@jskit-ai/auth-provider-local-core 0.1.8 → 0.1.10

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "kind": "runtime",
   "description": "Local auth provider with a file backend default and no database requirement.",
   "dependsOn": [
@@ -41,7 +41,7 @@ export default Object.freeze({
         },
         {
           "subpath": "./server/lib/index",
-          "summary": "Exports local auth service, file backend helpers, and password strategy helpers."
+          "summary": "Exports local auth service, file backend helpers, password strategy helpers, and local auth register hook decorators."
         }
       ],
       "containerTokens": {
@@ -57,8 +57,8 @@ export default Object.freeze({
   "mutations": {
     "dependencies": {
       "runtime": {
-        "@jskit-ai/auth-core": "0.1.107",
-        "@jskit-ai/kernel": "0.1.109",
+        "@jskit-ai/auth-core": "0.1.109",
+        "@jskit-ai/kernel": "0.1.111",
         "nodemailer": "^7.0.10",
         "dotenv": "^16.4.5"
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -11,8 +11,8 @@
     "./server/lib/index": "./src/server/lib/index.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.107",
-    "@jskit-ai/kernel": "0.1.109",
+    "@jskit-ai/auth-core": "0.1.109",
+    "@jskit-ai/kernel": "0.1.111",
     "nodemailer": "^7.0.10"
   }
 }

package/src/server/lib/index.js

@@ -1,3 +1,7 @@
 export { createLocalAuthService } from "./service.js";
 export { createLocalFileBackend } from "./fileBackend.js";
+export {
+  LOCAL_AUTH_USER_REGISTERED_EVENT,
+  createLocalAuthRegisterHookDecorator
+} from "./registerHookDecorator.js";
 export { hashPassword, normalizePasswordStrategy, verifyPassword } from "./passwords.js";

package/src/server/lib/passwords.js

@@ -42,7 +42,7 @@ async function verifyPassword(password, record) {
 }
 
 function normalizePasswordStrategy(strategy = null) {
-  if (!strategy) {
+  if (strategy == null) {
     return Object.freeze({
       hashPassword,
       verifyPassword
@@ -53,13 +53,12 @@ function normalizePasswordStrategy(strategy = null) {
     throw new TypeError("Local auth password strategy must be an object.");
   }
 
-  const normalized = strategy;
-  const strategyHashPassword = typeof normalized.hashPassword === "undefined"
+  const strategyHashPassword = typeof strategy.hashPassword === "undefined"
     ? hashPassword
-    : normalized.hashPassword;
-  const strategyVerifyPassword = typeof normalized.verifyPassword === "undefined"
+    : strategy.hashPassword;
+  const strategyVerifyPassword = typeof strategy.verifyPassword === "undefined"
     ? verifyPassword
-    : normalized.verifyPassword;
+    : strategy.verifyPassword;
 
   if (typeof strategyHashPassword !== "function") {
     throw new TypeError("Local auth password strategy hashPassword must be a function.");

