@learncard/network-brain-service 3.19.0 → 4.0.0

package/test/app-store-listing-updates.spec.ts

@@ -0,0 +1,236 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+
+import { AppManifestVersion, AppStoreListing, Integration, Profile } from '@models';
+
+import { getUser } from './helpers/getClient';
+import { seedListedApp } from './helpers/app-store.helpers';
+
+import type { AppManifest } from '@learncard/types';
+
+let owner: Awaited<ReturnType<typeof getUser>>;
+let stranger: Awaited<ReturnType<typeof getUser>>;
+let admin: Awaited<ReturnType<typeof getUser>>;
+
+const cleanup = async () => {
+    await AppManifestVersion.delete({ detach: true, where: {} });
+    await AppStoreListing.delete({ detach: true, where: {} });
+    await Integration.delete({ detach: true, where: {} });
+    await Profile.delete({ detach: true, where: {} });
+};
+
+const manifest = (permissions: string[]): AppManifest => ({
+    manifestVersion: 1,
+    appUrl: 'https://app.example.com',
+    permissions,
+    templates: [],
+    consentRequests: [],
+    featuresLaunched: [],
+    counterKeys: [],
+    usedLearnerContext: false,
+    usedNotifications: false,
+    firstCapturedAt: '2026-01-01T00:00:00.000Z',
+    lastUpdatedAt: '2026-01-01T00:00:00.000Z',
+});
+
+describe('updates to live apps', () => {
+    beforeAll(async () => {
+        owner = await getUser('a'.repeat(64));
+        stranger = await getUser('b'.repeat(64));
+        admin = await getUser('d'.repeat(64));
+    });
+
+    beforeEach(async () => {
+        await cleanup();
+        await owner.clients.fullAuth.profile.createProfile({ profileId: 'listing-owner' });
+        await stranger.clients.fullAuth.profile.createProfile({ profileId: 'stranger' });
+        await admin.clients.fullAuth.profile.createProfile({ profileId: 'app-store-admin' });
+    });
+
+    afterAll(cleanup);
+
+    const getOwned = async (listingId: string) =>
+        owner.clients.fullAuth.appStore.getListing({ listingId });
+
+    it('holds edits to a live app until they are approved', async () => {
+        const { listing } = await seedListedApp('listing-owner');
+
+        await owner.clients.fullAuth.appStore.updateListing({
+            listingId: listing.listing_id,
+            updates: { tagline: 'A brand new tagline', screenshots: ['https://example.com/s.png'] },
+        });
+
+        const publicListing = await stranger.clients.fullAuth.appStore.getPublicListing({
+            listingId: listing.listing_id,
+        });
+        expect(publicListing?.tagline).toBe('A test application');
+        expect(publicListing).not.toHaveProperty('pending_update');
+
+        const owned = await getOwned(listing.listing_id);
+        expect(owned?.tagline).toBe('A test application');
+        expect(owned?.pending_update).toMatchObject({
+            status: 'DRAFT',
+            changes: { tagline: 'A brand new tagline', screenshots: ['https://example.com/s.png'] },
+        });
+    });
+
+    it('applies an approved update to the live listing', async () => {
+        const { listing } = await seedListedApp('listing-owner');
+        const listingId = listing.listing_id;
+
+        await owner.clients.fullAuth.appStore.updateListing({
+            listingId,
+            updates: { tagline: 'Approved tagline' },
+        });
+        await owner.clients.fullAuth.appStore.submitListingUpdate({ listingId });
+
+        expect((await getOwned(listingId))?.pending_update?.status).toBe('PENDING_REVIEW');
+
+        await admin.clients.fullAuth.appStore.adminReviewListingUpdate({
+            listingId,
+            approve: true,
+        });
+
+        const owned = await getOwned(listingId);
+        expect(owned?.tagline).toBe('Approved tagline');
+        expect(owned?.app_listing_status).toBe('LISTED');
+        expect(owned?.pending_update).toBeUndefined();
+    });
+
+    it('keeps rejected changes editable without touching the live listing', async () => {
+        const { listing } = await seedListedApp('listing-owner');
+        const listingId = listing.listing_id;
+
+        await owner.clients.fullAuth.appStore.updateListing({
+            listingId,
+            updates: { tagline: 'Rejected tagline' },
+        });
+        await owner.clients.fullAuth.appStore.submitListingUpdate({ listingId });
