@fuzdev/fuz_app 0.144.0 → 0.146.0

package/dist/testing/cross_backend/identity_parity.js

@@ -25,7 +25,9 @@ import '../assert_dev_env.js';
  *   all-uppercase submission (proves the *lookup* folds case, not merely that
  *   the stored form was lowercased).
  * - **whitespace-trim login** — the same shape logs in with surrounding
- *   whitespace (proves `.trim()` on the lookup path).
+ *   whitespace (proves `.trim()` on the lookup path). The trimmed set is JS
+ *   `String.prototype.trim`'s on every spine: U+FEFF padding is trimmed (→
+ *   200, and alone → 400 empty), U+0085 is not (→ 401 lookup miss).
  * - **no Unicode case-fold collision (negative)** — a Turkish-`İ` (U+0130)
  *   variant of an existing ASCII username must NOT match. Both JS
  *   `.toLowerCase()` and Rust `str::to_lowercase()` map `İ` → `i` + U+0307
@@ -67,6 +69,10 @@ import '../assert_dev_env.js';
  * with mid-string `_`/`-` accepted siblings as the don't-over-reject control.
  * Signup is also strict-object on both spines (TS `z.strictObject`, Rust
  * `#[serde(deny_unknown_fields)]`), so an unknown signup body key → 400.
+ * Nothing trims a creation username: a padded one is refused 400 at signup and
+ * at bootstrap, never trimmed into a legal name. Bootstrap validates its body
+ * before its window check, so the padded bootstrap answers 400 even after
+ * bootstrap completed.
  *
  * **Email format (creation):** the optional signup `email` is validated to a
  * loose `local@domain.tld` shape on both spines — TS `Email`
@@ -78,6 +84,14 @@ import '../assert_dev_env.js';
  * share. This closed a real divergence: the Rust spine previously
  * length-checked the email only, accepting any non-empty string TS rejected.
  *
+ * **Malformed JSON body:** a body typed `application/json` that doesn't parse
+ * (`{`) or parses to anything but an object (`[]`) is 400 `{error:
+ * "invalid_json_body"}`, with no other field, on login, signup, bootstrap
+ * (`bootstrap_path`, parsed ahead of the window check), and the password change
+ * (`password_path`, default `/api/account/password`, `null` to skip) — parsed
+ * only after its credential and session-only gates, so the case sends the
+ * keeper's session, and an anonymous unparseable body is still 401.
+ *
  * Both surfaces are flat REST on every spine, so this is an imperative suite
  * (not a `conformance_table` row) and ungated. Runs both legs via the shared
  * `{setup_test}` protocol: the in-process leg
@@ -88,8 +102,9 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, test, assert } from 'vitest';
-import { ERROR_INVALID_CREDENTIALS, ERROR_INVALID_REQUEST_BODY, ERROR_NO_MATCHING_INVITE } from '../../http/error_schemas.js';
+import { ERROR_ALREADY_BOOTSTRAPPED, ERROR_AUTHENTICATION_REQUIRED, ERROR_INVALID_CREDENTIALS, ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY, ERROR_NO_MATCHING_INVITE } from '../../http/error_schemas.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+import { test_if } from './capabilities.js';
 /**
  * The flat-REST `{error}` reason each terminal login/signup status carries on
  * every spine — the assertion target that turns a status-only check into a
@@ -245,18 +260,29 @@ export const describe_identity_parity_cross_tests = (options) => {
     const { setup_test } = options;
     const login_path = options.login_path ?? '/api/account/login';
     const signup_path = options.signup_path ?? '/api/account/signup';
+    const bootstrap_path = options.bootstrap_path === undefined ? '/api/account/bootstrap' : options.bootstrap_path;
+    const password_path = options.password_path === undefined ? '/api/account/password' : options.password_path;
     /**
-     * POST JSON on a fresh (cookie-jar-free) transport; return the status and the
-     * parsed flat-REST `{error}` reason (`undefined` for success / non-JSON
-     * bodies). Always reads the body so the cross-process socket releases.
+     * POST a raw body typed `application/json` on a fresh (cookie-jar-free)
+     * transport, with the transport's allowed `Origin`; return the status and
+     * the body text. Always reads the body so the cross-process socket releases.
      */
-    const post_json = async (fixture, path, body) => {
+    const post_raw = async (fixture, path, body, headers) => {
         const res = await fixture.fresh_transport()(path, {
             method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(body)
+            headers: { 'content-type': 'application/json', ...headers },
+            body
         });
-        const text = await res.text().catch(() => '');
+        return { status: res.status, text: await res.text().catch(() => '') };
+    };
+    /**
+     * POST JSON on a fresh (cookie-jar-free) transport; return the status and the
+     * parsed flat-REST `{error}` reason (`undefined` for success / non-JSON
+     * bodies).
+     */
+    const post_json = async (fixture, path, body) => {
+        const res = await post_raw(fixture, path, JSON.stringify(body));
+        const text = res.text;
         let error;
         try {
             const parsed = text ? JSON.parse(text) : undefined;
@@ -311,6 +337,23 @@ export const describe_identity_parity_cross_tests = (options) => {
             await fixture.create_account({ username: 'Canon_Trim_User' });
             assert_attempt(await login(fixture, '  canon_trim_user  '), 200, 'whitespace-trim login');
         });
+        // JS `trim` and Rust `str::trim` disagree on two code points: U+FEFF is JS
+        // whitespace but not Unicode `White_Space`, U+0085 the reverse. Every