package/src/server/lib/registerHookDecorator.js

@@ -0,0 +1,96 @@
+const LOCAL_AUTH_USER_REGISTERED_EVENT = "auth.local.user.registered";
+
+function assertBlockingMode(hook) {
+  if (typeof hook?.blocking !== "boolean") {
+    throw new TypeError("Local auth register hooks must set blocking to true or false.");
+  }
+}
+
+function normalizeRegisterHook(hook = null) {
+  if (!hook || typeof hook !== "object" || Array.isArray(hook)) {
+    return null;
+  }
+  assertBlockingMode(hook);
+  if (typeof hook.handle !== "function") {
+    throw new TypeError("Local auth register hook handle must be a function.");
+  }
+  return Object.freeze({
+    hookId: String(hook.hookId || "anonymous"),
+    blocking: hook.blocking,
+    handle: hook.handle
+  });
+}
+
+function logNonBlockingHookFailure({ logger, hook, error } = {}) {
+  const payload = {
+    err: error,
+    hook: hook?.hookId || "anonymous",
+    event: LOCAL_AUTH_USER_REGISTERED_EVENT
+  };
+  if (logger && typeof logger.warn === "function") {
+    logger.warn(payload, "Non-blocking local auth register hook failed.");
+    return;
+  }
+  console.warn("Non-blocking local auth register hook failed.", payload);
+}
+
+async function runRegisterHook({ hook, result, logger }) {
+  if (!hook) {
+    return;
+  }
+
+  const payload = Object.freeze({
+    event: LOCAL_AUTH_USER_REGISTERED_EVENT,
+    actor: result?.actor || null,
+    profile: result?.profile || null,
+    authResult: result
+  });
+
+  if (hook.blocking) {
+    await hook.handle(payload);
+    return;
+  }
+
+  Promise.resolve()
+    .then(() => hook.handle(payload))
+    .catch((error) => logNonBlockingHookFailure({ logger, hook, error }));
+}
+
+function createLocalAuthRegisterHookDecorator({
+  decoratorId = "auth.local.registerHook",
+  order = 0,
+  logger = null,
+  hook = null
+} = {}) {
+  const registerHook = normalizeRegisterHook(hook);
+
+  if (!registerHook) {
+    throw new TypeError("createLocalAuthRegisterHookDecorator requires a hook object.");
+  }
+
+  return Object.freeze({
+    decoratorId: String(decoratorId || registerHook.hookId || "auth.local.registerHook"),
+    order: Number.isFinite(order) ? Number(order) : 0,
+    decorateAuthService(authService) {
+      if (!authService || typeof authService.register !== "function") {
+        return authService;
+      }
+
+      return Object.freeze(
+        Object.defineProperty(Object.create(authService), "register", {
+          enumerable: true,
+          value: async function register(input = {}) {
+            const result = await authService.register(input);
+            await runRegisterHook({ hook: registerHook, result, logger });
+            return result;
+          }
+        })
+      );
+    }
+  });
+}
+
+export {
+  LOCAL_AUTH_USER_REGISTERED_EVENT,
+  createLocalAuthRegisterHookDecorator
+};

package/src/server/providers/AuthLocalServiceProvider.js

@@ -1,3 +1,4 @@
+import { applyAuthServiceDecorators } from "@jskit-ai/auth-core/server/authServiceDecoratorRegistry";
 import fs from "node:fs";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
@@ -6,6 +7,11 @@ import { createLocalFileBackend } from "../lib/fileBackend.js";
 
 const DEFAULT_STORE_DIR = ".jskit/auth";
 
+function resolveLocalBackendMode(scope) {
+  const env = resolveRuntimeEnv(scope);
+  return String(env.AUTH_LOCAL_BACKEND || "file").trim().toLowerCase() || "file";
+}
+
 function parseBoolean(value, fallback = false) {
   const raw = String(value || "").trim().toLowerCase();
   if (!raw) {
@@ -157,12 +163,9 @@ class AuthLocalServiceProvider {
       throw new Error("AuthLocalServiceProvider cannot register authService because another auth provider already registered it.");
     }
 
-    if (!app.has("auth.local.backend")) {
+    if (!app.has("auth.local.backend") && resolveLocalBackendMode(app) === "file") {
       app.singleton("auth.local.backend", (scope) => {
         const config = resolveConfig(scope);
-        if (config.backend !== "file") {
-          throw new Error(`AUTH_LOCAL_BACKEND="${config.backend}" requires a custom auth.local.backend provider.`);
-        }
         return createLocalFileBackend({
           storeDir: config.storeDir
         });
@@ -171,6 +174,9 @@ class AuthLocalServiceProvider {
 
     app.singleton("authService", (scope) => {
       const config = resolveConfig(scope);
+      if (!scope.has("auth.local.backend")) {
+        throw new Error(`AUTH_LOCAL_BACKEND="${config.backend}" requires a package or app provider that registers auth.local.backend.`);
+      }
       const backend = scope.make("auth.local.backend");
       const profileProjector = scope.has("auth.profile.projector")
         ? {
@@ -200,13 +206,14 @@ class AuthLocalServiceProvider {
       const passwordStrategy = scope.has("auth.local.passwordStrategy")
         ? scope.make("auth.local.passwordStrategy")
         : null;
-      return createLocalAuthService({
+      const authService = createLocalAuthService({
         backend,
         config,
         profileProjector,
         passwordStrategy,
         invitationContextResolver
       });
+      return applyAuthServiceDecorators(scope, authService);
     });
   }
 
