@marktiderman/genesis-supabase 0.1.1 → 0.3.0

package/migrations/tests/0001_genesis_account_deletion.test.sql

@@ -0,0 +1,138 @@
+-- pgTAP test for 0001_genesis_account_deletion.sql.
+-- Copy into your app's `supabase/tests/database/` and run `supabase test db`.
+-- It reads only its own users and tables and rolls everything back. If your
+-- app already has `private.genesis_before_account_delete`, the hook cases
+-- replace it inside this transaction only.
+--
+-- Signing in: auth.uid() reads request.jwt.claims (and the legacy
+-- request.jwt.claim.sub on older images), so each case sets both, then
+-- switches to the authenticated role.
+begin;
+create extension if not exists pgtap with schema extensions;
+select plan(20);
+
+insert into auth.users (id, aud, role, email, instance_id)
+select ('00000000-0000-4000-8000-0000000000' || n)::uuid, 'authenticated', 'authenticated', 'genesis-delete-' || n || '@example.test', '00000000-0000-0000-0000-000000000000'
+from unnest(array['a1', 'b2', 'c3', 'd4', 'e5', 'f6', '07']) n;
+
+create function pg_temp.exists_user(n text) returns boolean language sql as $$
+  select exists (select 1 from auth.users where id = ('00000000-0000-4000-8000-0000000000' || n)::uuid)
+$$;
+
+-- Shape and privileges -------------------------------------------------------
+select ok(
+  (select prosecdef from pg_proc where oid = 'public.delete_my_account()'::regprocedure),
+  'delete_my_account is security definer'
+);
+select ok(
+  (select proconfig @> array['search_path=""'] from pg_proc where oid = 'public.delete_my_account()'::regprocedure),
+  'delete_my_account pins an empty search_path'
+);
+select is(
+  (select proowner::regrole::text from pg_proc where oid = 'public.delete_my_account()'::regprocedure),
+  'postgres',
+  'delete_my_account is owned by postgres, as hosted migrations run'
+);
+select ok(not has_function_privilege('anon', 'public.delete_my_account()', 'execute'), 'anon cannot execute it');
+select ok(
+  not exists (
+    select 1 from pg_proc p, aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) a
+    where p.oid = 'public.delete_my_account()'::regprocedure and a.grantee = 0 and a.privilege_type = 'EXECUTE'
+  ),
+  'public has no execute grant'
+);
+select ok(has_function_privilege('authenticated', 'public.delete_my_account()', 'execute'), 'authenticated can execute it');
+select ok(
+  not has_function_privilege('authenticated', 'private.genesis_require_recent_sign_in(interval)', 'execute'),
+  'authenticated cannot call the recent-sign-in helper directly'
+);
+
+-- Deletes only the caller ------------------------------------------------------
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000a1","role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000a1', true);
+set local role authenticated;
+select lives_ok($$ select public.delete_my_account() $$, 'a signed-in person deletes their account');
+reset role;
+select ok(not pg_temp.exists_user('a1') and pg_temp.exists_user('b2'), 'only the caller''s login is gone');
+
+select set_config('request.jwt.claims', '{"role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, '42501', null, 'a call with no signed-in person is refused');
+reset role;
+
+-- Foreign keys -------------------------------------------------------------------
+create table public.genesis_test_kept (person uuid references auth.users (id));
+create table public.genesis_test_cascaded (person uuid references auth.users (id) on delete cascade);
+insert into public.genesis_test_kept values ('00000000-0000-4000-8000-0000000000c3');
+insert into public.genesis_test_cascaded values ('00000000-0000-4000-8000-0000000000d4');
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000c3","role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000c3', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, '23503', null, 'a row without on delete cascade refuses the delete');
+reset role;
+select ok(pg_temp.exists_user('c3'), '... and the login is kept');
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000d4","role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000d4', true);
+set local role authenticated;
+select lives_ok($$ select public.delete_my_account() $$, 'a person with cascading rows deletes their account');
+reset role;
+select is((select count(*) from public.genesis_test_cascaded)::int, 0, '... and their cascading rows go with it');
+
+-- MFA step-up -------------------------------------------------------------------
+insert into auth.mfa_factors (id, user_id, friendly_name, factor_type, status, created_at, updated_at)
+values (gen_random_uuid(), '00000000-0000-4000-8000-0000000000e5', 'genesis-test', 'totp', 'verified', now(), now());
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000e5","role":"authenticated","aal":"aal1"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000e5', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, '42501', null, 'an aal1 session cannot delete an account with a verified factor');
+reset role;
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000e5","role":"authenticated","aal":"aal2"}', true);
+set local role authenticated;
+select lives_ok($$ select public.delete_my_account() $$, 'an aal2 session can');
+reset role;
+
+-- The app hook -------------------------------------------------------------------
+create or replace function private.genesis_before_account_delete(person uuid) returns void
+language plpgsql set search_path = '' as $$
+begin
+  if person = '00000000-0000-4000-8000-0000000000f6' then
+    raise exception 'sole owner';
+  end if;
+  if person = '00000000-0000-4000-8000-000000000007' then
+    perform private.genesis_require_recent_sign_in(interval '10 minutes');
+  end if;
+end $$;
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000f6","role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000000f6', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, 'GA001', 'sole owner', 'a hook that raises refuses the delete, as GA001');
+reset role;
+select ok(pg_temp.exists_user('f6'), '... and the login is kept');
+
+-- Recent sign-in, turned on from the hook: an hour-old sign-in is refused, a fresh one isn't.
