@learncard/network-brain-service 3.19.1 → 4.0.1

package/test/share-link-public-route.unit.spec.ts

@@ -1,5 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
+import { TRPCError } from '@trpc/server';
+
 import type { ShareLinkPolicyResolver } from '@helpers/share-link-policy/types';
 import type { ShareLinkRecord } from '../src/models/ShareLink';
 import { SharePasscodeCapacityError } from '../src/helpers/share-link-passcode';
@@ -216,6 +218,283 @@ beforeEach(() => {
     rateLimits.enforceRateLimits.mockResolvedValue(undefined);
 });
 
+describe('guarded managed attachment chunks', () => {
+    const attachmentId = '5d02e240-7cae-499d-9b18-d477e6b9ebd2';
+    const request = { id: SHARE_ID, contentVersion: 2, attachmentId, chunkIndex: 0 };
+    const setup = (overrides: Partial<ShareLinkRecord> = {}) => {
+        let record = shareRecord({ attachmentId, attachmentChunkCount: 16, ...overrides });
+        // This fixture deliberately changes password/clock dependencies between
+        // requests to exercise invalidation; production dependencies stay readonly.
+        const dependencies: {
+            -readonly [
+                Key in keyof PublicShareLinkRouterDependencies
+            ]: PublicShareLinkRouterDependencies[Key];
+        } = { ...makeDependencies({ getShareLink: vi.fn(async () => record) }) };
+        const fetch = vi.fn(
+            async (tuple: {
+                namespace: string;
+                ownerProfileId: string;
+                shareId: string;
+                contentVersion: number;
+                objectId: string;
+                operationId: string;
+            }) => ({ ok: true as const, value: { ...contentProjection(record), ...tuple } })
+        );
+        dependencies.repository.fetchAttachmentChunk = fetch;
+        return {
+            dependencies,
+            fetch,
+            setRecord: (next: ShareLinkRecord) => {
+                record = next;
+            },
+            getRecord: () => record,
+        };
+    };
+
+    it('derives storage tuple from committed state without accepting caller capabilities', async () => {
+        const { dependencies, fetch } = setup();
+        await expect(makeCaller(dependencies).attachmentChunk(request)).resolves.toEqual({
+            ...request,
+            envelope,
+        });
+        expect(fetch).toHaveBeenCalledWith({
+            namespace: NAME,
+            ownerProfileId: 'owner-1',
+            shareId: SHARE_ID,
+            contentVersion: 2,
+            objectId: `resume-pdf-${attachmentId}-0`,
+            operationId: attachmentId,
+        });
+        await expect(
+            makeCaller(dependencies).attachmentChunk({
+                ...request,
+                ownerProfileId: 'someone-else',
+            } as never)
+        ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        expect(fetch).toHaveBeenCalledOnce();
+        expect(dependencies.receipts.persist).not.toHaveBeenCalled();
+    });
+
+    it.each([
+        { status: 'stopped' },
+        { status: 'pending' },
+        { contentState: 'content_missing' },
+        { expiresAt: '2026-09-20T00:00:00.000Z' },
+        { contentVersion: 3 },
+        { attachmentId: OPERATION_ID },
+        { attachmentChunkCount: 0 },
+        { namespace: 'other-deployment' },
+    ] as Partial<ShareLinkRecord>[])(
+        'withholds chunks for inactive/mismatched state %#',
+        async override => {
+            const { dependencies, fetch } = setup(override);
+            await expect(makeCaller(dependencies).attachmentChunk(request)).rejects.toMatchObject({
+                code: 'NOT_FOUND',
+            });
+            expect(fetch).not.toHaveBeenCalled();
+        }
+    );
+
+    it.each(['stop', 'replace', 'expire', 'passcode'])(
+        'denies state change during remote fetch: %s',
+        async change => {
+            const state = setup();
+            state.fetch.mockImplementationOnce(async tuple => {
+                const original = state.getRecord();
+                const value = { ...contentProjection(original), ...tuple };
+                state.setRecord({
+                    ...original,
+                    ...(change === 'stop'
+                        ? { status: 'stopped' }
+                        : change === 'replace'
+                          ? { contentVersion: 3, version: 4 }
+                          : change === 'expire'
+                            ? { expiresAt: '2026-09-20T00:00:00.000Z' }
+                            : { passcodeHash: 'changed-verifier', version: 4 }),
+                });
+                return { ok: true as const, value };
+            });
+            await expect(
+                makeCaller(state.dependencies).attachmentChunk(request)
