@omega.js/backend 0.1.0

package/test/helpers/persona-domain.test.js

@@ -0,0 +1,87 @@
+const fs = require('fs');
+const path = require('path');
+const { resolvedBrandHost } = require('../../dist/vendor/config/index.js');
+const { getAccountDefinitions } = require('../../dist/test/test-accounts.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+/**
+ * Test: the persona email domain ([#708](https://github.com/Omega-JS-Stack/omega/issues/708))
+ *
+ * A persona's address has ONE derivation — the brand HOST — and every lane that
+ * composes one reads it from @omega.js/config's `resolvedBrandHost`. It used to
+ * have two: the seeder split `brand.contact.email`, the dev palette took
+ * `brand.url`'s hostname. A brand whose support address sits on the apex while
+ * the site lives on a subdomain therefore seeded accounts the palette could
+ * never sign in as — silent at seed time, and it reads as a dead emulator.
+ *
+ * PURE: derivation and source, no emulator and no Firestore.
+ *
+ * Run: npx omega test helpers/persona-domain
+ */
+
+// The switchboard config that found the bug: a support address on the apex —
+// a normal thing to publish — and a site on a subdomain of it.
+const SPLIT_BRAND = {
+  brand: {
+    url: 'https://switchboard.streamforge.app',
+    contact: { email: 'support@streamforge.app' },
+  },
+};
+
+// Every lane that composes a persona address. Each reads the one derivation;
+// none of them may go back to shaping the domain out of a contact address.
+const SEEDING_LANES = [
+  'dist/cli/commands/emulator.js',
+  'dist/cli/commands/test.js',
+  'dist/manager/routes/test/reset-account/post.js',
+];
+
+module.exports = defineCases({
+  description: 'The persona email domain is the brand host, everywhere',
+  type: 'group',
+  auth: 'none',
+
+  tests: [
+    // The derivation itself: the host the site is served from, never the
+    // domain the brand happens to answer support mail on.
+    {
+      name: 'persona-emails-follow-the-brand-host',
+      async run({ assert }) {
+        const domain = resolvedBrandHost(SPLIT_BRAND);
+
+        assert.equal(domain, 'switchboard.streamforge.app', 'The persona domain is the brand host');
+        assert.ok(domain !== 'streamforge.app', 'A support address on the apex must not shape persona identity');
+
+        const definitions = getAccountDefinitions(domain, SPLIT_BRAND);
+
+        assert.equal(
+          definitions.admin.email,
+          '_test.admin@switchboard.streamforge.app',
+          'The seeder composes persona addresses on the brand host, which is what the palette signs in on',
+        );
+      },
+    },
+
+    // And the pin that keeps the second home from growing back: a lane that
+    // splits `brand.contact.email` for a domain is the bug itself.
+    {
+      name: 'every-seeding-lane-reads-the-one-derivation',
+      async run({ assert }) {
+        for (const lane of SEEDING_LANES) {
+          const source = fs.readFileSync(path.join(__dirname, '..', '..', lane), 'utf8');
+
+          assert.ok(
+            source.includes('resolvedBrandHost'),
+            `${lane} must read the persona domain from @omega.js/config's resolvedBrandHost`,
+          );
+          // Multiline-tolerant on purpose: the pre-fix code read contact.email
+          // on one line and split it on the next, which a one-line regex missed.
+          assert.ok(
+            !/contact(\?)?\.email[\s\S]{0,300}?split\('@'\)/.test(source),
+            `${lane} must not derive a persona domain from brand.contact.email`,
+          );
+        }
+      },
+    },
+  ],
+});

package/test/helpers/recaptcha.test.js

@@ -0,0 +1,166 @@
+/**
+ * Test: recaptcha.verify() owns the whole subscribe-verification decision
+ * (cp265) — no RECAPTCHA_SECRET_KEY configured means PASS, even for a
+ * missing/empty token. Unkeyed brands are a sanctioned population (cp257:
+ * keys are optional and per-brand); the marketing/contact route no longer
+ * pre-rejects empty tokens, so this leniency is what keeps their public
+ * newsletter forms working.
+ *
+ * Also covers the rejection trail (#557): a failed verify prints Google's
+ * verdict once, so a 403 in Cloud Logging names its own reason.
