@fuzdev/fuz_app 0.141.0 → 0.142.0

package/dist/testing/cross_backend/cell_relations.js

@@ -16,11 +16,23 @@ import '../assert_dev_env.js';
  * - **grant lifecycle** — owner grants an actor-shaped editor; the grantee
  *   gains edit (was 404 before the grant); `cell_grant_list` is manage-tier
  *   (owner sees it, the editor gets the IDOR 404); revoke drops the edit path.
+ * - **no owner principal** — a grant naming the cell's owner is refused
+ *   `cell_grant_principal_is_owner`, with the owner's actor id sent lowercase
+ *   or uppercase.
  * - **`cell_visibility_manage_only`** — the editor-grant holder can edit
  *   content but flipping `visibility` is 403 (the case the 5-verb CRUD cut
  *   couldn't reach without a grant principal).
  * - **fields** — `cell_field_set` UPSERT, forward + reverse `cell_field_list`,
  *   idempotent `cell_field_delete`.
+ * - **relation-list caps** — past the default page of inbound edges, a
+ *   reverse `cell_item_list` / `cell_field_list` with no `limit` answers the
+ *   default page, an explicit `limit` caps it in either direction, and the
+ *   forward list defaults the same — the same counts on both spines. A page is
+ *   visible edges: a page's worth of private ends older than one public end
+ *   still leaves the public one on an anonymous page, in all four lists. An
+ *   out-of-range or mistyped `limit` (`0`, `-1`, `1.5`, past the max, `null`,
+ *   a string) is `invalid_params` in every direction, and the reverse lists
+ *   read oldest edge first.
  * - **items** — `cell_item_insert` at fractional-index positions, forward
  *   (lex-ordered) + reverse `cell_item_list`, `cell_item_move`, idempotent
  *   `cell_item_delete`.
@@ -55,13 +67,15 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { fractional_index_between } from '@fuzdev/fuz_util/fractional_index.ts';
+import { fractional_index_between, fractional_indices_between } from '@fuzdev/fuz_util/fractional_index.ts';
 import { CellCreateOutput, CellUpdateOutput, CellCloneOutput, CellGetOutput, CellListOutput } from '../../auth/cell_action_specs.js';
 import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
-import { CellGrantCreateOutput, CellGrantListOutput, CellGrantRevokeOutput } from '../../auth/cell_grant_action_specs.js';
+import { ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER, CellGrantCreateOutput, CellGrantListOutput, CellGrantRevokeOutput } from '../../auth/cell_grant_action_specs.js';
 import { CellFieldDeleteOutput, CellFieldListOutput, CellFieldSetOutput } from '../../auth/cell_field_action_specs.js';
 import { CellItemDeleteOutput, CellItemInsertOutput, CellItemListOutput, CellItemMoveOutput } from '../../auth/cell_item_action_specs.js';
 import { CellAuditListOutput } from '../../auth/cell_audit_action_specs.js';
+import { JSONRPC_INVALID_PARAMS } from '../../http/jsonrpc.js';
+import { CELL_RELATION_LIST_LIMIT_DEFAULT, CELL_RELATION_LIST_LIMIT_MAX } from '../../auth/cell_relation_list_limit.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
@@ -134,6 +148,20 @@ export const describe_cell_relations_cross_tests = (options) => {
             assert.ok(!post.ok, 'revoked editor still edited');
             assert.strictEqual(error_reason(post), 'cell_not_found');
         });
+        test_if(capabilities.cell_relations, 'a grant naming the owner is refused cell_grant_principal_is_owner, whatever the id case', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_grant_self_owner' });
+            const t = fixture.fresh_transport();
+            const owner_h = owner.create_session_headers();
+            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, owner_h), CellCreateOutput).cell;
+            // both spines canonicalize the id before comparing it with
+            // `created_by`, so the uppercased owner id is the owner too
+            for (const actor_id of [owner.actor.id, owner.actor.id.toUpperCase()]) {
+                const res = await cross_rpc_call(t, rpc_path, 'cell_grant_create', { cell_id: cell.id, level: 'viewer', principal: { kind: 'actor', actor_id } }, owner_h);
+                assert.ok(!res.ok, `a grant to the owner must be refused (${actor_id})`);
+                assert.strictEqual(error_reason(res), ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER, actor_id);
+            }
+        });
         test_if(capabilities.cell_relations, "cell_list shared_with: 'me' lists grant-admitted cells, excludes owned, enriches cell_grants", async () => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_shared_owner' });
@@ -219,6 +247,121 @@ export const describe_cell_relations_cross_tests = (options) => {
             const del2 = expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_delete', { source_id: source.id, name: 'cover' }, h), CellFieldDeleteOutput);
             assert.strictEqual(del2.deleted, false);
         });
+        test_if(capabilities.cell_relations, 'relation lists default to a capped page and honor limit, forward and reverse', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_list_cap_owner' });
+            const t = fixture.fresh_transport();
+            const h = owner.create_session_headers();
+            // one past the default page, so an omitted limit shows the cap
+            const inbound = CELL_RELATION_LIST_LIMIT_DEFAULT + 1;
+            const make = async () => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell.id;
+            const hub = await make();
+            const parent = await make();
+            const source = await make();
+            const positions = fractional_indices_between(null, null, inbound);
+            for (let i = 0; i < inbound; i++) {
+                expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_insert', { parent_id: parent, child_id: hub, position: positions[i] }, h), CellItemInsertOutput);
+                expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_set', { source_id: source, name: `link_${i}`, target_id: hub }, h), CellFieldSetOutput);
+            }
+            const items = async (params) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_list', params, h), CellItemListOutput).items.length;
+            const fields = async (params) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_list', params, h), CellFieldListOutput).fields.length;
+            for (const [label, count] of [
+                ['reverse items, no limit', await items({ child_id: hub })],
+                ['reverse fields, no limit', await fields({ target_id: hub })],
+                ['forward items, no limit', await items({ parent_id: parent })],
+                ['forward fields, no limit', await fields({ source_id: source })]
+            ]) {
+                assert.strictEqual(count, CELL_RELATION_LIST_LIMIT_DEFAULT, label);
+            }
+            assert.strictEqual(await items({ child_id: hub, limit: 3 }), 3, 'reverse items, limit 3');
+            assert.strictEqual(await fields({ target_id: hub, limit: 3 }), 3, 'reverse fields, limit 3');
