000Z');
-    adapter = new DyNTS_TestSessionAdapter();
-    service = new DyNTS_AccountSession_ControlService({
-      adapter: adapter,
-      accessTtlMs: 60_000,
-      refreshTtlMs: 600_000,
-      clock: (): Date => new Date(now),
-    });
-  });
-
-  it('| persists only token hashes and authenticates an active access credential', async (): Promise<void> => {
-    const pair: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 3, context);
-    const stored: DyNTS_AccountSessionRecord_Interface | undefined = adapter.sessions.get(pair.sessionId);
-    const claims: DyNTS_AccountSessionClaims_Interface = await service.authenticateAccessToken(pair.accessToken);
-
-    expect(stored?.accessTokenHash).toBe(hashToken(pair.accessToken));
-    expect(JSON.stringify(Array.from(adapter.sessions.values()))).not.toContain(pair.accessToken);
-    expect(JSON.stringify(Array.from(adapter.refreshTokens.values()))).not.toContain(pair.refreshToken);
-    expect(claims).toEqual({
-      subjectId: 'subject-1',
-      sessionId: pair.sessionId,
-      familyId: stored?.familyId,
-      authorizationVersion: 3,
-    });
-  });
-
-  it('| rejects an expired access credential with a content-free error', async (): Promise<void> => {
-    const pair: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
-
-    now = new Date('2026-08-18T10:01:00.001Z');
-    const error: DyFM_Error = await captureError(service.authenticateAccessToken(pair.accessToken));
-
-    expect(error._errorCode).toContain('ACCESS_TOKEN_INVALID');
-    expect(error._message).not.toContain(pair.accessToken);
-  });
-
-  it('| rejects a corrupt access expiry instead of treating it as unbounded', async (): Promise<void> => {
-    const pair: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
-    const stored: DyNTS_AccountSessionRecord_Interface | undefined = adapter.sessions.get(pair.sessionId);
-
-    if (stored) {
-      stored.accessExpiresAt = 'not-a-date';
-    }
-
-    await expectAsync(service.authenticateAccessToken(pair.accessToken)).toBeRejectedWithError(DyFM_Error);
-  });
-
-  it('| rotates a refresh credential once without extending its absolute expiry', async (): Promise<void> => {
-    const first: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
-
-    now = new Date('2026-08-18T10:00:30.000Z');
-    const second: DyNTS_AccountSessionTokenPair_Interface = await service.rotateRefreshToken(
-      first.refreshToken,
-      context
-    );
-    const oldToken: DyNTS_AccountRefreshTokenRecord_Interface | undefined =
-      adapter.refreshTokens.get(hashToken(first.refreshToken));
-
-    expect(second.refreshToken).not.toBe(first.refreshToken);
-    expect(second.refreshExpiresAt).toBe(first.refreshExpiresAt);
-    expect(oldToken?.state).toBe(DyNTS_AccountRefreshTokenState_Type.used);
-    expect((await service.authenticateAccessToken(second.accessToken)).subjectId).toBe('subject-1');
-  });
-
-  it('| treats refresh replay as compromise and revokes the complete family', async (): Promise<void> => {
-    const first: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
-    const second: DyNTS_AccountSessionTokenPair_Interface = await service.rotateRefreshToken(
-      first.refreshToken,
-      context
-    );
-    const replayError: DyFM_Error = await captureError(service.rotateRefreshToken(first.refreshToken, context));
-    const accessError: DyFM_Error = await captureError(service.authenticateAccessToken(second.accessToken));
-
-    expect(replayError._errorCode).toContain('REFRESH_TOKEN_REUSE');
-    expect(accessError._errorCode).toContain('ACCESS_TOKEN_INVALID');
-  });
-
-  it('| permits one concurrent rotation winner then revokes the raced family', async (): Promise<void> => {
-    const first: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
-    const results: PromiseSettledResult<DyNTS_AccountSessionTokenPair_Interface>[] = await Promise.allSettled([
-      service.rotateRefreshToken(first.refreshToken, context),
-      service.rotateRefreshToken(first.refreshToken, context),
-    ]);
-    const winners: PromiseFulfilledResult<DyNTS_AccountSessionTokenPair_Interface>[] = results.filter(
-      (result: PromiseSettledResult<DyNTS_AccountSessionTokenPair_Interface>):
-      result is PromiseFulfilledResult<DyNTS_AccountSessionTokenPair_Interface> => result.status === 'fulfilled'