+        // spine trims the JS set (TS is the oracle).
+        test('U+FEFF padding is trimmed on lookup → 200', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username: 'canon_bom_user' });
+            assert_attempt(await login(fixture, '\ufeffcanon_bom_user\ufeff'), 200, 'U+FEFF-padded login');
+        });
+        test('U+FEFF alone is empty after the trim → 400', async () => {
+            const fixture = await setup_test();
+            assert_attempt(await login(fixture, '\ufeff'), 400, 'U+FEFF-only login');
+        });
+        test('U+0085 padding is not trimmed → 401 lookup miss', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username: 'canon_nel_user' });
+            assert_attempt(await login(fixture, '\u0085canon_nel_user\u0085'), 401, 'U+0085-padded login');
+        });
         test('no Unicode case-fold collision — Turkish İ variant of an ASCII username → 401', async () => {
             const fixture = await setup_test();
             // `canon_admin_user` carries an ASCII `i`; the probe replaces it with İ
@@ -463,5 +506,77 @@ export const describe_identity_parity_cross_tests = (options) => {
                 unexpected_field: 'x'
             }), 400, 'signup unknown body key');
         });
+        // `Username` validates the raw value — nothing trims a creation username,
+        // so padding is refused, never repaired into a legal name (which would
+        // reach the invite gate → 403, or create the account under open signup).
+        for (const [username, label] of [
+            [' padded_signup_user ', 'space padding'],
+            ['padded_signup_user\t', 'trailing tab'],
+            ['\u0085padded_signup_user', 'leading U+0085']
+        ]) {
+            test(`padded username (${label}) → 400, not trimmed`, async () => {
+                const fixture = await setup_test();
+                assert_attempt(await signup(fixture, username), 400, `signup ${label}`);
+            });
+        }
+    });
+    describe('bootstrap input validation parity', () => {
+        // The body is validated before the bootstrap window is consulted on every
+        // spine (the TS route schema runs ahead of the handler), so a padded
+        // username answers 400 `invalid_request_body` even after bootstrap
+        // completed — not the closed window's refusal. The unpadded control, the
+        // same body otherwise, reaches the closed window, so the 400 can only be
+        // the username's.
+        test_if(bootstrap_path !== null, 'padded username → 400, not trimmed, ahead of the window check', async () => {
+            const fixture = await setup_test();
+            const body = {
+                token: 'identity-parity-not-the-token',
+                username: ' padded_keeper ',
+                password: DEFAULT_TEST_PASSWORD
+            };
+            assert_attempt(await post_json(fixture, bootstrap_path, body), 400, 'bootstrap padded username');
+            const control = await post_json(fixture, bootstrap_path, {
+                ...body,
+                username: 'padded_keeper'
+            });
+            assert.deepStrictEqual(control, { status: 403, error: ERROR_ALREADY_BOOTSTRAPPED }, 'bootstrap unpadded control');
+        });
+    });
+    describe('malformed JSON body parity', () => {
+        // A body typed `application/json` that doesn't parse, or parses to
+        // anything but an object, is 400 `invalid_json_body` on every spine —
+        // never the schema's `invalid_request_body`, and with no other field.
+        // Bootstrap parses ahead of its window check (so the 400 holds after
+        // bootstrap completed); the password change parses only after its
+        // credential and session-only gates, so it needs a session, and an
+        // anonymous caller still hears 401.
+        const MALFORMED_BODIES = [
+            ['{', 'unparseable'],
+            ['[]', 'a non-object array']
+        ];
+        const assert_invalid_json_body = (got, label) => {
+            assert.strictEqual(got.status, 400, `${label} — status: ${got.text}`);
+            assert.deepStrictEqual(JSON.parse(got.text), { error: ERROR_INVALID_JSON_BODY }, `${label} — body`);
+        };
+        const routes = [
+            { name: 'login', path: login_path, session: false },
+            { name: 'signup', path: signup_path, session: false },
+            { name: 'bootstrap', path: bootstrap_path, session: false },
+            { name: 'password', path: password_path, session: true }
+        ];
+        for (const { name, path, session } of routes) {
+            for (const [body, label] of MALFORMED_BODIES) {
+                test_if(path !== null, `${name}: ${label} body → 400 invalid_json_body`, async () => {
+                    const fixture = await setup_test();
+                    assert_invalid_json_body(await post_raw(fixture, path, body, session ? fixture.create_session_headers() : undefined), `${name} ${label} body`);
+                });
+            }
+        }
+        test_if(password_path !== null, 'password: an unparseable body without a session → 401, the gates ahead of the parse', async () => {
+            const fixture = await setup_test();
+            const got = await post_raw(fixture, password_path, '{');
+            assert.strictEqual(got.status, 401, `anonymous unparseable password body: ${got.text}`);
+            assert.strictEqual(JSON.parse(got.text).error, ERROR_AUTHENTICATION_REQUIRED);
+        });
     });
 };