+            ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+        }
+    );
+
+    it('enforces passcode attempts once and uses a current-state bound grant for all 16 chunks', async () => {
+        const state = setup({ passcodeHash: 'secret-password-verifier' });
+        state.dependencies.verifyPasscode = vi.fn(
+            async (_hash, password) => password === 'correct-password'
+        );
+        const caller = makeCaller(state.dependencies);
+        await expect(
+            caller.attachmentChunk({ ...request, passcode: 'wrong-password' })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        const first = await caller.attachmentChunk({ ...request, passcode: 'correct-password' });
+        expect(first.accessToken).toBeDefined();
+        expect(first.accessToken).not.toContain('secret-password-verifier');
+        for (let chunkIndex = 1; chunkIndex < 16; chunkIndex++) {
+            await expect(
+                caller.attachmentChunk({ ...request, chunkIndex, accessToken: first.accessToken })
+            ).resolves.toMatchObject({ chunkIndex, envelope });
+        }
+        expect(state.dependencies.verifyPasscode).toHaveBeenCalledTimes(2);
+        expect(state.dependencies.passcodeAttempts?.reserve).toHaveBeenCalledTimes(2);
+        // Grant is bound to source IP and cannot replace a current password check from another source.
+        await expect(
+            makeCaller(state.dependencies, { sourceIp: '203.0.113.8' }).attachmentChunk({
+                ...request,
+                accessToken: first.accessToken,
+            })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        state.dependencies.now = () => new Date('2026-09-21T00:01:00.000Z');
+        await expect(
+            caller.attachmentChunk({ ...request, accessToken: first.accessToken })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+    });
+
+    it('renews grants across a five-minute download without repeating passcode work', async () => {
+        const state = setup({ passcodeHash: 'secret-password-verifier' });
+        state.dependencies.verifyPasscode = vi.fn(async () => true);
+        let elapsed = 0;
+        state.dependencies.now = () => new Date(Date.parse('2026-09-21T00:00:00Z') + elapsed);
+        const caller = makeCaller(state.dependencies);
+        const first = await caller.attachmentChunk({ ...request, passcode: 'correct-password' });
+        let accessToken = first.accessToken;
+        for (let chunkIndex = 1; chunkIndex < 16; chunkIndex++) {
+            elapsed += 20_000;
+            const next = await caller.attachmentChunk({ ...request, chunkIndex, accessToken });
+            expect(next.envelope).toEqual(envelope);
+            expect(next.accessToken).not.toBe(accessToken);
+            accessToken = next.accessToken;
+        }
+        expect(elapsed).toBe(300_000);
+        expect(state.dependencies.verifyPasscode).toHaveBeenCalledOnce();
+        expect(state.dependencies.passcodeAttempts?.reserve).toHaveBeenCalledOnce();
+        await expect(
+            makeCaller(state.dependencies, { sourceIp: '203.0.113.8' }).attachmentChunk({
+                ...request,
+                accessToken,
+                passcode: 'correct-password',
+            })
+        ).resolves.toMatchObject({ accessToken: expect.any(String) });
+        expect(state.dependencies.verifyPasscode).toHaveBeenCalledTimes(2);
+        await expect(
+            caller.attachmentChunk({ ...request, accessToken: first.accessToken })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+    });
+
+    it('withholds a grant that expires during retrieval and permits fresh passcode authorization', async () => {
+        const state = setup({ passcodeHash: 'verifier' });
+        state.dependencies.verifyPasscode = vi.fn(async () => true);
+        const caller = makeCaller(state.dependencies);
+        const first = await caller.attachmentChunk({ ...request, passcode: 'correct-password' });
+        state.fetch.mockImplementationOnce(async tuple => {
+            state.dependencies.now = () => new Date('2026-09-21T00:01:01Z');
+            return {
+                ok: true as const,
+                value: { ...contentProjection(state.getRecord()), ...tuple },
+            };
+        });
+        await expect(
+            caller.attachmentChunk({ ...request, chunkIndex: 1, accessToken: first.accessToken })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        await expect(
+            caller.attachmentChunk({ ...request, chunkIndex: 1, passcode: 'correct-password' })
+        ).resolves.toMatchObject({ chunkIndex: 1, accessToken: expect.any(String) });
+        // Reauthentication still observes owner policy and never revives a stopped link.