@@ -218,4 +225,4 @@ class AuthLocalServiceProvider {
   }
 }
 
-export { AuthLocalServiceProvider };
+export { AuthLocalServiceProvider, resolveLocalBackendMode };

package/test/providerRuntime.test.js

@@ -5,10 +5,12 @@ import path from "node:path";
 import test from "node:test";
 import { createApplication } from "@jskit-ai/kernel/_testable";
 import { ActionRuntimeServiceProvider } from "@jskit-ai/kernel/server/actions";
+import { registerAuthServiceDecorator } from "@jskit-ai/auth-core/server/authServiceDecoratorRegistry";
 import { AuthActionsServiceProvider } from "@jskit-ai/auth-core/server/providers/AuthActionsServiceProvider";
 import { AuthLocalServiceProvider } from "../src/server/providers/AuthLocalServiceProvider.js";
 import { AuthProviderServiceProvider } from "../src/server/providers/AuthProviderServiceProvider.js";
 import {
+  createLocalAuthRegisterHookDecorator,
   createLocalAuthService,
   createLocalFileBackend,
   hashPassword,
@@ -54,7 +56,9 @@ async function createStartedApp({
   profileProjector = null,
   profileProjectorFactory = null,
   passwordStrategy = null,
-  invitationContextResolver = null
+  invitationContextResolver = null,
+  logger = null,
+  configureApp = null
 } = {}) {
   const storeDir = await fs.mkdtemp(path.join(os.tmpdir(), "jskit-auth-local-"));
   const app = createApplication();
@@ -66,12 +70,15 @@ async function createStartedApp({
     APP_PUBLIC_URL: "http://localhost:5173",
     NODE_ENV: "test"
   });
-  app.instance("jskit.logger", {
-    info() {},
-    warn() {},
-    error() {},
-    debug() {}
-  });
+  app.instance(
+    "jskit.logger",
+    logger || {
+      info() {},
+      warn() {},
+      error() {},
+      debug() {}
+    }
+  );
   app.instance("domainEvents", {
     async publish() {}
   });
@@ -87,6 +94,9 @@ async function createStartedApp({
   if (invitationContextResolver) {
     app.instance("auth.invitationContextResolver", invitationContextResolver);
   }
+  if (typeof configureApp === "function") {
+    configureApp(app);
+  }
   await app.start({
     providers: [
       ActionRuntimeServiceProvider,
@@ -152,6 +162,102 @@ test("local auth provider registers, logs in, reads session, and logs out with f
   assert.match(usersFile, /^user:v1:/);
 });
 