+select set_config('request.jwt.claims', json_build_object(
+  'sub', '00000000-0000-4000-8000-000000000007', 'role', 'authenticated',
+  'iat', extract(epoch from now())::bigint,
+  'amr', json_build_array(json_build_object('method', 'password', 'timestamp', extract(epoch from now() - interval '1 hour')::bigint))
+)::text, true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-000000000007', true);
+set local role authenticated;
+select throws_ok($$ select public.delete_my_account() $$, 'GA002', null, 'a refreshed token from an old sign-in is refused when the app requires a recent one');
+reset role;
+
+select set_config('request.jwt.claims', json_build_object(
+  'sub', '00000000-0000-4000-8000-000000000007', 'role', 'authenticated',
+  'amr', json_build_array(json_build_object('method', 'password', 'timestamp', extract(epoch from now() - interval '1 minute')::bigint))
+)::text, true);
+set local role authenticated;
+select lives_ok($$ select public.delete_my_account() $$, 'a recent sign-in passes');
+reset role;
+
+select * from finish();
+rollback;

package/migrations/tests/0002_genesis_app_release_policy.test.sql

@@ -0,0 +1,148 @@
+-- @feat:app-updates
+-- pgTAP test for 0002_genesis_app_release_policy.sql.
+-- Copy into your app's `supabase/tests/database/` and run `supabase test db`.
+-- It writes only its own `genesis-test-*` rows and rolls everything back.
+begin;
+create extension if not exists pgtap with schema extensions;
+select plan(29);
+
+-- Shape -------------------------------------------------------------------------
+select has_table('public', 'app_release_policy', 'app_release_policy exists');
+select col_is_pk('public', 'app_release_policy', 'app_id', 'one row per app');
+select ok(
+  (select relrowsecurity from pg_class where oid = 'public.app_release_policy'::regclass),
+  'row level security is on'
+);
+select is(
+  (select array_agg(polname::text order by polname) from pg_policy where polrelid = 'public.app_release_policy'::regclass),
+  array['app_release_policy_read'],
+  'the only policy is the read policy'
+);
+select is(
+  (select polcmd::text from pg_policy where polrelid = 'public.app_release_policy'::regclass),
+  'r',
+  '... and it is for select'
+);
+
+-- Privileges ------------------------------------------------------------------------
+select ok(has_table_privilege('anon', 'public.app_release_policy', 'select'), 'anon can read');
+select ok(has_table_privilege('authenticated', 'public.app_release_policy', 'select'), 'authenticated can read');
+select ok(
+  not has_table_privilege('anon', 'public.app_release_policy', 'insert')
+  and not has_table_privilege('anon', 'public.app_release_policy', 'update')
+  and not has_table_privilege('anon', 'public.app_release_policy', 'delete')
+  and not has_table_privilege('anon', 'public.app_release_policy', 'truncate'),
+  'anon cannot write'
+);
+select ok(
+  not has_table_privilege('authenticated', 'public.app_release_policy', 'insert')
+  and not has_table_privilege('authenticated', 'public.app_release_policy', 'update')
+  and not has_table_privilege('authenticated', 'public.app_release_policy', 'delete')
+  and not has_table_privilege('authenticated', 'public.app_release_policy', 'truncate'),
+  'authenticated cannot write'
+);
+select ok(
+  not exists (
+    select 1 from pg_class c, aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) a
+    where c.oid = 'public.app_release_policy'::regclass and a.grantee = 0
+  ),
+  'public has no grant'
+);
+select ok(
+  has_table_privilege('service_role', 'public.app_release_policy', 'insert')
+  and has_table_privilege('service_role', 'public.app_release_policy', 'update')
+  and has_table_privilege('service_role', 'public.app_release_policy', 'delete'),
+  'the service role can write'
+);
+
+-- Writing and reading as each role ----------------------------------------------------------
+set local role service_role;
+select lives_ok(
