@learncard/lca-api-service 1.6.2 → 1.7.0

package/test/keys-escrow.spec.ts

@@ -173,7 +173,8 @@ describe('authority enrollment persistence', () => {
         delete process.env.ESCROW_ENCLAVE_REMOTE_TOKEN;
         __setEscrowEnclaveForTests(undefined);
     });
-    const setup = async () => {
+    /** `enclave`: the label the fake enclave signs; `intent`: the client's intent tenant. */
+    const setup = async ({ enclave = 'learncard', intent = 'learncard' } = {}) => {
         const software = getEscrowEnclave();
         const attestation = await software.getAttestation();
         const persisted = await encryptEscrowBlob(
@@ -207,7 +208,7 @@ describe('authority enrollment persistence', () => {
                 nonce: string;
             }): Promise<AuthorityStateResponse> => ({
                 state: {
-                    tenant: 'learncard',
+                    tenant: enclave,
                     authorityGeneration: 'fresh-g1',
                     did: input.expectedDid,
                     status: 'empty',
@@ -238,7 +239,7 @@ describe('authority enrollment persistence', () => {
         const signedIntent = await signEscrowEnrollmentIntent(
             {
                 version: 2,
-                tenant: 'learncard',
+                tenant: intent,
                 did,
                 authorityGeneration: 'fresh-g1',
                 expectedEnrollmentVersion: 0,
@@ -409,6 +410,112 @@ describe('authority enrollment persistence', () => {
         expect((await record())?.escrowBlob?.envelope).toEqual(envelope);
         expect(apply).toHaveBeenCalledTimes(1);
     });
+    describe('authority tenant decoupled from the app tenant (VetPass on the learncard enclave)', () => {
+        const vetpassOwner = () =>
+            appRouter.createCaller({
+                domain: 'localhost%3A3000',
+                tenant: { id: 'vetpass', emailBranding: {}, resolvedVia: 'header' as const },
+                user: { did, isChallengeValid: true, authorizedDid: false },
+            });
+        afterEach(() => {
+            delete process.env.ESCROW_AUTHORITY_TENANT;
+        });
+
+        it('serves learncard authority state and applies learncard intents for X-Tenant-Id vetpass', async () => {
+            const { input, apply, persisted } = await setup();
+            const nonce = 'cd'.repeat(32);
+            await expect(
+                vetpassOwner().escrow.getAuthorityState({ ...auth, nonce })
+            ).resolves.toMatchObject({ state: { tenant: 'learncard' } });
+            await expect(vetpassOwner().escrow.enroll(input)).resolves.toMatchObject({
+                success: true,
+            });
+            expect(apply).toHaveBeenCalledTimes(1);
+            const signedIntent = await signEscrowEnrollmentIntent(
+                {
+                    ...input.signedIntent.intent,
+                    expectedEnrollmentVersion: 1,
+                    action: 'disable',
+                    sourceBlobIdentity: await getEscrowBlobIdentity(persisted),
+                    targetBlobIdentity: null,
+                    allowRewrap: false,
+                    requestId: randomUUID(),
+                    recoveryEmail: null,
+                    recoveryLanguage: null,
+                },
+                pk
+            );
+            apply.mockResolvedValueOnce({
+                envelope: null,
+                receipt,
+                authorityGeneration: 'fresh-g1',