+test("local auth provider applies auth service decorators for blocking and non-blocking hooks", async () => {
+  const calls = [];
+  const errors = [];
+  const { app } = await createStartedApp({
+    logger: {
+      info() {},
+      warn(payload, message) {
+        errors.push({ payload, message });
+      },
+      error() {},
+      debug() {}
+    },
+    configureApp(app) {
+      registerAuthServiceDecorator(app, "test.auth.local.nonBlockingHook", (scope) => ({
+        ...createLocalAuthRegisterHookDecorator({
+          decoratorId: "test.auth.local.nonBlockingHook",
+          order: 20,
+          logger: scope.make("jskit.logger"),
+          hook: {
+            hookId: "audit",
+            blocking: false,
+            async handle({ actor }) {
+              calls.push({ hook: "audit", email: actor.email });
+              throw new Error("audit unavailable");
+            }
+          }
+        })
+      }));
+      registerAuthServiceDecorator(app, "test.auth.local.blockingHook", () =>
+        createLocalAuthRegisterHookDecorator({
+          decoratorId: "test.auth.local.blockingHook",
+          order: 10,
+          hook: {
+            hookId: "permissions",
+            blocking: true,
+            async handle({ actor, profile }) {
+              calls.push({ hook: "permissions", email: actor.email });
+              if (profile?.displayName === "Block Permissions") {
+                throw new Error("permission provisioning failed");
+              }
+            }
+          }
+        })
+      );
+    }
+  });
+  const authService = app.make("authService");
+
+  const registered = await authService.register({
+    email: "hooks@example.com",
+    password: "correct horse battery staple",
+    displayName: "Hooks"
+  });
+  assert.equal(registered.actor.email, "hooks@example.com");
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.deepEqual(calls, [
+    { hook: "permissions", email: "hooks@example.com" },
+    { hook: "audit", email: "hooks@example.com" }
+  ]);
+  assert.equal(errors.length, 1);
+  assert.equal(errors[0].message, "Non-blocking local auth register hook failed.");
+
+  await assert.rejects(
+    () =>
+      authService.register({
+        email: "blocked-hooks@example.com",
+        password: "correct horse battery staple",
+        displayName: "Block Permissions"
+      }),
+    /permission provisioning failed/
+  );
+});
+
+test("local auth register hook decorators require explicit blocking mode", () => {
+  assert.throws(
+    () =>
+      createLocalAuthRegisterHookDecorator({
+        hook: {
+          hookId: "invalid",
+          async handle() {}
+        }
+      }),
+    /blocking to true or false/
+  );
+  assert.throws(
+    () =>
+      createLocalAuthRegisterHookDecorator({
+        hook: {
+          hookId: "invalid",
+          blocking: false
+        }
+      }),
+    /handle must be a function/
+  );
+});
+
 test("local auth provider resolves a custom password strategy from the container", async () => {
   const passwordStrategy = {
     prefix: "strategy",
@@ -196,10 +302,26 @@ test("local auth password strategy supports partial overrides and rejects invali
   assert.equal(await verifyPassword("new password value", defaultHashed), true);
   assert.equal(await strategy.verifyPassword("old password value", "legacy:users:old password value"), true);
 
+  const hashOnlyStrategy = normalizePasswordStrategy({
+    async hashPassword(password) {
+      return hashPassword(password);
+    }
+  });
+  const hashOnlyRecord = await hashOnlyStrategy.hashPassword("hash only password");
+  assert.equal(await hashOnlyStrategy.verifyPassword("hash only password", hashOnlyRecord), true);
+
   assert.throws(
     () => normalizePasswordStrategy("invalid"),
     /Local auth password strategy must be an object/
   );
+  assert.throws(
+    () => normalizePasswordStrategy(false),
+    /Local auth password strategy must be an object/
+  );
+  assert.throws(
+    () => normalizePasswordStrategy(0),
+    /Local auth password strategy must be an object/
+  );
   assert.throws(
     () => normalizePasswordStrategy([]),
     /Local auth password strategy must be an object/
@@ -222,165 +344,280 @@ test("local auth login verifies password and creates session in one backend tran
   const password = await hashPassword("current password value");
   let transactions = 0;
   let sessionCreated = false;
-  const backend = {
+  const backend = createLocalFileBackend({
+    storeDir: await fs.mkdtemp(path.join(os.tmpdir(), "jskit-auth-login-tx-"))
+  });
+  await backend.withTransaction((tx) =>
+    tx.users.create({
+      id: "usr_login_tx",
+      email: "tx@example.com",
+      displayName: "Transaction User",
+      password
+    })
+  );
+  const wrappedBackend = {
     async withTransaction(callback) {
       transactions += 1;
-      const tx = {
-        users: {
-          async findByEmail(email) {
-            assert.equal(email, "race@example.com");
-            return {
-              id: "usr_race",
-              email,
-              displayName: "Race User",
-              password,
-              disabled: false
-            };
-          }
-        },
-        sessions: {
-          async create(input) {
-            sessionCreated = true;
-            return {
-              ...input,
-              createdAt: new Date().toISOString(),
-              revokedAt: ""
-            };
+      return backend.withTransaction(async (tx) => {
+        const result = await callback({
+          ...tx,
+          sessions: {
+            ...tx.sessions,
+            async create(input) {
+              sessionCreated = true;
+              return tx.sessions.create(input);
+            }
           }
-        }
-      };
-      return callback(tx);
+        });
+        return result;
+      });
     }
   };
   const authService = createLocalAuthService({
-    backend,
+    backend: wrappedBackend,
     config: {
-      nodeEnv: "test",
       sessionSecret: "test-secret",
-      appPublicUrl: "http://localhost:5173",
+      nodeEnv: "test",
       smtpConfigured: false,
-      recoveryDevOutput: "disabled"
+      recoveryDevOutput: "response",
+      appPublicUrl: "http://localhost:5173"
     }
   });
 
   const result = await authService.login({
-    email: "race@example.com",
+    email: "tx@example.com",
     password: "current password value"
   });
 