+  $$ insert into public.app_release_policy (app_id, min_version_ios, min_version_android, store_url_ios, store_url_android, maintenance, maintenance_message, notes)
+     values ('genesis-test-a', '1.4.0', '1.4', 'https://apps.apple.com/app/id1', 'market://details?id=x', true, 'Back soon',
+             '[{"version": "1.4.0", "title": "Faster", "body": "Everything loads quicker."}]') $$,
+  'the service role writes a policy'
+);
+reset role;
+
+set local role anon;
+select is(
+  (select min_version_ios from public.app_release_policy where app_id = 'genesis-test-a'),
+  '1.4.0',
+  'anon reads it'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id) values ('genesis-test-b') $$,
+  '42501', null, 'anon cannot insert'
+);
+select throws_ok(
+  $$ update public.app_release_policy set maintenance = false where app_id = 'genesis-test-a' $$,
+  '42501', null, 'anon cannot update'
+);
+reset role;
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000000a1","role":"authenticated"}', true);
+set local role authenticated;
+select is(
+  (select maintenance from public.app_release_policy where app_id = 'genesis-test-a'),
+  true,
+  'authenticated reads it'
+);
+select throws_ok(
+  $$ delete from public.app_release_policy where app_id = 'genesis-test-a' $$,
+  '42501', null, 'authenticated cannot delete'
+);
+select throws_ok(
+  $$ update public.app_release_policy set min_version_ios = '0' where app_id = 'genesis-test-a' $$,
+  '42501', null, 'authenticated cannot update'
+);
+reset role;
+
+-- Checks keep malformed values out (the client fails open on them anyway) -------------------
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, min_version_ios, store_url_ios) values ('genesis-test-c', '1.4-beta', 'https://apps.apple.com/app/id1') $$,
+  '23514', null, 'a minimum version must be plain dotted numbers'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, min_version_android, store_url_android) values ('genesis-test-c', '1.2.3.4.5', 'market://details?id=x') $$,
+  '23514', null, '... of at most four parts'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, store_url_ios) values ('genesis-test-c', 'javascript:alert(1)') $$,
+  '23514', null, 'a store link must be https or the store''s scheme'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '{"version": "1.0"}') $$,
+  '23514', null, 'notes must be an array'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[{"version": 1, "body": "x"}]') $$,
+  '23514', null, 'each note needs a string version and body'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[{"version": "1.0"}]') $$,
+  '23514', null, '... a note without a body is refused'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[{"version": ["1.0"], "body": ["x", "y"]}]') $$,
+  '23514', null, '... arrays where strings belong are refused'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[[{"version": "1.0", "body": "x"}]]') $$,
+  '23514', null, '... a nested array is refused'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, notes) values ('genesis-test-c', '[{"version": "1.0", "body": "x", "title": 3}]') $$,
+  '23514', null, '... a title must be a string'
+);
+select throws_ok(
+  $$ insert into public.app_release_policy (app_id, min_version_android) values ('genesis-test-c', '2.0') $$,
+  '23514', null, 'a minimum version without its store link is refused (no way out of the screen)'
+);
+select lives_ok(
+  $$ insert into public.app_release_policy (app_id) values ('genesis-test-d') $$,
+  'a row with nothing set is valid: no minimum, no maintenance, no notes'
+);
+
+select * from finish();
+rollback;

package/migrations/tests/0003_genesis_apple_token_revocation.test.sql

@@ -0,0 +1,230 @@
+-- pgTAP test for 0003_genesis_apple_token_revocation.sql.
+-- Copy into your app's `supabase/tests/database/` and run `supabase test db`.
+-- It reads only its own users and rows and rolls everything back. (The claim
+-- cases push any other queued row out of reach first, inside this transaction.)