+        state.setRecord({ ...state.getRecord(), status: 'stopped' });
+        await expect(
+            caller.attachmentChunk({ ...request, passcode: 'correct-password' })
+        ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+    });
+
+    it('allows several full downloads behind one IP without exhausting content reads', async () => {
+        const state = setup();
+        const counts = new Map<string, number>();
+        state.dependencies.enforceRateLimit = vi.fn(async ({ key, limit }) => {
+            const count = (counts.get(key) ?? 0) + 1;
+            counts.set(key, count);
+            if (count > limit) throw new TRPCError({ code: 'TOO_MANY_REQUESTS' });
+        });
+        const caller = makeCaller(state.dependencies);
+        // Five recipients share one NAT address; each resolves metadata and downloads 16 chunks.
+        for (let person = 0; person < 5; person++) {
+            await caller.resolve({ id: SHARE_ID });
+            await caller.content({ id: SHARE_ID });
+            for (let chunkIndex = 0; chunkIndex < 16; chunkIndex++)
+                await caller.attachmentChunk({ ...request, chunkIndex });
+        }
+        expect(state.fetch).toHaveBeenCalledTimes(80);
+        expect(Array.from(counts.values()).sort((a, b) => a - b)).toEqual([5, 5, 80]);
+        // The attachment budget remains finite and independent of the password budget.
+        for (let index = 80; index < 240; index++) await caller.attachmentChunk(request);
+        await expect(caller.attachmentChunk(request)).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(state.fetch).toHaveBeenCalledTimes(240);
+    });
+
+    it.each([
+        [
+            new TRPCError({ code: 'TOO_MANY_REQUESTS', message: 'private detail' }),
+            'TOO_MANY_REQUESTS',
+        ],
+        [new Error('private backend detail'), 'SERVICE_UNAVAILABLE'],
+    ])(
+        'keeps rate-limit and backend failures distinct and fail-closed: %#',
+        async (error, code) => {
+            const state = setup();
+            state.dependencies.enforceRateLimit = vi.fn().mockRejectedValue(error);
+            await expect(
+                makeCaller(state.dependencies).attachmentChunk(request)
+            ).rejects.toMatchObject({ code });
+            expect(state.fetch).not.toHaveBeenCalled();
+        }
+    );
+
+    it('rejects an oversized immutable attachment response', async () => {
+        const { dependencies, fetch, getRecord } = setup();
+        fetch.mockImplementationOnce(async tuple => ({
+            ok: true as const,
+            value: {
+                ...contentProjection(getRecord()),
+                ...tuple,
+                envelope: { ...envelope, ct: Buffer.alloc(256 * 1024 + 17).toString('base64url') },
+            },
+        }));
+        await expect(makeCaller(dependencies).attachmentChunk(request)).rejects.toMatchObject({
+            code: 'NOT_FOUND',
+        });
+    });
+
+    it('rejects tampered grants and foreign immutable response tuples', async () => {
+        const state = setup({ passcodeHash: 'verifier' });
+        state.dependencies.verifyPasscode = vi.fn(async () => true);
+        const first = await makeCaller(state.dependencies).attachmentChunk({
+            ...request,
+            passcode: 'correct-password',
+        });
+        await expect(
+            makeCaller(state.dependencies).attachmentChunk({
+                ...request,
+                accessToken: `${first.accessToken}x`,
+            })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        state.setRecord({ ...state.getRecord(), passcodeHash: null });
+        state.fetch.mockImplementationOnce(async tuple => ({
+            ok: true as const,
+            value: {
+                ...contentProjection(state.getRecord()),
+                ...tuple,
+                ownerProfileId: 'wrong-owner',
+            },
+        }));
+        await expect(makeCaller(state.dependencies).attachmentChunk(request)).rejects.toMatchObject(
+            { code: 'NOT_FOUND' }
+        );
+    });
+});
+
 describe('public share-link resolve', () => {
     it('answers not_found and calls nothing when configuration is disabled', async () => {
         const dependencies = makeDependencies();

package/test/share-link-service-policy.neo4j.spec.ts

@@ -0,0 +1,403 @@