+ *
+ * Run: npx omega test backend:helpers/recaptcha
+ */
+const path = require('path');
+const { verify } = require('../../dist/manager/libraries/recaptcha.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+const MODULE_PATH = require.resolve('../../dist/manager/libraries/recaptcha.js');
+
+/**
+ * Run verify() against a STUBBED siteverify, with console.warn recorded.
+ *
+ * The library requires `wonderful-fetch` at module load, so the cache entry is
+ * swapped and the library re-required — the real verify() runs, only the wire
+ * is fake. Both the fetch entry and the module are restored, so every other
+ * test in the process keeps the real transport.
+ *
+ * @param {object} options
+ * @param {object} options.answer - What siteverify answers.
+ * @param {string} [options.token] - The token handed to verify().
+ * @returns {Promise<{result: boolean, warnings: string[], calls: object[]}>}
+ */
+async function verifyOnStubbedSiteverify({ answer, token }) {
+  const fetchPath = require.resolve('wonderful-fetch', { paths: [path.dirname(MODULE_PATH)] });
+  const realFetch = require.cache[fetchPath];
+  const realWarn = console.warn;
+  const savedSecret = process.env.RECAPTCHA_SECRET_KEY;
+  const warnings = [];
+  const calls = [];
+
+  require.cache[fetchPath] = {
+    id: fetchPath,
+    filename: fetchPath,
+    loaded: true,
+    exports: (url, options) => {
+      calls.push({ url: url, options: options });
+      return Promise.resolve(answer);
+    },
+  };
+  delete require.cache[MODULE_PATH];
+
+  process.env.RECAPTCHA_SECRET_KEY = 'test-secret-never-sent';
+  console.warn = (...args) => warnings.push(args.map((arg) => String(arg)).join(' '));
+
+  try {
+    const result = await require(MODULE_PATH).verify(token || 'test-token-never-logged');
+
+    return { result: result, warnings: warnings, calls: calls };
+  } finally {
+    console.warn = realWarn;
+
+    if (typeof savedSecret === 'undefined') {
+      delete process.env.RECAPTCHA_SECRET_KEY;
+    } else {
+      process.env.RECAPTCHA_SECRET_KEY = savedSecret;
+    }
+
+    if (realFetch) {
+      require.cache[fetchPath] = realFetch;
+    } else {
+      delete require.cache[fetchPath];
+    }
+    delete require.cache[MODULE_PATH];
+    require(MODULE_PATH);
+  }
+}
+
+module.exports = defineCases({
+  description: 'recaptcha.verify() no-secret leniency + the rejection trail',
+  type: 'group',
+  tests: [
+    {
+      name: 'no-secret-configured-passes-any-token-shape',
+      run: async ({ assert }) => {
+        const original = process.env.RECAPTCHA_SECRET_KEY;
+        delete process.env.RECAPTCHA_SECRET_KEY;
+
+        try {
+          assert.equal(await verify(''), true, 'empty token passes without a secret');
+          assert.equal(await verify(undefined), true, 'missing token passes without a secret');
+          assert.equal(await verify('anything'), true, 'any token passes without a secret');
+        } finally {
+          if (original !== undefined) process.env.RECAPTCHA_SECRET_KEY = original;
+        }
+      },
+    },
+    {
+      name: 'secret-configured-rejects-a-missing-token-before-any-network-call',
+      run: async ({ assert }) => {
+        const original = process.env.RECAPTCHA_SECRET_KEY;
+        process.env.RECAPTCHA_SECRET_KEY = 'test-secret-never-sent';
+
+        try {
+          assert.equal(await verify(''), false, 'empty token fails closed with a secret');
+          assert.equal(await verify(undefined), false, 'missing token fails closed with a secret');
+        } finally {
+          if (original === undefined) {
+            delete process.env.RECAPTCHA_SECRET_KEY;
+          } else {
+            process.env.RECAPTCHA_SECRET_KEY = original;
+          }
+        }
+      },
+    },
+    {
+      name: 'low-score-rejection-logs-googles-verdict-once',
+      run: async ({ assert }) => {
+        // The live 403 that opened #557: a real key, a real domain, an
+        // automated browser — success: true, score: 0.2, and no reason in the
+        // logs. The score IS the diagnosis, so the line must carry it.