+                enrollmentVersion: 2,
+                enrollmentEpoch: 1,
+            });
+            await expect(
+                vetpassOwner().escrow.disable({
+                    ...auth,
+                    optOut: false,
+                    signedIntent,
+                    sourceEnvelope: persisted,
+                })
+            ).resolves.toMatchObject({ receipt });
+            expect(apply).toHaveBeenCalledTimes(2);
+        });
+
+        it('rejects an app-tenant (vetpass) intent before reaching the enclave', async () => {
+            const { input, apply } = await setup({ intent: 'vetpass' });
+            await expect(vetpassOwner().escrow.enroll(input)).rejects.toMatchObject({
+                code: 'BAD_REQUEST',
+            });
+            await expect(owner().escrow.enroll(input)).rejects.toMatchObject({
+                code: 'BAD_REQUEST',
+            });
+            expect(apply).not.toHaveBeenCalled();
+            expect((await record())?.escrowBlob).toBeUndefined();
+        });
+
+        it('fails closed when the enclave signs a different authority tenant than configured', async () => {
+            const { input, apply } = await setup({ enclave: 'scouts' });
+            for (const caller of [owner, vetpassOwner]) {
+                await expect(
+                    caller().escrow.getAuthorityState({ ...auth, nonce: 'ef'.repeat(32) })
+                ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+                await expect(caller().escrow.enroll(input)).rejects.toMatchObject({
+                    code: 'FORBIDDEN',
+                });
+            }
+            expect(apply).not.toHaveBeenCalled();
+        });
+
+        it('checks against ESCROW_AUTHORITY_TENANT, not the request tenant', async () => {
+            process.env.ESCROW_AUTHORITY_TENANT = 'scouts';
+            const { input, apply } = await setup({ enclave: 'scouts', intent: 'scouts' });
+            await expect(
+                vetpassOwner().escrow.getAuthorityState({ ...auth, nonce: 'ab'.repeat(32) })
+            ).resolves.toMatchObject({ state: { tenant: 'scouts' } });
+            await expect(vetpassOwner().escrow.enroll(input)).resolves.toMatchObject({
+                success: true,
+            });
+            expect(apply).toHaveBeenCalledTimes(1);
+        });
+
+        it('keeps the per-app tenant on holds started from VetPass in authority mode', async () => {
+            await enroll();
+            const software = getEscrowEnclave();
+            __setEscrowEnclaveForTests(
+                Object.assign(software, { confirmHold: async () => ({ success: true as const }) })
+            );
+            const started = await appRouter
+                .createCaller({
+                    domain: 'localhost%3A3000',
+                    tenant: { id: 'vetpass', emailBranding: {}, resolvedVia: 'header' as const },
+                })
+                .escrow.startRecovery({ ...auth, clientEphemeralPublicKey: recipient.publicKey });
+            expect((await findEscrowHoldById(started.holdId))?.tenantId).toBe('vetpass');
+        });
+    });
+
     it('suppresses its own started notification and marks requiresConfirmation for an authority-mode hold', async () => {
         await enroll();
         const software = getEscrowEnclave();
@@ -1380,6 +1487,27 @@ describe('A6 escrow recovery', () => {
         }
     });
 