+import { afterAll, beforeEach, describe, expect, it } from 'vitest';
+import { v4 as uuid } from 'uuid';
+import { neogma } from '@instance';
+import { computeShareLinkRequestHash } from '@helpers/share-link-lifecycle';
+import {
+    abandonReservation,
+    claimRecoverableReservation,
+    finalizeReservation,
+    reserveCreate,
+    reserveReplacement,
+} from '../src/accesslayer/share-link';
+import { composeShareLinkPolicy } from '../src/helpers/share-link-policy/resolver';
+import { resolveCurrentShareLinkPolicy } from '../src/helpers/share-link-policy/production';
+import { withShareLinkRead } from '../src/accesslayer/share-link/transaction';
+import {
+    clearLifecycleGraph,
+    contentBinding,
+    nextShareId,
+    reserveShareFixture,
+} from './helpers/share-link-fixtures';
+import type { ShareLinkPolicySnapshot } from '../src/helpers/share-link-policy/types';
+import type { ReserveShareLinkResult } from '../src/accesslayer/share-link/types';
+
+const NOW = new Date('2026-10-05T12:00:00.000Z');
+const EXPIRY = '2026-10-25T12:00:00.000Z';
+const NAMESPACE = 'service-policy-test';
+
+const cases = [
+    {
+        name: 'resolved adult service without notifications',
+        dob: '1990-01-01',
+        service: true,
+        type: 'organization',
+        managed: true,
+        oldMinor: false,
+        resolved: true,
+        notify: false,
+        expected: true,
+    },
+    {
+        name: 'resolved minor-age service with notifications',
+        dob: '2020-01-01',
+        service: true,
+        type: 'organization',
+        managed: true,
+        oldMinor: true,
+        resolved: true,
+        notify: true,
+        expected: true,
+    },
+    {
+        name: 'unknown service snapshot',
+        dob: null,
+        service: true,
+        type: 'organization',
+        managed: true,
+        oldMinor: null,
+        resolved: false,
+        notify: true,
+        expected: true,
+    },
+    {
+        name: 'legacy explicit child with service flag',
+        dob: '1990-01-01',
+        service: true,
+        type: 'child',
+        managed: true,
+        oldMinor: true,
+        resolved: true,
+        notify: true,
+        expected: false,
+    },
+    {
+        name: 'managed personal adult',
+        dob: '1990-01-01',
+        service: false,
+        type: 'adult',
+        managed: true,
+        oldMinor: false,
+        resolved: true,
+        notify: true,
+        expected: false,
+    },
+    {
+        name: 'unmanaged personal adult with resolved restriction',
+        dob: '1990-01-01',
+        service: false,
+        type: 'adult',
+        managed: false,
+        oldMinor: false,
+        resolved: true,
+        notify: true,
+        expected: false,
+    },
+];
+
+const createLegacyShare = async (
+    ownerProfileId: string,
+    oldMinor: boolean | null,
+    resolved: boolean
+) => {
+    const created = await reserveShareFixture({
+        namespace: NAMESPACE,
+        ownerProfileId,
+        expiresAt: EXPIRY,
+        now: NOW,
+    });
+    const finalized = await finalizeReservation({ ...created, now: NOW });
+    await neogma.queryRunner.run(
+        `MATCH (s:ShareLink {id: $shareId})
+         SET s.minorPolicyIsMinor = $oldMinor, s.minorPolicyResolved = $resolved,
+             s.minorPolicyViewCountingEnabled = false, s.minorPolicyDefaultExpiryDays = 30`,
+        { shareId: created.shareId, oldMinor, resolved }
+    );
+    return { ...created, committed: finalized.share };
+};
+
+const createOwner = async (
+    ownerProfileId: string,
+    dob: string | null,
+    service: boolean,
+    type: string,
+    managed: boolean
+) => {
+    await neogma.queryRunner.run(
+        'CREATE (:Profile {profileId: $profileId, dob: $dob, isServiceProfile: $service, type: $type})',
+        { profileId: ownerProfileId, dob, service, type }
+    );
+    if (managed) {
+        await neogma.queryRunner.run(
+            'MATCH (p:Profile {profileId: $profileId}) CREATE (p)-[:MANAGED_BY]->(:Profile {profileId: $managerId})',
+            { profileId: ownerProfileId, managerId: `${ownerProfileId}-manager` }
+        );
+    }
+};
+const deleteOwner = async (ownerProfileId: string) => {
+    await neogma.queryRunner.run(
+        'MATCH (p:Profile) WHERE p.profileId IN [$profileId, $managerId] DETACH DELETE p',