+            assert.strictEqual(await items({ child_id: hub, limit: inbound }), inbound, 'reverse items, limit past the default');
+            assert.strictEqual(await fields({ target_id: hub, limit: inbound }), inbound, 'reverse fields, limit past the default');
+        });
+        test_if(capabilities.cell_relations, 'a relation page is visible edges: hidden ends never crowd out a visible one', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_list_pad_owner' });
+            const t = fixture.fresh_transport();
+            const h = owner.create_session_headers();
+            const anon = fixture.fresh_transport({ origin: null });
+            const make = async (visibility) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {}, visibility }, h), CellCreateOutput).cell.id;
+            const call = async (method, params) => cross_rpc_call(t, rpc_path, method, params, h);
+            // A full default page of private edges, older (and, forward, named
+            // earlier) than one public edge, in all four lists.
+            const target = await make('public');
+            const child = await make('public');
+            const source = await make('public');
+            const parent = await make('public');
+            const padding = CELL_RELATION_LIST_LIMIT_DEFAULT + 1;
+            const positions = fractional_indices_between(null, null, padding + 1);
+            for (let i = 0; i <= padding; i++) {
+                const end = await make(i < padding ? 'private' : 'public');
+                const name = `link_${String(i).padStart(3, '0')}`;
+                expect_output(await call('cell_field_set', { source_id: end, name: 'link', target_id: target }), CellFieldSetOutput);
+                expect_output(await call('cell_item_insert', { parent_id: end, child_id: child, position: 'a0' }), CellItemInsertOutput);
+                expect_output(await call('cell_field_set', { source_id: source, name, target_id: end }), CellFieldSetOutput);
+                expect_output(await call('cell_item_insert', {
+                    parent_id: parent,
+                    child_id: end,
+                    position: positions[i]
+                }), CellItemInsertOutput);
+            }
+            const anon_fields = async (params) => expect_output(await cross_rpc_call(anon, rpc_path, 'cell_field_list', params, {}), CellFieldListOutput).fields;
+            const anon_items = async (params) => expect_output(await cross_rpc_call(anon, rpc_path, 'cell_item_list', params, {}), CellItemListOutput).items;
+            assert.strictEqual((await anon_fields({ target_id: target })).length, 1, 'reverse fields: the public source, past a page of private ones');
+            assert.strictEqual((await anon_items({ child_id: child })).length, 1, 'reverse items: the public parent, past a page of private ones');
+            assert.strictEqual((await anon_fields({ source_id: source })).length, 1, 'forward fields: the public target, past a page of private ones');
+            assert.strictEqual((await anon_items({ parent_id: parent })).length, 1, 'forward items: the public child, past a page of private ones');
+            // the owner views every end: a full default page
+            const owned = expect_output(await call('cell_field_list', { target_id: target }), CellFieldListOutput).fields;
+            assert.strictEqual(owned.length, CELL_RELATION_LIST_LIMIT_DEFAULT, "the owner's page");
+        });
+        test_if(capabilities.cell_relations, 'relation-list limit: out-of-range and mistyped values refused alike, forward and reverse', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_list_limit_owner' });
+            const t = fixture.fresh_transport();
+            const h = owner.create_session_headers();
+            const cell = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell.id;
+            const directions = [
+                ['cell_field_list', { source_id: cell }],
+                ['cell_field_list', { target_id: cell }],
+                ['cell_item_list', { parent_id: cell }],
+                ['cell_item_list', { child_id: cell }]
+            ];
+            for (const [method, base] of directions) {
+                for (const limit of [0, -1, 1.5, CELL_RELATION_LIST_LIMIT_MAX + 1, null, '5']) {
+                    const res = await cross_rpc_call(t, rpc_path, method, { ...base, limit }, h);
+                    const label = `${method} ${JSON.stringify(base)} limit ${JSON.stringify(limit)}`;
+                    assert.ok(!res.ok, `${label} must be refused`);
+                    assert.strictEqual(res.error?.code, JSONRPC_INVALID_PARAMS, label);
+                    assert.strictEqual(error_reason(res), undefined, label);
+                }
+                for (const limit of [1, CELL_RELATION_LIST_LIMIT_MAX]) {
+                    const res = await cross_rpc_call(t, rpc_path, method, { ...base, limit }, h);
+                    assert.ok(res.ok, `${method} ${JSON.stringify(base)} limit ${limit}`);
+                }
+            }
+        });
+        test_if(capabilities.cell_relations, 'reverse relation lists read oldest edge first, so a page of one is the oldest', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_list_order_owner' });
+            const t = fixture.fresh_transport();
+            const h = owner.create_session_headers();
+            const make = async () => expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, h), CellCreateOutput).cell.id;
+            const hub = await make();
+            // each edge its own call, so each has its own `created_at`, in order
+            const ends = [await make(), await make(), await make()];
+            for (const end of ends) {
+                expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_insert', { parent_id: end, child_id: hub, position: 'a0' }, h), CellItemInsertOutput);
+                expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_set', { source_id: end, name: 'link', target_id: hub }, h), CellFieldSetOutput);
+            }
+            const parents = async (limit) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_item_list', { child_id: hub, limit }, h), CellItemListOutput).items.map((i) => i.parent_id);
+            const sources = async (limit) => expect_output(await cross_rpc_call(t, rpc_path, 'cell_field_list', { target_id: hub, limit }, h), CellFieldListOutput).fields.map((f) => f.source_id);
+            assert.deepStrictEqual(await parents(), ends, 'reverse items, oldest first');
+            assert.deepStrictEqual(await parents(1), [ends[0]], 'reverse items, a page of one');
+            assert.deepStrictEqual(await sources(), ends, 'reverse fields, oldest first');
+            assert.deepStrictEqual(await sources(1), [ends[0]], 'reverse fields, a page of one');
+        });
         test_if(capabilities.cell_relations, 'item insert → ordered forward + reverse list → move → idempotent delete', async () => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_item_owner' });