-    );
-
-    expect(winners.length).toBe(1);
-    expect(results.filter((result: PromiseSettledResult<DyNTS_AccountSessionTokenPair_Interface>): boolean => (
-      result.status === 'rejected'
-    )).length).toBe(1);
-    await expectAsync(service.authenticateAccessToken(winners[0].value.accessToken)).toBeRejectedWithError(
-      DyFM_Error
-    );
-  });
-
-  it('| revokes one session or every subject session without affecting another subject', async (): Promise<void> => {
-    const first: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
-    const second: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
-    const other: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-2', 1, context);
-
-    await service.revokeSession(first.sessionId, 'user-sign-out');
-    await expectAsync(service.authenticateAccessToken(first.accessToken)).toBeRejectedWithError(DyFM_Error);
-    expect((await service.authenticateAccessToken(second.accessToken)).subjectId).toBe('subject-1');
-    await service.revokeAllSubjectSessions('subject-1', 'password-change');
-    await expectAsync(service.authenticateAccessToken(second.accessToken)).toBeRejectedWithError(DyFM_Error);
-    expect((await service.authenticateAccessToken(other.accessToken)).subjectId).toBe('subject-2');
-  });
-
-  it('| exposes only the user-safe session projection', async (): Promise<void> => {
-    await service.issueSession('subject-1', 1, context);
-    const sessions: DyNTS_AccountSessionView_Interface[] = await service.listSubjectSessions('subject-1');
-    const serialized: string = JSON.stringify(sessions);
-
-    expect(sessions.length).toBe(1);
-    expect(serialized).not.toContain('accessTokenHash');
-    expect(serialized).not.toContain('familyId');
-    expect(serialized).not.toContain('subjectId');
-    expect(sessions[0].context).toEqual(context);
-  });
-
-  it('| rejects unsafe runtime settings before issuing credentials', (): void => {
-    expect((): DyNTS_AccountSession_ControlService => new DyNTS_AccountSession_ControlService({
-      adapter: adapter,
-      tokenBytes: 16,
-    })).toThrowError(DyFM_Error);
-  });
-
-  it('| rejects malformed authorization versions and oversized context before persistence', async (): Promise<void> => {
-    await expectAsync(service.issueSession('subject-1', -1, context)).toBeRejectedWithError(DyFM_Error);
-    await expectAsync(service.issueSession('subject-1', 1, {
-      ...context,
-      deviceName: 'x'.repeat(161),
-    })).toBeRejectedWithError(DyFM_Error);
-    expect(adapter.sessions.size).toBe(0);
-  });
-});
-
-function hashToken(token: string): string {
-  return createHash('sha256').update(token).digest('hex');
-}
-
-async function captureError(promise: Promise<unknown>): Promise<DyFM_Error> {
-  try {
-    await promise;
-  } catch (error: unknown) {
-    if (error instanceof DyFM_Error) {
-      return error;
-    }
-  }
-
-  throw new Error('Expected a DyFM_Error rejection.');
-}
+import { createHash } from 'crypto';
+
+import { DyFM_Error } from '@futdevpro/fsm-dynamo';
+
+import { DyNTS_AccountSession_ControlService } from './account-session.control-service';
+import { DyNTS_AccountRefreshTokenState_Type } from './_enums/account-refresh-token-state.type-enum';
+import { DyNTS_AccountSessionState_Type } from './_enums/account-session-state.type-enum';
+import { DyNTS_AccountRefreshTokenRecord_Interface } from './_models/account-refresh-token-record.interface';
+import { DyNTS_AccountSessionAdapter_Interface } from './_models/account-session-adapter.interface';
+import { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
+import { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
+import { DyNTS_AccountSessionCreate_Interface } from './_models/account-session-create.interface';
+import { DyNTS_AccountSessionRecord_Interface } from './_models/account-session-record.interface';
+import { DyNTS_AccountSessionRotate_Interface } from './_models/account-session-rotate.interface';
+import { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
+import { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
+
+class DyNTS_TestSessionAdapter implements DyNTS_AccountSessionAdapter_Interface {
+  public readonly sessions: Map<string, DyNTS_AccountSessionRecord_Interface> = new Map();