+    it('authenticates completion before migration and fails closed before claiming a valid hold', async () => {
+        setDuration(1);
+        await enroll();
+        const started = await start();
+        advanceToRelease(started);
+        const ready = vi.spyOn(models, 'ensureEscrowHoldsIndexes').mockRejectedValue(
+            new Error('Escrow hold index initialization failed', {
+                cause: { code: 11000, codeName: 'DuplicateKey' },
+            })
+        );
+        await expect(
+            getClient().escrow.completeRecovery({ holdId: started.holdId, resumeToken: 'wrong' })
+        ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect(ready).not.toHaveBeenCalled();
+        await expect(getClient().escrow.completeRecovery(resume(started))).rejects.toMatchObject({
+            code: 'INTERNAL_SERVER_ERROR',
+        });
+        expect(ready).toHaveBeenCalledOnce();
+        expect((await findEscrowHoldById(started.holdId))?.status).toBe('pending');
+    });
+
     it('rejects invalid tokens and removed, unconfirmed, replaced or expired recovery material', async () => {
         setDuration(1);
         await enroll();
@@ -1971,6 +2099,24 @@ describe('escrow PIN release', () => {
         expect((await record())?.escrowPin?.failedAttempts).toBe(2);
     });
 
+    it('never reports "Incorrect PIN." for a mismatch whose wrong entry was not recorded', async () => {
+        // The record changed under the compare (re-enrolled/rotated elsewhere): clients
+        // count every "Incorrect PIN." as their own recorded entry (own-typos rule).
+        await enrollPin();
+        const hold = await startPin();
+        vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+        vi.spyOn(models, 'recordEscrowPinFailure').mockResolvedValueOnce(null);
+        await expect(completePin(hold, wrongProof)).rejects.toMatchObject({
+            code: 'CONFLICT',
+            message: 'Automatic recovery changed; please refresh.',
+        });
+        expect(await findEscrowHoldById(hold.holdId)).toMatchObject({
+            status: 'cancelled',
+            cancelReason: 'pin-mismatch',
+        });
+        expect((await record())?.escrowPin?.verifiedFailedAttempts ?? 0).toBe(0);
+    });
+
     it('locks after ten mismatches and still permits delayed recovery', async () => {
         await enrollPin();
         let lockingHoldId = '';

package/test/keys-lifecycle-invariants.spec.ts

@@ -11,6 +11,7 @@ import {
     activateUserKeyByAuthProvider,
     createUserKeysIndexes,
     getUserKeysCollection,
+    linkAuthProviderKeepingShares,
     PROVISIONAL_MIGRATION_TTL_MS,
     upsertUserKeyByAuthProvider,
     UserKeyVersionConflictError,
@@ -537,6 +538,7 @@ describe('P0-1 provisional SSS activation', () => {
             expect(stored?.sssActivationState).toBe('provisional');
             expect(stored?.migratedFromWeb3Auth).toBe(false);
             expect(stored?.provisionalCreatedAt).toBeInstanceOf(Date);
+            expect(stored?.web3AuthLogin).toEqual({ type: 'firebase', id: uid });
 