package/dist/testing/cross_backend/expected_schema.json

@@ -76,7 +76,6 @@
 		"role",
 		"scope_id"
 	],
-	"cell_history": ["action_id", "cell_id", "created_at", "fact_hash", "id"],
 	"cell_item": ["child_id", "created_at", "parent_id", "position"],
 	"fact": ["bytes", "content_type", "created_at", "external_url", "hash", "size"],
 	"fact_ref": ["source_hash", "target_hash"],

package/dist/testing/cross_backend/login_security.d.ts

@@ -6,6 +6,22 @@ export interface LoginSecurityCrossTestOptions {
     readonly setup_test: SetupTest;
     /** REST login route path. Default `/api/account/login` (the spine convention). */
     readonly login_path?: string;
+    /** REST password-change route path. Default `/api/account/password`. */
+    readonly password_path?: string;
+    /**
+     * Whether the backend serves concurrent logins — each its own database
+     * transaction — at once, for the burst-of-correct-logins case. Default
+     * `false`: a backend on one in-process connection (pglet-wasm, PGlite)
+     * refuses a second top-level transaction while one runs, so concurrent
+     * successful logins answer `500` there whatever the limiter does.
+     */
+    readonly concurrent_transactions?: boolean;
+    /**
+     * The backend's base URL, for the repeated-`X-Forwarded-For` case, which
+     * needs a raw socket to send two header lines. `null` (the default) skips
+     * that case.
+     */
+    readonly base_url?: string | null;
 }
 export declare const describe_login_security_cross_tests: (options: LoginSecurityCrossTestOptions) => void;
 //# sourceMappingURL=login_security.d.ts.map

package/dist/testing/cross_backend/login_security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA0BD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA2KF,CAAC"}
+{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgF9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAgDD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA4UF,CAAC"}