-  assert.equal(result.actor.email, "race@example.com");
-  assert.equal(Boolean(result.session?.access_token), true);
-  assert.equal(sessionCreated, true);
+  assert.equal(result.actor.email, "tx@example.com");
   assert.equal(transactions, 1);
+  assert.equal(sessionCreated, true);
 });
 
 test("local auth service accepts a custom strategy for legacy stored password records", async () => {
-  const usersByEmail = new Map([
-    [
-      "legacy@example.com",
-      {
-        id: "usr_legacy",
-        email: "legacy@example.com",
-        displayName: "Legacy User",
-        password: {
-          algorithm: "legacy-bcrypt",
-          hash: "legacy password value"
-        },
-        disabled: false
-      }
-    ]
-  ]);
+  const passwordRecords = [];
   const sessions = [];
-  const backend = {
-    async withTransaction(callback) {
-      const tx = {
-        users: {
-          async findByEmail(email) {
-            return usersByEmail.get(email) || null;
+  const authService = createLocalAuthService({
+    backend: {
+      async withTransaction(callback) {
+        return callback({
+          users: {
+            async findByEmail(email) {
+              if (email !== "legacy@example.com") {
+                return null;
+              }
+              return {
+                id: "usr_legacy",
+                email,
+                displayName: "Legacy User",
+                password: "legacy:legacy@example.com:old-password",
+                disabled: false
+              };
+            },
+            async findById(userId) {
+              if (userId !== "usr_legacy") {
+                return null;
+              }
+              return {
+                id: "usr_legacy",
+                email: "legacy@example.com",
+                displayName: "Legacy User",
+                password: passwordRecords.at(-1) || "legacy:legacy@example.com:old-password",
+                disabled: false
+              };
+            },
+            async create(input) {
+              passwordRecords.push(input.password);
+              return input;
+            },
+            async updatePassword(_userId, password) {
+              passwordRecords.push(password);
+              return {
+                id: "usr_legacy",
+                email: "legacy@example.com",
+                displayName: "Legacy User",
+                password,
+                disabled: false
+              };
+            },
+            async updateProfile() {
+              throw new Error("not needed");
+            }
           },
-          async create(input) {
-            const user = {
-              ...input,
-              disabled: false
-            };
-            usersByEmail.set(user.email, user);
-            return user;
-          }
-        },
-        sessions: {
-          async create(input) {
-            const session = {
-              ...input,
-              createdAt: new Date().toISOString(),
-              revokedAt: ""
-            };
-            sessions.push(session);
-            return session;
+          sessions: {
+            async create(input) {
+              sessions.push(input);
+              return {
+                ...input,
+                createdAt: new Date().toISOString(),
+                revokedAt: ""
+              };
+            },
+            async findById() {
+              return null;
+            },
+            async findByTokenHash() {
+              return null;
+            },
+            async revoke() {
+              return null;
+            },
+            async revokeForUser() {
+              return 0;
+            }
+          },
+          recovery: {
+            async create() {},
+            async findByTokenHash() {
+              return null;
+            },
+            async consume() {
+              return null;
+            },
+            async consumeForUser() {
+              return 0;
+            }
           }
-        }
-      };
-      return callback(tx);
+        });
+      }
+    },
+    config: {
+      sessionSecret: "test-secret",
+      nodeEnv: "test",
+      smtpConfigured: false,
+      recoveryDevOutput: "response",
+      appPublicUrl: "http://localhost:5173"
+    },
+    passwordStrategy: {
+      async verifyPassword(password, record) {
+        return record === `legacy:legacy@example.com:${password}`;
+      }
     }
-  };
+  });
+
+  const legacyLogin = await authService.login({
+    email: "legacy@example.com",
+    password: "old-password"
+  });
+  assert.equal(legacyLogin.actor.providerUserId, "usr_legacy");
+  assert.equal(sessions.length, 1);
+
+  await authService.register({
+    email: "new@example.com",
+    password: "new-password",
+    displayName: "New User"
+  });
+  assert.equal(passwordRecords.length, 1);
+  assert.equal(passwordRecords[0].algorithm, "scrypt");
+  assert.equal(sessions.length, 2);
+});
+
+test("local auth password strategy handles register, reset, login, and change password paths", async () => {
+  const hashCalls = [];
+  const verifyCalls = [];
+  const encodePassword = (password) => Buffer.from(String(password), "utf8").toString("base64url");
   const passwordStrategy = {
     async hashPassword(password) {
+      hashCalls.push(password);
       return {
-        algorithm: "test-scrypt",
+        algorithm: "strategy-password",
         version: "v1",
-        salt: "test",
-        hash: `hashed-${password}`
+        salt: "",
+        hash: encodePassword(password)
       };
     },
     async verifyPassword(password, record) {
-      if (record?.algorithm === "legacy-bcrypt") {
-        return record.hash === password;
-      }
-      return record?.algorithm === "test-scrypt" && record.hash === `hashed-${password}`;
+      verifyCalls.push({
+        password,
+        hash: record?.hash || ""
+      });
+      return (
+        record?.algorithm === "strategy-password" &&
+        record.hash === encodePassword(password)
+      );
     }
   };
-  const authService = createLocalAuthService({
-    backend,
-    passwordStrategy,
-    config: {
-      nodeEnv: "test",
-      sessionSecret: "test-secret",
-      appPublicUrl: "http://localhost:5173",
-      smtpConfigured: false,
-      recoveryDevOutput: "disabled"
-    }
+  const { app } = await createStartedApp({ passwordStrategy });
+  const authService = app.make("authService");
+
+  await authService.register({
+    email: "strategy-paths@example.com",
+    password: "original password value",
+    displayName: "Strategy Paths"
+  });
+  await authService.login({
+    email: "strategy-paths@example.com",
+    password: "original password value"
   });
 