             // Simulate abandoning recovery confirmation for more than 30 days.
             const expiredAt = new Date(Date.now() - PROVISIONAL_MIGRATION_TTL_MS - 1_000);
@@ -562,6 +564,8 @@ describe('P0-1 provisional SSS activation', () => {
             expect(purged?.sssActivationState).toBeUndefined();
             expect(purged?.provisionalCreatedAt).toBeUndefined();
             expect(purged?.recoveryMethods).toEqual([]);
+            // The migration login stays known, so the original login still signs in.
+            expect(purged?.web3AuthLogin).toEqual({ type: 'firebase', id: uid });
             expect(purged?.previousAuthShares).toEqual([]);
         } finally {
             await collection.deleteMany({ 'contactMethod.value': email });
@@ -859,3 +863,234 @@ describe('P0-6 fresh DID authorization', () => {
         }
     );
 });
+
+describe('Web3Auth migration login', () => {
+    it('confirms only the login an account was migrated through', async () => {
+        const suffix = `${Date.now()}-${randomUUID()}`;
+        const email = `web3auth-login-${suffix}@example.com`;
+        const uid = `uid-${suffix}`;
+        const otherUid = `other-${suffix}`;
+        const token = makeMockToken(email, uid);
+        const { learnCard } = await getUser('5'.repeat(64));
+        const collection = getUserKeysCollection();
+        const caller = getClient({ did: learnCard.id.did(), isChallengeValid: true });
+
+        try {
+            await caller.keys.storeAuthShare({
+                authToken: token,
+                providerType: 'firebase',
+                primaryDid: learnCard.id.did(),
+                authShare: { encryptedData: 'share', encryptedDek: '', iv: '' },
+            });
+            await caller.keys.markMigrated({ authToken: token, providerType: 'firebase' });
+
+            const migrating = await collection.findOne({
+                authProviders: { $elemMatch: { type: 'firebase', id: uid } },
+            });
+            expect(migrating?.web3AuthLogin).toEqual({ type: 'firebase', id: uid });
+
+            // Activate through the route so activation is shown to keep the login.
+            await collection.updateOne(
+                { _id: migrating!._id },
+                {
+                    $set: {
+                        recoveryMethods: [
+                            {
+                                type: 'backup',
+                                createdAt: new Date(),
+                                confirmationStatus: 'confirmed',
+                                confirmedAt: new Date(),
+                                shareVersion: migrating!.shareVersion ?? 1,
+                            },
+                        ],
+                    },
+                }
+            );
+            await caller.keys.activate({ authToken: token, providerType: 'firebase' });
+
+            const migrated = await getClient().keys.getAuthShare({
+                authToken: token,
+                providerType: 'firebase',
+            });
+            expect(migrated?.keyProvider).toBe('sss');
+            expect(migrated?.isWeb3AuthLogin).toBe(true);
+
+            // A second login (e.g. added by PIN sign-in) derives a different Web3Auth key.
+            await collection.updateOne(
+                { _id: migrating!._id },
+                { $addToSet: { authProviders: { type: 'firebase', id: otherUid } } }
+            );
+            const viaOtherLogin = await getClient().keys.getAuthShare({
+                authToken: makeMockToken(email, otherUid),
+                providerType: 'firebase',
+            });
+            expect(viaOtherLogin?.keyProvider).toBe('sss');
+            expect(viaOtherLogin?.isWeb3AuthLogin).toBe(false);
+        } finally {
+            await collection.deleteMany({ 'contactMethod.value': email });
+        }
+    });
+
+    it.each([
+        ['a second linked login', { extraLogin: true }],
+        ['a rotated security epoch', { securityEpoch: 1 }],
+        ['an already recorded login', { recorded: true }],
+    ])('does not record the calling login with %s', async (_label, setup) => {
+        const suffix = `${Date.now()}-${randomUUID()}`;
+        const email = `migrate-gate-${suffix}@example.com`;
+        const uid = `uid-${suffix}`;
+        const otherUid = `other-${suffix}`;
+        const { learnCard } = await getUser('2'.repeat(64));
+        const collection = getUserKeysCollection();
+        const key = makeUserKey(email, uid, learnCard.id.did());
+
+        key.keyProvider = 'web3auth';
+        if ('extraLogin' in setup) key.authProviders.push({ type: 'firebase', id: otherUid });
+        if ('securityEpoch' in setup) key.securityEpoch = setup.securityEpoch;
+        if ('recorded' in setup) key.web3AuthLogin = { type: 'firebase', id: otherUid };
+        await collection.insertOne(key);
+
+        try {
+            await expect(
+                getClient({ did: learnCard.id.did(), isChallengeValid: true }).keys.markMigrated({
+                    authToken: makeMockToken(email, uid),
+                    providerType: 'firebase',
+                })
+            ).resolves.toEqual({ success: true });
+
+            const stored = await collection.findOne({ 'contactMethod.value': email });
+            expect(stored?.keyProvider).toBe('web3auth');
+            expect(stored?.web3AuthLogin).toEqual(
+                'recorded' in setup ? { type: 'firebase', id: otherUid } : undefined
+            );
+        } finally {
+            await collection.deleteMany({ 'contactMethod.value': email });