package/dist/testing/cross_backend/login_security.js

@@ -24,6 +24,26 @@ import '../assert_dev_env.js';
  *   not `429`). A backend that ignored XFF and keyed on the (loopback) TCP
  *   peer would 429 the fresh-IP request too — so the `401` proves the limiter
  *   keys on the resolved `X-Forwarded-For` client IP.
+ * - **IPv6 clients share a bucket per `/64`** — after one forwarded IPv6
+ *   address exhausts its bucket, another address in the same `/64` is `429`
+ *   and one in the next `/64` is not; the login audit rows keep each full
+ *   address, never the bucket key. A password change, which shares the
+ *   per-IP login limiter, from an address in an exhausted `/64` is `429` too.
+ * - **a concurrent burst gets at most the cap past the limiter** — `2 ×
+ *   ip_limit` wrong logins sent at once from one fresh forwarded IP answer at
+ *   most `ip_limit` `401`s and `429` for the rest. A limiter checked before
+ *   the lookup and recorded after the verify lets the whole burst through; each
+ *   attempt is reserved instead, counted in flight from the check on.
+ * - **a burst of correct logins past the cap waits, then succeeds** — attempts
+ *   count while in flight whatever their outcome, so `2 × ip_limit` correct
+ *   logins at once from one address meet the cap; the ones past it wait for a
+ *   slot (at most the cap of them) and all answer `200`. Runs on a backend
+ *   that serves concurrent transactions (`concurrent_transactions`).
+ * - **every `X-Forwarded-For` line is read** — a client that sends its own
+ *   line ahead of the one the trusted proxy appended can't choose its bucket:
+ *   after exhausting one forwarded IP, a raw request carrying a spoofed line
+ *   first and that IP last still `429`s. Raw socket only (`fetch` merges
+ *   repeated headers into one line), so it runs when `base_url` is given.
  * - **a success does not refund the per-IP budget** — the distributed-spray
  *   backstop. Failed guesses against *distinct* usernames from one forwarded
  *   IP, interleaved with the attacker's own successful logins, must still 429
@@ -50,7 +70,11 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { ERROR_RATE_LIMIT_EXCEEDED } from '../../http/error_schemas.js';
+import { raw_http_exchange, raw_http_parse_response } from '../transports/raw_http.js';
 import { default_login_account_rate_limit, default_login_ip_rate_limit } from '../../rate_limiter.js';
+import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
+import { cross_rpc_call, expect_output } from './cell_cross_helpers.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /**
  * RFC 5737 TEST-NET-3 (`203.0.113.0/24`) documentation addresses — guaranteed
  * non-routable, so they never collide with a real client IP. One per bucket the
@@ -63,11 +87,35 @@ const XFF_IP_LIMIT = '203.0.113.1';
 const XFF_SEGREGATION_EXHAUST = '203.0.113.2';
 const XFF_SEGREGATION_FRESH = '203.0.113.3';
 const XFF_SPRAY = '203.0.113.4';
+const XFF_BURST = '203.0.113.5';
+const XFF_CORRECT_BURST = '203.0.113.7';
+const XFF_REPEATED_LINES = '203.0.113.6';
+/** RFC 5737 TEST-NET-2 — the address a client writes into its own first line. */
+const XFF_SPOOFED_LINE = '198.51.100.77';
+/**
+ * RFC 3849 documentation (`2001:db8::/32`) addresses: two in one `/64` — the
+ * second differs past bit 64 only — and one in the next `/64`.
+ */
+const XFF_V6_EXHAUST = '2001:db8:e3:1::1';
+const XFF_V6_SAME_64 = '2001:db8:e3:1:8000::2';
+const XFF_V6_OTHER_64 = '2001:db8:e3:2::1';
+/**
+ * Two addresses in one more `/64`: login exhausts the first, and a password
+ * change — which reserves on the same per-IP login limiter — comes from the
+ * second.
+ */
+const XFF_V6_PASSWORD_EXHAUST = '2001:db8:e3:5::1';
+const XFF_V6_PASSWORD_SAME_64 = '2001:db8:e3:5:8000::2';
+/** How long a raw exchange waits for the login's answer. */
+const RAW_READ_TIMEOUT_MS = 5000;
 /** A non-routable, non-existent identifier — login resolves to the not-found path (records the bucket, returns 401). */
 const PROBE_PASSWORD = 'login_security_wrong_password';
 export const describe_login_security_cross_tests = (options) => {
     const { setup_test } = options;
     const login_path = options.login_path ?? '/api/account/login';
+    const password_path = options.password_path ?? '/api/account/password';
+    const concurrent_transactions = options.concurrent_transactions ?? false;
+    const base_url = options.base_url ?? null;
     /** Per-IP cap shared by both impls (TS `default_login_ip_rate_limit`, Rust `DEFAULT_LOGIN_IP_RATE_LIMIT`). */
     const ip_limit = default_login_ip_rate_limit.max_attempts;
     // The XFF-segregation case enables both limiters (one flag drives both), so
@@ -145,6 +193,112 @@ export const describe_login_security_cross_tests = (options) => {
             const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
             assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
         });
+        test('IPv6 clients share a bucket per /64, and the audit row keeps the full address', async () => {
+            const fixture = await setup_test();
+            for (let i = 0; i < ip_limit; i++) {
+                const outcome = await attempt(fixture, XFF_V6_EXHAUST, 'probe_v6');
+                assert.strictEqual(outcome.status, 401, `attempt ${i + 1} from ${XFF_V6_EXHAUST}`);
+            }
+            // another address in the same /64 draws the same budget
+            const same = await attempt(fixture, XFF_V6_SAME_64, 'probe_v6');
+            assert.strictEqual(same.status, 429, 'an address in the same /64 must be rate-limited');
+            // the next /64 has its own
+            const other = await attempt(fixture, XFF_V6_OTHER_64, 'probe_v6');
+            assert.strictEqual(other.status, 401, 'the next /64 must keep its own budget');
+            // The limiter keys the /64; the audit trail keeps the address. Drain
+            // the fire-and-forget audit writes, then read this test's login rows
+            // (`_testing_reset` wiped the log at setup).
+            const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), SPINE_RPC_PATH, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
+            assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+            const listed = expect_output(await cross_rpc_call(fixture.transport, SPINE_RPC_PATH, 'audit_log_list', { event_type: 'login', outcome: 'failure' }, fixture.create_session_headers()), AuditLogListOutput);