+        await admin.clients.fullAuth.appStore.adminReviewListingUpdate({
+            listingId,
+            approve: false,
+        });
+
+        const owned = await getOwned(listingId);
+        expect(owned?.tagline).toBe('A test application');
+        expect(owned?.pending_update).toMatchObject({
+            status: 'DRAFT',
+            changes: { tagline: 'Rejected tagline' },
+        });
+    });
+
+    it('blocks edits while an update is in review, until it is withdrawn', async () => {
+        const { listing } = await seedListedApp('listing-owner');
+        const listingId = listing.listing_id;
+
+        await owner.clients.fullAuth.appStore.updateListing({
+            listingId,
+            updates: { tagline: 'First' },
+        });
+        await owner.clients.fullAuth.appStore.submitListingUpdate({ listingId });
+
+        await expect(
+            owner.clients.fullAuth.appStore.updateListing({
+                listingId,
+                updates: { tagline: 'Second' },
+            })
+        ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+
+        await owner.clients.fullAuth.appStore.withdrawListingUpdate({ listingId });
+        await owner.clients.fullAuth.appStore.updateListing({
+            listingId,
+            updates: { tagline: 'Second' },
+        });
+
+        expect((await getOwned(listingId))?.pending_update).toMatchObject({
+            status: 'DRAFT',
+            changes: { tagline: 'Second' },
+        });
+    });
+
+    it('discards unsubmitted changes', async () => {
+        const { listing } = await seedListedApp('listing-owner');
+        const listingId = listing.listing_id;
+
+        await owner.clients.fullAuth.appStore.updateListing({
+            listingId,
+            updates: { tagline: 'Never mind' },
+        });
+        await owner.clients.fullAuth.appStore.discardListingUpdate({ listingId });
+
+        expect((await getOwned(listingId))?.pending_update).toBeUndefined();
+    });
+
+    it('holds new capabilities for a live app instead of switching them on', async () => {
+        const { listing, integration } = await seedListedApp('listing-owner');
+        const listingId = listing.listing_id;
+
+        const first = await owner.clients.fullAuth.appStore.submitAppManifest({
+            integrationId: integration.id,
+            manifest: manifest(['request_identity']),
+        });
+        const applied = await owner.clients.fullAuth.appStore.applyManifestVersion({
+            integrationId: integration.id,
+            version: first.version,
+            listingId,
+        });
+
+        expect(applied).toMatchObject({ applied: false, pendingReview: true });
+        expect((await getOwned(listingId))?.pending_update?.manifest_version).toBe(first.version);
+
+        await owner.clients.fullAuth.appStore.submitListingUpdate({ listingId });
+        await admin.clients.fullAuth.appStore.adminReviewListingUpdate({
+            listingId,
+            approve: true,
+        });
+
+        const versions = await owner.clients.fullAuth.appStore.getManifestVersions({
+            integrationId: integration.id,
+        });
+        expect(versions.records[0]).toMatchObject({ version: first.version, status: 'active' });
+    });
+
+    it('refuses to submit a localhost address in an update', async () => {
+        const { listing } = await seedListedApp('listing-owner');
+        const listingId = listing.listing_id;
+
+        await owner.clients.fullAuth.appStore.updateListing({
+            listingId,
+            updates: {
+                launch_type: 'EMBEDDED_IFRAME',
+                launch_config_json: JSON.stringify({ url: 'http://localhost:4321' }),
+            },
+        });
+
+        await expect(
+            owner.clients.fullAuth.appStore.submitListingUpdate({ listingId })
+        ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+    });
+
+    it('only lets the owner manage updates and only admins review them', async () => {
+        const { listing } = await seedListedApp('listing-owner');
+        const listingId = listing.listing_id;
+
+        await owner.clients.fullAuth.appStore.updateListing({
+            listingId,
+            updates: { tagline: 'Mine' },
+        });
+
+        await expect(