+        const { result, warnings } = await verifyOnStubbedSiteverify({
+          answer: { success: true, score: 0.2, action: 'contact', hostname: 'omegajs.dev' },
+          token: 'token-that-must-never-be-logged',
+        });
+
+        assert.equal(result, false, 'a score under the minimum still fails closed');
+        assert.equal(warnings.length, 1, 'a rejection prints exactly ONE warn line');
+
+        const line = warnings[0];
+
+        assert.ok(line.includes('[@omega.js/backend:recaptcha]'), `the line carries the identity tag: ${line}`);
+        assert.ok(line.includes('score=0.2'), `the line carries the score: ${line}`);
+        assert.ok(line.includes('action=contact'), `the line carries the action: ${line}`);
+        assert.ok(line.includes('hostname=omegajs.dev'), `the line carries the hostname: ${line}`);
+        assert.ok(!line.includes('token-that-must-never-be-logged'), `the line never carries the token: ${line}`);
+        assert.ok(!line.includes('test-secret-never-sent'), `the line never carries the secret: ${line}`);
+      },
+    },
+    {
+      name: 'error-codes-rejection-logs-the-codes',
+      run: async ({ assert }) => {
+        const { result, warnings } = await verifyOnStubbedSiteverify({
+          answer: { success: false, 'error-codes': ['invalid-input-secret', 'timeout-or-duplicate'] },
+        });
+
+        assert.equal(result, false, 'success: false fails closed');
+        assert.equal(warnings.length, 1, 'a rejection prints exactly ONE warn line');
+        assert.ok(
+          warnings[0].includes('error-codes=invalid-input-secret,timeout-or-duplicate'),
+          `the line names every code Google returned: ${warnings[0]}`
+        );
+      },
+    },
+    {
+      name: 'a-passing-verify-stays-silent',
+      run: async ({ assert }) => {
+        const { result, warnings } = await verifyOnStubbedSiteverify({
+          answer: { success: true, score: 0.9, action: 'contact', hostname: 'omegajs.dev' },
+        });
+
+        assert.equal(result, true, 'a good token passes');
+        assert.equal(warnings.length, 0, 'a pass prints nothing');
+      },
+    },
+  ],
+});

package/test/helpers/resolved-config.test.js

@@ -0,0 +1,106 @@
+/**
+ * Test: `config.resolved.*` — the config-DERIVED values @omega.js/backend hands
+ * consumer code ([#290](https://github.com/Omega-JS-Stack/omega/issues/290)).
+ *
+ * A brand target cannot require @omega.js/config (private, vendored), so a brand
+ * that needed the GitHub repo slug at runtime re-implemented the derivation and
+ * the copy drifted from the real merge rules. The framework runs the recipe at
+ * boot and publishes the finished value at `config.resolved.github`.
+ *
+ * Two things are pinned: the exposed value obeys the REAL merge semantics
+ * (a composed config, loaded by the real loader, with and without the backend
+ * target's `github.repo` override), and it IS @omega.js/config's own derivation
+ * rather than a second implementation living here. The booted Manager carries
+ * the group, which is the surface consumer code actually reads.
+ *
+ * Run: npx omega test backend:helpers/resolved-config
+ */
+const path = require('path');
+const jetpack = require('fs-jetpack');
+
+const { resolvedConfigValues } = require('../../dist/manager/helpers/resolved-config.js');
+const { loadConfig, brandRepo } = require('./_shared-config.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+// A real brand config on disk, composed through the real backend loader — the
+// target overlay is the half of the rule no hand-built object proves.
+function composeBrandConfig(targetsBackend) {
+  const root = jetpack.tmpDir({ prefix: 'resolved-config-' }).path();
+
+  jetpack.write(path.join(root, 'config', 'omega.json5'), `{
+    brand: { id: 'acme' },
+    repo: { providers: { github: { org: 'Acme-Org' } } },
+    targets: { backend: ${JSON.stringify(targetsBackend)} },
+  }`);
+
+  try {
+    return loadConfig(root, 'backend').config;
+  } finally {
+    jetpack.remove(root);
+  }
+}
+
+module.exports = defineCases({
+  description: 'config.resolved — derived values the framework hands consumer code',
+  type: 'group',
+
+  tests: [
+    {
+      name: 'github-repo-slug-derives-from-the-shared-provider-block',
+      auth: 'none',
+
+      async run({ assert }) {
+        const config = composeBrandConfig({});
+
+        assert.deepEqual(resolvedConfigValues(config).github, {
+          owner: 'Acme-Org',
+          name: 'acme-omega',
+          repo: 'Acme-Org/acme-omega',
+        });
+      },
+    },
+
+    {
+      name: 'backend-target-github-override-wins',
+      auth: 'none',
+
+      async run({ assert }) {
+        const config = composeBrandConfig({ github: { repo: 'itw-creative-works/acme-content' } });
+
+        assert.deepEqual(resolvedConfigValues(config).github, {
+          owner: 'itw-creative-works',
+          name: 'acme-content',
+          repo: 'itw-creative-works/acme-content',
+        });
+      },
+    },
+
+    {
+      name: 'the-exposed-value-is-config-packages-own-derivation',
+      auth: 'none',
+
+      async run({ assert }) {
+        // The whole point of #290: ONE implementation, in @omega.js/config. If
+        // this ever diverges, a second copy of the rule has grown here.