-  const legacyLogin = await authService.login({
-    email: "legacy@example.com",
-    password: "legacy password value"
+  const resetRequest = await authService.requestPasswordReset({
+    email: "strategy-paths@example.com"
   });
-  assert.equal(legacyLogin.actor.email, "legacy@example.com");
+  const recoveryToken = new URL(resetRequest.recoveryUrl).searchParams.get("token");
+  const recovery = await authService.completePasswordRecovery({
+    code: recoveryToken,
+    type: "recovery"
+  });
+  const recoveryReply = createReplyFixture();
+  authService.writeSessionCookies(recoveryReply, recovery.session);
+  await authService.resetPassword(
+    {
+      cookies: recoveryReply.cookies
+    },
+    {
+      password: "reset password value"
+    }
+  );
 
-  await authService.register({
-    email: "new-strategy@example.com",
-    password: "new password value",
-    displayName: "New Strategy"
+  const resetLogin = await authService.login({
+    email: "strategy-paths@example.com",
+    password: "reset password value"
   });
-  assert.deepEqual(usersByEmail.get("new-strategy@example.com").password, {
-    algorithm: "test-scrypt",
-    version: "v1",
-    salt: "test",
-    hash: "hashed-new password value"
+  const normalReply = createReplyFixture();
+  authService.writeSessionCookies(normalReply, resetLogin.session);
+  await authService.changePassword(
+    {
+      cookies: normalReply.cookies
+    },
+    {
+      currentPassword: "reset password value",
+      newPassword: "changed password value"
+    }
+  );
+  await authService.login({
+    email: "strategy-paths@example.com",
+    password: "changed password value"
   });
-  assert.equal(sessions.length, 2);
+
+  assert.deepEqual(hashCalls, [
+    "original password value",
+    "reset password value",
+    "changed password value"
+  ]);
+  assert.deepEqual(verifyCalls.map((call) => call.password), [
+    "original password value",
+    "reset password value",
+    "reset password value",
+    "changed password value"
+  ]);
 });
 