+  public readonly refreshTokens: Map<string, DyNTS_AccountRefreshTokenRecord_Interface> = new Map();
+
+  /** Stores a new session and its first refresh credential atomically in memory. */
+  public async createSession(set: DyNTS_AccountSessionCreate_Interface): Promise<void> {
+    this.sessions.set(set.session.sessionId, this.cloneSession(set.session));
+    this.refreshTokens.set(set.refreshToken.tokenHash, { ...set.refreshToken });
+  }
+
+  /** Finds a test session by its stable identifier. */
+  public async findSessionById(sessionId: string): Promise<DyNTS_AccountSessionRecord_Interface | null> {
+    const session: DyNTS_AccountSessionRecord_Interface | undefined = this.sessions.get(sessionId);
+
+    return session ? this.cloneSession(session) : null;
+  }
+
+  /** Finds a test session by its hashed access credential. */
+  public async findSessionByAccessTokenHash(
+    accessTokenHash: string
+  ): Promise<DyNTS_AccountSessionRecord_Interface | null> {
+    const session: DyNTS_AccountSessionRecord_Interface | undefined = Array.from(this.sessions.values())
+      .find((item: DyNTS_AccountSessionRecord_Interface): boolean => item.accessTokenHash === accessTokenHash);
+
+    return session ? this.cloneSession(session) : null;
+  }
+
+  /** Finds a one-time refresh ledger record by credential hash. */
+  public async findRefreshTokenByHash(
+    tokenHash: string
+  ): Promise<DyNTS_AccountRefreshTokenRecord_Interface | null> {
+    const token: DyNTS_AccountRefreshTokenRecord_Interface | undefined = this.refreshTokens.get(tokenHash);
+
+    return token ? { ...token } : null;
+  }
+
+  /** Performs an in-memory compare-and-set rotation without yielding between checks and writes. */
+  public async rotateSession(set: DyNTS_AccountSessionRotate_Interface): Promise<boolean> {
+    const session: DyNTS_AccountSessionRecord_Interface | undefined =
+      this.sessions.get(set.replacementSession.sessionId);
+    const currentToken: DyNTS_AccountRefreshTokenRecord_Interface | undefined =
+      this.refreshTokens.get(set.currentRefreshTokenHash);
+
+    if (
+      session?.revision !== set.expectedSessionRevision
+      || currentToken?.state !== DyNTS_AccountRefreshTokenState_Type.active
+    ) {
+      return false;
+    }
+
+    currentToken.state = DyNTS_AccountRefreshTokenState_Type.used;
+    currentToken.usedAt = set.usedAt;
+    this.sessions.set(set.replacementSession.sessionId, this.cloneSession(set.replacementSession));
+    this.refreshTokens.set(set.replacementRefreshToken.tokenHash, { ...set.replacementRefreshToken });
+
+    return true;
+  }
+
+  /** Revokes the family belonging to one test session. */
+  public async revokeSession(sessionId: string, revokedAt: string, reasonCode: string): Promise<void> {
+    const session: DyNTS_AccountSessionRecord_Interface | undefined = this.sessions.get(sessionId);
+
+    if (session) {
+      this.revokeMatching(session.familyId, revokedAt, reasonCode);
+    }
+  }
+
+  /** Revokes one complete test token family. */
+  public async revokeFamily(familyId: string, revokedAt: string, reasonCode: string): Promise<void> {
+    this.revokeMatching(familyId, revokedAt, reasonCode);
+  }
+
+  /** Revokes every test session belonging to one subject. */
+  public async revokeSubject(subjectId: string, revokedAt: string, reasonCode: string): Promise<void> {
+    Array.from(this.sessions.values())
+      .filter((session: DyNTS_AccountSessionRecord_Interface): boolean => session.subjectId === subjectId)
+      .forEach((session: DyNTS_AccountSessionRecord_Interface): void => {
+        this.revokeMatching(session.familyId, revokedAt, reasonCode);
+      });
+  }
+
+  /** Lists cloned test sessions belonging to one subject. */
+  public async listSubjectSessions(subjectId: string): Promise<DyNTS_AccountSessionRecord_Interface[]> {
+    return Array.from(this.sessions.values())
+      .filter((session: DyNTS_AccountSessionRecord_Interface): boolean => session.subjectId === subjectId)
+      .map((session: DyNTS_AccountSessionRecord_Interface): DyNTS_AccountSessionRecord_Interface => (
+        this.cloneSession(session)
+      ));
+  }
+
+  private revokeMatching(familyId: string, revokedAt: string, reasonCode: string): void {
+    Array.from(this.sessions.values())