+begin;
+create extension if not exists pgtap with schema extensions;
+select plan(45);
+
+insert into auth.users (id, aud, role, email, instance_id)
+select ('00000000-0000-4000-8000-0000000003' || n)::uuid, 'authenticated', 'authenticated', 'genesis-apple-' || n || '@example.test', '00000000-0000-0000-0000-000000000000'
+from unnest(array['a1', 'b2', 'c3']) n;
+
+create function pg_temp.u(n text) returns uuid language sql as $$ select ('00000000-0000-4000-8000-0000000003' || n)::uuid $$;
+create function pg_temp.queued(n text) returns bigint language sql as $$
+  select count(*) from private.genesis_apple_revocations where user_id = pg_temp.u(n)
+$$;
+
+-- The tables: private, row level security on, nothing granted -----------------
+select ok((select relrowsecurity from pg_class where oid = 'private.genesis_apple_tokens'::regclass), 'genesis_apple_tokens has row level security on');
+select ok((select relrowsecurity from pg_class where oid = 'private.genesis_apple_revocations'::regclass), 'genesis_apple_revocations has row level security on');
+select ok(
+  not exists (
+    select 1
+    from unnest(array['anon', 'authenticated']) r(role),
+         unnest(array['private.genesis_apple_tokens', 'private.genesis_apple_revocations']) t(tbl),
+         unnest(array['select', 'insert', 'update', 'delete', 'truncate', 'references', 'trigger']) p(priv)
+    where has_table_privilege(r.role, t.tbl, p.priv)
+  ),
+  'anon and authenticated have no privilege on either table'
+);
+select ok(
+  not exists (
+    select 1 from pg_class c, aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) a
+    where c.oid in ('private.genesis_apple_tokens'::regclass, 'private.genesis_apple_revocations'::regclass) and a.grantee = 0
+  ),
+  'public has no grant on either table'
+);
+select ok(not has_schema_privilege('anon', 'private', 'usage'), 'anon cannot use the private schema');
+select ok(not has_schema_privilege('authenticated', 'private', 'usage'), 'authenticated cannot use the private schema');
+
+-- The functions: security definer, empty search_path, service_role only ---------
+create temp table genesis_fns (sig regprocedure, public_api boolean);
+insert into genesis_fns values
+  ('private.genesis_apple_queue_revocation()'::regprocedure, false),
+  ('public.genesis_apple_token_save(uuid, text, text)'::regprocedure, true),
+  ('public.genesis_apple_revocations_claim(integer)'::regprocedure, true),
+  ('public.genesis_apple_revocation_done(bigint)'::regprocedure, true),
+  ('public.genesis_apple_revocation_failed(bigint, text)'::regprocedure, true);
+
+select ok(
+  (select bool_and(p.prosecdef and p.proconfig @> array['search_path=""']) from genesis_fns f join pg_proc p on p.oid = f.sig),
+  'every function is security definer with an empty search_path'
+);
+select ok(
+  (select bool_and(p.proowner::regrole::text = 'postgres') from genesis_fns f join pg_proc p on p.oid = f.sig),
+  'every function is owned by postgres, as hosted migrations run'
+);
+select ok(
+  not exists (select 1 from genesis_fns f where has_function_privilege('anon', f.sig, 'execute')),
+  'anon can execute none of them'
+);
+select ok(
+  not exists (select 1 from genesis_fns f where has_function_privilege('authenticated', f.sig, 'execute')),
+  'authenticated can execute none of them'
+);
+select ok(
+  not exists (
+    select 1 from genesis_fns f join pg_proc p on p.oid = f.sig, aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) a
+    where a.grantee = 0 and a.privilege_type = 'EXECUTE'
+  ),
+  'public has no execute grant on any of them'
+);
+select ok(
+  (select bool_and(has_function_privilege('service_role', f.sig, 'execute')) from genesis_fns f where f.public_api),
+  'service_role can execute the four public functions'
+);
+select ok(
+  not has_function_privilege('service_role', 'private.genesis_apple_queue_revocation()', 'execute'),
+  'service_role cannot call the trigger function directly'
+);
+select is(
+  (select count(*)::int from pg_trigger where tgrelid = 'auth.users'::regclass and tgname = 'genesis_apple_queue_revocation' and not tgisinternal and tgenabled <> 'D'),
+  1,
+  'the delete trigger is on auth.users'
+);
+
+-- A signed-in person can't reach a token, theirs or anyone's -----------------------