+        }
+    });
+
+    it('refuses a login PIN-linked to a mid-migration account whose activation failed', async () => {
+        const suffix = `${Date.now()}-${randomUUID()}`;
+        const email = `pin-linked-${suffix}@example.com`;
+        const uid = `uid-${suffix}`;
+        const linkedUid = `linked-${suffix}`;
+        const token = makeMockToken(email, uid);
+        const { learnCard } = await getUser('1'.repeat(64));
+        const collection = getUserKeysCollection();
+        const caller = getClient({ did: learnCard.id.did(), isChallengeValid: true });
+
+        try {
+            await caller.keys.storeAuthShare({
+                authToken: token,
+                providerType: 'firebase',
+                primaryDid: learnCard.id.did(),
+                authShare: { encryptedData: 'share', encryptedDek: '', iv: '' },
+            });
+            await caller.keys.markMigrated({ authToken: token, providerType: 'firebase' });
+            // PIN saved, activation never ran: the record stays provisional 'web3auth'.
+            const record = await collection.findOne({ 'contactMethod.value': email });
+            expect(record?.keyProvider).toBe('web3auth');
+
+            await expect(
+                linkAuthProviderKeepingShares({
+                    oldAuthProvider: { type: 'firebase', id: uid },
+                    newAuthProvider: { type: 'firebase', id: linkedUid },
+                    primaryDid: learnCard.id.did(),
+                    shareVersion: record!.shareVersion ?? 1,
+                    securityEpoch: 0,
+                })
+            ).resolves.not.toBeNull();
+
+            const viaLinked = await getClient().keys.getAuthShare({
+                authToken: makeMockToken(email, linkedUid),
+                providerType: 'firebase',
+            });
+            expect(viaLinked?.keyProvider).toBe('web3auth');
+            expect(viaLinked?.isWeb3AuthLogin).toBe(false);
+
+            const viaOriginal = await getClient().keys.getAuthShare({
+                authToken: token,
+                providerType: 'firebase',
+            });
+            expect(viaOriginal?.isWeb3AuthLogin).toBe(true);
+        } finally {
+            await collection.deleteMany({ 'contactMethod.value': email });
+        }
+    });
+
+    it.each([
+        ['its sole login', {}, true],
+        ['one of two logins', { extraLogin: true }, false],
+        ['a rotated security epoch', { securityEpoch: 1 }, false],
+    ])(
+        'confirms an unrecorded mid-migration record only through %s',
+        async (_label, setup, expected) => {
+            const suffix = `${Date.now()}-${randomUUID()}`;
+            const email = `unrecorded-${suffix}@example.com`;
+            const uid = `uid-${suffix}`;
+            const { learnCard } = await getUser('e'.repeat(64));
+            const collection = getUserKeysCollection();
+            const key = makeUserKey(email, uid, learnCard.id.did());
+
+            key.keyProvider = 'web3auth';
+            key.sssActivationState = 'provisional';
+            key.provisionalCreatedAt = new Date();
+            if ('extraLogin' in setup)
+                key.authProviders.push({ type: 'firebase', id: `x-${suffix}` });
+            if ('securityEpoch' in setup) key.securityEpoch = setup.securityEpoch;
+            await collection.insertOne(key);
+
+            try {
+                const result = await getClient().keys.getAuthShare({
+                    authToken: makeMockToken(email, uid),
+                    providerType: 'firebase',
+                });
+                expect(result?.isWeb3AuthLogin).toBe(expected);
+            } finally {
+                await collection.deleteMany({ 'contactMethod.value': email });
+            }
+        }
+    );
+
+    it('never confirms an account created with SSS', async () => {
+        const suffix = `${Date.now()}-${randomUUID()}`;
+        const email = `sss-native-${suffix}@example.com`;
+        const uid = `uid-${suffix}`;
+        const { learnCard } = await getUser('4'.repeat(64));
+        const collection = getUserKeysCollection();
+
+        await collection.insertOne(makeUserKey(email, uid, learnCard.id.did()));
+
+        try {
+            const result = await getClient().keys.getAuthShare({
+                authToken: makeMockToken(email, uid),
+                providerType: 'firebase',
+            });
+            expect(result?.keyProvider).toBe('sss');
+            expect(result?.isWeb3AuthLogin).toBe(false);
+        } finally {
+            await collection.deleteMany({ 'contactMethod.value': email });
+        }
+    });
+
+    it('requires the migration flag as well as the login', async () => {
+        const suffix = `${Date.now()}-${randomUUID()}`;
+        const email = `login-without-flag-${suffix}@example.com`;
+        const uid = `uid-${suffix}`;
+        const { learnCard } = await getUser('3'.repeat(64));
+        const collection = getUserKeysCollection();
+        const key = makeUserKey(email, uid, learnCard.id.did());
+
+        key.web3AuthLogin = { type: 'firebase', id: uid };
+        await collection.insertOne(key);
+
+        try {
+            const result = await getClient().keys.getAuthShare({
+                authToken: makeMockToken(email, uid),
+                providerType: 'firebase',
+            });
+            expect(result?.isWeb3AuthLogin).toBe(false);
+        } finally {
+            await collection.deleteMany({ 'contactMethod.value': email });
+        }
+    });
+});