+            const ips = listed.events.map((e) => e.ip);
+            assert.ok(ips.includes(XFF_V6_EXHAUST), `audit ips: ${JSON.stringify(ips)}`);
+            assert.ok(ips.includes(XFF_V6_OTHER_64), `audit ips: ${JSON.stringify(ips)}`);
+            assert.ok(ips.every((ip) => ip === null || !ip.includes('/')), `no audit row may carry a rate-limit key: ${JSON.stringify(ips)}`);
+        });
+        test('a password change from the /64 an exhausted IPv6 login shares is rate-limited', async () => {
+            const fixture = await setup_test();
+            for (let i = 0; i < ip_limit; i++) {
+                const outcome = await attempt(fixture, XFF_V6_PASSWORD_EXHAUST, 'probe_v6_password');
+                assert.strictEqual(outcome.status, 401, `attempt ${i + 1} from ${XFF_V6_PASSWORD_EXHAUST}`);
+            }
+            // The keeper's session, from another address in the same /64: the
+            // password route reserves on the per-IP login limiter before it
+            // reads the credential or the body, so the /64's spent budget
+            // answers. Keyed on the full address instead, the wrong
+            // `current_password` would answer `401`.
+            const res = await fixture.fresh_transport()(password_path, {
+                method: 'POST',
+                headers: fixture.create_session_headers({
+                    'content-type': 'application/json',
+                    'x-forwarded-for': XFF_V6_PASSWORD_SAME_64
+                }),
+                body: JSON.stringify({
+                    current_password: PROBE_PASSWORD,
+                    new_password: 'login_security_new_password'
+                })
+            });
+            const body = (await res.json().catch(() => undefined));
+            assert.strictEqual(res.status, 429, `password change answered ${JSON.stringify(body)}`);
+            assert.strictEqual(body?.error, ERROR_RATE_LIMIT_EXCEEDED);
+        });
+        test(`a concurrent burst of ${ip_limit * 2} wrong logins gets at most ${ip_limit} past the per-IP limit`, async () => {
+            const fixture = await setup_test();
+            // All sent at once, so every request reaches the limiter before any
+            // has been answered. Its own username keeps the per-account bucket
+            // (cap above the IP cap, asserted above) out of the count.
+            const outcomes = await Promise.all(Array.from({ length: ip_limit * 2 }, () => attempt(fixture, XFF_BURST, 'probe_burst')));
+            const statuses = outcomes.map((o) => o.status);
+            const refused = statuses.filter((status) => status === 401).length;
+            const limited = statuses.filter((status) => status === 429).length;
+            // Exactly the cap: every admitted attempt fails and records, and the
+            // ones past it — waiting for a slot — are refused as those failures
+            // record, so the count is the same however the burst interleaves.
+            assert.strictEqual(refused, ip_limit, `exactly ${ip_limit} may reach the verify (${statuses})`);
+            assert.strictEqual(refused + limited, ip_limit * 2, `the rest must be 429 (${statuses})`);
+            // And the window is spent: the burst can't have left budget behind.
+            const after = await attempt(fixture, XFF_BURST, 'probe_burst');
+            assert.strictEqual(after.status, 429, 'the burst must leave the per-IP bucket full');
+        });
+        test.skipIf(!concurrent_transactions)(`a concurrent burst of ${ip_limit * 2} correct logins all succeed past the per-IP cap`, async () => {
+            const fixture = await setup_test();
+            const account = await fixture.create_account({
+                username: 'burst_correct',
+                password_value: 'burst_correct_password'
+            });
+            const statuses = await Promise.all(Array.from({ length: ip_limit * 2 }, () => succeed(fixture, XFF_CORRECT_BURST, account.account.username, 'burst_correct_password')));
+            assert.deepStrictEqual(statuses, Array(ip_limit * 2).fill(200), 'the logins past the cap wait for a slot rather than being refused');
+        });
+        test.skipIf(base_url === null)('every X-Forwarded-For line is read (a spoofed first line picks no bucket)', async () => {
+            assert.ok(base_url !== null);
+            const fixture = await setup_test();
+            for (let i = 0; i < ip_limit; i++) {
+                await attempt(fixture, XFF_REPEATED_LINES, 'probe_xff_lines');
+            }
+            const exhausted = await attempt(fixture, XFF_REPEATED_LINES, 'probe_xff_lines');
+            assert.strictEqual(exhausted.status, 429, 'the forwarded IP must be exhausted first');
+            // The client's own line first, the address the proxy appended last.
+            // A backend that read only the first line would key this on the
+            // fresh spoofed address and answer 401.
+            const url = new URL(base_url);
+            const body = JSON.stringify({ username: 'probe_xff_lines', password: PROBE_PASSWORD });
+            const request = `POST ${login_path} HTTP/1.1\r\n` +
+                `host: ${url.host}\r\n` +
+                `content-type: application/json\r\n` +
+                `x-forwarded-for: ${XFF_SPOOFED_LINE}\r\n` +
+                `x-forwarded-for: ${XFF_REPEATED_LINES}\r\n` +
+                `content-length: ${body.length}\r\n` +
+                `connection: close\r\n` +
+                `\r\n` +
+                body;
+            const { received } = await raw_http_exchange(base_url, request, {
+                read_timeout_ms: RAW_READ_TIMEOUT_MS,
+                until: 'response'
+            });
+            const response = raw_http_parse_response(received);
+            assert.ok(response, `no whole response; received: ${received.slice(0, 200)}`);
+            assert.strictEqual(response.status, 429, `the request must key on the proxy-appended line (body: ${response.body})`);
+        });
         test('a success does not refund the per-IP budget (distributed-spray backstop)', async () => {
             const fixture = await setup_test();
             // The attacker's own account. Minting rides the setup path from