package/dist/testing/cross_backend/login_security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgF9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAgDD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA4UF,CAAC"}
+{"version":3,"file":"login_security.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/login_security.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsF9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAmDD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IA8XF,CAAC"}

package/dist/testing/cross_backend/login_security.js

@@ -44,6 +44,12 @@ import '../assert_dev_env.js';
  *   after exhausting one forwarded IP, a raw request carrying a spoofed line
  *   first and that IP last still `429`s. Raw socket only (`fetch` merges
  *   repeated headers into one line), so it runs when `base_url` is given.
+ * - **a malformed hop stops the walk** — a trusted proxy that appends a
+ *   non-bare-IP token (`ip:port` here) leaves the client's own entry to its
+ *   left. After exhausting one forwarded IP, a chain with that IP left of an
+ *   `ip:port` entry answers `401`, not `429`: the walk stopped at the malformed
+ *   entry and keyed the request on the connection IP (its audit row says so),
+ *   never on the client-written entry past it.
  * - **a success does not refund the per-IP budget** — the distributed-spray
  *   backstop. Failed guesses against *distinct* usernames from one forwarded
  *   IP, interleaved with the attacker's own successful logins, must still 429
@@ -90,6 +96,9 @@ const XFF_SPRAY = '203.0.113.4';
 const XFF_BURST = '203.0.113.5';
 const XFF_CORRECT_BURST = '203.0.113.7';
 const XFF_REPEATED_LINES = '203.0.113.6';
+const XFF_MALFORMED_HOP = '203.0.113.8';
+/** What a trusted hop that appends `ip:port` (an Azure App Gateway, IIS ARR) writes. */
+const XFF_PORT_SUFFIXED_HOP = '198.51.100.7:5555';
 /** RFC 5737 TEST-NET-2 — the address a client writes into its own first line. */
 const XFF_SPOOFED_LINE = '198.51.100.77';
 /**
@@ -193,6 +202,25 @@ export const describe_login_security_cross_tests = (options) => {
             const fresh = await attempt(fixture, XFF_SEGREGATION_FRESH, 'probe_xff');
             assert.strictEqual(fresh.status, 401, "a fresh forwarded IP must not inherit another IP's limit");
         });
+        test('a malformed hop stops the walk: the request keys on the connection IP', async () => {
+            const fixture = await setup_test();
+            for (let i = 0; i < ip_limit; i++) {
+                await attempt(fixture, XFF_MALFORMED_HOP, 'probe_malformed_hop');
+            }
+            const exhausted = await attempt(fixture, XFF_MALFORMED_HOP, 'probe_malformed_hop');
+            assert.strictEqual(exhausted.status, 429, 'the exhausted forwarded IP must be rate-limited');
+            // The client-written entry sits left of the hop's malformed one. A walk
+            // that skipped the malformed entry would key on it again → 429; one
+            // that stops keys on the (loopback) connection IP → 401.
+            const stopped = await attempt(fixture, `${XFF_MALFORMED_HOP}, ${XFF_PORT_SUFFIXED_HOP}`, 'probe_malformed_hop');
+            assert.strictEqual(stopped.status, 401, 'the walk must stop at the malformed hop, not reach the entry left of it');
+            const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), SPINE_RPC_PATH, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
+            assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+            const listed = expect_output(await cross_rpc_call(fixture.transport, SPINE_RPC_PATH, 'audit_log_list', { event_type: 'login', outcome: 'failure' }, fixture.create_session_headers()), AuditLogListOutput);
+            const ips = listed.events.map((e) => e.ip);
+            assert.ok(ips.some((ip) => ip === '127.0.0.1' || ip === '::1'), `the stopped walk must key on the loopback connection IP: ${JSON.stringify(ips)}`);
+            assert.ok(!ips.includes(XFF_PORT_SUFFIXED_HOP), `a malformed entry is never a client IP: ${JSON.stringify(ips)}`);
+        });
         test('IPv6 clients share a bucket per /64, and the audit row keeps the full address', async () => {
             const fixture = await setup_test();
             for (let i = 0; i < ip_limit; i++) {