package/test/keys-pin-sign-in.spec.ts

@@ -724,8 +724,40 @@ describe('same-PIN budget refresh with expected charges', () => {
         await expect(refresh({ attemptsRemaining: 9, wrongAttempts: 0 })).rejects.toMatchObject({
             code: 'CONFLICT',
         });
-        // Even with the current counts, a PIN with a recorded wrong entry is never refreshed.
-        await expect(refresh({ attemptsRemaining: 8, wrongAttempts: 1 })).rejects.toMatchObject({
+
+        expect(securityState(await record())).toEqual(securityState(before));
+    });
+
+    it("refreshes when the expected charges include the owner's own wrong entry (own-typos rule)", async () => {
+        await enrollPin();
+        // The owner mistypes once in this sign-in, then releases with the right PIN.
+        await expect(completePin(await startPin(), wrongProof)).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        await completePin(await startPin());
+        expect(await pinStatus()).toMatchObject({ attemptsRemaining: 8, wrongAttempts: 1 });
+
+        await refresh({ attemptsRemaining: 8, wrongAttempts: 1 });
+
+        expect((await record())?.escrowPin).toMatchObject({
+            salt: otherPinSalt,
+            failedAttempts: 0,
+        });
+    });
+
+    it('refuses a refresh whose wrong entries do not match the record, or exceed the charges', async () => {
+        await enrollPin();
+        await expect(completePin(await startPin(), wrongProof)).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        await completePin(await startPin());
+        const before = await record();
+
+        // A foreign wrong entry the client did not count.
+        await expect(refresh({ attemptsRemaining: 8, wrongAttempts: 0 })).rejects.toMatchObject({
+            code: 'CONFLICT',
+        });
+        await expect(refresh({ attemptsRemaining: 8, wrongAttempts: 3 })).rejects.toMatchObject({
             code: 'CONFLICT',
         });
 

package/test/notifications.spec.ts

@@ -46,6 +46,56 @@ describe('Notifications', () => {
     });
 