package/dist/testing/cross_backend/query_shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/query_shape.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAQjF,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAwHtF,CAAC"}
+{"version":3,"file":"query_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/query_shape.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAQjF,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAkJtF,CAAC"}

package/dist/testing/cross_backend/query_shape.js

@@ -12,8 +12,9 @@ import '../assert_dev_env.js';
  * pinned here on both backends:
  *
  * - **`GET /api/account/status`** — NO query schema: a duplicated `acting`
- *   reads first-wins (the persona resolves), unknown keys are ignored, and an
- *   anonymous caller with junk query hears 401, never a query 400.
+ *   reads first-wins (the persona resolves), a malformed `acting` answers
+ *   account-only (never a default-actor resolve), unknown keys are ignored,
+ *   and an anonymous caller with junk query hears 401, never a query 400.
  * - **the JSON-RPC GET endpoint** — `method` / `id` / `params` read
  *   first-wins; a duplicated `method` must dispatch the first one on every
  *   backend (a last-wins reader dispatches a different method per backend on
@@ -55,6 +56,27 @@ export const describe_query_shape_cross_tests = (options) => {
             const body = (await res.json());
             assert.strictEqual(body.actor?.id, fixture.actor.id, 'first acting occurrence must win');
         });
+        test_if(capabilities.account_status, 'status: a malformed acting is a missing persona, not a default-actor resolve', async () => {
+            const fixture = await setup_test();
+            // The keeper has one actor: an omitted selector resolves it, while a
+            // malformed one answers account-only.
+            const omitted = await fixture.transport(STATUS_PATH, {
+                method: 'GET',
+                headers: fixture.create_session_headers()
+            });
+            assert.strictEqual(omitted.status, 200);
+            const omitted_body = (await omitted.json());
+            assert.strictEqual(omitted_body.actor?.id, fixture.actor.id);
+            for (const raw of ['not-a-uuid', '', `"${fixture.actor.id}"`]) {
+                const res = await fixture.transport(`${STATUS_PATH}?acting=${encodeURIComponent(raw)}`, {
+                    method: 'GET',
+                    headers: fixture.create_session_headers()
+                });
+                assert.strictEqual(res.status, 200, raw);
+                const body = (await res.json());
+                assert.strictEqual(body.actor, null, raw);
+            }
+        });
         test_if(capabilities.account_status, 'status: anonymous with duplicated/unknown query keys → 401, never a query 400', async () => {
             const fixture = await setup_test();
             const anon = fixture.fresh_transport();

package/dist/testing/cross_backend/role_grant_participation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsC9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IA8IF,CAAC"}
+{"version":3,"file":"role_grant_participation.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/role_grant_participation.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,WAAW,sCAAsC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,6CAA6C,GACzD,SAAS,sCAAsC,KAC7C,IAuQF,CAAC"}