 test("local auth provider completes recovery through a recovery-scoped session", async () => {
   const { app } = await createStartedApp();
   const authService = app.make("authService");
-  const registered = await authService.register({
-    email: "grace@example.com",
-    password: "old password value",
-    displayName: "Grace"
+  await authService.register({
+    email: "Recovery@example.com",
+    password: "correct horse battery staple",
+    displayName: "Recovery User"
   });
-  const normalReply = createReplyFixture();
-  authService.writeSessionCookies(normalReply, registered.session);
 
+  const normalReply = createReplyFixture();
+  const normalLogin = await authService.login({
+    email: "recovery@example.com",
+    password: "correct horse battery staple"
+  });
+  authService.writeSessionCookies(normalReply, normalLogin.session);
+  normalReply.cookies.jskit_local_recovery_token = normalReply.cookies.jskit_local_access_token;
   await assert.rejects(
     () =>
       authService.resetPassword(
@@ -388,28 +625,27 @@ test("local auth provider completes recovery through a recovery-scoped session",
           cookies: normalReply.cookies
         },
         {
-          password: "bypassed password value"
+          password: "not allowed value"
         }
       ),
-    /Authentication required/
+    /Recovery session required/
   );
 
   const resetRequest = await authService.requestPasswordReset({
-    email: "grace@example.com"
+    email: "recovery@example.com"
   });
-  assert.equal(resetRequest.ok, true);
-  assert.match(resetRequest.recoveryUrl, /\/auth\/reset-password\?token=/);
-  const recoveryToken = new URL(resetRequest.recoveryUrl).searchParams.get("token");
-
+  assert.match(resetRequest.recoveryUrl, /^http:\/\/localhost:5173\/auth\/reset-password\?/);
+  const token = new URL(resetRequest.recoveryUrl).searchParams.get("token");
   const recovery = await authService.completePasswordRecovery({
-    code: recoveryToken,
+    code: token,
     type: "recovery"
   });
+  assert.equal(recovery.actor.email, "recovery@example.com");
+
   const reply = createReplyFixture();
   authService.writeSessionCookies(reply, recovery.session);
   assert.equal(Boolean(reply.cookies.jskit_local_recovery_token), true);
-  assert.equal(reply.cookieOptions.jskit_local_recovery_token.maxAge, 15 * 60);
-  assert.equal(reply.cookieOptions.jskit_local_refresh_token.maxAge, 15 * 60);
+  assert.equal(Boolean(reply.cookies.jskit_local_refresh_token), true);
 
   const generalSession = await authService.authenticateRequest({ cookies: reply.cookies });
   assert.equal(generalSession.authenticated, false);
@@ -420,39 +656,39 @@ test("local auth provider completes recovery through a recovery-scoped session",
       cookies: reply.cookies
     },
     {
-      password: "new password value"
+      password: "updated password value"
     }
   );
 
   await assert.rejects(
     () =>
       authService.login({
-        email: "grace@example.com",
-        password: "old password value"
+        email: "recovery@example.com",
+        password: "correct horse battery staple"
       }),
     /Invalid email or password/
   );
   const login = await authService.login({
-    email: "grace@example.com",
-    password: "new password value"
+    email: "recovery@example.com",
+    password: "updated password value"
   });
-  assert.equal(login.actor.email, "grace@example.com");
+  assert.equal(login.actor.email, "recovery@example.com");
 });
 
 test("local auth reset invalidates other outstanding recovery tokens for the user", async () => {
   const { app } = await createStartedApp();
   const authService = app.make("authService");
   await authService.register({
-    email: "multi-reset@example.com",
-    password: "old password value",
-    displayName: "Multi Reset"
+    email: "recovery-tokens@example.com",
+    password: "correct horse battery staple",
+    displayName: "Recovery Tokens"
   });
 