     describe('Send Notification', () => {
+        it('deduplicates concurrent campaign delivery and retries after a lost storage response', async () => {
+            const notification: LCNNotification = {
+                type: 'ANNOUNCEMENT',
+                to: { did: userA.learnCard.id.did() },
+                from: userB.learnCard.id.did(),
+                message: { title: 'Explore', body: 'Find your next step' },
+                data: {
+                    metadata: {
+                        campaignId: 'pilot-clr',
+                        campaignCreatedAt: '2026-01-01T00:00:00Z',
+                    },
+                },
+            };
+            const push = vi
+                .spyOn(PushNotifications, 'sendPushNotification')
+                .mockResolvedValue({ successCount: 1, failureCount: 0, failedTokens: [] });
+            try {
+                const send = () =>
+                    userA.clients.authorizedDidAuth.notifications.sendNotification(notification);
+                const results = await Promise.all(Array.from({ length: 10 }, send));
+                expect(results.every(Boolean)).toBe(true);
+                expect(await Notifications.countDocuments({ type: 'ANNOUNCEMENT' })).toBe(1);
+                expect(push).toHaveBeenCalledTimes(1);
+                await Notifications.updateOne(
+                    { type: 'ANNOUNCEMENT' },
+                    { $set: { read: true, archived: true } }
+                );
+                // A retry after storage succeeded but its HTTP response was lost.
+                await expect(send()).resolves.toBe(true);
+                expect(push).toHaveBeenCalledTimes(1);
+                expect(await Notifications.findOne({ type: 'ANNOUNCEMENT' })).toMatchObject({
+                    read: true,
+                    archived: true,
+                });
+                await userA.clients.authorizedDidAuth.notifications.sendNotification({
+                    ...notification,
+                    data: {
+                        metadata: {
+                            ...notification.data!.metadata!,
+                            campaignTestId: 'aaaaaaaa-aaaa-4aaa-aaaa-aaaaaaaaaaaa',
+                        },
+                    },
+                });
+                expect(await Notifications.countDocuments({ type: 'ANNOUNCEMENT' })).toBe(2);
+                expect(push).toHaveBeenCalledTimes(2);
+            } finally {
+                push.mockRestore();
+            }
+        });
+
         it('should allow an authorized service to send a notification to a user', async () => {
             await expect(
                 userA.clients.authorizedDidAuth.notifications.sendNotification(
@@ -62,6 +112,58 @@ describe('Notifications', () => {
                 ],
             });
         });
+        it.each([
+            ['relaxed', true, false],
+            ['expanded_optional', true, false],
+            ['requires_consent', false, true],
+        ] as const)(
+            'stores %s contract updates with the right feed and push policy',
+            async (kind, read, shouldPush) => {
+                const pushSpy = vi
+                    .spyOn(PushNotifications, 'sendPushNotification')
+                    .mockResolvedValue({ failureCount: 0, successCount: 0, failedTokens: [] });
+                const notification = getTestNotification(
+                    userA.learnCard.id.did(),
+                    userB.learnCard.id.did(),
+                    LCNNotificationTypeEnumValidator.enum.CONSENT_FLOW_CONTRACT_UPDATED,
+                    undefined,
+                    {
+                        contractUri: 'lc:network:contract:policy-test',
+                        fromVersion: 1,
+                        toVersion: 2,
+                        kind,
+                        diff: { added: [], removed: [], changed: [] },
+                        reviewUrl:
+                            'https://learncard.app/consent-flow/review?uri=lc%3Anetwork%3Acontract%3Apolicy-test',
+                    }
+                );
+
+                try {
+                    await expect(
+                        userA.clients.authorizedDidAuth.notifications.sendNotification(notification)
+                    ).resolves.toBe(true);
+                    await expect(
+                        userA.clients.authorizedDidAuth.notifications.sendNotification(notification)
+                    ).resolves.toBe(true);
+
+                    expect(
+                        await Notifications.findOne({
+                            type: LCNNotificationTypeEnumValidator.enum
+                                .CONSENT_FLOW_CONTRACT_UPDATED,
+                        })
+                    ).toMatchObject({ read });
+                    await expect(
+                        Notifications.countDocuments({
+                            type: LCNNotificationTypeEnumValidator.enum
+                                .CONSENT_FLOW_CONTRACT_UPDATED,
+                        })
+                    ).resolves.toBe(1);
+                    expect(pushSpy).toHaveBeenCalledTimes(shouldPush ? 1 : 0);
+                } finally {
+                    pushSpy.mockRestore();
+                }
+            }
+        );
         it('should prevent an unauthorized service to send a notification to a user', async () => {
             await expect(
                 userA.clients.fullAuth.notifications.sendNotification(

package/tsconfig.entrypoints.json

@@ -3,6 +3,6 @@
     "compilerOptions": {
         "noEmit": true
     },
-    "include": ["lambda.ts", "*Lambda.ts"],
+    "include": ["lambda.ts", "*Lambda.ts", "scripts/escrow-lambda-http.ts"],
     "exclude": ["node_modules", "dist", "build", "test", "src/**/*.test.ts"]
 }

package/vitest.config.ts

@@ -15,6 +15,7 @@ export default createVitestConfig(nodePreset, {
             'src/**/*.test.ts',
             'scripts/**/*.test.ts',
             '*Lambda.test.ts',
+            'lambdaApp.test.ts',
             'seedMigrationApp.test.ts',
             'test/keycloak-verify.spec.ts',
             'test/keycloak-verify.integration.spec.ts',

package/scripts/node24-runtime.cjs

@@ -1,9 +0,0 @@
-/* global module */
-// Serverless 3.40 predates Node 24. Extend only LCA's runtime enum, keeping
-// all other configuration validation enabled. AWS supports nodejs24.x.
-module.exports = class Node24Runtime {
-    constructor(serverless) {
-        const runtimes = serverless.configSchemaHandler.schema.definitions.awsLambdaRuntime.enum;
-        if (!runtimes.includes('nodejs24.x')) runtimes.push('nodejs24.x');
-    }
-};