+        for (const targetsBackend of [{}, { github: { repo: 'itw-creative-works/acme-content' } }]) {
+          const config = composeBrandConfig(targetsBackend);
+
+          assert.deepEqual(resolvedConfigValues(config).github, brandRepo(config),
+            `resolved.github must equal @omega.js/config's brandRepo() (targets.backend: ${JSON.stringify(targetsBackend)})`);
+        }
+      },
+    },
+
+    {
+      name: 'booted-manager-publishes-the-group',
+      auth: 'none',
+
+      async run({ assert, Manager }) {
+        // The surface consumer code reads: `Manager.config.resolved.github.repo`
+        // on the config object every route/hook/cron already receives.
+        assert.equal(typeof Manager.config.resolved.github.repo, 'string', 'the booted config must carry resolved.github.repo');
+        assert.deepEqual(Manager.config.resolved.github, brandRepo(Manager.config), 'the booted value must be the config package derivation');
+      },
+    },
+  ],
+});

package/test/helpers/response-log-redaction.test.js

@@ -0,0 +1,262 @@
+/**
+ * Test: the response line the route logger writes
+ * ([#796](https://github.com/Omega-JS-Stack/omega/issues/796)).
+ *
+ * `ctx.respond()` logged `JSON.stringify(response)` for every route, and
+ * `GET /omega/user` answers the whole user record: every connected provider's
+ * `connections.<provider>.token` (access and refresh) plus `api.privateKey`.
+ * That put a live third-party token and the caller's own key into Cloud
+ * Logging on every read of the account page, where log retention keeps them.
+ * [#275](https://github.com/Omega-JS-Stack/omega/issues/275) closed the request
+ * side of the same line; this is the response side.
+ *
+ * Run: npx omega test backend:helpers/response-log-redaction
+ *
+ * The redaction is pure (a response in, a copy out), so it runs here directly.
+ * The wiring half is proven by the emulator: every route suite still
+ * round-trips green through this same line.
+ */
+const Middleware = require('../../dist/manager/helpers/middleware.js');
+const { methods } = require('../../dist/manager/helpers/context/respond.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+const { redactResponseForLog } = Middleware;
+
+// The credentials the reported line printed, in the shapes the user record
+// carries them.
+const TWITCH_ACCESS = 'tw_access_796_live_token_value';
+const TWITCH_REFRESH = 'tw_refresh_796_live_token_value';
+const YOUTUBE_ACCESS = 'yt_access_796_live_token_value';
+const KICK_TOKEN = 'kick_796_bare_string_token_value';
+const PRIVATE_KEY = 'sk_live_796_private_key_value';
+
+// What the line is FOR: the fields that make a response trace readable.
+const DISPLAY_NAME = 'OmegaStreamer796';
+const EMAIL = 'user-796@example.com';
+
+// The user record `GET /omega/user` answers, trimmed to the branches that
+// matter: two connected providers, the API credential, and the identity the
+// line has to keep.
+function userRecord(overrides) {
+  return Object.assign({
+    id: 'uid-796',
+    email: EMAIL,
+    api: { clientId: 'client-796', privateKey: PRIVATE_KEY },
+    connections: {
+      twitch: {
+        type: 'oauth2',
+        token: { access_token: TWITCH_ACCESS, refresh_token: TWITCH_REFRESH, expires_in: 14400 },
+        profile: { displayName: DISPLAY_NAME, id: '796796' },
+      },
+      youtube: {
+        type: 'oauth2',
+        token: { access_token: YOUTUBE_ACCESS },
+      },
+      // A provider whose `token` is the credential STRING itself, not a pair.