+            stranger.clients.fullAuth.appStore.submitListingUpdate({ listingId })
+        ).rejects.toBeDefined();
+        await expect(
+            stranger.clients.fullAuth.appStore.discardListingUpdate({ listingId })
+        ).rejects.toBeDefined();
+
+        await owner.clients.fullAuth.appStore.submitListingUpdate({ listingId });
+        await expect(
+            owner.clients.fullAuth.appStore.adminReviewListingUpdate({ listingId, approve: true })
+        ).rejects.toBeDefined();
+
+        const pendingForAdmin = await admin.clients.fullAuth.appStore.adminGetAllListings({
+            pendingUpdatesOnly: true,
+        });
+        expect(pendingForAdmin.records.map(record => record.listing_id)).toEqual([listingId]);
+        expect(pendingForAdmin.records[0]?.pending_update?.changes.tagline).toBe('Mine');
+    });
+});

package/test/app-store-listing.spec.ts

@@ -893,6 +893,65 @@ describe('AppStoreListing', () => {
                 const after = await readAppStoreListingById(listingId);
                 expect(after).toBeNull();
             });
+
+            it('deletes an ARCHIVED (rejected) listing', async () => {
+                const integrationId = await seedIntegrationViaRouter(userA);
+                const listingId = await seedListingViaRouter(userA, integrationId);
+                await setListingStatus(listingId, 'ARCHIVED');
+
+                const ok = await userA.clients.fullAuth.appStore.deleteListing({ listingId });
+                expect(ok).toBe(true);
+
+                const after = await readAppStoreListingById(listingId);
+                expect(after).toBeNull();
+            });
+
+            it('refuses to delete a listing that is in review', async () => {
+                const integrationId = await seedIntegrationViaRouter(userA);
+                const listingId = await seedListingViaRouter(userA, integrationId);
+                await userA.clients.fullAuth.appStore.submitForReview({ listingId });
+
+                await expect(
+                    userA.clients.fullAuth.appStore.deleteListing({ listingId })
+                ).rejects.toMatchObject({
+                    code: 'PRECONDITION_FAILED',
+                    message: 'Only draft apps can be deleted. Withdraw it from review first.',
+                });
+
+                const after = await readAppStoreListingById(listingId);
+                expect(after?.app_listing_status).toBe('PENDING_REVIEW');
+            });
+
+            it('refuses to delete a live listing', async () => {
+                const integrationId = await seedIntegrationViaRouter(userA);
+                const listingId = await seedListingViaRouter(userA, integrationId);
+                await setListingStatus(listingId, 'LISTED');
+
+                await expect(
+                    userA.clients.fullAuth.appStore.deleteListing({ listingId })
+                ).rejects.toMatchObject({
+                    code: 'PRECONDITION_FAILED',
+                    message: "Live apps can't be deleted. Remove it from the store first.",
+                });
+
+                const after = await readAppStoreListingById(listingId);
+                expect(after?.app_listing_status).toBe('LISTED');
+            });
+
+            it('refuses to delete a live listing even with a pending update in review', async () => {
+                const integrationId = await seedIntegrationViaRouter(userA);
+                const listingId = await seedListingViaRouter(userA, integrationId);
+                await setListingStatus(listingId, 'LISTED');
+                await userA.clients.fullAuth.appStore.updateListing({
+                    listingId,
+                    updates: { tagline: 'A new tagline' },
+                });
+                await userA.clients.fullAuth.appStore.submitListingUpdate({ listingId });
+
+                await expect(
+                    userA.clients.fullAuth.appStore.deleteListing({ listingId })
+                ).rejects.toMatchObject({ code: 'PRECONDITION_FAILED' });
+            });
         });
 
         describe('submitForReview', () => {
@@ -2083,12 +2142,15 @@ describe('AppStoreListing', () => {
                 let browseResults = await noAuthClient.appStore.browseListedApps();