package/dist/testing/cross_backend/role_grant_participation.js

@@ -15,6 +15,15 @@ import '../assert_dev_env.js';
  *   re-assigning the active grant is idempotent (same id).
  * - **consent flow** — `role_grant_offer_create` of `participant` (admin-only)
  *   → the recipient `role_grant_offer_accept`s → a role_grant lands.
+ * - **offer replay** — re-accepting an accepted offer whose grant still
+ *   stands answers `200` with the same `role_grant_id` and writes no audit
+ *   row; once the grant is revoked, the replay is refused `invalid_request`
+ *   with reason `role_grant_offer_terminal` (never the revoked grant's id).
+ * - **no self-offer, in either case** — an admin offering to its own
+ *   account is refused `invalid_params` with reason
+ *   `role_grant_offer_self_target`, whether the id is sent lowercase or
+ *   uppercase: both spines canonicalize the id before comparing it with the
+ *   grantor's account.
  * - **scoped assign** — `role_grant_assign` of `participant` with a paired
  *   `scope_kind` + `scope_id` lands a scoped grant carrying both, read back
  *   through `admin_account_list`, distinct from the global grant.
@@ -32,6 +41,9 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { rpc_call } from '../rpc_helpers.js';
+import { AuditLogListOutput } from '../../auth/admin_action_specs.js';
+import { ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL } from '../../auth/role_grant_offer_action_specs.js';
+import { JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST } from '../../http/jsonrpc.js';
 import { SPINE_PARTICIPANT_ROLE, SPINE_RPC_PATH } from './spine_surface_constants.js';
 export const describe_role_grant_participation_cross_tests = (options) => {
     const { setup_test } = options;
@@ -100,5 +112,57 @@ export const describe_role_grant_participation_cross_tests = (options) => {
             assert.ok(accepted.ok, `accept must succeed: ${JSON.stringify(accepted)}`);
             assert.ok(typeof accepted.result.role_grant_id === 'string', 'accept lands a role_grant for the app-role');
         });
+        /** Offer `participant` to `recipient` as the keeper and accept it; returns the ids. */
+        const offer_and_accept = async (fixture, recipient) => {
+            const created = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id: recipient.account.id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+            assert.ok(created.ok, `offer create must succeed: ${JSON.stringify(created)}`);
+            const offer_id = created.result.offer.id;
+            const accepted = await rpc(fixture.fresh_transport(), 'role_grant_offer_accept', { offer_id }, recipient.create_session_headers());
+            assert.ok(accepted.ok, `accept must succeed: ${JSON.stringify(accepted)}`);
+            const { role_grant_id } = accepted.result;
+            return { offer_id, role_grant_id };
+        };
+        /** How many `event_type` audit rows the keeper can list. */
+        const count_audit_rows = async (fixture, event_type) => {
+            const listed = await rpc(fixture.transport, 'audit_log_list', { event_type }, fixture.create_session_headers());
+            assert.ok(listed.ok, `audit_log_list must succeed: ${JSON.stringify(listed)}`);
+            return AuditLogListOutput.parse(listed.result).events.length;
+        };
+        test('re-accepting an accepted offer answers the same grant and writes no audit row', async () => {
+            const fixture = await setup_test();
+            const recipient = await fixture.create_account({ username: 'participation_replayer' });
+            const { offer_id, role_grant_id } = await offer_and_accept(fixture, recipient);
+            const accept_rows = await count_audit_rows(fixture, 'role_grant_offer_accept');
+            const create_rows = await count_audit_rows(fixture, 'role_grant_create');
+            assert.ok(accept_rows >= 1, 'the accept itself is audited');
+            const replayed = await rpc(fixture.fresh_transport(), 'role_grant_offer_accept', { offer_id }, recipient.create_session_headers());
+            assert.ok(replayed.ok, `a replay of a held grant must succeed: ${JSON.stringify(replayed)}`);
+            assert.strictEqual(replayed.result.role_grant_id, role_grant_id, 'a replay answers the grant the accept minted');
+            assert.strictEqual(await count_audit_rows(fixture, 'role_grant_offer_accept'), accept_rows, 'a replay writes no role_grant_offer_accept row');
+            assert.strictEqual(await count_audit_rows(fixture, 'role_grant_create'), create_rows, 'a replay writes no role_grant_create row');
+        });
+        test('re-accepting an offer whose grant was revoked is refused as terminal', async () => {
+            const fixture = await setup_test();
+            const recipient = await fixture.create_account({ username: 'participation_revoked' });
+            const { offer_id, role_grant_id } = await offer_and_accept(fixture, recipient);
+            const revoked = await rpc(fixture.transport, 'role_grant_revoke', { actor_id: recipient.actor.id, role_grant_id }, fixture.create_session_headers());
+            assert.ok(revoked.ok, `revoke must succeed: ${JSON.stringify(revoked)}`);
+            const replayed = await rpc(fixture.fresh_transport(), 'role_grant_offer_accept', { offer_id }, recipient.create_session_headers());
+            assert.ok(!replayed.ok, `a replay after revoke must be refused: ${JSON.stringify(replayed)}`);
+            assert.strictEqual(replayed.status, 400);
+            assert.strictEqual(replayed.error.code, JSONRPC_INVALID_REQUEST);
+            assert.deepStrictEqual(replayed.error.data, { reason: ERROR_ROLE_GRANT_OFFER_TERMINAL });
+        });
+        test('an admin offering to its own account is refused, whatever the id case', async () => {
+            const fixture = await setup_test();
+            const own_id = fixture.account.id;
+            for (const to_account_id of [own_id, own_id.toUpperCase()]) {
+                const res = await rpc(fixture.transport, 'role_grant_offer_create', { to_account_id, role: SPINE_PARTICIPANT_ROLE }, fixture.create_session_headers());
+                assert.ok(!res.ok, `a self-offer must be refused (${to_account_id}): ${JSON.stringify(res)}`);
+                assert.strictEqual(res.status, 400, to_account_id);
+                assert.strictEqual(res.error.code, JSONRPC_INVALID_PARAMS, to_account_id);
+                assert.deepStrictEqual(res.error.data, { reason: ERROR_ROLE_GRANT_OFFER_SELF_TARGET }, to_account_id);
+            }
+        });
     });
 };