+        { profileId: ownerProfileId, managerId: `${ownerProfileId}-manager` }
+    );
+};
+
+describe('explicit service share policy refresh', () => {
+    beforeEach(clearLifecycleGraph);
+    afterAll(clearLifecycleGraph);
+
+    it.each(cases)('$name preserves expiry and applies only eligible tracking', async row => {
+        const ownerProfileId = `service-owner-${uuid()}`;
+        await createOwner(ownerProfileId, row.dob, row.service, row.type, row.managed);
+        try {
+            const created = await createLegacyShare(ownerProfileId, row.oldMinor, row.resolved);
+            const policy = await withShareLinkRead(tx =>
+                resolveCurrentShareLinkPolicy(tx, ownerProfileId, NOW)
+            );
+            const request = {
+                namespace: NAMESPACE,
+                ownerProfileId,
+                shareId: created.shareId,
+                expectedVersion: created.committed.version,
+                clientRequestId: uuid(),
+                requestHash: 'explicit-service-edit',
+                title: 'Updated title',
+                notifyOnView: row.notify,
+                leaseOwner: 'owner-edit',
+                policy,
+                now: NOW,
+            };
+            const reserved = await reserveReplacement(request);
+            if (reserved.outcome !== 'reserved')
+                throw new Error('expected explicit edit reservation');
+            const finalized = await finalizeReservation({
+                ...reserved.reservation,
+                resolveCurrentPolicy: resolveCurrentShareLinkPolicy,
+                now: NOW,
+            });
+            expect(finalized.share.minorPolicyViewCountingEnabled).toBe(row.expected);
+            expect(finalized.share.notifyOnView).toBe(row.expected && row.notify);
+            expect(finalized.share.expiresAt).toBe(EXPIRY);
+            expect(finalized.share.minorPolicyDefaultExpiryDays).toBe(30);
+            const replayed = await reserveReplacement({
+                ...request,
+                policy: composeShareLinkPolicy('adult', false, true),
+            });
+            expect(replayed.outcome).toBe('already_committed');
+            if (replayed.outcome === 'already_committed') {
+                expect(replayed.current.minorPolicyViewCountingEnabled).toBe(row.expected);
+                expect(replayed.current.expiresAt).toBe(EXPIRY);
+            }
+        } finally {
+            await deleteOwner(ownerProfileId);
+        }
+    });
+
+    it.each([
+        'replay',
+        'recovery',
+        'expired-replay',
+        'abandoned-replay',
+        'legacy-expired-replay',
+        'legacy-abandoned-replay',
+    ] as const)(
+        'keeps a restricted reservation restricted during %s even if the owner is now a service',
+        async mode => {
+            const ownerProfileId = `service-owner-${uuid()}`;
+            await createOwner(ownerProfileId, '2020-01-01', false, 'adult', true);
+            try {
+                const created = await createLegacyShare(ownerProfileId, true, true);
+                const request = {
+                    namespace: NAMESPACE,
+                    ownerProfileId,
+                    shareId: created.shareId,
+                    expectedVersion: created.committed.version,
+                    clientRequestId: uuid(),
+                    requestHash: computeShareLinkRequestHash('update', {
+                        id: created.shareId,
+                        notifyOnView: true,
+                    }),
+                    notifyOnView: true,
+                    leaseOwner: 'owner-edit',
+                    leaseMs: 1000,
+                    policy: composeShareLinkPolicy('minor', true),
+                    now: NOW,
+                };
+                const reserved = await reserveReplacement(request);
+                if (reserved.outcome !== 'reserved')
+                    throw new Error('expected restricted reservation');
+                await neogma.queryRunner.run(
+                    'MATCH (p:Profile {profileId: $profileId}) SET p.isServiceProfile = true, p.type = $type',
+                    { profileId: ownerProfileId, type: 'organization' }
+                );
+                if (mode.startsWith('legacy-')) {
+                    await neogma.queryRunner.run(