                 expect(browseResults.records.some(r => r.listing_id === listingId)).toBe(true);
 
-                // Delete the listing
-                await userA.clients.fullAuth.appStore.deleteListing({ listingId });
+                await setListingStatus(listingId, 'ARCHIVED');
 
-                // Verify it no longer appears in browse
                 browseResults = await noAuthClient.appStore.browseListedApps();
                 expect(browseResults.records.some(r => r.listing_id === listingId)).toBe(false);
+
+                await userA.clients.fullAuth.appStore.deleteListing({ listingId });
+
+                const after = await readAppStoreListingById(listingId);
+                expect(after).toBeNull();
             });
 
             it('unlisting an app removes it from public browse', async () => {

package/test/consent-data-boundaries.spec.ts

@@ -0,0 +1,352 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import type { ConsentFlowDataQuery, ConsentFlowTermsInput } from '@learncard/types';
+import { ConsentFlowTerms, ConsentFlowContract } from '@models';
+import { getUser } from './helpers/getClient';
+import { minimalContract, minimalTerms, normalContract, normalFullTerms } from './helpers/contract';
+
+describe('consented data boundaries', () => {
+    let owner: Awaited<ReturnType<typeof getUser>>;
+    let learner: Awaited<ReturnType<typeof getUser>>;
+    let learnerDid: string;
+
+    beforeEach(async () => {
+        const suffix = randomBytes(5).toString('hex');
+        owner = await getUser(randomBytes(32).toString('hex'));
+        learner = await getUser(randomBytes(32).toString('hex'));
+        await owner.clients.fullAuth.profile.createProfile({
+            profileId: `boundary-owner-${suffix}`,
+        });
+        await learner.clients.fullAuth.profile.createProfile({
+            profileId: `boundary-user-${suffix}`,
+        });
+        learnerDid = (await learner.clients.fullAuth.profile.getProfile())!.did;
+    });
+
+    const consent = async ({
+        terms = normalFullTerms,
+        expiresAt,
+        contractExpiresAt,
+        oneTime,
+        minimal = false,
+    }: {
+        terms?: ConsentFlowTermsInput;
+        expiresAt?: string;
+        contractExpiresAt?: string;
+        oneTime?: boolean;
+        minimal?: boolean;
+    } = {}) => {
+        const contractUri = await owner.clients.fullAuth.contracts.createConsentFlowContract({
+            name: 'Synthetic boundary contract',
+            contract: minimal ? minimalContract : normalContract,
+            expiresAt: contractExpiresAt,
+        });
+        const { termsUri } = await learner.clients.fullAuth.contracts.consentToContract({
+            contractUri,
+            terms,
+            expiresAt,
+            oneTime,
+        });
+        return { contractUri, termsUri };
+    };
+
+    const readAll = async (
+        contractUri: string,
+        query: ConsentFlowDataQuery = {},
+        pagination: { limit?: number; cursor?: string } = {}
+    ) => [
+        await owner.clients.fullAuth.contracts.getConsentedDataForContract({
+            uri: contractUri,
+            query,
+            ...pagination,
+        }),
+        await owner.clients.fullAuth.contracts.getConsentedDataForDid({
+            did: learnerDid,
+            query: { ...query, id: contractUri.split(':').at(-1)! },
+            ...pagination,
+        }),
+        await owner.clients.fullAuth.contracts.getConsentedData({ query, ...pagination }),
+    ];
+
+    it('returns live unexpired personal fields and selected credentials on every route', async () => {
+        const { contractUri } = await consent({
+            expiresAt: '2100-01-01T00:00:00+05:30',
+            contractExpiresAt: '2100-01-01T00:00:00-05:00',
+        });
+        for (const response of await readAll(contractUri)) {
+            expect(response.records).toHaveLength(1);
+            expect(response.records[0]!.personal).toEqual(normalFullTerms.read.personal);
+            expect(JSON.stringify(response)).toContain('achievement1');
+        }
+    });
+
+    it.each([
+        [{ name: true }, 1],
+        [{ name: false }, 0],
+        [{ missing: false }, 1],
+        [{ name: true, missing: true }, 0],
+    ] as const)(
+        'filters personal field presence without treating empty strings as absent: %j',