package/dist/testing/cross_backend/revocation_drivers.d.ts

@@ -0,0 +1,70 @@
+import '../assert_dev_env.js';
+import type { BackendCapabilities } from './capabilities.js';
+import type { TestAccountFixture, TestFixture } from './setup.js';
+/**
+ * POST a JSON body to a REST route on `account`'s session, asserting `200`.
+ *
+ * @param fixture - the per-test fixture whose fresh transport carries the request
+ * @param account - the account whose session cookie authenticates it
+ * @param path - the REST route path
+ * @param body - the JSON request body
+ */
+export declare const cross_post_as: (fixture: TestFixture, account: TestAccountFixture, path: string, body: unknown) => Promise<void>;
+/**
+ * Revoke every API token of `account_id` over the keeper's admin session
+ * (`admin_token_revoke_all`), asserting success.
+ *
+ * @param fixture - the per-test fixture; its keeper holds the admin role
+ * @param rpc_path - the RPC endpoint path
+ * @param account_id - the account whose tokens to revoke
+ */
+export declare const cross_admin_token_revoke_all: (fixture: TestFixture, rpc_path: string, account_id: string) => Promise<void>;
+/**
+ * Purge `account_id` over the keeper's daemon token (`account_purge`),
+ * asserting success. The request carries no `Origin`, as a daemon-token
+ * caller's wouldn't.
+ *
+ * @param fixture - the per-test fixture
+ * @param rpc_path - the RPC endpoint path
+ * @param account_id - the account to purge
+ */
+export declare const cross_account_purge: (fixture: TestFixture, rpc_path: string, account_id: string) => Promise<void>;
+/** One account-wide revocation, as a row both transport suites iterate. */
+export interface AccountRevocation {
+    /** Names the revocation in a case name and a failure message. */
+    readonly label: string;
+    /**
+     * Distinguishes the target account's username — unique in the table, and
+     * short enough that a suite's prefix keeps the username within `Username`.
+     */
+    readonly slug: string;
+    /** Whether the backend serves the revocation (beyond `rpc_path`, which every row needs). */
+    readonly gate: boolean;
+    /**
+     * Revoke `target`'s credentials and assert the revocation succeeded.
+     * `target` must have been created with `DEFAULT_TEST_PASSWORD`, which the
+     * password-change row presents.
+     */
+    readonly revoke: (fixture: TestFixture, target: TestAccountFixture) => Promise<void>;
+}
+/** Configuration for `create_account_revocations`. */
+export interface AccountRevocationsOptions {
+    /** Backend capability flags; `account_purge` gates on `account_lifecycle`. */
+    readonly capabilities: BackendCapabilities;
+    /** RPC endpoint path the admin and keeper revocations are sent to. */
+    readonly rpc_path: string;
+    /** REST logout route path. */
+    readonly logout_path: string;
+    /** REST password-change route path. */
+    readonly password_path: string;
+}
+/**
+ * The account-wide revocations that close every connection of the target
+ * account: `admin_token_revoke_all`, `POST /logout`, `POST /password`, and
+ * `account_purge` (gated on `capabilities.account_lifecycle`).
+ *
+ * @param options - the backend's capabilities and route paths
+ * @returns the revocation rows, in a stable order
+ */
+export declare const create_account_revocations: (options: AccountRevocationsOptions) => ReadonlyArray<AccountRevocation>;
+//# sourceMappingURL=revocation_drivers.d.ts.map