+      .filter((session: DyNTS_AccountSessionRecord_Interface): boolean => session.familyId === familyId)
+      .forEach((session: DyNTS_AccountSessionRecord_Interface): void => {
+        session.state = DyNTS_AccountSessionState_Type.revoked;
+        session.revokedAt = revokedAt;
+        session.revocationReason = reasonCode;
+      });
+    Array.from(this.refreshTokens.values())
+      .filter((token: DyNTS_AccountRefreshTokenRecord_Interface): boolean => token.familyId === familyId)
+      .forEach((token: DyNTS_AccountRefreshTokenRecord_Interface): void => {
+        token.state = DyNTS_AccountRefreshTokenState_Type.revoked;
+      });
+  }
+
+  private cloneSession(
+    session: DyNTS_AccountSessionRecord_Interface
+  ): DyNTS_AccountSessionRecord_Interface {
+    return { ...session, context: { ...session.context } };
+  }
+}
+
+describe('| DyNTS_AccountSession_ControlService', (): void => {
+  const context: DyNTS_AccountSessionContext_Interface = {
+    deviceName: 'Test browser',
+    ipAddressHash: 'ip-hash',
+    userAgentHash: 'agent-hash',
+  };
+  let now: Date;
+  let adapter: DyNTS_TestSessionAdapter;
+  let service: DyNTS_AccountSession_ControlService;
+
+  beforeEach((): void => {
+    now = new Date('2026-08-18T10:00:00.000Z');
+    adapter = new DyNTS_TestSessionAdapter();
+    service = new DyNTS_AccountSession_ControlService({
+      adapter: adapter,
+      accessTtlMs: 60_000,
+      refreshTtlMs: 600_000,
+      clock: (): Date => new Date(now),
+    });
+  });
+
+  it('| persists only token hashes and authenticates an active access credential', async (): Promise<void> => {
+    const pair: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 3, context);
+    const stored: DyNTS_AccountSessionRecord_Interface | undefined = adapter.sessions.get(pair.sessionId);
+    const claims: DyNTS_AccountSessionClaims_Interface = await service.authenticateAccessToken(pair.accessToken);
+
+    expect(stored?.accessTokenHash).toBe(hashToken(pair.accessToken));
+    expect(JSON.stringify(Array.from(adapter.sessions.values()))).not.toContain(pair.accessToken);
+    expect(JSON.stringify(Array.from(adapter.refreshTokens.values()))).not.toContain(pair.refreshToken);
+    expect(claims).toEqual({
+      subjectId: 'subject-1',
+      sessionId: pair.sessionId,
+      familyId: stored?.familyId,
+      authorizationVersion: 3,
+    });
+  });
+
+  it('| rejects an expired access credential with a content-free error', async (): Promise<void> => {
+    const pair: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
+
+    now = new Date('2026-08-18T10:01:00.001Z');
+    const error: DyFM_Error = await captureError(service.authenticateAccessToken(pair.accessToken));
+
+    expect(error._errorCode).toContain('ACCESS_TOKEN_INVALID');
+    expect(error._message).not.toContain(pair.accessToken);
+  });
+
+  it('| rejects a corrupt access expiry instead of treating it as unbounded', async (): Promise<void> => {
+    const pair: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
+    const stored: DyNTS_AccountSessionRecord_Interface | undefined = adapter.sessions.get(pair.sessionId);
+
+    if (stored) {
+      stored.accessExpiresAt = 'not-a-date';
+    }
+
+    await expectAsync(service.authenticateAccessToken(pair.accessToken)).toBeRejectedWithError(DyFM_Error);
+  });
+
+  it('| rotates a refresh credential once without extending its absolute expiry', async (): Promise<void> => {
+    const first: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
+
+    now = new Date('2026-08-18T10:00:30.000Z');
+    const second: DyNTS_AccountSessionTokenPair_Interface = await service.rotateRefreshToken(
+      first.refreshToken,
+      context
+    );
+    const oldToken: DyNTS_AccountRefreshTokenRecord_Interface | undefined =
+      adapter.refreshTokens.get(hashToken(first.refreshToken));
+
+    expect(second.refreshToken).not.toBe(first.refreshToken);
+    expect(second.refreshExpiresAt).toBe(first.refreshExpiresAt);
+    expect(oldToken?.state).toBe(DyNTS_AccountRefreshTokenState_Type.used);
+    expect((await service.authenticateAccessToken(second.accessToken)).subjectId).toBe('subject-1');
+  });
+
+  it('| treats refresh replay as compromise and revokes the complete family', async (): Promise<void> => {