+insert into private.genesis_apple_tokens (user_id, client_id, refresh_token) values (pg_temp.u('a1'), 'com.example.app', 'rt-a1-old');
+
+select set_config('request.jwt.claims', '{"sub":"00000000-0000-4000-8000-0000000003a1","role":"authenticated"}', true);
+select set_config('request.jwt.claim.sub', '00000000-0000-4000-8000-0000000003a1', true);
+set local role authenticated;
+select throws_ok($$ select refresh_token from private.genesis_apple_tokens $$, '42501', null, 'authenticated cannot read the tokens table');
+select throws_ok($$ select refresh_token from private.genesis_apple_revocations $$, '42501', null, 'authenticated cannot read the queue');
+select throws_ok(
+  $$ select public.genesis_apple_token_save('00000000-0000-4000-8000-0000000003b2', 'com.example.app', 'planted') $$,
+  '42501', null, 'authenticated cannot save a token'
+);
+select throws_ok($$ select * from public.genesis_apple_revocations_claim(100) $$, '42501', null, 'authenticated cannot claim the queue');
+select throws_ok($$ select public.genesis_apple_revocation_done(1) $$, '42501', null, 'authenticated cannot drop a queued token');
+reset role;
+
+set local role anon;
+select throws_ok($$ select * from public.genesis_apple_revocations_claim(100) $$, '42501', null, 'anon cannot claim the queue');
+reset role;
+
+-- Saving (service_role, as the Edge Function) ------------------------------------
+set local role service_role;
+select is(public.genesis_apple_token_save('00000000-0000-4000-8000-0000000003a1', 'com.example.app', 'rt-a1-new'), 'stored', 'a sign-in''s token is stored');
+reset role;
+select is(
+  (select array_agg(refresh_token) from private.genesis_apple_tokens where user_id = pg_temp.u('a1')),
+  array['rt-a1-new'],
+  '... replacing the earlier one for that client id'
+);
+set local role service_role;
+select is(public.genesis_apple_token_save('00000000-0000-4000-8000-0000000003a1', 'com.example.app.dev', 'rt-a1-dev'), 'stored', 'another client id keeps its own token');
+select is(
+  public.genesis_apple_token_save('00000000-0000-4000-8000-0000000003ff', 'com.example.app', 'rt-gone'),
+  'queued',
+  'a token for a login that is already gone goes to the queue'
+);
+select throws_ok(
+  $$ select public.genesis_apple_token_save('00000000-0000-4000-8000-0000000003b2', 'not a bundle id!', 'rt') $$,
+  '23514', null, 'a malformed client id is refused'
+);
+reset role;
+create function pg_temp.save_error_text() returns text language plpgsql as $f$
+declare msg text; det text;
+begin
+  perform public.genesis_apple_token_save('00000000-0000-4000-8000-0000000003b2', 'com.example.app', repeat('secret-token-', 400));
+  return 'no error';
+exception when others then
+  get stacked diagnostics msg = message_text, det = pg_exception_detail;
+  return coalesce(msg, '') || '|' || coalesce(det, '');
+end $f$;
+select ok(pg_temp.save_error_text() !~ 'secret-token', '... and a refused token never appears in the error');
+select is(pg_temp.queued('ff'), 1::bigint, '... and is queued once');
+
+-- Deleting the login queues its tokens -------------------------------------------
+delete from auth.users where id = pg_temp.u('a1');
+select is((select count(*) from private.genesis_apple_tokens where user_id = pg_temp.u('a1')), 0::bigint, 'deleting the login removes its stored tokens');
+select is(
+  (select array_agg(refresh_token order by client_id) from private.genesis_apple_revocations where user_id = pg_temp.u('a1')),
+  array['rt-a1-new', 'rt-a1-dev'],
+  '... after queueing every one of them for revocation'
+);
+
+-- A refused delete queues nothing ---------------------------------------------------
+insert into private.genesis_apple_tokens (user_id, client_id, refresh_token) values (pg_temp.u('b2'), 'com.example.app', 'rt-b2');
+create table public.genesis_test_apple_kept (person uuid references auth.users (id));
+insert into public.genesis_test_apple_kept values (pg_temp.u('b2'));
+select throws_ok($$ delete from auth.users where id = '00000000-0000-4000-8000-0000000003b2' $$, '23503', null, 'a delete refused by a foreign key fails');
+select is(pg_temp.queued('b2'), 0::bigint, '... and queues nothing');
+select is((select count(*) from private.genesis_apple_tokens where user_id = pg_temp.u('b2')), 1::bigint, '... and keeps the stored token');
+