+        async (personal, count) => {
+            const terms = structuredClone(normalFullTerms);
+            terms.read.personal = { ...terms.read.personal, name: '' };
+            const { contractUri } = await consent({ terms });
+            for (const response of await readAll(contractUri, { personal })) {
+                expect(response.records).toHaveLength(count);
+            }
+        }
+    );
+
+    it('treats legacy empty expiry strings as no expiry, including category expiry', async () => {
+        const terms = structuredClone(normalFullTerms);
+        terms.read.credentials.categories.Achievement!.shareUntil = '';
+        const { contractUri, termsUri } = await consent({ terms });
+        await learner.clients.fullAuth.contracts.updateConsentedContractTerms({
+            uri: termsUri,
+            terms,
+            expiresAt: '',
+        });
+        for (const response of await readAll(contractUri, {
+            credentials: { categories: { Achievement: true } },
+        })) {
+            expect(response.records).toHaveLength(1);
+        }
+        await learner.clients.fullAuth.contracts.syncCredentialsToContract({
+            termsUri,
+            categories: { Achievement: ['urn:blank-expiry:copy'] },
+        });
+    });
+
+    it.each([true, false, undefined] as const)(
+        'preserves anonymize presence filters for stored value %s',
+        async anonymize => {
+            const terms = structuredClone(normalFullTerms);
+            if (anonymize === undefined) delete terms.read.anonymize;
+            else terms.read.anonymize = anonymize;
+            const { contractUri } = await consent({ terms });
+            for (const filter of [true, false, undefined]) {
+                // The per-DID query does not expose anonymize; check its two supported routes.
+                const query = filter === undefined ? {} : { anonymize: filter };
+                for (const response of [
+                    await owner.clients.fullAuth.contracts.getConsentedDataForContract({
+                        uri: contractUri,
+                        query,
+                        limit: 1,
+                    }),
+                    await owner.clients.fullAuth.contracts.getConsentedData({ query, limit: 1 }),
+                ]) {
+                    expect(response.records).toHaveLength(
+                        filter === undefined || filter === (anonymize !== undefined) ? 1 : 0
+                    );
+                    expect(response.hasMore).toBe(false);
+                }
+            }
+        }
+    );
+
+    it.each(['terms', 'contract'] as const)(
+        'allows locked sync when %s expiry contains only whitespace',
+        async kind => {
+            const { contractUri, termsUri } = await consent();
+            const model = kind === 'terms' ? ConsentFlowTerms : ConsentFlowContract;
+            const uri = kind === 'terms' ? termsUri : contractUri;
+            await model.update({ expiresAt: '   ' }, { where: { id: uri.split(':').at(-1)! } });
+            await expect(
+                learner.clients.fullAuth.contracts.syncCredentialsToContract({
+                    termsUri,
+                    categories: { Achievement: ['urn:whitespace-expiry:copy'] },
+                })
+            ).resolves.toBe(true);
+        }
+    );
+
+    it('excludes withdrawn consent while retaining its audit history', async () => {
+        const { contractUri, termsUri } = await consent();
+        await learner.clients.fullAuth.contracts.withdrawConsent({ uri: termsUri });
+        const history = await learner.clients.fullAuth.contracts.getConsentedContracts();
+        expect(history.records.find(record => record.uri === termsUri)?.status).toBe('withdrawn');
+        for (const response of await readAll(contractUri)) expect(response.records).toEqual([]);
+    });
+
+    it.each(['terms', 'contract'] as const)('excludes expired %s on every route', async kind => {
+        const past = '2000-01-01T00:00:00.000Z';
+        const { contractUri } = await consent({
+            expiresAt: kind === 'terms' ? past : undefined,
+        });
+        // Seed an existing consent that subsequently expires, rather than consent to an expired contract.