+      kick: {
+        type: 'oauth2',
+        token: KICK_TOKEN,
+      },
+    },
+  }, overrides);
+}
+
+// Everything the redacted response could possibly emit, as one string: the
+// leak test is "does the credential appear anywhere in what gets logged".
+function serialize(value) {
+  return JSON.stringify(value);
+}
+
+// A res that records what it was handed, and a ctx carrying the REAL respond()
+// methods: the point of these two cases is the wiring, so nothing between the
+// call and the log line is stood in for.
+function mockContext() {
+  const logs = [];
+  const sent = { json: [], send: [], status: [] };
+  const res = {
+    headersSent: false,
+    status(code) { sent.status.push(code); return res; },
+    header() { return res; },
+    get() { return ''; },
+    json(body) { sent.json.push(body); return res; },
+    send(body) { sent.send.push(body); return res; },
+  };
+  const ctx = Object.assign({
+    ref: { res },
+    tag: null,
+    schema: {},
+    Manager: { libraries: {} },
+    log: (...args) => logs.push(args.join(' ')),
+    warn: (...args) => logs.push(args.join(' ')),
+    error: (...args) => logs.push(args.join(' ')),
+    clearLogPrefix() {},
+  }, methods);
+
+  return { ctx, res, logs, sent };
+}
+
+// The one line the leak was about.
+function responseLine(logs) {
+  return logs.find((line) => line.includes('Sending response')) || '(no Sending response line)';
+}
+
+module.exports = defineCases({
+  description: 'Response log redaction: no credential reaches the Sending response line',
+  type: 'group',
+
+  tests: [
+    {
+      name: 'no-connection-token-or-private-key-reaches-the-response-line',
+      async run({ assert }) {
+        const logged = serialize(redactResponseForLog(userRecord()));
+
+        for (const secret of [TWITCH_ACCESS, TWITCH_REFRESH, YOUTUBE_ACCESS, KICK_TOKEN, PRIVATE_KEY]) {
+          assert.equal(logged.includes(secret), false, `a credential leaked into the response line: ${logged}`);
+        }
+
+        assert.equal(logged.includes(DISPLAY_NAME), true, `the connection profile was dropped: ${logged}`);
+        assert.equal(logged.includes(EMAIL), true, `the caller identity was dropped: ${logged}`);
+        assert.equal(logged.includes('***'), true, `nothing was rendered as redacted: ${logged}`);
+      },
+    },
+
+    {
+      name: 'redaction-never-mutates-the-response',
+      async run({ assert }) {
+        // The response object is what res.json sends next, so a redaction that
+        // wrote through would ship redacted tokens to the caller.
+        const response = userRecord();
+        const before = JSON.parse(serialize(response));
+
+        redactResponseForLog(response);
+
+        assert.deepEqual(response, before, 'the response object was mutated');
+        assert.equal(response.connections.twitch.token.access_token, TWITCH_ACCESS, 'a connection token was rewritten');
+        assert.equal(response.connections.kick.token, KICK_TOKEN, 'a string connection token was rewritten');
+        assert.equal(response.api.privateKey, PRIVATE_KEY, 'the private key was rewritten');
+      },
+    },
+
+    {
+      name: 'a-non-object-response-passes-through',
+      async run({ assert }) {
+        // The error path stringifies a message string, and a route may answer
+        // nothing at all. One line shape means both route through here.
+        assert.equal(redactResponseForLog('Not found (omega/404)'), 'Not found (omega/404)');
+        assert.equal(redactResponseForLog(null), null);
+        assert.equal(redactResponseForLog(undefined), undefined);
+        assert.equal(redactResponseForLog(204), 204);
+      },
+    },
+
+    {
+      name: 'an-array-response-is-walked',
+      async run({ assert }) {
+        // A list route answers records, so the walk cannot stop at the root.
+        const logged = serialize(redactResponseForLog([
+          userRecord({ id: 'uid-796-a' }),
+          { id: 'uid-796-b', api: { privateKey: PRIVATE_KEY } },
+        ]));
+
+        assert.equal(logged.includes(TWITCH_ACCESS), false, `a credential leaked from an array item: ${logged}`);
+        assert.equal(logged.includes(PRIVATE_KEY), false, `a credential leaked from an array item: ${logged}`);
+        assert.equal(logged.includes('uid-796-b'), true, `an array item was dropped: ${logged}`);
+      },
+    },
+
+    {
+      name: 'a-credential-key-matches-whatever-its-case-or-separators',
+      async run({ assert }) {
+        // A key is matched lower-cased with `-` and `_` stripped, so the camel
+        // and snake spellings of one field are one key. `signInToken` is the
+        // admin custom token `POST /special/electron-client` answers with.