package/dist/testing/cross_backend/revocation_drivers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation_drivers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/revocation_drivers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACzB,SAAS,WAAW,EACpB,SAAS,kBAAkB,EAC3B,MAAM,MAAM,EACZ,MAAM,OAAO,KACX,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,WAAW,EACpB,UAAU,MAAM,EAChB,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CASd,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,SAAS,WAAW,EACpB,UAAU,MAAM,EAChB,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CASd,CAAC;AAEF,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,sDAAsD;AACtD,MAAM,WAAW,yBAAyB;IACzC,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8BAA8B;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,GACtC,SAAS,yBAAyB,KAChC,aAAa,CAAC,iBAAiB,CAiCjC,CAAC"}

package/dist/testing/cross_backend/revocation_drivers.js

@@ -0,0 +1,104 @@
+import '../assert_dev_env.js';
+/**
+ * The account-wide revocations the cross-process WS and SSE round-trip suites
+ * both close a live connection on — one table, so a revocation added here is
+ * covered on both transports.
+ *
+ * Each row drives one revocation of a target account's credentials and asserts
+ * it succeeded; the suite opens the target's connections first and asserts
+ * their close after. `describe_cross_process_ws_tests` and
+ * `describe_cross_process_sse_tests` iterate `create_account_revocations`. The
+ * revocations whose close is narrower than the account (one session, one
+ * token, a cap eviction) or that a suite drives differently (session
+ * revoke-all, account delete) stay in their suites.
+ *
+ * The drivers are exported on their own for a consumer suite that closes a
+ * transport of its own on the same revocations.
+ *
+ * @module
+ */
+import { assert } from 'vitest';
+import { account_purge_action_spec, admin_token_revoke_all_action_spec } from '../../auth/admin_action_specs.js';
+import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+import { cross_rpc_call } from './cell_cross_helpers.js';
+/**
+ * POST a JSON body to a REST route on `account`'s session, asserting `200`.
+ *
+ * @param fixture - the per-test fixture whose fresh transport carries the request
+ * @param account - the account whose session cookie authenticates it
+ * @param path - the REST route path
+ * @param body - the JSON request body
+ */
+export const cross_post_as = async (fixture, account, path, body) => {
+    const res = await fixture.fresh_transport()(path, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...account.create_session_headers() },
+        body: JSON.stringify(body)
+    });
+    assert.strictEqual(res.status, 200, `POST ${path}: ${await res.text()}`);
+};
+/**
+ * Revoke every API token of `account_id` over the keeper's admin session
+ * (`admin_token_revoke_all`), asserting success.
+ *
+ * @param fixture - the per-test fixture; its keeper holds the admin role
+ * @param rpc_path - the RPC endpoint path
+ * @param account_id - the account whose tokens to revoke
+ */
+export const cross_admin_token_revoke_all = async (fixture, rpc_path, account_id) => {
+    const res = await cross_rpc_call(fixture.transport, rpc_path, admin_token_revoke_all_action_spec.method, { account_id }, fixture.create_session_headers());
+    assert.ok(res.ok, `admin_token_revoke_all failed: ${JSON.stringify(res.error)}`);
+};
+/**
+ * Purge `account_id` over the keeper's daemon token (`account_purge`),
+ * asserting success. The request carries no `Origin`, as a daemon-token
+ * caller's wouldn't.
+ *
+ * @param fixture - the per-test fixture
+ * @param rpc_path - the RPC endpoint path
+ * @param account_id - the account to purge
+ */
+export const cross_account_purge = async (fixture, rpc_path, account_id) => {
+    const res = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, account_purge_action_spec.method, { account_id, confirm: true }, fixture.create_daemon_token_headers());
+    assert.ok(res.ok, `account_purge failed: ${JSON.stringify(res.error)}`);
+};
+/**
+ * The account-wide revocations that close every connection of the target
+ * account: `admin_token_revoke_all`, `POST /logout`, `POST /password`, and
+ * `account_purge` (gated on `capabilities.account_lifecycle`).
+ *
+ * @param options - the backend's capabilities and route paths
+ * @returns the revocation rows, in a stable order
+ */
+export const create_account_revocations = (options) => {
+    const { capabilities, rpc_path, logout_path, password_path } = options;
+    return [
+        {
+            label: 'admin_token_revoke_all',
+            slug: 'token_revoke_all',
+            gate: true,
+            revoke: (fixture, target) => cross_admin_token_revoke_all(fixture, rpc_path, target.account.id)
+        },
+        {
+            label: 'POST /logout',
+            slug: 'logout',
+            gate: true,
+            revoke: (fixture, target) => cross_post_as(fixture, target, logout_path, {})
+        },
+        {
+            label: 'POST /password',
+            slug: 'password',
+            gate: true,
+            revoke: (fixture, target) => cross_post_as(fixture, target, password_path, {
+                current_password: DEFAULT_TEST_PASSWORD,
+                new_password: 'revoked-new-password-456'
+            })
+        },
+        {
+            label: 'account_purge',
+            slug: 'purge',
+            gate: capabilities.account_lifecycle,
+            revoke: (fixture, target) => cross_account_purge(fixture, rpc_path, target.account.id)
+        }
+    ];
+};