+-- Claiming, retrying and finishing ------------------------------------------------
+update private.genesis_apple_revocations set next_attempt_at = 'infinity' where user_id not in (pg_temp.u('a1'), pg_temp.u('ff'));
+
+create temp table claimed (id bigint, client_id text, refresh_token text, attempts integer);
+grant insert on claimed to service_role;
+set local role service_role;
+insert into claimed select * from public.genesis_apple_revocations_claim(100);
+reset role;
+select is(
+  (select array_agg(c.refresh_token order by c.refresh_token) from claimed c),
+  array['rt-a1-dev', 'rt-a1-new', 'rt-gone'],
+  'a claim hands out every due revocation'
+);
+select ok((select bool_and(c.attempts = 1) from claimed c), '... counting the attempt');
+select ok(
+  (select bool_and(r.next_attempt_at > now()) from private.genesis_apple_revocations r join claimed c using (id)),
+  '... and leasing each row until its next retry'
+);
+create temp table ids as select (select id from claimed where refresh_token = 'rt-a1-dev') as failing, (select id from claimed where refresh_token = 'rt-a1-new') as revoked;
+set local role service_role;
+select is((select count(*) from public.genesis_apple_revocations_claim(100)), 0::bigint, 'a second claim takes none of the leased rows');
+reset role;
+select set_config('genesis.failing', (select failing::text from ids), true);
+select set_config('genesis.revoked', (select revoked::text from ids), true);
+set local role service_role;
+select is(public.genesis_apple_revocation_failed(current_setting('genesis.failing')::bigint, repeat('x', 300)), 'retry', 'a failure is kept for a retry');
+select public.genesis_apple_revocation_done(current_setting('genesis.revoked')::bigint);
+reset role;
+select is(
+  (select length(last_error) from private.genesis_apple_revocations where refresh_token = 'rt-a1-dev'),
+  200,
+  '... with its reason cut to 200 characters'
+);
+select is(
+  (select count(*) from private.genesis_apple_revocations where refresh_token = 'rt-a1-new'),
+  0::bigint,
+  'a revoked token is forgotten'
+);
+
+-- Backoff: one minute, doubling, at most a day.
+update private.genesis_apple_revocations set next_attempt_at = now() - interval '1 second', attempts = 30 where refresh_token = 'rt-a1-dev';
+set local role service_role;
+select is((select count(*) from public.genesis_apple_revocations_claim(100)), 1::bigint, 'a due retry is claimed again');
+reset role;
+select ok(
+  (select next_attempt_at between now() + interval '23 hours 59 minutes' and now() + interval '1 day' from private.genesis_apple_revocations where refresh_token = 'rt-a1-dev'),
+  'retries are at most a day apart'
+);
+
+-- Giving up: after the 30th attempt the token goes and the row stays as the record.
+set local role service_role;
+select is(public.genesis_apple_revocation_failed(current_setting('genesis.failing')::bigint, 'check: invalid_client (HTTP 400)'), 'gave_up', 'the 30th failed attempt gives up');
+select public.genesis_apple_revocation_done(current_setting('genesis.failing')::bigint);
+reset role;
+select ok(
+  (select refresh_token is null and last_error like 'gave_up after 31 attempts: check: invalid_client%' from private.genesis_apple_revocations where id = current_setting('genesis.failing')::bigint),
+  '... dropping the token and keeping the row, which done() leaves alone'
+);
+
+-- An Apple login with no stored token leaves a record -------------------------------
+insert into auth.identities (provider_id, user_id, identity_data, provider)
+values ('apple-sub-c3', pg_temp.u('c3'), '{"sub": "apple-sub-c3"}', 'apple');
+delete from auth.users where id = pg_temp.u('c3');
+select ok(
+  (select count(*) = 1 and bool_and(refresh_token is null and client_id is null and last_error like 'no_token:%') from private.genesis_apple_revocations where user_id = pg_temp.u('c3')),
+  'deleting an Apple login with no stored token records that nothing was revoked'
+);
+update private.genesis_apple_revocations set next_attempt_at = now() - interval '1 second' where user_id = pg_temp.u('c3');
+set local role service_role;
+select is((select count(*) from public.genesis_apple_revocations_claim(100)), 0::bigint, '... and a claim never hands out a row without a token');
+reset role;
+
+select * from finish();
+rollback;