   const firstResetRequest = await authService.requestPasswordReset({
-    email: "multi-reset@example.com"
+    email: "recovery-tokens@example.com"
   });
   const secondResetRequest = await authService.requestPasswordReset({
-    email: "multi-reset@example.com"
+    email: "recovery-tokens@example.com"
   });
   const firstToken = new URL(firstResetRequest.recoveryUrl).searchParams.get("token");
   const secondToken = new URL(secondResetRequest.recoveryUrl).searchParams.get("token");
@@ -463,13 +699,12 @@ test("local auth reset invalidates other outstanding recovery tokens for the use
   });
   const reply = createReplyFixture();
   authService.writeSessionCookies(reply, recovery.session);
-
   await authService.resetPassword(
     {
       cookies: reply.cookies
     },
     {
-      password: "new password value"
+      password: "updated password value"
     }
   );
 
@@ -487,9 +722,9 @@ test("local auth provider changes password through the account-security contract
   const { app } = await createStartedApp();
   const authService = app.make("authService");
   const registered = await authService.register({
-    email: "lin@example.com",
-    password: "old password value",
-    displayName: "Lin"
+    email: "Security@example.com",
+    password: "correct horse battery staple",
+    displayName: "Security User"
   });
   const reply = createReplyFixture();
   authService.writeSessionCookies(reply, registered.session);
@@ -497,74 +732,69 @@ test("local auth provider changes password through the account-security contract
   await assert.rejects(
     () =>
       authService.changePassword(
-        { cookies: reply.cookies },
         {
-          currentPassword: "wrong password",
-          newPassword: "new password value"
+          cookies: reply.cookies
+        },
+        {
+          currentPassword: "wrong password value",
+          newPassword: "updated password value"
         }
       ),
     /Current password is invalid/
   );
 
   await authService.changePassword(
-    { cookies: reply.cookies },
     {
-      currentPassword: "old password value",
-      newPassword: "new password value"
+      cookies: reply.cookies
+    },
+    {
+      currentPassword: "correct horse battery staple",
+      newPassword: "updated password value"
     }
   );
 
   await assert.rejects(
     () =>
       authService.login({
-        email: "lin@example.com",
-        password: "old password value"
+        email: "security@example.com",
+        password: "correct horse battery staple"
       }),
     /Invalid email or password/
   );
   const login = await authService.login({
-    email: "lin@example.com",
-    password: "new password value"
+    email: "security@example.com",
+    password: "updated password value"
   });
-  assert.equal(login.actor.email, "lin@example.com");
+  assert.equal(login.actor.email, "security@example.com");
 });
 
 test("local auth provider defers profile projector resolution until projection is needed", async () => {
-  let projectorResolved = 0;
-  let projectionCalls = 0;
+  let projectorFactoryCalls = 0;
   const { app } = await createStartedApp({
-    profileProjectorFactory: () => {
-      projectorResolved += 1;
+    profileProjectorFactory() {
+      projectorFactoryCalls += 1;
       return {
         async syncIdentityProfile(profile) {
-          projectionCalls += 1;
           return {
             ...profile,
-            id: "app-profile-id",
+            id: "projected-user",
             profileSource: "users"
           };
         }
       };
     }
   });
-
-  assert.equal(projectorResolved, 0);
-
+  assert.equal(projectorFactoryCalls, 0);
   const authService = app.make("authService");
-  assert.equal(authService.getCapabilities().features.appProfileProjection, true);
-  assert.equal(projectorResolved, 0);
-
+  assert.equal(projectorFactoryCalls, 0);
   const registered = await authService.register({
-    email: "projector@example.com",
-    password: "projector password value",
-    displayName: "Projector User"
+    email: "projected@example.com",
+    password: "correct horse battery staple",
+    displayName: "Projected User"
   });
-
-  assert.equal(projectorResolved, 1);
-  assert.equal(projectionCalls, 1);
-  assert.equal(registered.actor.appUserId, "app-profile-id");
+  assert.equal(projectorFactoryCalls, 1);
+  assert.equal(registered.actor.appUserId, "projected-user");
 });
-
 test("local auth provider projects app profile when auth.profile.projector is installed", async () => {
   const projectedProfiles = [];
   const { app } = await createStartedApp({