+        const secrets = {
+          webhook_secret: 'whsec_796_signing_value',
+          ClientSecret: 'cs_796_client_secret_value',
+          Access_Token: 'at_796_snake_token_value',
+          accessToken: 'at_796_camel_token_value',
+          private_key: 'pk_796_snake_private_key_value',
+          sessionCookie: 'sc_796_session_cookie_value',
+          signInToken: 'st_796_sign_in_token_value',
+          password: 'pw_796_password_value',
+        };
+        const redacted = redactResponseForLog(Object.assign({ message: 'ok' }, secrets));
+        const logged = serialize(redacted);
+
+        for (const [key, value] of Object.entries(secrets)) {
+          assert.equal(logged.includes(value), false, `${key} leaked: ${logged}`);
+        }
+
+        assert.equal(redacted.message, 'ok', `a non-credential field was dropped: ${logged}`);
+        assert.equal(redacted.webhook_secret, '***alue (23 chars)', logged);
+      },
+    },
+
+    {
+      name: 'an-empty-credential-still-reads-as-empty',
+      async run({ assert }) {
+        // "No token stored" is the diagnostic the line exists for, so a null or
+        // a missing credential says so instead of claiming a redacted object.
+        const redacted = redactResponseForLog({ token: null, refreshToken: undefined, hasPassword: true, tokenCount: 3 });
+
+        assert.equal(redacted.token, null, serialize(redacted));
+        assert.equal(redacted.refreshToken, undefined, serialize(redacted));
+        // A flag or a count under a credential-shaped name is not a secret.
+        assert.equal(serialize(redacted), '{"token":null,"hasPassword":true,"tokenCount":3}', serialize(redacted));
+      },
+    },
+
+    {
+      name: 'a-value-that-serializes-itself-keeps-its-json-shape',
+      async run({ assert }) {
+        // The copy walks own properties, and a Date has none, so a walked Date
+        // logged as `{}`. Anything carrying `toJSON` is walked through it, which
+        // is what JSON.stringify would have shown anyway.
+        const created = new Date('2026-09-04T12:00:00.000Z');
+        const redacted = redactResponseForLog({ metadata: { created }, buffer: Buffer.from('796') });
+
+        assert.equal(redacted.metadata.created, '2026-09-04T12:00:00.000Z', serialize(redacted));
+        assert.equal(redacted.buffer.type, 'Buffer', serialize(redacted));
+      },
+    },
+
+    {
+      name: 'the-real-respond-logs-a-redacted-line-and-sends-the-original',
+      async run({ assert }) {
+        // The wiring: the REAL respond() with a recording res. The line is
+        // redacted and the body on the wire is untouched, which is the whole
+        // point of copying rather than rewriting.
+        const { ctx, logs, sent } = mockContext();
+        const response = userRecord();
+
+        ctx.respond(response);
+
+        const line = responseLine(logs);
+
+        for (const secret of [TWITCH_ACCESS, TWITCH_REFRESH, YOUTUBE_ACCESS, KICK_TOKEN, PRIVATE_KEY]) {
+          assert.equal(line.includes(secret), false, `a credential leaked into the response line: ${line}`);
+        }
+
+        assert.equal(line.includes(EMAIL), true, `the line lost its trace value: ${line}`);
+        assert.deepEqual(sent.json[0], userRecord(), 'res.json received a rewritten body');
+        assert.equal(sent.json[0].connections.twitch.token.access_token, TWITCH_ACCESS, 'the token on the wire was redacted');
+      },
+    },
+
+    {
+      name: 'the-real-respond-error-path-logs-and-sends-the-same-string',
+      async run({ assert }) {
+        // The error path stringifies a message, so the same call runs a string
+        // through the same function: string in, string out, one line shape.
+        const { ctx, logs, sent } = mockContext();
+
+        ctx.respond('Connection refresh failed', { code: 400 });
+
+        const line = responseLine(logs);
+
+        assert.equal(line.includes('Connection refresh failed'), true, `the error line lost its message: ${line}`);
+        assert.equal(sent.send[0], 'Connection refresh failed', `res.send received a rewritten body: ${sent.send[0]}`);
+      },
+    },
+  ],
+});