package/dist/testing/cross_backend/sse_round_trip.d.ts

@@ -34,12 +34,17 @@ export interface CrossProcessSseTestOptions {
      * skips the case.
      */
     readonly max_per_scope?: number | null;
+    /** REST logout route path, for the logout close case. Default `/api/account/logout`. */
+    readonly logout_path?: string;
+    /** REST password-change route path, for its close case. Default `/api/account/password`. */
+    readonly password_path?: string;
 }
 /**
  * Register the cross-process SSE round-trip suite. Its cases run over a
  * real streaming `fetch`: connected-comment, audit data frame, account-wide
  * close-on-revoke, session-scoped close-on-revoke, close on account delete,
- * and the per-session cap.
+ * close on admin token revoke-all, logout, password change and purge, and the
+ * per-session cap.
  */
 export declare const describe_cross_process_sse_tests: (options: CrossProcessSseTestOptions) => void;
 //# sourceMappingURL=sse_round_trip.d.ts.map

package/dist/testing/cross_backend/sse_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8E9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,4DAA4D;AAC5D,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AA0BD;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA2PtF,CAAC"}
+{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkF9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,4DAA4D;AAC5D,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC;AA0BD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAyStF,CAAC"}

package/dist/testing/cross_backend/sse_round_trip.js

@@ -35,18 +35,21 @@ import '../assert_dev_env.js';
  *    `capabilities.account_lifecycle`) — the keeper soft-deletes a second
  *    admin whose stream is open; the delete revokes its credentials and
  *    closes its stream.
- * 6. **per-session cap** — one stream past `max_per_scope` on one session
+ * 6. **close on the other account-wide revocations** (gated on `rpc_path`;
+ *    purge also on `capabilities.account_lifecycle`) — `admin_token_revoke_all`,
+ *    `POST /logout`, `POST /password`, and `account_purge` of a second admin
+ *    each close its stream — the rows `create_account_revocations` shares with
+ *    the WS suite.
+ * 7. **per-session cap** — one stream past `max_per_scope` on one session
  *    closes the oldest (evict-oldest, no final frame) and leaves every other
  *    stream open. Needs no RPC: the cap runs inside the subscribe itself.
  *
- * The close-on-revoke matrix is layered: cases 3–5 exercise the account-wide
- * and session-scoped paths cross-process; the remaining revocation events
- * (`token_revoke_all` / `logout` / `password_change` / `account_purge`, all
- * account-wide; `token_revoke`, token-scoped; and `role_grant_revoke`,
- * role-matched) are covered by the spine's `fuz_realtime` SSE-registry unit
- * tests and the in-process guard self-test, so a cross-process
- * `token_revoke_all`-with-zero-tokens case (which may emit no audit row) stays
- * out to keep the spawned-backend suite non-flaky.
+ * The close-on-revoke matrix is layered: cases 3–6 exercise the account-wide
+ * and session-scoped paths cross-process; `token_revoke` (token-scoped — the
+ * stock stream admits sessions only, so its bearer close is covered on the
+ * WebSocket by `describe_cross_process_ws_tests`) and `role_grant_revoke`
+ * (role-matched) are covered by the spine's `fuz_realtime` SSE-registry unit
+ * tests and the in-process guard self-test.
  *
  * Gated on `capabilities.sse` — backends without an end-to-end SSE stream
  * skip (the cases still surface as `.skip` in the report). Cross-process
@@ -63,7 +66,9 @@ import { AUDIT_LOG_SSE_MAX_PER_SCOPE, audit_log_event_specs } from '../../realti
 import { SSE_CONNECTED_COMMENT } from '../../realtime/sse_constants.js';
 import { create_sse_transport } from '../transports/sse_transport.js';
 import { create_rpc_post_init } from '../rpc_helpers.js';
+import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
 import { test_if } from './capabilities.js';
+import { create_account_revocations } from './revocation_drivers.js';
 /** Default audit-log SSE stream path — the standard fuz_app `/api/admin/audit/stream`. */
 const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
 /**