+                        `MATCH (o:ShareLinkOperation {operationId: $operationId})
+                         REMOVE o.policyIsMinor, o.policyResolved,
+                                o.policyDefaultExpiryDays, o.policyViewCountingEnabled`,
+                        { operationId: reserved.reservation.operationId }
+                    );
+                }
+                const finalizeAt = mode === 'replay' ? NOW : new Date(NOW.getTime() + 2000);
+                if (mode.endsWith('abandoned-replay')) {
+                    expect(
+                        (await abandonReservation({ ...reserved.reservation, now: finalizeAt }))
+                            .outcome
+                    ).toBe('abandoned');
+                }
+                const resumed =
+                    mode === 'recovery'
+                        ? await claimRecoverableReservation({
+                              namespace: NAMESPACE,
+                              ownerProfileId,
+                              shareId: created.shareId,
+                              operationId: reserved.reservation.operationId,
+                              leaseOwner: 'recovery-worker',
+                              now: finalizeAt,
+                          })
+                        : await reserveReplacement({
+                              ...request,
+                              policy: composeShareLinkPolicy('minor', true, true),
+                              now: finalizeAt,
+                          });
+                if (resumed.outcome !== 'claimed' && resumed.outcome !== 'reserved')
+                    throw new Error('expected existing reservation');
+                const finalized = await finalizeReservation({
+                    ...resumed.reservation,
+                    resolveCurrentPolicy: resolveCurrentShareLinkPolicy,
+                    now: finalizeAt,
+                });
+                expect(finalized.share.minorPolicyViewCountingEnabled).toBe(false);
+                expect(finalized.share.notifyOnView).toBe(false);
+                expect(finalized.share.expiresAt).toBe(EXPIRY);
+
+                // A new explicit edit may refresh the service policy; only retries
+                // of the original logical request must retain its restriction.
+                const fresh = await reserveReplacement({
+                    ...request,
+                    expectedVersion: finalized.share.version,
+                    clientRequestId: uuid(),
+                    policy: composeShareLinkPolicy('minor', true, true),
+                    now: finalizeAt,
+                });
+                if (fresh.outcome !== 'reserved') throw new Error('expected fresh reservation');
+                const refreshed = await finalizeReservation({
+                    ...fresh.reservation,
+                    resolveCurrentPolicy: resolveCurrentShareLinkPolicy,
+                    now: finalizeAt,
+                });
+                expect(refreshed.share.minorPolicyViewCountingEnabled).toBe(true);
+                expect(refreshed.share.notifyOnView).toBe(true);
+                expect(refreshed.share.expiresAt).toBe(EXPIRY);
+            } finally {
+                await deleteOwner(ownerProfileId);
+            }
+        }
+    );
+
+    it.each(['create', 'update'] as const)(
+        'retains a tightened %s policy across expired replacement and subsequent cleanup',
+        async kind => {
+            const ownerProfileId = `service-owner-${uuid()}`;
+            await createOwner(ownerProfileId, '1990-01-01', true, 'organization', true);
+            try {
+                const created =
+                    kind === 'update' ? await createLegacyShare(ownerProfileId, false, true) : null;
+                const shareId = created?.shareId ?? nextShareId();
+                const request = {
+                    namespace: NAMESPACE,
+                    ownerProfileId,
+                    shareId,
+                    clientRequestId: uuid(),
+                    requestHash: computeShareLinkRequestHash(kind, {
+                        id: shareId,
+                        notifyOnView: true,
+                    }),
+                    title: 'Repeated retry',
+                    expiresAt: EXPIRY,
+                    notifyOnView: true,