+        if (kind === 'contract')
+            await ConsentFlowContract.update(
+                { expiresAt: past },
+                { where: { id: contractUri.split(':').at(-1)! } }
+            );
+        for (const response of await readAll(contractUri)) expect(response.records).toEqual([]);
+    });
+
+    it('preserves one-time snapshots without permitting ongoing sync, then honors withdrawal', async () => {
+        const { contractUri, termsUri } = await consent({ oneTime: true });
+        const history = await learner.clients.fullAuth.contracts.getConsentedContracts();
+        expect(history.records.find(record => record.uri === termsUri)?.status).toBe('stale');
+        for (const response of await readAll(contractUri)) {
+            expect(response.records).toHaveLength(1);
+            expect(JSON.stringify(response)).toContain('achievement1');
+        }
+        await expect(
+            learner.clients.fullAuth.contracts.syncCredentialsToContract({
+                termsUri,
+                categories: { Achievement: ['urn:synthetic:new'] },
+            })
+        ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        await learner.clients.fullAuth.contracts.withdrawConsent({ uri: termsUri });
+        for (const response of await readAll(contractUri)) expect(response.records).toEqual([]);
+    });
+
+    it('excludes stale consent without the explicit one-time flag', async () => {
+        const { contractUri, termsUri } = await consent();
+        await ConsentFlowTerms.update(
+            { status: 'stale' },
+            { where: { id: termsUri.split(':').at(-1)! } }
+        );
+        for (const response of await readAll(contractUri)) expect(response.records).toEqual([]);
+    });
+
+    it('also expires one-time snapshots', async () => {
+        const { contractUri } = await consent({ oneTime: true, expiresAt: '2000-01-01T00:00:00Z' });
+        for (const response of await readAll(contractUri)) expect(response.records).toEqual([]);
+    });
+
+    it.each(['disabled', 'unspecified', 'expired'] as const)(
+        'excludes %s category URIs and filters by permitted data on every route',
+        async kind => {
+            const terms = structuredClone(normalFullTerms);
+            terms.read.credentials.categories.Achievement = {
+                shared: ['urn:synthetic:blocked'],
+                sharing: kind === 'expired' ? true : kind === 'disabled' ? false : undefined,
+                shareUntil: kind === 'expired' ? '2000-01-01T00:00:00Z' : undefined,
+            };
+            const { contractUri } = await consent({ terms });
+            for (const response of await readAll(contractUri)) {
+                expect(response.records).toHaveLength(1);
+                expect(response.records[0]!.personal).toEqual(normalFullTerms.read.personal);
+                expect(JSON.stringify(response)).not.toContain('urn:synthetic:blocked');
+                expect(JSON.stringify(response)).toContain('id1');
+            }
+            for (const response of await readAll(contractUri, {
+                credentials: { categories: { Achievement: true } },
+            })) {
+                expect(response.records).toEqual([]);
+            }
+            for (const response of await readAll(contractUri, {
+                credentials: { categories: { Achievement: false } },
+            })) {
+                expect(response.records).toHaveLength(1);
+                expect(JSON.stringify(response)).not.toContain('urn:synthetic:blocked');
+            }
+        }
+    );
+
+    it('returns an empty credential collection for valid terms without categories', async () => {
+        const { contractUri } = await consent({ terms: minimalTerms, minimal: true });
+        const [byContract, byDid, aggregate] = await readAll(contractUri);
+        expect(byContract!.records[0]!.credentials).toEqual({ categories: {} });
+        expect(aggregate!.records[0]!.credentials).toEqual({ categories: {} });
+        expect(byDid!.records[0]!.credentials).toEqual([]);
+        expect(byDid!.records[0]!.personal).toEqual(minimalTerms.read.personal);
+    });
+