@@ -85,10 +90,11 @@ const assert_audit_data_frame = (frame) => {
  * Register the cross-process SSE round-trip suite. Its cases run over a
  * real streaming `fetch`: connected-comment, audit data frame, account-wide
  * close-on-revoke, session-scoped close-on-revoke, close on account delete,
- * and the per-session cap.
+ * close on admin token revoke-all, logout, password change and purge, and the
+ * per-session cap.
  */
 export const describe_cross_process_sse_tests = (options) => {
-    const { setup_test, capabilities, base_url, rpc_path, origin } = options;
+    const { setup_test, capabilities, base_url, rpc_path, origin, logout_path = '/api/account/logout', password_path = '/api/account/password' } = options;
     const sse_path = options.sse_path ?? DEFAULT_SSE_PATH;
     const max_per_scope = options.max_per_scope === undefined ? AUDIT_LOG_SSE_MAX_PER_SCOPE : options.max_per_scope;
     describe('cross-process sse', () => {
@@ -166,11 +172,8 @@ export const describe_cross_process_sse_tests = (options) => {
         // TS registry's `close_by_identity(session_hash)`). The keeper holds
         // exactly one session, so revoking it by its blake3 hash drops the stream
         // opened under it. This is the close-on-revoke path the account-wide case
-        // above doesn't exercise; the remaining account-wide events
-        // (`token_revoke_all` / `logout` / `password_change` / `account_purge`)
-        // share the close the `session_revoke_all` and account-delete cases cover,
-        // and `token_revoke`'s token-scoped and `role_grant_revoke`'s role-matched
-        // closes are covered by `fuz_realtime`'s SSE registry unit tests.
+        // above doesn't exercise; `role_grant_revoke`'s role-matched close is
+        // covered by `fuz_realtime`'s SSE registry unit tests.
         test_if(capabilities.sse && rpc_path !== undefined, 'stream closes on a single session_revoke of the subscriber session', async () => {
             const fixture = await setup_test();
             const sse = await create_sse_transport({
@@ -223,6 +226,39 @@ export const describe_cross_process_sse_tests = (options) => {
                 await sse.close();
             }
         });
+        // The account-wide revocations past session revoke-all and delete
+        // (`revocation_drivers.ts`, shared with the WS suite) each close the
+        // target admin's stream. Without `rpc_path` the rows still register, as
+        // skipped cases, and never run — so the empty path is never sent.
+        const revocations = create_account_revocations({
+            capabilities,
+            rpc_path: rpc_path ?? '',
+            logout_path,
+            password_path
+        });
+        for (const { label, slug, gate, revoke } of revocations) {
+            test_if(capabilities.sse && gate && rpc_path !== undefined, `stream closes on ${label} of the subscriber account`, async () => {
+                const fixture = await setup_test();
+                const target = await fixture.create_account({
+                    username: `sse_revoke_${slug}`,
+                    password_value: DEFAULT_TEST_PASSWORD,
+                    roles: [ROLE_ADMIN]
+                });
+                const cookie = target.create_session_headers().cookie;
+                assert.ok(cookie, 'expected a session cookie for the target account');
+                const sse = await create_sse_transport({ base_url, sse_path, cookies: [cookie], origin });
+                try {
+                    const first = await sse.read_frame();
+                    assert.strictEqual(first + '\n\n', SSE_CONNECTED_COMMENT, 'first frame must be the connected comment');
+                    await revoke(fixture, target);
+                    const closed = await sse.wait_for_close(2000);
+                    assert.ok(closed, `stream did not close within 2s after ${label}`);
+                }
+                finally {
+                    await sse.close();
+                }
+            });
+        }
         // One stream past the cap on one session → the oldest closes, the newest
         // stays open. Opened in sequence, each awaited to its connect comment, so
         // the server registered them in order and "oldest" is stream 0 on both