+    const first: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
+    const second: DyNTS_AccountSessionTokenPair_Interface = await service.rotateRefreshToken(
+      first.refreshToken,
+      context
+    );
+    const replayError: DyFM_Error = await captureError(service.rotateRefreshToken(first.refreshToken, context));
+    const accessError: DyFM_Error = await captureError(service.authenticateAccessToken(second.accessToken));
+
+    expect(replayError._errorCode).toContain('REFRESH_TOKEN_REUSE');
+    expect(accessError._errorCode).toContain('ACCESS_TOKEN_INVALID');
+  });
+
+  it('| permits one concurrent rotation winner then revokes the raced family', async (): Promise<void> => {
+    const first: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
+    const results: PromiseSettledResult<DyNTS_AccountSessionTokenPair_Interface>[] = await Promise.allSettled([
+      service.rotateRefreshToken(first.refreshToken, context),
+      service.rotateRefreshToken(first.refreshToken, context),
+    ]);
+    const winners: PromiseFulfilledResult<DyNTS_AccountSessionTokenPair_Interface>[] = results.filter(
+      (result: PromiseSettledResult<DyNTS_AccountSessionTokenPair_Interface>):
+      result is PromiseFulfilledResult<DyNTS_AccountSessionTokenPair_Interface> => result.status === 'fulfilled'
+    );
+
+    expect(winners.length).toBe(1);
+    expect(results.filter((result: PromiseSettledResult<DyNTS_AccountSessionTokenPair_Interface>): boolean => (
+      result.status === 'rejected'
+    )).length).toBe(1);
+    await expectAsync(service.authenticateAccessToken(winners[0].value.accessToken)).toBeRejectedWithError(
+      DyFM_Error
+    );
+  });
+
+  it('| revokes one session or every subject session without affecting another subject', async (): Promise<void> => {
+    const first: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
+    const second: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-1', 1, context);
+    const other: DyNTS_AccountSessionTokenPair_Interface = await service.issueSession('subject-2', 1, context);
+
+    await service.revokeSession(first.sessionId, 'user-sign-out');
+    await expectAsync(service.authenticateAccessToken(first.accessToken)).toBeRejectedWithError(DyFM_Error);
+    expect((await service.authenticateAccessToken(second.accessToken)).subjectId).toBe('subject-1');
+    await service.revokeAllSubjectSessions('subject-1', 'password-change');
+    await expectAsync(service.authenticateAccessToken(second.accessToken)).toBeRejectedWithError(DyFM_Error);
+    expect((await service.authenticateAccessToken(other.accessToken)).subjectId).toBe('subject-2');
+  });
+
+  it('| exposes only the user-safe session projection', async (): Promise<void> => {
+    await service.issueSession('subject-1', 1, context);
+    const sessions: DyNTS_AccountSessionView_Interface[] = await service.listSubjectSessions('subject-1');
+    const serialized: string = JSON.stringify(sessions);
+
+    expect(sessions.length).toBe(1);
+    expect(serialized).not.toContain('accessTokenHash');
+    expect(serialized).not.toContain('familyId');
+    expect(serialized).not.toContain('subjectId');
+    expect(sessions[0].context).toEqual(context);
+  });
+
+  it('| rejects unsafe runtime settings before issuing credentials', (): void => {
+    expect((): DyNTS_AccountSession_ControlService => new DyNTS_AccountSession_ControlService({
+      adapter: adapter,
+      tokenBytes: 16,
+    })).toThrowError(DyFM_Error);
+  });
+
+  it('| rejects malformed authorization versions and oversized context before persistence', async (): Promise<void> => {
+    await expectAsync(service.issueSession('subject-1', -1, context)).toBeRejectedWithError(DyFM_Error);
+    await expectAsync(service.issueSession('subject-1', 1, {
+      ...context,
+      deviceName: 'x'.repeat(161),
+    })).toBeRejectedWithError(DyFM_Error);
+    expect(adapter.sessions.size).toBe(0);
+  });
+});
+
+function hashToken(token: string): string {
+  return createHash('sha256').update(token).digest('hex');
+}
+
+async function captureError(promise: Promise<unknown>): Promise<DyFM_Error> {
+  try {
+    await promise;
+  } catch (error: unknown) {
+    if (error instanceof DyFM_Error) {
+      return error;
+    }
+  }
+
+  throw new Error('Expected a DyFM_Error rejection.');
+}