+                    leaseOwner: 'owner-edit',
+                    leaseMs: 1000,
+                };
+                const reserve = (
+                    policy: ShareLinkPolicySnapshot,
+                    now: Date
+                ): Promise<ReserveShareLinkResult> =>
+                    kind === 'create'
+                        ? reserveCreate({
+                              ...request,
+                              policy,
+                              now,
+                              selectedCount: 1,
+                              content: contentBinding(shareId),
+                          })
+                        : reserveReplacement({
+                              ...request,
+                              policy,
+                              now,
+                              expectedVersion: created?.committed.version ?? 1,
+                          });
+                const permissive = composeShareLinkPolicy('adult', false, true);
+                const restrictive = composeShareLinkPolicy('minor', true);
+                const initial = await reserve(permissive, NOW);
+                if (initial.outcome !== 'reserved') throw new Error('expected initial reservation');
+                const retryAt = new Date(NOW.getTime() + 2000);
+                const tightened = await reserve(restrictive, retryAt);
+                if (tightened.outcome !== 'reserved')
+                    throw new Error('expected replacement reservation');
+                expect(tightened.reservation.operationId).not.toBe(initial.reservation.operationId);
+                expect(tightened.reservation.policy).toEqual(restrictive);
+                expect(
+                    (await abandonReservation({ ...tightened.reservation, now: retryAt })).outcome
+                ).toBe('abandoned');
+                const retried = await reserve(permissive, retryAt);
+                if (retried.outcome !== 'reserved')
+                    throw new Error('expected cleanup retry reservation');
+                expect(retried.reservation.policy).toEqual(restrictive);
+                const finalized = await finalizeReservation({
+                    ...retried.reservation,
+                    resolveCurrentPolicy: resolveCurrentShareLinkPolicy,
+                    now: retryAt,
+                });
+                expect(finalized.share.minorPolicyViewCountingEnabled).toBe(false);
+                expect(finalized.share.notifyOnView).toBe(false);
+                expect(finalized.share.expiresAt).toBe(EXPIRY);
+            } finally {
+                await deleteOwner(ownerProfileId);
+            }
+        }
+    );
+
+    it('tightens a stale permissive service reservation when the locked owner is explicitly a child', async () => {
+        const ownerProfileId = `service-owner-${uuid()}`;
+        await createOwner(ownerProfileId, '1990-01-01', true, 'organization', true);
+        try {
+            const created = await createLegacyShare(ownerProfileId, false, true);
+            const reserved = await reserveReplacement({
+                namespace: NAMESPACE,
+                ownerProfileId,
+                shareId: created.shareId,
+                expectedVersion: created.committed.version,
+                clientRequestId: uuid(),
+                requestHash: 'stale-service-edit',
+                notifyOnView: true,
+                leaseOwner: 'owner-edit',
+                policy: composeShareLinkPolicy('adult', true, true),
+                now: NOW,
+            });
+            if (reserved.outcome !== 'reserved') throw new Error('expected reservation');
+            await neogma.queryRunner.run(
+                'MATCH (p:Profile {profileId: $profileId}) SET p.type = $type',
+                { profileId: ownerProfileId, type: 'child' }
+            );
+            const finalized = await finalizeReservation({
+                ...reserved.reservation,
+                resolveCurrentPolicy: resolveCurrentShareLinkPolicy,
+                now: NOW,
+            });
+            expect(finalized.share.minorPolicyViewCountingEnabled).toBe(false);
+            expect(finalized.share.notifyOnView).toBe(false);
+            expect(finalized.share.minorPolicyIsMinor).toBe(true);
+        } finally {
+            await deleteOwner(ownerProfileId);
+        }
+    });
+});