+    it('hides saved URIs when credential sharing is disabled globally', async () => {
+        const terms = structuredClone(normalFullTerms);
+        terms.read.credentials.sharing = false;
+        const { contractUri } = await consent({ terms });
+        for (const response of await readAll(contractUri)) {
+            expect(response.records).toHaveLength(1);
+            expect(JSON.stringify(response)).not.toContain('achievement1');
+            expect(JSON.stringify(response)).not.toContain('id1');
+        }
+        for (const response of await readAll(contractUri, {
+            credentials: { categories: { Achievement: true } },
+        })) {
+            expect(response.records).toEqual([]);
+        }
+        for (const response of await readAll(contractUri, {
+            credentials: { categories: { Achievement: false } },
+        })) {
+            expect(response.records).toHaveLength(1);
+        }
+    });
+
+    it.each(['terms', 'contract'] as const)(
+        'excludes malformed legacy %s expiry without failing the query',
+        async kind => {
+            const { contractUri, termsUri } = await consent();
+            const model = kind === 'terms' ? ConsentFlowTerms : ConsentFlowContract;
+            await model.update(
+                { expiresAt: 'invalid-legacy-date' },
+                { where: { id: (kind === 'terms' ? termsUri : contractUri).split(':').at(-1)! } }
+            );
+            for (const response of await readAll(contractUri)) expect(response.records).toEqual([]);
+        }
+    );
+
+    it('projects only requested categories consistently', async () => {
+        const { contractUri } = await consent();
+        for (const response of await readAll(contractUri, {
+            credentials: { categories: { Achievement: true } },
+        })) {
+            expect(JSON.stringify(response)).toContain('achievement1');
+            expect(JSON.stringify(response)).not.toContain('id1');
+        }
+    });
+
+    it('applies eligibility before pagination and accepts a cursor on every route', async () => {
+        const { contractUri, termsUri } = await consent();
+        const secondLearner = await getUser(randomBytes(32).toString('hex'));
+        await secondLearner.clients.fullAuth.profile.createProfile({
+            profileId: `boundary-second-${randomBytes(5).toString('hex')}`,
+        });
+        await secondLearner.clients.fullAuth.contracts.consentToContract({
+            contractUri,
+            terms: normalFullTerms,
+            expiresAt: '2000-01-01T00:00:00Z',
+        });
+        // Put the expired row first, so filtering after LIMIT would hide the live row.
+        await ConsentFlowTerms.update(
+            { updatedAt: '2001-01-01T00:00:00Z' },
+            {
+                where: { id: termsUri.split(':').at(-1)! },
+            }
+        );
+        for (const response of await readAll(contractUri, {}, { limit: 1 })) {
+            expect(response.records).toHaveLength(1);
+            expect(response.hasMore).toBe(false);
+        }
+        for (const response of await readAll(
+            contractUri,
+            {},
+            { cursor: '2001-01-01T00:00:00Z', limit: 1 }
+        )) {
+            expect(response.records).toEqual([]);
+        }
+    });
+
+    it('paginates per-DID data across contracts after excluding expired consent', async () => {
+        const { termsUri } = await consent();
+        await ConsentFlowTerms.update(
+            { updatedAt: '2001-01-01T00:00:00Z' },
+            { where: { id: termsUri.split(':').at(-1)! } }
+        );
+        await consent({ expiresAt: '2000-01-01T00:00:00Z' });
+        const response = await owner.clients.fullAuth.contracts.getConsentedDataForDid({
+            did: learnerDid,
+            limit: 1,
+        });
+        expect(response.records).toHaveLength(1);
+        expect(response.hasMore).toBe(false);
+        expect(response.cursor).toBe('2001-01-01T00:00:00Z');
+        const next = await owner.clients.fullAuth.contracts.getConsentedDataForDid({
+            did: learnerDid,
+            limit: 1,
+            cursor: response.cursor,
+        });
+        expect(next.records).toEqual([]);
+    });
+});