package/dist/testing/cross_backend/token_scope_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2E9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA4HF,CAAC"}
+{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgF9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAqB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA+JF,CAAC"}

package/dist/testing/cross_backend/token_scope_surface.js

@@ -35,6 +35,11 @@ import '../assert_dev_env.js';
  *   `surface:audit_stream`'s own capability string is consequently unreachable
  *   on the default mount and has no cross-impl pin — each spine's census holds
  *   its declaration, the way the WS upgrade's is held.
+ * - **The account status read answers a narrowed token as anonymous** —
+ *   `GET /api/account/status` answers anonymous callers, so rule 3 there is the
+ *   anonymous answer (`401` plus the bootstrap flag), byte for byte, never the
+ *   account's email, its verification, or its role grants. A full-scope bearer
+ *   reading the account is the control.
  * - **Scope outranks role** — a narrowed token whose account *also* lacks the
  *   gating role must hear `token_scope_required`, not
  *   `insufficient_permissions`. This is the observable the TS↔Rust ordering
@@ -70,6 +75,8 @@ import { mint_narrowed_api_token } from './narrowed_api_token.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** Default audit-log SSE path — the `audit_stream` surface. */
 const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
+/** The account status read, which answers a narrowed token as anonymous. */
+const STATUS_PATH = '/api/account/status';
 /**
  * A well-formed hash that no fact has. The scope gate is a pre-authorization
  * guard, so it fires before the handler ever looks the hash up — but *params*
@@ -172,6 +179,32 @@ export const describe_token_scope_surface_cross_tests = (options) => {
             const body = (await res.json().catch(() => undefined));
             assert.notStrictEqual(body?.error, ERROR_TOKEN_SCOPE_REQUIRED, 'a full-authority bearer must not be refused on scope grounds');
         });
+        /**
+         * The status read answers anonymous callers, so a narrowed token is
+         * answered as one — byte for byte, status and body — rather than refused.
+         * The full-scope bearer of the same account reads the account, so the
+         * 401 is the scope, not the bearer.
+         */
+        test_if(capabilities.account_status, 'a narrowed token reads the account status as the anonymous caller', async () => {
+            const fixture = await setup_test();
+            const token = await mint_narrowed_api_token({
+                app: fixture.transport,
+                rpc_path,
+                session_headers: fixture.create_session_headers(),
+                methods: [ADMITTED_METHOD]
+            });
+            const anonymous = await fixture.fresh_transport({ origin: null })(STATUS_PATH, {});
+            const narrowed = await fixture.fresh_transport({ origin: null })(STATUS_PATH, {
+                headers: { authorization: `Bearer ${token}` }
+            });
+            assert.strictEqual(anonymous.status, 401, 'anonymous status must be 401');
+            assert.strictEqual(narrowed.status, 401, 'a narrowed token must read status as anonymous');
+            assert.strictEqual(await narrowed.text(), await anonymous.text(), 'the narrowed answer must be the anonymous one, byte for byte');
+            const full = await fixture.fresh_transport({ origin: null })(STATUS_PATH, {
+                headers: fixture.create_bearer_headers()
+            });
+            assert.strictEqual(full.status, 200, 'a full-scope bearer must read the account');
+        });
         /**
          * **Scope outranks role**, and this is the case that had no cross-impl
          * pin while the two spines disagreed about it.