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -72,7 +72,7 @@ export declare const SPINE_ROLE_GATED_WS_PATH = "/api/gated/ws";
 export declare const SPINE_ROLE_GATED_WS_ROLES: ReadonlyArray<string>;
 /**
  * Committed expected-schema fixture for the spine `/ready` deploy gate — the
- * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)
+ * column map a fresh full spine bootstrap (auth + cell + fact)
  * produces. Resolved relative to this module so the spawned TS binary (which
  * imports this source under its loader) reads it off disk via `node:fs`.
  * Regenerated + guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`.

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -75,7 +75,7 @@ export const SPINE_ROLE_GATED_WS_ROLES = Object.freeze([
 ]);
 /**
  * Committed expected-schema fixture for the spine `/ready` deploy gate — the
- * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)
+ * column map a fresh full spine bootstrap (auth + cell + fact)
  * produces. Resolved relative to this module so the spawned TS binary (which
  * imports this source under its loader) reads it off disk via `node:fs`.
  * Regenerated + guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`.

package/dist/testing/cross_backend/ws_action_rate_limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_action_rate_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_action_rate_limit.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyC5C,+DAA+D;AAC/D,MAAM,WAAW,iCAAiC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAkBD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,iCAAiC,KACxC,IAqRF,CAAC"}
+{"version":3,"file":"ws_action_rate_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_action_rate_limit.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAgD5C,+DAA+D;AAC/D,MAAM,WAAW,iCAAiC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAkBD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,iCAAiC,KACxC,IAwSF,CAAC"}

package/dist/testing/cross_backend/ws_action_rate_limit.js

@@ -23,7 +23,9 @@ import '../assert_dev_env.js';
  *   'ip'`, public) with malformed params, from one `X-Forwarded-For` address
  *   over anonymous HTTP and over a WS whose upgrade carried the same header:
  *   the call past the cap is refused on both, while a second address keeps its
- *   own budget on both.
+ *   own budget on both. Over HTTP, IPv6 addresses bucket by their `/64`:
+ *   another address in the same `/64` is refused once one has spent the
+ *   budget, while one in the next `/64` keeps its own.
  * - **account axis at the dispatchers** — `cell_create` (`rate_limit:
  *   'account'`, on both spines' RPC and WS mounts) with malformed params: the
  *   call past the cap answers `429` over HTTP and `rate_limited` over WS, calls
@@ -84,6 +86,13 @@ const IP_LIMITED_BAD_PARAMS = { nonce: 'not_a_number' };
  */
 const XFF_IP_EXHAUSTED = '198.51.100.1';
 const XFF_IP_FRESH = '198.51.100.2';
+/**
+ * RFC 3849 documentation addresses: two in one `/64` — the second differs past
+ * bit 64 only — and one in the next `/64`. Distinct from `login_security.ts`'s.
+ */
+const XFF_V6_EXHAUSTED = '2001:db8:e3a:1::1';
+const XFF_V6_SAME_64 = '2001:db8:e3a:1:8000::2';
+const XFF_V6_OTHER_64 = '2001:db8:e3a:2::1';
 /** Generous per-response wait — the cases assert the server's answer, not a timeout. */
 const RESPONSE_TIMEOUT_MS = 5000;
 const outcome_from_frame = (status, frame) => ({
@@ -254,5 +263,16 @@ export const describe_ws_action_rate_limit_cross_tests = (options) => {
                 await ws_fresh.close();
             }
         });
+        test('an IP-limited action buckets IPv6 clients by /64', async () => {
+            const fixture = await setup_test();
+            const call = (forwarded_for) => call_http(fixture, IP_LIMITED_METHOD, IP_LIMITED_BAD_PARAMS, {
+                'x-forwarded-for': forwarded_for
+            });
+            for (let i = 1; i <= max_attempts; i++) {
+                assert_charged_not_limited(await call(XFF_V6_EXHAUSTED), `call ${i} from ${XFF_V6_EXHAUSTED}`);
+            }
+            assert_rate_limited(await call(XFF_V6_SAME_64), `a call from ${XFF_V6_SAME_64}, same /64`);
+            assert_charged_not_limited(await call(XFF_V6_OTHER_64), `a call from ${XFF_V6_OTHER_64}, the next /64`);
+        });
     });
 };

package/dist/testing/schema_introspect.js

@@ -105,7 +105,7 @@ export const SchemaSnapshot = z.object({
  * to the schema snapshot — is a gated fact, not a latent interop break.
  */
 export const MigrationTrackerEntry = z.object({
-    /** Migration namespace (e.g. `fuz_cell`, `fuz_cell_history`). */
+    /** Migration namespace (e.g. `fuz_auth`, `fuz_cell`). */
     namespace: z.string(),
     /** Migration name within the namespace (e.g. `full_cell_schema`). */
     name: z.string(),